* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV6] addrconf: Fix IPv6 on tuntap tunnels
  [TCP]: Add missing break to TCP option parsing code
  [SCTP] Don't disable PMTU discovery when mtu is small
  [SCTP] Flag a pmtu change request
  [SCTP] Update pmtu handling to be similar to tcp
  [SCTP] Fix leak in sctp_getsockopt_local_addrs when copy_to_user fails
  [SCTP]: Allow unspecified port in sctp_bindx()
  [SCTP]: Correctly set daddr for IPv6 sockets during peeloff
  [TCP]: Set initial_ssthresh default to zero in Cubic and BIC.
  [TCP]: Fix left_out setting during FRTO
  [TCP]: Disable TSO if MD5SIG is enabled.
  [PPP_MPPE]: Fix "osize too small" check.
  [PATCH] mac80211: Don't stop tx queue on master device while scanning.
  [PATCH] mac80211: fix debugfs tx power reduction output
  [PATCH] cfg80211: fix signed macaddress in sysfs
  [IrDA]: f-timer reloading when sending rejected frames.
  [IrDA]: Fix Rx/Tx path race.

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4445/1: ANUBIS: Fix CPLD registers
  [ARM] 4444/2: OSIRIS: CPLD suspend fix
  [ARM] 4443/1: OSIRIS: Add watchdog device to machine devices
  [ARM] 4442/1: OSIRIS: Fix CPLD register definitions
  [ARM] VFP: fix section mismatch error

The recent patch that added ipv6_hwtype is broken on tuntap tunnels.
Indeed, it's broken on any device that does not pass the ipv6_hwtype
test.

The reason is that the original test only applies to autoconfiguration,
not IPv6 support.  IPv6 support is allowed on any device.  In fact,
even with the ipv6_hwtype patch applied you can still add IPv6 addresses
to any interface that doesn't pass thw ipv6_hwtype test provided that
they have a sufficiently large MTU.  This is a serious problem because
come deregistration time these devices won't be cleaned up properly.

I've gone back and looked at the rationale for the patch.  It appears
that the real problem is that we were creating IPv6 devices even if the
MTU was too small.  So here's a patch which fixes that and reverts the
ipv6_hwtype stuff.

Thanks to Kanru Chen for reporting this issue.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

This flaw does not affect any behavior (currently).
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: move input-polldev to drivers/input
  Input: i8042 - add ULI EV4873 to noloop list
  Input: i8042 - add ASUS P65UP5 to the noloop list
  Input: usbtouchscreen - fix fallout caused by move from drivers/usb

Right now, when we receive a mtu estimate smaller then minim
threshold in the ICMP message, we disable the path mtu discovery
on the transport.  This leads to the never increasing sctp fragmentation
point even when the real path mtu has increased.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

Currently, if the socket is owned by the user, we drop the ICMP
message.  As a result SCTP forgets that path MTU changed and
never adjusting it's estimate.  This causes all subsequent
packets to be fragmented.  With this patch, we'll flag the association
that it needs to udpate it's estimate based on the already updated
routing information.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: Sridhar Samudrala <sri@us.ibm.com>

Introduce new function sctp_transport_update_pmtu that updates
the transports and destination caches view of the path mtu.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: Sridhar Samudrala <sri@us.ibm.com>

If the copy_to_user or copy_user calls fail in sctp_getsockopt_local_addrs(),
the function should free locally allocated storage before returning error.
Spotted by Coverity.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: Sridhar Samudrala <sri@us.ibm.com>

Allow sctp_bindx() to accept multiple address with
unspecified port.  In this case, all addresses inherit
the first bound port.  We still catch full mis-matches.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: Sridhar Samudrala <sri@us.ibm.com>

During peeloff of AF_INET6 socket, the inet6_sk(sk)->daddr
wasn't set correctly since the code was assuming IPv4 only.
Now we use a correct call to set the destination address.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: Sridhar Samudrala <sri@us.ibm.com>

Somehow the code to read the read-only switch of SD cards got lost
in the reorganisation.
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Ignoring OMAP_MMC_STAT_CARD_ERR, treating it as if the command
completed correctly.
Signed-off-by: Ragner Magalhaes <ragner.magalhaes@indt.org.br>
Signed-off-by: Carlos Eduardo Aguiar <carlos.aguiar@indt.org.br>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Because of the current default of 100, Cubic and BIC perform very
poorly compared to standard Reno.

In the worst case, this change makes Cubic and BIC as aggressive as
Reno.  So this change should be very safe.
Signed-off-by: David S. Miller <davem@davemloft.net>

To work around deficiences in Kconfig that allows to "select"
a symbol without automatically selecting all dependencies for
that symbol move input-polldev from drivers/input/misc to
drivers/input thus removing extra dependency on CONFIG_INPUT_MISC.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (89 commits)
  myri10ge: update driver version
  myri10ge: report when the link partner is running in Myrinet mode
  myri10ge: limit the number of recoveries
  NetXen: Fix link status messages
  Revert "[netdrvr e100] experiment with doing RX in a similar manner to eepro100"
  [PATCH] libertas: convert libertas_mpp into anycast_mask
  [PATCH] libertas: actually send mesh frames to mesh netdev
  [PATCH] libertas: deauthenticate from AP in channel switch
  [PATCH] libertas: pull current channel from firmware on mesh autostart
  [PATCH] libertas: reduce SSID and BSSID mixed-case abuse
  [PATCH] libertas: remove WPA_SUPPLICANT structure
  [PATCH] libertas: remove structure WLAN_802_11_SSID and libertas_escape_essid
  [PATCH] libertas: tweak association debug output
  [PATCH] libertas: fix big-endian associate command.
  [PATCH] libertas: don't byte-swap firmware version number. It's a byte array.
  [PATCH] libertas: more endianness fixes, in tx.c this time
  [PATCH] libertas: More endianness fixes.
  [PATCH] libertas: first pass at fixing up endianness issues
  [PATCH] libertas: sparse fixes
  [PATCH] libertas: fix character set in README
  ...

