The essid wireless extension does deadlock against the assoc mutex,
as we don't unlock the assoc mutex when flushing the workqueue, which
also holds the lock.
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

While filling the control set the driver tests for a PSPOLL frame.
But it tested only the subtype of the packet. The full type needs
to be tested to identify those packets reliably.

[dsd@gentoo.org: backport to mainline]
Signed-off-by: Ulrich Kunitz <kune@deine-taler.de>
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

conf->mac_addr is not guaranteed to be set. This ensures priv->hwaddr is
always set to a valid mac address. Thanks to Johannes Berg
<johannes@sipsolutions.net> for finding this problem.
Signed-off-by: Michael Wu <flamingice@sourmilk.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This patch removes some duplicated wireless ioctl entries in the array
'struct ioctl_trans ioctl_start[]' of fs/compat_ioctl.c

These entries are registered twice like:

	COMPATIBLE_IOCTL(SIOCGIWPRIV)

and

	HANDLE_IOCTL(SIOCGIWPRIV, do_wireless_ioctl)
Signed-off-by: Masakazu Mokuno <mokuno@sm.sony.co.jp>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This reverts commit 77548f58.

David Woodhouse wrote:

>This broke my shinybook. I seem to get absolutely _no_ outgoing packets,
>although I can receive OK.

Larry Finger wrote:

>Please revert this patch.
Signed-off-by: John W. Linville <linville@tuxdriver.com>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fixes for the SLB shadow buffer code
  [POWERPC] Fix a compile warning in powermac/feature.c
  [POWERPC] Fix a compile warning in pci_32.c
  [POWERPC] Fix parse_drconf_memory() for 64-bit start addresses
  [POWERPC] Fix num_cpus calculation in smp_call_function_map()
  [POWERPC] ps3: Fix section mismatch in ps3/setup.c
  [POWERPC] spufs: Fix affinity after introduction of node_allowed() calls
  [POWERPC] Fix special PTE code for secondary hash bucket
  [POWERPC] Expand RPN field to 34 bits when using 64k pages

 * wrong argument passed to pci_unmap_single() on failure
   exit paths
 * leak in the same area
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.infradead.org/~dwmw2/mtd-2.6.23:
  [MTD] Makefile fix for mtdsuper

* git://git.infradead.org/battery-2.6:
  Don't compile the PMU power driver on 64-bit PowerPC

* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6.23:
  sh: fix defconfigs for sh7751r boards
  sh: fix cf support on r2d boards
  sh: update r2d defconfig
  sh: update snapgear defconfig.
  sh: Fix SH-X3 FPU exception handling.
  sh: Fix pgd mismatch from cached TTB in unhandled fault.
  sh: Don't include fault-nommu on SH-2/SH-2A.
  sh: Fix irqflags tracing for SH-3/4 nommu.
  sh: Fix lockdep debugging oops on SH-3/4.

There is a couple of subtle checks which were needed to handle ptracing from
the same thread group. This was deprecated a long ago, imho this code just
complicates the understanding.

And, the "->parent->signal->flags & SIGNAL_GROUP_EXIT" check in exit_notify()
is not right. SIGNAL_GROUP_EXIT can mean exec(), not exit_group(). This means
ptracer can lose a ptraced zombie on exec(). Minor problem, but still the bug.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

the early setup function serial8250_console_early_setup() can be called
from non __init code (eg. hotpluggable serial ports like serial_cs) so
remove the __init from the call chain to avoid crashes.
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Cc: Yinghai Lu <yinghai.lu@sun.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC]: Fix O_CLOEXEC values.
  [SPARC32]: Fix modular build of floppy driver.
  [SOUND] CS4231 SBus: Two fixes.
  [CG6]: fix memory size detection
  [SPARC64]: Add missing dma_sync_single_range_for_*().

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [TCP]: DSACK signals data receival, be conservative
  [TCP]: Also handle snd_una changes in tcp_cwnd_down
  [TIPC]: Fix two minor sparse warnings.
  [TIPC]: Make function tipc_nameseq_subscribe static.
  [PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10
  [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg().
  [IPV4] route.c: mostly kmalloc + memset conversion to k[cz]alloc
  [IPV4] raw.c: kmalloc + memset conversion to kzalloc
  [NETFILTER] nf_conntrack_l3proto_ipv4_compat.c: kmalloc + memset conversion to kzalloc
  [NETFILTER] nf_conntrack_expect.c: kmalloc + memset conversion to kzalloc
  [NET]: Removal of duplicated include net/wanrouter/wanmain.c
  SCTP: remove useless code in function sctp_init_cause
  SCTP: drop SACK if ctsn is not less than the next tsn of assoc
  SCTP: IPv4 mapped addr not returned in SCTPv6 accept()
  SCTP: IPv4 mapped addr not returned in SCTPv6 accept()
  sctp: fix shadow symbol in net/sctp/tsnmap.c
  sctp: try to fix readlock
  sctp: remove shadowed symbols
  sctp: move global declaration to header file.
  sctp: make locally used function static

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: fw-core: make two variables static
  firewire: fw-ohci: dma_free_coherent needs IRQs enabled
  firewire: fw-sbp2: set correct maximum payload (fixes CardBus adapters)
  ieee1394: sbp2: more correct Kconfig dependencies
  ieee1394: revert "sbp2: enforce 32bit DMA mapping"

The one choosen by asm-generic/fcntl.h is not appropriate
for this platform.

