* 'splice-2.6.22' of git://git.kernel.dk/data/git/linux-2.6-block:
  splice: only check do_wakeup in splice_to_pipe() for a real pipe
  splice: fix leak of pages on short splice to pipe
  splice: adjust balance_dirty_pages_ratelimited() call

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
  KVM: Prevent guest fpu state from leaking into the host

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix builds where MSC01E_xxx is undefined.
  [MIPS] Separate performance counter interrupts
  [MIPS] Malta: Fix for SOCitSC based Maltas

* 'for-linus' of git://www.atmel.no/~hskinnemoen/linux/kernel/avr32:
  [AVR32] Define ARCH_KMALLOC_MINALIGN to L1_CACHE_BYTES
  [AVR32] STK1000: Set SPI_MODE_3 in the ltv350qv board info
  [AVR32] gpio_*_cansleep() fix
  [AVR32] ratelimit segfault reporting rate

SCSI marks internal commands with REQ_PREEMPT and push it at the front
of the request queue using blk_execute_rq().  When entering suspended
or frozen state, SCSI devices are quiesced using
scsi_device_quiesce().  In quiesced state, only REQ_PREEMPT requests
are processed.  This is how SCSI blocks other requests out while
suspending and resuming.  As all internal commands are pushed at the
front of the queue, this usually works.

Unfortunately, this interacts badly with ordered requeueing.  To
preserve request order on requeueing (due to busy device, active EH or
other failures), requests are sorted according to ordered sequence on
requeue if IO barrier is in progress.

The following sequence deadlocks.

1. IO barrier sequence issues.

2. Suspend requested.  Queue is quiesced with part or all of IO
   barrier sequence at the front.

3. During suspending or resuming, SCSI issues internal command which
   gets deferred and requeued for some reason.  As the command is
   issued after the IO barrier in #1, ordered requeueing code puts the
   request after IO barrier sequence.

4. The device is ready to process requests again but still is in
   quiesced state and the first request of the queue isn't
   REQ_PREEMPT, so command processing is deadlocked -
   suspending/resuming waits for the issued request to complete while
   the request can't be processed till device is put back into
   running state by resuming.

This can be fixed by always putting !fs requests at the front when
requeueing.

The following thread reports this deadlock.

  http://thread.gmane.org/gmane.linux.kernel/537473Signed-off-by: NTejun Heo <htejun@gmail.com>
Acked-by: NDavid Greaves <david@dgreaves.com>
Acked-by: NJeff Garzik <jeff@garzik.org>
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix console output getting dropped on platforms without udbg_putc
  [POWERPC] Fix per-cpu allocation on oldworld SMP powermacs

We only ever set do_wakeup to non-zero if the pipe has an inode
backing, so it's pointless to check outside the pipe->inode
check.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

If the destination pipe is full and we already transferred
data, we break out instead of waiting for more pipe room.
The exit logic looks at spd->nr_pages to see if we moved
everything inside the spd container, but we decrement that
variable in the loop to decide when spd has emptied.

Instead we want to compare to the original page count in
the spd, so cache that in a local variable.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

As we have potentially dirtied more than 1 page, we should indicate as
such to the dirty page balancing. So call
balance_dirty_pages_ratelimited_nr() and pass in the approximate number
of pages we dirtied.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

The lazy fpu changes did not take into account that some vmexit handlers
can sleep.  Move loading the guest state into the inner loop so that it
can be reloaded if necessary, and move loading the host state into
vmx_vcpu_put() so it can be performed whenever we relinquish the vcpu.
Signed-off-by: NAvi Kivity <avi@qumranet.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fix:
  kbuild: fix sh64 section mismatch problems

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: fix radeon setparam on 32/64 bit systems.
  drm/i915:  Add support for the G33, Q33, and Q35 chipsets.
  i915: add new pciids for 945GME, 965GME/GLE

* master.kernel.org:/pub/scm/linux/kernel/git/kyle/parisc-2.6: (30 commits)
  [PARISC] remove global_ack_eiem
  [PARISC] Fix kernel panic in check_ivt
  [PARISC] Fix bug when syscall nr is __NR_Linux_syscalls
  [PARISC] be more defensive in process.c::get_wchan
  [PARISC] fix "reduce size of task_struct on 64-bit machines" fallout
  [PARISC] fix null ptr deref in unwind.c
  [PARISC] fix trivial spelling nit in asm/linkage.h
  [PARISC] remove remnants of parisc-specific softirq code
  [PARISC] fix section mismatch in smp.c
  [PARISC] fix "ENTRY" macro redefinition
  [PARISC] Wire up utimensat/signalfd/timerfd/eventfd syscalls
  [PARISC] fix section mismatch in superio serial drivers
  [PARISC] fix section mismatch in parisc eisa driver
  [PARISC] fix section mismatches in arch/parisc/kernel
  [PARISC] fix section mismatch in ccio-dma
  [PARISC] fix section mismatch in parisc STI video drivers
  [PARISC] fix section mismatch in parport_gsc
  [PARISC] fix lasi_82596 build
  [PARISC] Build fixes for power.c
  [PARISC] kobject is embedded in subsys, not kset
  ...

* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
  [AGPGART] intel_agp: fix device probe

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix args to sun4v_ldc_revoke().
  [SPARC64]: Really fix parport.
  [SPARC64]: Fix IO/MEM space sizing for PCI.
  [SPARC64]: Wire up cookie based sun4v interrupt registry.

This patch trys to fix device probe in two cases. First we should
correctly detect device if integrated graphics device is not enabled
or exists, like an add-in card is plugged. Second on some type of intel
GMCH, it might have multiple graphic chip models, like 945GME case, so
we should be sure the detect works through the whole table.
Signed-off-by: NWang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: NDave Jones <davej@redhat.com>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV6] addrconf: Fix IPv6 on tuntap tunnels
  [TCP]: Add missing break to TCP option parsing code
  [SCTP] Don't disable PMTU discovery when mtu is small
  [SCTP] Flag a pmtu change request
  [SCTP] Update pmtu handling to be similar to tcp
  [SCTP] Fix leak in sctp_getsockopt_local_addrs when copy_to_user fails
  [SCTP]: Allow unspecified port in sctp_bindx()
  [SCTP]: Correctly set daddr for IPv6 sockets during peeloff
  [TCP]: Set initial_ssthresh default to zero in Cubic and BIC.
  [TCP]: Fix left_out setting during FRTO
  [TCP]: Disable TSO if MD5SIG is enabled.
  [PPP_MPPE]: Fix "osize too small" check.
  [PATCH] mac80211: Don't stop tx queue on master device while scanning.
  [PATCH] mac80211: fix debugfs tx power reduction output
  [PATCH] cfg80211: fix signed macaddress in sysfs
  [IrDA]: f-timer reloading when sending rejected frames.
  [IrDA]: Fix Rx/Tx path race.

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4445/1: ANUBIS: Fix CPLD registers
  [ARM] 4444/2: OSIRIS: CPLD suspend fix
  [ARM] 4443/1: OSIRIS: Add watchdog device to machine devices
  [ARM] 4442/1: OSIRIS: Fix CPLD register definitions
  [ARM] VFP: fix section mismatch error

The recent patch that added ipv6_hwtype is broken on tuntap tunnels.
Indeed, it's broken on any device that does not pass the ipv6_hwtype
test.

The reason is that the original test only applies to autoconfiguration,
not IPv6 support.  IPv6 support is allowed on any device.  In fact,
even with the ipv6_hwtype patch applied you can still add IPv6 addresses
to any interface that doesn't pass thw ipv6_hwtype test provided that
they have a sufficiently large MTU.  This is a serious problem because
come deregistration time these devices won't be cleaned up properly.

I've gone back and looked at the rationale for the patch.  It appears
that the real problem is that we were creating IPv6 devices even if the
MTU was too small.  So here's a patch which fixes that and reverts the
ipv6_hwtype stuff.

Thanks to Kanru Chen for reporting this issue.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This flaw does not affect any behavior (currently).
Signed-off-by: NIlpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NChris Dearman <chris@mips.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Support for performance counter overflow interrupt that is on a separate
interrupt from the timer.
Signed-off-by: NChris Dearman <chris@mips.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

And an attempt to tidy up the core/controller differences.
Signed-off-by: NChris Dearman <chris@mips.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

This allows SLUB debugging to be used without fear of messing up DMA
transfers. SPI is one example that easily breaks without this patch.
Signed-off-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>

In the latest incarnation of the ltv350qv driver the call to
spi_setup() has been removed. So we need to initialize things more
carefully in the board info struct.
Signed-off-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>

The AVR32 <asm/gpio.h> was missing the gpio_*_cansleep() calls,
breaking compilation for some code using them.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>

Limit the rate of the kernel logging for the segfaults of user
applications, to avoid potential message floods or denial-of-service
attacks.
Signed-off-by: NAndrea Righi <a.righi@cineca.it>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>

Previously, registering this early console would just result
in dropping early buffered printk output until a udbg_putc
was registered.

However, commit 69331af7
clears the CON_PRINTBUFFER flag on the main console when a
CON_BOOT (early) console has been registered, resulting in
the buffered messages never being displayed to the user.

This fixes the problem by making sure we don't register udbg_console
on platforms that don't implement udbg_putc.
Signed-off-by: NMilton Miller <miltonm@bga.com>
Acked-by: NMark A. Greer <mgreer@mvista.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The per-cpu area(a) for the secondary CPU(s) isn't getting allocated
on old SMP powermacs that don't have the secondary CPU(s) listed in
the device tree, as per-cpu areas are now only allocated for CPUs in
the cpu_possible_map, and we aren't setting the bits for the secondary
CPU(s) until smp_prepare_cpus(), which is after per-cpu allocation.
Therefore this sets the bits for CPUs 1..3 in cpu_possible_map in
pmac_setup_arch, so they get per-cpu data allocated.
Signed-off-by: NPaul Mackerras <paulus@samba.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: move input-polldev to drivers/input
  Input: i8042 - add ULI EV4873 to noloop list
  Input: i8042 - add ASUS P65UP5 to the noloop list
  Input: usbtouchscreen - fix fallout caused by move from drivers/usb

Right now, when we receive a mtu estimate smaller then minim
threshold in the ICMP message, we disable the path mtu discovery
on the transport.  This leads to the never increasing sctp fragmentation
point even when the real path mtu has increased.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

Currently, if the socket is owned by the user, we drop the ICMP
message.  As a result SCTP forgets that path MTU changed and
never adjusting it's estimate.  This causes all subsequent
packets to be fragmented.  With this patch, we'll flag the association
that it needs to udpate it's estimate based on the already updated
routing information.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NSridhar Samudrala <sri@us.ibm.com>

Introduce new function sctp_transport_update_pmtu that updates
the transports and destination caches view of the path mtu.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NSridhar Samudrala <sri@us.ibm.com>

If the copy_to_user or copy_user calls fail in sctp_getsockopt_local_addrs(),
the function should free locally allocated storage before returning error.
Spotted by Coverity.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NSridhar Samudrala <sri@us.ibm.com>

Allow sctp_bindx() to accept multiple address with
unspecified port.  In this case, all addresses inherit
the first bound port.  We still catch full mis-matches.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NSridhar Samudrala <sri@us.ibm.com>

During peeloff of AF_INET6 socket, the inet6_sk(sk)->daddr
wasn't set correctly since the code was assuming IPv4 only.
Now we use a correct call to set the destination address.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NSridhar Samudrala <sri@us.ibm.com>

Somehow the code to read the read-only switch of SD cards got lost
in the reorganisation.
Signed-off-by: NPierre Ossman <drzeus@drzeus.cx>

Ignoring OMAP_MMC_STAT_CARD_ERR, treating it as if the command
completed correctly.
Signed-off-by: NRagner Magalhaes <ragner.magalhaes@indt.org.br>
Signed-off-by: NCarlos Eduardo Aguiar <carlos.aguiar@indt.org.br>
Signed-off-by: NPierre Ossman <drzeus@drzeus.cx>

Because of the current default of 100, Cubic and BIC perform very
poorly compared to standard Reno.

In the worst case, this change makes Cubic and BIC as aggressive as
Reno.  So this change should be very safe.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>