The use of current_cpu_type() in cpu_is_noncoherent_r10000() is not preemption-safe.
Use boot_cpu_type() instead to make it preemption-safe.

<log>
/ # insmod mtd_readtest.ko dev=4
mtd_readtest: MTD device: 4
mtd_readtest: MTD device size 996671488, eraseblock size 524288, page size 4096, count of eraseblocks 1901, pages per eraseblock 128, OOB size 224
mtd_readtest: scanning for bad eraseblocks
mtd_readtest: scanned 1901 eraseblocks, 0 are bad
mtd_readtest: testing page read
BUG: using smp_processor_id() in preemptible [00000000] code: insmod/99
caller is mips_dma_sync_single_for_cpu+0x2c/0x128
CPU: 2 PID: 99 Comm: insmod Not tainted 3.10.4 #67
Stack : 00000006 69735f63 00000000 00000000 00000000 00000000 808273d6 00000032
          80820000 00000002 8d700000 8de48fa0 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 8d6afb00 8d6afb24 80721f24 807b9927 8012c130
          80820000 80721f24 00000002 00000063 8de48fa0 8082333c 807b98e6 8d6afaa0
          ...
Call Trace:
[<80109984>] show_stack+0x64/0x7c
[<80666230>] dump_stack+0x20/0x2c
[<803a2210>] debug_smp_processor_id+0xe0/0xf0
[<801116f0>] mips_dma_sync_single_for_cpu+0x2c/0x128
[<8043456c>] nand_plat_read_page+0x16c/0x234
[<8042fad4>] nand_do_read_ops+0x194/0x480
[<804301dc>] nand_read+0x50/0x7c
[<804261c8>] part_read+0x70/0xc0
[<804231dc>] mtd_read+0x80/0xe4
[<c0431354>] init_module+0x354/0x6f8 [mtd_readtest]
[<8010057c>] do_one_initcall+0x140/0x1a4
[<80176d7c>] load_module+0x1b5c/0x2258
[<8017752c>] SyS_init_module+0xb4/0xec
[<8010f3fc>] stack_done+0x20/0x44

BUG: using smp_processor_id() in preemptible [00000000] code: insmod/99
</log>
Signed-off-by: Jerin Jacob <jerinjacobk@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5800/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Fixed compilation errors in case of non-KEXEC kernel
Rearranging code so that crashk_res gets updated.
- crashk_res is updated after mips_parse_crashkernel(),
   after resource_init(), which is after arch_mem_init().
- The reserved memory is actually treated as Usable memory,
   Unless we load the crash kernel, everything works.
Signed-off-by: Prem Mallappa <pmallappa@caviumnetworks.com>
Cc: linux-mips <linux-mips@linux-mips.org>
Patchwork: http://patchwork.linux-mips.org/patch/5805/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

KDUMP: skip indirection page, as crashkernel has already copied to destination

[ralf@linux-mips.org: cosmetic changes.]
Signed-off-by: Prem Mallappa <pmallappa@caviumnetworks.com>
Cc: linux-mips <linux-mips@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/5786/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This change corrects DECstation HRT calibration, by removing the following
bugs:

1. Calibration period selection -- HZ / 10 has been chosen, however on
   DECstation computers, HZ never divides by 10, as the choice for HZ is
   among 128, 256 and 1024.  The choice therefore results in a systematic
   calibration error, e.g. 6.25% for the usual choice of 128 for HZ:

   128 / 10 * 10 = 120

   (128 - 120) / 128 -> 6.25%

   The change therefore makes calibration use HZ / 8 that is always
   accurate for the HZ values available, getting rid of the systematic
   error.

2. Calibration starting point synchronisation -- the duration of a number
   of intervals between DS1287A periodic interrupt assertions is measured,
   however code does not ensure at the beginning that the interrupt has
   not been previously asserted.  This results in a variable error of e.g.
   up to another 6.25% for the period of HZ / 8 (8.(3)% with the original
   HZ / 10 period) and the usual choice of 128 for HZ:

   1 / 16 -> 6.25%

   1 / 12 -> 8.(3)%

   The change therefore adds an initial call to ds1287_timer_state that
   clears any previous periodic interrupt pending.

The same issue applies to both I/O ASIC counter and R4k CP0 timer
calibration on DECstation systems as similar code is used in both cases
and both pieces of code are covered by this fix.

