[SCSI] lpfc: fix potential overflow of hbqs array

The Coverity checker noticed that we may overrun a statically allocated
array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find().

The case is this; In 'struct lpfc_hba' we have

#define LPFC_MAX_HBQS  4
...
struct lpfc_hba {
...
struct hbq_s hbqs[LPFC_MAX_HBQS];
...
};

But then in lpfc_sli_hbqbuf_find() we have this code

hbqno = tag >> 16;
if (hbqno > LPFC_MAX_HBQS)
return NULL;

if 'hbqno' ends up as exactely 4, then we won't return, and then this

list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {

will cause an overflow of the statically allocated array at index 4,
since the valid indices are only 0-3.

I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS'
into 'hbqno >= LPFC_MAX_HBQS' as a possible fix.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Smart <James.Smart@Emulex.Com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] fc4: convert to use the data buffer accessors

- remove the unnecessary map_single path.

- convert to use the new accessors for the sg lists and the
parameters.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Move documentation to Documentation/scsi

The 700+-line comment at the top of the advansys driver fits more comfortably
in Documentation/scsi.

Delete the sections on:
 - kernels supported
 - other files modified (obsolete)
 - source comments (obsolete)
 - tests to run
 - release history (that's what a VCS is for)
 - contacting connectcom (the domain has expired and the phone number is
   now in use by another organisation)

Known problems/fix list is moved down to the section where jejb put his FIXME.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: use memcpy instead of open-coded loop

Use memcpy to initialise eep_config instead of a loop.  For
AdvInitFrom38C1600EEP where we need to modify the default EEPROM
configuration, do it after the loop, and do it using the structure
definition, not by finding the right byte.  I think it was wrong for
big-endian machines.

Also delete some non-useful comments and prototypes.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Remove pci_slot_info

The driver kept a copy of the PCI config address; refer to the pci_dev
associated with the card instead.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Remove library-style callback routines

Convert adv_isr_callback, adv_async_callback and asc_isr_callback into
direct calls.  Remove the unused asc_exe_callback.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Move struct device out of the cfg structures

The cfg structures are supposed to be disposable after initialisation;
with the 'dev' used for DMA mapping in there, that's not possible.  Move
the dev to the board.

Also inline AscInitFromAscDvcVar into its only caller, remove some
unnecessary prototypes and sort out a few minor formatting issues.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Stop using n_io_port in Scsi_Host structure

n_io_port isn't suitable for advansys because some of the boards have
more than 255 bytes of io port space.  There's already a driver-private
replacement, asc_n_io_port, but for some reason the driver was still
setting and occasionally reporting n_io_port.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: ioremap no longer needs page-aligned addresses

At some point during Linux 2.1 development, ioremap() gained the ability
to handle addresses which weren't page-aligned.  Also expand the CONFIG_PCI
range to encompass that entire section of wide board initialisation, since
all wide boards are PCI.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: delete AscGetChipBusType

By moving a test from AscGetChipBusType into its only caller, we can delete
the whole function

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: misc reformatting

Remove some useless forward declarations
Reformat some comments, debug messages, and the occasional piece of real code
Removal of unnecessary braces
Remove duplicate setting of shost->irq

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: remove INQUIRY sniffing

Use slave_configure() to do all the work that used to be done in
AscInquiryHandling and AdvInquiryHandling.  Split slave_configure into
two functions, one for wide and one for narrow controllers.

Remove some unused definitions, duplicate definitions, unnecessary
declarations, and scsireqq, cap_info and inquiry from struct asc_board.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] Add QUANTUM XP34301 to the blacklist

According to the AdvanSys driver, this device has a problem with tagged
queueing.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: remove AscCompareString()

AscCompareString() is just another name for strncmp

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: More PCI cleanups

 - Remove wrappers around the PCI configuration space accessors
 - Call pci_set_master() instead of poking at config space directly
 - Move the latency setting into one function called for both narrow and
   wide boards.
 - Tidy up AdvInitGetConfig() a little.
 - Delete a few unused prototypes and definitions.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Update resource management

Make sure the resources are reserved and released by all the callers of
advansys_board_found().  This eliminates the check_region-style race.
It also allows us to use the pci_request_regions() API.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Convert to ISA driver model

