* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  dsa: fix master interface allmulti/promisc handling
  dsa: fix skb->pkt_type when mac address of slave interface differs
  net: fix setting of skb->tail in skb_recycle_check()
  net: fix /proc/net/snmp as memory corruptor
  mac80211: fix a buffer overrun in station debug code
  netfilter: payload_len is be16, add size of struct rather than size of pointer
  ipv6: fix ip6_mr_init error path
  [4/4] dca: fixup initialization dependency
  [3/4] I/OAT: fix async_tx.callback checking
  [2/4] I/OAT: fix dma_pin_iovec_pages() error handling
  [1/4] I/OAT: fix channel resources free for not allocated channels
  ssb: Fix DMA-API compilation for non-PCI systems
  SSB: hide empty sub menu
  vlan: Fix typos in proc output string
  [netdrvr] usb/hso: Cleanup rfkill error handling
  sfc: Correct address of gPXE boot configuration in EEPROM
  el3_common_init() should be __devinit, not __init
  hso: rfkill type should be WWAN
  mlx4_en: Start port error flow bug fix
  af_key: mark policy as dead before destroying

Before commit b6c40d68 ("net: only
invoke dev->change_rx_flags when device is UP"), the dsa driver could
sort-of get away with only fiddling with the master interface's
allmulti/promisc counts in ->change_rx_flags() and not touching them
in ->open() or ->stop().  After this commit (note that it was merged
almost simultaneously with the dsa patches, which is why this wasn't
caught initially), the breakage that was already there became more
apparent.

Since it makes no sense to keep the master interface's allmulti or
promisc count pinned for a slave interface that is down, copy the vlan
driver's sync logic (which does exactly what we want) over to dsa to
fix this.

Bug report from Dirk Teurlings <dirk@upexia.nl> and Peter van Valderen
<linux@ddcrew.com>.
Signed-off-by: NLennert Buytenhek <buytenh@marvell.com>
Tested-by: NDirk Teurlings <dirk@upexia.nl>
Tested-by: NPeter van Valderen <linux@ddcrew.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When a dsa slave interface has a mac address that differs from that
of the master interface, eth_type_trans() won't explicitly set
skb->pkt_type back to PACKET_HOST -- we need to do this ourselves
before calling eth_type_trans().
Signed-off-by: NLennert Buytenhek <buytenh@marvell.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since skb_reset_tail_pointer() reads skb->data, we need to set
skb->data before calling skb_reset_tail_pointer().  This was causing
spurious skb_over_panic()s from skb_put() being called on a recycled
skb that had its skb->tail set to beyond where it should have been.

Bug report from Peter van Valderen <linux@ddcrew.com>.
Signed-off-by: NLennert Buytenhek <buytenh@marvell.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

icmpmsg_put() can happily corrupt kernel memory, using a static
table and forgetting to reset an array index in a loop.

Remove the static array since its not safe without proper locking.
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.
Signed-off-by: NJianjun Kong <jianjun@zeuux.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

payload_len is a be16 value, not cpu_endian, also the size of a ponter
to a struct ipv6hdr was being added, not the size of the struct itself.
Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The order of cleanup operations in the error/exit section of ip6_mr_init()
is completely inversed. It should be the other way around.
Also a del_timer() is missing in the error path.
Signed-off-by: NBenjamin Thery <benjamin.thery@bull.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Mark dca_init as a subsys_initcall since it needs to be ready to go
before dependent drivers start registering themselves.

Cc: <stable@kernel.org>
Reported-and-tested-by: NMark Rustad <mark_rustad@Xiotech.com>
Acked-by: NMaciej Sosnowski <maciej.sosnowski@intel.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

async_tx.callback should be checked for the first
not the last descriptor in the chain.

Cc: <stable@kernel.org>
Signed-off-by: NMaciej Sosnowski <maciej.sosnowski@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Error handling needs to be modified in dma_pin_iovec_pages().
It should return NULL instead of ERR_PTR
(pinned_list is checked for NULL in tcp_recvmsg() to determine
if iovec pages have been successfully pinned down).
In case of error for the first iovec,
local_list->nr_iovecs needs to be initialized.

Cc: <stable@kernel.org>
Signed-off-by: NMaciej Sosnowski <maciej.sosnowski@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If the ioatdma driver is loaded but not used it does not allocate descriptors.
Before it frees channel resources it should first be sure
that they have been previously allocated.

