Rabin Vincent reports:
| On SMP, this BUG() in save_stack_trace_tsk() can be easily triggered
| from user space by reading /proc/$PID/stack, where $PID is any pid but
| the current process:
|
|	if (tsk != current) {
| #ifdef CONFIG_SMP
|		/*
|		 * What guarantees do we have here that 'tsk'
|		 * is not running on another CPU?
|		 */
|		BUG();
| #else

Fix this by replacing the BUG() with an entry to terminate the stack
trace, returning an empty trace - I'd rather not expose the dwarf
unwinder to a volatile stack of a running thread.
Reported-by: Rabin Vincent <rabin@rab.in>
Tested-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Build errors similar this appeared in todays kautobuild for the above
targets:

In file included from arch/arm/include/asm/pgtable.h:461,
                 from arch/arm/mach-pxa/generic.c:26:
include/asm-generic/pgtable.h: In function 'ptep_test_and_clear_young':
include/asm-generic/pgtable.h:29: error: dereferencing pointer to incomplete type

None of the .c files including asm/pgtable.h with this error is using
this header, so simply remove the include.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Do not use memory bank info to request the "system ram" resources as
they do not track holes created by memblock_remove inside
machine's reserve callback. If the removed memory is passed as
platform_device's ioresource, then drivers that call
request_mem_region would fail due to a conflict with the incorrectly
configured system ram resource.

Instead, iterate through the regions of memblock.memory and add
those as "System RAM" resources.
Signed-off-by: Dima Zavin <dima@android.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

e3d9c625 (ARM: CPU hotplug: fix hard-coded control register constants)
changed the wrong constants in the hotplug assembly code.  Fix this.
Reported-by: viresh kumar <viresh.kumar@st.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This depends on !XIP_KERNEL and not !XIP.
Signed-off-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Commit d30e45ee (ARM: pgtable: switch order of Linux vs hardware page tables)
introduced a pre-increment addressing offset which is out of range for
Thumb-2.  Thumb-2 only permits offsets <256.  So split the intruction in
two for Thumb-2.
Signed-off-by: Dave Martin <dave.martin@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The kerneldoc for this function is at odds with the DMA-API
document, which holds, so fix it.
Signed-off-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The CLZ instruction does not alter the condition flags, so remove the
"cc" clobber from the inline asm for fls().
Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

When CONFIG_CMDLINE_FORCE is used, the warning

  Ignoring unrecognised tag 0x54410009

was displayed. Change this to

  Ignoring tag cmdline (using the default kernel command line)
Signed-off-by: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

When running without an MMU, we do not need to install a mapping for the
vectors page. Attempting to do so causes a compile-time error because
install_special_mapping is not defined.

This patch adds compile-time guards to the vector mapping functions
so that we can build nommu configurations once more.
Acked-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The purpose of the minsec argument is to prevent 64-bit math overflow
when the number of cycles is multiplied up.  However, the multipler
is 32-bit, and in the sched_clock() case, the cycle counter is up to
32-bit as well.  So the math can never overflow.

With a value of 60, and clock rates greater than 71MHz, the calculated
multiplier is unnecessarily reduced in value, which reduces accuracy by
maybe 70ppt.  It's almost not worth bothering with as the oscillator
driving the counter won't be any more than 1ppm - unless you're using
a rubidium lamp or caesium fountain frequency standard.

So, set the minsec argument to zero.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

sched_clock is supposed to be initialized early - in the recently added
init_early platform hook.  However, in doing so we end up calling
mod_timer() before the timer lists are initialized, resulting in an
oops.

Split the initialization in two - the part which the platform calls
early which starts things off.  The addition of the timer can be
delayed until after we have more of the kernel initialized - when the
normal time sources are initialized.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Fix:
arch/arm/mach-integrator/cpu.c: In function ■integrator_get■:
arch/arm/mach-integrator/cpu.c:164: warning: ■vco.s■ may be used uninitialized in this function
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Fix section mismatch errors in the ep93xx-fb driver resulting from
incorrect init/exit annotations.
Reported-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Ryan Mallon <ryan@bluewatersys.com>
Tested-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The fraction of MHz was not being displayed correctly as the calculation
was a factor of 10 out.  Fix this.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