Register two isa_drivers, one for ISA and one for VLB, in order to
preserve detection order.  When deleting advansys_detect, we lose the
last vestiges of the code that limited IO port scanning.  This code
has been effectively disabled for many years anyway; I'll restore it
in a module_param later.  We also lose the code that placed all ISA PnP
cards into WaitForKey state -- drivers shouldn't be doing this anyway.
The asc_host array goes away too.  Also remove some IOADR and other
definitions, such as ASC_NUM_BOARD_SUPPORTED.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Convert to EISA driver model

 - Switch EISA probing to the driver model
 - Remove some now-unused macros and functions
 - Update the FIXME now that we use the correct driver model probing API

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Convert to PCI driver model

 - Add a pci_driver interface for the PCI advansys devices (for
   ISA/EISA/VLB devices, we still call advansys_detect).
 - Many functions are converted from __init to __devinit to allow hotplug
   PCI to work.
 - Only keep devices found by advansys_detect in the asc_host list.
 - Rename asc_board_count to asc_legacy_count.  New asc_board_count is only
   used to generate a unique name for each device.
 - Remove some now-unused macros and struct definitions

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Move to scsi hotplug initialisation model

 - Switch from scsi_register/scsi_unregister to scsi_host_alloc,
   scsi_add_host, scsi_scan_host and scsi_host_put.
 - Rename the scsi_host_template to advansys_template
 - Use module_init and module_exit instead of scsi_module.c
 - Remove protection against advansys_detect being called twice

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Make advansys_board_found a little more readable

 - Put all the error cleanup at the end of the function and goto the
   appropriate label
 - Split advansys_wide_init_chip out of advansys_board_found
 - Split advansys_wide_free_mem out of advansys_board_found.  Use it
   from advansys_release
 - Use GFP_KERNEL, not GFP_ATOMIC, when allocating memory during
   initialisation
 - Eliminate lots of PROC_FS ifdefs by removing the ifdefs around the prtbuf
   struct member

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Stop checking the scsi_cmnd belongs to our Scsi_Host

The interrupt routines used to walk the list of Scsi_Hosts belonging to
this driver to make sure that the scsi_cmnd belonged to one of them.
This is a waste of time and gets in the way of later cleanups, so
delete it.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Improve interrupt handler

Pass the Scsi_Host to the interrupt handler, rather than polling all
hosts for each interrupt.
Return IRQ_NONE if we didn't handle this interrupt
Don't set the IRQF_DISABLED flag; this is not a fast-executing interrupt
handler.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: Clean up proc_info implementation

Just use the Scsi_Host passed in, rather than looking through the driver's
own array of boards for one that matches it.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] advansys: undate version, copyright, etc

Update the version to 3.4
Add my copyright
Add myself to MAINTAINERS
Exercise my right to change the license from dual BSD/GPL to GPL
Don't force the definition of CONFIG_ISA on x86
Always include pci.h
Stop including stat.h

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] sg: increase sglist_len of the sg_scatter_hold structure

unsigned short is too small for sizeof(struct scatterlist) *
min(q->max_hw_segments, q->max_phys_segments).

This fixes memory leak with 4096 segments since 16 (likely sg size
with x86) * 4096 sets sglist_len to zero.

This might not happen without sg chaining support.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] Fix async scanning double-add problems

Stress-testing and some thought has revealed some places where
asynchronous scanning needs some more attention to locking.

 - Since async_scan is a bit, we need to hold the host_lock while
   modifying it to prevent races against other CPUs modifying the word
   that bit is in.  This is probably a theoretical race for the moment,
   but other patches may change that.
 - The async_scan bit means not only that this host is being scanned
   asynchronously, but that all the devices attached to this host are not
   yet added to sysfs.  So we must ensure that this bit is always in sync.
   I've chosen to do this with the scan_mutex since it's already acquired
   in most of the right places.
 - If the host changes state to deleted while we're in the middle of
   a scan, we'll end up with some devices on the host's list which must
   be deleted.  Add a check to scsi_sysfs_add_devices() to ensure the
   host is still running.
 - To avoid the async_scan bit being protected by three locks, the
   async_scan_lock now only protects the scanning_list.

