Inside a function declared as

    void foo(char bar[512])

the value of sizeof bar is the size of a pointer, not 512.  So avoid
constructions like this by passing the size explicitly.

Also reduce the size of the buffer to 128 bytes (512 was overly generous).
Signed-off-by: Dave Olson <dave.olson@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The small eeprom that holds the GUID etc. contains a data-length, but if 
the actual eeprom is new or has been erased, that byte will be 0xFF,
which is greater than the maximum physical length of the eeprom, and
more importantly greater than the length of the buffer we vmalloc'd.
Sanity-check the length to avoid the possbility of reading past end of
buffer.
Signed-off-by: Michael Albaugh <Michael.Albaugh@Qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

There is a small window where a send work queue entry could be
overwritten by ib_post_send() because s_last is updated before the
entry is read.

This patch closes the window by acquiring the lock and updating
the last send work queue entry index after reading the wr_id.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Because of a typo, mlx4_ib_post_send() takes the same lock rq.lock as
mlx4_ib_post_recv().  Correct the code so the intended sq.lock is
taken when posting a send.

Noticed by Yossi Leybovitch and pointed out by Jack Morgenstein from
Mellanox.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Commit 1b524963 ("IPoIB/cm: Use common CQ for CM send completions")
changed how the high-order bits of work request IDs were used, which
had the effect that IPOIB_CM_RX_DRAIN_WRID was no longer handled as a
connected mode receive completion.  This leads to the messages

    ib1: cm send completion event with wrid 1073741823 (> 64)
    ib1: RX drain timing out

when an interface with connected mode QPs is brought down.  Fix this
by making sure that both IPOIB_OP_CM and IPOIB_OP_RECV are set in
IPOIB_CM_RX_DRAIN_WRID.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  mlx4_core: Increase command timeout for INIT_HCA to 10 seconds
  IPoIB/cm: Use common CQ for CM send completions
  IB/uverbs: Fix checking of userspace object ownership
  IB/mlx4: Sanity check userspace send queue sizes
  IPoIB: Rewrite "if (!likely(...))" as "if (unlikely(!(...)))"
  IB/ehca: Enable large page MRs by default
  IB/ehca: Change meaning of hca_cap_mr_pgsize
  IB/ehca: Fix ehca_encode_hwpage_size() and alloc_fmr()
  IB/ehca: Fix masking error in {,re}reg_phys_mr()
  IB/ehca: Supply QP token for SRQ base QPs
  IPoIB: Use round_jiffies() for ah_reap_task
  RDMA/cma: Fix deadlock destroying listen requests
  RDMA/cma: Add locking around QP accesses
  IB/mthca: Avoid alignment traps when writing doorbells
  mlx4_core: Kill mlx4_write64_raw()

* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-lguest: (45 commits)
  Use "struct boot_params" in example launcher
  Loading bzImage directly.
  Revert lguest magic and use hook in head.S
  Update lguest documentation to reflect the new virtual block device name.
  generalize lgread_u32/lgwrite_u32.
  Example launcher handle guests not being ready for input
  Update example launcher for virtio
  Lguest support for Virtio
  Remove old lguest I/O infrrasructure.
  Remove old lguest bus and drivers.
  Virtio helper routines for a descriptor ringbuffer implementation
  Module autoprobing support for virtio drivers.
  Virtio console driver
  Block driver using virtio.
  Net driver using virtio
  Virtio interface
  Boot with virtual == physical to get closer to native Linux.
  Allow guest to specify syscall vector to use.
  Rename "cr3" to "gpgdir" to avoid x86-specific naming.
  Pagetables to use normal kernel types
  ...

As it is some callers of synchronize_irq rely on memory barriers
to provide synchronisation against the IRQ handlers.  For example,
the tg3 driver does

	tp->irq_sync = 1;
	smp_mb();
	synchronize_irq();

and then in the IRQ handler:

	if (!tp->irq_sync)
		netif_rx_schedule(dev, &tp->napi);

Unfortunately memory barriers only work well when they come in
pairs.  Because we don't actually have memory barriers on the
IRQ path, the memory barrier before the synchronize_irq() doesn't
actually protect us.

