118 lines
4 KiB
Diff
118 lines
4 KiB
Diff
From: Hante Meuleman <meuleman@broadcom.com>
|
|
Date: Tue, 19 Jan 2016 12:39:24 +0100
|
|
Subject: [PATCH] brcmfmac: fix sdio sg table alloc crash
|
|
|
|
With commit 7d34b0560567 ("brcmfmac: Move all module parameters to
|
|
one place") a bug was introduced causing a null pointer exception.
|
|
This patch fixes the bug by initializing the sg table till after
|
|
the settings have been initialized.
|
|
|
|
Fixes: 7d34b0560567 ("brcmfmac: Move all module parameters to one place")
|
|
Reported-by: Marc Zyngier <marc.zyngier@arm.com>
|
|
Tested-by: Marc Zyngier <marc.zyngier@arm.com>
|
|
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
|
|
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
|
|
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
|
|
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
|
|
Signed-off-by: Arend van Spriel <arend@broadcom.com>
|
|
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
|
---
|
|
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
|
|
@@ -879,11 +879,24 @@ int brcmf_sdiod_abort(struct brcmf_sdio_
|
|
return 0;
|
|
}
|
|
|
|
-static void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
|
|
+void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
|
|
{
|
|
+ struct sdio_func *func;
|
|
+ struct mmc_host *host;
|
|
+ uint max_blocks;
|
|
uint nents;
|
|
int err;
|
|
|
|
+ func = sdiodev->func[2];
|
|
+ host = func->card->host;
|
|
+ sdiodev->sg_support = host->max_segs > 1;
|
|
+ max_blocks = min_t(uint, host->max_blk_count, 511u);
|
|
+ sdiodev->max_request_size = min_t(uint, host->max_req_size,
|
|
+ max_blocks * func->cur_blksize);
|
|
+ sdiodev->max_segment_count = min_t(uint, host->max_segs,
|
|
+ SG_MAX_SINGLE_ALLOC);
|
|
+ sdiodev->max_segment_size = host->max_seg_size;
|
|
+
|
|
if (!sdiodev->sg_support)
|
|
return;
|
|
|
|
@@ -1021,9 +1034,6 @@ static void brcmf_sdiod_host_fixup(struc
|
|
|
|
static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
|
|
{
|
|
- struct sdio_func *func;
|
|
- struct mmc_host *host;
|
|
- uint max_blocks;
|
|
int ret = 0;
|
|
|
|
sdiodev->num_funcs = 2;
|
|
@@ -1054,26 +1064,6 @@ static int brcmf_sdiod_probe(struct brcm
|
|
goto out;
|
|
}
|
|
|
|
- /*
|
|
- * determine host related variables after brcmf_sdiod_probe()
|
|
- * as func->cur_blksize is properly set and F2 init has been
|
|
- * completed successfully.
|
|
- */
|
|
- func = sdiodev->func[2];
|
|
- host = func->card->host;
|
|
- sdiodev->sg_support = host->max_segs > 1;
|
|
- max_blocks = min_t(uint, host->max_blk_count, 511u);
|
|
- sdiodev->max_request_size = min_t(uint, host->max_req_size,
|
|
- max_blocks * func->cur_blksize);
|
|
- sdiodev->max_segment_count = min_t(uint, host->max_segs,
|
|
- SG_MAX_SINGLE_ALLOC);
|
|
- sdiodev->max_segment_size = host->max_seg_size;
|
|
-
|
|
- /* allocate scatter-gather table. sg support
|
|
- * will be disabled upon allocation failure.
|
|
- */
|
|
- brcmf_sdiod_sgtable_alloc(sdiodev);
|
|
-
|
|
ret = brcmf_sdiod_freezer_attach(sdiodev);
|
|
if (ret)
|
|
goto out;
|
|
@@ -1084,7 +1074,7 @@ static int brcmf_sdiod_probe(struct brcm
|
|
ret = -ENODEV;
|
|
goto out;
|
|
}
|
|
- brcmf_sdiod_host_fixup(host);
|
|
+ brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
|
|
out:
|
|
if (ret)
|
|
brcmf_sdiod_remove(sdiodev);
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
|
@@ -4114,6 +4114,11 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
|
|
goto fail;
|
|
}
|
|
|
|
+ /* allocate scatter-gather table. sg support
|
|
+ * will be disabled upon allocation failure.
|
|
+ */
|
|
+ brcmf_sdiod_sgtable_alloc(bus->sdiodev);
|
|
+
|
|
/* Query the F2 block size, set roundup accordingly */
|
|
bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
|
|
bus->roundup = min(max_roundup, bus->blocksize);
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
|
|
@@ -342,6 +342,7 @@ int brcmf_sdiod_ramrw(struct brcmf_sdio_
|
|
|
|
/* Issue an abort to the specified function */
|
|
int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
|
|
+void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev);
|
|
void brcmf_sdiod_change_state(struct brcmf_sdio_dev *sdiodev,
|
|
enum brcmf_sdiod_state state);
|
|
#ifdef CONFIG_PM_SLEEP
|