* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: silence a warning in ebtables
  [IPV6]: File the fingerprints off ah6->spi/esp6->spi
  [TCP]: Set default congestion control when no sysctl.
  [TIPC] net/tipc/port.c: fix NULL dereference

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix futex_atomic_cmpxchg_inatomic implementation.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  Revert "[PATCH] Add 0x7110 piix to ata_piix.c"
  [libata] sata_nv: Add PCI IDs
  [PATCH] ahci: fix status register check in ahci_softreset

This reverts commit f833229c:

According to reviewers and the lspci data provided in commit message
itself, PCI ID 0x7110 should not have been added to ata_piix.
Signed-off-by: NJeff Garzik <jeff@garzik.org>

net/bridge/netfilter/ebtables.c: In function 'ebt_dev_check':
net/bridge/netfilter/ebtables.c:89: warning: initialization discards qualifiers from pointer target type

So make the char* a const char * and the warning is gone.
Signed-off-by: NMeelis Roos <mroos@linux.ee>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

I copied the logic from ll/sc arch implementations, but that
was wrong and makes no sense at all.  Just do a straight
compare-exchange instruction, just like x86.

Based upon bug reports from Dennis Gilmore and Fabio Massimo.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In theory these are opaque 32bit values.  However, we end up
allocating them sequentially in host-endian and stick unchanged
on the wire.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The setting of the default congestion control was buried in
the sysctl code so it would not be done properly if SYSCTL was
not enabled.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The correct order is: NULL check before dereference

Spotted by the Coverity checker.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It turns out that the linker warnings on 64-bit powerpc about "section
blah exceeds stub group size" were being triggered by conditional
branches in head_64.S branching to global symbols, whether in
head_64.S or in other files.  This eliminates the warnings by making
some global symbols in head_64.S no longer global, and by rearranging
some branches.
Signed-off-by: NPaul Mackerras <paulus@samba.org>
[ Yee-haa. Maybe I'll notice newly introduced real warnings now - Linus ]
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix warning in mips-boards generic PCI
  [MIPS] SMTC: Synchronize cp0 counters on bootup.
  [MIPS] SMTC: Fix crash if # of TC's > # of VPE's after pt_regs irq cleanup.
  [MIPS] 16K & 64K page size fixes

Since the "mask" bit is in the low word, when we write a new entry, we
need to write the high word first, before we potentially unmask it.

The exception is when we actually want to mask the interrupt, in which
case we want to write the low word first to make sure that the high word
doesn't change while the interrupt routing is still active.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

arch/mips/mips-boards/generic/pci.c: In function `mips_pcibios_init':
arch/mips/mips-boards/generic/pci.c:227: warning: comparison of distinct pointer types lacks a cast
arch/mips/mips-boards/generic/pci.c:228: warning: comparison of distinct pointer types lacks a cast
Signed-off-by: NYoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Derived from Peter Watkins <treestem@gmail.com>'s work.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

This is preparation for fixing the ordering of the accesses that
got broken by the commit cf4c6a2f when
factoring out the "common" io apic routing entry accesses.

Move the accessor function (that were only used by io_apic.c) out
of a header file, and use proper memory-mapped accesses rather than
making up our own "volatile" pointers.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Make alignment exception always check exception table
  [POWERPC] Disallow kprobes on emulate_step and branch_taken
  [POWERPC] Make mmiowb's io_sync preempt safe
  [POWERPC] Make high hugepage areas preempt safe
  [POWERPC] Make current preempt-safe
  [POWERPC] qe_lib: qe_issue_cmd writes wrong value to CECDR
  [POWERPC] Use 4kB iommu pages even on 64kB-page systems
  [POWERPC] Fix oprofile support for e500 in arch/powerpc
  [POWERPC] Fix rmb() for e500-based machines it
  [POWERPC] Fix various offb issues

Signed-off-by: NJeff Garzik <jeff@garzik.org>

ahci_softreset() used to use ahci_tf_read() which reads D2H_REG area
to check for the Status register.  However, this area is zeroed on
initialization and not set by initial signature FIS.  Replace it with
ahci_check_status().