In particular, synchronize_irq() may return followed by the
result of netif_rx_schedule being made visible.

This patch (mostly written by Linus) fixes this by using spin
locks instead of memory barries on the synchronize_irq() path.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  SELinux: always check SIGCHLD in selinux_task_wait

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Add Vitaly Bordug as PPC8xx maintainer
  [POWERPC] 4xx: Enable EMAC on Bamboo board
  [POWERPC] 4xx: Enable EMAC for PPC405 Walnut board
  [POWERPC] 4xx: Fix timebase clock selection on Walnut
  [POWERPC] 4xx: Enable EMAC on the PPC 440GP Ebony board
  [POWERPC] 4xx: Split early debug output and early boot console for 44x
  [POWERPC] 4xx: Enable NEW EMAC support for Sequoia 440EPx.
  [POWERPC] 4xx: Add RGMII support for Sequoia 440EPx

* git://git.infradead.org/mtd-2.6:
  [MTD] [NOR] Fix deadlock in Intel chip driver caused by get_chip recursion
  [JFFS2] Fix return value from jffs2_write_end()
  [MTD] [OneNAND] Fix wrong free the static address in onenand_sim
  [MTD] [NAND] Replace -1 with -EBADMSG in nand error correction code
  [RSLIB] BUG() when passing illegal parameters to decode_rs8() or decode_rs16()
  [MTD] [NAND] treat any negative return value from correct() as an error
  [MTD] [NAND] nandsim: bugfix in initialization
  [MTD] Fix typo in Alauda config option help text.
  [MTD] [NAND] add s3c2440-specific read_buf/write_buf
  [MTD] [OneNAND] onenand-sim: fix kernel-doc and typos
  [JFFS2] Tidy up fix for ACL/permissions problem.

* 'for-linus' of ssh://master.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6:
  [AVR32] ARRAY_SIZE() cleanup
  [AVR32] Implement at32_add_device_cf()
  [AVR32] Implement more at32_add_device_foo() functions
  [AVR32] Fix a couple of sparse warnings
  [AVR32] Wire up AT73C213 sound driver on ATSTK1000 board
  [AVR32] Platform code for pata_at32

* 'sg' of git://git.kernel.dk/linux-2.6-block:
  sparc64: zero out dma_length
  fvr32: fixup dma-mapping for new sg layout
  sh/sh64: fixup dma-mapping for new sg layout
  Fix sctp compile
  m68knommu: remove sg_address()
  frv: update comment in scatterlist to reflect new setup
  blackfin: remove sg_address()
  arm: sg fallout
  mips: sg_page() fallout
  alpha: sg_virt() fallout
  intel-iommu: fix sg_page()
  parisc: fix sg_page() fallout
  ide: build fix
  net: fix xfrm build - missing scatterlist.h include
  [BLOCK] blk_rq_map_sg: force clear termination bit
  [BLOCK] Don't clear sg_dma_len/addr() in blk_rq_map_sg()
  s390 zfcp: sg fixups
  powerpc: Fix fallout from sg_page() changes
  IB/ehca: Fix sg_page() fallout
  arm: build fix

* 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] version 1.0.15
  [ALSA] hda-codec - Fix possible array overflow
  [ALSA] sound/core/control.c: hard-irq-safe -> hard-irq-unsafe lock warning
  [ALSA] usb-audio: Another USB mic quirk for Logitech Communicator webcam
  [ALSA] hda-codec - Fix build without CONFIG_SND_HDA_GENERIC
  [ALSA] hda-codec - Fix Conexant 5045 volumes
  [ALSA] hda-codec - Fix conflict of Master volume in STAC92xx codec
  [ALSA] snd-bt87x: Make the load_all option work correctly
  [ALSA] protect Dreamcast PCM driver (AICA) from G2 bus effects
  [ALSA] bt87x - Fix section mismatch
  [ALSA] hda-codec - Fix AD1986A Lenovo auto-mute
  [ALSA] This simplifies and fixes waiting loops of the mce_down()

Reduce the function pointer mess of the m68knommu timer code by calling
directly to the local hardware's timer setup, and expose the local
common timer interrupt handler to the lower level hardware timer.

