* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/iser: Handle aborting a command after it is sent
  IB/mthca: Fix thinko in init_mr_table()
  RDMA/cxgb3: Fix resource leak in cxio_hal_init_ctrl_qp()

So I think the right solution is to simply make pci_enable_device just
flip enable bits and move the rest of the work someplace else.

However a thorough cleanup is a little extreme for this point in the
release cycle, so I think a quick hack that makes the code not stomp the
irq when msi irq's are enabled should be the first fix.  Then we can
later make the code not change the irqs at all.
Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

nmi_cpu_setup() is called from hardirq context and acquires oprofilefs_lock.
alloc_event_buffer() and oprofilefs_ulong_from_user() acquire this lock
without disabling irqs, which could deadlock.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: Trivial fix for hp6xx build.
  sh: Fixup __cmpxchg() compile breakage with gcc4.
  sh: Kill bogus GCC4 symbol exports.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  ata: NCQ is broken on Maxtor 6L250S0
  pata_pdc202xx_old: LBA48 bug
  libata: IDENTIFY backwards for drive side cable detection
  ahci.c: walkaround for SB600 SATA internal error issue
  [libata] Disable ACPI by default; fix namespace problems

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  SUN3/3X Lance trivial fix improved
  mv643xx_eth: Fix use of uninitialized port_num field
  forcedeth: fix tx timeout
  forcedeth: fix nic poll
  qla3xxx: bugfix: Jumbo frame handling.
  qla3xxx: bugfix: Dropping interrupt under heavy network load.
  qla3xxx: bugfix: Multi segment sends were getting whacked.
  qla3xxx: bugfix: Add tx control block memset.
  atl1: remove unnecessary crc inversion
  myri10ge: correctly detect when TSO should be used
  [PATCH] WE-22 : prevent information leak on 64 bit
  [PATCH] wext: Add missing ioctls to 64<->32 conversion
  [PATCH] bcm43xx: Fix machine check on PPC for version 1 PHY
  [PATCH] bcm43xx: fix radio_set_tx_iq
  [PATCH] bcm43xx: Fix code for confusion between PHY revision and PHY version

hrtimer_start() incorrectly set the 'reprogram' flag to enqueue_hrtimer(),
which should only be 1 if the hrtimer is queued to the current CPU.

Doing otherwise could result in a reprogramming of the current CPU's
clockevents device, with a timer that is not queued to it - resulting in a
bogus next expiry value.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Cc: Michal Piotrowski <michal.k.k.piotrowski@gmail.com>
Acked-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We were only checking if there was enough space to put the int, but
left len as specified by the (malicious) user, sigh, fix it by setting
len to sizeof(val) and transfering just one int worth of data, the one
asked for.

Also check for negative len values.
Signed-off-by: NArnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The IRQ3 define was removed when asm-sh/irq.h was cleaned up,
this updates the hp6xx header to use the IRQ number directly.
Signed-off-by: NKristoffer Ericson <kristoffer_e1@hotmail.com>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

As reported by Manuel:

When I build linux with GCC-4.x and enable
CONFIG_CC_OPTIMIZE_FOR_SIZE linking fails with this error:

  LD      .tmp_vmlinux1
  kernel/built-in.o: In function '__cmpxchg_called_with_bad_pointer'
  make[1]: *** [.tmp_vmlinux1] Error 1
  make: *** [_all] Error 2

This ended up being an inlining problem, fixed by explicitly
including linux/compiler.h and grabbing the definitions from there.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

__sdivsi3_i4i, __udiv_qrnnd_16, and __udivsi3_i4i don't exist
outside of the ST compiler, so kill them off.

This causes compile failures with other GCC4 compilers.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

This patch adds checking for allocated DVMA memory and granted IRQ line.
Signed-off-by: NCyrill V. Gorcunov <gorcunov@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

In this driver, the default ethernet address is first set by by calling
eth_port_uc_addr_get() which reads the relevant registers of the
corresponding port as initially set by firmware. However that function
used the port_num field accessed through the private area of net_dev
before it was set.

The result was that one board I have ended up with the unicast address
set to 00:00:00:00:00:00 (only port 1 is connected on this board). The
problem appeared after commit 84dd619e.

This patch fixes the bug by setting mp->port_num prior to calling
eth_port_uc_get_addr().
Signed-off-by: NGabriel Paubert <paubert@iram.es>
Signed-off-by: NDale Farnsworth <dale@farnsworth.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The tx timeout routine was waking the tx queue conditionally. However,
it must call it unconditionally since the dev_watchdog has halted the tx
queue before calling the timeout function.
Signed-Off-By: NAyaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The nic poll routine was missing the call to the optimized irq routine.
This patch adds the missing call for the optimized path.

See http://bugzilla.kernel.org/show_bug.cgi?id=7950 for more information.
Signed-Off-By: NAyaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Fixed rx checksum bits. Turn on TCP processing for rx checksum.
Fixed max frame length register write.  It wasn't getting set
in multi-port system. Set rx buffer queue length properly
for jumbo frames.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Update the rx queue pointer when exiting NAPI poll rather than
at the end of each iteration.  Remove unnecessary PCI flushes
that occurred after every write.  Now write all regs and
flush once.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The proper header length was not being used.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This was removed in a previous patch to increase performance, but
caused a transmit error for the 4032 chip.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The original vendor driver contained a private ether_crc_le() function
that produced an inverted crc.  When we changed to the kernel version of
ether_crc_le(), we neglected to undo the inversion.  Let's do it now.
Discovered by and patch proffered by Jose Alberto Reguero.
Signed-off-by: NJose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: NJay Cliburn <jacliburn@bellsouth.net>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Correctly detect when TSO should be used on transmit by looking at the
skb->gso_size rather than seeing if the frame was larger than our MTU.
The old method causes problems when a host with a large (jumbo) MTU is
sending to a host with a small (standard) MTU.
Signed-off-by: NBrice Goglin <brice@myri.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

With this applied, my machine has stopped all those painful messages.
dmesg now says :

root@riri:/Kernels# dmesg | grep LBA
ata1.00: 490234752 sectors, multi 0: LBA48 NCQ (not used)
ata2.00: 640 sectors, multi 1: LBA
ata3.00: 490234752 sectors, multi 0: LBA48 NCQ (not used)
Signed-off-by: NPaul Rolland <rol@as2917.net>
Acked-by: NAlan Cox <alan@redhat.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

In LBA48 mode we have to help the controller to get anything to work. The
chip provides a register giving word counts meant for ATAPI use which we
can use. However we need to load the count in words not bytes..
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

For drive side cable detection to work correctly, drives need to be
identified backwards such that the slave device releases PDIAG- before
the mater drive tries to detect cable type.  ata_bus_probe() was fixed
by commit f31f0cc2 but the new EH path
wasn't fixed.  This patch makes new EH path do IDENTIFY backwards.

ata_dev_configure() for new devices are still performed master first.
This is to keep the detection messages in forward order.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

   There is a HW issue in ATI SB600 SATA that PxSERR.E should not be
set on some conditions, for example, when there is no media in SATA
CD/DVD drive or media is not ready, AHCI controller fails to execute
ATAPI commands and reports PORT_IRQ_TF_ERR, but ATI SB600 SATA
controller sets PxSERR.E at the
same time, which is not necessary.
    This patch is just to ignore the INTERNAL ERROR in such case.
Without this patch, ahci error handler will report many errors as
below:
    ----------- cut from dmesg -----------
ata9: soft resetting port
ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
ata9.00: configured for UDMA/33
ata9: EH complete
ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2
ata9.00: (irq_stat 0x40000001)
ata9.00: cmd a0/00:00:00:00:20/00:00:00:00:00/a0 tag 0 cdb 0x0 data 0
        res 51/24:03:00:00:20/00:00:00:00:00/a0 Emask 0x40 (internal error)
ata9: soft resetting port
ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
ata9.00: configured for UDMA/33
ata9: EH complete
ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2
ata9.00: (irq_stat 0x40000001)
ata9.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in
        res 51/24:03:00:00:00/00:00:00:00:00/a0 Emask 0x40 (internal error)
    -------- end cut ---------
Signed-off-by: NConke Hu <conke.hu@amd.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Not yet ready to turn on ATA ACPI by default, for either PATA or SATA.

Also, rename the global-scope module parameter variable 'noacpi' to
something more libata-specific, reducing the potential for namespace
collision.
Signed-off-by: NJeff Garzik <jeff@garzik.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV6]: Set IF_READY if the device is up and has carrier
  [NET_SCHED]: sch_htb/sch_hfsc: fix oops in qlen_notify
  [NET]: Remove dead net/sched/Makefile entry for sch_hpfq.o.

The user can generate console output if they cause do_mmap() to fail
during sys_io_setup().  This was seen in a regression test that does
exactly that by spinning calling mmap() until it gets -ENOMEM before
calling io_setup().

We don't need this printk at all, just remove it.
Signed-off-by: NZach Brown <zach.brown@oracle.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We still need to set the IF_READY flag in ipv6_add_dev for the case
where all addresses (including the link-local) are deleted and then
recreated.  In that case the IPv6 device too will be destroyed and
then recreated.

In order to prevent the original problem, we simply ensure that
the device is up before setting IF_READY.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

During both HTB and HFSC class deletion the class is removed from the
class hash before calling qdisc_tree_decrease_qlen. This makes the
->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL
pointer to ->qlen_notify, causing an oops.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

 	Johannes Berg discovered that kernel space was leaking to
userspace on 64 bit platform. He made a first patch to fix that. This
is an improved version of his patch.
Signed-off-by: NJean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

 	Johannes Berg and Michael Buesch noticed that the WPA ioctls
were missing from the 64<->32 bit conversion. This means that when
using a 32 bits userspace on a 64 bit kernel, those ioctls fail.
Signed-off-by: NJean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Recent changes in the specs that were introduced in commit
740ac4fb were incorrect and resulted in machine check
errors on the PPC architecture for G PHY's with a revision number equal to 1. The
two offending changes are reverted.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix a duplicated leftshift in bcm43xx_radio_set_tx_iq. data_high values are
already leftshifted. Thanks to Michael Buesch for spotting this.
Signed-off-by: NStefano Brivio <stefano.brivio@polimi.it>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There are several places where the PHY version and revision were interchanged.
These are changed in the specifications on 2/13/07 and now use "analog" instead
instead of "version" to help reduce confusion.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] gdth: fix oops in gdth_copy_cmd()
  [SCSI] mptsas: Fix oops for insmod during kexec
  [SCSI] lpfc: avoid double-free during PCI error failure

* git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
  V4L/DVB (5472): Isl6421: don't reference freed memory
  V4L/DVB (5441): Saa7146: Fix allocation of clipping memory
  V4L/DVB (5421): Fix suspend/resume in msp3400 and tuner
  V4L/DVB (5415): Msp_attach must return 0 if no msp3400 was found.
  V4L/DVB (5408): Fix SECAM handling on saa7115
  V4L/DVB (5400): Core: fix several locking related problems
  V4L/DVB (5390): Radio: Fix error in Kbuild file
  V4L/DVB (5332): Ir_rc5_timer_end decoder lockup fix

* git://kvm.qumranet.com/home/avi/kvm:
  KVM: always reload segment selectors
  KVM: Prevent system selectors leaking into guest on real->protected mode transition on vmx