This fixes the bug that the I/O buffer is not freed at the driver removal.
Signed-off-by: NMasakazu Mokuno <mokuno@sm.sony.co.jp>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This patch fixes a bug in RX path, the frequency was wrongly set in the
ieee80211_rx_status. This bug led to an empty scan list in A band.
Signed-off-by: NEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: NTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

zd_mac_tx_to_dev() could potentially free the skb, or hand it off
to mac80211 which might free it. Hence, this code needs to get the
usb pointer out of skb->cb before handing it off to that function.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

When, for some reason, the rt2x00pci module fails to allocate DMA memory for
the queues, it tries to undo the complete initialization of the PCI device,
including freeing of the irq. This results in the following error in dmesg, as
the irq hadn't been requested yet:

[  78.123456] Trying to free already-free IRQ 17

Fix this by implementing proper error handling code, instead of just using the
full uninitialization function.
Signed-off-by: NGertjan van Wingerde <gwingerde@kpnplanet.nl>
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

During initialization the initialize() callback function
in rt2x00pci and rt2x00usb will cleanup the mess they made.

rt2x00lib shouldn't call uninitialize because the callback function already
cleaned up _and_ the DEVICE_INITIALIZED isn't set which causes the
rt2x00lib_uninitialize() to halt directly anyway. All that is required
to be cleaned up by rt2x00lib is the queue, and that can be done by
calling rt2x00queue_uninitialize() directly.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

rt2x00pci allocates DMA for descriptor and data,
rt61pci doesn't use this for the beacon, but it can
use the descriptor part as temporary buffer instead
of using pskb_expand_head().
Using this temporary buffer is obviously much better
then reallocating the skb buffer...

At the same time we can set the data length for the
beacon queue at 0, to make sure no DMA is allocated for
data (but just for the descriptor).
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Make iwl4965_lq_sta->drv available even without CONFIG_MAC80211_DEBUGFS.
Signed-off-by: NYi Zhu <yi.zhu@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Reported by Daniel Marjamäki <danielm77@spray.se> here:

	http://bugzilla.kernel.org/show_bug.cgi?id=10588Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This fixes a regression introduced by commit 7b463ced (prism54: set
carrier flags correctly) which causes the device to come up without
a carrier in AP-mode.
Signed-off-by: NLuis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Determine the number of physical ports from the card's VPD data.
Previous fix failed on Maramba platform which doesn't have the
"board-model" property. This fix uses the "model" property which
exists on all cards and Neptune based motherboards.

cstyle cleanup included.
Signed-off-by: NMatheos Worku <matheos.worku@sun.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

As noticed by Ben Greear, macvlan crashes the kernel when unloading the
module. The reason is that it tries to clean up the macvlan_port pointer
on the macvlan device itself instead of the underlying device. A non-NULL
pointer is taken as indication that the macvlan_handle_frame_hook is
valid, when receiving the next packet on the underlying device it tries
to call the NULL hook and crashes.

Clean up the macvlan_port on the correct device to fix this.

Signed-off-by; Patrick McHardy <kaber@trash.net>
Tested-by: NBen Greear <greearb@candelatech.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

On a read error, e1000e might have returned uninitialized block of
eeprom data back to userspace. The convention is that 0xff is "empty",
so mark the entire eeprom as empty in case of an error.
Signed-off-by: NAuke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Commit 9fb1e350,
ucc_geth: use rx-clock-name and tx-clock-name device tree properties
Introduced a typo that made the driver use the RX clock
as TX clock, causing massive TX errors.
Signed-off-by: NJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Otherwise theoretically at least

	CAP_NET_ADMIN
	Reload new firmware
	Wait..
	Firmware patches kernel

So it should be CAY_SYS_RAWIO - not that I suspect this is in fact a
credible attack vector!
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Delete the non-napi code from the driver and Kconfig.
Tested x86_64.  Apply at next open opportunity.
Signed-off-by: NDon Fry <pcnet32@verizon.net>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

There are more memory leaks in the !PPC_CPM_NEW_BINDING case, but that code
will disappear soon along with arch/ppc.

