Add patch to fix brcmsmac oops (rhbz 989269)

2 files changed, 146 insertions, 0 deletions

diff --git a/3.10.-6-7-crashes-on-network-activity.patch b/3.10.-6-7-crashes-on-network-activity.patch
new file mode 100644
index 00000000..2e6b0d2e
--- /dev/null
+++ b/3.10.-6-7-crashes-on-network-activity.patch
@@ -0,0 +1,140 @@
+From 6aeddf9d409f3d9938b05b545d65810739237b2e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 20 Aug 2013 06:56:08 +0200
+Subject: [PATCH] 3.10.{6,7} crashes on network activity
+
+On 2013-08-20 2:28 AM, Greg Kroah-Hartman wrote:
+> On Tue, Aug 20, 2013 at 08:26:11AM +0800, Tom Gundersen wrote:
+>> On Tue, Aug 20, 2013 at 8:03 AM, Greg Kroah-Hartman
+>> <gregkh@linuxfoundation.org> wrote:
+>> > On Tue, Aug 20, 2013 at 07:59:47AM +0800, Tom Gundersen wrote:
+>> >> Hi guys,
+>> >>
+>> >> Starting with 3.10.6 (and still present in .7) I get an oops on
+>> >> connecting to the network.
+>> >>
+>> >> The attached picture shows the oops. In case it does not reach the ML,
+>> >> the top of the call trace reads:
+>> >>
+>> >> brcms_c_compute_rtscts_dur
+>> >> brcms_c_ampdu_finalize
+>> >> ampdu_finalize
+>> >> dma_txfast
+>> >> brcms_c_txfifo
+>> >> brcms_c_sendpkt_mac80211
+>> >> brcms_ops_tx
+>> >> __ieee80211_tx
+>> >>
+>> >> I bisected the problem and the first bad commit is
+>> >>
+>> >> commit ef47a5e4f1aaf1d0e2e6875e34b2c9595897bef6
+>> >> Author: Felix Fietkau <nbd@openwrt.org>
+>> >> Date:   Fri Jun 28 21:04:35 2013 +0200
+>> >>
+>> >>     mac80211/minstrel_ht: fix cck rate sampling
+>> >>
+>> >>     commit 1cd158573951f737fbc878a35cb5eb47bf9af3d5 upstream.
+>> >>
+>> >> Reverting it on top of .7 fixes the problem.
+>> >>
+>> >> I had the same (I suppose) problem on mainline some time ago, but I
+>> >> have not bisected it, verified that the problem still occurs there, or
+>> >> checked if reverting the upstream patch fixes it. I'd be happy to do
+>> >> that if it would help though.
+>> >>
+>> >> Let me know if you need any more information.
+>> >
+>> > Do you have this same problem with 3.11-rc6 as well?
+>>
+>> Yes, I just confirmed. I also confirmed that reverting the mainline
+>> commit on top of -rc6 fixes the problem.
+>
+> Great, thanks.
+>
+> Felix and Johannes, any chance we can get this reverted in Linus tree
+> soon, and push that revert back to the 3.10 stable tree as well?
+I'd like to avoid a revert, since that will simply replace one set of
+issues with another. Let's limit the use of the feature that brcmsmac
+can't handle to drivers that are known to work with it. Tom, Please
+test this patch to see if it fixes your issue.
+
+- Felix
+---
+ drivers/net/wireless/ath/ath9k/init.c    | 3 ++-
+ drivers/net/wireless/ath/carl9170/main.c | 3 ++-
+ drivers/net/wireless/rt2x00/rt2800lib.c  | 3 ++-
+ include/net/mac80211.h                   | 1 +
+ net/mac80211/rc80211_minstrel_ht.c       | 3 +++
+ 5 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index 2ba4945..bd126c2 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -767,7 +767,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+ 		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+-		IEEE80211_HW_SUPPORTS_RC_TABLE;
++		IEEE80211_HW_SUPPORTS_RC_TABLE |
++		IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
+index e9010a4..0686375 100644
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1857,7 +1857,8 @@ void *carl9170_alloc(size_t priv_size)
+ 		     IEEE80211_HW_SUPPORTS_PS |
+ 		     IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		     IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
+-		     IEEE80211_HW_SIGNAL_DBM;
++		     IEEE80211_HW_SIGNAL_DBM |
++		     IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	if (!modparam_noht) {
+ 		/*
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 705aa33..7e66a90 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -5912,7 +5912,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 	    IEEE80211_HW_SUPPORTS_PS |
+ 	    IEEE80211_HW_PS_NULLFUNC_STACK |
+ 	    IEEE80211_HW_AMPDU_AGGREGATION |
+-	    IEEE80211_HW_REPORTS_TX_ACK_STATUS;
++	    IEEE80211_HW_REPORTS_TX_ACK_STATUS |
++	    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	/*
+ 	 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 885898a..4e50d36 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1484,6 +1484,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_RC_TABLE			= 1<<24,
+ 	IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF		= 1<<25,
+ 	IEEE80211_HW_TIMING_BEACON_ONLY			= 1<<26,
++	IEEE80211_HW_SUPPORTS_HT_CCK_RATES		= 1<<27,
+ };
+ 
+ /**
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index f5aed96..f3bbea1 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -828,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+ 	if (sband->band != IEEE80211_BAND_2GHZ)
+ 		return;
+ 
++	if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
++		return;
++
+ 	mi->cck_supported = 0;
+ 	mi->cck_supported_short = 0;
+ 	for (i = 0; i < 4; i++) {
+-- 
+1.8.3.1
+
diff --git a/kernel.spec b/kernel.spec
index 68a7ac64..4aee1dab 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -773,6 +773,8 @@ Patch25077: media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020
 #CVE-2013-0343 rhbz 914664 999380
 Patch25078: ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch
 
+#rhbz 989269
+Patch25079: 3.10.-6-7-crashes-on-network-activity.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1495,6 +1497,9 @@ ApplyPatch media-cx23885-Fix-TeVii-S471-regression-since-introduction-of-ts2020.
 #CVE-2013-0343 rhbz 914664 999380
 ApplyPatch ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch
 
+#rhbz 989269
+ApplyPatch 3.10.-6-7-crashes-on-network-activity.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2308,6 +2313,7 @@ fi
 
 %changelog
 * Wed Aug 21 2013 Josh Boyer <jwboyer@fedoraproject.org>
+- Add patch to fix brcmsmac oops (rhbz 989269)
 - CVE-2013-0343 handling of IPv6 temporary addresses (rhbz 914664 999380)
 
 * Tue Aug 20 2013 Josh Boyer <jwboyer@fedoraproject.org>