* [PATCH v2 1/5] brcmfmac: To fix kernel crash on out of boundary access
2020-06-04 7:18 [PATCH v2 0/5] brcmfmac: Stability change series Wright Feng
@ 2020-06-04 7:18 ` Wright Feng
2020-07-14 9:44 ` Kalle Valo
2020-06-04 7:18 ` [PATCH v2 2/5] brcmfmac: fix invalid permanent MAC address in wiphy Wright Feng
` (3 subsequent siblings)
4 siblings, 1 reply; 7+ messages in thread
From: Wright Feng @ 2020-06-04 7:18 UTC (permalink / raw)
To: linux-wireless
Cc: wright.feng, brcm80211-dev-list, brcm80211-dev-list,
Arend van Spriel, Franky Lin, Hante Meuleman, Kalle Valo,
chi-hsien.lin, Raveendran Somu
From: Raveendran Somu <raveendran.somu@cypress.com>
To truncate the additional bytes, if extra bytes have been received.
Current code only have a warning and proceed without handling it.
But in one of the crash reported by DVT, these causes the
crash intermittently. So the processing is limit to the skb->len.
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Wright Feng <wright.feng@cypress.com>
---
v2:
- Correct all typos in commit message
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
index 09701262330d..531fe9be4025 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
@@ -1843,6 +1843,9 @@ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
WARN_ON(siglen > skb->len);
+ if (siglen > skb->len)
+ siglen = skb->len;
+
if (!siglen)
return;
/* if flow control disabled, skip to packet data and leave */
--
2.25.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v2 1/5] brcmfmac: To fix kernel crash on out of boundary access
2020-06-04 7:18 ` [PATCH v2 1/5] brcmfmac: To fix kernel crash on out of boundary access Wright Feng
@ 2020-07-14 9:44 ` Kalle Valo
0 siblings, 0 replies; 7+ messages in thread
From: Kalle Valo @ 2020-07-14 9:44 UTC (permalink / raw)
To: Wright Feng
Cc: linux-wireless, wright.feng, brcm80211-dev-list,
brcm80211-dev-list, Arend van Spriel, Franky Lin, Hante Meuleman,
chi-hsien.lin, Raveendran Somu
Wright Feng <wright.feng@cypress.com> wrote:
> From: Raveendran Somu <raveendran.somu@cypress.com>
>
> To truncate the additional bytes, if extra bytes have been received.
> Current code only have a warning and proceed without handling it.
> But in one of the crash reported by DVT, these causes the
> crash intermittently. So the processing is limit to the skb->len.
>
> Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
> Signed-off-by: Wright Feng <wright.feng@cypress.com>
5 patches applied to wireless-drivers-next.git, thanks.
698bae2e6ea1 brcmfmac: To fix kernel crash on out of boundary access
1eb4e9f62998 brcmfmac: fix invalid permanent MAC address in wiphy
eccbf46b15bb brcmfmac: keep SDIO watchdog running when console_interval is non-zero
ec3428bb8915 brcmfmac: reduce maximum station interface from 2 to 1 in RSDB mode
fa3266541b13 brcmfmac: To fix Bss Info flag definition Bug
--
https://patchwork.kernel.org/patch/11587075/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2 2/5] brcmfmac: fix invalid permanent MAC address in wiphy
2020-06-04 7:18 [PATCH v2 0/5] brcmfmac: Stability change series Wright Feng
2020-06-04 7:18 ` [PATCH v2 1/5] brcmfmac: To fix kernel crash on out of boundary access Wright Feng
@ 2020-06-04 7:18 ` Wright Feng
2020-06-04 7:18 ` [PATCH v2 3/5] brcmfmac: keep SDIO watchdog running when console_interval is non-zero Wright Feng
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Wright Feng @ 2020-06-04 7:18 UTC (permalink / raw)
To: linux-wireless
Cc: wright.feng, brcm80211-dev-list, brcm80211-dev-list,
Arend van Spriel, Franky Lin, Hante Meuleman, Kalle Valo,
chi-hsien.lin
When host driver retrieves mac addresses from dongle, driver copies memory
from drvr->mac to perm_addr. But at the moment, drvr->mac is all zero
array which causes permanent MAC address in wiphy is all zero as well.
