If "ur_idx" is wrong we could go past the end of the array.  The
"ur_idx" comes from root so it's not a huge deal, but adding a sanity
check makes the code more robust.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Fix the build warning:

drivers/mtd/nand/fsl_upm.c: In function 'fun_chip_init':
drivers/mtd/nand/fsl_upm.c:190: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'resource_size_t'
Signed-off-by: NRoy Zang <tie-fei.zang@freescale.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Only 3 warnings are left, one is off by one character, but splitting the line
would reduce the readability. One is for a for loop statement, which would also
not improve readability. The last one is a false positive on a test.

Artem: it is much easier to verify patches against nand_base.c with
       checkpatch.pl when nand_base.c itself does not have so many
       checkpatch.pl warnings.
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Artem: it is much easier to verify patches against nand_base.c with
       checkpatch.pl when nand_base.c itself does not have so many
       checkpatch.pl warnings.
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Sudhakar found out that 100µs are enough. Sadly, his updated patch was
overlooked and an older version still using 100ms was merged. Fix this.

Reference: http://patchwork.ozlabs.org/patch/59180/Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This patch adds support for Spansion S25FL016K and S25FL064K SPI flash.
It has been tested with physical devices. Note that both parts exhibit
a Winbond manufacturer ID so they might also be added to that section.
Signed-off-by: NGernot Hoyler <Gernot.Hoyler@spansion.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

In order to reduce the indentation and improve the readability of nand_get_
flash_type, split the ONFI detection logic to its own function. The detection
logic inside nand_flash_detect_onfi is also rewritten to allow for less
indentation.
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This patch adds support for reading NAND device ONFI parameters and use
the ONFI informations to define its geometry. In case the device supports
ONFI, the onfi_version field in struct nand_chip contains the version (BCD)
and the onfi_params structure can be used by drivers to set up timings and
such. We currently only support ONFI 1.0 parameters.
Signed-off-by: NBrian Norris <norris@broadcom.com>
Signed-off-by: NMatthieu Castet <matthieu.castet@parrot.com>
Signed-off-by: NMaxime Bizon <mbizon@freebox.fr>
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

S5PC110 OneNAND controller use the generic functions provided from onenand_base.
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

There are some additions to the detection scheme used by Samsung
MLC NAND. These simple changes to support the 400- and 436-byte OOB
are found in the following data sheet:

Samsung K9GBG08U0M (p.40)
Signed-off-by: NBrian Norris <norris@broadcom.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This code isn't reachable.  I looked through the git history and it
hasn't been reachable for years.  Someone removed the label to silence
gcc's unused label warning but these few lines accidentally got left
behind.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Add a call to of_node_put in the error handling code following a call to
of_find_compatible_node.
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NWolfram Sang <w.sang@pengutronix.de>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

For different command need different oob requirement, set the proper
oob length by different cmd.
Signed-off-by: NLei Wen <leiwen@marvell.com>
Acked-by: NEric Miao <eric.y.miao@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

After probe, all info already transfer to driver structure.
There is no need to keep the original flash info.
So that we could safely free the flash info in memory, which may grows
larger when more flash is suported.
Signed-off-by: NLei Wen <leiwen@marvell.com>
Signed-off-by: NHaojian Zhuang <haojian.zhuang@marvell.com>
Acked-by: NEric Miao <eric.y.miao@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

We certainly don't need to send read id command times by times, since
we already know what the id is after the first read id...

So create a default timing which could ensure it would successfully read
id out all supported chip. Then follow the build-in table to reconfigure
the timing.
Signed-off-by: NLei Wen <leiwen@marvell.com>
Signed-off-by: NHaojian Zhuang <haojian.zhuang@marvell.com>
Acked-by: NEric Miao <eric.y.miao@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Adding a new flash definition would need less code.
Keep the platform passing flash definition method.
If one flash is both defined in platform data and builtin table,
driver would select the one from platform data first.

By this way, platform could select the timing most suit for itself,
not need to follow the common settings.
Signed-off-by: NLei Wen <leiwen@marvell.com>
Signed-off-by: NHaojian Zhuang <haojian.zhuang@marvell.com>
Acked-by: NEric Miao <eric.y.miao@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Toshiba does not use ONFI for their NAND flash. So we have to continue
to add new IDs used by Toshiba devices as well as heuristic detection
for scanning the 2nd page for a BBM. This is a relatively harmless
start at supporting many of them.

These chips mostly follow the same ID fields of previous generations,
but there is a need for a tweak.

These chips introduce a strange 576 byte OOB (that's 36 bytes per
512 bytes of page). In the preliminary data, Toshiba has not
defined exactly how their ID strings should decode. In the future,
a new tweak must be added.

Data is taken from, among others, Toshiba TC58TxG4S2FBAxx
Signed-off-by: NBrian Norris <norris@broadcom.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Remove the MTD!=n dependency since that is handled by drivers/mtd/Kconfig.
Simplify the dependency checks for mtd/chips by using if/endif blocks. Remove
all default n since that is the Kconfig default.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

There were some improvements and additions necessary in the
comments explaining of the expansion of nand_ecclayout, the
introduction of nand_ecclayout_user, and the deprecation of the
ioctl ECCGETLAYOUT.

Also, I found a better placement for the macro MTD_MAX_ECCPOS_ENTRIES;
next to the definition of MTD_MAX_OOBFREE_ENTRIES in mtd-abi.h. The macro
is really only important for the ioctl code (found in drivers/mtd/mtdchar.c)
but since there are small edits being made to the user-space header, I
figured this is a better location.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

struct nand_ecclayout is too small for many new chips; OOB regions can be as
large as 448 bytes and may increase more in the future. Thus, copying that
struct to user-space with the ECCGETLAYOUT ioctl is not a good idea; the ioctl
would have to be updated every time there's a change to the current largest
size.

Instead, the old nand_ecclayout is renamed to nand_ecclayout_user and a
new struct nand_ecclayout is created that can accomodate larger sizes and
expand without affecting the user-space. struct nand_ecclayout can still
be used in board drivers without modification -- at least for now.

A new function is provided to convert from the new to the old in order to
allow the deprecated ioctl to continue to work with truncated data. Perhaps
the ioctl, the conversion process, and the struct nand_ecclayout_user can be
removed altogether in the future.

Note: There are comments in nand/davinci_nand.c::nand_davinci_probe()
regarding this issue; this driver (and maybe others) can be updated to
account for extra space. All kernel drivers can use the expanded
nand_ecclayout as a drop-in replacement and ignore its benefits.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Some Spansion chips have a method for determining eraseblock size that
is incompatible with similar ID chips of other sizes. This implements
some heuristic detection of these differences.

This patch checks for a 5-byte ID with trailing zeros as well as a
512-byte page size to ensure that chips are not misdetected as the
S30MLxxxP ORNAND series.

[Tweaked by Artem a bit]
Signed-off-by: NBrian Norris <norris@broadcom.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Drivers may (and do) return negative errno values other than -1 from the
ecc.correct callback.
Signed-off-by: NBaruch Siach <baruch@tkos.co.il>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

libata depends on scsi_host_template for module reference counting and
sht's should be owned by each low level driver.  During libahci split,
the sht was left with libahci.ko leaving the actual low level drivers
not reference counted.  This made ahci and ahci_platform always
unloadable even while they're being actively used.

Fix it by defining AHCI_SHT() macro in ahci.h and defining a sht for
each low level ahci driver.

stable: only applicable to 2.6.35.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-by: NPedro Francisco <pedrogfrancisco@gmail.com>
Tested-by: NMichael Tokarev <mjt@tls.msk.ru>
Cc: stable@kernel.org
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Commit e40cc4bd introduced
a build breakage if CONFIG_SMP is undefined. This commit
fixes the problem.

This fix is only a workaround. For a real fix, cpu_sibling_mask() should
be defined in UP include code, eg in linux/smp.h, and asm/smp.h should not be
included directly. This fix is currently not possible because asm/smp.h defines
cpu_sibling_mask() unconditionally and is included directly from many source
files.
Reported-by: NIngo Molnar <mingo@elte.hu>
Tested-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NGuenter Roeck <guenter.roeck@ericsson.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>

The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a
pktcdvd_device from the global pkt_devs array.  The index into this
array is provided directly by the user and is a signed integer, so the
comparison to ensure that it falls within the bounds of this array will
fail when provided with a negative index.

