Wrong choice of port number caused modify_qp() to fail -- fixed.
Signed-off-by: NJoachim Fenkes <fenkes@de.ibm.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

When checking the states passed in, mlx4_qp_modify() accidentally checks
cur_state twice rather than checking cur_state and new_state.  Fix this
to make sure that both values are in-bounds.

Since these values may be passed in from userspace, this bug results in
userspace being able to trigger an oops.
Signed-off-by: NJack Morgenstein <jackm@dev.mellanox.co.il>
Cc: stable <stable@kernel.org>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

The error codes for ib_post_send(), ib_post_recv(), and ib_post_srq_recv()
were inconsistent. Use EINVAL for too many SGEs and ENOMEM for too many
WRs.
Signed-off-by: NRalph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

The wrong offset was being returned to libipathverbs so that when
ibv_modify_srq() calls mmap(), it always fails.
Signed-off-by: NRalph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

This patch fixes the code which frees the partially allocated QP
resources if there was an error while creating the QP. In particular,
the QPN wasn't deallocated and the QP wasn't removed from the hash
table.
Signed-off-by: NRalph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

The wrong offset was being returned to libipathverbs so that when
ibv_resize_cq() calls mmap(), it always fails.
Signed-off-by: NRalph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

This patch enables VLAN support on sunhme by increasing BMAC_TXMAX/BMAC_RXMAX
and allocating extra space via skb_put for the VLAN header.
Signed-off-by: NChris Poon <dev-null@telus.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

eth_type_trans() now sets skb->dev.  Access skb->def after it gets
set.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Recent (i.e. 2005 and later) Sony Vaio laptops have names beginning
with VGN rather than PCG. Update the eeprom driver so that it
recognizes these.
Signed-off-by: NJean Delvare <khali@linux-fr.org>

The sysfs interface to DMI data takes care to not make the system
serial number and UUID world-readable, presumably due to privacy
concerns. For consistency, we should not let the eeprom driver
export these same strings to the world on Sony Vaio laptops.
Instead, only make them readable by root, as we already do for BIOS
passwords.
Signed-off-by: NJean Delvare <khali@linux-fr.org>

Turns out we don't actually check the status to see if there was a
device out there to talk to, just if we had a timeout when doing so.

Add the proper check, so we don't falsly think there are devices
on the bus that are not there, etc.
Signed-off-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

Signed-off-by: NRobert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

i2c_check_addr is only used inside i2c-core now, so we can make it
static and stop exporting it. Thanks to David Brownell for noticing.
Signed-off-by: NJean Delvare <khali@linux-fr.org>

Let i2c-dev deal properly with new-style i2c clients. Instead of
considering them always busy, it needs to check wether a driver is
bound to them or not.

This is still not completely correct, as the client could become
busy later, but the same problem already existed before new-style
clients were introduced. We'll want to fix it someday.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NDavid Brownell <dbrownell@users.sourceforge.net>

This adds some "how does this work" comments to the i2c-dev driver,
plus separators between the three main components:

  - The parallel list of i2c_adapters ("i2c_dev_list"), each of which
    gets a "struct i2c_dev" and a /dev/i2c-X character special file.

  - An i2cdev_driver gets adapter add/remove notifications, which are
    used to maintain that list of adapters.

  - Special file operations, which let userspace talk either directly to
    the adapter (for i2c_msg operations) or through cached addressing info
    using an anonymous i2c_client (never registered anywhere).

Plus there's the usual module load/unload record keeping.

After making sense of this code, I think that the anonymous i2c_client
is pretty shady.  But since it's never registered, using this code with
a system set up for "new style" I2C drivers is no more complicated than
always using the I2C_SLAVE_FORCE ioctl (instead of I2C_SLAVE).
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

This reverts commit 7fb7ac24.

Heikki Orsila reports that it causes a regression:

  "Doing

	nc host port < /dev/zero

   on a sending machine (not skge) to an skge machine that is receiving:

	nc -l -p port >/dev/null

   with ~60 MiB/s speed, causes the interface go malfunct. A slow
   transfer doesn't cause a problem."

See

	http://bugzilla.kernel.org/show_bug.cgi?id=9321

for some more information.

