* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [TCP]: Fix iov_len calculation in tcp_v4_send_ack().
  [NETFILTER]: nf_conntrack_netbios_ns: fix uninitialized member in expectation
  [TG3]: Add PHY workaround for 5755M.
  [BNX2]: Update version and reldate.
  [BNX2]: Fix bug in bnx2_nvram_write().
  [BNX2]: Fix 5709 Serdes detection.
  [BNX2]: Don't apply CRC PHY workaround to 5709.
  NetLabel: correct CIPSO tag handling when adding new DOI definitions
  NetLabel: correct locking in selinux_netlbl_socket_setsid()
  [Bluetooth] Correct SCO buffer for Broadcom based Dell laptops
  [Bluetooth] Correct SCO buffer for Broadcom based HP laptops
  [Bluetooth] Correct SCO buffer size for another ThinkPad laptop
  [Bluetooth] Handle device registration failures
  [Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()
  [Bluetooth] More checks if DLC is still attached to the TTY
  [Bluetooth] Add packet size checks for CAPI messages
  [X25]: Trivial, SOCK_DEBUG's in x25_facilities missing newlines
  [INET]: Fix incorrect "inet_sock->is_icsk" assignment.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  pcnet_cs : add new id
  chelsio: error path fix
  s390: iucv Kconfig help description changes
  s390: qeth driver fixes: atomic context fixups
  s390: qeth driver fixes: packet socket
  s390: qeth driver fixes: VLAN hdr, perf stats
  forcedeth: sideband management fix
  Revert "[PATCH] e1000: disable TSO on the 82544 with slab debugging"
  qeth: fix uaccess handling and get rid of unused variable
  qla3xxx: Add delay to NVRAM register access.
  qla3xxx: Remove NETIF_F_LLTX from driver features.
  ixgb: Write RA register high word first, increment version
  ixgb: Maybe stop TX if not enough free descriptors
  ixgb: Fix early TSO completion
  [PATCH] ipw2100: Fix dropping fragmented small packet problem
  [PATCH] ieee80211: WLAN_GET_SEQ_SEQ fix (select correct region)

* 'merge' of master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix bugs in the hypervisor call stats code
  [POWERPC] Fix corruption in hcall9
  [POWERPC] iSeries: fix setup initcall
  [POWERPC] iSeries: fix viopath initialisation
  [POWERPC] iSeries: fix lpevents initialisation
  [POWERPC] iSeries: fix proc/iSeries initialisation
  [POWERPC] iSeries: fix mf proc initialisation
  [POWERPC] disable PReP and EFIKA during make oldconfig
  [POWERPC] Fix mpc52xx serial driver to work for arch/ppc again
  [POWERPC] Don't include powerpc/sysdev/rom.o for arch/ppc builds
  [POWERPC] Fix mpc52xx fdt to use correct device_type for sound devices
  [POWERPC] 52xx: Don't use device_initcall to probe of_platform_bus
  [POWERPC] Add legacy iSeries to ppc64_defconfig
  [POWERPC] Update ppc64_defconfig
  [POWERPC] Fix manual assembly WARN_ON() in enter_rtas().
  [POWERPC] Avoid calling get_irq_server() with a real, not virtual irq.
  [POWERPC] Fix unbalanced uses of of_node_put
  [POWERPC] Fix bogus BUG_ON() in in hugetlb_get_unmapped_area()

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] locking problem with __cpcmd.
  [S390] don't call handle_mm_fault() if in an atomic context.
  [S390] Fix vmalloc area size calculation.
  [S390] Fix cpu hotplug (missing 'online' attribute).
  [S390] cio: use barrier() in stsch_reset.
  [S390] memory detection misses 128k.

The sis96x SMBus PCI device depends on two different quirks to run
in a specific order.  Apart from being fragile, this was found to
actually break on (at least) recent FC4, FC5, and FC6 kernels.  This
patch fixes the quirks so that they work without relying on the
compiler and/or linker to put them in any specific order.

  http://lists.lm-sensors.org/pipermail/lm-sensors/2006-April/015962.html
  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189719

I tested this patch.
Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Adrian Bunk <bunk@stusta.de>
Cc: Greg K-H <greg@kroah.com>
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Changeset 740b5706 moved the protecting
spinlock from __cpcmd to cpcmd. Therefore vmcp can no longer use __cpcmd,
instead we have to use cpcmd.
Signed-off-by: Christian Borntraeger <cborntra@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

There are several places in the futex code where a spin_lock is held
and still uaccesses happen. Deadlocks are avoided by increasing the
preempt count. The pagefault handler will then not take any locks
but will immediately search the fixup tables.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

setup_memory_end() uses VMALLOC_END instead of VMALLOC_END_INIT to
calculate the maximum supported size of physical memory. Since
VMALLOC_END is zero, this will cause a crash on 31 bit systems.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

72486f1f inverts the logic if an
'online' attribute in /sys/devices/system/cpu/cpuX should appear.
So we end up with no hotpluggable cpus at all...
Set the hotpluggable value to one to make sure the online
attribute appears again.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Use barrier() in stsch_reset() instead of duplicating the stsch()
inline assembly and adding "memory" to the clobberlist.
Pointed out by Chuck Ebbert.

