https://gist.github.com/joanbm/5c640ac074d27fd1d82c74a5b67a1290

From f3d652840f8dd959395065a1cf67ca40b04ec69b Mon Sep 17 00:00:00 2001
From: Joan Bruguera <joanbrugueram@gmail.com>
Date: Tue, 13 Oct 2020 19:35:55 +0200
Subject: [PATCH] Get rid of get_fs/set_fs calls in Broadcom WL driver.

Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 5.10 (tested -rc1 up to 5.10.1)

Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-23 on Arch Linux.

NB: Some checks in wlc_ioctl_internal are likely superfluous,
    but I'm not familiar enough with the driver to remove them with confidence.

See also: https://lwn.net/Articles/722267/
          https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47058bb54b57962b3958a936ddbc59355e4c5504
          https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5e6e9852d6f76e01b2e6803c74258afa5b432bc5

Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
---
 src/wl/sys/wl_cfg80211_hybrid.c | 25 ++-------------------
 src/wl/sys/wl_iw.c              | 25 ++-------------------
 src/wl/sys/wl_linux.c           | 40 ++++++++++++++++++++++++++++-----
 src/wl/sys/wl_linux.h           |  2 ++
 src/wl/sys/wlc_pub.h            |  1 +
 5 files changed, 42 insertions(+), 51 deletions(-)

diff -u -r src/wl/sys/wl_cfg80211_hybrid.c src/wl/sys/wl_cfg80211_hybrid.c
--- a/src/wl/sys/wl_cfg80211_hybrid.c	2021-01-25 08:55:05.625224400 -0800
+++ b/src/wl/sys/wl_cfg80211_hybrid.c	2021-01-25 08:58:30.000982902 -0800
@@ -41,6 +41,7 @@
 #include <wlioctl.h>
 #include <proto/802.11.h>
 #include <wl_cfg80211_hybrid.h>
+#include <wl_linux.h>
 
 #define EVENT_TYPE(e) dtoh32((e)->event_type)
 #define EVENT_FLAGS(e) dtoh16((e)->flags)
@@ -446,30 +447,8 @@
 static s32
 wl_dev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len)
 {
-	struct ifreq ifr;
-	struct wl_ioctl ioc;
-	mm_segment_t fs;
-	s32 err = 0;
-
 	BUG_ON(len < sizeof(int));
-
-	memset(&ioc, 0, sizeof(ioc));
-	ioc.cmd = cmd;
-	ioc.buf = arg;
-	ioc.len = len;
-	strcpy(ifr.ifr_name, dev->name);
-	ifr.ifr_data = (caddr_t)&ioc;
-
-	fs = get_fs();
-	set_fs(get_ds());
-#if defined(WL_USE_NETDEV_OPS)
-	err = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
-#else
-	err = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
-#endif
-	set_fs(fs);
-
-	return err;
+  return wlc_ioctl_internal(dev, cmd, arg, len);
 }
 
 static s32
diff -u -r src/wl/sys/wl_iw.c src/wl/sys/wl_iw.c
--- a/src/wl/sys/wl_iw.c	2021-01-25 09:00:13.163543809 -0800
+++ b/src/wl/sys/wl_iw.c	2021-01-25 09:02:04.218646005 -0800
@@ -37,6 +37,7 @@
 
 #include <wl_dbg.h>
 #include <wl_iw.h>
+#include <wl_linux.h>
 
 extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
 	uint32 reason, char* stringBuf, uint buflen);
@@ -106,29 +107,7 @@
 	int len
 )
 {
-	struct ifreq ifr;
-	wl_ioctl_t ioc;
-	mm_segment_t fs;
-	int ret;
-
-	memset(&ioc, 0, sizeof(ioc));
-	ioc.cmd = cmd;
-	ioc.buf = arg;
-	ioc.len = len;
-
-	strcpy(ifr.ifr_name, dev->name);
-	ifr.ifr_data = (caddr_t) &ioc;
-
-	fs = get_fs();
-	set_fs(get_ds());
-#if defined(WL_USE_NETDEV_OPS)
-	ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
-#else
-	ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
-#endif
-	set_fs(fs);
-
-	return ret;
+  return wlc_ioctl_internal(dev, cmd, arg, len);
 }
 
 static int
diff -u -r src/wl/sys/wl_linux.c src/wl/sys/wl_linux.c
--- a/src/wl/sys/wl_linux.c	2021-01-25 09:02:08.055475147 -0800
+++ b/src/wl/sys/wl_linux.c	2021-01-25 09:06:11.894764339 -0800
@@ -1650,10 +1650,7 @@
 		goto done2;
 	}
 
-	if (segment_eq(get_fs(), KERNEL_DS))
-		buf = ioc.buf;
-
-	else if (ioc.buf) {
+	if (ioc.buf) {
 		if (!(buf = (void *) MALLOC(wl->osh, MAX(ioc.len, WLC_IOCTL_MAXLEN)))) {
 			bcmerror = BCME_NORESOURCE;
 			goto done2;
@@ -1674,7 +1671,7 @@
 	WL_UNLOCK(wl);
 
 done1:
-	if (ioc.buf && (ioc.buf != buf)) {
+	if (ioc.buf) {
 		if (copy_to_user(ioc.buf, buf, ioc.len))
 			bcmerror = BCME_BADADDR;
 		MFREE(wl->osh, buf, MAX(ioc.len, WLC_IOCTL_MAXLEN));
@@ -1684,6 +1681,39 @@
 	ASSERT(VALID_BCMERROR(bcmerror));
 	if (bcmerror != 0)
 		wl->pub->bcmerror = bcmerror;
+	return (OSL_ERROR(bcmerror));
+}
+
+int
+wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len)
+{
+	wl_info_t *wl;
+	wl_if_t *wlif;
+	int bcmerror;
+
+	if (!dev)
+		return -ENETDOWN;
+
+	wl = WL_INFO(dev);
+	wlif = WL_DEV_IF(dev);
+	if (wlif == NULL || wl == NULL || wl->dev == NULL)
+		return -ENETDOWN;
+
+	bcmerror = 0;
+
+	WL_TRACE(("wl%d: wlc_ioctl_internal: cmd 0x%x\n", wl->pub->unit, cmd));
+
+	WL_LOCK(wl);
+	if (!capable(CAP_NET_ADMIN)) {
+		bcmerror = BCME_EPERM;
+	} else {
+		bcmerror = wlc_ioctl(wl->wlc, cmd, buf, len, wlif->wlcif);
+	}
+	WL_UNLOCK(wl);
+
+	ASSERT(VALID_BCMERROR(bcmerror));
+	if (bcmerror != 0)
+		wl->pub->bcmerror = bcmerror;
 	return (OSL_ERROR(bcmerror));
 }
 
diff -u -r src/wl/sys/wl_linux.h src/wl/sys/wl_linux.h
--- a/src/wl/sys/wl_linux.h	2021-01-25 09:06:15.188672391 -0800
+++ b/src/wl/sys/wl_linux.h	2021-01-25 09:07:49.457810535 -0800
@@ -29,6 +29,7 @@
 #define _wl_linux_h_
 
 #include <wlc_types.h>
+#include <wlc_pub.h>
 
 typedef struct wl_timer {
 	struct timer_list 	timer;
@@ -194,6 +195,7 @@
 extern int __devinit wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
 extern void wl_free(wl_info_t *wl);
 extern int  wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
+extern int wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len);
 extern struct net_device * wl_netdev_get(wl_info_t *wl);
 
 #endif 
diff -u -r src/wl/sys/wlc_pub.h src/wl/sys/wlc_pub.h
--- a/src/wl/sys/wlc_pub.h	2021-01-25 09:07:54.543645032 -0800
+++ b/src/wl/sys/wlc_pub.h	2021-01-25 09:08:10.772110464 -0800
@@ -24,6 +24,7 @@
 
 #include <wlc_types.h>
 #include <wlc_utils.h>
+#include <siutils.h>
 #include "proto/802.11.h"
 #include "proto/bcmevent.h"
 
