6 files changed, 225 insertions, 59 deletions

diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 144d2e880422..174ac8ef82fa 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -53,8 +53,8 @@
 
 #define _NETXEN_NIC_LINUX_MAJOR 4
 #define _NETXEN_NIC_LINUX_MINOR 0
-#define _NETXEN_NIC_LINUX_SUBVERSION 72
-#define NETXEN_NIC_LINUX_VERSIONID  "4.0.72"
+#define _NETXEN_NIC_LINUX_SUBVERSION 73
+#define NETXEN_NIC_LINUX_VERSIONID  "4.0.73"
 
 #define NETXEN_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
@@ -420,7 +420,6 @@ struct status_desc {
 } __attribute__ ((aligned(16)));
 
 /* UNIFIED ROMIMAGE *************************/
-#define NX_UNI_FW_MIN_SIZE              0xc8000
 #define NX_UNI_DIR_SECT_PRODUCT_TBL     0x0
 #define NX_UNI_DIR_SECT_BOOTLD          0x6
 #define NX_UNI_DIR_SECT_FW              0x7
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index 2a8ef5fc9663..f26e54716c88 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -669,13 +669,15 @@ int netxen_alloc_hw_resources(struct netxen_adapter *adapter)
                 }
                 sds_ring->desc_head = (struct status_desc *)addr;
 
-                sds_ring->crb_sts_consumer =
-                        netxen_get_ioaddr(adapter,
-                        recv_crb_registers[port].crb_sts_consumer[ring]);
+                if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
+                        sds_ring->crb_sts_consumer =
+                                netxen_get_ioaddr(adapter,
+                                recv_crb_registers[port].crb_sts_consumer[ring]);
 
-                sds_ring->crb_intr_mask =
-                        netxen_get_ioaddr(adapter,
-                        recv_crb_registers[port].sw_int_mask[ring]);
+                        sds_ring->crb_intr_mask =
+                                netxen_get_ioaddr(adapter,
+                                recv_crb_registers[port].sw_int_mask[ring]);
+                }
         }
 
 
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index f8499e56cbee..aecba787f7c8 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -703,6 +703,11 @@ netxen_nic_get_ethtool_stats(struct net_device *dev,
         }
 }
 
+static u32 netxen_nic_get_tx_csum(struct net_device *dev)
+{
+        return dev->features & NETIF_F_IP_CSUM;
+}
+
 static u32 netxen_nic_get_rx_csum(struct net_device *dev)
 {
         struct netxen_adapter *adapter = netdev_priv(dev);
@@ -909,6 +914,7 @@ const struct ethtool_ops netxen_nic_ethtool_ops = {
         .set_ringparam = netxen_nic_set_ringparam,
         .get_pauseparam = netxen_nic_get_pauseparam,
         .set_pauseparam = netxen_nic_set_pauseparam,
+        .get_tx_csum = netxen_nic_get_tx_csum,
         .set_tx_csum = ethtool_op_set_tx_csum,
         .set_sg = ethtool_op_set_sg,
         .get_tso = netxen_nic_get_tso,
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index a945591298a8..5e5fe2fd6397 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -23,6 +23,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include "netxen_nic.h"
 #include "netxen_nic_hw.h"
 
@@ -537,7 +538,7 @@ netxen_nic_set_mcast_addr(struct netxen_adapter *adapter,
 void netxen_p2_nic_set_multi(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
-        struct dev_mc_list *mc_ptr;
+        struct netdev_hw_addr *ha;
         u8 null_addr[6];
         int i;
 
@@ -571,8 +572,8 @@ void netxen_p2_nic_set_multi(struct net_device *netdev)
         netxen_nic_enable_mcast_filter(adapter);
 
         i = 0;
-        netdev_for_each_mc_addr(mc_ptr, netdev)
-                netxen_nic_set_mcast_addr(adapter, i++, mc_ptr->dmi_addr);
+        netdev_for_each_mc_addr(ha, netdev)
+                netxen_nic_set_mcast_addr(adapter, i++, ha->addr);
 
         /* Clear out remaining addresses */
         while (i < adapter->max_mc_count)
@@ -680,7 +681,7 @@ static int nx_p3_nic_add_mac(struct netxen_adapter *adapter,
 void netxen_p3_nic_set_multi(struct net_device *netdev)
 {
         struct netxen_adapter *adapter = netdev_priv(netdev);
-        struct dev_mc_list *mc_ptr;
+        struct netdev_hw_addr *ha;
         u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
         u32 mode = VPORT_MISS_MODE_DROP;
         LIST_HEAD(del_list);
@@ -707,8 +708,8 @@ void netxen_p3_nic_set_multi(struct net_device *netdev)
         }
 
         if (!netdev_mc_empty(netdev)) {
-                netdev_for_each_mc_addr(mc_ptr, netdev)
-                        nx_p3_nic_add_mac(adapter, mc_ptr->dmi_addr, &del_list);
+                netdev_for_each_mc_addr(ha, netdev)
+                        nx_p3_nic_add_mac(adapter, ha->addr, &del_list);
         }
 
 send_fw_cmd:
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 1c63610ead42..388feaf60ee7 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -25,6 +25,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include "netxen_nic.h"
 #include "netxen_nic_hw.h"
 
@@ -613,22 +614,123 @@ static struct uni_table_desc *nx_get_table_desc(const u8 *unirom, int section)
         return NULL;
 }
 
+#define QLCNIC_FILEHEADER_SIZE  (14 * 4)
+
 static int
-nx_set_product_offs(struct netxen_adapter *adapter)
-{
-        struct uni_table_desc *ptab_descr;
+netxen_nic_validate_header(struct netxen_adapter *adapter)
+ {
         const u8 *unirom = adapter->fw->data;
-        uint32_t i;
+        struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
+        u32 fw_file_size = adapter->fw->size;
+        u32 tab_size;
         __le32 entries;
+        __le32 entry_size;
+
+        if (fw_file_size < QLCNIC_FILEHEADER_SIZE)
+                return -EINVAL;
+
+        entries = cpu_to_le32(directory->num_entries);
+        entry_size = cpu_to_le32(directory->entry_size);
+        tab_size = cpu_to_le32(directory->findex) + (entries * entry_size);
+
+        if (fw_file_size < tab_size)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int
+netxen_nic_validate_bootld(struct netxen_adapter *adapter)
+{
+        struct uni_table_desc *tab_desc;
+        struct uni_data_desc *descr;
+        const u8 *unirom = adapter->fw->data;
+        __le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+                                NX_UNI_BOOTLD_IDX_OFF));
+        u32 offs;
+        u32 tab_size;
+        u32 data_size;
+
+        tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_BOOTLD);
+
+        if (!tab_desc)
+                return -EINVAL;
+
+        tab_size = cpu_to_le32(tab_desc->findex) +
+                        (cpu_to_le32(tab_desc->entry_size) * (idx + 1));
+
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
+
+        offs = cpu_to_le32(tab_desc->findex) +
+                (cpu_to_le32(tab_desc->entry_size) * (idx));
+        descr = (struct uni_data_desc *)&unirom[offs];
+
+        data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
+
+        if (adapter->fw->size < data_size)
+                return -EINVAL;
 
+        return 0;
+}
+
+static int
+netxen_nic_validate_fw(struct netxen_adapter *adapter)
+{
+        struct uni_table_desc *tab_desc;
+        struct uni_data_desc *descr;
+        const u8 *unirom = adapter->fw->data;
+        __le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+                                NX_UNI_FIRMWARE_IDX_OFF));
+        u32 offs;
+        u32 tab_size;
+        u32 data_size;
+
+        tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_FW);
+
+        if (!tab_desc)
+                return -EINVAL;
+
+        tab_size = cpu_to_le32(tab_desc->findex) +
+                        (cpu_to_le32(tab_desc->entry_size) * (idx + 1));
+
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
+
+        offs = cpu_to_le32(tab_desc->findex) +
+                (cpu_to_le32(tab_desc->entry_size) * (idx));
+        descr = (struct uni_data_desc *)&unirom[offs];
+        data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
+
+        if (adapter->fw->size < data_size)
+                return -EINVAL;
+
+        return 0;
+}
+
+
+static int
+netxen_nic_validate_product_offs(struct netxen_adapter *adapter)
+{
+        struct uni_table_desc *ptab_descr;
+        const u8 *unirom = adapter->fw->data;
         int mn_present = (NX_IS_REVISION_P2(adapter->ahw.revision_id)) ?
                         1 : netxen_p3_has_mn(adapter);
+        __le32 entries;
+        __le32 entry_size;
+        u32 tab_size;
+        u32 i;
 
         ptab_descr = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_PRODUCT_TBL);
         if (ptab_descr == NULL)
-                return -1;
+                return -EINVAL;
 
         entries = cpu_to_le32(ptab_descr->num_entries);
+        entry_size = cpu_to_le32(ptab_descr->entry_size);
+        tab_size = cpu_to_le32(ptab_descr->findex) + (entries * entry_size);
+
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
 
 nomn:
         for (i = 0; i < entries; i++) {
@@ -657,9 +759,38 @@ nomn:
                 goto nomn;
         }
 
-        return -1;
+        return -EINVAL;
 }
 
+static int
+netxen_nic_validate_unified_romimage(struct netxen_adapter *adapter)
+{
+        if (netxen_nic_validate_header(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: header validation failed\n");
+                return -EINVAL;
+        }
+
+        if (netxen_nic_validate_product_offs(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: product validation failed\n");
+                return -EINVAL;
+        }
+
+        if (netxen_nic_validate_bootld(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: bootld validation failed\n");
+                return -EINVAL;
+        }
+
+        if (netxen_nic_validate_fw(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: firmware validation failed\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
 
 static struct uni_data_desc *nx_get_data_desc(struct netxen_adapter *adapter,
                         u32 section, u32 idx_offset)
@@ -761,7 +892,7 @@ nx_get_bios_version(struct netxen_adapter *adapter)
         if (adapter->fw_type == NX_UNIFIED_ROMIMAGE) {
                 bios_ver = cpu_to_le32(*((u32 *) (&fw->data[prd_off])
                                                 + NX_UNI_BIOS_VERSION_OFF));
-                return (bios_ver << 24) + ((bios_ver >> 8) & 0xff00) +
+                return (bios_ver << 16) + ((bios_ver >> 8) & 0xff00) +
                                                         (bios_ver >> 24);
         } else
                 return cpu_to_le32(*(u32 *)&fw->data[NX_BIOS_VERSION_OFFSET]);
@@ -889,6 +1020,16 @@ netxen_load_firmware(struct netxen_adapter *adapter)
 
                         flashaddr += 8;
                 }
+
+                size = (__force u32)nx_get_fw_size(adapter) % 8;
+                if (size) {
+                        data = cpu_to_le64(ptr64[i]);
+
+                        if (adapter->pci_mem_write(adapter,
+                                                flashaddr, data))
+                                return -EIO;
+                }
+
         } else {
                 u64 data;
                 u32 hi, lo;
@@ -933,27 +1074,23 @@ static int
 netxen_validate_firmware(struct netxen_adapter *adapter)
 {
         __le32 val;
-        u32 ver, min_ver, bios, min_size;
+        u32 ver, min_ver, bios;
         struct pci_dev *pdev = adapter->pdev;
         const struct firmware *fw = adapter->fw;
         u8 fw_type = adapter->fw_type;
 
         if (fw_type == NX_UNIFIED_ROMIMAGE) {
-                if (nx_set_product_offs(adapter))
+                if (netxen_nic_validate_unified_romimage(adapter))
                         return -EINVAL;
-
-                min_size = NX_UNI_FW_MIN_SIZE;
         } else {
                 val = cpu_to_le32(*(u32 *)&fw->data[NX_FW_MAGIC_OFFSET]);
                 if ((__force u32)val != NETXEN_BDINFO_MAGIC)
                         return -EINVAL;
 
