lkml.org 
[lkml]   [2009]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[44/46] iwlwifi: incorrect method used for finding valid OTP blocks
    2.6.31-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Jay Sternberg <jay.e.sternberg@intel.com>

    commit 2facba769d7f9e563cf706de709074a2d20f1bba upstream.

    The address stored in the next link address is a word address but when
    reading the OTP blocks, a byte address is used. Also if the blocks are
    full and the last link pointer is not zero, then none of the blocks are
    valid so return an error.

    The algorithm is simply valid blocks have a next address and that
    address's contents is zero.

    Using the wrong address for the next link address gets arbitrary data,
    obviously. In cases seen, the first block is considered valid when it is not.

    If the block has in fact been invalidated there may be old data or
    there may be no data, bad data, or partial data, there is no way of
    telling. Without this patch it is possible that a device with valid OTP data
    is unable to work.

    Signed-off-by: Jay Sternberg <jay.e.sternberg@intel.com>
    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/net/wireless/iwlwifi/iwl-eeprom.c | 23 +++++++++++------------
    1 file changed, 11 insertions(+), 12 deletions(-)

    --- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
    +++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
    @@ -335,7 +335,6 @@ static int iwl_find_otp_image(struct iwl
    u16 *validblockaddr)
    {
    u16 next_link_addr = 0, link_value = 0, valid_addr;
    - int ret = 0;
    int usedblocks = 0;

    /* set addressing mode to absolute to traverse the link list */
    @@ -355,29 +354,29 @@ static int iwl_find_otp_image(struct iwl
    * check for more block on the link list
    */
    valid_addr = next_link_addr;
    - next_link_addr = link_value;
    + next_link_addr = link_value * sizeof(u16);
    IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
    usedblocks, next_link_addr);
    if (iwl_read_otp_word(priv, next_link_addr, &link_value))
    return -EINVAL;
    if (!link_value) {
    /*
    - * reach the end of link list,
    + * reach the end of link list, return success and
    * set address point to the starting address
    * of the image
    */
    - goto done;
    + *validblockaddr = valid_addr;
    + /* skip first 2 bytes (link list pointer) */
    + *validblockaddr += 2;
    + return 0;
    }
    /* more in the link list, continue */
    usedblocks++;
    - } while (usedblocks < priv->cfg->max_ll_items);
    - /* OTP full, use last block */
    - IWL_DEBUG_INFO(priv, "OTP is full, use last block\n");
    -done:
    - *validblockaddr = valid_addr;
    - /* skip first 2 bytes (link list pointer) */
    - *validblockaddr += 2;
    - return ret;
    + } while (usedblocks <= priv->cfg->max_ll_items);
    +
    + /* OTP has no valid blocks */
    + IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n");
    + return -EINVAL;
    }

    /**



    \
     
     \ /
      Last update: 2009-10-16 19:27    [W:0.025 / U:0.028 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site