From: Greg Kroah-Hartman Date: Wed, 14 Jan 2009 19:40:03 +0000 (-0800) Subject: 4 more .28 patches X-Git-Tag: v2.6.27.12~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8d40070f1aaf61e407fbc47a1132ddfb094cede7;p=thirdparty%2Fkernel%2Fstable-queue.git 4 more .28 patches --- diff --git a/queue-2.6.28/scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch b/queue-2.6.28/scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch new file mode 100644 index 00000000000..d00b9a416a2 --- /dev/null +++ b/queue-2.6.28/scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch @@ -0,0 +1,61 @@ +From 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e Mon Sep 17 00:00:00 2001 +From: FUJITA Tomonori +Date: Tue, 23 Dec 2008 04:01:35 +0900 +Subject: SCSI: eata: fix the data buffer accessors conversion regression + +From: FUJITA Tomonori + +commit 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e upstream. + +This fixes the regression introduced by the commit +58e2a02eb18393e76a469580fedf7caec190eb5e (eata: convert to use the +data buffer accessors), reported: + +http://marc.info/?t=122987621300006&r=1&w=2 + +- fix DMA_NONE handling in map_dma() + +- this driver can't use scsi_dma_map since host->shost_gendev.parent +is not set properly (it uses scsi_register). + +Signed-off-by: FUJITA Tomonori +Reported-by: Arthur Marsh +Tested-by: Arthur Marsh +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/eata.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/eata.c ++++ b/drivers/scsi/eata.c +@@ -1626,8 +1626,15 @@ static void map_dma(unsigned int i, stru + + cpp->sense_len = SCSI_SENSE_BUFFERSIZE; + +- count = scsi_dma_map(SCpnt); +- BUG_ON(count < 0); ++ if (!scsi_sg_count(SCpnt)) { ++ cpp->data_len = 0; ++ return; ++ } ++ ++ count = pci_map_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt), ++ pci_dir); ++ BUG_ON(!count); ++ + scsi_for_each_sg(SCpnt, sg, count, k) { + cpp->sglist[k].address = H2DEV(sg_dma_address(sg)); + cpp->sglist[k].num_bytes = H2DEV(sg_dma_len(sg)); +@@ -1655,7 +1662,9 @@ static void unmap_dma(unsigned int i, st + pci_unmap_single(ha->pdev, DEV2H(cpp->sense_addr), + DEV2H(cpp->sense_len), PCI_DMA_FROMDEVICE); + +- scsi_dma_unmap(SCpnt); ++ if (scsi_sg_count(SCpnt)) ++ pci_unmap_sg(ha->pdev, scsi_sglist(SCpnt), scsi_sg_count(SCpnt), ++ pci_dir); + + if (!DEV2H(cpp->data_len)) + pci_dir = PCI_DMA_BIDIRECTIONAL; diff --git a/queue-2.6.28/series b/queue-2.6.28/series index 7344c6622af..d584b41adf5 100644 --- a/queue-2.6.28/series +++ b/queue-2.6.28/series @@ -8,3 +8,7 @@ cifs-make-sure-that-dfs-pathnames-are-properly-formed.patch ring-buffer-prevent-false-positive-warning.patch ring-buffer-fix-dangling-commit-race.patch iwlwifi-use-gfp_kernel-to-allocate-rx-skb-memory.patch +tx493ide-fix-length-for-__ide_flush_dcache_range.patch +tx4939ide-do-not-use-zero-count-prd-entry.patch +scsi-eata-fix-the-data-buffer-accessors-conversion-regression.patch +usb-emi26-fix-oops-on-load.patch diff --git a/queue-2.6.28/tx4939ide-do-not-use-zero-count-prd-entry.patch b/queue-2.6.28/tx4939ide-do-not-use-zero-count-prd-entry.patch new file mode 100644 index 00000000000..058666a6031 --- /dev/null +++ b/queue-2.6.28/tx4939ide-do-not-use-zero-count-prd-entry.patch @@ -0,0 +1,35 @@ +From a0fce792b55b260589c3d77293a224e84395ec07 Mon Sep 17 00:00:00 2001 +From: Atsushi Nemoto +Date: Mon, 29 Dec 2008 20:27:28 +0100 +Subject: tx4939ide: Do not use zero count PRD entry + +From: Atsushi Nemoto + +commit a0fce792b55b260589c3d77293a224e84395ec07 upstream. + +This fixes data corruption on some heavy load. + +Signed-off-by: Atsushi Nemoto +Cc: sshtylyov@ru.mvista.com +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/tx4939ide.