-                min_size = NX_FW_MIN_SIZE;
+                if (fw->size < NX_FW_MIN_SIZE)
+                        return -EINVAL;
         }
 
-        if (fw->size < min_size)
-                return -EINVAL;
-
         val = nx_get_fw_version(adapter);
 
         if (NX_IS_REVISION_P3(adapter->ahw.revision_id))
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 08780ef1c1f8..b665b420a4f2 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -23,6 +23,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/interrupt.h>
 #include "netxen_nic_hw.h"
@@ -604,16 +605,14 @@ netxen_cleanup_pci_map(struct netxen_adapter *adapter)
 static int
 netxen_setup_pci_map(struct netxen_adapter *adapter)
 {
-        void __iomem *mem_ptr0 = NULL;
-        void __iomem *mem_ptr1 = NULL;
-        void __iomem *mem_ptr2 = NULL;
         void __iomem *db_ptr = NULL;
 
         resource_size_t mem_base, db_base;
-        unsigned long mem_len, db_len = 0, pci_len0 = 0;
+        unsigned long mem_len, db_len = 0;
 
         struct pci_dev *pdev = adapter->pdev;
         int pci_func = adapter->ahw.pci_func;
+        struct netxen_hardware_context *ahw = &adapter->ahw;
 
         int err = 0;
 
@@ -630,24 +629,40 @@ netxen_setup_pci_map(struct netxen_adapter *adapter)
 
         /* 128 Meg of memory */
         if (mem_len == NETXEN_PCI_128MB_SIZE) {
-                mem_ptr0 = ioremap(mem_base, FIRST_PAGE_GROUP_SIZE);
-                mem_ptr1 = ioremap(mem_base + SECOND_PAGE_GROUP_START,
+
+                ahw->pci_base0 = ioremap(mem_base, FIRST_PAGE_GROUP_SIZE);
+                ahw->pci_base1 = ioremap(mem_base + SECOND_PAGE_GROUP_START,
                                 SECOND_PAGE_GROUP_SIZE);
-                mem_ptr2 = ioremap(mem_base + THIRD_PAGE_GROUP_START,
+                ahw->pci_base2 = ioremap(mem_base + THIRD_PAGE_GROUP_START,
                                 THIRD_PAGE_GROUP_SIZE);
-                pci_len0 = FIRST_PAGE_GROUP_SIZE;
+                if (ahw->pci_base0 == NULL || ahw->pci_base1 == NULL ||
+                                                ahw->pci_base2 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        err = -EIO;
+                        goto err_out;
+                }
+
+                ahw->pci_len0 = FIRST_PAGE_GROUP_SIZE;
+
         } else if (mem_len == NETXEN_PCI_32MB_SIZE) {
-                mem_ptr1 = ioremap(mem_base, SECOND_PAGE_GROUP_SIZE);
-                mem_ptr2 = ioremap(mem_base + THIRD_PAGE_GROUP_START -
+
+                ahw->pci_base1 = ioremap(mem_base, SECOND_PAGE_GROUP_SIZE);
+                ahw->pci_base2 = ioremap(mem_base + THIRD_PAGE_GROUP_START -
                         SECOND_PAGE_GROUP_START, THIRD_PAGE_GROUP_SIZE);
+                if (ahw->pci_base1 == NULL || ahw->pci_base2 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        err = -EIO;
+                        goto err_out;
+                }
+
         } else if (mem_len == NETXEN_PCI_2MB_SIZE) {
 
