From 18acfa2597d57c19249346d130fc3334244557b4 Mon Sep 17 00:00:00 2001 From: Anton Vorontsov Date: Thu, 13 Nov 2008 21:26:27 +0300 Subject: [PATCH 1/5] net/ucc_geth: Fix oops in uec_get_ethtool_stats() p_{tx,rx}_fw_statistics_pram are special: they're available only when a device is open. If the device is closed, we should just fill the data with zeroes. Fixes the following oops: root@b1:~# ifconfig eth1 down root@b1:~# ethtool -S eth1 Unable to handle kernel paging request for data at address 0x00000000 Faulting instruction address: 0xc01e1dcc Oops: Kernel access of bad area, sig: 11 [#1] [...] NIP [c01e1dcc] uec_get_ethtool_stats+0x98/0x124 LR [c0287cc8] ethtool_get_stats+0xfc/0x23c Call Trace: [cfaadde0] [c0287ca8] ethtool_get_stats+0xdc/0x23c (unreliable) [cfaade20] [c0288340] dev_ethtool+0x2fc/0x588 [cfaade50] [c0285648] dev_ioctl+0x290/0x33c [cfaadea0] [c0272238] sock_ioctl+0x80/0x2ec [cfaadec0] [c00b5ae4] vfs_ioctl+0x40/0xc0 [cfaadee0] [c00b5fa8] do_vfs_ioctl+0x78/0x20c [cfaadf10] [c00b617c] sys_ioctl+0x40/0x74 [cfaadf40] [c00142d8] ret_from_syscall+0x0/0x38 [...] ---[ end trace b941007b2dfb9759 ]--- Segmentation fault p.s. While at it, also remove u64 casts, they aren't needed. Signed-off-by: Anton Vorontsov Signed-off-by: Jeff Garzik --- drivers/net/ucc_geth_ethtool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c index 85f38a6b6a49..68a7f5414133 100644 --- a/drivers/net/ucc_geth_ethtool.c +++ b/drivers/net/ucc_geth_ethtool.c @@ -323,17 +323,17 @@ static void uec_get_ethtool_stats(struct net_device *netdev, if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_HARDWARE) { base = (u32 __iomem *)&ugeth->ug_regs->tx64; for (i = 0; i < UEC_HW_STATS_LEN; i++) - data[j++] = (u64)in_be32(&base[i]); + data[j++] = in_be32(&base[i]); } if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX) { base = (u32 __iomem *)ugeth->p_tx_fw_statistics_pram; for (i = 0; i < UEC_TX_FW_STATS_LEN; i++) - data[j++] = (u64)in_be32(&base[i]); + data[j++] = base ? in_be32(&base[i]) : 0; } if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX) { base = (u32 __iomem *)ugeth->p_rx_fw_statistics_pram; for (i = 0; i < UEC_RX_FW_STATS_LEN; i++) - data[j++] = (u64)in_be32(&base[i]); + data[j++] = base ? in_be32(&base[i]) : 0; } } From 81183059e89c36f9b4c41f9332d642c2e0bff971 Mon Sep 17 00:00:00 2001 From: Andy Fleming Date: Wed, 12 Nov 2008 10:07:11 -0600 Subject: [PATCH 2/5] gianfar: Fix DMA unmap invocations We weren't unmapping DMA memory, which will break when gianfar gets used on systems with more than 32-bits of memory. Also, it's just plain wrong. Signed-off-by: Andy Fleming Signed-off-by: Jeff Garzik --- drivers/net/gianfar.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c index 83a5cb6aa23b..c4af949bf860 100644 --- a/drivers/net/gianfar.c +++ b/drivers/net/gianfar.c @@ -1407,6 +1407,10 @@ static int gfar_clean_tx_ring(struct net_device *dev) if (bdp->status & TXBD_DEF) dev->stats.collisions++; + /* Unmap the DMA memory */ + dma_unmap_single(&priv->dev->dev, bdp->bufPtr, + bdp->length, DMA_TO_DEVICE); + /* Free the sk buffer associated with this TxBD */ dev_kfree_skb_irq(priv->tx_skbuff[priv->skb_dirtytx]); @@ -1666,6 +1670,9 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit) skb = priv->rx_skbuff[priv->skb_currx]; + dma_unmap_single(&priv->dev->dev, bdp->bufPtr, + priv->rx_buffer_size, DMA_FROM_DEVICE); + /* We drop the frame if we failed to allocate a new buffer */ if (unlikely(!newskb || !(bdp->status & RXBD_LAST) || bdp->status & RXBD_ERR)) { @@ -1674,14 +1681,8 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit) if (unlikely(!newskb)) newskb = skb; - if (skb) { - dma_unmap_single(&priv->dev->dev, - bdp->bufPtr, - priv->rx_buffer_size, - DMA_FROM_DEVICE); - + if (skb) dev_kfree_skb_any(skb); - } } else { /* Increment the number of packets */ dev->stats.rx_packets++; From 7ee0fddfe05f105d3346aa8774695e7130697836 Mon Sep 17 00:00:00 2001 From: "J. K. Cliburn" Date: Tue, 11 Nov 2008 16:21:48 -0600 Subject: [PATCH 3/5] atl1e: fix broken multicast by removing unnecessary crc inversion Inverting the crc after calling ether_crc_le() is unnecessary and breaks multicast. Remove it. Tested-by: David Madore Signed-off-by: Jay Cliburn Cc: stable@kernel.org Signed-off-by: Jeff Garzik --- drivers/net/atl1e/atl1e_hw.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/net/atl1e/atl1e_hw.c b/drivers/net/atl1e/atl1e_hw.c index 8cbc1b59bd62..4a7700620119 100644 --- a/drivers/net/atl1e/atl1e_hw.c +++ b/drivers/net/atl1e/atl1e_hw.c @@ -163,9 +163,6 @@ int atl1e_read_mac_addr(struct atl1e_hw *hw) * atl1e_hash_mc_addr * purpose * set hash value for a multicast address - * hash calcu processing : - * 1. calcu 32bit CRC for multicast address - * 2. reverse crc with MSB to LSB */ u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr) { @@ -174,7 +171,6 @@ u32 atl1e_hash_mc_addr(struct atl1e_hw *hw, u8 *mc_addr) int i; crc32 = ether_crc_le(6, mc_addr); - crc32 = ~crc32; for (i = 0; i < 32; i++) value |= (((crc32 >> i) & 1) << (31 - i)); From 3b259e365998291a02488225e32b9f2b73723b3e Mon Sep 17 00:00:00 2001 From: "J. K. Cliburn" Date: Sun, 9 Nov 2008 15:05:30 -0600 Subject: [PATCH 4/5] atl1: Do not enumerate options unsupported by chip Of the various WOL options provided in include/linux/ethtool.h, the L1 NIC supports only magic packet. Remove all options except magic packet from the atl1 driver. Signed-off-by: Jay Cliburn Signed-off-by: Jeff Garzik --- drivers/net/atlx/atl1.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c index 246d92b42636..aef403d299ee 100644 --- a/drivers/net/atlx/atl1.c +++ b/drivers/net/atlx/atl1.c @@ -3404,14 +3404,8 @@ static void atl1_get_wol(struct net_device *netdev, { struct atl1_adapter *adapter = netdev_priv(netdev); - wol->supported = WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | WAKE_MAGIC; + wol->supported = WAKE_MAGIC; wol->wolopts = 0; - if (adapter->wol & ATLX_WUFC_EX) - wol->wolopts |= WAKE_UCAST; - if (adapter->wol & ATLX_WUFC_MC) - wol->wolopts |= WAKE_MCAST; - if (adapter->wol & ATLX_WUFC_BC) - wol->wolopts |= WAKE_BCAST; if (adapter->wol & ATLX_WUFC_MAG) wol->wolopts |= WAKE_MAGIC; return; @@ -3422,15 +3416,10 @@ static int atl1_set_wol(struct net_device *netdev, { struct atl1_adapter *adapter = netdev_priv(netdev); - if (wol->wolopts & (WAKE_PHY | WAKE_ARP | WAKE_MAGICSECURE)) + if (wol->wolopts & (WAKE_PHY | WAKE_UCAST | WAKE_MCAST | WAKE_BCAST | + WAKE_ARP | WAKE_MAGICSECURE)) return -EOPNOTSUPP; adapter->wol = 0; - if (wol->wolopts & WAKE_UCAST) - adapter->wol |= ATLX_WUFC_EX; - if (wol->wolopts & WAKE_MCAST) - adapter->wol |= ATLX_WUFC_MC; - if (wol->wolopts & WAKE_BCAST) - adapter->wol |= ATLX_WUFC_BC; if (wol->wolopts & WAKE_MAGIC) adapter->wol |= ATLX_WUFC_MAG; return 0; From 3e44017b589f001941723dfdfede2ca6284dddce Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 9 Nov 2008 05:34:47 +0100 Subject: [PATCH 5/5] phylib: fix premature freeing of struct mii_bus Commit 46abc02175b3c246dd5141d878f565a8725060c9 ("phylib: give mdio buses a device tree presence") added a call to device_unregister() in a situation where the caller did not intend for the device to be freed yet, but apart from just unregistering the device from the system, device_unregister() does an additional put_device() that is intended to free it. The right function to use in this situation is device_del(), which unregisters the device from the system like device_unregister() does, but without dropping the reference count an additional time. Bug report from Bryan Wu . Signed-off-by: Lennert Buytenhek Tested-by: Bryan Wu Signed-off-by: Jeff Garzik --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index d0ed1ef284a8..536bda1f428b 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -136,7 +136,7 @@ void mdiobus_unregister(struct mii_bus *bus) BUG_ON(bus->state != MDIOBUS_REGISTERED); bus->state = MDIOBUS_UNREGISTERED; - device_unregister(&bus->dev); + device_del(&bus->dev); for (i = 0; i < PHY_MAX_ADDR; i++) { if (bus->phy_map[i]) device_unregister(&bus->phy_map[i]->dev);