Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (31 commits)
  [BRIDGE]: Fix crash in __ip_route_output_key with bridge netfilter
  [NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
  [IPV6] ADDRCONF: Don't generate temporary address for ip6-ip6 interface.
  [IPV6] ADDRCONF: Ensure disabling multicast RS even if privacy extensions are disabled.
  [IPV6]: Use appropriate sock tclass setting for routing lookup.
  [IPV6]: IPv6 extension header structures need to be packed.
  [IPV6]: Fix ipv6 address fetching in raw6_icmp_error().
  [NET]: Return more appropriate error from eth_validate_addr().
  [ISDN]: Do not validate ISDN net device address prior to interface-up
  [NET]: Fix kernel-doc for skb_segment
  [SOCK] sk_stamp: should be initialized to ktime_set(-1L, 0)
  net: check for underlength tap writes
  net: make struct tun_struct private to tun.c
  [SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.
  [SCTP]: Fix compiler warning about const qualifiers
  [SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK
  [SCTP]: Add check for hmac_algo parameter in sctp_verify_param()
  [NET_SCHED] cls_u32: refcounting fix for u32_delete()
  [DCCP]: Fix skb->cb conflicts with IP
  [AX25]: Potential ax25_uid_assoc-s leaks on module unload.
  ...

13 files changed, 139 insertions, 40 deletions

diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index ced83c202cac..ef1a300068dc 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2010,6 +2010,7 @@ isdn_net_init(struct net_device *ndev)
         ndev->flags = IFF_NOARP|IFF_POINTOPOINT;
         ndev->type = ARPHRD_ETHER;
         ndev->addr_len = ETH_ALEN;
+        ndev->validate_addr = NULL;
 
         /* for clients with MPPP maybe higher values better */
         ndev->tx_queue_len = 30;
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 93b7fb246960..a8d3280923e8 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0089"
+#define DRV_VERSION     "EHEA_0090"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
@@ -371,6 +371,7 @@ struct ehea_port_res {
         struct ehea_q_skb_arr rq2_skba;
         struct ehea_q_skb_arr rq3_skba;
         struct ehea_q_skb_arr sq_skba;
+        int sq_skba_size;
         spinlock_t netif_queue;
         int queue_stopped;
         int swqe_refill_th;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 07c742dd3f09..f460b623c077 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -349,7 +349,8 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
         pr->rq1_skba.os_skbs = 0;
 
         if (unlikely(test_bit(__EHEA_STOP_XFER, &ehea_driver_flags))) {
-                pr->rq1_skba.index = index;
+                if (nr_of_wqes > 0)
+                        pr->rq1_skba.index = index;
                 pr->rq1_skba.os_skbs = fill_wqes;
                 return;
         }
@@ -1464,7 +1465,9 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
                           init_attr->act_nr_rwqes_rq2,
                           init_attr->act_nr_rwqes_rq3);
 
-        ret = ehea_init_q_skba(&pr->sq_skba, init_attr->act_nr_send_wqes + 1);
+        pr->sq_skba_size = init_attr->act_nr_send_wqes + 1;
+
+        ret = ehea_init_q_skba(&pr->sq_skba, pr->sq_skba_size);
         ret |= ehea_init_q_skba(&pr->rq1_skba, init_attr->act_nr_rwqes_rq1 + 1);
         ret |= ehea_init_q_skba(&pr->rq2_skba, init_attr->act_nr_rwqes_rq2 + 1);
         ret |= ehea_init_q_skba(&pr->rq3_skba, init_attr->act_nr_rwqes_rq3 + 1);
@@ -2621,6 +2624,22 @@ void ehea_purge_sq(struct ehea_qp *orig_qp)
         }
 }
 