Ultimately this will save definitions of all these functions across all
the platform code to setup the function pointers (which for any given
m68knommu CPU family member can be only one set of hardware timer
functions).
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

A new style serial driver for the Freescale ColdFire UART to replace
the old style one currently in the tree (drivers/serial/mcfserial.c).

Currently this UART is only found in the ColdFire CPU family of parts
(thus I prefixed this patch [M68KNOMMU]).

This has been around for a long while now, tested on all available
platforms.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove build reference to arch/m68knommu/boot directory, it doesn't
exist.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove use of undefined symbols CONFIG_TELOS, CONFIG_M68EZ328ADS
and CONFIG_ALMA_ANS.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Improve the readability of mii_do_cmd().
Signed-off-by: Philippe De Muyter <phdm@macqel.be>
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix system call restart handling. We can call directly to the
restart handler, no need to back track through trap that isn't
even implemented on m68knommu.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add make support for the Savant/Rosie1 board.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There is no separate stack region addresses to print at startup time,
so remove it from the debug listing
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add configure support for the Savant/Rosie1 board.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Updated defconfig with new options for m68knommu.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Up to now m68knommu has been using the asm-m68k/module.h instead of
defining its own. There are recent changes there that we don't need
(fixups specifically). We don't need much support here so it makes
sense to have an m68knommu specific one now.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Define __clear_user macro, consistent with other architectures.
fs/signalfd.c won't compile without it.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix the system call code for handling syscall tracing, so strace
and gdbserver work properly.

This fix originally developed by Philippe De Muyter and Stuart Hughes.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Indent all the `else' the same way.
Remove some unecesary white space.
Signed-off-by: Philippe De Muyter <phdm@macqel.be>
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ztxdone is jumped to even if tty is NULL and tty_wakeup placed after
this label doesn't expect NULLed parameter, so this will cause an oops
in some situations (why they scheduled a wakeup there before remove
bottom half processing patch?).

wakeup only in the case when we have non-null tty struct.

Spotted by Adrian Bunk.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix mprotect bug in recent commit 3ed75eb8
(setup vma->vm_page_prot by vm_get_page_prot()): the vma_wants_writenotify
case was setting the same prot as when not.

Nothing wrong with the use of protection_map[] in mmap_region(),
but use vm_get_page_prot() there too in the same ~VM_SHARED way.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Cc: Coly Li <coyli@suse.de>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
'pending' and 'ack' bits.  Since the test_and_ack_op() macro only checks
against 'complete' it can get an inconsistent snapshot of pending work.

Move the clearing of these bits to handle_stripe5(), under the lock.
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Tested-by: Joel Bertrand <joel.bertrand@systella.fr>
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: Stable <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

As page->index is unsigned, this all becomes an unsigned comparison,
which almost always returns an error.
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: Stable <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge branch 'for-2.6.24' of master.kernel.org:/pub/scm/linux/kernel/git/jwboyer/powerpc-4xx into merge

This patch solves kernel deadlock issue seen on JFFF2 simultaneous 
operations. Detailed investigation of the issue showed that the kernel 
deadlock is caused by tons of recursive get_chip calls.
Signed-off-by: Alexey Korolev <akorolev@infradead.org>
Acked-by: Nicolas Pitre <nico@cam.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

zero out dma_length in the entry immediately following the last mapped
entry for unmap_sg.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

sctp fails to compile with
net/sctp/sm_make_chunk.c: In function 'sctp_pack_cookie':
net/sctp/sm_make_chunk.c:1516: error: implicit declaration of function 'sg_init_table'
net/sctp/sm_make_chunk.c:1517: error: implicit declaration of function 'sg_set_page'

use the proper include file.

SCTP maintainers Vlad Yasevich and Sridhar Samudrala  are CCed.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

I would have replaced it with sg_virt(), but it doesn't appear to be
used at all.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>