commit 51eaaa677691f8da526ce5a3d89e08ee2d2669ce
Merge: b7d6266... 3477d20...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:56:55 2008 -0800

    Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6
    
    * 'linux-next' of git://git.infradead.org/ubifs-2.6:
      UBIFS: pre-allocate bulk-read buffer
      UBIFS: do not allocate too much
      UBIFS: do not print scary memory allocation warnings
      UBIFS: allow for gaps when dirtying the LPT
      UBIFS: fix compilation warnings
      MAINTAINERS: change UBI/UBIFS git tree URLs
      UBIFS: endian handling fixes and annotations
      UBIFS: remove printk

commit b7d626606201c397319b40721ca558b7e54040d5
Merge: e6d9f0f... 6c47535...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:56:17 2008 -0800

    Merge branch 'kvm-updates/2.6.28' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm
    
    * 'kvm-updates/2.6.28' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
      KVM: MMU: avoid creation of unreachable pages in the shadow
      KVM: ppc: stop leaking host memory on VM exit
      KVM: MMU: fix sync of ptes addressed at owner pagetable
      KVM: ia64: Fix: Use correct calling convention for PAL_VPS_RESUME_HANDLER
      KVM: ia64: Fix incorrect kbuild CFLAGS override
      KVM: VMX: Fix interrupt loss during race with NMI
      KVM: s390: Fix problem state handling in guest sigp handler

commit e6d9f0fb5f9ceca5f4945f12cd3e71efd3382c13
Merge: e1825e7... b270ee8...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:55:43 2008 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc64: Fix offset calculation in compute_size()
      rtc: rtc-starfire fixes

commit e1825e7515010053e44287e6e78f9078cd1916a9
Merge: 5d279dc... 44ae98b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:55:05 2008 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits)
      MAINTAINERS: add netdev to ATM
      ATM: horizon, fix hrz_probe fail path
      pppol2tp: Add missing sock_put() in pppol2tp_release()
      net: Fix soft lockups/OOM issues w/ unix garbage collector
      macvlan: don't broadcast PAUSE frames to macvlan devices
      Phonet: fix oops in phonet_address_del() on non-Phonet device
      netfilter: ctnetlink: fix GFP_KERNEL allocation under spinlock
      sungem: Fix PCS_MIICTRL register write in gem_init_phy().
      net: make skb_truesize_bug() call WARN()
      net: hp-plus uses eip_poll
      net/wireless/reg.c: fix bad WARN_ON in if statement
      ath5k: disable beacon filter when station is not associated
      ath5k: fix Security issue in DebugFS part of ath5k
      ath9k: correct expected max RX buffer size
      ath9k: Fix SW-IOMMU bounce buffer starvation
      mac80211 : Fix setting ad-hoc mode and non-ibss channel
      iwlagn: fix DMA sync
      phylib: Add Vitesse VSC8221 SGMII PHY
      rose: zero length frame filtering in af_rose.c
      bridge: netfilter: fix update_pmtu crash with GRE
      ...

commit 5d279dcf98350ac3cbfa43c6aa62f4305408f2df
Merge: e2e2983... ae4e143...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:53:41 2008 -0800

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
      m68k: Update defconfigs for 2.6.28-rc7
      macfb: Do not overflow fb_fix_screeninfo.id

commit e2e29831cc463f4be61d4e36b8699ae7e071a685
Merge: 9a689bc... 9596401...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:53:10 2008 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
      alim15x3: fix sparse warning
      ide: remove dead code from drive_is_ready()
      ide: fix build for DEBUG_PM
      ide: respect current DMA setting during resume
      ide: add SAMSUNG SP0822N with firmware WA100-10 to ivb_list[]
      amd74xx: workaround unreliable AltStatus register for nVidia controllers
      ide: fix the ide_release_lock imbalance

commit 9a689bc4f09f8b89f88e65b1b0a2ea780b4f28de
Merge: 1122b19... dc5c49b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 2 15:52:28 2008 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
      [SCSI] stex: switch to block timeout
      [SCSI] make scsi_eh_try_stu use block timeout
      [SCSI] megaraid_sas: switch to block timeout
      [SCSI] ibmvscsi: switch to block timeout
      [SCSI] aacraid: switch to block timeout
      [SCSI] zfcp: prevent double decrement on host_busy while being busy
      [SCSI] zfcp: fix deadlock between wq triggered port scan and ERP
      [SCSI] zfcp: eliminate race between validation and locking
      [SCSI] zfcp: verify for correct rport state before scanning for SCSI devs
      [SCSI] zfcp: returning an ERR_PTR where a NULL value is expected
      [SCSI] zfcp: Fix opening of wka ports
      [SCSI] zfcp: fix remote port status check
      [SCSI] fc_transport: fix old bug on bitflag definitions
      [SCSI] Fix hang in starved list processing

commit 1122b19b8f4da2ee6d6b21780f86bea7957f641e
Author: Mark Salter <msalter@redhat.com>
Date:   Tue Dec 2 14:38:09 2008 +0000

    MN10300: Fix application of kernel module relocations
    
    This fixes the MN10300 kernel module linking to match the toolchain.  RELA
    relocs don't use the value at the location being relocated.  This has been
    working because the tools always leave the value at the target location
    cleared.
    
    Signed-off-by: Mark Salter <msalter@redhat.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 026bde120a161d9035502a47dd311bd572f6d31f
Author: Dean Nelson <dcn@sgi.com>
Date:   Tue Dec 2 08:06:01 2008 -0600

    sgi-gru: call fs_initcall() if statically linked
    
    If xpc.ko and gru.ko are both statically linked into the kernel, then
    xpc_init() can get called before gru_init() and make a call to one of the
    gru's exported functions before the gru has initialized itself. The end
    result is a NULL dereference.
    
    Signed-off-by: Dean Nelson <dcn@sgi.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 7a0d7940e7c7c143520e38900ddd4e217d3c6640
Author: Kumar Gala <galak@kernel.crashing.org>
Date:   Tue Dec 2 13:37:01 2008 -0600

    powerpc: Use physical cpu id when setting the processor affinity
    
    In the CONFIG_SMP case the irq_choose_cpu() code was returning back
    a logical cpu id not the physical id.  We were writing that directly
    into the HW register.
    
    We need to be calling get_hard_smp_processor_id() so irq_choose_cpu()
    always returns a physical cpu id.
    
    Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 9ff473b9a72942c5ac0ad35607cae28d8d59ed7a
Author: Rik van Riel <riel@redhat.com>
Date:   Tue Dec 2 10:31:52 2008 -0800

    vmscan: evict streaming IO first
    
    Count the insertion of new pages in the statistics used to drive the
    pageout scanning code.  This should help the kernel quickly evict
    streaming file IO.
    
