From 209261c019f56d77f6a0cc38048e9a6f25867589 Mon Sep 17 00:00:00 2001 From: Grant Grundler Date: Sun, 23 Mar 2008 23:23:10 -0600 Subject: [PATCH 1/9] [netdrvr] tulip_read_eeprom fixes for BUG 4420 If "location" is > "addr_len" bits, the high bits of location would interfere with the READ_CMD sent to the eeprom controller. A patch was submitted to bug: http://bugzilla.kernel.org/show_bug.cgi?id=4420 which simply truncated the "location", read whatever was in "location modulo addr_len", and returned that value. That avoids confusing the eeprom but seems like the wrong solution to me. Correct would be to not read beyond "1 << addr_len" address of the eeprom. I am submitting two changes to implement this: 1) tulip_read_eeprom will return zero (since we can't return -EINVAL) if this is attempted (defensive programming). 2) In tulip_core.c, fix the tulip_read_eeprom caller so they don't iterate past addr_len bits and make sure the entire tp->eeprom[] array is cleared. I konw we don't strictly need both. I would prefer both in the tree since it documents the issue and provides a second "defense" from the bug from creeping back in. Signed-off-by: Grant Grundler Signed-off-by: Jeff Garzik --- drivers/net/tulip/eeprom.c | 6 ++++++ drivers/net/tulip/tulip_core.c | 7 ++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c index 206918bad539..da2206f6021d 100644 --- a/drivers/net/tulip/eeprom.c +++ b/drivers/net/tulip/eeprom.c @@ -343,6 +343,12 @@ int __devinit tulip_read_eeprom(struct net_device *dev, int location, int addr_l void __iomem *ee_addr = tp->base_addr + CSR9; int read_cmd = location | (EE_READ_CMD << addr_len); + /* If location is past the end of what we can address, don't + * read some other location (ie truncate). Just return zero. + */ + if (location > (1 << addr_len) - 1) + return 0; + iowrite32(EE_ENB & ~EE_CS, ee_addr); iowrite32(EE_ENB, ee_addr); diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c index ed600bf56e78..82f404b76d81 100644 --- a/drivers/net/tulip/tulip_core.c +++ b/drivers/net/tulip/tulip_core.c @@ -1437,6 +1437,7 @@ static int __devinit tulip_init_one (struct pci_dev *pdev, EEPROM. */ ee_data = tp->eeprom; + memset(ee_data, 0, sizeof(tp->eeprom)); sum = 0; if (chip_idx == LC82C168) { for (i = 0; i < 3; i++) { @@ -1458,8 +1459,12 @@ static int __devinit tulip_init_one (struct pci_dev *pdev, /* A serial EEPROM interface, we read now and sort it out later. */ int sa_offset = 0; int ee_addr_size = tulip_read_eeprom(dev, 0xff, 8) & 0x40000 ? 8 : 6; + int ee_max_addr = ((1 << ee_addr_size) - 1) * sizeof(u16); - for (i = 0; i < sizeof(tp->eeprom); i+=2) { + if (ee_max_addr > sizeof(tp->eeprom)) + ee_max_addr = sizeof(tp->eeprom); + + for (i = 0; i < ee_max_addr ; i += sizeof(u16)) { u16 data = tulip_read_eeprom(dev, i/2, ee_addr_size); ee_data[i] = data & 0xff; ee_data[i + 1] = data >> 8; From 47df976c4ef1456b39b59caf4b8fc64f77e0e5b9 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Fri, 28 Mar 2008 22:25:29 +0100 Subject: [PATCH 2/9] dm9601: Fix multicast hash table handling The loop forgot to walk the net->mc_list list, so only the first multicast address was programmed into the hash table. Signed-off-by: Jeff Garzik --- drivers/net/usb/dm9601.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c index 0343b00cf1fd..01660f68943a 100644 --- a/drivers/net/usb/dm9601.c +++ b/drivers/net/usb/dm9601.c @@ -354,7 +354,7 @@ static void dm9601_set_multicast(struct net_device *net) struct dev_mc_list *mc_list = net->mc_list; int i; - for (i = 0; i < net->mc_count; i++) { + for (i = 0; i < net->mc_count; i++, mc_list = mc_list->next) { u32 crc = ether_crc(ETH_ALEN, mc_list->dmi_addr) >> 26; hashes[crc >> 3] |= 1 << (crc & 0x7); } From 1424fd904c5424922f7403a21ad6419ae7e7c76e Mon Sep 17 00:00:00 2001 From: David Brownell Date: Fri, 28 Mar 2008 14:50:26 -0700 Subject: [PATCH 3/9] drivers/net/usb/pegasus.c: remove in_atomic() check Remove superfluous in-atomic() check; ethtool MII ops are called from task context. Signed-off-by: David Brownell Cc: Greg KH Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/usb/pegasus.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index d1ed68a11e70..b588c890ea70 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -1128,12 +1128,8 @@ pegasus_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd) { pegasus_t *pegasus; - if (in_atomic()) - return 0; - pegasus = netdev_priv(dev); mii_ethtool_gset(&pegasus->mii, ecmd); - return 0; } From f70e550df83f9eb98b342257aa589860630eae41 Mon Sep 17 00:00:00 2001 From: Sreenivasa Honnur Date: Fri, 28 Mar 2008 17:35:36 -0400 Subject: [PATCH 4/9] S2io: Version update for Tx completion patch - Updated version number. - Resubmitting with correct version update. - this patch to be applied for upstream-davem branch Signed-off-by: Surjit Reang Signed-off-by: Sreenivasa Honnur Signed-off-by: Jeff Garzik --- drivers/net/s2io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c index 3c915b82e199..c082cf0b1ac6 100644 --- a/drivers/net/s2io.c +++ b/drivers/net/s2io.c @@ -84,7 +84,7 @@ #include "s2io.h" #include "s2io-regs.h" -#define DRV_VERSION "2.0.26.15-2" +#define DRV_VERSION "2.0.26.20" /* S2io Driver name & version. */ static char s2io_driver_name[] = "Neterion"; From 5beaf7d6f89c13b2414656e994d3ee6350e99d3a Mon Sep 17 00:00:00 2001 From: Michael Ellerman Date: Fri, 28 Mar 2008 12:17:33 +1100 Subject: [PATCH 5/9] Make pasemi_mac.c depend on PPC_PASEMI to prevent link errors drivers/net/pasemi_mac.c is enabled by CONFIG_PASEMI_MAC, which depends on PPC64 && PCI. However pasemi_mac.c uses several routines that are only built when PPC_PASEMI is selected. This can lead to an unbuildable config: ERROR: ".pasemi_dma_start_chan" [drivers/net/pasemi_mac.ko] undefined! So make CONFIG_PASEMI_MAC depend on PPC_PASEMI instead of PPC64. Signed-off-by: Michael Ellerman Signed-off-by: Jeff Garzik --- drivers/net/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index fe7b5ec09708..3a0b20afec7b 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -2635,7 +2635,7 @@ config NIU config PASEMI_MAC tristate "PA Semi 1/10Gbit MAC" - depends on PPC64 && PCI + depends on PPC_PASEMI && PCI select PHYLIB select INET_LRO help From e66f4168d133b9d848dead4c031d11a84caec6dc Mon Sep 17 00:00:00 2001 From: Valentine Barshak Date: Thu, 27 Mar 2008 17:43:57 +0300 Subject: [PATCH 6/9] ibm_newemac: emac_tx_csum typo fix Move the "&& skb->ip_summed == CHECKSUM_PARTIAL" part out of emac_has_feature parameters. Signed-off-by: Valentine Barshak Signed-off-by: Jeff Garzik --- drivers/net/ibm_newemac/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c index 0789802d59ed..378a23963495 100644 --- a/drivers/net/ibm_newemac/core.c +++ b/drivers/net/ibm_newemac/core.c @@ -1242,8 +1242,8 @@ static int emac_close(struct net_device *ndev) static inline u16 emac_tx_csum(struct emac_instance *dev, struct sk_buff *skb) { - if (emac_has_feature(dev, EMAC_FTR_HAS_TAH && - skb->ip_summed == CHECKSUM_PARTIAL)) { + if (emac_has_feature(dev, EMAC_FTR_HAS_TAH) && + (skb->ip_summed == CHECKSUM_PARTIAL)) { ++dev->stats.tx_packets_csum; return EMAC_TX_CTRL_TAH_CSUM; } From 51a491c92e7a8e4c2fd9ffdb1f046429300a4619 Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Wed, 26 Mar 2008 18:21:58 -0700 Subject: [PATCH 7/9] Blackfin EMAC Driver: delete unused variables to fixup gcc warnings Signed-off-by: Mike Frysinger Signed-off-by: Bryan Wu Signed-off-by: Jeff Garzik --- drivers/net/bfin_mac.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c index c993a32b3f50..26b2dd5016cd 100644 --- a/drivers/net/bfin_mac.c +++ b/drivers/net/bfin_mac.c @@ -575,7 +575,6 @@ adjust_head: static int bf537mac_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) { - struct bf537mac_local *lp = netdev_priv(dev); unsigned int data; current_tx_ptr->skb = skb; @@ -634,7 +633,6 @@ out: static void bf537mac_rx(struct net_device *dev) { struct sk_buff *skb, *new_skb; - struct bf537mac_local *lp = netdev_priv(dev); unsigned short len; /* allocate a new skb for next time receive */ From c6cbcad1ec0dbb08b640d1ca166a42dcb4fb8faa Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Fri, 28 Mar 2008 14:41:15 -0700 Subject: [PATCH 8/9] usb net: asix does not really need 10/100mbit The asix usb driver currently depends on NET_ETHERNET which means you cannot enable this driver if you only have 1000mbit enabled in your kernel. Since there is no real dependency between the NET_ETHERNET portion and the asix driver, simply drop it. Signed-off-by: Mike Frysinger Cc: Greg KH Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/usb/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig index a12c9c41b217..0604f3faf043 100644 --- a/drivers/net/usb/Kconfig +++ b/drivers/net/usb/Kconfig @@ -129,7 +129,7 @@ config USB_USBNET config USB_NET_AX8817X tristate "ASIX AX88xxx Based USB 2.0 Ethernet Adapters" - depends on USB_USBNET && NET_ETHERNET + depends on USB_USBNET select CRC32 default y help From bd6ca6375b9f18f40e814f391d9d1abaa916bc72 Mon Sep 17 00:00:00 2001 From: Ingo Molnar Date: Fri, 28 Mar 2008 14:41:30 -0700 Subject: [PATCH 9/9] forcedeth: fix locking bug with netconsole While using netconsole on forcedeth, lockdep noticed the following locking bug: ================================= [ INFO: inconsistent lock state ] 2.6.24-rc6 #6 Signed-off-by: Ingo Molnar --------------------------------- inconsistent {softirq-on-W} -> {in-softirq-W} usage. udevd/719 [HC0[0]:SC1[1]:HE1:SE0] takes: (_xmit_ETHER){-+..}, at: [] dev_watchdog+0x1c/0xb9 {softirq-on-W} state was registered at: [] mark_held_locks+0x4e/0x66 [] trace_hardirqs_on+0xfe/0x136 [] _spin_unlock_irq+0x22/0x42 [] nv_start_xmit_optimized+0x347/0x37a [] netpoll_send_skb+0xa4/0x147 [] netpoll_send_udp+0x238/0x242 [] write_msg+0x6d/0x9b [] __call_console_drivers+0x4e/0x5a [] _call_console_drivers+0x57/0x5b [] release_console_sem+0x11c/0x1b9 [] register_console+0x1eb/0x1f3 [] init_netconsole+0x119/0x15f [] kernel_init+0x147/0x294 [] kernel_thread_helper+0x7/0x10 [] 0xffffffff irq event stamp: 950 hardirqs last enabled at (950): [] _spin_unlock_irq+0x22/0x42 hardirqs last disabled at (949): [] _spin_lock_irq+0xc/0x38 softirqs last enabled at (0): [] copy_process+0x375/0x126d softirqs last disabled at (947): [] do_softirq+0x61/0xc6 other info that might help us debug this: no locks held by udevd/719. stack backtrace: Pid: 719, comm: udevd Not tainted 2.6.24-rc6 #6 [] show_trace_log_lvl+0x12/0x25 [] show_trace+0xd/0x10 [] dump_stack+0x57/0x5f [] print_usage_bug+0x10a/0x117 [] mark_lock+0x121/0x402 [] __lock_acquire+0x3d1/0xb64 [] lock_acquire+0x4e/0x6a [] _spin_lock+0x23/0x32 [] dev_watchdog+0x1c/0xb9 [] run_timer_softirq+0x133/0x193 [] __do_softirq+0x78/0xed [] do_softirq+0x61/0xc6 ======================= eth1: link down The fix is to disable/restore irqs instead of disable/enable. Signed-off-by: Ingo Molnar Cc: Ayaz Abdulla Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/forcedeth.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 6f7e3fde9e7c..980c2c229a71 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -1854,6 +1854,7 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev) struct ring_desc* start_tx; struct ring_desc* prev_tx; struct nv_skb_map* prev_tx_ctx; + unsigned long flags; /* add fragments to entries count */ for (i = 0; i < fragments; i++) { @@ -1863,10 +1864,10 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev) empty_slots = nv_get_empty_tx_slots(np); if (unlikely(empty_slots <= entries)) { - spin_lock_irq(&np->lock); + spin_lock_irqsave(&np->lock, flags); netif_stop_queue(dev); np->tx_stop = 1; - spin_unlock_irq(&np->lock); + spin_unlock_irqrestore(&np->lock, flags); return NETDEV_TX_BUSY; } @@ -1929,13 +1930,13 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev) tx_flags_extra = skb->ip_summed == CHECKSUM_PARTIAL ? NV_TX2_CHECKSUM_L3 | NV_TX2_CHECKSUM_L4 : 0; - spin_lock_irq(&np->lock); + spin_lock_irqsave(&np->lock, flags); /* set tx flags */ start_tx->flaglen |= cpu_to_le32(tx_flags | tx_flags_extra); np->put_tx.orig = put_tx; - spin_unlock_irq(&np->lock); + spin_unlock_irqrestore(&np->lock, flags); dprintk(KERN_DEBUG "%s: nv_start_xmit: entries %d queued for transmission. tx_flags_extra: %x\n", dev->name, entries, tx_flags_extra); @@ -1971,6 +1972,7 @@ static int nv_start_xmit_optimized(struct sk_buff *skb, struct net_device *dev) struct ring_desc_ex* prev_tx; struct nv_skb_map* prev_tx_ctx; struct nv_skb_map* start_tx_ctx; + unsigned long flags; /* add fragments to entries count */ for (i = 0; i < fragments; i++) { @@ -1980,10 +1982,10 @@ static int nv_start_xmit_optimized(struct sk_buff *skb, struct net_device *dev) empty_slots = nv_get_empty_tx_slots(np); if (unlikely(empty_slots <= entries)) { - spin_lock_irq(&np->lock); + spin_lock_irqsave(&np->lock, flags); netif_stop_queue(dev); np->tx_stop = 1; - spin_unlock_irq(&np->lock); + spin_unlock_irqrestore(&np->lock, flags); return NETDEV_TX_BUSY; } @@ -2059,7 +2061,7 @@ static int nv_start_xmit_optimized(struct sk_buff *skb, struct net_device *dev) start_tx->txvlan = 0; } - spin_lock_irq(&np->lock); + spin_lock_irqsave(&np->lock, flags); if (np->tx_limit) { /* Limit the number of outstanding tx. Setup all fragments, but @@ -2085,7 +2087,7 @@ static int nv_start_xmit_optimized(struct sk_buff *skb, struct net_device *dev) start_tx->flaglen |= cpu_to_le32(tx_flags | tx_flags_extra); np->put_tx.ex = put_tx; - spin_unlock_irq(&np->lock); + spin_unlock_irqrestore(&np->lock, flags); dprintk(KERN_DEBUG "%s: nv_start_xmit_optimized: entries %d queued for transmission. tx_flags_extra: %x\n", dev->name, entries, tx_flags_extra);