Merge branch 'libertas-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Merge branch 'libertas' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Without FRTO, the tcp_try_to_open is never called with
lost_out > 0 (see tcp_time_to_recover). However, when FRTO is
enabled, the !tp->lost condition is not used until end of FRTO
because that way TCP avoids premature entry to fast recovery
during FRTO.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

Allowing attribute and symlink dentries to be reclaimed means
sd->s_dentry can change dynamically.  However, updates to the field
are unsynchronized leading to race conditions.  This patch adds
sysfs_lock and use it to synchronize updates to sd->s_dentry.

Due to the locking around ->d_iput, the check in sysfs_drop_dentry()
is complex.  sysfs_lock only protect sd->s_dentry pointer itself.  The
validity of the dentry is protected by dcache_lock, so whether dentry
is alive or not can only be tested while holding both locks.

This is minimal backport of sysfs_drop_dentry() rewrite in devel
branch.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The condition check doesn't make much sense as it basically always
succeeds.  This causes NULL dereferencing on certain cases.  It seems
that parentheses are put in the wrong place.  Fix it.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Backport of
ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.22-rc1/2.6.22-rc1-mm1/broken-out/gregkh-driver-sysfs-allocate-inode-number-using-ida.patch

For regular files in sysfs, sysfs_readdir wants to traverse
sysfs_dirent->s_dentry->d_inode->i_ino to get to the inode number.
But, the dentry can be reclaimed under memory pressure, and there is
no synchronization with readdir.  This patch follows Tejun's scheme of
allocating and storing an inode number in the new s_ino member of a
sysfs_dirent, when dirents are created, and retrieving it from there
for readdir, so that the pointer chain doesn't have to be traversed.

Tejun's upstream patch uses a new-ish "ida" allocator which brings
along some extra complexity; this -stable patch has a brain-dead
incrementing counter which does not guarantee uniqueness, but because
sysfs doesn't hash inodes as iunique expects, uniqueness wasn't
guaranteed today anyway.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Update myri10ge driver version to 1.3.1-1.248.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Since Myri-10G boards may also run in Myrinet mode instead of Ethernet,
add a message when we detect that the link partner is not running in the
right mode.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Limit the number of recoveries from a NIC hw watchdog reset to 1 by default.
It enables detection of defective NICs immediately since these memory parity
errors are expected to happen very rarely (less than once per century*NIC).
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

NetXen: Fix incorrect link status even with switch turned OFF.
NetXen driver failed to accurately indicate when a link is up or down.
This was encountered during failover testing, when the first port
indicated that the link was up even when the 10G switch it was assigned
to in the Bladecenter was turned off completely.

Signed-off by: Wen Xiong <wenxiong@us.ibm.com>
Signed-off by: Mithlesh Thukral <mithlesh@netxen.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This reverts commit d52df4a3.

This patch attempted to fix e100 for non-cache coherent memory
architectures by using the cb style code that eepro100 had and using
the EL and s bits from the RFD list. Unfortunately the hardware
doesn't work exactly like this and therefore this patch actually
breaks e100. Reverting the change brings it back to the previously
known good state for 2.6.22. The pending rewrite in progress to this
code can then be safely merged later.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

Prevent mppe_decompress() from generating "osize too small" errors when
checking for output buffer size.  When receiving a packet of mru size the
output buffer for decrypted data is 1 byte too small since
mppe_decompress() tries to account for possible PFC, however later in code
it is assumed no PFC.

Adjusting the check prevented these errors from occurring.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'mac80211-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

With firmware 5.220.11.p5, this allows to specify the anycast addresses the
device will listen to.

The anycast address range is C0:27:C0:27:C0:XX where XX goes from 00 to 1F (or
0 to 31 in dec). The value to write on anycast_mask will specify which
addresses the device listens to. Bits in a 32 bit int are numbered from 0
(least significative bit) to 31. A specific address ending in YY will be
listened to if bit YY in the value is set to one.

Examples:

0x00000000 : do not listen to any anycast address
0xFFFFFFFF : listen to every anycast address from :00 to :1F
0x00000013 : listen to anycast addresses :00, :01 and :04
Signed-off-by: Luis Carlos Cobo <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Found by Luis; got broken during module split.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This avoids channel mismatch between driver and firmware in case we change
channel while associated to an AP.
Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The box does not implement AUX LOOP command properly and so we
can't test for AUX IRQ delivery so blacklist it via DMI and
assume that AUX port is present.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

This board does not raise AUX IRQ in response to AUX LOOP command
which interferes with our test for proper AUX IRQ wiring. Put it
in the blacklist and assume mouse is present.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

During the move from drivers/usb/input into drivers/input/touchscreen
Kconfig variables were shuffled a bit to use a new namespace
(CONFIG_TOUCHSCREEN) while usbtouchscreen was still using old ones.

Also noticed by Robert P. J. Day <rpjday@mindspring.com>
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

mac80211 stops the tx queues during scans. This is wrong with respect
to the master deivce tx queue, since stopping it prevents any probes
from being sent during the scan. Instead, they accumulate in the queue
and are only sent after the scan is finished, which is obviously
wrong.
Signed-off-by: Mattias Nissler <mattias.nissler@gmx.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>