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] microtek: use data accessors and !use_sg cleanup

  - use scsi_cmnd data accessors
  - Clean the !use_sg code paths

Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
[jejb: merge conflict fix]
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] fix write buffer length in scsi_req_map_sg()

sg's may have setup a the buffer with a different length than
the transfer length so we should be using the bufflen passed
in as the request's data len.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] ps3rom: convert to use the data buffer accessors

This converts ps3rom driver to use the new accessors for the sg lists
and the parameters.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] scsi_transport_srp: remove tgt dependencies

it's better to remove tgt dependencies in srp transport class since
most people want only initiator support.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] tgt: convert ibmvstgt to use transport tsk_mgmt_response callback

This converts ibmvstgt to use transport tsk_mgmt_response callback.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] tgt: move tsk_mgmt_response callback to transport class

This moves tsk_mgmt_response callback in struct scsi_host_template to
struct scsi_transport_template since struct scsi_transport_template is
more suitable for the task management stuff.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] tgt: convert libsrp and ibmvstgt to use srp_transport

This converts libsrp and ibmvstgt to use srp transport.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] srp_transport: add target driver support

This adds minimum target driver support:

- srp_rport_{add,del} calls scsi_tgt_it_nexus_{create,destroy} for
target drivers.

- add a callback to notify target drivers of the nexus operation
results to srp_function_template.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] tgt: add I_T nexus support

tgt uses scsi_host as I_T nexus. This works for ibmvstgt because it
creates one scsi_host for one initiator. However, other target drivers
don't work like that.

This adds I_T nexus support, which enable one scsi_host to handle
multiple initiators. New scsi_tgt_it_nexus_create/destroy functions
are expected be called transport classes. For example, ibmvstgt
creates an initiator remote port, then the srp transport calls
tgt_it_nexus_create. tgt doesn't manages I_T nexus, instead it tells
tgtd, user-space daemon, to create a new I_T nexus.

On the receiving the response from tgtd, tgt calls
shost->transportt->it_nexus_response. transports should notify a
lld. The srp transport uses it_nexus_response callback in
srp_function_template to do that.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] transport_srp: add rport roles attribute

This adds a 'roles' attribute to rport like transport_fc. The role can
be initiator or target. That is, the initiator driver creates target
remote ports and the target driver creates initiator remote ports.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] ib_srp: convert to use the srp transport class

This converts ib_srp to use the srp transport class.

I don't have ib hardware so I've not tested this patch.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Roland Dreier <rolandd@cisco.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] ibmvscsi: convert to use the srp transport class

This converts ibmvscsi to use the srp transport class.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] add srp transport class

This adds srp transport class that works with ib_srp and ibmvscsi.

It creates only /sys/class/{srp_host,srp_remote_ports} and
srp_remote_ports has only "port_id" attribute.

viola:/sys/class/srp_remote_ports/port-0:1# ls
device  port_id  subsystem  uevent
viola:/sys/class/srp_remote_ports/port-0:1# cat port_id
4c:49:4e:55:58:20:56:49:4f:00:00:00:00:00:00:00

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Update version number to 8.02.00-k3.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Correct mailbox register dump for FWI2 capable ISPs.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Correct 8GB iIDMA support.

Original implementation manipulated the FC_GS values for
port-speed.  Transition the codes to use the driver's own
internal representations as this makes for a reduction in
duplicate 'conversion' codes throughout the driver.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Correct management-server login-state synchronization issue.

Transitioning link-state via NOS/OLS requires a relogin to a
fabric's Management Server.  Request relogin when the firmware
issues a point-to-point asynchronous event (0x8030).

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Don't modify parity bits during ISP25XX restart.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] qla2xxx: Allocate enough space for the full PCI descriptor.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] zfcp: fix the data buffer accessor patch

Fix the data buffer accessor patch.

For request without a data buffer nothing was written into
a SBALE.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] zfcp: allocate gid_pn_data objects from gid_pn_cache

allocate gid_pn_data objects from gid_pn_cache.

