* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)
  net: fix build erros with CONFIG_BUG=n, CONFIG_GENERIC_BUG=n
  ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().
  tg3: Update copyright and driver version
  tg3: Disable 5717 serdes and B0 support
  tg3: Add reliable serdes detection for 5717 A0
  tg3: Fix std rx prod ring handling
  tg3: Fix std prod ring nicaddr for 5787 and 57765
  sfc: Fix conditions for MDIO self-test
  sfc: Fix polling for slow MCDI operations
  e1000e: workaround link issues on busy hub in half duplex on 82577/82578
  e1000e: MDIO slow mode should always be done for 82577
  ixgbe: update copyright dates
  ixgbe: Do not attempt to perform interrupts in netpoll when down
  cfg80211: fix refcount imbalance when wext is disabled
  mac80211: fix queue selection for data frames on monitor interfaces
  iwlwifi: silence buffer overflow warning
  iwlwifi: disable tx on beacon update notification
  iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr
  mac80211: fix endian error
  mac80211: add missing sanity checks for action frames
  ...

Fixed build errors introduced by commit 7ad6848c (ip: fix mc_loop
checks for tunnels with multicast outer addresses)
Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes CERT-FI FICORA #341748

Discovered by Olli Jarva and Tuomo Untinen from the CROSS
project at Codenomicon Ltd.

Just like in CVE-2007-4567, we can't rely upon skb_dst() being
non-NULL at this point.  We fixed that in commit
e76b2b25 ("[IPV6]: Do no rely on
skb->dst before it is assigned.")

However commit 483a47d2 ("ipv6: added
net argument to IP6_INC_STATS_BH") put a new version of the same bug
into this function.

Complicating analysis further, this bug can only trigger when network
namespaces are enabled in the build.  When namespaces are turned off,
the dev_net() does not evaluate it's argument, so the dereference
would not occur.

So, for a long time, namespaces couldn't be turned on unless SYSFS was
disabled.  Therefore, this code has largely been disabled except by
people turning it on explicitly for namespace development.

With help from Eugene Teo <eugene@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch updates the copyright notice for 2010 and updates the version
number to 3.106.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The B0 revision of the 5717 will not get enough testing by the time
2.6.33 ships.  Since the kernel is already at RC3, serdes support
will require too many patches to fix.  For these reasons, this patch
disables 5717 serdes support and will refuse to attach to all 5717
devices that are later than an A0 revision.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The serdes status bit does not work as intended for the 5717 A0.
This patch implements an alternative detection scheme that will only be
valid for A0 revisions.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There are some tg3 devices that require the driver to post new rx
buffers in smaller increments.  Commit
4361935a, "tg3: Consider
rx_std_prod_idx a hw mailbox" changed how the driver tracks the rx
producer ring updates, but it does not make any special considerations
for the above-mentioned devices.  For those devices, it is possible for
the driver to hit the special case path, which updates the hardware
mailbox register but skips updating the shadow software mailbox member.
If the special case path represents the final mailbox update for this
ISR iteration, the hardware and software mailbox values will be out of
sync.  Ultimately, this will cause the driver to use a stale mailbox
value on the next iteration, which will appear to the hardware as a
large rx buffer update.  Bad things ensue.

The fix is to update the software shadow mailbox member when the special
case path is taken.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 87668d35, titled "tg3: Don't
touch RCB nic addresses", tried to avoid assigning the nic address of
the standard producer ring.  Unfortunately, the default nic address is
not correct for the 5787, the 5755M, or the 57765.  This patch
reenables the old behavior and opts out of the assignment only
for the 5717.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Tested-by: Chow Loong Jin <hyperair@ubuntu.com>
Tested-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

The MDIO self-test should not be run on boards without an MDIO PHY,
such as SFN5122F-R3 and later revisions.  It should also not try to
address a specific MMD in an MDIO clause 22 PHY.  Check the
mode_support field to decide which mode to use, if any.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When the interface is down and we are using polled mode for MCDI
operations, we busy-wait for completion for approximately 1 jiffy
using udelay() and then back off to schedule().  But the completion
will not wake the task, since we are using polled mode!  We must use
schedule_timeout_uninterruptible() instead.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch removes a delay in hardware after every received packet allowing
more time for transmitted packets to go out in between received packets in
half duplex.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

