Get rid of the mdelay call in rhine_disable_linkmon.  The function
is called from the via-rhine versions of mdio_read and mdio_write.
Those functions are indirectly called from rhine_check_media and
rhine_tx_timeout, both of which can be called in interrupt context.

So, create tx_timeout_task and check_media_task as instances of struct
work_struct inside of rhine_private.  Then, change rhine_tx_timeout to
invoke schedule_work for tx_timeout_task (i.e. rhine_tx_timeout_task),
moving the work to process context.  Also, change rhine_error (invoked
from rhine_interrupt) to invoke schedule_work for check_media_task
(i.e. rhine_check_media_task), which simply calls rhine_check media
in process context.  Finally, add a call to flush_scheduled_work in
rhine_close to avoid any resource conflicts with pending work items.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

drivers/net/e1000/e1000_main.c: In function `e1000_intr':
drivers/net/e1000/e1000_main.c:3156: error: `i' undeclared (first use in this function)
drivers/net/e1000/e1000_main.c:3156: error: (Each undeclared identifier is reported only once
drivers/net/e1000/e1000_main.c:3156: error: for each function it appears in.)

This function is foul.

Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/Kconfig   |    8 +
 drivers/net/Makefile  |    1
 drivers/net/mipsnet.c |  371 ++++++++++++++++++++++++++++++++++++++++++++++++++
 drivers/net/mipsnet.h |  127 +++++++++++++++++
 4 files changed, 507 insertions(+)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Support for Toshiba's RBHMA4500 eval board for the TX4938.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/ne.c |   15 +++++++++++++++
 1 files changed, 15 insertions(+)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Use physical addresses at the interface level, letting drivers remap
them as appropriate.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/declance.c |   26 ++++++++++----------------
 1 files changed, 10 insertions(+), 16 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/declance.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

These should really be addresses obtained with ioremap() or some
bus-specific backend, but for now...
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/declance.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/declance.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/sgiseeq.c       |   28 ++++++++++++++--------------
 include/asm-mips/sgi/hpc3.h |   40 ++++++++++++++++++++--------------------
 2 files changed, 34 insertions(+), 34 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/sgiseeq.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/tulip/de2104x.c |    5 +++++
 1 files changed, 5 insertions(+)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

 o Add support for DP83847 MII.
 o remove unused variable.
 o Add some initialisations so even an unknown MII won't result in a crash.
 o Correct error message to "no known MIIs found".
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/au1000_eth.c |   13 +++++--------
 1 files changed, 5 insertions(+), 8 deletions(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/sb1250-mac.c |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletion(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 drivers/net/sb1250-mac.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

This fixes division by zero bug in ieee80211_wx_get_scan().
Signed-off-by: Jiri Benc <jbenc@suse.cz>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

If .owner isn't set the module can be unloaded even while still active.
Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

SMACK (Stuttgart Modified Amateurradio CRC KISS) is a KISS variant that
uses CRC16 checksums to secure data transfers between the modem and host.
It's also used to communicate over a pty to applications such as Wampes.

Patches for Linux 2.4 by Thomas Osterried DL9SAU, upgraded to the latest
mkiss 2.6 mkiss driver by me.
Signed-off-by: Thomas Osterried DL9SAU <thomas@x-berg.in-berlin.de>
Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

From Suzanne Wood <suzannew@cs.pdx.edu>:

Clarify RCU implementation in bpqether.c.

Because bpq_new_device() calls list_add_rcu() and bpq_free_device() calls
list_del_rcu(), substitute list_for_each_entry_rcu() for
list_for_each_entry() in bpq_get_ax25_dev() and in bpq_seq_start().

Add rcu dereference protection in bpq_seq_next().

The rcu_read_lock()/unlock() in bpq_device_event() are removed because
netdev event handlers are called with RTNL locking in place.

FYI: bpq_free_device() calls list_del_rcu() which, per list.h, requires
synchronize_rcu() which can block or call_rcu() or call_rcu_bh() which
cannot block.  Herbert Xu notes that synchronization is done here by
unregister_netdevice().  This calls synchronize_net() which in turn uses
synchronize_rcu().
Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

This patch fixes the following bugs with offline diagnostics
code(run with "ethtool -t").