Allocate gid_pn_data objects from the corresponding cache which ensures
proper alignment.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

[SCSI] zfcp: fix memory leak

fix memory leak.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Merge git://git./linux/kernel/git/steve/gfs2-2.6-fixes

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
  [GFS2] Revert remounting w/o acl option leaves acls enabled
  [GFS2] Fix setting of inherit jdata attr
  [GFS2] Fix incorrect error path in prepare_write()
  [GFS2] Fix incorrect return code in rgrp.c
  [GFS2] soft lockup in rgblk_search
  [GFS2] soft lockup detected in databuf_lo_before_commit
  [DLM] fix basts for granted PR waiting CW
  [DLM] More othercon fixes
  [DLM] Fix memory leak in dlm_add_member() when dlm_node_weight() returns less than zero
  [DLM] zero unused parts of sockaddr_storage
  [DLM] fix NULL ls usage
  [DLM] Clear othercon pointers when a connection is closed

Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6

* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  i2c-s3c2410: Build fix
  i2c/menelaus: Build fix
  i2c-mv64xxx: Reinitialize hw and driver on I2C bus hang
  i2c-mpc: Don't disable I2C module on stop condition
  i2c-iop3xx: Set I2C_CLASS_HWMON to adapter class
  i2c/isp1301_omap: Build fixes, whitespace
  i2c-mpc: Pass correct dev_id to free_irq on error path
  i2c-i801: Typo: erroneous

i2c-s3c2410: Build fix

Fixup the include files after the arch moves that
where included in 2.6.23.

Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c/menelaus: Build fix

Fix Menelaus build error, and remove needless "#define DEBUG".

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c-mv64xxx: Reinitialize hw and driver on I2C bus hang

Under certain conditions, the mv64xxx I2C bus can hang preventing
further operation.  To make the driver more robust, we now reset
the I2C hardware and the driver state machine when such hangs are
detected.

Signed-off-by: Dale Farnsworth <dale@farnsworth.org>
Acked-by: Mark A. Greer <mgreer@mvista.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c-mpc: Don't disable I2C module on stop condition

Disabling module on stop doesn't work on some CPUs (ie. mpc8241,
as reported by Guennadi Liakhovetski), so remove that.

Disable I2C module on errors/interrupts to prevent it from
locking up on mpc5200b.

Signed-off-by: Domen Puncer <domen.puncer@telargo.com>
Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c-iop3xx: Set I2C_CLASS_HWMON to adapter class

In order to be able to use sensors on the IOP3xx SoCs, one needs to set
the adapter class to I2C_CLASS_HWMON.

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c/isp1301_omap: Build fixes, whitespace

Build fixes for isp1301_omap driver.  I think an earlier version
of this must have gotten lost somewhere, or maybe it only went
into the Linux-OMAP tree.

Also, some whitespace fixes to bring this more into sync with the
version of this found in the Linux-OMAP tree.  (That version has
updates for the OTG controller on the OMAP 1710 which break that
functionality on OMAP 161x boards like the H2, so merging all of
it is not currently an option.)

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c-mpc: Pass correct dev_id to free_irq on error path

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

i2c-i801: Typo: erroneous

Signed-off-by: Jean Delvare <khali@linux-fr.org>

Merge branch 'master' of /linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPVS]: Use IP_VS_WAIT_WHILE when encessary.
  [NET]: Share correct feature code between bridging and bonding
  [ATM] drivers/atm/iphase.c: mostly kmalloc + memset conversion to kzalloc
  [IRDA] irda-usb.c: mostly kmalloc + memset conversion to k[cz]alloc
  [WAN] drivers/net/wan/hdlc_fr.c: kmalloc + memset conversion to kzalloc
  [DCCP]: fix memory leak and clean up style - dccp_feat_empty_confirm()
  [DCCP]: fix theoretical ccids_{read,write}_lock() race
  [XFRM]: Clean up duplicate includes in net/xfrm/
  [TIPC]: Clean up duplicate includes in net/tipc/
  [SUNRPC]: Clean up duplicate includes in net/sunrpc/
  [PKT_SCHED]: Clean up duplicate includes in net/sched/
  [IPV6]: Clean up duplicate includes in net/ipv6/
  [IPV4]: Clean up duplicate includes in net/ipv4/
  [ATM]: Clean up duplicate includes in net/atm/
  [ATM]: Clean up duplicate includes in drivers/atm/
  [IPCONFIG]: ip_auto_config fix
  [ATM]: fore200e_param_bs_queue() must be __devinit

