summaryrefslogtreecommitdiffstats
path: root/drivers/net/r8169.c
AgeCommit message (Collapse)Author
2010-03-29r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)Neil Horman
Official patch to fix the r8169 frame length check error. Based on this initial thread: http://marc.info/?l=linux-netdev&m=126202972828626&w=1 This is the official patch to fix the frame length problems in the r8169 driver. As noted in the previous thread, while this patch incurs a performance hit on the driver, its possible to improve performance dynamically by updating the mtu and rx_copybreak values at runtime to return performance to what it was for those NICS which are unaffected by the ideosyncracy (if there are any). Summary: A while back Eric submitted a patch for r8169 in which the proper allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too much data. This was done in commit fdd7b4c3302c93f6833e338903ea77245eb510b4. A long time prior to that however, Francois posted 126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c, which expiclitly disabled the MaxSize setting due to the fact that the hardware behaved in odd ways when overlong frames were received on NIC's supported by this driver. This was mentioned in a security conference recently: http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html It seems that if we can't enable frame size filtering, then, as Eric correctly noticed, we can find ourselves DMA-ing too much data to a buffer, causing corruption. As a result is seems that we are forced to allocate a frame which is ready to handle a maximally sized receive. This obviously has performance issues with it, so to mitigate that issue, this patch does two things: 1) Raises the copybreak value to the frame allocation size, which should force appropriately sized packets to get allocated on rx, rather than a full new 16k buffer. 2) This patch only disables frame filtering initially (i.e., during the NIC open), changing the MTU results in ring buffer allocation of a size in relation to the new mtu (along with a warning indicating that this is dangerous). Because of item (2), individuals who can't cope with the performance hit (or can otherwise filter frames to prevent the bug), or who have hardware they are sure is unaffected by this issue, can manually lower the copybreak and reset the mtu such that performance is restored easily. Signed-off-by: Neil Horman <nhorman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-27r8169: fix broken register writesFrancois Romieu
This is quite similar to b39fe41f481d20c201012e4483e76c203802dda7 though said registers are not even documented as 64-bit registers - as opposed to the initial TxDescStartAddress ones - but as single bytes which must be combined into 32 bits at the MMIO read/write level before being merged into a 64 bit logical entity. Credits go to Ben Hutchings <ben@decadent.org.uk> for the MAR registers (aka "multicast is broken for ages on ARM) and to Timo Teräs <timo.teras@iki.fi> for the MAC registers. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-26Revert "r8169: enable 64-bit DMA by default for PCI Express devices (v2)"David S. Miller
This reverts commit 353176888386d9025062a12dcec08d49af10cf2c. People are reporting problems due to this change and there is no anticipation that the cause will be tracked down any time soon. We can try next time to selectively re-enable this based upon chip type, or have a black list of some sort. Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-04r8169: use correct barrier between cacheable and non-cacheable memoryDavid Dillow
r8169 needs certain writes to be visible to other CPUs or the NIC before touching the hardware, but was using smp_wmb() which is only required to order cacheable memory access. Switch to wmb() which is required to order both cacheable and non-cacheable memory. Noticed by Catalin Marinas and Paul Mackerras. Signed-off-by: David Dillow <dave@thedillows.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-02-26net: convert multiple drivers to use netdev_for_each_mc_addr, part5 V2Jiri Pirko
removed some needless checks and also corrected bug in lp486e (dmi was passed instead of dmi->dmi_addr) Signed-off-by: Jiri Pirko <jpirko@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-02-19r8169: enable 64-bit DMA by default for PCI Express devices (v2)Robert Hancock
Currently use of 64-bit DMA is disabled in r8169 unless the user passes the use_dac module option. This is reasonable for conventional PCI devices where broken chipsets may not handle dual-address-cycle transfers properly for 32-bit slots and so this may not be safe. However, PCI Express should not have this problem and not using 64-bit DMA results in DMA transfers needlessly using the IOMMU or SWIOTLB. Set the use_dac module parameter to a new default value of -1 which results in 64-bit DMA being enabled by default for PCI Express devices only. Signed-off-by: Robert Hancock <hancockrwd@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-02-12drivers/net/r8196.c: Use netif_printk macrosJoe Perches
Simplify the logic a bit, make the message logs a bit more consistent. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-02-12net: use netdev_mc_count and netdev_mc_empty when appropriateJiri Pirko
This patch replaces dev->mc_count in all drivers (hopefully I didn't miss anything). Used spatch and did small tweaks and conding style changes when it was suitable. Jirka Signed-off-by: Jiri Pirko <jpirko@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2010-01-07drivers/net/: use DEFINE_PCI_DEVICE_TABLE()Alexey Dobriyan
Use DEFINE_PCI_DEVICE_TABLE() so we get place PCI ids table into correct section in every case. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-12-29drivers/net/r8169.c: use %pM to shown MAC addressH Hartley Sweeten
Use the %pM kernel extension to display the MAC address. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-12-15const: constify remaining dev_pm_opsAlexey Dobriyan
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-12-03drivers/net: Move && and || to end of previous lineJoe Perches
Only files where David Miller is the primary git-signer. wireless, wimax, ixgbe, etc are not modified. Compile tested x86 allyesconfig only Not all files compiled (not x86 compatible) Added a few > 80 column lines, which I ignored. Existing checkpatch complaints ignored. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-12-01Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: net/mac80211/ht.c
2009-11-29r8169: restore mac addr in rtl8169_remove_one and rtl_shutdownIvan Vecera
The newer chipsets (all PCI-E) are known that they need full power cycle (AC or battery removal) to reset MAC address to a hardwired one. Previous patch to address this problem loads the original MAC address from EEPROM. But it brought other problem for which it is necessary to introduce a new module parameter. However, it might suffice to restore the initial MAC address before shutdown/reboot/kexec and when removing the module. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-25r8169: move PHY regs tables to .rodataAlexey Dobriyan
As side effect, consume less stack. -rtl8169_get_mac_version [vmlinux]: 432 -rtl8169_init_one [vmlinux]: 376 +rtl8169_init_one [vmlinux]: 136 Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-17Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/can/Kconfig
2009-11-13r8169: Fix receive buffer length when MTU is between 1515 and 1536Raimonds Cicans
In r8169 driver MTU is used to calculate receive buffer size. Receive buffer size is used to configure hardware incoming packet filter. For jumbo frames: Receive buffer size = Max frame size = MTU + 14 (ethernet header) + 4 (vlan header) + 4 (ethernet checksum) = MTU + 22 Bug: driver for all MTU up to 1536 use receive buffer size 1536 As you can see from formula, this mean all IP packets > 1536 - 22 (for vlan tagged, 1536 - 18 for not tagged) are dropped by hardware filter. Example: host_good> ifconfig eth0 mtu 1536 host_r8169> ifconfig eth0 mtu 1536 host_good> ping host_r8169 Ok host_good> ping -s 1500 host_r8169 Fail host_good> ifconfig eth0 mtu 7000 host_r8169> ifconfig eth0 mtu 7000 host_good> ping -s 1500 host_r8169 Ok Bonus: got rid of magic number 8 Signed-off-by: Raimonds Cicans <ray@apollo.lv> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-06Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/usb/cdc_ether.c All CDC ethernet devices of type USB_CLASS_COMM need to use '&mbm_info'. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-10-29r8169: Fix card drop incoming VLAN tagged MTU byte large jumbo framesRaimonds Cicans
r8169 card drop incoming VLAN tagged MTU byte large jumbo frames It looks to compare current and maximal packet sizes hardware use '<' operator, not '<='. Bug introduced by commit fdd7b4c3302c93f6833e338903ea77245eb510b4 ("r8169: fix crash when large packets are received") Signed-off-by: Raimonds Cicans <ray@apollo.lv> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-10-27Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/sh_eth.c
2009-10-24r8169: fix Ethernet Hangup for RTL8110SC rev dSimon Wunderlich
The 8110SC rev d chip on our board shows a regression which the 8110SB chip did not have. When inbound traffic is overflowing the receive descriptor queue, "holes" in the ring buffer may occur which lead to a hangup until the buffer is filled again. The packets are than completely processed, but the ring remains porous and no packets are processed until the next overflow. Setting the interface down and up can fix the problem temporary from userspace. For some reason we don't know, this behaviour is not occuring if the RxVlan bit for hardware VLAN untagging is set. There is another "Work around for AMD plateform" in the current code which checks the VLAN status word in receive descriptors, but does never come to effect when hardware VLAN support is enabled. We assume that this is a bug in the chip. The following patch fixes the problem. Without the patch we could reproduce the hang within minutes (given other devices also generating lots of interrupts), without we couldn't reproduce within a few days of long term testing. This version contains minor style adjustments and is sent with mutt which will hopefully not destroy the formatting again. Signed-off-by: Bernhard Schmidt <bernhard.schmidt@saxnet.de> Signed-off-by: Simon Wunderlich <simon.wunderlich@saxnet.de> Acked-by: Francois Romieu <romieu@zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-10-13Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
2009-10-13r8169: partial support and phy init for the 8168dfrançois romieu
Extracted from Realtek's 8.012.00 r8168 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Simon Farnsworth <simon.farnsworth@onelan.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-10-13net: Use netdev_alloc_skb_ip_align()Eric Dumazet
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-09-07r8169: Fix warning in rtl8169_start_xmit().David S. Miller
Reported by Stephen Rothwell: drivers/net/r8169.c: In function 'rtl8169_start_xmit': drivers/net/r8169.c:3421: warning: label 'out' defined but not used Introduced by commit 61357325f377889a1daffa14962d705dc814dd0e ("netdev: convert bulk of drivers to netdev_tx_t"). Signed-off-by: David S. Miller <davem@davemloft.net>
2009-09-03netdev: Remove redundant checks for CAP_NET_ADMIN in MDIO implementationsBen Hutchings
dev_ioctl() already checks capable(CAP_NET_ADMIN) before calling the driver's implementation of MDIO ioctls. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-09-01netdev: convert bulk of drivers to netdev_tx_tStephen Hemminger
In a couple of cases collapse some extra code like: int retval = NETDEV_TX_OK; ... return retval; into return NETDEV_TX_OK; Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: phy init for the 8102efrançois romieu
Synced with Realtek's 1.013.00 r8101 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: phy init for the 8169sfrançois romieu
Synced with Realtek's 6.011.00 r8169 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: phy init for the 8169scdfrançois romieu
Synced with Realtek's 6.011.00 r8169 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: phy init for the 8169scefrançois romieu
Synced with Realtek's 6.011.00 r8169 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: differentiate close chipsets in the startup identification messagefrançois romieu
The driver displays the same 0x18000000 xid for RTL_GIGA_MAC_VER_06 and RTL_GIGA_MAC_VER_05 whereas the former ought to be identified as 0x98000000. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-08-12r8169: fix r8101 quirk dupefrançois romieu
Noticed by Vincent Pelletier <plr.vincent@gmail.com>. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-07-26r8169: WakeOnLan fix for the 8168françois romieu
More stuff for http://bugzilla.kernel.org/show_bug.cgi?id=9512 Some 8168 are unable to WoL when receiving is not enabled (plain old 8169 do not seem to care). It is not exactly pretty to leave the receiver enabled but we should now enable DMA late enough for it to be safe. Some late stage boot failure due to pxe and friends may benefit from the delayed enabling of bus-mastering as well. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Jaromír Cápík <tavvva@volny.cz> Cc: Edward Hsu <edward_hsu@realtek.com.tw>
2009-06-19r8169: remove unused variableFlorian Westphal
all references got removed by 865c652d6be9929927cabdc54b137b7541eb6612 (r8169: remove non-napi code). Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-17r8169: do not bring device down when suspendingfrançois romieu
Stopping all activity through ChipCmd and blindly acking the irqs is neither nice nor completely needed: the transition to low-power mode does enough work and it apparently keeps the device in a sane state. Patch suggested by a fix for http://bugzilla.kernel.org/show_bug.cgi?id=9512 The rtl_shutdown path is kept unchanged so far. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Anders Eriksson <aeriksson@fastmail.fm> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-15Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 Conflicts: Documentation/feature-removal-schedule.txt drivers/scsi/fcoe/fcoe.c net/core/drop_monitor.c net/core/net-traces.c
2009-06-11r8169: use dev_kfree_skb() instead of dev_kfree_skb_irq()Eric Dumazet
rtl8169_tx_interrupt() is used from NAPI context, it can directly free skbs. dev_kfree_skb_irq() is a leftover from pre-NAPI times of this driver. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-09r8169: fix crash when large packets are receivedEric Dumazet
Michael Tokarev reported receiving a large packet could crash a machine with RTL8169 NIC. ( original thread at http://lkml.org/lkml/2009/6/8/192 ) Problem is this driver tells that NIC frames up to 16383 bytes can be received but provides skb to rx ring allocated with smaller sizes (1536 bytes in case standard 1500 bytes MTU is used) When a frame larger than what was allocated by driver is received, dma transfert can occurs past the end of buffer and corrupt kernel memory. Fix is to tell to NIC what is the maximum size a frame can be. This bug is very old, (before git introduction, linux-2.6.10), and should be backported to stable versions. Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-03Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/forcedeth.c