Noticed by Ulrich Drepper.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Remove unnecessary sbus_dma_reset function and change sbus_dma_enable
to avoid occasional system crashes when stopping recording.
Signed-off-by: Georg Chini <georg.chini@triaton-webhosting.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes memory size detection on the CG6 card.
The 1MB TGX card has dblbuf property set to 0.
Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>

Reported by Andrew Morton.
Signed-off-by: David S. Miller <davem@davemloft.net>

We want drivers/mtd/{mtdcore, mtdsuper, mtdpart}.c to be built and linked
into the same mtd.ko module. Fix the Makefile to ensure this, and remove
duplicate MODULE_ declarations in mtdpart.c, as mtdcore.c already has them.
Signed-off-by: Satyam Sharma <satyam@infradead.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

On a machine with hardware 64kB pages and a kernel configured for a
64kB base page size, we need to change the vmalloc segment from 64kB
pages to 4kB pages if some driver creates a non-cacheable mapping in
the vmalloc area.  However, we never updated with SLB shadow buffer.
This fixes it.  Thanks to paulus for finding this.

Also added some write barriers to ensure the shadow buffer contents
are always consistent.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

...by using the pci_get API instead of the deprecated old stuff.
Signed-off-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

__must_check, so do so.
Signed-off-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Some new machines use the "ibm,dynamic-reconfiguration-memory" property
to provide memory layout information, rather than via memory nodes.

There is a bug in the code to parse this property for start addresses
over 4GB; we store the start address in an unsigned int, which means
we throw away the high bits and add apparently duplicate regions.
This results in a BUG() in free_bootmem_core().  This fixes it by
using an unsigned long instead.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

In smp_call_function_map(), num_cpus is set to the number of online
CPUs minus one.  However, if the CPU mask does not include all CPUs
(except the one we're running on), the routine will hang in the first
while() loop until the 8 second timeout occurs.

The num_cpus should be set to the number of CPUs specified in the mask
passed into the routine, after we've made any modifications to the
mask.  With this change, we can also get rid of the call to
cpus_empty() and avoid adding another pass through the bitmask.
Signed-off-by: Kevin Corry <kevcorry@us.ibm.com>
Signed-off-by: Carl Love <carll@us.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

WARNING: vmlinux.o(.text+0x605d4): Section mismatch: reference to
.init.text:.__alloc_bootmem (between '.prealloc' and '.ps3_power_save')
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This patch fixes affinity reference point placement, which was not being
done in some situations, after the introduction of node_allowed() calls.

The previously used parameter, 'ctx', is just the iterator of the
previous list_for_each_entry_reverse loop, and its value might be
invalid at the end of the loop. Also, the right context to seek
for information when defining the reference ctx location
_is_ the reference ctx.
Signed-off-by: Andre Detsch <adetsch@br.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The code for mapping special 4k pages on kernels using a 64kB base
page size was missing the code for doing the RPN (real page number)
manipulation when inserting the hardware PTE in the secondary hash
bucket.  It needs the same code as has already been added to the
code that inserts the HPTE in the primary hash bucket.  This adds it.

Spotted by Ben Herrenschmidt.
Signed-off-by: Paul Mackerras <paulus@samba.org>

The real page number field in our PTEs when configured for 64kB pages
is currently 32 bits, which turns out to be not quite enough for the
resources that the eHCA driver wants to map.  This expands the RPN
field to include 2 adjacent, previously-unused bits.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

In case a DSACK is received, it's better to lower cwnd as it's
a sign of data receival.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp_cwnd_down must check for it too as it should be conservative
in case of collapse stuff and also when receiver is trying to
lie (though that wouldn't be very successful/useful anyway).

Note:
- Separated also is_dupack and do_lost in fast_retransalert
	* Much cleaner look-and-feel now
	* This time it really fixes cumulative ACK with many new
	  SACK blocks recovery entry (I claimed this fixes with
	  last patch but it wasn't). TCP will now call
	  tcp_update_scoreboard regardless of is_dupack when
	  in recovery as long as there is enough fackets_out.
- Introduce FLAG_SND_UNA_ADVANCED
	* Some prior_snd_una arguments are unnecessary after it
- Added helper FLAG_ANY_PROGRESS to avoid long FLAG...|FLAG...
  constructs
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

fix two warnings generated by sparse:

link.c:2386 symbol 'msgcount' shadows an earlier one
node.c:244 symbol 'addr_string' shadows an earlier one
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

make needlessly global function tipc_nameseq_subscribe static.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Although an ipsec SA was established, kernel couldn't seem to find it.

I think since we are now using "x->sel.family" instead of "family" in
the xfrm_selector_match() called in xfrm_state_find(), af_key needs to
set this field too, just as xfrm_user.

In af_key.c, x->sel.family only gets set when there's an
ext_hdrs[SADB_EXT_ADDRESS_PROXY-1] which I think is for tunnel.

I think pfkey needs to also set the x->sel.family field when it is 0.

Tested with below patch, and ipsec worked when using pfkey.
Signed-off-by: David S. Miller <davem@davemloft.net>

As discovered by Evegniy Polyakov, if we try to sendmsg after
a connection reset, we can do incredibly stupid things.

The core issue is that inet_sendmsg() tries to autobind the
socket, but we should never do that for TCP.  Instead we should
just go straight into TCP's sendmsg() code which will do all
of the necessary state and pending socket error checks.

TCP's sendpage already directly vectors to tcp_sendpage(), so this
merely brings sendmsg() in line with that.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>