On an R3400 test system used this fix results in a change of the I/O ASIC
clock frequency reported from values like:

I/O ASIC clock frequency 23185830Hz

to:

I/O ASIC clock frequency 24999288Hz

removing the miscalculation by 6.25% from the systematic error and (for
the individual sample provided) a further 1.00% from the variable error,
accordingly.  The nominal I/O ASIC clock frequency is 25MHz on this
system.

Here's another result, with the fix applied, from a system that has both
HRTs available (using an R4400 at 60MHz nominal):

MIPS counter frequency 59999328Hz
I/O ASIC clock frequency 24999432Hz
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5807/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

ERROR: "copy_from_user_page" [drivers/staging/lustre/lustre/libcfs/libcfs.ko] undefined!
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/5808/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The kbldr.h header file required for this was neither committed in the
original submission in a3a0f8c8
"MIPS: PowerTV: Base files for Cisco PowerTV platform"
nor was it ever present in the git tree so this option never worked.
Fixes the following build problem:
arch/mips/powertv/reset.c:25:36: fatal error: asm/mach-powertv/kbldr.h: No such
file or directory
compilation terminated.

Cc: David VomLehn <dvomlehn@cisco.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: David VomLehn <dvomlehn@cisco.com>
Patchwork: https://patchwork.linux-mips.org/patch/5801/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The NR_CPUS_DEFAULT_1 introduced as an aid for the QEMU
platform in 72ede9b1
"[MIPS] Qemu: Fix Symmetric Uniprocessor support"
which was later removed in
302922e5
"[MIPS] Qemu: Remove platform."

On certain randconfigs it may happen for NR_CPUS to have an
empty value because not all SMP platforms select a suitable
NR_CPUS_DEFAULT_* value. We fix this by restoring the range
of NR_CPUS to 2..64 and drop the NR_CPUS_DEFAULT_{1,2} symbols.
The first one is no longer used and the latter is not needed since
NR_CPUS=2 is now the default value.

Fixes the following problem on a randconfig:
.config:164:warning: symbol value '' invalid for NR_CPUS
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5747/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The jmr3927_vec txx9_board_vec struct is defined in
txx9/jmr3927/setup.c which is only built if
CONFIG_TOSHIBA_JMR3927 is selected. This patch fixes the following
build problem:

arch/mips/txx9/generic/setup.c: In function 'select_board':
arch/mips/txx9/generic/setup.c:354:20: error:
'jmr3927_vec' undeclared (first use in this function)
arch/mips/txx9/generic/setup.c:354:20: note: each undeclared
identifier is reported only once for each function it appears in
make[3]: *** [arch/mips/txx9/generic/setup.o] Error 1
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5713/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The pci.c code depends on symbols which are only visible
if CONFIG_PCI is selected.

Also fixes the following problem on loongson allnoconfig:
arch/mips/built-in.o: In function `pcibios_init':
pci.c:(.init.text+0x528):
undefined reference to `register_pci_controller'
arch/mips/built-in.o:(.data+0xc):
undefined reference to `loongson_pci_ops'
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Acked-by: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5584/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Dynamic function tracing was not working on MIPS.  When doing dynamic
tracing, the tracer attempts to match up the passed in address with
the one the compiler creates in the mcount tables.  The MIPS code was
passing in the return address from the tracing function call, but the
compiler tables were the address of the function call.  So they
wouldn't match.

Just subtracting 8 from the return address will give the address of
the function call.  Easy enough.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
[david.daney@cavium.com: Adjusted code comment and patch Subject.]
Signed-off-by: David Daney <david.daney@cavium.com>
Cc: linux-mips@linux-mips.org
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Patchwork: https://patchwork.linux-mips.org/patch/5592/

This is a fix for a bug introduced with commit
447cdf26, submitted as archived here:
http://www.linux-mips.org/cgi-bin/mesg.cgi?a=linux-mips&i=20080312235002.c717dde3.yoichi_yuasa%40tripeaks.co.jp
regrettably with no further explanation.

The issue is with the CP0 Count register read erratum present on R4000 and
some R4400 processors.  If this erratum is present, then a read from this
register that happens around the time it reaches the value stored in the
CP0 Compare register causes a CP0 timer interrupt that is supposed to
happen when the values in the two registers match to be missed.  The
implication for the chips affected is the CP0 timer can be used either as
a source of a timer interrupt (a clock event) or as a source of a
high-resolution counter (a clock source), but not both at a time.

