diff options
2 files changed, 151 insertions, 0 deletions
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch new file mode 100644 index 0000000000..40ba73f66b --- /dev/null +++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch @@ -0,0 +1,99 @@ +--- a/src/drv_mei_cpe_api_intern.c ++++ b/src/drv_mei_cpe_api_intern.c +@@ -421,7 +421,9 @@ IFX_int32_t MEI_InternalMsgSend( + return retVal; + } + +-static IFX_void_t MEI_Internal_DumpMessage( ++#define MEI_Internal_DumpMessage_bufSize 10 ++ ++static IFX_int32_t MEI_Internal_DumpMessage( + MEI_DYN_CNTRL_T *pMeiDynCntrl, + const IFX_uint16_t nMsgId, + const IFX_uint16_t *pData, +@@ -435,15 +437,20 @@ static IFX_void_t MEI_Internal_DumpMessa + IFX_uint8_t i; + const IFX_uint32_t nCommonPayloadSize = 5*nSize/2; + const IFX_uint8_t nInfoSize = 35; +- const IFX_uint8_t nBufSize = 10; + IFX_uint32_t nMsgSize = nCommonPayloadSize + nInfoSize; + IFX_uint32_t nCharsWrittenToBuf = 0; +- char msg[nMsgSize]; +- char buf[nBufSize]; ++ char *msg; ++ char buf[MEI_Internal_DumpMessage_bufSize]; + + if((pData == IFX_NULL) || (nSize < 4)) + { +- return ; ++ return 0; ++ } ++ ++ msg = kcalloc(nMsgSize, sizeof(*msg), GFP_KERNEL); ++ if (!msg) ++ { ++ return -ENOMEM; + } + + pMsg16 = (IFX_uint16_t*)(pData+2); +@@ -464,7 +471,8 @@ static IFX_void_t MEI_Internal_DumpMessa + /* 32-bit payload elements */ + for (i=0; i<((nSize-4)/4); i++) + { +- nCharsWrittenToBuf = snprintf(buf, nBufSize, " %08X", pMsg32[i]); ++ nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize, ++ " %08X", pMsg32[i]); + strncat(msg, buf, nMsgSize); + nMsgSize -= nCharsWrittenToBuf; + } +@@ -474,7 +482,8 @@ static IFX_void_t MEI_Internal_DumpMessa + /* 16-bit payload elements */ + for (i=0; i<((nSize-4)/2); i++) + { +- nCharsWrittenToBuf = snprintf(buf, nBufSize, " %04X", pMsg16[i]); ++ nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize, ++ " %04X", pMsg16[i]); + strncat(msg, buf, nMsgSize); + nMsgSize -= nCharsWrittenToBuf; + } +@@ -482,6 +491,10 @@ static IFX_void_t MEI_Internal_DumpMessa + strncat(msg, MEI_DRV_CRLF, nMsgSize); + + PRN_DBG_USR_RAW(MEI_MSG_DUMP_API, dbg_level, (msg)); ++ ++ kfree(msg); ++ ++ return 0; + } + + IFX_int32_t MEI_InternalSendMessage( +@@ -503,18 +516,25 @@ IFX_int32_t MEI_InternalSendMessage( + msg.ack_msg.pPayload = (unsigned char *)pDataAck; + msg.ack_msg.paylSize_byte = nLenAck; + +- MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId, ++ ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId, + (IFX_uint16_t *)msg.write_msg.pPayload, msg.write_msg.paylSize_byte, + IFX_FALSE, MEI_DRV_PRN_LEVEL_NORMAL); + ++ if (ret < 0) ++ { ++ return ret; ++ } ++ + ret = MEI_InternalMsgSend(pMeiDynCntrl, &msg); + +- if (ret >= 0) ++ if (ret < 0) + { +- MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId, ++ return ret; ++ } ++ ++ ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId, + (IFX_uint16_t *)msg.ack_msg.pPayload, msg.ack_msg.paylSize_byte, + IFX_TRUE, MEI_DRV_PRN_LEVEL_NORMAL); +- } + + return ret; + } diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch new file mode 100644 index 0000000000..63a530b6c5 --- /dev/null +++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch @@ -0,0 +1,52 @@ +--- a/src/drv_mei_cpe_linux.c ++++ b/src/drv_mei_cpe_linux.c +@@ -1267,7 +1267,9 @@ static long MEI_Ioctl( struct file *filp, + MEI_IOCTL_RETURN: + + local_args.drv_ioctl.retCode = ret; +- copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize); ++ if (copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize)) ++ PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR, ++ ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF)); + + return (ret < 0) ? -1 : 0; + } +@@ -3571,9 +3573,11 @@ static int MEI_IoctlMeiDbgAccessWr_Wrap( + ret = MEI_IoctlMeiDbgAccessWr( pMeiDynCntrl, pLocalArgument); + + /* return arguments - count */ +- copy_to_user( (void *)&pUserArgument->count, ++ if (copy_to_user( (void *)&pUserArgument->count, + (void *)&pLocalArgument->count, +- sizeof(pUserArgument->count) ) ; ++ sizeof(pUserArgument->count) )) ++ PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR, ++ ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF)); + + return ret; + } +@@ -3600,16 +3604,20 @@ static int MEI_IoctlMeiDbgAccessRd_Wrap( + if ( pLocalArgument->count ) + { + /* return the buffer */ +- copy_to_user( pUserBuf, ++ if (copy_to_user( pUserBuf, + pLocalArgument->pData_32, +- pLocalArgument->count * sizeof(IFX_uint32_t) ) ; ++ pLocalArgument->count * sizeof(IFX_uint32_t) )) ++ PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR, ++ ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF)); + + } + + /* return count argument */ +- copy_to_user( (void *)&pUserArgument->count, ++ if (copy_to_user( (void *)&pUserArgument->count, + (void *)&pLocalArgument->count, +- sizeof(pUserArgument->count) ) ; ++ sizeof(pUserArgument->count) )) ++ PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR, ++ ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF)); + + return ret; + } |