When loops reaches 0 the postfix decrement still subtracts, so the subsequent
test fails.
Signed-off-by: NRoel Kluin <12o3l@tiscali.nl>
Acked-by: NMaciej W. Rozycki <macro@linux-mips.org>
Cc: Johannes Weiner <hannes@saeurebad.de>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

After the loop in walk_pte_range() pte might point to the first address after
the pmd it walks.  The pte_unmap() is then applied to something bad.

Spotted by Roel Kluin and Andreas Schwab.
Signed-off-by: NJohannes Weiner <hannes@saeurebad.de>
Cc: Roel Kluin <12o3l@tiscali.nl>
Cc: Andreas Schwab <schwab@suse.de>
Acked-by: NMatt Mackall <mpm@selenic.com>
Acked-by: NMikael Pettersson <mikpe@it.uu.se>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Adrian Bunk noticed the following Coverity report:

> Commit e7f260a2
> (x86: PAT use reserve free memtype in mmap of /dev/mem)
> added the following gem to arch/x86/mm/pat.c:
>
> <--  snip  -->
>
> ...
> int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
>                                 unsigned long size, pgprot_t *vma_prot)
> {
>         u64 offset = ((u64) pfn) << PAGE_SHIFT;
>         unsigned long flags = _PAGE_CACHE_UC_MINUS;
>         unsigned long ret_flags;
> ...
> ...  (nothing that touches ret_flags)
> ...
>         if (flags != _PAGE_CACHE_UC_MINUS) {
>                 retval = reserve_memtype(offset, offset + size, flags, NULL);
>         } else {
>                 retval = reserve_memtype(offset, offset + size, -1, &ret_flags);
>         }
>
>         if (retval < 0)
>                 return 0;
>
>         flags = ret_flags;
>
>         if (pfn <= max_pfn_mapped &&
>             ioremap_change_attr((unsigned long)__va(offset), size, flags) < 0) {
>                 free_memtype(offset, offset + size);
>                 printk(KERN_INFO
>                 "%s:%d /dev/mem ioremap_change_attr failed %s for %Lx-%Lx\n",
>                         current->comm, current->pid,
>                         cattr_name(flags),
>                         offset, offset + size);
>                 return 0;
>         }
>
>         *vma_prot = __pgprot((pgprot_val(*vma_prot) & ~_PAGE_CACHE_MASK) |
>                              flags);
>         return 1;
> }
>
> <--  snip  -->
>
> If (flags != _PAGE_CACHE_UC_MINUS) we pass garbage from the stack to
> ioremap_change_attr() and/or __pgprot().
>
> Spotted by the Coverity checker.

the fix simplifies the code as we get rid of the 'ret_flags'
complication.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Ingo already fixed one of these at my request (in "x86 PAT: tone down
debugging messages", commit 1ebcc654),
but there was another one he missed.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (40 commits)
  [SCSI] jazz_esp, sgiwd93, sni_53c710, sun3x_esp: fix platform driver hotplug/coldplug
  [SCSI] aic7xxx: add const
  [SCSI] aic7xxx: add static
  [SCSI] aic7xxx: Update _shipped files
  [SCSI] aic7xxx: teach aicasm to not emit unused debug code/data
  [SCSI] qla2xxx: Update version number to 8.02.01-k2.
  [SCSI] qla2xxx: Correct regression in relogin code.
  [SCSI] qla2xxx: Correct misc. endian and byte-ordering issues.
  [SCSI] qla2xxx: make qla2x00_issue_iocb_timeout() static
  [SCSI] qla2xxx: qla_os.c, make 2 functions static
  [SCSI] qla2xxx: Re-register FDMI information after a LIP.
  [SCSI] qla2xxx: Correct SRB usage-after-completion/free issues.
  [SCSI] qla2xxx: Correct ISP84XX verify-chip response handling.
  [SCSI] qla2xxx: Wakeup DPC thread to process any deferred-work requests.
  [SCSI] qla2xxx: Collapse RISC-RAM retrieval code during a firmware-dump.
  [SCSI] m68k: new mac_esp scsi driver
  [SCSI] zfcp: Add some statistics provided by the FCP adapter to the sysfs
  [SCSI] zfcp: Print some messages only during ERP
  [SCSI] zfcp: Wait for free SBAL during exchange config
  [SCSI] scsi_transport_fc: fc_user_scan correction
  ...

Since

commit 43cc71ee
Author: Kay Sievers <kay.sievers@vrfy.org>
Date:   Sat Aug 18 04:40:39 2007 +0200

    platform: prefix MODALIAS with "platform:"

the platform modalias is prefixed with "platform:". Add MODULE_ALIAS()
to the hotpluggable SCSI platform drivers, to re-enable auto loading.