The erratum does not affect timer interrupt operation itself, because in
this case the CP0 Count register is only read while the timer interrupt
has already been raised, while high-resolution counter references happen
at random times.

Additionally some systems apparently have issues with the timer interrupt
line being routed externally and not following the usual CP0 Count/Compare
semantics.  In this case we don't want to use the R4k clock event.

We've meant to address the erratum and the timer interrupt routing issue
in time_init, however the commit referred to above broke our solution.
What we currently have is we enable the R4k clock source if the R4k clock
event initialization has succeeded (the timer is present and has no timer
interrupt routing issue) or there is no CP0 Count register read erratum.
Which gives the following boolean matrix:

clock event | count erratum => clock source
------------+---------------+--------------
     0      |       0       |      1 (OK)
     0      |       1       |      0 (bug!) -> no interference, could use
     1      |       0       |      1 (OK)
     1      |       1       |      1 (bug!) -> can't use, interference

What we want instead is to enable the R4k clock source if there is no CP0
Count register read erratum (obviously) or the R4k clock event
initialization has *failed* -- because in the latter case we won't be
using the timer interrupt anyway, so we don't care about any interference
CP0 Count reads might cause with the interrupt.  This corresponds to the
following boolean matrix:

clock event | count erratum => clock source
------------+---------------+--------------
     0      |       0       |      1
     0      |       1       |      1
     1      |       0       |      1
     1      |       1       |      0

This is implemented here, effectively reverting the problematic commit,
and a short explanation is given next to code modified so that the
rationale is known to future readers and confusion is prevented from
happening here again.

It is worth noting that mips_clockevent_init returns 0 upon success while
cpu_has_mfc0_count_bug returns 0 upon failure.  This is because the former
function returns an error code while the latter returns a boolean value.
To signify the difference I have therefore chosen to compare the result of
the former call explicitly against 0.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/5799/

get_user_pages_fast() is missing cache flushes for MIPS platforms with
cache aliases.  Filesystem failures observed with DirectIO operations due
to missing flush_anon_page() that use page coloring logic to work with
cache aliases. This fix falls through to take slow_irqon path that calls
get_user_pages() that has required logic for platforms where
cpu_has_dc_aliases is true.

[ralf@linux-mips.org: Explicity include <asm/cpu-features.h>.]
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/5469/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Pull staging fixes from Greg KH:
 "Here are two tiny staging tree fixes (well, one is for an iio driver,
  but those updates come through the staging tree due to dependancies)

  One fixes a problem with an IIO driver, and the other fixes a bug in
  the comedi driver core"

* tag 'staging-3.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: comedi: bug-fix NULL pointer dereference on failed attach
  iio: adjd_s311: Fix non-scan mode data read

Pull USB fixes from Greg KH:
 "Here are two USB fixes for 3.11-rc7

  One fixes a reported regression in the OHCI driver, and the other
  fixes a reported build breakage in the USB phy drivers"

* tag 'usb-3.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: phy: fix build breakage
  USB: OHCI: add missing PCI PM callbacks to ohci-pci.c

Pull ARM fixes from Russell King:
 "This round of fixes is smaller than previous: a couple more updates
  for the security fixes, and a one-liner kexec fix"

* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
  ARM: 7816/1: CONFIG_KUSER_HELPERS: fix help text
  ARM: 7815/1: kexec: offline non panic CPUs on Kdump panic
  ARM: 7819/1: fiq: Cast the first argument of flush_icache_range()

Pull vfs fixes from Al Viro:
 "Assorted fixes from the last week or so"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  VFS: collect_mounts() should return an ERR_PTR
  bfs: iget_locked() doesn't return an ERR_PTR
  efs: iget_locked() doesn't return an ERR_PTR()
  proc: kill the extra proc_readfd_common()->dir_emit_dots()
  cope with potentially long ->d_dname() output for shmem/hugetlb

Pull ACPI fix from Rafael Wysocki:
 "I really hoped that it wouldn't be necessary to change anything in
  ACPI at this point, but it turns out that we need to revert one more
  ACPI video commit causing trouble.

