Based on patch from Sridhar Samudrala

The following patch fixes the check for IPv6 GSO packet in ixgbevf
driver to use skb_is_gso_v6(). SKB_GSO_DODGY is also set
when packets are forwarded from a guest.

CC: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the VF detects that the PF has reset turn off carrier and stop all
tx queues.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix panics in the VF driver that occur when you bring it down after
having already brought the PF down.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the VF driver gets a control message from the PF that indicates the
PF is about to reset or go down we schedule the watchdog timer so that
it will detect the PF has gone offline and take appropriate action.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Inadequate coordination between the PF driver and the VF driver results
in tx hangs in the VF driver when you perform certain actions that will
lead to a re-init of the PF.  Add feature to notify active VFs when the PF
is about to re-initialize so that the VFs can take appropriate action.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The PF Reset Done bit should not be set in the extended control register
until the PF has actually completed the bring up process.  It is a mis-
interpretation of the purpose of this bit to assume it should be set
when the physical reset of the device is done.  Instead it should be used
to indicate to the VFs when the PF is ready to provide them with required
services.  This is not until after the PF is finished coming up and ready
to process mailbox events.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This data storage for SW emulated MAC addresses is unlikely to ever be used
so pull it.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When VFs are allocated (as indicated by adapter->num_vfs is non-zero) then
the PF pool is no longer zero.  Instead it will be the same as the number
of VFs allocated.  When setting the VLVF entry for the PF we need to use
the correct pool otherwise the PF will get VLAN packets from the wire
because the packet will pass VFTA filtering and the PF has the default
pool, but it will not get VLAN packets from the VFs because it has
not set the correct pool bit in the VLVF entry.
Signed-off-by: NGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Pages are posted to the rxq in such a way that more than one frag
can share the page. The last frag that uses the page unmaps the
page.  In the case when a page is not fully used (due to lack of space in rxq)
the last frag that uses the page is not being set as a "last_page_user";
instead, the next frag in the rxq is incorrectly being set.

The fix has also been tested on ppc64 with 64k pages...
Signed-off-by: NSathya Perla <sathyap@serverengines.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NSarveshwar Bandi <sarveshwarb@serverengines.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The ddr dma ethtool self test needs to be performed even when ETH_TEST_FL_OFFLINE is not set.
Signed-off-by: NSarveshwar Bandi <sarveshwarb@serverengines.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NLiu Yu <yu.liu@freescale.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Old method only set tbi-phy for eth0.
Signed-off-by: NLiu Yu <yu.liu@freescale.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch rounds out the 57765 asic rev support by adding the 57765 phy
ID and entering the 57765 device IDs in the pci table.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The 57765 repurposes all the GPIOs normally used to switch power sources
when configured as a NIC device.  This patch changes the code to avoid
touching the GPIOs for this asic rev.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If the debug UART is left enabled, the LEDs will not work properly.
This patch disables the debug UART.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If a device supports MSI-X interrupts, the driver assumes TSS will be
available.  This is not true for the 57765.  This patch changes the code
so that only the default tx mailbox is initialized if TSS is not
available.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The 57765 needs the driver to supply a nic address to the jumbo RCB,
just like all other devices except the 5717.  This patch changes the
test to single out the 5717 rather than maintain a lengthy whitelist of
asic revs.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Both the 5717 and the 57765 will fail 'ethtool -t' selftests at the
memory selftest portion.  The memory map for these two devices differs
from the rest of the asic revs and each other.  This patch adds a new
memory map to use for memory selftests.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The 5717 serdes devices have a different phy register layout than all
other previous serdes devices.  This patch aborts the phy init sequence
in tg3_phy_reset() if the device is a 5717 serdes.  It also aborts the
tg3_phy_toggle_apd() operation.  Most other operations in the MII_SERDES
path are O.K.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The serdes and copper phys of the 5717 asic rev have different phy IDs.
This patch adds the serdes phy ID.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The 5717 and the 57765 have more resources at their disposal internally.
This patch tunes the driver to get better performance.  The adjustments
made here only apply to the 57765 and 5717 asic revs.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

PCIe PLL power down cannot be used if CLKREQ is enabled because data
corruption will occur.  If CLKREQ is disabled though, enabling PCIE P1
PLL power-down saves some power.
Signed-off-by: NMatt Carlson <mcarlson@broadcom.com>
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Originally patched by Neil Horman <nhorman@tuxdriver.com>

e1000e could with a jumbo frame enabled interface, and packet split disabled,
receive a packet that would overflow a single rx buffer.  While in practice
very hard to craft a packet that could abuse this, it is possible.

this is related to CVE-2009-4538
Signed-off-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
CC: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Originally From: Neil Horman <nhorman@tuxdriver.com>
Modified by: Jesse Brandeburg <jesse.brandeburg@intel.com>

Hey all-
	A security discussion was recently given:
http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html
And a patch that I submitted awhile back was brought up.  Apparently some of
their testing revealed that they were able to force a buffer fragment in e1000
in which the trailing fragment was greater than 4 bytes.  As a result the
fragment check I introduced failed to detect the fragement and a partial
invalid frame was passed up into the network stack.  I've written this patch
to correct it.  I'm in the process of testing it now, but it makes good
logical sense to me.  Effectively it maintains a per-adapter state variable
which detects a non-EOP frame, and discards it and subsequent non-EOP frames
leading up to _and_ _including_ the next positive-EOP frame (as it is by
definition the last fragment).  This should prevent any and all partial frames
from entering the network stack from e1000.
Signed-off-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
Acked-by: NNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The variable count and i are unsigned so the (<|>=)0 tests do not work.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix check to verify if a register bit is set. We have not hit this bug because
wait_for_cmd_complete() is always called with S2IO_BIT_RESET. 
Reported by Roel Kluin <roel.kluin@gmail.com>.
Signed-off-by: NRam Vepa <ram.vepa@neterion.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

I was just looking at ppp_generic, and noticed that it fairly recently
(as in the last year) got rather mangled with many spaces turned into tabs
in places they very much shouldn't have been.  I tracked it down to commit
9c705260 (ppp: ppp_mp_explode() redesign).

I am amazed if that patch passed the patch checking script.  I have no
idea what kind of weird editor setting did this, but it has to have been a
weird editor setting or a very unfortunate search and replace gone wrong.
I only found it trying to apply a patch I was playing with and wondering
why it wouldn't apply.  Then I found there were tabs in the middle of
comments that used to be spaces.

Well here is a patch that should fix it up as far as I can tell.

Purely whitespace repair.  No actual code changes.
Signed-off-by: NLen Sorensen <lsorense@csclub.uwaterloo.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This driver tweaks VR_CTL, so pull in the header for the bit defines.
Also switch to the new define name as the old one has gone away.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Checking the PHY XS MMD here is unnecessary and can give false negatives.
Signed-off-by: NBen Hutchings <bhutchings@solarflare.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit 7583605b ("ucc_geth: Fix empty
TX queue processing") fixed empty TX queue mishandling, but didn't
account another corner case: when TX queue becomes full.

Without this patch the driver will stop transmiting when TX queue
becomes full since 'bd == ugeth->txBd[txQ]' actually checks for
two things: queue empty or full.

