diff options
Diffstat (limited to 'package/kernel/mac80211/patches')
| -rw-r--r-- | package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch (renamed from package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch) | 0 | ||||
| -rw-r--r-- | package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch | 118 |
2 files changed, 118 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch index d9511c8d5f..d9511c8d5f 100644 --- a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch +++ b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch new file mode 100644 index 0000000000..711e019e2b --- /dev/null +++ b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch @@ -0,0 +1,118 @@ +From: Hante Meuleman <meuleman@broadcom.com> +Date: Tue, 19 Jan 2016 12:39:24 +0100 +Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash + +With commit 7d34b0560567 ("brcmfmac: Move all module parameters to +one place") a bug was introduced causing a null pointer exception. +This patch fixes the bug by initializing the sg table till after +the settings have been initialized. + +Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place") +Reported-by: Marc Zyngier <marc.zyngier@arm.com> +Tested-by: Marc Zyngier <marc.zyngier@arm.com> +Reviewed-by: Arend Van Spriel <arend@broadcom.com> +Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com> +Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> +Signed-off-by: Hante Meuleman <meuleman@broadcom.com> +Signed-off-by: Arend van Spriel <arend@broadcom.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_ + return 0; + } + +-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) ++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) + { ++ struct sdio_func *func; ++ struct mmc_host *host; ++ uint max_blocks; + uint nents; + int err; + ++ func = sdiodev->func[2]; ++ host = func->card->host; ++ sdiodev->sg_support = host->max_segs > 1; ++ max_blocks = min_t(uint, host->max_blk_count, 511u); ++ sdiodev->max_request_size = min_t(uint, host->max_req_size, ++ max_blocks * func->cur_blksize); ++ sdiodev->max_segment_count = min_t(uint, host->max_segs, ++ SG_MAX_SINGLE_ALLOC); ++ sdiodev->max_segment_size = host->max_seg_size; ++ + if (!sdiodev->sg_support) + return; + +@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc + + static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev) + { +- struct sdio_func *func; +- struct mmc_host *host; +- uint max_blocks; + int ret = 0; + + sdiodev->num_funcs = 2; +@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm + goto out; + } + +- /* +- * determine host related variables after brcmf_sdiod_probe() +- * as func->cur_blksize is properly set and F2 init has been +- * completed successfully. +- */ +- func = sdiodev->func[2]; +- host = func->card->host; +- sdiodev->sg_support = host->max_segs > 1; +- max_blocks = min_t(uint, host->max_blk_count, 511u); +- sdiodev->max_request_size = min_t(uint, host->max_req_size, +- max_blocks * func->cur_blksize); +- sdiodev->max_segment_count = min_t(uint, host->max_segs, +- SG_MAX_SINGLE_ALLOC); +- sdiodev->max_segment_size = host->max_seg_size; +- +- /* allocate scatter-gather table. sg support +- * will be disabled upon allocation failure. +- */ +- brcmf_sdiod_sgtable_alloc(sdiodev); +- + ret = brcmf_sdiod_freezer_attach(sdiodev); + if (ret) + goto out; +@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm + ret = -ENODEV; + goto out; + } +- brcmf_sdiod_host_fixup(host); ++ brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host); + out: + if (ret) + brcmf_sdiod_remove(sdiodev); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru + goto fail; + } + ++ /* allocate scatter-gather table. sg support ++ * will be disabled upon allocation failure. ++ */ ++ brcmf_sdiod_sgtable_alloc(bus->sdiodev); ++ + /* Query the F2 block size, set roundup accordingly */ + bus->blocksize = bus->sdiodev->func[2]->cur_blksize; + bus->roundup = min(max_roundup, bus->blocksize); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_ + + /* Issue an abort to the specified function */ + int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn); ++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev); + void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev, + enum brcmf_sdiod_state state); + #ifdef CONFIG_PM_SLEEP |