- 11 7月, 2016 1 次提交
-
-
由 Lukas Wunner 提交于
The EFI firmware on Macs contains a full-fledged network stack for downloading OS X images from osrecovery.apple.com. Unfortunately on Macs introduced 2011 and 2012, EFI brings up the Broadcom 4331 wireless card on every boot and leaves it enabled even after ExitBootServices has been called. The card continues to assert its IRQ line, causing spurious interrupts if the IRQ is shared. It also corrupts memory by DMAing received packets, allowing for remote code execution over the air. This only stops when a driver is loaded for the wireless card, which may be never if the driver is not installed or blacklisted. The issue seems to be constrained to the Broadcom 4331. Chris Milsted has verified that the newer Broadcom 4360 built into the MacBookPro11,3 (2013/2014) does not exhibit this behaviour. The chances that Apple will ever supply a firmware fix for the older machines appear to be zero. The solution is to reset the card on boot by writing to a reset bit in its mmio space. This must be done as an early quirk and not as a plain vanilla PCI quirk to successfully combat memory corruption by DMAed packets: Matthew Garrett found out in 2012 that the packets are written to EfiBootServicesData memory (http://mjg59.dreamwidth.org/11235.html). This type of memory is made available to the page allocator by efi_free_boot_services(). Plain vanilla PCI quirks run much later, in subsys initcall level. In-between a time window would be open for memory corruption. Random crashes occurring in this time window and attributed to DMAed packets have indeed been observed in the wild by Chris Bainbridge. When Matthew Garrett analyzed the memory corruption issue in 2012, he sought to fix it with a grub quirk which transitions the card to D3hot: http://git.savannah.gnu.org/cgit/grub.git/commit/?id=9d34bb85da56 This approach does not help users with other bootloaders and while it may prevent DMAed packets, it does not cure the spurious interrupts emanating from the card. Unfortunately the card's mmio space is inaccessible in D3hot, so to reset it, we have to undo the effect of Matthew's grub patch and transition the card back to D0. Note that the quirk takes a few shortcuts to reduce the amount of code: The size of BAR 0 and the location of the PM capability is identical on all affected machines and therefore hardcoded. Only the address of BAR 0 differs between models. Also, it is assumed that the BCMA core currently mapped is the 802.11 core. The EFI driver seems to always take care of this. Michael Büsch, Bjorn Helgaas and Matt Fleming contributed feedback towards finding the best solution to this problem. The following should be a comprehensive list of affected models: iMac13,1 2012 21.5" [Root Port 00:1c.3 = 8086:1e16] iMac13,2 2012 27" [Root Port 00:1c.3 = 8086:1e16] Macmini5,1 2011 i5 2.3 GHz [Root Port 00:1c.1 = 8086:1c12] Macmini5,2 2011 i5 2.5 GHz [Root Port 00:1c.1 = 8086:1c12] Macmini5,3 2011 i7 2.0 GHz [Root Port 00:1c.1 = 8086:1c12] Macmini6,1 2012 i5 2.5 GHz [Root Port 00:1c.1 = 8086:1e12] Macmini6,2 2012 i7 2.3 GHz [Root Port 00:1c.1 = 8086:1e12] MacBookPro8,1 2011 13" [Root Port 00:1c.1 = 8086:1c12] MacBookPro8,2 2011 15" [Root Port 00:1c.1 = 8086:1c12] MacBookPro8,3 2011 17" [Root Port 00:1c.1 = 8086:1c12] MacBookPro9,1 2012 15" [Root Port 00:1c.1 = 8086:1e12] MacBookPro9,2 2012 13" [Root Port 00:1c.1 = 8086:1e12] MacBookPro10,1 2012 15" [Root Port 00:1c.1 = 8086:1e12] MacBookPro10,2 2012 13" [Root Port 00:1c.1 = 8086:1e12] For posterity, spurious interrupts caused by the Broadcom 4331 wireless card resulted in splats like this (stacktrace omitted): irq 17: nobody cared (try booting with the "irqpoll" option) handlers: [<ffffffff81374370>] pcie_isr [<ffffffffc0704550>] sdhci_irq [sdhci] threaded [<ffffffffc07013c0>] sdhci_thread_irq [sdhci] [<ffffffffc0a0b960>] azx_interrupt [snd_hda_codec] Disabling IRQ #17 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79301 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111781 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=728916 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=895951#c16 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1009819 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1098621 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1149632#c5 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1279130 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1332732 Tested-by: Konstantin Simanov <k.simanov@stlk.ru> # [MacBookPro8,1] Tested-by: Lukas Wunner <lukas@wunner.de> # [MacBookPro9,1] Tested-by: Bryan Paradis <bryan.paradis@gmail.com> # [MacBookPro9,2] Tested-by: Andrew Worsley <amworsley@gmail.com> # [MacBookPro10,1] Tested-by: Chris Bainbridge <chris.bainbridge@gmail.com> # [MacBookPro10,2] Signed-off-by: NLukas Wunner <lukas@wunner.de> Acked-by: NRafał Miłecki <zajec5@gmail.com> Acked-by: NMatt Fleming <matt@codeblueprint.co.uk> Cc: Andy Lutomirski <luto@kernel.org> Cc: Bjorn Helgaas <bhelgaas@google.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Chris Milsted <cmilsted@redhat.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Matthew Garrett <mjg59@srcf.ucam.org> Cc: Michael Buesch <m@bues.ch> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Yinghai Lu <yinghai@kernel.org> Cc: b43-dev@lists.infradead.org Cc: linux-pci@vger.kernel.org Cc: linux-wireless@vger.kernel.org Cc: stable@vger.kernel.org Cc: stable@vger.kernel.org # 123456789abc: x86/quirks: Apply nvidia_bugs quirk only on root bus Cc: stable@vger.kernel.org # 123456789abc: x86/quirks: Reintroduce scanning of secondary buses Link: http://lkml.kernel.org/r/48d0972ac82a53d460e5fce77a07b2560db95203.1465690253.git.lukas@wunner.de [ Did minor readability edits. ] Signed-off-by: NIngo Molnar <mingo@kernel.org>
-
- 07 3月, 2016 1 次提交
-
-
由 Rafał Miłecki 提交于
This follows the way of handling other flashes and cleans code a bit. As next task we will want to move flash code to ChipCommon driver as: 1) Flash controllers are accesible using ChipCommon registers 2) This code isn't MIPS specific This change prepares bcma for that. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 06 2月, 2016 1 次提交
-
-
由 Rafał Miłecki 提交于
UART is connected to and controlled over ChipCommon core. It doesn't have much to do with MIPS core (where we initialize it currently) except just existing on embedded systemms. There isn't point of such cross-core initialization (and we needed #ifdef anyway) so just handle it in ChipCommon. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 11 8月, 2015 1 次提交
-
-
由 Hauke Mehrtens 提交于
bus->host_pdev is part of a union so bus->host_pdev != NULL is probably also true for PCIe devices, because there it accesses bus->host_pci. If we access the dev member at the offset defined in struct platform_device in struct pci_dev instead we probably get something else. This patch adds a new function which returns the host dev struct and NULL if we do not have a host dev. When this gets registered on MIPS brcm47xx we do not have a host dev in some situations. This function could also be used in other places. This problem was introduced in this commit: commit cae761b5 Author: Rafa? Mi?ecki <zajec5@gmail.com> Date: Sun Jun 28 17:17:13 2015 +0200 bcma: populate bus DT subnodes as platform_device-s Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 13 3月, 2015 1 次提交
-
-
由 Rafał Miłecki 提交于
It isn't required for bcma bus on SoCs, so provide some empty functions and allow disabling it. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 05 3月, 2015 1 次提交
-
-
由 Rafał Miłecki 提交于
These functions are not exported nor used anywhere, so there is no reason to put them in public headers. Also drop unused bcma_chipco_(suspend|resume). Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 02 3月, 2015 3 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
由 Rafał Miłecki 提交于
Bringing PCIe hosted bus up requires operating on host-related core. Since we plan to support PCIe Gen 2 devices we should provide a helper picking the correct one (PCIE or PCIE2). Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 29 1月, 2015 1 次提交
-
-
由 Rafał Miłecki 提交于
This allows us to drop some #ifdef magic (mess). Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 24 1月, 2015 2 次提交
-
-
由 Rafał Miłecki 提交于
Starting with kernel 3.19-rc1 early registration of bcma on MIPS is done a bit later, with memory allocator available. This allows us to simplify code by using standard bus scanning method. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
由 Rafał Miłecki 提交于
This moves main bus init code to the main.c and renames old function to make its purpose clear. Thanks to this change we'll also be able to separate scanning from registration (and support PCIe Gen 2 devices) in the future. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
