bus_rescan_devices_helper() does not hold the dev->sem when it checks for
!dev->driver().  device_attach() holds the sem, but calls again
device_bind_driver() even when dev->driver is set.

What happens is that a first device_attach() call (module insertion time)
is on the way binding the device to a driver.  Another thread calls
bus_rescan_devices().  Now when bus_rescan_devices_helper() checks for
dev->driver it is still NULL 'cos the the prior device_attach() is not yet
finished.  But as soon as the first one releases the dev->sem the second
device_attach() tries to rebind the already bound device again.
device_bind_driver() does this blindly which leads to a corrupt
driver->klist_devices list (the device links itself, the head points to the
device).  Later a call to device_release_driver() sets dev->driver to NULL
and breaks the link it has to itself on knode_driver.  Rmmoding the driver
later calls driver_detach() which leads to an endless loop 'cos the list
head in klist_devices still points to the device.  And since dev->driver is
NULL it's stuck with the same device forever.  Boom.  And rmmod hangs.

Very easy to reproduce with new-style pcmcia and a 16bit card.  Just loop
modprobe <pcmcia-modules> ;cardctl eject; rmmod <card driver, pcmcia
modules>.

Easiest fix is to check if the device is already bound to a driver in
device_bind_driver().  This avoids the double binding.
Signed-off-by: NDaniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

vlan_hwaccel_rx should be used when in interrupt context.

Fixes bug  http://bugzilla.kernel.org/show_bug.cgi?id=5284Signed-off-by: NTommy S. Christensen <tommy.christensen@tpack.net>
Cc: Francois Romieu <romieu@fr.zoreil.com>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jgarzik@pobox.com>

Cleanup receive buffer allocation and management,
Add more error handling checks from PHY and bump version.
Signed-off-by: NJeff Garzik <jgarzik@pobox.com>

Expand the returned data for ethtool debug access to include
all of the mapped PCI area; except for the small set of registers
that are for diagnostic RAM access. Access to those registers
will hang the system.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NJeff Garzik <jgarzik@pobox.com>

Fix bond_enslave link monitoring warning to check use_carrier status
and ethtool_ops in addition to do_ioctl.  This version checks ethtool_ops
as well as do_ioctl, and also uses the per-bond params.use_carrier
instead of the global use_carrier.
Signed-off-by: NJason R. Martin <nsxfreddy@gmail.com>
Signed-off-by: NJeff Garzik <jgarzik@pobox.com>

Based on simplification idea from Sean Hefty <sean.hefty@intel.com>
Signed-off-by: NHal Rosenstock <halr@voltaire.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

Clean up code by using enums instead of hard-coded magic numbers.
Signed-off-by: NSean Hefty <sean.hefty@intel.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

We currently unregister the config-osm driver if initialization of the
legacy ioctl() handlers failed but still return success.  We should be
returning -EBUSY in this case.
Signed-off-by: NDeepak Saxena <dsaxena@plexity.net>
Cc: Markus Lidel <Markus.Lidel@shadowconnect.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This function was removed a while ago, but crept in again via a recent
scsi merge.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This patch fixes the problem Bjorn reported.  The busy_initializing flag
should have cleared before going into the for loop.
Signed-off-by: NMike Miller <mike.miller@hp.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NTom 'spot' Callaway <tcallawa@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In fbdev perspective, the frontporch is the lower/right margin and the
backporch is the upper/left margin.

Correct.
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

A recent change in nvidiafb caused nvidiafb_cursor to always return -ENXIO
instead of using the soft_cursor.  This will happen if the parameter "hwcur"
is not set, which happens to be the default.
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Seems that the Acorn RTC driver missed an update.  Fix it.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Clean up QP table array on device removal.
Signed-off-by: NMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

ipoib_mcast_restart_task() is always called from within the
single-threaded IPoIB workqueue, so flushing the workqueue from within
the function can lead to a recursion overflow.  But since we're
running in a single-threaded workqueue, we're already synchronized
against other items in the workqueue, so just get rid of the flush in
ipoib_mcast_restart_task().
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

The following commit breaks cisco mode with my WAN drivers:
author	David S. Miller <davem@davemloft.net>
	Tue, 28 Jun 2005 22:25:31 +0000 (15:25 -0700)
commit	689be439

"[NET]: Remove gratuitous use of skb->tail in network drivers."

The following patch fixes it - please apply (cisco_hard_header does
skb_push(4 bytes)).
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We need to subtract off the header length from our payload
length when sending multi-packet SA messages.
Signed-off-by: NHal Rosenstock <halr@voltaire.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

this patch adds some fc host attributes and removes its equivalents
from the zfcp_adapter structure and zfcp specific sysfs subtree.

Furthermore it removes superfluous calls to fc_remort_port_delete when
an adapter is set offline because rports will be removed by
fc_remove_host anyway.
Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

N_Port ID Virtualization (NPIV) allows a single FCP port to appear as
multiple, distinct ports providing separate port identification. NPIV
is supported by FC HBAs on System z9. zfcp was adapted to support this
new feature.
Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Debug features (DBFs) els_dbf, cmd_dbf and abt_dbf were removed and
san_dbf, hba_dbf and scsi_dbf were introduced. The erp_dbf did not
change.
The new traces improve debugging of problems with zfcp, scsi-stack,
multipath and hardware in the SAN. san_dbf traces things like ELS and
CT commands, hba_dbf saves HBA specific information of requests, and
scsi_dbf saves FCP and SCSI specific information of requests. Common
to all new DBFs is that they provide a so called structured view. This
significantly improves readability of the traces.
Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

o union zfcp_req_data removed
o increment unit refcount when processing FCP commands
 (This fixes a theoretical race: When all scsi commands of a unit
  are aborted and the scsi_device is removed then the unit could be
  removed before all fsf_requests of that unit are completely processed.)
Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

o always use locking when changing erp_action lists,
o avoid escalation to ERP_ACTION_REOPEN_PORT_FORCED if erp_action is
  still in use for ERP_ACTION_REOPEN_PORT
Signed-off-by: NAndreas Herrmann <aherrman@de.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

On Thursday, September 15, 2005 6:22 AM, Christoph Hellwig wrote:
> Looks good to me, except for the spurious scsi_print_command prototype
> in mptscsih.h.

The attached patch addresses that concern.
Signed-off-by: NEric Moore <Eric.Moore@lsil.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Summary of Changes:
* splitting mpt_interrupt per Christophs suggestion
about a month ago
* rename ScsiCfgData to SpiCfgData structure,
then move all the raid related info into
new structure called RaidCfgData.  This is
done because SAS supports RAID, as well as SPI,
so the raid stuff should be seperate.
* incorrect timeout calculation for cntdn
inside WaitForDoorbellAck and WaitForDoortbellInt
* add support for interpreting SAS Log Info
* Increase Event Log Size from 0xA to 0x32
* Fix bug in mptsas/mptfc/mptspi - when controller
has Initiator Mode Disabled, and only running in
TargetMode, the mptctl would panic when loading.
The fix is to return 0, instead of -ENODEV, in
SCSI LLD respective probe routines
* Fix bug in mptlan.c - driver will panic if
there is host reset, due to dev being set to
zero in mpt_lan_ioc_reset
* Fix's for SPI - Echo Buffer
* Several fix's in mptscsih_io_done - FCP Response
info, RESIDUAL_MISMATCH, Data Underrun, etc.
* Cleanup Error Handling - EH handlers,
mptscsih_flush_cmds, and zeroing out ScsiLookup
from mptscsih_qcmd
* Cleanup asyn event handling from
mptscsih -> mptscsih_event_process.  Also
added support for SAS Persistent Table Full,
an asyn event
Signed-off-by: NEric Moore <Eric.Moore@lsil.com>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Adds the actual mptsas driver, based upon the LSI driver with new work
for SAS transport class integration from Eric Moore and me.