To fix this, we set drvr->mac before setting perm_addr.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
---
v2:
- Correct the typo in commit subject
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index dec25e415619..e3758bd86acf 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -209,8 +209,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
bphy_err(drvr, "Retrieving cur_etheraddr failed, %d\n", err);
goto done;
}
- memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+ memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
bus = ifp->drvr->bus_if;
ri = &ifp->drvr->revinfo;
--
2.25.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v2 3/5] brcmfmac: keep SDIO watchdog running when console_interval is non-zero
2020-06-04 7:18 [PATCH v2 0/5] brcmfmac: Stability change series Wright Feng
2020-06-04 7:18 ` [PATCH v2 1/5] brcmfmac: To fix kernel crash on out of boundary access Wright Feng
2020-06-04 7:18 ` [PATCH v2 2/5] brcmfmac: fix invalid permanent MAC address in wiphy Wright Feng
@ 2020-06-04 7:18 ` Wright Feng
2020-06-04 7:18 ` [PATCH v2 4/5] brcmfmac: reduce maximum station interface from 2 to 1 in RSDB mode Wright Feng
2020-06-04 7:18 ` [PATCH v2 5/5] brcmfmac: To fix Bss Info flag definition Bug Wright Feng
4 siblings, 0 replies; 7+ messages in thread
From: Wright Feng @ 2020-06-04 7:18 UTC (permalink / raw)
To: linux-wireless
Cc: wright.feng, brcm80211-dev-list, brcm80211-dev-list,
Arend van Spriel, Franky Lin, Hante Meuleman, Kalle Valo,
chi-hsien.lin
brcmfmac host driver makes SDIO bus sleep and stops SDIO watchdog if no
pending event or data. As a result, host driver does not poll firmware
console buffer before buffer overflow, which leads to missing firmware
logs. We should not stop SDIO watchdog if console_interval is non-zero
in debug build.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index ce6f15284277..50444989ae09 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3686,7 +3686,11 @@ static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
if (bus->idlecount > bus->idletime) {
brcmf_dbg(SDIO, "idle\n");
sdio_claim_host(bus->sdiodev->func1);
- brcmf_sdio_wd_timer(bus, false);
+#ifdef DEBUG
+ if (!BRCMF_FWCON_ON() ||
+ bus->console_interval == 0)
+#endif
+ brcmf_sdio_wd_timer(bus, false);
bus->idlecount = 0;
brcmf_sdio_bus_sleep(bus, true, false);
sdio_release_host(bus->sdiodev->func1);
--
2.25.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v2 4/5] brcmfmac: reduce maximum station interface from 2 to 1 in RSDB mode
2020-06-04 7:18 [PATCH v2 0/5] brcmfmac: Stability change series Wright Feng
` (2 preceding siblings ...)
2020-06-04 7:18 ` [PATCH v2 3/5] brcmfmac: keep SDIO watchdog running when console_interval is non-zero Wright Feng
@ 2020-06-04 7:18 ` Wright Feng
2020-06-04 7:18 ` [PATCH v2 5/5] brcmfmac: To fix Bss Info flag definition Bug Wright Feng
4 siblings, 0 replies; 7+ messages in thread
From: Wright Feng @ 2020-06-04 7:18 UTC (permalink / raw)
To: linux-wireless
Cc: wright.feng, brcm80211-dev-list, brcm80211-dev-list,
Arend van Spriel, Franky Lin, Hante Meuleman, Kalle Valo,
chi-hsien.lin
The firmware state machines are not fully suitable for concurrent
station interface support, it may hit unexpected error if we have 2
different SSIDs and the roaming scenarios concurrently.
To avoid the bad user-experience if this is not fully validated, we
dis-allow user to create two concurrent station interfaces.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
---
.../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index a757abd7a599..8c1801fb59e7 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6801,7 +6801,7 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
* #AP <= 4, matching BI, channels = 1, 4 total
*
* no p2p and rsdb:
- * #STA <= 2, #AP <= 2, channels = 2, 4 total
+ * #STA <= 1, #AP <= 2, channels = 2, 4 total
*
* p2p, no mchan, and mbss:
*
@@ -6816,7 +6816,7 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
* #AP <= 4, matching BI, channels = 1, 4 total
*
* p2p, rsdb, and no mbss:
- * #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
+ * #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
* channels = 2, 4 total
*/
static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
@@ -6857,7 +6857,7 @@ static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
goto err;
combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
- c0_limits[i].max = 1 + rsdb;
+ c0_limits[i].max = 1;
c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
if (mon_flag) {
c0_limits[i].max = 1;
@@ -6873,7 +6873,7 @@ static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
if (p2p && rsdb) {
c0_limits[i].max = 2;
c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
- combo[c].max_interfaces = 5;
+ combo[c].max_interfaces = 4;
} else if (p2p) {
combo[c].max_interfaces = i;
} else if (rsdb) {
--
2.25.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v2 5/5] brcmfmac: To fix Bss Info flag definition Bug
2020-06-04 7:18 [PATCH v2 0/5] brcmfmac: Stability change series Wright Feng
` (3 preceding siblings ...)
2020-06-04 7:18 ` [PATCH v2 4/5] brcmfmac: reduce maximum station interface from 2 to 1 in RSDB mode Wright Feng
@ 2020-06-04 7:18 ` Wright Feng
4 siblings, 0 replies; 7+ messages in thread
From: Wright Feng @ 2020-06-04 7:18 UTC (permalink / raw)
To: linux-wireless
Cc: wright.feng, brcm80211-dev-list, brcm80211-dev-list,
Arend van Spriel, Franky Lin, Hante Meuleman, Kalle Valo,
chi-hsien.lin, Prasanna Kerekoppa
From: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
Bss info flag definition need to be fixed from 0x2 to 0x4
This flag is for rssi info received on channel.
All Firmware branches defined as 0x4 and this is bug in brcmfmac.
Signed-off-by: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Wright Feng <wright.feng@cypress.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index de0ef1b545c4..2e31cc10c195 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -19,7 +19,7 @@
#define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008
#define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */
-#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002
+#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004
#define BRCMF_STA_BRCM 0x00000001 /* Running a Broadcom driver */
#define BRCMF_STA_WME 0x00000002 /* WMM association */
--
2.25.0
^ permalink raw reply related [flat|nested] 7+ messages in thread