mac80211: Update to version 5.4.27
The removed patches are all integrated in the upstream version now. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
		@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 | 
			
		||||
 | 
			
		||||
PKG_NAME:=mac80211
 | 
			
		||||
 | 
			
		||||
PKG_VERSION:=5.4-rc8-1
 | 
			
		||||
PKG_VERSION:=5.4.27-1
 | 
			
		||||
PKG_RELEASE:=1
 | 
			
		||||
PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.4-rc8/
 | 
			
		||||
PKG_HASH:=707ffc50d0f6fe3398bcc3a7abd44ffa088d9309255a3a71d014620c20d3bbf9
 | 
			
		||||
PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v5.4.27/
 | 
			
		||||
PKG_HASH:=4c853a2f4c4fcc81cf60a3d59c5efbdb60c3e4acda22996cb192443581753950
 | 
			
		||||
 | 
			
		||||
PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 | 
			
		||||
PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)
 | 
			
		||||
 
 | 
			
		||||
@@ -1,40 +0,0 @@
 | 
			
		||||
From bd8eca2c0f5542c5b20b1c2cc506b8b8a46018df Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Christian Lamparter <chunkeey@gmail.com>
 | 
			
		||||
Date: Sun, 24 Nov 2019 15:22:55 +0100
 | 
			
		||||
Subject: [PATCH] ath9k: use iowrite32 over __raw_writel
 | 
			
		||||
To: linux-wireless@vger.kernel.org
 | 
			
		||||
Cc: QCA ath9k Development <ath9k-devel@qca.qualcomm.com>,
 | 
			
		||||
    Kalle Valo <kvalo@codeaurora.org>,
 | 
			
		||||
    Hauke Mehrtens <hauke@hauke-m.de>,
 | 
			
		||||
    Mathias Kresin <dev@kresin.me>,
 | 
			
		||||
    Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 | 
			
		||||
 | 
			
		||||
This patch changes the ath9k_pci_owl_loader to use the
 | 
			
		||||
same iowrite32 memory accessor that ath9k_pci is using
 | 
			
		||||
to communicate with the PCI(e) chip.
 | 
			
		||||
 | 
			
		||||
This will fix endian issues that came up during testing
 | 
			
		||||
with loaned AVM Fritz!Box 7360 (Lantiq MIPS SoCs + AR9287).
 | 
			
		||||
 | 
			
		||||
Fixes: 5a4f2040fd07 ("ath9k: add loader for AR92XX (and older) pci(e)")
 | 
			
		||||
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c | 2 +-
 | 
			
		||||
 1 file changed, 1 insertion(+), 1 deletion(-)
 | 
			
		||||
 | 
			
		||||
diff --git a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
 | 
			
		||||
index 956fa7828d0c..56d1a7764b9f 100644
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
 | 
			
		||||
@@ -83,7 +83,7 @@ static int ath9k_pci_fixup(struct pci_dev *pdev, const u16 *cal_data,
 | 
			
		||||
 			val = swahb32(val);
 | 
			
		||||
 		}
 | 
			
		||||
 
 | 
			
		||||
-		__raw_writel(val, mem + reg);
 | 
			
		||||
+		iowrite32(val, mem + reg);
 | 
			
		||||
 		usleep_range(100, 120);
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
-- 
 | 
			
		||||
2.24.0
 | 
			
		||||
 | 
			
		||||
@@ -11,7 +11,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath9k/ath9k_pci_owl_loader.c
 | 
			
		||||
@@ -104,6 +104,7 @@
 | 
			
		||||
@@ -104,6 +104,7 @@ static void owl_fw_cb(const struct firmw
 | 
			
		||||
 {
 | 
			
		||||
 	struct pci_dev *pdev = (struct pci_dev *)context;
 | 
			
		||||
 	struct owl_ctx *ctx = (struct owl_ctx *)pci_get_drvdata(pdev);
 | 
			
		||||
@@ -19,7 +19,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 | 
			
		||||
 	struct pci_bus *bus;
 | 
			
		||||
 
 | 
			
		||||
 	complete(&ctx->eeprom_load);
 | 
			
		||||
@@ -121,6 +122,16 @@
 | 
			
		||||
@@ -119,6 +120,16 @@ static void owl_fw_cb(const struct firmw
 | 
			
		||||
 		goto release;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
@@ -36,7 +36,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 | 
			
		||||
 	if (ath9k_pci_fixup(pdev, (const u16 *)fw->data, fw->size))
 | 
			
		||||
 		goto release;
 | 
			
		||||
 
 | 
			
		||||
@@ -138,8 +149,14 @@
 | 
			
		||||
@@ -138,8 +149,14 @@ release:
 | 
			
		||||
 static const char *owl_get_eeprom_name(struct pci_dev *pdev)
 | 
			
		||||
 {
 | 
			
		||||
 	struct device *dev = &pdev->dev;
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/net/wireless/reg.c
 | 
			
		||||
+++ b/net/wireless/reg.c
 | 
			
		||||
@@ -3032,6 +3032,8 @@ void regulatory_hint_country_ie(struct w
 | 
			
		||||
@@ -3039,6 +3039,8 @@ void regulatory_hint_country_ie(struct w
 | 
			
		||||
 	enum environment_cap env = ENVIRON_ANY;
 | 
			
		||||
 	struct regulatory_request *request = NULL, *lr;
 | 
			
		||||
 
 | 
			
		||||
@@ -9,7 +9,7 @@
 | 
			
		||||
 	/* IE len must be evenly divisible by 2 */
 | 
			
		||||
 	if (country_ie_len & 0x01)
 | 
			
		||||
 		return;
 | 
			
		||||
@@ -3283,6 +3285,7 @@ static bool is_wiphy_all_set_reg_flag(en
 | 
			
		||||
@@ -3290,6 +3292,7 @@ static bool is_wiphy_all_set_reg_flag(en
 | 
			
		||||
 
 | 
			
		||||
 void regulatory_hint_disconnect(void)
 | 
			
		||||
 {
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
@@ -8671,6 +8671,21 @@ static int ath10k_mac_init_rd(struct ath
 | 
			
		||||
@@ -8673,6 +8673,21 @@ static int ath10k_mac_init_rd(struct ath
 | 
			
		||||
 	return 0;
 | 
			
		||||
 }
 | 
			
		||||
 
 | 
			
		||||
@@ -22,7 +22,7 @@
 | 
			
		||||
 int ath10k_mac_register(struct ath10k *ar)
 | 
			
		||||
 {
 | 
			
		||||
 	static const u32 cipher_suites[] = {
 | 
			
		||||
@@ -8997,6 +9012,12 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
@@ -9000,6 +9015,12 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
 
 | 
			
		||||
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -13,7 +13,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
 | 
			
		||||
 2 files changed, 8 insertions(+), 10 deletions(-)
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
@@ -4573,13 +4573,6 @@ static struct ieee80211_sta_vht_cap ath1
 | 
			
		||||
@@ -4575,13 +4575,6 @@ static struct ieee80211_sta_vht_cap ath1
 | 
			
		||||
 		vht_cap.cap |= val;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -456,7 +456,7 @@ v13:
 | 
			
		||||
 {
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
 | 
			
		||||
@@ -4364,6 +4364,8 @@ static const struct wmi_ops wmi_tlv_ops
 | 
			
		||||
@@ -4367,6 +4367,8 @@ static const struct wmi_ops wmi_tlv_ops
 | 
			
		||||
 	.gen_echo = ath10k_wmi_tlv_op_gen_echo,
 | 
			
		||||
 	.gen_vdev_spectral_conf = ath10k_wmi_tlv_op_gen_vdev_spectral_conf,
 | 
			
		||||
 	.gen_vdev_spectral_enable = ath10k_wmi_tlv_op_gen_vdev_spectral_enable,
 | 
			
		||||
 
 | 
			
		||||
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 | 
			
		||||
 	if (ret)
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
@@ -9029,7 +9029,7 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
@@ -9032,7 +9032,7 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 | 
			
		||||
 
 | 
			
		||||
 #ifdef CPTCFG_MAC80211_LEDS
 | 
			
		||||
 
 | 
			
		||||
@@ -1,83 +0,0 @@
 | 
			
		||||
From cc8ec75f5ad4acf9babe5e26a10c9bca10624593 Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Hauke Mehrtens <hauke@hauke-m.de>
 | 
			
