package/kernel/mac80211/patches/346-rtl8192cu-Prevent-Ooops-under-rtl92c_set_fw_rsvdpage.patch

   1 From: Karsten Wiese <fzuuzf@googlemail.com>
   2 Date: Wed, 22 Oct 2014 15:47:34 +0200
   3 Subject: [PATCH] rtl8192cu: Prevent Ooops under rtl92c_set_fw_rsvdpagepkt
   4
   5 rtl92c_set_fw_rsvdpagepkt is used by rtl8192cu and its pci sibling rtl8192ce.
   6 rtl_cmd_send_packet crashes when called inside rtl8192cu because it works on
   7 memory allocated only by rtl8192ce.
   8 Fix the crash by calling a dummy function when used in rtl8192cu.
   9 Comparision with the realtek vendor driver makes me think, something is missing in
  10 the dummy function.
  11 Short test as WPA2 station show good results connected to an 802.11g basestation.
  12 Traffic stops after few MBytes as WPA2 station connected to an 802.11n basestation.
  13
  14 Signed-off-by: Karsten Wiese <fzuuzf@googlemail.com>
  15 ---
  16
  17 --- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
  18 +++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
  19 @@ -656,7 +656,8 @@ static u8 reserved_page_packet[TOTAL_RES
  20         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  21  };
  22
  23 -void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
  24 +void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
  25 +        bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *))
  26  {
  27         struct rtl_priv *rtlpriv = rtl_priv(hw);
  28         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
  29 @@ -722,7 +723,10 @@ void rtl92c_set_fw_rsvdpagepkt(struct ie
  30         memcpy((u8 *)skb_put(skb, totalpacketlen),
  31                &reserved_page_packet, totalpacketlen);
  32
  33 -       rtstatus = rtl_cmd_send_packet(hw, skb);
  34 +       if (cmd_send_packet)
  35 +               rtstatus = cmd_send_packet(hw, skb);
  36 +       else
  37 +               rtstatus = rtl_cmd_send_packet(hw, skb);
  38
  39         if (rtstatus)
  40                 b_dlok = true;
  41 --- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
  42 +++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
  43 @@ -109,7 +109,9 @@ void rtl92c_fill_h2c_cmd(struct ieee8021
  44                          u32 cmd_len, u8 *p_cmdbuffer);
  45  void rtl92c_firmware_selfreset(struct ieee80211_hw *hw);
  46  void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
  47 -void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
  48 +void rtl92c_set_fw_rsvdpagepkt
  49 +       (struct ieee80211_hw *hw,
  50 +        bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *));
  51  void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
  52  void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
  53  void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
  54 --- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
  55 +++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
  56 @@ -459,7 +459,7 @@ void rtl92ce_set_hw_reg(struct ieee80211
  57                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
  58                                                tmp_reg422 & (~BIT(6)));
  59
  60 -                               rtl92c_set_fw_rsvdpagepkt(hw, 0);
  61 +                               rtl92c_set_fw_rsvdpagepkt(hw, NULL);
  62
  63                                 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
  64                                 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
  65 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
  66 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
  67 @@ -1592,6 +1592,20 @@ void rtl92cu_get_hw_reg(struct ieee80211
  68         }
  69  }
  70
  71 +bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
  72 +{
  73 +  /* Currently nothing happens here.
  74 +   * Traffic stops after some seconds in WPA2 802.11n mode.
  75 +   * Maybe because rtl8192cu chip should be set from here?
  76 +   * If I understand correctly, the realtek vendor driver sends some urbs
  77 +   * if its "here".
  78 +   *
  79 +   * This is maybe necessary:
  80 +   * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
  81 +   */
  82 +       return true;
  83 +}
  84 +
  85  void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
  86  {
  87         struct rtl_priv *rtlpriv = rtl_priv(hw);
  88 @@ -1939,7 +1953,8 @@ void rtl92cu_set_hw_reg(struct ieee80211
  89                                         recover = true;
  90                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
  91                                                tmp_reg422 & (~BIT(6)));
  92 -                               rtl92c_set_fw_rsvdpagepkt(hw, 0);
  93 +                               rtl92c_set_fw_rsvdpagepkt(hw,
  94 +                                                         &usb_cmd_send_packet);
  95                                 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0);
  96                                 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
  97                                 if (recover)
  98 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
  99 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
 100 @@ -104,7 +104,6 @@ bool rtl92cu_gpio_radio_on_off_checking(
 101  void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
 102  int rtl92c_download_fw(struct ieee80211_hw *hw);
 103  void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
 104 -void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished);
 105  void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 106  void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw,
 107                          u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);