1. After running offline diagnostics, adapter would report
corrupted packets on receive. This was because of adapter not
being brought out of "RLDRAM test mode".
2. Current EEPROM test works only for Xframe I. Since Xframe II
uses different interface(SPI), support for this interface has
been added. Also, since SPI supports write access to all areas
of EEPROM, negative testing is done only for Xframe I.
3. Return values from subfunctions of offline diagnostics have
been corrected.
4. In register test, expected value from rx_queue_cfg register
is made to depend on adapter type.
5. After the test, need to restore values at EEPROM offsets
0x4F0 and 0x7F0. These locations were modified as part of test.
6. Use macro SPECIAL_REG_WRITE for write access to mc_rldram_test_ctrl
register. Also, couple of unnecessary writes to mc_rldram_test_ctrl
have been removed.
Signed-off-by: Ravinandan Arakali <ravinandan.arakali@neterion.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

The following build error happens with 2.6.14-rc4 when CONFIG_KALLSYMS is
not defined.  The error message in a fragment of the output was:

  CC      arch/i386/lib/usercopy.o
  AR      arch/i386/lib/lib.a
/bin/sh: line 1: +@: command not found
make[3]: warning: jobserver unavailable: using -j1.  Add `+' to parent make rule.
  CHK     include/linux/compile.h
Signed-off-by: Mark Rustad <mrustad@mac.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

lock_kiocb() was introduced to serialize retrying and cancellation.  In the
process of doing so it tried to sleep waiting for KIF_LOCKED while holding
the ctx_lock spinlock.  Recent fixes have ensured that multiple concurrent
retries won't be attempted for a given iocb.  Cancel has other problems and
has no significant in-tree users that have been complaining about it.  So
for the immediate future we'll revert sleeping with the lock held and will
address proper cancellation and retry serialization in the future.
Signed-off-by: Zach Brown <zach.brown@oracle.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Only signal completion after marking request slot as free, otherwise other
processor can free request structure before we finish using it.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix -EIO on /proc/acpi/events after suspends.  This actually breaks
suspending by power button in many setups.
Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Since Revision 1.10 was released the n_r3964 module wasn't able to receive any
data.  The reason for that behavior is because there were some wrong calls of
mod_timer(...) in the function receive_char (...).  This patch should fix this
problem and was successfully tested with talking to some kuka industrial
robots.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Currently you do not get all the map entries on nommu systems because the
start function doesn't index into the list using the value of "pos".
Signed-off-by: David McCullough <davidm@snapgear.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This makes call_rcu() keep track of how many events there are on the RCU
list, and cause a reschedule event when the list gets too long.

This helps keep RCU event lists down.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This change makes quirk_intel_ide_combined() dependent on the precise
conditions under which it is needed:

* IDE is built in
* IDE SATA option is not set
* ata_piix or ahci drivers are enabled

This fixes an issue where some modular configurations would not cause
the quirk to be enabled.
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Linus torvalds <torvalds@osdl.org>

Make sure we release the task struct properly when releasing pending
timers.

release_task() does write_lock_irq(&tasklist_lock), so it can't race
with run_posix_cpu_timers() on any cpu.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Oopsable since nfs_wait_on_inode() can get called as part of iput_final().

Unnecessary since the caller had better be damned sure that the inode won't
disappear from underneath it anyway.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

If the data cache has been marked as potentially invalid by nfs_refresh_inode,
we should invalidate it rather than assume that changes are due to our own
activity.

Also ensure that we always start with a valid cache before declaring it
to be protected by a delegation.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

During the development of an USB device I found a bug in the handling of
Highspeed HID devices in the kernel.

What happened?

Highspeed HID devices are correctly recognized and enumerated by the
kernel. But even if usbhid kernel module is loaded, no HID reports are
received by the kernel.

The output of the hardware USB analyzer told me that the host doesn't
even poll for interrupt IN transfers (even the "interrupt in" USB
transfer are polled by the host).

After some debugging in hid-core.c I've found the reason.

In case of a highspeed device, the endpoint interval is re-calculated in
driver/usb/input/hid-core.c:

line 1669:
             /* handle potential highspeed HID correctly */
             interval = endpoint->bInterval;
             if (dev->speed == USB_SPEED_HIGH)
                   interval = 1 << (interval - 1);

Basically this calculation is correct (refer to USB 2.0 spec, 9.6.6).
This new calculated value of "interval" is used as input for
usb_fill_int_urb:

line 1685:

            usb_fill_int_urb(hid->urbin, dev, pipe, hid->inbuf, 0,
                   hid_irq_in, hid, interval);

Unfortunately the same calculation as above is done a second time in
usb_fill_int_urb in the file include/linux/usb.h:

line 933:
        if (dev->speed == USB_SPEED_HIGH)
                urb->interval = 1 << (interval - 1);
        else
                urb->interval = interval;

This means, that if the endpoint descriptor (of a high speed device)
specifies e.g. bInterval = 7, the urb->interval gets the value:

hid-core.c: interval = 1 << (7-1) = 0x40 = 64
urb->interval = 1 << (interval -1) = 1 << (63) = integer overflow

Because of this the value of urb->interval is sometimes negative and is
rejected in core/urb.c:
line 353:
                /* too small? */
                if (urb->interval <= 0)
                        return -EINVAL;

The conclusion is, that the recalculaton of the interval (which is
necessary for highspeed) should not be made twice, because this is
simply wrong. ;-)

Re-calculation in usb_fill_int_urb makes more sense, because it is the
most general approach. So it would make sense to remove it from
hid-core.c.

Because in hid-core.c the interval variable is only used for calling
usb_fill_int_urb, it is no problem to remove the highspeed
re-calculation in this file.
Signed-off-by: Christian Krause <chkr@plauener.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Increased use of scatter-gather by usb-storage driver after 2.6.13 has
exposed a buggy codepath in isp116x-hcd, which was probably never
visited before: bug happened only for those urbs, for which
URB_SHORT_NOT_OK was set AND short transfer occurred.

The fix attached was tested in 2 ways: (a) it fixed failing
initialization of a flash drive with an embedded hub; (b) the fix was
tested with 'usbtest' against a modified g_zero driver (on top of
net2280), which generated short bulk IN transfers of various lengths
including multiples and non-multiples of max_packet_length.
Signed-off-by: Olav Kongas <ok@artecdesign.ee>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Dipankar made RCU limit the batch size to improve latency, but that
approach is unworkable: it can cause the RCU queues to grow without
bounds, since the batch limiter ended up limiting the callbacks.

So make the limit much higher, and start planning on instead limiting
the batch size by doing RCU callbacks more often if the queue looks like
it might be growing too long.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix the fact that the svideo input will only give input in black/white in
some circumstances.  Reason is that in the PCI controller driver (zr36067),
after setting input, we reset norm, which overwrites the input register
with the default.  This patch makes it always set the correct value for the
input when changing norm.
Signed-off-by: Ronald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix bug #5404 in kernel bugzilla.

It basically updates the vpx3220 initialization tables with some newer
values that we've had in CVS for a while (and that, for some reason, never
ended up in the kernel...  must've gotten lost).  Those fix a ~16 pixels
noise at the top of the picture in at least SECAM, although (now that I
think about it) PAL was probably affected, also.
Signed-off-by: Ronald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix bug 5441.

I didn't know about messy programs like svgatextmode...  Couldn't this be
integrated in some linux/drivers/video/console/svgacon.c ?...  So because
of the existence of the svgatextmode program, the kernel is not supposed to
touch to CRT_OVERFLOW/SYNC_END/DISP/DISP_END/OFFSET ?

Disabling the check in vgacon_resize() might help indeed, but I'm really
not sure whether it will work for any chipset: in my patch, CRT registers
are set at each console switch, since stty rows/cols apply to consoles
separately...

The attached solution is to keep the test, but if it fails, we assume that
the caller knows what it does (i.e.  it is svgatextmode) and then disable
any further call to vgacon_doresize.  Svgatextmode is usually used to
_expand_ the display, not to shrink it.  And it is harmless in the case of
a too big stty rows/cols: the display will just be cropped.  I tested it on
my laptop, and it works fine with svgatextmode.

A better solution would be that svgatextmode explicitely tells the kernel
not to care about video timing, but for this an interface needs be defined
and svgatextmode be patched.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It seems that all the list_*_rcu primitives are missing a memory barrier
on the very first dereference.  For example,

#define list_for_each_rcu(pos, head) \
	for (pos = (head)->next; prefetch(pos->next), pos != (head); \
		pos = rcu_dereference(pos->next))

It will go something like:

	pos = (head)->next

	prefetch(pos->next)

	pos != (head)

	do stuff

We're missing a barrier here.

	pos = rcu_dereference(pos->next)

		fetch pos->next

		barrier given by rcu_dereference(pos->next)

		store pos

Without the missing barrier, the pos->next value may turn out to be stale.
In fact, if "do stuff" were also dereferencing pos and relying on
list_for_each_rcu to provide the barrier then it may also break.

So here is a patch to make sure that we have a barrier for the first
element in the list.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: "Paul E. McKenney" <paulmck@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

As noticed by Nick Piggin, we need to make sure that we check the page
count before we check for PageDirty, since the dirty check is only valid
if the count implies that we're the only possible ones holding the page.

We always did do this, but the code needs a read-memory-barrier to make
sure that the orderign is also honored by the CPU.

(The writer side is ordered due to the atomic decrement and test on the
page count, see the discussion on linux-kernel)
Signed-off-by: Linus Torvalds <torvalds@osdl.org>