* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      [MIPS] Alchemy:  Fix PCI-memory access
  [MIPS] Fix N32 SysV IPC routines
  [MIPS] PNX8550: Fix system timer initialization

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  MMC: at91 mmc linkage updates
  ARM: OMAP: fix MMC workqueue changes

    
    The problem was introduced in 2.6.18.3 with the casting of some
    36bit-defines (PCI memory) in au1000.h to resource_size_t which may be
    u32 or u64 depending on the experimental CONFIG_RESOURCES_64BIT.
    
    With unset CONFIG_RESOURCES_64BIT, the pci-memory cannot be accessed
    because the ioremap in arch/mips/au1000/common/pci.c already used the
    truncated addresses.
    With set CONFIG_RESOURCES_64BIT, things get even worse, because PCI-scan
    aborts, due to resource conflict: request_resource() in arch/mips/pci/pci.c
    fails because the maximum iomem-address is 0xffffffff (32bit) but the
    pci-memory-start-address is 0x440000000 (36bit).
    
    To get pci working again, I propose the following patch:
    
    1. remove the resource_size_t-casting from au1000.h again
    2. make the casting in arch/mips/au1000/common/pci.c (it's allowed and
    necessary here. The 36bit-handling will be done in __fixup_bigphys_addr).
    
    With this patch pci works again like in 2.6.18.2, the gcc-compile warnings
    in pci.c are gone and it doesn't depend on CONFIG_EXPERIMENTAL.
Signed-off-by: Alexander Bigga <ab@mycable.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

---

Add wrappers for N32 msg{snd,rcv}.  compat_sys_msg{snd,rcv} can not not be
used as system call entries as is.  This fix is based on Kaz Kylheku's
patch.

Also change a type of last argument of sysn32_semctl to match its true
size.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Revert previous attempts at messing with the linux banner string and
simply use a separate format string for proc.
Signed-off-by: Roman Zippel <zippel@linux-m68k.org>
Acked-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Jean Delvare <khali@linux-fr.org>
Cc: Andrey Borzenkov <arvidjaar@mail.ru>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Andy Whitcroft <apw@shadowen.org>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV4] devinet: inetdev_init out label moved after RCU assignment
  [INET]: style updates for the inet_sock->is_icsk assignment fix
  [SCTP]: Fix err_hdr assignment in sctp_init_cause.
  [NETFILTER]: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value
  [NETFILTER]: nf_nat: fix hanging connections when loading the NAT module
  [NETFILTER]: arp_tables: fix userspace compilation
  [NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments

This patch adds myself as maintainer of the sata_promise
libata driver.
Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mthca: Don't execute QUERY_QP firmware command for QP in RESET state
  IB/ehca: Use proper GFP_ flags for get_zeroed_page()
  IB/mthca: Fix PRM compliance problem in atomic-send completions
  RDMA/ucma: Don't report events with invalid user context
  RDMA/ucma: Fix struct ucma_event leak when backlog is full
  RDMA/iwcm: iWARP connection timeouts shouldn't be reported as rejects
  IB/iser: Return error code when PDUs may not be sent
  IB/mthca: Fix off-by-one in FMR handling on memfree

inetdev_init out label moved after RCU assignment
(final suggestion by Herbert Xu)
Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

A quick patch to change the inet_sock->is_icsk assignment to better fit with
existing kernel coding style.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

The subh->err_hdr should point to the error header, not the data.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

IP_CT_TCP_FLAG_CLOSE_INIT is a flag and should have a value of 0x4 instead
of 0x3, which is IP_CT_TCP_FLAG_WINDOW_SCALE | IP_CT_TCP_FLAG_SACK_PERM.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

When loading the NAT module, existing connection tracking entries don't
have room for NAT information allocated and packets are dropped, causing
hanging connections. They really should be entered into the NAT table
as NULL mappings, but the current allocation scheme doesn't allow this.

For now simply accept those packets to avoid the hanging connections.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

The included patch translates arpt_counters to xt_counters, making
userspace arptables compile against recent kernels.
Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

If a QP being queried is in the RESET state, don't execute the
QUERY_QP firmware command (because it will fail).
Signed-off-by: Dotan Barak <dotanb@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Here is a patch for ehca to use proper flag, ie. GFP_ATOMIC
resp. GFP_KERNEL, when calling get_zeroed_page() to prevent "Bug:
scheduling while atomic...". This error does not cause a kernel panic
but makes ipoib un-usable afterwards.  It is reproducible on
2.6.20-rc4 if one does ifconfig down during a flood ping test.  I have
not observed this error in earlier releases incl. 2.6.20-rc1.

This error occurs when a qp event/irq is received and ehca event
handler allocates a control block/page to obtain HCA error data block.
Use of GFP_ATOMIC when in interrupt context prevents this issue.

Signed-off-by Hoang-Nam Nguyen <hnguyen@de.ibm.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] version 1.0.14rc1
  [ALSA] usbaudio - Fix kobject_add() error at reconnection
  [ALSA] usb: usbmixer error path fix
  [ALSA] _snd_cmipci_uswitch_put doesn't set zero flags
  [ALSA] hda-codec - Fix NULL dereference in generic hda code
  [ALSA] hda_intel: ALSA HD Audio patch for Intel ICH9
  [ALSA] usb-audio: work around wrong frequency in CM6501 descriptors
  [ALSA] Fix potential NULL pointer dereference in echoaudio midi
  [ALSA] Audio: Add nvidia HD Audio controllers of MCP67 support to hda_intel.c

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [TCP]: Fix iov_len calculation in tcp_v4_send_ack().
  [NETFILTER]: nf_conntrack_netbios_ns: fix uninitialized member in expectation
  [TG3]: Add PHY workaround for 5755M.
  [BNX2]: Update version and reldate.
  [BNX2]: Fix bug in bnx2_nvram_write().
  [BNX2]: Fix 5709 Serdes detection.
  [BNX2]: Don't apply CRC PHY workaround to 5709.
  NetLabel: correct CIPSO tag handling when adding new DOI definitions
  NetLabel: correct locking in selinux_netlbl_socket_setsid()
  [Bluetooth] Correct SCO buffer for Broadcom based Dell laptops
  [Bluetooth] Correct SCO buffer for Broadcom based HP laptops
  [Bluetooth] Correct SCO buffer size for another ThinkPad laptop
  [Bluetooth] Handle device registration failures
  [Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()
  [Bluetooth] More checks if DLC is still attached to the TTY
  [Bluetooth] Add packet size checks for CAPI messages
  [X25]: Trivial, SOCK_DEBUG's in x25_facilities missing newlines
  [INET]: Fix incorrect "inet_sock->is_icsk" assignment.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  pcnet_cs : add new id
  chelsio: error path fix
  s390: iucv Kconfig help description changes
  s390: qeth driver fixes: atomic context fixups
  s390: qeth driver fixes: packet socket
  s390: qeth driver fixes: VLAN hdr, perf stats
  forcedeth: sideband management fix
  Revert "[PATCH] e1000: disable TSO on the 82544 with slab debugging"
  qeth: fix uaccess handling and get rid of unused variable
  qla3xxx: Add delay to NVRAM register access.
  qla3xxx: Remove NETIF_F_LLTX from driver features.
  ixgb: Write RA register high word first, increment version
  ixgb: Maybe stop TX if not enough free descriptors
  ixgb: Fix early TSO completion
  [PATCH] ipw2100: Fix dropping fragmented small packet problem
  [PATCH] ieee80211: WLAN_GET_SEQ_SEQ fix (select correct region)