[dbrownell@users.sourceforge.net: more drivers, registration fixes]
[akpm@linux-foundation.org: fix sgiwd93.c]
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch adds more const keywords where appropriate.
Signed-off-by: NDenys Vlasenko <vda.linux@googlemail.com>
Acked-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch adds static (and sometimes const) keywords where appropriate.
Signed-off-by: NDenys Vlasenko <vda.linux@googlemail.com>
Acked-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Update the precompiled sequencer code to match the latest
aicasm changes.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Add a 'count' variable to each symbol which gets increased every time
the symbol is referenced.  And then modify the register definition to
include counts for symbols which are referenced from the source code
only and not from the sequencer code.

This will give us an automatic usage count for the symbols with only
minimal hand-crafting.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Commit 63a8651f ([SCSI] qla2xxx:
Correct infinite-login-retry issue.) introduced a small
regression where a successful relogin would result in an fcport's
loop_id to be incorrectly reset to FC_NO_LOOP_ID.  Only clear-out
loopid, if retries have been 'truly' exhausted.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

There were several places in the driver which could cause byte
ordering problem as provided by Al Viro
<viro@ZenIV.linux.org.uk>.
Signed-off-by: NSeokmann Ju <seokmann.ju@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch makes the needlessly global qla2x00_issue_iocb_timeout()
static.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch makes the following needlessly global functions static:
- qla2x00_alloc_work()
- qla2x00_post_work()
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Original code would (incorrectly) only re-register after a
loop-down condition.  Also, FDMI registration should be enabled
by default.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The driver is incorrectly assuming that the 'sp' reference held
in qla2[x00|4xx]_abort_command() is valid after the mailbox
command is issued to abort the exchange.  It is *not*, as the
command may be completed during interrupt context before control
is returned to the mailbox caller.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Earlier code could trigger an infinite-retry if 1st invocation
returned a non-CS_COMPLETE status.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Use the more efficient read-DMA'ble-buffer mailbox commands
rather than reading a single word/dword at a time.  We also
remove a bulk of the duplicate mailbox command-handling codes in
favor of more generic read-memory() routines (qla2xxx_dump_ram()
and qla24xx_dump_ram()).
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Replace the mac_esp driver with a new one based on the esp_scsi core.

For esp_scsi: add support for sync transfers for the PIO mode, add a new
esp_driver_ops method to get the maximum dma transfer size (like the old
NCR53C9x driver), and some cleanups.
Signed-off-by: NFinn Thain <fthain@telegraphics.com.au>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The new FCP adapter statistics provide a variety of information about
the virtual adapter (subchannel). In order to collect this information
the zfcp driver is extended to query this information.

The information provided by the new FCP adapter statistics can be
fetched by reading from the following files in the sysfs filesystem

/sys/class/scsi_host/host<n>/seconds_active
/sys/class/scsi_host/host<n>/requests
/sys/class/scsi_host/host<n>/megabytes
/sys/class/scsi_host/host<n>/utilization

These are the statistics on a virtual adapter (subchannel) level.

The information provided is raw and not modified or interpreted by any
means.  No interpretation or modification of the values is done by the
zfcp driver.
Signed-off-by: NSwen Schillig <swen@vnet.ibm.com>
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

When statistics are polled from sysfs, the statistics use the same
commands as the adapter initialization. Change the messages printed
here, so they are only printed during initialization and not for each
poll of adapter data.
Signed-off-by: NSwen Schillig <swen@vnet.ibm.com>
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

When sending a exchange config data command, wait for a free SBAL.
This does not matter during adapter initialization, but this is
required for pulling adapter statistics during high I/O load.
Signed-off-by: NSwen Schillig <swen@vnet.ibm.com>
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Way back when, when the fc_user_scan routine was created, it kept some
of its original logic that walked the rport list and kicked off a scan.
Unfortunately, it didn't keep any of the locking around the rport list,
nor did it consider the synchronous nature of the scan invoked. The result,
there are some scan requests where the rport list changes, thus a subsequent
scan is called on a bogus rport structure and the system NMI's.
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

- where the 'irq' function argument is known never to be used, rename
  it to 'dummy' to make this more obvious

- replace per-irq lookup functions and tables with a direct reference
  to data object obtained via 'dev_id' function argument, passed from
  request_irq()
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

scsi_transport_spi.c needs to #include <linux/sysfs.h>:

next-20080423/drivers/scsi/scsi_transport_spi.c:1467: error: implicit declaration of function 'sysfs_update_group'
make[3]: *** [drivers/scsi/scsi_transport_spi.o] Error 1
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch fixes off-by-one errors in error checks (the variables are
used as array indexes for arrays with MAX_SCSI_TAR resp. MAX_LUN
elements) spotted by the Coverity checker.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The function type_check() in aicasm grammar code was
never used properly due to a bug.
This patch fixes it up and ensures it's only called if appropriate.

In addition the unused 16bit instruction are disabled, but left in
the code for reference.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

We're getting a WARN_ON from SLUB indicating that we're trying to free
caches with in-use objects.  The root cause is a new dependency in the
command/sense free on unchecked_isa_dma.  The WARN_ON is caused by
drivers which change this in their setup after the command/sense cache
is allocated.

The fix is to move the allocation of this cache into scsi_add_host()
so things like gdth have an opportunity to modify it between alloc and
add (but *not* after).

The true fix would be to move unchecked_isa_dma into the template and
out of the host, so it because a truly read only variable.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

* 'kvm-updates-2.6.26' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm: (147 commits)
  KVM: kill file->f_count abuse in kvm
  KVM: MMU: kvm_pv_mmu_op should not take mmap_sem
  KVM: SVM: remove selective CR0 comment
  KVM: SVM: remove now obsolete FIXME comment
  KVM: SVM: disable CR8 intercept when tpr is not masking interrupts
  KVM: SVM: sync V_TPR with LAPIC.TPR if CR8 write intercept is disabled
  KVM: export kvm_lapic_set_tpr() to modules
  KVM: SVM: sync TPR value to V_TPR field in the VMCB
  KVM: ppc: PowerPC 440 KVM implementation
  KVM: Add MAINTAINERS entry for PowerPC KVM
  KVM: ppc: Add DCR access information to struct kvm_run
  ppc: Export tlb_44x_hwater for KVM
  KVM: Rename debugfs_dir to kvm_debugfs_dir
  KVM: x86 emulator: fix lea to really get the effective address
  KVM: x86 emulator: fix smsw and lmsw with a memory operand
  KVM: x86 emulator: initialize src.val and dst.val for register operands
  KVM: SVM: force a new asid when initializing the vmcb
  KVM: fix kvm_vcpu_kick vs __vcpu_run race
  KVM: add ioctls to save/store mpstate
  KVM: Rename VCPU_MP_STATE_* to KVM_MP_STATE_*
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: (49 commits)
  ide-tape: remove tape->merge_stage
  ide-tape: mv tape->merge_stage_size tape->merge_bh_size
  ide-tape: mv idetape_empty_write_pipeline ide_tape_flush_merge_buffer
  ide-tape: mv idetape_discard_read_pipeline ide_tape_discard_merge_buffer
  ide-tape: make __idetape_discard_read_pipeline() of type void
  ide: remove now unused ide_pci_create_host_proc()
  ide: remove /proc/ide/ali
  ide-tape: improve buffer pages freeing strategy
  ide-tape: mv tape->pages_per_stage tape->pages_per_buffer
  ide-tape: mv tape->stage_size tape->buffer_size
  ide-tape: improve buffer allocation strategy
  ide: add struct ide_io_ports (take 3)
  ide: make ide_unregister() take 'ide_hwif_t *' as an argument (take 2)
  ide: sanitize ide_unregister() usage
  mpc8xx-ide: use ide_find_port()
  ide: add "noacpi" / "acpigtf" / "acpionboot" parameters
  gayle: add "doubler" parameter
  ide: add "cdrom=" and "chs=" parameters
  ide: add "nodma|noflush|noprobe|nowerr=" parameters
  ide: remove obsoleted "hdx=autotune" kernel parameter
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-idle-fix:
  fix idle (arch, acpi and apm) and lockdep

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xpad - fix build failure

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  mlx4_core: Add helper to move QP to ready-to-send
  mlx4_core: Add HW queues allocation helpers
  RDMA/nes: Remove volatile qualifier from struct nes_hw_cq.cq_vbase
  mlx4_core: CQ resizing should pass a 0 opcode modifier to MODIFY_CQ
  mlx4_core: Move kernel doorbell management into core
  IB/ehca: Bump version number to 0026
  IB/ehca: Make some module parameters bool, update descriptions
  IB/ehca: Remove mr_largepage parameter
  IB/ehca: Move high-volume debug output to higher debug levels
  IB/ehca: Prevent posting of SQ WQEs if QP not in RTS
  IPoIB: Handle 4K IB MTU for UD (datagram) mode
  RDMA/nes: Fix adapter reset after PXE boot
  RDMA/nes: Print IPv4 addresses in a readable format
  RDMA/nes: Use print_mac() to format ethernet addresses for printing

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

	... and isn't possible on sparc32 boxen anyway, unless somebody
had done JavaStation with PCIE lately.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Use kvm own refcounting instead of playing with ->filp->f_count.
That will allow to get rid of a lot of crap in anon_inode_getfd() and
kill a race in kvm_dev_ioctl_create_vm() (file might have been closed
immediately by another thread, so ->filp might point to already freed
struct file when we get around to setting it).
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NAvi Kivity <avi@qumranet.com>

kvm_pv_mmu_op should not take mmap_sem. All gfn_to_page() callers down
in the MMU processing will take it if necessary, so as it is it can
deadlock.

Apparently a leftover from the days before slots_lock.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NAvi Kivity <avi@qumranet.com>

There is not selective cr0 intercept bug. The code in the comment sets the
CR0.PG bit. But KVM sets the CR4.PG bit for SVM always to implement the paged
real mode. So the 'mov %eax,%cr0' instruction does not change the CR0.PG bit.
Selective CR0 intercepts only occur when a bit is actually changed. So its the
right behavior that there is no intercept on this instruction.
Signed-off-by: NJoerg Roedel <joerg.roedel@amd.com>
Signed-off-by: NAvi Kivity <avi@qumranet.com>