+void ehea_flush_sq(struct ehea_port *port)
+{
+        int i;
+
+        for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++) {
+                struct ehea_port_res *pr = &port->port_res[i];
+                int swqe_max = pr->sq_skba_size - 2 - pr->swqe_ll_count;
+                int k = 0;
+                while (atomic_read(&pr->swqe_avail) < swqe_max) {
+                        msleep(5);
+                        if (++k == 20)
+                                break;
+                }
+        }
+}
+
 int ehea_stop_qps(struct net_device *dev)
 {
         struct ehea_port *port = netdev_priv(dev);
@@ -2845,6 +2864,7 @@ static void ehea_rereg_mrs(struct work_struct *work)
                                         if (dev->flags & IFF_UP) {
                                                 down(&port->port_lock);
                                                 netif_stop_queue(dev);
+                                                ehea_flush_sq(port);
                                                 ret = ehea_stop_qps(dev);
                                                 if (ret) {
                                                         up(&port->port_lock);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 419f533006ab..9f088a47d8b1 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5316,8 +5316,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         /* check the workaround bit for correct mac address order */
         txreg = readl(base + NvRegTransmitPoll);
-        if ((txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) ||
-            (id->driver_data & DEV_HAS_CORRECT_MACADDR)) {
+        if (id->driver_data & DEV_HAS_CORRECT_MACADDR) {
                 /* mac address is already in correct order */
                 dev->dev_addr[0] = (np->orig_mac[0] >>  0) & 0xff;
                 dev->dev_addr[1] = (np->orig_mac[0] >>  8) & 0xff;
@@ -5325,6 +5324,22 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff;
                 dev->dev_addr[4] = (np->orig_mac[1] >>  0) & 0xff;
                 dev->dev_addr[5] = (np->orig_mac[1] >>  8) & 0xff;
+        } else if (txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) {
+                /* mac address is already in correct order */
+                dev->dev_addr[0] = (np->orig_mac[0] >>  0) & 0xff;
+                dev->dev_addr[1] = (np->orig_mac[0] >>  8) & 0xff;
+                dev->dev_addr[2] = (np->orig_mac[0] >> 16) & 0xff;
+                dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff;
+                dev->dev_addr[4] = (np->orig_mac[1] >>  0) & 0xff;
+                dev->dev_addr[5] = (np->orig_mac[1] >>  8) & 0xff;
+                /*
+                 * Set orig mac address back to the reversed version.
+                 * This flag will be cleared during low power transition.
+                 * Therefore, we should always put back the reversed address.
+                 */
+                np->orig_mac[0] = (dev->dev_addr[5] << 0) + (dev->dev_addr[4] << 8) +
+                        (dev->dev_addr[3] << 16) + (dev->dev_addr[2] << 24);
+                np->orig_mac[1] = (dev->dev_addr[1] << 0) + (dev->dev_addr[0] << 8);
         } else {
                 /* need to reverse mac address to correct order */
                 dev->dev_addr[0] = (np->orig_mac[1] >>  8) & 0xff;
@@ -5595,7 +5610,9 @@ out:
 static int nv_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
+        u8 __iomem *base = get_hwbase(dev);
         int rc = 0;
+        u32 txreg;
 
         if (!netif_running(dev))
                 goto out;
@@ -5606,6 +5623,11 @@ static int nv_resume(struct pci_dev *pdev)
         pci_restore_state(pdev);
         pci_enable_wake(pdev, PCI_D0, 0);
 
+        /* restore mac address reverse flag */
+        txreg = readl(base + NvRegTransmitPoll);
+        txreg |= NVREG_TRANSMITPOLL_MAC_ADDR_REV;
+        writel(txreg, base + NvRegTransmitPoll);
+
         rc = nv_open(dev);
 out:
         return rc;
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index af869cf9ae7d..940e2041ba38 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -835,7 +835,8 @@ static int fs_enet_close(struct net_device *dev)
 
         netif_stop_queue(dev);
         netif_carrier_off(dev);
-        napi_disable(&fep->napi);
+        if (fep->fpi->use_napi)
+                napi_disable(&fep->napi);
         phy_stop(fep->phydev);
 
         spin_lock_irqsave(&fep->lock, flags);
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 1d210ed46130..489c7c3b90d9 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -242,12 +242,12 @@ static int macb_mii_init(struct macb *bp)
         /* Enable managment port */
         macb_writel(bp, NCR, MACB_BIT(MPE));
 
