PKG_NAME:=mac80211
PKG_VERSION:=2017-01-31
-PKG_RELEASE:=11
+PKG_RELEASE:=12
PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
PKG_BACKPORT_VERSION:=
PKG_HASH:=75e6d39e34cf156212a2509172a4a62b673b69eb4a1d9aaa565f7fa719fa2317
--- /dev/null
+From f56324baf329bc9362a52ad77a4a1a0f3356d1bc Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Thu, 26 Apr 2018 12:16:51 +0200
+Subject: [PATCH] brcmfmac: coarse support for PCIe shared structure rev7
+
+Revision 7 of PCIe dongle interface increases the item size of tx and rx
+complete rings to accommodate extra payload for new feature. This patch
+simply bump up the size of these two rings without adding the support
+for utilizing the new space. This makes brcmfmac compatible with rev7
+firmware.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h | 6 ++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 23 ++++++++++++++++++----
+ 2 files changed, 23 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
+@@ -27,8 +27,10 @@
+ #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE 40
+ #define BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE 32
+ #define BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE 24
+-#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE 16
+-#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE 32
++#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7 16
++#define BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE 24
++#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7 32
++#define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE 40
+ #define BRCMF_H2D_TXFLOWRING_ITEMSIZE 48
+
+ struct msgbuf_buf_addr {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -135,8 +135,9 @@ static struct brcmf_firmware_mapping brc
+ BRCMF_PCIE_MB_INT_D2H3_DB0 | \
+ BRCMF_PCIE_MB_INT_D2H3_DB1)
+
++#define BRCMF_PCIE_SHARED_VERSION_7 7
+ #define BRCMF_PCIE_MIN_SHARED_VERSION 5
+-#define BRCMF_PCIE_MAX_SHARED_VERSION 6
++#define BRCMF_PCIE_MAX_SHARED_VERSION BRCMF_PCIE_SHARED_VERSION_7
+ #define BRCMF_PCIE_SHARED_VERSION_MASK 0x00FF
+ #define BRCMF_PCIE_SHARED_DMA_INDEX 0x10000
+ #define BRCMF_PCIE_SHARED_DMA_2B_IDX 0x100000
+@@ -316,6 +317,14 @@ static const u32 brcmf_ring_max_item[BRC
+ BRCMF_D2H_MSGRING_RX_COMPLETE_MAX_ITEM
+ };
+
++static const u32 brcmf_ring_itemsize_pre_v7[BRCMF_NROF_COMMON_MSGRINGS] = {
++ BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
++ BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
++ BRCMF_D2H_MSGRING_CONTROL_COMPLETE_ITEMSIZE,
++ BRCMF_D2H_MSGRING_TX_COMPLETE_ITEMSIZE_PRE_V7,
++ BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE_PRE_V7
++};
++
+ static const u32 brcmf_ring_itemsize[BRCMF_NROF_COMMON_MSGRINGS] = {
+ BRCMF_H2D_MSGRING_CONTROL_SUBMIT_ITEMSIZE,
+ BRCMF_H2D_MSGRING_RXPOST_SUBMIT_ITEMSIZE,
+@@ -999,8 +1008,14 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ struct brcmf_pcie_ringbuf *ring;
+ u32 size;
+ u32 addr;
++ const u32 *ring_itemsize_array;
++
++ if (devinfo->shared.version < BRCMF_PCIE_SHARED_VERSION_7)
++ ring_itemsize_array = brcmf_ring_itemsize_pre_v7;
++ else
++ ring_itemsize_array = brcmf_ring_itemsize;
+
+- size = brcmf_ring_max_item[ring_id] * brcmf_ring_itemsize[ring_id];
++ size = brcmf_ring_max_item[ring_id] * ring_itemsize_array[ring_id];
+ dma_buf = brcmf_pcie_init_dmabuffer_for_device(devinfo, size,
+ tcm_ring_phys_addr + BRCMF_RING_MEM_BASE_ADDR_OFFSET,
+ &dma_handle);
+@@ -1010,7 +1025,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ addr = tcm_ring_phys_addr + BRCMF_RING_MAX_ITEM_OFFSET;
+ brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_max_item[ring_id]);
+ addr = tcm_ring_phys_addr + BRCMF_RING_LEN_ITEMS_OFFSET;
+- brcmf_pcie_write_tcm16(devinfo, addr, brcmf_ring_itemsize[ring_id]);
++ brcmf_pcie_write_tcm16(devinfo, addr, ring_itemsize_array[ring_id]);
+
+ ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+ if (!ring) {
+@@ -1019,7 +1034,7 @@ brcmf_pcie_alloc_dma_and_ring(struct brc
+ return NULL;
+ }
+ brcmf_commonring_config(&ring->commonring, brcmf_ring_max_item[ring_id],
+- brcmf_ring_itemsize[ring_id], dma_buf);
++ ring_itemsize_array[ring_id], dma_buf);
+ ring->dma_handle = dma_handle;
+ ring->devinfo = devinfo;
+ brcmf_commonring_register_cb(&ring->commonring,
--- /dev/null
+From 9c4a121e82634aa000a702c98cd6f05b27d6e186 Mon Sep 17 00:00:00 2001
+From: Sean Lanigan <sean@lano.id.au>
+Date: Fri, 4 May 2018 16:48:23 +1000
+Subject: [PATCH] brcmfmac: Add support for bcm43364 wireless chipset
+
+Add support for the BCM43364 chipset via an SDIO interface, as used in
+e.g. the Murata 1FX module.
+
+The BCM43364 uses the same firmware as the BCM43430 (which is already
+included), the only difference is the omission of Bluetooth.
+
+However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS
+of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't
+load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place
+triggers the brcmfmac driver to load, and then correctly use the
+firmware file 'brcmfmac43430-sdio.bin'.
+
+Signed-off-by: Sean Lanigan <sean@lano.id.au>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ include/linux/mmc/sdio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1097,6 +1097,7 @@ static const struct sdio_device_id brcmf
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -34,6 +34,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4335_4339 0x4335
+ #define SDIO_DEVICE_ID_BROADCOM_4339 0x4339
+ #define SDIO_DEVICE_ID_BROADCOM_43362 0xa962
++#define SDIO_DEVICE_ID_BROADCOM_43364 0xa9a4
+ #define SDIO_DEVICE_ID_BROADCOM_43430 0xa9a6
+ #define SDIO_DEVICE_ID_BROADCOM_4345 0x4345
+ #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf
--- /dev/null
+From 88001968245c42c26416476bf0ef960442371605 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 14 May 2018 08:48:20 +0200
+Subject: [PATCH] brcmfmac: add debugfs entry for reading firmware capabilities
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows reading all capabilities as reported by a firmware. They are
+printed using native (raw) names, just like developers like it the most.
+It's how firmware reports support for various features, e.g. supported
+modes, supported standards, power saving details, max BSS-es.
+
+Access to all that info is useful for trying new firmwares, comparing
+them and debugging features AKA bugs.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 36 ++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -138,6 +138,41 @@ static void brcmf_feat_firmware_capabili
+ }
+ }
+
++/**
++ * brcmf_feat_fwcap_debugfs_read() - expose firmware capabilities to debugfs.
++ *
++ * @seq: sequence for debugfs entry.
++ * @data: raw data pointer.
++ */
++static int brcmf_feat_fwcap_debugfs_read(struct seq_file *seq, void *data)
++{
++ struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
++ struct brcmf_if *ifp = brcmf_get_ifp(bus_if->drvr, 0);
++ char caps[MAX_CAPS_BUFFER_SIZE + 1] = { };
++ char *tmp;
++ int err;
++
++ err = brcmf_fil_iovar_data_get(ifp, "cap", caps, sizeof(caps));
++ if (err) {
++ brcmf_err("could not get firmware cap (%d)\n", err);
++ return err;
++ }
++
++ /* Put every capability in a new line */
++ for (tmp = caps; *tmp; tmp++) {
++ if (*tmp == ' ')
++ *tmp = '\n';
++ }
++
++ /* Usually there is a space at the end of capabilities string */
++ seq_printf(seq, "%s", caps);
++ /* So make sure we don't print two line breaks */
++ if (tmp > caps && *(tmp - 1) != '\n')
++ seq_printf(seq, "\n");
++
++ return 0;
++}
++
+ void brcmf_feat_attach(struct brcmf_pub *drvr)
+ {
+ struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+@@ -196,6 +231,7 @@ void brcmf_feat_attach(struct brcmf_pub
+ }
+
+ brcmf_debugfs_add_entry(drvr, "features", brcmf_feat_debugfs_read);
++ brcmf_debugfs_add_entry(drvr, "fwcap", brcmf_feat_fwcap_debugfs_read);
+ }
+
+ bool brcmf_feat_is_enabled(struct brcmf_if *ifp, enum brcmf_feat_id id)
--- /dev/null
+From 8e072168f75ebce85b96cbcefea2b10ddbd5913f Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 16 May 2018 14:11:59 +0200
+Subject: [PATCH] brcmfmac: add support for sysfs initiated coredump
+
+The driver already supports device coredump initiated by firmware
+event. Since commit 3c47d19ff4dc ("drivers: base: add coredump driver
+ops") it is also possible to initiate it from user-space through
+sysfs. This patch adds support for SDIO and PCIe devices.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 2 ++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 8 ++++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 1 +
+ 4 files changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1299,6 +1299,9 @@ static struct sdio_driver brcmf_sdmmc_dr
+ #ifdef CONFIG_PM_SLEEP
+ .pm = &brcmf_sdio_pm_ops,
+ #endif /* CONFIG_PM_SLEEP */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
++ .coredump = brcmf_dev_coredump,
++#endif
+ },
+ };
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -231,6 +231,8 @@ void brcmf_detach(struct device *dev);
+ void brcmf_dev_reset(struct device *dev);
+ /* Indication from bus module to change flow-control state */
+ void brcmf_txflowblock(struct device *dev, bool state);
++/* Request from bus module to initiate a coredump */
++void brcmf_dev_coredump(struct device *dev);
+
+ /* Notify the bus has transferred the tx packet to firmware */
+ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1159,6 +1159,14 @@ void brcmf_dev_reset(struct device *dev)
+ brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
+ }
+
++void brcmf_dev_coredump(struct device *dev)
++{
++ struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++
++ if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
++ brcmf_dbg(TRACE, "failed to create coredump\n");
++}
++
+ void brcmf_detach(struct device *dev)
+ {
+ s32 i;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1995,6 +1995,9 @@ static struct pci_driver brcmf_pciedrvr
+ #ifdef CONFIG_PM
+ .driver.pm = &brcmf_pciedrvr_pm,
+ #endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
++ .driver.coredump = brcmf_dev_coredump,
++#endif
+ };
+
+
--- /dev/null
+From d2af9b566554e01f9ad67b330ce569dbc130e5d3 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:01 +0200
+Subject: [PATCH] brcmfmac: validate user provided data for memdump before
+ copying
+
+In patch "brcmfmac: add support for sysfs initiated coredump", a new
+scenario of brcmf_debug_create_memdump was added in which the user of
+the function might not necessarily provide prefix data. Hence the
+function should not assume the data is always valid and should perform a
+check before copying.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -42,7 +42,8 @@ int brcmf_debug_create_memdump(struct br
+ if (!dump)
+ return -ENOMEM;
+
+- memcpy(dump, data, len);
++ if (data && len > 0)
++ memcpy(dump, data, len);
+ err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
+ if (err) {
+ vfree(dump);
--- /dev/null
+From 8a3ab2f38f1669e3be6433a1f6b82a077b38c4c7 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:02 +0200
+Subject: [PATCH] brcmfmac: trigger memory dump upon firmware halt signal
+
+PCIe dongle firmware signals a halt/trap through mailbox interrupt.
+Trigger a memory dump upon receiving such signal could help to provide
+useful information for issue debug.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -180,6 +180,7 @@ static struct brcmf_firmware_mapping brc
+ #define BRCMF_D2H_DEV_D3_ACK 0x00000001
+ #define BRCMF_D2H_DEV_DS_ENTER_REQ 0x00000002
+ #define BRCMF_D2H_DEV_DS_EXIT_NOTE 0x00000004
++#define BRCMF_D2H_DEV_FWHALT 0x10000000
+
+ #define BRCMF_H2D_HOST_D3_INFORM 0x00000001
+ #define BRCMF_H2D_HOST_DS_ACK 0x00000002
+@@ -715,6 +716,10 @@ static void brcmf_pcie_handle_mb_data(st
+ devinfo->mbdata_completed = true;
+ wake_up(&devinfo->mbdata_resp_wait);
+ }
++ if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
++ brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
++ brcmf_dev_coredump(&devinfo->pdev->dev);
++ }
+ }
+
+
--- /dev/null
+From b8248236e92790ac635caeb4156e46ea2417e037 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 16 May 2018 14:12:03 +0200
+Subject: [PATCH] brcmfmac: trigger memory dump on SDIO firmware halt message
+
+Attempt to dump dongle memory for debug upon receiving firmware halt
+message through dongle to host mail box interrupt.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1095,8 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
+ bus->sdcnt.f1regdata += 2;
+
+ /* dongle indicates the firmware has halted/crashed */
+- if (hmb_data & HMB_DATA_FWHALT)
++ if (hmb_data & HMB_DATA_FWHALT) {
+ brcmf_err("mailbox indicates firmware halted\n");
++ brcmf_dev_coredump(&sdiod->func1->dev);
++ }
+
+ /* Dongle recomposed rx frames, accept them again */
+ if (hmb_data & HMB_DATA_NAKHANDLED) {
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1268,6 +1268,7 @@ int __init brcmf_core_init(void)
+@@ -1276,6 +1276,7 @@ int __init brcmf_core_init(void)
{
if (!schedule_work(&brcmf_driver_work))
return -EBUSY;