mac80211: Update to version 5.4.27

The removed patches are all integrated in the upstream version now.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

8 files changed, 12 insertions, 285 deletions

diff --git a/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch b/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch
deleted file mode 100644
index a92118a19a..0000000000
--- a/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 18 Nov 2019 11:52:41 +0100
-Subject: [PATCH FIX] brcmfmac: disable PCIe interrupts before bus reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Keeping interrupts on could result in brcmfmac freeing some resources
-and then IRQ handlers trying to use them. That was obviously a straight
-path for crashing a kernel.
-
-Example:
-CPU0                           CPU1
-----                           ----
-brcmf_pcie_reset
-  brcmf_pcie_bus_console_read
-  brcmf_detach
-    ...
-    brcmf_fweh_detach
-    brcmf_proto_detach
-                               brcmf_pcie_isr_thread
-                                 ...
-                                 brcmf_proto_msgbuf_rx_trigger
-                                   ...
-                                   drvr->proto->pd
-    brcmf_pcie_release_irq
-
-[  363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038
-[  363.797339] pgd = c0004000
-[  363.800050] [00000038] *pgd=00000000
-[  363.803635] Internal error: Oops: 17 [#1] SMP ARM
-(...)
-[  364.029209] Backtrace:
-[  364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac])
-[  364.043662]  r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800
-
-Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
-Cc: stable@vger.kernel.org # v5.2+
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1427,6 +1427,8 @@ static int brcmf_pcie_reset(struct devic
- 	struct brcmf_fw_request *fwreq;
- 	int err;
- 
-+	brcmf_pcie_intr_disable(devinfo);
-+
- 	brcmf_pcie_bus_console_read(devinfo, true);
- 
- 	brcmf_detach(dev);
diff --git a/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch b/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch
deleted file mode 100644
index 6c325ee844..0000000000
--- a/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 18 Nov 2019 13:35:20 +0100
-Subject: [PATCH 5.5] brcmfmac: remove monitor interface when detaching
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This fixes a minor WARNING in the cfg80211:
-[  130.658034] ------------[ cut here ]------------
-[  130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211]
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1371,6 +1371,11 @@ void brcmf_detach(struct device *dev)
- 	brcmf_fweh_detach(drvr);
- 	brcmf_proto_detach(drvr);
- 
-+	if (drvr->mon_if) {
-+		brcmf_net_detach(drvr->mon_if->ndev, false);
-+		drvr->mon_if = NULL;
-+	}
-+
- 	/* make sure primary interface removed last */
- 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
- 		if (drvr->iflist[i])
diff --git a/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch b/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
deleted file mode 100644
index 5bf4ad278a..0000000000
--- a/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 Mon Sep 17 00:00:00 2001
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-Date: Fri, 22 Nov 2019 13:19:48 -0600
-Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
-
-In the implementation of brcmf_p2p_create_p2pdev() the allocated memory
-for p2p_vif is leaked when the mac address is the same as primary
-interface. To fix this, go to error path to release p2p_vif via
-brcmf_free_vif().
-
-Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness")
-Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_cr
- 	/* firmware requires unique mac address for p2pdev interface */
- 	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
- 		bphy_err(drvr, "discovery vif must be different from primary interface\n");
--		return ERR_PTR(-EINVAL);
-+		err = -EINVAL;
-+		goto fail;
- 	}
- 
- 	brcmf_p2p_generate_bss_mac(p2p, addr);
diff --git a/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch b/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch
deleted file mode 100644
index 1b56f6d7ce..0000000000
--- a/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001
-From: Dan Carpenter <dan.carpenter@oracle.com>
-Date: Tue, 3 Dec 2019 12:58:55 +0300
-Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
-
-The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
-static checker warning:
-
-    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
-    error: dereferencing freed memory 'pkt'
-
-It looks like there was supposed to be a continue after we free "pkt".
-
-Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Acked-by: Franky Lin <franky.lin@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct
- 					       BRCMF_SDIO_FT_NORMAL)) {
- 				rd->len = 0;
- 				brcmu_pkt_buf_free_skb(pkt);
-+				continue;
- 			}
- 			bus->sdcnt.rx_readahead_cnt++;
- 			if (rd->len != roundup(rd_new.len, 16)) {
diff --git a/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch b/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch
deleted file mode 100644
index e1dfe84c97..0000000000
--- a/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Tue, 10 Dec 2019 12:44:22 +0100
-Subject: [PATCH] brcmfmac: fix interface sanity check
-
-Make sure to use the current alternate setting when verifying the
-interface descriptors to avoid binding to an invalid interface.
-
-Failing to do so could cause the driver to misbehave or trigger a WARN()
-in usb_submit_urb() that kernels with panic_on_warn set would choke on.
-
-Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
-Cc: stable <stable@vger.kernel.org>     # 3.4
-Cc: Arend van Spriel <arend@broadcom.com>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in
- 		goto fail;
- 	}
- 
--	desc = &intf->altsetting[0].desc;
-+	desc = &intf->cur_altsetting->desc;
- 	if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
- 	    (desc->bInterfaceSubClass != 2) ||
- 	    (desc->bInterfaceProtocol != 0xff)) {
-@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in
- 
- 	num_of_eps = desc->bNumEndpoints;
- 	for (ep = 0; ep < num_of_eps; ep++) {
--		endpoint = &intf->altsetting[0].endpoint[ep].desc;
-+		endpoint = &intf->cur_altsetting->endpoint[ep].desc;
- 		endpoint_num = usb_endpoint_num(endpoint);
- 		if (!usb_endpoint_xfer_bulk(endpoint))
- 			continue;
diff --git a/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch b/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch
deleted file mode 100644
index a55d286e57..0000000000
--- a/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-Date: Sat, 14 Dec 2019 19:51:14 -0600
-Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit
-
-In the implementation of brcmf_usbdev_qinit() the allocated memory for
-reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
-handling path.
-
-Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
-Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -430,6 +430,7 @@ fail:
- 			usb_free_urb(req->urb);
- 		list_del(q->next);
- 	}
-+	kfree(reqs);
- 	return NULL;
- 
- }
diff --git a/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch b/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch
deleted file mode 100644
index 5ec2e9b131..0000000000
--- a/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Mon Sep 17 00:00:00 2001
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Date: Thu, 26 Dec 2019 10:20:33 +0100
-Subject: [PATCH] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
-
-Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling
-brcmf_bus_started()") changed the initialization order of the brcmfmac
-SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now
-called before the sdiodev->bus_if initialization, it reads the wrong
-chip ID and fails to initialize the GPIO on brcm43362. Thus the chip
-cannot send interrupts and fails to probe:
-
-[   12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
-[   12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110
-[   12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110
-[   12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
-
-Initialize the bus interface earlier to ensure that
-brcmf_sdiod_intr_register() properly sets up the OOB interrupt.
-
-BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438
-Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()")
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4243,6 +4243,12 @@ static void brcmf_sdio_firmware_callback
- 	}
- 
- 	if (err == 0) {
-+		/* Assign bus interface call back */
-+		sdiod->bus_if->dev = sdiod->dev;
-+		sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
-+		sdiod->bus_if->chip = bus->ci->chip;
-+		sdiod->bus_if->chiprev = bus->ci->chiprev;
-+
- 		/* Allow full data communication using DPC from now on. */
- 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
- 
-@@ -4259,12 +4265,6 @@ static void brcmf_sdio_firmware_callback
- 
- 	sdio_release_host(sdiod->func1);
- 
--	/* Assign bus interface call back */
--	sdiod->bus_if->dev = sdiod->dev;
--	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
--	sdiod->bus_if->chip = bus->ci->chip;
--	sdiod->bus_if->chiprev = bus->ci->chiprev;
--
- 	err = brcmf_alloc(sdiod->dev, sdiod->settings);
- 	if (err) {
- 		brcmf_err("brcmf_alloc failed\n");
diff --git a/package/kernel/mac80211/patches/brcm/998-survey.patch b/package/kernel/mac80211/patches/brcm/998-survey.patch
index 9e9d2c51b7..3c52cec0b9 100644
--- a/package/kernel/mac80211/patches/brcm/998-survey.patch
+++ b/package/kernel/mac80211/patches/brcm/998-survey.patch
@@ -1,8 +1,6 @@
-Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-===================================================================
---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2747,6 +2747,63 @@ done:
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2826,6 +2826,63 @@ done:
  }
  