  This reverts a change in the ACPI video driver that caused the ACPI
  backlight initialization to be carried out even if acpi_backlight=vendor
  is passed in the kernel command line which turns out to break things
  at least on one system"

* tag 'acpi-3.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "ACPI / video: Always call acpi_video_init_brightness() on init"

Pull SCSI fixes from James Bottomley:
 "This is a set of small bug fixes for lpfc and zfcp and a fix for a
  fairly nasty bug in sg where a process which cancels I/O completes in
  a kernel thread which would then try to write back to the now gone
  userspace and end up writing to a random kernel address instead"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] zfcp: remove access control tables interface (keep sysfs files)
  [SCSI] zfcp: fix schedule-inside-lock in scsi_device list loops
  [SCSI] zfcp: fix lock imbalance by reworking request queue locking
  [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal
  [SCSI] lpfc: Don't force CONFIG_GENERIC_CSUM on

For a search buffer, 2 byte aligned, strchr() was returning pointer
outside of buffer (buf - 1)

------------->8----------------
    // Input buffer (default 4 byte aigned)
    char *buffer = "1AA_";

    // actual search start (to mimick 2 byte alignment)
    char *current_line = &(buffer[2]);

    // Character to search for
    char c = 'A';

    char *c_pos = strchr(current_line, c);

    printf("%s\n", c_pos) --> 'AA_' as oppose to 'A_'
------------->8----------------
Reported-by: Anton Kolesov <Anton.Kolesov@synopsys.com>
Debugged-by: Anton Kolesov <Anton.Kolesov@synopsys.com>
Cc: <stable@vger.kernel.org> # [3.9 and 3.10]
Cc: Noam Camus <noamc@ezchip.com>
Signed-off-by: Joern Rennecke  <joern.rennecke@embecosm.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This should actually be returning an ERR_PTR on error instead of NULL.
That was how it was designed and all the callers expect it.

[AV: actually, that's what "VFS: Make clone_mnt()/copy_tree()/collect_mounts()
return errors" missed - originally collect_mounts() was expected to return
NULL on failure]

Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

iget_locked() returns a NULL on error, it doesn't return an ERR_PTR.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

The iget_locked() function returns NULL on error and never an ERR_PTR.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

proc_readfd_common() does dir_emit_dots() twice in a row,
we need to do this only once.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

dynamic_dname() is both too much and too little for those - the
output may be well in excess of 64 bytes dynamic_dname() assumes
to be enough (thanks to ashmem feeding really long names to
shmem_file_setup()) and vsnprintf() is an overkill for those
guys.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Pull libata fixes from Tejun Heo:
 "This contains three commits all of which are updates for specific
  devices which aren't too widespread.  Pretty limited scope and nothing
  too interesting or dangerous"

* 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  sata_fsl: save irqs while coalescing
  libata: apply behavioral quirks to sil3826 PMP
  sata, highbank: fix ordering of SGPIO signals

Pull cgroup fix from Tejun Heo:
 "A late fix for cgroup.

  This fixes a behavior regression visible to userland which was created
  by a commit merged during -rc1.  While the behavior change isn't too
  likely to be noticeable, the fix is relatively low risk and we'll need
  to backport it through -stable anyway if the bug gets released"

* 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cpuset: fix a regression in validating config change

Pull drm fixes from Dave Airlie:
 "Ben was on holidays for a week so a few nouveau regression fixes
  backed up, but they all seem necessary.

  Otherwise one i915 and one gma500 fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  gma500: Fix SDVO turning off randomly
  drm/nv04/disp: fix framebuffer pin refcounting
  drm/nouveau/mc: fix race condition between constructor and request_irq()
  drm/nouveau: fix reclocking on nv40
  drm/nouveau/ltcg: fix allocating memory as free
  drm/nouveau/ltcg: fix ltcg memory initialization after suspend
  drm/nouveau/fb: fix null derefs in nv49 and nv4e init
  drm/i915: Invalidate TLBs for the rings after a reset

Commit 94ae9843 (usb: phy: rename all phy drivers to phy-$name-usb.c)
renamed drivers/usb/phy/otg_fsm.h to drivers/usb/phy/phy-fsm-usb.h
but changed drivers/usb/phy/phy-fsm-usb.c to include not existing
"phy-otg-fsm.h" instead of new "phy-fsm-usb.h". This breaks building:
  ...
  drivers/usb/phy/phy-fsm-usb.c:32:25: fatal error: phy-otg-fsm.h: No such file or directory
  compilation terminated.
  make[3]: *** [drivers/usb/phy/phy-fsm-usb.o] Error 1

