From 3a86ef8c46c258ef4bec4279bb7ce7f6ad2619ad Mon Sep 17 00:00:00 2001 From: AmadeusGhost <42570690+AmadeusGhost@users.noreply.github.com> Date: Mon, 30 Mar 2020 12:18:10 +0800 Subject: [PATCH] mac80211: brcm: backport remaining 5.6 kernel patches (#4070) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * mac80211: brcm: backport remaining 5.6 kernel patches * mac80211: fix brcmfmac monitor interface crash This fixes bug in brcmfmac *exposed* by ipv6/addrconf fix. Fixes: 6e4453aecc22 ("kernel: backport out-of-memory fix for non-Ethernet devices") Signed-off-by: Rafał Miłecki Co-authored-by: Rafał Miłecki --- ...ove-monitor-interface-when-detaching.patch | 30 -- ...on-t-WARN-when-there-are-no-requests.patch | 28 ++ ...suspend-resume-when-power-is-cut-off.patch | 109 ++++++ ...set-but-not-used-variable-mpnum-nsp-.patch | 58 +++ ...le-PCIe-interrupts-before-bus-reset.patch} | 0 ...mory-leak-in-brcmf_p2p_create_p2pdev.patch | 29 ++ ...-after-free-in-brcmf_sdio_readframes.patch | 31 ++ ...-interface-carrier-to-off-by-default.patch | 29 ++ ...-brcmfmac-fix-interface-sanity-check.patch | 40 ++ ...wo-D11-cores-if-chip-has-two-D11-cor.patch | 121 ++++++ ...-F2-blocksize-and-watermark-for-4359.patch | 79 ++++ ...0003-brcmfmac-fix-rambase-for-4359-9.patch | 34 ++ ...rors-when-setting-roaming-parameters.patch | 42 +++ ...add-support-for-BCM4359-SDIO-chipset.patch | 75 ++++ ...B-condition-when-setting-interface-c.patch | 130 +++++++ ...-mbss-in-vif-if-firmware-does-not-su.patch | 38 ++ ...ix-memory-leak-in-brcmf_usbdev_qinit.patch | 26 ++ ...B-wake-interrupt-disabled-when-it-sh.patch | 66 ++++ ...mac-use-true-false-for-bool-variable.patch | 27 ++ ...x-OOB-interrupt-initialization-on-br.patch | 57 +++ ...lify-building-interface-combinations.patch | 103 ++++++ ...add-initial-support-for-monitor-mode.patch | 345 ++++++++++++++++++ ...-Remove-always-false-idx-0-statement.patch | 24 ++ ...-add-stub-for-monitor-interface-xmit.patch | 100 +++++ ...-register-wiphy-s-during-module_init.patch | 2 +- ...und-bug-with-some-inconsistent-BSSes.patch | 2 +- ...62-brcmfmac-Disable-power-management.patch | 2 +- 27 files changed, 1594 insertions(+), 33 deletions(-) delete mode 100644 package/kernel/mac80211/patches/brcm/397-brcmfmac-remove-monitor-interface-when-detaching.patch create mode 100644 package/kernel/mac80211/patches/brcm/401-v5.5-0001-brcmfmac-don-t-WARN-when-there-are-no-requests.patch create mode 100644 package/kernel/mac80211/patches/brcm/401-v5.5-0002-brcmfmac-fix-suspend-resume-when-power-is-cut-off.patch create mode 100644 package/kernel/mac80211/patches/brcm/403-v5.5-brcmfmac-remove-set-but-not-used-variable-mpnum-nsp-.patch rename package/kernel/mac80211/patches/brcm/{396-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch => 404-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch} (100%) create mode 100644 package/kernel/mac80211/patches/brcm/410-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch create mode 100644 package/kernel/mac80211/patches/brcm/411-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch create mode 100644 package/kernel/mac80211/patches/brcm/412-v5.6-brcmfmac-set-interface-carrier-to-off-by-default.patch create mode 100644 package/kernel/mac80211/patches/brcm/413-v5.6-brcmfmac-fix-interface-sanity-check.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0001-brcmfmac-reset-two-D11-cores-if-chip-has-two-D11-cor.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0002-brcmfmac-set-F2-blocksize-and-watermark-for-4359.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0003-brcmfmac-fix-rambase-for-4359-9.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0004-brcmfmac-make-errors-when-setting-roaming-parameters.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0005-brcmfmac-add-support-for-BCM4359-SDIO-chipset.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0006-brcmfmac-add-RSDB-condition-when-setting-interface-c.patch create mode 100644 package/kernel/mac80211/patches/brcm/414-v5.6-0007-brcmfmac-not-set-mbss-in-vif-if-firmware-does-not-su.patch create mode 100644 package/kernel/mac80211/patches/brcm/415-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch create mode 100644 package/kernel/mac80211/patches/brcm/416-v5.6-brcmfmac-Keep-OOB-wake-interrupt-disabled-when-it-sh.patch create mode 100644 package/kernel/mac80211/patches/brcm/417-v5.6-brcmfmac-use-true-false-for-bool-variable.patch create mode 100644 package/kernel/mac80211/patches/brcm/418-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch create mode 100644 package/kernel/mac80211/patches/brcm/419-v5.6-0001-brcmfmac-simplify-building-interface-combinations.patch create mode 100644 package/kernel/mac80211/patches/brcm/419-v5.6-0002-brcmfmac-add-initial-support-for-monitor-mode.patch create mode 100644 package/kernel/mac80211/patches/brcm/420-v5.6-brcmfmac-Remove-always-false-idx-0-statement.patch create mode 100644 package/kernel/mac80211/patches/brcm/500-brcmfmac-add-stub-for-monitor-interface-xmit.patch diff --git a/package/kernel/mac80211/patches/brcm/397-brcmfmac-remove-monitor-interface-when-detaching.patch b/package/kernel/mac80211/patches/brcm/397-brcmfmac-remove-monitor-interface-when-detaching.patch deleted file mode 100644 index 6c325ee84..000000000 --- a/package/kernel/mac80211/patches/brcm/397-brcmfmac-remove-monitor-interface-when-detaching.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= -Date: Mon, 18 Nov 2019 13:35:20 +0100 -Subject: [PATCH 5.5] brcmfmac: remove monitor interface when detaching -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a minor WARNING in the cfg80211: -[ 130.658034] ------------[ cut here ]------------ -[ 130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211] - -Signed-off-by: Rafał Miłecki ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1371,6 +1371,11 @@ void brcmf_detach(struct device *dev) - brcmf_fweh_detach(drvr); - brcmf_proto_detach(drvr); - -+ if (drvr->mon_if) { -+ brcmf_net_detach(drvr->mon_if->ndev, false); -+ drvr->mon_if = NULL; -+ } -+ - /* make sure primary interface removed last */ - for (i = BRCMF_MAX_IFS - 1; i > -1; i--) { - if (drvr->iflist[i]) diff --git a/package/kernel/mac80211/patches/brcm/401-v5.5-0001-brcmfmac-don-t-WARN-when-there-are-no-requests.patch b/package/kernel/mac80211/patches/brcm/401-v5.5-0001-brcmfmac-don-t-WARN-when-there-are-no-requests.patch new file mode 100644 index 000000000..a1311e0a4 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/401-v5.5-0001-brcmfmac-don-t-WARN-when-there-are-no-requests.patch @@ -0,0 +1,28 @@ +From 1524cbf3621576c639405e7aabeac415f9617c8d Mon Sep 17 00:00:00 2001 +From: Adrian Ratiu +Date: Wed, 25 Sep 2019 16:44:57 +0300 +Subject: [PATCH] brcmfmac: don't WARN when there are no requests + +When n_reqs == 0 there is nothing to do so it doesn't make sense to +search for requests and issue a warning because none is found. + +Signed-off-by: Martyn Welch +Signed-off-by: Adrian Ratiu +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c +@@ -57,6 +57,10 @@ static int brcmf_pno_remove_request(stru + + mutex_lock(&pi->req_lock); + ++ /* Nothing to do if we have no requests */ ++ if (pi->n_reqs == 0) ++ goto done; ++ + /* find request */ + for (i = 0; i < pi->n_reqs; i++) { + if (pi->reqs[i]->reqid == reqid) diff --git a/package/kernel/mac80211/patches/brcm/401-v5.5-0002-brcmfmac-fix-suspend-resume-when-power-is-cut-off.patch b/package/kernel/mac80211/patches/brcm/401-v5.5-0002-brcmfmac-fix-suspend-resume-when-power-is-cut-off.patch new file mode 100644 index 000000000..49ea85bf9 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/401-v5.5-0002-brcmfmac-fix-suspend-resume-when-power-is-cut-off.patch @@ -0,0 +1,109 @@ +From e0ae4bac22effbd644add326f658a3aeeb8d45ee Mon Sep 17 00:00:00 2001 +From: Adrian Ratiu +Date: Wed, 25 Sep 2019 16:44:58 +0300 +Subject: [PATCH] brcmfmac: fix suspend/resume when power is cut off + +brcmfmac assumed the wifi device always remains powered on and thus +hardcoded the MMC_PM_KEEP_POWER flag expecting the wifi device to +remain on even during suspend/resume cycles. + +This is not always the case, some appliances cut power to everything +connected via SDIO for efficiency reasons and this leads to wifi not +being usable after coming out of suspend because the device was not +correctly reinitialized. + +So we check for the keep_power capability and if it's not present then +we remove the device and probe it again during resume to mirror what's +happening in hardware and ensure correct reinitialization in the case +when MMC_PM_KEEP_POWER is not supported. + +Suggested-by: Gustavo Padovan +Signed-off-by: Adrian Ratiu +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/bcmsdh.c | 53 ++++++++++++++----- + 1 file changed, 39 insertions(+), 14 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -1097,7 +1097,8 @@ static int brcmf_ops_sdio_suspend(struct + struct sdio_func *func; + struct brcmf_bus *bus_if; + struct brcmf_sdio_dev *sdiodev; +- mmc_pm_flag_t sdio_flags; ++ mmc_pm_flag_t pm_caps, sdio_flags; ++ int ret = 0; + + func = container_of(dev, struct sdio_func, dev); + brcmf_dbg(SDIO, "Enter: F%d\n", func->num); +@@ -1108,19 +1109,33 @@ static int brcmf_ops_sdio_suspend(struct + bus_if = dev_get_drvdata(dev); + sdiodev = bus_if->bus_priv.sdio; + +- brcmf_sdiod_freezer_on(sdiodev); +- brcmf_sdio_wd_timer(sdiodev->bus, 0); ++ pm_caps = sdio_get_host_pm_caps(func); + +- sdio_flags = MMC_PM_KEEP_POWER; +- if (sdiodev->wowl_enabled) { +- if (sdiodev->settings->bus.sdio.oob_irq_supported) +- enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); +- else +- sdio_flags |= MMC_PM_WAKE_SDIO_IRQ; ++ if (pm_caps & MMC_PM_KEEP_POWER) { ++ /* preserve card power during suspend */ ++ brcmf_sdiod_freezer_on(sdiodev); ++ brcmf_sdio_wd_timer(sdiodev->bus, 0); ++ ++ sdio_flags = MMC_PM_KEEP_POWER; ++ if (sdiodev->wowl_enabled) { ++ if (sdiodev->settings->bus.sdio.oob_irq_supported) ++ enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); ++ else ++ sdio_flags |= MMC_PM_WAKE_SDIO_IRQ; ++ } ++ ++ if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags)) ++ brcmf_err("Failed to set pm_flags %x\n", sdio_flags); ++ ++ } else { ++ /* power will be cut so remove device, probe again in resume */ ++ brcmf_sdiod_intr_unregister(sdiodev); ++ ret = brcmf_sdiod_remove(sdiodev); ++ if (ret) ++ brcmf_err("Failed to remove device on suspend\n"); + } +- if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags)) +- brcmf_err("Failed to set pm_flags %x\n", sdio_flags); +- return 0; ++ ++ return ret; + } + + static int brcmf_ops_sdio_resume(struct device *dev) +@@ -1128,13 +1143,23 @@ static int brcmf_ops_sdio_resume(struct + struct brcmf_bus *bus_if = dev_get_drvdata(dev); + struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio; + struct sdio_func *func = container_of(dev, struct sdio_func, dev); ++ mmc_pm_flag_t pm_caps = sdio_get_host_pm_caps(func); ++ int ret = 0; + + brcmf_dbg(SDIO, "Enter: F%d\n", func->num); + if (func->num != 2) + return 0; + +- brcmf_sdiod_freezer_off(sdiodev); +- return 0; ++ if (!(pm_caps & MMC_PM_KEEP_POWER)) { ++ /* bus was powered off and device removed, probe again */ ++ ret = brcmf_sdiod_probe(sdiodev); ++ if (ret) ++ brcmf_err("Failed to probe device on resume\n"); ++ } else { ++ brcmf_sdiod_freezer_off(sdiodev); ++ } ++ ++ return ret; + } + + static const struct dev_pm_ops brcmf_sdio_pm_ops = { diff --git a/package/kernel/mac80211/patches/brcm/403-v5.5-brcmfmac-remove-set-but-not-used-variable-mpnum-nsp-.patch b/package/kernel/mac80211/patches/brcm/403-v5.5-brcmfmac-remove-set-but-not-used-variable-mpnum-nsp-.patch new file mode 100644 index 000000000..25b3ceb95 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/403-v5.5-brcmfmac-remove-set-but-not-used-variable-mpnum-nsp-.patch @@ -0,0 +1,58 @@ +From 7af496b9eb0433bc4cb478c9a46f85509cdb5541 Mon Sep 17 00:00:00 2001 +From: zhengbin +Date: Sat, 16 Nov 2019 15:22:47 +0800 +Subject: [PATCH] brcmfmac: remove set but not used variable + 'mpnum','nsp','nmp' + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_get_regaddr: +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:790:5: warning: variable mpnum set but not used [-Wunused-but-set-variable] +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_erom_scan: +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:866:10: warning: variable nsp set but not used [-Wunused-but-set-variable] +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c: In function brcmf_chip_dmp_erom_scan: +drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:866:5: warning: variable nmp set but not used [-Wunused-but-set-variable] + +Reported-by: Hulk Robot +Signed-off-by: zhengbin +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -778,7 +778,6 @@ static int brcmf_chip_dmp_get_regaddr(st + { + u8 desc; + u32 val, szdesc; +- u8 mpnum = 0; + u8 stype, sztype, wraptype; + + *regbase = 0; +@@ -786,7 +785,6 @@ static int brcmf_chip_dmp_get_regaddr(st + + val = brcmf_chip_dmp_get_desc(ci, eromaddr, &desc); + if (desc == DMP_DESC_MASTER_PORT) { +- mpnum = (val & DMP_MASTER_PORT_NUM) >> DMP_MASTER_PORT_NUM_S; + wraptype = DMP_SLAVE_TYPE_MWRAP; + } else if (desc == DMP_DESC_ADDRESS) { + /* revert erom address */ +@@ -854,7 +852,7 @@ int brcmf_chip_dmp_erom_scan(struct brcm + u8 desc_type = 0; + u32 val; + u16 id; +- u8 nmp, nsp, nmw, nsw, rev; ++ u8 nmw, nsw, rev; + u32 base, wrap; + int err; + +@@ -880,8 +878,6 @@ int brcmf_chip_dmp_erom_scan(struct brcm + return -EFAULT; + + /* only look at cores with master port(s) */ +- nmp = (val & DMP_COMP_NUM_MPORT) >> DMP_COMP_NUM_MPORT_S; +- nsp = (val & DMP_COMP_NUM_SPORT) >> DMP_COMP_NUM_SPORT_S; + nmw = (val & DMP_COMP_NUM_MWRAP) >> DMP_COMP_NUM_MWRAP_S; + nsw = (val & DMP_COMP_NUM_SWRAP) >> DMP_COMP_NUM_SWRAP_S; + rev = (val & DMP_COMP_REVISION) >> DMP_COMP_REVISION_S; diff --git a/package/kernel/mac80211/patches/brcm/396-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch b/package/kernel/mac80211/patches/brcm/404-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch similarity index 100% rename from package/kernel/mac80211/patches/brcm/396-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch rename to package/kernel/mac80211/patches/brcm/404-v5.5-brcmfmac-disable-PCIe-interrupts-before-bus-reset.patch diff --git a/package/kernel/mac80211/patches/brcm/410-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch b/package/kernel/mac80211/patches/brcm/410-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch new file mode 100644 index 000000000..5bf4ad278 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/410-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch @@ -0,0 +1,29 @@ +From 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Fri, 22 Nov 2019 13:19:48 -0600 +Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev() + +In the implementation of brcmf_p2p_create_p2pdev() the allocated memory +for p2p_vif is leaked when the mac address is the same as primary +interface. To fix this, go to error path to release p2p_vif via +brcmf_free_vif(). + +Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness") +Signed-off-by: Navid Emamdoost +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_cr + /* firmware requires unique mac address for p2pdev interface */ + if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) { + bphy_err(drvr, "discovery vif must be different from primary interface\n"); +- return ERR_PTR(-EINVAL); ++ err = -EINVAL; ++ goto fail; + } + + brcmf_p2p_generate_bss_mac(p2p, addr); diff --git a/package/kernel/mac80211/patches/brcm/411-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch b/package/kernel/mac80211/patches/brcm/411-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch new file mode 100644 index 000000000..1b56f6d7c --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/411-v5.6-brcmfmac-Fix-use-after-free-in-brcmf_sdio_readframes.patch @@ -0,0 +1,31 @@ +From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 3 Dec 2019 12:58:55 +0300 +Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes() + +The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a +static checker warning: + + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes() + error: dereferencing freed memory 'pkt' + +It looks like there was supposed to be a continue after we free "pkt". + +Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine") +Signed-off-by: Dan Carpenter +Acked-by: Franky Lin +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct + BRCMF_SDIO_FT_NORMAL)) { + rd->len = 0; + brcmu_pkt_buf_free_skb(pkt); ++ continue; + } + bus->sdcnt.rx_readahead_cnt++; + if (rd->len != roundup(rd_new.len, 16)) { diff --git a/package/kernel/mac80211/patches/brcm/412-v5.6-brcmfmac-set-interface-carrier-to-off-by-default.patch b/package/kernel/mac80211/patches/brcm/412-v5.6-brcmfmac-set-interface-carrier-to-off-by-default.patch new file mode 100644 index 000000000..bb4782a7a --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/412-v5.6-brcmfmac-set-interface-carrier-to-off-by-default.patch @@ -0,0 +1,29 @@ +From 8d9627b05b2c33e4468e65739eb7caf9c3f274d8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Tue, 10 Dec 2019 12:35:55 +0100 +Subject: [PATCH] brcmfmac: set interface carrier to off by default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +It's important