* 'merge' of master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix bugs in the hypervisor call stats code
  [POWERPC] Fix corruption in hcall9
  [POWERPC] iSeries: fix setup initcall
  [POWERPC] iSeries: fix viopath initialisation
  [POWERPC] iSeries: fix lpevents initialisation
  [POWERPC] iSeries: fix proc/iSeries initialisation
  [POWERPC] iSeries: fix mf proc initialisation
  [POWERPC] disable PReP and EFIKA during make oldconfig
  [POWERPC] Fix mpc52xx serial driver to work for arch/ppc again
  [POWERPC] Don't include powerpc/sysdev/rom.o for arch/ppc builds
  [POWERPC] Fix mpc52xx fdt to use correct device_type for sound devices
  [POWERPC] 52xx: Don't use device_initcall to probe of_platform_bus
  [POWERPC] Add legacy iSeries to ppc64_defconfig
  [POWERPC] Update ppc64_defconfig
  [POWERPC] Fix manual assembly WARN_ON() in enter_rtas().
  [POWERPC] Avoid calling get_irq_server() with a real, not virtual irq.
  [POWERPC] Fix unbalanced uses of of_node_put
  [POWERPC] Fix bogus BUG_ON() in in hugetlb_get_unmapped_area()

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] locking problem with __cpcmd.
  [S390] don't call handle_mm_fault() if in an atomic context.
  [S390] Fix vmalloc area size calculation.
  [S390] Fix cpu hotplug (missing 'online' attribute).
  [S390] cio: use barrier() in stsch_reset.
  [S390] memory detection misses 128k.

The sis96x SMBus PCI device depends on two different quirks to run
in a specific order.  Apart from being fragile, this was found to
actually break on (at least) recent FC4, FC5, and FC6 kernels.  This
patch fixes the quirks so that they work without relying on the
compiler and/or linker to put them in any specific order.

  http://lists.lm-sensors.org/pipermail/lm-sensors/2006-April/015962.html
  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189719

I tested this patch.
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Adrian Bunk <bunk@stusta.de>
Cc: Greg K-H <greg@kroah.com>
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Jaroslav Kysela <perex@suse.cz>

Changeset 740b5706 moved the protecting
spinlock from __cpcmd to cpcmd. Therefore vmcp can no longer use __cpcmd,
instead we have to use cpcmd.
Signed-off-by: Christian Borntraeger <cborntra@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

There are several places in the futex code where a spin_lock is held
and still uaccesses happen. Deadlocks are avoided by increasing the
preempt count. The pagefault handler will then not take any locks
but will immediately search the fixup tables.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

setup_memory_end() uses VMALLOC_END instead of VMALLOC_END_INIT to
calculate the maximum supported size of physical memory. Since
VMALLOC_END is zero, this will cause a crash on 31 bit systems.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

72486f1f inverts the logic if an
'online' attribute in /sys/devices/system/cpu/cpuX should appear.
So we end up with no hotpluggable cpus at all...
Set the hotpluggable value to one to make sure the online
attribute appears again.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Use barrier() in stsch_reset() instead of duplicating the stsch()
inline assembly and adding "memory" to the clobberlist.
Pointed out by Chuck Ebbert.

Real fix would be to add a fixup section to the stsch() and extend the
basic program check handler so it searches the exception tables in case
of a program check.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Fix a memory leak problem in the memory detection routines.  A memory leak
of 128k occurs when we have a contiguous memory with mixed access-mode
(read or write) ranges.
Signed-off-by: Hongjie Yang <hongjie@us.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

This fixes the ftp stalls present in the current kernels.

All credit goes to Komuro <komurojun-mbn@nifty.com> for tracking
this down. The patch is untested but it looks *cough* obviously
correct.
Signed-off-by: Craig Schlenter <craig@codefountain.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

->helper is uninitialized in the expectation registered by the netbios_ns
helper and it later copied to the expected connection, which causes invalid
memory dereferences when trying to call the helper.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Some PHY trim values need to be fine-tuned on 5755M to be
IEEE-compliant.

Update version to 3.72.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Update version to 1.5.3.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The bug was a bogus pointer being passed to kfree().  The pointer was
incremented in the write loop and then passed to kfree().

The fix is to use align_buf to save the original address.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

5709 has a new register to detect copper/fiber PHYs.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The workaround is only needed on 5706/5708 and cannot be applied on
5709.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch.  The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array.  The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

The spinlock protecting the update of the "sksec->nlbl_state" variable is not
currently softirq safe which can lead to problems.  This patch fixes this by
changing the spin_{un}lock() functions into spin_{un}lock_bh() functions.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>