From: Robert Hentosh <robert_hentosh@dell.com>

Actually, we just stumbled on a different bug found in find_e820_area() in
e820.c.  The following code does not handle the edge condition correctly:

   while (bad_addr(&addr, size) && addr+size < ei->addr + ei->size)
       ;
   last = addr + size;
   if ( last > ei->addr + ei->size )
       continue;

The second statement in the while loop needs to be a <= b so that it is the
logical negavite of the if (a > b) outside it. It needs to read:

   while (bad_addr(&addr, size) && addr+size <= ei->addr + ei->size)
       ;

In the case that failed bad_addr was returning an address that is exactly size
bellow the end of the e820 range.

AK: Again together with the earlier avoid edma fix this fixes
boot on a Dell PE6850/16GB
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Daniel Yeisley <dan.yeisley@unisys.com>

It is possible to boot a Unisys ES7000 with CPUs from multiple cells, and not
also include the memory from those cells.  This can create a scenario where
node 0 has cpus, but no associated memory.  The system will boot fine in a
configuration where node 0 has memory, but nodes 2 and 3 do not.

[AK: I rechecked the code and generic code seems to indeed handle that already.
Dan's original patch had a change for mm/slab.c that seems to be already in now.]
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: "Jan Beulich" <jbeulich@novell.com>

The PM timer code updates vxtime.last_tsc, but this update was done
incorrectly in two ways:
- offset_delay being in microseconds requires multiplying with cpu_mhz
  rather than cpu_khz
- the multiplication of offset_delay and cpu_khz (both being 32-bit
  values) on most current CPUs would overflow (observed value of the
  delay was approximately 4000us, yielding an overflow for frequencies
  starting a little above 1GHz)
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: "Jan Beulich" <jbeulich@novell.com>

When using apic= on the kernel command line, this had no effect for machines
matched by either the ACPI MADT or the MPS OEM table scan. However, when such
option is specified, it should also take effect for this set of systems.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Complaining about the IOMMU not compiled in doesn't make sense
here because it is clearly compiled in.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

ia32_setup_arg_pages would ignore the passed in random stack top
and use its own static value.

Now it uses the 8bit of randomness native i386 would use too.

This indirectly fixes mmap randomization for 32bit processes too,
which depends on the stack randomization.

Should also give slightly better virtual cache colouring and
possibly better performance with HyperThreading.
Signed-off-by: Andi Kleen <ak@suse.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- Drop cic from the list when seen as dead.
- Fixup the locking, just use a simple spinlock.
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
  [AGPGART] VIA PT880 Ultra support.
  [AGPGART] Fix Nforce3 suspend on amd64.
  [AGPGART] Enable SIS AGP driver on x86-64 for EM64T systems

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [[CIFS] Pass truncate open flag through on file open in case setattr fails
  [CIFS] Fix typos in previous fix
  [CIFS] endian fix for new POSIX byte range lock support
  [CIFS] fix memory leak in cifs session info struct on reconnect
  [CIFS] ACPI suspend oops
  [CIFS] Do not limit the length of share names (was 100 for whole UNC name)
  [CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: PPTP helper: fix sstate/cstate typo
  [NETFILTER]: mark H.323 helper experimental
  [NETFILTER]: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343)

on set size to zero.
Signed-off-by: Sebastian Voitzsch <sebastoam/vpotzscj@web.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>

Signed-off-by: Steve French <sfrench@us.ibm.com>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

Signed-off-by: Steve French <sfrench@us.ibm.com>

Wasn't able to reproduce a hard hang, but was able to get an oops if
suspended the machine during a copy to the cifs mount.  This led to some
things hanging, including a "sync".  Also got I/O errors when trying to
access the mount afterwards (even when didn't see the oops), and had
to unmount and remount in order to access the filesystem.