-                mem_ptr0 = pci_ioremap_bar(pdev, 0);
-                if (mem_ptr0 == NULL) {
+                ahw->pci_base0 = pci_ioremap_bar(pdev, 0);
+                if (ahw->pci_base0 == NULL) {
                         dev_err(&pdev->dev, "failed to map PCI bar 0\n");
                         return -EIO;
                 }
-                pci_len0 = mem_len;
+                ahw->pci_len0 = mem_len;
         } else {
                 return -EIO;
         }
@@ -656,11 +671,6 @@ netxen_setup_pci_map(struct netxen_adapter *adapter)
 
         dev_info(&pdev->dev, "%dMB memory map\n", (int)(mem_len>>20));
 
-        adapter->ahw.pci_base0 = mem_ptr0;
-        adapter->ahw.pci_len0 = pci_len0;
-        adapter->ahw.pci_base1 = mem_ptr1;
-        adapter->ahw.pci_base2 = mem_ptr2;
-
         if (NX_IS_REVISION_P3P(adapter->ahw.revision_id)) {
                 adapter->ahw.ocm_win_crb = netxen_get_ioaddr(adapter,
                         NETXEN_PCIX_PS_REG(PCIX_OCM_WINDOW_REG(pci_func)));
@@ -772,15 +782,22 @@ netxen_check_options(struct netxen_adapter *adapter)
         if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
                 adapter->msix_supported = !!use_msi_x;
                 adapter->rss_supported = !!use_msi_x;
-        } else if (adapter->fw_version >= NETXEN_VERSION_CODE(3, 4, 336)) {
-                switch (adapter->ahw.board_type) {
-                case NETXEN_BRDTYPE_P2_SB31_10G:
-                case NETXEN_BRDTYPE_P2_SB31_10G_CX4:
-                        adapter->msix_supported = !!use_msi_x;
-                        adapter->rss_supported = !!use_msi_x;
-                        break;
-                default:
-                        break;
+        } else {
+                u32 flashed_ver = 0;
+                netxen_rom_fast_read(adapter,
+                                NX_FW_VERSION_OFFSET, (int *)&flashed_ver);
+                flashed_ver = NETXEN_DECODE_VERSION(flashed_ver);
+
+                if (flashed_ver >= NETXEN_VERSION_CODE(3, 4, 336)) {
+                        switch (adapter->ahw.board_type) {
+                        case NETXEN_BRDTYPE_P2_SB31_10G:
+                        case NETXEN_BRDTYPE_P2_SB31_10G_CX4:
+                                adapter->msix_supported = !!use_msi_x;
+                                adapter->rss_supported = !!use_msi_x;
+                                break;
+                        default:
+                                break;
+                        }
                 }
         }
 
@@ -1246,8 +1263,8 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int pci_func_id = PCI_FUNC(pdev->devfn);
         uint8_t revision_id;
 
-        if (pdev->revision >= NX_P3_A0 && pdev->revision < NX_P3_B1) {
-                pr_warning("%s: chip revisions between 0x%x-0x%x"
+        if (pdev->revision >= NX_P3_A0 && pdev->revision <= NX_P3_B1) {
+                pr_warning("%s: chip revisions between 0x%x-0x%x "
                                 "will not be enabled.\n",
                                 module_name(THIS_MODULE), NX_P3_A0, NX_P3_B1);
                 return -ENODEV;
@@ -2294,6 +2311,7 @@ netxen_fwinit_work(struct work_struct *work)
                 }
                 break;
 
+        case NX_DEV_NEED_RESET:
         case NX_DEV_INITALIZING:
                 if (++adapter->fw_wait_cnt < FW_POLL_THRESH) {
                         netxen_schedule_work(adapter,
@@ -2337,6 +2355,9 @@ netxen_detach_work(struct work_struct *work)
 
         ref_cnt = nx_decr_dev_ref_cnt(adapter);
 
+        if (ref_cnt == -EIO)
+                goto err_ret;
+
         delay = (ref_cnt == 0) ? 0 : (2 * FW_POLL_DELAY);
 
         adapter->fw_wait_cnt = 0;