Commit d720bc4b partially removed a
private implementation of baud speed decoding.  However it doesn't seem
to be complete: after the speed is decoded, it is still being used as an
index to a local speed table (array overrun, no doubt).

This was found by Graham Murray who noticed it caused a 2.6.19 regression
with the SX driver: https://bugs.gentoo.org/170554Signed-off-by: NDaniel Drake <dsd@gentoo.org>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

...  still not sure why we need this ....
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If this mddev and queue got reused for another array that doesn't register a
congested_fn, this function would get called incorretly.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

All that is missing the the function pointers in raid4_pers.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This cancel_delayed_work call is called from a function that is only called
from a piece of code that immediate follows a cancel and destruction of the
workqueue, so it's clearly a mistake.

Cc: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: N"J. Bruce Fields" <bfields@citi.umich.edu>
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The reused clientid here is a more of a problem for the client than the
server, and the client can report the problem itself if it's serious.
Signed-off-by: N"J. Bruce Fields" <bfields@citi.umich.edu>
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

A regression introduced in the last set of acl patches removed the
INHERIT_ONLY flag from aces derived from the posix acl.  Fix.
Signed-off-by: N"J. Bruce Fields" <bfields@citi.umich.edu>
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

->readdir passes lofft_t offsets (used as nfs cookies) to
nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it
becomes an 'off_t', which isn't good.

So filesystems that returned 64bit offsets would lose.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Ingo reported it on lkml in the thread
  "2.6.21-rc5: maxcpus=1 crash in cpufreq: kernel BUG at drivers/cpufreq/cpufreq.c:82!"

This check added to remove_dev  is symmetric to one in add_dev and handles
callbacks for offline cpus cleanly.
Signed-off-by: NVenkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Acked-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [SUNGEM]: Fix MAC address setting when interface is up.
  [IPV4] fib_trie: Document locking.
  [NET]: Correct accept(2) recovery after sock_attach_fd()
  [PPP]: Don't leak an sk_buff on interface destruction.
  [NET_SCHED]: Fix ingress locking
  [NET_SCHED]: cls_basic: fix NULL pointer dereference
  [DCCP]: make dccp_write_xmit_timer() static again
  [TG3]: Update version and reldate.
  [TG3]: Exit irq handler during chip reset.
  [TG3]: Eliminate the unused TG3_FLAG_SPLIT_MODE flag.
  [IPV6]: Fix routing round-robin locking.
  [DECNet] fib: Fix out of bound access of dn_fib_props[]
  [IPv4] fib: Fix out of bound access of fib_props[]
  [NET] AX.25 Kconfig and docs updates and fixes
  [NET]: Fix neighbour destructor handling.
  [NET]: Fix fib_rules compatibility breakage
  [SCTP]: Update SCTP Maintainers entry
  [NET]: remove unused header file: drivers/net/wan/lmc/lmc_media.h

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] zcrypt: Fix ap_poll_requests counter in lost requests error path.
  [S390] zcrypt: Fix possible dead lock in AP bus module.
  [S390] cio: Device status validity.
  [S390] kprobes: Align probe address.
  [S390] Fix TCP/UDP pseudo header checksum computation.
  [S390] dasd: Work around gcc bug.

This patch implements set_mac_address for the sungem driver.  This
allows changing the mac address of the interface, even when the
interface is up.
Signed-off-by: NRuben Vandeginste <snowbender@gmail.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: fix usb-serial/ftdi build warning
  USB: fix usb-serial/generic build warning
  USB: another entry for the quirk list
  USB: remove duplicated device id in airprime driver
  USB: omap_udc: workaround dma_free_coherent() bogosity
  UHCI: Fix problem caused by lack of terminating QH

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/pci-2.6:
  PCI: Fix warning message in PCIE port driver
  PCI: Stop unhiding the SMBus on Toshiba laptops
  PCI: Fix up PCI power management doc
  pci: set pci=bfsort for PowerEdge R900

Change prototypes for __chk_user_ptr and __chk_io_ptr to take const
void* instead of void*, so that code can pass "const void *" to them.

(Right now sparse does not warn about passing const void* to void*
functions, but that is a separate bug that I believe Josh is working on,
and once sparse does check this, the changed prototypes will be
necessary.)
Signed-off-by: NRuss Cox <rsc@swtch.com>
Signed-off-by: NJosh Triplett <josh@freedesktop.org>
Acked-by: NChristopher Li <sparse@chrisli.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Paul E. McKenney writes:

> Those of use who dive into networking only occasionally would much
> appreciate this.  ;-)

No problem here... 
Acked-by: NRobert Olsson <robert.olsson@its.uu.se>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> (but trivial)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: make struct v9fs_cached_file_operations static

Fix annoying build warning:

drivers/usb/serial/ftdi_sio.c:890: warning: enumeration value `FT232RL' not handled in switch

Also add logic to detect FT232R chips (version 6.00, usb 2.0 full speed),
so that case isn't completely useless.  (NOTE:  FT232RL and FT232RQ are
the same chip in different packages:  L is SSOP, Q is QFN.)
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix annoying build warning when CONFIG_USB_SERIAL_GENERIC is undefined.

  drivers/usb/serial/generic.c:24: warning: `generic_probe' declared `static' but never defined
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this scanner disconnects upon suspend.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Both airprime and option now want to handle vendor ID 0x1410,
device ID 0x1100. Airprime calls it 'ExpressCard34 Qualcomm 3G CDMA'.
Option calls it 'Novatel Merlin XS620/S640'. Patch attached to remove it
from airprime.

From: Jon K Hellan <jon.kare.hellan@uninett.no>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Various fixes to omap_udc, noted with some recent testing:

 - Cope with some SMP-induced braindamage in ARM's dma_{alloc,free}_coherent()
   implementation: alloc() can be called with IRQs blocked, but since late
   last year that's no longer true for free().  This resolves really NASTY
   problems with logspamming via WARN_ON(), indicating N-page leaks.

 - Be more correct in handling GET_STATUS request for RECIP_ENDPOINT ... the
   previous code only handled RECIP_INTERFACE, this version should be correct
   except for (sigh) bulk/interrupt endpoints.

 - Provide a better name for the function reporting whether the board has
   vbus sensing wired up.

GET_STATUS requests for endpoint status still acts strangely though, at least
given one flakey host doesn't always ack the first DATA packet, then the packet
that gets retransmitted doesn't have data!
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as871) fixes a problem introduced by an earlier change.
It turns out that some systems really do need to have a terminating
skeleton QH present whenever FSBR is on.  I don't know any way to tell
which systems do need it and which don't; the easiest answer is to
have it there always.

This fixes the NumLock-hang bug reported by Jiri Slaby.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: use correct IDE error recovery
  pdc202xx_new: Enable ATAPI DMA
  ide: cosmetic adaption of drivers/ide/Kconfig concerning SATA
  ide: fix locking for manual DMA enable/disable ("hdparm -d")
  ide: revert "ide: fix drive side 80c cable check, take 2" for now

PCIE error output should conform to vendor_id:device_id.
Signed-off-by: NPrarit Bhargava <prarit@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It was found that the Toshiba laptops with hidden Intel SMBus have SMM
code handling the thermal management which accesses the SMBus. Thus it
is not safe to unhide it and let Linux access it. We have to leave the
SMBus hidden. SMM is a pain, really.

This fixes bugs #6315 and #6395, for good this time.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Update the documentation of PCI power management functions.
Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch automatically enables pci=bfsort for the Dell PowerEdge
R900.  This is necessary to ensure the onboard NICs enumerate in the
proper order, similar to the other systems already on the list.
Signed-off-by: NMatt Domsch <Matt_Domsch@dell.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL
* bail out to out_fd label, doing fput()/__fput() on new file
* but __fput() assumes valid ->f_dentry and dereferences it
Signed-off-by: NAlexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The current sysfs support of clockevents does not obey the "only one
value per file" rule.

The real fix is not 2.6.21 material. Therefor remove the sysfs support
for now.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NIngo Molnar <mingo@elte.hu>
Acked-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

IDE error recovery is using IDLE IMMEDIATE if the drive is busy or has DRQ set.
This violates the ATA spec (can only send IDLE IMMEDIATE when drive is not
busy) and really hoses up some drives (modern drives will not be able to
recover using this error handling).  The correct thing to do is issue a SRST
followed by a SET FEATURES command.  This is what Western Digital recommends
for error recovery and what Western Digital says Windows does.  It also does
not violate the ATA spec as far as I can tell.