Merge branch 'upstream-linus' of /linux/kernel/git/jgarzik/netdev-2.6

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  e1000: Add device IDs of new 82571 board variants
  xen-netfront: Avoid deref'ing skbafter it is potentially freed.
  3c59x maintainer
  3c59x: fix duplex configuration
  natsemi: fix netdev error acounting
  ax88796 printk fixes
  myri10ge: Use the pause counter to avoid a needless device reset
  via-rhine: disable rx_copybreak on archs that don't allow unaligned DMA access

[GFS2] Revert remounting w/o acl option leaves acls enabled

This reverts commit 569a7b6c2e8965ff4908003b925757703a3d649c. The
code was correct originally. The default setting for ACLs after a
remount should be to be the same as before the remount.

Signed-off-by: Abhijith Das <adas@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[GFS2] Fix setting of inherit jdata attr

Due to a mix up between the jdata attribute and inherit jdata attribute
it has not been possible to set the inherit jdata attribute on
directories. This is now fixed and the ioctl will report the inherit
jdata attribute for directories rather than the jdata attribute as it
did previously. This stems from our need to have the one bit in the
ioctl attr flags mean two different things according to whether the
underlying inode is a directory or not.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[GFS2] Fix incorrect error path in prepare_write()

The error path in prepare_write() was incorrect in the (very rare) event
that the transaction fails to start. The following prevents a NULL
pointer dereference,

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[GFS2] Fix incorrect return code in rgrp.c

The following patch fixes a bug where 0 was being used as a return code
to indicate "nothing to do" when in fact 0 was a valid block location
which might be returned by the function.

Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[GFS2] soft lockup in rgblk_search

This patch seems to fix the problem described in bugzilla bug 246114.
It was written by Steve Whitehouse with some tweaking by me.

The code was looping in the relatively new section of code designed to
search for and reuse unlinked inodes.  In cases where it was finding an
appropriate inode to reuse, it was looping around and finding the same
block over and over because a "<=" check should have been a "<" when
comparing the goal block to the last unlinked block found.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[GFS2] soft lockup detected in databuf_lo_before_commit

This is part 2 of the patch for bug #245832, part 1 of which is already
in the git tree.

The problem was that sdp->sd_log_num_databuf was not always being
protected by the gfs2_log_lock spinlock, but the sd_log_le_databuf
(which it is supposed to reflect) was protected.  That meant there
was a timing window during which gfs2_log_flush called
databuf_lo_before_commit and the count didn't match what was
really on the linked list in that window.  So when it ran out of
items on the linked list, it decremented total_dbuf from 0 to -1 and
thus never left the "while(total_dbuf)" loop.

The solution is to protect the variable sdp->sd_log_num_databuf so
that the value will always match the contents of the linked list,
and therefore the number will never go negative, and therefore, the
loop will be exited properly.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] fix basts for granted PR waiting CW

Fix a long standing bug where a blocking callback would be missed
when there's a granted lock in PR mode and waiting locks in both
PR and CW modes (and the PR lock was added to the waiting queue
before the CW lock).  The logic simply compared the numerical values
of the modes to determine if a blocking callback was required, but in
the one case of PR and CW, the lower valued CW mode blocks the higher
valued PR mode.  We just need to add a special check for this PR/CW
case in the tests that decide when a blocking callback is needed.

Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] More othercon fixes

The last patch to clean out 'othercon' structures only fixed half the problem.
The attached addresses the other situations too, and fixes bz#238490

Signed-Off-By: Patrick Caulfield <pcaulfie@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] Fix memory leak in dlm_add_member() when dlm_node_weight() returns less than zero

There's a memory leak in fs/dlm/member.c::dlm_add_member().

If "dlm_node_weight(ls->ls_name, nodeid)" returns < 0, then
we'll return without freeing the memory allocated to the (at
that point yet unused) 'memb'.
This patch frees the allocated memory in that case and thus
avoids the leak.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] zero unused parts of sockaddr_storage

When we build a sockaddr_storage for an IP address, clear the unused parts as
they could be used for node comparisons.

I have seen this occasionally make sctp connections fail.

Signed-Off-By: Patrick Caulfield <pcaulfie@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] fix NULL ls usage

Fix regression in recent patch "[DLM] variable allocation" which
attempts to dereference an "ls" struct when it's NULL.

Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

[DLM] Clear othercon pointers when a connection is closed

This patch clears the othercon pointer and frees the memory when a connnection
is closed. This could cause a small memory leak when nodes leave the cluster.

Signed-Off-By: Patrick Caulfield <pcaulfie@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

e1000: Add device IDs of new 82571 board variants

This patch adds support for 2 new board variants:
- A Quad port fiber 82571 board
- A blade version of the 82571 quad copper board

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[IPVS]: Use IP_VS_WAIT_WHILE when encessary.

For architectures that don't have a volatile atomic_ts constructs like
while (atomic_read(&something)); might result in endless loops since a
barrier() is missing which forces the compiler to generate code that
actually reads memory contents.
Fix this in ipvs by using the IP_VS_WAIT_WHILE macro which resolves to
while (expr) { cpu_relax(); }
(why isn't this open coded btw?)

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NET]: Share correct feature code between bridging and bonding

http://bugzilla.kernel.org/show_bug.cgi?id=8797 shows that the
bonding driver may produce bogus combinations of the checksum
flags and SG/TSO.

For example, if you bond devices with NETIF_F_HW_CSUM and
NETIF_F_IP_CSUM you'll end up with a bonding device that
has neither flag set.  If both have TSO then this produces
an illegal combination.

The bridge device on the other hand has the correct code to
deal with this.

In fact, the same code can be used for both.  So this patch
moves that logic into net/core/dev.c and uses it for both
bonding and bridging.

In the process I've made small adjustments such as only
setting GSO_ROBUST if at least one constituent device
supports it.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

[ATM] drivers/atm/iphase.c: mostly kmalloc + memset conversion to kzalloc

 drivers/atm/iphase.c | 111508 -> 111431 (-77 bytes)
 drivers/atm/iphase.o | 254740 -> 254260 (-480 bytes)

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IRDA] irda-usb.c: mostly kmalloc + memset conversion to k[cz]alloc

 drivers/net/irda/irda-usb.c | 59694 -> 59541 (-153 bytes)
 drivers/net/irda/irda-usb.o | 170588 -> 169256 (-1332 bytes)

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[WAN] drivers/net/wan/hdlc_fr.c: kmalloc + memset conversion to kzalloc

 drivers/net/wan/hdlc_fr.c | 31260 -> 31223 (-37 bytes)
 drivers/net/wan/hdlc_fr.o | 144872 -> 144728 (-144 bytes)

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

[DCCP]: fix memory leak and clean up style - dccp_feat_empty_confirm()

There's a memory leak in net/dccp/feat.c::dccp_feat_empty_confirm().  If we
hit the 'default:' case of the 'switch' statement, then we return without
freeing 'opt', thus leaking 'struct dccp_opt_pend' bytes.

The leak is fixed easily enough by adding a kfree(opt); before the return
statement.

The patch also changes the layout of the 'switch' to be more in line with
CodingStyle.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[DCCP]: fix theoretical ccids_{read,write}_lock() race

Make sure that spin_unlock_wait() is properly ordered wrt atomic_inc().

(akpm: can't we convert this code to use rwlocks?)

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[XFRM]: Clean up duplicate includes in net/xfrm/

This patch cleans up duplicate includes in
net/xfrm/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[TIPC]: Clean up duplicate includes in net/tipc/

This patch cleans up duplicate includes in
net/tipc/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[SUNRPC]: Clean up duplicate includes in net/sunrpc/

This patch cleans up duplicate includes in
net/sunrpc/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[PKT_SCHED]: Clean up duplicate includes in net/sched/

This patch cleans up duplicate includes in
net/sched/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IPV6]: Clean up duplicate includes in net/ipv6/

This patch cleans up duplicate includes in
net/ipv6/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IPV4]: Clean up duplicate includes in net/ipv4/

This patch cleans up duplicate includes in
net/ipv4/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[ATM]: Clean up duplicate includes in net/atm/

This patch cleans up duplicate includes in
net/atm/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[ATM]: Clean up duplicate includes in drivers/atm/

This patch cleans up duplicate includes in
drivers/atm/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IPCONFIG]: ip_auto_config fix

The following commandline:

 root=/dev/mtdblock6 rw rootfstype=jffs2 ip=192.168.1.10:::255.255.255.0:localhost.localdomain:eth1:off console=ttyS0,115200

makes ip_auto_config fall back to DHCP and complain "IP-Config: Incomplete
network configuration information." depending on if CONFIG_IP_PNP_DHCP is
set or not.

