Janos Haar of First NetCenter Bt.  reported numerous crashes involving the
NBD driver.  With his help, this was tracked down to bogus bio vectors
which in turn was the result of a race condition between the
receive/transmit routines in the NBD driver.

The bug manifests itself like this:

CPU0				CPU1
do_nbd_request
	add req to queuelist
	nbd_send_request
		send req head
		for each bio
			kmap
			send
				nbd_read_stat
					nbd_find_request
					nbd_end_request
			kunmap

When CPU1 finishes nbd_end_request, the request and all its associated
bio's are freed.  So when CPU0 calls kunmap whose argument is derived from
the last bio, it may crash.

Under normal circumstances, the race occurs only on the last bio.  However,
if an error is encountered on the remote NBD server (such as an incorrect
magic number in the request), or if there were a bug in the server, it is
possible for the nbd_end_request to occur any time after the request's
addition to the queuelist.

The following patch fixes this problem by making sure that requests are not
added to the queuelist until after they have been completed transmission.

In order for the receiving side to be ready for responses involving
requests still being transmitted, the patch introduces the concept of the
active request.

When a response matches the current active request, its processing is
delayed until after the tranmission has come to a stop.

This has been tested by Janos and it has been successful in curing this
race condition.

From: Herbert Xu <herbert@gondor.apana.org.au>

  Here is an updated patch which removes the active_req wait in
  nbd_clear_queue and the associated memory barrier.

  I've also clarified this in the comment.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: <djani22@dynamicweb.hu>
Cc: Paul Clements <Paul.Clements@SteelEye.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

nls_utf8 is available, and the check in hfsplus_fill_super checks the wrong
pointer for NULLness (it checks the saved nls, not the new one that it
needs to use.)
Signed-off-by: Joshua Kwan <joshk@triplehelix.org>
Cc: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Setting RF (resume flag) allows a debugger to resume execution after a
code breakpoint without tripping the breakpoint again.  It is reset by
the CPU after execution of one instruction.

Requested by Stephane Eranian:
  "I am trying to the user HW debug registers on i386 and I am running
   into a problem with ptrace() not allowing access to EFLAGS_RF for
   POKEUSER (see FLAG_MASK).  [ ...  ] It avoids the need to remove the
   breakpoint, single step, and reinstall.  The equivalent functionality
   exists on IA-64 and is allowed by ptrace()"

Cc: Stephane Eranian <eranian@hpl.hp.com>
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

These patches add the header linux/if_ether.h and change 1500 to
ETH_DATA_LEN in some files.
Signed-off-by: Kris Katterjohn <kjak@users.sourceforge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add some PCMCIA device IDs for the microdrive found in the Sharp Zaurus
and a different revision of the Socket CF+ Bluetooth card.
Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

kill the socket_shutdown()/shutdown_socket() confusion by making it
one single function. move cs_socket_put() in there. nicer to read and
smaller:

original:
   text	   data	    bss	    dec	    hex	filename
  25181	   1076	     32	  26289	   66b1	drivers/pcmcia/pcmcia_core.ko

patched:
   text	   data	    bss	    dec	    hex	filename
  24973	   1076	     32	  26081	   65e1	drivers/pcmcia/pcmcia_core.ko
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Convert users of kmalloc and memset to kzalloc
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Do not wildly probe the IO ports we're trying to use on PARISC.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Export the stored values instead of re-reading everything in the socket
information sysfs files, and make them accessible to all users, not only
to root.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

This adds PCMCIA support for both MPC885ADS and MPC866ADS.

This is established not together with FADS, because 885 does not have
io_block_mapping() for BCSR area.
Also, some cleanups done both for 885ADS and MBX.
Signed-off-by: Vitaly Bordug <vbordug@ru.mvista.com>
Signed-off-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

This fixes misconfiguration that could result in odd work of some old CF
cards.
Signed-off-by: Vitaly Bordug <vbordug@ru.mvista.com>
Signed-off-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Some PCMCIA sockets have statically mapped memory windows, but dynamically
mapped IO windows. Using the "nonstatic" socket library is inpractical for
them, as they do neither need a resource database (as we can trust the
kernel resource database on m68k and ppc) nor lots of other features of that
library. Let them get a small "iodyn" socket library (105 lines of code)
instead.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Update the PCMCIA sound drivers to handle the recent changes to the PCMCIA
core. A part of this merge was done by Takashi Iwai <tiwai@suse.de>.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Unify the EVENT_CARD_INSERTION and "attach" callbacks to one unified
probe() callback. As all in-kernel drivers are changed to this new
callback, there will be no temporary backwards-compatibility. Inside a
probe() function, each driver _must_ set struct pcmcia_device
*p_dev->instance and instance->handle correctly.