as brcmfmac creates one main interface for each PHY and +doesn't allow deleting it. Not setting carrier could result in other +subsystems misbehaving (e.g. LEDs "netdev" trigger turning LED on). + +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -678,6 +678,8 @@ int brcmf_net_attach(struct brcmf_if *if + goto fail; + } + ++ netif_carrier_off(ndev); ++ + netdev_set_priv_destructor(ndev, brcmf_cfg80211_free_netdev); + brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name); + return 0; diff --git a/package/kernel/mac80211/patches/brcm/413-v5.6-brcmfmac-fix-interface-sanity-check.patch b/package/kernel/mac80211/patches/brcm/413-v5.6-brcmfmac-fix-interface-sanity-check.patch new file mode 100644 index 000000000..e1dfe84c9 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/413-v5.6-brcmfmac-fix-interface-sanity-check.patch @@ -0,0 +1,40 @@ +From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:44:22 +0100 +Subject: [PATCH] brcmfmac: fix interface sanity check + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") +Cc: stable # 3.4 +Cc: Arend van Spriel +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in + goto fail; + } + +- desc = &intf->altsetting[0].desc; ++ desc = &intf->cur_altsetting->desc; + if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) || + (desc->bInterfaceSubClass != 2) || + (desc->bInterfaceProtocol != 0xff)) { +@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in + + num_of_eps = desc->bNumEndpoints; + for (ep = 0; ep < num_of_eps; ep++) { +- endpoint = &intf->altsetting[0].endpoint[ep].desc; ++ endpoint = &intf->cur_altsetting->endpoint[ep].desc; + endpoint_num = usb_endpoint_num(endpoint); + if (!usb_endpoint_xfer_bulk(endpoint)) + continue; diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0001-brcmfmac-reset-two-D11-cores-if-chip-has-two-D11-cor.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0001-brcmfmac-reset-two-D11-cores-if-chip-has-two-D11-cor.patch new file mode 100644 index 000000000..19bf41ad9 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0001-brcmfmac-reset-two-D11-cores-if-chip-has-two-D11-cor.patch @@ -0,0 +1,121 @@ +From 1b8d2e0a9e4221b99eea375c079507ce8ef655f5 Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Thu, 12 Dec 2019 00:52:45 +0100 +Subject: [PATCH 1/7] brcmfmac: reset two D11 cores if chip has two D11 cores + +There are two D11 cores in RSDB chips like 4359. We have to reset two +D11 cores simutaneously before firmware download, or the firmware may +not be initialized correctly and cause "fw initialized failed" error. + +Signed-off-by: Wright Feng +Signed-off-by: Soeren Moch +Reviewed-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/chip.c | 50 +++++++++++++++++++ + .../broadcom/brcm80211/brcmfmac/chip.h | 1 + + .../broadcom/brcm80211/brcmfmac/pcie.c | 2 +- + 3 files changed, 52 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -433,11 +433,25 @@ static void brcmf_chip_ai_resetcore(stru + { + struct brcmf_chip_priv *ci; + int count; ++ struct brcmf_core *d11core2 = NULL; ++ struct brcmf_core_priv *d11priv2 = NULL; + + ci = core->chip; + ++ /* special handle two D11 cores reset */ ++ if (core->pub.id == BCMA_CORE_80211) { ++ d11core2 = brcmf_chip_get_d11core(&ci->pub, 1); ++ if (d11core2) { ++ brcmf_dbg(INFO, "found two d11 cores, reset both\n"); ++ d11priv2 = container_of(d11core2, ++ struct brcmf_core_priv, pub); ++ } ++ } ++ + /* must disable first to work for arbitrary current core state */ + brcmf_chip_ai_coredisable(core, prereset, reset); ++ if (d11priv2) ++ brcmf_chip_ai_coredisable(d11priv2, prereset, reset); + + count = 0; + while (ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL) & +@@ -449,9 +463,30 @@ static void brcmf_chip_ai_resetcore(stru + usleep_range(40, 60); + } + ++ if (d11priv2) { ++ count = 0; ++ while (ci->ops->read32(ci->ctx, ++ d11priv2->wrapbase + BCMA_RESET_CTL) & ++ BCMA_RESET_CTL_RESET) { ++ ci->ops->write32(ci->ctx, ++ d11priv2->wrapbase + BCMA_RESET_CTL, ++ 0); ++ count++; ++ if (count > 50) ++ break; ++ usleep_range(40, 60); ++ } ++ } ++ + ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL, + postreset | BCMA_IOCTL_CLK); + ci->ops->read32(ci->ctx, core->wrapbase + BCMA_IOCTL); ++ ++ if (d11priv2) { ++ ci->ops->write32(ci->ctx, d11priv2->wrapbase + BCMA_IOCTL, ++ postreset | BCMA_IOCTL_CLK); ++ ci->ops->read32(ci->ctx, d11priv2->wrapbase + BCMA_IOCTL); ++ } + } + + char *brcmf_chip_name(u32 id, u32 rev, char *buf, uint len) +@@ -1109,6 +1144,21 @@ void brcmf_chip_detach(struct brcmf_chip + kfree(chip); + } + ++struct brcmf_core *brcmf_chip_get_d11core(struct brcmf_chip *pub, u8 unit) ++{ ++ struct brcmf_chip_priv *chip; ++ struct brcmf_core_priv *core; ++ ++ chip = container_of(pub, struct brcmf_chip_priv, pub); ++ list_for_each_entry(core, &chip->cores, list) { ++ if (core->pub.id == BCMA_CORE_80211) { ++ if (unit-- == 0) ++ return &core->pub; ++ } ++ } ++ return NULL; ++} ++ + struct brcmf_core *brcmf_chip_get_core(struct brcmf_chip *pub, u16 coreid) + { + struct brcmf_chip_priv *chip; +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h +@@ -74,6 +74,7 @@ struct brcmf_chip *brcmf_chip_attach(voi + const struct brcmf_buscore_ops *ops); + void brcmf_chip_detach(struct brcmf_chip *chip); + struct brcmf_core *brcmf_chip_get_core(struct brcmf_chip *chip, u16 coreid); ++struct brcmf_core *brcmf_chip_get_d11core(struct brcmf_chip *pub, u8 unit); + struct brcmf_core *brcmf_chip_get_chipcommon(struct brcmf_chip *chip); + struct brcmf_core *brcmf_chip_get_pmu(struct brcmf_chip *pub); + bool brcmf_chip_iscoreup(struct brcmf_core *core); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -78,7 +78,7 @@ static const struct brcmf_firmware_mappi + BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371), + }; + +-#define BRCMF_PCIE_FW_UP_TIMEOUT 2000 /* msec */ ++#define BRCMF_PCIE_FW_UP_TIMEOUT 5000 /* msec */ + + #define BRCMF_PCIE_REG_MAP_SIZE (32 * 1024) + diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0002-brcmfmac-set-F2-blocksize-and-watermark-for-4359.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0002-brcmfmac-set-F2-blocksize-and-watermark-for-4359.patch new file mode 100644 index 000000000..34f597482 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0002-brcmfmac-set-F2-blocksize-and-watermark-for-4359.patch @@ -0,0 +1,79 @@ +From 172f6854551d48d1c9530f84513b421db944e714 Mon Sep 17 00:00:00 2001 +From: Chung-Hsien Hsu +Date: Thu, 12 Dec 2019 00:52:46 +0100 +Subject: [PATCH 2/7] brcmfmac: set F2 blocksize and watermark for 4359 + +Set F2 blocksize to 256 bytes and watermark to 0x40 for 4359. Also +enable and configure F1 MesBusyCtrl. It fixes DMA error while having +UDP bi-directional traffic. + +Signed-off-by: Chung-Hsien Hsu +[slightly adapted for rebase on mainline linux] +Signed-off-by: Soeren Moch +Reviewed-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 6 +++++- + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 15 +++++++++++++++ + 2 files changed, 20 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -43,6 +43,7 @@ + + #define SDIO_FUNC1_BLOCKSIZE 64 + #define SDIO_FUNC2_BLOCKSIZE 512 ++#define SDIO_4359_FUNC2_BLOCKSIZE 256 + /* Maximum milliseconds to wait for F2 to come up */ + #define SDIO_WAIT_F2RDY 3000 + +@@ -892,6 +893,7 @@ static void brcmf_sdiod_host_fixup(struc + static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev) + { + int ret = 0; ++ unsigned int f2_blksz = SDIO_FUNC2_BLOCKSIZE; + + sdio_claim_host(sdiodev->func1); + +@@ -901,7 +903,9 @@ static int brcmf_sdiod_probe(struct brcm + sdio_release_host(sdiodev->func1); + goto out; + } +- ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE); ++ if (sdiodev->func2->device == SDIO_DEVICE_ID_BROADCOM_4359) ++ f2_blksz = SDIO_4359_FUNC2_BLOCKSIZE; ++ ret = sdio_set_block_size(sdiodev->func2, f2_blksz); + if (ret) { + brcmf_err("Failed to set F2 blocksize\n"); + sdio_release_host(sdiodev->func1); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -42,6 +42,8 @@ + #define DEFAULT_F2_WATERMARK 0x8 + #define CY_4373_F2_WATERMARK 0x40 + #define CY_43012_F2_WATERMARK 0x60 ++#define CY_4359_F2_WATERMARK 0x40 ++#define CY_4359_F1_MESBUSYCTRL (CY_4359_F2_WATERMARK | SBSDIO_MESBUSYCTRL_ENAB) + + #ifdef DEBUG + +@@ -4210,6 +4212,19 @@ static void brcmf_sdio_firmware_callback + brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl, + &err); + break; ++ case SDIO_DEVICE_ID_BROADCOM_4359: ++ brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n", ++ CY_4359_F2_WATERMARK); ++ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, ++ CY_4359_F2_WATERMARK, &err); ++ devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL, ++ &err); ++ devctl |= SBSDIO_DEVCTL_F2WM_ENAB; ++ brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl, ++ &err); ++ brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL, ++ CY_4359_F1_MESBUSYCTRL, &err); ++ break; + default: + brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, + DEFAULT_F2_WATERMARK, &err); diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0003-brcmfmac-fix-rambase-for-4359-9.