The existing code had the following race:

Thread-1                       Thread-2

inc/read in_use
                               inc/read in_use
inc tx_free_list[qos].len
                               inc tx_free_list[qos].len

The actual in_use value was incremented twice, but thread-1 is going
to free memory based on its stale value, and will free one too many
times.  The result is that memory is freed back to the kernel while
its packet is still in the transmit buffer.  If the memory is
overwritten before it is transmitted, the hardware will put a valid
checksum on it and send it out (just like it does with good packets).
If by chance the TCP flags are clobbered but not the addresses or
ports, the result can be a broken TCP stream.

The fix is to track the number of freed packets in a single location
(a Fetch-and-Add Unit register).  That way it can never get out of sync
with itself.

We try to free up to MAX_SKB_TO_FREE (currently 10) buffers at a time.
If fewer are available we adjust the free count with the difference.
The action of claiming buffers to free is atomic so two threads cannot
claim the same buffers.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Convert the driver to use net_device_ops as it is now mandatory.

Also compensate for the removal of struct sk_buff's dst field.

The changes are mostly mechanical, the content of ethernet-common.c
was moved to ethernet.c and ethernet-common.{c,h} are removed.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Thanks to Cavium Inc. for the code contribution and help.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The SMP implementation of suspend and hibernate depends on CPU hotplugging.
In the past we didn't have CPU hotplug so suspend and hibernation were not
possible on SMP systems.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Each platform has to add support for CPU hotplugging itself by providing
suitable definitions for the cpu_disable and cpu_die of the smp_ops
methods and setting SYS_SUPPORTS_HOTPLUG_CPU.  A platform should only set
SYS_SUPPORTS_HOTPLUG_CPU once all it's smp_ops definitions have the
necessary changes.  This patch contains the changes to the dummy smp_ops
definition for uni-processor systems.

Parts of the code contributed by Cavium Inc.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This patch does not change actual behaviour since dma_unmap_page is just
an alias of dma_unmap_single on MIPS.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Cc: Ralf Baechle <ralf@linux-mips.org>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This fixes kernel.org bugzilla 13596, see
http://bugzilla.kernel.org/show_bug.cgi?id=13596

Reported-by: dvice_null@yahoo.com
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This fixes kernel.org bugzilla 13595, see
http://bugzilla.kernel.org/show_bug.cgi?id=13595

Reported-by: dvice_null@yahoo.com
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

We can't perform any flushes on SMP from swsusp_arch_resume because
interrupts are disabled.  A cross-CPU flush is unnecessary anyway
because all but the local CPU have already been disabled.  A local
flush is not needed either because we didn't change any mappings.  So
just delete the code.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Some of the were relying into smp.h being dragged in by another header
which of course is fragile.  <asm/cpu-info.h> uses smp_processor_id()
only in macros and including smp.h there leads to an include loop, so
don't change cpu-info.h.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

In the past this file somehow used to be dragged in.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

On bootup nvidiafb prints the following on my Apple G5:

	nvidiafb: CRTC 1appears to have a CRT attached

There should be a space between the '1' and the 'appears'.  Add it.
Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix the incorrect "select" directives by dropping the "CONFIG_"
prefixes, and correcting the typo "H8S2768" to "H8S2678".
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Acked-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

After downing/upping a cpu, an attempt to set
/proc/sys/vm/percpu_pagelist_fraction results in an oops in
percpu_pagelist_fraction_sysctl_handler().

If a processor is downed then we need to set the pageset pointer back to
the boot pageset.

Updates of the high water marks should not access pagesets of unpopulated
zones (those pointer go to the boot pagesets which would be no longer
functional if their size would be increased beyond zero).
Signed-off-by: Dimitri Sivanich <sivanich@sgi.com>
Signed-off-by: Christoph Lameter <cl@linux-foundation.org>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

After the recent changes that went into mm/vmscan.c to overhaul stuff, we
ended up with these warnings on no-mmu systems:

  mm/vmscan.c: In function `shrink_page_list':
  mm/vmscan.c:580: warning: unused variable `vm_flags'
  mm/vmscan.c: In function `shrink_active_list':
  mm/vmscan.c:1294: warning: `vm_flags' may be used uninitialized in this function
  mm/vmscan.c:1242: note: `vm_flags' was declared here

This is because the no-mmu function defines page_referenced() to work on
the first argument only (the page).  It does not clear the vm_flags given
to it because for no-mmu systems, they never actually get utilized.  Since
that is no longer strictly true, we need to set vm_flags to 0 like
everyone else so gcc can do proper dead code elimination without annoying
us with unused warnings.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Cc: David Howells <dhowells@redhat.com>
Acked-by: David McCullough <davidm@snapgear.com>
Cc: Greg Ungerer <gerg@uclinux.org>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

If a kthread happens to use get_user_pages() on an mm (as KSM does),
there's a chance that it will end up trying to read in a swap page, then
oops in grab_swap_token() because the kthread has no mm: GUP passes down
the right mm, so grab_swap_token() ought to be using it.

