Commit d4533992 authored by Hante Meuleman's avatar Hante Meuleman Committed by John W. Linville

brcmfmac: Limit control message length from host to device.

An control request or set message length is restricted to
ETH frame length for the buffer from host to device. This
is limitation is imposed by the firmware.
Reviewed-by: default avatarArend Van Spriel <arend@broadcom.com>
Signed-off-by: default avatarHante Meuleman <meuleman@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 75b39dd2
...@@ -41,9 +41,6 @@ struct brcmf_proto_bcdc_dcmd { ...@@ -41,9 +41,6 @@ struct brcmf_proto_bcdc_dcmd {
__le32 status; /* status code returned from the device */ __le32 status; /* status code returned from the device */
}; };
/* Max valid buffer size that can be sent to the dongle */
#define BCDC_MAX_MSG_SIZE (ETH_FRAME_LEN+ETH_FCS_LEN)
/* BCDC flag definitions */ /* BCDC flag definitions */
#define BCDC_DCMD_ERROR 0x01 /* 1=cmd failed */ #define BCDC_DCMD_ERROR 0x01 /* 1=cmd failed */
#define BCDC_DCMD_SET 0x02 /* 0=get, 1=set cmd */ #define BCDC_DCMD_SET 0x02 /* 0=get, 1=set cmd */
...@@ -133,9 +130,12 @@ brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf, ...@@ -133,9 +130,12 @@ brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
if (buf) if (buf)
memcpy(bcdc->buf, buf, len); memcpy(bcdc->buf, buf, len);
len += sizeof(*msg);
if (len > BRCMF_TX_IOCTL_MAX_MSG_SIZE)
len = BRCMF_TX_IOCTL_MAX_MSG_SIZE;
/* Send request */ /* Send request */
return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, len);
len + sizeof(struct brcmf_proto_bcdc_dcmd));
} }
static int brcmf_proto_bcdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len) static int brcmf_proto_bcdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
......
...@@ -37,6 +37,11 @@ ...@@ -37,6 +37,11 @@
#define BRCMF_DCMD_MEDLEN 1536 #define BRCMF_DCMD_MEDLEN 1536
#define BRCMF_DCMD_MAXLEN 8192 #define BRCMF_DCMD_MAXLEN 8192
/* IOCTL from host to device are limited in lenght. A device can only handle
* ethernet frame size. This limitation is to be applied by protocol layer.
*/
#define BRCMF_TX_IOCTL_MAX_MSG_SIZE (ETH_FRAME_LEN+ETH_FCS_LEN)
#define BRCMF_AMPDU_RX_REORDER_MAXFLOWS 256 #define BRCMF_AMPDU_RX_REORDER_MAXFLOWS 256
/* Length of firmware version string stored for /* Length of firmware version string stored for
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment