Fix races in in destroying various objects.  If a destroy routine
waits for an object to become free by doing

	wait_event(&obj->wait, !atomic_read(&obj->refcount));
	/* now clean up and destroy the object */

and another place drops a reference to the object by doing

	if (atomic_dec_and_test(&obj->refcount))
		wake_up(&obj->wait);

then this is susceptible to a race where the wait_event() and final
freeing of the object occur between the atomic_dec_and_test() and the
wake_up().  And this is a use-after-free, since wake_up() will be
called on part of the already-freed object.

Fix this in mthca by replacing the atomic_t refcounts with plain old
integers protected by a spinlock.  This makes it possible to do the
decrement of the reference count and the wake_up() so that it appears
as a single atomic operation to the code waiting on the wait queue.

While touching this code, also simplify mthca_cq_clean(): the CQ being
cleaned cannot go away, because it still has a QP attached to it.  So
there's no reason to be paranoid and look up the CQ by number; it's
perfectly safe to use the pointer that the callers already have.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

If a SCSI abort completes, or the command completes successfully, then
the driver must remove the command from its queue of pending
commands.  Similarly, if a device reset succeeds, then all commands
queued for the given device must be removed from the queue.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The code to display local_link_integrity_errors and
excessive_buffer_overrun_errors in
/sys/class/infiniband/<hca>/ports/<n>/counters/
uses the wrong shift to extract the 4 bit values.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6:
  [PATCH] bcm43xx: Fix access to non-existent PHY registers
  [PATCH] bcm43xx: Fix array overrun in bcm43xx_geo_init
  [PATCH] bcm43xx: check for valid MAC address in SPROM
  [PATCH] ieee80211: Fix A band channel count (resent)
  [PATCH] bcm43xx: fix iwmode crash when down
  [PATCH] softmac: make non-operational after being stopped
  [PATCH] softmac: don't reassociate if user asked for deauthentication
  spidernet: enable support for bcm5461 ethernet phy
  spidernet: introduce new setting
  Fix RTL8019AS init for Toshiba RBTX49xx boards
  au1000_eth.c: use ether_crc() from <linux/crc32.h>
  sky2: version 1.3
  Add more support for the Yukon Ultra chip found in dual core centino laptops.
  sky2: synchronize irq on remove
  sky2: dont write status ring
  sky2: edge triggered workaround enhancement
  sky2: use mask instead of modulo operation
  sky2: tx ring index mask fix
  sky2: status irq hang fix
  sky2: backout NAPI reschedule

Instantiation of 8MB pages on the TLB cache for the kernel static
mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations.
This ensures r3 gets saved and restored.
Signed-off-by: Marcelo Tosatti <marcelo@kvack.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

My commit 6bfd93c3 broke the ARCH=ppc
compilation by using the is_kernel_addr() macro in asm/uaccess.h.
This fixes it by defining a suitable is_kernel_addr() for ARCH=ppc.
Signed-off-by: Paul Mackerras <paulus@samba.org>

* git://oss.sgi.com:8090/xfs-2.6:
  [XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an
  [XFS] Fix a project quota space accounting leak on rename.
  [XFS] Fix a possible forced shutdown due to mishandling write barriers

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

A newer board revision changed the type of ethernet phy.
Moreover, this generalizes the way that a phy gets switched
into fiber mode when autodetection is not available.
Signed-off-by: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

We found a new chip setting that we need in order
to make the driver work more reliable.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

    Ensure that 8-bit mode is selected for the on-board Realtek RTL8019AS chip
on Toshiba RBHMA4x00, get rid of the duplicate #ifdef's when setting
ei_status.word16.
    The chip's datasheet says that the PSTOP register shouldn't exceed 0x60 in
8-bit mode -- ensure this too.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

since the au1000 driver already selects the CRC32 routines, simply replace
the internal ether_crc() implementation with the semantically equivalent
one from <linux/crc32.h>
Signed-off-by: Herbert Valerio Riedel <hvr@gnu.org>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Update version number, to track changes.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

The newest Yukon Ultra chipset's require more special tweaks.
They seem to be like the Yukon XL chipsets. This code is transliterated
from the latest SysKonnect driver; I don't have any Ultra hardware.
Signed-off-by: Stephe Hemminger <shemminger@osdl.org>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Need to make sure interrupt is not racing with unregister of
network device.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

It is more efficient not to write the status ring from the
processor and just read the active portion.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Need to make the edge-triggered workaround timer faster to get marginally
better peformance. The test_and_set_bit in schedule_prep() acts as a barrier
already. Make it a module parameter so that laptops who are concerned
about power can set it to 0; and user's stuck with broken BIOS's
can turn the driver into pure polling.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Gcc isn't smart enough to know that it can do a modulo
operation with power of 2 constant by doing a mask.
So add macro to do it for us.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Mask for transmit ring status was picking up bits from the
unused sync ring.  They were always zero, so far...
Also, make sure to remind self not to make tx ring too big.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

The status interrupt flag should be cleared before processing,
not afterwards to avoid race. Need to process in poll routine
even if no new interrupt status. This is a normal occurrence when
more than 64 frames (NAPI weight) are processed in one poll routine.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

This is a backout of earlier patch.

The whole rescheduling hack was a bad idea. It doesn't really solve
the problem and it makes the code more complicated for no good reason.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

This reverts commit c8d8b837, which
caused problems for the x86 build. Quoth Sam:

  "It was discussed on mips list but apparently the fix was bogus.  I
   will not have time to look into it so mips can carry this local fix
   until we get a proper fix in mainline."
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Taking the cpu hotplug semaphore in a normal events workqueue
is unsafe because other tasks can wait for any workqueues with
it hold. This results in a deadlock.

