From: Felix Fietkau Date: Sun, 26 Jun 2016 17:00:01 +0000 (+0200) Subject: mac80211: update to wireless-testing 2016-06-20 X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=67a7daa938671a5c7006e5d689c297a26499d75c;p=openwrt%2Fstaging%2Fnbd.git mac80211: update to wireless-testing 2016-06-20 Signed-off-by: Felix Fietkau --- diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile index 38eb4aff26..199a189976 100644 --- a/package/kernel/mac80211/Makefile +++ b/package/kernel/mac80211/Makefile @@ -10,11 +10,11 @@ include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=mac80211 -PKG_VERSION:=2016-05-12 +PKG_VERSION:=2016-06-20 PKG_RELEASE:=1 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources PKG_BACKPORT_VERSION:= -PKG_MD5SUM:=2142cf38509896dca108624e7c193611 +PKG_MD5SUM:=29c79bdc3928ef5113b17042ebda9237 PKG_SOURCE:=compat-wireless-$(PKG_VERSION)$(PKG_BACKPORT_VERSION).tar.bz2 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/compat-wireless-$(PKG_VERSION) diff --git a/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch b/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch new file mode 100644 index 0000000000..38b31795a4 --- /dev/null +++ b/package/kernel/mac80211/patches/004-fix_duplicate_skcipher_backport.patch @@ -0,0 +1,11 @@ +--- a/compat/Makefile ++++ b/compat/Makefile +@@ -35,8 +35,6 @@ compat-$(CPTCFG_KERNEL_4_6) += backport- + + compat-$(CPTCFG_BPAUTO_BUILD_CRYPTO_CCM) += crypto-ccm.o + compat-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += crypto-skcipher.o +-skcipher-objs += crypto-skcipher.o +-obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o + compat-$(CPTCFG_BPAUTO_BUILD_WANT_DEV_COREDUMP) += drivers-base-devcoredump.o + compat-$(CPTCFG_BPAUTO_RHASHTABLE) += lib-rhashtable.o + cordic-objs += lib-cordic.o diff --git a/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch b/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch deleted file mode 100644 index 38d655fe05..0000000000 --- a/package/kernel/mac80211/patches/004-header-backport-GENL_UNS_ADMIN_PERM.patch +++ /dev/null @@ -1,21 +0,0 @@ -From: Felix Fietkau -Date: Sat, 14 May 2016 16:39:35 +0200 -Subject: [PATCH] header: backport GENL_UNS_ADMIN_PERM - -Signed-off-by: Felix Fietkau ---- - create mode 100644 backport-include/uapi/linux/genetlink.h - ---- /dev/null -+++ b/backport-include/uapi/linux/genetlink.h -@@ -0,0 +1,10 @@ -+#ifndef __COMPAT_UAPI_LINUX_GENETLINK_H -+#define __COMPAT_UAPI_LINUX_GENETLINK_H -+ -+#include_next -+ -+#ifndef GENL_UNS_ADMIN_PERM -+#define GENL_UNS_ADMIN_PERM GENL_ADMIN_PERM -+#endif -+ -+#endif diff --git a/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch b/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch deleted file mode 100644 index e20d87a7fd..0000000000 --- a/package/kernel/mac80211/patches/005-header-backport-nla_put_u64_64bit-and-nla_put_64bit.patch +++ /dev/null @@ -1,158 +0,0 @@ -From: Felix Fietkau -Date: Sat, 14 May 2016 16:40:16 +0200 -Subject: [PATCH] header: backport nla_put_u64_64bit and nla_put_64bit - -Signed-off-by: Felix Fietkau ---- - ---- a/backport-include/net/netlink.h -+++ b/backport-include/net/netlink.h -@@ -189,4 +189,148 @@ static inline __le64 nla_get_le64(const - } - #endif /* < 4.4 */ - -+ -+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,7,0) -+ -+/** -+ * nla_need_padding_for_64bit - test 64-bit alignment of the next attribute -+ * @skb: socket buffer the message is stored in -+ * -+ * Return true if padding is needed to align the next attribute (nla_data()) to -+ * a 64-bit aligned area. -+ */ -+static inline bool nla_need_padding_for_64bit(struct sk_buff *skb) -+{ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ /* The nlattr header is 4 bytes in size, that's why we test -+ * if the skb->data _is_ aligned. A NOP attribute, plus -+ * nlattr header for next attribute, will make nla_data() -+ * 8-byte aligned. -+ */ -+ if (IS_ALIGNED((unsigned long)skb_tail_pointer(skb), 8)) -+ return true; -+#endif -+ return false; -+} -+ -+/** -+ * nla_align_64bit - 64-bit align the nla_data() of next attribute -+ * @skb: socket buffer the message is stored in -+ * @padattr: attribute type for the padding -+ * -+ * Conditionally emit a padding netlink attribute in order to make -+ * the next attribute we emit have a 64-bit aligned nla_data() area. -+ * This will only be done in architectures which do not have -+ * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS defined. -+ * -+ * Returns zero on success or a negative error code. -+ */ -+static inline int nla_align_64bit(struct sk_buff *skb, int padattr) -+{ -+ if (nla_need_padding_for_64bit(skb) && -+ !nla_reserve(skb, padattr, 0)) -+ return -EMSGSIZE; -+ -+ return 0; -+} -+ -+/** -+ * __nla_reserve_64bit - reserve room for attribute on the skb and align it -+ * @skb: socket buffer to reserve room on -+ * @attrtype: attribute type -+ * @attrlen: length of attribute payload -+ * @padattr: attribute type for the padding -+ * -+ * Adds a netlink attribute header to a socket buffer and reserves -+ * room for the payload but does not copy it. It also ensure that this -+ * attribute will have a 64-bit aligned nla_data() area. -+ * -+ * The caller is responsible to ensure that the skb provides enough -+ * tailroom for the attribute header and payload. -+ */ -+static inline struct nlattr *__nla_reserve_64bit(struct sk_buff *skb, int attrtype, -+ int attrlen, int padattr) -+{ -+ if (nla_need_padding_for_64bit(skb)) -+ nla_align_64bit(skb, padattr); -+ -+ return __nla_reserve(skb, attrtype, attrlen); -+} -+ -+/** -+ * __nla_put_64bit - Add a netlink attribute to a socket buffer and align it -+ * @skb: socket buffer to add attribute to -+ * @attrtype: attribute type -+ * @attrlen: length of attribute payload -+ * @data: head of attribute payload -+ * @padattr: attribute type for the padding -+ * -+ * The caller is responsible to ensure that the skb provides enough -+ * tailroom for the attribute header and payload. -+ */ -+static inline void __nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen, -+ const void *data, int padattr) -+{ -+ struct nlattr *nla; -+ -+ nla = __nla_reserve_64bit(skb, attrtype, attrlen, padattr); -+ memcpy(nla_data(nla), data, attrlen); -+} -+ -+/** -+ * nla_total_size_64bit - total length of attribute including padding -+ * @payload: length of payload -+ */ -+static inline int nla_total_size_64bit(int payload) -+{ -+ return NLA_ALIGN(nla_attr_size(payload)) -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ + NLA_ALIGN(nla_attr_size(0)) -+#endif -+ ; -+} -+ -+/** -+ * nla_put_64bit - Add a netlink attribute to a socket buffer and align it -+ * @skb: socket buffer to add attribute to -+ * @attrtype: attribute type -+ * @attrlen: length of attribute payload -+ * @data: head of attribute payload -+ * @padattr: attribute type for the padding -+ * -+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store -+ * the attribute header and payload. -+ */ -+static inline int nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen, -+ const void *data, int padattr) -+{ -+ size_t len; -+ -+ if (nla_need_padding_for_64bit(skb)) -+ len = nla_total_size_64bit(attrlen); -+ else -+ len = nla_total_size(attrlen); -+ if (unlikely(skb_tailroom(skb) < len)) -+ return -EMSGSIZE; -+ -+ __nla_put_64bit(skb, attrtype, attrlen, data, padattr); -+ return 0; -+} -+ -+/** -+ * nla_put_u64_64bit - Add a u64 netlink attribute to a skb and align it -+ * @skb: socket buffer to add attribute to -+ * @attrtype: attribute type -+ * @value: numeric value -+ * @padattr: attribute type for the padding -+ */ -+static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype, -+ u64 value, int padattr) -+{ -+ return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr); -+} -+ -+ -+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4,7,0) */ -+ - #endif /* __BACKPORT_NET_NETLINK_H */ diff --git a/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch b/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch deleted file mode 100644 index 1fdad3c633..0000000000 --- a/package/kernel/mac80211/patches/006-compat-bump-rhashtable-backport-version-due-to-API-c.patch +++ /dev/null @@ -1,18 +0,0 @@ -From: Felix Fietkau -Date: Sat, 14 May 2016 16:44:57 +0200 -Subject: [PATCH] compat: bump rhashtable backport version due to API changes - -Signed-off-by: Felix Fietkau ---- - ---- a/compat/Kconfig -+++ b/compat/Kconfig -@@ -139,7 +139,7 @@ config BPAUTO_BUILD_WANT_DEV_COREDUMP - config BPAUTO_RHASHTABLE - bool - # current API of rhashtable was introduced in version 4.1 -- depends on KERNEL_4_1 -+ depends on KERNEL_4_7 - # not very nice - but better than always having it - default y if MAC80211 - #h-file linux/rhashtable.h diff --git a/package/kernel/mac80211/patches/007-fix_duplicate_skcipher_backport.patch b/package/kernel/mac80211/patches/007-fix_duplicate_skcipher_backport.patch deleted file mode 100644 index 38b31795a4..0000000000 --- a/package/kernel/mac80211/patches/007-fix_duplicate_skcipher_backport.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/compat/Makefile -+++ b/compat/Makefile -@@ -35,8 +35,6 @@ compat-$(CPTCFG_KERNEL_4_6) += backport- - - compat-$(CPTCFG_BPAUTO_BUILD_CRYPTO_CCM) += crypto-ccm.o - compat-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += crypto-skcipher.o --skcipher-objs += crypto-skcipher.o --obj-$(CPTCFG_BPAUTO_CRYPTO_SKCIPHER) += skcipher.o - compat-$(CPTCFG_BPAUTO_BUILD_WANT_DEV_COREDUMP) += drivers-base-devcoredump.o - compat-$(CPTCFG_BPAUTO_RHASHTABLE) += lib-rhashtable.o - cordic-objs += lib-cordic.o diff --git a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch index e9a140c26f..8be5fa15e9 100644 --- a/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch +++ b/package/kernel/mac80211/patches/060-no_local_ssb_bcma.patch @@ -57,7 +57,7 @@ return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev); #else return bus->chipco.dev; -@@ -4901,7 +4901,7 @@ static int b43_wireless_core_init(struct +@@ -4883,7 +4883,7 @@ static int b43_wireless_core_init(struct } if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW) hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */ diff --git a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch index 3029598437..16fab84535 100644 --- a/package/kernel/mac80211/patches/150-disable_addr_notifier.patch +++ b/package/kernel/mac80211/patches/150-disable_addr_notifier.patch @@ -18,9 +18,9 @@ static int ieee80211_ifa6_changed(struct notifier_block *nb, unsigned long data, void *arg) { -@@ -1089,14 +1089,14 @@ int ieee80211_register_hw(struct ieee802 - - rtnl_unlock(); +@@ -1090,14 +1090,14 @@ int ieee80211_register_hw(struct ieee802 + if (result) + goto fail_flows; -#ifdef CONFIG_INET +#ifdef __disabled__CONFIG_INET @@ -35,7 +35,7 @@ local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed; result = register_inet6addr_notifier(&local->ifa6_notifier); if (result) -@@ -1105,13 +1105,13 @@ int ieee80211_register_hw(struct ieee802 +@@ -1106,13 +1106,13 @@ int ieee80211_register_hw(struct ieee802 return 0; @@ -51,8 +51,8 @@ +#if defined(__disabled__CONFIG_INET) || defined(__disabled__CONFIG_IPV6) fail_ifa: #endif - rtnl_lock(); -@@ -1139,10 +1139,10 @@ void ieee80211_unregister_hw(struct ieee + ieee80211_txq_teardown_flows(local); +@@ -1142,10 +1142,10 @@ void ieee80211_unregister_hw(struct ieee tasklet_kill(&local->tx_pending_tasklet); tasklet_kill(&local->tasklet); diff --git a/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch b/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch index 8f7e8936c3..098bda7e93 100644 --- a/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch +++ b/package/kernel/mac80211/patches/300-ath9k-force-rx_clear-when-disabling-rx.patch @@ -1,4 +1,4 @@ -From: Felix Fietkau +From: Felix Fietkau Date: Sun, 7 Jun 2015 13:53:35 +0200 Subject: [PATCH] ath9k: force rx_clear when disabling rx diff --git a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch index 358d0280c5..a160dc4f02 100644 --- a/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch +++ b/package/kernel/mac80211/patches/301-ath9k-limit-retries-for-powersave-response-frames.patch @@ -1,4 +1,4 @@ -From: Felix Fietkau +From: Felix Fietkau Date: Thu, 2 Jul 2015 15:20:56 +0200 Subject: [PATCH] ath9k: limit retries for powersave response frames @@ -8,7 +8,7 @@ gone to sleep. To avoid wasting too much airtime on this, limit the number of retries on such frames and ensure that no sample rate gets used. -Signed-off-by: Felix Fietkau +Signed-off-by: Felix Fietkau --- --- a/drivers/net/wireless/ath/ath9k/xmit.c diff --git a/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch b/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch new file mode 100644 index 0000000000..73accd866b --- /dev/null +++ b/package/kernel/mac80211/patches/303-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch @@ -0,0 +1,21 @@ +From: Ben Greear +Date: Fri, 1 Apr 2016 14:12:08 -0700 +Subject: [PATCH] ath10k: Ensure txrx-compl-task is stopped when cleaning + htt-tx. + +Otherwise, the txrx-compl-task may access some bad memory? + +Signed-off-by: Ben Greear +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_tx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c +@@ -388,6 +388,8 @@ void ath10k_htt_tx_free(struct ath10k_ht + { + int size; + ++ tasklet_kill(&htt->txrx_compl_task); ++ + idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar); + idr_destroy(&htt->pending_tx); + diff --git a/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch b/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch deleted file mode 100644 index 518d0a31da..0000000000 --- a/package/kernel/mac80211/patches/303-mac80211-mesh-flush-mesh-paths-unconditionally.patch +++ /dev/null @@ -1,146 +0,0 @@ -From: Bob Copeland -Date: Sun, 15 May 2016 13:19:16 -0400 -Subject: [PATCH] mac80211: mesh: flush mesh paths unconditionally - -Currently, the mesh paths associated with a nexthop station are cleaned -up in the following code path: - - __sta_info_destroy_part1 - synchronize_net() - __sta_info_destroy_part2 - -> cleanup_single_sta - -> mesh_sta_cleanup - -> mesh_plink_deactivate - -> mesh_path_flush_by_nexthop - -However, there are a couple of problems here: - -1) the paths aren't flushed at all if the MPM is running in userspace - (e.g. when using wpa_supplicant or authsae) - -2) there is no synchronize_rcu between removing the path and readers - accessing the nexthop, which means the following race is possible: - -CPU0 CPU1 -~~~~ ~~~~ - sta_info_destroy_part1() - synchronize_net() -rcu_read_lock() -mesh_nexthop_resolve() - mpath = mesh_path_lookup() - [...] -> mesh_path_flush_by_nexthop() - sta = rcu_dereference( - mpath->next_hop) - kfree(sta) - access sta <-- CRASH - -Fix both of these by unconditionally flushing paths before destroying -the sta, and by adding a synchronize_net() after path flush to ensure -no active readers can still dereference the sta. - -Fixes this crash: - -[ 348.529295] BUG: unable to handle kernel paging request at 00020040 -[ 348.530014] IP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] -[ 348.530014] *pde = 00000000 -[ 348.530014] Oops: 0000 [#1] PREEMPT -[ 348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ] -[ 348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G O 4.6.0-rc5-wt=V1 #1 -[ 348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016 11/07/2014 -[ 348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000 -[ 348.530014] EIP: 0060:[] EFLAGS: 00010246 CPU: 0 -[ 348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] -[ 348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008 -[ 348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40 -[ 348.530014] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 -[ 348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690 -[ 348.530014] Stack: -[ 348.530014] 00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0 -[ 348.530014] f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320 -[ 348.530014] f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1 -[ 348.530014] Call Trace: -[ 348.530014] [] mesh_nexthop_lookup+0xbb/0xc8 [mac80211] -[ 348.530014] [] mesh_nexthop_resolve+0x34/0xd8 [mac80211] -[ 348.530014] [] ieee80211_xmit+0x92/0xc1 [mac80211] -[ 348.530014] [] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211] -[ 348.530014] [] ? sch_direct_xmit+0xd7/0x1b3 -[ 348.530014] [] ? __local_bh_enable_ip+0x5d/0x7b -[ 348.530014] [] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4] -[ 348.530014] [] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat] -[ 348.530014] [] ? netif_skb_features+0x14d/0x30a -[ 348.530014] [] ieee80211_subif_start_xmit+0xa/0xe [mac80211] -[ 348.530014] [] dev_hard_start_xmit+0x1f8/0x267 -[ 348.530014] [] ? validate_xmit_skb.isra.120.part.121+0x10/0x253 -[ 348.530014] [] sch_direct_xmit+0x8b/0x1b3 -[ 348.530014] [] __dev_queue_xmit+0x2c8/0x513 -[ 348.530014] [] dev_queue_xmit+0xa/0xc -[ 348.530014] [] batadv_send_skb_packet+0xd6/0xec [batman_adv] -[ 348.530014] [] batadv_send_unicast_skb+0x15/0x4a [batman_adv] -[ 348.530014] [] batadv_dat_send_data+0x27e/0x310 [batman_adv] -[ 348.530014] [] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv] -[ 348.530014] [] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv] -[ 348.530014] [] batadv_interface_tx+0x206/0x385 [batman_adv] -[ 348.530014] [] dev_hard_start_xmit+0x1f8/0x267 -[ 348.530014] [] ? validate_xmit_skb.isra.120.part.121+0x10/0x253 -[ 348.530014] [] sch_direct_xmit+0x8b/0x1b3 -[ 348.530014] [] __dev_queue_xmit+0x2c8/0x513 -[ 348.530014] [] ? igb_xmit_frame+0x57/0x72 [igb] -[ 348.530014] [] dev_queue_xmit+0xa/0xc -[ 348.530014] [] br_dev_queue_push_xmit+0xeb/0xfb [bridge] -[ 348.530014] [] br_forward_finish+0x29/0x74 [bridge] -[ 348.530014] [] ? deliver_clone+0x3b/0x3b [bridge] -[ 348.530014] [] __br_forward+0x89/0xe7 [bridge] -[ 348.530014] [] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge] -[ 348.530014] [] deliver_clone+0x34/0x3b [bridge] -[ 348.530014] [] ? br_flood+0x95/0x95 [bridge] -[ 348.530014] [] br_flood+0x77/0x95 [bridge] -[ 348.530014] [] br_flood_forward+0x13/0x1a [bridge] -[ 348.530014] [] ? br_flood+0x95/0x95 [bridge] -[ 348.530014] [] br_handle_frame_finish+0x392/0x3db [bridge] -[ 348.530014] [] ? nf_iterate+0x2b/0x6b -[ 348.530014] [] br_handle_frame+0x1e6/0x240 [bridge] -[ 348.530014] [] ? br_handle_local_finish+0x6a/0x6a [bridge] -[ 348.530014] [] __netif_receive_skb_core+0x43a/0x66b -[ 348.530014] [] ? br_handle_frame_finish+0x3db/0x3db [bridge] -[ 348.530014] [] ? resched_curr+0x19/0x37 -[ 348.530014] [] ? check_preempt_wakeup+0xbf/0xfe -[ 348.530014] [] ? ktime_get_with_offset+0x5c/0xfc -[ 348.530014] [] __netif_receive_skb+0x47/0x55 -[ 348.530014] [] netif_receive_skb_internal+0x40/0x5a -[ 348.530014] [] napi_gro_receive+0x3a/0x94 -[ 348.530014] [] igb_poll+0x6fd/0x9ad [igb] -[ 348.530014] [] ? swake_up_locked+0x14/0x26 -[ 348.530014] [] net_rx_action+0xde/0x250 -[ 348.530014] [] __do_softirq+0x8a/0x163 -[ 348.530014] [] ? __hrtimer_tasklet_trampoline+0x19/0x19 -[ 348.530014] [] do_softirq_own_stack+0x26/0x2c -[ 348.530014] -[ 348.530014] [] irq_exit+0x31/0x6f -[ 348.530014] [] do_IRQ+0x8d/0xa0 -[ 348.530014] [] common_interrupt+0x2c/0x40 -[ 348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005 -[ 348.530014] EIP: [] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40 -[ 348.530014] CR2: 0000000000020040 -[ 348.530014] ---[ end trace 48556ac26779732e ]--- -[ 348.530014] Kernel panic - not syncing: Fatal exception in interrupt -[ 348.530014] Kernel Offset: disabled - -Cc: stable@vger.kernel.org -Reported-by: Fred Veldini -Tested-by: Fred Veldini -Signed-off-by: Bob Copeland ---- - ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -161,6 +161,10 @@ void mesh_sta_cleanup(struct sta_info *s - del_timer_sync(&sta->mesh->plink_timer); - } - -+ /* make sure no readers can access nexthop sta from here on */ -+ mesh_path_flush_by_nexthop(sta); -+ synchronize_net(); -+ - if (changed) - ieee80211_mbss_info_change_notify(sdata, changed); - } diff --git a/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch b/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch new file mode 100644 index 0000000000..7dec1fb55a --- /dev/null +++ b/package/kernel/mac80211/patches/304-ath10k-Ensure-peer_map-references-are-cleaned-up.patch @@ -0,0 +1,60 @@ +From: Ben Greear +Date: Fri, 1 Apr 2016 14:12:09 -0700 +Subject: [PATCH] ath10k: Ensure peer_map references are cleaned up. + +While debugging OS crashes due to firmware crashes, I enabled +kasan, and it noticed that peer objects were being used-after-freed. + +Looks like there are two places we could be leaving stale references +in the peer-map, so clean that up. + +Signed-off-by: Ben Greear +--- + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -802,6 +802,7 @@ static void ath10k_peer_cleanup(struct a + { + struct ath10k_peer *peer, *tmp; + int peer_id; ++ int i; + + lockdep_assert_held(&ar->conf_mutex); + +@@ -818,6 +819,17 @@ static void ath10k_peer_cleanup(struct a + ar->peer_map[peer_id] = NULL; + } + ++ /* Double check that peer is properly un-referenced from ++ * the peer_map ++ */ ++ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) { ++ if (ar->peer_map[i] == peer) { ++ ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n", ++ peer->addr, peer, i); ++ ar->peer_map[i] = NULL; ++ } ++ } ++ + list_del(&peer->list); + kfree(peer); + ar->num_peers--; +@@ -828,6 +840,7 @@ static void ath10k_peer_cleanup(struct a + static void ath10k_peer_cleanup_all(struct ath10k *ar) + { + struct ath10k_peer *peer, *tmp; ++ int i; + + lockdep_assert_held(&ar->conf_mutex); + +@@ -836,6 +849,10 @@ static void ath10k_peer_cleanup_all(stru + list_del(&peer->list); + kfree(peer); + } ++ ++ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) ++ ar->peer_map[i] = NULL; ++ + spin_unlock_bh(&ar->data_lock); + + ar->num_peers = 0; diff --git a/package/kernel/mac80211/patches/304-mac80211-fix-fast_tx-header-alignment.patch b/package/kernel/mac80211/patches/304-mac80211-fix-fast_tx-header-alignment.patch deleted file mode 100644 index 6316d81729..0000000000 --- a/package/kernel/mac80211/patches/304-mac80211-fix-fast_tx-header-alignment.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Felix Fietkau -Date: Thu, 19 May 2016 17:32:13 +0200 -Subject: [PATCH] mac80211: fix fast_tx header alignment - -The header field is defined as u8[] but also accessed as struct -ieee80211_hdr. Enforce an alignment of 2 to prevent unnecessary -unaligned accesses, which can be very harmful for performance on many -platforms. - -Fixes: e495c24731a2 ("mac80211: extend fast-xmit for more ciphers") -Cc: stable@vger.kernel.org -Signed-off-by: Felix Fietkau ---- - ---- a/net/mac80211/sta_info.h -+++ b/net/mac80211/sta_info.h -@@ -280,7 +280,7 @@ struct ieee80211_fast_tx { - u8 sa_offs, da_offs, pn_offs; - u8 band; - u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV + -- sizeof(rfc1042_header)]; -+ sizeof(rfc1042_header)] __aligned(2); - - struct rcu_head rcu_head; - }; diff --git a/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch b/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch new file mode 100644 index 0000000000..7248a8cecf --- /dev/null +++ b/package/kernel/mac80211/patches/305-ath10k-Clean-up-peer-when-sta-goes-away.patch @@ -0,0 +1,32 @@ +From: Ben Greear +Date: Fri, 1 Apr 2016 14:12:11 -0700 +Subject: [PATCH] ath10k: Clean up peer when sta goes away. + +If WMI and/or firmware has issues removing the peer object, +then we still need to clean up the peer object in the driver. + +Signed-off-by: Ben Greear +--- + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5992,9 +5992,17 @@ static int ath10k_sta_state(struct ieee8 + continue; + + if (peer->sta == sta) { +- ath10k_warn(ar, "found sta peer %pM entry on vdev %i after it was supposedly removed\n", +- sta->addr, arvif->vdev_id); ++ ath10k_warn(ar, "found sta peer %pM (ptr %p id %d) entry on vdev %i after it was supposedly removed\n", ++ sta->addr, peer, i, arvif->vdev_id); + peer->sta = NULL; ++ ++ /* Clean up the peer object as well since we ++ * must have failed to do this above. ++ */ ++ list_del(&peer->list); ++ ar->peer_map[i] = NULL; ++ kfree(peer); ++ ar->num_peers--; + } + } + spin_unlock_bh(&ar->data_lock); diff --git a/package/kernel/mac80211/patches/305-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch b/package/kernel/mac80211/patches/305-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch deleted file mode 100644 index 73accd866b..0000000000 --- a/package/kernel/mac80211/patches/305-ath10k-Ensure-txrx-compl-task-is-stopped-when-cleani.patch +++ /dev/null @@ -1,21 +0,0 @@ -From: Ben Greear -Date: Fri, 1 Apr 2016 14:12:08 -0700 -Subject: [PATCH] ath10k: Ensure txrx-compl-task is stopped when cleaning - htt-tx. - -Otherwise, the txrx-compl-task may access some bad memory? - -Signed-off-by: Ben Greear ---- - ---- a/drivers/net/wireless/ath/ath10k/htt_tx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c -@@ -388,6 +388,8 @@ void ath10k_htt_tx_free(struct ath10k_ht - { - int size; - -+ tasklet_kill(&htt->txrx_compl_task); -+ - idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar); - idr_destroy(&htt->pending_tx); - diff --git a/package/kernel/mac80211/patches/306-ath10k-Ensure-peer_map-references-are-cleaned-up.patch b/package/kernel/mac80211/patches/306-ath10k-Ensure-peer_map-references-are-cleaned-up.patch deleted file mode 100644 index 2979b4b57e..0000000000 --- a/package/kernel/mac80211/patches/306-ath10k-Ensure-peer_map-references-are-cleaned-up.patch +++ /dev/null @@ -1,60 +0,0 @@ -From: Ben Greear -Date: Fri, 1 Apr 2016 14:12:09 -0700 -Subject: [PATCH] ath10k: Ensure peer_map references are cleaned up. - -While debugging OS crashes due to firmware crashes, I enabled -kasan, and it noticed that peer objects were being used-after-freed. - -Looks like there are two places we could be leaving stale references -in the peer-map, so clean that up. - -Signed-off-by: Ben Greear ---- - ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -773,6 +773,7 @@ static void ath10k_peer_cleanup(struct a - { - struct ath10k_peer *peer, *tmp; - int peer_id; -+ int i; - - lockdep_assert_held(&ar->conf_mutex); - -@@ -789,6 +790,17 @@ static void ath10k_peer_cleanup(struct a - ar->peer_map[peer_id] = NULL; - } - -+ /* Double check that peer is properly un-referenced from -+ * the peer_map -+ */ -+ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) { -+ if (ar->peer_map[i] == peer) { -+ ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %p idx %d)\n", -+ peer->addr, peer, i); -+ ar->peer_map[i] = NULL; -+ } -+ } -+ - list_del(&peer->list); - kfree(peer); - ar->num_peers--; -@@ -799,6 +811,7 @@ static void ath10k_peer_cleanup(struct a - static void ath10k_peer_cleanup_all(struct ath10k *ar) - { - struct ath10k_peer *peer, *tmp; -+ int i; - - lockdep_assert_held(&ar->conf_mutex); - -@@ -807,6 +820,10 @@ static void ath10k_peer_cleanup_all(stru - list_del(&peer->list); - kfree(peer); - } -+ -+ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) -+ ar->peer_map[i] = NULL; -+ - spin_unlock_bh(&ar->data_lock); - - ar->num_peers = 0; diff --git a/package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch b/package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch new file mode 100644 index 0000000000..4a8f143946 --- /dev/null +++ b/package/kernel/mac80211/patches/306-mac80211-add-hdrlen-to-ieee80211_tx_data.patch @@ -0,0 +1,203 @@ +From: Janusz Dziedzic +Date: Fri, 19 Feb 2016 11:01:49 +0100 +Subject: [PATCH] mac80211: add hdrlen to ieee80211_tx_data + +Add hdrlen to ieee80211_tx_data and use this +when wep/ccmd/tkip. This is preparation for +aligned4 code. + +Signed-off-by: Janusz Dziedzic +--- + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -173,6 +173,7 @@ struct ieee80211_tx_data { + struct ieee80211_tx_rate rate; + + unsigned int flags; ++ unsigned int hdrlen; + }; + + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -922,7 +922,7 @@ ieee80211_tx_h_fragment(struct ieee80211 + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_hdr *hdr = (void *)skb->data; + int frag_threshold = tx->local->hw.wiphy->frag_threshold; +- int hdrlen; ++ int hdrlen = tx->hdrlen; + int fragnum; + + /* no matter what happens, tx->skb moves to tx->skbs */ +@@ -943,8 +943,6 @@ ieee80211_tx_h_fragment(struct ieee80211 + if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU)) + return TX_DROP; + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); +- + /* internal error, why isn't DONTFRAG set? */ + if (WARN_ON(skb->len + FCS_LEN <= frag_threshold)) + return TX_DROP; +@@ -1176,6 +1174,8 @@ ieee80211_tx_prepare(struct ieee80211_su + + hdr = (struct ieee80211_hdr *) skb->data; + ++ tx->hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ + if (likely(sta)) { + if (!IS_ERR(sta)) + tx->sta = sta; +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1226,6 +1226,7 @@ void ieee80211_send_auth(struct ieee8021 + struct ieee80211_local *local = sdata->local; + struct sk_buff *skb; + struct ieee80211_mgmt *mgmt; ++ unsigned int hdrlen; + int err; + + /* 24 + 6 = header + auth_algo + auth_transaction + status_code */ +@@ -1250,8 +1251,10 @@ void ieee80211_send_auth(struct ieee8021 + memcpy(skb_put(skb, extra_len), extra, extra_len); + + if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) { ++ hdrlen = ieee80211_hdrlen(mgmt->frame_control); + mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); +- err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx); ++ err = ieee80211_wep_encrypt(local, skb, hdrlen, key, ++ key_len, key_idx); + WARN_ON(err); + } + +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -89,11 +89,11 @@ static void ieee80211_wep_get_iv(struct + + static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, + struct sk_buff *skb, ++ unsigned int hdrlen, + int keylen, int keyidx) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +- unsigned int hdrlen; + u8 *newhdr; + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); +@@ -101,7 +101,6 @@ static u8 *ieee80211_wep_add_iv(struct i + if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) + return NULL; + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); + newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN); + memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen); + +@@ -160,6 +159,7 @@ int ieee80211_wep_encrypt_data(struct cr + */ + int ieee80211_wep_encrypt(struct ieee80211_local *local, + struct sk_buff *skb, ++ unsigned int hdrlen, + const u8 *key, int keylen, int keyidx) + { + u8 *iv; +@@ -169,7 +169,7 @@ int ieee80211_wep_encrypt(struct ieee802 + if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN)) + return -1; + +- iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); ++ iv = ieee80211_wep_add_iv(local, skb, hdrlen, keylen, keyidx); + if (!iv) + return -1; + +@@ -306,13 +306,14 @@ static int wep_encrypt_skb(struct ieee80 + struct ieee80211_key_conf *hw_key = info->control.hw_key; + + if (!hw_key) { +- if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key, ++ if (ieee80211_wep_encrypt(tx->local, skb, tx->hdrlen, ++ tx->key->conf.key, + tx->key->conf.keylen, + tx->key->conf.keyidx)) + return -1; + } else if ((hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) || + (hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) { +- if (!ieee80211_wep_add_iv(tx->local, skb, ++ if (!ieee80211_wep_add_iv(tx->local, skb, tx->hdrlen, + tx->key->conf.keylen, + tx->key->conf.keyidx)) + return -1; +--- a/net/mac80211/wep.h ++++ b/net/mac80211/wep.h +@@ -22,6 +22,7 @@ int ieee80211_wep_encrypt_data(struct cr + size_t klen, u8 *data, size_t data_len); + int ieee80211_wep_encrypt(struct ieee80211_local *local, + struct sk_buff *skb, ++ unsigned int hdrlen, + const u8 *key, int keylen, int keyidx); + int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key, + size_t klen, u8 *data, size_t data_len); +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -43,7 +43,7 @@ ieee80211_tx_h_michael_mic_add(struct ie + skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control)) + return TX_CONTINUE; + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ hdrlen = tx->hdrlen; + if (skb->len < hdrlen) + return TX_DROP; + +@@ -186,7 +186,6 @@ mic_fail_no_key: + + static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb) + { +- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + struct ieee80211_key *key = tx->key; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + unsigned int hdrlen; +@@ -201,7 +200,7 @@ static int tkip_encrypt_skb(struct ieee8 + return 0; + } + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ hdrlen = tx->hdrlen; + len = skb->len - hdrlen; + + if (info->control.hw_key) +@@ -418,7 +417,7 @@ static int ccmp_encrypt_skb(struct ieee8 + return 0; + } + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ hdrlen = tx->hdrlen; + len = skb->len - hdrlen; + + if (info->control.hw_key) +@@ -651,7 +650,7 @@ static int gcmp_encrypt_skb(struct ieee8 + return 0; + } + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ hdrlen = tx->hdrlen; + len = skb->len - hdrlen; + + if (info->control.hw_key) +@@ -791,7 +790,6 @@ static ieee80211_tx_result + ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx, + struct sk_buff *skb) + { +- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct ieee80211_key *key = tx->key; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + int hdrlen; +@@ -807,8 +805,7 @@ ieee80211_crypto_cs_encrypt(struct ieee8 + pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC))) + return TX_DROP; + +- hdrlen = ieee80211_hdrlen(hdr->frame_control); +- ++ hdrlen = tx->hdrlen; + pos = skb_push(skb, iv_len); + memmove(pos, pos + iv_len, hdrlen); + diff --git a/package/kernel/mac80211/patches/307-ath10k-Clean-up-peer-when-sta-goes-away.patch b/package/kernel/mac80211/patches/307-ath10k-Clean-up-peer-when-sta-goes-away.patch deleted file mode 100644 index f814ae7187..0000000000 --- a/package/kernel/mac80211/patches/307-ath10k-Clean-up-peer-when-sta-goes-away.patch +++ /dev/null @@ -1,32 +0,0 @@ -From: Ben Greear -Date: Fri, 1 Apr 2016 14:12:11 -0700 -Subject: [PATCH] ath10k: Clean up peer when sta goes away. - -If WMI and/or firmware has issues removing the peer object, -then we still need to clean up the peer object in the driver. - -Signed-off-by: Ben Greear ---- - ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -5949,9 +5949,17 @@ static int ath10k_sta_state(struct ieee8 - continue; - - if (peer->sta == sta) { -- ath10k_warn(ar, "found sta peer %pM entry on vdev %i after it was supposedly removed\n", -- sta->addr, arvif->vdev_id); -+ ath10k_warn(ar, "found sta peer %pM (ptr %p id %d) entry on vdev %i after it was supposedly removed\n", -+ sta->addr, peer, i, arvif->vdev_id); - peer->sta = NULL; -+ -+ /* Clean up the peer object as well since we -+ * must have failed to do this above. -+ */ -+ list_del(&peer->list); -+ ar->peer_map[i] = NULL; -+ kfree(peer); -+ ar->num_peers--; - } - } - spin_unlock_bh(&ar->data_lock); diff --git a/package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch b/package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch new file mode 100644 index 0000000000..eeb881e030 --- /dev/null +++ b/package/kernel/mac80211/patches/307-mac80211-add-NEED_ALIGNED4_SKBS-hw-flag.patch @@ -0,0 +1,235 @@ +From: Janusz Dziedzic +Date: Fri, 19 Feb 2016 11:01:50 +0100 +Subject: [PATCH] mac80211: add NEED_ALIGNED4_SKBS hw flag + +HW/driver should set NEED_ALIGNED4_SKBS flag in case +require aligned skbs to four-byte boundaries. +This affect only TX direction. + +Padding is added after ieee80211_hdr, before IV/LLC. + +Before we have to do memmove(hdrlen) twice in the +dirver. Once before we pass this to HW and next +in tx completion (to be sure monitor will report +this tx frame correctly). + +With this patch we can skip this memmove() and save CPU. + +Currently this was tested with ath9k, both hw/sw crypt for +wep/tkip/ccmp. + +Signed-off-by: Janusz Dziedzic +--- + +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -2014,6 +2014,9 @@ struct ieee80211_txq { + * @IEEE80211_HW_TX_FRAG_LIST: Hardware (or driver) supports sending frag_list + * skbs, needed for zero-copy software A-MSDU. + * ++ * @IEEE80211_HW_NEEDS_ALIGNED4_SKBS: Driver need aligned skbs to four-byte. ++ * Padding will be added after ieee80211_hdr, before IV/LLC. ++ * + * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays + */ + enum ieee80211_hw_flags { +@@ -2054,6 +2057,7 @@ enum ieee80211_hw_flags { + IEEE80211_HW_USES_RSS, + IEEE80211_HW_TX_AMSDU, + IEEE80211_HW_TX_FRAG_LIST, ++ IEEE80211_HW_NEEDS_ALIGNED4_SKBS, + + /* keep last, obviously */ + NUM_IEEE80211_HW_FLAGS +--- a/net/mac80211/debugfs.c ++++ b/net/mac80211/debugfs.c +@@ -302,6 +302,7 @@ static const char *hw_flag_names[] = { + FLAG(USES_RSS), + FLAG(TX_AMSDU), + FLAG(TX_FRAG_LIST), ++ FLAG(NEEDS_ALIGNED4_SKBS), + #undef FLAG + }; + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1497,6 +1497,29 @@ ieee80211_have_rx_timestamp(struct ieee8 + return false; + } + ++static inline unsigned int ++ieee80211_hdr_padsize(struct ieee80211_hw *hw, unsigned int hdrlen) ++{ ++ /* ++ * While hdrlen is already aligned to two-byte boundaries, ++ * simple check with & 2 will return correct padsize. ++ */ ++ if (ieee80211_hw_check(hw, NEEDS_ALIGNED4_SKBS)) ++ return hdrlen & 2; ++ return 0; ++} ++ ++static inline unsigned int ++ieee80211_padded_hdrlen(struct ieee80211_hw *hw, __le16 fc) ++{ ++ unsigned int hdrlen; ++ ++ hdrlen = ieee80211_hdrlen(fc); ++ hdrlen += ieee80211_hdr_padsize(hw, hdrlen); ++ ++ return hdrlen; ++} ++ + u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local, + struct ieee80211_rx_status *status, + unsigned int mpdu_len, +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -279,7 +279,7 @@ struct ieee80211_fast_tx { + u8 hdr_len; + u8 sa_offs, da_offs, pn_offs; + u8 band; +- u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV + ++ u8 hdr[30 + 2 + 2 + IEEE80211_FAST_XMIT_MAX_IV + + sizeof(rfc1042_header)] __aligned(2); + + struct rcu_head rcu_head; +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -683,9 +683,22 @@ void ieee80211_tx_monitor(struct ieee802 + struct sk_buff *skb2; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_sub_if_data *sdata; ++ struct ieee80211_hdr *hdr = (void *)skb->data; + struct net_device *prev_dev = NULL; ++ unsigned int hdrlen, padsize; + int rtap_len; + ++ /* Remove padding if was added */ ++ if (ieee80211_hw_check(&local->hw, NEEDS_ALIGNED4_SKBS)) { ++ hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ padsize = ieee80211_hdr_padsize(&local->hw, hdrlen); ++ ++ if (padsize && skb->len > hdrlen + padsize) { ++ memmove(skb->data + padsize, skb->data, hdrlen); ++ skb_pull(skb, padsize); ++ } ++ } ++ + /* send frame to monitor interfaces now */ + rtap_len = ieee80211_tx_radiotap_len(info); + if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) { +--- a/net/mac80211/tkip.c ++++ b/net/mac80211/tkip.c +@@ -201,10 +201,12 @@ void ieee80211_get_tkip_p2k(struct ieee8 + { + struct ieee80211_key *key = (struct ieee80211_key *) + container_of(keyconf, struct ieee80211_key, conf); ++ struct ieee80211_hw *hw = &key->local->hw; + const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY]; + struct tkip_ctx *ctx = &key->u.tkip.tx; + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; +- const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control); ++ const u8 *data = (u8 *)hdr + ieee80211_padded_hdrlen(hw, ++ hdr->frame_control); + u32 iv32 = get_unaligned_le32(&data[4]); + u16 iv16 = data[2] | (data[0] << 8); + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1173,8 +1173,7 @@ ieee80211_tx_prepare(struct ieee80211_su + info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING; + + hdr = (struct ieee80211_hdr *) skb->data; +- +- tx->hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ tx->hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control); + + if (likely(sta)) { + if (!IS_ERR(sta)) +@@ -2108,7 +2107,7 @@ netdev_tx_t ieee80211_monitor_start_xmit + goto fail; + + hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr); +- hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ hdrlen = ieee80211_padded_hdrlen(&local->hw, hdr->frame_control); + + if (skb->len < len_rthdr + hdrlen) + goto fail; +@@ -2334,7 +2333,7 @@ static struct sk_buff *ieee80211_build_h + struct ieee80211_chanctx_conf *chanctx_conf; + struct ieee80211_sub_if_data *ap_sdata; + enum nl80211_band band; +- int ret; ++ int padsize, ret; + + if (IS_ERR(sta)) + sta = NULL; +@@ -2554,6 +2553,9 @@ static struct sk_buff *ieee80211_build_h + hdrlen += 2; + } + ++ /* Check aligned4 skb required */ ++ padsize = ieee80211_hdr_padsize(&sdata->local->hw, hdrlen); ++ + /* + * Drop unicast frames to unauthorised stations unless they are + * EAPOL frames from the local station. +@@ -2640,6 +2642,7 @@ static struct sk_buff *ieee80211_build_h + h_pos -= skip_header_bytes; + + head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb); ++ head_need += padsize; + + /* + * So we need to modify the skb header and hence need a copy of +@@ -2678,6 +2681,9 @@ static struct sk_buff *ieee80211_build_h + } + #endif + ++ if (padsize) ++ memset(skb_push(skb, padsize), 0, padsize); ++ + if (ieee80211_is_data_qos(fc)) { + __le16 *qos_control; + +@@ -2691,8 +2697,8 @@ static struct sk_buff *ieee80211_build_h + } else + memcpy(skb_push(skb, hdrlen), &hdr, hdrlen); + +- nh_pos += hdrlen; +- h_pos += hdrlen; ++ nh_pos += hdrlen + padsize; ++ h_pos += hdrlen + padsize; + + /* Update skb pointers to various headers since this modified frame + * is going to go through Linux networking code that may potentially +@@ -2861,6 +2867,9 @@ void ieee80211_check_fast_xmit(struct st + fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA); + } + ++ /* Check aligned4 skb required */ ++ build.hdr_len += ieee80211_hdr_padsize(&local->hw, build.hdr_len); ++ + /* We store the key here so there's no point in using rcu_dereference() + * but that's fine because the code that changes the pointers will call + * this function after doing so. For a single CPU that would be enough, +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1224,6 +1224,7 @@ void ieee80211_send_auth(struct ieee8021 + u32 tx_flags) + { + struct ieee80211_local *local = sdata->local; ++ struct ieee80211_hw *hw = &local->hw; + struct sk_buff *skb; + struct ieee80211_mgmt *mgmt; + unsigned int hdrlen; +@@ -1251,7 +1252,7 @@ void ieee80211_send_auth(struct ieee8021 + memcpy(skb_put(skb, extra_len), extra, extra_len); + + if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) { +- hdrlen = ieee80211_hdrlen(mgmt->frame_control); ++ hdrlen = ieee80211_padded_hdrlen(hw, mgmt->frame_control); + mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + err = ieee80211_wep_encrypt(local, skb, hdrlen, key, + key_len, key_idx); diff --git a/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch b/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch new file mode 100644 index 0000000000..8590aadabe --- /dev/null +++ b/package/kernel/mac80211/patches/308-ath10k-Fix-sending-NULL-Qos-NULL-data-frames-for-QCA.patch @@ -0,0 +1,72 @@ +From: Mohammed Shafi Shajakhan +Date: Thu, 23 Jun 2016 22:10:01 +0530 +Subject: [PATCH] ath10k: Fix sending NULL/ Qos NULL data frames for + QCA99X0 and later + +For chipsets like QCA99X0, IPQ4019 and later we are not getting proper +NULL func status (always acked/successs !!) when hostapd does a +PROBE_CLIENT via nullfunc frames when the station is powered off +abruptly (inactive timer probes client via null func after the inactive +time reaches beyond the threshold). Fix this by disabling the workaround +(getting the ACK status of NULL func frames by sending via HTT mgmt-tx + path) introduced by the change ("ath10k: fix beacon loss handling ") +for QCA99X0 and later chipsets. The normal tx path provides the proper +ACK status for NULL data frames. As of now disable this workaround for +chipsets QCA99X0 and later, once the 10.1 firmware is obselete we can +completely get rid of this workaround for all the chipsets + +Signed-off-by: Tamizh chelvam +Signed-off-by: Mohammed Shafi Shajakhan +--- + +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -181,6 +181,7 @@ static const struct ath10k_hw_params ath + .board = QCA99X0_HW_2_0_BOARD_DATA_FILE, + .board_size = QCA99X0_BOARD_DATA_SZ, + .board_ext_size = QCA99X0_BOARD_EXT_DATA_SZ, ++ .disable_null_func_workaround = true, + }, + }, + { +@@ -204,6 +205,7 @@ static const struct ath10k_hw_params ath + .board = QCA9984_HW_1_0_BOARD_DATA_FILE, + .board_size = QCA99X0_BOARD_DATA_SZ, + .board_ext_size = QCA99X0_BOARD_EXT_DATA_SZ, ++ .disable_null_func_workaround = true, + }, + }, + { +@@ -262,6 +264,7 @@ static const struct ath10k_hw_params ath + .board = QCA4019_HW_1_0_BOARD_DATA_FILE, + .board_size = QCA4019_BOARD_DATA_SZ, + .board_ext_size = QCA4019_BOARD_EXT_DATA_SZ, ++ .disable_null_func_workaround = true, + }, + }, + }; +--- a/drivers/net/wireless/ath/ath10k/core.h ++++ b/drivers/net/wireless/ath/ath10k/core.h +@@ -750,6 +750,12 @@ struct ath10k { + const char *board; + size_t board_size; + size_t board_ext_size; ++ /* Workaround of sending NULL data frames via ++ * HTT mgmt TX and getting the proper ACK status does ++ * not works for chipsets QCA99X0 and later, while ++ * Tx data path reports the ACK status properly. ++ */ ++ bool disable_null_func_workaround; + } fw; + } hw_params; + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3253,6 +3253,7 @@ ath10k_mac_tx_h_get_txmode(struct ath10k + * mode though because AP don't sleep. + */ + if (ar->htt.target_version_major < 3 && ++ !ar->hw_params.fw.disable_null_func_workaround && + (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && + !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX, + ar->running_fw->fw_file.fw_features)) diff --git a/package/kernel/mac80211/patches/308-ath10k-remove-duplicate-and-unused-rx-rate-flags.patch b/package/kernel/mac80211/patches/308-ath10k-remove-duplicate-and-unused-rx-rate-flags.patch deleted file mode 100644 index 7c5c5bef7a..0000000000 --- a/package/kernel/mac80211/patches/308-ath10k-remove-duplicate-and-unused-rx-rate-flags.patch +++ /dev/null @@ -1,66 +0,0 @@ -From: Mohammed Shafi Shajakhan -Date: Thu, 2 Jun 2016 19:54:41 +0530 -Subject: [PATCH] ath10k: remove duplicate and unused rx rate flags - -All these flags are not used and their use is completely -covered by 'ath10k_hw_rate_ofdm', 'ath10k_hw_rate_cck', -and RX_PPDU_START_RATE_FLAG - -Signed-off-by: Mohammed Shafi Shajakhan ---- - ---- a/drivers/net/wireless/ath/ath10k/rx_desc.h -+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h -@@ -656,26 +656,6 @@ struct rx_msdu_end { - * Reserved: HW should fill with zero. FW should ignore. - */ - --#define RX_PPDU_START_SIG_RATE_SELECT_OFDM 0 --#define RX_PPDU_START_SIG_RATE_SELECT_CCK 1 -- --#define RX_PPDU_START_SIG_RATE_OFDM_48 0 --#define RX_PPDU_START_SIG_RATE_OFDM_24 1 --#define RX_PPDU_START_SIG_RATE_OFDM_12 2 --#define RX_PPDU_START_SIG_RATE_OFDM_6 3 --#define RX_PPDU_START_SIG_RATE_OFDM_54 4 --#define RX_PPDU_START_SIG_RATE_OFDM_36 5 --#define RX_PPDU_START_SIG_RATE_OFDM_18 6 --#define RX_PPDU_START_SIG_RATE_OFDM_9 7 -- --#define RX_PPDU_START_SIG_RATE_CCK_LP_11 0 --#define RX_PPDU_START_SIG_RATE_CCK_LP_5_5 1 --#define RX_PPDU_START_SIG_RATE_CCK_LP_2 2 --#define RX_PPDU_START_SIG_RATE_CCK_LP_1 3 --#define RX_PPDU_START_SIG_RATE_CCK_SP_11 4 --#define RX_PPDU_START_SIG_RATE_CCK_SP_5_5 5 --#define RX_PPDU_START_SIG_RATE_CCK_SP_2 6 -- - #define HTT_RX_PPDU_START_PREAMBLE_LEGACY 0x04 - #define HTT_RX_PPDU_START_PREAMBLE_HT 0x08 - #define HTT_RX_PPDU_START_PREAMBLE_HT_WITH_TXBF 0x09 -@@ -711,25 +691,6 @@ struct rx_msdu_end { - /* No idea what this flag means. It seems to be always set in rate. */ - #define RX_PPDU_START_RATE_FLAG BIT(3) - --enum rx_ppdu_start_rate { -- RX_PPDU_START_RATE_OFDM_48M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_48M, -- RX_PPDU_START_RATE_OFDM_24M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_24M, -- RX_PPDU_START_RATE_OFDM_12M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_12M, -- RX_PPDU_START_RATE_OFDM_6M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_6M, -- RX_PPDU_START_RATE_OFDM_54M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_54M, -- RX_PPDU_START_RATE_OFDM_36M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_36M, -- RX_PPDU_START_RATE_OFDM_18M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_18M, -- RX_PPDU_START_RATE_OFDM_9M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_OFDM_9M, -- -- RX_PPDU_START_RATE_CCK_LP_11M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_LP_11M, -- RX_PPDU_START_RATE_CCK_LP_5_5M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_LP_5_5M, -- RX_PPDU_START_RATE_CCK_LP_2M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_LP_2M, -- RX_PPDU_START_RATE_CCK_LP_1M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_LP_1M, -- RX_PPDU_START_RATE_CCK_SP_11M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_SP_11M, -- RX_PPDU_START_RATE_CCK_SP_5_5M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_SP_5_5M, -- RX_PPDU_START_RATE_CCK_SP_2M = RX_PPDU_START_RATE_FLAG | ATH10K_HW_RATE_CCK_SP_2M, --}; -- - struct rx_ppdu_start { - struct { - u8 pri20_mhz; diff --git a/package/kernel/mac80211/patches/309-ath10k-fix-CCK-h-w-rates-for-QCA99X0-and-newer-chips.patch b/package/kernel/mac80211/patches/309-ath10k-fix-CCK-h-w-rates-for-QCA99X0-and-newer-chips.patch deleted file mode 100644 index 50ebfcef04..0000000000 --- a/package/kernel/mac80211/patches/309-ath10k-fix-CCK-h-w-rates-for-QCA99X0-and-newer-chips.patch +++ /dev/null @@ -1,141 +0,0 @@ -From: Mohammed Shafi Shajakhan -Date: Thu, 2 Jun 2016 19:54:42 +0530 -Subject: [PATCH] ath10k: fix CCK h/w rates for QCA99X0 and newer chipsets - -CCK hardware table mapping from QCA99X0 onwards got revised. -The CCK hardware rate values are in a proper order wrt. to -rate and preamble as below - -ATH10K_HW_RATE_REV2_CCK_LP_1M = 1, -ATH10K_HW_RATE_REV2_CCK_LP_2M = 2, -ATH10K_HW_RATE_REV2_CCK_LP_5_5M = 3, -ATH10K_HW_RATE_REV2_CCK_LP_11M = 4, -ATH10K_HW_RATE_REV2_CCK_SP_2M = 5, -ATH10K_HW_RATE_REV2_CCK_SP_5_5M = 6, -ATH10K_HW_RATE_REV2_CCK_SP_11M = 7, - -This results in reporting of rx frames (with CCK rates) -totally wrong for QCA99X0, QCA4019. Fix this by having -separate CCK rate table for these chipsets with rev2 suffix -and registering the correct rate mapping to mac80211 based on -the new hw_param (introduced) 'cck_rate_map_rev2' which shall -be true for any newchipsets from QCA99X0 onwards - -Signed-off-by: Mohammed Shafi Shajakhan ---- - ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -148,6 +148,8 @@ static const struct ath10k_hw_params ath - .uart_pin = 7, - .otp_exe_param = 0x00000700, - .continuous_frag_desc = true, -+ .cck_rate_map_rev2 = true, -+ .cck_rate_map_rev2 = true, - .channel_counters_freq_hz = 150000, - .max_probe_resp_desc_thres = 24, - .hw_4addr_pad = ATH10K_HW_4ADDR_PAD_BEFORE, -@@ -205,6 +207,7 @@ static const struct ath10k_hw_params ath - .has_shifted_cc_wraparound = true, - .otp_exe_param = 0x0010000, - .continuous_frag_desc = true, -+ .cck_rate_map_rev2 = true, - .channel_counters_freq_hz = 125000, - .max_probe_resp_desc_thres = 24, - .hw_4addr_pad = ATH10K_HW_4ADDR_PAD_BEFORE, ---- a/drivers/net/wireless/ath/ath10k/core.h -+++ b/drivers/net/wireless/ath/ath10k/core.h -@@ -716,6 +716,12 @@ struct ath10k { - */ - bool continuous_frag_desc; - -+ /* CCK hardware rate table mapping for the newer chipsets -+ * like QCA99X0, QCA4019 got revised. The CCK h/w rate values -+ * are in a proper order with respect to the rate/preamble -+ */ -+ bool cck_rate_map_rev2; -+ - u32 channel_counters_freq_hz; - - /* Mgmt tx descriptors threshold for limiting probe response ---- a/drivers/net/wireless/ath/ath10k/hw.h -+++ b/drivers/net/wireless/ath/ath10k/hw.h -@@ -315,6 +315,16 @@ enum ath10k_hw_rate_cck { - ATH10K_HW_RATE_CCK_SP_2M, - }; - -+enum ath10k_hw_rate_rev2_cck { -+ ATH10K_HW_RATE_REV2_CCK_LP_1M = 1, -+ ATH10K_HW_RATE_REV2_CCK_LP_2M, -+ ATH10K_HW_RATE_REV2_CCK_LP_5_5M, -+ ATH10K_HW_RATE_REV2_CCK_LP_11M, -+ ATH10K_HW_RATE_REV2_CCK_SP_2M, -+ ATH10K_HW_RATE_REV2_CCK_SP_5_5M, -+ ATH10K_HW_RATE_REV2_CCK_SP_11M, -+}; -+ - enum ath10k_hw_4addr_pad { - ATH10K_HW_4ADDR_PAD_AFTER, - ATH10K_HW_4ADDR_PAD_BEFORE, ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -62,6 +62,32 @@ static struct ieee80211_rate ath10k_rate - { .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M }, - }; - -+static struct ieee80211_rate ath10k_rates_rev2[] = { -+ { .bitrate = 10, -+ .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_1M }, -+ { .bitrate = 20, -+ .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_2M, -+ .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_2M, -+ .flags = IEEE80211_RATE_SHORT_PREAMBLE }, -+ { .bitrate = 55, -+ .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_5_5M, -+ .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_5_5M, -+ .flags = IEEE80211_RATE_SHORT_PREAMBLE }, -+ { .bitrate = 110, -+ .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_11M, -+ .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_11M, -+ .flags = IEEE80211_RATE_SHORT_PREAMBLE }, -+ -+ { .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M }, -+ { .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M }, -+ { .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M }, -+ { .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M }, -+ { .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M }, -+ { .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M }, -+ { .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M }, -+ { .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M }, -+}; -+ - #define ATH10K_MAC_FIRST_OFDM_RATE_IDX 4 - - #define ath10k_a_rates (ath10k_rates + ATH10K_MAC_FIRST_OFDM_RATE_IDX) -@@ -70,6 +96,9 @@ static struct ieee80211_rate ath10k_rate - #define ath10k_g_rates (ath10k_rates + 0) - #define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates)) - -+#define ath10k_g_rates_rev2 (ath10k_rates_rev2 + 0) -+#define ath10k_g_rates_rev2_size (ARRAY_SIZE(ath10k_rates_rev2)) -+ - static bool ath10k_mac_bitrate_is_cck(int bitrate) - { - switch (bitrate) { -@@ -7720,8 +7749,14 @@ int ath10k_mac_register(struct ath10k *a - band = &ar->mac.sbands[NL80211_BAND_2GHZ]; - band->n_channels = ARRAY_SIZE(ath10k_2ghz_channels); - band->channels = channels; -- band->n_bitrates = ath10k_g_rates_size; -- band->bitrates = ath10k_g_rates; -+ -+ if (ar->hw_params.cck_rate_map_rev2) { -+ band->n_bitrates = ath10k_g_rates_rev2_size; -+ band->bitrates = ath10k_g_rates_rev2; -+ } else { -+ band->n_bitrates = ath10k_g_rates_size; -+ band->bitrates = ath10k_g_rates; -+ } - - ar->hw->wiphy->bands[NL80211_BAND_2GHZ] = band; - } diff --git a/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch b/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch new file mode 100644 index 0000000000..41c27cac41 --- /dev/null +++ b/package/kernel/mac80211/patches/309-cfg80211-fix-proto-in-ieee80211_data_to_8023-for-fra.patch @@ -0,0 +1,37 @@ +From: Felix Fietkau +Date: Wed, 29 Jun 2016 10:02:32 +0200 +Subject: [PATCH] cfg80211: fix proto in ieee80211_data_to_8023 for frames + without LLC header + +The PDU length of incoming LLC frames is set to the total skb payload size +in __ieee80211_data_to_8023() of net/wireless/util.c which incorrectly +includes the length of the IEEE 802.11 header. + +The resulting LLC frame header has a too large PDU length, causing the +llc_fixup_skb() function of net/llc/llc_input.c to reject the incoming +skb, effectively breaking STP. + +Solve the problem by properly substracting the IEEE 802.11 frame header size +from the PDU length, allowing the LLC processor to pick up the incoming +control messages. + +Special thanks to Gerry Rozema for tracking down the regression and proposing +a suitable patch. + +Fixes: 2d1c304cb2d5 ("cfg80211: add function for 802.3 conversion with separate output buffer") +Cc: stable@vger.kernel.org +Reported-by: Gerry Rozema +Signed-off-by: Felix Fietkau +--- + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(stru + * replace EtherType */ + hdrlen += ETH_ALEN + 2; + else +- tmp.h_proto = htons(skb->len); ++ tmp.h_proto = htons(skb->len - hdrlen); + + pskb_pull(skb, hdrlen); + diff --git a/package/kernel/mac80211/patches/310-ath10k-improve-tx-scheduling.patch b/package/kernel/mac80211/patches/310-ath10k-improve-tx-scheduling.patch deleted file mode 100644 index 81ac2db842..0000000000 --- a/package/kernel/mac80211/patches/310-ath10k-improve-tx-scheduling.patch +++ /dev/null @@ -1,67 +0,0 @@ -From: Michal Kazior -Date: Mon, 23 May 2016 23:12:45 +0300 -Subject: [PATCH] ath10k: improve tx scheduling - -Recent changes revolving around implementing -wake_tx_queue support introduced a significant -performance regressions on some (slower, uni-proc) -systems. - -Signed-off-by: Michal Kazior -Signed-off-by: Kalle Valo ---- - ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -2291,7 +2291,6 @@ bool ath10k_htt_t2h_msg_handler(struct a - ath10k_htt_tx_mgmt_dec_pending(htt); - spin_unlock_bh(&htt->tx_lock); - } -- ath10k_mac_tx_push_pending(ar); - break; - } - case HTT_T2H_MSG_TYPE_TX_COMPL_IND: -@@ -2442,8 +2441,6 @@ static void ath10k_htt_txrx_compl_task(u - dev_kfree_skb_any(skb); - } - -- ath10k_mac_tx_push_pending(ar); -- - num_mpdus = atomic_read(&htt->num_mpdus_ready); - - while (num_mpdus) { ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -3827,6 +3827,9 @@ void ath10k_mac_tx_push_pending(struct a - int ret; - int max; - -+ if (ar->htt.num_pending_tx >= (ar->htt.max_num_pending_tx / 2)) -+ return; -+ - spin_lock_bh(&ar->txqs_lock); - rcu_read_lock(); - -@@ -4097,9 +4100,7 @@ static void ath10k_mac_op_wake_tx_queue( - list_add_tail(&artxq->list, &ar->txqs); - spin_unlock_bh(&ar->txqs_lock); - -- if (ath10k_mac_tx_can_push(hw, txq)) -- tasklet_schedule(&ar->htt.txrx_compl_task); -- -+ ath10k_mac_tx_push_pending(ar); - ath10k_htt_tx_txq_update(hw, txq); - } - ---- a/drivers/net/wireless/ath/ath10k/txrx.c -+++ b/drivers/net/wireless/ath/ath10k/txrx.c -@@ -117,6 +117,9 @@ int ath10k_txrx_tx_unref(struct ath10k_h - - ieee80211_tx_status(htt->ar->hw, msdu); - /* we do not own the msdu anymore */ -+ -+ ath10k_mac_tx_push_pending(ar); -+ - return 0; - } - diff --git a/package/kernel/mac80211/patches/311-ath10k-fix-deadlock-while-processing-rx_in_ord_ind.patch b/package/kernel/mac80211/patches/311-ath10k-fix-deadlock-while-processing-rx_in_ord_ind.patch deleted file mode 100644 index 3664d70984..0000000000 --- a/package/kernel/mac80211/patches/311-ath10k-fix-deadlock-while-processing-rx_in_ord_ind.patch +++ /dev/null @@ -1,59 +0,0 @@ -From: Rajkumar Manoharan -Date: Thu, 9 Jun 2016 11:33:55 +0530 -Subject: [PATCH] ath10k: fix deadlock while processing rx_in_ord_ind - -commit 5c86d97bcc1d ("ath10k: combine txrx and replenish task") -introduced deadlock while processing rx in order indication message -for qca6174 based devices. While merging replenish and txrx tasklets, -replenish task should be called out of htt rx ring locking since it -is also try to acquire the same lock. - -Unfortunately this issue is not exposed by other solutions (qca988x, -qca99x0 & qca4019), as rx_in_ord_ind message is specific to qca6174 -based devices. This patch fixes - -============================================= -[ INFO: possible recursive locking detected ] -4.7.0-rc2-wt-ath+ #1353 Tainted: G E ---------------------------------------------- -swapper/3/0 is trying to acquire lock: - (&(&htt->rx_ring.lock)->rlock){+.-...}, at: [] -ath10k_htt_rx_msdu_buff_replenish+0x29/0x90 [ath10k_core] - -but task is already holding lock: - (&(&htt->rx_ring.lock)->rlock){+.-...}, at: [] -ath10k_htt_txrx_compl_task+0x21b/0x250 [ath10k_core] - -other info that might help us debug this: - Possible unsafe locking scenario: - - CPU0 - ---- - lock(&(&htt->rx_ring.lock)->rlock); - lock(&(&htt->rx_ring.lock)->rlock); - - *** DEADLOCK *** - - May be due to missing lock nesting notation - -1 lock held by swapper/3/0: - #0: (&(&htt->rx_ring.lock)->rlock){+.-...}, at: [] -ath10k_htt_txrx_compl_task+0x21b/0x250 [ath10k_core] - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=119151 -Fixes: 5c86d97bcc1d ("ath10k: combine txrx and replenish task") -Reported-by: Mike Lothian -Signed-off-by: Rajkumar Manoharan -Signed-off-by: Kalle Valo ---- - ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -1904,7 +1904,6 @@ static void ath10k_htt_rx_in_ord_ind(str - return; - } - } -- ath10k_htt_rx_msdu_buff_replenish(htt); - } - - static void ath10k_htt_rx_tx_fetch_resp_id_confirm(struct ath10k *ar, diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch index 28f5dcca90..c40598dde6 100644 --- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch +++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch @@ -1,6 +1,6 @@ --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h -@@ -2406,6 +2406,7 @@ struct cfg80211_qos_map { +@@ -2410,6 +2410,7 @@ struct cfg80211_qos_map { * (as advertised by the nl80211 feature flag.) * @get_tx_power: store the current TX power into the dbm variable; * return 0 if successful @@ -8,7 +8,7 @@ * * @set_wds_peer: set the WDS peer for a WDS interface * -@@ -2667,6 +2668,7 @@ struct cfg80211_ops { +@@ -2671,6 +2672,7 @@ struct cfg80211_ops { enum nl80211_tx_power_setting type, int mbm); int (*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev, int *dbm); @@ -18,7 +18,7 @@ const u8 *addr); --- a/include/net/mac80211.h +++ b/include/net/mac80211.h -@@ -1305,6 +1305,7 @@ enum ieee80211_smps_mode { +@@ -1317,6 +1317,7 @@ enum ieee80211_smps_mode { * * @power_level: requested transmit power (in dBm), backward compatibility * value only that is set to the minimum of all interfaces @@ -26,7 +26,7 @@ * * @chandef: the channel definition to tune to * @radar_enabled: whether radar detection is enabled -@@ -1325,6 +1326,7 @@ enum ieee80211_smps_mode { +@@ -1337,6 +1338,7 @@ enum ieee80211_smps_mode { struct ieee80211_conf { u32 flags; int power_level, dynamic_ps_timeout; @@ -36,9 +36,9 @@ u8 ps_dtim_period; --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h -@@ -1819,6 +1819,9 @@ enum nl80211_commands { - * - * @NL80211_ATTR_PAD: attribute used for padding for 64-bit alignment +@@ -1829,6 +1829,9 @@ enum nl80211_commands { + * %NL80211_ATTR_EXT_CAPA_MASK, to specify the extended capabilities per + * interface type. * + * @NL80211_ATTR_WIPHY_ANTENNA_GAIN: Configured antenna gain. Used to reduce + * transmit power to stay within regulatory limits. u32, dBi. @@ -46,9 +46,9 @@ * @NUM_NL80211_ATTR: total number of nl80211_attrs available * @NL80211_ATTR_MAX: highest attribute number currently defined * @__NL80211_ATTR_AFTER_LAST: internal use -@@ -2201,6 +2204,8 @@ enum nl80211_attrs { +@@ -2213,6 +2216,8 @@ enum nl80211_attrs { - NL80211_ATTR_PAD, + NL80211_ATTR_IFTYPE_EXT_CAPA, + NL80211_ATTR_WIPHY_ANTENNA_GAIN, + @@ -87,7 +87,7 @@ CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd) --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h -@@ -1322,6 +1322,7 @@ struct ieee80211_local { +@@ -1338,6 +1338,7 @@ struct ieee80211_local { int dynamic_ps_forced_timeout; int user_power_level; /* in dBm, for all interfaces */ @@ -129,7 +129,7 @@ local->user_power_level = IEEE80211_UNSET_POWER_LEVEL; --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c -@@ -406,6 +406,7 @@ static const struct nla_policy nl80211_p +@@ -407,6 +407,7 @@ static const struct nla_policy nl80211_p [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 }, @@ -137,7 +137,7 @@ }; /* policy for the key attributes */ -@@ -2251,6 +2252,20 @@ static int nl80211_set_wiphy(struct sk_b +@@ -2294,6 +2295,20 @@ static int nl80211_set_wiphy(struct sk_b if (result) return result; } diff --git a/package/kernel/mac80211/patches/533-mac80211_correct_4addr_skbsize.patch b/package/kernel/mac80211/patches/533-mac80211_correct_4addr_skbsize.patch deleted file mode 100644 index afd8cca0f2..0000000000 --- a/package/kernel/mac80211/patches/533-mac80211_correct_4addr_skbsize.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(stru - * replace EtherType */ - hdrlen += ETH_ALEN + 2; - else -- tmp.h_proto = htons(skb->len); -+ tmp.h_proto = htons(skb->len - hdrlen); - - pskb_pull(skb, hdrlen); - diff --git a/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch b/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch index 3c5e9f5fcd..c2d2781559 100644 --- a/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch +++ b/package/kernel/mac80211/patches/541-ath9k_rx_dma_stop_check.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath9k/mac.c +++ b/drivers/net/wireless/ath/ath9k/mac.c -@@ -695,7 +695,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw +@@ -698,7 +698,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw { #define AH_RX_STOP_DMA_TIMEOUT 10000 /* usec */ struct ath_common *common = ath9k_hw_common(ah); @@ -9,7 +9,7 @@ int i; /* Enable access to the DMA observation bus */ -@@ -725,6 +725,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw +@@ -728,6 +728,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw } if (i == 0) { diff --git a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch index b60ef76a65..f8f555f3e6 100644 --- a/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch +++ b/package/kernel/mac80211/patches/820-b43-add-antenna-control.patch @@ -9,7 +9,7 @@ antenna = b43_antenna_to_phyctl(antenna); ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL); /* We can't send beacons with short preamble. Would get PHY errors. */ -@@ -3300,8 +3300,8 @@ static int b43_chip_init(struct b43_wlde +@@ -3297,8 +3297,8 @@ static int b43_chip_init(struct b43_wlde /* Select the antennae */ if (phy->ops->set_rx_antenna) @@ -20,7 +20,7 @@ if (phy->type == B43_PHYTYPE_B) { value16 = b43_read16(dev, 0x005E); -@@ -4001,7 +4001,6 @@ static int b43_op_config(struct ieee8021 +@@ -3998,7 +3998,6 @@ static int b43_op_config(struct ieee8021 struct b43_wldev *dev = wl->current_dev; struct b43_phy *phy = &dev->phy; struct ieee80211_conf *conf = &hw->conf; @@ -28,7 +28,7 @@ int err = 0; mutex_lock(&wl->mutex); -@@ -4044,11 +4043,9 @@ static int b43_op_config(struct ieee8021 +@@ -4041,11 +4040,9 @@ static int b43_op_config(struct ieee8021 } /* Antennas for RX and management frame TX. */ @@ -42,7 +42,7 @@ if (wl->radio_enabled != phy->radio_on) { if (wl->radio_enabled) { -@@ -5207,6 +5204,47 @@ static int b43_op_get_survey(struct ieee +@@ -5189,6 +5186,47 @@ static int b43_op_get_survey(struct ieee return 0; } @@ -90,7 +90,7 @@ static const struct ieee80211_ops b43_hw_ops = { .tx = b43_op_tx, .conf_tx = b43_op_conf_tx, -@@ -5228,6 +5266,8 @@ static const struct ieee80211_ops b43_hw +@@ -5210,6 +5248,8 @@ static const struct ieee80211_ops b43_hw .sw_scan_complete = b43_op_sw_scan_complete_notifier, .get_survey = b43_op_get_survey, .rfkill_poll = b43_rfkill_poll, @@ -99,7 +99,7 @@ }; /* Hard-reset the chip. Do not call this directly. -@@ -5536,6 +5576,8 @@ static int b43_one_core_attach(struct b4 +@@ -5513,6 +5553,8 @@ static int b43_one_core_attach(struct b4 if (!wldev) goto out; @@ -108,7 +108,7 @@ wldev->use_pio = b43_modparam_pio; wldev->dev = dev; wldev->wl = wl; -@@ -5626,6 +5668,9 @@ static struct b43_wl *b43_wireless_init( +@@ -5603,6 +5645,9 @@ static struct b43_wl *b43_wireless_init( hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN; diff --git a/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch b/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch deleted file mode 100644 index 46227c48dd..0000000000 --- a/package/kernel/mac80211/patches/860-brcmfmac-add-missing-eth_type_trans-call.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= -Subject: [PATCH] brcmfmac: add missing eth_type_trans call -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -There are 2 protocols supported by brcmfmac and msgbuf one was missing a -proper skb setup before passing it to the netif. This was triggering -"NULL pointer dereference". - -Fixes: 9c349892ccc9 ("brcmfmac: revise handling events in receive path") -Signed-off-by: Rafał Miłecki ---- - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c -@@ -1157,6 +1157,9 @@ brcmf_msgbuf_process_rx_complete(struct - brcmu_pkt_buf_free_skb(skb); - return; - } -+ -+ skb->protocol = eth_type_trans(skb, ifp->ndev); -+ - brcmf_netif_rx(ifp, skb); - } - diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch new file mode 100644 index 0000000000..0bfaae6a1b --- /dev/null +++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch @@ -0,0 +1,97 @@ +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Mon, 8 Jun 2015 16:11:40 +0200 +Subject: [PATCH] brcmfmac: register wiphy(s) during module_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This is needed by OpenWrt which expects all PHYs to be created after +module loads successfully. + +Signed-off-by: Rafał Miłecki +--- + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1208,6 +1208,7 @@ int __init brcmf_core_init(void) + { + if (!schedule_work(&brcmf_driver_work)) + return -EBUSY; ++ flush_work(&brcmf_driver_work); + + return 0; + } +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -444,6 +444,7 @@ struct brcmf_fw { + u16 bus_nr; + void (*done)(struct device *dev, const struct firmware *fw, + void *nvram_image, u32 nvram_len); ++ struct completion *completion; + }; + + static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx) +@@ -478,6 +479,8 @@ static void brcmf_fw_request_nvram_done( + goto fail; + + fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length); ++ if (fwctx->completion) ++ complete(fwctx->completion); + kfree(fwctx); + return; + +@@ -485,6 +488,8 @@ fail: + brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); + release_firmware(fwctx->code); + device_release_driver(fwctx->dev); ++ if (fwctx->completion) ++ complete(fwctx->completion); + kfree(fwctx); + } + +@@ -500,6 +505,8 @@ static void brcmf_fw_request_code_done(c + /* only requested code so done here */ + if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) { + fwctx->done(fwctx->dev, fw, NULL, 0); ++ if (fwctx->completion) ++ complete(fwctx->completion); + kfree(fwctx); + return; + } +@@ -517,6 +524,8 @@ static void brcmf_fw_request_code_done(c + fail: + brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); + device_release_driver(fwctx->dev); ++ if (fwctx->completion) ++ complete(fwctx->completion); + kfree(fwctx); + } + +@@ -528,6 +537,8 @@ int brcmf_fw_get_firmwares_pcie(struct d + u16 domain_nr, u16 bus_nr) + { + struct brcmf_fw *fwctx; ++ struct completion completion; ++ int err; + + brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev)); + if (!fw_cb || !code) +@@ -548,9 +559,17 @@ int brcmf_fw_get_firmwares_pcie(struct d + fwctx->domain_nr = domain_nr; + fwctx->bus_nr = bus_nr; + +- return request_firmware_nowait(THIS_MODULE, true, code, dev, ++ init_completion(&completion); ++ fwctx->completion = &completion; ++ ++ err = request_firmware_nowait(THIS_MODULE, true, code, dev, + GFP_KERNEL, fwctx, + brcmf_fw_request_code_done); ++ if (!err) ++ wait_for_completion_timeout(fwctx->completion, ++ msecs_to_jiffies(5000)); ++ fwctx->completion = NULL; ++ return err; + } + + int brcmf_fw_get_firmwares(struct device *dev, u16 flags, diff --git a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch deleted file mode 100644 index 8cf9ea28f5..0000000000 --- a/package/kernel/mac80211/patches/861-brcmfmac-register-wiphy-s-during-module_init.patch +++ /dev/null @@ -1,97 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= -Date: Mon, 8 Jun 2015 16:11:40 +0200 -Subject: [PATCH] brcmfmac: register wiphy(s) during module_init -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is needed by OpenWrt which expects all PHYs to be created after -module loads successfully. - -Signed-off-by: Rafał Miłecki ---- - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1232,6 +1232,7 @@ int __init brcmf_core_init(void) - { - if (!schedule_work(&brcmf_driver_work)) - return -EBUSY; -+ flush_work(&brcmf_driver_work); - - return 0; - } ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c -@@ -444,6 +444,7 @@ struct brcmf_fw { - u16 bus_nr; - void (*done)(struct device *dev, const struct firmware *fw, - void *nvram_image, u32 nvram_len); -+ struct completion *completion; - }; - - static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx) -@@ -478,6 +479,8 @@ static void brcmf_fw_request_nvram_done( - goto fail; - - fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length); -+ if (fwctx->completion) -+ complete(fwctx->completion); - kfree(fwctx); - return; - -@@ -485,6 +488,8 @@ fail: - brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); - release_firmware(fwctx->code); - device_release_driver(fwctx->dev); -+ if (fwctx->completion) -+ complete(fwctx->completion); - kfree(fwctx); - } - -@@ -500,6 +505,8 @@ static void brcmf_fw_request_code_done(c - /* only requested code so done here */ - if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) { - fwctx->done(fwctx->dev, fw, NULL, 0); -+ if (fwctx->completion) -+ complete(fwctx->completion); - kfree(fwctx); - return; - } -@@ -517,6 +524,8 @@ static void brcmf_fw_request_code_done(c - fail: - brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev)); - device_release_driver(fwctx->dev); -+ if (fwctx->completion) -+ complete(fwctx->completion); - kfree(fwctx); - } - -@@ -528,6 +537,8 @@ int brcmf_fw_get_firmwares_pcie(struct d - u16 domain_nr, u16 bus_nr) - { - struct brcmf_fw *fwctx; -+ struct completion completion; -+ int err; - - brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev)); - if (!fw_cb || !code) -@@ -548,9 +559,17 @@ int brcmf_fw_get_firmwares_pcie(struct d - fwctx->domain_nr = domain_nr; - fwctx->bus_nr = bus_nr; - -- return request_firmware_nowait(THIS_MODULE, true, code, dev, -+ init_completion(&completion); -+ fwctx->completion = &completion; -+ -+ err = request_firmware_nowait(THIS_MODULE, true, code, dev, - GFP_KERNEL, fwctx, - brcmf_fw_request_code_done); -+ if (!err) -+ wait_for_completion_timeout(fwctx->completion, -+ msecs_to_jiffies(5000)); -+ fwctx->completion = NULL; -+ return err; - } - - int brcmf_fw_get_firmwares(struct device *dev, u16 flags, diff --git a/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch new file mode 100644 index 0000000000..87211550f7 --- /dev/null +++ b/package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch @@ -0,0 +1,50 @@ +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Thu, 9 Jul 2015 00:07:59 +0200 +Subject: [PATCH] brcmfmac: workaround bug with some inconsistent BSSes state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Rafał Miłecki +--- + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -665,9 +665,37 @@ static struct wireless_dev *brcmf_cfg802 + u32 *flags, + struct vif_params *params) + { ++ struct net_device *dev; + struct wireless_dev *wdev; + int err; + ++ /* ++ * There is a bug with in-firmware BSS management. When adding virtual ++ * interface brcmfmac first tells firmware to create new BSS and then ++ * it creates new struct net_device. ++ * ++ * If creating/registering netdev(ice) fails, BSS remains in some bugged ++ * state. It conflicts with existing BSSes by overtaking their auth ++ * requests. ++ * ++ * It results in one BSS (addresss X) sending beacons and another BSS ++ * (address Y) replying to authentication requests. This makes interface ++ * unusable as AP. ++ * ++ * To workaround this bug we may try to guess if register_netdev(ice) ++ * will fail. The most obvious case is using interface name that already ++ * exists. This is actually quite likely with brcmfmac & some user space ++ * scripts as brcmfmac doesn't allow deleting virtual interfaces. ++ * So this bug can be triggered even by something trivial like: ++ * iw dev wlan0 delete ++ * iw phy phy0 interface add wlan0 type __ap ++ */ ++ dev = dev_get_by_name(&init_net, name); ++ if (dev) { ++ dev_put(dev); ++ return ERR_PTR(-ENFILE); ++ } ++ + brcmf_dbg(TRACE, "enter: %s type %d\n", name, type); + err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type); + if (err) { diff --git a/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch new file mode 100644 index 0000000000..104438a951 --- /dev/null +++ b/package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch @@ -0,0 +1,27 @@ +From 66ae1b1750720a33e29792a177b1e696f4f005fb Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Wed, 9 Mar 2016 17:25:59 +0000 +Subject: [PATCH] brcmfmac: Disable power management + +Disable wireless power saving in the brcmfmac WLAN driver. This is a +temporary measure until the connectivity loss resulting from power +saving is resolved. + +Signed-off-by: Phil Elwell +--- + drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -2746,6 +2746,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip + * preference in cfg struct to apply this to + * FW later while initializing the dongle + */ ++#if defined(CONFIG_BCM2708) || defined(CONFIG_BCM2709) ++ pr_info("power management disabled\n"); ++ enabled = false; ++#endif + cfg->pwr_save = enabled; + if (!check_vif_up(ifp->vif)) { + diff --git a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch deleted file mode 100644 index 4f22a4e719..0000000000 --- a/package/kernel/mac80211/patches/862-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch +++ /dev/null @@ -1,50 +0,0 @@ -From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= -Date: Thu, 9 Jul 2015 00:07:59 +0200 -Subject: [PATCH] brcmfmac: workaround bug with some inconsistent BSSes state -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Rafał Miłecki ---- - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -650,9 +650,37 @@ static struct wireless_dev *brcmf_cfg802 - u32 *flags, - struct vif_params *params) - { -+ struct net_device *dev; - struct wireless_dev *wdev; - int err; - -+ /* -+ * There is a bug with in-firmware BSS management. When adding virtual -+ * interface brcmfmac first tells firmware to create new BSS and then -+ * it creates new struct net_device. -+ * -+ * If creating/registering netdev(ice) fails, BSS remains in some bugged -+ * state. It conflicts with existing BSSes by overtaking their auth -+ * requests. -+ * -+ * It results in one BSS (addresss X) sending beacons and another BSS -+ * (address Y) replying to authentication requests. This makes interface -+ * unusable as AP. -+ * -+ * To workaround this bug we may try to guess if register_netdev(ice) -+ * will fail. The most obvious case is using interface name that already -+ * exists. This is actually quite likely with brcmfmac & some user space -+ * scripts as brcmfmac doesn't allow deleting virtual interfaces. -+ * So this bug can be triggered even by something trivial like: -+ * iw dev wlan0 delete -+ * iw phy phy0 interface add wlan0 type __ap -+ */ -+ dev = dev_get_by_name(&init_net, name); -+ if (dev) { -+ dev_put(dev); -+ return ERR_PTR(-ENFILE); -+ } -+ - brcmf_dbg(TRACE, "enter: %s type %d\n", name, type); - err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type); - if (err) { diff --git a/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch deleted file mode 100644 index f971bb7f26..0000000000 --- a/package/kernel/mac80211/patches/863-brcmfmac-Disable-power-management.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 66ae1b1750720a33e29792a177b1e696f4f005fb Mon Sep 17 00:00:00 2001 -From: Phil Elwell -Date: Wed, 9 Mar 2016 17:25:59 +0000 -Subject: [PATCH] brcmfmac: Disable power management - -Disable wireless power saving in the brcmfmac WLAN driver. This is a -temporary measure until the connectivity loss resulting from power -saving is resolved. - -Signed-off-by: Phil Elwell ---- - drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -2711,6 +2711,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip - * preference in cfg struct to apply this to - * FW later while initializing the dongle - */ -+#if defined(CONFIG_BCM2708) || defined(CONFIG_BCM2709) -+ pr_info("power management disabled\n"); -+ enabled = false; -+#endif - cfg->pwr_save = enabled; - if (!check_vif_up(ifp->vif)) { - diff --git a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch index 9322b45568..e842d612b7 100644 --- a/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch +++ b/package/kernel/mac80211/patches/921-ath10k_init_devices_synchronously.patch @@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -2012,6 +2012,16 @@ int ath10k_core_register(struct ath10k * +@@ -2107,6 +2107,16 @@ int ath10k_core_register(struct ath10k * ar->chip_id = chip_id; queue_work(ar->workqueue, &ar->register_work); diff --git a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch index 1bfded01b0..3795f750a3 100644 --- a/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch +++ b/package/kernel/mac80211/patches/930-ath10k_add_tpt_led_trigger.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -7717,6 +7717,21 @@ struct ath10k_vif *ath10k_get_arvif(stru +@@ -7731,6 +7731,21 @@ struct ath10k_vif *ath10k_get_arvif(stru return arvif_iter.arvif; } @@ -22,7 +22,7 @@ int ath10k_mac_register(struct ath10k *ar) { static const u32 cipher_suites[] = { -@@ -7941,6 +7956,12 @@ int ath10k_mac_register(struct ath10k *a +@@ -7955,6 +7970,12 @@ int ath10k_mac_register(struct ath10k *a ar->hw->wiphy->cipher_suites = cipher_suites; ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites); diff --git a/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch b/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch index 7f51dd2dd6..e81e367d5b 100644 --- a/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch +++ b/package/kernel/mac80211/patches/936-ath10k_skip_otp_check.patch @@ -1,6 +1,6 @@ --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -1168,9 +1168,6 @@ static int ath10k_core_fetch_firmware_fi +@@ -1243,9 +1243,6 @@ static int ath10k_core_fetch_firmware_fi { int ret; @@ -10,7 +10,7 @@ ar->fw_api = 5; ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api); -@@ -1873,6 +1870,9 @@ static int ath10k_core_probe_fw(struct a +@@ -1968,6 +1965,9 @@ static int ath10k_core_probe_fw(struct a goto err_power_down; } @@ -20,7 +20,7 @@ ret = ath10k_core_fetch_firmware_files(ar); if (ret) { ath10k_err(ar, "could not fetch firmware files (%d)\n", ret); -@@ -1895,11 +1895,14 @@ static int ath10k_core_probe_fw(struct a +@@ -1990,11 +1990,14 @@ static int ath10k_core_probe_fw(struct a "could not load pre cal data: %d\n", ret); }