User supplied len < 0 can cause leak of kernel memory.
Use unsigned compare instead.
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

I came across this bug in http://bugzilla.kernel.org/show_bug.cgi?id=8155Signed-off-by: Olaf Kirch <olaf.kirch@oracle.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

The TX CCID needs the write_xmit_timer for delaying packet sends. Previously
this timer was only activated on active (connecting) sockets.

This patch initialises the write_xmit_timer in sync with the other timers, i.e.
the timer will be ready on any socket. This is used by applications with a
listening socket which start to stream after receiving an initiation by the
client.  The write_xmit_timer is stopped when the application closes, as before.

Was tested to work and to remove the timer bug reported on dccp@vger.

Also moved timer initialisation into timer.c (static). 
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return negative error value (embedded in the pointer) instead of
returning NULL.
Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] DEC: Remove call to register_prom_console.

* git://git.infradead.org/mtd-2.6:
  [JFFS2] print a message when marking bad block
  [JFFS2] Check for all-zero node headers
  [MTD] [OneNAND] Classify the page data and oob buffer
  [MTD] [OneNAND] Exit the loop when transferring/filling of the oob is finished
  [MTD] [OneNAND] add Nokia Copyright and a credit
  [MTD] [OneNAND] Fix typo & wrong comments
  [MTD] [OneNAND] Use oob buffer instead of main one in oob functions
  [MTD] Correct partition failed erase address
  [JFFS2] Use yield() between GC passes in background thread.
  [MTD] [NAND] Correct misspelled preprocessor variable.
  [MTD] [MAPS] dilnetpc: Fix printk warning
  [MTD] [NOR] Fix oops in cfi_amdstd_sync
  [MTD] ESB2 check for closed ROM window
  [JFFS2] Fix writebuffer recovery in the first page of a block
  [MTD] [NAND] make oobavail public

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  ibmtr: Drain rich supply of modpost warnings.
  3c59x: Fix several modpost warnings
  z85230: Fix FIFO handling
  r8169: fix a race between PCI probe and dev_open
  r8169: revert bogus BMCR reset
  sky2: turn off Rx checksum on bad hardware
  mv643xx: Clear pending interrupts before calling request_irq
  myri10ge: add a wc_enabled flag to myri10ge_priv
  myri10ge: prevent 4k rdma on SGI TIOCE chipset
  myri10ge: use pci_map_page to prepare the dmatest buffer
  myri10ge: fix error checking and return value in myri10ge_allocate_rings
  netxen: fix warnings
  via-rhine: set avoid_D3 for broken BIOSes
  [PATCH] bcm43xx: Fix assertion failures in interrupt handler
  [PATCH] bcm43xx: Fix bug in frequency to channel conversion
  [PATCH] bcm43xx: Fix errors in specs to code translation in B6PHY init

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Building ibmtr as a module produces a spectacular pile of modpost warnings:

WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x450) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x454) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x458) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x45c) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x4e8) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x4ec) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x4f0) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x4f4) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:find_turbo_adapters from .text between 'ibmtr_probe_card' (at offset 0x500) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:find_turbo_adapters from .text between 'ibmtr_probe_card' (at offset 0x504) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:find_turbo_adapters from .text between 'ibmtr_probe_card' (at offset 0x508) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:find_turbo_adapters from .text between 'ibmtr_probe_card' (at offset 0x50c) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x520) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x524) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x528) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data:ibmtr_portlist from .text between 'ibmtr_probe_card' (at offset 0x534) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data: from .text between 'ibmtr_probe_card' (at offset 0x540) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data: from .text between 'ibmtr_probe_card' (at offset 0x544) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data: from .text between 'ibmtr_probe_card' (at offset 0x548) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.data: from .text between 'ibmtr_probe_card' (at offset 0x54c) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x558) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x55c) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x560) and 'ibmtr_reset_timer'
WARNING: drivers/net/tokenring/ibmtr.o - Section mismatch: reference to .init.text:ibmtr_probe1 from .text between 'ibmtr_probe_card' (at offset 0x564) and 'ibmtr_reset_timer'

Fix by making ibmtr_probe an __init function.