    We count on the fact that new file pages start on the inactive file LRU
    and new anonymous pages start on the active anon list.  This means
    streaming file IO will increment the recent scanned file statistic, while
    leaving the recent rotated file statistic alone, driving pageout scanning
    to the file LRUs.
    
    Pageout activity does its own list manipulation.
    
    Signed-off-by: Rik van Riel <riel@redhat.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Tested-by: Gene Heskett <gene.heskett@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f1d0b063d993527754f062c589b73f125024d216
Author: Kay Sievers <kay.sievers@vrfy.org>
Date:   Tue Dec 2 10:31:50 2008 -0800

    bdi: register sysfs bdi device only once per queue
    
    Devices which share the same queue, like floppies and mtd devices, get
    registered multiple times in the bdi interface, but bdi accounts only the
    last registered device of the devices sharing one queue.
    
    On remove, all earlier registered devices leak, stay around in sysfs, and
    cause "duplicate filename" errors if the devices are re-created.
    
    This prevents the creation of multiple bdi interfaces per queue, and the
    bdi device will carry the dev_t name of the block device which is the
    first one registered, of the pool of devices using the same queue.
    
    [akpm@linux-foundation.org: add a WARN_ON so we know which drivers are misbehaving]
    Tested-by: Peter Korsgaard <jacmet@sunsite.dk>
    Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Kay Sievers <kay.sievers@vrfy.org>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1b79cd04fab80be61dcd2732e2423aafde9a4c1c
Author: Junjiro R. Okajima <hooanon05@yahoo.co.jp>
Date:   Tue Dec 2 10:31:46 2008 -0800

    nfsd: fix vm overcommit crash fix #2
    
    The previous patch from Alan Cox ("nfsd: fix vm overcommit crash",
    commit 731572d39fcd3498702eda4600db4c43d51e0b26) fixed the problem where
    knfsd crashes on exported shmemfs objects and strict overcommit is set.
    
    But the patch forgot supporting the case when CONFIG_SECURITY is
    disabled.
    
    This patch copies a part of his fix which is mainly for detecting a bug
    earlier.
    
    Acked-by: James Morris <jmorris@namei.org>
    Signed-off-by: Alan Cox <alan@redhat.com>
    Signed-off-by: Junjiro R. Okajima <hooanon05@yahoo.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ae4e1434a03207661b4331ea715d3f18cb479123
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Tue Dec 2 20:58:26 2008 +0100

    m68k: Update defconfigs for 2.6.28-rc7
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>

commit 95964018d53f479529dfdc2b46fe30c0a14a00e0
Author: Hannes Eder <hannes@hanneseder.net>
Date:   Tue Dec 2 20:40:04 2008 +0100

    alim15x3: fix sparse warning
    
    Fix this sparse warning:
    
      drivers/ide/alim15x3.c:594:2: warning: returning void-valued expression
    
    Signed-off-by: Hannes Eder <hannes@hanneseder.net>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit a3663801b1bb1b6f6e2be5198cc81bc16f1558fd
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Dec 2 20:40:04 2008 +0100

    ide: remove dead code from drive_is_ready()
    
    We guarantee 400ns delay at the time of issuing the command.
    
    Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 6b7d8fc36272169d1d07a07174f2c8a7909c025e
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Dec 2 20:40:03 2008 +0100

    ide: fix build for DEBUG_PM
    
    Also while at it:
    
    * Drop unused arguments from ide_complete_power_step().
    
    * Move DEBUG_PM printk() from ide_end_drive_cmd() to
      ide_complete_power_step().
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit e9eb8388306364295308132265c00bea685f409f
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Dec 2 20:40:03 2008 +0100

    ide: respect current DMA setting during resume
    
    Respect current DMA setting during resume, otherwise PIO timings
    may get destroyed if host uses shared PIO/MWDMA timings.
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit c7b997b372e8b6e7ee8d91696c74a556754f5fdb
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Dec 2 20:40:03 2008 +0100

    ide: add SAMSUNG SP0822N with firmware WA100-10 to ivb_list[]
    
    Should fix kernel.org bug #10225:
    http://bugzilla.kernel.org/show_bug.cgi?id=10225
    
    Reported-by: Matthias B. <haferfrost@web.de>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Acked-by: Sergei Shtyltov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 6636487e8dc49a1c43fed336bdc4a2f3d7ce6881
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Dec 2 20:40:03 2008 +0100

    amd74xx: workaround unreliable AltStatus register for nVidia controllers
    
    It seems that on some nVidia controllers using AltStatus register
    can be unreliable so default to Status register if the PCI device
    is in Compatibility Mode.  In order to achieve this:
    
    * Add ide_pci_is_in_compatibility_mode() inline helper to <linux/ide.h>.
    
    * Add IDE_HFLAG_BROKEN_ALTSTATUS host flag and set it in amd74xx host
      driver for nVidia controllers in Compatibility Mode.
    
    * Teach actual_try_to_identify() and drive_is_ready() about the new flag.
    
    This fixes the regression caused by removal of CONFIG_IDEPCI_SHARE_IRQ
    config option in 2.6.25 and using AltStatus register unconditionally when
    available (kernel.org bugs #11659 and #10216).
    
    [ Moreover for CONFIG_IDEPCI_SHARE_IRQ=y (which is what most people
      and distributions use) it never worked correctly. ]
    
    Thanks to Remy LABENE and Lars Winterfeld for help with debugging the problem.
    
    More info at:
    http://bugzilla.kernel.org/show_bug.cgi?id=11659
    http://bugzilla.kernel.org/show_bug.cgi?id=10216
    
    Reported-by: Remy LABENE <remy.labene@free.fr>
    Tested-by: Remy LABENE <remy.labene@free.fr>
    Tested-by: Lars Winterfeld <lars.winterfeld@tu-ilmenau.de>
    Acked-by: Borislav Petkov <petkovbb@gmail.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit f9e3326dce0ef117308872cd234b903aa19aa40f
Author: Michael Schmitz <schmitz@biophys.uni-duesseldorf.de>
Date:   Tue Dec 2 20:40:02 2008 +0100

    ide: fix the ide_release_lock imbalance
    
    ide_release_lock() spits out lots of:
    
    	ide_release_lock: bug
    
    warnings on Atari Falcon.
    
    Fix the ide_release_lock imbalance.
    
    Signed-off-by: Michael Schmitz <schmitz@biophys.uni-duesseldorf.de>
    Cc: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 89c223a616cddd9eab792b860f61f99cec53c4e8
Author: Finn Thain <fthain@telegraphics.com.au>
Date:   Tue Nov 18 20:40:40 2008 +0100

    macfb: Do not overflow fb_fix_screeninfo.id
    
    Don't overflow the 16-character fb_fix_screeninfo id string (fixes some
    console erasing and blanking artifacts). Have the ID default to "Unknown"
    on machines with no built-in video and no nubus devices. Check for
    fb_alloc_cmap failure.
    
    Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>

commit dc5c49bff34e5b5a4334560dc7f7dfeae91d8962
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Nov 30 10:38:08 2008 -0600

    [SCSI] stex: switch to block timeout
    
    stex sets the timeout in its slave configure routine for all devices.
    This now needs to update the request queue timeout in block.
    
    Cc: Ed Lin <ed.lin@promise.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 9728c0814ecb505546696a659858fdb761375544
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Nov 30 10:32:26 2008 -0600

    [SCSI] make scsi_eh_try_stu use block timeout
    
    scsi_eh_try_stu() was still using the timeout parameter in the device
    which is now not set (i.e. zero filled) meaning that it waited no time
    at all for the start unit command to complete (leading the routine to
    conclude failure every time).  This lead to a 2.6.27 regression:
    
    http://bugzilla.kernel.org/show_bug.cgi?id=12120
    
    Where firewire devices that were non spec compliant wouldn't spin up.
    
    Fix this by using the block queue timeout value instead.
    
    Reported-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit ee1ab9e945803a607ba5c2a96b69e4820a806552
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Nov 30 10:27:51 2008 -0600

    [SCSI] megaraid_sas: switch to block timeout
    
    megaraid_sas sets the timeout in its slave configure routine for devices
    on special channels.  This now needs to update the request queue timeout
    in block.
    
    Cc: "Yang, Bo" <Bo.Yang@lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 97b5648a8bc2aef980645ee39d31bba0933a6112
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Nov 30 10:20:37 2008 -0600

    [SCSI] ibmvscsi: switch to block timeout
    
    ibmvscsi sets the timeout in its slave configure routine for disk
    devices.  This now needs to update the request queue timeout in block.
    
    Cc: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 8fbd64e2eeb81d4b94be935a15d6d4829ec62aa2
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Sun Nov 30 10:15:37 2008 -0600

    [SCSI] aacraid: switch to block timeout
    
    aacraid updates the timeout in its slave configure routine if it is too
    small.  This now needs to update the request queue timeout in block.
    
    Cc: AACRAID list <aacraid@adaptec.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit f7a65e92e4bef3ccf9e008ed8cd52d914b6a4adb
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Thu Nov 27 11:44:07 2008 +0100

    [SCSI] zfcp: prevent double decrement on host_busy while being busy
    
    The zfcp_scsi_queuecommand was not acting according to the standard
    when the respective unit was not available. In this case an -EBUSY was
    returned, which is not valid in itself, and in addition scsi_done
    was called. This combination is not allowed and was leading to a
    double finish of the request and therefor double decrement of the
    host_busy counter.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit fca55b6fb587e42c7761ee30bd1a6c313a9270c9
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Wed Nov 26 18:07:40 2008 +0100

    [SCSI] zfcp: fix deadlock between wq triggered port scan and ERP
    
    Waiting for the ERP to be finished in a task running in the global
    kernel work-queue is a bad idea, especially if the ERP needs to run
    another job in this work-queue before it can finish. -> deadlock.
    
    This patch removes the necessity to wait for a finished ERP from the
    scan task and moves the job scheduling to the end of the ERP.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 0ac55aa90f2c3bd08e57e52a513b82b18ce0a5bc
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Wed Nov 26 18:07:39 2008 +0100

    [SCSI] zfcp: eliminate race between validation and locking
    
    The check of having a valid pointer was performed before the
    processing was secured by the lock. Between those two steps the
    pointer can turn invalid.  During further processing another value is
    used (referenced by the pointer described above) as a function pointer
    which is never verified to be valid either, resulting under some
    circumstances in an invalid function call.  This patch is fixing both
    issues.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 26871c97d52e50dc574bd01967926650643b142a
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Wed Nov 26 18:07:38 2008 +0100

    [SCSI] zfcp: verify for correct rport state before scanning for SCSI devs
    
    Prevent a SCSI target scan for a rport which have turned invalid
    in the meantime.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 633528c304f20b5c2e3e04d48f620548ce08b12e
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Wed Nov 26 18:07:37 2008 +0100

    [SCSI] zfcp: returning an ERR_PTR where a NULL value is expected
    
    Aborting a SCSI cmnd might requrie to send a abort_fsf_cmnd. If the
    creation of this fsf_req fails an ERR_PTR is returned where a NULL
    value would be expected as an error indicator. This ERR_PTR is
    dereferenced as valid fsf_req in succeeding processing leading to
    an error.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 1c1cba17a9078c83a80a099bc207b208d664a13a
Author: Christof Schmitt <christof.schmitt@de.ibm.com>
Date:   Wed Nov 26 18:07:36 2008 +0100

    [SCSI] zfcp: Fix opening of wka ports
    
    Running two wka_port_get calls in parallel could issue two open_port
    requests, overwriting the port handle. Don't issue an open_port
    for the state PORT_OPENING, and only read the data from GOOD
    responses.
    
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Acked-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit bce02614cd1b3d669af1195695e503e818b60fae
Author: Martin Petermann <martin@linux.vnet.ibm.com>
Date:   Wed Nov 26 18:07:35 2008 +0100

    [SCSI] zfcp: fix remote port status check
    
    For an incoming RSCN it was checked by the ZFCP_STATUS_PORT_DID_DID
    define to re-open a remote port or to test the connection. Since this
    define was re-used it was also necessary to replace that define with
    ZFCP_STATUS_PORT_PHYS_OPEN.
    
    Signed-off-by: Martin Petermann <martin@linux.vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit b270ee8a9fc9547eb781ce9ccd379450bcf9a204
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Dec 1 02:48:26 2008 -0800

    sparc64: Fix offset calculation in compute_size()
    
    The fault address is somewhere inside of the buffer, not
    before it.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 44ae98b53961e7c8c1d47bbffaf08c4f7bf29249
Author: Jiri Slaby <jirislaby@gmail.com>
Date:   Sun Nov 30 23:27:11 2008 -0800

    MAINTAINERS: add netdev to ATM
    
    Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit aac725cf1649d593a13be1edc99ed489f8050a99
Author: Jiri Slaby <jirislaby@gmail.com>
Date:   Sat Nov 29 20:42:28 2008 -0800

    ATM: horizon, fix hrz_probe fail path
    
    One fail path in hrz_probe omitted device disable. Fix it.
    
    Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e6358135147807351db3b7782d3e198a1bba8b62
Author: Frédéric Moulins <frederic.moulins@alsatis.com>
Date:   Fri Nov 28 22:12:02 2008 -0800

    pppol2tp: Add missing sock_put() in pppol2tp_release()
    
    pppol2tp_sock_to_session() do sock_hold() if the session to release is
    not NULL.
    
