* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/ipoib: Fix thinko in packet length checks
  IPoIB: Fix use-after-free in path_rec_completion()
  IB/ehca: Make scaling code work without CPU hotplug
  RDMA/cxgb3: Handle build_phys_page_list() failure in iwch_reregister_phys_mem()
  IB/ipath: Check return value of lookup_one_len
  IPoIB: Fix race in detaching from mcast group before attaching
  IPoIB/cm: Fix reaping of stale connections

The PIT has no dedicated mode for shut down. The only way to disable PIT
is to put it into one shot mode. AMD implementations of PIT on Geode
(also observed on Cyrix) are confused by an "empty" transition from
CLOCK_EVT_MODE_UNUSED to CLOCK_EVT_MODE_SHUTDOWN, which puts the PIT
into one shot mode momentarily.

I realized after staring helpless at the bug report
http://bugzilla.kernel.org/show_bug.cgi?id=8027 for quite a while, that
the only change, which might influence the bogomips calibration, is the
above transition during the PIT initialization.

Avoiding the unnecessary switch to oneshot and later to periodic mode
fixes the weird bogomips value and also the resulting slowness.

The fix is confirmed on OLPC and another Geode based box.

Note: this is unrelated to the Dual Core problem discussed here:
http://lkml.org/lkml/2007/3/17/48Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The packet length checks in ipoib are broken: we add 4 bytes (IPoIB
encapsulation header) when sending a packet, not 20 bytes (hardware
address length) to each packet.  Therefore, if connected mode is
enabled so that the interface MTU is larger than the multicast MTU,
IPoIB may end up trying to send too-long multicast packets.  For
example, multicast is broken if a message of size 2048 bytes is sent
on an interface with UD MTU 2048, because 2048 is bigger than the real
limit of 2044 but the code tests against the wrong limit of 2060.

This patch fixes <https://bugs.openfabrics.org/show_bug.cgi?id=418>,
submitted by Scott Weitzenkamp <sweitzen@cisco.com>.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free.  Fix this by changing to the _safe
variant of the list walking macro.

This was spotted by the Coverity checker (CID 1567).
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

eHCA scaling code must not depend on register_cpu_notifier() if
CONFIG_HOTPLUG_CPU is not set, so put all related code into #ifdefs.
Signed-off-by: Joachim Fenkes <fenkes@de.ibm.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

This fixes kernel.org bug 8003.
Signed-off-by: Bryan O'Sullivan <bryan.osullivan@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

There's a race between ipoib_mcast_leave() and ipoib_mcast_join_finish()
where we can try to detach from a multicast group before we've
attached to it.  Fix this by reordering the code in ipoib_mcast_leave
to free the multicast group first, which waits for the multicast
callback thread (which calls ipoib_mcast_join_finish()) to complete
before detaching from the group.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The sense of the time_after_eq() test in ipoib_cm_stale_task() is
reversed so that only non-stale connections are reaped.  Fix this by
changing to time_before_eq().

Noticed by Pradeep Satyanarayana <pradeep@us.ibm.com>.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] Fix wrong /proc/iomem on SGI Altix
  [IA64] Altix: ioremap vga_console_iobase
  [IA64] Fix typo/thinko in crash.c
  [IA64] Fix get_model_name() for mixed cpu type systems
  [IA64] min_low_pfn and max_low_pfn calculation fix

* master.kernel.org:/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  [CRYPTO] tcrypt: Fix error checking for comp allocation
  [CRYPTO] doc: Fix typo in hash example
  [CRYPTO] api: scatterwalk_copychunks() fails to advance through scatterlist

This patch fixes loading the tcrypt module while deflate isn't available
at all (isn't build).
Signed-off-by: Sebastian Siewior <linux-crypto@ml.breakpoint.cc>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

there is a tiny bug in Documentation/crypto/api-intro.txt.
The file has the following example code:

struct scatterlist sg[2];
[...]
if (crypto_hash_digest(&desc, &sg, 2, result))

which does not match the declaration of crypto_hash_digest() in
include/linux/crypto.h.

(static inline int crypto_hash_digest(struct hash_desc *desc,
	struct scatterlist *sg, unsigned int nbytes, u8 *out)

The code in the example passes the address of a pointer (an array actually) as
the second argument, while the function expects the pointer itself.