We perform the microseconds to loops calculation using a number of
multiplies and shift rights.  Each shift right rounds down the
resulting value, which can result in delays shorter than requested.
Ensure that we always round up.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (255 commits)
  [media] radio-aimslab.c: Fix gcc 4.5+ bug
  [media] cx25821: Fix compilation breakage due to BKL dependency
  [media] v4l2-compat-ioctl32: fix compile warning
  [media] zoran: fix compiler warning
  [media] tda18218: fix compile warning
  [media] ngene: fix compile warning
  [media] DVB: IR support for TechnoTrend CT-3650
  [media] cx23885, cimax2.c: Fix case of two CAM insertion irq
  [media] ir-nec-decoder: fix repeat key issue
  [media] staging: se401 depends on USB
  [media] staging: usbvideo/vicam depends on USB
  [media] soc_camera: Add the ability to bind regulators to soc_camedra devices
  [media] V4L2: Add a v4l2-subdev (soc-camera) driver for OmniVision OV2640 sensor
  [media] v4l: soc-camera: switch to .unlocked_ioctl
  [media] v4l: ov772x: simplify pointer dereference
  [media] ov9640: fix OmniVision OV9640 sensor driver's priv data retrieving
  [media] ov9640: use macro to request OmniVision OV9640 sensor private data
  [media] ivtv-i2c: Fix two warnings
  [media] staging/lirc: Update lirc TODO files
  [media] cx88: Remove the obsolete i2c_adapter.id field
  ...

* 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm: (416 commits)
  ARM: DMA: add support for DMA debugging
  ARM: PL011: add DMA burst threshold support for ST variants
  ARM: PL011: Add support for transmit DMA
  ARM: PL011: Ensure IRQs are disabled in UART interrupt handler
  ARM: PL011: Separate hardware FIFO size from TTY FIFO size
  ARM: PL011: Allow better handling of vendor data
  ARM: PL011: Ensure error flags are clear at startup
  ARM: PL011: include revision number in boot-time port printk
  ARM: vexpress: add sched_clock() for Versatile Express
  ARM i.MX53: Make MX53 EVK bootable
  ARM i.MX53: Some bug fix about MX53 MSL code
  ARM: 6607/1: sa1100: Update platform device registration
  ARM: 6606/1: sa1100: Fix platform device registration
  ARM i.MX51: rename IPU irqs
  ARM i.MX51: Add ipu clock support
  ARM: imx/mx27_3ds: Add PMIC support
  ARM: DMA: Replace page_to_dma()/dma_to_page() with pfn_to_dma()/dma_to_pfn()
  mx51: fix usb clock support
  MX51: Add support for usb host 2
  arch/arm/plat-mxc/ehci.c: fix errors/typos
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6: (25 commits)
  atyfb: Fix bootup hangs on sparc64.
  sparc: update copyright in piggyback.c
  sparc: unify strip command in boot/Makefile
  sparc: rename piggyback_32 to piggyback
  sparc: fix tftpboot.img for sparc64 on little-endian host
  sparc: add $BITS to piggyback arguments
  sparc: remove obsolete ELF support in piggyback_32.c
  sparc: additional comments to piggyback_32.c
  sparc: use _start for the start entry (like 64 bit does)
  sparc: use trapbase in setup_arch
  sparc: refactor piggy_32.c
  Added support for ampopts in APBUART driver. Used in AMP systems.
  APBUART: added raw AMBA vendor/device number to match against.
  SPARC/LEON: avoid AMBAPP name duplicates in openprom fs when REG is missing
  SPARC/LEON: added support for selecting Timer Core and Timer within core
  LEON: added raw AMBA vendor/device number to find TIMER, IRQCTRL
  SPARC/LEON: added support for IRQAMP IRQ Controller
  SPARC/LEON: find IRQCTRL and Timer via OF-Tree, instead of hardcoded.
  sparc: fix sparse warnings in arch/sparc/prom for 32 bit build
  sparc: remove unused prom tree functions
  ...