There is a workaround (also reported by Heikki):

  "After some fiddling, I noticed that not changing the register write
   order on patch:

   +       skge_write32(hw, RB_ADDR(q, RB_END), end);
           skge_write32(hw, RB_ADDR(q, RB_WP), start);
           skge_write32(hw, RB_ADDR(q, RB_RP), start);
   -       skge_write32(hw, RB_ADDR(q, RB_END), end);

   fixes the visible effect..  Possibly not the root cause of the
   problem, but changing the order back fixes networking here."

but that has yet to be ack'ed or tested more widely, so the whole
problem-causing commit gets reverted until this is resolved properly.
Bisected-and-requested-by: NHeikki Orsila <shdl@zakalwe.fi>
Cc: Stephen Hemminger <shemminger@linux-foundation.org>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Simple mtu change when device is down.
Fix http://bugzilla.kernel.org/show_bug.cgi?id=9382.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Declare mac using DECLARE_MAC_BUF for use when calling print_mac().

This fixes compile error where mac was undeclared.
Also, remove unused variable i.
Signed-off-by: NJesper Nilsson <jesper.nilsson@axis.com>
Cc: Mikael Starvik <mikael.starvik@axis.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

New and improved serial driver for CRISv10, take three, with improvements
suggested by Jiri Slaby.

- Call wait_event_interruptible with a _correct_ and sensible condition.
- Removed superfluous test of info->flags & ASYNC_CLOSING, since that is done
  by wait_event_interruptible.
- Moved common code for deregistering DMA and IRQ to deinit_port function.
- Use setup_timer when initializing flush_timer.
- Convert bit-field for uses_dma_in and uses_dma_out to regular bytes.
- Removed CVS tags.
- Removed defines and comments for CRIS_BUF_SIZE and TTY_THRESHOLD_THROTTLE
  (no longer used).
- Cleaned up code to pass checkpatch.
- Add crisv10.h header file.
- Merge of CRISv10 from Axis internal CVS.
Signed-off-by: NJesper Nilsson <jesper.nilsson@axis.com>
Reviewed-by: NJiri Slaby <jirislaby@gmail.com>
Cc: Mikael Starvik <starvik@axis.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix locking bug noted by  Roel Kluin <12o3l@tiscali.nl>.

Cc: Jeff Garzik <jeff@garzik.org>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Mikael Starvik <starvik@axis.com>
Cc: Roel Kluin <12o3l@tiscali.nl>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

New (updated) version of ethernet driver for cris v10.

- First steps to simplify and make the MII code more similar
  between the etrax100 and etraxfs ports.

- Start the transmit queue before enabling tx interrupts
  to avoid race with the first frame.

- Flip the comparition statement to stick to physical addresses
  to avoid phys_to_virt mapping a potential null pointer.
  This was not an error but the change simplifies debugging
  of address-space mappings.

- Made myPrevRxDesc local to e100_rx since it was only used there.
  Fixed out of memory handling in e100_rx.  If dev_alloc_skb() fails
  persistently the system is hosed anyway but at least it won't
  loop in an interrupt handler.

- Correct some code formatting issues.

- Add defines SET_ETH_ENABLE_LEDS, SET_ETH_DISABLE_LEDS
  and SET_ETH_AUTONEG used in new cris v10 ethernet driver.
Signed-off-by: NJesper Nilsson <jesper.nilsson@axis.com>
Acked-by: NMikael Starvik <starvik@axis.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

arm:

drivers/scsi/aic94xx/aic94xx_sds.c:381:1: warning: "FLASH_SIZE" redefined
In file included from include/asm/arch/irqs.h:22,
                 from include/asm/irq.h:4,
                 from include/asm/hardirq.h:6,
                 from include/linux/hardirq.h:7,
                 from include/asm-generic/local.h:5,
                 from include/asm/local.h:1,
                 from include/linux/module.h:19,
                 from include/linux/device.h:21,
                 from include/linux/pci.h:52,
                 from drivers/scsi/aic94xx/aic94xx_sds.c:28:
include/asm/arch/platform.h:444:1: warning: this is the location of the previous definition

Cc: Gilbert Wu <gilbert_wu@adaptec.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant code leading to NULL ptr deref and let terminal config
settings take place in the proper initialization path in
usb_console_setup().
Signed-off-by: NBorislav Petkov <bbpetkov@yahoo.de>
Cc: <lucy@keyspan.com>
Cc: Greg KH <greg@kroah.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Check if AC state has changed across resume and notify userspace if so.