I have attached a patch to fix this.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

In the loop in scatterwalk_copychunks(), if walk->offset is zero,
then scatterwalk_pagedone rounds that up to the nearest page boundary:

		walk->offset += PAGE_SIZE - 1;
		walk->offset &= PAGE_MASK;

which is a no-op in this case, so we don't advance to the next element
of the scatterlist array:

		if (walk->offset >= walk->sg->offset + walk->sg->length)
			scatterwalk_start(walk, sg_next(walk->sg));

and we end up copying the same data twice.

It appears that other callers of scatterwalk_{page}done first advance
walk->offset, so I believe that's the correct thing to do here.

This caused a bug in NFS when run with krb5p security, which would
cause some writes to fail with permissions errors--for example, writes
of less than 8 bytes (the des blocksize) at the start of a file.

A git-bisect shows the bug was originally introduced by
5c64097a, first in 2.6.19-rc1.
Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

In sn_io_slot_fixup(), the parent is re-set from the bus to
io(port|mem)_resource because the address is changed in a way that it's not
child of the bus any more.

However, only the root is set but not the parent/child/sibling relationship in
the resource tree which causes 'cat /proc/iomem' to stop after this memory
area. Depding on the poition in the tree the iomem may be nearly completely
empty.
Signed-off-by: Bernhard Walle <bwalle@suse.de>
Acked-by: John Keller <jpk@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

When booting an SN system without specifing a console
(i.e., no "console=" on boot line), the system will hang during
boot at the point where /sbin/init is run.

The problem is that vga_console_iobase is not converted to a
virtual address before storing in io_space[0].mmio_base.
The conversion was happening in sn_scan_pcdp(), but not in
setup_vga_console().
Signed-off-by: John Keller <jpk@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Clearly should be checking for "val == DIE_INIT_SLAVE_ENTER".
Signed-off-by: Jay Lan <jlan@sgi.com>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Tony Luck <tony.luck@intel.com>

If a system consists of mixed processor types, kmalloc()
can be called before the per-cpu data page is initialized.
If the slab contains sufficient memory, then kmalloc() works
ok. However, if the slabs are empty, slab calls the memory
allocator. This requires per-cpu data (NODE_DATA()) & the
cpu dies.

Also noted by Russ Anderson who had a very similar patch.
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

We have seen bad_pte_print when testing crashdump on an SN machine in
recent 2.6.20 kernel.  There are tons of bad pte print (pfn < max_low_pfn)
reports when the crash kernel boots up, all those reported bad pages
are inside initmem range; That is because if the crash kernel code and
data happens to be at the beginning of the 1st node. build_node_maps in
discontig.c will bypass reserved regions with filter_rsvd_memory. Since
min_low_pfn is calculated in build_node_map, so in this case, min_low_pfn
will be greater than kernel code and data.

Because pages inside initmem are freed and reused later, we saw
pfn_valid check fail on those pages.

I think this theoretically happen on a normal kernel. When I check
min_low_pfn and max_low_pfn calculation in contig.c and discontig.c.
I found more issues than this.

1. min_low_pfn and max_low_pfn calculation is inconsistent between
contig.c and discontig.c,
min_low_pfn is calculated as the first page number of boot memmap in
contig.c (Why? Though this may work at the most of the time, I don't
think it is the right logic). It is calculated as the lowest physical
memory page number bypass reserved regions in discontig.c.
max_low_pfn is calculated include reserved regions in contig.c. It is
calculated exclude reserved regions in discontig.c.

2. If kernel code and data region is happen to be at the begin or the
end of physical memory, when min_low_pfn and max_low_pfn calculation is
bypassed kernel code and data, pages in initmem will report bad.

3. initrd is also in reserved regions, if it is at the begin or at the
end of physical memory, kernel will refuse to reuse the memory. Because
the virt_addr_valid check in free_initrd_mem.

So it is better to fix and clean up those issues.
Calculate min_low_pfn and max_low_pfn in a consistent way.
Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
Acked-by: Jay Lan <jlan@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: store-init needs trailing membar.

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: new Novatel device ids for option driver
  USB: berry_charge: correct dbg string for second magic command
  usblp: quirk flag and device entry for Seiko Epson M129C printer
  airprime: USB ID for Novatel EV620 mini PCI-E card
  USB: necessary update for mos7720 driver
  USB: RAZR v3i unusual_devs
  USB: two more device ids for dm9601 usbnet driver
  USB: fix usb-serial regression

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Export except_vec_vi_{mori,lui,ori} as text symbols.
  [MIPS] mips-boards: More liberal check for mips-board console
  [MIPS] Misc fixes for plat_irq_dispatch functions
  [MIPS] Qemu: Fix Symmetric Uniprocessor support.
  [MIPS] VI: TRACE_IRQS_OFF clobbers $v0, so save & restore around call.

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  pata_ixp4xx_cf: fix interrupt
  pata_ixp4xx_cf: fix oops on detach
  libata: kernel-doc fix
  sata_inic162x: kill double region requests
  drivers/ata/Kconfig: PATA_SCC depends on wrong platform
  sata_sil24: Add Adaptec 1220SA PCI ID
  libata: don't whine if ->prereset() returns -ENOENT

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4264/1: ldrex/strex syntax errors with recent compilers
  [ARM] Fix breakage caused by 72486f1f

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] zcrypt: fix possible race when unloading zcrypt driver modules
  [S390] zcrypt: fix possible dead lock in AP bus module
  [S390] Wire up sys_utimes.
  [S390] reboot from and dump to SCSI under z/VM fails.
  [S390] Wire up compat_sys_epoll_pwait.
  [S390] strlcpy is smart enough
  [S390] memory detection: fix off by one bug.
  [S390] cio: qdio slsb setup

This moves all of the Novatel device ids to the option driver, where
they belong.

Thanks to Novatel for providing a list of all supported devices.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The manual says that it is required and we actually have crash reports
where loads see stale data due to not having membars here.

In one case the networking does:

	memset(skb, 0, offsetof(struct sk_buff, truesize));

and then some code later checks skb->nohdr for zero, but it's still
the value that was there before the memset().

Note that arch/sparc64/lib/xor.S already got this right.
Signed-off-by: David S. Miller <davem@davemloft.net>

Otherwise objdump will screw up disassembly.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Allows overriding the MALTA/ATLAS/etc. default console setting with
non-serial console devices.
Signed-Off-By: Thiemo Seufer <ths@networkno.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 o adds missing ST0_IM masks, which caused the logging of valid interrupts
   as spurious
 o stops pnx8550 to log every interrupt as spurious
 o adds cause register masks for ip22/ip32, which caused handling of masked
   interrupts
 o removes some superfluous parentheses in the SNI interrupt code
Signed-Off-By: Thiemo Seufer <ths@networkno.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Might be useful for SMP debugging.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

[Rewritten Kconfig bits to deal better fit in the usual pattern of doing
things - Ralf]
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

I was testing the berry_charge module with my Blackberry 8700c and had
great success, thanks. Looking at the code for my own learning I noticed
the following cut and paste error... just a nit.
Signed-off-by: Ken L Johnson <ken@novell.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch (as872) adds a device table entry and a new quirk flag to
the usblp driver for the Seiko Epson Receipt printer.  This printer
returns Vendor-Specific values for bInterfaceClass and
bInterfaceSubClass, but the bInterfaceProtocol value is valid and it
works with usblp.  The new quirks flag tells the driver to ignore the
Class and SubClass values in the interface descriptor.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Add an ID to recognise the Novatel EV620 wireless adapter.
http://www.novatelwireless.com/products/expedite/ev620.html

It looks like a mini PCI-Express adapter.  The mPCIE connector includes USB
pins... the card shows up to the system as a USB device, and powers itself
from the PCI bus.

The card I have isn't activated yet, so I can't get a PPP session up yet, but
I have tested basic serial communication successfully in both 2.6.18 and
2.6.20 kernels, once the product ID was added.  (the driver changed quite a
bit between the two revs.)  In both drivers, it responds to AT commands and
such.
Signed-off-by: Mark Glines <mark@glines.org>
Cc: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

these devices have a shared interrupt endpoint. For serialcore to pass
an interrupt endpoint to a subdriver, the subdriver must define and
_export_ a fitting callback. The mos7720 driver failed to do so. This led
invariably to an oops upon open. This patch fixes it. The driver is useless
without it. Please try to get this into 2.6.21 and the stable kernels that
have this driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This adds an unusual_devs entry for the Motorola RAZR 3vi.

From: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch for the linux-usb-devel tree adds two more
product ids to the dm9601 driver. These ids were found on
rebadged dm9601 devices in the wild.
Signed-off-by: Jon Dowland <jon@alcopop.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch reverts d9a7ecac since it
breaks drivers that need to access the ->port[] array in shutdown
(most of them).

Signed-Off: Jim Radford <radford@blackbean.org>
Acked-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

 As per compact flash specifications, the default
 irq mode upon cf insertion is pulse mode. this patch fixes
 the driver to cope with that.
Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Jeff Garzik <jeff@garzik.org>