This commit also missed to modify drivers/usb/phy/phy-fsl-usb.h
to include new "phy-fsm-usb.h" instead of "otg_fsm.h" resulting
in another build breakage:
  ...
  In file included from drivers/usb/phy/phy-fsl-usb.c:46:0:
  drivers/usb/phy/phy-fsl-usb.h:18:21: fatal error: otg_fsm.h: No such file or directory
  compilation terminated.
  make[3]: *** [drivers/usb/phy/phy-fsl-usb.o] Error 1

Fix both issues.
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Cc: stable <stable@vger.kernel.org> # 3.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit c1117afb (USB: OHCI: make ohci-pci a separate driver)
neglected to preserve the entries for the pci_suspend and pci_resume
driver callbacks.  As a result, OHCI controllers don't work properly
during suspend and after hibernation.

This patch adds the missing callbacks to the driver.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Steve Cotton <steve@s.cotton.clara.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit dcd7b8bd ("staging: comedi: put
module _after_ detach" by myself) reversed a couple of calls in
`comedi_device_attach()` when recovering from an error returned by the
low-level driver's 'attach' handler.  Unfortunately, that introduced a
NULL pointer dereference bug as `dev->driver` is NULL after the call to
`comedi_device_detach()`.   We still have a pointer to the low-level
comedi driver structure in the `driv` variable, so use that instead.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge networking fixes from David Miller:

 1) Revert Johannes Berg's genetlink locking fix, because it causes
    regressions.

    Johannes and Pravin Shelar are working on fixing things properly.

 2) Do not drop ipv6 ICMP messages without a redirected header option,
    they are legal.  From Duan Jiong.

 3) Missing error return propagation in probing of via-ircc driver.
    From Alexey Khoroshilov.

 4) Do not clear out broadcast/multicast/unicast/WOL bits in r8169 when
    initializing, from Peter Wu.

 5) realtek phy driver programs wrong interrupt status bit, from
    Giuseppe CAVALLARO.

 6) Fix statistics regression in AF_PACKET code, from Willem de Bruijn.

 7) Bridge code uses wrong bitmap length, from Toshiaki Makita.

 8) SFC driver uses wrong indexes to look up MAC filters, from Ben
    Hutchings.

 9) Don't pass stack buffers into usb control operations in hso driver,
    from Daniel Gimpelevich.

10) Multiple ipv6 fragmentation headers in one packet is illegal and
    such packets should be dropped, from Hannes Frederic Sowa.

11) When TCP sockets are "repaired" as part of checkpoint/restart, the
    timestamp field of SKBs need to be refreshed otherwise RTOs can be
    wildly off.  From Andrey Vagin.

12) Fix memcpy args (uses 'address of pointer' instead of 'pointer') in
    hostp driver.  From Dan Carpenter.

13) nl80211hdr_put() doesn't return an ERR_PTR, but some code believes
    it does.  From Dan Carpenter.

14) Fix regression in wireless SME disconnects, from Johannes Berg.

15) Don't use a stack buffer for DMA in zd1201 USB wireless driver, from
    Jussi Kivilinna.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
  ipv4: expose IPV4_DEVCONF
  ipv6: handle Redirect ICMP Message with no Redirected Header option
  be2net: fix disabling TX in be_close()
  Revert "genetlink: fix family dump race"
  hso: Fix stack corruption on some architectures
  hso: Earlier catch of error condition
  sfc: Fix lookup of default RX MAC filters when steered using ethtool
  bridge: Use the correct bit length for bitmap functions in the VLAN code
  packet: restore packet statistics tp_packets to include drops
  net: phy: rtl8211: fix interrupt on status link change
  r8169: remember WOL preferences on driver load
  via-ircc: don't return zero if via_ircc_open() failed
  macvtap: Ignore tap features when VNET_HDR is off
  macvtap: Correctly set tap features when IFF_VNET_HDR is disabled.
  macvtap: simplify usage of tap_features
  tcp: set timestamps for restored skb-s
  bnx2x: set VF DMAE when first function has 0 supported VFs
  bnx2x: Protect against VFs' ndos when SR-IOV is disabled
  bnx2x: prevent VF benign attentions
  bnx2x: Consider DCBX remote error
  ...

