Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (54 commits)
  glge: remove unused #include <version.h>
  dnet: remove unused #include <version.h>
  tcp: miscounts due to tcp_fragment pcount reset
  tcp: add helper for counter tweaking due mid-wq change
  hso: fix for the 'invalid frame length' messages
  hso: fix for crash when unplugging the device
  fsl_pq_mdio: Fix compile failure
  fsl_pq_mdio: Revive UCC MDIO support
  ucc_geth: Pass proper device to DMA routines, otherwise oops happens
  i.MX31: Fixing cs89x0 network building to i.MX31ADS
  tc35815: Fix build error if NAPI enabled
  hso: add Vendor/Product ID's for new devices
  ucc_geth: Remove unused header
  gianfar: Remove unused header
  kaweth: Fix locking to be SMP-safe
  net: allow multiple dev per napi with GRO
  r8169: reset IntrStatus after chip reset
  ixgbe: Fix potential memory leak/driver panic issue while setting up Tx & Rx ring parameters
  ixgbe: fix ethtool -A|a behavior
  ixgbe: Patch to fix driver panic while freeing up tx & rx resources
  ...

4 files changed, 46 insertions, 40 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 35c5f6a5cb7c..5ba533d234db 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -253,7 +253,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
 
-        rcu_read_lock();
+        rcu_read_lock_bh();
         private = rcu_dereference(table->private);
         table_base = rcu_dereference(private->entries[smp_processor_id()]);
 
@@ -329,7 +329,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                 }
         } while (!hotdrop);
 
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
         if (hotdrop)
                 return NF_DROP;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 82ee7c9049ff..810c0b62c7d4 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -339,7 +339,7 @@ ipt_do_table(struct sk_buff *skb,
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 
-        rcu_read_lock();
+        rcu_read_lock_bh();
         private = rcu_dereference(table->private);
         table_base = rcu_dereference(private->entries[smp_processor_id()]);
 
@@ -437,7 +437,7 @@ ipt_do_table(struct sk_buff *skb,
                 }
         } while (!hotdrop);
 
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2451aeb5ac23..fafbec8b073e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1081,8 +1081,7 @@ out_err:
  *      this, no blocking and very strange errors 8)
  */
 
-static int tcp_recv_urg(struct sock *sk, long timeo,
-                        struct msghdr *msg, int len, int flags)
+static int tcp_recv_urg(struct sock *sk, struct msghdr *msg, int len, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -1697,7 +1696,7 @@ out:
         return err;
 
 recv_urg:
-        err = tcp_recv_urg(sk, timeo, msg, len, flags);
+        err = tcp_recv_urg(sk, msg, len, flags);
         goto out;
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c1f259d2d33b..53300fa2359f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -754,6 +754,36 @@ static void tcp_adjust_fackets_out(struct sock *sk, struct sk_buff *skb,
                 tp->fackets_out -= decr;
 }
 
+/* Pcount in the middle of the write queue got changed, we need to do various
+ * tweaks to fix counters
+ */
+static void tcp_adjust_pcount(struct sock *sk, struct sk_buff *skb, int decr)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        tp->packets_out -= decr;
+
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                tp->sacked_out -= decr;
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
+                tp->retrans_out -= decr;
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
+                tp->lost_out -= decr;
+
+        /* Reno case is special. Sigh... */
+        if (tcp_is_reno(tp) && decr > 0)
+                tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
+
+        tcp_adjust_fackets_out(sk, skb, decr);
+
+        if (tp->lost_skb_hint &&
+            before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
+            (tcp_is_fack(tp) || TCP_SKB_CB(skb)->sacked))
+                tp->lost_cnt_hint -= decr;
+
+        tcp_verify_left_out(tp);
+}
+
 /* Function to create two new TCP segments.  Shrinks the given segment
  * to the specified size and appends a new segment with the rest of the
  * packet to the list.  This won't be called frequently, I hope.
@@ -836,28 +866,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
                 int diff = old_factor - tcp_skb_pcount(skb) -
                         tcp_skb_pcount(buff);
 
-                tp->packets_out -= diff;
-
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
-                        tp->sacked_out -= diff;
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
-                        tp->retrans_out -= diff;
-
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
-                        tp->lost_out -= diff;
-
-                /* Adjust Reno SACK estimate. */
-                if (tcp_is_reno(tp) && diff > 0) {
-                        tcp_dec_pcount_approx_int(&tp->sacked_out, diff);
-                        tcp_verify_left_out(tp);
-                }
-                tcp_adjust_fackets_out(sk, skb, diff);
-
-                if (tp->lost_skb_hint &&
-                    before(TCP_SKB_CB(skb)->seq,
-                           TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
-                    (tcp_is_fack(tp) || TCP_SKB_CB(skb)->sacked))
-                        tp->lost_cnt_hint -= diff;
+                if (diff)
+                        tcp_adjust_pcount(sk, skb, diff);
         }
 
         /* Link BUFF into the send queue. */
@@ -1768,22 +1778,14 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
          * packet counting does not break.
          */
         TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
-        if (TCP_SKB_CB(next_skb)->sacked & TCPCB_SACKED_RETRANS)
-                tp->retrans_out -= tcp_skb_pcount(next_skb);
-        if (TCP_SKB_CB(next_skb)->sacked & TCPCB_LOST)
-                tp->lost_out -= tcp_skb_pcount(next_skb);
-        /* Reno case is special. Sigh... */
-        if (tcp_is_reno(tp) && tp->sacked_out)
-                tcp_dec_pcount_approx(&tp->sacked_out, next_skb);
-
-        tcp_adjust_fackets_out(sk, next_skb, tcp_skb_pcount(next_skb));
-        tp->packets_out -= tcp_skb_pcount(next_skb);
 
         /* changed transmit queue under us so clear hints */
         tcp_clear_retrans_hints_partial(tp);
         if (next_skb == tp->retransmit_skb_hint)
                 tp->retransmit_skb_hint = skb;
 
+        tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
+
         sk_wmem_free_skb(sk, next_skb);
 }
 
@@ -1891,7 +1893,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
         } else {
-                tcp_init_tso_segs(sk, skb, cur_mss);
+                int oldpcount = tcp_skb_pcount(skb);
+
+                if (unlikely(oldpcount > 1)) {
+                        tcp_init_tso_segs(sk, skb, cur_mss);
+                        tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
+                }
         }
 
         tcp_retrans_try_collapse(sk, skb, cur_mss);