* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: Fix NULL pointer dereference in nf_nat_move_storage()
  [SUNHME]: VLAN support for sunhme
  [CHELSIO]: Fix skb->dev setting.
  [NETFILTER]: fix compat_nf_sockopt typo
  [INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue
  [VIA_VELOCITY]: Don't oops on MTU change.
  iwl4965: fix not correctly dealing with hotunplug
  rt2x00: Fix chipset revision validation
  iwl3945: place CCK rates in front of OFDM for supported rates
  mac80211: Fix queuing of scan containing a SSID

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] N32 needs to use the compat version of sys_nfsservctl.
  [MIPS] irq_cpu: use handle_percpu_irq handler to avoid dropping interrupts.
  [MIPS] Sibyte: Fix name of clocksource.
  [MIPS] SNI: s/achknowledge/acknowledge/
  [MIPS] Makefile: Fix canonical system names
  [MIPS] vpe: handle halting TCs in an errata safe way.
  [MIPS] Sibyte: Stop timers before programming next even.
  [MIPS] Sibyte: Increase minimum oneshot timer interval to two ticks.
  [MIPS] Lasat: Fix overlap of interrupt number ranges.
  [MIPS] SNI PCIT CPLUS: workaround for b0rked irq wiring of onboard PCI bus 1
  [MIPS] Fix shadow register support.
  [MIPS] Change get_cycles to always return 0.
  [MIPS] Fix typo in R3000 TRACE_IRQFLAGS code
  [MIPS] Sibyte: Replace use of removed IO_SPACE_BASE with IOADDR.
  [MIPS] iounmap if in vr41xx_pciu_init() pci clock is over 33MHz
  [MIPS] BCM1480: Remove duplicate acknowledge of timer interrupt.
  [MIPS] Sibyte: pin timer interrupt to their cores.
  [MIPS] Qemu: Add early printk, your friend in a cold night.
  [MIPS] Convert reference to mem_map to pfn_to_page().
  [MIPS] Sibyte: resurrect old cache hack.

Reported by Chuck Ebbert as:

	https://bugzilla.redhat.com/show_bug.cgi?id=259501#c14

This routine is called each time hash should be replaced, nf_conn has
extension list which contains pointers to connection tracking users
(like nat, which is right now the only such user), so when replace takes
place it should copy own extensions. Loop above checks for own
extension, but tries to move higer-layer one, which can lead to above
oops.
Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch enables VLAN support on sunhme by increasing BMAC_TXMAX/BMAC_RXMAX
and allocating extra space via skb_put for the VLAN header.
Signed-off-by: Chris Poon <dev-null@telus.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This matters to any sort of device that is wired to one of the CPU
interrupt pins on an SMP system.  Typically the scenario is most easily
triggered with the count/compare timer interrupt where the same interrupt
number and thus irq_desc is used on each processor.

   CPU A			CPU B

   do_IRQ()
   generic_handle_irq()
   handle_level_irq()
   spin_lock(desc_lock)
   set IRQ_INPROGRESS
   spin_unlock(desc_lock)
				do_IRQ()
				generic_handle_irq()
				handle_level_irq()
				spin_lock(desc_lock)
				IRQ_INPROGRESS set => bail out
   spin_lock(desc_lock)
   clear IRQ_INPROGRESS
   spin_unlock(desc_lock)

In case of the cp0 compare interrupt this means the interrupt will be
acked and not handled or re-armed on CPU b, so there won't be any timer
interrupt until the count register wraps around.

With kernels 2.6.20 ... 2.6.23 we usually were lucky that things were just
working right on VSMP because the count registers are synchronized on
bootup so it takes something that disables interrupts for a long time on
one processor to trigger this one.

For scenarios where an interrupt is multicasted or broadcasted over several
CPUs the existing code was safe and the fix will break it.  There is no
way to know in the interrupt controller code because it is abstracted from
the platform code.  I think we do not have such a setup currently, so this
should be ok.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The GNU `config.guess' uses "linux-gnu" as the canonical system name.
Fix the list of compiler prefixes checked to spell it correctly.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Adds a JR.HB after halting a TC, to ensure that the TC has really halted.
only modifies the TCSTATUS register when the TC is safely halted.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

We have no guarantee by the generic time code that the timer is stopped
when the ->next_event method is called.  Modifying the Timer Initial Count
register while the timer is enabled has UNPREDICTABLE effect according to
the BCM1250/BCM1125/BCM1125H User Manual.  So stop the timer before
reprogramming.

This is a paranoia fix; no ill effects have been observed previously.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

For the old minimum of a single tick a value of zero would be programmed
into the init value register which in the BCM1250/BCM1125/BCM1125H User
Manual in the Timer Special Cases section is documented to have
UNPREDICTABLE effect.

Observable sympthoms of this bug were hangs of several seconds on the
console during bootup and later if both dyntick and highres timer options
were activated.

In theory contiguous mode of the timers is also affected but in an act of
hopeless lack of realism I'll assume nobody will ever configure a KERNEL
for HZ > 500kHz but if so I leave that to evolution to sort out.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The range of MIPS_CPU IRQ and the range of LASAT IRQ overlap.
Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Shadow register support would not possibly have worked on multicore
systems.  The support code for it was also depending not on MIPS R2 but
VSMP or SMTC kernels even though it makes perfect sense with UP kernels.

SR sets are a scarce resource and the expected usage pattern is that
users actually hardcode the register set numbers in their code.  So fix
the allocator by ditching it.  Move the remaining CPU probe bits into
the generic CPU probe.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This avoids us executing an mfc0 c0_count instruction on processors which
don't have but also on certain R4000 and R4400 versions where reading from
the count register just in the very moment when its value equals
c0_compare will result in the timer interrupt getting lost.

There is still a number of users of get_cycles remaining outside the
arch code:

crypto/tcrypt.c:                start = get_cycles();
crypto/tcrypt.c:                end = get_cycles();
crypto/tcrypt.c:                start = get_cycles();
crypto/tcrypt.c:                end = get_cycles();
crypto/tcrypt.c:                start = get_cycles();
crypto/tcrypt.c:                end = get_cycles();
drivers/char/hangcheck-timer.c: return get_cycles();
drivers/char/hangcheck-timer.c: printk("Hangcheck: Using get_cycles().\n");
drivers/char/random.c:  sample.cycles = get_cycles();
drivers/input/joystick/analog.c:#define GET_TIME(x)     do { x = get_cycles(); }
include/linux/arcdevice.h:          _x = get_cycles(); \
include/linux/arcdevice.h:          _y = get_cycles(); \
mm/slub.c:      if (!s->defrag_ratio || get_cycles() % 1024 > s->defrag_ratio)
mm/slub.c:      p += 64 + (get_cycles() & 0xff) * sizeof(void *);
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

iounmap if pci clock is over 33MHz.  Cosmetic because the iomap() in this
case is just a bit of address magic.
Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
Acked-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Or strange things will happen.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This was crashing the combination of highmem and sparsemem.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The recent switch of the Sibyte SOCs from the processor specific cache
managment code in c-sb1.c to c-r4k.c lost this old hack

    [MIPS] Hack for SB1 cache issues

    Removing flush_icache_page a while ago broke SB1 which was using an empty
    flush_data_cache_page function.  This glues things well enough so a more
    efficient but also more intrusive solution can be found later.
Signed-Off-By: Thiemo Seufer <ths@networkno.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

in the hope it was no longer needed.  As it turns it still is so resurrect
it until there is a better solution.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

eth_type_trans() now sets skb->dev.  Access skb->def after it gets
set.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

It should pass opt to the ->get/->set functions, not ops.
Tested-by: Luca Tettamanti <kronos.it@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

* git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched:
  sched: reorder SCHED_FEAT_ bits
  sched: make sched_nr_latency static
  sched: remove activate_idle_task()
  sched: fix __set_task_cpu() SMP race
  sched: fix SCHED_FIFO tasks & FAIR_GROUP_SCHED
  sched: fix accounting of interrupts during guest execution on s390

reorder SCHED_FEAT_ bits so that the used ones come first. Makes
tuning instructions easier.
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched_nr_latency can now become static.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

cpu_down() code is ok wrt sched_idle_next() placing the 'idle' task not
at the beginning of the queue.

