From: Greg Kroah-Hartman Date: Mon, 4 May 2009 21:28:14 +0000 (-0700) Subject: more .27 patches X-Git-Tag: v2.6.27.23~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3b599aafe1d0c847bc8d84e8f7113ae162ab3e38;p=thirdparty%2Fkernel%2Fstable-queue.git more .27 patches --- diff --git a/queue-2.6.27/b43-poison-rx-buffers.patch b/queue-2.6.27/b43-poison-rx-buffers.patch new file mode 100644 index 00000000000..cf222b9f7ed --- /dev/null +++ b/queue-2.6.27/b43-poison-rx-buffers.patch @@ -0,0 +1,118 @@ +From stable-bounces@linux.kernel.org Fri Apr 24 16:05:36 2009 +Date: Fri, 24 Apr 2009 16:05:31 GMT +Message-Id: <200904241605.n3OG5VSB008123@hera.kernel.org> +From: Michael Buesch +To: jejb@kernel.org, stable@kernel.org +Subject: b43: Poison RX buffers + +From: Michael Buesch + +upstream commit: ec9a1d8c13e36440eda0f3c79b8149080e3ab5ba + +This patch adds poisoning and sanity checking to the RX DMA buffers. +This is used for protection against buggy hardware/firmware that raises +RX interrupts without doing an actual DMA transfer. + +This mechanism protects against rare "bad packets" (due to uninitialized skb data) +and rare kernel crashes due to uninitialized RX headers. + +The poison is selected to not match on valid frames and to be cheap for checking. + +The poison check mechanism _might_ trigger incorrectly, if we are voluntarily +receiving frames with bad PLCP headers. However, this is nonfatal, because the +chance of such a match is basically zero and in case it happens it just results +in dropping the packet. +Bad-PLCP RX defaults to off, and you should leave it off unless you want to listen +to the latest news broadcasted by your microwave oven. + +This patch also moves the initialization of the RX-header "length" field in front of +the mapping of the DMA buffer. The CPU should not touch the buffer after we mapped it. + +Cc: stable@kernel.org +Reported-by: Francesco Gringoli +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/b43/dma.c | 37 +++++++++++++++++++++++++++++++++---- + 1 file changed, 33 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -551,11 +551,32 @@ address_error: + return 1; + } + ++static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb) ++{ ++ unsigned char *f = skb->data + ring->frameoffset; ++ ++ return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF); ++} ++ ++static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb) ++{ ++ struct b43_rxhdr_fw4 *rxhdr; ++ unsigned char *frame; ++ ++ /* This poisons the RX buffer to detect DMA failures. */ ++ ++ rxhdr = (struct b43_rxhdr_fw4 *)(skb->data); ++ rxhdr->frame_len = 0; ++ ++ B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2); ++ frame = skb->data + ring->frameoffset; ++ memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */); ++} ++ + static int setup_rx_descbuffer(struct b43_dmaring *ring, + struct b43_dmadesc_generic *desc, + struct b43_dmadesc_meta *meta, gfp_t gfp_flags) + { +- struct b43_rxhdr_fw4 *rxhdr; + dma_addr_t dmaaddr; + struct sk_buff *skb; + +@@ -564,6 +585,7 @@ static int setup_rx_descbuffer(struct b4 + skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags); + if (unlikely(!skb)) + return -ENOMEM; ++ b43_poison_rx_buffer(ring, skb); + dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0); + if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) { + /* ugh. try to realloc in zone_dma */ +@@ -574,6 +596,7 @@ static int setup_rx_descbuffer(struct b4 + skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags); + if (unlikely(!skb)) + return -ENOMEM; ++ b43_poison_rx_buffer(ring, skb); + dmaaddr = map_descbuffer(ring, skb->data, + ring->rx_buffersize, 0); + } +@@ -589,9 +612,6 @@ static int setup_rx_descbuffer(struct b4 + ring->ops->fill_descriptor(ring, desc, dmaaddr, + ring->rx_buffersize, 0, 0, 0); + +- rxhdr = (struct b43_rxhdr_fw4 *)(skb->data); +- rxhdr->frame_len = 0; +- + return 0; + } + +@@ -1484,6 +1504,15 @@ static void dma_rx(struct b43_dmaring *r + goto drop; + } + } ++ if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) { ++ /* Something went wrong with the DMA. ++ * The device