diff options
Diffstat (limited to 'package/kernel/mac80211/patches/brcm')
8 files changed, 12 insertions, 285 deletions
diff --git a/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch b/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch deleted file mode 100644 index a92118a19a..0000000000 --- a/package/kernel/mac80211/patches/brcm/104-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> -Date: Mon, 18 Nov 2019 11:52:41 +0100 -Subject: [PATCH FIX] brcmfmac: disable PCIe interrupts before bus reset -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Keeping interrupts on could result in brcmfmac freeing some resources -and then IRQ handlers trying to use them. That was obviously a straight -path for crashing a kernel. - -Example: -CPU0 CPU1 ----- ---- -brcmf_pcie_reset - brcmf_pcie_bus_console_read - brcmf_detach - ... - brcmf_fweh_detach - brcmf_proto_detach - brcmf_pcie_isr_thread - ... - brcmf_proto_msgbuf_rx_trigger - ... - drvr->proto->pd - brcmf_pcie_release_irq - -[ 363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038 -[ 363.797339] pgd = c0004000 -[ 363.800050] [00000038] *pgd=00000000 -[ 363.803635] Internal error: Oops: 17 [#1] SMP ARM -(...) -[ 364.029209] Backtrace: -[ 364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac]) -[ 364.043662] r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800 - -Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash") -Cc: stable@vger.kernel.org # v5.2+ -Signed-off-by: Rafał Miłecki <rafal@milecki.pl> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -@@ -1427,6 +1427,8 @@ static int brcmf_pcie_reset(struct devic - struct brcmf_fw_request *fwreq; - int err; - -+ brcmf_pcie_intr_disable(devinfo); -+ - brcmf_pcie_bus_console_read(devinfo, true); - - brcmf_detach(dev); diff --git a/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch b/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch deleted file mode 100644 index 6c325ee844..0000000000 --- a/package/kernel/mac80211/patches/brcm/105-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl> -Date: Mon, 18 Nov 2019 13:35:20 +0100 -Subject: [PATCH 5.5] brcmfmac: remove monitor interface when detaching -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a minor WARNING in the cfg80211: -[ 130.658034] ------------[ cut here ]------------ -[ 130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211] - -Signed-off-by: Rafał Miłecki <rafal@milecki.pl> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1371,6 +1371,11 @@ void brcmf_detach(struct device *dev) - brcmf_fweh_detach(drvr); - brcmf_proto_detach(drvr); - -+ if (drvr->mon_if) { -+ brcmf_net_detach(drvr->mon_if->ndev, false); -+ drvr->mon_if = NULL; -+ } -+ - /* make sure primary interface removed last */ - for (i = BRCMF_MAX_IFS - 1; i > -1; i--) { - if (drvr->iflist[i]) diff --git a/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch b/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch deleted file mode 100644 index 5bf4ad278a..0000000000 --- a/package/kernel/mac80211/patches/brcm/110-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 Mon Sep 17 00:00:00 2001 -From: Navid Emamdoost <navid.emamdoost@gmail.com> -Date: Fri, 22 Nov 2019 13:19:48 -0600 -Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev() - -In the implementation of brcmf_p2p_create_p2pdev() the allocated memory -for p2p_vif is leaked when the mac address is the same as primary -interface. To fix this, go to error path to release p2p_vif via -brcmf_free_vif(). - -Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness") -Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c -@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_cr - /* firmware requires unique mac address for p2pdev interface */ - if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) { - bphy_err(drvr, "discovery vif must be different from primary interface\n"); -- return ERR_PTR(-EINVAL); -+ err = -EINVAL; -+ goto fail; - } - - brcmf_p2p_generate_bss_mac(p2p, addr); diff --git a/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch b/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch deleted file mode 100644 index 1b56f6d7ce..0000000000 --- a/package/kernel/mac80211/patches/brcm/111-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Tue, 3 Dec 2019 12:58:55 +0300 -Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes() - -The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a -static checker warning: - - drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes() - error: dereferencing freed memory 'pkt' - -It looks like there was supposed to be a continue after we free "pkt". - -Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine") -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Acked-by: Franky Lin <franky.lin@broadcom.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct - BRCMF_SDIO_FT_NORMAL)) { - rd->len = 0; - brcmu_pkt_buf_free_skb(pkt); -+ continue; - } - bus->sdcnt.rx_readahead_cnt++; - if (rd->len != roundup(rd_new.len, 16)) { diff --git a/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch b/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch deleted file mode 100644 index e1dfe84c97..0000000000 --- a/package/kernel/mac80211/patches/brcm/113-v5.6-brcmfmac-fix-interface-sanity-check.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 10 Dec 2019 12:44:22 +0100 -Subject: [PATCH] brcmfmac: fix interface sanity check - -Make sure to use the current alternate setting when verifying the -interface descriptors to avoid binding to an invalid interface. - -Failing to do so could cause the driver to misbehave or trigger a WARN() -in usb_submit_urb() that kernels with panic_on_warn set would choke on. - -Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") -Cc: stable <stable@vger.kernel.org> # 3.4 -Cc: Arend van Spriel <arend@broadcom.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in - goto fail; - } - -- desc = &intf->altsetting[0].desc; -+ desc = &intf->cur_altsetting->desc; - if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) || - (desc->bInterfaceSubClass != 2) || - (desc->bInterfaceProtocol != 0xff)) { -@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in - - num_of_eps = desc->bNumEndpoints; - for (ep = 0; ep < num_of_eps; ep++) { -- endpoint = &intf->altsetting[0].endpoint[ep].desc; -+ endpoint = &intf->cur_altsetting->endpoint[ep].desc; - endpoint_num = usb_endpoint_num(endpoint); - if (!usb_endpoint_xfer_bulk(endpoint)) - continue; diff --git a/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch b/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch deleted file mode 100644 index a55d286e57..0000000000 --- a/package/kernel/mac80211/patches/brcm/115-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001 -From: Navid Emamdoost <navid.emamdoost@gmail.com> -Date: Sat, 14 Dec 2019 19:51:14 -0600 -Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit - -In the implementation of brcmf_usbdev_qinit() the allocated memory for -reqs is leaking if usb_alloc_urb() fails. Release reqs in the error -handling path. - -Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") -Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c -@@ -430,6 +430,7 @@ fail: - usb_free_urb(req->urb); - list_del(q->next); - } -+ kfree(reqs); - return NULL; - - } diff --git a/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch b/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch deleted file mode 100644 index 5ec2e9b131..0000000000 --- a/package/kernel/mac80211/patches/brcm/118-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Mon Sep 17 00:00:00 2001 -From: Jean-Philippe Brucker <jean-philippe@linaro.org> -Date: Thu, 26 Dec 2019 10:20:33 +0100 -Subject: [PATCH] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362 - -Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling -brcmf_bus_started()") changed the initialization order of the brcmfmac -SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now -called before the sdiodev->bus_if initialization, it reads the wrong -chip ID and fails to initialize the GPIO on brcm43362. Thus the chip -cannot send interrupts and fails to probe: - -[ 12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout -[ 12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110 -[ 12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110 -[ 12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed - -Initialize the bus interface earlier to ensure that -brcmf_sdiod_intr_register() properly sets up the OOB interrupt. - -BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438 -Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()") -Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> -Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -@@ -4243,6 +4243,12 @@ static void brcmf_sdio_firmware_callback - } - - if (err == 0) { -+ /* Assign bus interface call back */ -+ sdiod->bus_if->dev = sdiod->dev; -+ sdiod->bus_if->ops = &brcmf_sdio_bus_ops; -+ sdiod->bus_if->chip = bus->ci->chip; -+ sdiod->bus_if->chiprev = bus->ci->chiprev; -+ - /* Allow full data communication using DPC from now on. */ - brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA); - -@@ -4259,12 +4265,6 @@ static void brcmf_sdio_firmware_callback - - sdio_release_host(sdiod->func1); - -- /* Assign bus interface call back */ -- sdiod->bus_if->dev = sdiod->dev; -- sdiod->bus_if->ops = &brcmf_sdio_bus_ops; -- sdiod->bus_if->chip = bus->ci->chip; -- sdiod->bus_if->chiprev = bus->ci->chiprev; -- - err = brcmf_alloc(sdiod->dev, sdiod->settings); - if (err) { - brcmf_err("brcmf_alloc failed\n"); diff --git a/package/kernel/mac80211/patches/brcm/998-survey.patch b/package/kernel/mac80211/patches/brcm/998-survey.patch index 9e9d2c51b7..3c52cec0b9 100644 --- a/package/kernel/mac80211/patches/brcm/998-survey.patch +++ b/package/kernel/mac80211/patches/brcm/998-survey.patch @@ -1,8 +1,6 @@ -Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -=================================================================== ---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -2747,6 +2747,63 @@ done: +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -2826,6 +2826,63 @@ done: } static int @@ -66,7 +64,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev, int idx, u8 *mac, struct station_info *sinfo) { -@@ -2836,6 +2893,7 @@ static s32 brcmf_inform_single_bss(struc +@@ -2915,6 +2972,7 @@ static s32 brcmf_inform_single_bss(struc struct brcmu_chan ch; u16 channel; u32 freq; @@ -74,7 +72,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8 u16 notify_capability; u16 notify_interval; u8 *notify_ie; -@@ -2860,6 +2918,17 @@ static s32 brcmf_inform_single_bss(struc +@@ -2939,6 +2997,17 @@ static s32 brcmf_inform_single_bss(struc band = NL80211_BAND_5GHZ; freq = ieee80211_channel_to_frequency(channel, band); @@ -92,7 +90,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8 bss_data.chan = ieee80211_get_channel(wiphy, freq); bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20; bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime()); -@@ -5277,6 +5346,7 @@ static struct cfg80211_ops brcmf_cfg8021 +@@ -5356,6 +5425,7 @@ static struct cfg80211_ops brcmf_cfg8021 .leave_ibss = brcmf_cfg80211_leave_ibss, .get_station = brcmf_cfg80211_get_station, .dump_station = brcmf_cfg80211_dump_station, @@ -100,11 +98,9 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8 .set_tx_power = brcmf_cfg80211_set_tx_power, .get_tx_power = brcmf_cfg80211_get_tx_power, .add_key = brcmf_cfg80211_add_key, -Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -=================================================================== ---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1277,6 +1277,8 @@ int brcmf_attach(struct device *dev) +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1352,6 +1352,8 @@ int brcmf_attach(struct device *dev) /* Link to bus module */ drvr->hdrlen = 0; @@ -113,7 +109,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core /* Attach and link in the protocol */ ret = brcmf_proto_attach(drvr); -@@ -1359,6 +1361,12 @@ void brcmf_detach(struct device *dev) +@@ -1434,6 +1436,12 @@ void brcmf_detach(struct device *dev) if (drvr == NULL) return; @@ -126,10 +122,8 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core #ifdef CONFIG_INET unregister_inetaddr_notifier(&drvr->inetaddr_notifier); #endif -Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h -=================================================================== ---- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h -+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h @@ -91,6 +91,11 @@ struct brcmf_rev_info { u32 nvramrev; }; |