The only way I can make ip_auto_config accept my IP config is to add an
entry for the server IP:

ip=192.168.1.10:192.168.1.15::255.255.255.0:localhost.localdomain:eth1:off

I think this is a bug since I am not using a NFS root FS.

The following patch fixes the above problem.

From: Andrew Morton <akpm@linux-foundation.org>

Davem said (in February!):

  Well, first of all the change in question is not in 2.4.x either.  I just
  checked the current 2.4.x GIT tree and the test is exactly:

if (ic_myaddr == INADDR_NONE ||
#ifdef CONFIG_ROOT_NFS
    (MAJOR(ROOT_DEV) == UNNAMED_MAJOR
     && root_server_addr == INADDR_NONE
     && ic_servaddr == INADDR_NONE) ||
#endif
    ic_first_dev->next) {

  which matches 2.6.x

  I even checked 2.4.x when it was branched for 2.5.x and the test was the
  same at the point in time too.

  Looking at the proposed change a bit it appears that it is probably
  correct, as it's trying to check that ROOT_DEV is nfs root.  But if it is
  correct then the UNNAMED_MAJOR comparison in the same code block should be
  removed as it becomes superfluous.

  I'm happy to apply this patch with that modification made.

Signed-off-by: Joakim Tjernlund <joakim.tjernlund@transmode.se>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[ATM]: fore200e_param_bs_queue() must be __devinit

WARNING: drivers/built-in.o(.text+0x6203bb): Section mismatch: reference to .init.text:fore200e_param_bs_queue (between 'fore200e_initialize' and 'fore200e_monitor_putc')

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

xen-netfront: Avoid deref'ing skbafter it is potentially freed.

xennet_tx_bug_gc can free the skb before we use it, so make sure we don't.

Signed-off-by: Keir Fraser <keir@xensource.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

3c59x maintainer

Add 3c59x maintainer.

Signed-off-by: Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

3c59x: fix duplex configuration

A special sequence of ifconfig up/down and plug/unplug the cable can break
the duplex configuration of the driver.

Setting
vp->mii.full_duplex = vp->full_duplex
in vortex_up should fix this.

Addresses Bug 8575 3c59x duplex configuration broken
http://bugzilla.kernel.org/show_bug.cgi?id=8575

Cc: Martin Buck <mb-tmp-ohtmvyyn.xreary.bet@gromit.dyndns.org>
Signed-off-by: Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
Cc: Natalie Protasevich <protasnb@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

natsemi: fix netdev error acounting

When a detailed netdev error is counted, we also must account for it in the
aggregated error count.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=8106

Cc: Tim Hockin <thockin@hockin.org>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Chongfeng Hu <loveminix@yahoo.com.cn>
Cc: Natalie Protasevich <protasnb@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

ax88796 printk fixes

drivers/net/ax88796.c: In function `ax_probe':
drivers/net/ax88796.c:825: warning: size_t format, different type arg (arg 4)
drivers/net/ax88796.c:825: warning: size_t format, different type arg (arg 5)

resource_size_t isn't size_t.

Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

myri10ge: Use the pause counter to avoid a needless device reset

Use the pause counter to avoid a needless device reset, and
print a message telling the admin that our link partner is
flow controlling us down to 0 pkts/sec.

Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

via-rhine: disable rx_copybreak on archs that don't allow unaligned DMA access

Patch to disable the rx_copybreak feature on hardware architectures that
don't allow unaligned DMA access.

#ifdef code taken from tulip_core.c.  Problem pointed out by Ivan
Kokshaysky.

Signed-off-by: Dustin Marquess <jailbird@alcatraz.fdf.net>
Cc: Francois Romieu <romieu@fr.zoreil.com>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

ACPI: EC: Fix "no battery" regression

Restore deleted call to register query methods.

http://bugzilla.kernel.org/show_bug.cgi?id=8886

Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>

Linux 2.6.23-rc3