[PATCH] USB: net: Fix asix read transfer buffer allocations.

Valentine Barshak

author

2007-10-22 15:50 UTC #0 lore raw

PATCH 1/1 USB: net: Fix asix read transfer buffer allocations.

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack.

Signed-off-by Valentine Barshak <[email protected]>

---
 drivers/net/usb/asix.c |   21 +++++++++++++++++++--
 1 files changed, 19 insertions(+), 2 deletions(-)

drivers/net/usb/asix.c +19 -2

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c
@@ -568,12 +568,20 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
+
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Oliver Neukum

2007-10-22 17:29 UTC #1 lore raw

Am Montag 22 Oktober 2007 schrieb Valentine Barshak:

Quoted 10 lines

static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc) {
        struct usbnet *dev = netdev_priv(netdev);
+       void *buf;
        u16 res;

        mutex_lock(&dev->phy_mutex);
        asix_set_sw_mii(dev);
+
+       buf = kmalloc(2, GFP_KERNEL);

This is done under lock. Can you allocate the buffer once and reuse it?

Regards
Oliver

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-22 19:22 UTC #2 lore raw

Quoted 12 lines · Oliver Neukum

Am Montag 22 Oktober 2007 schrieb Valentine Barshak:
drivers/net/usb/asix.c static void asix_set_multicast(struct ne · line 577
Quoted 10 lines
static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
        struct usbnet *dev = netdev_priv(netdev);
drivers/net/usb/asix.c +3 -0
+       void *buf;
        u16 res;
 
        mutex_lock(&dev->phy_mutex);
        asix_set_sw_mii(dev);
+
+       buf = kmalloc(2, GFP_KERNEL);

Quoted 5 lines

This is done under lock. Can you allocate the buffer once and reuse it?
Regards
Oliver

I think we can use 2 bytes of the usbnet data buffer for this. I'll submit a new patch soon.
Thanks,
Valentine.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Ingo Oeser

2007-10-23 17:00 UTC #3 lore raw

Quoted 8 lines · Valentine Barshak

Quoted 7 lines · Oliver Neukum
Am Montag 22 Oktober 2007 schrieb Valentine Barshak:
Quoted 6 lines
static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
        struct usbnet *dev = netdev_priv(netdev);
+       void *buf;
        u16 res;

Quoted 8 lines

Quoted 6 lines
drivers/net/usb/asix.c static void asix_set_multicast(struct ne · line 577
Quoted 4 lines
        mutex_lock(&dev->phy_mutex);
        asix_set_sw_mii(dev);
drivers/net/usb/asix.c +2 -0
+
+       buf = kmalloc(2, GFP_KERNEL);
This is done under lock. Can you allocate the buffer once and reuse it?
I think we can use 2 bytes of the usbnet data buffer for this. I'll submit a new patch soon.

If this cannot be done for some reason, then you can at least kmalloc() before you do "mutex_lock(&dev->phy_mutex);" and kfree() after you did "mutex_unlock(&dev->phy_mutex);"

The reason to can do this, is that "buf" has a life time limited to this function.

The reason you should do this, is that kmalloc(, GFP_KERNEL) is allowed to sleep, which will block the mutex for that time. While this is technically ok, since mutexes can sleep, it is not desireable, since other users of that mutex are blocked until the allocation is done.

If you are able to implement the "2 bytes of usbnet data buffer" version, please ignore that mail :-)

Best Regards

Ingo Oeser

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-23 17:20 UTC #4 lore raw

Quoted 28 lines · Ingo Oeser

Quoted 8 lines · Valentine Barshak
Quoted 7 lines · Oliver Neukum
Am Montag 22 Oktober 2007 schrieb Valentine Barshak:
Quoted 6 lines
static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
        struct usbnet *dev = netdev_priv(netdev);
+       void *buf;
        u16 res;
Quoted 7 lines
Quoted 5 lines
drivers/net/usb/asix.c static void asix_set_multicast(struct ne · line 577
Quoted 4 lines
        mutex_lock(&dev->phy_mutex);
        asix_set_sw_mii(dev);
drivers/net/usb/asix.c +2 -0
+
+       buf = kmalloc(2, GFP_KERNEL);
This is done under lock. Can you allocate the buffer once and reuse it?
I think we can use 2 bytes of the usbnet data buffer for this. I'll submit a new patch soon.
If this cannot be done for some reason, then you can at least kmalloc() before you do "mutex_lock(&dev->phy_mutex);" and kfree() after you did "mutex_unlock(&dev->phy_mutex);"
The reason to can do this, is that "buf" has a life time limited to this function.
The reason you should do this, is that kmalloc(, GFP_KERNEL) is allowed to sleep, which will block the mutex for that time. While this is technically ok, since mutexes can sleep, it is not desireable, since other users of that mutex are blocked until the allocation is done.