-
- 28 10月, 2014 1 次提交
-
-
由 Rafał Miłecki 提交于
We were setting things like dma_dev, IRQ, etc. during core registration only. We need such info for cores handled internally (e.g. ChipCommon) as well. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Acked-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 01 10月, 2014 1 次提交
-
-
由 Hauke Mehrtens 提交于
This driver is used by the bcm53xx ARM SoC code. Now it is possible to give the address of the chipcommon core in device tree and bcma will search for all the other cores. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Acked-by: NArnd Bergmann <arnd@arndb.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 10 9月, 2014 1 次提交
-
-
由 Hauke Mehrtens 提交于
This core is used on BCM4708 to configure the PCIe and USB3 PHYs and it contains the addresses to the Device Management unit. This will be used by the PCIe driver first. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 05 1月, 2014 1 次提交
-
-
由 Hauke Mehrtens 提交于
This function is used to get a specific core when there is more than one core of that specific type. This is used in bgmac to reset all GMAC cores. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Acked-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 28 6月, 2013 1 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 05 2月, 2013 1 次提交
-
-
由 Hauke Mehrtens 提交于
This patch unregisters the gpio chip before bcma gets unloaded. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Reported-by: NPiotr Haber <phaber@broadcom.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 31 1月, 2013 1 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 08 1月, 2013 1 次提交
-
-
由 Hauke Mehrtens 提交于
This bcma_find_core_unit() is needed by the mips driver in the next patch. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 04 1月, 2013 1 次提交
-
-
由 Greg Kroah-Hartman 提交于
CONFIG_HOTPLUG is going away as an option. As a result, the __dev* markings need to be removed. This change removes the use of __devinit, __devexit_p, and __devexit from these drivers. Based on patches originally written by Bill Pemberton, but redone by me in order to handle some of the coding style issues better, by hand. Cc: Bill Pemberton <wfp5p@virginia.edu> Cc: "Rafał Miłecki" <zajec5@gmail.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 11 12月, 2012 1 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 07 12月, 2012 1 次提交
-
-
由 Hauke Mehrtens 提交于
Register the watchdog driver to the system if this is a SoC. Using the watchdog on a non SoC device, like a PCIe card, will make the PCIe card die when the timeout expired, but starting it again is not supported by bcma. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 22 11月, 2012 1 次提交
-
-
由 Hauke Mehrtens 提交于
Register a GPIO driver to access the GPIOs provided by the chip. The GPIOs of the SoC should always start at 0 and the other GPIOs could start at a random position. There is just one SoC in a system and when they start at 0 the number is predictable. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Patchwork: http://patchwork.linux-mips.org/patch/4587Acked-by: NFlorian Fainelli <florian@openwrt.org>
-
- 22 8月, 2012 2 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 18 7月, 2012 1 次提交
-
-
由 Rafał Miłecki 提交于
Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 10 7月, 2012 1 次提交
-
-
由 Rafał Miłecki 提交于
Having bus number printed makes it much easier to anaylze logs on systems with more buses. For example Netgear WNDR4500 has 3 AMBA buses in total, which makes standard log really messy. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 07 2月, 2012 3 次提交
-
-
由 Hauke Mehrtens 提交于
Some SoCs have a PCIe host controller to make it possible to attach some other devices to it, like an other Wifi card. This code was tested with an Netgear WNDR3400 (bcm4716 based), but should work with all bcma based SoCs. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Hauke Mehrtens 提交于
bcma_core_pci_hostmode_init() has to be in __devinit as it will call a function in that section and so all functions calling it also have to be in __devinit. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Hauke Mehrtens 提交于
This will be needed by the host controller. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 17 1月, 2012 1 次提交
-
-
由 Linus Torvalds 提交于