Fixes "[2.6.24-rc1 regression] AC adapter state does not change after resume"
Signed-off-by: NAlexey Starikovskiy <astarikovskiy@suse.de>
Tested-by: NAndrey Borzenkov <arvidjaar@mail.ru>
Cc: Len Brown <lenb@kernel.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Do not provide /proc/acpi/ac_adapter if ACPI_PROCFS is not defined.  This
eliminates duplicated power adapters in HAL and makes it consistent with
battery module
Signed-off-by: NAndrey Borzenkov <arvidjaar@mail.ru>
Acked-by: NAlexey Starikovskiy <astarikovskiy@suse.de>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make 'default_mode' and 'default_var' be __initdata.
Fixes these section warnings:

WARNING: vmlinux.o(.data+0x128e0): Section mismatch: reference to .init.data:default_mode_CRT (between 'default_mode' and 'default_var')
WARNING: vmlinux.o(.data+0x128e4): Section mismatch: reference to .init.data:default_var_CRT (between 'default_var' and 'dev_attr_size')
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We have seen ramdisk based install systems, where some pages of mapped
libraries and programs were suddendly zeroed under memory pressure.  This
should not happen, as the ramdisk avoids freeing its pages by keeping them
dirty all the time.

It turns out that there is a case, where the VM makes a ramdisk page clean,
without telling the ramdisk driver.  On memory pressure shrink_zone runs
and it starts to run shrink_active_list.  There is a check for
buffer_heads_over_limit, and if true, pagevec_strip is called.
pagevec_strip calls try_to_release_page.  If the mapping has no releasepage
callback, try_to_free_buffers is called.  try_to_free_buffers has now a
special logic for some file systems to make a dirty page clean, if all
buffers are clean.  Thats what happened in our test case.

The simplest solution is to provide a noop-releasepage callback for the
ramdisk driver.  This avoids try_to_free_buffers for ramdisk pages.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Acked-by: NNick Piggin <npiggin@suse.de>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The tle62x0 driver was ignoring all read errors.  This patch makes it
pass such errors up the stack, instead of returning bogus data.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

"Luming Yu" <luming.yu@gmail.com> says:

  There is a "ttyS1 irq is -1" problem observed on tiger4 which cause the
  serial port broken.

  It is because that there is __no__ ACPI IRQ resource assigned for the
  serial port.  So the value of the IRQ for the port is never changed since it
  got initialized to -1.

If PNP supplies a valid IRQ, use it.  Otherwise, leave port.irq == 0, which
means "no IRQ" to the serial core.
Signed-off-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Yu Luming <luming.yu@intel.com>
Acked-by: NMatthew Wilcox <matthew@wil.cx>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The i5000_edac driver's PCI registration structure has the name
""i5000_edac"" (with extra set of double-quotes) which is probably not
intentional.  Get rid of __stringify.
Signed-off-by: NDarrick J. Wong <djwong@us.ibm.com>
Cc: Doug Thompson <norsk5@yahoo.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Firmware like PNPBIOS or ACPI can report the address space consumed by the
RTC.  The actual space consumed may be less than the size (RTC_IO_EXTENT)
assumed by the RTC driver.

The PNP core doesn't request resources yet, but I'd like to make it do so.
If/when it does, the RTC_IO_EXTENT request may fail, which prevents the RTC
driver from loading.

Since we only use the RTC index and data registers at RTC_PORT(0) and
RTC_PORT(1), we can fall back to requesting just enough space for those.