Quoted 7 lines

If you are able to implement the "2 bytes of usbnet data buffer" version, please ignore that mail :-)
Best Regards
Ingo Oeser

Looks like we cannot use usbnet data buffer for read transfers either, because it's just a part of the usbnet structure and we may still lose data while invalidating cache the same way we do using buffers on stack. Allocating a permanent buffer for phy transfer needs more driver
changes: we should add unbind finction to the device_info for all asix devices to deallocate the buffer at exit.
And we still need to allocate buffers for other transfers dynamically, so having just one permanent buffer for phy doesn't help much. I've reworked the original patch a bit: moved kmalloc out of the phy_mutex and added more clean-ups.
Will submit shortly.
Thanks,
Valentine.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-23 17:40 UTC #5 lore raw

PATCH 1/1 USB: net: Fix asix read transfer buffer allocations.

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack. It also sets data parameter to NULL for zero-length transfers and uses ETH_ALEN size for allocating MAC address buffer.

drivers/net/usb/asix.c +31 ~~-13~~

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c
@@ -568,15 +568,23 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);
 
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
 	return le16_to_cpu(res & 0xffff);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

@@ -644,7 +661,6 @@ asix_set_wol(struct net_device *net, str
 {
 	struct usbnet *dev = netdev_priv(net);
 	u8 opt = 0;
-	u8 buf[1];
 
 	if (wolinfo->wolopts & WAKE_PHY)
 		opt |= AX_MONITOR_LINK;

@@ -654,7 +670,7 @@ asix_set_wol(struct net_device *net, str
 		opt |= AX_MONITOR_MODE;
 
 	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
-			      opt, 0, 0, &buf) < 0)
+			      opt, 0, 0, NULL) < 0)
 		return -EINVAL;
 
 	return 0;

@@ -820,7 +836,7 @@ static int ax88172_bind(struct usbnet *d
 	for (i = 2; i >= 0; i--) {
 		if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
 					(gpio_bits >> (i * 8)) & 0xff, 0, 0,
-					buf)) < 0)
+					NULL)) < 0)
 			goto out2;
 		msleep(5);
 	}

@@ -831,7 +847,7 @@ static int ax88172_bind(struct usbnet *d
 	/* Get the MAC address */
 	memset(buf, 0, ETH_ALEN);
 	if ((ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
-				0, 0, 6, buf)) < 0) {
+				0, 0, ETH_ALEN, buf)) < 0) {
 		dbg("read AX_CMD_READ_NODE_ID failed: %d", ret);
 		goto out2;
 	}

@@ -909,7 +925,7 @@ static int ax88772_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;

@@ -923,7 +939,7 @@ static int ax88772_bind(struct usbnet *d
 	/* 0x10 is the phy id of the embedded 10/100 ethernet phy */
 	embd_phy = ((asix_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
-				embd_phy, 0, 0, buf)) < 0) {
+				embd_phy, 0, 0, NULL)) < 0) {
 		dbg("Select PHY #1 failed: %d", ret);
 		goto out2;
 	}

@@ -998,7 +1014,7 @@ static int ax88772_bind(struct usbnet *d
 
 	if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
 				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
-				AX88772_IPG2_DEFAULT, 0, buf)) < 0) {
+				AX88772_IPG2_DEFAULT, 0, NULL)) < 0) {
 		dbg("Write IPG,IPG1,IPG2 failed: %d", ret);
 		goto out2;
 	}

@@ -1202,20 +1218,22 @@ static int ax88178_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;
 		goto out1;
 	}
 
-	eeprom = 0;
-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &eeprom);
+	memset(buf, 0, ETH_ALEN);
+	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, buf);
+	eeprom = *(u8 *)buf;
 	dbg("GPIO Status: 0x%04x", eeprom);
 
 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL);
-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom);
+	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, buf);
 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL);
+	eeprom = *(u16 *)buf;
 
 	dbg("EEPROM index 0x17 is 0x%04x", eeprom);

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

David Brownell

2007-10-23 20:00 UTC #6 lore raw

Quoted 8 lines

From [email protected] Tue Oct 23 10:51:00 2007
Date: Tue, 23 Oct 2007 21:40:18 +0400
From: Valentine Barshak <[email protected]>
To: [email protected]
Cc: [email protected]
Subject: [linux-usb-devel] [PATCH] USB: net: Fix asix read transfer buffer
allocations.