Conflicts:
	arch/arm/mach-pxa/clock.c
	arch/arm/mach-pxa/clock.h

Conflicts:
	arch/arm/Kconfig
	arch/arm/common/Makefile
	arch/arm/kernel/Makefile
	arch/arm/kernel/smp.c

Conflicts:
	arch/arm/kernel/entry-armv.S
	arch/arm/mm/ioremap.c

Add ARM support for the DMA debug infrastructure, which allows the
DMA API usage to be debugged.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'for-linus' of git://codeaurora.org/quic/kernel/davidb/linux-msm: (35 commits)
  mmc: msm_sdcc: Check for only DATA_END interrupt to end a request
  mmc: msm_sdcc: Fix bug in PIO mode when data size is not word aligned
  mmc: msm_sdcc: Reset SDCC in case of data transfer errors
  mmc: msm_sdcc: Add prog done interrupt support
  mmc: msm_sdcc: Fix possible circular locking dependency warning
  MSM: Add USB support for MSM7x30
  MSM: Add USB suport for QSD8x50
  msm: initial framebuffer support
  msm: add handling for clocks tagged as CLK_MINMAX
  msm: trout: change name of pmdh_clk to mddi_clk
  msm: add CLK_MINMAX to pmdh_clk
  msm: trout: add gpio_to_irq
  msm: iommu: Use the correct memory allocation flag
  msm_serial: Remove redundant unlikely()
  msm: iommu: Miscellaneous code cleanup
  msm: iommu: Support cache-coherent memory access
  msm: iommu: Definitions for extended memory attributes
  msm: iommu: Kconfig dependency for the IOMMU API
  msm: iommu: Check if device is already attached
  msm: iommu: Kconfig item for cacheable page tables
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6: (55 commits)
  video: udlfb: Kill off special printk wrappers, use pr_fmt().
  video: udlfb: Kill off some magic constants for EDID sizing.
  video: udlfb: deifdefify (yes, that's a word).
  fbdev: modedb: Add a new mode for 864x480 TAAL panels.
  drivers/video/i810/i810-i2c.c: fix i2c bus handling
  video: Fix the HGA framebuffer driver
  drivers/video/carminefb.c: improve error handling
  video: imxfb: Fix the maximum value for yres
  fbdev: sh_mobile_lcdcfb: Enable 32 bpp and 24 bpp support
  fbdev: sh_mipi_dsi: use platform provided register layout and values
  ARM: mach-shmobile: specify sh7372 MIPI DSI register layout
  fbdev: sh_mipi_dsi: support different register layouts
  ARM: mach-shmobile: improve MIPI DSI clock configuration
  fbdev: sh-mobile: implement MIPI DSI runtime PM support
  sisfb: eliminate compiler warnings
  sisfb: delete unused register I/O macros
  sisfb: replace setSISIDXREG with SiS_SetRegANDOR
  sisfb: replace andSISIDXREG with SiS_SetRegAND
  sisfb: replace orSISIDXREG with SiS_SetRegOR
  sisfb: replace outSISIDXREG with SiS_SetReg
  ...

* 'sh-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: include Migo-R TS driver in Migo-R defconfig
  sh: correct definitions to access stack pointers
  sh: Tidy up SH-4A unaligned load support.
  dma: shdma: NMI support.
  sh: mach-sdk7786: Handle baseboard NMI source selection.
  sh: mach-rsk: Add polled GPIO buttons support for RSK+7203.
  sh: Break out cpuinfo_op procfs bits.
  sh: Enable optional gpiolib for all CPUs with pinmux tables.
  sh: migrate SH_CLK_MD to mode pin API.
  sh: machvec IO death.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1436 commits)
  cassini: Use local-mac-address prom property for Cassini MAC address
  net: remove the duplicate #ifdef __KERNEL__
  net: bridge: check the length of skb after nf_bridge_maybe_copy_header()
  netconsole: clarify stopping message
  netconsole: don't announce stopping if nothing happened
  cnic: Fix the type field in SPQ messages
  netfilter: fix export secctx error handling
  netfilter: fix the race when initializing nf_ct_expect_hash_rnd
  ipv4: IP defragmentation must be ECN aware
  net: r6040: Return proper error for r6040_init_one
  dcb: use after free in dcb_flushapp()
  dcb: unlock on error in dcbnl_ieee_get()
  net: ixp4xx_eth: Return proper error for eth_init_one
  include/linux/if_ether.h: Add #define ETH_P_LINK_CTL for HPNA and wlan local tunnel
  net: add POLLPRI to sock_def_readable()
  af_unix: Avoid socket->sk NULL OOPS in stream connect security hooks.
  net_sched: pfifo_head_drop problem
  mac80211: remove stray extern
  mac80211: implement off-channel TX using hw r-o-c offload
  mac80211: implement hardware offload for remain-on-channel
  ...

