Badari Pulavarty reported a case of this BUG_ON is triggering during
testing.  It's completely bogus and should be removed.

It's trying to notice if we left references to the dio hanging around in
the sync case.  They should have been dropped as IO completed while this
path was in dio_await_completion().  This condition will also be
checked, via some twisty logic, by the BUG_ON(ret != -EIOCBQUEUED) a few
lines lower.  So to start this BUG_ON() is redundant.

More fatally, it's dereferencing dio-> after having dropped its
reference.  It's only safe to dereference the dio after releasing the
lock if the final reference was just dropped.  Another CPU might free
the dio in bio completion and reuse the memory after this path drops the
dio lock but before the BUG_ON() is evaluated.

This patch passed aio+dio regression unit tests and aio-stress on ext3.
Signed-off-by: Zach Brown <zach.brown@oracle.com>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

With this change it works again when the nmi watchdog is disabled.
Signed-off-by: Andi Kleen <ak@suse.de>
Cc: Björn Steinbrink <B.Steinbrink@gmx.de>
Cc: Stephane Eranian <eranian@hpl.hp.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Matthias Lenk reports that the PCI subsystem would move the HPET on
SB400/SB600-based systems, where the HPET is in BAR1 of the SMbus
controller.

The reason? The ACPI layer registered the PCI MMIO range as being busy
too early, before PCI enumeration had happened, causing the PCI layer to
decide that it should relocate the resources somewhere else.

Firmware resources should be marked busy _after_ the PCI enumeration and
probing has happened, not before.

Remove the too-early reservation, we'll fix it up to do it properly
later.  In the meantime, this solves the regression.
Tested-by: Matthias Lenk <matthias.lenk@amd.com>
Cc: Aaron Durbin <adurbin@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: ide_scan_pcibus(): check __pci_register_driver return value
  ide: pdc202xx_new PLL input clock fix
  it821x: fix incorrect SWDMA mask
  amd74xx: resume fix
  hpt366: use correct enablebits for HPT36x
  hpt366: blacklist MAXTOR STM3320620A for UltraDMA/66
  ide: Fix a theoretical Ooops case
  ide: never called printk statement in ide-taskfile.c::wait_drive_not_busy

* 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
  V4L/DVB (5822): Fix the return value in ttpci_budget_init()
  V4L/DVB (5818): CinergyT2: fix flush_workqueue() vs work->func() deadlock
  V4L/DVB (5816): Cx88-blackbird: fix vidioc_g_tuner never ending list of tuners
  V4L/DVB (5808): Bttv: fix v4l1 breaking the driver

If we move the local_irq_enable() to the end of the function then
add_partial() in early_kmem_cache_node_alloc() will be called
with interrupts disabled like during regular operations.

This makes lockdep happy.
Signed-off-by: Christoph Lameter <clameter@sgi.com>
Tested-by: Andre Noll <maan@systemlinux.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The clock_was_set() call in seconds_overflow() which happens only when
leap seconds are inserted / deleted is wrong in two aspects:

1. it results in a call to on_each_cpu() with interrupts disabled
2. it is potential deadlock source vs. call_lock in smp_call_function()

The only possible side effect of the removal might be, that an absolute
CLOCK_REALTIME timer fires 1 second too late, in the rare case of leap
second deletion and an absolute CLOCK_REALTIME timer which expires in
the affected time frame. It will never fire too early.

This was probably observed by the reporter of a June 30th -> July 1st
hang: http://lkml.org/lkml/2007/7/3/103

A similar problem was observed by Dave Jones, who provided a screen shot
with a lockdep back trace, which allowed to analyse the problem.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/ide/setup-pci.c: In function 'ide_scan_pcibus':
drivers/ide/setup-pci.c:879: warning: ignoring return value of '__pci_register_driver', declared with attribute warn_unused_result
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Recently the PLL input clock of Promise 2027x is sometimes detected
higher than expected (e.g. 20.027 MHz compared to 16.714 MHz).
It seems sometimes the mdelay() function is not as precise as it
used to be. Per Alan's advice, HT or power management might affect
the precision of mdelay().

This patch calls gettimeofday() to measure the time elapsed and
calculate the PLL input clock accordingly.
Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Bahadir Balban <bahadir.balban@gmail.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

SWDMA modes are unsupported by it821x.  Attempts to tune SWDMA modes always
fail (due to sanity check in ->speedproc) and result in PIO being tuned.

* Fix incorrect SWDMA mask so core code won't try these modes and will just
  tune PIO if no other DMA modes are available.

* Bump driver version.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>

* Driver can't skip programming transfer mode on the device in amd_set_drive()
  (similar fix has been applied to via82cxxx driver ages ago).

* While at it remove redundant warning (ide_config_drive_speed() already
  produces more valuable one).