.. and connect it up with the pci host bcma driver. Now, the next step is to connect those bcma bus-level suspend/resume functions to the actual bcma device suspend resume functions. Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org> Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 14 12月, 2011 1 次提交
-
-
由 Rafał Miłecki 提交于
bcma used to lock up machine without enabling PCI or initializing CC. Cc: stable@vger.kernel.org Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 09 8月, 2011 3 次提交
-
-
由 Hauke Mehrtens 提交于
Add method to return the clock of the CPU. This is needed by the arch code to calculate the mips_hpt_frequency. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Acked-by: NRalf Baechle <ralf@linux-mips.org> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Hauke Mehrtens 提交于
This adds support for serial console to bcma, when operating on an SoC. Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Acked-by: NRalf Baechle <ralf@linux-mips.org> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
由 Hauke Mehrtens 提交于
The chip common and mips core have to be setup early in the boot process to get the cpu clock. bcma_bus_early_register() gets pointers to some space to store the core data and searches for the chip common and mips core and initializes chip common. After that was done and the kernel is out of early boot we just have to run bcma_bus_register() and it will search for the other cores, initialize and register them. The cores are getting the same numbers as before. Acked-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Acked-by: NRalf Baechle <ralf@linux-mips.org> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 08 7月, 2011 1 次提交
-
-
由 Rafał Miłecki 提交于
We must not init it like clientmode one, it would break device (tested by Hauke on BCM4718). Add stub hostmode driver for now. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 21 6月, 2011 1 次提交
-
-
由 Rafał Miłecki 提交于
Function managing IRQs is needed for external drivers like b43. On the other side we do not expect writing any hosts drivers outside of bcma, so this is safe to do not export functions related to this. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 04 6月, 2011 1 次提交
-
-
由 Rafał Miłecki 提交于
In case of BCMA cards SPROM is located in the ChipCommon core, it is not mapped as separated host window. So far we have met only SPROMs rev 8. SPROM layout seems to be the same as for SSB buses, so we decided to share SPROM struct and some defines. For now we extract MAC address only, this can be improved of course. Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 11 5月, 2011 1 次提交
-
-
由 Rafał Miłecki 提交于
Broadcom has released cards based on a new AMBA-based bus type. From a programming point of view, this new bus type differs from AMBA and does not use AMBA common registers. It also differs enough from SSB. We decided that a new bus driver is needed to keep the code clean. In its current form, the driver detects devices present on the bus and registers them in the system. It allows registering BCMA drivers for specified bus devices and provides them basic operations. The bus driver itself includes two important bus managing drivers: ChipCommon core driver and PCI(c) core driver. They are early used to allow correct initialization. Currently code is limited to supporting buses on PCI(e) devices, however the driver is designed to be used also on other hosts. The host abstraction layer is implemented and already used for PCI(e). Support for PCI(e) hosts is working and seems to be stable (access to 80211 core was tested successfully on a few devices). We can still optimize it by using some fixed windows, but this can be done later without affecting any external code. Windows are just ranges in MMIO used for accessing cores on the bus. Cc: Greg KH <greg@kroah.com> Cc: Michael Büsch <mb@bu3sch.de> Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: George Kashperko <george@znau.edu.ua> Cc: Arend van Spriel <arend@broadcom.com> Cc: linux-arm-kernel@lists.infradead.org Cc: Russell King <rmk@arm.linux.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Andy Botting <andy@andybotting.com> Cc: linuxdriverproject <devel@linuxdriverproject.org> Cc: linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org> Signed-off-by: NRafał Miłecki <zajec5@gmail.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-