This can be used to read arbitrary kernel memory or cause a crash due to
an invalid pointer dereference.  This can be exploited by users with
permission to open /dev/pktcdvd/control (on many distributions, this is
readable by group "cdrom").
Signed-off-by: NDan Rosenberg <dan.j.rosenberg@gmail.com>
[ Rather than add a cast, just make the function take the right type -Linus ]
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When the interface is up, using ethtool breaks it because:
a) link is put down but media_timer interval is not shortened to NO_LINK
b) rxtx is stopped but not restarted

Also manual 10baseT-HD (and probably FD too - untested) mode does not work -
the link is forced up, packets are transmitted but nothing is received.
Changing CSR14 value to match documentation (not disabling link check) fixes this.
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Acked-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch (commit 690a1f20) added a
new call site for acpi_set_WOL() without checking that the function is
actually suitable to be called via

 vortex_set_wol+0xcd/0xe0 [3c59x]
 dev_ethtool+0xa5a/0xb70
 dev_ioctl+0x2e0/0x4b0
 T.961+0x49/0x50
 sock_ioctl+0x47/0x290
 do_vfs_ioctl+0x7f/0x340
 sys_ioctl+0x80/0xa0
 system_call_fastpath+0x16/0x1b

i.e. outside of code paths run when the device is not yet enabled or
already disabled. In particular, putting the device into D3hot is a
pretty bad idea when it was already brought up.

Furthermore, all prior callers of the function made sure they're
actually dealing with a PCI device, while the newly added one didn't.

In the same spirit, the .get_wol handler shouldn't indicate support
for WOL for non-PCI devices.
Signed-off-by: NJan Beulich <jbeulich@novell.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The HW by default has RX coalescing on.  For iWARP connections, this
causes a 100ms delay in connection establishement due to the ingress
MPA Start message being stalled in HW.  So explicitly turn RX
coalescing off when setting up iWARP connections.

This was causing very bad performance for NP64 gather operations using
Open MPI, due to the way it sets up connections on larger jobs.
Signed-off-by: NSteve Wise <swise@opengridcomputing.com>
Cc: <stable@kernel.org>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

f4347553 removed the edac polling
mechanism in favor of using a notifier chain for conveying MCE
information to edac. However, the module removal path didn't test
whether the driver had setup the polling function workqueue at all and
the rmmod process was hanging in the kernel at try_to_del_timer_sync()
in the cancel_delayed_work() path, trying to cancel an uninitialized
work struct.

Fix that by adding a balancing check to the workqueue removal path.
Signed-off-by: NBorislav Petkov <borislav.petkov@amd.com>

Freeing netdev without free_netdev() leads to net, tx leaks.
I might lead to dereferencing freed pointer.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

@@
struct net_device* dev;
@@

-kfree(dev)
+free_netdev(dev)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Freeing netdev without free_netdev() leads to net, tx leaks.
I might lead to dereferencing freed pointer.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

@@
struct net_device* dev;
@@

-kfree(dev)
+free_netdev(dev)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Freeing netdev without free_netdev() leads to net, tx leaks.
I might lead to dereferencing freed pointer.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

@@
struct net_device* dev;
@@

-kfree(dev)
+free_netdev(dev)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Freeing netdev without free_netdev() leads to net, tx leaks.
I might lead to dereferencing freed pointer.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

@@
struct net_device* dev;
@@

-kfree(dev)
+free_netdev(dev)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This enables auto loading for the smsc911x ethernet driver.
Signed-off-by: NVincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Compex FreedomLine 32 PnP-PCI2 cards have only TP and BNC connectors but the
SROM contains AUI port too. When TP loses link, the driver switches to
non-existing AUI port (which reports that carrier is always present).

Connecting TP back generates LinkPass interrupt but de_media_interrupt() is
broken - it only updates the link state of currently connected media, ignoring
the fact that LinkPass and LinkFail bits of MacStatus register belong to the
TP port only (the chip documentation says that).

This patch changes de_media_interrupt() to switch media to TP when link goes
up (and media type is not locked) and also to update the link state only when
the TP port is used.

Also the NonselPortActive (and also SelPortActive) bits of SIAStatus register
need to be cleared (by writing 1) after reading or they're useless.
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Acked-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

At least my 21041 cards come out of suspend with bus mastering disabled so
they did not work after resume(no data transferred).
After adding pci_set_master(), the driver oopsed immediately on resume -
because de_clean_rings() is called on suspend but de_init_rings() call
was missing in resume.

Also disable link (reset SIA) before sleep (de4x5 does this too).
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Acked-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If not all clocks have been defined in platform data, the driver will
cause a null pointer dereference when it is removed. This patch fixes
this issue.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NChris Ball <cjb@laptop.org>

In the commit f522886e a merge conflict
in the sdhci-s3c driver been fixed. However the fix used incorrect
spinlock operation - it caused a race with sdhci interrupt service. The
correct way to solve it is to use spin_lock_irqsave/irqrestore() calls.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NChris Ball <cjb@laptop.org>