--- /dev/null
+From stable-bounces@linux.kernel.org Fri Apr 24 16:05:36 2009
+Date: Fri, 24 Apr 2009 16:05:31 GMT
+Message-Id: <200904241605.n3OG5VSB008123@hera.kernel.org>
+From: Michael Buesch <mb@bu3sch.de>
+To: jejb@kernel.org, stable@kernel.org
+Subject: b43: Poison RX buffers
+
+From: Michael Buesch <mb@bu3sch.de>
+
+upstream commit: ec9a1d8c13e36440eda0f3c79b8149080e3ab5ba
+
+This patch adds poisoning and sanity checking to the RX DMA buffers.
+This is used for protection against buggy hardware/firmware that raises
+RX interrupts without doing an actual DMA transfer.
+
+This mechanism protects against rare "bad packets" (due to uninitialized skb data)
+and rare kernel crashes due to uninitialized RX headers.
+
+The poison is selected to not match on valid frames and to be cheap for checking.
+
+The poison check mechanism _might_ trigger incorrectly, if we are voluntarily
+receiving frames with bad PLCP headers. However, this is nonfatal, because the
+chance of such a match is basically zero and in case it happens it just results
+in dropping the packet.
+Bad-PLCP RX defaults to off, and you should leave it off unless you want to listen
+to the latest news broadcasted by your microwave oven.
+
+This patch also moves the initialization of the RX-header "length" field in front of
+the mapping of the DMA buffer. The CPU should not touch the buffer after we mapped it.
+
+Cc: stable@kernel.org
+Reported-by: Francesco Gringoli <francesco.gringoli@ing.unibs.it>
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/b43/dma.c | 37 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 33 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -551,11 +551,32 @@ address_error:
+ return 1;
+ }
+
++static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
++{
++ unsigned char *f = skb->data + ring->frameoffset;
++
++ return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF);
++}
++
++static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb)
++{
++ struct b43_rxhdr_fw4 *rxhdr;
++ unsigned char *frame;
++
++ /* This poisons the RX buffer to detect DMA failures. */
++
++ rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
++ rxhdr->frame_len = 0;
++
++ B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2);
++ frame = skb->data + ring->frameoffset;
++ memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */);
++}
++
+ static int setup_rx_descbuffer(struct b43_dmaring *ring,
+ struct b43_dmadesc_generic *desc,
+ struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
+ {
+- struct b43_rxhdr_fw4 *rxhdr;
+ dma_addr_t dmaaddr;
+ struct sk_buff *skb;
+
+@@ -564,6 +585,7 @@ static int setup_rx_descbuffer(struct b4
+ skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
+ if (unlikely(!skb))
+ return -ENOMEM;
++ b43_poison_rx_buffer(ring, skb);
+ dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
+ if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
+ /* ugh. try to realloc in zone_dma */
+@@ -574,6 +596,7 @@ static int setup_rx_descbuffer(struct b4
+ skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
+ if (unlikely(!skb))
+ return -ENOMEM;
++ b43_poison_rx_buffer(ring, skb);
+ dmaaddr = map_descbuffer(ring, skb->data,
+ ring->rx_buffersize, 0);
+ }
+@@ -589,9 +612,6 @@ static int setup_rx_descbuffer(struct b4
+ ring->ops->fill_descriptor(ring, desc, dmaaddr,
+ ring->rx_buffersize, 0, 0, 0);
+
+- rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
+- rxhdr->frame_len = 0;
+-
+ return 0;
+ }
+
+@@ -1484,6 +1504,15 @@ static void dma_rx(struct b43_dmaring *r
+ goto drop;
+ }
+ }
++ if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
++ /* Something went wrong with the DMA.
++ * The device did not touch the buffer and did not overwrite the poison. */
++ b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
++ /* recycle the descriptor buffer. */
++ sync_descbuffer_for_device(ring, meta->dmaaddr,
++ ring->rx_buffersize);
++ goto drop;
++ }
+ if (unlikely(len > ring->rx_buffersize)) {
+ /* The data did not fit into one descriptor buffer
+ * and is split over multiple buffers.
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Apr 24 16:05:34 2009
+Date: Fri, 24 Apr 2009 16:05:29 GMT
+Message-Id: <200904241605.n3OG5TGL008104@hera.kernel.org>
+From: Michael Buesch <mb@bu3sch.de>
+To: jejb@kernel.org, stable@kernel.org
+Subject: b43: Refresh RX poison on buffer recycling
+
+From: Michael Buesch <mb@bu3sch.de>
+
+upstream commit: cf68636a9773aa97915497fe54fa4a51e3f08f3a
+
+The RX buffer poison needs to be refreshed, if we recycle an RX buffer,
+because it might be (partially) overwritten by some DMA operations.
+
+Cc: stable@kernel.org
+Cc: Francesco Gringoli <francesco.gringoli@ing.unibs.it>
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/b43/dma.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1498,20 +1498,16 @@ static void dma_rx(struct b43_dmaring *r
+ len = le16_to_cpu(rxhdr->frame_len);
+ } while (len == 0 && i++ < 5);
+ if (unlikely(len == 0)) {
+- /* recycle the descriptor buffer. */
+- sync_descbuffer_for_device(ring, meta->dmaaddr,
+- ring->rx_buffersize);
+- goto drop;
++ dmaaddr = meta->dmaaddr;
++ goto drop_recycle_buffer;
+ }
+ }
+ if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
+ /* Something went wrong with the DMA.
+ * The device did not touch the buffer and did not overwrite the poison. */
+ b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
+- /* recycle the descriptor buffer. */
+- sync_descbuffer_for_device(ring, meta->dmaaddr,
+- ring->rx_buffersize);
+- goto drop;
++ dmaaddr = meta->dmaaddr;
++ goto drop_recycle_buffer;
+ }
+ if (unlikely(len > ring->rx_buffersize)) {
+ /* The data did not fit into one descriptor buffer
+@@ -1525,6 +1521,7 @@ static void dma_rx(struct b43_dmaring *r
+ while (1) {
+ desc = ops->idx2desc(ring, *slot, &meta);
+ /* recycle the descriptor buffer. */
++ b43_poison_rx_buffer(ring, meta->skb);
+ sync_descbuffer_for_device(ring, meta->dmaaddr,
+ ring->rx_buffersize);
+ *slot = next_slot(ring, *slot);
+@@ -1543,8 +1540,7 @@ static void dma_rx(struct b43_dmaring *r
+ err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC);
+ if (unlikely(err)) {
+ b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n");
+- sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
+- goto drop;
++ goto drop_recycle_buffer;
+ }
+
+ unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
+@@ -1554,6 +1550,11 @@ static void dma_rx(struct b43_dmaring *r
+ b43_rx(ring->dev, skb, rxhdr);
+ drop:
+ return;
++
++drop_recycle_buffer:
++ /* Poison and recycle the RX buffer. */
++ b43_poison_rx_buffer(ring, skb);
++ sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
+ }
+
+ void b43_dma_rx(struct b43_dmaring *ring)
--- /dev/null
+From 35a7433c789ba6df6d96b70fa745ae9e6cac0038 Mon Sep 17 00:00:00 2001
+From: Ed Swierk <eswierk@aristanetworks.com>
+Date: Mon, 6 Apr 2009 17:49:12 -0700
+Subject: forcedeth: Fix resume from hibernation regression.
+
+From: Ed Swierk <eswierk@aristanetworks.com>
+
+upstream commit: 35a7433c789ba6df6d96b70fa745ae9e6cac0038
+
+Reset phy state on resume, fixing a regression caused by powering down
+the phy on hibernate.
+
+Signed-off-by: Ed Swierk <eswierk@aristanetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@sophos.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/forcedeth.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5967,6 +5967,9 @@ static int nv_resume(struct pci_dev *pde
+ for (i = 0;i <= np->register_size/sizeof(u32); i++)
+ writel(np->saved_config_space[i], base+i*sizeof(u32));
+
++ /* restore phy state, including autoneg */
++ phy_init(dev);
++
+ netif_device_attach(dev);
+ if (netif_running(dev)) {
+ rc = nv_open(dev);
drm-i915-add-support-for-g41-chipset.patch
+virtio-rng-remove-false-bug-for-spurious-callbacks.patch
+usb-unusual-device-support-for-gold-mp3-player-energy.patch
+forcedeth-fix-resume-from-hibernation-regression.patch
+b43-poison-rx-buffers.patch
+b43-refresh-rx-poison-on-buffer-recycling.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Apr 24 16:05:08 2009
+Date: Fri, 24 Apr 2009 16:05:04 GMT
+Message-Id: <200904241605.n3OG54gX007660@hera.kernel.org>
+From: Chuck Short <zulcss@ubuntu.com>
+To: jejb@kernel.org, stable@kernel.org
+Subject: USB: Unusual Device support for Gold MP3 Player Energy
+
+From: Chuck Short <zulcss@ubuntu.com>
+
+upstream commit: 46c6e93faa85d1362e1d127dc28cf9d0b304a6f1
+
+Reported by Alessio Treglia on
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/125250
+
+User was getting the following errors in dmesg:
+
+[ 2158.139386] sd 5:0:0:1: ioctl_internal_command return code = 8000002
+[ 2158.139390] : Current: sense key: No Sense
+[ 2158.139393] Additional sense: No additional sense information
+
+Adds unusual device support.
+
+modified: drivers/usb/storage/unusual_devs.h
+
+Signed-off-by: Chuck Short <zulcss@ubuntu.com>
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/usb/storage/unusual_devs.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2147,6 +2147,12 @@ UNUSUAL_DEV( 0xed06, 0x4500, 0x0001, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_CAPACITY_HEURISTICS),
+
++/* Reported by Alessio Treglia <quadrispro@ubuntu.com> */
++UNUSUAL_DEV( 0xed10, 0x7636, 0x0001, 0x0001,
++ "TGE",
++ "Digital MP3 Audio Player",
++ US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
++
+ /* Control/Bulk transport for all SubClass values */
+ USUAL_DEV(US_SC_RBC, US_PR_CB, USB_US_TYPE_STOR),
+ USUAL_DEV(US_SC_8020, US_PR_CB, USB_US_TYPE_STOR),
--- /dev/null
+From chrisw@hera.kernel.org Fri Apr 24 15:37:55 2009
+Date: Fri, 24 Apr 2009 22:35:03 GMT
+Message-Id: <200904242235.n3OMZ3Uq008747@hera.kernel.org>
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+To: jejb@kernel.org, stable@kernel.org
+Subject: virtio-rng: Remove false BUG for spurious callbacks
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+upstream commit: e5b89542ea18020961882228c26db3ba87f6e608
+
+The virtio-rng drivers checks for spurious callbacks. Since
+callbacks can be implemented via shared interrupts (e.g. PCI) this
+could lead to guest kernel oopses with lots of virtio devices.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Cc: stable@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/char/hw_random/virtio-rng.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -37,9 +37,9 @@ static void random_recv_done(struct virt
+ {
+ int len;
+
+- /* We never get spurious callbacks. */
++ /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
+ if (!vq->vq_ops->get_buf(vq, &len))
+- BUG();
++ return;
+
+ data_left = len / sizeof(random_data[0]);
+ complete(&have_data);
projects / thirdparty / kernel / stable-queue.git / commitdiff