Let's better check for NULL skb, which unambiguously signals an empty
queue.
Signed-off-by: NJiajun Wu <b06378@freescale.com>
Signed-off-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
Cc: Stable <stable@vger.kernel.org> [2.6.32]
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit 541cd3ee ("phylib: Fix deadlock
on resume") caused TI DaVinci EMAC ethernet driver to oops upon resume:

 PM: resume of devices complete after 237.098 msecs
 Restarting tasks ... done.
 kernel BUG at kernel/workqueue.c:354!
 Unable to handle kernel NULL pointer dereference at virtual address 00000000
 [...]
 Backtrace:
 [<c002c598>] (__bug+0x0/0x2c) from [<c0052a54>] (queue_delayed_work_on+0x74/0xf8)
 [<c00529e0>] (queue_delayed_work_on+0x0/0xf8) from [<c0052b30>] (queue_delayed_work+0x2c/0x30)

The oops pops up because TI DaVinci EMAC driver detaches PHY on
suspend and attaches it back on resume. Attaching makes phylib call
phy_start_machine() that initializes a workqueue. On the other hand,
PHY's resume routine will call phy_start_machine() again, and that
will cause the oops since we just destroyed the already scheduled
workqueue.

This patch fixes the issue by moving workqueue initialization to
phy_device_create().

p.s. We don't see this oops with ucc_geth and gianfar drivers because
they perform a fine-grained suspend, i.e. they just stop the PHYs
without detaching.
Reported-by: NSekhar Nori <nsekhar@ti.com>
Signed-off-by: NAnton Vorontsov <avorontsov@ru.mvista.com>
Tested-by: NSekhar Nori <nsekhar@ti.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Yasuhiro ABE <yadiary@gmail.com> reported success in sourceforge zd1211-dev list.
The device is a NEC Aterm WL54GU usb wireless stick.

The brand and retail product name
    NEC, Aterm PA-WL54GU
The USB ID's (duh)
    ID 0409:0248
The chip ID string
    zd1211rw 1-1:1.0: zd1211b chip 0409:0248 v4810 high 00-1b-8b AL2230S_RF pa0 g--N-
The FCC ID
    unknown
Signed-off-by: NHin-Tak Leung <htl10@users.sourceforge.net>
Signed-off-by: NYasuhiro ABE <yadiary@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

A long time ago, a user reported several crashes due to
data corruptions which are likely the result of a
not-100%-supported, or faulty? PCI bridge.
( http://patchwork.kernel.org/patch/53004/ )

This patch fixes entry #1.
"1.  p54p_check_rx_ring - skb_over_panic: Under a ping flood
or just left running for a bit would panic with a skb_over_panic."
As described in the mail: The invalid frame length causes
skb_put to bailout and trigger a crash.

Note:
Simply dropping the frame is problematic, because if its content
contains a tx feedback we would lose some portion of the device
memory space.... And the driver/mac80211 should handle all other
invalid data.
Reported-by: NQuintin Pitts <geek4linux@gmail.com>
Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Similar to 6000 and 1000 series, RTS/CTS is the recommended protection
mechanism for 5000 series in HT mode based on the HW design.

Using RTS/CTS will better protect the inner exchange from interference,
especially in highly-congested environment, it also prevent uCode encounter
TX FIFO underrun and other HT mode related performance issues.
Signed-off-by: NWey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NReinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The variable qdev is initialized twice to the same (side effect-free)
expression.  Drop one initialization.

A simplified version of the semantic match that finds this problem is:
(http://coccinelle.lip6.fr/)

// <smpl>
@forall@
idexpression *x;
identifier f!=ERR_PTR;
@@

x = f(...)
... when != x
(
x = f(...,<+...x...+>,...)
|
* x = f(...)
)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

MTU changes, ring size changes, etc cause the chip to be reset and the
statisctics flushed.  To keep track of the accumulated statistics, we
add code to save the whole statistics block before reset.  We also
modify the macros and statistics functions to return the sum of the
saved and current counters.

Based on original patch by Breno Leitao <leitao@linux.vnet.ibm.com>
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Refine the statistics macros by passing in just the name of the
counter field.  This makes it a lot easier and cleaner to add
counters saved before the last reset in the next patch.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

__net_init/__net_exit are apparently not going away, so use them
to full extent.

In some cases __net_init was removed, because it was called from
__net_exit code.
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>