With these patches, the basic driver interface for 16-bit PCMCIA drivers
now has the classic four callbacks known also from other buses:

        int (*probe)            (struct pcmcia_device *dev);
        void (*remove)          (struct pcmcia_device *dev);

        int (*suspend)          (struct pcmcia_device *dev);
        int (*resume)           (struct pcmcia_device *dev);
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

The linked list of devices managed by each PCMCIA driver is, in very most
cases, unused. Therefore, remove it from many drivers.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Remove the old "detach" mechanism as it is unused now.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Unify the "detach" and REMOVAL_EVENT handlers to one "remove" function.
Old functionality is preserved, for the moment.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Merge the suspend and resume methods for 16-bit PCMCIA cards into the
device model -- for both runtime power management and suspend to ram/disk.

Bugfix in ds.c by Richard Purdie
Signed-Off-By: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Move the suspend and resume methods out of the event handler, and into
special functions. Also use these functions for pre- and post-reset, as
almost all drivers already do, and the remaining ones can easily be
converted.

Bugfix to include/pcmcia/ds.c
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Make the bridge specific initialization code config options depending on
CONFIG_EMBEDDED. Config options for TI/EnE, Toshiba, Ricoh and O2Micro are
available. Disabling all of the specific tweaks cuts off more than half
of yenta_socket.ko.
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Also return a value if CONFIG_PCMCIA_PROBE is not set.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Add a return value to pcmcia_validate_mem.  Only if we have enough memory
available to map the CIS, we should proceed in trying to determine information
about the device.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

The .get_socket callback is never used by the PCMCIA core, therefore remove
it.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Remove the register_callback declaration in struct pccard_operations as it is
unused.
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Don't waste cpu time in yenta interrupt handler when the interrupt was for
another device.
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

Fix macro abuse in pcmcia.
Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>

arch/ia64/kernel/setup.c: In function `show_cpuinfo':
arch/ia64/kernel/setup.c:576: warning: long unsigned int format, different type arg (arg 12)
arch/ia64/kernel/setup.c:576: warning: long unsigned int format, different type arg (arg 13)

Introduced by 95235ca2Signed-off-by: Tony Luck <tony.luck@intel.com>

	I have recently been switching from using 2.4.32 on my trusty
old Sparc Blade 100 to using 2.6.15 .  Some of the problems I ran into
were distorted video when the console was active (missing first
character, skipped dots) and when running X windows (colored snow,
stripes, missing pixels).  A quick examination of the 2.6 versus 2.4
source for the ATY driver revealed alot of changes.

         A closer look at the code/data for the 64GR/XL chip revealed
two minor "typos" that the rewriter(s) of the code made.  The first is
a incorrect clock value (230 .vs. 235) and the second is a missing
flag (M64F_SDRAM_MAGIC_PLL).  Making both these changes seems to have
fixed my problem.  I tend to think the 235 value is the correct one,
as there is a 29.4 Mhz clock crystal close to the video chip and 235.2
(29.4*8) is too close to 235 to make it a coincidence.

	The flag for M64F_SDRAM_MAGIC_PLL was dropped during the
changes made by adaplas in file revision 1.72 on the old bitkeeper
repository.

	The change relating to the clock rate has been there forever,
at least in the 2.6 tree.  I'm not sure where to look for the old 2.5
tree or if anyone cares when it happened.

On SPARC Blades 100's, which use the ATY MACH64GR video chipset, the
clock crystal frequency is 235.2 Mhz, not 230 Mhz.  The chipset also
requires the use of M64F_SDRAM_MAGIC_PLL in order to setup the PLL
properly for the DRAM.
Signed-off-by: Luis F. Ortiz <lfo@Polyad.Org>
Signed-off-by: David S. Miller <davem@davemloft.net>

HOPLIMIT metric is appropriate to TCP reset sent by REJECT target
than hard-coded max TTL. Thanks to David S. Miller for hint.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>

CC [M]  net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.o
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c: In function 'ipv4_refrag':
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c:198: error: dereferencing pointer to incomplete type
make[3]: *** [net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.o] Error 1
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

The original ipv6_find_hdr() finds the specified header in IPv6 packets.
This makes it possible to get transport header so that we can kill similar
loop in ip6_match_packet().
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>