* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 3508/1: Update collie defconfig
[ARM] Fix thread struct allocator for SMP case
[ARM] Update mach-types
[ARM] Update versatile_defconfig

* master.kernel.org:/home/rmk/linux-2.6-serial:
[SERIAL] 8250: add locking to console write function
[SERIAL] Remove unconditional enable of TX irq for console
[SERIAL] 8250: set divisor register correctly for AMD Alchemy SoC uart
[SERIAL] AMD Alchemy UART: claim memory range
[SERIAL] Clean up serial locking when obtaining a reference to a port

Patch from Pavel Machek

Update collie defconfig to something that can bring closer-to-working
system to its user.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NET_SCHED]: HFSC: fix thinko in hfsc_adjust_levels()
[IPV6]: skb leakage in inet6_csk_xmit
[BRIDGE]: Do sysfs registration inside rtnl.
[NET]: Do sysfs registration as part of register_netdevice.
[TG3]: Fix possible NULL deref in tg3_run_loopback().
[NET] linkwatch: Handle jiffies wrap-around
[IRDA]: Switching to a workqueue for the SIR work
[IRDA]: smsc-ircc: Minimal hotplug support.
[IRDA]: Removing unused EXPORT_SYMBOLs
[IRDA]: New maintainer.
[NET]: Make netdev_chain a raw notifier.
[IPV4]: ip_options_fragment() has no effect on fragmentation
[NET]: Add missing operstates documentation.

x86 SMP breaks as a result of the previous change, we have no real
option other than to add locking to the 8250 console write function.
If an oops is in progress, try to acquire the lock. If we fail to
do so, continue anyway.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The ARM thread struct allocator is racy on SMP systems. Fix it by
turning it into a per-cpu based allocator. This also allows keeps
the cache cache warm for thread structs and kernel stacks.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (25 commits)
[SCSI] mptfc: race between mptfc_register_dev and mptfc_target_alloc
[SCSI] lpfc 8.1.6 : Fix Data Corruption in Bus Reset Path
[SCSI] mptspi: revalidate negotiation parameters after host reset and resume
[SCSI] srp.h: avoid padding of structs
[SCSI] ibmvscsi: fix leak when failing to send srp event
[SCSI] qla2xxx: Correct eh_abort recovery logic.
[SCSI] megaraid_{mm,mbox}: fix a bug in reset handler
[SCSI] fusion - bug fix stack overflow in mptbase
[SCSI] scsi: Add IBM 2104-DU3 to blist
[SCSI] Fix DVD burning issues.
[SCSI] SCSI: aic7xxx_osm_pci resource leak fix.
[SCSI] - fusion - mptfc bug fix's to prevent deadlock situations
[SCSI] mptfusion: bug fix's for raid components adding/deleting
[SCSI] aic7xxx: ahc_pci_write_config() fix
[SCSI] megaraid: unused variable
[SCSI] qla2xxx: only free_irq() after request_irq() succeeds
[SCSI] Overrun in drivers/scsi/sim710.c
[SCSI] lpfc 8.1.5 : Change version number to 8.1.5
[SCSI] lpfc 8.1.5 : Misc small fixes
[SCSI] lpfc 8.1.5 : Additional fixes to LOGO, PLOGI, and RSCN processing
...

When deleting the last child the level of a class should drop to zero.

Noticed by Andreas Mueller <andreas@stapelspeicher.org>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

A bug report from Gerd Hoffmann has highlighted that unconditionally
enabling the transmit interrupt at the end of console writes is very
bad.

In Gerd's case, it causes the test for buggy UARTs to give false
positives, incorrectly identifying ports as buggy when they are not.

Moreover, if we unconditionally enable the interrupt, and the port
is sharing it's interrupt with other ports, there is the very real
possibility that we'll cause an interrupt storm. (Not all ports use
OUT2 as an interrupt mask.)

Hence, revert part of f91a3715db2bb44fcf08cec642e68f919b70f7f4 and
all of f5968b37b3ad35b682b574b578843a0361218aff until a better solution
can be found.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Don't recurse back into the driver even if the unplug threshold is met,
when the driver asks for a requeue. This is both silly from a logical
point of view (requeues typically happen due to driver/hardware
shortage), and also dangerous since we could hit an endless request_fn
-> requeue -> unplug -> request_fn loop and crash on stack overrun.

Also limit blk_run_queue() to one level of recursion, similar to how
blk_start_queue() works.

This patch fixed a real problem with SLES10 and lpfc, and it could hit
any SCSI lld that returns non-zero from it's ->queuecommand() handler.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

A race condition exists in mptfc between the thread registering a device
with the fc transport and the scan work generated by the transport.
This race existed prior to the application of the mptfc bug fix patch.

mptfc_register_dev() calls fc_remote_port_add() with the FC_RPORT_ROLE_TARGET
bit set in the rport ids passed to the function. Having this bit set causes
fc_remote_port_add() to schedule a scan of the device.

This scan can execute before mptfc_register_dev() can fill in the dd_data
in the rport structure. When this happens, mptfc_target_alloc() will fail
because dd_data is null.

Attached is a patch which fixes the problem. The patch changes the rport ids
passed to fc_remote_port_add() to not have the TARGET bit set. This prevents
the scan from being scheduled. After mptfc_register_dev() fills in the rport
dd_data field, fc_remote_port_rolechg() is called, changing the role of the
rport to TARGET. Thus, the scan is scheduled after dd_data is filled
in which prevents the failure in mptfc_target_alloc().

Signed-off-by: Michael Reed <mdr@sgi.com>
Signed-off-by: Eric Moore <Eric.Moore@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

inet6_csk_xit does not free skb when routing fails.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

Alchemy SoC uart have got a non-standard divisor register that needs some
special handling.

This patch adds divisor read/write functions with test and special
handling for Alchemy internal uart.

Signed-off-by: Jon Anders Haugum <jonah@omegav.ntnu.no>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Update versatile default configuration, enabling the AACI sound driver,
VFP and Versatile AB support.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Eric Biederman points out that we can't take the task_lock while holding
tasklist_lock for writing, because another CPU that holds the task lock
might take an interrupt that then tries to take tasklist_lock for writing.

Which would be a nasty deadlock, with one CPU spinning forever in an
interrupt handler (although admittedly you need to really work at
triggering it ;)

Since the ptrace_attach() code is special and very unusual, just make it
be extra careful, and use trylock+repeat to avoid the possible deadlock.

Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch updates the lpfc driver to revision 8.1.6, which includes
the following changes:

- Fix data corruption in SCSI BUS reset path, due to reusing
the same request structure for each target.
- Change version number to 8.1.6

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Now that netdevice sysfs registration is done as part of
register_netdevice; bridge code no longer has to be tricky when adding
it's kobjects to bridges.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

I've noticed that the 8250/Au1x00 driver (drivers/serial/8250_au1x00.c)
doesn't claim UART memory ranges and uses wrong (KSEG1-based) UART
addresses instead of the physical ones.

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 3507/1: Replace map_desc.physical with map_desc.pfn: aaed2000
[ARM] 3506/1: aaec2000: debug-macro.S needs hardware.h
[ARM] 3505/1: aaec2000: entry-macro.S needs asm/arch/irqs.h
[ARM] 3504/1: Fix clcd includes for aaec2000
[ARM] 3503/1: Fix map_desc structure for aaec2000
[ARM] 3501/1: i.MX: fix lowlevel debug macros
[ARM] rtc-sa1100: fix compiler warnings and error cleanup
[ARM] Allow SA1100 RTC alarm to be configured for wakeup

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/mthca: FMR ioremap fix
IPoIB: Free child interfaces properly
IB/mthca: Fix race in reference counting
IB/srp: Fix tracking of pending requests during error handling
IB: Fix display of 4-bit port counters in sysfs

This is a bug fix for mptspi driver, where after a host reset or
resume, we revalidate the negotiation parameters for all devices.
This bug was introduced when the driver was ported to use the spi
transport layer.

Signed-off-by: Eric Moore <Eric.Moore@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

The last step of netdevice registration was being done by a delayed
call, but because it was delayed, it was impossible to return any error
code if the class_device registration failed.

Side effects:
* one state in registration process is unnecessary.
* register_netdevice can sleep inside class_device registration/hotplug
* code in netdev_run_todo only does unregistration so it is simpler.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

The locking for the uart_port is over complicated, and can be
simplified if we introduce a flag to indicate that a port is "dead"
and will be removed.

This also helps the validator because it removes a case of non-nested
unlock ordering.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>

This holds the task lock (and, for ptrace_attach, the tasklist_lock)
over the actual attach event, which closes a race between attacking to a
thread that is either doing a PTRACE_TRACEME or getting de-threaded.

Thanks to Oleg Nesterov for reminding me about this, and Chris Wright
for noticing a lost return value in my first version.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Patch from Bellido Nicolas

aaed2000 map_desc.pfn conversion

Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'upstream' of master.kernel.org:/pub/scm/linux/kernel/git/shemminger/netdev-2.6:
sis900: phy for FoxCon motherboard
dl2k: use DMA_48BIT_MASK constant
phy: mdiobus_register(): initialize all phy_map entries
sky2: ifdown kills irq mask

Addresses for ioremap must be calculated off of pci_resource_start;
we can't directly use the bus address as seen by the HCA. Fix the
code that remaps device memory for FMR access.

Based on patch by Klaus Smolin.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Several structs in <scsi/srp.h> get padded to a multiple of 8 bytes on
64-bit architectures and end up with a size that does not match the
definition in the SRP spec:

SRP spec 64-bit
sizeof (struct indirect_buf) 20 24
sizeof (struct srp_login_rsp) 52 56
sizeof (struct srp_rsp) 36 40

Fix this by adding __attribute__((packed)) to the offending structs.

Problem pointed out by Arne Redlich <arne.redlich@xiranet.com>.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

tg3_run_loopback doesn't check that dev_alloc_skb() returns anything
useful.

Even if dev_alloc_skb() fails to return an skb to us we'll happily go
on and assume it did, so we risk dereferencing a NULL pointer. Much
better to fail gracefully by returning -ENOMEM than crashing here.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[PATCH] powerpc: update cell_defconfig
[PATCH] spufs: Disable local interrupts for SPE hash_page calls.
[PATCH] powerpc: Add cputable entry for POWER6
[PATCH] ppc32 CPM_UART: Fixed odd address translations
[PATCH] ppc32: Update board-specific code of the CPM UART users
[PATCH] ppc32 CPM_UART: Convert to use platform devices
[PATCH] ppc32: odd fixes and improvements in ppc_sys
[PATCH] powerpc: Wire up *at syscalls
[PATCH] ppc32: add 440GX erratum 440_43 workaround
[PATCH] powerpc: Use check_legacy_ioport() on ppc32 too.
[PATCH] powerpc64: Fix loading of modules without a .toc section
[PATCH] sound/ppc: snd_pmac_toonie_init should be __init
powerpc/pseries: Tell firmware our capabilities on new machines
[PATCH] powerpc: Fix pagetable bloat for hugepages

Xiaoliang (David) Wei wrote:
> Hi gurus,
>
> I am reading the code of tcp_highspeed.c in the kernel and have a
> question on the hstcp_cong_avoid function, specifically the following
> AI part (line 136~143 in net/ipv4/tcp_highspeed.c ):
>
> /* Do additive increase */
> if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
> tp->snd_cwnd_cnt += ca->ai;
> if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
> tp->snd_cwnd++;
> tp->snd_cwnd_cnt -= tp->snd_cwnd;
> }
> }
>
> In this part, when (tp->snd_cwnd_cnt == tp->snd_cwnd),
> snd_cwnd_cnt will be -1... snd_cwnd_cnt is defined as u16, will this
> small chance of getting -1 becomes a problem?
> Shall we change it by reversing the order of the cwnd++ and cwnd_cnt -=
> cwnd?

Absolutely correct. Thanks.

Signed-off-by: John Heffner <jheffner@psc.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>

Patch from Bellido Nicolas

Include hardware.h in debug-macro.S, otherwise io_p2v is undefined.

Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This patch corrects the order of the calls to register_chrdev() and
pcmcia_register_driver(). Now udev correctly creates userspace device
files /dev/cmmN and /dev/cmxN respectively.

Based on an earlier patch by Jan Niehusmann <jan@gondor.com>.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

661FX7MI-S motherboard which uses the SiS 661FX chipset. The patch adds
an entry to mii_chip_info for the transceiver.

The PHY ids were found using the sis900_c_122.diff patch from
http://brownhat.org/sis900.html but that patch didn't solve the problem,
because the PHY at address 1 was already being chosen.

Without my patch, when bursts of packets arrive from other hosts on a
LAN, the interface dropped one roughly 10% of the time, causing
retransmits. There were fifth second pauses in refresh of large xterms,
and it made Netrek suck. I can provide further test data.

Workaround in lieu of patch is to use mii-tool to advertise
100baseTx-HD, then force renegotiation.

I wasn't able to identify the actual transceiver, so the description
field is a guess.

This patch is similar to Artur Skawina's patch:
http://marc.theaimsgroup.com/?l=linux-netdev&m=114297516729079&w=2

I'm not sure, but I wonder if it means the default behaviour should be
changed, so as to better handle future transceivers.

Diff is against 2.6.16.13.

Signed-off-by: James Cameron <james.cameron@hp.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

When deleting a child interface with a non-default P_Key via
/sys/class/net/ibX/delete_child, the interface must be freed with
free_netdev() (rather than kfree() on the private data).

Signed-off-by: Roland Dreier <rolandd@cisco.com>

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

The test used in the linkwatch does not handle wrap-arounds correctly.
Since the intention of the code is to eliminate bursts of messages we
can afford to delay things up to a second. Using that fact we can
easily handle wrap-arounds by making sure that we don't delay things
by more than one second.

This is based on diagnosis and a patch by Stefan Rompf.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Stefan Rompf <stefan@loplof.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Content of file au1200fb.c was duplicated. Remove.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

reflect the changes to Kconfig since the last update.

Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

There are out of date and don't tell the user anything useful.
The similar messages which IPV4 and the core networking used
to output were killed a long time ago.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Patch from Bellido Nicolas

Since git commit 2b78838842346da390e8547cd37035184376d506, entry-macro.S needs to include asm/arch/irqs.h

Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/netdev-2.6:
[PATCH] bcm43xx: Fix access to non-existent PHY registers
[PATCH] bcm43xx: Fix array overrun in bcm43xx_geo_init
[PATCH] bcm43xx: check for valid MAC address in SPROM
[PATCH] ieee80211: Fix A band channel count (resent)
[PATCH] bcm43xx: fix iwmode crash when down
[PATCH] softmac: make non-operational after being stopped
[PATCH] softmac: don't reassociate if user asked for deauthentication
spidernet: enable support for bcm5461 ethernet phy
spidernet: introduce new setting
Fix RTL8019AS init for Toshiba RBTX49xx boards
au1000_eth.c: use ether_crc() from <linux/crc32.h>
sky2: version 1.3
Add more support for the Yukon Ultra chip found in dual core centino laptops.
sky2: synchronize irq on remove
sky2: dont write status ring
sky2: edge triggered workaround enhancement
sky2: use mask instead of modulo operation
sky2: tx ring index mask fix
sky2: status irq hang fix
sky2: backout NAPI reschedule

Typo will be harder with this one.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

Fix races in in destroying various objects. If a destroy routine
waits for an object to become free by doing

wait_event(&obj->wait, !atomic_read(&obj->refcount));
/* now clean up and destroy the object */

and another place drops a reference to the object by doing

if (atomic_dec_and_test(&obj->refcount))
wake_up(&obj->wait);

then this is susceptible to a race where the wait_event() and final
freeing of the object occur between the atomic_dec_and_test() and the
wake_up(). And this is a use-after-free, since wake_up() will be
called on part of the already-freed object.

Fix this in mthca by replacing the atomic_t refcounts with plain old
integers protected by a spinlock. This makes it possible to do the
decrement of the reference count and the wake_up() so that it appears
as a single atomic operation to the code waiting on the wait queue.

While touching this code, also simplify mthca_cq_clean(): the CQ being
cleaned cannot go away, because it still has a QP attached to it. So
there's no reason to be paranoid and look up the CQ by number; it's
perfectly safe to use the pointer that the callers already have.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

Fix the driver to return SUCCESS if the firmware or driver doesn't
have a command to abort, i.e., it's already been returned. Without
this patch, error recovery will take the target offline as it tries
harder and harder to get the driver to return the command it no longer
has.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Since sir_kthread.c pretty much duplicates the workqueue
functionality, we'd better switch. The SIR fsm has been merged into
sir_dev.c and thus sir_kthread.c is deleted.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Samuel Ortiz <samuel.ortiz@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Let people enable the advansys driver on x86-32, even though it's broken
on other architectures due to missing DMA mapping infrastructure.

It's used by Jeffrey Phillips Freeman <jeffreyfreeman@syncleus.com> and
possibly others.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch disables and saves local interrupts during
hash_page processing for SPE contexts.

We have to do it explicitly in the spu_irq_class_1_bottom
function. For the interrupt handlers, we get the behaviour
implicitly by using SA_INTERRUPT to disable interrupts while
in the handler.

Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Calling sock_orphan inside bh_lock_sock in dccp_close can lead to dead
locks. For example, the inet_diag code holds sk_callback_lock without
disabling BH. If an inbound packet arrives during that admittedly tiny
window, it will cause a dead lock on bh_lock_sock. Another possible
path would be through sock_wfree if the network device driver frees the
tx skb in process context with BH enabled.

We can fix this by moving sock_orphan out of bh_lock_sock.

The tricky bit is to work out when we need to destroy the socket
ourselves and when it has already been destroyed by someone else.

By moving sock_orphan before the release_sock we can solve this
problem. This is because as long as we own the socket lock its
state cannot change.

So we simply record the socket state before the release_sock
and then check the state again after we regain the socket lock.
If the socket state has transitioned to DCCP_CLOSED in the time being,
we know that the socket has been destroyed. Otherwise the socket is
still ours to keep.

This problem was discoverd by Ingo Molnar using his lock validator.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Patch from Bellido Nicolas

Since this patch:
[ARM] 3366/1: Allow the 16bpp mode configuration in the CLCD control register

linux/amba/bus.h needs to be included before linux/amba/clcd.h

Signed-off-by: Nicolas Bellido <ml@acolin.be>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Instantiation of 8MB pages on the TLB cache for the kernel static
mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations.
This ensures r3 gets saved and restored.

Signed-off-by: Marcelo Tosatti <marcelo@kvack.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

make sure phy_map entries whose PHY address is masked are initialized
to NULL, given that other code (such as mdiobus_unregister for
instance) assumes that non-NULL phy_map entries are allocated
phy_devices

Signed-off-by: Herbert Valerio Riedel <hvr@gnu.org>
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>

If a SCSI abort completes, or the command completes successfully, then
the driver must remove the command from its queue of pending
commands. Similarly, if a device reset succeeds, then all commands
queued for the given device must be removed from the queue.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

When abort failed, the driver gets reset handleer called. In the reset
handler, driver calls 'scsi_done()' callback for same SCSI command packet
(struct scsi_cmnd) multiple times if there are multiple SCSI command packet
in the pend_list. More over, if there are entry in the pend_lsit with
IOCTL packet associated, the driver returns it to wrong free_list so that,
in turn, the driver could end up with 'NULL pointer dereference..' during
I/O command building with incorrect resource.

Also, the patch contains several minor/cosmetic changes besides this.

Signed-off-by: Seokmann Ju <seokmann.ju@lsil.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Minimal PNP hotplug support for the smsc-ircc2 driver. A modular
driver will be modprobed via hotplug, but still bypasses driver model
probing.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Samuel Ortiz <samuel.ortiz@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The FXSAVE information leak patch introduced a bug in FP exception
handling: it clears FP exceptions only when there are already
none outstanding. Mikael Pettersson reported that causes problems
with the Erlang runtime and has tested this fix.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Acked-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>