package/kernel/mac80211/patches/323-0001-brcmfmac-analyze-descriptors-of-current-component-on.patch

   1 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
   2 Date: Tue, 26 Jan 2016 17:57:01 +0100
   3 Subject: [PATCH] brcmfmac: analyze descriptors of current component only
   4 MIME-Version: 1.0
   5 Content-Type: text/plain; charset=UTF-8
   6 Content-Transfer-Encoding: 8bit
   7
   8 So far we were looking for address descriptors without a check for
   9 crossing current component border. In case of dealing with unsupported
  10 descriptor or descriptor missing at all the code would incorrectly get
  11 data from another component.
  12
  13 Consider this binary-described component from BCM4366 EROM:
  14 4bf83b01        TAG==CI         CID==0x83b
  15 20080201        TAG==CI         PORTS==0+1      WRAPPERS==0+1
  16 18400035        TAG==ADDR       SZ_SZD          TYPE_SLAVE
  17 00050000
  18 18107085        TAG==ADDR       SZ_4K           TYPE_SWRAP
  19
  20 Driver was assigning invalid base address to this core:
  21 brcmfmac:  [6 ] core 0x83b:32 base 0x18109000 wrap 0x18107000
  22 which came from totally different component defined in EROM:
  23 43b36701        TAG==CI         CID==0x367
  24 00000201        TAG==CI         PORTS==0+1      WRAPPERS==0+0
  25 18109005        TAG==ADDR       SZ_4K           TYPE_SLAVE
  26
  27 This change will also allow us to support components without wrapper
  28 address in the future.
  29
  30 Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  31 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  32 ---
  33
  34 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
  35 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
  36 @@ -803,7 +803,14 @@ static int brcmf_chip_dmp_get_regaddr(st
  37                                 *eromaddr -= 4;
  38                                 return -EFAULT;
  39                         }
  40 -               } while (desc != DMP_DESC_ADDRESS);
  41 +               } while (desc != DMP_DESC_ADDRESS &&
  42 +                        desc != DMP_DESC_COMPONENT);
  43 +
  44 +               /* stop if we crossed current component border */
  45 +               if (desc == DMP_DESC_COMPONENT) {
  46 +                       *eromaddr -= 4;
  47 +                       return 0;
  48 +               }
  49
  50                 /* skip upper 32-bit address descriptor */
  51                 if (val & DMP_DESC_ADDRSIZE_GT32)