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/ide/tx4939ide.c ++++ b/drivers/ide/tx4939ide.c +@@ -259,6 +259,12 @@ static int tx4939ide_build_dmatable(ide_ + bcount = 0x10000 - (cur_addr & 0xffff); + if (bcount > cur_len) + bcount = cur_len; ++ /* ++ * This workaround for zero count seems required. ++ * (standard ide_build_dmatable do it too) ++ */ ++ if ((bcount & 0xffff) == 0x0000) ++ bcount = 0x8000; + *table++ = bcount & 0xffff; + *table++ = cur_addr; + cur_addr += bcount; diff --git a/queue-2.6.28/tx493ide-fix-length-for-__ide_flush_dcache_range.patch b/queue-2.6.28/tx493ide-fix-length-for-__ide_flush_dcache_range.patch new file mode 100644 index 00000000000..a55db0d5161 --- /dev/null +++ b/queue-2.6.28/tx493ide-fix-length-for-__ide_flush_dcache_range.patch @@ -0,0 +1,61 @@ +From f26f6ceacaaf017a677138cbca7ab076b565ca87 Mon Sep 17 00:00:00 2001 +From: Atsushi Nemoto +Date: Mon, 29 Dec 2008 20:27:29 +0100 +Subject: tx493[89]ide: Fix length for __ide_flush_dcache_range + +From: Atsushi Nemoto + +commit f26f6ceacaaf017a677138cbca7ab076b565ca87 upstream. + +This fixes data corruption on PIO mode. + +Signed-off-by: Atsushi Nemoto +Cc: sshtylyov@ru.mvista.com +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/tx4938ide.c | 4 ++-- + drivers/ide/tx4939ide.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/ide/tx4938ide.c ++++ b/drivers/ide/tx4938ide.c +@@ -181,7 +181,7 @@ static void tx4938ide_input_data_swap(id + + while (count--) + *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port)); +- __ide_flush_dcache_range((unsigned long)buf, count * 2); ++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2)); + } + + static void tx4938ide_output_data_swap(ide_drive_t *drive, struct request *rq, +@@ -195,7 +195,7 @@ static void tx4938ide_output_data_swap(i + __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port); + ptr++; + } +- __ide_flush_dcache_range((unsigned long)buf, count * 2); ++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2)); + } + + static const struct ide_tp_ops tx4938ide_tp_ops = { +--- a/drivers/ide/tx4939ide.c ++++ b/drivers/ide/tx4939ide.c +@@ -558,7 +558,7 @@ static void tx4939ide_input_data_swap(id + + while (count--) + *ptr++ = cpu_to_le16(__raw_readw((void __iomem *)port)); +- __ide_flush_dcache_range((unsigned long)buf, count * 2); ++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2)); + } + + static void tx4939ide_output_data_swap(ide_drive_t *drive, struct request *rq, +@@ -572,7 +572,7 @@ static void tx4939ide_output_data_swap(i + __raw_writew(le16_to_cpu(*ptr), (void __iomem *)port); + ptr++; + } +- __ide_flush_dcache_range((unsigned long)buf, count * 2); ++ __ide_flush_dcache_range((unsigned long)buf, roundup(len, 2)); + } + + static const struct ide_tp_ops tx4939ide_tp_ops = { diff --git a/queue-2.6.28/usb-emi26-fix-oops-on-load.patch b/queue-2.6.28/usb-emi26-fix-oops-on-load.patch new file mode 100644 index 00000000000..297f7c7b487 --- /dev/null +++ b/queue-2.6.28/usb-emi26-fix-oops-on-load.patch @@ -0,0 +1,92 @@ +From 327d74f6b65ddc8a042c43c11fdd4be0bb354668 Mon Sep 17 00:00:00 2001 +From: Marcin Slusarz +Date: Sun, 4 Jan 2009 13:25:13 +0100 +Subject: USB: emi26: fix oops on load + +From: Marcin Slusarz + +commit 327d74f6b65ddc8a042c43c11fdd4be0bb354668 upstream. + +Fix oops introduced by commit ae93a55bf948753de0bb8e43fa9c027f786abb05 +(emi26: use request_firmware()): + +usb 1-1: new full speed USB device using uhci_hcd and address 2 +usb 1-1: configuration #1 chosen from 1 choice +emi26 - firmware loader 1-1:1.0: emi26_probe start +usb 1-1: firmware: requesting emi26/loader.fw +usb 1-1: firmware: requesting emi26/bitstream.fw +usb 1-1: firmware: requesting emi26/firmware.fw +usb 1-1: emi26_set_reset - 1 +usb 1-1: emi26_set_reset - 0 +BUG: unable to handle kernel NULL pointer dereference at 00000000 +IP: [] emi26_probe+0x2f7/0x620 [emi26] +*pde = 00000000 +Oops: 0000 [#1] SMP +last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading +Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic + +Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG +EIP: 0060:[] EFLAGS: 00010206 CPU: 0 +EIP is at emi26_probe+0x2f7/0x620 [emi26] +EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000 +ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc + DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 +Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000) +Stack: + 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0 + 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0 + f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000 +Call Trace: + [] sysfs_add_one+0x12/0x50 + [] usb_probe_interface+0xa0/0x140 [usbcore] + [] sysfs_create_link+0xf/0x20 + [] driver_probe_device+0x82/0x180 + [] usb_match_id+0x3b/0x50 [usbcore] + [] __driver_attach+0x7e/0x80 + [] bus_for_each_dev+0x3a/0x60 + [] driver_attach+0x16/0x20 + [] __driver_attach+0x0/0x80 + [] bus_add_driver+0x1a1/0x220 + [] driver_register+0x4d/0x120 + [] idr_get_empty_slot+0xf2/0x290 + [] usb_register_driver+0x81/0x100 [usbcore] + [] emi26_init+0x0/0x14 [emi26] + [] do_one_initcall+0x36/0x1b0 + [] sysfs_ilookup_test+0x0/0x10 + [] ifind+0x31/0x90 + [] __sysfs_add_one+0x59/0x80 + [] sysfs_addrm_finish+0x14/0x1c0 + [] __vunmap+0xa3/0xd0 + [] load_module+0x1544/0x1640 + [] sys_init_module+0x87/0x1b0 + [] sys_read+0x41/0x70 + [] sysenter_do_call+0x12/0x21 + [] wait_for_common+0x40/0x110 +Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00 +EIP: [] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc +---[ end trace 2eefa13825431230 ]--- + +After the last "package" of firmware data is sent to the device, we dereference +NULL pointer (on access to rec->addr). Fix it. + +Reported--by: David Flatz +Tested-by: David Flatz +Signed-off-by: Marcin Slusarz +Cc: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/emi26.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/emi26.c ++++ b/drivers/usb/misc/emi26.c +@@ -160,7 +160,7 @@ static int emi26_load_firmware (struct u + err("%s - error loading firmware: error = %d", __func__, err); + goto wraperr; + } +- } while (i > 0); ++ } while (rec); + + /* Assert reset (stop the CPU in the EMI) */ + err = emi26_set_reset(dev,1);