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0003-brcmfmac-fix-rambase-for-4359-9.patch new file mode 100644 index 000000000..7e4e32ffd --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0003-brcmfmac-fix-rambase-for-4359-9.patch @@ -0,0 +1,34 @@ +From 6647274ed995a172369cb04754eb5f8b85f68f6d Mon Sep 17 00:00:00 2001 +From: Soeren Moch +Date: Thu, 12 Dec 2019 00:52:47 +0100 +Subject: [PATCH 3/7] brcmfmac: fix rambase for 4359/9 + +Newer 4359 chip revisions need a different rambase address. +This fixes firmware download on such devices which fails otherwise. + +Signed-off-by: Soeren Moch +Acked-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -712,7 +712,6 @@ static u32 brcmf_chip_tcm_rambase(struct + case BRCM_CC_43569_CHIP_ID: + case BRCM_CC_43570_CHIP_ID: + case BRCM_CC_4358_CHIP_ID: +- case BRCM_CC_4359_CHIP_ID: + case BRCM_CC_43602_CHIP_ID: + case BRCM_CC_4371_CHIP_ID: + return 0x180000; +@@ -722,6 +721,8 @@ static u32 brcmf_chip_tcm_rambase(struct + case BRCM_CC_4366_CHIP_ID: + case BRCM_CC_43664_CHIP_ID: + return 0x200000; ++ case BRCM_CC_4359_CHIP_ID: ++ return (ci->pub.chiprev < 9) ? 0x180000 : 0x160000; + case CY_CC_4373_CHIP_ID: + return 0x160000; + default: diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0004-brcmfmac-make-errors-when-setting-roaming-parameters.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0004-brcmfmac-make-errors-when-setting-roaming-parameters.patch new file mode 100644 index 000000000..b15907217 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0004-brcmfmac-make-errors-when-setting-roaming-parameters.patch @@ -0,0 +1,42 @@ +From c12c8913d79c49ceccb38f42714d25b783833758 Mon Sep 17 00:00:00 2001 +From: Soeren Moch +Date: Thu, 12 Dec 2019 00:52:48 +0100 +Subject: [PATCH 4/7] brcmfmac: make errors when setting roaming parameters + non-fatal + +4359 dongles do not support setting roaming parameters (error -52). +Do not fail the 80211 configuration in this case. + +Signed-off-by: Soeren Moch +Acked-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -5936,19 +5936,17 @@ static s32 brcmf_dongle_roam(struct brcm + roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL); + err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER, + (void *)roamtrigger, sizeof(roamtrigger)); +- if (err) { ++ if (err) + bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err); +- goto roam_setup_done; +- } + + roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA); + roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL); + err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA, + (void *)roam_delta, sizeof(roam_delta)); +- if (err) { ++ if (err) + bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err); +- goto roam_setup_done; +- } ++ ++ return 0; + + roam_setup_done: + return err; diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0005-brcmfmac-add-support-for-BCM4359-SDIO-chipset.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0005-brcmfmac-add-support-for-BCM4359-SDIO-chipset.patch new file mode 100644 index 000000000..266c32246 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0005-brcmfmac-add-support-for-BCM4359-SDIO-chipset.patch @@ -0,0 +1,75 @@ +From d4aef159394d5940bd7158ab789969dab82f7c76 Mon Sep 17 00:00:00 2001 +From: Soeren Moch +Date: Thu, 12 Dec 2019 00:52:49 +0100 +Subject: [PATCH 5/7] brcmfmac: add support for BCM4359 SDIO chipset + +BCM4359 is a 2x2 802.11 abgn+ac Dual-Band HT80 combo chip and it +supports Real Simultaneous Dual Band feature. + +Based on a similar patch by: Wright Feng + +Signed-off-by: Soeren Moch +Acked-by: Chi-Hsien Lin +Acked-by: Ulf Hansson +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 ++ + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 + + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 ++ + include/linux/mmc/sdio_ids.h | 2 ++ + 4 files changed, 7 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -962,8 +962,10 @@ static const struct sdio_device_id brcmf + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43455), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4359), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_4373), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_43012), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_89359), + { /* end: all zeroes */ } + }; + MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -1408,6 +1408,7 @@ bool brcmf_chip_sr_capable(struct brcmf_ + addr = CORE_CC_REG(base, sr_control0); + reg = chip->ops->read32(chip->ctx, addr); + return (reg & CC_SR_CTL0_ENABLE_MASK) != 0; ++ case BRCM_CC_4359_CHIP_ID: + case CY_CC_43012_CHIP_ID: + addr = CORE_CC_REG(pmu->base, retention_ctl); + reg = chip->ops->read32(chip->ctx, addr); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -616,6 +616,7 @@ BRCMF_FW_DEF(43455, "brcmfmac43455-sdio" + BRCMF_FW_DEF(43456, "brcmfmac43456-sdio"); + BRCMF_FW_DEF(4354, "brcmfmac4354-sdio"); + BRCMF_FW_DEF(4356, "brcmfmac4356-sdio"); ++BRCMF_FW_DEF(4359, "brcmfmac4359-sdio"); + BRCMF_FW_DEF(4373, "brcmfmac4373-sdio"); + BRCMF_FW_DEF(43012, "brcmfmac43012-sdio"); + +@@ -638,6 +639,7 @@ static const struct brcmf_firmware_mappi + BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFDC0, 43455), + BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354), + BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), ++ BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359), + BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373), + BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012) + }; +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -41,8 +41,10 @@ + #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf + #define SDIO_DEVICE_ID_BROADCOM_4354 0x4354 + #define SDIO_DEVICE_ID_BROADCOM_4356 0x4356 ++#define SDIO_DEVICE_ID_BROADCOM_4359 0x4359 + #define SDIO_DEVICE_ID_CYPRESS_4373 0x4373 + #define SDIO_DEVICE_ID_CYPRESS_43012 43012 ++#define SDIO_DEVICE_ID_CYPRESS_89359 0x4355 + + #define SDIO_VENDOR_ID_INTEL 0x0089 + #define SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX 0x1402 diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0006-brcmfmac-add-RSDB-condition-when-setting-interface-c.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0006-brcmfmac-add-RSDB-condition-when-setting-interface-c.patch new file mode 100644 index 000000000..c56ae2c24 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0006-brcmfmac-add-RSDB-condition-when-setting-interface-c.patch @@ -0,0 +1,130 @@ +From 837482e69a3f0d7cbc73922020012f83635f5ddb Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Thu, 12 Dec 2019 00:52:50 +0100 +Subject: [PATCH 6/7] brcmfmac: add RSDB condition when setting interface + combinations + +With firmware RSDB feature +1. The maximum support interface is four. +2. The maximum difference channel is two. +3. The maximum interfaces of {station/p2p client/AP} are two. +4. The maximum interface of p2p device is one. + +Signed-off-by: Wright Feng +Signed-off-by: Soeren Moch +Reviewed-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 54 ++++++++++++++++--- + 1 file changed, 46 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6444,6 +6444,9 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = + * #STA <= 1, #AP <= 1, channels = 1, 2 total + * #AP <= 4, matching BI, channels = 1, 4 total + * ++ * no p2p and rsdb: ++ * #STA <= 2, #AP <= 2, channels = 2, 4 total ++ * + * p2p, no mchan, and mbss: + * + * #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total +@@ -6455,6 +6458,10 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = + * #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total + * #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total + * #AP <= 4, matching BI, channels = 1, 4 total ++ * ++ * p2p, rsdb, and no mbss: ++ * #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2, ++ * channels = 2, 4 total + */ + static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp) + { +@@ -6462,13 +6469,14 @@ static int brcmf_setup_ifmodes(struct wi + struct ieee80211_iface_limit *c0_limits = NULL; + struct ieee80211_iface_limit *p2p_limits = NULL; + struct ieee80211_iface_limit *mbss_limits = NULL; +- bool mbss, p2p; ++ bool mbss, p2p, rsdb; + int i, c, n_combos; + + mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS); + p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P); ++ rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB); + +- n_combos = 1 + !!p2p + !!mbss; ++ n_combos = 1 + !!