Cc: <stable@kernel.org>
Signed-off-by: NMaciej Sosnowski <maciej.sosnowski@intel.com>
Tested-by: NTom Picard <tom.s.picard@intel.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes compilation of the SSB DMA-API code on non-PCI platforms.
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If the target system cannot support SSB, then don't show the menu option as
it'll simply be an empty submenu.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NFerenc Wagner <wferi@niif.hu>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

While investigating the failure of hibernation on 32-bit x86 with
CONFIG_NUMA set, as described in this message
http://marc.info/?l=linux-kernel&m=122634118116226&w=4
I asked some people for help and I was told that it wasn't really
worth the effort, because CONFIG_NUMA was generally broken on 32-bit
x86 systems and it shouldn't be used in such configs.  For this
reason, make CONFIG_NUMA depend on BROKEN instead of EXPERIMENTAL on
x86-32.
Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Pavel Machek <pavel@suse.cz>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make request_key() instantiate the per-user keyrings so that it doesn't oops
if it needs to get hold of the user session keyring because there isn't a
session keyring in place.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Tested-by: NSteve French <smfrench@gmail.com>
Tested-by: NRutger Nijlunsing <rutger.nijlunsing@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Make the HP EliteBook 8530p use AD1884A model laptop
  ALSA: gusextreme: Fix build errors
  ALSA: hdsp: check for iobox and upload firmware during ioctl
  ALSA: HDSP: check for io box before uploading firmware
  ALSA: hda - Add another HP model (6730s) for AD1884A
  alsa: fix snd_BUG_on() and friends
  ALSA: hda - Add a quirk for MEDION MD96630
  ALSA: hda - Limit the number of GPIOs show in proc

Added a QUIRK to patch_analog.c for the HP Elitebook 8530p
(IDs 0x103c:0x30e7) to use AD1884A model 'laptop' by default.
Playback and Capture confirmed working.
Signed-off-by: NTravis Place <wishie@wishie.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This patch reverts the following three commits which convert libata to
use block layer tagging.

 43a49cbd
 e013e13b
 2fca5ccf

Although using block layer tagging is the right direction, due to the
tight coupling among tag number, data structure allocation and
hardware command slot allocation, libata doesn't work correctly with
the current conversion.

The biggest problem is guaranteeing that tag 0 is always used for
non-NCQ commands.  Due to the way blk-tag is implemented and how SCSI
starts and finishes requests, such guarantee can't be made.  I'm not
sure whether this would actually break any low level driver but it
doesn't look like a good idea to break such assumption given the
frailty of ATA controllers.

So, for the time being, keep using the old dumb in-libata qc
allocation.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Jens Axobe <jens.axboe@oracle.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

gusextreme depends on opl3 support. Add the approriate select to Kconfig.
Also remove the unnecessary hwdep select.

Relevant build errors:
ERROR: "snd_opl3_hwdep_new" [sound/isa/gus/snd-gusextreme.ko] undefined!
ERROR: "snd_opl3_create" [sound/isa/gus/snd-gusextreme.ko] undefined!
Signed-off-by: NVille Syrjala <syrjala@sci.fi>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

It's showing up as regressions; disabling it very likely just papers
over an underlying issue, but time is running out for 2.6.28, lets get
back to this for 2.6.29

Fixes: #11826 and #11893
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes:
  kbuild: Fixup deb-pkg target to generate separate firmware deb

The below is a simplistic fix for "make deb-pkg"; it splits the
firmware out to a linux-firmware-image package and adds an
(unversioned) Suggests to the linux package for this firmware.
Signed-Off-By: NJonathan McDowell <noodles@earth.li>
Acked-by: NFrans Pop <elendil@planet.nl>
Signed-off-by: NSam Ravnborg <sam@ravnborg.org>

The "Exclude staging drivers" question is there so that we don't build
staging drivers for allyesconfig or allnoconfig settings, but it's very
irritating when you've already said "no" to staging drivers earlier.

There is absolutely no point in declining twice - once you've declined
the staging drivers, you're done.

So make the second question depend on the first question having been
answered in the affirmative.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-2.6.28' of git://linux-nfs.org/~bfields/linux:
  Fix nfsd truncation of readdir results

* 'cpus4096' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  cpumask: introduce new API, without changing anything, v3
  cpumask: new API, v2
  cpumask: introduce new API, without changing anything

Commit 8d7c4203 "nfsd: fix failure to set eof in readdir in some
situations" introduced a bug: on a directory in an exported ext3
filesystem with dir_index unset, a READDIR will only return about 250
entries, even if the directory was larger.