This bug prevented CLO code from being activated whenever BSY and/or
DRQ is set prior to softreset.  This fix makes
AHCI_FLAG_RESET_NEEDS_CLO flag redundant.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] ata_piix: allow 01b MAP for both ICH6M and ICH7M
  [PATCH] libata: unexport ata_dev_revalidate()
  [PATCH] Add 0x7110 piix to ata_piix.c
  [PATCH] sata_sis: fix flags handling for the secondary port

The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

On powerpc, probing on emulate_step function will crash 2.6.18.1 when
it is triggered.

When kprobe is triggered, emulate_step() is on its kernel path and
will cause recursive kprobe fault.  And branch_taken() is called
in emulate_step().  This disallows kprobes on both of them.
Signed-off-by: NPaul Mackerras <paulus@samba.org>

If mmiowb() is always used prior to releasing spinlock as Doc suggests,
then it's safe against preemption; but I'm not convinced that's always
the case.  If preemption occurs between sync and get_paca()->io_sync = 0,
I believe there's no problem.  But in the unlikely event that gcc does
the store relative to another register than r13 (as it did with current),
then there's a small danger of setting another cpu's io_sync to 0, after
it had just set it to 1.  Rewrite ppc64 mmiowb to prevent that.

The remaining io_sync assignments in io.h all get_paca()->io_sync = 1,
which is harmless even if preempted to the wrong cpu (the context switch
itself syncs); and those in spinlock.h are while preemption is disabled.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Checking source for other get_paca()->field preemption dangers found that
open_high_hpage_areas does a structure copy into its paca while preemption
is enabled: unsafe however gcc accomplishes it.  Just remove that copy:
it's done safely afterwards by on_each_cpu, as in open_low_hpage_areas.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Acked-by: NDavid Gibson <dwg@au1.ibm.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Repeated -j20 kernel builds on a G5 Quad running an SMP PREEMPT kernel
would often collapse within a day, some exec failing with "Bad address".
In each case examined, load_elf_binary was doing a kernel_read, but
generic_file_aio_read's access_ok saw current->thread.fs.seg as USER_DS
instead of KERNEL_DS.

objdump of filemap.o shows gcc 4.1.0 emitting "mr r5,r13 ... ld r9,416(r5)"
here for get_paca()->__current, instead of the expected and much more usual
"ld r9,416(r13)"; I've seen other gcc4s do the same, but perhaps not gcc3s.

So, if the task is preempted and rescheduled on a different cpu in between
the mr and the ld, r5 will be looking at a different paca_struct from the
one it's now on, pick up the wrong __current, and perhaps the wrong seg.
Presumably much worse could happen elsewhere, though that split is rare.

Other architectures appear to be safe (x86_64's read_pda is more limiting
than get_paca), but ppc64 needs to force "current" into one instruction.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Changed qe_issue_cmd() to write cmd_input to the CECDR unmodified.  It
was treating cmd_input as a virtual address and tried to convert it to
a physical address.
Signed-off-by: NTimur Tabi <timur@freescale.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The 10Gigabit ethernet device drivers appear to be able to chew
up all 256MB of TCE mappings on pSeries systems, as evidenced by
numerous error messages:

 iommu_alloc failed, tbl c0000000010d5c48 vaddr c0000000d875eff0 npages 1

Some experimentation indicates that this is essentially because
one 1500 byte ethernet MTU gets mapped as a 64K DMA region when
the large 64K pages are enabled. Thus, it doesn't take much to
exhaust all of the available DMA mappings for a high-speed card.

This patch changes the iommu allocator to work with its own
unique, distinct page size. Although the patch is long, its
actually quite simple: it just #defines a distinct IOMMU_PAGE_SIZE
and then uses this in all the places that matter.

As a side effect, it also dramatically improves network performance
on platforms with H-calls on iommu translation inserts/removes (since
we no longer call it 16 times for a 1500 bytes packet when the iommu HW
is still 4k).

In the future, we might want to make the IOMMU_PAGE_SIZE a variable
in the iommu_table instance, thus allowing support for different HW
page sizes in the iommu itself.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: NOlof Johansson <olof@lixom.net>
Acked-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Fixed a compile error in building the 85xx support with oprofile, and in
the process cleaned up some issues with the fsl_booke performance monitor
code.

* Reorganized FSL Book-E performance monitoring code so that the 7450
  wouldn't be built if the e500 was, and cleaned it up so it was more
  self-contained.