This obviously depends on the SAS transport class.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

 - various bits for SAS support from the LSI driver.
 - use the device private data for the fusion target private data.
   this should be using the midlayer target data framework, but we
   can't move over to that until fusion has been switched to the
   generic DV code
 - use target ID and channel from the fusion target private data,
   because those in scsi_device will be different for mptsas
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

Userspace SRQs don't have a buffer allocated for them in the kernel, so
it doesn't make sense to set srq->last during initialization.  In fact,
this can crash trying to follow a nonexistent buffer pointer.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

From: 	Alan Stern <stern@rowland.harvard.edu>

This patch (as561) fixes the error handler's thread-exit code.  The
kthread_stop call won't wake the thread from a down_interruptible, so
the patch gets rid of the semaphore and simply does

        set_current_state(TASK_INTERRUPTIBLE);
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>

Modified to simplify the termination loop and correct the sleep condition.
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

We fix the oops by enforcing the host state model.  There have also
been two extra states added: SHOST_CANCEL_RECOVERY and
SHOST_DEL_RECOVERY so we can take the model through host removal while
the recovery thread is active.
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

The error handling paths in mthca_tavor_post_srq_recv() and
mthca_arbel_post_srq_recv() are quite bogus, the result of a
screwed up merge.  Fix them so they work as intended.

Pointed out by Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

In mthca_create_eq(), we call get_eqe() before setting eq->nent.  This
is wrong, because get_eqe() uses eq->nent.  Fix this, and clean up the
code a little while we're at it.  (We got lucky with the current code,
because eq->nent was cleared to 0, which get_eqe() made happen to do
the right thing)

Pointed out by Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

We got a little mixed up with what the backoff member holds in the
IPoIB multicast group structure: sometimes it was used as a number of
seconds, and sometimes it was used as a number of jiffies.  Fix the
code so that backoff is always in seconds.
Signed-off-by: NHal Rosenstock <halr@voltaire.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

Fix posting first WQE for mem-free HCAs: we need to link to previous
WQE even in that case.  While we're at it, simplify code for
Tavor-mode HCAs.  We don't really need the conditional test there
either; we can similarly always link to the previous WQE.

Based on Michael S. Tsirkin's analogous fix for userspace libmthca.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

The hardware reads the ACK timeout field from the most significant 5
bits of struct mthca_qp_path's ackto field, not the least significant
bits.  This fix has the driver put the timeout in the right place.
Without this, we get a timeout that is 2^8 times too small.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

Since ipoib uses queue_delayed_work to run flush task on port state events,
it must flush scheduled work after unregistering the event handler.
Signed-off-by: NMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

This patch (as545) fixes the list traversals in __scsi_remove_target and
scsi_forget_host.  In each case the existing code list_for_each_entry_safe
in an _unsafe_ manner, because the list was not protected from outside
modification while the iteration was running.

The new scsi_forget_host routine takes the moderately controversial step
of iterating over devices for removal rather than iterating over targets.
This makes more sense to me because the current scheme treats targets as
second-class citizens, created and removed on demand, rather than as
objects corresponding to actual hardware.  (Also I couldn't figure out any
safe way to iterate over the target list, since it's not so easy to tell
when a target has already been removed.)
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>

From: Florin Malita <fmalita@gmail.com>

bond_init() is not releasing rtnl_sem after register_netdevice() and before
calling unregister_netdevice() (from bond_free_all()) in the exception
path.  As the device registration is not completed (dev->reg_state ==
NETREG_REGISTERING), the call to unregister_netdevice() triggers
BUG_ON(dev->reg_state != NETREG_REGISTERED).
Signed-off-by: NFlorin Malita <fmalita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>