Arwin Vosselman pointed out:
> The ewrk3-driver doesn't function with 2.6.16-kernels (used 2.6.16.41 for
> my tests). Cards will never be detected due to this bug.
>
> drivers/net/ewrks3.c:
> Line 417 reads:
>
> if (nicsr == (CSR_TXD | CSR_RXD))
>
> that should be:
>
> if (nicsr != (CSR_TXD | CSR_RXD))
>
> Comparison with the same line in v2.4 shows why:
>
> 2.4:
> if (nicsr == (CSR_TXD | CSR_RXD)){
>
> blah, blah
> ==========
> 2.6:
> if (nicsr == (CSR_TXD | CSR_RXD))
>     return -ENXIO;
>
> blah, blah
> ==========
>
> blah,blah will not, but should, be executed in 2.6 with a card being present.
>
> The fix mentioned above solves this bug.
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into tmp

Use tabs instead of white spaces for CHELSIO_T3 entry.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Driver version is now 1.3.0-1.226.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix management of allocated physical pages when the architecture
page size is not 4kB since the firmware cannot cross 4K boundary.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Update the default value of 2 module parameters:
* wcfifo disabled
* intr_coal_delay 75us
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH 1/4] myri10ge: Serverworks HT2100 provides aligned PCIe completion

Use the regular firmware on Serverworks HT2100 PCIe ports since this
chipset provides aligned PCIe completion.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

mv643xx_eth_shutdown is needed for kexec.
Signed-off-by: Dale Farnsworth <dale@farnsworth.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The SAA9730 driver doesn't quite grok what the difference between an ioport
and memory mapped I/O is.  It just happened to work on the one Linux
system the SAA9730 happens to spend it's misserable existence on.

drivers/net/saa9730.c: In function 'evm_saa9730_enable_lan_int':
drivers/net/saa9730.c:68: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:70: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:72: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'evm_saa9730_disable_lan_int':
drivers/net/saa9730.c:78: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:80: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'evm_saa9730_clear_lan_int':
drivers/net/saa9730.c:85: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'evm_saa9730_block_lan_int':
drivers/net/saa9730.c:91: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'evm_saa9730_unblock_lan_int':
drivers/net/saa9730.c:97: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'show_saa9730_regs':
drivers/net/saa9730.c:150: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_allocate_buffers':
drivers/net/saa9730.c:292: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:295: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:302: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:305: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:312: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_cam_load':
drivers/net/saa9730.c:329: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:332: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_mii_init':
drivers/net/saa9730.c:369: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:395: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:403: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:410: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:432: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_control_init':
drivers/net/saa9730.c:470: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:474: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:478: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:484: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:487: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:490: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:493: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_stop':
drivers/net/saa9730.c:505: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:508: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:510: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_dma_init':
drivers/net/saa9730.c:536: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_start':
drivers/net/saa9730.c:556: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:560: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:564: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:567: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_tx':
drivers/net/saa9730.c:590: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_rx':
drivers/net/saa9730.c:664: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:729: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_write':
drivers/net/saa9730.c:848: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c: In function 'lan_saa9730_set_multicast':
drivers/net/saa9730.c:943: warning: passing argument 2 of 'outl' makes integer from pointer without a cast
drivers/net/saa9730.c:949: warning: passing argument 2 of 'outl' makes integer from pointer without a cast

Fixed by using writel instead of outl.  42 warnings less.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This reverts commit 18babd38.

Michael Barkowski points out that it's wrong, and I agree.  The
patch causes a problem rather than fixes one after another
patch "ucc_geth: Fix BD processing" was applied.  Before that
patch, current packet should be blocked.  However after the patch
current packet is ok and we only need to block next.
Reported-by: Michael Barkowski <michael.barkowski@freescale.com>
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

T3B2 does not lose its pcie config space on reset.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Under rare conditions, the MAC might hang while generating a pause frame.
This patch fine tunes the MAC settings to avoid the issue, allows for
periodic MAC state check, and triggers a recovery if hung.

Also fix one MAC statistics counter for the rev board T3B2.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The driver attempts to upgrade the FW if the card has the wrong version.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Limit ethtool -g/-G to the given port's queues.
Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

We assign the return value of register_netdev to i, but return rc later
on. Fix it.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Rather than a workqueue and a per-board mutex to control PHY,
use a tasklet and spinlock. Tasklet is lower overhead and works
just as well for this.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Wheen a port on the skge driver is not used, it should
mask off interrupts from theat port.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The skge driver will deadlock if gets a transmit timeout
because the netif_tx_lock() is already held.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] Allow reset of file to ATTR_NORMAL when archive bit not set
  [CIFS] Do not negotiate new POSIX_PATH_OPERATIONS_CAP yet
  [CIFS] reset mode when client notices that ATTR_READONLY is no longer set

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  ACPI: IA64: fix %ll build warnings
  ACPI: IA64: fix allnoconfig build
  ACPI: Only use IPI on known broken machines (AMD, Dothan/BaniasPentium M)
  ACPI: ibm-acpi: allow module to load when acpi notifiers can't be set (v2)
  ACPI: parse 2nd MADT by default
  ACPICA: revert "acpi_serialize" changes
  sony-laptop: MAINTAINERS fix entry, add L: and W:
  ACPI: resolve HP nx6125 S3 immediate wakeup regression
  ACPI: Add support to parse 2nd MADT

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Bypass hcall stats until cpu features have run
  [POWERPC] Avoid hypervisor statistics calculation in real mode
  [POWERPC] Fix atomicity of TIF update in flush_thread()

latest -git triggers an irqtrace/lockdep warning of a leaked
irqs-off condition:

  BUG: at kernel/fork.c:1033 copy_process()

after some debugging it turns out that commit ca1b940c accidentally left
interrupts disabled - which trickled down all the way to the first time
we fork a kernel thread and triggered the warning.

the fix is to re-enable interrupts in the 'else' branch of
setup_boot_APIC_clock()'s pmtimers calibration path.
Reported-by: Michal Piotrowski <michal.k.k.piotrowski@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Thomas Gleixner <tglx@brown.paperbag.linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

lockdep's data shouldn't be used when debug_locks == 0 because it's not
updated after this, so it's more misleading than helpful.

PS: probably lockdep's current-> fields should be reset after it turns
debug_locks off: so, after printing a bug report, but before return from
exported functions, but there are really a lot of these possibilities (e.g.
 after DEBUG_LOCKS_WARN_ON), so, something could be missed.  (Of course
direct use of this fields isn't recommended either.)
Reported-by: Folkert van Heusden <folkert@vanheusden.com>
Inspired-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Since freezable workqueues are broken in 2.6.21-rc
(cf. http://marc.theaimsgroup.com/?l=linux-kernel&m=116855740612755,
http://marc.theaimsgroup.com/?l=linux-kernel&m=117261312523921&w=2)
it's better to change the only user of them, which is XFS, to use "normal"
nonfreezable workqueues.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: David Chinner <dgc@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

lockdep found a bug during a run of workqueue function - this could be also
caused by a bug from other code running simultaneously.

lockdep really shouldn't be used when debug_locks == 0!
Reported-by: Folkert van Heusden <folkert@vanheusden.com>
Inspired-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
Cc: Ingo Molnar <mingo@elte.hu>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It causes extra moon icons blinking on x60, and breaks at least two other
systems.

During resume, we do not know that "reboot"/"shutdown" method was used, so
we assume "plaform" and call BIOS, anyway...

This is 2.6.21 material, and should fix 2 or 3 regressions from 2.6.20.
Signed-off-by: Pavel Machek <pavel@suse.cz>
Acked-by: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Make the SYSV SHM nattch counter work correctly by forcing multiple VMAs to
be produced to represent MAP_SHARED segments, even if they overlap exactly.

Using this test program:

	http://people.redhat.com/~dhowells/doshm.c

Run as:

	doshm sysv

I can see nattch going from one before the patch:

	# /doshm sysv
	Command: sysv
	shmid: 65536
	memory: 0xc3700000
	c0b00000-c0b04000 rw-p 00000000 00:00 0
	c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3180000-c31dede4 r-xs 00000000 00:0b 14582179  /lib/libuClibc-0.9.28.so
	c3520000-c352278c rw-p 00000000 00:0b 13763417  /doshm
	c3584000-c35865e8 r-xs 00000000 00:0b 13763417  /doshm
	c3588000-c358aa00 rw-p 00008000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3590000-c359b6c0 rw-p 00000000 00:00 0
	c3620000-c3640000 rwxp 00000000 00:00 0
	c3700000-c37fa000 rw-S 00000000 00:06 1411      /SYSV00000000 (deleted)
	c3700000-c37fa000 rw-S 00000000 00:06 1411      /SYSV00000000 (deleted)
	nattch 1

To two after the patch:

	# /doshm sysv
	Command: sysv
	shmid: 0
	memory: 0xc3700000
	c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3180000-c31dede4 r-xs 00000000 00:0b 14582179  /lib/libuClibc-0.9.28.so
	c3320000-c3340000 rwxp 00000000 00:00 0
	c3530000-c35325e8 r-xs 00000000 00:0b 13763417  /doshm
	c3534000-c353678c rw-p 00000000 00:0b 13763417  /doshm
	c3538000-c353aa00 rw-p 00008000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3590000-c359b6c0 rw-p 00000000 00:00 0
	c35a4000-c35a8000 rw-p 00000000 00:00 0
	c3700000-c37fa000 rw-S 00000000 00:06 1369      /SYSV00000000 (deleted)
	c3700000-c37fa000 rw-S 00000000 00:06 1369      /SYSV00000000 (deleted)
	nattch 2

That's +1 to nattch for each shmat() made.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Supply a get_unmapped_area() to fix NOMMU SYSV SHM support.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Adam Litke <agl@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix unannotated variable declarations.  Variables that have allocation
section annotations (such as __meminitdata) on their definitions must also
have them on their declarations as not doing so may affect the addressing
mode used by the compiler and may result in a linker error.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The local APIC timer stops to work in deeper C-States.  This is handled by
the ACPI code and a broadcast mechanism in the clockevents / tick managment
code.