Fallback on the local-mac-address prom property if the Cassini device
does not have an address programmed in the VPD ROM. This uses the same
technique as implemented by the sungem driver.

The problem was reported by Frans van Berckel using Debian kernel 2.6.34-7
on Sun Fire V440. udev was assigning a new eth<n> device name on each reboot
because the cassini driver was using a random MAC address.

Fix tested on 2.6.34-7 and 2.6.37 Sun Fire V440. Compile tested against
2.6.36 davem/sparc-2.6.git
Reported-by: Frans van Berckel <fberckel@xs4all.nl>
Tested-by: Frans van Berckel <fberckel@xs4all.nl>
Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Richard Mortimer <richm@oldelvet.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

Since we are already in #ifdef __KERNEL__, we don't need to check it
again.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

After commit 25edd694 ("sparc64: Get
rid of indirect p1275 PROM call buffer.")  we can't pass virtual
addresses >4GB to PROM calls.

Largely this is never necessary in drivers because we have a copy of
the entire PROM device tree in the kernel and a set of of_*()
interfaces to access it.

Unfortunately there were some lingering prom calls in the atyfb
driver, in particular prom_finddevice() was being called with an
on-stack address which could be anywhere.

This code is actually probing for information we already have, the
PROM choosen console output device is stored in of_console_device so
all of this nasty code consolidates into a one-line comparison.

Next we have some prom_getintdefault() calls which are trivially
transformed into the equivalent of_getintprop_default().

Special thanks to Fabio, who figured out exactly where the bootup
was hanging.  That made this bug trivial to fix.
Reported-by: Fabio M. Di NItto <fabbione@fabbione.net>
Reported-by: Sam Ravnborg <sam@ravnborg.org>
Reported-by: Frans van Berckel <fberckel@xs4all.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Fabio M. Di NItto <fabbione@fabbione.net>

Since nf_bridge_maybe_copy_header() may change the length of skb,
we should check the length of skb after it to handle the ppoe skbs.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Ferenc Wagner <wferi@niif.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Ferenc Wagner <wferi@niif.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>

The new firmware interface requires each Slow Path Queue (SPQ) message's
type field to include the function number.  The existing code does not
do this consistently.  We fix this by OR'ing in the function number
into the type field centrally in cnic_submit_kwqe_16().
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

In 1ae4de0c, the secctx was exported
via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
instead of the secmark.

That patch introduced the use of security_secid_to_secctx() which may
return a non-zero value on error.

In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
security modules. Thus, security_secid_to_secctx() returns a negative
value that results in the breakage of the /proc and `conntrack -L'
outputs. To fix this, we skip the inclusion of secctx if the
aforementioned function fails.

This patch also fixes the dynamic netlink message size calculation
if security_secid_to_secctx() returns an error, since its logic is
also wrong.

This problem exists in Linux kernel >= 2.6.37.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Since nf_ct_expect_dst_hash() may be called without nf_conntrack_lock
locked, nf_ct_expect_hash_rnd should be initialized in the atomic way.

In this patch, we use nf_conntrack_hash_rnd instead of
nf_ct_expect_hash_rnd.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

RFC3168 (The Addition of Explicit Congestion Notification to IP)
states :

5.3.  Fragmentation

   ECN-capable packets MAY have the DF (Don't Fragment) bit set.
   Reassembly of a fragmented packet MUST NOT lose indications of
   congestion.  In other words, if any fragment of an IP packet to be
   reassembled has the CE codepoint set, then one of two actions MUST be
   taken:

      * Set the CE codepoint on the reassembled packet.  However, this
        MUST NOT occur if any of the other fragments contributing to
        this reassembly carries the Not-ECT codepoint.

      * The packet is dropped, instead of being reassembled, for any
        other reason.

This patch implements this requirement for IPv4, choosing the first
action :

If one fragment had NO-ECT codepoint
        reassembled frame has NO-ECT
ElIf one fragment had CE codepoint
        reassembled frame has CE
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return -ENOMEM instead of 0 for the case of mdiobus_alloc and kmalloc failure.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

The original code has a use after free bug because it's not using the
_safe() version of the list_for_each_entry() macro.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>