did not touch the buffer and did not overwrite the poison. */ ++ b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n"); ++ /* recycle the descriptor buffer. */ ++ sync_descbuffer_for_device(ring, meta->dmaaddr, ++ ring->rx_buffersize); ++ goto drop; ++ } + if (unlikely(len > ring->rx_buffersize)) { + /* The data did not fit into one descriptor buffer + * and is split over multiple buffers. diff --git a/queue-2.6.27/b43-refresh-rx-poison-on-buffer-recycling.patch b/queue-2.6.27/b43-refresh-rx-poison-on-buffer-recycling.patch new file mode 100644 index 00000000000..db59ac8dbeb --- /dev/null +++ b/queue-2.6.27/b43-refresh-rx-poison-on-buffer-recycling.patch @@ -0,0 +1,81 @@ +From stable-bounces@linux.kernel.org Fri Apr 24 16:05:34 2009 +Date: Fri, 24 Apr 2009 16:05:29 GMT +Message-Id: <200904241605.n3OG5TGL008104@hera.kernel.org> +From: Michael Buesch +To: jejb@kernel.org, stable@kernel.org +Subject: b43: Refresh RX poison on buffer recycling + +From: Michael Buesch + +upstream commit: cf68636a9773aa97915497fe54fa4a51e3f08f3a + +The RX buffer poison needs to be refreshed, if we recycle an RX buffer, +because it might be (partially) overwritten by some DMA operations. + +Cc: stable@kernel.org +Cc: Francesco Gringoli +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/b43/dma.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -1498,20 +1498,16 @@ static void dma_rx(struct b43_dmaring *r + len = le16_to_cpu(rxhdr->frame_len); + } while (len == 0 && i++ < 5); + if (unlikely(len == 0)) { +- /* recycle the descriptor buffer. */ +- sync_descbuffer_for_device(ring, meta->dmaaddr, +- ring->rx_buffersize); +- goto drop; ++ dmaaddr = meta->dmaaddr; ++ goto drop_recycle_buffer; + } + } + if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) { + /* Something went wrong with the DMA. + * The device did not touch the buffer and did not overwrite the poison. */ + b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n"); +- /* recycle the descriptor buffer. */ +- sync_descbuffer_for_device(ring, meta->dmaaddr, +- ring->rx_buffersize); +- goto drop; ++ dmaaddr = meta->dmaaddr; ++ goto drop_recycle_buffer; + } + if (unlikely(len > ring->rx_buffersize)) { + /* The data did not fit into one descriptor buffer +@@ -1525,6 +1521,7 @@ static void dma_rx(struct b43_dmaring *r + while (1) { + desc = ops->idx2desc(ring, *slot, &meta); + /* recycle the descriptor buffer. */ ++ b43_poison_rx_buffer(ring, meta->skb); + sync_descbuffer_for_device(ring, meta->dmaaddr, + ring->rx_buffersize); + *slot = next_slot(ring, *slot); +@@ -1543,8 +1540,7 @@ static void dma_rx(struct b43_dmaring *r + err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC); + if (unlikely(err)) { + b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n"); +- sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize); +- goto drop; ++ goto drop_recycle_buffer; + } + + unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0); +@@ -1554,6 +1550,11 @@ static void dma_rx(struct b43_dmaring *r + b43_rx(ring->dev, skb, rxhdr); + drop: + return; ++ ++drop_recycle_buffer: ++ /* Poison and recycle the RX buffer. */ ++ b43_poison_rx_buffer(ring, skb); ++ sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize); + } + + void b43_dma_rx(struct b43_dmaring *ring) diff --git a/queue-2.6.27/forcedeth-fix-resume-from-hibernation-regression.patch b/queue-2.6.27/forcedeth-fix-resume-from-hibernation-regression.patch new file mode 100644 index 00000000000..4f4f0850ba3 --- /dev/null +++ b/queue-2.6.27/forcedeth-fix-resume-from-hibernation-regression.patch @@ -0,0 +1,33 @@ +From 35a7433c789ba6df6d96b70fa745ae9e6cac0038 Mon Sep 17 00:00:00 2001 +From: Ed Swierk +Date: Mon, 6 Apr 2009 17:49:12 -0700 +Subject: forcedeth: Fix resume from hibernation regression. + +From: Ed Swierk + +upstream commit: 35a7433c789ba6df6d96b70fa745ae9e6cac0038 + +Reset phy state on resume, fixing a regression caused by powering down +the phy on hibernate. + +Signed-off-by: Ed Swierk +Signed-off-by: David S. Miller +Cc: Tvrtko Ursulin +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/forcedeth.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -5967,6 +5967,9 @@ static int nv_resume(struct pci_dev *pde + for (i = 0;i <= np->register_size/sizeof(u32); i++) + writel(np->saved_config_space[i], base+i*sizeof(u32)); + ++ /* restore phy state, including autoneg */ ++ phy_init(dev); ++ + netif_device_attach(dev); + if (netif_running(dev)) { + rc = nv_open(dev); diff --git a/queue-2.6.27/series b/queue-2.6.27/series index a4aa12a171b..5957dc7b44d 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -1 +1,6 @@ drm-i915-add-support-for-g41-chipset.patch +virtio-rng-remove-false-bug-for-spurious-callbacks.patch +usb-unusual-device-support-for-gold-mp3-player-energy.patch +forcedeth-fix-resume-from-hibernation-regression.patch +b43-poison-rx-buffers.patch +b43-refresh-rx-poison-on-buffer-recycling.patch diff --git a/queue-2.6.27/usb-unusual-device-support-for-gold-mp3-player-energy.patch b/queue-2.6.27/usb-unusual-device-support-for-gold-mp3-player-energy.patch new file mode 100644 index 00000000000..9c9c7de85ee --- /dev/null +++ b/queue-2.6.27/usb-unusual-device-support-for-gold-mp3-player-energy.patch @@ -0,0 +1,49 @@ +From stable-bounces@linux.kernel.org Fri Apr 24 16:05:08 2009 +Date: Fri, 24 Apr 2009 16:05:04 GMT +Message-Id: <200904241605.n3OG54gX007660@hera.kernel.org> +From: Chuck Short +To: jejb@kernel.org, stable@kernel.org +Subject: USB: Unusual Device support for Gold MP3 Player Energy + +From: Chuck Short + +upstream commit: 46c6e93faa85d1362e1d127dc28cf9d0b304a6f1 + +Reported by Alessio Treglia on +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/125250 + +User was getting the following errors in dmesg: + +[ 2158.139386] sd 5:0:0:1: ioctl_internal_command return code = 8000002 +[ 2158.139390] : Current: sense key: No Sense +[ 2158.139393] Additional sense: No additional sense information + +Adds unusual device support. + +modified: drivers/usb/storage/unusual_devs.h + +Signed-off-by: Chuck Short +Signed-off-by: Tim Gardner +Signed-off-by: Stefan Bader +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Chris Wright +--- + drivers/usb/storage/unusual_devs.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2147,6 +2147,12 @@ UNUSUAL_DEV( 0xed06, 0x4500, 0x0001, 0x + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_CAPACITY_HEURISTICS), + ++/* Reported by Alessio Treglia */ ++UNUSUAL_DEV( 0xed10, 0x7636, 0x0001, 0x0001, ++ "TGE", ++ "Digital MP3 Audio Player", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), ++ + /* Control/Bulk transport for all SubClass values */ + USUAL_DEV(US_SC_RBC, US_PR_CB, USB_US_TYPE_STOR), + USUAL_DEV(US_SC_8020, US_PR_CB, USB_US_TYPE_STOR), diff --git a/queue-2.6.27/virtio-rng-remove-false-bug-for-spurious-callbacks.patch b/queue-2.6.27/virtio-rng-remove-false-bug-for-spurious-callbacks.patch new file mode 100644 index 00000000000..6a279a435e8 --- /dev/null +++ b/queue-2.6.27/virtio-rng-remove-false-bug-for-spurious-callbacks.patch @@ -0,0 +1,39 @@ +From chrisw@hera.kernel.org Fri Apr 24 15:37:55 2009 +Date: Fri, 24 Apr 2009 22:35:03 GMT +Message-Id: <200904242235.n3OMZ3Uq008747@hera.kernel.org> +From: Christian Borntraeger +To: jejb@kernel.org, stable@kernel.org +Subject: virtio-rng: Remove false BUG for spurious callbacks + +From: Christian Borntraeger + +upstream commit: e5b89542ea18020961882228c26db3ba87f6e608 + +The virtio-rng drivers checks for spurious callbacks. Since +callbacks can be implemented via shared interrupts (e.g. PCI) this +could lead to guest kernel oopses with lots of virtio devices. + +Signed-off-by: Christian Borntraeger +Cc: Rusty Russell +Cc: stable@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/hw_random/virtio-rng.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/hw_random/virtio-rng.c ++++ b/drivers/char/hw_random/virtio-rng.c +@@ -37,9 +37,9 @@ static void random_recv_done(struct virt + { + int len; + +- /* We never get spurious callbacks. */ ++ /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */ + if (!vq->vq_ops->get_buf(vq, &len)) +- BUG(); ++ return; + + data_left = len / sizeof(random_data[0]); + complete(&have_data);