If the PNP core requests resources, this results in typical I/O port usage
like this:

    0070-0073 : 00:06		<-- PNP device 00:06 responds to 70-73
      0070-0071 : rtc		<-- RTC driver uses only 70-71

instead of the current:

    0070-0077 : rtc		<-- RTC_IO_EXTENT == 8
Signed-off-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: David Brownell <david-b@pacbell.net>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The misc_register() error path always released an I/O port region,
even if the region was memory-mapped (only mips uses memory-mapped RTC,
as far as I can see).
Signed-off-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: David Brownell <david-b@pacbell.net>
Acked-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add support for version 2 of the ioatdma device.  This device handles
the descriptor chain and DCA services slightly differently:
 - Instead of moving the dma descriptors between a busy and an idle chain,
   this new version uses a single circular chain so that we don't have
   rewrite the next_descriptor pointers as we add new requests, and the
   device doesn't need to re-read the last descriptor.
 - The new device has the DCA tags defined internally instead of needing
   them defined statically.
Signed-off-by: NShannon Nelson <shannon.nelson@intel.com>
Cc: "Williams, Dan J" <dan.j.williams@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

<debug output from Joel's system>
handling stripe 7629696, state=0x14 cnt=1, pd_idx=2 ops=0:0:0
check 5: state 0x6 toread 0000000000000000 read 0000000000000000 write fffff800ffcffcc0 written 0000000000000000
check 4: state 0x6 toread 0000000000000000 read 0000000000000000 write fffff800fdd4e360 written 0000000000000000
check 3: state 0x1 toread 0000000000000000 read 0000000000000000 write 0000000000000000 written 0000000000000000
check 2: state 0x1 toread 0000000000000000 read 0000000000000000 write 0000000000000000 written 0000000000000000
check 1: state 0x6 toread 0000000000000000 read 0000000000000000 write fffff800ff517e40 written 0000000000000000
check 0: state 0x6 toread 0000000000000000 read 0000000000000000 write fffff800fd4cae60 written 0000000000000000
locked=4 uptodate=2 to_read=0 to_write=4 failed=0 failed_num=0
for sector 7629696, rmw=0 rcw=0
</debug>

These blocks were prepared to be written out, but were never handled in
ops_run_biodrain(), so they remain locked forever.  The operations flags
are all clear which means handle_stripe() thinks nothing else needs to be
done.

This state suggests that the STRIPE_OP_PREXOR bit was sampled 'set' when it
should not have been.  This patch cleans up cases where the code looks at
sh->ops.pending when it should be looking at the consistent stack-based
snapshot of the operations flags.

Report from Joel:
	Resync done. Patch fix this bug.
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Tested-by: NJoel Bertrand <joel.bertrand@systella.fr>
Cc: <stable@kernel.org>
Cc: Neil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove annoying build warnings about unused variables in atmel_serial,
which afflict both AT91 and AVR32 builds.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Acked-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>
Cc: Andrew Victor <andrew@sanpeople.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When a DMA device is unregistered, its reference count is decremented twice
for each channel: Once dma_class_dev_release() and once in
dma_chan_cleanup().  This may result in the DMA device driver's remove()
function completing before all channels have been cleaned up, causing lots
of use-after-free fun.

Fix it by incrementing the device's reference count twice for each
channel during registration.

[dan.j.williams@intel.com: kill unnecessary client refcounting]
Signed-off-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NShannon Nelson <shannon.nelson@intel.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Move pci_dev_put outside the loops in which it occurs.  Within the loop,
pci_dev_put is done implicitly by pci_get_device.

The problem was detected using the following semantic patch, and corrected
by hand.

@@
expression dev;
expression E;
@@

- pci_dev_put(dev)
   ... when != dev = E
- pci_get_device(...,dev)
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The pf driver for parallel port floppy drives seems to be broken.  At least
with Imation SuperDisk with EPAT chip, the driver calls pi_connect() and
pi_disconnect after each transferred sector.  At least with EPAT, this
operation is very expensive - causes drive recalibration.  Thus, transferring
even a single byte (dd if=/dev/pf0 of=/dev/null bs=1 count=1) takes 20
seconds, making the driver useless.

The pf_next_buf() function seems to be broken as it returns 1 always (except
when pf_run is non-zero), causing the loop in do_pf_read_drq (and
do_pf_write_drq) to be executed only once.

The following patch fixes this problem.  It also fixes swapped descriptions in
pf_lock() function and removes DBMSG macro, which seems useless.
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Some error paths in txx9spi_probe wrongly return 0.  This patch fixes them by
using the devres interfaces.
Signed-off-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

After 49dce689, device_for_each_child
iteration hits the master device itself.  Do not call spi_unregister_device()
for the master device.
Signed-off-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>