Merge fixes from Andrew Morton:
 "A few fixes.  One is a licensing change and I don't do licensing, so
  please eyeball that one"

Licensing eye-balled.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  lib/lz4: correct the LZ4 license
  memcg: get rid of swapaccount leftovers
  nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection
  nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error
  drivers/platform/olpc/olpc-ec.c: initialise earlier

The LZ4 code is listed as using the "BSD 2-Clause License".
Signed-off-by: Richard Laager <rlaager@wiktel.com>
Acked-by: Kyungsik Lee <kyungsik.lee@lge.com>
Cc: Chanho Min <chanho.min@lge.com>
Cc: Richard Yao <ryao@gentoo.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ The 2-clause BSD can be just converted into GPL, but that's rude and
  pointless, so don't do it   - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The swapaccount kernel parameter without any values has been removed by
commit a2c8990a ("memsw: remove noswapaccount kernel parameter") but
it seems that we didn't get rid of all the left overs.

Make sure that menuconfig help text and kernel-parameters.txt are clear
about value for the paramter and remove the stalled comment which is not
very much useful on its own.
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Reported-by: Gergely Risko <gergely@risko.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix the issue with improper counting number of flying bio requests for
BIO_EOPNOTSUPP error detection case.

The sb_nbio must be incremented exactly the same number of times as
complete() function was called (or will be called) because
nilfs_segbuf_wait() will call wail_for_completion() for the number of
times set to sb_nbio:

  do {
      wait_for_completion(&segbuf->sb_bio_event);
  } while (--segbuf->sb_nbio > 0);

Two functions complete() and wait_for_completion() must be called the
same number of times for the same sb_bio_event.  Otherwise,
wait_for_completion() will hang or leak.
Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove double call of bio_put() in nilfs_end_bio_write() for the case of
BIO_EOPNOTSUPP error detection.  The issue was found by Dan Carpenter
and he suggests first version of the fix too.
Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Being a low-level component, various drivers (e.g.  olpc-battery) assume
that it is ok to communicate with the OLPC Embedded Controller during
probe.  Therefore the OLPC EC driver must be initialised before other
drivers try to use it.  This was the case until it was recently moved
out of arch/x86 and restructured around commits ac250415 ("Platform:
OLPC: turn EC driver into a platform_driver") and 85f90cf6 ("x86:
OLPC: switch over to using new EC driver on x86").

Use arch_initcall so that olpc-ec is readied earlier, matching the
previous behaviour.

Fixes a regression introduced in Linux-3.6 where various drivers such as
olpc-battery and olpc-xo1-sci failed to load due to an inability to
communicate with the EC.  The user-visible effect was a lack of battery
monitoring, missing ebook/lid switch input devices, etc.
Signed-off-by: Daniel Drake <dsd@laptop.org>
Cc: Andres Salomon <dilinger@queued.net>
Cc: Paul Fox <pgf@laptop.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge tag 'drm-intel-fixes-2013-08-23' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes

Just one patch that soaked for quite a bit to fix a resume issue,
resulting in gpu hangs (or worse) due to tlb containing garbage.

* tag 'drm-intel-fixes-2013-08-23' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: Invalidate TLBs for the rings after a reset

IP sends device configuration (see inet_fill_link_af) as an array
in the netlink information, but the indices in that array are not
exposed to userspace through any current santized header file.

It was available back in 2.6.32 (in /usr/include/linux/sysctl.h)
but was broken by:
  commit 02291680
  Author: Eric W. Biederman <ebiederm@xmission.com>
  Date:   Sun Feb 14 03:25:51 2010 +0000

    net ipv4: Decouple ipv4 interface parameters from binary sysctl numbers

Eric was solving the sysctl problem but then the indices were re-exposed
by a later addition of devconf support for IPV4

  commit 9f0f7272
  Author: Thomas Graf <tgraf@infradead.org>
  Date:   Tue Nov 16 04:32:48 2010 +0000

    ipv4: AF_INET link address family

Putting them in /usr/include/linux/ip.h seemed the logical match
for the DEVCONF_ definitions for IPV6 in /usr/include/linux/ip6.h
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>