* Added a cpu_setup function for FSL Book-E.  The original
  cpu_setup function prototype had no arguments, assuming that
  the reg_setup function would copy the required information into
  variables which represented the registers.  This was silly for
  e500, since it has 1 register per counter (rather than 3 for
  all counters), so the code has been restructured to have
  cpu_setup take the current counter config array as an argument,
  with op_powerpc_setup() invoking op_powerpc_cpu_setup() through
  on_each_cpu(), and op_powerpc_cpu_setup() invoking the
  model-specific cpu_setup function with an argument.  The
  argument is ignored on all other platforms at present.

* Fixed a confusing line where a trinary operator only had two
  arguments
Signed-off-by: NAndrew Fleming <afleming@freescale.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The e500 core generates an illegal instruction exception when it tries
to execute the lwsync instruction, which we currently use for rmb().
This fixes it by using the LWSYNC macro, which turns into a plain sync
on 32-bit machines.
Signed-off-by: NAndrew Fleming <afleming@freescale.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

This patch fixes a few issues in offb:

 - A test was inverted causing the palette hack to never work
(no device node was passed down to the init function)

 - Some cards seem to have their assigned-addresses property in a random
order, thus we need to try using of_get_pci_address() first, which will
fail if it's not a PCI device, and fallback to of_get_address() in that
case. of_get_pci_address() properly parsees assigned-addresses to test
the BAR number and thus will get it right whatever the order is.

 - Some cards (like GXT4500) provide a linebytes of 0xffffffff in the
device-tree which does no good. This patch handles that by using the
screen width when that happens. (Also fixes btext.c while at it).

 - Add detection of the GXT4500 in addition to the GXT2000 for the
palette hacks (we use the same hack, palette is linear in register space
at offset 0x6000).
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

ICH7M was separated from ICH6M to allow undocumented MAP value 01b
which was spotted on an ASUS notebook.  However, there is also
notebooks with MAP value 01b on ICH6M.  This patch re-merges ICH6M and
ICH7M entries and allows MAP value 01b for both.

This problem has been reported and initial patch provided by Jonathan
Dieter.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Jonathan Dieter <jdieter@gmail.com>
Cc: Tom Deblauwe <tom.deblauwe@telenet.be>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

ata_dev_revalidate() isn't used outside of libata core.  Unexport it.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Hi Jeff,

I tested the PATA support on my old VAIO notebook, and it failed to find
my piix device:

00:07.1 Class 0101: 8086:7111 (rev 01) (prog-if 80 [Master])
        Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop-
ParErr- Stepping- SERR- FastB2B-
        Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-
<TAbort- <MAbort- >SERR- <PERR-
        Latency: 64
        Region 4: I/O ports at fc90 [size=16]

This patch adds the pci id to ata_piix.c and things then work as
expected.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

sis_init_one() modifies probe_ent->port_flags after allocating and
initializing it using ata_pci_init_native_mode().  This makes port_flags
for the secondary port (probe_ent->pinfo2->flags) go out of sync resulting
in misdetection of device due to incorrectly initialized SCR access flag.

This patch make probe_ent alloc/init happen after the final port flags
value is determined.  This is fragile but probe_ent and all the related
mess are scheduled to go away soon for exactly this reason.  We just need
to hold everything together till then.

This has been spotted and diagnosed and tested by Patrick McHardy.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Patric McHardy <kaber@trash.net>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The sky2 driver uses a single NAPI poll routine for both ports on dual ported
cards (because there is a single IRQ and status ring). Netpoll makes assumptions
about the relationship between network device and NAPI that aren't correct
on the second port, this will cause the port to never clear work.

Most systems, just have single port, so not a big issue.
The easy fix is just make the second port, not netpoll capable.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

I don't want my code to downgraded to GPLv3 because of
cut-n-pasted the comments. These files which I hold copyright
on were started before it was clear what GPLv3 was going to be.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Checks for NULL dev_alloc_skb() and returns on true to avoid subsequent
dereference.

Cc: Jeff Garzik <jgarzik@pobox.com>
Cc: Christoph Hellwig <hch@infrared.org>
Signed-off-by: NDavid Rientjes <rientjes@cs.washington.edu>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch fixes kzalloc parameters (GFP_ATOMIC instead of GFP_KERNEL)
Signed-off-by: NJan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

No need to keep defining PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE
in the driver code since it is now defined in pci_ids.h.
Signed-off-by: NBrice Goglin <brice@myri.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>