		||||
Date: Sun, 18 Aug 2019 15:33:51 +0200
 | 
			
		||||
Subject: [PATCH] ath10k: Check if station exists before forwarding tx airtime
 | 
			
		||||
 report
 | 
			
		||||
 | 
			
		||||
It looks like the FW on QCA9984 already reports the tx airtimes before
 | 
			
		||||
the station is added to the peer entry. The peer entry is created in
 | 
			
		||||
ath10k_peer_map_event() just with the vdev_id and the ethaddr, but
 | 
			
		||||
not with a station entry, this is added later in ath10k_peer_create() in
 | 
			
		||||
callbacks from mac80211.
 | 
			
		||||
 | 
			
		||||
When there is no sta added to the peer entry, this function fails
 | 
			
		||||
because it calls ieee80211_sta_register_airtime() with NULL.
 | 
			
		||||
 | 
			
		||||
This was reported in OpenWrt some time ago:
 | 
			
		||||
https://bugs.openwrt.org/index.php?do=details&task_id=2414
 | 
			
		||||
 | 
			
		||||
This commit should fix this crash:
 | 
			
		||||
[   75.991714] Unable to handle kernel paging request at virtual address fffff9e8
 | 
			
		||||
[   75.991756] pgd = c0204000
 | 
			
		||||
[   75.997955] [fffff9e8] *pgd=5fdfd861, *pte=00000000, *ppte=00000000
 | 
			
		||||
[   76.000537] Internal error: Oops: 37 [#1] SMP ARM
 | 
			
		||||
[   76.006686] Modules linked in: pppoe ppp_async ath10k_pci ath10k_core ath pptp pppox ppp_mppe ppp_generic mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY usbserial slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink iptable_raw iptable_mangle iptable_filter ipt_ah ipt_ECN ip_tables crc_ccitt compat chaoskey fuse sch_cake sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32
 | 
			
		||||
[   76.059974]  cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6t_NPT ip6t_MASQUERADE nf_nat_masquerade_ipv6 nf_nat nf_conntrack nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip_gre gre ifb sit tunnel4 ip_tunnel tun vfat fat hfsplus cifs nls_utf8 nls_iso8859_15 nls_iso8859_1 nls_cp850 nls_cp437 nls_cp1250 sha1_generic md5 md4
 | 
			
		||||
[   76.130634]  usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_of_simple ohci_platform ohci_hcd phy_qcom_dwc3 ahci ehci_platform sd_mod ahci_platform libahci_platform libahci libata scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat crc32c_generic
 | 
			
		||||
[   76.154772] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.132 #0
 | 
			
		||||
[   76.177001] Hardware name: Generic DT based system
 | 
			
		||||
[   76.182990] task: c0b06d80 task.stack: c0b00000
 | 
			
		||||
[   76.187832] PC is at ieee80211_sta_register_airtime+0x24/0x148 [mac80211]
 | 
			
		||||
[   76.192211] LR is at ath10k_htt_t2h_msg_handler+0x678/0x10f4 [ath10k_core]
 | 
			
		||||
[   76.199052] pc : [<bf75bfac>]    lr : [<bf83e8b0>]    psr: a0000113
 | 
			
		||||
[   76.205820] sp : c0b01d54  ip : 00000002  fp : bf869c0c
 | 
			
		||||
[   76.211981] r10: 0000003c  r9 : dbdca138  r8 : 00060002
 | 
			
		||||
[   76.217192] r7 : 00000000  r6 : dabe1150  r5 : 00000000  r4 : dbdc95c0
 | 
			
		||||
[   76.222401] r3 : 00000000  r2 : 00060002  r1 : 00000000  r0 : 00000000
 | 
			
		||||
[   76.229003] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
 | 
			
		||||
[   76.235509] Control: 10c5787d  Table: 5c94006a  DAC: 00000051
 | 
			
		||||
[   76.242716] Process swapper/0 (pid: 0, stack limit = 0xc0b00210)
 | 
			
		||||
[   76.248446] Stack: (0xc0b01d54 to 0xc0b02000)
 | 
			
		||||
[   76.254532] 1d40:                                              dbdc95c0 00000000 dabe1150
 | 
			
		||||
[   76.258808] 1d60: 00000001 dabe1150 dbdca138 0000003c bf869c0c bf83e8b0 00000002 c0314b10
 | 
			
		||||
[   76.266969] 1d80: dbdc9c70 00000001 00000001 dabe114c 00010000 00000000 dbdcd724 bf88f3d8
 | 
			
		||||
[   76.275126] 1da0: c0310d28 db393c00 dbdc95c0 00000000 c0b01dd0 c07fb4c4 dbdcd724 00000001
 | 
			
		||||
[   76.283286] 1dc0: 00000022 bf88b09c db393c00 00000022 c0b01dd0 c0b01dd0 00000000 dbdcc5c0
 | 
			
		||||
[   76.291445] 1de0: bf88f04c dbdcd654 dbdcd71c dbdc95c0 00000014 dbdcd724 dbdcc5c0 00000005
 | 
			
		||||
[   76.299605] 1e00: 0004b400 bf85c360 00000000 bf87101c c0b01e24 00000006 00000000 dbdc95c0
 | 
			
		||||
[   76.307764] 1e20: 00000001 00000040 0000012c c0b01e80 1cf51000 bf85c448 dbdcd440 dbdc95c0
 | 
			
		||||
[   76.315925] 1e40: dbdca440 ffffa880 00000040 bf88cb68 dbdcd440 00000001 00000040 ffffa880
 | 
			
		||||
[   76.324084] 1e60: c0b02d00 c06d72e0 dd990080 c0a3f080 c0b255dc c0b047e4 c090afac c090e80c
 | 
			
		||||
[   76.332244] 1e80: c0b01e80 c0b01e80 c0b01e88 c0b01e88 dd4cc200 00000000 00000003 c0b0208c
 | 
			
		||||
[   76.340405] 1ea0: c0b02080 40000003 ffffe000 00000100 c0b02080 c03015c8 00000000 00000001
 | 
			
		||||
[   76.348564] 1ec0: dd408000 c0a38210 c0b2c7c0 0000000a ffffa880 c0b02d00 c07fb764 00200102
 | 
			
		||||
[   76.356723] 1ee0: dd4cc268 c0a3e414 00000000 00000000 00000001 dd408000 de803000 00000000
 | 
			
		||||
[   76.364883] 1f00: 00000000 c03247cc c0a3e414 c0368f1c c0b03f60 c0b153cc de80200c de802000
 | 
			
		||||
[   76.373042] 1f20: c0b01f48 c0301488 c0308630 60000013 ffffffff c0b01f7c 00000000 c0b00000
 | 
			
		||||
[   76.381204] 1f40: 00000000 c030c08c 00000001 00000000 00000000 c0315180 ffffe000 c0b03cc0
 | 
			
		||||
[   76.389363] 1f60: c0b03c70 00000000 00000000 c0a2da28 00000000 00000000 c0b01f90 c0b01f98
 | 
			
		||||
[   76.397522] 1f80: c030862c c0308630 60000013 ffffffff 00000051 00000000 ffffe000 c035dd18
 | 
			
		||||
[   76.405681] 1fa0: 000000bf c0b03c40 00000000 c0b2c000 dddfce80 c035e060 c0b2c040 c0a00cf4
 | 
			
		||||
[   76.413842] 1fc0: ffffffff ffffffff 00000000 c0a0067c c0a2da28 00000000 00000000 c0b2c1d4
 | 
			
		||||
[   76.422001] 1fe0: c0b03c5c c0a2da24 c0b07ee0 4220406a 512f04d0 4220807c 00000000 00000000
 | 
			
		||||
[   76.430335] [<bf75bfac>] (ieee80211_sta_register_airtime [mac80211]) from [<00000002>] (0x2)
 | 
			
		||||
[   76.438314] Code: e1cd81f0 e1a08002 e1cda1f8 e58de020 (e5102618)
 | 
			
		||||
[   76.446965] ---[ end trace 227a38ade964d642 ]---
 | 
			
		||||
 | 
			
		||||
Fixes: bb31b7cb106c ("ath10k: report tx airtime provided by fw")
 | 
			
		||||
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/ath/ath10k/htt_rx.c | 2 +-
 | 
			
		||||
 1 file changed, 1 insertion(+), 1 deletion(-)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
 | 
			
		||||
@@ -2726,7 +2726,7 @@ static void ath10k_htt_rx_tx_compl_ind(s
 | 
			
		||||
 		spin_lock_bh(&ar->data_lock);
 | 
			
		||||
 
 | 
			
		||||
 		peer = ath10k_peer_find_by_id(ar, peer_id);
 | 
			
		||||
-		if (!peer) {
 | 
			
		||||
+		if (!peer || !peer->sta) {
 | 
			
		||||
 			spin_unlock_bh(&ar->data_lock);
 | 
			
		||||
 			rcu_read_unlock();
 | 
			
		||||
 			continue;
 | 
			
		||||
@@ -1,54 +0,0 @@
 | 
			
		||||
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
 | 
			
		||||
Date: Mon, 18 Nov 2019 11:52:41 +0100
 | 
			
		||||
Subject: [PATCH FIX] brcmfmac: disable PCIe interrupts before bus reset
 | 
			
		||||
MIME-Version: 1.0
 | 
			
		||||
Content-Type: text/plain; charset=UTF-8
 | 
			
		||||
Content-Transfer-Encoding: 8bit
 | 
			
		||||
 | 
			
		||||
Keeping interrupts on could result in brcmfmac freeing some resources
 | 
			
		||||
and then IRQ handlers trying to use them. That was obviously a straight
 | 
			
		||||
path for crashing a kernel.
 | 
			
		||||
 | 
			
		||||
Example:
 | 
			
		||||
CPU0                           CPU1
 | 
			
		||||
----                           ----
 | 
			
		||||
brcmf_pcie_reset
 | 
			
		||||
  brcmf_pcie_bus_console_read
 | 
			
		||||
  brcmf_detach
 | 
			
		||||
    ...
 | 
			
		||||
    brcmf_fweh_detach
 | 
			
		||||
    brcmf_proto_detach
 | 
			
		||||
                               brcmf_pcie_isr_thread
 | 
			
		||||
                                 ...
 | 
			
		||||
                                 brcmf_proto_msgbuf_rx_trigger
 | 
			
		||||
                                   ...
 | 
			
		||||
                                   drvr->proto->pd
 | 
			
		||||
    brcmf_pcie_release_irq
 | 
			
		||||
 | 
			
		||||
[  363.789218] Unable to handle kernel NULL pointer dereference at virtual address 00000038
 | 
			
		||||
[  363.797339] pgd = c0004000
 | 
			
		||||
[  363.800050] [00000038] *pgd=00000000
 | 
			
		||||
[  363.803635] Internal error: Oops: 17 [#1] SMP ARM
 | 
			
		||||
(...)
 | 
			
		||||
[  364.029209] Backtrace:
 | 
			
		||||
[  364.031725] [<bf243838>] (brcmf_proto_msgbuf_rx_trigger [brcmfmac]) from [<bf2471dc>] (brcmf_pcie_isr_thread+0x228/0x274 [brcmfmac])
 | 
			
		||||
[  364.043662]  r7:00000001 r6:c8ca0000 r5:00010000 r4:c7b4f800
 | 
			
		||||
 | 
			
		||||
Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
 | 
			
		||||
Cc: stable@vger.kernel.org # v5.2+
 | 
			
		||||
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 ++
 | 
			
		||||
 1 file changed, 2 insertions(+)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 | 
			
		||||
@@ -1427,6 +1427,8 @@ static int brcmf_pcie_reset(struct devic
 | 
			
		||||
 	struct brcmf_fw_request *fwreq;
 | 
			
		||||
 	int err;
 | 
			
		||||
 
 | 
			
		||||
+	brcmf_pcie_intr_disable(devinfo);
 | 
			
		||||
+
 | 
			
		||||
 	brcmf_pcie_bus_console_read(devinfo, true);
 | 
			
		||||
 
 | 
			
		||||
 	brcmf_detach(dev);
 | 
			
		||||
@@ -1,30 +0,0 @@
 | 
			
		||||
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
 | 
			
		||||
Date: Mon, 18 Nov 2019 13:35:20 +0100
 | 
			
		||||
Subject: [PATCH 5.5] brcmfmac: remove monitor interface when detaching
 | 
			
		||||
MIME-Version: 1.0
 | 
			
		||||
Content-Type: text/plain; charset=UTF-8
 | 
			
		||||
Content-Transfer-Encoding: 8bit
 | 
			
		||||
 | 
			
		||||
This fixes a minor WARNING in the cfg80211:
 | 
			
		||||
[  130.658034] ------------[ cut here ]------------
 | 
			
		||||
[  130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211]
 | 
			
		||||
 | 
			
		||||
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
 | 
			
		||||
 1 file changed, 5 insertions(+)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
@@ -1371,6 +1371,11 @@ void brcmf_detach(struct device *dev)
 | 
			
		||||
 	brcmf_fweh_detach(drvr);
 | 
			
		||||
 	brcmf_proto_detach(drvr);
 | 
			
		||||
 
 | 
			
		||||
+	if (drvr->mon_if) {
 | 
			
		||||
+		brcmf_net_detach(drvr->mon_if->ndev, false);
 | 
			
		||||
+		drvr->mon_if = NULL;
 | 
			
		||||
+	}
 | 
			
		||||
+
 | 
			
		||||
 	/* make sure primary interface removed last */
 | 
			
		||||
 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
 | 
			
		||||
 		if (drvr->iflist[i])
 | 
			
		||||
@@ -1,29 +0,0 @@
 | 
			
		||||
From 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Navid Emamdoost <navid.emamdoost@gmail.com>
 | 
			
		||||
Date: Fri, 22 Nov 2019 13:19:48 -0600
 | 
			
		||||
Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
 | 
			
		||||
 | 
			
		||||
In the implementation of brcmf_p2p_create_p2pdev() the allocated memory
 | 
			
		||||
for p2p_vif is leaked when the mac address is the same as primary
 | 
			
		||||
interface. To fix this, go to error path to release p2p_vif via
 | 
			
		||||
brcmf_free_vif().
 | 
			
		||||
 | 
			
		||||
Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness")
 | 
			
		||||
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
 | 
			
		||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++-
 | 
			
		||||
 1 file changed, 2 insertions(+), 1 deletion(-)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
 | 
			
		||||
@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_cr
 | 
			
		||||
 	/* firmware requires unique mac address for p2pdev interface */
 | 
			
		||||
 	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
 | 
			
		||||
 		bphy_err(drvr, "discovery vif must be different from primary interface\n");
 | 
			
		||||
-		return ERR_PTR(-EINVAL);
 | 
			
		||||
+		err = -EINVAL;
 | 
			
		||||
+		goto fail;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	brcmf_p2p_generate_bss_mac(p2p, addr);
 | 
			
		||||
@@ -1,31 +0,0 @@
 | 
			
		||||
From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Dan Carpenter <dan.carpenter@oracle.com>
 | 
			
		||||
Date: Tue, 3 Dec 2019 12:58:55 +0300
 | 
			
		||||
Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
 | 
			
		||||
 | 
			
		||||
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
 | 
			
		||||
static checker warning:
 | 
			
		||||
 | 
			
		||||
    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
 | 
			
		||||
    error: dereferencing freed memory 'pkt'
 | 
			
		||||
 | 
			
		||||
It looks like there was supposed to be a continue after we free "pkt".
 | 
			
		||||
 | 
			
		||||
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
 | 
			
		||||
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
 | 
			
		||||
Acked-by: Franky Lin <franky.lin@broadcom.com>
 | 
			
		||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
 | 
			
		||||
 1 file changed, 1 insertion(+)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 | 
			