* Bump driver version.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

The HPT36x chips finally turned out to have the channel enable bits -- however,
badly implemented.  Make use of them despite it's probably only going to burden
the driver's code -- assuming both channels are always enabled by the HighPoint
BIOS anyway...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Linas Vepstas <linas@austin.ibm.com>
Cc: michal.kepien@poczta.onet.pl
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Add the MAXTOR STM3320620A drive into the UltraDMA/66 mode blacklist
for the HPT36x chips.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Found by a static analyser. It is in theory possible we dereference
dev->id when it has become invalid. Re-order to avoid this.

Not needed for new-ide as we no longer support the crazy exabyte nest stuff
Signed-off-by: Alan Cox <alan@redhat.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Look at wait_drive_not_busy in drivers/ide/ide-taskfile.c:

    static u8 wait_drive_not_busy(ide_drive_t *drive)
    {
            ide_hwif_t *hwif = HWIF(drive);
            int retries = 100;
            u8 stat;

            /*
             * Last sector was transfered, wait until drive is ready.
             * This can take up to 10 usec, but we will wait max 1 ms
             * (drive_cmd_intr() waits that long).
             */
            while (((stat = hwif->INB(IDE_STATUS_REG)) & BUSY_STAT) && retries--)
                    udelay(10);

            if (!retries)
                    printk(KERN_ERR "%s: drive still BUSY!\n", drive->name);

            return stat;
    }

`printk' is never called because `retries' never holds zero at the
outside of `while' loop: when `retries' holds zero at the while's loop
condition, `retries' will hold -1 at the if condition.
Signed-off-by: Masatake YAMATO <jet@gyve.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Cc: joe@perches.com
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

if the call to budget_register() fails in ttpci_budget_int(),
ttpci_budget_init() returns success. The attached patch will
fix this problem.
Signed-off-by: Hartmut Birr <e9hack@googlemail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

Spotted and tested by Thomas Sattler <tsattler@gmx.de>.

cinergyT2.c does cancel_delayed_work() + flush_scheduled_work() while
holding cinergyt2->sem. This leads to deadlock because work->func()
needs the same mutex to complete. Another bug is that this code in fact
can't reliably stop the re-arming delayed_work.

Convert this code to use cancel_rearming_delayed_work() and move it
out of ->sem. Another mutex, ->wq_sem, was added to protect against the
concurrent open/resume.

This patch is a horrible hack to fix the lockup which happens in practice.
As Dmitry Torokhov pointed out this driver has other problems and needs
further changes.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

v4l-info and other programs would loop indefinitely while querying the
tuners for cx88-blackbird cards.

The cause was that vidioc_g_tuner didn't return an error value for
qctrl->id != 0, making the application think there is a never ending
list of tuners...

This patch adds the same index check as done in vidioc_g_tuner() in
cx88-video.
Signed-off-by: Jelle Foks <jelle@foks.8m.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

If one uses a V4L *one* application, such as vlc or mplayer's v4l driver, as
the first user after the driver is loaded, the driver wedges itself and will
never capture properly.  Even if one uses a V4L2 application later, it still
won't work.

If one uses a V4L *two* application first, such as tvtime or mplayer's v4l2
driver, then the driver will be ok.  One can then run a V4L1 application, and
it will work.

It turns out the problem is with norm changing and the crop support that was
added in 2.6.21.  The driver defaults to PAL, and keeps the last norm it was
set too across opens.  If one changes the norm via V4L1, the cropping
parameters are not reset like they should be, and they'll remain broken across
device opens.

This patch removes the direct setting of btv->tvnorm in the V4L1 ioctl
VIDIOCSCHAN handler.  The norm is set via the existing call to set_input(),
which calls set_tvnorm(), which will reset the cropping values now that it is
able to detect the norm change.
Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

PCMCIA doesn't use DMA and as this driver is used on many platforms we
don't want it to fail on those that define the DMA alloc API as a NULL
return
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

We got it backwards and now the other detects are fixed it shows up
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Mirrors change in IT821X
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This patch was found to fix some of the problems with the
pata_ali driver.

https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=156482Signed-off-by: Jeff Garzik <jeff@garzik.org>

Signed-off-by: Florian Attenberger  <valdyn@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

host->irq and host->irq2 should be set before ata_host_register() for
IRQ reporting to work.  Move up host->irq assignment in
ata_host_activate() and add it to ata_pci_init_one() native path and
pata_cs5520.

The port info printing in ata_host_register() doesn't fit all the
different controllers.  It should probably be moved out to LLDs with
some helpers in the future.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Need to check for special case "acpi_osi=!Linux" before handling the
general case "acpi_osi=!*", or it will have no effect.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IPoIB/cm: Partial error clean up unmaps wrong address
  mlx4_core: Add new Mellanox device IDs

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/cooloney/blackfin-2.6:
  Blackfin arch: remove zero-sized include/asm-blackfin/macros.h
  Blackfin arch: update board defconfig files
  Blackfin arch: Fix up remaining printks with proper log levels
  Blackfin arch: Add proper -mcpu option according to the cpu and silicon revision configuration

* 'upstream-linus2' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [libata] sata_nv: undo merge error

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  3c589_cs: fix local_bh_enable warning
  RESEND [PATCH 3/3] NetXen: Graceful teardown of interface and hardware upon module unload
  drivers/net/ns83820.c: fix a check-after-use
  net/usb/cdc_ether minor sparse cleanup
  RESEND [PATCH 2/3] NetXen: Support per PCI-function interrupt mask registers
  RESEND [PATCH 1/3] NetXen: Fix issue of MSI not working correctly
  dm9601: Return 0 from bind() on success
  Update MAINTAINERS for USB network devices
  usbnet: Zero padding byte if there is tail room in skb
  dm9601: HW header size shouldn't be included in packet length
  starfire list alpha as 64 bit arch
  myri10ge: SET_NETDEV_DEV()
  gianfar: Fix typo bug introduced by move to udp_hdr()
  [PATCH] libertas: remove private ioctls
  [PATCH] libertas: fix WPA associations by handling ENABLE_RSN correctly
  [PATCH] libertas: kill wlan_scan_process_results
  [PATCH] libertas: style fixes

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: PATA-mode fixes for sis_sata
  libata: add HTS541616J9SA00 to NCQ blacklist
  sata_nv: allow changing queue depth
  sata_inic162x: disable LBA48 devices
  libata: remove reading alt_status from ata_hsm_qc_complete()
  libata: pata_pdc2027x PLL input clock fix
  scsi disk help file is not complete

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: add Kconfig help on building both stacks
  firewire: fix async reception on big endian machines

If a page can't be allocated for the frag list of a skb, the code to
unmap the partially allocated list is off by one.  For exaple, if
'frags' equals one, i == 0, and the alloc_page() fails, then the old
loop would have unmapped mapping[1] which is uninitialized.  The same
would happen if the call to ib_dma_map_page() failed.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Acked-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Add new IDs for PCIe gen2 devices.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

 This file accidentally got truncated instead of deleted in commit df30b117.
Signed-off-by: Marco Roeland <marco.roeland@xs4all.nl>
Cc: Robert P. J. Day <rpjday@mindspring.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Jesper Juhl <jesper.juhl@gmail.com>
Cc: Alex Riesen <raa.lkml@gmail.com>
Cc: Robin Getz <robin.getz@analog.com>
Acked-by: Bryan Wu <bryan.wu@analog.com>

Only the ADMA entry was supposed to be able to change queue depth.
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Russell King wrote:
> Having upgraded from 2.6.16 to 2.6.22-rc6, I'm now seeing the following.
>
> Looks like netfilter is calling local_bh_enable() with IRQs disabled,
> which would appear to be illegal.  Thankfully, this is a warn-once
> warning.
>
> WARNING: at /home/rmk/git/linux-2.6-rmk/kernel/softirq.c:138 local_bh_enable()
> [...]
> [<c01447fc>] (nf_conntrack_destroy+0x0/0x2c) from [<c012c05c>] (__kfree_skb+0xd0/0x100)
> [<c012bf8c>] (__kfree_skb+0x0/0x100) from [<c012c0d8>] (kfree_skb+0x4c/0x50)
>  r5:c12a3800 r4:00000300
> [<c012c08c>] (kfree_skb+0x0/0x50) from [<bf03cbb0>] (el3_start_xmit+0xb8/0xd0 [3c589_cs])
> [<bf03caf8>] (el3_start_xmit+0x0/0xd0 [3c589_cs]) from [<c01324dc>] (dev_hard_start_xmit+0x1a8/0x244)
>  r7:c12a3800 r6:c1a9aa00 r5:c1a9aa00 r4:c12a3800
> [<c0132334>] (dev_hard_start_xmit+0x0/0x244) from [<c013fcc0>] (__qdisc_run+0xb0/0x198)

Thats a bug in the 3c589_cs driver. Patch attached.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Changed PATA handler for PATA-ports used by sata_sis.
This patch was originally submitted by Jeff Garzik.

Added PCI-ID 1180 for SiS966 Controller in pata_sis.
The 1180 mode is fully compatible to other SiS PATA-controller.

The PCI-ID 1183 is SATA in PATA-emulation, but not fully compatible
to SiS5513/5518. sata_sis.c is forwarding this ID to pata_sis.
1183 is not working if simply added to pata_sis.
This handling fixes issues with SiS968.
Signed-off-by: Uwe Koziolek <uwe.koziolek@gmx.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Another member of HTS5416* family doing spurious NCQ completion.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Enrico Sardi <enricoss@tiscali.it>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The sata_nv driver was missing the change_queue_depth hook in the SCSI host
template which the other NCQ-capable libata drivers had. This made it impossible
to change the queue depth by user request. Add this in.
Signed-off-by: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>