--- /dev/null
+From 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e Mon Sep 17 00:00:00 2001
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Date: Tue, 23 Dec 2008 04:01:35 +0900
+Subject: SCSI: eata: fix the data buffer accessors conversion regression
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e upstream.
+
+This fixes the regression introduced by the commit
+58e2a02eb18393e76a469580fedf7caec190eb5e (eata: convert to use the
+data buffer accessors), reported:
+
+http://marc.info/?t=122987621300006&r=1&w=2
+
+- fix DMA_NONE handling in map_dma()
+
+- this driver can't use scsi_dma_map since host->shost_gendev.parent
+is not set properly (it uses scsi_register).
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Arthur Marsh <arthur.marsh@internode.on.net>
+Tested-by: Arthur Marsh <arthur.marsh@internode.on.net>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/eata.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/eata.c
++++ b/drivers/scsi/eata.c
+@@ -1626,8 +1626,15 @@ static void map_dma(unsigned int i, stru
+
+ cpp->sense_len = SCSI_SENSE_BUFFERSIZE;
+
+- count = scsi_dma_map(SCpnt);
+- BUG_ON(count < 0);
++ if (!scsi_sg_count(SCpnt)) {
++ cpp->data_len = 0;
++ return;
++ }
++
++ count = pci_map_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
++ pci_dir);
++ BUG_ON(!count);
++
+ scsi_for_each_sg(SCpnt, sg, count, k) {
+ cpp->sglist[k].address = H2DEV(sg_dma_address(sg));
+ cpp->sglist[k].num_bytes = H2DEV(sg_dma_len(sg));
+@@ -1655,7 +1662,9 @@ static void unmap_dma(unsigned int i, st
+ pci_unmap_single(ha->pdev, DEV2H(cpp->sense_addr),
+ DEV2H(cpp->sense_len), PCI_DMA_FROMDEVICE);
+
+- scsi_dma_unmap(SCpnt);
++ if (scsi_sg_count(SCpnt))
++ pci_unmap_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
++ pci_dir);
+
+ if (!DEV2H(cpp->data_len))
+ pci_dir = PCI_DMA_BIDIRECTIONAL;
ring-buffer-prevent-false-positive-warning.patch
ring-buffer-fix-dangling-commit-race.patch
iwlwifi-use-gfp_kernel-to-allocate-rx-skb-memory.patch
+tx493ide-fix-length-for-__ide_flush_dcache_range.patch
+tx4939ide-do-not-use-zero-count-prd-entry.patch
+scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch
+usb-emi26-fix-oops-on-load.patch
--- /dev/null
+From a0fce792b55b260589c3d77293a224e84395ec07 Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Date: Mon, 29 Dec 2008 20:27:28 +0100
+Subject: tx4939ide: Do not use zero count PRD entry
+
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+commit a0fce792b55b260589c3d77293a224e84395ec07 upstream.
+
+This fixes data corruption on some heavy load.
+
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Cc: sshtylyov@ru.mvista.com
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/tx4939ide.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/ide/tx4939ide.c
++++ b/drivers/ide/tx4939ide.c
+@@ -259,6 +259,12 @@ static int tx4939ide_build_dmatable(ide_
+ bcount = 0x10000 - (cur_addr & 0xffff);
+ if (bcount > cur_len)
+ bcount = cur_len;
++ /*
++ * This workaround for zero count seems required.
++ * (standard ide_build_dmatable do it too)
++ */
++ if ((bcount & 0xffff) == 0x0000)
++ bcount = 0x8000;
+ *table++ = bcount & 0xffff;
+ *table++ = cur_addr;
+ cur_addr += bcount;
--- /dev/null
+From f26f6ceacaaf017a677138cbca7ab076b565ca87 Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Date: Mon, 29 Dec 2008 20:27:29 +0100
+Subject: tx493[89]ide: Fix length for __ide_flush_dcache_range
+
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+commit f26f6ceacaaf017a677138cbca7ab076b565ca87 upstream.
+
+This fixes data corruption on PIO mode.
+
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Cc: sshtylyov@ru.mvista.com
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/tx4938ide.c | 4 ++--
+ drivers/ide/tx4939ide.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/ide/tx4938ide.c
++++ b/drivers/ide/tx4938ide.c
+@@ -181,7 +181,7 @@ static void tx4938ide_input_data_swap(id
+
+ while (count--)
+ *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
+- __ide_flush_dcache_range((unsigned long)buf, count * 2);
++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
+ }
+
+ static void tx4938ide_output_data_swap(ide_drive_t *drive, struct request *rq,
+@@ -195,7 +195,7 @@ static void tx4938ide_output_data_swap(i
+ __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
+ ptr++;
+ }
+- __ide_flush_dcache_range((unsigned long)buf, count * 2);
++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
+ }
+
+ static const struct ide_tp_ops tx4938ide_tp_ops = {
+--- a/drivers/ide/tx4939ide.c
++++ b/drivers/ide/tx4939ide.c
+@@ -558,7 +558,7 @@ static void tx4939ide_input_data_swap(id
+
+ while (count--)
+ *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port));
+- __ide_flush_dcache_range((unsigned long)buf, count * 2);
++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
+ }
+
+ static void tx4939ide_output_data_swap(ide_drive_t *drive, struct request *rq,
+@@ -572,7 +572,7 @@ static void tx4939ide_output_data_swap(i
+ __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port);
+ ptr++;
+ }
+- __ide_flush_dcache_range((unsigned long)buf, count * 2);
++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2));
+ }
+
+ static const struct ide_tp_ops tx4939ide_tp_ops = {
--- /dev/null
+From 327d74f6b65ddc8a042c43c11fdd4be0bb354668 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Sun, 4 Jan 2009 13:25:13 +0100
+Subject: USB: emi26: fix oops on load
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 327d74f6b65ddc8a042c43c11fdd4be0bb354668 upstream.
+
+Fix oops introduced by commit ae93a55bf948753de0bb8e43fa9c027f786abb05
+(emi26: use request_firmware()):
+
+usb 1-1: new full speed USB device using uhci_hcd and address 2
+usb 1-1: configuration #1 chosen from 1 choice
+emi26 - firmware loader 1-1:1.0: emi26_probe start
+usb 1-1: firmware: requesting emi26/loader.fw
+usb 1-1: firmware: requesting emi26/bitstream.fw
+usb 1-1: firmware: requesting emi26/firmware.fw
+usb 1-1: emi26_set_reset - 1
+usb 1-1: emi26_set_reset - 0
+BUG: unable to handle kernel NULL pointer dereference at 00000000
+IP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26]
+*pde = 00000000
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading
+Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic
+
+Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG
+EIP: 0060:[<f80dc487>] EFLAGS: 00010206 CPU: 0
+EIP is at emi26_probe+0x2f7/0x620 [emi26]
+EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000
+ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc
+ DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000)
+Stack:
+ 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0
+ 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0
+ f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000
+Call Trace:
+ [<c01c6262>] sysfs_add_one+0x12/0x50
+ [<fbacb290>] usb_probe_interface+0xa0/0x140 [usbcore]
+ [<c01c70bf>] sysfs_create_link+0xf/0x20
+ [<c02dead2>] driver_probe_device+0x82/0x180
+ [<fbac9eeb>] usb_match_id+0x3b/0x50 [usbcore]
+ [<c02dec4e>] __driver_attach+0x7e/0x80
+ [<c02de27a>] bus_for_each_dev+0x3a/0x60
+ [<c02de956>] driver_attach+0x16/0x20
+ [<c02debd0>] __driver_attach+0x0/0x80
+ [<c02de7b1>] bus_add_driver+0x1a1/0x220
+ [<c02dee4d>] driver_register+0x4d/0x120
+ [<c024e622>] idr_get_empty_slot+0xf2/0x290
+ [<fbacab71>] usb_register_driver+0x81/0x100 [usbcore]
+ [<f806c000>] emi26_init+0x0/0x14 [emi26]
+ [<c0101126>] do_one_initcall+0x36/0x1b0
+ [<c01c5e70>] sysfs_ilookup_test+0x0/0x10
+ [<c0197a61>] ifind+0x31/0x90
+ [<c01c6229>] __sysfs_add_one+0x59/0x80
+ [<c01c64e4>] sysfs_addrm_finish+0x14/0x1c0
+ [<c0175ca3>] __vunmap+0xa3/0xd0
+ [<c014b854>] load_module+0x1544/0x1640
+ [<c014b9d7>] sys_init_module+0x87/0x1b0
+ [<c0187f41>] sys_read+0x41/0x70
+ [<c01032a5>] sysenter_do_call+0x12/0x21
+ [<c03d0000>] wait_for_common+0x40/0x110
+Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00
+EIP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc
+---[ end trace 2eefa13825431230 ]---
+
+After the last "package" of firmware data is sent to the device, we dereference
+NULL pointer (on access to rec->addr). Fix it.
+
+Reported--by: David Flatz <david@upcs.at>
+Tested-by: David Flatz <david@upcs.at>
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/emi26.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/emi26.c
++++ b/drivers/usb/misc/emi26.c
+@@ -160,7 +160,7 @@ static int emi26_load_firmware (struct u
+ err("%s - error loading firmware: error = %d", __func__, err);
+ goto wraperr;
+ }
+- } while (i > 0);
++ } while (rec);
+
+ /* Assert reset (stop the CPU in the EMI) */
+ err = emi26_set_reset(dev,1);
projects / thirdparty / kernel / stable-queue.git / commitdiff