  static int
@@ -66,7 +64,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
  brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
  			    int idx, u8 *mac, struct station_info *sinfo)
  {
-@@ -2836,6 +2893,7 @@ static s32 brcmf_inform_single_bss(struc
+@@ -2915,6 +2972,7 @@ static s32 brcmf_inform_single_bss(struc
  	struct brcmu_chan ch;
  	u16 channel;
  	u32 freq;
@@ -74,7 +72,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
  	u16 notify_capability;
  	u16 notify_interval;
  	u8 *notify_ie;
-@@ -2860,6 +2918,17 @@ static s32 brcmf_inform_single_bss(struc
+@@ -2939,6 +2997,17 @@ static s32 brcmf_inform_single_bss(struc
  		band = NL80211_BAND_5GHZ;
  
  	freq = ieee80211_channel_to_frequency(channel, band);
@@ -92,7 +90,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
  	bss_data.chan = ieee80211_get_channel(wiphy, freq);
  	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
  	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
-@@ -5277,6 +5346,7 @@ static struct cfg80211_ops brcmf_cfg8021
+@@ -5356,6 +5425,7 @@ static struct cfg80211_ops brcmf_cfg8021
  	.leave_ibss = brcmf_cfg80211_leave_ibss,
  	.get_station = brcmf_cfg80211_get_station,
  	.dump_station = brcmf_cfg80211_dump_station,
@@ -100,11 +98,9 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
  	.set_tx_power = brcmf_cfg80211_set_tx_power,
  	.get_tx_power = brcmf_cfg80211_get_tx_power,
  	.add_key = brcmf_cfg80211_add_key,
-Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-===================================================================
---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1277,6 +1277,8 @@ int brcmf_attach(struct device *dev)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1352,6 +1352,8 @@ int brcmf_attach(struct device *dev)
  
  	/* Link to bus module */
  	drvr->hdrlen = 0;
@@ -113,7 +109,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core
  
  	/* Attach and link in the protocol */
  	ret = brcmf_proto_attach(drvr);
-@@ -1359,6 +1361,12 @@ void brcmf_detach(struct device *dev)
+@@ -1434,6 +1436,12 @@ void brcmf_detach(struct device *dev)
  	if (drvr == NULL)
  		return;
  
@@ -126,10 +122,8 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core
  #ifdef CONFIG_INET
  	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
  #endif
-Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-===================================================================
---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 @@ -91,6 +91,11 @@ struct brcmf_rev_info {
  	u32 nvramrev;
  };