(p2p && !rsdb) + !!mbss; + combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL); + if (!combo) + goto err; +@@ -6479,16 +6487,36 @@ static int brcmf_setup_ifmodes(struct wi + + c = 0; + i = 0; +- c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL); ++ if (p2p && rsdb) ++ c0_limits = kcalloc(4, sizeof(*c0_limits), GFP_KERNEL); ++ else if (p2p) ++ c0_limits = kcalloc(3, sizeof(*c0_limits), GFP_KERNEL); ++ else ++ c0_limits = kcalloc(2, sizeof(*c0_limits), GFP_KERNEL); + if (!c0_limits) + goto err; +- c0_limits[i].max = 1; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); +- if (p2p) { ++ if (p2p && rsdb) { ++ combo[c].num_different_channels = 2; ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | ++ BIT(NL80211_IFTYPE_P2P_GO) | ++ BIT(NL80211_IFTYPE_P2P_DEVICE); ++ c0_limits[i].max = 2; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ c0_limits[i].max = 1; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE); ++ c0_limits[i].max = 2; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) | ++ BIT(NL80211_IFTYPE_P2P_GO); ++ c0_limits[i].max = 2; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); ++ combo[c].max_interfaces = 5; ++ } else if (p2p) { + if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)) + combo[c].num_different_channels = 2; + else + combo[c].num_different_channels = 1; ++ c0_limits[i].max = 1; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); + wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | + BIT(NL80211_IFTYPE_P2P_GO) | + BIT(NL80211_IFTYPE_P2P_DEVICE); +@@ -6497,16 +6525,26 @@ static int brcmf_setup_ifmodes(struct wi + c0_limits[i].max = 1; + c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) | + BIT(NL80211_IFTYPE_P2P_GO); ++ combo[c].max_interfaces = i; ++ } else if (rsdb) { ++ combo[c].num_different_channels = 2; ++ c0_limits[i].max = 2; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ c0_limits[i].max = 2; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); ++ combo[c].max_interfaces = 3; + } else { + combo[c].num_different_channels = 1; + c0_limits[i].max = 1; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ c0_limits[i].max = 1; + c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); ++ combo[c].max_interfaces = i; + } +- combo[c].max_interfaces = i; + combo[c].n_limits = i; + combo[c].limits = c0_limits; + +- if (p2p) { ++ if (p2p && !rsdb) { + c++; + i = 0; + p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL); diff --git a/package/kernel/mac80211/patches/brcm/414-v5.6-0007-brcmfmac-not-set-mbss-in-vif-if-firmware-does-not-su.patch b/package/kernel/mac80211/patches/brcm/414-v5.6-0007-brcmfmac-not-set-mbss-in-vif-if-firmware-does-not-su.patch new file mode 100644 index 000000000..96df09dfa --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/414-v5.6-0007-brcmfmac-not-set-mbss-in-vif-if-firmware-does-not-su.patch @@ -0,0 +1,38 @@ +From 2635853ce4ab7654a77ab7080fb56de83408606b Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Thu, 12 Dec 2019 00:52:51 +0100 +Subject: [PATCH 7/7] brcmfmac: not set mbss in vif if firmware does not + support MBSS + +With RSDB mode, FMAC and firmware are able to create 2 or more AP, +so we should not set mbss in vif structure if firmware does not +support MBSS feature. + +Signed-off-by: Wright Feng +Signed-off-by: Soeren Moch +Reviewed-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -5293,6 +5293,7 @@ struct brcmf_cfg80211_vif *brcmf_alloc_v + struct brcmf_cfg80211_vif *vif_walk; + struct brcmf_cfg80211_vif *vif; + bool mbss; ++ struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0); + + brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n", + sizeof(*vif)); +@@ -5305,7 +5306,8 @@ struct brcmf_cfg80211_vif *brcmf_alloc_v + + brcmf_init_prof(&vif->profile); + +- if (type == NL80211_IFTYPE_AP) { ++ if (type == NL80211_IFTYPE_AP && ++ brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) { + mbss = false; + list_for_each_entry(vif_walk, &cfg->vif_list, list) { + if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) { diff --git a/package/kernel/mac80211/patches/brcm/415-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch b/package/kernel/mac80211/patches/brcm/415-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch new file mode 100644 index 000000000..a55d286e5 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/415-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch @@ -0,0 +1,26 @@ +From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sat, 14 Dec 2019 19:51:14 -0600 +Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit + +In the implementation of brcmf_usbdev_qinit() the allocated memory for +reqs is leaking if usb_alloc_urb() fails. Release reqs in the error +handling path. + +Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") +Signed-off-by: Navid Emamdoost +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -430,6 +430,7 @@ fail: + usb_free_urb(req->urb); + list_del(q->next); + } ++ kfree(reqs); + return NULL; + + } diff --git a/package/kernel/mac80211/patches/brcm/416-v5.6-brcmfmac-Keep-OOB-wake-interrupt-disabled-when-it-sh.patch b/package/kernel/mac80211/patches/brcm/416-v5.6-brcmfmac-Keep-OOB-wake-interrupt-disabled-when-it-sh.patch new file mode 100644 index 000000000..3d193df77 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/416-v5.6-brcmfmac-Keep-OOB-wake-interrupt-disabled-when-it-sh.patch @@ -0,0 +1,66 @@ +From a32de68edab7b73ded850bcf76cdf6858e92a7e5 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 15 Dec 2019 21:42:24 +0300 +Subject: [PATCH] brcmfmac: Keep OOB wake-interrupt disabled when it shouldn't + be enabled + +NVIDIA Tegra SoCs do not like when OOB wake is enabled and WiFi interface +is in DOWN state during suspend. This results in a CPU hang on programming +OOB wake-up state of the GPIO controller during of system's suspend. + +The solution is trivial: don't enable wake for the OOB interrupt when it +should be disabled. + +This fixes hang on Tegra20 (Acer A500) and Tegra30 (Nexus 7) devices which +are using BCM4329 and BCM4330 WiFi chips respectively. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Kalle Valo +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 10 +++++----- + .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 - + 2 files changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -120,7 +120,7 @@ int brcmf_sdiod_intr_register(struct brc + brcmf_err("enable_irq_wake failed %d\n", ret); + return ret; + } +- sdiodev->irq_wake = true; ++ disable_irq_wake(pdata->oob_irq_nr); + + sdio_claim_host(sdiodev->func1); + +@@ -179,10 +179,6 @@ void brcmf_sdiod_intr_unregister(struct + sdio_release_host(sdiodev->func1); + + sdiodev->oob_irq_requested = false; +- if (sdiodev->irq_wake) { +- disable_irq_wake(pdata->oob_irq_nr); +- sdiodev->irq_wake = false; +- } + free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev); + sdiodev->irq_en = false; + sdiodev->oob_irq_requested = false; +@@ -1162,6 +1158,10 @@ static int brcmf_ops_sdio_resume(struct + if (ret) + brcmf_err("Failed to probe device on resume\n"); + } else { ++ if (sdiodev->wowl_enabled && ++ sdiodev->settings->bus.sdio.oob_irq_supported) ++ disable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr); ++ + brcmf_sdiod_freezer_off(sdiodev); + } + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h +@@ -178,7 +178,6 @@ struct brcmf_sdio_dev { + bool sd_irq_requested; + bool irq_en; /* irq enable flags */ + spinlock_t irq_en_lock; +- bool irq_wake; /* irq wake enable flags */ + bool sg_support; + uint max_request_size; + ushort max_segment_count; diff --git a/package/kernel/mac80211/patches/brcm/417-v5.6-brcmfmac-use-true-false-for-bool-variable.patch b/package/kernel/mac80211/patches/brcm/417-v5.6-brcmfmac-use-true-false-for-bool-variable.patch new file mode 100644 index 000000000..0eb169c2d --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/417-v5.6-brcmfmac-use-true-false-for-bool-variable.patch @@ -0,0 +1,27 @@ +From b92c017deda819e45a0f054f6df6b53e645d7fe4 Mon Sep 17 00:00:00 2001 +From: zhengbin +Date: Tue, 24 Dec 2019 22:16:06 +0800 +Subject: [PATCH] brcmfmac: use true,false for bool variable + +Fixes coccicheck warning: + +drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c:911:2-24: WARNING: Assignment of 0/1 to bool variable + +Reported-by: Hulk Robot +Signed-off-by: zhengbin +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +@@ -908,7 +908,7 @@ static u8 brcmf_fws_hdrpush(struct brcmf + wlh += wlh[1] + 2; + + if (entry->send_tim_signal) { +- entry->send_tim_signal = 0; ++ entry->send_tim_signal = false; + wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP; + wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN; + wlh[2] = entry->mac_handle; diff --git a/package/kernel/mac80211/patches/brcm/418-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch b/package/kernel/mac80211/patches/brcm/418-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch new file mode 100644 index 000000000..3b1b00c1d --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/418-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch @@ -0,0 +1,57 @@ +From 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Mon Sep 17 00:00:00 2001 +From: Jean-Philippe Brucker +Date: Thu, 26 Dec 2019 10:20:33 +0100 +Subject: [PATCH] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362 + +Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling +brcmf_bus_started()") changed the initialization order of the brcmfmac +SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now +called before the sdiodev->bus_if initialization, it reads the wrong +chip ID and fails to initialize the GPIO on brcm43362. Thus the chip +cannot send interrupts and fails to probe: + +[ 12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout +[ 12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110 +[ 12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110 +[ 12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed + +Initialize the bus interface earlier to ensure that +brcmf_sdiod_intr_register() properly sets up the OOB interrupt. + +BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438 +Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()") +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4247,6 +4247,12 @@ static void brcmf_sdio_firmware_callback + } + + if (err == 0) { ++ /* Assign bus interface call back */ ++ sdiod->bus_if->dev = sdiod->dev; ++ sdiod->bus_if->ops = &brcmf_sdio_bus_ops; ++ sdiod->bus_if->chip = bus->ci->chip; ++ sdiod->bus_if->chiprev = bus->ci->chiprev; ++ + /* Allow full data communication using DPC from now on. */ + brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA); + +@@ -4263,12 +4269,6 @@ static void brcmf_sdio_firmware_callback + + sdio_release_host(sdiod->func1); + +- /* Assign bus interface call back */ +- sdiod->bus_if->dev = sdiod->dev; +- sdiod->bus_if->ops = &brcmf_sdio_bus_ops; +- sdiod->bus_if->chip = bus->ci->chip; +- sdiod->bus_if->chiprev = bus->ci->chiprev; +- + err = brcmf_alloc(sdiod->dev, sdiod->settings); + if (err) { + brcmf_err("brcmf_alloc failed\n"); diff --git a/package/kernel/mac80211/patches/brcm/419-v5.6-0001-brcmfmac-simplify-building-interface-combinations.patch b/package/kernel/mac80211/patches/brcm/419-v5.6-0001-brcmfmac-simplify-building-interface-combinations.patch new file mode 100644 index 000000000..8c231cbe1 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/419-v5.6-0001-brcmfmac-simplify-building-interface-combinations.patch @@ -0,0 +1,103 @@ +From 24332f8068ff6df7f16aefee45d514de1de4de80 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Thu, 26 Dec 2019 14:30:49 +0100 +Subject: [PATCH] brcmfmac: simplify building interface combinations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Move similar/duplicated code out of combination specific code blocks. +This simplifies code a bit and allows adding more combinations later. +A list of combinations remains unchanged. + +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 43 ++++++------------- + 1 file changed, 14 insertions(+), 29 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6471,12 +6471,13 @@ static int brcmf_setup_ifmodes(struct wi + struct ieee80211_iface_limit *c0_limits = NULL; + struct ieee80211_iface_limit *p2p_limits = NULL; + struct ieee80211_iface_limit *mbss_limits = NULL; +- bool mbss, p2p, rsdb; ++ bool mbss, p2p, rsdb, mchan; + int i, c, n_combos; + + mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS); + p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P); + rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB); ++ mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN); + + n_combos = 1 + !!(p2p && !rsdb) + !!mbss; + combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL); +@@ -6486,6 +6487,10 @@ static int brcmf_setup_ifmodes(struct wi + wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) | + BIT(NL80211_IFTYPE_ADHOC) | + BIT(NL80211_IFTYPE_AP); ++ if (p2p) ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | ++ BIT(NL80211_IFTYPE_P2P_GO) | ++ BIT(NL80211_IFTYPE_P2P_DEVICE); + + c = 0; + i = 0; +@@ -6497,48 +6502,28 @@ static int brcmf_setup_ifmodes(struct wi + c0_limits = kcalloc(2, sizeof(*c0_limits), GFP_KERNEL); + if (!c0_limits) + goto err; +- if (p2p && rsdb) { +- combo[c].num_different_channels = 2; +- wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | +- BIT(NL80211_IFTYPE_P2P_GO) | +- BIT(NL80211_IFTYPE_P2P_DEVICE); +- c0_limits[i].max = 2; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ ++ combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan)); ++ c0_limits[i].max = 1 + rsdb; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ if (p2p) { + c0_limits[i].max = 1; + c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE); +- c0_limits[i].max = 2; ++ c0_limits[i].max = 1 + rsdb; + c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) | + BIT(NL80211_IFTYPE_P2P_GO); ++ } ++ if (p2p && rsdb) { + c0_limits[i].max = 2; + c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); + combo[c].max_interfaces = 5; + } else if (p2p) { +- if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)) +- combo[c].num_different_channels = 2; +- else +- combo[c].num_different_channels = 1; +- c0_limits[i].max = 1; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); +- wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | +- BIT(NL80211_IFTYPE_P2P_GO) | +- BIT(NL80211_IFTYPE_P2P_DEVICE); +- c0_limits[i].max = 1; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE); +- c0_limits[i].max = 1; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) | +- BIT(NL80211_IFTYPE_P2P_GO); + combo[c].max_interfaces = i; + } else if (rsdb) { +- combo[c].num_different_channels = 2; +- c0_limits[i].max = 2; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); + c0_limits[i].max = 2; + c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); + combo[c].max_interfaces = 3; + } else { +- combo[c].num_different_channels = 1; +- c0_limits[i].max = 1; +- c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); + c0_limits[i].max = 1; + c0_limits[i++].types = BIT(NL80211_IFTYPE_AP); + combo[c].max_interfaces = i; diff --git a/package/kernel/mac80211/patches/brcm/419-v5.6-0002-brcmfmac-add-initial-support-for-monitor-mode.patch b/package/kernel/mac80211/patches/brcm/419-v5.6-0002-brcmfmac-add-initial-support-for-monitor-mode.patch new file mode 100644 index 000000000..f64ff1e82 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/419-v5.6-0002-brcmfmac-add-initial-support-for-monitor-mode.patch @@ -0,0 +1,345 @@ +From 20f2c5fa3af060401c72e444999470a4cab641cf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Thu, 26 Dec 2019 14:30:50 +0100 +Subject: [PATCH] brcmfmac: add initial support for monitor mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Report monitor interface availability using cfg80211 and support it in +the add_virtual_intf() and del_virtual_intf() callbacks. This new +feature is conditional and depends on firmware flagging monitor packets. +Receiving monitor frames is already handled by the brcmf_netif_mon_rx(). + +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 112 ++++++++++++++++-- + .../broadcom/brcm80211/brcmfmac/core.c | 68 ++++++++++- + .../broadcom/brcm80211/brcmfmac/core.h | 2 + + .../broadcom/brcm80211/brcmfmac/feature.c | 1 + + .../broadcom/brcm80211/brcmfmac/feature.h | 2 + + .../broadcom/brcm80211/brcmfmac/fwil.h | 2 + + 6 files changed, 174 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -619,6 +620,82 @@ static bool brcmf_is_ibssmode(struct brc + return vif->wdev.iftype == NL80211_IFTYPE_ADHOC; + } + ++/** ++ * brcmf_mon_add_vif() - create monitor mode virtual interface ++ * ++ * @wiphy: wiphy device of new interface. ++ * @name: name of the new interface. ++ */ ++static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy, ++ const char *name) ++{ ++ struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy); ++ struct brcmf_cfg80211_vif *vif; ++ struct net_device *ndev; ++ struct brcmf_if *ifp; ++ int err; ++ ++ if (cfg->pub->mon_if) { ++ err = -EEXIST; ++ goto err_out; ++ } ++ ++ vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR); ++ if (IS_ERR(vif)) { ++ err = PTR_ERR(vif); ++ goto err_out; ++ } ++ ++ ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup); ++ if (!ndev) { ++ err = -ENOMEM; ++ goto err_free_vif; ++ } ++ ndev->type = ARPHRD_IEEE80211_RADIOTAP; ++ ndev->ieee80211_ptr = &vif->wdev; ++ ndev->needs_free_netdev = true; ++ ndev->priv_destructor = brcmf_cfg80211_free_netdev; ++ SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy)); ++ ++ ifp = netdev_priv(ndev); ++ ifp->vif = vif; ++ ifp->ndev = ndev; ++ ifp->drvr = cfg->pub; ++ ++ vif->ifp = ifp; ++ vif->wdev.netdev = ndev; ++ ++ err = brcmf_net_mon_attach(ifp); ++ if (err) { ++ brcmf_err("Failed to attach %s device\n", ndev->name); ++ free_netdev(ndev); ++ goto err_free_vif; ++ } ++ ++ cfg->pub->mon_if = ifp; ++ ++ return &vif->wdev; ++ ++err_free_vif: ++ brcmf_free_vif(vif); ++err_out: ++ return ERR_PTR(err); ++} ++ ++static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev) ++{ ++ struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy); ++ struct net_device *ndev = wdev->netdev; ++ ++ ndev->netdev_ops->ndo_stop(ndev); ++ ++ brcmf_net_detach(ndev, true); ++ ++ cfg->pub->mon_if = NULL; ++ ++ return 0; ++} ++ + static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy, + const char *name, + unsigned char name_assign_type, +@@ -641,9 +718,10 @@ static struct wireless_dev *brcmf_cfg802 + case NL80211_IFTYPE_STATION: + case NL80211_IFTYPE_AP_VLAN: + case NL80211_IFTYPE_WDS: +- case NL80211_IFTYPE_MONITOR: + case NL80211_IFTYPE_MESH_POINT: + return ERR_PTR(-EOPNOTSUPP); ++ case NL80211_IFTYPE_MONITOR: ++ return brcmf_mon_add_vif(wiphy, name); + case NL80211_IFTYPE_AP: + wdev = brcmf_ap_add_vif(wiphy, name, params); + break; +@@ -826,9 +904,10 @@ int brcmf_cfg80211_del_iface(struct wiph + case NL80211_IFTYPE_STATION: + case NL80211_IFTYPE_AP_VLAN: + case NL80211_IFTYPE_WDS: +- case NL80211_IFTYPE_MONITOR: + case NL80211_IFTYPE_MESH_POINT: + return -EOPNOTSUPP; ++ case NL80211_IFTYPE_MONITOR: ++ return brcmf_mon_del_vif(wiphy, wdev); + case NL80211_IFTYPE_AP: + return brcmf_cfg80211_del_ap_iface(wiphy, wdev); + case NL80211_IFTYPE_P2P_CLIENT: +@@ -6471,9 +6550,10 @@ static int brcmf_setup_ifmodes(struct wi + struct ieee80211_iface_limit *c0_limits = NULL; + struct ieee80211_iface_limit *p2p_limits = NULL; + struct ieee80211_iface_limit *mbss_limits = NULL; +- bool mbss, p2p, rsdb, mchan; +- int i, c, n_combos; ++ bool mon_flag, mbss, p2p, rsdb, mchan; ++ int i, c, n_combos, n_limits; + ++ mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG); + mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS); + p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P); + rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB); +@@ -6487,6 +6567,8 @@ static int brcmf_setup_ifmodes(struct wi + wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) | + BIT(NL80211_IFTYPE_ADHOC) | + BIT(NL80211_IFTYPE_AP); ++ if (mon_flag) ++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR); + if (p2p) + wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) | + BIT(NL80211_IFTYPE_P2P_GO) | +@@ -6494,18 +6576,18 @@ static int brcmf_setup_ifmodes(struct wi + + c = 0; + i = 0; +- if (p2p && rsdb) +- c0_limits = kcalloc(4, sizeof(*c0_limits), GFP_KERNEL); +- else if (p2p) +- c0_limits = kcalloc(3, sizeof(*c0_limits), GFP_KERNEL); +- else +- c0_limits = kcalloc(2, sizeof(*c0_limits), GFP_KERNEL); ++ n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p); ++ c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL); + if (!c0_limits) + goto err; + + combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan)); + c0_limits[i].max = 1 + rsdb; + c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION); ++ if (mon_flag) { ++ c0_limits[i].max = 1; ++ c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR); ++ } + if (p2p) { + c0_limits[i].max = 1; + c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE); +@@ -6554,14 +6636,20 @@ static int brcmf_setup_ifmodes(struct wi + if (mbss) { + c++; + i = 0; +- mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL); ++ n_limits = 1 + mon_flag; ++ mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits), ++ GFP_KERNEL); + if (!mbss_limits) + goto err; + mbss_limits[i].max = 4; + mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP); ++ if (mon_flag) { ++ mbss_limits[i].max = 1; ++ mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR); ++ } + combo[c].beacon_int_infra_match = true; + combo[c].num_different_channels = 1; +- combo[c].max_interfaces = 4; ++ combo[c].max_interfaces = 4 + mon_flag; + combo[c].n_limits = i; + combo[c].limits = mbss_limits; + } +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -690,7 +690,7 @@ fail: + return -EBADE; + } + +-static void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked) ++void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked) + { + if (ndev->reg_state == NETREG_REGISTERED) { + if (rtnl_locked) +@@ -703,6 +703,72 @@ static void brcmf_net_detach(struct net_ + } + } + ++static int brcmf_net_mon_open(struct net_device *ndev) ++{ ++ struct brcmf_if *ifp = netdev_priv(ndev); ++ struct brcmf_pub *drvr = ifp->drvr; ++ u32 monitor; ++ int err; ++ ++ brcmf_dbg(TRACE, "Enter\n"); ++ ++ err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_MONITOR, &monitor); ++ if (err) { ++ bphy_err(drvr, "BRCMF_C_GET_MONITOR error (%d)\n", err); ++ return err; ++ } else if (monitor) { ++ bphy_err(drvr, "Monitor mode is already enabled\n"); ++ return -EEXIST; ++ } ++ ++ monitor = 3; ++ err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor); ++ if (err) ++ bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err); ++ ++ return err; ++} ++ ++static int brcmf_net_mon_stop(struct net_device *ndev) ++{ ++ struct brcmf_if *ifp = netdev_priv(ndev); ++ struct brcmf_pub *drvr = ifp->drvr; ++ u32 monitor; ++ int err; ++ ++ brcmf_dbg(TRACE, "Enter\n"); ++ ++ monitor = 0; ++ err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor); ++ if (err) ++ bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err); ++ ++ return err; ++} ++ ++static const struct net_device_ops brcmf_netdev_ops_mon = { ++ .ndo_open = brcmf_net_mon_open, ++ .ndo_stop = brcmf_net_mon_stop, ++}; ++ ++int brcmf_net_mon_attach(struct brcmf_if *ifp) ++{ ++ struct brcmf_pub *drvr = ifp->drvr; ++ struct net_device *ndev; ++ int err; ++ ++ brcmf_dbg(TRACE, "Enter\n"); ++ ++ ndev = ifp->ndev; ++ ndev->netdev_ops = &brcmf_netdev_ops_mon; ++ ++ err = register_netdevice(ndev); ++ if (err) ++ bphy_err(drvr, "Failed to register %s device\n", ndev->name); ++ ++ return err; ++} ++ + void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on) + { + struct net_device *ndev; +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h +@@ -210,6 +210,8 @@ void brcmf_txflowblock_if(struct brcmf_i + void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success); + void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb); + void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb); ++void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked); ++int brcmf_net_mon_attach(struct brcmf_if *ifp); + void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on); + int __init brcmf_core_init(void); + void __exit brcmf_core_exit(void); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +@@ -38,6 +38,7 @@ static const struct brcmf_feat_fwcap brc + { BRCMF_FEAT_MCHAN, "mchan" }, + { BRCMF_FEAT_P2P, "p2p" }, + { BRCMF_FEAT_MONITOR, "monitor" }, ++ { BRCMF_FEAT_MONITOR_FLAG, "rtap" }, + { BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" }, + { BRCMF_FEAT_DOT11H, "802.11h" } + }; +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h +@@ -23,6 +23,7 @@ + * GSCAN: enhanced scan offload feature. + * FWSUP: Firmware supplicant. + * MONITOR: firmware can pass monitor packets to host. ++ * MONITOR_FLAG: firmware flags monitor packets. + * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header + * MONITOR_FMT_HW_RX_HDR: firmware provides monitor packets with hw/ucode header + * DOT11H: firmware supports 802.11h +@@ -43,6 +44,7 @@ + BRCMF_FEAT_DEF(GSCAN) \ + BRCMF_FEAT_DEF(FWSUP) \ + BRCMF_FEAT_DEF(MONITOR) \ ++ BRCMF_FEAT_DEF(MONITOR_FLAG) \ + BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP) \ + BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR) \ + BRCMF_FEAT_DEF(DOT11H) +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h +@@ -49,6 +49,8 @@ + #define BRCMF_C_GET_PM 85 + #define BRCMF_C_SET_PM 86 + #define BRCMF_C_GET_REVINFO 98 ++#define BRCMF_C_GET_MONITOR 107 ++#define BRCMF_C_SET_MONITOR 108 + #define BRCMF_C_GET_CURR_RATESET 114 + #define BRCMF_C_GET_AP 117 + #define BRCMF_C_SET_AP 118 diff --git a/package/kernel/mac80211/patches/brcm/420-v5.6-brcmfmac-Remove-always-false-idx-0-statement.patch