Some systems do not expose the deeper C-States to the kernel, but switch
into deeper C-States behind the kernels back.  This delays the local apic
timer interrupts for ever and makes the systems unusable.

Add a command line option to disable the local apic timer and a dmi
quirk for known broken systems.

Andi sayeth:

  While not wrong by itself i think it is still better to use some heuristic
  -- like "has battery in ACPI" With the DMI table if the problem is more wide
  spread we will just continue extending it.

  But anyways should be ok now for .21 although I'm not really happy with
  it.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: john stultz <johnstul@us.ibm.com>
Grudgingly-acked-by: Andi Kleen <ak@suse.de>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The SNAPSHOT_S2RAM ioctl does not disable the nonboot CPUs before entering
the suspend, although it should do this.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I added the 'Q' to list. A short description in the `Ok, so what can I
use them for'-section, on when or why to use it would be nice!
Signed-off-by: Johannes Weiner <hannes-kernel@saeurebad.de>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

NULL checks should be before the first dereference.

Spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Ondrej Zajicek <santiago@crfreenet.org>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  i2c/ds1374: Check workqueue creation status
  i2c-i801: Restore the device state before leaving
  i2c-amd8111: Missed cleanup

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: nat: avoid rerouting packets if only XFRM policy key changed
  [NETFILTER]: nf_conntrack_netlink: add missing dependency on NF_NAT
  [NET]: fix up misplaced inlines.
  [SCTP]: Correctly reset ssthresh when restarting association
  [BRIDGE]: Fix fdb RCU race
  [NET]: Fix fib_rules dump race
  [XFRM]: ipsecv6 needs a space when printing audit record.
  [X25] x25_forward_call(): fix NULL dereferences
  [SCTP]: Reset some transport and association variables on restart
  [SCTP]: Increment error counters on user requested HBs.
  [SCTP]: Clean up stale data during association restart
  [IrDA]: Calling ppp_unregister_channel() from process context
  [IrDA]: irttp_dup spin_lock initialisation
  [IrDA]: Delay needed when uploading firmware chunks

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/ipoib: Fix thinko in packet length checks
  IPoIB: Fix use-after-free in path_rec_completion()
  IB/ehca: Make scaling code work without CPU hotplug
  RDMA/cxgb3: Handle build_phys_page_list() failure in iwch_reregister_phys_mem()
  IB/ipath: Check return value of lookup_one_len
  IPoIB: Fix race in detaching from mcast group before attaching
  IPoIB/cm: Fix reaping of stale connections

The PIT has no dedicated mode for shut down. The only way to disable PIT
is to put it into one shot mode. AMD implementations of PIT on Geode
(also observed on Cyrix) are confused by an "empty" transition from
CLOCK_EVT_MODE_UNUSED to CLOCK_EVT_MODE_SHUTDOWN, which puts the PIT
into one shot mode momentarily.

I realized after staring helpless at the bug report
http://bugzilla.kernel.org/show_bug.cgi?id=8027 for quite a while, that
the only change, which might influence the bogomips calibration, is the
above transition during the PIT initialization.

Avoiding the unnecessary switch to oneshot and later to periodic mode
fixes the weird bogomips value and also the resulting slowness.

The fix is confirmed on OLPC and another Geode based box.

Note: this is unrelated to the Dual Core problem discussed here:
http://lkml.org/lkml/2007/3/17/48Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When a file had a dos attribute of 0x1 (readonly - but dos attribute
of archive was not set) - doing chmod 0777 or equivalent would
try to set a dos attribute of 0 (which some servers ignore)
rather than ATTR_NORMAL (0x20) which most servers accept.
Does not affect servers which support the CIFS Unix Extensions.
Acked-by: Prasad Potluri <pvp@us.ibm.com>
Acked-by: Shirish Pargaonkar <shirishp@us.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

The packet length checks in ipoib are broken: we add 4 bytes (IPoIB
encapsulation header) when sending a packet, not 20 bytes (hardware
address length) to each packet.  Therefore, if connected mode is
enabled so that the interface MTU is larger than the multicast MTU,
IPoIB may end up trying to send too-long multicast packets.  For
example, multicast is broken if a message of size 2048 bytes is sent
on an interface with UD MTU 2048, because 2048 is bigger than the real
limit of 2044 but the code tests against the wrong limit of 2060.

This patch fixes <https://bugs.openfabrics.org/show_bug.cgi?id=418>,
submitted by Scott Weitzenkamp <sweitzen@cisco.com>.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free.  Fix this by changing to the _safe
variant of the list walking macro.

This was spotted by the Coverity checker (CID 1567).
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>