-        bp->mii_bus.name = "MACB_mii_bus",
-        bp->mii_bus.read = &macb_mdio_read,
-        bp->mii_bus.write = &macb_mdio_write,
-        bp->mii_bus.reset = &macb_mdio_reset,
-        bp->mii_bus.id = bp->pdev->id,
-        bp->mii_bus.priv = bp,
+        bp->mii_bus.name = "MACB_mii_bus";
+        bp->mii_bus.read = &macb_mdio_read;
+        bp->mii_bus.write = &macb_mdio_write;
+        bp->mii_bus.reset = &macb_mdio_reset;
+        bp->mii_bus.id = bp->pdev->id;
+        bp->mii_bus.priv = bp;
         bp->mii_bus.dev = &bp->dev->dev;
         pdata = bp->pdev->dev.platform_data;
 
@@ -1257,6 +1257,8 @@ static int __exit macb_remove(struct platform_device *pdev)
 
         if (dev) {
                 bp = netdev_priv(dev);
+                if (bp->phy_dev)
+                        phy_disconnect(bp->phy_dev);
                 mdiobus_unregister(&bp->mii_bus);
                 kfree(bp->mii_bus.irq);
                 unregister_netdev(dev);
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 37b42394560d..15fcee55284e 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1446,6 +1446,7 @@ static int __devinit sc92031_probe(struct pci_dev *pdev,
         }
 
         pci_set_drvdata(pdev, dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
 
 #if SC92031_USE_BAR == 0
         dev->mem_start = pci_resource_start(pdev, SC92031_USE_BAR);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 853bce0ac478..f226bcac7d17 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -154,6 +154,7 @@ static const char *yukon2_name[] = {
         "EC",           /* 0xb6 */
         "FE",           /* 0xb7 */
         "FE+",          /* 0xb8 */
+        "Supreme",      /* 0xb9 */
 };
 
 static void sky2_set_multicast(struct net_device *dev);
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 4020e9e955b3..63a54e29d563 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -1326,9 +1326,11 @@ static irqreturn_t smc_interrupt(int irq, void *dev_id)
         SMC_SET_INT_MASK(mask);
         spin_unlock(&lp->lock);
 
+#ifndef CONFIG_NET_POLL_CONTROLLER
         if (timeout == MAX_IRQ_LOOPS)
                 PRINTK("%s: spurious interrupt (mask = 0x%02x)\n",
                        dev->name, mask);
+#endif
         DBG(3, "%s: Interrupt done (%d loops)\n",
                dev->name, MAX_IRQ_LOOPS - timeout);
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index d4655b2d1f3f..96043c5746d0 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.89"
-#define DRV_MODULE_RELDATE      "April 03, 2008"
+#define DRV_MODULE_VERSION      "3.90"
+#define DRV_MODULE_RELDATE      "April 12, 2008"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -12578,7 +12578,8 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
         static int tg3_version_printed = 0;
-        unsigned long tg3reg_base, tg3reg_len;
+        resource_size_t tg3reg_base;
+        unsigned long tg3reg_len;
         struct net_device *dev;
         struct tg3 *tp;
         int err, pm_cap;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7b816a032957..5b5d87585d91 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -67,9 +67,42 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
+/* Uncomment to enable debugging */
+/* #define TUN_DEBUG 1 */
+
 #ifdef TUN_DEBUG
 static int debug;
+
+#define DBG  if(tun->debug)printk
+#define DBG1 if(debug==2)printk
+#else
+#define DBG( a... )
+#define DBG1( a... )
+#endif
+
+struct tun_struct {
+        struct list_head        list;
+        unsigned long           flags;
+        int                     attached;
+        uid_t                   owner;
+        gid_t                   group;
+
+        wait_queue_head_t       read_wait;
+        struct sk_buff_head     readq;
+
+        struct net_device       *dev;
+
+        struct fasync_struct    *fasync;
+
+        unsigned long if_flags;
+        u8 dev_addr[ETH_ALEN];
+        u32 chr_filter[2];
+        u32 net_filter[2];
+
+#ifdef TUN_DEBUG
+        int debug;
 #endif
+};
 