So get rid of activate_idle_task() and make use of activate_task() instead.
It is the same as activate_task(), except for the update_rq_clock(rq) call
that is redundant.

Code size goes down:

   text    data     bss     dec     hex filename
  47853    3934     336   52123    cb9b sched.o.before
  47828    3934     336   52098    cb82 sched.o.after
Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Grant Wilson has reported rare SCHED_FAIR_USER crashes on his quad-core
system, which crashes can only be explained via runqueue corruption.

there is a narrow SMP race in __set_task_cpu(): after ->cpu is set up to
a new value, task_rq_lock(p, ...) can be successfuly executed on another
CPU. We must ensure that updates of per-task data have been completed by
this moment.

this bug has been hiding in the Linux scheduler for an eternity (we never
had any explicit barrier for task->cpu in set_task_cpu() - so the bug was
introduced in 2.5.1), but only became visible via set_task_cfs_rq() being
accidentally put after the task->cpu update. It also probably needs a
sufficiently out-of-order CPU to trigger.
Reported-by: Grant Wilson <grant.wilson@zen.co.uk>
Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Suppose that the SCHED_FIFO task does

	switch_uid(new_user);

Now, p->se.cfs_rq and p->se.parent both point into the old
user_struct->tg because sched_move_task() doesn't call set_task_cfs_rq()
for !fair_sched_class case.

Suppose that old user_struct/task_group is freed/reused, and the task
does

	sched_setscheduler(SCHED_NORMAL);

__setscheduler() sets fair_sched_class, but doesn't update
->se.cfs_rq/parent which point to the freed memory.

This means that check_preempt_wakeup() doing

		while (!is_same_group(se, pse)) {
			se = parent_entity(se);
			pse = parent_entity(pse);
		}

may OOPS in a similar way if rq->curr or p did something like above.

Perhaps we need something like the patch below, note that
__setscheduler() can't do set_task_cfs_rq().
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Currently the scheduler checks for PF_VCPU to decide if this timeslice
has to be accounted as guest time. On s390 host interrupts are not
disabled during guest execution. This causes theses interrupts to be
accounted as guest time if CONFIG_VIRT_CPU_ACCOUNTING is set. Solution
is to check if an interrupt triggered account_system_time. As the tick
is timer interrupt based, we have to subtract hardirq_offset.

I tested the patch on s390 with CONFIG_VIRT_CPU_ACCOUNTING and on
x86_64. Seems to work.

CC: Avi Kivity <avi@qumranet.com>
CC: Laurent Vivier <Laurent.Vivier@bull.net>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  i2c/eeprom: Recognize VGN as a valid Sony Vaio name prefix
  i2c/eeprom: Hide Sony Vaio serial numbers
  i2c-pasemi: Fix NACK detection
  i2c-pasemi: Replace obsolete "driverfs" reference with "sysfs"
  i2c: Make i2c_check_addr static
  i2c-dev: Unbound new-style i2c clients aren't busy
  i2c-dev: "how does it work" comments

Recent (i.e. 2005 and later) Sony Vaio laptops have names beginning
with VGN rather than PCG. Update the eeprom driver so that it
recognizes these.
Signed-off-by: Jean Delvare <khali@linux-fr.org>

The sysfs interface to DMI data takes care to not make the system
serial number and UUID world-readable, presumably due to privacy
concerns. For consistency, we should not let the eeprom driver
export these same strings to the world on Sony Vaio laptops.
Instead, only make them readable by root, as we already do for BIOS
passwords.
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Turns out we don't actually check the status to see if there was a
device out there to talk to, just if we had a timeout when doing so.

Add the proper check, so we don't falsly think there are devices
on the bus that are not there, etc.
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c_check_addr is only used inside i2c-core now, so we can make it
static and stop exporting it. Thanks to David Brownell for noticing.
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Let i2c-dev deal properly with new-style i2c clients. Instead of
considering them always busy, it needs to check wether a driver is
bound to them or not.

This is still not completely correct, as the client could become
busy later, but the same problem already existed before new-style
clients were introduced. We'll want to fix it someday.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>