aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel
diff options
context:
space:
mode:
authorRafał Miłecki <zajec5@gmail.com>2016-02-25 20:24:38 +0000
committerRafał Miłecki <zajec5@gmail.com>2016-02-25 20:24:38 +0000
commitb24accd72d72758227165d6b90c7d9001094b5a6 (patch)
tree9c68629574c43224e33b55a31cabca766652b0ff /package/kernel
parent64da662a88aafb7f8a1637fa0e29118445e98252 (diff)
downloadupstream-b24accd72d72758227165d6b90c7d9001094b5a6.tar.gz
upstream-b24accd72d72758227165d6b90c7d9001094b5a6.tar.bz2
upstream-b24accd72d72758227165d6b90c7d9001094b5a6.zip
mac80211: backport brcmfmac fix for sdio sg table alloc crash
Signed-off-by: Rafał Miłecki <zajec5@gmail.com> SVN-Revision: 48781
Diffstat (limited to 'package/kernel')
-rw-r--r--package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch (renamed from package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch)0
-rw-r--r--package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch118
2 files changed, 118 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
index d9511c8d5f..d9511c8d5f 100644
--- a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch
+++ b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch
diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
new file mode 100644
index 0000000000..711e019e2b
--- /dev/null
+++ b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch
@@ -0,0 +1,118 @@
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Tue, 19 Jan 2016 12:39:24 +0100
+Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash
+
+With commit 7d34b0560567 ("brcmfmac: Move all module parameters to
+one place") a bug was introduced causing a null pointer exception.
+This patch fixes the bug by initializing the sg table till after
+the settings have been initialized.
+
+Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place")
+Reported-by: Marc Zyngier <marc.zyngier@arm.com>
+Tested-by: Marc Zyngier <marc.zyngier@arm.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
+ return 0;
+ }
+
+-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
+ {
++ struct sdio_func *func;
++ struct mmc_host *host;
++ uint max_blocks;
+ uint nents;
+ int err;
+
++ func = sdiodev->func[2];
++ host = func->card->host;
++ sdiodev->sg_support = host->max_segs > 1;
++ max_blocks = min_t(uint, host->max_blk_count, 511u);
++ sdiodev->max_request_size = min_t(uint, host->max_req_size,
++ max_blocks * func->cur_blksize);
++ sdiodev->max_segment_count = min_t(uint, host->max_segs,
++ SG_MAX_SINGLE_ALLOC);
++ sdiodev->max_segment_size = host->max_seg_size;
++
+ if (!sdiodev->sg_support)
+ return;
+
+@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc
+
+ static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
+ {
+- struct sdio_func *func;
+- struct mmc_host *host;
+- uint max_blocks;
+ int ret = 0;
+
+ sdiodev->num_funcs = 2;
+@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm
+ goto out;
+ }
+
+- /*
+- * determine host related variables after brcmf_sdiod_probe()
+- * as func->cur_blksize is properly set and F2 init has been
+- * completed successfully.
+- */
+- func = sdiodev->func[2];
+- host = func->card->host;
+- sdiodev->sg_support = host->max_segs > 1;
+- max_blocks = min_t(uint, host->max_blk_count, 511u);
+- sdiodev->max_request_size = min_t(uint, host->max_req_size,
+- max_blocks * func->cur_blksize);
+- sdiodev->max_segment_count = min_t(uint, host->max_segs,
+- SG_MAX_SINGLE_ALLOC);
+- sdiodev->max_segment_size = host->max_seg_size;
+-
+- /* allocate scatter-gather table. sg support
+- * will be disabled upon allocation failure.
+- */
+- brcmf_sdiod_sgtable_alloc(sdiodev);
+-
+ ret = brcmf_sdiod_freezer_attach(sdiodev);
+ if (ret)
+ goto out;
+@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm
+ ret = -ENODEV;
+ goto out;
+ }
+- brcmf_sdiod_host_fixup(host);
++ brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
+ out:
+ if (ret)
+ brcmf_sdiod_remove(sdiodev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ goto fail;
+ }
+
++ /* allocate scatter-gather table. sg support
++ * will be disabled upon allocation failure.
++ */
++ brcmf_sdiod_sgtable_alloc(bus->sdiodev);
++
+ /* Query the F2 block size, set roundup accordingly */
+ bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+ bus->roundup = min(max_roundup, bus->blocksize);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
+
+ /* Issue an abort to the specified function */
+ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
+ void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
+ enum brcmf_sdiod_state state);
+ #ifdef CONFIG_PM_SLEEP