We have not identified a stronger case than KSM's daemon (not yet in
mainline), but the issue must have come up before, since RHEL has included
a fix for this for years (though a different fix, they just back out of
grab_swap_token if current->mm is unset: which is what we first proposed,
but using the right mm here seems more correct).
Reported-by: Izik Eidus <ieidus@redhat.com>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Acked-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: Fix up HAVE_PERF_COUNTERS typo.
  sh: Fix up more dma-mapping fallout.
  sh: SH7786 SMP support.
  sh: Wire up the uncached fixmap on sh64 as well.
  sh: Use local TLB flush in set_pte_phys().
  sh: Provide cpu_idle_wait() to fix up cpuidle/SMP build.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  RDMA: Add __init/__exit macros to addr.c and cma.c
  IB/ehca: Bump version number
  mlx4_core: Fix dma_sync_single_for_cpu() with matching for_device() calls
  IB/mthca: Replace dma_sync_single() use with proper functions
  RDMA/nes: Fix FIN state handling under error conditions
  RDMA/nes: Fix max_qp_init_rd_atom returned from query device
  IB/ehca: Ensure that guid_entry index is not negative
  IB/ehca: Tolerate dynamic memory operations before driver load

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (38 commits)
  fusion: mptsas, fix lock imbalance
  [SCSI] scsi_transport_fc: replace BUS_ID_SIZE by fixed count
  sd, sr: fix Driver 'sd' needs updating message
  scsi_transport_iscsi: return -EOVERFLOW for Too many iscsi targets
  fc_transport: Selective return value from BSG timeout function
  fc_transport: The softirq_done function registration for BSG request
  sym53c8xx: ratelimit parity errors
  explain the hidden scsi_wait_scan Kconfig variable
  ibmvfc: Fix endless PRLI loop in discovery
  ibmvfc: Process async events before command responses
  libfc: Add runtime debugging with debug_logging module parameter
  libfcoe: Add runtime debugging with module param debug_logging
  fcoe: Add runtime debug logging with module parameter debug_logging
  scsi_debug: Add support for physical block exponent and alignment
  cnic: add NETDEV_1000 and NETDEVICES to Kconfig select
  cnic: Fix __symbol_get() build error.
  Revert "[SCSI] cnic: fix error: implicit declaration of function ‘__symbol_get’"
  ipr: differentiate pci-x and pci-e based adapters
  ipr: add test for MSI interrupt support
  scsi_transport_spi: Blacklist Ultrium-3 tape for IU transfers
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  asm-generic: add dummy pgprot_noncached()
  lib/checksum.c: fix endianess bug
  asm-generic: hook up new system calls
  asm-generic: list Arnd as asm-generic maintainer
  asm-generic: drop HARDIRQ_BITS definition from hardirq.h
  asm-generic: uaccess: fix up local access_ok() usage
  asm-generic: uaccess: add missing access_ok() check to strnlen_user()

* 'kmemleak' of git://linux-arm.org/linux-2.6:
  kmemleak: Do not force the slab debugging Kconfig options
  kmemleak: use pr_fmt

Indeed FOLL_WRITE matches FAULT_FLAG_WRITE, matches GUP_FLAGS_WRITE,
and it's tempting to devise a set of Grand Unified Paging flags;
but not today.  So until then, let's rely upon the compiler to spot
the coincidence, "rather than have that subtle dependency and a
comment for it" - as you remarked in another context yesterday.
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Acked-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

handle_mm_fault() is now passing fault flags rather than write_access
down to hugetlb_fault(), so better recognize that in hugetlb_fault(),
and in hugetlb_no_page().
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Acked-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://www.jni.nu/cris:
  CRISv10: remove redundant tests on unsigned
  CRISv32: irq.c - Move end brace outside #endif
  CRISv32: Fix potential null reference in cryptocop driver.
  CRISv32: Add arch optimized strcmp.
  CRIS: assignment/is equal confusion

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Make jack-plug notification selectable
  ALSA: ctxfi - Add PM support
  sound: seq_midi_event: fix decoding of (N)RPN events
  ALSA: hda - Add digital-mic support to ALC262 auto model
  ALSA: hda - Fix check of input source type for realtek codecs
  ALSA: hda - Add quirk for Sony VAIO Z21MN
  ALSA: hda - Get back Input Source for ALC262 toshiba-s06 model
  ALSA: hda - Fix unsigned comparison in patch_sigmatel.c
  ALSA: via82xx: add option to disable 500ms delay in snd_via82xx_codec_wait
  sound: fix check for return value in snd_pcm_hw_refine
  ALSA: ctxfi - Allow unknown PCI SSIDs
  ASoC: Blackfin: update the bf5xx_i2s_resume parameters
  ASoC: Blackfin: keep better track of SPORT configuration state

