Clearing drvdata in ->remove_one causes NULL pointer deference.  Clear
drvdata only in ata_host_release() after all resources are freed.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch fixes a possible race that leads to double freeing an idr index.
 When the master begin to close, release_dev() is called and then
pty_close() is called:

        if (tty->driver->close)
                tty->driver->close(tty, filp);

This is done without helding any locks other than BKL.  Inside pty_close(),
being a master close, the devpts entry will be removed:

#ifdef CONFIG_UNIX98_PTYS
                if (tty->driver == ptm_driver)
                        devpts_pty_kill(tty->index);
#endif

But devpts_pty_kill() will call get_node() that may sleep while waiting for
&devpts_root->d_inode->i_sem.  When this happens and the slave is being
opened, tty_open() just found the driver and index:

        driver = get_tty_driver(device, &index);
        if (!driver) {
                mutex_unlock(&tty_mutex);
                return -ENODEV;
        }

This part of the code is already protected under tty_mute.  The problem is
that the slave close already got an index.  Then init_dev() is called and
blocks waiting for the same &devpts_root->d_inode->i_sem.

When the master close resumes, it removes the devpts entry, and the
relation between idr index and the tty is gone.  The master then sleeps
waiting for the tty_mutex on release_dev().

Slave open resumes and found no tty for that index.  As result, a NULL tty
is returned and init_dev() doesn't flow to fast_track:

        /* check whether we're reopening an existing tty */
        if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
                tty = devpts_get_tty(idx);
                if (tty && driver->subtype == PTY_TYPE_MASTER)
                        tty = tty->link;
        } else {
                tty = driver->ttys[idx];
        }
        if (tty) goto fast_track;

The result of this, is that a new tty will be created and init_dev() returns
sucessfull. After returning, tty_mutex is dropped and master close may resume.

Master close finds it's the only use and both sides are closing, then releases
the tty and the index. At this point, the idr index is free, but slave still
has it.

Slave open then calls pty_open() and finds that tty->link->count is 0,
because there's no master and returns error.  Then tty_open() calls
release_dev() which executes without any warning, as it was a case of last
slave close when the master is already closed (master->count == 0,
slave->count == 1).  The tty is then released with the already released idr
index.

This normally would only issue a warning on idr_remove() but in case of a
customer's critical application, it's never too simple:

thread1: opens master, gets index X
thread1: begin closing master
thread2: begin opening slave with index X
thread1: finishes closing master, index X released
thread3: opens master, gets index X, just released
thread2: fails opening slave, releases index X         <----
thread4: opens master, gets index X, init_dev() then find an already in use
	 and healthy tty and fails

If no more indexes are released, ptmx_open() will keep failing, as the
first free index available is X, and it will make init_dev() fail because
you're trying to "reopen a master" which isn't valid.

The patch notices when this race happens and make init_dev() fail
imediately.  The init_dev() function is called with tty_mutex held, so it's
safe to continue with tty till the end of function because release_dev()
won't make any further changes without grabbing the tty_mutex.

Without the patch, on some machines it's possible get easily idr warnings
like this one:

idr_remove called for id=15 which is not allocated.
 [<c02555b9>] idr_remove+0x139/0x170
 [<c02a1b62>] release_mem+0x182/0x230
 [<c02a28e7>] release_dev+0x4b7/0x700
 [<c02a0ea7>] tty_ldisc_enable+0x27/0x30
 [<c02a1e64>] init_dev+0x254/0x580
 [<c02a0d64>] check_tty_count+0x14/0xb0
 [<c02a4f05>] tty_open+0x1c5/0x340
 [<c02a4d40>] tty_open+0x0/0x340
 [<c017388f>] chrdev_open+0xaf/0x180
 [<c017c2ac>] open_namei+0x8c/0x760
 [<c01737e0>] chrdev_open+0x0/0x180
 [<c0167bc9>] __dentry_open+0xc9/0x210
 [<c0167e2c>] do_filp_open+0x5c/0x70
 [<c0167a91>] get_unused_fd+0x61/0xd0
 [<c0167e93>] do_sys_open+0x53/0x100
 [<c0167f97>] sys_open+0x27/0x30
 [<c010303b>] syscall_call+0x7/0xb

using this test application available on:
 http://www.ruivo.org/~aris/pty_sodomizer.cSigned-off-by: NAristeu Sergio Rozanski Filho <aris@ruivo.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The CAPI trace debug functions were using a fixed size buffer, which can be
overflowed if wrong formatted CAPI messages were sent to the kernel capi
layer.  The code was also not protected against multiple callers.  This fix
bug 8028.

Additionally the patch make the CAPI trace functions optional.
Signed-off-by: NKarsten Keil <kkeil@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

ps3: Introduce CONFIG_PS3_ADVANCED, as suggested by Roman Zippel, and use
it to control questions about PS3 subsystems that may not be obvious for
the casual user.

This gets rid of the following warning on non-powerpc platforms: |
drivers/video/Kconfig:1604:warning: 'select' used by config symbol 'FB_PS3'
refer to undefined symbol 'PS3_PS3AV'
Signed-off-by: NGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Acked-by: NGeoff Levand <geoffrey.levand@am.sony.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Since the bay driver depends on the dock driver for proper notification,
make this driver depend on the dock driver.
Signed-off-by: NKristen Carlson Accardi <kristen.c.accardi@intel.com>
Acked-by: NLen Brown <lenb@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

a) Remove #define acrobatics that have become unnecessary by the move of
   asyncdata.o into the common part.

b) Correct the rule for building the common part into the kernel when
   some or all hardware specific parts are built as modules.
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Cc: Adrian Bunk <bunk@stusta.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix an oops on the rtc_device_unregister() path by waiting until the last
moment before nulling the rtc->ops vector.  Fix some potential oopses by
having the rtc_class_open()/rtc_class_close() interface increase the RTC's
reference count while an RTC handle is available outside the RTC framework.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

i.e. one or more drives can be added and the array will re-stripe
while on-line.

Most of the interesting work was already done for raid5.  This just extends it
to raid6.

mdadm newer than 2.6 is needed for complete safety, however any version of
mdadm which support raid5 reshape will do a good enough job in almost all
cases (an 'echo repair > /sys/block/mdX/md/sync_action' is recommended after a
reshape that was aborted and had to be restarted with an such a version of
mdadm).
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

An error always aborts any resync/recovery/reshape on the understanding that
it will immediately be restarted if that still makes sense.  However a reshape
currently doesn't get restarted.  With this patch it does.

To avoid restarting when it is not possible to do work, we call into the
personality to check that a reshape is ok, and strengthen raid5_check_reshape
to fail if there are too many failed devices.

We also break some code out into a separate function: remove_and_add_spares as
the indent level for that code was getting crazy.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The mddev and queue might be used for another array which does not set these,
so they need to be cleared.
Signed-off-by: NNeilBrown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

md tries to warn the user if they e.g.  create a raid1 using two partitions of
the same device, as this does not provide true redundancy.

However it also warns if a raid0 is created like this, and there is nothing
wrong with that.

At the place where the warning is currently printer, we don't necessarily know
what level the array will be, so move the warning from the point where the
device is added to the point where the array is started.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

- Use kernel_fpu_begin() and kernel_fpu_end()
- Use boot_cpu_has() for feature testing even in userspace
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

There are two errors that can lead to recovery problems with raid10
when used in 'far' more (not the default).

Due to a '>' instead of '>=' the wrong block is located which would result in
garbage being written to some random location, quite possible outside the
range of the device, causing the newly reconstructed device to fail.

The device size calculation had some rounding errors (it didn't round when it
should) and so recovery would go a few blocks too far which would again cause
a write to a random block address and probably a device error.

The code for working with device sizes was fairly confused and spread out, so
this has been tided up a bit.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If register_blkdev() or alloc-disk fail in mm_init() after
pci_register_driver() succeeds, then mm_pci_driver is not unregistered
properly:

Cc: Philip Guo <pg@cs.stanford.edu>
Signed-off-by: NNeil Brown <neilb@suse.de>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Cc: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Compiler warning spots real error!

The function do_rom_fast_read called in do_rom_fast_write can fail
and leave data1 unset. This causes a compile warning.
The correct thing is to propagate the error out.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Bob Tracy <rct@gherkin.frus.com> reported that the addition of support
for Aculab E1/T1 cPCI carrier cards broke detection of vanilla natsemi
cards.  This patch fixes that: the problem is that the driver-specific
ta in the PCI device table is an index into a second table and this
had not been updated for the vanilla cards.

This patch fixes the problem minimally.
Signed-Off-By: NMark Brown <broonie@sirena.org.uk>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Chelsio without NAPI enabled has been broken (won't compile) since
3de00b89 ("chelsio: NAPI speed improvement"):

    drivers/net/chelsio/sge.c: In function `t1_interrupt`:
    drivers/net/chelsio/sge.c:1716: error: `Q` undeclared (first use in this function)

The change below seems to add back in the declaration and
initialization of `Q` that was removed by mistake, and at least makes
the driver compile for me, although I have no hardware and hence no
way to test whether this actually works.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Populate Rx free list with pages.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Improve the traffic recovery after the HW ran out of response queue entries.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Offload packets may be DMAed long after their SGE Tx descriptors are done
so they must remain mapped until they are freed rather than until their
descriptors are freed.  Unmap such packets through an skb destructor.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Update FW version to 3.2
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Clean up some private ioctls.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

sysfs attributes are now managed per port, no longer per adapter.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Restore in s2io_reset, the mac address assigned during s2io_open.
  Earlier, it was getting overwritten to the factory default (read from the
  eeprom) and subsequently dropping received frames.

- Fixed the typo in calling rtnl_unlock in s2io_set_link function.
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Enhanced Statistics are supported only for Xframe II (Herculas) card. Add
  condition check such Enhanced statistics will included only in the case of
  Xframe II card.
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Turning off LED for LINK_DOWN notification
- Return from rxd_owner_bit_reset function if call to set_rxd_buffer_pointer
  fails with ENOMEM
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Added code to not to strip vlan tag when driver is in promiscuous mode
- Added module loadable parameter 'vlan_tag_strip" through which user can
  enable or disable vlan stripping irrespective of mode
  ( promiscuous or non-promiscuous ).
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Optimized delay to wait for command completion so as to reduce the
  initialization wait time.
- Disable differentiated services steering. By default RMAC is configured to
  steer traffic with certain DS codes to other queues. Driver must initialize
  the DS memory to 0 to make sure that DS steering will not be used by default.
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

- Added debug statements to print a debug message if the MSI/MSI-X vector (or)
  data is zero.

- This patch removes the code that will enable NAPI for the case of single
  ring and MSI-X / MSI case. There are some issue in the enabling NAPI with
  MSI/MSI-X.  So we are turning off NAPI in the case of MSI/MSI-X.
Signed-off-by: NSivakumar Subramani <sivakumar.subramani@neterion.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: NBenjamin Li <benjamin.li@qlogic.com>
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

To reproduce this panic consistently, we run an intensive network
application like 'netperf'. After waiting for a couple of seconds,
you will see a stack trace and a kernel panic where we are calling
pci_unmap_single() in ql_poll().

Changes:
1)  Check the flags on the Response MAC IO Control block to check for
errors
2)  Ensure that if we are on the 4022 we only use one segment
3)  Before, we were reading the memory mapped producer index register
everytime we iterated in the loop when clearing the queue.  We should
only be iterating to a known point, not as the producer index
is being updated.
Signed-off-by: NBenjamin Li <benjamin.li@qlogic.com>
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

To Reproduce the Problem:
To reproduce this panic consistently, we run an intensive network
application like 'netperf' and then switch to a different console.
After waiting for a couple of seconds, you will see a tx reset has occured.

Reason:
We enable interrupts even if we were not running.

Solution:
Now we will enable interrupts only after we are ready to give up the poll
routine.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

qla3xxx: Check return code from pci_map_single() in ql_release_to_lrg_buf_free_list(), ql_populate_free_queue(), ql_alloc_large_buffers(), and ql3xxx_send()

pci_map_single() could fail.  We need to properly check the return
code from pci_map_single().  If we can not properly map this address,
then we should cleanup and return the proper return code.
Signed-off-by: NBenjamin Li <benjamin.li@qlogic.com>
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The scatter/gather lists were not being build correctly.  When
large frames spanned several buffers the chip would panic.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This change removes use of constants for rx buffer queue size
and instead calculates the queue length based on what he MTU
is set to.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This network device driver shares the same hardware as the qla4xxx
iSCSI driver. Changing the MTU via the device interface will
cause qla4xxx to crash as there is no way to make notification.
Users wishing to change the MTU must do so using an iSCSI
utility such as Qlogic SanSurfer. This forces the user to
unload/reload this network device driver after the MTU
value has been changed in flash.
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

1) Fix deadlock issue when in QL_RESET_ACTIVE state and traversing
   through the Link State Machine
2) Fix deadlock issue when ethtool would call ql_get_settings()
3) Fix deadlock issue when adaptor is ifup'ed but adaptor fails to initialize
Signed-off-by: NBenjamin Li <benjamin.li@qlogic.com>
Signed-off-by: NRon Mercer <ron.mercer@qlogic.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>