diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile index 9b3dac299f..2576355bd1 100644 --- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile +++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile @@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=ltq-vdsl-vr9-mei PKG_VERSION:=1.5.17.6 -PKG_RELEASE:=6 +PKG_RELEASE:=7 PKG_BASE_NAME:=drv_mei_cpe PKG_SOURCE:=$(PKG_BASE_NAME)-$(PKG_VERSION).tar.gz diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-fix-field-spanning-write-mei-mailbox-packed.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-fix-field-spanning-write-mei-mailbox-packed.patch new file mode 100644 index 0000000000..549411b78e --- /dev/null +++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-fix-field-spanning-write-mei-mailbox-packed.patch @@ -0,0 +1,179 @@ +--- a/src/cmv_message_format.h ++++ b/src/cmv_message_format.h +@@ -308,7 +308,7 @@ typedef struct cmv_std_message_header_s + unsigned short index; + /** CMV length */ + unsigned short length; +-} CMV_STD_MESSAGE_HEADER_T; ++} __attribute__((packed)) CMV_STD_MESSAGE_HEADER_T; + + /** + CMV payload paramaters (8, 16, 32 Bit) +@@ -318,7 +318,7 @@ typedef union cmv_std_message_payload_s + unsigned char params_8Bit[CMV_USED_PAYLOAD_8BIT_SIZE]; + unsigned short params_16Bit[CMV_USED_PAYLOAD_16BIT_SIZE]; + unsigned int params_32Bit[CMV_USED_PAYLOAD_32BIT_SIZE]; +-} CMV_STD_MESSAGE_PAYLOAD_T; ++} __attribute__((packed)) CMV_STD_MESSAGE_PAYLOAD_T; + + /** + CMV Standard message. +@@ -327,7 +327,7 @@ typedef struct cmv_std_message_s + { + CMV_STD_MESSAGE_HEADER_T header; + CMV_STD_MESSAGE_PAYLOAD_T payload; +-} CMV_STD_MESSAGE_T; ++} __attribute__((packed)) CMV_STD_MESSAGE_T; + + + /* ============================================================================ +@@ -341,7 +341,7 @@ typedef struct cmv_message_modem_rdy_s + { + CMV_STD_MESSAGE_HEADER_T header; + CMV_STD_MESSAGE_PAYLOAD_T modemRdyParams; +-} CMV_MESSAGE_MODEM_RDY_T; ++} __attribute__((packed)) CMV_MESSAGE_MODEM_RDY_T; + + + /* ============================================================================ +@@ -358,7 +358,7 @@ typedef struct cmv_message_modem_rdy_s + typedef struct cmv_message_cs_static_params_s + { + unsigned short pageIdx[MEI_CMV_CODESWAP_MAX_PAGES]; +-} CMV_MESSAGE_CS_STATIC_PARAMS_T; ++} __attribute__((packed)) CMV_MESSAGE_CS_STATIC_PARAMS_T; + + + typedef struct cmv_dyn_codeswap_page_info_s +@@ -366,7 +366,7 @@ typedef struct cmv_dyn_codeswap_page_inf + unsigned short pageIdx; + unsigned short h_destAddr; + unsigned short l_destAddr; +-} CMV_DYN_CODESWAP_PAGE_INFO_T; ++} __attribute__((packed)) CMV_DYN_CODESWAP_PAGE_INFO_T; + + /** + CMV codeswap message payload (dynamic). +@@ -374,7 +374,7 @@ typedef struct cmv_dyn_codeswap_page_inf + typedef struct cmv_message_cs_dyn_params_s + { + CMV_DYN_CODESWAP_PAGE_INFO_T pageInfo[MEI_CMV_CODESWAP_MAX_PAGES]; +-} CMV_MESSAGE_CS_DYN_PARAMS_T; ++} __attribute__((packed)) CMV_MESSAGE_CS_DYN_PARAMS_T; + + + /** +@@ -388,7 +388,7 @@ typedef struct cmv_message_cs_s + CMV_MESSAGE_CS_STATIC_PARAMS_T csStaticParams; + CMV_MESSAGE_CS_DYN_PARAMS_T csDynParams; + } params; +-} CMV_MESSAGE_CS_T; ++} __attribute__((packed)) CMV_MESSAGE_CS_T; + + /* ============================================================================ + CMV Fast Read request message definitions +@@ -406,7 +406,7 @@ typedef struct cmv_fast_read_params_s + unsigned short addrMSW; + unsigned short addrLSW; + unsigned short size_16bit; +-} CMV_FAST_READ_PARAMS_T; ++} __attribute__((packed)) CMV_FAST_READ_PARAMS_T; + + /** + CMV fast read message payload. +@@ -414,7 +414,7 @@ typedef struct cmv_fast_read_params_s + typedef struct cmv_message_fast_rd_params_s + { + unsigned short fastRdpage[MEI_CMV_FAST_READ_MAX_PAGES]; +-} CMV_MESSAGE_FAST_RD_PARAMS_T; ++} __attribute__((packed)) CMV_MESSAGE_FAST_RD_PARAMS_T; + + /** + CMV codeswap message. +@@ -423,7 +423,7 @@ typedef struct cmv_message_fast_rd_s + { + CMV_STD_MESSAGE_HEADER_T header; + CMV_MESSAGE_FAST_RD_PARAMS_T