A previous 82577 workaround that set the MDIO access speed to slow mode for
every PHY register read/write when the cable is unplugged should instead
set the access mode to always be slow before any PHY register access.
Since the mode bit gets cleared when the PHY is reset, set the mode after
every PHY reset.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Shannon Nelson <shannon.nelson@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch resolves issues seen when running netconsole and rebooting via
reboot -f.  The issue was due to the fact that we were attempting to
perform interrupt actions when the q_vectors and rings had already been
freed via the ixgbe_shutdown routines.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'for-linus/bugfixes' of git://xenbits.xensource.com/people/ianc/linux-2.6:
  xen: fix hang on suspend.

* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: change drm set mode messages as DRM_DEBUG
  drm: fix crtc no modes printf + typo
  drm/radeon/kms: only evict to GTT if CP is ready
  drm/radeon/kms: Fix crash getting TV info with no BIOS.
  drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2)
  drm/radeon/kms/r6xx+: make irq handler less verbose
  drm/radeon/kms: fix up LVDS handling on macs (v2)

Commit ac4c2a3b broke the build
of all powerpc boot wrappers.

It attempts to add an include of autoconf.h but used the wrong
path for it. It also adds -D__KERNEL__ to our boot wrapper, both
things that we pretty much didn't do on purpose so far.

We want our boot wrapper to remain independent enough of the kernel
for various reasons, one of them being that you can "wrap" an existing
kernel at distro install time which allows to ship one kernel image
and a set of boot wrappers for different platforms, the wrappers
don't have to be built out of the same kernel build tree.

It's also incorrect to do what the patch does in our boot environment
since we may not have a proper alignment exception handler which means
we may not be able to fixup the few cases where an unaligned access will
need SW emulation (depends on the core variant, could be when crossing
page or segment boundaries for example).

This patch fixes it by putting the old code back in and using the
new "fancy" variant only when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
is set, which happens not to be set on powerpc since we don't include
autoconf.h. It also reverts the changes to our boot wrapper Makefile.

This means that x86 should, afaik, keep the optimisations since its
boot wrapper does include autoconf.h and define __KERNEL__ (though I
doubt they make that much different outside of slow embedded processors).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: wacom: Add BTN_TOOL_FINGER for pad button reporting
  HID: add device IDs for new model of Apple Wireless Keyboard
  HID: fix pad button definition in hid-wacom
  HID: Support 171 byte variant of Samsung USB IR receiver
  HID: blacklist ET&T TC5UH touchscreen controller

* 'for-33' of git://repo.or.cz/linux-kbuild:
  Makefile: do not override LC_CTYPE
  kbuild: really fix bzImage build with non-bash sh

If __block_prepare_write() was failed in block_write_begin(), the
allocated blocks can be outside of ->i_size.

But new truncate_pagecache() in vmtuncate() does nothing if new < old.
It means the above usage is not working anymore.

So, this patch fixes it by removing "new < old" check. It would need
more cleanup/change. But, now -rc and truncate working is in progress,
so, this tried to fix it minimum change.
Acked-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* fasync-helper:
  fasync: split 'fasync_helper()' into separate add/remove functions

Setting LC_CTYPE=C breaks localized messages in some setups. With only
LC_COLLATE=C and LC_NUMERIC=C, we get almost all we need, except for not
so defined character classes and tolower()/toupper(). The former is not
a big issue, because we can assume that e.g. [:alpha:] will always
include a-zA-Z and we only ever process ASCII input. The latter seems
only affect arch/sh/tools/gen-mach-types, which we can handle separately.

So after this patch the meaning of ranges like [a-z], the behavior of
sort and join, etc. should be the same everywhere and at the same time
gcc should be able to print localized waring and error messages.
LC_NUMERIC=C might not be necessary, but setting it doesn't hurt.
Reported-by: Simon Horman <horms@verge.net.au>
Reported-by: Sergei Trofimovich <slyfox@inbox.ru>
Acked-by: H. Peter Anvin <hpa@zytor.com>
Tested-by: Simon Horman <horms@verge.net.au>
Tested-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Michal Marek <mmarek@suse.cz>

In an x86 build with CONFIG_KERNEL_LZMA enabled and dash as sh,
arch/x86/boot/compressed/vmlinux.bin.lzma ends with
'\xf0\x7d\x39\x00' (16 bytes) instead of the 4 bytes intended and
the resulting vmlinuz fails to boot.  This improves on the
previous behavior, in which the file contained the characters
'-ne ' as well, but not by much.

Previous commits replaced "echo -ne" first with "/bin/echo -ne",
then "printf" in the hope of improving portability, but none of
these commands is guaranteed to support hexadecimal escapes on
POSIX systems.  So use the shell to convert from hexadecimal to
octal.

With this change, an LZMA-compressed kernel built with dash as sh
boots correctly again.
Reported-by: Sebastian Dalfuß <sd@sedf.de>
Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
Reported-by: Michael Guntsche <mike@it-loops.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Cc: Michael Tokarev <mjt@tls.msk.ru>
Cc: Alek Du <alek.du@intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Without this patch xf86-input-wacom driver wasn't able to properly recognise
pad button events. It was also causing some problems with button mapping.
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Added device IDs for the new model of the Apple Wireless Keyboard
(November 2009).
Signed-off-by: Christian Schuerer-Waldheim <csw@xray.at>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

This fix is required for xorg driver to recognise 2 pad buttons
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

In 65f63384 "xen: improve error handling in do_suspend" I said:
    - xs_suspend()/xs_resume() and dpm_suspend_noirq()/dpm_resume_noirq() were not
      nested in the obvious way.
and changed the ordering of the calls as so:
    BEFORE		AFTER
    xs_suspend		dpm_suspend_noirq
    dpm_suspend_noirq	xs_suspend
    *SUSPEND*		*SUSPEND*
    dpm_resume_noirq	dpm_resume_noirq
    xs_resume		xs_resume
Clearly this is not an improvement and I was talking rubbish.

In particular the new ordering is susceptible to a hang if a xenstore write is
in progress at the point at which the suspend kicks in. When the suspend
process calls xs_suspend it tries to take the request_mutex but if a write is
in progress it could be looping in xenbus_xs.c:read_reply() waiting for
something to arrive on &xs_state.reply_list while holding the request_mutex
(taken in the caller of read_reply).

However if we have done dpm_suspend_noirq before xs_suspend then we won't get
any more xenstore interrupts and process_msg() will never be woken up to add
anything to the reply_list.

Fix this by calling xs_suspend before dpm_suspend_noirq. If dpm_suspend_noirq
fails then make sure we go through the xs_suspend_cancel() code path.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Stable Kernel <stable@kernel.org>

* korg/drm-radeon-next
  drm/radeon/kms: only evict to GTT if CP is ready
  drm/radeon/kms: Fix crash getting TV info with no BIOS.
  drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2)
  drm/radeon/kms/r6xx+: make irq handler less verbose
  drm/radeon/kms: fix up LVDS handling on macs (v2)

Following drm info repeat 207 times during one hour, it's quite annoying
[ 1266.286747] [drm] TV-19: set mode NTSC 480i 0

Change from DRM_INFO to DRM_DEBUG
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Toralf Förster pointed out the typo, the fact I forget the if
statement is purely personal fail.
Signed-off-by: Dave Airlie <airlied@redhat.com>

* git://git.infradead.org/battery-2.6:
  pmu_battery: Fix battery full reporting

/sys/bus/pci/drivers/megaraid_sas/poll_mode_io defaults to being
world-writable, which seems bad (letting any user affect kernel driver
behavior).

This turns off group and user write permissions, so that on typical
production systems only root can write to it.
Signed-off-by: Bryn M. Reeves <bmr@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://gitorious.org/linux-omap-dss2/linux:
  OMAP: DSS2: OMAPFB: fix crash when panel driver was not loaded
  OMAP: DSS2: Reject scaling settings when they cannot be supported
  OMAP: DSS2: Make check-delay-loops consistent
  OMAP: DSS2: OMAPFB: fix omapfb_free_fbmem()
  video/omap: add __init/__exit macros to drivers/video/omap/lcd_htcherald.c
  OMAP: DSS2: Fix compile warning
  MAINTAINERS: Combine DSS2 and OMAPFB2 into one entry
  MAINTAINERS: change omapfb maintainer
  OMAP: OMAPFB: add dummy release function for omapdss
  OMAP: OMAPFB: fix clk_get for RFBI
  OMAP: DSS2: RFBI: convert to new kfifo API
  OMAP: DSS2: Fix crash when panel doesn't define enable_te()
  OMAP: DSS2: Collect interrupt statistics
  OMAP: DSS2: DSI: print debug DCS cmd in hex
  OMAP: DSS2: DSI: fix VC channels in send_short and send_null

There are two copies of list_sort() in the tree already, one in the DRM
code, another in ubifs.  Now XFS needs this as well.  Create a generic
list_sort() function from the ubifs version and convert existing users
to it so we don't end up with yet another copy in the tree.
Signed-off-by: Dave Chinner <david@fromorbit.com>
Acked-by: Dave Airlie <airlied@redhat.com>
Acked-by: Artem Bityutskiy <dedekind@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Maybe this will stop people emailing me about it.
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: retry link resume if necessary
  ata_piix: enable 32bit PIO on SATA piix
  sata_promise: don't classify overruns as HSM errors

* master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: Ensure ARMv6/7 mm files are built using appropriate assembler options
  ARM: Fix wrong dmb
  ARM: 5874/1: serial21285: fix disable_irq-from-interrupt-handler deadlock
  ARM: 5873/1: ARM: Fix the reset logic for ARM RealView boards
  ARM: 5872/1: ARM: include needed linux/cpu.h in asm/cpu.h
  ARM: 5871/1: arch/arm: Fix build failure for lpd7a404_defconfig caused by missing includes
  ARM: 5870/1: arch/arm: Fix build failure for defconfigs without CONFIG_ISA_DMA_API set
  ARM: 5868/1: ARM: fix "BUG: using smp_processor_id() in preemptible code"
  ARM: 5867/1: Update U300 defconfig
  ARM: 5866/1: arm ptrace: use unsigned types for kernel pt_regs
  [ARM] pxa: fix strange characters in zaurus gpio .desc
  ARM: add missing recvmmsg syscall number
  [ARM] pxa: fix compiler warnings of unused variable 'id' in cpu_is_pxa9*()
  [ARM] pxa: update pwm_backlight->notify() to include missed 'struct device *'
  [ARM] pxa: enable L2 if present in XSC3
  [ARM] pxa: do not enable L2 after MMU is enabled

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (22 commits)
  MIPS: Ignore vmlinux.*
  MIPS: Move vmlinux.ecoff to arch/mips/boot
  MIPS: cpumask_of_node() should handle -1 as a node
  MIPS: Octeon: Use non-overflowing arithmetic in sched_clock
  MIPS: Malta, PowerTV: Remove unnecessary "Linux started"
  MIPS: BCM63xx: Remove duplicate CONFIG_CMDLINE.
  MIPS: AR7: Remove unused prom_getchar()
  MIPS: PowerTV: Remove extra r4k_clockevent_init() call
  MIPS: Cobalt use strlcat() for the command line arguments
  MIPS: Octeon: Add sched_clock() to csrc-octeon.c
  MIPS: TXx9: Cleanup builtin-cmdline processing
  MIPS: PowerTV: simplify prom_init_cmdline() and merge into prom_init()
  MIPS: PowerTV: Remove unused platform_die()
  MIPS: PowerTV: Remove mips_machine_halt()
  MIPS: PowerTV: Remove unused ptv_memsize
  MIPS: PowerTV: Remove unused prom_getcmdline()
  MIPS: AR7: Remove kgdb_enabled
  MIPS: Alchemy: Correct code taking the size of a pointer
  MIPS: BCM63xx: Fix whitespace damaged board_bcm963xx.c
  MIPS: VR41xx: Use strlcat() for the command line arguments
  ...