The kernel crashes when ipsec passes a udp packet of about 14XX bytes
of data to aes-xcbc-mac.

It seems the first xxxx bytes of the data are in first sg entry,
and remaining xx bytes are in next sg entry. But we don't 
check next sg entry to see if we need to go look the page up.

I noticed in hmac.c, we do a scatterwalk_sg_next(), to do this check
and possible lookup, thus xcbc.c needs to use this routine too.

A 15-hour run of an ipsec stress test sending streams of tcp and
udp packets of various sizes,  using this patch and 
aes-xcbc-mac completed successfully, so hopefully this fixes the
problem.
Signed-off-by: Joy Latten <latten@austin.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Small typo in the patch recently merged to avoid the unused symbol
message for count_partial(). Discussion thread with confirmation of fix at
http://marc.info/?t=120696854400001&r=1&w=2

Typo in the check if we need the count_partial function that was
introduced by 53625b42Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: fw-ohci: plug dma memory leak in AR handler

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.25:
  sh: Fix up uImage compression type
  remove include/asm-sh/floppy.h
  sh: Fix TIF_USEDFPU clearing under FPU emulation.
  sh: Fix occasional FPU register corruption under preempt.

* 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/ralf/upstream-linus:
  [MIPS] XSS1500: Fix compilation
  [MIPS] Bigsur: make defconfig more useful.
  [MIPS] Alchemy: work around clock misdetection on early Au1000
  [MIPS] Add missing 4KEC TLB refill handler
  [MIPS] BCM1480: Fix PCI/HT IO access
  [MIPS] Fix the installation condition of MIPS clocksource
  [MIPS] Check for GCC r10k-cache-barrier support
  [MIPS] I8253: Export i2853_lock to modules.
  [MIPS] VPE loader: Check result of memory allocation.

This patch corrects an error in the driver it8712f_wdt.  You cannot set
the 16-bit WDT_TIMEOUT access as a 16-bit outw, because the byte
ordering will be wrong.  So just do the high 8 bits as a separate
access.
Signed-off-by: Oliver Schuster <olivers137@aol.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4875/1: Add MODULE_ALIAS to ixp4xx-beeper module
  [ARM] 4873/1: Fix ITE 8152 interrupt demux
  [ARM] 4878/1: Add oabi shim for fstatat64

* 'release' of git://lm-sensors.org/kernel/mhoffman/hwmon-2.6:
  hwmon: (w83781d) Fix I/O resource conflict with PNP

* 'for-linus' of git://git.o-hand.com/linux-rpurdie-leds:
  leds: Remove incorrect use of preempt_count() from leds-gpio
  leds: Fix potential leds-gpio oops

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: make sure input interfaces pin parent input devices
  Input: apm-power - fix crash when unloading modules
  Input: pxa27x - fix keypad KPC macros

Some time ago it turned out that our suspend code ordering broke some
NVidia-based systems that hung if _PTS was executed with one of the PCI
devices, specifically a USB controller, in a low power state.

Then, it was noticed that the suspend code ordering was not compliant
with ACPI 1.0, although it was compliant with ACPI 2.0 (and later), and
it was argued that the code had to be changed for that reason (ref.
http://bugzilla.kernel.org/show_bug.cgi?id=9528).

So we did, but evidently we did wrong, because it's now turning out that
some systems have been broken by this change. Refs:
	http://bugzilla.kernel.org/show_bug.cgi?id=10340
	https://bugzilla.novell.com/show_bug.cgi?id=374217#c16

[ I said at that time that something like this might happend, but the
  majority of people involved thought that it was improbable due to the
  necessity to preserve the compliance of hardware with ACPI 1.0. ]

This actually is a quite serious regression from 2.6.24.

Moreover, the ACPI 1.0 ordering of suspend code introduced another issue
that I have only noticed recently.  Namely, if the suspend of one of
devices fails, the already suspended devices will be resumed without
executing _WAK before, which leads to problems on some systems (for
example, in such situations thermal management is broken on my HP
nx6325).  Consequently, it also breaks suspend debugging on the affected
systems.

Note also, that the requirement to execute _PTS before suspending
devices does not really make sense, because the device in question may
be put into a low power state at run time for a reason unrelated to a
system-wide suspend.

For the reasons outlined above, the change of the suspend ordering
should be reverted, which is done by the patch below.

[ Felix Möller: "I am the reporter from the original Novell Bug:

	https://bugzilla.novell.com/show_bug.cgi?id=374217

  I just tried current git head (two hours ago) with the patch (the one
  from the beginning of this thread) from Rafael and without it.  With
  the patch my MacBook does suspend without it does not." ]
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Tested-by: Felix Möller <felix@derklecks.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Plip uses spin_lock_irq/spin_unlock_irq in its IRQ handler (called from
parport IRQ handler), the latter enables interrupts without parport
subsystem IRQ handler expecting it.

The bug can be seen if you compile kernel with lock dependency checking
and use plip --- it produces a warning.

This patch changes it to spin_lock_irqsave/spin_lock_irqrestore, so that
it doesn't enable interrupts when already disabled.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fixes the compilation of the Au1000 XSS1500
board setup and irqmap code.
Signed-off-by: Florian Fainelli <florian.fainelli@telecomint.eu>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Work around the CPU clock miscalculation on Au1000DA/HA/HB due the
sys_cpupll register being write-only, i.e. actually do what the comment
before cal_r4off() function advertised for years but the code failed at.
This is achieved by just giving user a chance to define the clock
explicitly  in the board config. via CONFIG_SOC_AU1000_FREQUENCY option,
defaulting to 396 MHz if the option is not given...

The patch is based on the AMD's big unpublished patch, the issue seems to
be an undocumented errata (or feature :-)...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Early 4KEc were MIPS32r1 and therefore need some love to get a TLB
refill handler.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

- removed check for enable HT-PCI bridges, because some CFE version
  init only the needed one and scanning works even with disabled HT
  links
- implemented I/O access behind HT PCI busses
- fixed pci_map for IO resource behind PCI bridge

Tested with E100 and Tulip driver.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Check whether gcc supports -mr10-cache-barrier=1 and issue a cleaner
error message if not. This option is needed to build working SGI IP28
kernels.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This fixes:

  ERROR: "i8253_lock" [drivers/input/misc/pcspkr.ko] undefined!
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

And while at it, make it a little cleaner.  Issue originally reported by
Tiejun Chen (tiejun.chen@windriver.com).
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Recent driver core change causes references to parent devices being
dropped early, at device_del() time, as opposed to when all children
are freed. This causes oops in evdev with grabbed devices. Take the
reference to the parent input device ourselves to ensure that it
stays around long enough.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

It appears that we can't just check to see if we're in a task
context ... so instead of trying that, just make the relevant
leds always schedule a little worklet.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Richard Purdie <rpurdie@rpsys.net>

Call gpio_cansleep only after gpio_request succeeded avoiding an
oops.
Signed-off-by: Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Richard Purdie <rpurdie@rpsys.net>

Fix up uImage compression type.
Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This patch removes the unused include/asm-sh/floppy.h
(ARCH_MAY_HAVE_PC_FDC was not enabled).
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Mark Lord wrote:
>
> On boot, syslog is flooded with "uevent: unsupported action-string;" messages.
..
> Mar 28 14:43:29 shrimp kernel: tty ptyqd: uevent: unsupported
> action-string; this will be ignored in a future kernel version
> Mar 28 14:43:29 shrimp kernel: tty ptyqe: uevent: unsupported
> action-string; this will be ignored in a future kernel version
> Mar 28 14:43:29 shrimp kernel: tty ptyqf: uevent: unsupported
> action-string; this will be ignored in a future kernel version
> Mar 28 14:43:29 shrimp kernel: tty ptyr0: uevent: unsupported
> action-string; this will be ignored in a future kernel version
..

These messages are a regression compared with 2.6.24, which did not
flood the syslog with them.

The actual underlying problem was introduced in 2.6.23, when somebody
made the string parsing no longer accept nul-terminated strings as a
valid input to store_uevent().

Eg.  "add\0" was valid prior to 2.6.23, where the code regressed to
require "add" without the '\0'.

This patch fixes the 2.6.23 / 2.6.24 regressions, by having the code
once again tolerate the trailing '\0', if present.

According to GregKH, this mainly affects older Ubuntu systems, such as
the one I have here that requires this fix.
Signed-off-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When getting disconnected we need to release eventual grabs on the
underlying input device as we also release the input device itself.
Otherwise, we would try to release the grab when the client that
requested it closes its handle, accessing the input device which
might already be freed.
Signed-off-by: Björn Steinbrink <B.Steinbrink@gmx.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I accidentally removed the module license from sound/oss/ac97_codec.c in
commit 83bad1d7 ("scheduled OSS driver
removal")

Spotted by Roland <devzero@web.de>.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: fix for non-coherent DMA PowerPC
  drm: radeon: fix sparse integer as NULL pointer warnings in radeon_mem.c
  drm/i915: fix oops on agp=off
  drm/r300: fix bug in r300 userspace hardware wait emission

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: ATA_EHI_LPM should be ATA_EH_LPM
  pata_sil680: only enable MMIO on Cell blades

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: fix defining SUPPORT_VLB_SYNC
  Revert "ide: change master/slave IDENTIFY order"

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 a) every bitwise declaration will give a unique type; use typedefs.

 b) no need to bother with the stuff pointed to by iomem pointers,
    unless it's accessed directly.  noderef will force us to use helpers
    anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>