		||||
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct
 | 
			
		||||
 					       BRCMF_SDIO_FT_NORMAL)) {
 | 
			
		||||
 				rd->len = 0;
 | 
			
		||||
 				brcmu_pkt_buf_free_skb(pkt);
 | 
			
		||||
+				continue;
 | 
			
		||||
 			}
 | 
			
		||||
 			bus->sdcnt.rx_readahead_cnt++;
 | 
			
		||||
 			if (rd->len != roundup(rd_new.len, 16)) {
 | 
			
		||||
@@ -1,40 +0,0 @@
 | 
			
		||||
From 3428fbcd6e6c0850b1a8b2a12082b7b2aabb3da3 Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Johan Hovold <johan@kernel.org>
 | 
			
		||||
Date: Tue, 10 Dec 2019 12:44:22 +0100
 | 
			
		||||
Subject: [PATCH] brcmfmac: fix interface sanity check
 | 
			
		||||
 | 
			
		||||
Make sure to use the current alternate setting when verifying the
 | 
			
		||||
interface descriptors to avoid binding to an invalid interface.
 | 
			
		||||
 | 
			
		||||
Failing to do so could cause the driver to misbehave or trigger a WARN()
 | 
			
		||||
in usb_submit_urb() that kernels with panic_on_warn set would choke on.
 | 
			
		||||
 | 
			
		||||
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
 | 
			
		||||
Cc: stable <stable@vger.kernel.org>     # 3.4
 | 
			
		||||
Cc: Arend van Spriel <arend@broadcom.com>
 | 
			
		||||
Signed-off-by: Johan Hovold <johan@kernel.org>
 | 
			
		||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 ++--
 | 
			
		||||
 1 file changed, 2 insertions(+), 2 deletions(-)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 | 
			
		||||
@@ -1348,7 +1348,7 @@ brcmf_usb_probe(struct usb_interface *in
 | 
			
		||||
 		goto fail;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
-	desc = &intf->altsetting[0].desc;
 | 
			
		||||
+	desc = &intf->cur_altsetting->desc;
 | 
			
		||||
 	if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
 | 
			
		||||
 	    (desc->bInterfaceSubClass != 2) ||
 | 
			
		||||
 	    (desc->bInterfaceProtocol != 0xff)) {
 | 
			
		||||
@@ -1361,7 +1361,7 @@ brcmf_usb_probe(struct usb_interface *in
 | 
			
		||||
 
 | 
			
		||||
 	num_of_eps = desc->bNumEndpoints;
 | 
			
		||||
 	for (ep = 0; ep < num_of_eps; ep++) {
 | 
			
		||||
-		endpoint = &intf->altsetting[0].endpoint[ep].desc;
 | 
			
		||||
+		endpoint = &intf->cur_altsetting->endpoint[ep].desc;
 | 
			
		||||
 		endpoint_num = usb_endpoint_num(endpoint);
 | 
			
		||||
 		if (!usb_endpoint_xfer_bulk(endpoint))
 | 
			
		||||
 			continue;
 | 
			
		||||
@@ -1,26 +0,0 @@
 | 
			
		||||
From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Navid Emamdoost <navid.emamdoost@gmail.com>
 | 
			
		||||
Date: Sat, 14 Dec 2019 19:51:14 -0600
 | 
			
		||||
Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit
 | 
			
		||||
 | 
			
		||||
In the implementation of brcmf_usbdev_qinit() the allocated memory for
 | 
			
		||||
reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
 | 
			
		||||
handling path.
 | 
			
		||||
 | 
			
		||||
Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
 | 
			
		||||
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
 | 
			
		||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
 | 
			
		||||
 1 file changed, 1 insertion(+)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 | 
			
		||||
@@ -430,6 +430,7 @@ fail:
 | 
			
		||||
 			usb_free_urb(req->urb);
 | 
			
		||||
 		list_del(q->next);
 | 
			
		||||
 	}
 | 
			
		||||
+	kfree(reqs);
 | 
			
		||||
 	return NULL;
 | 
			
		||||
 
 | 
			
		||||
 }
 | 
			
		||||
@@ -1,57 +0,0 @@
 | 
			
		||||
From 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Mon Sep 17 00:00:00 2001
 | 
			
		||||
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
 | 
			
		||||
Date: Thu, 26 Dec 2019 10:20:33 +0100
 | 
			
		||||
Subject: [PATCH] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
 | 
			
		||||
 | 
			
		||||
Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling
 | 
			
		||||
brcmf_bus_started()") changed the initialization order of the brcmfmac
 | 
			
		||||
SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now
 | 
			
		||||
called before the sdiodev->bus_if initialization, it reads the wrong
 | 
			
		||||
chip ID and fails to initialize the GPIO on brcm43362. Thus the chip
 | 
			
		||||
cannot send interrupts and fails to probe:
 | 
			
		||||
 | 
			
		||||
[   12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
 | 
			
		||||
[   12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110
 | 
			
		||||
[   12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110
 | 
			
		||||
[   12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
 | 
			
		||||
 | 
			
		||||
Initialize the bus interface earlier to ensure that
 | 
			
		||||
brcmf_sdiod_intr_register() properly sets up the OOB interrupt.
 | 
			
		||||
 | 
			
		||||
BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438
 | 
			
		||||
Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()")
 | 
			
		||||
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 | 
			
		||||
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
 | 
			
		||||
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 | 
			
		||||
---
 | 
			
		||||
 .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++------
 | 
			
		||||
 1 file changed, 6 insertions(+), 6 deletions(-)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 | 
			
		||||
@@ -4243,6 +4243,12 @@ static void brcmf_sdio_firmware_callback
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	if (err == 0) {
 | 
			
		||||
+		/* Assign bus interface call back */
 | 
			
		||||
+		sdiod->bus_if->dev = sdiod->dev;
 | 
			
		||||
+		sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
 | 
			
		||||
+		sdiod->bus_if->chip = bus->ci->chip;
 | 
			
		||||
+		sdiod->bus_if->chiprev = bus->ci->chiprev;
 | 
			
		||||
+
 | 
			
		||||
 		/* Allow full data communication using DPC from now on. */
 | 
			
		||||
 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
 | 
			
		||||
 
 | 
			
		||||
@@ -4259,12 +4265,6 @@ static void brcmf_sdio_firmware_callback
 | 
			
		||||
 
 | 
			
		||||
 	sdio_release_host(sdiod->func1);
 | 
			
		||||
 
 | 
			
		||||
-	/* Assign bus interface call back */
 | 
			
		||||
-	sdiod->bus_if->dev = sdiod->dev;
 | 
			
		||||
-	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
 | 
			
		||||
-	sdiod->bus_if->chip = bus->ci->chip;
 | 
			
		||||
-	sdiod->bus_if->chiprev = bus->ci->chiprev;
 | 
			
		||||
-
 | 
			
		||||
 	err = brcmf_alloc(sdiod->dev, sdiod->settings);
 | 
			
		||||
 	if (err) {
 | 
			
		||||
 		brcmf_err("brcmf_alloc failed\n");
 | 
			
		||||
@@ -1,8 +1,6 @@
 | 
			
		||||
Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 | 
			
		||||
===================================================================
 | 
			
		||||
--- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 | 
			
		||||
+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 | 
			
		||||
@@ -2747,6 +2747,63 @@ done:
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 | 
			
		||||
@@ -2826,6 +2826,63 @@ done:
 | 
			
		||||
 }
 | 
			
		||||
 
 | 
			
		||||
 static int
 | 
			
		||||
@@ -66,7 +64,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
 | 
			
		||||
 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
 | 
			
		||||
 			    int idx, u8 *mac, struct station_info *sinfo)
 | 
			
		||||
 {
 | 
			
		||||
@@ -2836,6 +2893,7 @@ static s32 brcmf_inform_single_bss(struc
 | 
			
		||||
@@ -2915,6 +2972,7 @@ static s32 brcmf_inform_single_bss(struc
 | 
			
		||||
 	struct brcmu_chan ch;
 | 
			
		||||
 	u16 channel;
 | 
			
		||||
 	u32 freq;
 | 
			
		||||
@@ -74,7 +72,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
 | 
			
		||||
 	u16 notify_capability;
 | 
			
		||||
 	u16 notify_interval;
 | 
			
		||||
 	u8 *notify_ie;
 | 
			
		||||
@@ -2860,6 +2918,17 @@ static s32 brcmf_inform_single_bss(struc
 | 
			
		||||
@@ -2939,6 +2997,17 @@ static s32 brcmf_inform_single_bss(struc
 | 
			
		||||
 		band = NL80211_BAND_5GHZ;
 | 
			
		||||
 
 | 
			
		||||
 	freq = ieee80211_channel_to_frequency(channel, band);
 | 
			
		||||
@@ -92,7 +90,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
 | 
			
		||||
 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
 | 
			
		||||
 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
 | 
			
		||||
 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
 | 
			
		||||
@@ -5277,6 +5346,7 @@ static struct cfg80211_ops brcmf_cfg8021
 | 
			
		||||
@@ -5356,6 +5425,7 @@ static struct cfg80211_ops brcmf_cfg8021
 | 
			
		||||
 	.leave_ibss = brcmf_cfg80211_leave_ibss,
 | 
			
		||||
 	.get_station = brcmf_cfg80211_get_station,
 | 
			
		||||
 	.dump_station = brcmf_cfg80211_dump_station,
 | 
			
		||||
@@ -100,11 +98,9 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8
 | 
			
		||||
 	.set_tx_power = brcmf_cfg80211_set_tx_power,
 | 
			
		||||
 	.get_tx_power = brcmf_cfg80211_get_tx_power,
 | 
			
		||||
 	.add_key = brcmf_cfg80211_add_key,
 | 
			
		||||
Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
===================================================================
 | 
			
		||||
--- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
@@ -1277,6 +1277,8 @@ int brcmf_attach(struct device *dev)
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 | 
			
		||||
@@ -1352,6 +1352,8 @@ int brcmf_attach(struct device *dev)
 | 
			
		||||
 
 | 
			
		||||
 	/* Link to bus module */
 | 
			
		||||
 	drvr->hdrlen = 0;
 | 
			
		||||
@@ -113,7 +109,7 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core
 | 
			
		||||
 
 | 
			
		||||
 	/* Attach and link in the protocol */
 | 
			
		||||
 	ret = brcmf_proto_attach(drvr);
 | 
			
		||||
@@ -1359,6 +1361,12 @@ void brcmf_detach(struct device *dev)
 | 
			
		||||
@@ -1434,6 +1436,12 @@ void brcmf_detach(struct device *dev)
 | 
			
		||||
 	if (drvr == NULL)
 | 
			
		||||
 		return;
 | 
			
		||||
 
 | 
			
		||||
@@ -126,10 +122,8 @@ Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core
 | 
			
		||||
 #ifdef CONFIG_INET
 | 
			
		||||
 	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
 | 
			
		||||
 #endif
 | 
			
		||||
Index: backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 | 
			
		||||
===================================================================
 | 
			
		||||
--- backports-5.4-rc8-1.orig/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 | 
			
		||||
+++ backports-5.4-rc8-1/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 | 
			
		||||
@@ -91,6 +91,11 @@ struct brcmf_rev_info {
 | 
			
		||||
 	u32 nvramrev;
 | 
			
		||||
 };
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
 | 
			
		||||
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
 | 
			
		||||
@@ -11481,6 +11481,15 @@ static const struct attribute_group ipw_
 | 
			
		||||
@@ -11482,6 +11482,15 @@ static const struct attribute_group ipw_
 | 
			
		||||
 	.attrs = ipw_sysfs_entries,
 | 
			
		||||
 };
 | 
			
		||||
 
 | 
			
		||||
@@ -16,7 +16,7 @@
 | 
			
		||||
 #ifdef CPTCFG_IPW2200_PROMISCUOUS
 | 
			
		||||
 static int ipw_prom_open(struct net_device *dev)
 | 
			
		||||
 {
 | 
			
		||||
@@ -11529,15 +11538,6 @@ static netdev_tx_t ipw_prom_hard_start_x
 | 
			
		||||
@@ -11530,15 +11539,6 @@ static netdev_tx_t ipw_prom_hard_start_x
 | 
			
		||||
 	return NETDEV_TX_OK;
 | 
			
		||||
 }
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -140,7 +140,7 @@
 | 
			
		||||
 # LED support
 | 
			
		||||
--- a/drivers/net/wireless/broadcom/b43legacy/main.c
 | 
			
		||||
+++ b/drivers/net/wireless/broadcom/b43legacy/main.c
 | 
			
		||||
@@ -1905,7 +1905,7 @@ static int b43legacy_gpio_init(struct b4
 | 
			
		||||
@@ -1906,7 +1906,7 @@ static int b43legacy_gpio_init(struct b4
 | 
			
		||||
 	if (dev->dev->id.revision >= 2)
 | 
			
		||||
 		mask  |= 0x0010; /* FIXME: This is redundant. */
 | 
			
		||||
 
 | 
			
		||||
@@ -149,7 +149,7 @@
 | 
			
		||||
 	pcidev = bus->pcicore.dev;
 | 
			
		||||
 #endif
 | 
			
		||||
 	gpiodev = bus->chipco.dev ? : pcidev;
 | 
			
		||||
@@ -1924,7 +1924,7 @@ static void b43legacy_gpio_cleanup(struc
 | 
			
		||||
@@ -1925,7 +1925,7 @@ static void b43legacy_gpio_cleanup(struc
 | 
			
		||||
 	struct ssb_bus *bus = dev->dev->bus;
 | 
			
		||||
 	struct ssb_device *gpiodev, *pcidev = NULL;
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/drivers/net/wireless/marvell/libertas/cfg.c
 | 
			
		||||
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
 | 
			
		||||
@@ -2041,6 +2041,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
 | 
			
		||||
@@ -2053,6 +2053,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
 | 
			
		||||
 		goto err_wiphy_new;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/drivers/net/wireless/marvell/libertas/cfg.c
 | 
			
		||||
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
 | 
			
		||||
@@ -2117,6 +2117,8 @@ int lbs_cfg_register(struct lbs_private
 | 
			
		||||
@@ -2129,6 +2129,8 @@ int lbs_cfg_register(struct lbs_private
 | 
			
		||||
 	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
 | 
			
		||||
 	wdev->wiphy->reg_notifier = lbs_reg_notifier;
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -1,88 +0,0 @@
 | 
			
		||||
From patchwork Sat Nov  2 17:47:01 2019
 | 
			
		||||
Content-Type: text/plain; charset="utf-8"
 | 
			
		||||
MIME-Version: 1.0
 | 
			
		||||
Content-Transfer-Encoding: 7bit
 | 
			
		||||
X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
 | 
			
		||||
X-Patchwork-Id: 11224189
 | 
			
		||||
X-Patchwork-Delegate: kvalo@adurom.com
 | 
			
		||||
Return-Path: <SRS0=CgQo=Y2=vger.kernel.org=linux-wireless-owner@kernel.org>
 | 
			
		||||
Date: Sat, 2 Nov 2019 18:47:01 +0100
 | 
			
		||||
From: Daniel Golle <daniel@makrotopia.org>
 | 
			
		||||
To: Stanislaw Gruszka <sgruszka@redhat.com>
 | 
			
		||||
Cc: linux-wireless@vger.kernel.org, Roman Yeryomin <roman@advem.lv>,
 | 
			
		||||
        wbob <wbob@jify.de>
 | 
			
		||||
Subject: [PATCH v2] rt2800: remove errornous duplicate condition
 | 
			
		||||
Message-ID: <20191102174701.GA1489@makrotopia.org>
 | 
			
		||||
References: <20191102154639.GA4589@redhat.com>
 | 
			
		||||
MIME-Version: 1.0
 | 
			
		||||
Content-Disposition: inline
 | 
			
		||||
In-Reply-To: <20191102154639.GA4589@redhat.com>
 | 
			
		||||
User-Agent: Mutt/1.12.2 (2019-09-21)
 | 
			
		||||
Sender: linux-wireless-owner@vger.kernel.org
 | 
			
		||||
Precedence: bulk
 | 
			
		||||
List-ID: <linux-wireless.vger.kernel.org>
 | 
			
		||||
X-Mailing-List: linux-wireless@vger.kernel.org
 | 
			
		||||
 | 
			
		||||
On 2019-10-28 06:07, wbob wrote:
 | 
			
		||||
> Hello Roman,
 | 
			
		||||
>
 | 
			
		||||
> while reading around drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 | 
			
		||||
> I stumbled on what I think is an edit of yours made in error in march
 | 
			
		||||
> 2017:
 | 
			
		||||
>
 | 
			
		||||
> https://github.com/torvalds/linux/commit/41977e86#diff-dae5dc10da180f3b055809a48118e18aR5281
 | 
			
		||||
>
 | 
			
		||||
> RT6352 in line 5281 should not have been introduced as the "else if"
 | 
			
		||||
> below line 5291 can then not take effect for a RT6352 device. Another
 | 
			
		||||
> possibility is for line 5291 to be not for RT6352, but this seems
 | 
			
		||||
> very unlikely. Are you able to clarify still after this substantial time?
 | 
			
		||||
>
 | 
			
		||||
> 5277: static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 | 
			
		||||
> ...
 | 
			
		||||
> 5279:  } else if (rt2x00_rt(rt2x00dev, RT5390) ||
 | 
			
		||||
> 5280:         rt2x00_rt(rt2x00dev, RT5392) ||
 | 
			
		||||
> 5281:         rt2x00_rt(rt2x00dev, RT6352)) {
 | 
			
		||||
> ...
 | 
			
		||||
> 5291:  } else if (rt2x00_rt(rt2x00dev, RT6352)) {
 | 
			
		||||
> ...
 | 
			
		||||
 | 
			
		||||
Hence remove errornous line 5281 to make the driver actually
 | 
			
		||||
execute the correct initialization routine for MT7620 chips.
 | 
			
		||||
 | 
			
		||||
As it was requested by Stanislaw Gruszka remove setting values of
 | 
			
		||||
MIMO_PS_CFG and TX_PIN_CFG. MIMO_PS_CFG is responsible for MIMO
 | 
			
		||||
power-safe mode (which is disabled), hence we can drop setting it.
 | 
			
		||||
TX_PIN_CFG is set correctly in other functions, and as setting this
 | 
			
		||||
value breaks some devices, rather don't set it here during init, but
 | 
			
		||||
only modify it later on.
 | 
			
		||||
 | 
			
		||||
Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
 | 
			
		||||
Reported-by: wbob <wbob@jify.de>
 | 
			
		||||
Reported-by: Roman Yeryomin <roman@advem.lv>
 | 
			
		||||
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 | 
			
		||||
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
 | 
			
		||||
---
 | 
			
		||||
 drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 +----
 | 
			
		||||
 1 file changed, 1 insertion(+), 4 deletions(-)
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 | 
			
		||||
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 | 
			
		||||
@@ -5839,8 +5839,7 @@ static int rt2800_init_registers(struct
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_0, 0x8000fc21);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_TXBF_CFG_3, 0x00009c40);
 | 
			
		||||
 	} else if (rt2x00_rt(rt2x00dev, RT5390) ||
 | 
			
		||||
-		   rt2x00_rt(rt2x00dev, RT5392) ||
 | 
			
		||||
-		   rt2x00_rt(rt2x00dev, RT6352)) {
 | 
			
		||||
+		   rt2x00_rt(rt2x00dev, RT5392)) {
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 | 
			
		||||
@@ -5854,8 +5853,6 @@ static int rt2800_init_registers(struct
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 | 
			
		||||
-		rt2800_register_write(rt2x00dev, MIMO_PS_CFG, 0x00000002);
 | 
			
		||||
-		rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150F0F);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
 | 
			
		||||
 		rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
 | 
			
		||||
@@ -31,7 +31,7 @@ Tested-by: Christoph Krapp <achterin@googlemail.com>
 | 
			
		||||
 static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
 | 
			
		||||
 {
 | 
			
		||||
 	struct hw_mode_spec *spec = &rt2x00dev->spec;
 | 
			
		||||
@@ -1211,6 +1225,10 @@ static int rt2x00lib_probe_hw(struct rt2
 | 
			
		||||
@@ -1211,6 +1224,10 @@ static int rt2x00lib_probe_hw(struct rt2
 | 
			
		||||
 
 | 
			
		||||
 #undef RT2X00_TASKLET_INIT
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -1,6 +1,6 @@
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -4015,6 +4015,12 @@ out:
 | 
			
		||||
@@ -4024,6 +4024,12 @@ out:
 | 
			
		||||
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 | 
			
		||||
 				       struct net_device *dev)
 | 
			
		||||
 {
 | 
			
		||||
 
 | 
			
		||||
@@ -143,7 +143,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
 		ieee80211_free_txskb(&local->hw, skb);
 | 
			
		||||
 		return;
 | 
			
		||||
 	}
 | 
			
		||||
@@ -2775,29 +2781,13 @@ static struct sk_buff *ieee80211_build_h
 | 
			
		||||
@@ -2784,29 +2790,13 @@ static struct sk_buff *ieee80211_build_h
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	skb_pull(skb, skip_header_bytes);
 | 
			
		||||
@@ -179,7 +179,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	if (encaps_data)
 | 
			
		||||
@@ -3412,7 +3402,6 @@ static bool ieee80211_xmit_fast(struct i
 | 
			
		||||
@@ -3421,7 +3411,6 @@ static bool ieee80211_xmit_fast(struct i
 | 
			
		||||
 	struct ieee80211_local *local = sdata->local;
 | 
			
		||||
 	u16 ethertype = (skb->data[12] << 8) | skb->data[13];
 | 
			
		||||
 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
 | 
			
		||||
@@ -187,7 +187,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
 	struct ethhdr eth;
 | 
			
		||||
 	struct ieee80211_tx_info *info;
 | 
			
		||||
 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
 | 
			
		||||
@@ -3464,10 +3453,7 @@ static bool ieee80211_xmit_fast(struct i
 | 
			
		||||
@@ -3473,10 +3462,7 @@ static bool ieee80211_xmit_fast(struct i
 | 
			
		||||
 	 * as the may-encrypt argument for the resize to not account for
 | 
			
		||||
 	 * more room than we already have in 'extra_head'
 | 
			
		||||
 	 */
 | 
			
		||||
 
 | 
			
		||||
@@ -62,7 +62,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 			} else {
 | 
			
		||||
 				ieee80211_lost_packet(sta, info);
 | 
			
		||||
 			}
 | 
			
		||||
@@ -1127,7 +1132,7 @@ void ieee80211_tx_status_ext(struct ieee
 | 
			
		||||
@@ -1128,7 +1133,7 @@ void ieee80211_tx_status_ext(struct ieee
 | 
			
		||||
 
 | 
			
		||||
 		sta = container_of(pubsta, struct sta_info, sta);
 | 
			
		||||
 
 | 
			
		||||
@@ -71,7 +71,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 			sta->status_stats.retry_failed++;
 | 
			
		||||
 		sta->status_stats.retry_count += retry_count;
 | 
			
		||||
 
 | 
			
		||||
@@ -1142,6 +1147,8 @@ void ieee80211_tx_status_ext(struct ieee
 | 
			
		||||
@@ -1143,6 +1148,8 @@ void ieee80211_tx_status_ext(struct ieee
 | 
			
		||||
 				sta->status_stats.last_tdls_pkt_time = jiffies;
 | 
			
		||||
 		} else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
 | 
			
		||||
 			return;
 | 
			
		||||
 
 | 
			
		||||
@@ -13,7 +13,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -2430,6 +2430,33 @@ static int ieee80211_lookup_ra_sta(struc
 | 
			
		||||
@@ -2439,6 +2439,33 @@ static int ieee80211_lookup_ra_sta(struc
 | 
			
		||||
 	return 0;
 | 
			
		||||
 }
 | 
			
		||||
 
 | 
			
		||||
@@ -47,7 +47,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 /**
 | 
			
		||||
  * ieee80211_build_hdr - build 802.11 header in the given frame
 | 
			
		||||
  * @sdata: virtual interface to build the header for
 | 
			
		||||
@@ -2723,26 +2750,8 @@ static struct sk_buff *ieee80211_build_h
 | 
			
		||||
@@ -2732,26 +2759,8 @@ static struct sk_buff *ieee80211_build_h
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	if (unlikely(!multicast && skb->sk &&
 | 
			
		||||
 
 | 
			
		||||
@@ -45,7 +45,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 		struct {
 | 
			
