--- /dev/null
+From lrodriguez@Atheros.com Tue Dec 2 16:09:29 2008
+From: "Luis R. Rodriguez" <lrodriguez@Atheros.com>
+Date: Tue, 2 Dec 2008 12:51:21 -0800
+Subject: ath9k: correct expected max RX buffer size
+To: <stable@kernel.org>
+Cc: <sfr@canb.auug.org.au>, <ath9k-devel@venema.h4ckr.net>, "Luis R. Rodriguez" <lrodriguez@Atheros.com>, Bennyam Malavazi <Bennyam.Malavazi@Atheros.com>
+Message-ID: <1228251082-11677-3-git-send-email-lrodriguez@atheros.com>
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit b4b6cda2298b0c9a0af902312184b775b8867c65 upstream
+
+We should only tell the hardware its capable of DMA'ing
+to us only what we asked dev_alloc_skb(). Prior to this
+it is possible a large RX'd frame could have corrupted
+DMA data but for us but we were saved only because we
+were previously also pci_map_single()'ing the same large
+value. The issue prior to this though was we were unmapping
+a smaller amount which the prior DMA patch fixed.
+
+Signed-off-by: Bennyam Malavazi <Bennyam.Malavazi@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/recv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath9k/recv.c
++++ b/drivers/net/wireless/ath9k/recv.c
+@@ -52,7 +52,7 @@ static void ath_rx_buf_link(struct ath_s
+ /* setup rx descriptors */
+ ath9k_hw_setuprxdesc(ah,
+ ds,
+- skb_tailroom(skb), /* buffer size */
++ sc->sc_rxbufsize,
+ 0);
+
+ if (sc->sc_rxlink == NULL)
--- /dev/null
+From lrodriguez@Atheros.com Tue Dec 2 16:08:24 2008
+From: "Luis R. Rodriguez" <lrodriguez@Atheros.com>
+Date: Tue, 2 Dec 2008 12:51:20 -0800
+Subject: ath9k: Fix SW-IOMMU bounce buffer starvation
+To: <stable@kernel.org>
+Cc: <sfr@canb.auug.org.au>, <ath9k-devel@venema.h4ckr.net>, "Luis R. Rodriguez" <lrodriguez@Atheros.com>, Maciej Zenczykowski <zenczykowski@gmail.com>, Bennyam Malavazi <Bennyam.Malavazi@Atheros.com>
+Message-ID: <1228251082-11677-2-git-send-email-lrodriguez@atheros.com>
+
+From: Luis R. Rodriguez <lrodriguez@Atheros.com>
+
+commit ca0c7e5101fd4f37fed8e851709f08580b92fbb3 upstream.
+
+This should fix the SW-IOMMU bounce buffer starvation
+seen ok kernel.org bugzilla 11811:
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11811
+
+Users on MacBook Pro 3.1/MacBook v2 would see something like:
+
+DMA: Out of SW-IOMMU space for 4224 bytes at device 0000:0b:00.0
+
+Unfortunately its only easy to trigger on MacBook Pro 3.1/MacBook v2
+so far so its difficult to debug (even with swiotlb=force).
+
+We were pci_unmap_single()'ing less bytes than what we called
+for with pci_map_single() and as such we were starving
+the swiotlb from its 64MB amount of bounce buffers. We remain
+consistent and now always use sc->rxbufsize for RX. While at
+it we update the beacon DMA maps as well to only use the data
+portion of the skb, previous to this we were pci_map_single()'ing
+more data for beaconing than what we tell the hardware it can use,
+therefore pushing more iotlb abuse.
+
+Still not sure why this is so easily triggerable on
+MacBook Pro 3.1, it may be the hardware configuration
+tends to use more memory > 3GB mark for DMA.
+
+Signed-off-by: Maciej Zenczykowski <zenczykowski@gmail.com>
+Signed-off-by: Bennyam Malavazi <Bennyam.Malavazi@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath9k/recv.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath9k/recv.c
++++ b/drivers/net/wireless/ath9k/recv.c
+@@ -1011,7 +1011,7 @@ int ath_rx_tasklet(struct ath_softc *sc,
+
+ pci_dma_sync_single_for_cpu(sc->pdev,
+ bf->bf_buf_addr,
+- skb_tailroom(skb),
++ sc->sc_rxbufsize,
+ PCI_DMA_FROMDEVICE);
+ pci_unmap_single(sc->pdev,
+ bf->bf_buf_addr,
+@@ -1303,8 +1303,7 @@ dma_addr_t ath_skb_map_single(struct ath
+ * NB: do NOT use skb->len, which is 0 on initialization.
+ * Use skb's entire data area instead.
+ */
+- *pa = pci_map_single(sc->pdev, skb->data,
+- skb_end_pointer(skb) - skb->head, direction);
++ *pa = pci_map_single(sc->pdev, skb->data, sc->sc_rxbufsize, direction);
+ return *pa;
+ }
+
+@@ -1314,6 +1313,5 @@ void ath_skb_unmap_single(struct ath_sof
+ dma_addr_t *pa)
+ {
+ /* Unmap skb's entire data area */
+- pci_unmap_single(sc->pdev, *pa,
+- skb_end_pointer(skb) - skb->head, direction);
++ pci_unmap_single(sc->pdev, *pa, sc->sc_rxbufsize, direction);
+ }