While at it, move move ibmtr_probe_card below ibmtr_probe so the protoype
for ibmtr_probe can be deleted.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/tokenring/ibmtr.c |   25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)
Signed-off-by: Jeff Garzik <jeff@garzik.org>

WARNING: drivers/net/3c59x.o - Section mismatch: reference to .init.text: from .text between 'vortex_eisa_probe' (at offset 0x4580) and 'vortex_eisa_remove'
WARNING: drivers/net/3c59x.o - Section mismatch: reference to .init.text: from .text between 'vortex_eisa_probe' (at offset 0x4584) and 'vortex_eisa_remove'
WARNING: drivers/net/3c59x.o - Section mismatch: reference to .init.text: from .text between 'vortex_eisa_probe' (at offset 0x4588) and 'vortex_eisa_remove'
WARNING: drivers/net/3c59x.o - Section mismatch: reference to .init.text: from .text between 'vortex_eisa_probe' (at offset 0x458c) and 'vortex_eisa_remove'

Fixed by:

 o move definition of vortex_eisa_driver below the functions it references.
 o remove now unnecessary prototypes for vortex_eisa_probe and
   vortex_eisa_remove.
 o Make vortex_eisa_probe an __init function.
 o Make vortex_eisa_remove a __devexit function.
 o Wrap vortex_eisa_driver reference to vortex_eisa_remove with
   __devexit_p().
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/3c59x.c |   28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)
Signed-off-by: Jeff Garzik <jeff@garzik.org>

We must exit immediately on a FIFO fill not take the end of packet path
otherwise each underrun in PIO transmit mode causes a runt packet and the
data is lost.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Initialize the timer with the rest of the private-struct.
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Added during bf793295

The current code requests a reset but prohibits autoneg, 1000 Mb/s,
100 Mb/s and full duplex. The 8168 does not like it at all.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

On Yukon FE, occasional hardware receive checksum errors are seen.
An early indication of the problem is single bit differences in the two
checksum engines.  Use this as a detection mechanism to turn off Rx
checksumming.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Signed-off-by: Dale Farnsworth <dale@farnsworth.org>
Acked-by: Giridhar Pemmasani <pgiri@yahoo.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Add a wc_enabled flag in the myri10ge_priv instead of relying
on mtrr >= 0.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Do not use 4k rdma request on SGI TIOCE chipset since this
bridge does not support it.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Allocate a specific page and use pci_map_page for dma test instead
of relying on another existing buffer.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix a missing error check in myri10ge_allocate_rings() and set status
to -ENOMEM before all actual allocations so that the error path returns
what it should.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

  CC [M]  drivers/net/netxen/netxen_nic_hw.o
drivers/net/netxen/netxen_nic_hw.c: In function 'netxen_nic_hw_resources':
drivers/net/netxen/netxen_nic_hw.c:231: warning: format '%llx' expects type 'long long unsigned int', but argument 2 has type 'dma_addr_t'
drivers/net/netxen/netxen_nic_hw.c:250: warning: format '%llx' expects type 'long long unsigned int', but argument 2 has type 'dma_addr_t'

u64 is unsigned long so the cast to u64 will result in a warning on the
printf arguments for 64-bit builds.  So cast to unsigned long long instead.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This patch sets avoid_D3 for BIOSes known to be broken. Said BIOSes fail
at PXE boot if the chip is in power state D3.
Signed-off-by: Roger Luethi <rl@hellgate.ch>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Some platform devices are driven without driver attached, so managed
resources can be acquired without driver attached.  Make sure such
resources are released by calling devres_release_all() in
device_del().
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

host->ops->host_stop() might access ports.  Free ports after
host_stop.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Commit 721449bf added support for using the
ADMA notifier bits to determine which commands to check for completion.
However there have been reports that this causes command timeouts in certain
cases. This is still being investigated. In addition, apparently the notifiers
won't work if ADMA is disabled on the other port as a result of an ATAPI device
being connected, and we don't handle this case properly.

For now, just restore the previous behavior of checking all active commands
to see if they are complete, without relying on the notifiers.
Signed-off-by: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Recently I got my hands on nVidia's MCP61 PM-AM board, and
it contains IDE chip configured by BIOS with only primary
channel enabled.  This confuses code which probes for
device DMA capabilities - it gets 0x60 (happy duplex
device) from primary channel BMDMA, but 0xFF (nobody here)
from secondary channel BMDMA.  Due to this code then believes
that chip is simplex.  I do not address this problem in
my patch, as I'm not sure how to handle this.  Probably
ata_pci_init_one should have bitmap of enabled/possible
interfaces instead of their count, but it looks like
quite intrusive change, and maybe we do not care - for device
with only one channel simplex and regular DMA engines are
same.