 /* Network device part of the driver */
 
@@ -253,8 +286,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
                         return -EFAULT;
         }
 
-        if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV)
+        if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
                 align = NET_IP_ALIGN;
+                if (unlikely(len < ETH_HLEN))
+                        return -EINVAL;
+        }
 
         if (!(skb = alloc_skb(len + align, GFP_KERNEL))) {
                 tun->dev->stats.rx_dropped++;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 8cc316653a39..0ee4c168e4c0 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3833,6 +3833,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         struct device_node *phy;
         int err, ucc_num, max_speed = 0;
         const phandle *ph;
+        const u32 *fixed_link;
         const unsigned int *prop;
         const char *sprop;
         const void *mac_addr;
@@ -3923,18 +3924,38 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ug_info->uf_info.regs = res.start;
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
+        fixed_link = of_get_property(np, "fixed-link", NULL);
+        if (fixed_link) {
+                ug_info->mdio_bus = 0;
+                ug_info->phy_address = fixed_link[0];
+                phy = NULL;
+        } else {
+                ph = of_get_property(np, "phy-handle", NULL);
+                phy = of_find_node_by_phandle(*ph);
 
-        ph = of_get_property(np, "phy-handle", NULL);
-        phy = of_find_node_by_phandle(*ph);
+                if (phy == NULL)
+                        return -ENODEV;
 
-        if (phy == NULL)
-                return -ENODEV;
+                /* set the PHY address */
+                prop = of_get_property(phy, "reg", NULL);
+                if (prop == NULL)
+                        return -1;
+                ug_info->phy_address = *prop;
+
+                /* Set the bus id */
+                mdio = of_get_parent(phy);
+
+                if (mdio == NULL)
+                        return -1;
 
-        /* set the PHY address */
-        prop = of_get_property(phy, "reg", NULL);
-        if (prop == NULL)
-                return -1;
-        ug_info->phy_address = *prop;
+                err = of_address_to_resource(mdio, 0, &res);
+                of_node_put(mdio);
+
+                if (err)
+                        return -1;
+
+                ug_info->mdio_bus = res.start;
+        }
 
         /* get the phy interface type, or default to MII */
         prop = of_get_property(np, "phy-connection-type", NULL);
@@ -3979,20 +4000,6 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
                 ug_info->numThreadsRx = UCC_GETH_NUM_OF_THREADS_4;
         }
 
-        /* Set the bus id */
-        mdio = of_get_parent(phy);
-
-        if (mdio == NULL)
-                return -1;
-
-        err = of_address_to_resource(mdio, 0, &res);
-        of_node_put(mdio);
-
-        if (err)
-                return -1;
-
-        ug_info->mdio_bus = res.start;
-
         if (netif_msg_probe(&debug))
                 printk(KERN_INFO "ucc_geth: UCC%1d at 0x%8x (irq = %d) \n",
                         ug_info->uf_info.ucc_num + 1, ug_info->uf_info.regs,
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index a3df09ee729f..8005dd16fb4e 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -150,9 +150,13 @@ config HDLC_FR
 
 config HDLC_PPP
         tristate "Synchronous Point-to-Point Protocol (PPP) support"
-        depends on HDLC
+        depends on HDLC && BROKEN
         help
           Generic HDLC driver supporting PPP over WAN connections.
+          This module is currently broken and will cause a kernel panic
+          when a device configured in PPP mode is activated.
+
+          It will be replaced by new PPP implementation in Linux 2.6.26.
 
           If unsure, say N.