From 4c93566e2a61b48ef071a8d8a8fa9904c83a668e Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Mon, 21 Jan 2008 23:20:58 -0800 Subject: [TULIP] DMFE: Fix SROM parsing regression. Changeset 16b110c3fd760620b4a787db6ed512fe531ab1b5 (dmfe warning fix) bothed up the offsets read from the SROM so that it doesn't read the same datums it used to. The change made transformations like turning: "srom + 34" into "(__le32 *)srom + 34/4" which doesn't work because 4 does not divide evenly into 34 so we're using a different pointer offset than in the original code. I've changed theses cases in dmfe_parse_srom() to consistently use "(type *)(srom + offset)" preserving the offsets from the original code. Signed-off-by: David S. Miller --- drivers/net/tulip/dmfe.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c index b4891ca..6562004 100644 --- a/drivers/net/tulip/dmfe.c +++ b/drivers/net/tulip/dmfe.c @@ -1909,7 +1909,7 @@ static void dmfe_parse_srom(struct dmfe_board_info * db) if ( ( (int) srom[18] & 0xff) == SROM_V41_CODE) { /* SROM V4.01 */ /* Get NIC support media mode */ - db->NIC_capability = le16_to_cpup((__le16 *)srom + 34/2); + db->NIC_capability = le16_to_cpup((__le16 *) (srom + 34)); db->PHY_reg4 = 0; for (tmp_reg = 1; tmp_reg < 0x10; tmp_reg <<= 1) { switch( db->NIC_capability & tmp_reg ) { @@ -1921,8 +1921,8 @@ static void dmfe_parse_srom(struct dmfe_board_info * db) } /* Media Mode Force or not check */ - dmfe_mode = le32_to_cpup((__le32 *)srom + 34/4) & - le32_to_cpup((__le32 *)srom + 36/4); + dmfe_mode = (le32_to_cpup((__le32 *) (srom + 34)) & + le32_to_cpup((__le32 *) (srom + 36))); switch(dmfe_mode) { case 0x4: dmfe_media_mode = DMFE_100MHF; break; /* 100MHF */ case 0x2: dmfe_media_mode = DMFE_10MFD; break; /* 10MFD */ -- cgit v1.1 From a781cf94e6dcc09bf13e548298185d916d9ff3c8 Mon Sep 17 00:00:00 2001 From: Reinette Chatre Date: Mon, 21 Jan 2008 10:08:31 -0800 Subject: iwlwifi: fix possible read attempt on ucode that is not available This fixes a NULL pointer dereference that can occur when the ucode is not loaded at the time __iwl_up is called. The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid= Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl3945-base.c | 5 +++++ drivers/net/wireless/iwlwifi/iwl4965-base.c | 5 +++++ 2 files changed, 10 insertions(+) (limited to 'drivers') diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c index 1a6b0e0..0b3ec7e 100644 --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c @@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c index 6cd57c2..15a45f4 100644 --- a/drivers/net/wireless/iwlwifi/iwl4965-base.c +++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c @@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); -- cgit v1.1 From ebc71647309539aaf9088f4e41b9f364cce8f7eb Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Tue, 4 Dec 2007 22:58:41 +0100 Subject: sis190: add cmos ram access code for the SiS19x/968 chipset pair More work is needed to handle correctly the PHY of the new devices when connected to a 10Mb link but this change already helps some users as is. Fix for: http://bugzilla.kernel.org/show_bug.cgi?id=9467 Signed-off-by: Francois Romieu Cc: K.M. Liu Cc: J. Gleacher Cc: Alexandre Penasso Teixeira Cc: Arliton Rocha Cc: Juan Jose Pablos Cc: Wipat Srutiprom --- drivers/net/sis190.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'drivers') diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 7eab072..c63f484 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -1549,28 +1549,31 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev, } /** - * sis190_get_mac_addr_from_apc - Get MAC address for SiS965 model + * sis190_get_mac_addr_from_apc - Get MAC address for SiS96x model * @pdev: PCI device * @dev: network device to get address for * - * SiS965 model, use APC CMOS RAM to store MAC address. + * SiS96x model, use APC CMOS RAM to store MAC address. * APC CMOS RAM is accessed through ISA bridge. * MAC address is read into @net_dev->dev_addr. */ static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev, struct net_device *dev) { + static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 }; struct sis190_private *tp = netdev_priv(dev); struct pci_dev *isa_bridge; u8 reg, tmp8; - int i; + unsigned int i; net_probe(tp, KERN_INFO "%s: Read MAC address from APC.\n", pci_name(pdev)); - isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0965, NULL); - if (!isa_bridge) - isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0966, NULL); + for (i = 0; i < ARRAY_SIZE(ids); i++) { + isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, ids[i], NULL); + if (isa_bridge) + break; + } if (!isa_bridge) { net_probe(tp, KERN_INFO "%s: Can not find ISA bridge.\n", -- cgit v1.1 From 11913d30b9fb985b12835037281ae0483be59623 Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 15:55:10 +0100 Subject: sis190: remove duplicate INIT_WORK It is already done in sis190_init_one. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index c63f484..92e0eb9 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -1041,8 +1041,6 @@ static int sis190_open(struct net_device *dev) if (rc < 0) goto err_free_rx_1; - INIT_WORK(&tp->phy_task, sis190_phy_task); - sis190_request_timer(dev); rc = request_irq(dev->irq, sis190_interrupt, IRQF_SHARED, dev->name, dev); -- cgit v1.1 From 7bf3f232f7c78efee8c4d14ad9af8a5a40304916 Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 16:56:43 +0100 Subject: sis190: mdio operation failure is not correctly detected i ranges from 0 to 100 in the 'for' loop a few lines above. Reported by davem. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 92e0eb9..342a986 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -372,7 +372,7 @@ static void __mdio_cmd(void __iomem *ioaddr, u32 ctl) msleep(1); } - if (i > 999) + if (i > 99) printk(KERN_ERR PFX "PHY command failed !\n"); } -- cgit v1.1 From b334349eb4c8562fd60bc8a8bd5ba6b42f22b8ac Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 21:29:47 +0100 Subject: sis190: scheduling while atomic error sis190_tx_timeout -> sis190_hw_start -> sis190_soft_reset -> msleep *splat* PCI transactions are correctly flushed here. The msleep() is probably useless. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 342a986..b570402 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -847,10 +847,8 @@ static void sis190_soft_reset(void __iomem *ioaddr) { SIS_W32(IntrControl, 0x8000); SIS_PCI_COMMIT(); - msleep(1); SIS_W32(IntrControl, 0x0); sis190_asic_down(ioaddr); - msleep(1); } static void sis190_hw_start(struct net_device *dev) -- cgit v1.1