Quoted 10 lines

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack. It also sets data parameter to NULL for zero-length transfers and uses ETH_ALEN size for allocating MAC address buffer.

Looks plausible to me, on a quick scan, but you should CC Dave Hollis for updates to this drver ... last I knew, he was still maintaining this code. (Though he's not listed in MAINTAINERS...)

This is missing a Signed-Off-By line ...

Quoted 143 lines

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c

drivers/net/usb/asix.c +31 ~~-14~~

@@ -568,15 +568,23 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);
 
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
 	return le16_to_cpu(res & 0xffff);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

@@ -644,7 +661,6 @@ asix_set_wol(struct net_device *net, str
 {
 	struct usbnet *dev = netdev_priv(net);
 	u8 opt = 0;
-	u8 buf[1];
 
 	if (wolinfo->wolopts & WAKE_PHY)
 		opt |= AX_MONITOR_LINK;

@@ -654,7 +670,7 @@ asix_set_wol(struct net_device *net, str
 		opt |= AX_MONITOR_MODE;
 
 	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
-			      opt, 0, 0, &buf) < 0)
+			      opt, 0, 0, NULL) < 0)
 		return -EINVAL;
 
 	return 0;

@@ -820,7 +836,7 @@ static int ax88172_bind(struct usbnet *d
 	for (i = 2; i >= 0; i--) {
 		if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
 					(gpio_bits >> (i * 8)) & 0xff, 0, 0,
-					buf)) < 0)
+					NULL)) < 0)
 			goto out2;
 		msleep(5);
 	}

@@ -831,7 +847,7 @@ static int ax88172_bind(struct usbnet *d
 	/* Get the MAC address */
 	memset(buf, 0, ETH_ALEN);
 	if ((ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
-				0, 0, 6, buf)) < 0) {
+				0, 0, ETH_ALEN, buf)) < 0) {
 		dbg("read AX_CMD_READ_NODE_ID failed: %d", ret);
 		goto out2;
 	}

@@ -909,7 +925,7 @@ static int ax88772_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;

@@ -923,7 +939,7 @@ static int ax88772_bind(struct usbnet *d
 	/* 0x10 is the phy id of the embedded 10/100 ethernet phy */
 	embd_phy = ((asix_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
-				embd_phy, 0, 0, buf)) < 0) {
+				embd_phy, 0, 0, NULL)) < 0) {
 		dbg("Select PHY #1 failed: %d", ret);
 		goto out2;
 	}

@@ -998,7 +1014,7 @@ static int ax88772_bind(struct usbnet *d
 
 	if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
 				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
-				AX88772_IPG2_DEFAULT, 0, buf)) < 0) {
+				AX88772_IPG2_DEFAULT, 0, NULL)) < 0) {
 		dbg("Write IPG,IPG1,IPG2 failed: %d", ret);
 		goto out2;
 	}

@@ -1202,20 +1218,22 @@ static int ax88178_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;
 		goto out1;
 	}
 
-	eeprom = 0;
-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &eeprom);
+	memset(buf, 0, ETH_ALEN);
+	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, buf);
+	eeprom = *(u8 *)buf;
 	dbg("GPIO Status: 0x%04x", eeprom);
 
 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL);
-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom);
+	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, buf);
 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL);
+	eeprom = *(u16 *)buf;
 
 	dbg("EEPROM index 0x17 is 0x%04x", eeprom);
 
 
-------------------------------------------------------------------------

Quoted 9 lines

This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-24 11:24 UTC #7 lore raw

PATCH 1/1 USB: net: Fix asix read transfer buffer allocations.

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack. It also sets data parameter to NULL for zero-length transfers and uses ETH_ALEN size for allocating MAC address buffer.