Bisected it back to this commit; reverting it fixes the problem.

It turns out that in this case ext3 reads a block at a time, then
returns from readdir, which means we can end up with buf.full==0 but
with more entries in the directory still to be read.  Before 8d7c4203
(but after c002a6c7 "Optimise NFS readdir hack slightly"), this would
cause us to return the READDIR result immediately, but with the eof bit
unset.  That could cause a performance regression (because the client
would need more roundtrips to the server to read the whole directory),
but no loss in correctness, since the cleared eof bit caused the client
to send another readdir.  After 8d7c4203, the setting of the eof bit
made this a correctness problem.

So, move nfserr_eof into the loop and remove the buf.full check so that
we loop until buf.used==0.  The following seems to do the right thing
and reduces the network traffic since we don't return a READDIR result
until the buffer is full.

Tested on an empty directory & large directory; eof is properly sent and
there are no more short buffers.
Signed-off-by: NDoug Nazar <nazard@dragoninc.ca>
Cc: David Woodhouse <David.Woodhouse@intel.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NJ. Bruce Fields <bfields@citi.umich.edu>

Impact: cleanup

Clean up based on feedback from Andrew Morton and others:

 - change to inline functions instead of macros
 - add __init to bootmem method
 - add a missing debug check
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Previously I assumed that the receive queues of candidates don't
change during the GC.  This is only half true, nothing can be received
from the queues (see comment in unix_gc()), but buffers could be added
through the other half of the socket pair, which may still have file
descriptors referring to it.

This can result in inc_inflight_move_tail() erronously increasing the
"inflight" counter for a unix socket for which dec_inflight() wasn't
previously called.  This in turn can trigger the "BUG_ON(total_refs <
inflight_refs)" in a later garbage collection run.

Fix this by only manipulating the "inflight" counter for sockets which
are candidates themselves.  Duplicating the file references in
unix_attach_fds() is also needed to prevent a socket becoming a
candidate for GC while the skb that contains it is not yet queued.
Reported-by: NAndrea Bittau <a.bittau@cs.ucl.ac.uk>
Signed-off-by: NMiklos Szeredi <mszeredi@suse.cz>
CC: stable@kernel.org
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently, all existing users of cnt32_to_63() are fine since the CPU
architectures where it is used don't do read access reordering, and user
mode preemption is disabled already.  It is nevertheless a good idea to
better elaborate usage requirements wrt preemption, and use an explicit
memory barrier on SMP to avoid different CPUs accessing the counter
value in the wrong order.  On UP a simple compiler barrier is
sufficient.
Signed-off-by: NNicolas Pitre <nico@marvell.com>
Acked-by: NMathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  mmc: struct device - replace bus_id with dev_name(), dev_set_name()
  mmc: increase SD write timeout for crappy cards

Use menuconfig instead of flat configs so that you can disable/enable
regulator items with one selection.  Also, use depends instead of
reverse selections to make life easier, too.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLiam Girdwood <lrg@slimlogic.co.uk>

currently, the error message when trying to run hdspmixer or hdspconf
if the breakout box is not connected is somehow misleading, since it
asks the user to upload the firmware.

this patch adds a test, whether the breakout box is connected and
tries to upload the firmware in the case, that it is not present, e.g.
because of power failures of the breakout box.

[Minor coding-style fixes by tiwai]
Signed-off-by: NTim Blechmann <tim@klingt.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

currently the hdsp driver tries to upload the firmware, even if the
io box is not connected. this patch adds a check for the io box
before trying to upload the firmware.
thus instead of messages complaining about the fifo status and firmware
loading failure, the driver gives a message that no multiface or
digiface is connected.

[A minor coding-style fix by tiwai]
Signed-off-by: NTim Blechmann <tim@klingt.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Added model=laptop for another HP machine (103c:3614) with AD1884A
codec.
Signed-off-by: NMichel Marti <mma@objectxp.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Acked-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-Off-By: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NPierre Ossman <drzeus@drzeus.cx>

It seems that some cards are slightly out of spec and occasionally
will not be able to complete a write in the alloted 250 ms [1].
Incease the timeout slightly to allow even these cards to function
properly.

[1] http://lkml.org/lkml/2008/9/23/390Signed-off-by: NPierre Ossman <drzeus@drzeus.cx>