15 files changed, 107 insertions, 59 deletions

diff --git a/include/asm-frv/mem-layout.h b/include/asm-frv/mem-layout.h
index 83532252b8be..734a1d0583b6 100644
--- a/include/asm-frv/mem-layout.h
+++ b/include/asm-frv/mem-layout.h
@@ -60,7 +60,7 @@
  */
 #define BRK_BASE                        __UL(2 * 1024 * 1024 + PAGE_SIZE)
 #define STACK_TOP                       __UL(2 * 1024 * 1024)
-#define STACK_TOP_MAX   STACK_TOP
+#define STACK_TOP_MAX                   __UL(0xc0000000)
 
 /* userspace process size */
 #ifdef CONFIG_MMU
diff --git a/include/asm-frv/pgtable.h b/include/asm-frv/pgtable.h
index 6c0682ed5fc9..4e219046fe42 100644
--- a/include/asm-frv/pgtable.h
+++ b/include/asm-frv/pgtable.h
@@ -507,13 +507,22 @@ static inline int pte_file(pte_t pte)
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t pte)
 {
+        struct mm_struct *mm;
         unsigned long ampr;
-        pgd_t *pge = pgd_offset(current->mm, address);
-        pud_t *pue = pud_offset(pge, address);
-        pmd_t *pme = pmd_offset(pue, address);
 
-        ampr = pme->ste[0] & 0xffffff00;
-        ampr |= xAMPRx_L | xAMPRx_SS_16Kb | xAMPRx_S | xAMPRx_C | xAMPRx_V;
+        mm = current->mm;
+        if (mm) {
+                pgd_t *pge = pgd_offset(mm, address);
+                pud_t *pue = pud_offset(pge, address);
+                pmd_t *pme = pmd_offset(pue, address);
+
+                ampr = pme->ste[0] & 0xffffff00;
+                ampr |= xAMPRx_L | xAMPRx_SS_16Kb | xAMPRx_S | xAMPRx_C |
+                        xAMPRx_V;
+        } else {
+                address = ULONG_MAX;
+                ampr = 0;
+        }
 
         asm volatile("movgs %0,scr0\n"
                      "movgs %0,scr1\n"
diff --git a/include/asm-frv/spr-regs.h b/include/asm-frv/spr-regs.h
index c2a541ef828d..01e6af5e99b8 100644
--- a/include/asm-frv/spr-regs.h
+++ b/include/asm-frv/spr-regs.h
@@ -99,9 +99,23 @@
 #define TBR_TT_TRAP1            (0x81 << 4)
 #define TBR_TT_TRAP2            (0x82 << 4)
 #define TBR_TT_TRAP3            (0x83 << 4)
+#define TBR_TT_TRAP120          (0xf8 << 4)
+#define TBR_TT_TRAP121          (0xf9 << 4)
+#define TBR_TT_TRAP122          (0xfa << 4)
+#define TBR_TT_TRAP123          (0xfb << 4)
+#define TBR_TT_TRAP124          (0xfc << 4)
+#define TBR_TT_TRAP125          (0xfd << 4)
 #define TBR_TT_TRAP126          (0xfe << 4)
 #define TBR_TT_BREAK            (0xff << 4)
 
+#define TBR_TT_ATOMIC_CMPXCHG32 TBR_TT_TRAP120
+#define TBR_TT_ATOMIC_XCHG32    TBR_TT_TRAP121
+#define TBR_TT_ATOMIC_XOR       TBR_TT_TRAP122
+#define TBR_TT_ATOMIC_OR        TBR_TT_TRAP123
+#define TBR_TT_ATOMIC_AND       TBR_TT_TRAP124
+#define TBR_TT_ATOMIC_SUB       TBR_TT_TRAP125
+#define TBR_TT_ATOMIC_ADD       TBR_TT_TRAP126
+
 #define __get_TBR()     ({ unsigned long x; asm volatile("movsg tbr,%0" : "=r"(x)); x; })
 
 /*
diff --git a/include/asm-frv/system.h b/include/asm-frv/system.h
index 2c57f4734746..30a67a9da11a 100644
--- a/include/asm-frv/system.h
+++ b/include/asm-frv/system.h
@@ -179,14 +179,23 @@ do {							\
 #define mb()                    asm volatile ("membar" : : :"memory")
 #define rmb()                   asm volatile ("membar" : : :"memory")
 #define wmb()                   asm volatile ("membar" : : :"memory")
-#define set_mb(var, value)      do { var = value; mb(); } while (0)
+#define read_barrier_depends()  barrier()
 
-#define smp_mb()                mb()
-#define smp_rmb()               rmb()
-#define smp_wmb()               wmb()
-
-#define read_barrier_depends()          do {} while(0)
+#ifdef CONFIG_SMP
+#define smp_mb()                        mb()
+#define smp_rmb()                       rmb()
+#define smp_wmb()                       wmb()
 #define smp_read_barrier_depends()      read_barrier_depends()
+#define set_mb(var, value) \
+        do { xchg(&var, (value)); } while (0)
+#else
+#define smp_mb()                        barrier()
+#define smp_rmb()                       barrier()
+#define smp_wmb()                       barrier()
+#define smp_read_barrier_depends()      do {} while(0)
+#define set_mb(var, value) \
+        do { var = (value); barrier(); } while (0)
+#endif
 
 #define HARD_RESET_NOW()                        \
 do {                                            \
diff --git a/include/asm-x86/linkage.h b/include/asm-x86/linkage.h
index 31739c7d66a9..c048353f4b85 100644
--- a/include/asm-x86/linkage.h
+++ b/include/asm-x86/linkage.h
@@ -8,12 +8,45 @@
 
 #ifdef CONFIG_X86_32
 #define asmlinkage CPP_ASMLINKAGE __attribute__((regparm(0)))
-#define prevent_tail_call(ret) __asm__ ("" : "=r" (ret) : "0" (ret))
 /*
  * For 32-bit UML - mark functions implemented in assembly that use
  * regparm input parameters:
  */
 #define asmregparm __attribute__((regparm(3)))
+
+/*
+ * Make sure the compiler doesn't do anything stupid with the
+ * arguments on the stack - they are owned by the *caller*, not
+ * the callee. This just fools gcc into not spilling into them,
+ * and keeps it from doing tailcall recursion and/or using the
+ * stack slots for temporaries, since they are live and "used"
+ * all the way to the end of the function.
+ *
+ * NOTE! On x86-64, all the arguments are in registers, so this
+ * only matters on a 32-bit kernel.
+ */
+#define asmlinkage_protect(n, ret, args...) \
+        __asmlinkage_protect##n(ret, ##args)
+#define __asmlinkage_protect_n(ret, args...) \
+        __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
+#define __asmlinkage_protect0(ret) \
+        __asmlinkage_protect_n(ret)
+#define __asmlinkage_protect1(ret, arg1) \
+        __asmlinkage_protect_n(ret, "g" (arg1))
+#define __asmlinkage_protect2(ret, arg1, arg2) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2))
+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3))
+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4))
+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4), "g" (arg5))
+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4), "g" (arg5), "g" (arg6))
+
 #endif
 
 #ifdef CONFIG_X86_ALIGNMENT_16
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 9cdd12a9e843..cedbbd806bf6 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -86,6 +86,7 @@ header-y += if_plip.h
 header-y += if_ppp.h
 header-y += if_slip.h
 header-y += if_strip.h
+header-y += if_tun.h
 header-y += if_tunnel.h
 header-y += in6.h
 header-y += in_route.h
@@ -229,7 +230,6 @@ unifdef-y += if_link.h
 unifdef-y += if_pppol2tp.h
 unifdef-y += if_pppox.h
 unifdef-y += if_tr.h
-unifdef-y += if_tun.h
 unifdef-y += if_vlan.h
 unifdef-y += if_wanpipe.h
 unifdef-y += igmp.h
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 72f1c5f47be3..8c71fe2fb1f5 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -18,47 +18,8 @@
 #ifndef __IF_TUN_H
 #define __IF_TUN_H
 
-/* Uncomment to enable debugging */
-/* #define TUN_DEBUG 1 */
-
 #include <linux/types.h>
 
-#ifdef __KERNEL__
-
-#ifdef TUN_DEBUG
-#define DBG  if(tun->debug)printk
-#define DBG1 if(debug==2)printk
-#else
-#define DBG( a... )
-#define DBG1( a... )
-#endif
-
-struct tun_struct {
-        struct list_head        list;
-        unsigned long           flags;
-        int                     attached;
-        uid_t                   owner;
-        gid_t                   group;
-
-        wait_queue_head_t       read_wait;
-        struct sk_buff_head     readq;
-
-        struct net_device       *dev;
-
-        struct fasync_struct    *fasync;
-
-        unsigned long if_flags;
-        u8 dev_addr[ETH_ALEN];
-        u32 chr_filter[2];
-        u32 net_filter[2];
-
-#ifdef TUN_DEBUG        
-        int debug;
-#endif  
-};
-
-#endif /* __KERNEL__ */
-
 /* Read queue size */
 #define TUN_READQ_SIZE  500
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 4aaefc349a4b..134c8e5cf07c 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -53,7 +53,7 @@ struct ipv6_opt_hdr {
         /* 
          * TLV encoded option data follows.
          */
-};
+} __attribute__ ((packed));     /* required for some archs */
 
 #define ipv6_destopt_hdr ipv6_opt_hdr
 #define ipv6_hopopt_hdr  ipv6_opt_hdr
diff --git a/include/linux/linkage.h b/include/linux/linkage.h
index 0592936344c4..2119610b24f8 100644
--- a/include/linux/linkage.h
+++ b/include/linux/linkage.h
@@ -17,8 +17,24 @@
 # define asmregparm
 #endif
 
-#ifndef prevent_tail_call
-# define prevent_tail_call(ret) do { } while (0)
+/*
+ * This is used by architectures to keep arguments on the stack
+ * untouched by the compiler by keeping them live until the end.
+ * The argument stack may be owned by the assembly-language
+ * caller, not the callee, and gcc doesn't always understand
+ * that.
+ *
+ * We have the return value, and a maximum of six arguments.
+ *
+ * This should always be followed by a "return ret" for the
+ * protection to work (ie no more work that the compiler might
+ * end up needing stack temporaries for).
+ */
+/* Assembly files may be compiled with -traditional .. */
+#ifndef __ASSEMBLY__
+#ifndef asmlinkage_protect
+# define asmlinkage_protect(n, ret, args...)    do { } while (0)
+#endif
 #endif
 
 #ifndef __ALIGN
diff --git a/include/linux/pnp.h b/include/linux/pnp.h
index 29dd55838e84..b2f05c230f4b 100644
--- a/include/linux/pnp.h
+++ b/include/linux/pnp.h
@@ -175,7 +175,7 @@ static inline void pnp_set_card_drvdata(struct pnp_card_link *pcard, void *data)
 struct pnp_dev {
         struct device dev;              /* Driver Model device interface */
         u64 dma_mask;
-        unsigned char number;           /* used as an index, must be unique */
+        unsigned int number;            /* used as an index, must be unique */
         int status;
 
         struct list_head global_list;   /* node in global list of devices */
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 576a5f77d3bd..1129ee0a7180 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -341,6 +341,9 @@ static inline void double_spin_unlock(spinlock_t *l1, spinlock_t *l2,
  * atomic_dec_and_lock - lock on reaching reference count zero
  * @atomic: the atomic counter
  * @lock: the spinlock in question
+ *
+ * Decrements @atomic by 1.  If the result is 0, returns true and locks
+ * @lock.  Returns false for all other cases.
  */
 extern int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock);
 #define atomic_dec_and_lock(atomic, lock) \
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index ba33db053854..7040a782c656 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -47,7 +47,7 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
     } while (0)
 
 #define IP6_ECN_flow_xmit(sk, label) do {                               \
-        if (INET_ECN_is_capable(inet_sk(sk)->tos))                      \
+        if (INET_ECN_is_capable(inet6_sk(sk)->tclass))                  \
                 (label) |= htonl(INET_ECN_ECT_0 << 20);                 \
     } while (0)
 
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 10ae2da6f93b..35b1e83fb96a 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -104,6 +104,7 @@ typedef enum {
         SCTP_CMD_ADAPTATION_IND, /* generate and send adaptation event */
         SCTP_CMD_ASSOC_SHKEY,    /* generate the association shared keys */
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
+        SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 9bcfc12275e8..7ea12e8e6676 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -67,7 +67,7 @@ struct sctp_ulpevent {
 };
 
 /* Retrieve the skb this event sits inside of. */
-static inline struct sk_buff *sctp_event2skb(struct sctp_ulpevent *ev)
+static inline struct sk_buff *sctp_event2skb(const struct sctp_ulpevent *ev)
 {
         return container_of((void *)ev, struct sk_buff, cb);
 }
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 7de4ea3a04d9..4fd3eb2f8ec2 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -752,6 +752,8 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp)
         return tp->packets_out - tcp_left_out(tp) + tp->retrans_out;
 }
 
+extern int tcp_limit_reno_sacked(struct tcp_sock *tp);
+
 /* If cwnd > ssthresh, we may raise ssthresh to be half-way to cwnd.
  * The exception is rate halving phase, when cwnd is decreasing towards
  * ssthresh.