There was an off-by-one bug in bnx2_tx_avail().  If the tx ring is
completely full, the producer and consumer indices may be apart by
256 even though the ring size is only 255.  One entry in the ring is
unused and must be properly accounted for when calculating the number
of available entries.  The bug caused the tx ring entries to be
reused by mistake, overwriting active entries, and ultimately causing
it to crash.

This bug rarely occurs because the tx ring is rarely completely full.
We always stop when there is less than MAX_SKB_FRAGS entries available
in the ring.

Thanks to Corey Kovacs <cjk@techma.com> and Andy Gospodarek
<agospoda@redhat.com> for reporting the problem and helping to collect
debug information.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

rose_add_loopback_neigh uses kmalloc and the callers were ignoring the
error value.  Rewrite to let the caller deal with the allocation.  This
allows the use of static allocation of kmalloc use entirely.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

ax25_linkfail_register uses kmalloc and the callers were ignoring the
error value.  Rewrite to let the caller deal with the allocation.  This
allows the use of static allocation of kmalloc use entirely.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix ax25_listen_register to return something that's a sane error code,
then all callers to use it.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Replace ax25_protocol_register by ax25_register_pid which assumes the
caller has done the memory allocation.  This allows replacing the
kmalloc allocations entirely by static allocations.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The recent fix 0506d406 made obvious that
error values were not being propagated through the AX.25 stack.  To help
with that this patch marks all kmalloc users in the AX.25, NETROM and
ROSE stacks as __must_check.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Replace kmalloc+memset with kzalloc
Signed-off-by: NYan Burman <burman.yan@gmail.com>
Acked-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* master.kernel.org:/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ] longhaul compile fix.
  [CPUFREQ] Advise not to use longhaul on VIA C7.
  [CPUFREQ] set policy->curfreq on initialization
  [CPUFREQ] Trivial cleanup for acpi read/write port in acpi-cpufreq.c
  [CPUFREQ] fixes typo in cpufreq.c

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Acked-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Recent workqueue changes basically make this a formal requirement.

Also, move atomic32.o from lib-y to obj-y since it exports symbols
to modules.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Some gcc's are more anal than others about empty switch labels.
error: label at end of compound statement
Signed-off-by: NDave Jones <davej@redhat.com>

C7's are centrino speedstep-alike.
Signed-off-by: NDave Jones <davej@redhat.com>

Check the correct variable and set policy->cur upon acpi-cpufreq
initialization to allow the userspace governor to be used as default.
Signed-off-by: NMattia Dongili <malattia@linux.it>
Acked-by: N"Pallipadi, Venkatesh" <venkatesh.pallipadi@intel.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDave Jones <davej@redhat.com>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

"sunkbd_enable(sunkbd, 0);" has no effect. Adding "sunkbd->enabled =
enable" in sunkbd_enable (obvious)
Signed-off-by: NFabrice Knevez <nuxdoors@cegetel.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

desc-status --> desc->status
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Use struct irq_chip instead of hw_interrupt_type.

Delete hw_resend_irq(), totally unused.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It branches around some necessary prom calls, which we would
need to do even if we are mapped at the correct location already.
So it doesn't work.

The idea was that this sort of thing could be used for the eventual
kexec implementation, but it is clear that this will need to be
done differently.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

fix a typo, sys_mincore() needs min().
Signed-off-by: NOleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: NLinus "I'm a moron" Torvalds <torvalds@osdl.org>

amikbd: missing declaration
sun3_NCR5380: more work_struct mess
sun3_NCR5380: cast is not an lvalue
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Hugh Dickins correctly points out that mincore() is actually _supposed_
to fail on an unmapped hole in the user address space, rather than
return valid ("empty") information about the hole.  This just simplifies
the problem further (I had been misled by our previous confusing and
complicated way of doing mincore()).

Also, in the unlikely situation that we can't allocate a temporary
kernel buffer, we should actually return EAGAIN, not ENOMEM, to keep the
"unmapped hole" and "allocation failure" error cases separate.

Finally, add a comment about our stupid historical lack of support for
anonymous mappings.  I'll fix that if somebody reminds me after 2.6.20
is out.
Acked-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mthca: Use DEFINE_MUTEX() instead of mutex_init()
  IB/mthca: Add HCA profile module parameters
  IB/srp: Fix FMR mapping for 32-bit kernels and addresses above 4G
  IB: Fix ib_dma_alloc_coherent() wrapper

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] pata_via: Cable detect error
  [PATCH] Fix help text for CONFIG_ATA_PIIX
  [PATCH] initializer entry defined twice in pata_rz1000
  [PATCH] ata: fix platform_device_register_simple() error check
  [PATCH] ahci: do not mangle saved HOST_CAP while resetting controller
  [PATCH] libata: don't initialize sg in ata_exec_internal() if DMA_NONE (take #2)
  [libata] sata_svw: Disable ATAPI DMA on current boards (errata workaround)
  [libata] use kmap_atomic(KM_IRQ0) in SCSI simulator
  [PATCH] ata_piix: use piix_host_stop() in ich_pata_ops
  [PATCH] ata_piix: IDE mode SATA patch for Intel ICH9

On architectures where the atomicity of the bit operations is handled by
external means (ie a separate spinlock to protect concurrent accesses),
just doing a direct assignment on the workqueue data field (as done by
commit 4594bf15) can cause the
assignment to be lost due to lack of serialization with the bitops on
the same word.

So we need to serialize the assignment with the locks on those
architectures (notably older ARM chips, PA-RISC and sparc32).

So rather than using an "unsigned long", let's use "atomic_long_t",
which already has a safe assignment operation (atomic_long_set()) on
such architectures.

This requires that the atomic operations use the same atomicity locks as
the bit operations do, but that is largely the case anyway.  Sparc32
will probably need fixing.

Architectures (including modern ARM with LL/SC) that implement sane
atomic operations for SMP won't see any of this matter.

Cc: Russell King <rmk+lkml@arm.linux.org.uk>
Cc: David Howells <dhowells@redhat.com>
Cc: David Miller <davem@davemloft.com>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: Linux Arch Maintainers <linux-arch@vger.kernel.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Doug Chapman noticed that mincore() will doa "copy_to_user()" of the
result while holding the mmap semaphore for reading, which is a big
no-no.  While a recursive read-lock on a semaphore in the case of a page
fault happens to work, we don't actually allow them due to deadlock
schenarios with writers due to fairness issues.

Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
the mess instead - not just fixing the locking problem, but making the
code smaller and (imho) much easier to understand.

Cc: Doug Chapman <dchapman@redhat.com>
Cc: Marcel Holtmann <holtmann@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The UDMA66 VIA hardware has no controller side cable detect bits we can
use. This patch minimally fixes the problem by reporting unknown in this
case and using drive side detection.

The old drivers/ide code does some additional tricks but those aren't
appropriate now we are in -rc.

Without this update UDMA66 via controllers run slowly. They don't fail so
it's a borderline call whether this is -rc material or not.
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

> Thanks for clarifying Bill, and sorry Alan. ata_piix does indeed work
> correctly. The help text is a bit confusing:
>
> config ATA_PIIX
>         tristate "Intel PIIX/ICH SATA support"
>         depends on PCI
>         help
>           This option enables support for ICH5/6/7/8 Serial ATA.
>           If PATA support was enabled previously, this enables
>           support for select Intel PIIX/ICH PATA host controllers.

New help text
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This removes the extra definition of the .error_handler member
in the pata_rz1000 driver.
Signed-off-by: NIra W. Snyder <kernel@irasnyder.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The return value of platform_device_register_simple() should be checked
by IS_ERR().

Cc: Jeff Garzik <jgarzik@pobox.com>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Do not mangle with HOST_CAP while resetting controller.  The code is
there for a historical reason.  The mangling breaks controller feature
detection and 0 PORTS_IMPL workaround code.

This problem was spotted by Manoj Kasichainula.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Manoj Kasichainula <manoj@io.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Calling sg_init_one() with NULL buf causes oops on certain
configurations.  Don't initialize sg in ata_exec_internal() if
DMA_NONE and make the function complain if @buf is NULL when dma_dir
isn't DMA_NONE.  While at it, fix comment.

The problem is discovered and initial patch was submitted by Arnd
Bergmann.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Current Broadcom/Serverworks SATA boards (including Apple K2 SATA)
have problems with ATAPI DMA, so it is disabled.  ATAPI PIO, ATA PIO,
and ATA DMA continue to work just fine.
Acked-by: NAnantha Subramanyam <ananth@broadcom.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

We are inside spin_lock_irqsave().  quoth akpm's debug facility:

 [  231.948000] SCSI device sda: 195371568 512-byte hdwr sectors (100030 MB)
 [  232.232000] ata1.00: configured for UDMA/33
 [  232.404000] WARNING (1) at arch/i386/mm/highmem.c:47 kmap_atomic()
 [  232.404000]  [<c01162e6>] kmap_atomic+0xa9/0x1ab
 [  232.404000]  [<c0242c81>] ata_scsi_rbuf_get+0x1c/0x30
 [  232.404000]  [<c0242caf>] ata_scsi_rbuf_fill+0x1a/0x87
 [  232.404000]  [<c0243ab2>] ata_scsiop_mode_sense+0x0/0x309
 [  232.404000]  [<c01729d5>] end_bio_bh_io_sync+0x0/0x37
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c0242dcc>] ata_scsi_simulate+0xb0/0x13f
[...]
Signed-off-by: NJeff Garzik <jeff@garzik.org>

piix_init_one() allocates host private data which should be freed by
piix_host_stop().  ich_pata_ops wasn't converted to piix_host_stop()
while merging, leaking 4 bytes on driver detach.  Fix it.

This was spotted using Kmemleak by Catalin Marinas.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Catalin Marinas <catalin.marinas@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This updated patch adds the Intel ICH9 IDE mode SATA controller DID's.
Signed-off-by: NJason Gaston <jason.d.gaston@intel.com>
Acked-by: NTejun Heo <htejun@gmail.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

mthca_device_mutex() can be initialized automatically with
DEFINE_MUTEX() rather than explicitly calling mutex_init().  This
saves a bit of text and shrinks the source by a line, so we may as
well do it....
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

Add module parameters that enable settting some of the HCA
profile values, such as the number of QPs, CQs, etc.
Signed-off-by: NLeonid Arsh <leonida@voltaire.com>
Signed-off-by: NMoni Shoua <monis@voltaire.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>