Real fix would be to add a fixup section to the stsch() and extend the
basic program check handler so it searches the exception tables in case
of a program check.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Fix a memory leak problem in the memory detection routines.  A memory leak
of 128k occurs when we have a contiguous memory with mixed access-mode
(read or write) ranges.
Signed-off-by: Hongjie Yang <hongjie@us.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

This fixes the ftp stalls present in the current kernels.

All credit goes to Komuro <komurojun-mbn@nifty.com> for tracking
this down. The patch is untested but it looks *cough* obviously
correct.
Signed-off-by: Craig Schlenter <craig@codefountain.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

->helper is uninitialized in the expectation registered by the netbios_ns
helper and it later copied to the expected connection, which causes invalid
memory dereferences when trying to call the helper.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Some PHY trim values need to be fine-tuned on 5755M to be
IEEE-compliant.

Update version to 3.72.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Update version to 1.5.3.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The bug was a bogus pointer being passed to kfree().  The pointer was
incremented in the write loop and then passed to kfree().

The fix is to use align_buf to save the original address.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

5709 has a new register to detect copper/fiber PHYs.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The workaround is only needed on 5706/5708 and cannot be applied on
5709.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The current netlbl_cipsov4_add_common() function has two problems which are
fixed with this patch.  The first is an off-by-one bug where it is possibile to
overflow the doi_def->tags[] array.  The second is a bug where the same
doi_def->tags[] array was not always fully initialized, which caused sporadic
failures.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

The spinlock protecting the update of the "sksec->nlbl_state" variable is not
currently softirq safe which can lead to problems.  This patch fixes this by
changing the spin_{un}lock() functions into spin_{un}lock_bh() functions.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

The SCO buffer size values on Dell laptops with a Bluetooth chip from
Broadcom are wrong. The USB Bluetooth driver has to set a quirk to
correct the SCO buffer size values.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The SCO buffer size values on HP laptops with a Bluetooth chip from
Broadcom are wrong. The USB Bluetooth driver has to set a quirk to
correct the SCO buffer size values.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The ThinkPad R60E uses a Broadcom based Bluetooth chip and even this
version needs the quirk to correct the SCO buffer size values.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

In the case the device registration for a new Bluetooth low-level
connection fails there is no need to unregister it when the temporary
data structure has been removed.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

When calling send() with a zero length parameter on a RFCOMM socket
it returns a positive value. In this rare case the variable err is
used uninitialized and unfortunately its value is returned.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

If the DLC device is no longer attached to the TTY device, then return
errors or default values for various callbacks of the TTY layer.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

With malformed packets it might be possible to overwrite internal
CMTP and CAPI data structures. This patch adds additional length
checks to prevent these kinds of remote attacks.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Trivial. Newlines missing on the SOCK_DEBUG's for X.25 facility
negotiation.
Signed-off-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The inet_create() and inet6_create() functions incorrectly set the
inet_sock->is_icsk field.  Both functions assume that the is_icsk field is
large enough to hold at least a INET_PROTOSW_ICSK value when it is actually
only a single bit.  This patch corrects the assignment by doing a boolean
comparison whose result will safely fit into a single bit field.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pcnet_cs: add new id.
 corega K.K. (CG-LAPCCTXD)
 Logitec LPM-LN10TE
Signed-off-by: Komuro <komurojun-mbn@nifty.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix handling of allocation failure.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH 4/5] s390: iucv Kconfig help description changes

From: Ursula Braun <braunu@de.ibm.com>
        remove text from help description which does not
	apply anymore for 2.6 kernel series.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

    - qeth device functions were not callable
      in atomic context due to usage of wait_event_xxx operations in qeth.
      "schedule while atomic" message appeared and kernel dumped when
      removing slave from bond device.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

    - packet socket support is not complete.
      Recvfrom a packet socket does not fill the sockaddr_ll structure.
      device function hard_header_parse is not implemented.
      For layer 2 mode and layer 3 mode with fake_ll turned on, we have
      the information to fill sockaddr_ll.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

From: Ursula Braun <braunu@de.ibm.com>
        - VLAN header reordering did not work on packets
          received through qeth interface in layer 2 mode.
          This caused dhcpcd not to work with VLAN devices.
	- set qeth performance statistics initally inactive
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This patch contains a fix that implements proper communication with the
sideband management unit. Also, it makes sure that the speed is
correctly set for gigabit phys in the case where sideband mgmt unit
initialized the phy. Refer to bug #7684 for more details.
Signed-Off-By: Ayaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

There were a few issues with the HCALL_STATS code:

- PURR cpu feature checks were backwards
- We iterated one entry off the end of the hcall_stats array
- Remove dead update_hcall_stats() function prototype

I noticed one thing while debugging, and that is we call H_ENTER (to set
up the MMU hashtable in early init) before we have done the cpu fixups.
This means we will execute the PURR SPR reads even on a CPU that isnt
capable of it. I wonder if we can move the CPU feature fixups earlier.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

It looks to me like we are corrupting r12 in the hcall9 function.
Although we have r0 free we cant use offsets against it, so save
away r12 in there instead.  r12 holds the ninth return value from
the hypervisor call, so without this fix, the caller will see the
wrong value for the ninth element in the array that gets the return
values.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Clearing the progress indicator should only be done if we are running
on legacy iSeries.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

/proc/iSeries/config should only be created if we are running on legacy
iSeries.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>