lkml.org 
[lkml]   [2003]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: Cisco Aironet mini-PCI wireless card (MPI-350) [Was: Re: Intel PRO/Wireless 2100 vs. Broadcom BCM9430x]
    From
    Date
    On Thu, 2003-06-12 at 10:20, Jan Mynarik wrote:
    > Cisco's linux support is great until you have IBM's ThinkPad R40. With
    > this notebook, their newest Linux driver (version 2.0, older ones do not
    > support my card) module (mpi350.o) can't be inserted to kernel (oops and
    > module remains 'initializing' forever). Module is compiled successfully
    > against both 2.4.20 and 2.4.21-rc7 kernels.
    >
    > I'm just fighting their bureaucracy (in support) and trying to reach
    > someone who actually wrote the driver (module says Roland Wilcher). I
    > want to help him with testing and provide him with all possible
    > information.

    Downgrade your firmware. On the Cisco site, there's a Linux driver
    paired with a particular firmware version. Use it: there's a bug in the
    kernel driver in which it reads stuff out of the card's RIDs into a
    local structure, but using the card's RID size. The newer firmware has
    increased the structure sizes for some RIDs, which overruns the stack
    and crashes.

    I have attached a patch for the driver to fix the crash, but I'm not
    confident the card works well without the correct firmware.

    J

    --- mpi350.c.orig 2003-05-22 17:20:42.000000000 -0700
    +++ mpi350.c 2003-05-23 15:37:26.000000000 -0700
    @@ -135,7 +135,7 @@
    struct net_device *init_venus_card(struct pci_dev *);
    void venus_remove(void);
    static int venus_probe(struct pci_dev *);
    -static int vreadrid(struct venus_info *,unsigned short,unsigned char *);
    +static int vreadrid(struct venus_info *,unsigned short,unsigned char *,unsigned int);
    static int vwriterid(struct venus_info *,unsigned short,unsigned char *);
    static void venus_interrupt( int irq, void* dev_id, struct pt_regs *regs);
    static int venus_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
    @@ -442,7 +442,7 @@
    printk(KERN_INFO "MIC interrupt\n");
    #endif
    venusout(v_info,V_EVACK,EV_MIC);
    - vreadrid((struct venus_info *)dev->priv,RID_MIC,(char *)&mic);
    + vreadrid((struct venus_info *)dev->priv,RID_MIC,(char *)&mic,sizeof(mic));
    micinit(v_info,&mic);
    enable_interrupts(v_info);
    spin_unlock(&v_info->mpi_lock);
    @@ -845,7 +845,7 @@
    memset( data->wbuffer, 0, 33*3 );
    data->on_close = proc_ssid_on_close;

    - vreadrid(vi,RID_SSLIST,(unsigned char *)SSID_rid);
    + vreadrid(vi,RID_SSLIST,(unsigned char *)SSID_rid,sizeof(blargbuf));

    ptr = data->rbuffer;

    @@ -881,8 +881,8 @@
    data = (struct proc_data *)file->private_data;
    data->rbuffer = kmalloc( 2048, GFP_KERNEL );

    - vreadrid(vi,RID_STATUS,(unsigned char *)&status_rid);
    - vreadrid(vi,RID_CAPABILITIES,(unsigned char *)&cap_rid);
    + vreadrid(vi,RID_STATUS,(unsigned char *)&status_rid,sizeof(status_rid));
    + vreadrid(vi,RID_CAPABILITIES,(unsigned char *)&cap_rid,sizeof(cap_rid));

    sprintf( data->rbuffer, "Mode: %x\n"
    "Signal Strength: %d\n"
    @@ -935,7 +935,7 @@
    * Return 0 on sucess or other on failure . Uses the len value of all rids
    * in the first 2 bytes .
    */
    -static int vreadrid(struct venus_info *v_info,unsigned short rid,unsigned char *ridp){
    +static int vreadrid(struct venus_info *v_info,unsigned short rid,unsigned char *ridp,unsigned ridsz){
    Cmd cmd;
    Resp rsp;
    int status;
    @@ -962,8 +962,14 @@
    return rsp.rsp0; /* return error qualifier */

    if(!status){
    + unsigned len = ridsz;
    ridlen = VADDR(unsigned short,v_info->ConfigDesc);
    - memcpy((char *)ridp,(char *)v_info->ConfigDesc.VirtualHostAddress,*ridlen);
    + if (*ridlen <= len)
    + len = *ridlen;
    + else
    + printk(KERN_INFO "vreadrid: rid=%04x ridlen=%d ridsz=%d\n",
    + rid, *ridlen, ridsz);
    + memcpy((char *)ridp,(char *)v_info->ConfigDesc.VirtualHostAddress,len);
    }
    return status;
    }
    @@ -1509,8 +1515,8 @@
    pci_set_master (v_info->pcip); /* Gets called twice no harm */

    cfg = (ConfigRid *)iobuf;
    - vreadrid((struct venus_info *)dev->priv,RID_CAPABILITIES,(char *)&xcaps);
    - vreadrid((struct venus_info *)dev->priv,RID_CONFIG,iobuf);
    + vreadrid((struct venus_info *)dev->priv,RID_CAPABILITIES,(char *)&xcaps,sizeof(xcaps));
    + vreadrid((struct venus_info *)dev->priv,RID_CONFIG,iobuf,sizeof(iobuf));

    /*
    * Find out if an extended capability rid was returned
    @@ -1536,7 +1542,7 @@
    for(i=0;i!=6;i++){
    dev->dev_addr[i] = cfg->macAddr[i];
    }
    - printk( KERN_INFO "MPI350 start: MAC %x:%x:%x:%x:%x:%x\n",
    + printk( KERN_INFO "MPI350 start: MAC %02x:%02x:%02x:%02x:%02x:%02x\n",
    dev->dev_addr[0],dev->dev_addr[1],dev->dev_addr[2],
    dev->dev_addr[3],dev->dev_addr[4],dev->dev_addr[5]);

    @@ -1735,7 +1741,7 @@
    break;
    }

    - vreadrid((struct venus_info *)dev->priv,ridcode,iobuf);
    + vreadrid((struct venus_info *)dev->priv,ridcode,iobuf,sizeof(iobuf));

    if (copy_to_user(comp->data, iobuf, MIN (comp->len, sizeof(iobuf))))
    return -EFAULT;
    @@ -1799,7 +1805,7 @@
    case AIROPSTCLR:
    ridcode = RID_STATSDELTACLEAR;
    memset((char *)&v_info->micstats,0,sizeof(v_info->micstats)); /*Clear micstats */
    - vreadrid((struct venus_info *)dev->priv,ridcode,iobuf);
    + vreadrid((struct venus_info *)dev->priv,ridcode,iobuf,sizeof(iobuf));

    if (copy_to_user(comp->data,blargo,MIN(comp->len,sizeof(blargo))))
    return -EFAULT;
    \
     
     \ /
      Last update: 2005-03-22 13:36    [W:0.029 / U:0.308 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site