Bart:
* port the patch over the current tree
* undo the recalibration code removal
* send SET FEATURES command after checking for good drive status
* don't check whether the current request is of REQ_TYPE_ATA_{CMD,TASK}
  type because we need to send SET FEATURES before handling any requests
* some pre-ATA4 drives require INITIALIZE DEVICE PARAMETERS command before
  other commands (except IDENTIFY) so send SET FEATURES only if there are
  no pending drive->special requests
* update comments and patch description
* any bugs introduced by this patch are mine and not Suleiman's :-)
Signed-off-by: NSuleiman Souhlal <suleiman@google.com>
Acked-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

[ bart: the ressurection of 2 years old patch which slipped thru the cracks
  (thanks to Sergei Shtylyov for finding it) ]

These is the patch to turn on pdc202xx_new for ATAPI DMA.  When testing, it
works fine without the (request_bufflen % 256) workaround as needed in libata.
ide-scsi filters out (pc->request_transfer % 1024) and use PIO, so the pdc202xx
ATAPI DMA problem is avoid.  Both ide-cd and ide-scsi won't hit the ATAPI DMA
problem on pdc202xx_new.
Signed-off-by: NAlbert Lee <albertcc@tw.ibm.com>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Since especially Serial ATA has it's own menu point now, I guess we can
change the description of the deprecated SATA driver as well, since the
new libATA subsystem is not configured through a SCSI low-level driver
anymore, but has it's own menu point.

From: Patrick Ringl <patrick_@freenet.de>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Since hwif->ide_dma_check and hwif->ide_dma_on never queue any commands
(ide_config_drive_speed() sets transfer mode using polling and has no error
recovery) we are safe with setting hwgroup->busy for the time while DMA
setting for a drive is changed (so it won't race against I/O commands in fly).

I audited briefly all ->ide_dma_check/->ide_dma_on/->tuneproc/->speedproc
implementations and they all look OK wrt to this change.

This patch finally allowed me to close kernel bugzilla bug #8169
(once again thanks to Patrick Horn for reporting the issue & testing patches).

Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

"ide: fix drive side 80c cable check, take 2" patch from Tejun Heo (commit
fab59375) fixed 80c bit test (bit13 of word93)
but we also need to fix master/slave IDENTIFY order (slave device should be
probed first in order to make it release PDIAG- signal) and we should also
check for pre-ATA3 slave devices (which may not release PDIAG- signal).

[ Unfortunately the fact that IDE driver doesn't reset devices itself helps
  only a bit as it seems that some BIOS-es reset ATA devices after programming
  the chipset, some BIOS-es can be set to not probe/configure selected devices,
  there may be no BIOS in case of add-on cards etc. ]

Since we are quite late in the release cycle and the required changes will
affect a lot of systems just revert the fix for now.

[ Please also see libata commit f31f0cc2. ]

Thanks goes out to Fernando Mitio Yamada for reporting the problem
and patiently testing patches.
Acked-by: NTejun Heo <htejun@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

In the unlikely event that an AP device lost requests, don't forget to
update the ap_poll_requests counter too. Same must happen in case an AP
device is removed while there are still outstanding requests.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NRalph Wuerthner <rwuerthn@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

If a AP device is unconfigured __ap_poll_all() will call
device_unregister() in software interrupt context which can cause
dead locks. To fix this the device will be only marked as unconfigured
and the device_unregister() call will be done later by either
ap_scan_bus() or ap_queue_message() in process context.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NRalph Wuerthner <rwuerthn@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

Only accumulate device status field in irb if it is valid.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

Running a probe on s390 with a probe address that is not 4 byte aligned
results in a Kernel BUG.  The problem is that the stura instruction used
by swap_instruction requires the destination address to be 4 byte aligned.
As stura only writes 4 bytes, aligning to the next 4 byte aligned address
results in the breakpoint instruction being stored past the probe address.
The fix is to align the address backward (to the previous 4 byte aligned
address) and writing the two byte breakpoint instruction in the appropriate
bytes.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NDavid Wilder <dwilder@us.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>

git commit f994aae1 changed the
function declaration of csum_tcpudp_nofold. Argument types were
changed from unsigned long to __be32 (unsigned int). Therefore we
lost the implicit type conversion that zeroed the upper half of the
registers that are used to pass parameters. Since the inline assembly
relied on this we ended up adding random values and wrong checksums
were created.
Showed only up on machines with more than 4GB since gcc produced code
where the registers that are used to pass 'saddr' and 'daddr' previously
contained addresses before calling this function.
Fix this by using 32 bit arithmetics and convert code to C, since gcc
produces better code than these hand-optimized versions.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>