Signed-off-by Valentine Barshak <[email protected]>

---
 drivers/net/usb/asix.c |   44 +++++++++++++++++++++++++++++++-------------
 1 files changed, 31 insertions(+), 13 deletions(-)

drivers/net/usb/asix.c +31 ~~-13~~

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c
@@ -568,15 +568,23 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);
 
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
 	return le16_to_cpu(res & 0xffff);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

@@ -644,7 +661,6 @@ asix_set_wol(struct net_device *net, str
 {
 	struct usbnet *dev = netdev_priv(net);
 	u8 opt = 0;
-	u8 buf[1];
 
 	if (wolinfo->wolopts & WAKE_PHY)
 		opt |= AX_MONITOR_LINK;

@@ -654,7 +670,7 @@ asix_set_wol(struct net_device *net, str
 		opt |= AX_MONITOR_MODE;
 
 	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
-			      opt, 0, 0, &buf) < 0)
+			      opt, 0, 0, NULL) < 0)
 		return -EINVAL;
 
 	return 0;

@@ -820,7 +836,7 @@ static int ax88172_bind(struct usbnet *d
 	for (i = 2; i >= 0; i--) {
 		if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
 					(gpio_bits >> (i * 8)) & 0xff, 0, 0,
-					buf)) < 0)
+					NULL)) < 0)
 			goto out2;
 		msleep(5);
 	}

@@ -831,7 +847,7 @@ static int ax88172_bind(struct usbnet *d
 	/* Get the MAC address */
 	memset(buf, 0, ETH_ALEN);
 	if ((ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
-				0, 0, 6, buf)) < 0) {
+				0, 0, ETH_ALEN, buf)) < 0) {
 		dbg("read AX_CMD_READ_NODE_ID failed: %d", ret);
 		goto out2;
 	}

@@ -909,7 +925,7 @@ static int ax88772_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;

@@ -923,7 +939,7 @@ static int ax88772_bind(struct usbnet *d
 	/* 0x10 is the phy id of the embedded 10/100 ethernet phy */
 	embd_phy = ((asix_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
-				embd_phy, 0, 0, buf)) < 0) {
+				embd_phy, 0, 0, NULL)) < 0) {
 		dbg("Select PHY #1 failed: %d", ret);
 		goto out2;
 	}

@@ -998,7 +1014,7 @@ static int ax88772_bind(struct usbnet *d
 
 	if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
 				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
-				AX88772_IPG2_DEFAULT, 0, buf)) < 0) {
+				AX88772_IPG2_DEFAULT, 0, NULL)) < 0) {
 		dbg("Write IPG,IPG1,IPG2 failed: %d", ret);
 		goto out2;
 	}

@@ -1202,20 +1218,22 @@ static int ax88178_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;
 		goto out1;
 	}
 
-	eeprom = 0;
-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &eeprom);
+	memset(buf, 0, ETH_ALEN);
+	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, buf);
+	eeprom = *(u8 *)buf;
 	dbg("GPIO Status: 0x%04x", eeprom);
 
 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL);
-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom);
+	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, buf);
 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL);
+	eeprom = *(u16 *)buf;
 
 	dbg("EEPROM index 0x17 is 0x%04x", eeprom);

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-24 11:33 UTC #8 lore raw

Sorry,
CC'ed Dave Brownell instead of Dave Hollis :)

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Valentine Barshak

author

2007-10-24 11:33 UTC #9 lore raw

PATCH 1/1 USB: net: Fix asix read transfer buffer allocations.

In reply to David Brownell

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack. It also sets data parameter to NULL for zero-length transfers and uses ETH_ALEN size for allocating MAC address buffer.

Signed-off-by Valentine Barshak <[email protected]>

---
 drivers/net/usb/asix.c |   44 +++++++++++++++++++++++++++++++-------------
 1 files changed, 31 insertions(+), 13 deletions(-)

drivers/net/usb/asix.c +31 ~~-13~~

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c
@@ -568,15 +568,23 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);
 
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
 	return le16_to_cpu(res & 0xffff);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

@@ -644,7 +661,6 @@ asix_set_wol(struct net_device *net, str
 {
 	struct usbnet *dev = netdev_priv(net);
 	u8 opt = 0;
-	u8 buf[1];
 
 	if (wolinfo->wolopts & WAKE_PHY)
 		opt |= AX_MONITOR_LINK;

