Commit 5dcf5e6b authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] Mac ADB IOP fix

From: Geert Uytterhoeven <geert@linux-m68k.org>

Mac ADB IOP: Fix improperly initialized request struct in the reset code,
causing a bogus pointer (from Matthias Urlichs)
parent 701819b6
...@@ -105,18 +105,19 @@ static void adb_iop_listen(struct iop_msg *msg, struct pt_regs *regs) ...@@ -105,18 +105,19 @@ static void adb_iop_listen(struct iop_msg *msg, struct pt_regs *regs)
struct adb_iopmsg *amsg = (struct adb_iopmsg *) msg->message; struct adb_iopmsg *amsg = (struct adb_iopmsg *) msg->message;
struct adb_request *req; struct adb_request *req;
uint flags; uint flags;
#ifdef DEBUG_ADB_IOP
int i;
#endif
local_irq_save(flags); local_irq_save(flags);
req = current_req; req = current_req;
#ifdef DEBUG_ADB_IOP #ifdef DEBUG_ADB_IOP
printk("adb_iop_listen: rcvd packet, %d bytes: %02X %02X", printk("adb_iop_listen %p: rcvd packet, %d bytes: %02X %02X", req,
(uint) amsg->count + 2, (uint) amsg->flags, (uint) amsg->cmd); (uint) amsg->count + 2, (uint) amsg->flags, (uint) amsg->cmd);
i = 0; for (i = 0; i < amsg->count; i++)
while (i < amsg->count) { printk(" %02X", (uint) amsg->data[i]);
printk(" %02X", (uint) amsg->data[i++]);
}
printk("\n"); printk("\n");
#endif #endif
...@@ -134,7 +135,7 @@ static void adb_iop_listen(struct iop_msg *msg, struct pt_regs *regs) ...@@ -134,7 +135,7 @@ static void adb_iop_listen(struct iop_msg *msg, struct pt_regs *regs)
adb_iop_end_req(req, idle); adb_iop_end_req(req, idle);
} }
} else { } else {
/* TODO: is it possible for more tha one chunk of data */ /* TODO: is it possible for more than one chunk of data */
/* to arrive before the timeout? If so we need to */ /* to arrive before the timeout? If so we need to */
/* use reply_ptr here like the other drivers do. */ /* use reply_ptr here like the other drivers do. */
if ((adb_iop_state == awaiting_reply) && if ((adb_iop_state == awaiting_reply) &&
...@@ -163,6 +164,9 @@ static void adb_iop_start(void) ...@@ -163,6 +164,9 @@ static void adb_iop_start(void)
unsigned long flags; unsigned long flags;
struct adb_request *req; struct adb_request *req;
struct adb_iopmsg amsg; struct adb_iopmsg amsg;
#ifdef DEBUG_ADB_IOP
int i;
#endif
/* get the packet to send */ /* get the packet to send */
req = current_req; req = current_req;
...@@ -171,7 +175,7 @@ static void adb_iop_start(void) ...@@ -171,7 +175,7 @@ static void adb_iop_start(void)
local_irq_save(flags); local_irq_save(flags);
#ifdef DEBUG_ADB_IOP #ifdef DEBUG_ADB_IOP
printk("adb_iop_start: sending packet, %d bytes:", req->nbytes); printk("adb_iop_start %p: sending packet, %d bytes:", req, req->nbytes);
for (i = 0 ; i < req->nbytes ; i++) for (i = 0 ; i < req->nbytes ; i++)
printk(" %02X", (uint) req->data[i]); printk(" %02X", (uint) req->data[i]);
printk("\n"); printk("\n");
...@@ -267,13 +271,17 @@ void adb_iop_poll(void) ...@@ -267,13 +271,17 @@ void adb_iop_poll(void)
int adb_iop_reset_bus(void) int adb_iop_reset_bus(void)
{ {
struct adb_request req; struct adb_request req = {
.reply_expected = 0,
.nbytes = 2,
.data = { ADB_PACKET, 0 },
};
req.reply_expected = 0;
req.nbytes = 2;
req.data[0] = ADB_PACKET;
req.data[1] = 0; /* RESET */
adb_iop_write(&req); adb_iop_write(&req);
while (!req.complete) adb_iop_poll(); while (!req.complete) {
adb_iop_poll();
schedule();
}
return 0; return 0;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment