1 files changed, 53 insertions, 36 deletions

diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index d348c265e867..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -15,6 +15,7 @@
 
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
@@ -31,7 +32,7 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS("prism54pci");
 MODULE_FIRMWARE("isl3886pci");
 
-static struct pci_device_id p54p_table[] __devinitdata = {
+static DEFINE_PCI_DEVICE_TABLE(p54p_table) = {
         /* Intersil PRISM Duette/Prism GT Wireless LAN adapter */
         { PCI_DEVICE(0x1260, 0x3890) },
         /* 3COM 3CRWE154G72 Wireless LAN adapter */
@@ -157,6 +158,14 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
                                                  skb_tail_pointer(skb),
                                                  priv->common.rx_mtu + 32,
                                                  PCI_DMA_FROMDEVICE);
+
+                        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                                dev_kfree_skb_any(skb);
+                                dev_err(&priv->pdev->dev,
+                                        "RX DMA Mapping error\n");
+                                break;
+                        }
+
                         desc->host_addr = cpu_to_le32(mapping);
                         desc->device_addr = 0;  // FIXME: necessary?
                         desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
@@ -197,6 +206,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
                         i %= ring_limit;
                         continue;
                 }
+
+                if (unlikely(len > priv->common.rx_mtu)) {
+                        if (net_ratelimit())
+                                dev_err(&priv->pdev->dev, "rx'd frame size "
+                                        "exceeds length threshold.\n");
+
+                        len = priv->common.rx_mtu;
+                }
                 skb_put(skb, len);
 
                 if (p54_rx(dev, skb)) {
@@ -218,25 +235,24 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
         p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
 }
 
-/* caller must hold priv->lock */
 static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         int ring_index, struct p54p_desc *ring, u32 ring_limit,
-        void **tx_buf)
+        struct sk_buff **tx_buf)
 {
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
         struct p54p_desc *desc;
+        struct sk_buff *skb;
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
                 desc = &ring[i];
-                if (tx_buf[i])
-                        if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
-                                p54_free_skb(dev, tx_buf[i]);
+
+                skb = tx_buf[i];
                 tx_buf[i] = NULL;
 
                 pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
@@ -247,17 +263,28 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
                 desc->len = 0;
                 desc->flags = 0;
 
+                if (skb && FREE_AFTER_TX(skb))
+                        p54_free_skb(dev, skb);
+
                 i++;
                 i %= ring_limit;
         }
 }
 
-static void p54p_rx_tasklet(unsigned long dev_id)
+static void p54p_tasklet(unsigned long dev_id)
 {
         struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
 
+        p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+                           ARRAY_SIZE(ring_control->tx_mgmt),
+                           priv->tx_buf_mgmt);
+
+        p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+                           ARRAY_SIZE(ring_control->tx_data),
+                           priv->tx_buf_data);
+
         p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
                 ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
 
@@ -272,59 +299,49 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
 {
         struct ieee80211_hw *dev = dev_id;
         struct p54p_priv *priv = dev->priv;
-        struct p54p_ring_control *ring_control = priv->ring_control;
         __le32 reg;
 
-        spin_lock(&priv->lock);
         reg = P54P_READ(int_ident);
         if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
-                spin_unlock(&priv->lock);
-                return IRQ_HANDLED;
+                goto out;
         }
-
         P54P_WRITE(int_ack, reg);
 
         reg &= P54P_READ(int_enable);
 
-        if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
-                p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
-                                   3, ring_control->tx_mgmt,
-                                   ARRAY_SIZE(ring_control->tx_mgmt),
-                                   priv->tx_buf_mgmt);
-
-                p54p_check_tx_ring(dev, &priv->tx_idx_data,
-                                   1, ring_control->tx_data,
-                                   ARRAY_SIZE(ring_control->tx_data),
-                                   priv->tx_buf_data);
-
-                tasklet_schedule(&priv->rx_tasklet);
-
-        } else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+        if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
+                tasklet_schedule(&priv->tasklet);
+        else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
                 complete(&priv->boot_comp);
 
-        spin_unlock(&priv->lock);
-
+out:
         return reg ? IRQ_HANDLED : IRQ_NONE;
 }
 
 static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
+        unsigned long flags;
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
-        unsigned long flags;
         struct p54p_desc *desc;
         dma_addr_t mapping;
         u32 device_idx, idx, i;
 
         spin_lock_irqsave(&priv->lock, flags);
-
         device_idx = le32_to_cpu(ring_control->device_idx[1]);
         idx = le32_to_cpu(ring_control->host_idx[1]);
         i = idx % ARRAY_SIZE(ring_control->tx_data);
 
-        priv->tx_buf_data[i] = skb;
         mapping = pci_map_single(priv->pdev, skb->data, skb->len,
                                  PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                spin_unlock_irqrestore(&priv->lock, flags);
+                p54_free_skb(dev, skb);
+                dev_err(&priv->pdev->dev, "TX DMA mapping error\n");
+                return ;
+        }
+        priv->tx_buf_data[i] = skb;
+
         desc = &ring_control->tx_data[i];
         desc->host_addr = cpu_to_le32(mapping);
         desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;
@@ -346,14 +363,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
         unsigned int i;
         struct p54p_desc *desc;
 
-        tasklet_kill(&priv->rx_tasklet);
-
         P54P_WRITE(int_enable, cpu_to_le32(0));
         P54P_READ(int_enable);
         udelay(10);
 
         free_irq(priv->pdev->irq, dev);
 
+        tasklet_kill(&priv->tasklet);
+
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
 
         for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
@@ -411,7 +428,7 @@ static int p54p_open(struct ieee80211_hw *dev)
         int err;
 
         init_completion(&priv->boot_comp);
-        err = request_irq(priv->pdev->irq, &p54p_interrupt,
+        err = request_irq(priv->pdev->irq, p54p_interrupt,
                           IRQF_SHARED, "p54pci", dev);
         if (err) {
                 dev_err(&priv->pdev->dev, "failed to register IRQ handler\n");
@@ -537,7 +554,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
         priv->common.tx = p54p_tx;
 
         spin_lock_init(&priv->lock);
-        tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
+        tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
 
         err = request_firmware(&priv->firmware, "isl3886pci",
                                &priv->pdev->dev);