This patch fixed the oops.
Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

during mount. Especially important for some non-Western languages.
Signed-off-by: Steve French <sfrench@us.ibm.com>

Signed-off-by: Steve French <sfrench@us.ibm.com>

Added different lifebook-versions and the CF-18 to the corresponding
dmi-table.
Signed-off-by: Kenan Esau <kenan.esau@conan.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Remove the numbered SW_* entries from the input system and assign names
to the existing users.
Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Correct touchpad left & right keys assignments for ALPS_OLDPROTO
that were swapped. Old protocol is used on UMAX ActionBook-530T
notebook.
Signed-off-by: Yotam Medini <yotam.medini@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

In sw_connect we leak 'buf' and 'idbuf' when we do not leave via one of
the fail* labels. This was spotted by the coverity checker.

Patch is compile tested only due to lack of hardware.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak (CVE-2006-1343).
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] the latest consensus libata resume fix

A typo crept in with commit ea1e847c
which defined TI_LOCAL_FLAGS to be the offset of the `flags' field
of struct thread_info, rather than the `local_flags' field.  This
fixes it.  The typo was pointed out by Guennadi Liakhovetski.
Signed-off-by: Paul Mackerras <paulus@samba.org>

Okay, just to sum things up.

This forces libata to wait for up to 2 seconds for BUSY|DRQ to clear
on resume before continuing.

[jgarzik adds...]  During testing we never saw DRQ asserted, but
nonetheless (a) this works and (b) testing for DRQ won't hurt.
Signed-off-by: Mark Lord <liml@rtr.ca>
Acked-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [PATCH] powerpc: fix RTC/NVRAM accesses on Maple
  [PATCH] ppc32 CPM_UART: various fixes for pq2 uart users
  [PATCH] powerpc: linuxppc64.org no more

Previous fix patches added a bunch of trailing whitespace,
which git-applymbox complained loudly about.

	This is the second lcs driver patch containing the rest of lcs fixes.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Several problems occured with lcs device driver:
	 - device not operational anymore after cable pull/plug-in.
       	 - unpredictable results occured, e.g. kernel panic
	   using cards of type QD8F.
	 - STOPLAN and delete multicast address command
           were not proper recognized by OSA card under heavy network workload.
       	 - channel/device error checks missing in interrupt handler.
	To fix all problems at once recovery of lcs devices has been improved.
	missing error checks in lcs interrupt handler has been added.
	Once a hardware problem occurs lcs will recover the device now properly.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

From: Frank Blaschka <Frank.Blaschka@de.ibm.com>
From: Frank Pavlic <fpavlic@de.ibm.com>

        - fix fake_ll during initial device bringup. fake_ll was
	  not active after first start of the device.
	  Problem only occured when qeth was built without IPV6 support.
        - avoid skb usage after invocation of qeth_flush_buffers,
	  because skb might already be freed.
        - remove yet another useless netif_wake_queue in
	  qeth_softsetup_ipv6 since this function is only called
	  when device is going online. In this case card->state will
	  never be in state UP. So let the net_device queue down .
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

From: Frank Pavlic <fpavlic@de.ibm.com>

	- correct checking of sscanf-%n value in qeth_string_to_ipaddr().
	- don't use netif_stop_queue outside the hard_start_xmit routine.
	  Rather use netif_tx_disable.
	- don't call qeth_netdev_init on a recovery.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

In case of a parse error for the cu3088 group attribute,
return -EINVAL instead of count.
Signed-off-by: Frank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

During a code scan for another change I discovered that this call to
pcnet32_free_ring must be removed.  If the open fails due to a lack of
memory all the ring structures are removed via the call to free_ring
and a subsequent call to open will dereference a null pointer in
pcnet32_init_ring.

Please apply to 2.6.17.
Signed-off-by: Don Fry <brazilnut@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Someone was waaay too aggressive and removed e1000's reboot notifier
instead of porting it to the new way of the shutdown handler.  This change
broke wake on lan.  Add the shutdown handler back in using the same method
as e100 uses.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>

(cherry picked from c653e635 commit)

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes