== DF-3643 trace: unchecked PHY-read returns -> uninit stack use ==
-- [site 1] e1000_set_eee_pchlan: declarations 909, unchecked read 959-961
s32 e1000_set_eee_pchlan(struct e1000_hw *hw)
{
	struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
	s32 ret_val;
	u16 lpa, pcs_status, adv, adv_addr, lpi_ctrl, data;

		if (adv & dev_spec->eee_lp_ability & I82579_EEE_1000_SUPPORTED)
			lpi_ctrl |= I82579_LPI_CTRL_1000_ENABLE;

		if (adv & dev_spec->eee_lp_ability & I82579_EEE_100_SUPPORTED) {
			hw->phy.ops.read_reg_locked(hw, PHY_LP_ABILITY, &data);
			if (data & NWAY_LPAR_100TX_FD_CAPS)
				lpi_ctrl |= I82579_LPI_CTRL_100_ENABLE;
			else
				/* EEE is not supported in 100Half, so ignore
				 * partner's EEE in 100 ability if full-duplex
				 * is not advertised.
				 */
				dev_spec->eee_lp_ability &=
				    ~I82579_EEE_100_SUPPORTED;
		}
-- [site 2] check_for_copper_link:1617-1626 read-modify-write of uninit phy_reg (declared 1552)
	s32 ret_val, tipg_reg = 0;
	u16 emi_addr, emi_val = 0;
	bool link;
	u16 phy_reg;

		if (hw->mac.type >= e1000_pch_lpt) {
			hw->phy.ops.read_reg_locked(hw, I217_PLL_CLOCK_GATE_REG,
						    &phy_reg);
			phy_reg &= ~I217_PLL_CLOCK_GATE_MASK;
			if (speed == SPEED_100 || speed == SPEED_10)
				phy_reg |= 0x3E8;
			else
				phy_reg |= 0xFA;
			hw->phy.ops.write_reg_locked(hw,
						     I217_PLL_CLOCK_GATE_REG,
						     phy_reg);
-- [site 3] check_for_copper_link:1765-1772
		/* Workaround for PCHx parts in half-duplex:
		 * Set the number of preambles removed from the packet
		 * when it is passed from the PHY to the MAC to prevent
		 * the MAC from misinterpreting the packet type.
		 */
		hw->phy.ops.read_reg(hw, HV_KMRN_FIFO_CTRLSTA, &phy_reg);
		phy_reg &= ~HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK;

		if ((E1000_READ_REG(hw, E1000_STATUS) & E1000_STATUS_FD) !=
		    E1000_STATUS_FD)
			phy_reg |= (1 << HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT);

		hw->phy.ops.write_reg(hw, HV_KMRN_FIFO_CTRLSTA, phy_reg);
		break;
-- [site 4] lv_jumbo_workaround:2771-2773 unchecked read then OR/write-back
	/* disable Rx path while enabling/disabling workaround */
	hw->phy.ops.read_reg(hw, PHY_REG(769, 20), &phy_reg);
	ret_val = hw->phy.ops.write_reg(hw, PHY_REG(769, 20),
					phy_reg | (1 << 14));
	if (ret_val)
-- [sites 5-8] lv_jumbo 2837-2859 further unchecked RMWs
		hw->phy.ops.read_reg(hw, PHY_REG(769, 23), &data);
		data &= ~(0x7F << 5);
		data |= (0x37 << 5);
		ret_val = hw->phy.ops.write_reg(hw, PHY_REG(769, 23), data);
		if (ret_val)
			return ret_val;
		hw->phy.ops.read_reg(hw, PHY_REG(769, 16), &data);
		data &= ~(1 << 13);
		ret_val = hw->phy.ops.write_reg(hw, PHY_REG(769, 16), data);
		if (ret_val)
			return ret_val;
		hw->phy.ops.read_reg(hw, PHY_REG(776, 20), &data);
		data &= ~(0x3FF << 2);
		data |= (E1000_TX_PTR_GAP << 2);
		ret_val = hw->phy.ops.write_reg(hw, PHY_REG(776, 20), data);
		if (ret_val)
			return ret_val;
		ret_val = hw->phy.ops.write_reg(hw, PHY_REG(776, 23), 0xF100);
		if (ret_val)
			return ret_val;
		hw->phy.ops.read_reg(hw, HV_PM_CTRL, &data);
		ret_val = hw->phy.ops.write_reg(hw, HV_PM_CTRL, data |
						(1 << 10));

-- upstream identical (FreeBSD HEAD) --
1052:			hw->phy.ops.read_reg_locked(hw, PHY_LP_ABILITY, &data);