    Signed-off-by: Frédéric Moulins <frederic.moulins@alsatis.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5f23b734963ec7eaa3ebcd9050da0c9b7d143dd3
Author: dann frazier <dannf@hp.com>
Date:   Wed Nov 26 15:32:27 2008 -0800

    net: Fix soft lockups/OOM issues w/ unix garbage collector
    
    This is an implementation of David Miller's suggested fix in:
      https://bugzilla.redhat.com/show_bug.cgi?id=470201
    
    It has been updated to use wait_event() instead of
    wait_event_interruptible().
    
    Paraphrasing the description from the above report, it makes sendmsg()
    block while UNIX garbage collection is in progress. This avoids a
    situation where child processes continue to queue new FDs over a
    AF_UNIX socket to a parent which is in the exit path and running
    garbage collection on these FDs. This contention can result in soft
    lockups and oom-killing of unrelated processes.
    
    Signed-off-by: dann frazier <dannf@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit efbbced361f3ff4ff9e85310ccff894185c4d904
Author: Patrick McHardy <kaber@trash.net>
Date:   Wed Nov 26 15:30:48 2008 -0800

    macvlan: don't broadcast PAUSE frames to macvlan devices
    
    PAUSE frames are only relevant for the real device, broadcasting them
    to all macvlan devices can cause a significant load increase.
    
    Reported-by: Ben Greear <greearb@candelatech.com>
    Tested-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7e5ab54296a41f590c9cbc976e1c86272f3a7e00
Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Date:   Wed Nov 26 15:26:43 2008 -0800

    Phonet: fix oops in phonet_address_del() on non-Phonet device
    
    A NULL dereference would occur when trying to delete an addres from a
    network device that does not have any Phonet address.
    
    Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3ec192559033ed457f0d7856838654c100fc659f
Author: Patrick McHardy <kaber@trash.net>
Date:   Wed Nov 26 03:57:44 2008 -0800

    netfilter: ctnetlink: fix GFP_KERNEL allocation under spinlock
    
    The previous fix for the conntrack creation race (netfilter: ctnetlink:
    fix conntrack creation race) missed a GFP_KERNEL allocation that is
    now performed while holding a spinlock. Switch to GFP_ATOMIC.
    
    Reported-and-tested-by: Zoltan Borbely <bozo@andrews.hu>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6c475352e87224a8f0b8cc6f6cc96b30563dc5b4
Author: Marcelo Tosatti <mtosatti@redhat.com>
Date:   Tue Nov 25 15:33:10 2008 +0100

    KVM: MMU: avoid creation of unreachable pages in the shadow
    
    It is possible for a shadow page to have a parent link
    pointing to a freed page. When zapping a high level table,
    kvm_mmu_page_unlink_children fails to remove the parent_pte link.
    For that to happen, the child must be unreachable via the shadow
    tree, which can happen in shadow_walk_entry if the guest pte was
    modified in between walk() and fetch(). Remove the parent pte
    reference in such case.
    
    Possible cause for oops in bug #2217430.
    
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit bd51126957eeac96d056c670545ff798c89f63f5
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Nov 26 01:17:01 2008 -0800

    sungem: Fix PCS_MIICTRL register write in gem_init_phy().
    
    Use writel not writeb.
    
    Noticed by Hermann Lauer.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8f480c0e4e120911a673ed7385359bf76ae01963
Author: Arjan van de Ven <arjan@linux.intel.com>
Date:   Tue Nov 25 21:08:13 2008 -0800

    net: make skb_truesize_bug() call WARN()
    
    The truesize message check is important enough to make it print "BUG"
    to the user console... lets also make it important enough to spit a
    backtrace/module list etc so that kerneloops.org can track them.
    
    Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1d71da164d7fb40fac72c0406a4a531265916fc8
Author: Randy Dunlap <randy.dunlap@oracle.com>
Date:   Tue Nov 25 21:05:51 2008 -0800

    net: hp-plus uses eip_poll
    
    hp-plus uses 8390p.c, so it should use eip_poll(), not ei_poll().
    
    drivers/built-in.o: In function `hpp_probe1':
    hp-plus.c:(.init.text+0x9cbd): undefined reference to `ei_poll'
    
    Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d7713ccc7bec64fbe0e4e39f93b17dfec711db7f
Merge: 11c6dd2... 020cf6b...
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Nov 25 14:27:58 2008 -0800

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 020cf6ba7a91ccc5db359f91e9abba175fd3a0aa
Author: Ingo Molnar <mingo@elte.hu>
Date:   Sun Nov 23 20:09:54 2008 +0100

    net/wireless/reg.c: fix bad WARN_ON in if statement
    
    fix:
    
      net/wireless/reg.c:348:29: error: macro "if" passed 2 arguments, but takes just 1
    
    triggered by the branch-tracer.
    
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 02969b38e6f7cef80e71d673d1e512e029a7009f
Author: Martin Xu <martin.xu@intel.com>
Date:   Mon Nov 24 10:49:27 2008 +0800

    ath5k: disable beacon filter when station is not associated
    
    Ath5k driver has too many interrupts per second at idle
    http://bugzilla.kernel.org/show_bug.cgi?id=11749
    
    Signed-off-by: Martin Xu <martin.xu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 33ab625f2a23e743161f7ccd8e774ce3d3891339
Author: Cheng Renquan <crquan@gmail.com>
Date:   Sat Nov 22 11:22:49 2008 +0800

    ath5k: fix Security issue in DebugFS part of ath5k
    
    http://bugzilla.kernel.org/show_bug.cgi?id=12076
    
    Remove any write access to groups and others, only keep write permission
    to its owner, usually only root user.
    
    Reported-by: Jérôme Poulin <jeromepoulin@gmail.com>
    Signed-off-by: Cheng Renquan <crquan@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit b4b6cda2298b0c9a0af902312184b775b8867c65
Author: Luis R. Rodriguez <lrodriguez@atheros.com>
Date:   Thu Nov 20 17:15:13 2008 -0800

    ath9k: correct expected max RX buffer size
    
    We should only tell the hardware its capable of DMA'ing
    to us only what we asked dev_alloc_skb(). Prior to this
    it is possible a large RX'd frame could have corrupted
    DMA data but for us but we were saved only because we
    were previously also pci_map_single()'ing the same large
    value. The issue prior to this though was we were unmapping
    a smaller amount which the prior DMA patch fixed.
    
