korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-18 17:54:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

r8169: explicit firmware format check.

Browse Source 
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
This commit is contained in:
Francois Romieu 2011-06-17 17:16:24 +02:00
parent b6ffd97f5b
commit 1c361efb22
1 changed files with 51 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
drivers/net/r8169.c
View File

@ -669,6 +669,15 @@ struct rtl8169_private {
struct rtl_fw {
const struct firmware *fw;
#define RTL_VER_SIZE 32
char version[RTL_VER_SIZE];
struct rtl_fw_phy_action {
__le32 *code;
size_t size;
} phy_action;
} *rtl_fw;
#define RTL_FIRMWARE_UNKNOWN ERR_PTR(-EAGAIN);
};
@ -1229,8 +1238,9 @@ static void rtl8169_get_drvinfo(struct net_device *dev,
strcpy(info->driver, MODULENAME);
strcpy(info->version, RTL8169_VERSION);
strcpy(info->bus_info, pci_name(tp->pci_dev));
strncpy(info->fw_version, IS_ERR_OR_NULL(rtl_fw) ? "N/A" :
rtl_lookup_firmware_name(tp), sizeof(info->fw_version) - 1);
BUILD_BUG_ON(sizeof(info->fw_version) < sizeof(rtl_fw->version));
strcpy(info->fw_version, IS_ERR_OR_NULL(rtl_fw) ? "N/A" :
rtl_fw->version);
}
static int rtl8169_get_regs_len(struct net_device *dev)
@ -1744,21 +1754,47 @@ static void rtl_writephy_batch(struct rtl8169_private *tp,
#define PHY_DELAY_MS 0xe0000000
#define PHY_WRITE_ERI_WORD 0xf0000000
static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
#define FW_OPCODE_SIZE sizeof(typeof(*((struct rtl_fw_phy_action *)0)->code))
static bool rtl_fw_format_ok(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
{
const struct firmware *fw = rtl_fw->fw;
__le32 *phytable = (__le32 *)fw->data;
struct net_device *dev = tp->dev;
size_t index, fw_size = fw->size / sizeof(*phytable);
u32 predata, count;
struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
char *version = rtl_fw->version;
bool rc = false;
if (fw->size % sizeof(*phytable)) {
netif_err(tp, probe, dev, "odd sized firmware %zd\n", fw->size);
if (fw->size < FW_OPCODE_SIZE)
goto out;
else {
if (fw->size % FW_OPCODE_SIZE)
goto out;
strlcpy(version, rtl_lookup_firmware_name(tp), RTL_VER_SIZE);
pa->code = (__le32 *)fw->data;
pa->size = fw->size / FW_OPCODE_SIZE;
}
version[RTL_VER_SIZE - 1] = 0;
rc = true;
out:
return rc;
}
static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
{
struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
struct net_device *dev = tp->dev;
u32 predata, count;
size_t index;
if (!rtl_fw_format_ok(tp, rtl_fw)) {
netif_err(tp, probe, dev, "invalid firwmare\n");
return;
}
for (index = 0; index < fw_size; index++) {
u32 action = le32_to_cpu(phytable[index]);
for (index = 0; index < pa->size; index++) {
u32 action = le32_to_cpu(pa->code[index]);
u32 regno = (action & 0x0fff0000) >> 16;
switch(action & 0xf0000000) {
@ -1780,7 +1816,7 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
}
break;
case PHY_READCOUNT_EQ_SKIP:
if (index + 2 >= fw_size) {
if (index + 2 >= pa->size) {
netif_err(tp, probe, tp->dev,
"Out of range of firmware\n");
return;
@ -1789,7 +1825,7 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
case PHY_COMP_EQ_SKIPN:
case PHY_COMP_NEQ_SKIPN:
case PHY_SKIPN:
if (index + 1 + regno >= fw_size) {
if (index + 1 + regno >= pa->size) {
netif_err(tp, probe, tp->dev,
"Out of range of firmware\n");
return;
@ -1809,8 +1845,8 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
predata = 0;
count = 0;
for (index = 0; index < fw_size; ) {
u32 action = le32_to_cpu(phytable[index]);
for (index = 0; index < pa->size; ) {
u32 action = le32_to_cpu(pa->code[index]);
u32 data = action & 0x0000ffff;
u32 regno = (action & 0x0fff0000) >> 16;