into pobox.com:/spare/repo/net-drivers-2.6

Bugzilla #2905

During receive processing, the tg3 card updates rx_producer (the
hardware position in the receive ring) and the opaque cookie. Due to PCI
rules the stores happen in order. However the cpu may reorder the reads.

In these sort of cases there is usually a data dependency between
reading the index and looking up the data (since we use the index to
load the data). I think all cpus except alpha guarantee the reads
happen in order in this case.

However in this particular case we load hw_idx, compare it to sw_idx and
then use sw_idx to locate the opaque cookie. There is no data dependency
in this case. We need a read memory barrier between the read of
rx_producer and the opaque cookie to enforce ordering.

Thanks to Olof Johansson, Michael Chan and Broadcom for their assistance
in finding this bug.
Signed-off-by: Anton Blanchard <anton@samba.org>

From: Bill Nottingham <notting@redhat.com>

airo creates /proc/driver/aironet/<device name> on device activation.
However, the device can be renamed - then on teardown it tries to remove
the wrong directory.  The removal of /proc/driver/aironet then runs afoul
of the BUG_ON() in remove_proc_entry.

This fixes it by keeping a copy of the name of the directory it created.

(It doesn't actually solve the problem of the stats directory still being
/proc/driver/aironet/eth0 when you rename the device to, say, 'joe'.  But
that patch would be a little less trivial.)
Signed-off-by: Andrew Morton <akpm@osdl.org>

2004-07-12 Margit Schubert-While <margitsw@t-online.de>

* The OID type for BSSID was incorrectly set to type SSID.
  It should be type RAW. This lead to interesting reporting
  by "iwpriv ethX g_bssid".
  (Which caused garbage output and possibly an out of bound)

* Be ultra-cautious in reporting SSID by changing the "%s"
  to "%.*s" and passing the length. (Prompted by the false
  type above, whereby length = 0 and a %s on a garbage field)

into pobox.com:/spare/repo/net-drivers-2.6

into pobox.com:/spare/repo/net-drivers-2.6

into pobox.com:/spare/repo/net-drivers-2.6

It's tulip driver, and tulip driver performs better than dmfe
(yet some distro installers pick this driver to use).

Requested by ALi.

 From:  a.othieno@bluewin.ch (Arthur Othieno)

Here it is.  The patch fixes all compile errors and warnings in
pci-skeleton.c.  The "debug" parameter lacks corresponding variable,
so I removed it to avoid a warning on module load.  Obsolete
pci_power_on() and pci_power_off() have been replaced with the new
code using pci_set_power_state(), pci_save_state() and
pci_restore_state().  The driver has been tested by compiling it as
module and as part of the kernel.

	access_ok() expects a pointer, not unsigned long.  It's not a
problem on platforms that have this guy done as a macro (or ones that
do not use fs/compat.c at all), but that's still wrong and on some
platforms that care we actually have access_ok() as inlined function.
Bogus cast removed.

__vfs_follow_link() really should be inline; that's a special case since
we are in the middle of recursion and really want to conserve stack
space.  Moved before the first use, made inline again.

(partially based on patch from Mika Kukkonen)

	Dumb Typo(tm) - the first bug caught by 0/NULL checks (arg is
really a kernel pointer there, so memset() is actually OK - results
will be copied to userland by caller.  Or would be, if we would not
oops  ;-)

	ipc compat code switched to compat_alloc_user_space() and annotated.

	ss_sp in struct sigaltstack made __user
	->si_addr and ->sival_ptr made __user
	your ->sa_restorer and ->sa_handler changes propagated
	users of these guys annotated on i386/amd64/alpha/sparc/sparc64

	Missing bits of cpumask_t conversion

	* added usual CHECK assignment in Makefile
	* switched uaccess.h to __check_uptr()
	* added L on long constants (ones missed earlier)
	* added __user in osf_sys.c (duh - I've added __user to cast in
the initializer, but forgot to add it in declaration)

	a) vfc is not 64bit-clean, marked as such in Kconfig
	b) aurora is simply broken - still uses tqueues.  Marked as broken.
	c) vfc does dereferencing of userland pointer, right after having
carefully copied the data to kernel space ;-)  Fixed.
	d) vfc ->mmap() had missed prototype change.  Fixed.
	e) BPP ioctls are misdeclared - they should've been _IO(...) instead
of _IOR(..., void).  Too late to fix, but we can at least make them
_IOR(..., char) - same value, but doesn't try to find sizeof(void).

	tms380tr is used both by ISA and PCI drivers.  Enabling/disabling
DMA is done only for ISA ones (it's protected by if (dev->dma > 0) and
PCI ones leave it 0), but it's compiled unconditionally.  Which breaks
on platforms that don't have that ISA crap at all, but support PCI just
fine.  Code in question placed under ifdef CONFIG_ISA.

bitrot strikes again...

direct write to userland pointer.

	Division by zero is an ugly thing...  We are safe wrt overflows,
since the maximal value we ever pass is 10000 - not enough to overflow
unless you've got a platform with HZ > 200000.

	usb ioctls in compat_ioctl.c switched to compat_alloc_user_space()
and cleaned up; ioctl structures annotated.

In handling of VIDIOCSWIN for 32bit on 64bit platforms:
	* switched to compat_alloc_user_space()
	* fixed memory corruption in copying arguments from userland
	* fixed arithmetic overflows
	* added missing checks for get_user() results
	  and corresponding returns with -EFAULT.

 - afs and rxrpc switched to kvec; definition of kvec moved to uio.h (duh).
 - afs/mntpt.c got missing cast added.

at that point afs is sparse-clean and rxrpc has only one remaining warning
(setsockopt from local variable, protected by set_fs()).

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Steve French (sfrench@us.ibm.com)