But making device simplex pointed out that support for
DMA on simplex devices is currently broken - ata_dev_xfermask
tests whether device is simplex and if it is whether DMA
engine was assigned to this port.  If not then it strips
out DMA bits from device.  Problem is that code which assigns
DMA engine to port in ata_set_mode first detect device
mode and assigns DMA engine to channel only if some DMA
capable device was found.

And as xfermask stripped out DMA bits, host->simplex_claimed
is always NULL with current implementation.

By allowing DMA either if simplex_claimed is NULL or if it
points to current port DMA can be finally used - it gets
assigned to first port which contains any DMA capable
device.

Before:
pata_amd 0000:00:06.0: version 0.2.8
PCI: Setting latency timer of device 0000:00:06.0 to 64
ata5: PATA max UDMA/133 cmd 0x000101f0 ctl 0x000103f6 bmdma 0x0001f000 irq 14
ata6: PATA max UDMA/133 cmd 0x00010170 ctl 0x00010376 bmdma 0x0001f008 irq 15
scsi4 : pata_amd
ata5.00: ATAPI, max UDMA/66
ata5.00: simplex DMA is claimed by other device, disabling DMA
ata5.00: configured for PIO4
scsi5 : pata_amd
ata6: port disabled. ignoring.
ata6: reset failed, giving up
scsi 4:0:0:0: CD-ROM            ATAPI    DVD W  DH16W1P   LG12 PQ: 0 ANSI: 5

After:
pata_amd 0000:00:06.0: version 0.2.8
PCI: Setting latency timer of device 0000:00:06.0 to 64
ata5: PATA max UDMA/133 cmd 0x000101f0 ctl 0x000103f6 bmdma 0x0001f000 irq 14
ata6: PATA max UDMA/133 cmd 0x00010170 ctl 0x00010376 bmdma 0x0001f008 irq 15
scsi4 : pata_amd
ata5.00: ATAPI, max UDMA/66
ata5.00: configured for UDMA/33
scsi5 : pata_amd
ata6: port disabled. ignoring.
ata6: reset failed, giving up
scsi 4:0:0:0: CD-ROM            ATAPI    DVD W  DH16W1P   LG12 PQ: 0 ANSI: 5
Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

A while ago I modified the libata code so that drivers can return -ENOENT
for unknown ports not fiddle with the EH flags and print stuff directly.
Somewhere along the line ata_piix didn't get fully converted.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

New bad eraseblock is an event which is important enough to be printed
about.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Register_prom_console was removed when mips was converted to early printk.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Due to a poor choice of CRC32 seed, a node header which is all zeroes
would pass the CRC32 check. Explicitly check for this case, and treat it
as we do a CRC failure.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Classify the page data and oob buffer
and it prevents the memory fragementation (writesize + oobsize)
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

When transferring/filling of the oob is finished in OOB_AUTO, we exit the loop
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

add Nokia Copyright and a credit
Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Fix typo & wrong comments
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

In oob functions, it is used main buffer instead of oob one. So fix it.
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

missing close bracket.
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 - point to the sparse webpage
 - use git:// instead of rsync://
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

x86_64 nvidia_bugs() broke when we bailed out on not finding the HPET.
However, the quirk works by checking for _not_ finding the HPET...

Delete the nvidia_hpet_detected flag and simply test for
not finding the HPET, which is simple to do now that
acpi_table_parse returns 1 on failure.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IPoIB: Turn on interface's carrier after broadcast group is joined
  RDMA/ucma: Avoid sending reject if backlog is full
  RDMA/cxgb3: Fix MR permission problems
  RDMA/cxgb3: Don't reuse skbs that are non-linear or cloned
  RDMA/cxgb3: Squelch logging AE errors
  RDMA/cxgb3: Stop EP timer when MPA exchange is aborted by peer
  RDMA/cxgb3: Move QP to error on destroy if the state is IDLE
  RDMA/cxgb3: Fixes for "normal close" failures
  RDMA/cxgb3: Fix build on sparc64
  RDMA/cma: Initialize rdma_bind_list in cma_alloc_any_port()
  RDMA/cxgb3: Don't use mm after it's freed in iwch_mmap()
  RDMA/cxgb3: Start ep timer on a MPA reject
  IB/mthca: Fix error path in mthca_alloc_memfree()
  IB/ehca: Fix sync between completion handler and destroy cq
  IPoIB: Only handle async events for one port

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [SCTP] ipv6: inconsistent lock state ipv6_add_addr/sctp_v6_copy_addrlist

Need to provide {claim,release}_dma_lock() for this guy too.
Signed-off-by: David S. Miller <davem@davemloft.net>