Reported by Daniel Marjamki <danielm77@spray.se> at
http://bugzilla.kernel.org/show_bug.cgi?id=10591Signed-off-by: NScott Wood <scottwood@freescale.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Taken from http://bugzilla.kernel.org/show_bug.cgi?id=10577

I was unable to access a computer containing an Intel EtherExpress 16 network
card using IPv6.

I traced this to failure of neighbour discovery.  When I used an "ip -6 neigh
add" command, on the computer attempting access, to insert a binding between
the IPv6 address of the computer with the Intel EtherExpress 16 network card
and the card's ethernet address, I was able to access that computer using
IPv6.

Neighbour discovery requires working multicast.  The driver sources file
eexpress.c contains an approximately 30 line function eexp_setup_filter used
when loading multicast addresses.

I found 3 problems in this function

1) It wrote the number of multicast addresses to the card instead of the
    number of bytes in the multicast addresses.

2) When loading multiple multicast addresses it loaded the first one
    provided multiple times instead of loading each one once.

3) The setting of pointer 'data' from 'dmi->dmi_addr' occured before the
    test for the error situation of 'dmi' being NULL.

Correcting these problems allows the computer with the Intel EtherExpress 16
network card to found by IPv6 neighbour discovery.

p.s. There is some information on the Intel EtherExpress 16 at
http://www.intel.com/support/etherexpress/vintage/sb/cs-013500.htm
Datasheet for the Intel 82586 ethernet controller used by the card
http://www.datasheetcatalog.com/datasheets_pdf/8/2/5/8/82586.shtmlSigned-off-by: NBruce Robson <bns_robson@hotmail.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Use net_device_stats from net_device structure instead of local.
Signed-off-by: NPaulius Zaleckas <paulius.zaleckas@teltonika.lt>
Acked-by: NSteffen Klassert <klassert@mathematik.tu-chemnitz.de>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The ethernet card 3c980-TX needs a mdio_sync() to initialize the ethernet
properly. This is forced by adding an EXTRA_PREAMBLE to its drv_flags.

Without this, the driver did not reconnect after a link loss.
Signed-off-by: NGunnar Larisch <Gunnar.Larisch@gmx.de>
Acked-by: NSteffen Klassert <klassert@mathematik.tu-chemnitz.de>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

drivers/net/appletalk/cops.c: In function ‘cops_reset’:
drivers/net/appletalk/cops.c:507: warning: comparison of distinct pointer
types lacks a cast

by replacing hand-woven msleep() with call to msleep()
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

This patch adds support for the BM PHY, a new PHY model being used
on ICH9-based implementations.

This new PHY exposes issues in the ICH9 silicon when receiving
jumbo frames large enough to use more than a certain part of the
Rx FIFO, and this unfortunately breaks packet split jumbo receives.
For this reason we re-introduce (for affected adapters only) the
jumbo single-skb receive routine back so that people who do
wish to use jumbo frames on these ich9 platforms can do so.
Part of this problem has to do with CPU sleep states and to make
sure that all the wake up timings are correctly we force them
with the recently merged pm_qos infrastructure written by Mark
Gross. (See http://lkml.org/lkml/2007/10/4/400).

To make code read a bit easier we introduce a _IS_ICH flag so
that we don't need to do mac type checks over the code.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NAuke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

This patch fixes uli526x driver's issues on a PowerPC boards: uli chip
is unable to receive the packets.

It appears that send_frame_filter prepares the setup frame in the
endianness unsafe manner. On a big endian machines we should shift
the address nibble by two bytes.
Signed-off-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The firmware on MPC8610HPCD boards enables ULI ethernet and leaves it
in some funky state before booting Linux. For drivers, it's always good
idea to (re)initialize the hardware prior to requesting interrupts.

This patch fixes the following oops:

Oops: Kernel access of bad area, sig: 11 [#1]
MPC86xx HPCD
NIP: c0172820 LR: c017287c CTR: 00000000
[...]
NIP [c0172820] allocate_rx_buffer+0x2c/0xb0
LR [c017287c] allocate_rx_buffer+0x88/0xb0
Call Trace:
[df82bdc0] [c017287c] allocate_rx_buffer+0x88/0xb0 (unreliable)
[df82bde0] [c0173000] uli526x_interrupt+0xe4/0x49c
[df82be20] [c0045418] request_irq+0xf0/0x114
[df82be50] [c01737b0] uli526x_open+0x48/0x160
[df82be70] [c0201184] dev_open+0xb0/0xe8
[df82be80] [c0200104] dev_change_flags+0x90/0x1bc
[df82bea0] [c035fab0] ip_auto_config+0x214/0xef4
[df82bf60] [c03421c8] kernel_init+0xc4/0x2ac
[df82bff0] [c0010834] kernel_thread+0x44/0x60
Instruction dump:
4e800020 9421ffe0 7c0802a6 bfa10014 7c7e1b78 90010024 80030060 83e30054
2b80002f 419d0078 3fa0c039 48000058 <907f0010> 80630088 2f830000 419e0014
Signed-off-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

ucc_geth didn't have anything marked as __iomem.  It was also inconsistent
with its use of in/out accessors (using them sometimes, not using them other
times).  Cleaning this up cuts the warnings down from hundreds to just over a
dozen.
Signed-off-by: NAndy Fleming <afleming@freescale.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Declared some things static, declared some things in the header.
Signed-off-by: NAndy Fleming <afleming@freescale.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

During sparse cleanup, found a locking bug.  Some of the sysfs functions were
acquiring a lock, and then returning in the event of an error.  We rearrange
the code so that the lock is released in error conditions, too.
Signed-off-by: NAndy Fleming <afleming@freescale.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

	As part of:

commit c2edacf8
Author: Jay Vosburgh <fubar@us.ibm.com>
Date:   Mon Jul 9 10:42:47 2007 -0700

    bonding / ipv6: no addrconf for slaves separately from master

two steps were rearranged in the enslavement process: netdev_set_master
is now before the call to dev_open to open the slave.

	This patch updates the error cases and unwind process at the
end of bond_enslave to match the new order.  Without this patch, it is
possible for the enslavement to fail, but leave the slave with IFF_SLAVE
set in its flags.
Signed-off-by: NJay Vosburgh <fubar@us.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The sysfs layer has an internal protection, that ensures, that
all the process sitting inside ->sore/->show callback exits
before the appropriate entry is unregistered (the calltraces
are rather big, but I can provide them if required).

On the other hand, bonding takes rtnl_lock in
a) the bonding_store_bonds, i.e. in ->store callback,
b) module exit before calling the sysfs unregister routines.

Thus, the classical AB-BA deadlock may occur. To reproduce run
# while :; do modprobe bonding; rmmod bonding; done
and
# while :; do echo '+bond%d' > /sys/class/net/bonding_masters ; done
in parallel.

The fix is to move the bond_destroy_sysfs out of the rtnl_lock,
but _before_ bond_free_all to make sure no bonding devices exist
after module unload.
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Acked-by: NJay Vosburgh <fubar@us.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

	Fixed an error unwind in bonding_store_bonds that didn't release
the locks it held, and consolidated unwinds into a common block at the
end of the function.  Bug reported by Pavel Emelyanov <xemul@openvz.org>,
who provided a different fix.
Signed-off-by: NJay Vosburgh <fubar@us.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

If the call to bond_create_sysfs_entry in bond_create fails, the
proper rollback is to call unregister_netdevice, not free_netdev.
Otherwise - kernel BUG at net/core/dev.c:4057!

Checked with artificial failures injected into bond_create_sysfs_entry.

Pavel's original patch modified by Jay Vosburgh to move code around
for clarity (remove goto-hopping within the unwind block).
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Signed-off-by: NJay Vosburgh <fubar@us.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

IWLWIFI should be a tristate so that if IWLCORE and/or IWL3945 are m
and none of them is y kbuild doesn't create an empty 
drivers/net/wireless/built-in.o

This patch also removes the pointless "default n".
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

x86.git testing found this build bug on v2.6.26-rc1:

  ERROR: "pnp_get_resource" [drivers/net/irda/smsc-ircc2.ko] undefined!
  make[1]: *** [__modpost] Error 1
  make: *** [modules] Error 2

the driver did not anticipate the case of !CONFIG_PNP which is rare but 
still possible. Instead of restricting the driver to PNP-only in the 
Kconfig space, add the (trivial) dummy struct pnp_driver - this is that 
other drivers use in the !PNP case too.

The driver itself can in theory be initialized on !PNP too in certain 
cases, via smsc_ircc_legacy_probe().

Patch only minimally build tested, i dont have this hardware.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

x86.git testing found the following build failure in latest -git:

 drivers/built-in.o: In function `nsc_ircc_pnp_probe':
 nsc-ircc.c:(.text+0xdf1b6): undefined reference to `pnp_get_resource'
 nsc-ircc.c:(.text+0xdf1d4): undefined reference to `pnp_get_resource'
 nsc-ircc.c:(.text+0xdf1ee): undefined reference to `pnp_get_resource'
 nsc-ircc.c:(.text+0xdf237): undefined reference to `pnp_get_resource'
 nsc-ircc.c:(.text+0xdf24c): undefined reference to `pnp_get_resource'
 drivers/built-in.o:nsc-ircc.c:(.text+0xdf266): more undefined references to `pnp_get_resource' follow
 make: *** [.tmp_vmlinux1] Error 1

triggered via this config:

  http://redhat.com/~mingo/misc/config-Sat_May__3_20_53_13_CEST_2008.bad

while generally most users will have PNP enabled, drivers can support
non-PNP build mode too - and most drivers implement it. That is typically
done by providing a dummy pnp_driver structure that will not probe anything.

The fallback routines in the driver will handle this dumber mode of
operation too.

This patch implements that. I have not tested whether this actually
works on real hardware so take care. It does resolve the build bug.

[ Another solution that is used by a few drivers is to exclude the driver
  in the Kconfig if PNP is disabled, via "depends on PNP", but this would
  limit the availability of the driver needlessly. ]
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Changeset 7f7c4072 ("niu: Determine
the # of ports from the card's VPD data") caused maramba on-board
NIU ports to stop probing properly.

The old code had a fallback that would use a num_ports value of
4 if all the probing methods failed, but that was removed.

This restores the fallback of 4 ports, to get things working
again.

Bump driver version and release date.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Otherwise it leaks forever.

Based upon a report by Roland <devzero@web.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The new RV2P firmware fixes 2 issues:

1. The jumbo rx buffer page size is now configurable and set to the
   proper PAGE_SIZE.  Before, it was assumed to be always 4K.

2. Driver sometimes would crash when receiving jumbo packets mixed
   with firmware management packets.  This was caused by the old
   firmware DMA'ing to the wrong address.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We should zero out the context memory for 5709 before each reset.  When
we resume after suspend for example, the memory may not be zero and the
chip may not function correctly.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The register BNX2_CTX_STATUS (0x1004) should be skipped on 5709 as it
contains reserved bits.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

On some remote PHY blade systems, the driver receives no initial link
interrupt.  As a result, the GMII/MII MAC mode does not get setup properly.
To fix this problem, we add an initial poll of the link state after chip
reset.

With this change, the setting of the initial carrier state in the init
code can be eliminated.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>