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] wdt_pci.c: remove #ifdef CONFIG_WDT_501_PCI
  [WATCHDOG] hpwdt: Add NMI priority option
  [WATCHDOG] OMAP fixes: enable clock in probe, trigger timer reload
  [WATCHDOG] add bcm47xx watchdog driver
  [WATCHDOG] Freescale STMP: watchdog driver
  [WATCHDOG] twl4030 watchdog driver
  [WATCHDOG] U300 COH 901 327 watchdog driver
  [WATCHDOG] Add pnx833x_wdt

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (62 commits)
  V4L/DVB (12131): BUGFIX: An incorrect Carrier Recovery Loop optimization table was being
  V4L/DVB (12130): Fix a redundant compiler warning
  V4L/DVB (12003): v4l2: Move bounding code outside I2C ifdef block
  V4L/DVB (11913): cx231xx: TRY_FMT should not actually set anything
  V4L/DVB (11912): em28xx: Use v4l bounding/alignment function
  V4L/DVB (11911): cx231xx: Use v4l bounding/alignment function
  V4L/DVB (11910): mt9: Use v4l bounding/alignment function
  V4L/DVB (11909): cx23885: Use v4l bounding/alignment function
  V4L/DVB (11908): w8968cf: Use v4l bounding/alignment function
  V4L/DVB (11907): cx88: Use v4l bounding/alignment function
  V4L/DVB (11906): saa7134: Use v4l bounding/alignment function
  V4L/DVB (11905): vivi: Use v4l bounding/alignment function
  V4L/DVB (11904): zoran: Use v4l bounding/alignment functiob
  V4L/DVB (11903): sh_mobile_ceu_camera: Use v4l bounding/alignment function
  V4L/DVB (11902): pxa-camera: Use v4l bounding/alignment function
  V4L/DVB (11901): v4l2: Create helper function for bounding and aligning images
  V4L/DVB (12128): v4l2: update framework documentation.
  V4L/DVB (12125): v4l2: add new s_config subdev ops and v4l2_i2c_new_subdev_cfg/board calls
  V4L/DVB (12122): pvrusb2: De-obfuscate code which handles routing schemes
  V4L/DVB (12121): pvrusb2: Improve handling of routing schemes
  ...

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: don't set IORDY for reset
  sata_fsl: Add power mgmt support
  [libata] PATA driver for CF interface on AT91SAM9260 SoC
  [libata] beautify module parameters

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6:
  ide cmd64x: Remove serialize setting.
  ide: Take over as maintainer.

Add __init and __exit annotations to the module_init/module_exit
functions from drivers/infiniband/core/addr.c and cma.c.
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Increment version number for DMEM toleration.
Signed-off-by: Alexander Schmidt <alexs@linux.vnet.ibm.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The isolated page is "cursor_page" not "page".

This could cause LRU list corruption under memory pressure, caught by
CONFIG_DEBUG_LIST.
Reported-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Reviewed-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Tested-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

That's HAVE_PERF_COUNTERS not HAVE_PERF_COUNTER. This was right
initially but I seem to have screwed it up while re-typing it out
by hand on another machine when I checked it in. Hmph.
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Selecting DEBUG_SLAB or SLUB_DEBUG by the KMEMLEAK menu entry may cause
issues with other dependencies (KMEMCHECK). These configuration options
aren't strictly needed by kmemleak but they may increase the chances of
finding leaks. This patch also updates the KMEMLEAK config entry help
text.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Pekka Enberg <penberg@cs.helsinki.fi>

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Most architectures now provide a pgprot_noncached(), the
remaining ones can simply use an dummy default implementation,
except for cris and xtensa, which should override the
default appropriately.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Chris Zankel <chris@zankel.net>
Cc: Magnus Damm <magnus.damm@gmail.com>

commit dbe6f186
("dma-mapping: mark dma_sync_single and dma_sync_sg as deprecated"
conveniently broke every single SH build.

In the future it would be great if people could at least bother
figuring out how to use grep.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

SH7786 is roughly identical to SH-X3 proto SMP, though there are only 2
CPUs. This just wraps in to the existing SH-X3 SMP code with some minor
changes for SH7786, including wiring up the IPIs properly, enabling
IRQ_PER_CPU, and so forth.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Now that sh64 also can use the uncached section, wire up the fixmap for
it as well.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>