Gurudas Pai reports kernel BUG at arch/i386/mm/highmem.c:15! below
sys_remap_file_pages, while running Oracle database test on x86 in 6GB
RAM: kunmap thinks we're in_interrupt because the preempt count has
wrapped.

That's because __do_fault expected to unmap page_table, but one of its
two callers do_nonlinear_fault already unmapped it: let do_linear_fault
unmap it first too, and then there's no need to pass the page_table arg
down.

Why have we been so slow to notice this? Probably through forgetting
that the mapping_cap_account_dirty test means that sys_remap_file_pages
nowadays only goes the full nonlinear vma route on a few memory-backed
filesystems like ramfs, tmpfs and hugetlbfs.

[ It also depends on CONFIG_HIGHPTE, so it becomes even harder to
  trigger in practice. Many who have need of large memory have probably
  migrated to x86-64..

  Problem introduced by commit d0217ac0
  ("mm: fault feedback #1")                -- Linus ]
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Cc: gurudas pai <gurudas.pai@oracle.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  drivers/ata/pata_ixp4xx_cf.c: ioremap return code check
  Ata: pata_marvell, use ioread* for iomap-ped memory
  libata: fix for sata_mv >64KB DMA segments

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  sky2: jumbo frame regression fix
  [PATCH] softmac: Fix compiler-warning
  [PATCH] bcm43xx: Correct printk with PFX before KERN_

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Terminally fix local_{dec,sub}_if_positive
  [MIPS] Type proof reimplementation of cmpxchg.
  [MIPS] pg-r4k.c: Fix a typo in an R4600 v2 erratum workaround

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/cooloney/blackfin-2.6:
  Blackfin arch: fix PORT_J BUG for BF537/6 EMAC driver reported by Kalle Pokki <kalle.pokki@iki.fi>
  Blackfin arch: gpio pinmux and resource allocation API required by BF537 on chip ethernet mac driver
  Blackfin arch: add some missing syscall
  binfmt_flat: checkpatch fixing minimum support for the blackfin relocations
  Binfmt_flat: Add minimum support for the Blackfin relocations

Add missing ioremap return checks.

Signed-off-by: Scott Thompson <postfail <at> hushmail.com>
Acked-by: NTejun Heo <htejun@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

pata_marvell, use ioread* for iomap-ped memory

read* on pci_iomapped memory is incorrect, fix it
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Fix bug in sata_mv for cases where the IOMMU layer has merged SG entries
to larger than 64KB. They need to be split up before being sent to
the driver.

Just for simplicity's sake, split up at 64K boundary instead of 64K size,
since that's what the common code does anyway.
Signed-off-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The fs was not unlocking the local alloc inode mutex in the code path in
which it failed to find a window of free bits in the global bitmap.
Signed-off-by: NSunil Mushran <sunil.mushran@oracle.com>
Signed-off-by: NMark Fasheh <mark.fasheh@oracle.com>

Remove unneeded check that caused problems with jumbo frame sizes.
The check was recently added and is wrong.
When using jumbo frames the sky2 driver does fragmentation, so
rx_data_size is less than mtu.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Merge branch 'fixes-jgarzik' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Cc: Kalle Pokki <kalle.pokki@iki.fi>
Signed-off-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NBryan Wu <bryan.wu@analog.com>

Blackfin arch: gpio pinmux and resource allocation API required by BF537 on chip ethernet mac driver
Signed-off-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NBryan Wu <bryan.wu@analog.com>

They contain 64-bit instructions so wouldn't work on 32-bit kernels or
32-bit hardware.  Since there are no users, blow them away.  They
probably were only ever created because there are atomic_sub_if_positive
and atomic_dec_if_positive which exist only for sake of semaphores.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Restore a load from KSEG1 done as a workaround for an R4600 v2
erratum, dropped with 211be16de99a7424e66c0b6c0d00e2c970508ac2.
Signed-off-by: NMaciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

  CC      net/ieee80211/softmac/ieee80211softmac_wx.o
/home/kernel/src/net/ieee80211/softmac/ieee80211softmac_wx.c: In function ‘ieee80211softmac_wx_set_essid’:
/home/kernel/src/net/ieee80211/softmac/ieee80211softmac_wx.c:117: warning: label ‘out’ defined but not used

due to commit: efe870f9. Removing the label.
Signed-off-by: NRichard Knutsson <ricknu-0@student.ltu.se>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Correct printk with PFX before KERN_ in bcm43xx_wx.c
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

* 'sas-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
  aic94xx: fix DMA data direction for SMP requests

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  dm9601: Fix receive MTU
  mv643xx_eth: Do not modify struct netdev tx_queue_len
  qla3xxx: bugfix: Fix VLAN rx completion handling.
  qla3xxx: bugfix: Add memory barrier before accessing rx completion.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  ata_piix: add another TECRA M3 entry to broken suspend list

* git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched:
  sched: fix profile=sleep

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix missing load-twin usage in Niagara-1 memcpy.
  [SPARC64]: Fix put_user() calls in binfmt_aout32.c
  [SPARC]: Fix EBUS use of uninitialized variable.

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IEEE80211]: avoid integer underflow for runt rx frames
  [TCP]: secure_tcp_sequence_number() should not use a too fast clock
  [SFQ]: Remove artificial limitation for queue limit.

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix xics set_affinity code

DMA-mapped SMP (scsi management protocol) requests going /to/ the device
need the PCI DMA data direction to indicate such.
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

dm9601 didn't take the ethernet header into account when calculating
RX MTU, causing packets bigger than 1486 to fail.
Signed-off-by: NPeter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This driver erroneously zeros dev->tx_queue_len, since
mp->tx_ring_size has not yet been initialized.  Actually,
the driver shouldn't modify tx_queue_len at all and should
leave the value set by alloc_etherdev(), currently 1000.
Signed-off-by: NDale Farnsworth <dale@farnsworth.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Fix 4032 chip undocumented "feature" where bit-8 is set
if the inbound completion is for a VLAN.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

There's a different version of DMI table for TECRA M3 where it has
proper vendor and product name entry.  Add the entry to the broken
suspend list.

Angus Turnbull reported and provided initial patch.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Angus Turnbull <angus@twinhelix.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

fix sleep profiling - we lost this chunk in the CFS merge.
Found-by: NMel Gorman <mel@csn.ul.ie>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

For the case where the source is not aligned modulo 8
we don't use load-twins to suck the data in and this
kills performance since normal loads allocate in the
L1 cache (unlike load-twin) and thus big memcpys swipe
the entire L1 D-cache.

We need to allocate a register window to implement this
properly, but that actually simplifies a lot of things
as a nice side-effect.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Reported by Chris Evans <scarybeasts@gmail.com>:

> The summary is that an evil 80211 frame can crash out a victim's
> machine. It only applies to drivers using the 80211 wireless code, and
> only then to certain drivers (and even then depends on a card's
> firmware not dropping a dubious packet). I must confess I'm not
> keeping track of Linux wireless support, and the different protocol
> stacks etc.
>
> Details are as follows:
>
> ieee80211_rx() does not explicitly check that "skb->len >= hdrlen".
> There are other skb->len checks, but not enough to prevent a subtle
> off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag
> set.
>
> This leads to integer underflow and crash here:
>
> if (frag != 0)
>    flen -= hdrlen;
>
> (flen is subsequently used as a memcpy length parameter).

How about this?
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

TCP V4 sequence numbers are 32bits, and RFC 793 assumed a 250 KHz clock.
In order to follow network speed increase, we can use a faster clock, but
we should limit this clock so that the delay between two rollovers is
greater than MSL (TCP Maximum Segment Lifetime : 2 minutes)

Choosing a 64 nsec clock should be OK, since the rollovers occur every
274 seconds.

Problem spotted by Denys Fedoryshchenko

[ This bug was introduced by f8595815 ]
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This is followup to Patrick's patch. A little optimization to enqueue
routine allows to remove artificial limitation on queue length.

Plus, testing showed that hash function used by SFQ is too bad or even worse.
It does not even sweep the whole range of hash values.
Switched to Jenkins' hash.
Signed-off-by: NAlexey Kuznetsov <kaber@ms2.inr.ac.ru>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

No, I didn't want to do this, but we had more stuff go in after -rc8
than we had in the previous -rc. Gaah.

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] vmlinux.lds.S: Handle note sections
  [MIPS] Fix value of O_TRUNC

For some reason old binutils genertate larger headers so increase the text
offset of the vdso to avoid linker errors.

Roland McGrath explains:
  "There are extra symbols in the '.dynsym' section that are responsible
   for the size difference (They also cause corresponding inflation in
   '.gnu.version')

   Older ld's wrongly generated these unneeded symbols in .dynsym.  This
   was fixed not all that long ago (2006); binutils-2.17.50.0.6 might be
   the first fixed version, but I have not verified for sure where the
   cutoff was.

   The unneeded symbols et al from old ld add almost 700 bytes excess.
   This limits fairly tightly the amount by which the actual text and
   data in the vDSO can grow in the future without pushing the whole
   file over 4kb.  If it does grow later on, we should consider changing
   the layout with a config option or something to pack it better
   without that padding, when building the kernel with newer binutils."
Signed-off-by: NAndi Kleen <ak@suse.de>
Cc: Roland McGrath <roland@redhat.com>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

On a POWER6 machine running 2.6.23-rc8 I sometimes see the following error:

xics_set_affinity: No online cpus in the mask 00000000,00000000,00000000,00000001 for irq 20

In a desperate attempt to get a changelog entry in 2.6.23, I took a look
into it.

It turns out we are passing a real and not a virtual irq into
get_irq_server.  This works for the case where hwirq < NR_IRQS and we
set virq = hwirq.  In my case however hwirq = 590082 and we try and
access irq_desc[590082], slightly past the end at 512 entries.

Lucky we ship lots of memory with our machines.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>