b/package/kernel/mac80211/patches/brcm/420-v5.6-brcmfmac-Remove-always-false-idx-0-statement.patch new file mode 100644 index 000000000..9efa76283 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/420-v5.6-brcmfmac-Remove-always-false-idx-0-statement.patch @@ -0,0 +1,24 @@ +From 627b0d094240c38393b2f2d40626c33a8fff6103 Mon Sep 17 00:00:00 2001 +From: yuehaibing +Date: Wed, 8 Jan 2020 21:57:48 +0800 +Subject: [PATCH] brcmfmac: Remove always false 'idx < 0' statement + +idx is declared as u32, it will never less than 0. + +Signed-off-by: yuehaibing +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -365,7 +365,7 @@ brcmf_msgbuf_get_pktid(struct device *de + struct brcmf_msgbuf_pktid *pktid; + struct sk_buff *skb; + +- if (idx < 0 || idx >= pktids->array_size) { ++ if (idx >= pktids->array_size) { + brcmf_err("Invalid packet id %d (max %d)\n", idx, + pktids->array_size); + return NULL; diff --git a/package/kernel/mac80211/patches/brcm/500-brcmfmac-add-stub-for-monitor-interface-xmit.patch b/package/kernel/mac80211/patches/brcm/500-brcmfmac-add-stub-for-monitor-interface-xmit.patch new file mode 100644 index 000000000..8280918fa --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/500-brcmfmac-add-stub-for-monitor-interface-xmit.patch @@ -0,0 +1,100 @@ +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Fri, 27 Mar 2020 13:40:50 +0100 +Subject: [PATCH] brcmfmac: add stub for monitor interface xmit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +According to the struct net_device_ops documentation .ndo_start_xmit is +"Required; cannot be NULL.". Missing it may crash kernel easily: + +[ 341.216709] Unable to handle kernel NULL pointer dereference at virtual address 00000000 +[ 341.224836] pgd = 26088755 +[ 341.227544] [00000000] *pgd=00000000 +[ 341.231135] Internal error: Oops: 80000007 [#1] SMP ARM +[ 341.236367] Modules linked in: pppoe ppp_async iptable_nat brcmfmac xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQU +[ 341.304689] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.24 #0 +[ 341.310621] Hardware name: BCM5301X +[ 341.314116] PC is at 0x0 +[ 341.316664] LR is at dev_hard_start_xmit+0x8c/0x11c +[ 341.321546] pc : [<00000000>] lr : [] psr: 60000113 +[ 341.327821] sp : c0801c30 ip : c610cf00 fp : c08048e4 +[ 341.333051] r10: c073a63a r9 : c08044dc r8 : c6c04e00 +[ 341.338283] r7 : 00000000 r6 : c60f5000 r5 : 00000000 r4 : c6a9c3c0 +[ 341.344820] r3 : 00000000 r2 : bf25a13c r1 : c60f5000 r0 : c6a9c3c0 +[ 341.351358] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 341.358504] Control: 10c5387d Table: 0611c04a DAC: 00000051 +[ 341.364257] Process swapper/0 (pid: 0, stack limit = 0xc68ed0ca) +[ 341.370271] Stack: (0xc0801c30 to 0xc0802000) +[ 341.374633] 1c20: c6e7d480 c0802d00 c60f5050 c0801c6c +[ 341.382825] 1c40: c60f5000 c6a9c3c0 c6f90000 c6f9005c c6c04e00 c60f5000 00000000 c6f9005c +[ 341.391015] 1c60: 00000000 c04a033c 00f90200 00000010 c6a9c3c0 c6a9c3c0 c6f90000 00000000 +[ 341.399205] 1c80: 00000000 00000000 00000000 c046a7ac c6f9005c 00000001 fffffff4 00000000 +[ 341.407395] 1ca0: c6f90200 00000000 c60f5000 c0479550 00000000 c6f90200 c6a9c3c0 16000000 +[ 341.415586] 1cc0: 0000001c 6f4ad52f c6197040 b6df9387 36000000 c0520404 c073a80c c6a9c3c0 +[ 341.423777] 1ce0: 00000000 c6d643c0 c6a9c3c0 c0800024 00000001 00000001 c6d643c8 c6a9c3c0 +[ 341.431967] 1d00: c081b9c0 c7abca80 c610c840 c081b9c0 0000001c 00400000 c6bc5e6c c0522fb4 +[ 341.440157] 1d20: c6d64400 00000004 c6bc5e0a 00000000 c60f5000 c7abca80 c081b9c0 c0522f54 +[ 341.448348] 1d40: c6a9c3c0 c7abca80 c0803e48 c0549c94 c610c828 0000000a c0801d74 00000003 +[ 341.456538] 1d60: c6ec8f0a 00000000 c60f5000 c7abca80 c081b9c0 c0548520 0000000a 00000000 +[ 341.464728] 1d80: 00000000 003a0000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 341.472919] 1da0: 000002ff 00000000 00000000 16000000 00000000 00000000 00000000 00000000 +[ 341.481110] 1dc0: 00000000 0000008f 00000000 00000000 00000000 2d132a69 c6bc5e40 00000000 +[ 341.489300] 1de0: c6bc5e40 c6a9c3c0 00000000 c6ec8e50 00000001 c054b070 00000001 00000000 +[ 341.497490] 1e00: c0807200 c6bc5e00 00000000 ffffe000 00000100 c054aea4 00000000 00000000 +[ 341.505681] 1e20: 00000122 00400000 c0802d00 c0172e80 6f56a70e ffffffff 6f56a70e c7eb9cc0 +[ 341.513871] 1e40: c7eb82c0 00000000 c0801e60 c017309c 00000000 00000000 07780000 c07382c0 +[ 341.522061] 1e60: 00000000 c7eb9cc0 c0739cc0 c0803f74 c0801e70 c0801e70 c0801ea4 c013d380 +[ 341.530253] 1e80: 00000000 000000a0 00000001 c0802084 c0802080 40000001 ffffe000 00000100 +[ 341.538443] 1ea0: c0802080 c01021e8 c8803100 10c5387d 00000000 c07341f0 c0739880 0000000a +[ 341.546633] 1ec0: c0734180 00001017 c0802d00 c062aa98 00200002 c062aa60 c8803100 c073984c +[ 341.554823] 1ee0: 00000000 00000001 00000000 c7810000 c8803100 10c5387d 00000000 c011c188 +[ 341.563014] 1f00: c073984c c015f0f8 c0804244 c0815ae4 c880210c c8802100 c0801f40 c037c584 +[ 341.571204] 1f20: c01035f8 60000013 ffffffff c0801f74 c080afd4 c0800000 10c5387d c0101a8c +[ 341.579395] 1f40: 00000000 004ac9dc c7eba4b4 c010ee60 ffffe000 c0803e68 c0803ea8 00000001 +[ 341.587587] 1f60: c080afd4 c062ca20 10c5387d 00000000 00000000 c0801f90 c01035f4 c01035f8 +[ 341.595776] 1f80: 60000013 ffffffff 00000051 00000000 ffffe000 c013ff50 000000ce c0803e40 +[ 341.603967] 1fa0: c082216c 00000000 00000001 c072ba38 10c5387d c0140214 c0822184 c0700df8 +[ 341.612157] 1fc0: ffffffff ffffffff 00000000 c070058c c072ba38 2d162e71 00000000 c0700330 +[ 341.620348] 1fe0: 00000051 10c0387d 000000ff 00a521d0 413fc090 00000000 00000000 00000000 +[ 341.628558] [] (dev_hard_start_xmit) from [] (sch_direct_xmit+0xe4/0x2bc) +[ 341.637106] [] (sch_direct_xmit) from [] (__dev_queue_xmit+0x6a4/0x72c) +[ 341.645481] [] (__dev_queue_xmit) from [] (ip6_finish_output2+0x18c/0x434) +[ 341.654112] [] (ip6_finish_output2) from [] (ip6_output+0x5c/0xd0) +[ 341.662053] [] (ip6_output) from [] (mld_sendpack+0x1a0/0x1a8) +[ 341.669640] [] (mld_sendpack) from [] (mld_ifc_timer_expire+0x1cc/0x2e4) +[ 341.678111] [] (mld_ifc_timer_expire) from [] (call_timer_fn.constprop.3+0x24/0x98) +[ 341.687527] [] (call_timer_fn.constprop.3) from [] (run_timer_softirq+0x1a8/0x1e4) +[ 341.696860] [] (run_timer_softirq) from [] (__do_softirq+0x120/0x2b0) +[ 341.705066] [] (__do_softirq) from [] (irq_exit+0x78/0x84) +[ 341.712317] [] (irq_exit) from [] (__handle_domain_irq+0x60/0xb4) +[ 341.720179] [] (__handle_domain_irq) from [] (gic_handle_irq+0x4c/0x90) +[ 341.728549] [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90) + +Fixes: 20f2c5fa3af0 ("brcmfmac: add initial support for monitor mode") +Signed-off-by: Rafał Miłecki +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -746,9 +746,18 @@ static int brcmf_net_mon_stop(struct net + return err; + } + ++static netdev_tx_t brcmf_net_mon_start_xmit(struct sk_buff *skb, ++ struct net_device *ndev) ++{ ++ dev_kfree_skb_any(skb); ++ ++ return NETDEV_TX_OK; ++} ++ + static const struct net_device_ops brcmf_netdev_ops_mon = { + .ndo_open = brcmf_net_mon_open, + .ndo_stop = brcmf_net_mon_stop, ++ .ndo_start_xmit = brcmf_net_mon_start_xmit, + }; + + int brcmf_net_mon_attach(struct brcmf_if *ifp) diff --git a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch index 8194c0769..c18a5bfa4 100644 --- a/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch +++ b/package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch @@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1477,6 +1477,7 @@ int __init brcmf_core_init(void) +@@ -1554,6 +1554,7 @@ int __init brcmf_core_init(void) { if (!schedule_work(&brcmf_driver_work)) return -EBUSY; diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch index 5f0fa7faa..37ebb5190 100644 --- a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch +++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch @@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -628,8 +628,36 @@ static struct wireless_dev *brcmf_cfg802 +@@ -705,8 +705,36 @@ static struct wireless_dev *brcmf_cfg802 struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy); struct brcmf_pub *drvr = cfg->pub; struct wireless_dev *wdev; diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch index c5501b94b..afbd2cc74 100644 --- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch +++ b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch @@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -2787,6 +2787,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip +@@ -2866,6 +2866,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip * preference in cfg struct to apply this to * FW later while initializing the dongle */