    Signed-off-by: Bennyam Malavazi <Bennyam.Malavazi@atheros.com>
    Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ca0c7e5101fd4f37fed8e851709f08580b92fbb3
Author: Luis R. Rodriguez <lrodriguez@atheros.com>
Date:   Thu Nov 20 17:15:12 2008 -0800

    ath9k: Fix SW-IOMMU bounce buffer starvation
    
    This should fix the SW-IOMMU bounce buffer starvation
    seen ok kernel.org bugzilla 11811:
    
    http://bugzilla.kernel.org/show_bug.cgi?id=11811
    
    Users on MacBook Pro 3.1/MacBook v2 would see something like:
    
    DMA: Out of SW-IOMMU space for 4224 bytes at device 0000:0b:00.0
    
    Unfortunately its only easy to trigger on MacBook Pro 3.1/MacBook v2
    so far so its difficult to debug (even with swiotlb=force).
    
    We were pci_unmap_single()'ing less bytes than what we called
    for with pci_map_single() and as such we were starving
    the swiotlb from its 64MB amount of bounce buffers. We remain
    consistent and now always use sc->rxbufsize for RX. While at
    it we update the beacon DMA maps as well to only use the data
    portion of the skb, previous to this we were pci_map_single()'ing
    more data for beaconing than what we tell the hardware it can use,
    therefore pushing more iotlb abuse.
    
    Still not sure why this is so easily triggerable on
    MacBook Pro 3.1, it may be the hardware configuration
    tends to use more memory > 3GB mark for DMA.
    
    Signed-off-by: Maciej Zenczykowski <zenczykowski@gmail.com>
    Signed-off-by: Bennyam Malavazi <Bennyam.Malavazi@atheros.com>
    Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 3dd3b79aeadc6f6abc5cc78724d7df3dfcc1bd0b
Author: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
Date:   Thu Nov 20 10:20:31 2008 -0800

    mac80211 : Fix setting ad-hoc mode and non-ibss channel
    
    Patch fixes the kernel trace when user tries to set
    ad-hoc mode on non IBSS channel.
    e.g iwconfig wlan0 chan 36 mode ad-hoc
    
    Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit e91af0af8677198346d5d29f09ab39bb3b0e3faf
Author: Johannes Berg <johannes@sipsolutions.net>
Date:   Wed Nov 19 01:22:51 2008 +0100

    iwlagn: fix DMA sync
    
    For the RX DMA fix for iwlwifi ("iwlagn: fix RX skb alignment") Luis
    pointed out:
    
    > aligned_dma_addr can obviously be > real_dma_addr at this point, what
    > guarantees we can use it on our own whim?
    
    I asked around, and he's right, there may be platforms that do not allow
    passing such such an address to the DMA API functions. This patch
    changes it by using the proper dma_sync_single_range_for_cpu API
    invented for this purpose.
    
    Cc: Luis R. Rodriguez <mcgrof@gmail.com>
    Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit c30f8a6c6d74f67bc2107726cc61a1e7c71e9740
Author: Hollis Blanchard <hollisb@us.ibm.com>
Date:   Mon Nov 24 11:37:38 2008 -0600

    KVM: ppc: stop leaking host memory on VM exit
    
    When the VM exits, we must call put_page() for every page referenced in the
    shadow TLB.
    
    Without this patch, we usually leak 30-50 host pages (120 - 200 KiB with 4 KiB
    pages). The maximum number of pages leaked is the size of our shadow TLB, 64
    pages.
    
    Signed-off-by: Hollis Blanchard <hollisb@us.ibm.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit 11c6dd2c723a9ff9bdd4ee11b2798a08abc94e98
Author: Trent Piepho <tpiepho@freescale.com>
Date:   Tue Nov 25 01:00:47 2008 -0800

    phylib: Add Vitesse VSC8221 SGMII PHY
    
    PHY is mostly compatible with the existing VSC8244 PHY.  The init sequence
    is different and the interrupt mask lacks some bits present in the VSC8244.
    
    Rather than making a copy of the existing VSC234x config_intr function and
    change one constant, I modify it to select the interrupt mask based on
    which driver is calling it.  This lets it be used by both drivers.
    
    Signed-off-by: Trent Piepho <tpiepho@freescale.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 244f46ae6e9e18f6fc0be7d1f49febde4762c34b
Author: Bernard Pidoux <bernard.pidoux@upmc.fr>
Date:   Mon Nov 24 11:49:40 2008 +0000

    rose: zero length frame filtering in af_rose.c
    
    Since changeset e79ad711a0108475c1b3a03815527e7237020b08 from  mainline,
    >From David S. Miller,
    empty packet can be transmitted on connected socket for datagram protocols.
    
    However, this patch broke a high level application using ROSE network protocol with connected datagram.
    
    Bulletin Board Stations perform bulletins forwarding between BBS stations via ROSE network using a forward protocol.
    Now, if for some reason, a buffer in the application software happens to be empty at a specific moment,
    ROSE sends an empty packet via unfiltered packet socket.
    When received, this ROSE packet introduces perturbations of data exchange of BBS forwarding,
    for the application message forwarding protocol is waiting for something else.
    We agree that a more careful programming of the application protocol would avoid this situation and we are
    willing to debug it.
    But, as an empty frame is no use and does not have any meaning for ROSE protocol,
    we may consider filtering zero length data both when sending and receiving socket data.
    
    The proposed patch repaired BBS data exchange through ROSE network that were broken since 2.6.22.11 kernel.
    
    Signed-off-by: Bernard Pidoux <f6bvp@amsat.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 631339f1e544a4d39a63cfe6708c5bddcd5a2c48
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Mon Nov 24 16:06:50 2008 -0800

    bridge: netfilter: fix update_pmtu crash with GRE
    
    As GRE tries to call the update_pmtu function on skb->dst and
    bridge supplies an skb->dst that has a NULL ops field, all is
    not well.
    
    This patch fixes this by giving the bridge device an ops field
    with an update_pmtu function.  For the moment I've left all
    other fields blank but we can fill them in later should the
    need arise.
    
    Based on report and patch by Philip Craig.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit f79fca55f9a6fe54635ad32ddc8a38f92a94ec30
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Nov 24 16:06:17 2008 -0800

    netfilter: xtables: add missing const qualifier to xt_tgchk_param
    
    When entryinfo was a standalone parameter to functions, it used to be
    "const void *". Put the const back in.
    
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b54ad409fd09a395b839fb81f300880d76861c0e
Author: Patrick McHardy <kaber@trash.net>
Date:   Mon Nov 24 15:56:17 2008 -0800

    netfilter: ctnetlink: fix conntrack creation race
    
    Conntrack creation through ctnetlink has two races:
    
    - the timer may expire and free the conntrack concurrently, causing an
      invalid memory access when attempting to put it in the hash tables
    
    - an identical conntrack entry may be created in the packet processing
      path in the time between the lookup and hash insertion
    
    Hold the conntrack lock between the lookup and insertion to avoid this.
    
    Reported-by: Zoltan Borbely <bozo@andrews.hu>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5147d14e995c097571d383fe1287fb33345a51ee
Author: Qinghuang Feng <qhfeng.kernel@gmail.com>
Date:   Sun Nov 23 15:47:24 2008 -0800

    drivers/net/chelsio/sge.c: remove redundant argument comments
    
    remove redundant argument comments
    
    Signed-off-by: Qinghuang Feng <qhfeng.kernel@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ece4af18e07a5cea592ca095844783db4a349cb2
Author: Qinghuang Feng <qhfeng.kernel@gmail.com>
Date:   Sun Nov 23 15:46:55 2008 -0800

    driver/net/*: remove redundant argument comments
    
    remove redundant argument comments in files of drivers/net/*
    
    Signed-off-by: Qinghuang Feng <qhfeng.kernel@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0c0f40bdbe4ddb48ebecfb5c2b56eeb175a57c45
Author: Marcelo Tosatti <mtosatti@redhat.com>
Date:   Fri Nov 21 19:13:58 2008 +0100

    KVM: MMU: fix sync of ptes addressed at owner pagetable
    
    During page sync, if a pagetable contains a self referencing pte (that
    points to the pagetable), the corresponding spte may be marked as
    writable even though all mappings are supposed to be write protected.
    
    Fix by clearing page unsync before syncing individual sptes.
    
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit ce50b91d0f7b0b90e3960a6f306b4027378c7c27
Author: Xiantao Zhang <xiantao.zhang@intel.com>
Date:   Fri Nov 21 10:56:08 2008 +0800

    KVM: ia64: Fix: Use correct calling convention for PAL_VPS_RESUME_HANDLER
    
    PAL_VPS_RESUME_HANDLER should use r26 to hold vac fields according to SDM.
    
    Signed-off-by: Xiantao Zhang <xiantao.zhang@intel.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit 547567c67774d872eb344d21e0f2d7a76eb1e9c5
Author: Xiantao Zhang <xiantao.zhang@intel.com>
Date:   Thu Nov 20 10:35:35 2008 +0800

    KVM: ia64: Fix incorrect kbuild CFLAGS override
    
    Use CFLAGS_vcpu.o, not EXTRA_CFLAGS, to provide fixed register information
    to the compiler.
    
    Signed-off-by: Xiantao Zhang <xiantao.zhang@intel.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit bd2b3ca7686d9470b1b58df631daa03179486182
Author: Avi Kivity <avi@redhat.com>
Date:   Thu Nov 20 11:47:18 2008 +0200

    KVM: VMX: Fix interrupt loss during race with NMI
    
    If an interrupt cannot be injected for some reason (say, page fault
    when fetching the IDT descriptor), the interrupt is marked for
    reinjection.  However, if an NMI is queued at this time, the NMI
    will be injected instead and the NMI will be lost.
    
    Fix by deferring the NMI injection until the interrupt has been
    injected successfully.
    
    Analyzed by Jan Kiszka.
    
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit 3eb77d5116d78cce5b9fa9eb19d012bc636116b6
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Mon Nov 17 14:50:35 2008 +0100

    KVM: s390: Fix problem state handling in guest sigp handler
    
    We can get an exit for instructions starting with 0xae, even if the guest is
    in userspace. Lets make sure, that the signal processor handler is only called
    in guest supervisor mode. Otherwise, send a program check.
    
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>

commit 7e56b5d698707a9934833c47b24d78fb0bcaf764
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Fri Nov 21 16:45:22 2008 -0800

    net: Fix memory leak in the proto_register function
    
    If the slub allocator is used, kmem_cache_create() may merge two or more
    kmem_cache's into one but the cache name pointer is not updated and
    kmem_cache_name() is no longer guaranteed to return the pointer passed
    to the former function. This patch stores the kmalloc'ed pointers in the
    corresponding request_sock_ops and timewait_sock_ops structures.
    
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Reviewed-by: Christoph Lameter <cl@linux-foundation.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 33cf71cee14743185305c61625c4544885055733
Author: Petr Tesarik <ptesarik@suse.cz>
Date:   Fri Nov 21 16:42:58 2008 -0800

    tcp: Do not use TSO/GSO when there is urgent data
    
    This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=12014
    
    Since most (if not all) implementations of TSO and even the in-kernel
    software GSO do not update the urgent pointer when splitting a large
    segment, it is necessary to turn off TSO/GSO for all outgoing traffic
    with the URG pointer set.
    
    Looking at tcp_current_mss (and the preceding comment) I even think
    this was the original intention. However, this approach is insufficient,
    because TSO/GSO is turned off only for newly created frames, not for
    frames which were already pending at the arrival of a message with
    MSG_OOB set. These frames were created when TSO/GSO was enabled,
    so they may be large, and they will have the urgent pointer set
    in tcp_transmit_skb().
    
    With this patch, such large packets will be fragmented again before
    going to the transmit routine.
    
    As a side note, at least the following NICs are known to screw up
    the urgent pointer in the TCP header when doing TSO:
    
    	Intel 82566MM (PCI ID 8086:1049)
    	Intel 82566DC (PCI ID 8086:104b)
    	Intel 82541GI (PCI ID 8086:1076)
    	Broadcom NetXtreme II BCM5708 (PCI ID 14e4:164c)
    
    Signed-off-by: Petr Tesarik <ptesarik@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 38ae07e44bb2dc86770555a1acafcb937ec74478
Author: Randy Dunlap <randy.dunlap@oracle.com>
Date:   Fri Nov 21 16:33:25 2008 -0800

    net/hp-plus: fix link errors
    
    Fix hp-plus driver link errors.
    Builds as loadable module and kernel image driver.
    All drivers that use 8390.o or 8390p.o that will build on
    i386 with MCA/PCI/EISA/ISA were built successfully both
    =m and =y.
    
    drivers/built-in.o: In function `hpp_open':
    hp-plus.c:(.text+0xac06c): undefined reference to `eip_interrupt'
    hp-plus.c:(.text+0xac0d7): undefined reference to `eip_open'
    drivers/built-in.o: In function `hpp_close':
    hp-plus.c:(.text+0xac1bb): undefined reference to `eip_close'
    drivers/built-in.o: In function `hpp_probe1':
    hp-plus.c:(.init.text+0xa98a): undefined reference to `NS8390p_init'
    drivers/built-in.o: In function `hp_plus_probe':
    (.init.text+0xa9fe): undefined reference to `__alloc_eip_netdev'
    
    Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 208fbec5bec1de4fce48aab41efde11ba25ab04c
Author: Cord Walter <cord.walter@gmx.de>
Date:   Thu Nov 20 13:46:57 2008 +0000

    axnet_cs / pcnet_cs: moving PCMCIA_DEVICE_PROD_ID for Netgear FA411
    
    Hi,
    
    after noticing that my Netgear FA411 (PCMCIA-NIC) [1] stopped working with
    the release of the 2.6.25 kernel (sidux-version), I checked the
    respective driver sources and noticed that the pcnet_cs driver bailed
    out with "use axnet_cs instead" for the Netgear FA411, but axnet_cs
    doesn't claim this ID.
    
    I compiled a kernel with the PCMCIA-ID for the netgear card moved to
    axnet_cs from pcnet_cs which worked. I then contacted sidux-kernel
    maintainer Stefan Lippers-Hollmann who turned the info into this patch
    and integrated it into the kernel:
    
    <http://svn.berlios.de/svnroot/repos/fullstory/linux-sidux-2.6/trunk/debian/patches/features/2.6.27.4_PCMCIA_move-PCMCIA-ID-for-Netgear-FA411-from-pcnet_cs-to-axnet_cs.patch>
    
    This works for me and AFAIK there were no reports of any breakage for
    other devices on sidux-support.
    
    This looks like a trivial patch, but since I have very limited
    experience with kernel modifications  I might be woefully wrong there.
    But if there are no side effects of this patch, is it possible to get it
    into the official kernel?
    
    I can provide more detailed information on the affected hardware if
    necessary.
    
    -cord
    
    [1]
    Socket 1 Device 0:      [axnet_cs]              (bus ID: 1.0)
            Configuration:  state: on
            Product Name:   NETGEAR FA411 Fast Ethernet
            Identification: manf_id: 0x0149 card_id: 0x0411
                            function: 6 (network)
                            prod_id(1): "NETGEAR" (0x9aa79dc3)
                            prod_id(2): "FA411" (0x40fad875)
                            prod_id(3): "Fast Ethernet" (0xb4be14e3)
                            prod_id(4): --- (---)
    
    From: Stefan Lippers-Hollmann <s.l-h@gmx.de>
    Date: Sat, 1 Nov 2008 23:53:04 +0000
    Subject: PCMCIA: move PCMCIA ID for Netgear FA411 from pcnet_cs to axnet_cs:
    
    Since kernel 2.6.25, commit 61da96be07ec860e260ca4af0199b9d48d000b80
    (pcnet_cs: if AX88190-based card, printk "use axnet_cs instead" message.),
    pcnet_cs bails out with "use axnet_cs instead" for the Netgear FA411, but
    axnet_cs doesn't claim this ID.
    
    Socket 1 Device 0:      [axnet_cs]              (bus ID: 1.0)
            Configuration:  state: on
            Product Name:   NETGEAR FA411 Fast Ethernet
            Identification: manf_id: 0x0149 card_id: 0x0411
                            function: 6 (network)
                            prod_id(1): "NETGEAR" (0x9aa79dc3)
                            prod_id(2): "FA411" (0x40fad875)
                            prod_id(3): "Fast Ethernet" (0xb4be14e3)
                            prod_id(4): --- (---)
    
    Cc: stable <stable@kernel.org> [2.6.25, 2.6.26, 2.6.27]
    Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
    Signed-off-by: Cord Walter <qord@cwalter.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3477d204658733aa3a87d3ae03b0327c1e599517
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Wed Nov 19 11:53:15 2008 +0200

    UBIFS: pre-allocate bulk-read buffer
    
    To avoid memory allocation failure during bulk-read, pre-allocate
    a bulk-read buffer, so that if there is only one bulk-reader at
    a time, it would just use the pre-allocated buffer and would not
    do any memory allocation. However, if there are more than 1 bulk-
    reader, then only one reader would use the pre-allocated buffer,
    while the other reader would allocate the buffer for itself.
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit 6c0c42cdfd73fb161417403d8d077cb136e10bbf
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Tue Nov 18 20:20:05 2008 +0200

    UBIFS: do not allocate too much
    
    Bulk-read allocates 128KiB or more using kmalloc. The allocation
    starts failing often when the memory gets fragmented. UBIFS still
    works fine in this case, because it falls-back to standard
    (non-optimized) read method, though. This patch teaches bulk-read
    to allocate exactly the amount of memory it needs, instead of
    allocating 128KiB every time.
    
    This patch is also a preparation to the further fix where we'll
    have a pre-allocated bulk-read buffer as well. For example, now
    the @bu object is prepared in 'ubifs_bulk_read()', so we could
    path either pre-allocated or allocated information to
    'ubifs_do_bulk_read()' later. Or teaching 'ubifs_do_bulk_read()'
    not to allocate 'bu->buf' if it is already there.
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit 39ce81ce7168aa7226fb9f182c3a2b57060d0905
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Tue Nov 18 18:09:49 2008 +0200

    UBIFS: do not print scary memory allocation warnings
    
    Bulk-read allocates a lot of memory with 'kmalloc()', and when it
    is/gets fragmented 'kmalloc()' fails with a scarry warning. But
    because bulk-read is just an optimization, UBIFS keeps working fine.
    Supress the warning by passing __GFP_NOWARN option to 'kmalloc()'.
    
    This patch also introduces a macro for the magic 128KiB constant.
    This is just neater.
    
    Note, this is not really fixes the problem we had, but just hides
    the warnings. The further patches fix the problem.
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit be1ffce3527d800ad50b955ede6eb44811cefd03
Author: Alessandro Zummo <a.zummo@towertech.it>
Date:   Fri Nov 21 01:24:38 2008 -0800

    rtc: rtc-starfire fixes
    
    Changes:
    
    - remove locks, rtc class provides them
    - remove unused include
    - if the rtc can't handle set_time, the driver should not fake it
    
    Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 21098c68df7115554fe041170899bdff709efd08
Author: James Smart <James.Smart@Emulex.Com>
Date:   Thu Nov 20 10:58:01 2008 -0500

    [SCSI] fc_transport: fix old bug on bitflag definitions
    
    When the fastfail flag was added, it did not account for the flags
    being bit fields. Correct the definition so there is no longer a
    conflict.
    
    Signed-off-by: James Smart <james.smart@emulex.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 6436cbcd735a11fc93bf3353c68914bc545e6d1e
Author: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Date:   Thu Nov 20 20:43:18 2008 -0800

    phy: fix phy_id detection also for broken hardware.
    
    This patch fixes the case when the phy_ids is mostly Fs and in some case 0x0
    due to broken hardware.
    
    Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 75e07fc3d87ba9b3255e1fcd735186a533ea0754
Author: Andreas Petlund <andreas@petlund.no>
Date:   Thu Nov 20 20:42:25 2008 -0800

    pci: Added quirk to disable msi for MCP55 NIC on Asus P5N32-SLI Premium
    
    Signed-off-by: Andreas Petlund <andreas@petlund.no>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2a3a59e5c977654d3aad5bc11cc0aca2303a7f44
Author: Mike Christie <michaelc@cs.wisc.edu>
Date:   Tue Nov 11 13:42:35 2008 -0600

    [SCSI] Fix hang in starved list processing
    
    Close possible infinite loop with interrupts off when devices are
    added back to the starved list.
    
    Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=11898
    
    Reported-by: <alex.shi@intel.com>
    Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 7e2d9bfa4eabee3e1919a40f20d2ef8b569bd07e
Author: Adrian Hunter <ext-adrian.hunter@nokia.com>
Date:   Wed Nov 5 16:09:04 2008 +0200

    UBIFS: allow for gaps when dirtying the LPT
    
    The LPT may have gaps in it because initially empty LEBs
    are not added by mkfs.ubifs - because it does not know how
    many there are.  Then UBIFS allocates empty LEBs in the
    reverse order that they are discovered i.e. they are
    added to, and removed from, the front of a list.  That
    creates a gap in the middle of the LPT.
    
    The function dirtying the LPT tree (for the purpose of
    small model garbage collection) assumed that a gap could
    only occur at the very end of the LPT and stopped dirtying
    prematurely, which in turn resulted in the LPT running
    out of space - something that is designed to be impossible.
    
    Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>

commit e84461ad9c4f0ff91ab8553596acdb7bf5522df4
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Wed Oct 29 12:08:43 2008 +0200

    UBIFS: fix compilation warnings
    
    We print 'ino_t' type using '%lu' printk() placeholder, but this
    results in many warnings when compiling for Alpha platform. Fix
    this by adding (unsingned long) casts.
    
    Fixes these warnings:
    
    fs/ubifs/journal.c:693: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/journal.c:1131: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/dir.c:163: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/tnc.c:2680: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/tnc.c:2700: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/replay.c:1066: warning: format '%lu' expects type 'long unsigned int', but argument 7 has type 'ino_t'
    fs/ubifs/orphan.c:108: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:135: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:142: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:154: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:159: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:451: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:539: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:612: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:843: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/orphan.c:856: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/recovery.c:1438: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/recovery.c:1443: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/recovery.c:1475: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/recovery.c:1495: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:105: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:105: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:110: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:110: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:114: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:114: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:118: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:118: warning: format '%lu' expects type 'long unsigned int', but argument 3 has type 'ino_t'
    fs/ubifs/debug.c:1591: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1671: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1674: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:1680: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1699: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:1788: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:1821: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:1833: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:1924: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1932: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1938: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1945: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1953: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1960: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1967: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1973: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1988: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'ino_t'
    fs/ubifs/debug.c:1991: warning: format '%lu' expects type 'long unsigned int', but argument 5 has type 'ino_t'
    fs/ubifs/debug.c:2009: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'ino_t'
    
    Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit e2966cbe8901e3f1c120ef82d29c59db1b3bd882
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Sat Oct 25 18:54:04 2008 +0300

    MAINTAINERS: change UBI/UBIFS git tree URLs
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit 0ecb9529a4d47825778e7b0d226eb36019252a9d
Author: Harvey Harrison <harvey.harrison@gmail.com>
Date:   Fri Oct 24 10:52:57 2008 -0700

    UBIFS: endian handling fixes and annotations
    
    Noticed by sparse:
    fs/ubifs/file.c:75:2: warning: restricted __le64 degrades to integer
    fs/ubifs/file.c:629:4: warning: restricted __le64 degrades to integer
    fs/ubifs/dir.c:431:3: warning: restricted __le64 degrades to integer
    
    This should be checked to ensure the ubifs_assert is working as
    intended, I've done the suggested annotation in this patch.
    
    fs/ubifs/sb.c:298:6: warning: incorrect type in assignment (different base types)
    fs/ubifs/sb.c:298:6:    expected int [signed] [assigned] tmp
    fs/ubifs/sb.c:298:6:    got restricted __le64 [usertype] <noident>
    fs/ubifs/sb.c:299:19: warning: incorrect type in assignment (different base types)
    fs/ubifs/sb.c:299:19:    expected restricted __le64 [usertype] atime_sec
    fs/ubifs/sb.c:299:19:    got int [signed] [assigned] tmp
    fs/ubifs/sb.c:300:19: warning: incorrect type in assignment (different base types)
    fs/ubifs/sb.c:300:19:    expected restricted __le64 [usertype] ctime_sec
    fs/ubifs/sb.c:300:19:    got int [signed] [assigned] tmp
    fs/ubifs/sb.c:301:19: warning: incorrect type in assignment (different base types)
    fs/ubifs/sb.c:301:19:    expected restricted __le64 [usertype] mtime_sec
    fs/ubifs/sb.c:301:19:    got int [signed] [assigned] tmp
    
    This looks like a bugfix as your tmp was a u32 so there was truncation in
    the atime, mtime, ctime value, probably not intentional, add a tmp_le64
    and use it here.
    
    fs/ubifs/key.h:348:9: warning: cast to restricted __le32
    fs/ubifs/key.h:348:9: warning: cast to restricted __le32
    fs/ubifs/key.h:419:9: warning: cast to restricted __le32
    
    Read from the annotated union member instead.
    
    fs/ubifs/recovery.c:175:13: warning: incorrect type in assignment (different base types)
    fs/ubifs/recovery.c:175:13:    expected unsigned int [unsigned] [usertype] save_flags
    fs/ubifs/recovery.c:175:13:    got restricted __le32 [usertype] flags
    fs/ubifs/recovery.c:186:13: warning: incorrect type in assignment (different base types)
    fs/ubifs/recovery.c:186:13:    expected restricted __le32 [usertype] flags
    fs/ubifs/recovery.c:186:13:    got unsigned int [unsigned] [usertype] save_flags
    
    Do byteshifting at compile time of the flag value.  Annotate the saved_flags
    as le32.
    
    fs/ubifs/debug.c:368:10: warning: cast to restricted __le32
    fs/ubifs/debug.c:368:10: warning: cast from restricted __le64
    
    Should be checked if the truncation was intentional, I've changed the
    printk to print the full width.
    
    Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

commit 069782a1ee55105220e5ae2db448495dac267cb1
Author: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Date:   Tue Oct 21 12:56:31 2008 +0300

    UBIFS: remove printk
    
    Remove the "UBIFS background thread ubifs_bgd0_0 started" message.
    We kill the background thread when we switch to R/O mode, and
    start it again whan we switch to R/W mode. OLPC is doing this
    many times during boot, and we see this message many times as
    well, which is irritating. So just kill the message.
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>