From 6be4452b15f320788674a02807faf1b3074373d6 Mon Sep 17 00:00:00 2001 From: rmilecki Date: Thu, 25 Feb 2016 20:24:38 +0000 Subject: [PATCH] mac80211: backport brcmfmac fix for sdio sg table alloc crash MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Signed-off-by: Rafał Miłecki git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48781 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- ...h => 309-01-brcmfmac-add-missing-include.patch} | 0 ...02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch | 118 +++++++++++++++++++++ 2 files changed, 118 insertions(+) rename package/kernel/mac80211/patches/{309-brcmfmac-add-missing-include.patch => 309-01-brcmfmac-add-missing-include.patch} (100%) create mode 100644 package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch diff --git a/package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch b/package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch similarity index 100% rename from package/kernel/mac80211/patches/309-brcmfmac-add-missing-include.patch rename to package/kernel/mac80211/patches/309-01-brcmfmac-add-missing-include.patch diff --git a/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch new file mode 100644 index 0000000000..711e019e2b --- /dev/null +++ b/package/kernel/mac80211/patches/309-02-brcmfmac-fix-sdio-sg-table-alloc-crash.patch @@ -0,0 +1,118 @@ +From: Hante Meuleman +Date: Tue, 19 Jan 2016 12:39:24 +0100 +Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash + +With commit 7d34b0560567 ("brcmfmac: Move all module parameters to +one place") a bug was introduced causing a null pointer exception. +This patch fixes the bug by initializing the sg table till after +the settings have been initialized. + +Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place") +Reported-by: Marc Zyngier +Tested-by: Marc Zyngier +Reviewed-by: Arend Van Spriel +Reviewed-by: Franky (Zhenhui) Lin +Reviewed-by: Pieter-Paul Giesberts +Signed-off-by: Hante Meuleman +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_ + return 0; + } + +-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) ++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) + { ++ struct sdio_func *func; ++ struct mmc_host *host; ++ uint max_blocks; + uint nents; + int err; + ++ func = sdiodev->func[2]; ++ host = func->card->host; ++ sdiodev->sg_support = host->max_segs > 1; ++ max_blocks = min_t(uint, host->max_blk_count, 511u); ++ sdiodev->max_request_size = min_t(uint, host->max_req_size, ++ max_blocks * func->cur_blksize); ++ sdiodev->max_segment_count = min_t(uint, host->max_segs, ++ SG_MAX_SINGLE_ALLOC); ++ sdiodev->max_segment_size = host->max_seg_size; ++ + if (!sdiodev->sg_support) + return; + +@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc + + static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev) + { +- struct sdio_func *func; +- struct mmc_host *host; +- uint max_blocks; + int ret = 0; + + sdiodev->num_funcs = 2; +@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm + goto out; + } + +- /* +- * determine host related variables after brcmf_sdiod_probe() +- * as func->cur_blksize is properly set and F2 init has been +- * completed successfully. +- */ +- func = sdiodev->func[2]; +- host = func->card->host; +- sdiodev->sg_support = host->max_segs > 1; +- max_blocks = min_t(uint, host->max_blk_count, 511u); +- sdiodev->max_request_size = min_t(uint, host->max_req_size, +- max_blocks * func->cur_blksize); +- sdiodev->max_segment_count = min_t(uint, host->max_segs, +- SG_MAX_SINGLE_ALLOC); +- sdiodev->max_segment_size = host->max_seg_size; +- +- /* allocate scatter-gather table. sg support +- * will be disabled upon allocation failure. +- */ +- brcmf_sdiod_sgtable_alloc(sdiodev); +- + ret = brcmf_sdiod_freezer_attach(sdiodev); + if (ret) + goto out; +@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm + ret = -ENODEV; + goto out; + } +- brcmf_sdiod_host_fixup(host); ++ brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host); + out: + if (ret) + brcmf_sdiod_remove(sdiodev); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru + goto fail; + } + ++ /* allocate scatter-gather table. sg support ++ * will be disabled upon allocation failure. ++ */ ++ brcmf_sdiod_sgtable_alloc(bus->sdiodev); ++ + /* Query the F2 block size, set roundup accordingly */ + bus->blocksize = bus->sdiodev->func[2]->cur_blksize; + bus->roundup = min(max_roundup, bus->blocksize); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_ + + /* Issue an abort to the specified function */ + int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn); ++void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev); + void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev, + enum brcmf_sdiod_state state); + #ifdef CONFIG_PM_SLEEP -- 2.11.0