From: Rafał Miłecki Date: Thu, 26 Jul 2018 20:43:18 +0000 (+0200) Subject: mac80211: backport brcmfmac fixes & debugging helpers from 4.18 X-Git-Tag: v18.06.0~19 X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fopenwrt.git;a=commitdiff_plain;h=29aab93ea2a334026c0cc87414e7d1e731aedb11 mac80211: backport brcmfmac fixes & debugging helpers from 4.18 The most important is probably regression fix in handling platform NVRAM. That bug stopped hardware from being properly calibrated breaking e.g. 5 GHz for Netgear R8000. Other than that it triggers memory dumps when experiencing firmware problems which is important for debugging purposes. Fixes: 2811c97803e5 ("mac80211: backport brcmfmac firmware & clm_blob loading rework") Signed-off-by: Rafał Miłecki (cherry picked from commit b26214adb53da2816ff830b6cd6e31e1dafa2635) --- diff --git a/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch new file mode 100644 index 0000000000..f353a60b87 --- /dev/null +++ b/package/kernel/mac80211/patches/335-v4.18-0001-brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch @@ -0,0 +1,52 @@ +From f8793c26fe586659d6da3fa277e63961a69d314b Mon Sep 17 00:00:00 2001 +From: Arend Van Spriel +Date: Wed, 16 May 2018 14:11:58 +0200 +Subject: [PATCH] brcmfmac: move ALLFFMAC variable in flowring module + +The only user of ALLFFMAC is the flowring module so no need to +expose it in a header file. + +Reviewed-by: Hante Meuleman +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 -- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h | 2 -- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 2 ++ + 3 files changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -36,8 +36,6 @@ MODULE_AUTHOR("Broadcom Corporation"); + MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver."); + MODULE_LICENSE("Dual BSD/GPL"); + +-const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; +- + #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40 + #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40 + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h +@@ -19,8 +19,6 @@ + #include + #include "fwil_types.h" + +-extern const u8 ALLFFMAC[ETH_ALEN]; +- + #define BRCMF_FW_ALTPATH_LEN 256 + + /* Definitions for the module global and device specific settings are defined +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c +@@ -46,6 +46,8 @@ static const u8 brcmf_flowring_prio2fifo + 3 + }; + ++static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; ++ + + static bool + brcmf_flowring_is_tdls_mac(struct brcmf_flowring *flow, u8 mac[ETH_ALEN]) diff --git a/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch new file mode 100644 index 0000000000..86533b95b6 --- /dev/null +++ b/package/kernel/mac80211/patches/335-v4.18-0002-brcmfmac-add-support-for-sysfs-initiated-coredump.patch @@ -0,0 +1,76 @@ +From 8e072168f75ebce85b96cbcefea2b10ddbd5913f Mon Sep 17 00:00:00 2001 +From: Arend Van Spriel +Date: Wed, 16 May 2018 14:11:59 +0200 +Subject: [PATCH] brcmfmac: add support for sysfs initiated coredump + +The driver already supports device coredump initiated by firmware +event. Since commit 3c47d19ff4dc ("drivers: base: add coredump driver +ops") it is also possible to initiate it from user-space through +sysfs. This patch adds support for SDIO and PCIe devices. + +[rafal@milecki.pl: use LINUX_VERSION_CODE] +Reviewed-by: Hante Meuleman +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Rafał Miłecki +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 + + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 2 ++ + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 8 ++++++++ + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 1 + + 4 files changed, 12 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -1165,6 +1165,9 @@ static struct sdio_driver brcmf_sdmmc_dr + #ifdef CONFIG_PM_SLEEP + .pm = &brcmf_sdio_pm_ops, + #endif /* CONFIG_PM_SLEEP */ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0) ++ .coredump = brcmf_dev_coredump, ++#endif + }, + }; + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h +@@ -250,6 +250,8 @@ int brcmf_attach(struct device *dev, str + void brcmf_detach(struct device *dev); + /* Indication from bus module that dongle should be reset */ + void brcmf_dev_reset(struct device *dev); ++/* Request from bus module to initiate a coredump */ ++void brcmf_dev_coredump(struct device *dev); + + /* Configure the "global" bus state used by upper layers */ + void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state); +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1201,6 +1201,14 @@ void brcmf_dev_reset(struct device *dev) + brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1); + } + ++void brcmf_dev_coredump(struct device *dev) ++{ ++ struct brcmf_bus *bus_if = dev_get_drvdata(dev); ++ ++ if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0) ++ brcmf_dbg(TRACE, "failed to create coredump\n"); ++} ++ + void brcmf_detach(struct device *dev) + { + s32 i; +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -2044,6 +2044,9 @@ static struct pci_driver brcmf_pciedrvr + #ifdef CONFIG_PM + .driver.pm = &brcmf_pciedrvr_pm, + #endif ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0) ++ .driver.coredump = brcmf_dev_coredump, ++#endif + }; + + diff --git a/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch new file mode 100644 index 0000000000..455009ef1d --- /dev/null +++ b/package/kernel/mac80211/patches/335-v4.18-0004-brcmfmac-validate-user-provided-data-for-memdump-bef.patch @@ -0,0 +1,32 @@ +From d2af9b566554e01f9ad67b330ce569dbc130e5d3 Mon Sep 17 00:00:00 2001 +From: Franky Lin +Date: Wed, 16 May 2018 14:12:01 +0200 +Subject: [PATCH] brcmfmac: validate user provided data for memdump before + copying + +In patch "brcmfmac: add support for sysfs initiated coredump", a new +scenario of brcmf_debug_create_memdump was added in which the user of +the function might not necessarily provide prefix data. Hence the +function should not assume the data is always valid and should perform a +check before copying. + +Reviewed-by: Arend van Spriel +Signed-off-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c +@@ -40,7 +40,8 @@ int brcmf_debug_create_memdump(struct br + if (!dump) + return -ENOMEM; + +- memcpy(dump, data, len); ++ if (data && len > 0) ++ memcpy(dump, data, len); + err = brcmf_bus_get_memdump(bus, dump + len, ramsize); + if (err) { + vfree(dump); diff --git a/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch new file mode 100644 index 0000000000..b94e06fa44 --- /dev/null +++ b/package/kernel/mac80211/patches/335-v4.18-0005-brcmfmac-trigger-memory-dump-upon-firmware-halt-sign.patch @@ -0,0 +1,38 @@ +From 8a3ab2f38f1669e3be6433a1f6b82a077b38c4c7 Mon Sep 17 00:00:00 2001 +From: Franky Lin +Date: Wed, 16 May 2018 14:12:02 +0200 +Subject: [PATCH] brcmfmac: trigger memory dump upon firmware halt signal + +PCIe dongle firmware signals a halt/trap through mailbox interrupt. +Trigger a memory dump upon receiving such signal could help to provide +useful information for issue debug. + +Reviewed-by: Arend van Spriel +Signed-off-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -182,6 +182,7 @@ static const struct brcmf_firmware_mappi + #define BRCMF_D2H_DEV_D3_ACK 0x00000001 + #define BRCMF_D2H_DEV_DS_ENTER_REQ 0x00000002 + #define BRCMF_D2H_DEV_DS_EXIT_NOTE 0x00000004 ++#define BRCMF_D2H_DEV_FWHALT 0x10000000 + + #define BRCMF_H2D_HOST_D3_INFORM 0x00000001 + #define BRCMF_H2D_HOST_DS_ACK 0x00000002 +@@ -717,6 +718,10 @@ static void brcmf_pcie_handle_mb_data(st + devinfo->mbdata_completed = true; + wake_up(&devinfo->mbdata_resp_wait); + } ++ if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) { ++ brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n"); ++ brcmf_dev_coredump(&devinfo->pdev->dev); ++ } + } + + diff --git a/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch new file mode 100644 index 0000000000..045e20acfb --- /dev/null +++ b/package/kernel/mac80211/patches/335-v4.18-0006-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch @@ -0,0 +1,30 @@ +From b8248236e92790ac635caeb4156e46ea2417e037 Mon Sep 17 00:00:00 2001 +From: Franky Lin +Date: Wed, 16 May 2018 14:12:03 +0200 +Subject: [PATCH] brcmfmac: trigger memory dump on SDIO firmware halt message + +Attempt to dump dongle memory for debug upon receiving firmware halt +message through dongle to host mail box interrupt. + +Reviewed-by: Arend van Spriel +Signed-off-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -1072,8 +1072,10 @@ static u32 brcmf_sdio_hostmail(struct br + bus->sdcnt.f1regdata += 2; + + /* dongle indicates the firmware has halted/crashed */ +- if (hmb_data & HMB_DATA_FWHALT) ++ if (hmb_data & HMB_DATA_FWHALT) { + brcmf_err("mailbox indicates firmware halted\n"); ++ brcmf_dev_coredump(&sdiod->func1->dev); ++ } + + /* Dongle recomposed rx frames, accept them again */ + if (hmb_data & HMB_DATA_NAKHANDLED) { diff --git a/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch new file mode 100644 index 0000000000..a478b675cc --- /dev/null +++ b/package/kernel/mac80211/patches/336-v4.18-brcmfmac-stop-watchdog-before-detach-and-free-everyt.patch @@ -0,0 +1,70 @@ +From 373c83a801f15b1e3d02d855fad89112bd4ccbe0 Mon Sep 17 00:00:00 2001 +From: Michael Trimarchi +Date: Wed, 30 May 2018 11:06:34 +0200 +Subject: [PATCH] brcmfmac: stop watchdog before detach and free everything + +Using built-in in kernel image without a firmware in filesystem +or in the kernel image can lead to a kernel NULL pointer deference. +Watchdog need to be stopped in brcmf_sdio_remove + +The system is going down NOW! +[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8 +Sent SIGTERM to all processes +[ 1348.121412] Mem abort info: +[ 1348.126962] ESR = 0x96000004 +[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits +[ 1348.135948] SET = 0, FnV = 0 +[ 1348.138997] EA = 0, S1PTW = 0 +[ 1348.142154] Data abort info: +[ 1348.145045] ISV = 0, ISS = 0x00000004 +[ 1348.148884] CM = 0, WnR = 0 +[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) +[ 1348.158475] [00000000000002f8] pgd=0000000000000000 +[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 1348.168927] Modules linked in: ipv6 +[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18 +[ 1348.180757] Hardware name: Amarula A64-Relic (DT) +[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20 +[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290 +[ 1348.200253] sp : ffff00000b85be30 +[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000 +[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638 +[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800 +[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660 +[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00 +[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001 +[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8 +[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400 +[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001 +[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10 +[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870 +[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55 +[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000 +[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100 +[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000 + +Signed-off-by: Michael Trimarchi +Acked-by: Arend van Spriel +Tested-by: Andy Shevchenko +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4297,6 +4297,13 @@ void brcmf_sdio_remove(struct brcmf_sdio + brcmf_dbg(TRACE, "Enter\n"); + + if (bus) { ++ /* Stop watchdog task */ ++ if (bus->watchdog_tsk) { ++ send_sig(SIGTERM, bus->watchdog_tsk, 1); ++ kthread_stop(bus->watchdog_tsk); ++ bus->watchdog_tsk = NULL; ++ } ++ + /* De-register interrupt handler */ + brcmf_sdiod_intr_unregister(bus->sdiodev); + diff --git a/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch new file mode 100644 index 0000000000..2e265a2f37 --- /dev/null +++ b/package/kernel/mac80211/patches/337-v4.18-brcmfmac-fix-regression-in-parsing-NVRAM-for-multipl.patch @@ -0,0 +1,41 @@ +From 299b6365a3b7cf7f5ea1c945a420e9ee4841d6f7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Sun, 22 Jul 2018 23:46:25 +0200 +Subject: [PATCH] brcmfmac: fix regression in parsing NVRAM for multiple + devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +NVRAM is designed to work with Broadcom's SDK Linux kernel which fakes +PCI domain 0 for all internal MMIO devices. Since official Linux kernel +uses platform devices for that purpose there is a mismatch in numbering +PCI domains. + +There used to be a fix for that problem but it was accidentally dropped +during the last firmware loading rework. That resulted in brcmfmac not +being able to extract device specific NVRAM content and all kind of +calibration problems. + +Reported-by: Aditya Xavier +Fixes: 2baa3aaee27f ("brcmfmac: introduce brcmf_fw_alloc_request() function") +Cc: stable@vger.kernel.org # v4.17+ +Signed-off-by: Rafał Miłecki +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brc + fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY; + fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM; + fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL; +- fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus); ++ /* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */ ++ fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1; + fwreq->bus_nr = devinfo->pdev->bus->number; + + return fwreq; diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch index 3afffc0fc4..65782906a1 100644 --- a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch +++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch @@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -1314,6 +1314,7 @@ int __init brcmf_core_init(void) +@@ -1322,6 +1322,7 @@ int __init brcmf_core_init(void) { if (!schedule_work(&brcmf_driver_work)) return -EBUSY; diff --git a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch index 8d5dbfc733..417b6ec869 100644 --- a/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch +++ b/package/kernel/mac80211/patches/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch @@ -9,7 +9,7 @@ Signed-off-by: Phil Elwell --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c -@@ -72,7 +72,11 @@ static int brcmf_fcmode; +@@ -70,7 +70,11 @@ static int brcmf_fcmode; module_param_named(fcmode, brcmf_fcmode, int, 0); MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");