fastRdParams; +-} CMV_MESSAGE_FAST_RD_T; ++} __attribute__((packed)) CMV_MESSAGE_FAST_RD_T; + + /** + CMV messages +@@ -435,7 +435,7 @@ typedef union cmv_message_all_s + CMV_MESSAGE_CS_T codeSwap; + CMV_MESSAGE_FAST_RD_T fastRd; + unsigned short rawMsg[CMV_HEADER_16BIT_SIZE + CMV_USED_PAYLOAD_16BIT_SIZE]; +-} CMV_MESSAGE_ALL_T; ++} __attribute__((packed)) CMV_MESSAGE_ALL_T; + + + +--- a/src/drv_mei_cpe_mailbox.h ++++ b/src/drv_mei_cpe_mailbox.h +@@ -197,7 +197,7 @@ typedef union MEI_cmv_mailbox_s + CMV_MESSAGE_CS_T codeSwap; + /** CMV Fast Read message */ + CMV_MESSAGE_FAST_RD_T fastRd; +-} MEI_CMV_MAILBOX_T; ++} __attribute__((packed)) MEI_CMV_MAILBOX_T; + + + /** +@@ -206,7 +206,7 @@ typedef union MEI_cmv_mailbox_s + typedef struct MEI_mei_mailbox_raw_s + { + IFX_uint16_t rawMsg[CMV_HEADER_16BIT_SIZE + CMV_USED_PAYLOAD_16BIT_SIZE]; +-} MEI_MEI_MAILBOX_RAW_T; ++} __attribute__((packed)) MEI_MEI_MAILBOX_RAW_T; + + + /** +@@ -218,7 +218,7 @@ typedef union MEI_mei_mailbox_s + MEI_MEI_MAILBOX_RAW_T mbRaw; + /** CMV message type */ + MEI_CMV_MAILBOX_T mbCmv; +-} MEI_MEI_MAILBOX_T; ++} __attribute__((packed)) MEI_MEI_MAILBOX_T; + + + #ifdef __cplusplus +--- a/src/drv_mei_cpe_msg_process.c ++++ b/src/drv_mei_cpe_msg_process.c +@@ -2172,7 +2172,7 @@ MEI_STATIC IFX_int32_t MEI_ModemNfcRead( + Return IFX/modem message + - index and length fields becomes part of the appl. payload + */ +- pSource = (unsigned char *)&pMailbox->mbCmv.cmv.header.index; ++ pSource = (unsigned char *)&pMailbox->mbCmv.cmv + offsetof(CMV_STD_MESSAGE_T, header.index); + + /* size field contains number of 16 bit payload elements of the message */ + paylSize_byte = (CMV_MSGHDR_PAYLOAD_SIZE_GET(pMailbox->mbCmv.cmv)) << CMV_MSG_BIT_SIZE_16BIT; +@@ -3508,7 +3508,7 @@ IFX_int32_t MEI_IoctlCmdMsgWrite( + */ + cmvMbSize = CMV_HEADER_8BIT_SIZE + + pUserMsg->paylSize_byte - (sizeof(IFX_uint16_t) * 2); +- pDestPtr = (unsigned char *)&pMailbox->mbCmv.cmv.header.index; ++ pDestPtr = (unsigned char *)&pMailbox->mbCmv.cmv + offsetof(CMV_STD_MESSAGE_T, header.index); + + if ( cmvMbSize > (int)(sizeof(MEI_CMV_MAILBOX_T)) ) + { +@@ -3622,7 +3622,7 @@ IFX_int32_t MEI_IoctlAckMsgRead( + Return IFX/modem message + - index and length fields becomes part of the appl. payload + */ +- pSource = (unsigned char *)&pMailbox->mbCmv.cmv.header.index; ++ pSource = (unsigned char *)&pMailbox->mbCmv.cmv + offsetof(CMV_STD_MESSAGE_T, header.index); + + /* size field contains number of 16 bit payload elements of the message */ + paylSize_byte = (CMV_MSGHDR_PAYLOAD_SIZE_GET(pMailbox->mbCmv.cmv)) << CMV_MSG_BIT_SIZE_16BIT; +--- a/src/drv_mei_cpe_msg_process_ar9.c ++++ b/src/drv_mei_cpe_msg_process_ar9.c +@@ -1385,7 +1385,7 @@ MEI_STATIC IFX_int32_t MEI_ModemNfcRead( + Return IFX/modem message + - index and length fields becomes part of the appl. payload + */ +- pSource = (unsigned char *)&pMailbox->mbCmv.cmv.header.index; ++ pSource = (unsigned char *)&pMailbox->mbCmv.cmv + offsetof(CMV_STD_MESSAGE_T, header.index); + + /* size field contains number of 16 bit payload elements of the message */ + paylSize_byte = (CMV_MSGHDR_PAYLOAD_SIZE_GET(pMailbox->mbCmv.cmv)) << CMV_MSG_BIT_SIZE_16BIT; diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-use-unsafe_memcpy-for-intentional-field-spanning-write.patch b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-use-unsafe_memcpy-for-intentional-field-spanning-write.patch deleted file mode 100644 index 1542ace44f..0000000000 --- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/401-use-unsafe_memcpy-for-intentional-field-spanning-write.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- a/src/drv_mei_cpe_msg_process.c -+++ b/src/drv_mei_cpe_msg_process.c -@@ -3524,7 +3524,12 @@ IFX_int32_t MEI_IoctlCmdMsgWrite( - { - if (bInternCall) - { -+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5,19,0)) - memcpy(pDestPtr, pUserMsg->pPayload, pUserMsg->paylSize_byte); -+#else -+ unsafe_memcpy(pDestPtr, pUserMsg->pPayload, pUserMsg->paylSize_byte, -+ /* field-spanning writing is used here intentionally */); -+#endif - } - else - {