Move the DBS timer into its own work queue which is not
affected by other work queue flushes to avoid this.

Has been acked by Venkatesh.

Cc: venkatesh.pallipadi@intel.com
Cc: cpufreq@lists.linux.org.uk
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Based on analysis&patch from Robert Hentosch

Observed on a Dell PE6850 with 16GB

The problem occurs very early on, when the kernel allocates space for the
temporary memory map called bootmap. The bootmap overlaps the EBDA region.
EBDA region is not historically reserved in the e820 mapping. When the
bootmap is freed it marks the EBDA region as usable.

If you notice in setup.c there is already code to work around the EBDA
in reserve_ebda_region(), this check however occurs after the bootmap
is allocated and doesn't prevent the bootmap from using this range.

AK: I redid the original patch. Thanks also to Jan Beulich for
spotting some mistakes.

Cc: Robert_Hentosch@dell.com
Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Playing with NMI watchdog on x86_64, I discovered that it didn't
do what I expected.  It always panic-ed, even when it didn't
happen from interrupt context.  This patch solves that
problem for me.  Also, in this case, do_exit() will be called
with interrupts disabled, I believe.  Would it be wise to also
call local_irq_enable() after nmi_exit()?
[Yes I added it -AK]

Currently, on x86_64, any NMI watchdog timeout will cause a panic
because the irq count will always be set to be in an interrupt
when do_exit() is called from die_nmi().  If we add nmi_exit() to
the die_nmi() call (since the nmi will never exit "normally")
it seems to solve this problem.  The following small program
can be used to trigger the NMI watchdog to reproduce this:
  main ()
  {
        iopl(3);
        for (;;) asm("cli");
  }
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I noticed this when poking around in this area.

The oops_begin() function in x86_64 would only conditionally claim
the die_lock if the call is nested, but oops_end() would always
release the spinlock. This patch adds a nest count for the die lock
so that the release of the lock is only done on the final oops_end().
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The IOMMU code can only deal with 8 northbridges. Error out when
more are found.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The patch addresses a problem with ACPI SCI interrupt entry, which gets
re-used, and the IRQ is assigned to another unrelated device.  The patch
corrects the code such that SCI IRQ is skipped and duplicate entry is
avoided.  Second issue came up with VIA chipset, the problem was caused by
original patch assigning IRQs starting 16 and up.  The VIA chipset uses
4-bit IRQ register for internal interrupt routing, and therefore cannot
handle IRQ numbers assigned to its devices.  The patch corrects this
problem by allowing PCI IRQs below 16.

Cc: len.brown@intel.com

Signed-off by: Natalie Protasevich <Natalie.Protasevich@unisys.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] remove asm-ia64/bitops.h self-inclusion
  [IA64] strcpy returns NULL pointer and not destination pointer

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IRDA] irda-usb: use NULL instead of 0
  [IPV4]: Remove likely in ip_rcv_finish()
  [NET]: Create netdev attribute_groups with class_device_add
  [CLASS DEVICE]: add attribute_group creation

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild:
  kbuild: Do not overwrite makefile as anohter user
  kbuild: drivers/video/logo/ - fix ident glitch
  kbuild: fix gen_initramfs_list.sh
  kbuild modpost - relax driver data name
  kbuild: removing .tmp_versions considered harmful
  kbuild: fix modpost segfault for 64bit mipsel kernel

It is insane to be giving lease_init() the task of freeing the lock it is
supposed to initialise, given that the lock is not guaranteed to be
allocated on the stack. This causes lockups in fcntl_setlease().
Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com>

Also fix a slab leak in __setlease() due to an uninitialised return value.
Problem diagnosed by Björn Steinbrink.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

AG freelist.

SGI-PV: 952681
SGI-Modid: xfs-linux-melb:xfs-kern:25902a
Signed-off-by: Nathan Scott <nathans@sgi.com>

SGI-PV: 951636
SGI-Modid: xfs-linux-melb:xfs-kern:25811a
Signed-off-by: Nathan Scott <nathans@sgi.com>

with remount,ro.

SGI-PV: 951944
SGI-Modid: xfs-linux-melb:xfs-kern:25742a
Signed-off-by: Nathan Scott <nathans@sgi.com>

Change the conditional of the outputmakefile rule to be evaluated entirely
in make, and add a conditional to not touch the generated makefile when e.g.
running 'make install' as root while the build was done as non-root. Also
adjust the comment describing this, and move the message printing and
redirection to mkmakefile.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 3507/1: Replace map_desc.physical with map_desc.pfn: aaed2000
  [ARM] 3506/1: aaec2000: debug-macro.S needs hardware.h
  [ARM] 3505/1: aaec2000: entry-macro.S needs asm/arch/irqs.h
  [ARM] 3504/1: Fix clcd includes for aaec2000
  [ARM] 3503/1: Fix map_desc structure for aaec2000
  [ARM] 3501/1: i.MX: fix lowlevel debug macros
  [ARM] rtc-sa1100: fix compiler warnings and error cleanup
  [ARM] Allow SA1100 RTC alarm to be configured for wakeup

Patch from Bellido Nicolas

aaed2000 map_desc.pfn conversion
Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Bellido Nicolas

Include hardware.h in debug-macro.S, otherwise io_p2v is undefined.
Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Bellido Nicolas

Since git commit 2b78838842346da390e8547cd37035184376d506, entry-macro.S needs to include asm/arch/irqs.h
Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>