		||||
--- a/net/mac80211/cfg.c
 | 
			
		||||
+++ b/net/mac80211/cfg.c
 | 
			
		||||
@@ -3427,7 +3427,7 @@ int ieee80211_attach_ack_skb(struct ieee
 | 
			
		||||
@@ -3449,7 +3449,7 @@ int ieee80211_attach_ack_skb(struct ieee
 | 
			
		||||
 
 | 
			
		||||
 	spin_lock_irqsave(&local->ack_status_lock, spin_flags);
 | 
			
		||||
 	id = idr_alloc(&local->ack_status_frames, ack_skb,
 | 
			
		||||
@@ -56,7 +56,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 	if (id < 0) {
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -2443,7 +2443,7 @@ static int ieee80211_store_ack_skb(struc
 | 
			
		||||
@@ -2452,7 +2452,7 @@ static int ieee80211_store_ack_skb(struc
 | 
			
		||||
 
 | 
			
		||||
 		spin_lock_irqsave(&local->ack_status_lock, flags);
 | 
			
		||||
 		id = idr_alloc(&local->ack_status_frames, ack_skb,
 | 
			
		||||
 
 | 
			
		||||
@@ -54,7 +54,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 			       sta_info_hash_lookup(local, _addr), hash_node)
 | 
			
		||||
--- a/net/mac80211/status.c
 | 
			
		||||
+++ b/net/mac80211/status.c
 | 
			
		||||
@@ -1085,19 +1085,13 @@ void ieee80211_tx_status(struct ieee8021
 | 
			
		||||
@@ -1086,19 +1086,13 @@ void ieee80211_tx_status(struct ieee8021
 | 
			
		||||
 		.skb = skb,
 | 
			
		||||
 		.info = IEEE80211_SKB_CB(skb),
 | 
			
		||||
 	};
 | 
			
		||||
 
 | 
			
		||||
@@ -367,7 +367,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 /**
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -3667,7 +3667,8 @@ struct ieee80211_txq *ieee80211_next_txq
 | 
			
		||||
@@ -3676,7 +3676,8 @@ struct ieee80211_txq *ieee80211_next_txq
 | 
			
		||||
 {
 | 
			
		||||
 	struct ieee80211_local *local = hw_to_local(hw);
 | 
			
		||||
 	struct ieee80211_txq *ret = NULL;
 | 
			
		||||
@@ -377,7 +377,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 
 | 
			
		||||
 	spin_lock_bh(&local->active_txq_lock[ac]);
 | 
			
		||||
 
 | 
			
		||||
@@ -3678,13 +3679,30 @@ struct ieee80211_txq *ieee80211_next_txq
 | 
			
		||||
@@ -3687,13 +3688,30 @@ struct ieee80211_txq *ieee80211_next_txq
 | 
			
		||||
 	if (!txqi)
 | 
			
		||||
 		goto out;
 | 
			
		||||
 
 | 
			
		||||
@@ -410,7 +410,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 			list_move_tail(&txqi->schedule_order,
 | 
			
		||||
 				       &local->active_txqs[txqi->txq.ac]);
 | 
			
		||||
 			goto begin;
 | 
			
		||||
@@ -3738,6 +3756,33 @@ void __ieee80211_schedule_txq(struct iee
 | 
			
		||||
@@ -3747,6 +3765,33 @@ void __ieee80211_schedule_txq(struct iee
 | 
			
		||||
 }
 | 
			
		||||
 EXPORT_SYMBOL(__ieee80211_schedule_txq);
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -112,7 +112,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 				if (sta->status_stats.lost_packets)
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -3544,6 +3544,9 @@ struct sk_buff *ieee80211_tx_dequeue(str
 | 
			
		||||
@@ -3553,6 +3553,9 @@ struct sk_buff *ieee80211_tx_dequeue(str
 | 
			
		||||
 
 | 
			
		||||
 	WARN_ON_ONCE(softirq_count() == 0);
 | 
			
		||||
 
 | 
			
		||||
@@ -122,7 +122,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 begin:
 | 
			
		||||
 	spin_lock_bh(&fq->lock);
 | 
			
		||||
 
 | 
			
		||||
@@ -3654,6 +3657,21 @@ begin:
 | 
			
		||||
@@ -3663,6 +3666,21 @@ begin:
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
 	IEEE80211_SKB_CB(skb)->control.vif = vif;
 | 
			
		||||
 
 | 
			
		||||
@@ -32,7 +32,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 | 
			
		||||
--- a/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
+++ b/drivers/net/wireless/ath/ath10k/mac.c
 | 
			
		||||
@@ -8868,6 +8868,7 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
@@ -8870,6 +8870,7 @@ int ath10k_mac_register(struct ath10k *a
 | 
			
		||||
 	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
 | 
			
		||||
 	wiphy_ext_feature_set(ar->hw->wiphy,
 | 
			
		||||
 			      NL80211_EXT_FEATURE_SET_SCAN_DWELL);
 | 
			
		||||
@@ -233,7 +233,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 	u64 rx_airtime;
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -3658,7 +3658,7 @@ begin:
 | 
			
		||||
@@ -3667,7 +3667,7 @@ begin:
 | 
			
		||||
 
 | 
			
		||||
 	IEEE80211_SKB_CB(skb)->control.vif = vif;
 | 
			
		||||
 
 | 
			
		||||
@@ -242,7 +242,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 		u32 airtime;
 | 
			
		||||
 
 | 
			
		||||
 		airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
 | 
			
		||||
@@ -3780,7 +3780,7 @@ bool ieee80211_txq_airtime_check(struct
 | 
			
		||||
@@ -3789,7 +3789,7 @@ bool ieee80211_txq_airtime_check(struct
 | 
			
		||||
 	struct sta_info *sta;
 | 
			
		||||
 	struct ieee80211_local *local = hw_to_local(hw);
 | 
			
		||||
 
 | 
			
		||||
 
 | 
			
		||||
@@ -1,22 +0,0 @@
 | 
			
		||||
From: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
Date: Wed, 8 Jan 2020 18:00:41 +0100
 | 
			
		||||
Subject: [PATCH] cfg80211: fix memory leak in nl80211_probe_mesh_link
 | 
			
		||||
 | 
			
		||||
The per-tid statistics need to be released after the call to rdev_get_station
 | 
			
		||||
 | 
			
		||||
Cc: stable@vger.kernel.org
 | 
			
		||||
Fixes: 5ab92e7fe49a ("cfg80211: add support to probe unexercised mesh link")
 | 
			
		||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
---
 | 
			
		||||
 | 
			
		||||
--- a/net/wireless/nl80211.c
 | 
			
		||||
+++ b/net/wireless/nl80211.c
 | 
			
		||||
@@ -13808,6 +13808,8 @@ static int nl80211_probe_mesh_link(struc
 | 
			
		||||
 	if (err)
 | 
			
		||||
 		return err;
 | 
			
		||||
 
 | 
			
		||||
+	cfg80211_sinfo_release_content(&sinfo);
 | 
			
		||||
+
 | 
			
		||||
 	return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
 | 
			
		||||
 }
 | 
			
		||||
 
 | 
			
		||||
@@ -1,21 +0,0 @@
 | 
			
		||||
From: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
Date: Wed, 8 Jan 2020 18:03:04 +0100
 | 
			
		||||
Subject: [PATCH] cfg80211: fix memory leak in cfg80211_cqm_rssi_update
 | 
			
		||||
 | 
			
		||||
The per-tid statistics need to be released after the call to rdev_get_station
 | 
			
		||||
 | 
			
		||||
Cc: stable@vger.kernel.org
 | 
			
		||||
Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info")
 | 
			
		||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
---
 | 
			
		||||
 | 
			
		||||
--- a/net/wireless/nl80211.c
 | 
			
		||||
+++ b/net/wireless/nl80211.c
 | 
			
		||||
@@ -10847,6 +10847,7 @@ static int cfg80211_cqm_rssi_update(stru
 | 
			
		||||
 		if (err)
 | 
			
		||||
 			return err;
 | 
			
		||||
 
 | 
			
		||||
+		cfg80211_sinfo_release_content(&sinfo);
 | 
			
		||||
 		if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
 | 
			
		||||
 			wdev->cqm_config->last_rssi_event_value =
 | 
			
		||||
 				(s8) sinfo.rx_beacon_signal_avg;
 | 
			
		||||
@@ -1,25 +0,0 @@
 | 
			
		||||
From: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
Date: Mon, 13 Jan 2020 18:34:31 +0100
 | 
			
		||||
Subject: [PATCH] cfg80211: fix page refcount issue in A-MSDU decap
 | 
			
		||||
 | 
			
		||||
The fragments attached to a skb can be part of a compound page. In that case,
 | 
			
		||||
page_ref_inc will increment the refcount for the wrong page. Fix this by
 | 
			
		||||
using get_page instead, which calls page_ref_inc on the compound head and
 | 
			
		||||
also checks for overflow.
 | 
			
		||||
 | 
			
		||||
Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx")
 | 
			
		||||
Cc: stable@vger.kernel.org
 | 
			
		||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 | 
			
		||||
---
 | 
			
		||||
 | 
			
		||||
--- a/net/wireless/util.c
 | 
			
		||||
+++ b/net/wireless/util.c
 | 
			
		||||
@@ -564,7 +564,7 @@ __frame_add_frag(struct sk_buff *skb, st
 | 
			
		||||
 	struct skb_shared_info *sh = skb_shinfo(skb);
 | 
			
		||||
 	int page_offset;
 | 
			
		||||
 
 | 
			
		||||
-	page_ref_inc(page);
 | 
			
		||||
+	get_page(page);
 | 
			
		||||
 	page_offset = ptr - page_address(page);
 | 
			
		||||
 	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
 | 
			
		||||
 }
 | 
			
		||||
@@ -48,7 +48,7 @@ Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
 | 
			
		||||
 		struct {
 | 
			
		||||
--- a/net/mac80211/cfg.c
 | 
			
		||||
+++ b/net/mac80211/cfg.c
 | 
			
		||||
@@ -3427,7 +3427,7 @@ int ieee80211_attach_ack_skb(struct ieee
 | 
			
		||||
@@ -3449,7 +3449,7 @@ int ieee80211_attach_ack_skb(struct ieee
 | 
			
		||||
 
 | 
			
		||||
 	spin_lock_irqsave(&local->ack_status_lock, spin_flags);
 | 
			
		||||
 	id = idr_alloc(&local->ack_status_frames, ack_skb,
 | 
			
		||||
@@ -59,7 +59,7 @@ Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
 | 
			
		||||
 	if (id < 0) {
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -2443,7 +2443,7 @@ static int ieee80211_store_ack_skb(struc
 | 
			
		||||
@@ -2452,7 +2452,7 @@ static int ieee80211_store_ack_skb(struc
 | 
			
		||||
 
 | 
			
		||||
 		spin_lock_irqsave(&local->ack_status_lock, flags);
 | 
			
		||||
 		id = idr_alloc(&local->ack_status_frames, ack_skb,
 | 
			
		||||
 
 | 
			
		||||
@@ -1,45 +0,0 @@
 | 
			
		||||
commit 753ffad3d6243303994227854d951ff5c70fa9e0
 | 
			
		||||
Author: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
 | 
			
		||||
Date:   Tue Nov 19 14:34:51 2019 +0100
 | 
			
		||||
 | 
			
		||||
    mac80211: fix TID field in monitor mode transmit
 | 
			
		||||
    
 | 
			
		||||
    Fix overwriting of the qos_ctrl.tid field for encrypted frames injected on
 | 
			
		||||
    a monitor interface. While qos_ctrl.tid is not encrypted, it's used as an
 | 
			
		||||
    input into the encryption algorithm so it's protected, and thus cannot be
 | 
			
		||||
    modified after encryption. For injected frames, the encryption may already
 | 
			
		||||
    have been done in userspace, so we cannot change any fields.
 | 
			
		||||
    
 | 
			
		||||
    Before passing the frame to the driver, the qos_ctrl.tid field is updated
 | 
			
		||||
    from skb->priority. Prior to dbd50a851c50 skb->priority was updated in
 | 
			
		||||
    ieee80211_select_queue_80211(), but this function is no longer always
 | 
			
		||||
    called.
 | 
			
		||||
    
 | 
			
		||||
    Update skb->priority in ieee80211_monitor_start_xmit() so that the value
 | 
			
		||||
    is stored, and when later code 'modifies' the TID it really sets it to
 | 
			
		||||
    the same value as before, preserving the encryption.
 | 
			
		||||
    
 | 
			
		||||
    Fixes: dbd50a851c50 ("mac80211: only allocate one queue when using iTXQs")
 | 
			
		||||
    Signed-off-by: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
 | 
			
		||||
    Link: https://lore.kernel.org/r/20191119133451.14711-1-fredrik.olofsson@anyfinetworks.com
 | 
			
		||||
    [rewrite commit message based on our discussion]
 | 
			
		||||
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 | 
			
		||||
 | 
			
		||||
--- a/net/mac80211/tx.c
 | 
			
		||||
+++ b/net/mac80211/tx.c
 | 
			
		||||
@@ -2269,6 +2269,15 @@ netdev_tx_t ieee80211_monitor_start_xmit
 | 
			
		||||
 						    payload[7]);
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
+	/*
 | 
			
		||||
+	 * Initialize skb->priority for QoS frames. This is put in the TID field
 | 
			
		||||
+	 * of the frame before passing it to the driver.
 | 
			
		||||
+	 */
 | 
			
		||||
+	if (ieee80211_is_data_qos(hdr->frame_control)) {
 | 
			
		||||
+		u8 *p = ieee80211_get_qos_ctl(hdr);
 | 
			
		||||
+		skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
 | 
			
		||||
+	}
 | 
			
		||||
+
 | 
			
		||||
 	memset(info, 0, sizeof(*info));
 | 
			
		||||
 
 | 
			
		||||
 	info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
 | 
			
		||||
@@ -8,7 +8,7 @@
 | 
			
		||||
  *
 | 
			
		||||
  * @set_wds_peer: set the WDS peer for a WDS interface
 | 
			
		||||
  *
 | 
			
		||||
@@ -3766,6 +3767,7 @@ struct cfg80211_ops {
 | 
			
		||||
@@ -3769,6 +3770,7 @@ struct cfg80211_ops {
 | 
			
		||||
 				enum nl80211_tx_power_setting type, int mbm);
 | 
			
		||||
 	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
 | 
			
		||||
 				int *dbm);
 | 
			
		||||
@@ -77,7 +77,7 @@
 | 
			
		||||
 static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
 | 
			
		||||
 				  const u8 *addr)
 | 
			
		||||
 {
 | 
			
		||||
@@ -3995,6 +4008,7 @@ const struct cfg80211_ops mac80211_confi
 | 
			
		||||
@@ -4017,6 +4030,7 @@ const struct cfg80211_ops mac80211_confi
 | 
			
		||||
 	.set_wiphy_params = ieee80211_set_wiphy_params,
 | 
			
		||||
 	.set_tx_power = ieee80211_set_tx_power,
 | 
			
		||||
 	.get_tx_power = ieee80211_get_tx_power,
 | 
			
		||||
@@ -129,7 +129,7 @@
 | 
			
		||||
 	local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
 | 
			
		||||
--- a/net/wireless/nl80211.c
 | 
			
		||||
+++ b/net/wireless/nl80211.c
 | 
			
		||||
@@ -624,6 +624,7 @@ const struct nla_policy nl80211_policy[N
 | 
			
		||||
@@ -630,6 +630,7 @@ const struct nla_policy nl80211_policy[N
 | 
			
		||||
 					.len = SAE_PASSWORD_MAX_LEN },
 | 
			
		||||
 	[NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 | 
			
		||||
 	[NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 | 
			
		||||
@@ -137,7 +137,7 @@
 | 
			
		||||
 };
 | 
			
		||||
 
 | 
			
		||||
 /* policy for the key attributes */
 | 
			
		||||
@@ -2988,6 +2989,20 @@ static int nl80211_set_wiphy(struct sk_b
 | 
			
		||||
@@ -2994,6 +2995,20 @@ static int nl80211_set_wiphy(struct sk_b
 | 
			
		||||
 		if (result)
 | 
			
		||||
 			return result;
 | 
			
		||||
 	}
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user