From: Rafał Miłecki Date: Sun, 16 Jun 2019 16:56:15 +0000 (+0200) Subject: mac80211: brcm: backport remaining brcmfmac 5.2 patches X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=8888cb725d492ad5cad5b59fc7117b006e1bba5a;p=openwrt%2Fstaging%2Fdangole.git mac80211: brcm: backport remaining brcmfmac 5.2 patches This improves FullMAC firmware compatibility, adds logging in case of firmware crash and *may* fix "Invalid packet id" errors. Signed-off-by: Rafał Miłecki --- diff --git a/package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch b/package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch new file mode 100644 index 0000000000..b0207d8e10 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch @@ -0,0 +1,70 @@ +From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 22 Apr 2019 22:41:23 +0200 +Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 + mini PCs + +The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor +and product_name DMI strings, without this patch brcmfmac will try to load: +"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which +is way too generic. + +The DMI strings on which we are matching are somewhat generic too, but +"To be filled by O.E.M." is less common then "Default string" and the +system-sku and bios-version strings are pretty unique. Beside the DMI +strings we also check the wifi-module chip-id and revision. I'm confident +that the combination of all this is unique. + +Both the T8 and T11 use the same wifi-module, this commit adds DMI +quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt . + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852 +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -31,6 +31,10 @@ struct brcmf_dmi_data { + + /* NOTE: Please keep all entries sorted alphabetically */ + ++static const struct brcmf_dmi_data acepc_t8_data = { ++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8" ++}; ++ + static const struct brcmf_dmi_data gpd_win_pocket_data = { + BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket" + }; +@@ -49,6 +53,28 @@ static const struct brcmf_dmi_data pov_t + + static const struct dmi_system_id dmi_platform_data[] = { + { ++ /* ACEPC T8 Cherry Trail Z8350 mini PC */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { ++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { + /* Match for the GPDwin which unfortunately uses somewhat + * generic dmi strings, which is why we test for 4 strings. + * Comparing against 23 other byt/cht boards, board_vendor diff --git a/package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch new file mode 100644 index 0000000000..c0a1fcd615 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch @@ -0,0 +1,32 @@ +From 99d94ef367af67f630b38c93ff46c5819b7d06b6 Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Thu, 25 Apr 2019 07:05:46 +0000 +Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware + device + +For PCIE wireless device with core revision less than 14, device may miss +PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending +mail box interrupt twice as a hardware workaround. + +Signed-off-by: Wright Feng +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -698,7 +698,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci + + brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data); + pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); +- pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); ++ ++ /* Send mailbox interrupt twice as a hardware workaround */ ++ core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2); ++ if (core->rev <= 13) ++ pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); + + return 0; + } diff --git a/package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch b/package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch new file mode 100644 index 0000000000..8c7e6a8b93 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch @@ -0,0 +1,30 @@ +From 324f1feb960c79a07df3acde89a119a5aa80cb10 Mon Sep 17 00:00:00 2001 +From: Kalle Valo +Date: Thu, 25 Apr 2019 20:08:31 +0300 +Subject: [PATCH] Revert "brcmfmac: send mailbox interrupt twice for specific + hardware device" + +This reverts commit 99d94ef367af67f630b38c93ff46c5819b7d06b6. I accidentally +applied this broken (failed to compile) patch due to a bug in my patchwork +script. + +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -698,11 +698,7 @@ brcmf_pcie_send_mb_data(struct brcmf_pci + + brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data); + pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); +- +- /* Send mailbox interrupt twice as a hardware workaround */ +- core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2); +- if (core->rev <= 13) +- pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); ++ pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); + + return 0; + } diff --git a/package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch new file mode 100644 index 0000000000..1fcf8c70c7 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch @@ -0,0 +1,39 @@ +From 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Fri, 26 Apr 2019 03:12:32 +0000 +Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware + device + +For PCIE wireless device with core revision less than 14, device may miss +PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending +mail box interrupt twice as a hardware workaround. + +Signed-off-by: Wright Feng +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -675,6 +675,7 @@ static int + brcmf_pcie_send_mb_data(struct brcmf_pciedev_info *devinfo, u32 htod_mb_data) + { + struct brcmf_pcie_shared_info *shared; ++ struct brcmf_core *core; + u32 addr; + u32 cur_htod_mb_data; + u32 i; +@@ -698,7 +699,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci + + brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data); + pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); +- pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); ++ ++ /* Send mailbox interrupt twice as a hardware workaround */ ++ core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2); ++ if (core->rev <= 13) ++ pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1); + + return 0; + } diff --git a/package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch b/package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch new file mode 100644 index 0000000000..b4d56c34bc --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch @@ -0,0 +1,50 @@ +From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 24 Apr 2019 12:52:18 +0300 +Subject: [PATCH] brcm80211: potential NULL dereference in + brcmf_cfg80211_vndr_cmds_dcmd_handler() + +If "ret_len" is negative then it could lead to a NULL dereference. + +The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative +then we don't allocate the "dcmd_buf" buffer. Then we pass "ret_len" to +brcmf_fil_cmd_data_set() where it is cast to a very high u32 value. +Most of the functions in that call tree check whether the buffer we pass +is NULL but there are at least a couple places which don't such as +brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd(). We memcpy() to and +from the buffer so it would result in a NULL dereference. + +The fix is to change the types so that "ret_len" can't be negative. (If +we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an +issue). + +Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c +@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd + struct brcmf_if *ifp; + const struct brcmf_vndr_dcmd_hdr *cmdhdr = data; + struct sk_buff *reply; +- int ret, payload, ret_len; ++ unsigned int payload, ret_len; + void *dcmd_buf = NULL, *wr_pointer; + u16 msglen, maxmsglen = PAGE_SIZE - 0x100; ++ int ret; + + if (len < sizeof(*cmdhdr)) { + brcmf_err("vendor command too short: %d\n", len); +@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd + brcmf_err("oversize return buffer %d\n", ret_len); + ret_len = BRCMF_DCMD_MAXLEN; + } +- payload = max(ret_len, len) + 1; ++ payload = max_t(unsigned int, ret_len, len) + 1; + dcmd_buf = vzalloc(payload); + if (NULL == dcmd_buf) + return -ENOMEM; diff --git a/package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch b/package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch new file mode 100644 index 0000000000..6702dd57b6 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch @@ -0,0 +1,49 @@ +From 2d91c8ad068a5cad4d9e7ece8dc811a697c7176a Mon Sep 17 00:00:00 2001 +From: Wright Feng +Date: Fri, 26 Apr 2019 03:41:46 +0000 +Subject: [PATCH] brcmfmac: set txflow request id from 1 to pktids array size + +Some PCIE firmwares drop txstatus if pktid is 0 and make packet held in +host side and never be released. If that packet type is 802.1x, the +pend_8021x_cnt value will be always greater than 0 and show "Timed out +waiting for no pending 802.1x packets" error message when sending key to +dongle every time. + +To be compatible with all firmwares, host should set txflow request id +from 1 instead of from 0. + +Signed-off-by: Wright Feng +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -375,7 +375,7 @@ brcmf_msgbuf_get_pktid(struct device *de + struct brcmf_msgbuf_pktid *pktid; + struct sk_buff *skb; + +- if (idx >= pktids->array_size) { ++ if (idx < 0 || idx >= pktids->array_size) { + brcmf_err("Invalid packet id %d (max %d)\n", idx, + pktids->array_size); + return NULL; +@@ -747,7 +747,7 @@ static void brcmf_msgbuf_txflow(struct b + tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr; + + tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST; +- tx_msghdr->msg.request_id = cpu_to_le32(pktid); ++ tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1); + tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid); + tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3; + tx_msghdr->flags |= (skb->priority & 0x07) << +@@ -884,7 +884,7 @@ brcmf_msgbuf_process_txstatus(struct brc + u16 flowid; + + tx_status = (struct msgbuf_tx_status *)buf; +- idx = le32_to_cpu(tx_status->msg.request_id); ++ idx = le32_to_cpu(tx_status->msg.request_id) - 1; + flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id); + flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART; + skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev, diff --git a/package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch b/package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch new file mode 100644 index 0000000000..ceb85055d5 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch @@ -0,0 +1,90 @@ +From 47dd82e3d25e85a7c7c4e4b0eac9d297d1e5e2d4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Sun, 28 Apr 2019 23:38:26 +0200 +Subject: [PATCH] brcmfmac: print firmware messages after a firmware crash +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Normally firmware messages are printed with debugging enabled only. It's +a good idea as firmware may print a lot of messages that normal users +don't need to care about. + +However, on firmware crash, it may be very helpful to log all recent +messages. There is almost always a backtrace available as well as rought +info on the latest actions/state. + +Signed-off-by: Rafał Miłecki +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + .../broadcom/brcm80211/brcmfmac/pcie.c | 24 ++++++++++++++----- + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -764,15 +764,22 @@ static void brcmf_pcie_bus_console_init( + console->base_addr, console->buf_addr, console->bufsize); + } + +- +-static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo) ++/** ++ * brcmf_pcie_bus_console_read - reads firmware messages ++ * ++ * @error: specifies if error has occurred (prints messages unconditionally) ++ */ ++static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo, ++ bool error) + { ++ struct pci_dev *pdev = devinfo->pdev; ++ struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev); + struct brcmf_pcie_console *console; + u32 addr; + u8 ch; + u32 newidx; + +- if (!BRCMF_FWCON_ON()) ++ if (!error && !BRCMF_FWCON_ON()) + return; + + console = &devinfo->shared.console; +@@ -796,7 +803,10 @@ static void brcmf_pcie_bus_console_read( + } + if (ch == '\n') { + console->log_str[console->log_idx] = 0; +- pr_debug("CONSOLE: %s", console->log_str); ++ if (error) ++ brcmf_err(bus, "CONSOLE: %s", console->log_str); ++ else ++ pr_debug("CONSOLE: %s", console->log_str); + console->log_idx = 0; + } + } +@@ -857,7 +867,7 @@ static irqreturn_t brcmf_pcie_isr_thread + &devinfo->pdev->dev); + } + } +- brcmf_pcie_bus_console_read(devinfo); ++ brcmf_pcie_bus_console_read(devinfo, false); + if (devinfo->state == BRCMFMAC_PCIE_STATE_UP) + brcmf_pcie_intr_enable(devinfo); + devinfo->in_irq = false; +@@ -1426,6 +1436,8 @@ static int brcmf_pcie_reset(struct devic + struct brcmf_fw_request *fwreq; + int err; + ++ brcmf_pcie_bus_console_read(devinfo, true); ++ + brcmf_detach(dev); + + brcmf_pcie_release_irq(devinfo); +@@ -1818,7 +1830,7 @@ static void brcmf_pcie_setup(struct devi + if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0) + return; + +- brcmf_pcie_bus_console_read(devinfo); ++ brcmf_pcie_bus_console_read(devinfo, false); + + fail: + device_release_driver(dev); diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch b/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch index 88b9807311..b2671564fd 100644 --- a/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch +++ b/package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch @@ -55,7 +55,7 @@ Signed-off-by: Rafał Miłecki void brcmf_chip_detach(struct brcmf_chip *chip); --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -@@ -1762,6 +1762,12 @@ static void brcmf_pcie_setup(struct devi +@@ -1779,6 +1779,12 @@ static void brcmf_pcie_setup(struct devi nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len; kfree(fwreq);