2009-05-29net: dont update dev->trans_startEric Dumazet
Second round of drivers for Gb cards (and NIU one I forgot in the 10GB round) Now that core network takes care of trans_start updates, dont do it in drivers themselves, if possible. Drivers can avoid one cache miss (on dev->trans_start) in their start_xmit() handler. Exceptions are NETIF_F_LLTX drivers Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-26r8169: Use a different default for each familyJean Delvare
The r8169 driver supports 3 different families of network chips (RTL8169, RTL8168 and RTL8101). When an unknown version is found, the driver currently always defaults to the RTL8169 variant. This has very little chance to ever work for chips of the other families. So better define a per-family default. Signed-off-by: Jean Delvare <jdelvare@suse.de> Acked-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-25r8169: avoid losing MSI interruptsDavid Dillow
The 8169 chip only generates MSI interrupts when all enabled event sources are quiescent and one or more sources transition to active. If not all of the active events are acknowledged, or a new event becomes active while the existing ones are cleared in the handler, we will not see a new interrupt. The current interrupt handler masks off the Rx and Tx events once the NAPI handler has been scheduled, which opens a race window in which we can get another Rx or Tx event and never ACK'ing it, stopping all activity until the link is reset (ifconfig down/up). Fix this by always ACK'ing all event sources, and loop in the handler until we have all sources quiescent. Signed-off-by: David Dillow <dave@thedillows.org> Tested-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-19r8169: allow true forced mode settingfrançois romieu
Due to mostly historic reasons, including a lack of reliability of the link handling (especially with the older 8169), the current r8169 driver emulates forced mode setting by limiting the advertised modes. With this change the driver allows real 10/100 forced mode settings on the 8169 and 8101/8102. Original idea by Vincent Steenhoute. The RTL_GIGA_MAC_VER_03 tweak was extracted from Realtek's r8169 v6.010.00 driver. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Jean Delvare <jdelvare@suse.de> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-05-19r8169: remove useless struct memberfrançois romieu
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Cc: Edward Hsu <edward_hsu@realtek.com.tw> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-04-13NET/r8169: Rework suspend and resumeRafael J. Wysocki
The recent changes of the PCI PM core allow us to simplify the suspend and resume handling in a number of device drivers, since they don't need to carry out the general PCI PM operations, such as changing the power state of the device, during suspend and resume any more. Simplify the suspend and resume callbacks of r8169 using the observation that the PCI PM core can take care of some operations carried out by the driver. Additionally, make the shutdown callback of r8169 only put the device into a low power state if the system is going to be powered off (kexec is known to have problems with network adapters that are put into low power states on shutdown). This patch has been tested on MSI Wind U100. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Tested-by: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-04-07dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)Yang Hongyang
Replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) Signed-off-by: Yang Hongyang<yanghy@cn.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-04-07dma-mapping: replace all DMA_64BIT_MASK macro with DMA_BIT_MASK(64)Yang Hongyang
Replace all DMA_64BIT_MASK macro with DMA_BIT_MASK(64) Signed-off-by: Yang Hongyang<yanghy@cn.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-04-02r8169: reset IntrStatus after chip resetKarsten Wiese
Original comment (Karsten): On a MSI MS-6702E mainboard, when in rtl8169_init_one() for the first time after BIOS has run, IntrStatus reads 5 after chip has been reset. IntrStatus should equal 0 there, so patch changes IntrStatus reset to happen after chip reset instead of before. Remark (Francois): Assuming that the loglevel of the driver is increased above NETIF_MSG_INTR, the bug reveals itself with a typical "interrupt 0025 in poll" message at startup. In retrospect, the message should had been read as an hint of an unexpected hardware state several months ago :o( Fixes (at least part of) https://bugzilla.redhat.com/show_bug.cgi?id=460747 Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de> Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Tested-by: Josep <josep.puigdemont@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-17Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: drivers/net/igb/igb_main.c drivers/net/qlge/qlge_main.c drivers/net/wireless/ath9k/ath9k.h drivers/net/wireless/ath9k/core.h drivers/net/wireless/ath9k/hw.c