@@ -654,7 +670,7 @@ asix_set_wol(struct net_device *net, str
 		opt |= AX_MONITOR_MODE;
 
 	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
-			      opt, 0, 0, &buf) < 0)
+			      opt, 0, 0, NULL) < 0)
 		return -EINVAL;
 
 	return 0;

@@ -820,7 +836,7 @@ static int ax88172_bind(struct usbnet *d
 	for (i = 2; i >= 0; i--) {
 		if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
 					(gpio_bits >> (i * 8)) & 0xff, 0, 0,
-					buf)) < 0)
+					NULL)) < 0)
 			goto out2;
 		msleep(5);
 	}

@@ -831,7 +847,7 @@ static int ax88172_bind(struct usbnet *d
 	/* Get the MAC address */
 	memset(buf, 0, ETH_ALEN);
 	if ((ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
-				0, 0, 6, buf)) < 0) {
+				0, 0, ETH_ALEN, buf)) < 0) {
 		dbg("read AX_CMD_READ_NODE_ID failed: %d", ret);
 		goto out2;
 	}

@@ -909,7 +925,7 @@ static int ax88772_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;

@@ -923,7 +939,7 @@ static int ax88772_bind(struct usbnet *d
 	/* 0x10 is the phy id of the embedded 10/100 ethernet phy */
 	embd_phy = ((asix_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
-				embd_phy, 0, 0, buf)) < 0) {
+				embd_phy, 0, 0, NULL)) < 0) {
 		dbg("Select PHY #1 failed: %d", ret);
 		goto out2;
 	}

@@ -998,7 +1014,7 @@ static int ax88772_bind(struct usbnet *d
 
 	if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
 				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
-				AX88772_IPG2_DEFAULT, 0, buf)) < 0) {
+				AX88772_IPG2_DEFAULT, 0, NULL)) < 0) {
 		dbg("Write IPG,IPG1,IPG2 failed: %d", ret);
 		goto out2;
 	}

@@ -1202,20 +1218,22 @@ static int ax88178_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;
 		goto out1;
 	}
 
-	eeprom = 0;
-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &eeprom);
+	memset(buf, 0, ETH_ALEN);
+	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, buf);
+	eeprom = *(u8 *)buf;
 	dbg("GPIO Status: 0x%04x", eeprom);
 
 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL);
-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom);
+	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, buf);
 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL);
+	eeprom = *(u16 *)buf;
 
 	dbg("EEPROM index 0x17 is 0x%04x", eeprom);

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

David Hollis

Acked-by on v1 1/1

2007-10-24 11:59 UTC #10 lore raw

Quoted 11 lines · Valentine Barshak

On systems with noncoherent cache, allocating dma buffers on the stack for USB IN transfers causes kernel crash, because usb map_urb_for_dma() code calls dma_map_single(), that invalidates data cache for DMA_FROM_DEVICE transfer direction and causes stack data loss if transfer size is less than cache line and not cache-line aligned. This patch makes asix usb network driver allocate USB IN transfer buffers with kmalloc instead of directly using variables on stack. It also sets data parameter to NULL for zero-length transfers and uses ETH_ALEN size for allocating MAC address buffer.

Quoted 1 line

Signed-off-by Valentine Barshak <[email protected]>

Acked-by David Hollis <[email protected]>

Quoted 145 lines

---
 drivers/net/usb/asix.c |   44 +++++++++++++++++++++++++++++++-------------
 1 files changed, 31 insertions(+), 13 deletions(-)

diff -pruN linux-2.6.orig/drivers/net/usb/asix.c linux-2.6/drivers/net/usb/asix.c

drivers/net/usb/asix.c +31 ~~-13~~

@@ -568,15 +568,23 @@ static void asix_set_multicast(struct ne
 static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
 {
 	struct usbnet *dev = netdev_priv(netdev);
+	void *buf;
 	u16 res;
 
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	mutex_lock(&dev->phy_mutex);
 	asix_set_sw_mii(dev);
 	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
-				(__u16)loc, 2, (u16 *)&res);
+				(__u16)loc, 2, buf);
 	asix_set_hw_mii(dev);
 	mutex_unlock(&dev->phy_mutex);
 
+	res = *((u16 *)buf);
+	kfree(buf);
+
 	devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
 	return le16_to_cpu(res & 0xffff);

@@ -622,13 +630,22 @@ static void
 asix_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
+	void *buf;
 	u8 opt;
 
-	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return;
+
+	if (asix_read_cmd(dev, AX_CMD_READ_MONITOR_MODE, 0, 0, 1, buf) < 0) {
 		wolinfo->supported = 0;
 		wolinfo->wolopts = 0;
+		kfree(buf);
 		return;
 	}
+	opt = *((u8 *)buf);
+	kfree(buf);
+
 	wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
 	wolinfo->wolopts = 0;
 	if (opt & AX_MONITOR_MODE) {

@@ -644,7 +661,6 @@ asix_set_wol(struct net_device *net, str
 {
 	struct usbnet *dev = netdev_priv(net);
 	u8 opt = 0;
-	u8 buf[1];
 
 	if (wolinfo->wolopts & WAKE_PHY)
 		opt |= AX_MONITOR_LINK;

@@ -654,7 +670,7 @@ asix_set_wol(struct net_device *net, str
 		opt |= AX_MONITOR_MODE;
 
 	if (asix_write_cmd(dev, AX_CMD_WRITE_MONITOR_MODE,
-			      opt, 0, 0, &buf) < 0)
+			      opt, 0, 0, NULL) < 0)
 		return -EINVAL;
 
 	return 0;

@@ -820,7 +836,7 @@ static int ax88172_bind(struct usbnet *d
 	for (i = 2; i >= 0; i--) {
 		if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_GPIOS,
 					(gpio_bits >> (i * 8)) & 0xff, 0, 0,
-					buf)) < 0)
+					NULL)) < 0)
 			goto out2;
 		msleep(5);
 	}

@@ -831,7 +847,7 @@ static int ax88172_bind(struct usbnet *d
 	/* Get the MAC address */
 	memset(buf, 0, ETH_ALEN);
 	if ((ret = asix_read_cmd(dev, AX88172_CMD_READ_NODE_ID,
-				0, 0, 6, buf)) < 0) {
+				0, 0, ETH_ALEN, buf)) < 0) {
 		dbg("read AX_CMD_READ_NODE_ID failed: %d", ret);
 		goto out2;
 	}

@@ -909,7 +925,7 @@ static int ax88772_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;

@@ -923,7 +939,7 @@ static int ax88772_bind(struct usbnet *d
 	/* 0x10 is the phy id of the embedded 10/100 ethernet phy */
 	embd_phy = ((asix_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
 	if ((ret = asix_write_cmd(dev, AX_CMD_SW_PHY_SELECT,
-				embd_phy, 0, 0, buf)) < 0) {
+				embd_phy, 0, 0, NULL)) < 0) {
 		dbg("Select PHY #1 failed: %d", ret);
 		goto out2;
 	}

@@ -998,7 +1014,7 @@ static int ax88772_bind(struct usbnet *d
 
 	if ((ret = asix_write_cmd(dev, AX_CMD_WRITE_IPG0,
 				AX88772_IPG0_DEFAULT | AX88772_IPG1_DEFAULT,
-				AX88772_IPG2_DEFAULT, 0, buf)) < 0) {
+				AX88772_IPG2_DEFAULT, 0, NULL)) < 0) {
 		dbg("Write IPG,IPG1,IPG2 failed: %d", ret);
 		goto out2;
 	}

@@ -1202,20 +1218,22 @@ static int ax88178_bind(struct usbnet *d
 
 	usbnet_get_endpoints(dev,intf);
 
-	buf = kmalloc(6, GFP_KERNEL);
+	buf = kmalloc(ETH_ALEN, GFP_KERNEL);
 	if(!buf) {
 		dbg ("Cannot allocate memory for buffer");
 		ret = -ENOMEM;
 		goto out1;
 	}
 
-	eeprom = 0;
-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &eeprom);
+	memset(buf, 0, ETH_ALEN);
+	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, buf);
+	eeprom = *(u8 *)buf;
 	dbg("GPIO Status: 0x%04x", eeprom);
 
 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL);
-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom);
+	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, buf);
 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL);
+	eeprom = *(u16 *)buf;
 
 	dbg("EEPROM index 0x17 is 0x%04x", eeprom);

Signature · 12 lines

David Hollis <[email protected]>


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel