debian-packaging
/
linux
8
0
Fork 0
Code Releases Activity

Merge /dists/sid/linux-2.6 (2.6.32-12). 

svn path=/dists/trunk/linux-2.6/; revision=15620
This commit is contained in:
Ben Hutchings 2010-05-04 02:55:51 +00:00
parent c35ba993cc
commit 28817f7dbd
44 changed files with 15717 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
debian/changelog vendored
View File

@ -108,6 +108,92 @@ linux-2.6 (2.6.33-1~experimental.1) experimental; urgency=low
-- maximilian attems <maks@debian.org> Thu, 25 Feb 2010 15:21:38 +0100
linux-2.6 (2.6.32-12) unstable; urgency=low
* The "Microwave Background" release
[ Ben Hutchings ]
* Prepare debconf templates for translation. (closes: #576758)
* [x86] PCI/forcedeth: Disable MSI for MCP55 on P5N32-E SLI
(Closes: #552299)
* phylib: Fix typo in bcm63xx PHY driver table
* linux-base: Fix bugs and improve libata transition code:
- Fix scope of _system() function (Closes: #576925)
- Fix case where a file may wrongly be listed as automatically converted
(Closes: #577047)
- Check device IDs in mdadm.conf rather than assuming it needs manual
conversion
- Use vol_id if available since the version of blkid in lenny does not
support the output format we need (Closes: #576608)
- Fix missing line breaks in updated crypttab (Closes: #577735)
* i915: Stop trying to use ACPI lid status to determine LVDS connection
(Closes: #577724)
* forcedeth: Fix hardware version check for TX bug workaround
(Closes: #572201)
* rndis_host: Poll status channel before control channel (Closes: #576929)
* megaraid_sas: Fix copying of sense data for 32-bit management tools on
64-bit kernel (Closes: #578398)
* Add ipheth driver for iPhone tethering
* virtio_net: Make delayed refill more reliable (Closes: #576838)
[ maximilian attems]
* [ia64] Built in fbcon.
* Update openvz patch to c05f95fcb04e. (closes: #574598)
* Reenable nouveau autoloading.
* reiserfs: Fix permissions on .reiserfs_priv. CVE-2010-1146
* libata,ata_piix: detect and clear spurious IRQs.
* libata/SCSI: fix locking around blk_abort_request().
* topconfig enable NET_DROP_MONITOR. (closes: #578568)
* Add stable 2.6.32.12:
- ACPI: EC: Allow multibyte access to EC; fixes temperature monitoring
on some Dell laptops (Closes: #563313)
- [x86] KVM: disable paravirt mmu reporting (Closes: #573071)
- thinkpad-acpi: lock down video output state access (Closes: #565790)
- xfs update (closes: #579410)
* Add drm changes from stable 2.6.33.3:
- drm/radeon: R300 AD only has one quad pipe (Closes: #575681)
* libata: Fix accesses at LBA28 boundary (old bug, but nasty) (v2)
* Add EC path for Thinkpad X100.
* Bump ABI to 5, apply:
- hrtimer: Tune hrtimer_interrupt hang logic
* Add libata TRIM support.
* Backport radeon r800 modesetting support.
* drm/radeon/kms: further spread spectrum fixes.
* Backport p54 fixes.
* net: export device speed and duplex via sysfs.
* postrm: rm modules.softdep. (closes: #579175)
* Backport KVM: Xen PV-on-HVM guest support.
* Backport KVM: x86: Add KVM_GET/SET_VCPU_EVENTS.
* hugetlb: fix infinite loop in get_futex_key() when backed by huge pages
* ext4: Issue the discard operation *before* releasing the blocks to be
reused.
* libiscsi: regression: fix header digest errors.
* Revert module.c and module.h changes from -stable update.
[ dann frazier ]
* Add DRBD backport
* sctp: Fix skb_over_panic resulting from multiple invalid parameter
errors (CVE-2010-1173)
* [CIFS] Allow null nd (as nfs server uses) on create (CVE-2010-1148)
* tipc: Fix oops on send prior to entering networked mode (CVE-2010-1187)
* [powerpc] KGDB: don't needlessly skip PAGE_USER test for Fsl booke
Note: KGDB is not currently enabled in debian builds (CVE-2010-1446)
[ Aurelien Jarno ]
* [sh4] Add a sh7751r flavour.
* [mips/*malta] Remove options that are present in topconfig.
[ Martin Michlmayr ]
* dns323-setup.c: fix WARN() when booting (Arnaud Patard).
* mips: enable PATA platform on SWARM and LITTLESUR (Sebastian Andrzej
Siewior).
* [mips/sb1-bcm91250a] Enable PATA_PLATFORM.
[ Bastian Blank ]
* Update Xen patch.
-- Ben Hutchings <ben@decadent.org.uk> Sat, 01 May 2010 02:58:31 +0100
linux-2.6 (2.6.32-11) unstable; urgency=low
[ Ben Hutchings ]

3
debian/config/config vendored
View File

@ -1648,6 +1648,7 @@ CONFIG_USB_NET_ZAURUS=m
CONFIG_USB_HSO=m
CONFIG_USB_NET_INT51X1=m
CONFIG_USB_CDC_PHONET=m
CONFIG_USB_IPHETH=m
##
## file: drivers/net/wan/Kconfig
@ -3417,7 +3418,7 @@ CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=y
CONFIG_NET_PKTGEN=m
# CONFIG_NET_DROP_MONITOR is not set
CONFIG_NET_DROP_MONITOR=y
CONFIG_WIRELESS=y
##

2
debian/config/ia64/config vendored
View File

@ -700,7 +700,7 @@ CONFIG_FB_TRIDENT=m
## file: drivers/video/console/Kconfig
##
CONFIG_VGA_CONSOLE=y
CONFIG_FRAMEBUFFER_CONSOLE=m
CONFIG_FRAMEBUFFER_CONSOLE=y
# CONFIG_FONTS is not set
CONFIG_FONT_8x8=y
CONFIG_FONT_8x16=y

1
debian/config/mips/config.sb1-bcm91250a vendored
View File

@ -136,6 +136,7 @@ CONFIG_SATA_SIS=m
CONFIG_SATA_ULI=m
CONFIG_SATA_VIA=m
CONFIG_SATA_VITESSE=m
CONFIG_PATA_PLATFORM=y
##
## file: drivers/block/Kconfig

266
debian/config/sh4/config.sh7751r vendored Normal file
View File

@ -0,0 +1,266 @@
#
# System type
#
CONFIG_CPU_SUBTYPE_SH7751R=y
#
# Memory management options
#
CONFIG_QUICKLIST=y
CONFIG_MMU=y
CONFIG_PAGE_OFFSET=0x80000000
CONFIG_FORCE_MAX_ZONEORDER=11
CONFIG_MEMORY_START=0x0c000000
CONFIG_MEMORY_SIZE=0x04000000
CONFIG_29BIT=y
CONFIG_VSYSCALL=y
CONFIG_ARCH_FLATMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_DEFAULT=y
CONFIG_MAX_ACTIVE_REGIONS=1
CONFIG_ARCH_POPULATES_NODE_MAP=y
CONFIG_ARCH_SELECT_MEMORY_MODEL=y
CONFIG_PAGE_SIZE_4KB=y
CONFIG_SELECT_MEMORY_MODEL=y
CONFIG_FLATMEM_MANUAL=y
CONFIG_FLATMEM=y
CONFIG_FLAT_NODE_MEM_MAP=y
CONFIG_SPARSEMEM_STATIC=y
CONFIG_PAGEFLAGS_EXTENDED=y
CONFIG_SPLIT_PTLOCK_CPUS=4
CONFIG_ZONE_DMA_FLAG=0
CONFIG_NR_QUICK=2
CONFIG_HAVE_MLOCK=y
CONFIG_HAVE_MLOCKED_PAGE_BIT=y
#
# Processor features
#
CONFIG_CPU_LITTLE_ENDIAN=y
CONFIG_SH_FPU=y
CONFIG_CPU_HAS_INTEVT=y
CONFIG_CPU_HAS_SR_RB=y
CONFIG_CPU_HAS_FPU=y
#
# Board support
#
CONFIG_SH_RTS7751R2D=y
#
# RTS7751R2D Board Revision
#
CONFIG_RTS7751R2D_PLUS=y
CONFIG_RTS7751R2D_1=y
#
# Timer and clock configuration
#
CONFIG_SH_TIMER_TMU=y
CONFIG_SH_PCLK_FREQ=60000000
CONFIG_SH_CLK_CPG=y
CONFIG_SH_CLK_CPG_LEGACY=y
CONFIG_TICK_ONESHOT=y
CONFIG_NO_HZ=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
#
# Boot options
#
CONFIG_ZERO_PAGE_OFFSET=0x00010000
CONFIG_BOOT_LINK_OFFSET=0x009e0000
CONFIG_ENTRY_OFFSET=0x00001000
#
# Bus options
#
CONFIG_PCI=y
CONFIG_SH_PCIDMA_NONCOHERENT=y
#
# Generic Driver Options
#
CONFIG_MTD=y
CONFIG_MTD_CONCAT=y
CONFIG_MTD_PARTITIONS=y
#
# User Modules And Translation Layers
#
CONFIG_MTD_CHAR=y
CONFIG_MTD_BLKDEVS=y
CONFIG_MTD_BLOCK=y
#
# RAM/ROM/Flash chip drivers
#
CONFIG_MTD_CFI=y
CONFIG_MTD_GEN_PROBE=y
CONFIG_MTD_MAP_BANK_WIDTH_1=y
CONFIG_MTD_MAP_BANK_WIDTH_2=y
CONFIG_MTD_MAP_BANK_WIDTH_4=y
CONFIG_MTD_CFI_I1=y
CONFIG_MTD_CFI_I2=y
CONFIG_MTD_CFI_AMDSTD=y
CONFIG_MTD_CFI_UTIL=y
#
# Mapping drivers for chip access
#
CONFIG_MTD_PHYSMAP=y
#
# UBI - Unsorted block images
#
CONFIG_HAVE_IDE=y
#
# SCSI device support
#
CONFIG_SCSI=y
CONFIG_SCSI_DMA=y
#
# SCSI support type (disk, tape, CD-ROM)
#
CONFIG_BLK_DEV_SD=y
#
# SCSI Transports
#
CONFIG_ATA=y
CONFIG_ATA_VERBOSE_ERROR=y
CONFIG_SATA_PMP=y
CONFIG_ATA_SFF=y
CONFIG_PATA_PLATFORM=y
# net device
CONFIG_NETDEVICES=y
CONFIG_MII=y
CONFIG_NET_ETHERNET=y
CONFIG_NET_PCI=y
CONFIG_8139CP=y
#
# Input device support
#
CONFIG_INPUT=y
#
# Input Device Drivers
#
CONFIG_INPUT_KEYBOARD=y
#
# Character devices
#
CONFIG_VT=y
CONFIG_CONSOLE_TRANSLATIONS=y
CONFIG_VT_CONSOLE=y
CONFIG_HW_CONSOLE=y
CONFIG_VT_HW_CONSOLE_BINDING=y
#
# Non-8250 serial port support
#
CONFIG_SERIAL_SH_SCI=y
CONFIG_SERIAL_SH_SCI_NR_UARTS=6
CONFIG_SERIAL_SH_SCI_CONSOLE=y
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
CONFIG_DEVPORT=y
#
# SPI Master Controller Drivers
#
CONFIG_SPI=y
CONFIG_SPI_MASTER=y
CONFIG_SPI_BITBANG=y
CONFIG_SPI_SH_SCI=y
#
# Multifunction device drivers
#
CONFIG_MFD_SM501=y
#
# Graphics support
#
CONFIG_FB=y
CONFIG_FB_CFB_FILLRECT=y
CONFIG_FB_CFB_COPYAREA=y
CONFIG_FB_CFB_IMAGEBLIT=y
#
# Frame buffer hardware drivers
#
CONFIG_FB_SM501=y
#
# Console display driver support
#
CONFIG_DUMMY_CONSOLE=y
CONFIG_FRAMEBUFFER_CONSOLE=y
CONFIG_FONT_8x8=y
CONFIG_FONT_8x16=y
CONFIG_LOGO=y
CONFIG_LOGO_SUPERH_MONO=y
CONFIG_LOGO_SUPERH_VGA16=y
CONFIG_LOGO_SUPERH_CLUT224=y
CONFIG_HID_SUPPORT=y
CONFIG_HID=y
#
# USB Input Devices
#
CONFIG_USB_HID=y
#
# USB Host
#
CONFIG_USB_SUPPORT=y
CONFIG_USB=y
#
# Miscellaneous USB options
#
CONFIG_USB_DEVICE_CLASS=y
#
# USB Host Controller Drivers
#
CONFIG_USB_OHCI_HCD=y
CONFIG_USB_OHCI_LITTLE_ENDIAN=y
#
# RTC
#
CONFIG_RTC_LIB=y
CONFIG_RTC_CLASS=y
CONFIG_RTC_HCTOSYS=y
CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
#
# RTC interfaces
#
CONFIG_RTC_INTF_SYSFS=y
CONFIG_RTC_INTF_PROC=y
CONFIG_RTC_INTF_DEV=y
#
# SPI RTC drivers
#
CONFIG_RTC_DRV_R9701=y
#
# on-CPU RTC drivers
#
# CONFIG_RTC_DRV_SH is not set
# CONFIG_RTC_DRV_GENERIC is not set
#
# File systems
#
CONFIG_EXT3_FS=y

8
debian/config/sh4/defines vendored
View File

@ -1,11 +1,19 @@
[base]
flavours:
sh7751r
sh7785lcr
kernel-arch: sh
[image]
suggests: fdutils
[sh7751r_build]
image-file: arch/sh/boot/zImage
[sh7751r_description]
hardware: sh7751r
hardware-long: Renesas SH7751R R2D plus board
[sh7785lcr_build]
image-file: arch/sh/boot/zImage

80
debian/linux-base.postinst vendored
View File

@ -53,6 +53,9 @@ package DebianKernel::DiskId;
### utility
# Import _system() function
*_system = \&main::_system;
sub id_to_path {
my ($id) = @_;
$id =~ m|^/|
@ -881,7 +884,8 @@ sub cryptsetup_update {
my ($text, $dst, $src, $key, $opts) = cryptsetup_next($old);
last unless defined($text);
if (defined($src) && defined($map->{$src})) {
$text = "# $text" . join(' ', $dst, $map->{$src}, $key, $opts);
$text = "# $text" .
join(' ', $dst, $map->{$src}, $key, $opts) . "\n";
}
$new->print($text);
}
@ -904,6 +908,25 @@ sub hdparm_list {
return @results;
}
### mdadm
sub mdadm_list {
my ($file) = @_;
my (@results) = ();
while (<$file>) {
# Look for DEVICE (case-insensitive, may be abbreviated to as
# little as 3 letters) followed by a whitespace-separated list
# of devices (or wildcards, or keywords!). Ignore comments
# (hash preceded by whitespace).
if (/^DEV(?:I(?:C(?:E)?)?)?[ \t]*((?:[^ \t]|[ \t][^#])*)/i) {
push @results, split(/[ \t]+/, $1);
}
}
return @results;
}
### list of all configuration files and functions
my @config_files = ({packages => 'mount',
@ -984,7 +1007,8 @@ my @config_files = ({packages => 'mount',
# mdadm.conf requires manual update because it may
# contain wildcards.
{packages => 'mdadm',
path => '/etc/mdadm/mdadm.conf'},
path => '/etc/mdadm/mdadm.conf',
list => \&mdadm_list},
# hdparm.conf requires manual update because it
# (1) refers to whole disks (2) might not work
# properly with the new drivers (3) is in a very
@ -1170,8 +1194,11 @@ sub scan_config_files {
$needs_update = defined($id_map_text) && $id_map_text ne '';
} elsif (exists($config->{list})) {
for my $bdev (&{$config->{list}}($file)) {
if ($bdev =~ m{^/dev/(?:[hs]d[a-z]\d*|s(?:cd|r)\d+)$} &&
-b $bdev) {
# Match standard IDE and SCSI device names, plus wildcards
# in disk device names to allow for mdadm insanity.
if ($bdev =~ m{^/dev/(?:[hs]d[a-z\?\*][\d\?\*]*|
s(?:cd|r)\d+)$}x &&
($bdev =~ m/[\?\*]/ || -b $bdev)) {
$bdev_map{$bdev} = {};
push @matched_bdevs, $bdev;
}
@ -1219,10 +1246,16 @@ sub add_tag {
}
sub scan_devices {
my $id_command;
if (-x '/sbin/vol_id') {
$id_command = '/sbin/vol_id';
} else {
$id_command = 'blkid -o udev -s LABEL -s UUID';
}
for (`blkid -o device`) {
chomp;
my $bdev = $_;
for (`blkid -o udev -s LABEL -s UUID '$bdev'`) {
for (`$id_command '$bdev'`) {
if (/^ID_FS_(LABEL|UUID)_ENC=(.+)\n$/) {
add_tag($bdev, $1, $2);
}
@ -1232,12 +1265,13 @@ sub scan_devices {
# Discard all labels and UUIDs(!) that are ambiguous.
# Discard all labels with 'unsafe' characters (escaped by blkid using
# backslashes) as they will not be usable in all configuration files.
# Similarly for '#' which blkid surprisingly does not consider unsafe.
# Sort each device's IDs in reverse lexical order so that UUIDs are
# preferred.
for my $bdev (keys(%bdev_map)) {
@{$bdev_map{$bdev}->{ids}} =
sort({$b cmp $a}
grep({ @{$id_map{$_}} == 1 && $_ !~ /\\/ }
grep({ @{$id_map{$_}} == 1 && $_ !~ /[\\#]/ }
@{$bdev_map{$bdev}->{ids}}));
}
@ -1341,10 +1375,7 @@ sub set_new_ids {
}
sub update_config {
my %map;
for my $bdev (keys(%bdev_map)) {
$map{$bdev} = $bdev_map{$bdev}->{ids}->[0];
}
my $map = shift;
for my $match (@_) {
# Generate a new config
@ -1353,7 +1384,7 @@ sub update_config {
my $new = new FileHandle("$path.new", POSIX::O_WRONLY | POSIX::O_CREAT,
0600)
or die "$!";
&{$match->{config}->{update}}($old, $new, \%map);
&{$match->{config}->{update}}($old, $new, $map);
$old->close();
$new->close();
@ -1386,6 +1417,7 @@ sub transition {
my @auto_configs = grep({defined($_->{config}->{update})} @matched_configs);
my $found_boot_loader =
grep({$_->{config}->{is_boot_loader} && $_->{installed}} @found_configs);
my %update_map = ();
# We can skip all of this if we didn't find any configuration
# files that need conversion and we found the configuration file
@ -1412,6 +1444,22 @@ sub transition {
scan_devices();
assign_new_ids();
# Construct the device ID update map
for my $bdev (keys(%bdev_map)) {
if (@{$bdev_map{$bdev}->{ids}}) {
$update_map{$bdev} = $bdev_map{$bdev}->{ids}->[0];
}
}
# Weed out configurations which will be unaffected by this
# mapping or by a custom mapping described in id_map_text.
@auto_configs = grep({ defined($_->{id_map_text}) ||
grep({exists($update_map{$_})}
@{$_->{devices}}) }
@auto_configs);
}
if (@auto_configs && $answer eq 'true') {
if (grep({$bdev_map{$_}->{new_id}} keys(%bdev_map))) {
$question = 'linux-base/disk-id-convert-plan';
($ret, $seen) = subst($question, 'relabel',
@ -1426,9 +1474,8 @@ sub transition {
}
($ret, $seen) = subst($question, 'id_map',
join("\\n",
map({sprintf("%s: %s", $_, $bdev_map{$_}->{ids}->[0])}
grep({@{$bdev_map{$_}->{ids}}}
keys(%bdev_map))),
map({sprintf("%s: %s", $_, $update_map{$_})}
keys(%update_map)),
grep({defined}
map({$_->{id_map_text}} @auto_configs))));
die "Error setting debconf substitutions in $question: $seen" if $ret;
@ -1449,7 +1496,7 @@ sub transition {
if ($answer eq 'true') {
set_new_ids();
update_config(@auto_configs);
update_config(\%update_map, @auto_configs);
}
}
@ -1458,8 +1505,7 @@ sub transition {
if (!defined($match->{config}->{update})) {
push @unconv_files, $match->{config}->{path};
} else {
my @unconv_bdevs = grep({!exists($bdev_map{$_}->{ids}) ||
@{$bdev_map{$_}->{ids}} == 0}
my @unconv_bdevs = grep({!exists($update_map{$_})}
@{$match->{devices}});
if (@unconv_bdevs) {
push @unconv_files, sprintf('%s: %s', $match->{config}->{path},

84
debian/patches/bugfix/all/block-blk_abort_request-lock-fix.patch vendored Normal file
View File

@ -0,0 +1,84 @@
From: Tejun Heo <teheo@suse.de>
Subject: libata/SCSI: fix locking around blk_abort_request()
References: bnc#585927
Patch-mainline: submitted for 2.6.34-rc5 and stable (as two patches)
blk_abort_request() expects queue lock to be held by the caller.
Grab it before calling the function.
Lack of this synchronization led to infinite loop on corrupt
q->timeout_list.
Signed-off-by: Tejun Heo <teheo@suse.de>
---
drivers/ata/libata-eh.c | 4 ++++
drivers/scsi/libsas/sas_ata.c | 4 ++++
drivers/scsi/libsas/sas_scsi_host.c | 4 ++++
3 files changed, 12 insertions(+)
Index: linux-2.6.32-SLE11-SP1/drivers/ata/libata-eh.c
===================================================================
--- linux-2.6.32-SLE11-SP1.orig/drivers/ata/libata-eh.c
+++ linux-2.6.32-SLE11-SP1/drivers/ata/libata-eh.c
@@ -870,6 +870,8 @@ static void ata_eh_set_pending(struct at
void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
{
struct ata_port *ap = qc->ap;
+ struct request_queue *q = qc->scsicmd->device->request_queue;
+ unsigned long flags;
WARN_ON(!ap->ops->error_handler);
@@ -881,7 +883,9 @@ void ata_qc_schedule_eh(struct ata_queue
* Note that ATA_QCFLAG_FAILED is unconditionally set after
* this function completes.
*/
+ spin_lock_irqsave(q->queue_lock, flags);
blk_abort_request(qc->scsicmd->request);
+ spin_unlock_irqrestore(q->queue_lock, flags);
}
/**
Index: linux-2.6.32-SLE11-SP1/drivers/scsi/libsas/sas_ata.c
===================================================================
--- linux-2.6.32-SLE11-SP1.orig/drivers/scsi/libsas/sas_ata.c
+++ linux-2.6.32-SLE11-SP1/drivers/scsi/libsas/sas_ata.c
@@ -394,11 +394,15 @@ int sas_ata_init_host_and_port(struct do
void sas_ata_task_abort(struct sas_task *task)
{
struct ata_queued_cmd *qc = task->uldd_task;
+ struct request_queue *q = qc->scsicmd->device->request_queue;
struct completion *waiting;
+ unsigned long flags;
/* Bounce SCSI-initiated commands to the SCSI EH */
if (qc->scsicmd) {
+ spin_lock_irqsave(q->queue_lock, flags);
blk_abort_request(qc->scsicmd->request);
+ spin_unlock_irqrestore(q->queue_lock, flags);
scsi_schedule_eh(qc->scsicmd->device->host);
return;
}
Index: linux-2.6.32-SLE11-SP1/drivers/scsi/libsas/sas_scsi_host.c
===================================================================
--- linux-2.6.32-SLE11-SP1.orig/drivers/scsi/libsas/sas_scsi_host.c
+++ linux-2.6.32-SLE11-SP1/drivers/scsi/libsas/sas_scsi_host.c
@@ -1029,6 +1029,8 @@ int __sas_task_abort(struct sas_task *ta
void sas_task_abort(struct sas_task *task)
{
struct scsi_cmnd *sc = task->uldd_task;
+ struct request_queue *q = sc->device->request_queue;
+ unsigned long flags;
/* Escape for libsas internal commands */
if (!sc) {
@@ -1043,7 +1045,9 @@ void sas_task_abort(struct sas_task *tas
return;
}
+ spin_lock_irqsave(q->queue_lock, flags);
blk_abort_request(sc->request);
+ spin_unlock_irqrestore(q->queue_lock, flags);
scsi_schedule_eh(sc->device->host);
}

127
debian/patches/bugfix/all/cifs-allow-null-nd-on-create.patch vendored Normal file
View File

@ -0,0 +1,127 @@
[CIFS] Allow null nd (as nfs server uses) on create
While creating a file on a server which supports unix extensions
such as Samba, if a file is being created which does not supply
nameidata (i.e. nd is null), cifs client can oops when calling
cifs_posix_open.
Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
---
Adjusted to apply to Debian's 2.6.32 by dann frazier <dannf@debian.org>
diff -urpN a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
--- a/fs/cifs/cifsproto.h 2009-12-02 20:51:21.000000000 -0700
+++ b/fs/cifs/cifsproto.h 2010-04-30 00:24:18.000000000 -0600
@@ -95,8 +95,10 @@ extern struct cifsFileInfo *cifs_new_fil
__u16 fileHandle, struct file *file,
struct vfsmount *mnt, unsigned int oflags);
extern int cifs_posix_open(char *full_path, struct inode **pinode,
- struct vfsmount *mnt, int mode, int oflags,
- __u32 *poplock, __u16 *pnetfid, int xid);
+ struct vfsmount *mnt,
+ struct super_block *sb,
+ int mode, int oflags,
+ __u32 *poplock, __u16 *pnetfid, int xid);
extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr,
FILE_UNIX_BASIC_INFO *info,
struct cifs_sb_info *cifs_sb);
diff -urpN a/fs/cifs/dir.c b/fs/cifs/dir.c
--- a/fs/cifs/dir.c 2009-12-02 20:51:21.000000000 -0700
+++ b/fs/cifs/dir.c 2010-04-30 00:24:18.000000000 -0600
@@ -183,13 +183,14 @@ cifs_new_fileinfo(struct inode *newinode
}
int cifs_posix_open(char *full_path, struct inode **pinode,
- struct vfsmount *mnt, int mode, int oflags,
- __u32 *poplock, __u16 *pnetfid, int xid)
+ struct vfsmount *mnt, struct super_block *sb,
+ int mode, int oflags,
+ __u32 *poplock, __u16 *pnetfid, int xid)
{
int rc;
FILE_UNIX_BASIC_INFO *presp_data;
__u32 posix_flags = 0;
- struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb);
+ struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
struct cifs_fattr fattr;
cFYI(1, ("posix open %s", full_path));
@@ -241,7 +242,7 @@ int cifs_posix_open(char *full_path, str
/* get new inode and set it up */
if (*pinode == NULL) {
- *pinode = cifs_iget(mnt->mnt_sb, &fattr);
+ *pinode = cifs_iget(sb, &fattr);
if (!*pinode) {
rc = -ENOMEM;
goto posix_open_ret;
@@ -250,7 +251,8 @@ int cifs_posix_open(char *full_path, str
cifs_fattr_to_inode(*pinode, &fattr);
}
- cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags);
+ if (mnt)
+ cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags);
posix_open_ret:
kfree(presp_data);
@@ -314,13 +316,14 @@ cifs_create(struct inode *inode, struct
if (nd && (nd->flags & LOOKUP_OPEN))
oflags = nd->intent.open.flags;
else
- oflags = FMODE_READ;
+ oflags = FMODE_READ | SMB_O_CREAT;
if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) &&
(CIFS_UNIX_POSIX_PATH_OPS_CAP &
le64_to_cpu(tcon->fsUnixInfo.Capability))) {
- rc = cifs_posix_open(full_path, &newinode, nd->path.mnt,
- mode, oflags, &oplock, &fileHandle, xid);
+ rc = cifs_posix_open(full_path, &newinode,
+ nd ? nd->path.mnt : NULL,
+ inode->i_sb, mode, oflags, &oplock, &fileHandle, xid);
/* EIO could indicate that (posix open) operation is not
supported, despite what server claimed in capability
negotation. EREMOTE indicates DFS junction, which is not
@@ -677,6 +680,7 @@ cifs_lookup(struct inode *parent_dir_ino
(nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
(nd->intent.open.flags & O_CREAT)) {
rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
+ parent_dir_inode->i_sb,
nd->intent.open.create_mode,
nd->intent.open.flags, &oplock,
&fileHandle, xid);
diff -urpN a/fs/cifs/file.c b/fs/cifs/file.c
--- a/fs/cifs/file.c 2009-12-02 20:51:21.000000000 -0700
+++ b/fs/cifs/file.c 2010-04-30 00:24:18.000000000 -0600
@@ -295,10 +295,12 @@ int cifs_open(struct inode *inode, struc
(CIFS_UNIX_POSIX_PATH_OPS_CAP &
le64_to_cpu(tcon->fsUnixInfo.Capability))) {
int oflags = (int) cifs_posix_convert_flags(file->f_flags);
+ oflags |= SMB_O_CREAT;
/* can not refresh inode info since size could be stale */
rc = cifs_posix_open(full_path, &inode, file->f_path.mnt,
- cifs_sb->mnt_file_mode /* ignored */,
- oflags, &oplock, &netfid, xid);
+ inode->i_sb,
+ cifs_sb->mnt_file_mode /* ignored */,
+ oflags, &oplock, &netfid, xid);
if (rc == 0) {
cFYI(1, ("posix open succeeded"));
/* no need for special case handling of setting mode
@@ -510,8 +512,9 @@ reopen_error_exit:
int oflags = (int) cifs_posix_convert_flags(file->f_flags);
/* can not refresh inode info since size could be stale */
rc = cifs_posix_open(full_path, NULL, file->f_path.mnt,
- cifs_sb->mnt_file_mode /* ignored */,
- oflags, &oplock, &netfid, xid);
+ inode->i_sb,
+ cifs_sb->mnt_file_mode /* ignored */,
+ oflags, &oplock, &netfid, xid);
if (rc == 0) {
cFYI(1, ("posix reopen succeeded"));
goto reopen_success;

31
debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch vendored Normal file
View File

@ -0,0 +1,31 @@
From 088ea189c4c75cdf211146faa4b341a0f7476be6 Mon Sep 17 00:00:00 2001
From: Darren Jenkins <darrenrjenkins@gmail.com>
Date: Wed, 17 Feb 2010 23:40:15 +1100
Subject: [PATCH] drivers/net/wireless/p54/txrx.c Fix off by one error
fix off by one error in the queue size check of p54_tx_qos_accounting_alloc()
Coverity CID: 13314
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/txrx.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 0e8f694..6605799 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
struct p54_tx_queue_stats *queue;
unsigned long flags;
- if (WARN_ON(p54_queue > P54_QUEUE_NUM))
+ if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
return -EINVAL;
queue = &priv->tx_stats[p54_queue];
--
1.6.5

100
debian/patches/bugfix/all/drm-i915-Stop-trying-to-use-ACPI-lid-status-to-deter.patch vendored Normal file
View File

@ -0,0 +1,100 @@
From: Eric Anholt <eric@anholt.net>
Date: Wed, 17 Mar 2010 13:48:06 -0700
Subject: [PATCH] drm/i915: Stop trying to use ACPI lid status to determine LVDS connection.
I've been getting more and more quirk reports about this. It seems
clear at this point that other OSes are not using this for determining
whether the integrated panel should be turned on, and it is not
reliable for doing so. Better to light up an unintended panel than to
not light up the only usable output on the system.
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
[bwh: Backport to drm-2.6.33]
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1045,6 +1045,13 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
#define IS_I9XX(dev) (INTEL_INFO(dev)->is_i9xx)
#define IS_MOBILE(dev) (INTEL_INFO(dev)->is_mobile)
+#define IS_GEN3(dev) (IS_I915G(dev) || \
+ IS_I915GM(dev) || \
+ IS_I945G(dev) || \
+ IS_I945GM(dev) || \
+ IS_G33(dev) || \
+ IS_PINEVIEW(dev))
+
#define I915_NEED_GFX_HWS(dev) (INTEL_INFO(dev)->need_gfx_hws)
/* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -599,53 +599,6 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
I915_WRITE(PFIT_CONTROL, lvds_priv->pfit_control);
}
-/* Some lid devices report incorrect lid status, assume they're connected */
-static const struct dmi_system_id bad_lid_status[] = {
- {
- .ident = "Compaq nx9020",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
- DMI_MATCH(DMI_BOARD_NAME, "3084"),
- },
- },
- {
- .ident = "Samsung SX20S",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
- DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
- },
- },
- {
- .ident = "Aspire One",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire one"),
- },
- },
- {
- .ident = "Aspire 1810T",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1810T"),
- },
- },
- {
- .ident = "PC-81005",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
- DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
- },
- },
- {
- .ident = "Clevo M5x0N",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
- DMI_MATCH(DMI_BOARD_NAME, "M5x0N"),
- },
- },
- { }
-};
-
/**
* Detect the LVDS connection.
*
@@ -661,12 +614,9 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
/* ACPI lid methods were generally unreliable in this generation, so
* don't even bother.
*/
- if (IS_I8XX(dev))
+ if (IS_I8XX(dev) || IS_GEN3(dev))
return connector_status_connected;
- if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
- status = connector_status_disconnected;
-
return status;
}

97
debian/patches/bugfix/all/drm-radeon-kms-further-spread-spectrum-fixes.patch vendored Normal file
View File

@ -0,0 +1,97 @@
From 7aac5b711ff4c64bad5a6027cf6d38f1bbd53efe Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Tue, 20 Apr 2010 18:30:37 +1000
Subject: [PATCH] drm/radeon/kms: further spread spectrum fixes
Adjust modeset ordering to fix spread spectrum.
The spread spectrum command table relies on the
crtc routing to already be set in order to work
properly on some asics.
Should fix fdo bug 25741.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Conflicts:
drivers/gpu/drm/radeon/atombios_crtc.c
---
drivers/gpu/drm/radeon/atombios_crtc.c | 5 +++++
drivers/gpu/drm/radeon/radeon_encoders.c | 25 +++++++++++++++----------
2 files changed, 20 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c076eac..e70b575 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1115,6 +1115,11 @@ static bool atombios_crtc_mode_fixup(struct drm_crtc *crtc,
static void atombios_crtc_prepare(struct drm_crtc *crtc)
{
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+ /* pick pll */
+ radeon_crtc->pll_id = radeon_atom_pick_pll(crtc);
+
atombios_lock_crtc(crtc, ATOM_ENABLE);
atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
}
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index cac9e06..ff28ad8 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1207,6 +1207,9 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
}
atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+
+ /* update scratch regs with new routing */
+ radeon_atombios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
}
static void
@@ -1317,19 +1320,9 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
struct drm_device *dev = encoder->dev;
struct radeon_device *rdev = dev->dev_private;
struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
- struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
- if (radeon_encoder->active_device &
- (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT)) {
- struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
- if (dig)
- dig->dig_encoder = radeon_atom_pick_dig_encoder(encoder);
- }
radeon_encoder->pixel_clock = adjusted_mode->clock;
- radeon_atombios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
- atombios_set_encoder_crtc_source(encoder);
-
if (ASIC_IS_AVIVO(rdev)) {
if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
atombios_yuv_setup(encoder, true);
@@ -1483,8 +1476,20 @@ radeon_atom_dac_detect(struct drm_encoder *encoder, struct drm_connector *connec
static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
{
+ struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+
+ if (radeon_encoder->active_device &
+ (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT)) {
+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+ if (dig)
+ dig->dig_encoder = radeon_atom_pick_dig_encoder(encoder);
+ }
+
radeon_atom_output_lock(encoder, true);
radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
+
+ /* this is needed for the pll/ss setup to work correctly in some cases */
+ atombios_set_encoder_crtc_source(encoder);
}
static void radeon_atom_encoder_commit(struct drm_encoder *encoder)
--
1.6.5.2

62
debian/patches/bugfix/all/ext4-issue-discard-operation-before-releasing-blocks.patch vendored Normal file
View File

@ -0,0 +1,62 @@
From: Theodore Ts'o <tytso@mit.edu>
Date: Tue, 20 Apr 2010 20:51:59 +0000 (-0400)
Subject: ext4: Issue the discard operation *before* releasing the blocks to be reused
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=b90f687018e6d6c77d981b09203780f7001407e5
ext4: Issue the discard operation *before* releasing the blocks to be reused
[ backported to 2.6.3[23] ]
Otherwise, we can end up having data corruption because the blocks
could get reused and then discarded!
https://bugzilla.kernel.org/show_bug.cgi?id=15579
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
---
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 54df209..e5ab41b 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2534,6 +2534,20 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
mb_debug(1, "gonna free %u blocks in group %u (0x%p):",
entry->count, entry->group, entry);
+ if (test_opt(sb, DISCARD)) {
+ ext4_fsblk_t discard_block;
+ struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
+ discard_block = (ext4_fsblk_t)entry->group *
+ EXT4_BLOCKS_PER_GROUP(sb)
+ + entry->start_blk
+ + le32_to_cpu(es->s_first_data_block);
+ trace_ext4_discard_blocks(sb,
+ (unsigned long long)discard_block,
+ entry->count);
+ sb_issue_discard(sb, discard_block, entry->count);
+ }
+
err = ext4_mb_load_buddy(sb, entry->group, &e4b);
/* we expect to find existing buddy because it's pinned */
BUG_ON(err != 0);
@@ -2555,19 +2566,6 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
page_cache_release(e4b.bd_bitmap_page);
}
ext4_unlock_group(sb, entry->group);
- if (test_opt(sb, DISCARD)) {
- ext4_fsblk_t discard_block;
- struct ext4_super_block *es = EXT4_SB(sb)->s_es;
-
- discard_block = (ext4_fsblk_t)entry->group *
- EXT4_BLOCKS_PER_GROUP(sb)
- + entry->start_blk
- + le32_to_cpu(es->s_first_data_block);
- trace_ext4_discard_blocks(sb,
- (unsigned long long)discard_block,
- entry->count);
- sb_issue_discard(sb, discard_block, entry->count);
- }
kmem_cache_free(ext4_free_ext_cachep, entry);
ext4_mb_release_desc(&e4b);
}

35
debian/patches/bugfix/all/forcedeth-fix-tx-limit2-flag-check.patch vendored Normal file
View File

@ -0,0 +1,35 @@
From 5c659322a904a7cc0265e7b183372b9bdebec6db Mon Sep 17 00:00:00 2001
From: Ayaz Abdulla <aabdulla@nvidia.com>
Date: Tue, 13 Apr 2010 18:49:51 -0700
Subject: [PATCH] forcedeth: fix tx limit2 flag check
This is a fix for bug 572201 @ bugs.debian.org
This patch fixes the TX_LIMIT feature flag. The previous logic check
for TX_LIMIT2 also took into account a device that only had TX_LIMIT
set.
Reported-by: Stephen Mulcahu <stephen.mulcahy@deri.org>
Reported-by: Ben Huchings <ben@decadent.org.uk>
Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/forcedeth.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 73b260c..5c98f7c 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5899,7 +5899,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
/* Limit the number of tx's outstanding for hw bug */
if (id->driver_data & DEV_NEED_TX_LIMIT) {
np->tx_limit = 1;
- if ((id->driver_data & DEV_NEED_TX_LIMIT2) &&
+ if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) &&
pci_dev->revision >= 0xA2)
np->tx_limit = 0;
}
--
1.7.0.3

78
debian/patches/bugfix/all/hugetlb-fix-infinite-loop-in-get_futex_key-when-backed-by-huge-pages.patch vendored Normal file
View File

@ -0,0 +1,78 @@
From 23be7468e8802a2ac1de6ee3eecb3ec7f14dc703 Mon Sep 17 00:00:00 2001
From: Mel Gorman <mel@csn.ul.ie>
Date: Fri, 23 Apr 2010 13:17:56 -0400
Subject: hugetlb: fix infinite loop in get_futex_key() when backed by huge pages
From: Mel Gorman <mel@csn.ul.ie>
commit 23be7468e8802a2ac1de6ee3eecb3ec7f14dc703 upstream.
If a futex key happens to be located within a huge page mapped
MAP_PRIVATE, get_futex_key() can go into an infinite loop waiting for a
page->mapping that will never exist.
See https://bugzilla.redhat.com/show_bug.cgi?id=552257 for more details
about the problem.
This patch makes page->mapping a poisoned value that includes
PAGE_MAPPING_ANON mapped MAP_PRIVATE. This is enough for futex to
continue but because of PAGE_MAPPING_ANON, the poisoned value is not
dereferenced or used by futex. No other part of the VM should be
dereferencing the page->mapping of a hugetlbfs page as its page cache is
not on the LRU.
This patch fixes the problem with the test case described in the bugzilla.
[akpm@linux-foundation.org: mel cant spel]
Signed-off-by: Mel Gorman <mel@csn.ul.ie>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Darren Hart <darren@dvhart.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/poison.h | 9 +++++++++
mm/hugetlb.c | 5 ++++-
2 files changed, 13 insertions(+), 1 deletion(-)
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -48,6 +48,15 @@
#define POISON_FREE 0x6b /* for use-after-free poisoning */
#define POISON_END 0xa5 /* end-byte of poisoning */
+/********** mm/hugetlb.c **********/
+/*
+ * Private mappings of hugetlb pages use this poisoned value for
+ * page->mapping. The core VM should not be doing anything with this mapping
+ * but futex requires the existence of some page->mapping value even though it
+ * is unused if PAGE_MAPPING_ANON is set.
+ */
+#define HUGETLB_POISON ((void *)(0x00300300 + POISON_POINTER_DELTA + PAGE_MAPPING_ANON))
+
/********** arch/$ARCH/mm/init.c **********/
#define POISON_FREE_INITMEM 0xcc
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -545,6 +545,7 @@ static void free_huge_page(struct page *
mapping = (struct address_space *) page_private(page);
set_page_private(page, 0);
+ page->mapping = NULL;
BUG_ON(page_count(page));
INIT_LIST_HEAD(&page->lru);
@@ -2095,8 +2096,10 @@ retry:
spin_lock(&inode->i_lock);
inode->i_blocks += blocks_per_huge_page(h);
spin_unlock(&inode->i_lock);
- } else
+ } else {
lock_page(page);
+ page->mapping = HUGETLB_POISON;
+ }
}
/*

73
debian/patches/bugfix/all/ipheth-potential-null-dereferences-on-error-path.patch vendored Normal file
View File

@ -0,0 +1,73 @@
From d87ff58fda926fe5cb01214cccf1c72422ac776d Mon Sep 17 00:00:00 2001
From: Dan Carpenter <error27@gmail.com>
Date: Mon, 26 Apr 2010 23:20:12 +0000
Subject: [PATCH] ipheth: potential null dereferences on error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: L. Alberto Giménez <agimenez@sysvalve.es>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/ipheth.c | 15 ++++++++-------
1 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index fd10331..418825d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (tx_urb == NULL)
- goto error;
+ goto error_nomem;
rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (rx_urb == NULL)
- goto error;
+ goto free_tx_urb;
tx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&tx_urb->transfer_dma);
if (tx_buf == NULL)
- goto error;
+ goto free_rx_urb;
rx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&rx_urb->transfer_dma);
if (rx_buf == NULL)
- goto error;
+ goto free_tx_buf;
iphone->tx_urb = tx_urb;
@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
iphone->rx_buf = rx_buf;
return 0;
-error:
- usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
- rx_urb->transfer_dma);
+free_tx_buf:
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
tx_urb->transfer_dma);
+free_rx_urb:
usb_free_urb(rx_urb);
+free_tx_urb:
usb_free_urb(tx_urb);
+error_nomem:
return -ENOMEM;
}
--
1.7.0.3

148
debian/patches/bugfix/all/libata-ata_piix-clear-spurious-IRQ.patch vendored Normal file
View File

@ -0,0 +1,148 @@
From: Tejun Heo <tj@kernel.org>
Subject: libata,ata_piix: detect and clear spurious IRQs
Patch-Mainline: Backported from changes pending for 2.6.34
References: bnc#445872, bnc#589449
Backport spurious IRQ handling from 2.6.34. It isn't exactly the same
form in that it doesn't use callbacks but implements custom
piix_interrupt() but should function the same. This protects ata_piix
against nobody-cared which gets reported not so rarely.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Tejun Heo <teheo@suse.de>
---
drivers/ata/ata_piix.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++-
drivers/ata/libata-sff.c | 12 ++++++-
2 files changed, 85 insertions(+), 3 deletions(-)
Index: linux-2.6.32-SLE11-SP1/drivers/ata/ata_piix.c
===================================================================
--- linux-2.6.32-SLE11-SP1.orig/drivers/ata/ata_piix.c
+++ linux-2.6.32-SLE11-SP1/drivers/ata/ata_piix.c
@@ -949,6 +949,80 @@ static int piix_sidpr_scr_read(struct at
return 0;
}
+static irqreturn_t piix_interrupt(int irq, void *dev_instance)
+{
+ struct ata_host *host = dev_instance;
+ bool retried = false;
+ unsigned int i;
+ unsigned int handled = 0, polling = 0, idle = 0;
+ unsigned long flags;
+
+ spin_lock_irqsave(&host->lock, flags);
+retry:
+ handled = idle = polling = 0;
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+ struct ata_queued_cmd *qc;
+
+ if (ata_port_is_dummy(ap))
+ continue;
+
+ qc = ata_qc_from_tag(ap, ap->link.active_tag);
+ if (qc) {
+ if (!(qc->tf.flags & ATA_TFLAG_POLLING))
+ handled |= ata_sff_host_intr(ap, qc);
+ else
+ polling |= 1 << i;
+ } else
+ idle |= 1 << i;
+ }
+
+ /*
+ * If no port was expecting IRQ but the controller is actually
+ * asserting IRQ line, nobody cared will ensue. Check IRQ
+ * pending status if available and clear spurious IRQ.
+ */
+ if (!handled && !retried) {
+ bool retry = false;
+
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+ u8 host_stat;
+
+ if (polling & (1 << i))
+ continue;
+
+ if (unlikely(!ap->ioaddr.bmdma_addr))
+ continue;
+
+ host_stat = ap->ops->bmdma_status(ap);
+ if (!(host_stat & ATA_DMA_INTR))
+ continue;
+
+ if (idle & (1 << i)) {
+ ap->ops->sff_check_status(ap);
+ ap->ops->sff_irq_clear(ap);
+ } else {
+ /* clear INTRQ and check if BUSY cleared */
+ if (!(ap->ops->sff_check_status(ap) & ATA_BUSY))
+ retry |= true;
+ /*
+ * With command in flight, we can't do
+ * sff_irq_clear() w/o racing with completion.
+ */
+ }
+ }
+ if (retry) {
+ retried = true;
+ goto retry;
+ }
+ }
+
+ spin_unlock_irqrestore(&host->lock, flags);
+
+ return IRQ_RETVAL(handled);
+}
+
static int piix_sidpr_scr_write(struct ata_link *link,
unsigned int reg, u32 val)
{
@@ -1607,7 +1681,7 @@ static int __devinit piix_init_one(struc
host->flags |= ATA_HOST_PARALLEL_SCAN;
pci_set_master(pdev);
- return ata_pci_sff_activate_host(host, ata_sff_interrupt, &piix_sht);
+ return ata_pci_sff_activate_host(host, piix_interrupt, &piix_sht);
}
static void piix_remove_one(struct pci_dev *pdev)
Index: linux-2.6.32-SLE11-SP1/drivers/ata/libata-sff.c
===================================================================
--- linux-2.6.32-SLE11-SP1.orig/drivers/ata/libata-sff.c
+++ linux-2.6.32-SLE11-SP1/drivers/ata/libata-sff.c
@@ -1667,6 +1667,7 @@ unsigned int ata_sff_host_intr(struct at
{
struct ata_eh_info *ehi = &ap->link.eh_info;
u8 status, host_stat = 0;
+ bool bmdma_stopped = false;
VPRINTK("ata%u: protocol %d task_state %d\n",
ap->print_id, qc->tf.protocol, ap->hsm_task_state);
@@ -1699,6 +1700,7 @@ unsigned int ata_sff_host_intr(struct at
/* before we do anything else, clear DMA-Start bit */
ap->ops->bmdma_stop(qc);
+ bmdma_stopped = true;
if (unlikely(host_stat & ATA_DMA_ERR)) {
/* error when transfering data to/from memory */
@@ -1716,8 +1718,14 @@ unsigned int ata_sff_host_intr(struct at
/* check main status, clearing INTRQ if needed */
status = ata_sff_irq_status(ap);
- if (status & ATA_BUSY)
- goto idle_irq;
+ if (status & ATA_BUSY) {
+ if (bmdma_stopped) {
+ /* BMDMA engine is already stopped, we're screwed */
+ qc->err_mask |= AC_ERR_HSM;
+ ap->hsm_task_state = HSM_ST_ERR;
+ } else
+ goto idle_irq;
+ }
/* ack bmdma irq events */
ap->ops->sff_irq_clear(ap);

35
debian/patches/bugfix/all/libata-fix-accesses-at-LBA28-boundary.patch vendored Normal file
View File

@ -0,0 +1,35 @@
From: Mark Lord <kernel@teksavvy.com>
Date: Wed, 7 Apr 2010 17:52:08 +0000 (-0400)
Subject: libata: Fix accesses at LBA28 boundary (old bug, but nasty) (v2)
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=45c4d015a92f72ec47acd0c7557abdc0c8a6499d
libata: Fix accesses at LBA28 boundary (old bug, but nasty) (v2)
Most drives from Seagate, Hitachi, and possibly other brands,
do not allow LBA28 access to sector number 0x0fffffff (2^28 - 1).
So instead use LBA48 for such accesses.
This bug could bite a lot of systems, especially when the user has
taken care to align partitions to 4KB boundaries. On misaligned systems,
it is less likely to be encountered, since a 4KB read would end at
0x10000000 rather than at 0x0fffffff.
Signed-off-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
---
diff --git a/include/linux/ata.h b/include/linux/ata.h
index b4c85e2..700c5b9 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -1025,8 +1025,8 @@ static inline int ata_ok(u8 status)
static inline int lba_28_ok(u64 block, u32 n_block)
{
- /* check the ending block number */
- return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
+ /* check the ending block number: must be LESS THAN 0x0fffffff */
+ return ((block + n_block) < ((1 << 28) - 1)) && (n_block <= 256);
}
static inline int lba_48_ok(u64 block, u32 n_block)

49
debian/patches/bugfix/all/libiscsi-regression-fix-header-digest-errors.patch vendored Normal file
View File

@ -0,0 +1,49 @@
From: michaelc@cs.wisc.edu
To: linux-scsi@vger.kernel.org
Cc: Mike Christie <michaelc@cs.wisc.edu>
Subject: [PATCH] libiscsi: regression: fix header digest errors
Date: Sat, 24 Apr 2010 16:21:19 -0500
Message-Id: <1272144079-10494-1-git-send-email-michaelc@cs.wisc.edu>
This fixes a regression introduced with this commit:
d3305f3407fa3e9452079ec6cc8379067456e4aa
in 2.6.32.
When I moved the hdr->cmdsn after init_task, I added
a bug when header digests are used. The problem is
that the LLD may calculate the header digest in init_task,
so if we then set the cmdsn after the init_task call we
change what the digest will be calculated by the target.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
---
drivers/scsi/libiscsi.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 6d5ae44..633e090 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -471,12 +471,12 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
WARN_ON(hdrlength >= 256);
hdr->hlength = hdrlength & 0xFF;
+ hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
if (session->tt->init_task && session->tt->init_task(task))
return -EIO;
task->state = ISCSI_TASK_RUNNING;
- hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
session->cmdsn++;
conn->scsicmd_pdus_cnt++;
--
1.6.6.1
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

106
debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch vendored Normal file
View File

@ -0,0 +1,106 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id ED48524045
for <maks@dual>; Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.16)
for <maks@dual> (single-drop); Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 407AB5C001
for <max@stro.at>; Thu, 22 Apr 2010 19:44:39 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755433Ab0DVRwc (ORCPT <rfc822;max@stro.at>);
Thu, 22 Apr 2010 13:52:32 -0400
Received: from mail-vw0-f46.google.com ([209.85.212.46]:52767 "EHLO
mail-vw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755072Ab0DVRwb (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 22 Apr 2010 13:52:31 -0400
Received: by vws14 with SMTP id 14so38715vws.19
for <linux-wireless@vger.kernel.org>; Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
bh=rH+Y7riac85RIiXG6qbakuXBSY790hWoyH0ONriCSeg=;
b=Ykzs36TepjY445cGIr5IH3C+knJyI56PTTlTKWlRkO098l3gXlGleAI5fn2s5sivNa
F5+SpVSoGspL0FT7yHTYb+CnZ+6ZyzshVgudsBPAakjfrZNlBYpEub3PAgddsugf9A75
j1t9aq3UhlHL13NLQQg1mwfWsN5hUSbfjKwZQ=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
b=ZixBFP6qSmufbPzN9DU5JjG83DMDIZFFEClBzUKD1bszfbpbEy3fsXLEFwgDchVGf2
VpqO7MVL6R70pPqT4CGb/k2XnaFpVM3lQZK695ehjHK+X/g0nPaprPYrZu/TbPii3Ieg
3Dj6OuAw0/tMNg5FUfKbIlLct8v3HfpJmNVwE=
Received: by 10.220.126.153 with SMTP id c25mr1130560vcs.140.1271958749500;
Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
Received: from blech.mobile ([72.14.241.41])
by mx.google.com with ESMTPS id i29sm814619vcr.12.2010.04.22.10.52.27
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 22 Apr 2010 10:52:28 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id bUG7mXcCH9aE; Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id ADBA2342417;
Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH 1/2] p54pci: fix bugs in p54p_check_tx_ring
Date: Thu, 22 Apr 2010 19:52:16 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com, hdegoede@redhat.com
MIME-Version: 1.0
X-Length: 2052
X-UID: 75
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004221952.16857.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
Content-Length: 1159
From: Hans de Goede <hdegoede@redhat.com>
Hans de Goede identified a bug in p54p_check_tx_ring:
there are two ring indices. 1 => tx data and 3 => tx management.
But the old code had a constant "1" and this resulted in spurious
dma unmapping failures.
Cc: stable@kernel.org
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
Bug-Identified-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 679da7e..cffe2f2 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
u32 idx, i;
i = (*index) % ring_limit;
- (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
idx %= ring_limit;
while (i != idx) {
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

164
debian/patches/bugfix/all/p54pci-fix-regression.patch vendored Normal file
View File

@ -0,0 +1,164 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 6945624045
for <maks@dual>; Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.16)
for <maks@dual> (single-drop); Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 0650F5C00B
for <max@stro.at>; Thu, 22 Apr 2010 19:45:05 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755708Ab0DVRxA (ORCPT <rfc822;max@stro.at>);
Thu, 22 Apr 2010 13:53:00 -0400
Received: from mail-pz0-f194.google.com ([209.85.222.194]:37203 "EHLO
mail-pz0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755147Ab0DVRw7 (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 22 Apr 2010 13:52:59 -0400
Received: by pzk32 with SMTP id 32so5663626pzk.21
for <linux-wireless@vger.kernel.org>; Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
bh=yJz+c5/JMqOxuMrxk75S5LvVDV5la+16zQVI/xQuosY=;
b=krjzx1PwXDglH9BKcI+e7WyvVPwy284xIAAxYojJMM3AkNsVpxCyuUXkzqkrDWaN8Z
VwzlJJFO5mYy9ZmQM+utsqENnmIEpQp2eszSxI2cfx36lKpoE71gDBkK1A+vDnClheMv
MyFHfI869i03WhBAASw6oe1xhdI1bb4F49zmE=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
b=kLB1kLIJwVvNYqGmlY3Ql+PqUEXjk7KvsSUZSvES9+eYqzjAQYbiuEpl40DM10BSrl
Mtdenj+I5Ce2chMF6i1JrzzNFMFz0pUVtqUuAk9iQL9Iuo7eE7DZEOS2X3Vo4xCdRLC1
S3ygbtj1GOb1JfYn7ge9GL39GsyCNQBRlfVuA=
Received: by 10.141.188.24 with SMTP id q24mr1593520rvp.0.1271958778042;
Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
Received: from blech.mobile ([72.14.240.9])
by mx.google.com with ESMTPS id 22sm156714pzk.13.2010.04.22.10.52.55
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 22 Apr 2010 10:52:57 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id vx9ld1JknfF5; Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id 80D53342417;
Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH 2/2] p54pci: fix regression from prevent stuck rx-ring on slow system
Date: Thu, 22 Apr 2010 19:52:43 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com, hdegoede@redhat.com
MIME-Version: 1.0
X-Length: 4801
X-UID: 74
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004221952.44071.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
Content-Length: 4096
From: Hans de Goede <hdegoede@redhat.com>
This patch fixes a recently introduced use-after-free regression
from "p54pci: prevent stuck rx-ring on slow system".
Hans de Goede reported a use-after-free regression:
>BUG: unable to handle kernel paging request at 6b6b6b6b
>IP: [<e122284a>] p54p_check_tx_ring+0x84/0xb1 [p54pci]
>*pde = 00000000
>Oops: 0000 [#1] SMP
>EIP: 0060:[<e122284a>] EFLAGS: 00010286 CPU: 0
>EIP is at p54p_check_tx_ring+0x84/0xb1 [p54pci]
>EAX: 6b6b6b6b EBX: df10b170 ECX: 00000003 EDX: 00000001
>ESI: dc471500 EDI: d8acaeb0 EBP: c098be9c ESP: c098be84
> DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
>Process swapper (pid: 0, ti=c098a000 task=c09ccfe0 task.ti=c098a000)
>Call Trace:
> [<e1222b02>] ? p54p_tasklet+0xaa/0xb5 [p54pci]
> [<c0440568>] ? tasklet_action+0x78/0xcb
> [<c0440ed3>] ? __do_softirq+0xbc/0x173
Quote from comment #17:
"The problem is the innocent looking moving of the tx processing to
after the rx processing in the tasklet. Quoting from the changelog:
This patch does it the same way, except that it also prioritize
rx data processing, simply because tx routines *can* wait.
This is causing an issue with us referencing already freed memory,
because some skb's we transmit, we immediately receive back, such
as those for reading the eeprom (*) and getting stats.
What can happen because of the moving of the tx processing to after
the rx processing is that when the tasklet first runs after doing a
special skb tx (such as eeprom) we've already received the answer
to it.
Then the rx processing ends up calling p54_find_and_unlink_skb to
find the matching tx skb for the just received special rx skb and
frees the tx skb.
Then after the processing of the rx skb answer, and thus freeing
the tx skb, we go process the completed tx ring entires, and then
dereference the free-ed skb, to see if it should free free-ed by
p54p_check_tx_ring()."
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
Bug-Identified-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index ca42ccb..07c4528 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -277,6 +277,14 @@ static void p54p_tasklet(unsigned long dev_id)
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
+
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -285,14 +293,6 @@ static void p54p_tasklet(unsigned long dev_id)
wmb();
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
-
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
}
static irqreturn_t p54p_interrupt(int irq, void *dev_id)
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

103
debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch vendored Normal file
View File

@ -0,0 +1,103 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 4027E2429D
for <maks@dual>; Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.13)
for <maks@dual> (single-drop); Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 785425C00F
for <max@stro.at>; Thu, 15 Apr 2010 14:09:33 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1752356Ab0DOMRR (ORCPT <rfc822;max@stro.at>);
Thu, 15 Apr 2010 08:17:17 -0400
Received: from mail-ew0-f220.google.com ([209.85.219.220]:35717 "EHLO
mail-ew0-f220.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1752038Ab0DOMRQ (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 15 Apr 2010 08:17:16 -0400
Received: by ewy20 with SMTP id 20so459287ewy.1
for <linux-wireless@vger.kernel.org>; Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:content-type
:content-transfer-encoding:message-id;
bh=p4STqoMJiC6z/cKYzv2Exm9RYHj8L3PhiKgV8V/My+8=;
b=Df3+ZF5p9OAOZbcMmdGwwyRhe6KKgy9XnEhFVlpwzN2ifr78NiUNl9AwiYsHd2bCAb
DFIq9aj2Lw3AzsJziQaRZjAyi1BCwRHWYVT1z6DAUac3GKAPDbTwg8ci9O31eyKBcbQu
3d//ULPy6g8NH7caloyA+ZhU8cmIl93ddMv0I=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:content-type
:content-transfer-encoding:message-id;
b=n2N7kl6h8TV/cyVhTSMxV505sNe8/00nKdlLKyTn7h0M9MPZhLYgvJms0gr6wMtuoS
t78oiQsjdGsh2YMGVes/1eMoISXolb2pGF36Lp3UnoVJtJx5s6aBasGQ0oVUc2PIYozG
FyMOuuxhdfOyNOE8iJVAGWVBWLNxyIICBR4tU=
Received: by 10.213.2.81 with SMTP id 17mr25407ebi.76.1271333835129;
Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
Received: from blech.mobile (nat-wh.rz.uni-karlsruhe.de [129.13.72.197])
by mx.google.com with ESMTPS id 15sm922586ewy.12.2010.04.15.05.17.14
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 15 Apr 2010 05:17:14 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id gSWm7mhNvXD9; Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id 6D2D834077B;
Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH] p54pci: fix serious sparse warning
Date: Thu, 15 Apr 2010 14:17:07 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc3-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004151417.07538.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
X-Virus-Scanned: by Amavis (ClamAV) at stro.at
Content-Length: 1202
This patch fixes a bug which was just recently introduced by
("p54pci: prevent stuck rx-ring on slow system").
make M=drivers/net/wireless/p54 C=2 CF=-D__CHECK_ENDIAN__
CHECK drivers/net/wireless/p54/p54pci.c
drivers/net/wireless/p54/p54pci.c:143:11: warning: cast to restricted __le32
CC [M] drivers/net/wireless/p54/p54pci.o
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 86f3e9a..679da7e 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -140,7 +140,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
idx = le32_to_cpu(ring_control->host_idx[ring_index]);
limit = idx;
- limit -= le32_to_cpu(index);
+ limit -= index;
limit = ring_limit - limit;
i = idx % ring_limit;
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

180
debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch vendored Normal file
View File

@ -0,0 +1,180 @@
From d713804c6032b95cd3035014e16fadebb9655c6f Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Sun, 17 Jan 2010 23:19:25 +0100
Subject: [PATCH] p54pci: move tx cleanup into tasklet
This patch moves the tx cleanup routines out of the critical
interrupt context and into the (previously known as rx) tasklet.
The main goal of this operation is to remove the extensive
usage of spin_lock_irqsaves in the generic p54common library.
The next step would be to modify p54usb to do the
rx processing inside a tasklet (just like usbnet).
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54pci.c | 56 +++++++++++++++++++------------------
drivers/net/wireless/p54/p54pci.h | 6 ++--
2 files changed, 32 insertions(+), 30 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 4bf4c21..48cae48 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -234,25 +234,26 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
}
-/* caller must hold priv->lock */
static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
- void **tx_buf)
+ struct sk_buff **tx_buf)
{
+ unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
struct p54p_desc *desc;
+ struct sk_buff *skb;
u32 idx, i;
i = (*index) % ring_limit;
(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
idx %= ring_limit;
+ spin_lock_irqsave(&priv->lock, flags);
while (i != idx) {
desc = &ring[i];
- if (tx_buf[i])
- if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
- p54_free_skb(dev, tx_buf[i]);
+
+ skb = tx_buf[i];
tx_buf[i] = NULL;
pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
@@ -263,17 +264,32 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
desc->len = 0;
desc->flags = 0;
+ if (skb && FREE_AFTER_TX(skb)) {
+ spin_unlock_irqrestore(&priv->lock, flags);
+ p54_free_skb(dev, skb);
+ spin_lock_irqsave(&priv->lock, flags);
+ }
+
i++;
i %= ring_limit;
}
+ spin_unlock_irqrestore(&priv->lock, flags);
}
-static void p54p_rx_tasklet(unsigned long dev_id)
+static void p54p_tasklet(unsigned long dev_id)
{
struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
+
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -288,38 +304,24 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
{
struct ieee80211_hw *dev = dev_id;
struct p54p_priv *priv = dev->priv;
- struct p54p_ring_control *ring_control = priv->ring_control;
__le32 reg;
spin_lock(&priv->lock);
reg = P54P_READ(int_ident);
if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
- spin_unlock(&priv->lock);
- return IRQ_HANDLED;
+ goto out;
}
-
P54P_WRITE(int_ack, reg);
reg &= P54P_READ(int_enable);
- if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
- 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data,
- 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
-
- tasklet_schedule(&priv->rx_tasklet);
-
- } else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+ if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
+ tasklet_schedule(&priv->tasklet);
+ else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
complete(&priv->boot_comp);
+out:
spin_unlock(&priv->lock);
-
return reg ? IRQ_HANDLED : IRQ_NONE;
}
@@ -368,7 +370,7 @@ static void p54p_stop(struct ieee80211_hw *dev)
unsigned int i;
struct p54p_desc *desc;
- tasklet_kill(&priv->rx_tasklet);
+ tasklet_kill(&priv->tasklet);
P54P_WRITE(int_enable, cpu_to_le32(0));
P54P_READ(int_enable);
@@ -559,7 +561,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
priv->common.tx = p54p_tx;
spin_lock_init(&priv->lock);
- tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
+ tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
err = request_firmware(&priv->firmware, "isl3886pci",
&priv->pdev->dev);
diff --git a/drivers/net/wireless/p54/p54pci.h b/drivers/net/wireless/p54/p54pci.h
index fbb6839..2feead6 100644
--- a/drivers/net/wireless/p54/p54pci.h
+++ b/drivers/net/wireless/p54/p54pci.h
@@ -92,7 +92,7 @@ struct p54p_priv {
struct p54_common common;
struct pci_dev *pdev;
struct p54p_csr __iomem *map;
- struct tasklet_struct rx_tasklet;
+ struct tasklet_struct tasklet;
const struct firmware *firmware;
spinlock_t lock;
struct p54p_ring_control *ring_control;
@@ -101,8 +101,8 @@ struct p54p_priv {
u32 rx_idx_mgmt, tx_idx_mgmt;
struct sk_buff *rx_buf_data[8];
struct sk_buff *rx_buf_mgmt[4];
- void *tx_buf_data[32];
- void *tx_buf_mgmt[4];
+ struct sk_buff *tx_buf_data[32];
+ struct sk_buff *tx_buf_mgmt[4];
struct completion boot_comp;
};
--
1.6.5

188
debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch vendored Normal file
View File

@ -0,0 +1,188 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 9C5E5240B2
for <maks@dual>; Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.13)
for <maks@dual> (single-drop); Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 57CCD5C001
for <max@stro.at>; Fri, 9 Apr 2010 21:30:10 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755774Ab0DIThv (ORCPT <rfc822;max@stro.at>);
Fri, 9 Apr 2010 15:37:51 -0400
Received: from mail-fx0-f223.google.com ([209.85.220.223]:53451 "EHLO
mail-fx0-f223.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755660Ab0DIThu (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Fri, 9 Apr 2010 15:37:50 -0400
Received: by fxm23 with SMTP id 23so3059091fxm.21
for <linux-wireless@vger.kernel.org>; Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:to:subject:cc:from
:date:mime-version:content-type:content-transfer-encoding:message-id;
bh=/1/MkPwABrV9B+UeF6gm0FPvrdPa07zITP+BiYkzzvw=;
b=auJ2WlRwYLTrqH7PVkjv2hQzjgsBbBZysz1x9gVsGRQoOOZ+wTxIkXHmADOz2Clurf
qKYgHxxCHnjDu6Xb3kQiYRHAmKFE9O/sRDNyWmVXKU9eLSt47cF16hKkyVPAOs/+g2P7
usGYv5VXGKFrTCJwhqjvUCrVeW/6sy2mne5qo=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=to:subject:cc:from:date:mime-version:content-type
:content-transfer-encoding:message-id;
b=jVz41M1Z71WIF8rYp/LErkkyGct/5qylglZrBSMErJB5AC3su/UaeNmI6c+tEXGrmE
RYWQDDFlrvqDy7qgL+QmxvU0RgOizjnueLLPZlD3X4dR1O7YN+CuIpK1JJ+6Roa+p2QF
e60ozvjRK1DjNk1aahW0hpaZxRDPGrFVxtxwM=
Received: by 10.223.6.153 with SMTP id 25mr453117faz.81.1270841868071;
Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
Received: from debian64.daheim (p5B16D5D6.dip.t-dialin.net [91.22.213.214])
by mx.google.com with ESMTPS id e17sm3562248fke.27.2010.04.09.12.37.42
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Fri, 09 Apr 2010 12:37:42 -0700 (PDT)
Received: from debian64.daheim
([192.168.0.4] helo=debian64.localnet ident=chuck)
by debian64.daheim with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.71)
(envelope-from <chunkeey@googlemail.com>)
id 1O0K1N-0002Xr-Ua; Fri, 09 Apr 2010 21:37:41 +0200
To: linux-wireless@vger.kernel.org
Subject: [PATCH] p54pci: prevent stuck rx-ring on slow system
Cc: linville@tuxdriver.com
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Fri, 9 Apr 2010 21:37:38 +0200
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004092137.39285.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
X-Virus-Scanned: by Amavis (ClamAV) at stro.at
Content-Length: 4420
From: Quintin Pitts <geek4linux@gmail.com>
This patch fixes an old problem, which - under certain
circumstances - could cause the device to become
unresponsive.
most of p54pci's rx-ring management is implemented in just
two distinct standalone functions. p54p_check_rx_ring takes
care of processing incoming data, while p54p_refill_rx_ring
tries to replenish all depleted communication buffers.
This has always worked fine on my fast machine, but
now I know there is a hidden race...
The most likely candidate here is ring_control->device_idx.
Quintin Pitts had already analyzed the culprit and posted
a patch back in Oct 2009. But sadly, no one's picked up on this.
( https://patchwork.kernel.org/patch/53079/ [2 & 3] ).
This patch does the same way, except that it also prioritize
rx data processing, simply because tx routines *can* wait.
Reported-by: Sean Young <sean@mess.org>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=11386
Reported-by: Quintin Pitts <geek4linux@gmail.com>
Signed-off-by: Quintin Pitts <geek4linux@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
John,
It's been nearly a week and no complains or regressions
have been reported. Therefore I think it is now save to
finally merge this patch... Preferably into -next, so
bug #11386 can be closed for 2.6.34 release.
Regards,
Chr
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index ed4bdff..aa29663 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -131,7 +131,7 @@ static int p54p_upload_firmware(struct ieee80211_hw *dev)
static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
- struct sk_buff **rx_buf)
+ struct sk_buff **rx_buf, u32 index)
{
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
@@ -139,7 +139,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
idx = le32_to_cpu(ring_control->host_idx[ring_index]);
limit = idx;
- limit -= le32_to_cpu(ring_control->device_idx[ring_index]);
+ limit -= le32_to_cpu(index);
limit = ring_limit - limit;
i = idx % ring_limit;
@@ -231,7 +231,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
i %= ring_limit;
}
- p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
+ p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf, *index);
}
static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
@@ -276,14 +276,6 @@ static void p54p_tasklet(unsigned long dev_id)
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
-
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -292,6 +284,14 @@ static void p54p_tasklet(unsigned long dev_id)
wmb();
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
}
static irqreturn_t p54p_interrupt(int irq, void *dev_id)
@@ -444,10 +444,10 @@ static int p54p_open(struct ieee80211_hw *dev)
priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
- ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
+ ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data, 0);
p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
- ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
+ ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt, 0);
P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
P54P_READ(ring_control_base);
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

100
debian/patches/bugfix/all/p54pci-revise-tx-locking.patch vendored Normal file
View File

@ -0,0 +1,100 @@
From b92f7d30830a319148df2943b7565989494e5ad1 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Fri, 22 Jan 2010 08:01:11 +0100
Subject: [PATCH] p54pci: revise tx locking
This patch continues the effort which began with:
"[PATCH] p54pci: move tx cleanup into tasklet".
Thanks to these changes, p54pci's interrupt & tx
cleanup routines can be made lock-less.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54pci.c | 16 ++++------------
1 files changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 48cae48..bda29c0 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -238,7 +238,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
struct sk_buff **tx_buf)
{
- unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
struct p54p_desc *desc;
@@ -249,7 +248,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
idx %= ring_limit;
- spin_lock_irqsave(&priv->lock, flags);
while (i != idx) {
desc = &ring[i];
@@ -264,16 +262,12 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
desc->len = 0;
desc->flags = 0;
- if (skb && FREE_AFTER_TX(skb)) {
- spin_unlock_irqrestore(&priv->lock, flags);
+ if (skb && FREE_AFTER_TX(skb))
p54_free_skb(dev, skb);
- spin_lock_irqsave(&priv->lock, flags);
- }
i++;
i %= ring_limit;
}
- spin_unlock_irqrestore(&priv->lock, flags);
}
static void p54p_tasklet(unsigned long dev_id)
@@ -306,7 +300,6 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
struct p54p_priv *priv = dev->priv;
__le32 reg;
- spin_lock(&priv->lock);
reg = P54P_READ(int_ident);
if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
goto out;
@@ -321,15 +314,14 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
complete(&priv->boot_comp);
out:
- spin_unlock(&priv->lock);
return reg ? IRQ_HANDLED : IRQ_NONE;
}
static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
{
+ unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
- unsigned long flags;
struct p54p_desc *desc;
dma_addr_t mapping;
u32 device_idx, idx, i;
@@ -370,14 +362,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
unsigned int i;
struct p54p_desc *desc;
- tasklet_kill(&priv->tasklet);
-
P54P_WRITE(int_enable, cpu_to_le32(0));
P54P_READ(int_enable);
udelay(10);
free_irq(priv->pdev->irq, dev);
+ tasklet_kill(&priv->tasklet);
+
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
--
1.6.5

27
debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch vendored Normal file
View File

@ -0,0 +1,27 @@
From 15a69a81731d337a3d9db51692ff8704c1114f43 Mon Sep 17 00:00:00 2001
From: Shimada Hirofumi <hirofumi@flycat.org>
Date: Sun, 14 Feb 2010 04:16:16 +0900
Subject: [PATCH] p54usb: Add usbid for Corega CG-WLUSB2GT.
Signed-off-by: Shimada Hirofumi <hirofumi@flycat.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 92af9b9..dcb484b 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
/* Version 1 devices (pci chip + net2280) */
{USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
{USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
+ {USB_DEVICE(0x07aa, 0x001c)}, /* Corega CG-WLUSB2GT */
{USB_DEVICE(0x083a, 0x4501)}, /* Accton 802.11g WN4501 USB */
{USB_DEVICE(0x083a, 0x4502)}, /* Siemens Gigaset USB Adapter */
{USB_DEVICE(0x083a, 0x5501)}, /* Phillips CPWUA054 */
--
1.6.5

17
debian/patches/bugfix/all/phylib-fix-typo-in-bcm6xx-PHY-driver-table.patch vendored Normal file
View File

@ -0,0 +1,17 @@
From: Florian Fainelli <ffainelli@freebox.fr>
Subject: [PATCH] PHY: fix typo in bcm63xx PHY driver table
Date: Fri, 9 Apr 2010 13:04:45 +0200
Signed-off-by: Florian Fainelli <ffainelli@freebox.fr>
---
diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
index ac5e498..c128156 100644
--- a/drivers/net/phy/bcm63xx.c
+++ b/drivers/net/phy/bcm63xx.c
@@ -137,4 +137,4 @@ static struct mdio_device_id bcm63xx_tbl[] = {
{ }
};
-MODULE_DEVICE_TABLE(mdio, bcm64xx_tbl);
+MODULE_DEVICE_TABLE(mdio, bcm63xx_tbl);

79
debian/patches/bugfix/all/reiserfs-fix-permissions-on-reiserfs_priv.patch vendored Normal file
View File

@ -0,0 +1,79 @@
From: Jeff Mahoney <jeffm@suse.com>
Subject: [PATCH] reiserfs: Fix permissions on .reiserfs_priv
References: bnc#593906 CVE-2010-1146
Patch-mainline: Submitted 8 Apr 2010
Commit 677c9b2e393a0cd203bd54e9c18b012b2c73305a removed the magic
from the lookup code to hide the .reiserfs_priv directory since it
was getting loaded at mount-time instead. The intent was that the
entry would be hidden from the user via a poisoned d_compare, but
this was faulty.
This introduced a security issue where unpriviledged users could
access and modify extended attributes or ACLs belonging to other
users, including root.
This patch resolves the issue by properly hiding .reiserfs_priv. This
was the intent of the xattr poisoning code, but it appears to have
never worked as expected. This is fixed by using d_revalidate instead
of d_compare.
This patch makes -oexpose_privroot a no-op. I'm fine leaving it this
way. The effort involved in working out the corner cases wrt permissions
and caching outweigh the benefit of the feature.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
---
fs/reiserfs/dir.c | 2 --
fs/reiserfs/xattr.c | 17 ++++-------------
2 files changed, 4 insertions(+), 15 deletions(-)
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -45,8 +45,6 @@ static inline bool is_privroot_deh(struc
struct reiserfs_de_head *deh)
{
struct dentry *privroot = REISERFS_SB(dir->d_sb)->priv_root;
- if (reiserfs_expose_privroot(dir->d_sb))
- return 0;
return (dir == dir->d_parent && privroot->d_inode &&
deh->deh_objectid == INODE_PKEY(privroot->d_inode)->k_objectid);
}
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -972,21 +972,13 @@ int reiserfs_permission(struct inode *in
return generic_permission(inode, mask, NULL);
}
-/* This will catch lookups from the fs root to .reiserfs_priv */
-static int
-xattr_lookup_poison(struct dentry *dentry, struct qstr *q1, struct qstr *name)
+static int xattr_hide_revalidate(struct dentry *dentry, struct nameidata *nd)
{
- struct dentry *priv_root = REISERFS_SB(dentry->d_sb)->priv_root;
- if (container_of(q1, struct dentry, d_name) == priv_root)
- return -ENOENT;
- if (q1->len == name->len &&
- !memcmp(q1->name, name->name, name->len))
- return 0;
- return 1;
+ return -EPERM;
}
static const struct dentry_operations xattr_lookup_poison_ops = {
- .d_compare = xattr_lookup_poison,
+ .d_revalidate = xattr_hide_revalidate,
};
int reiserfs_lookup_privroot(struct super_block *s)
@@ -1000,8 +992,7 @@ int reiserfs_lookup_privroot(struct supe
strlen(PRIVROOT_NAME));
if (!IS_ERR(dentry)) {
REISERFS_SB(s)->priv_root = dentry;
- if (!reiserfs_expose_privroot(s))
- s->s_root->d_op = &xattr_lookup_poison_ops;
+ dentry->d_op = &xattr_lookup_poison_ops;
if (dentry->d_inode)
dentry->d_inode->i_flags |= S_PRIVATE;
} else

62
debian/patches/bugfix/all/rndis_host-Poll-status-channel-before-control-channel.patch vendored Normal file
View File

@ -0,0 +1,62 @@
From 1c941691a933e9c2d0314c9b84ea77b6ef2807e1 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Fri, 9 Apr 2010 01:55:27 +0100
Subject: [PATCH] rndis_host: Poll status channel before control channel
Some RNDIS devices don't respond on the control channel until polled
on the status channel. In particular, this was reported to be the
case for the 2Wire HomePortal 1000SW.
This is roughly based on a patch by John Carr <john.carr@unrouted.co.uk>
which is reported to be needed for use with some Windows Mobile devices
and which is currently applied by Mandriva.
Reported-by: Mark Glassberg <vzeeaxwl@myfairpoint.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Tested-by: Mark Glassberg <vzeeaxwl@myfairpoint.net>
---
drivers/net/usb/rndis_host.c | 18 ++++++++++++------
1 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index f56dec6..52faca1 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -103,8 +103,10 @@ static void rndis_msg_indicate(struct usbnet *dev, struct rndis_indicate *msg,
int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
{
struct cdc_state *info = (void *) &dev->data;
+ struct usb_cdc_notification notification;
int master_ifnum;
int retval;
+ int partial;
unsigned count;
__le32 rsp;
u32 xid = 0, msg_len, request_id;
@@ -132,13 +134,17 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
if (unlikely(retval < 0 || xid == 0))
return retval;
- // FIXME Seems like some devices discard responses when
- // we time out and cancel our "get response" requests...
- // so, this is fragile. Probably need to poll for status.
+ /* Some devices don't respond on the control channel until
+ * polled on the status channel, so do that first. */
+ retval = usb_interrupt_msg(
+ dev->udev,
+ usb_rcvintpipe(dev->udev, dev->status->desc.bEndpointAddress),
+ &notification, sizeof(notification), &partial,
+ RNDIS_CONTROL_TIMEOUT_MS);
+ if (unlikely(retval < 0))
+ return retval;
- /* ignore status endpoint, just poll the control channel;
- * the request probably completed immediately
- */
+ /* Poll the control channel; the request probably completed immediately */
rsp = buf->msg_type | RNDIS_MSG_COMPLETION;
for (count = 0; count < 10; count++) {
memset(buf, 0, CONTROL_BUFFER_SIZE);
--
1.7.0.3

218
debian/patches/bugfix/all/sctp-fix-skb_over_panic-resulting-from-multiple-invalid-parameter-errors.patch vendored Normal file
View File

@ -0,0 +1,218 @@
commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
Author: Neil Horman <nhorman@tuxdriver.com>
Date: Wed Apr 28 10:30:59 2010 +0000
sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4)
Ok, version 4
Change Notes:
1) Minor cleanups, from Vlads notes
Summary:
Hey-
Recently, it was reported to me that the kernel could oops in the
following way:
<5> kernel BUG at net/core/skbuff.c:91!
<5> invalid operand: 0000 [#1]
<5> Modules linked in: sctp netconsole nls_utf8 autofs4 sunrpc iptable_filter
ip_tables cpufreq_powersave parport_pc lp parport vmblock(U) vsock(U) vmci(U)
vmxnet(U) vmmemctl(U) vmhgfs(U) acpiphp dm_mirror dm_mod button battery ac md5
ipv6 uhci_hcd ehci_hcd snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss
snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_ac97_codec snd soundcore
pcnet32 mii floppy ext3 jbd ata_piix libata mptscsih mptsas mptspi mptscsi
mptbase sd_mod scsi_mod
<5> CPU: 0
<5> EIP: 0060:[<c02bff27>] Not tainted VLI
<5> EFLAGS: 00010216 (2.6.9-89.0.25.EL)
<5> EIP is at skb_over_panic+0x1f/0x2d
<5> eax: 0000002c ebx: c033f461 ecx: c0357d96 edx: c040fd44
<5> esi: c033f461 edi: df653280 ebp: 00000000 esp: c040fd40
<5> ds: 007b es: 007b ss: 0068
<5> Process swapper (pid: 0, threadinfo=c040f000 task=c0370be0)
<5> Stack: c0357d96 e0c29478 00000084 00000004 c033f461 df653280 d7883180
e0c2947d
<5> 00000000 00000080 df653490 00000004 de4f1ac0 de4f1ac0 00000004
df653490
<5> 00000001 e0c2877a 08000800 de4f1ac0 df653490 00000000 e0c29d2e
00000004
<5> Call Trace:
<5> [<e0c29478>] sctp_addto_chunk+0xb0/0x128 [sctp]
<5> [<e0c2947d>] sctp_addto_chunk+0xb5/0x128 [sctp]
<5> [<e0c2877a>] sctp_init_cause+0x3f/0x47 [sctp]
<5> [<e0c29d2e>] sctp_process_unk_param+0xac/0xb8 [sctp]
<5> [<e0c29e90>] sctp_verify_init+0xcc/0x134 [sctp]
<5> [<e0c20322>] sctp_sf_do_5_1B_init+0x83/0x28e [sctp]
<5> [<e0c25333>] sctp_do_sm+0x41/0x77 [sctp]
<5> [<c01555a4>] cache_grow+0x140/0x233
<5> [<e0c26ba1>] sctp_endpoint_bh_rcv+0xc5/0x108 [sctp]
<5> [<e0c2b863>] sctp_inq_push+0xe/0x10 [sctp]
<5> [<e0c34600>] sctp_rcv+0x454/0x509 [sctp]
<5> [<e084e017>] ipt_hook+0x17/0x1c [iptable_filter]
<5> [<c02d005e>] nf_iterate+0x40/0x81
<5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151
<5> [<c02e0c7f>] ip_local_deliver_finish+0xc6/0x151
<5> [<c02d0362>] nf_hook_slow+0x83/0xb5
<5> [<c02e0bb2>] ip_local_deliver+0x1a2/0x1a9
<5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151
<5> [<c02e103e>] ip_rcv+0x334/0x3b4
<5> [<c02c66fd>] netif_receive_skb+0x320/0x35b
<5> [<e0a0928b>] init_stall_timer+0x67/0x6a [uhci_hcd]
<5> [<c02c67a4>] process_backlog+0x6c/0xd9
<5> [<c02c690f>] net_rx_action+0xfe/0x1f8
<5> [<c012a7b1>] __do_softirq+0x35/0x79
<5> [<c0107efb>] handle_IRQ_event+0x0/0x4f
<5> [<c01094de>] do_softirq+0x46/0x4d
Its an skb_over_panic BUG halt that results from processing an init chunk in
which too many of its variable length parameters are in some way malformed.
The problem is in sctp_process_unk_param:
if (NULL == *errp)
*errp = sctp_make_op_error_space(asoc, chunk,
ntohs(chunk->chunk_hdr->length));
if (*errp) {
sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
WORD_ROUND(ntohs(param.p->length)));
sctp_addto_chunk(*errp,
WORD_ROUND(ntohs(param.p->length)),
param.v);
When we allocate an error chunk, we assume that the worst case scenario requires
that we have chunk_hdr->length data allocated, which would be correct nominally,
given that we call sctp_addto_chunk for the violating parameter. Unfortunately,
we also, in sctp_init_cause insert a sctp_errhdr_t structure into the error
chunk, so the worst case situation in which all parameters are in violation
requires chunk_hdr->length+(sizeof(sctp_errhdr_t)*param_count) bytes of data.
The result of this error is that a deliberately malformed packet sent to a
listening host can cause a remote DOS, described in CVE-2010-1173:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1173
I've tested the below fix and confirmed that it fixes the issue. We move to a
strategy whereby we allocate a fixed size error chunk and ignore errors we don't
have space to report. Tested by me successfully
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff30177..597f8e2 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
struct iovec *data);
void sctp_chunk_free(struct sctp_chunk *);
void *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
struct sctp_chunk *sctp_chunkify(struct sk_buff *,
const struct sctp_association *,
struct sock *);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 0fd5b4c..30c1767 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -108,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
cpu_to_be16(sizeof(struct sctp_paramhdr)),
};
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
* provided chunk, as most cause codes will be embedded inside an
* abort chunk.
*/
@@ -125,6 +125,29 @@ void sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
}
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk. Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+ size_t paylen)
+{
+ sctp_errhdr_t err;
+ __u16 len;
+
+ /* Cause code constants are now defined in network order. */
+ err.cause = cause_code;
+ len = sizeof(sctp_errhdr_t) + paylen;
+ err.length = htons(len);
+
+ if (skb_tailroom(chunk->skb) > len)
+ return -ENOSPC;
+ chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ sizeof(sctp_errhdr_t),
+ &err);
+ return 0;
+}
/* 3.3.2 Initiation (INIT) (1)
*
* This chunk is used to initiate a SCTP association between two
@@ -1132,6 +1155,24 @@ nodata:
return retval;
}
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+ const struct sctp_association *asoc,
+ const struct sctp_chunk *chunk)
+{
+ size_t size = asoc ? asoc->pathmtu : 0;
+
+ if (!size)
+ size = SCTP_DEFAULT_MAXSEGMENT;
+
+ return sctp_make_op_error_space(asoc, chunk, size);
+}
+
/* Create an Operation Error chunk. */
struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
const struct sctp_chunk *chunk,
@@ -1374,6 +1415,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
return target;
}
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ int len, const void *data)
+{
+ if (skb_tailroom(chunk->skb) > len)
+ return sctp_addto_chunk(chunk, len, data);
+ else
+ return NULL;
+}
+
/* Append bytes from user space to the end of a chunk. Will panic if
* chunk is not big enough.
* Returns a kernel err value.
@@ -1977,13 +2030,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
* returning multiple unknown parameters.
*/
if (NULL == *errp)
- *errp = sctp_make_op_error_space(asoc, chunk,
- ntohs(chunk->chunk_hdr->length));
+ *errp = sctp_make_op_error_fixed(asoc, chunk);
if (*errp) {
- sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+ sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
WORD_ROUND(ntohs(param.p->length)));
- sctp_addto_chunk(*errp,
+ sctp_addto_chunk_fixed(*errp,
WORD_ROUND(ntohs(param.p->length)),
param.v);
} else {

16
debian/patches/bugfix/all/thinkpad-acpi-add-x100e.patch vendored Normal file
View File

@ -0,0 +1,16 @@
From: Matthew Garrett <mjg@redhat.com>
Date: Wed Apr 21 14:13:22 2010 UTC
Subject: Add EC path for Thinkpad X100
diff -up linux-2.6.32.noarch/drivers/platform/x86/thinkpad_acpi.c.mjg linux-2.6.32.noarch/drivers/platform/x86/thinkpad_acpi.c
--- linux-2.6.32.noarch/drivers/platform/x86/thinkpad_acpi.c.mjg 2010-04-21 10:02:53.658034129 -0400
+++ linux-2.6.32.noarch/drivers/platform/x86/thinkpad_acpi.c 2010-04-21 10:03:30.402030108 -0400
@@ -491,6 +491,7 @@ TPACPI_HANDLE(ec, root, "\\_SB.PCI0.ISA.
"\\_SB.PCI0.ISA.EC", /* A21e, A2xm/p, T20-22, X20-21 */
"\\_SB.PCI0.AD4S.EC0", /* i1400, R30 */
"\\_SB.PCI0.ICH3.EC0", /* R31 */
+ "\\_SB.PCI0.LPC0.EC", /* X100e */
"\\_SB.PCI0.LPC.EC", /* all others */
);

209
debian/patches/bugfix/all/tipc-fix-oops-on-send-prior-to-entering-networked-mode.patch vendored Normal file
View File

@ -0,0 +1,209 @@
commit d0021b252eaf65ca07ed14f0d66425dd9ccab9a6
Author: Neil Horman <nhorman@tuxdriver.com>
Date: Wed Mar 3 08:31:23 2010 +0000
tipc: Fix oops on send prior to entering networked mode (v3)
Fix TIPC to disallow sending to remote addresses prior to entering NET_MODE
user programs can oops the kernel by sending datagrams via AF_TIPC prior to
entering networked mode. The following backtrace has been observed:
ID: 13459 TASK: ffff810014640040 CPU: 0 COMMAND: "tipc-client"
[exception RIP: tipc_node_select_next_hop+90]
RIP: ffffffff8869d3c3 RSP: ffff81002d9a5ab8 RFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000001001001
RBP: 0000000001001001 R8: 0074736575716552 R9: 0000000000000000
R10: ffff81003fbd0680 R11: 00000000000000c8 R12: 0000000000000008
R13: 0000000000000001 R14: 0000000000000001 R15: ffff810015c6ca00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
RIP: 0000003cbd8d49a3 RSP: 00007fffc84e0be8 RFLAGS: 00010206
RAX: 000000000000002c RBX: ffffffff8005d116 RCX: 0000000000000000
RDX: 0000000000000008 RSI: 00007fffc84e0c00 RDI: 0000000000000003
RBP: 0000000000000000 R8: 00007fffc84e0c10 R9: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc84e0d10 R14: 0000000000000000 R15: 00007fffc84e0c30
ORIG_RAX: 000000000000002c CS: 0033 SS: 002b
What happens is that, when the tipc module in inserted it enters a standalone
node mode in which communication to its own address is allowed <0.0.0> but not
to other addresses, since the appropriate data structures have not been
allocated yet (specifically the tipc_net pointer). There is nothing stopping a
client from trying to send such a message however, and if that happens, we
attempt to dereference tipc_net.zones while the pointer is still NULL, and
explode. The fix is pretty straightforward. Since these oopses all arise from
the dereference of global pointers prior to their assignment to allocated
values, and since these allocations are small (about 2k total), lets convert
these pointers to static arrays of the appropriate size. All the accesses to
these bits consider 0/NULL to be a non match when searching, so all the lookups
still work properly, and there is no longer a chance of a bad dererence
anywhere. As a bonus, this lets us eliminate the setup/teardown routines for
those pointers, and elimnates the need to preform any locking around them to
prevent access while their being allocated/freed.
I've updated the tipc_net structure to behave this way to fix the exact reported
problem, and also fixed up the tipc_bearers and media_list arrays to fix an
obvious simmilar problem that arises from issuing tipc-config commands to
manipulate bearers/links prior to entering networked mode
I've tested this for a few hours by running the sanity tests and stress test
with the tipcutils suite, and nothing has fallen over. There have been a few
lockdep warnings, but those were there before, and can be addressed later, as
they didn't actually result in any deadlock.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Allan Stephens <allan.stephens@windriver.com>
CC: David S. Miller <davem@davemloft.net>
CC: tipc-discussion@lists.sourceforge.net
bearer.c | 37 ++++++-------------------------------
bearer.h | 2 +-
net.c | 25 ++++---------------------
3 files changed, 11 insertions(+), 53 deletions(-)
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 327011f..7809137 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -45,10 +45,10 @@
#define MAX_ADDR_STR 32
-static struct media *media_list = NULL;
+static struct media media_list[MAX_MEDIA];
static u32 media_count = 0;
-struct bearer *tipc_bearers = NULL;
+struct bearer tipc_bearers[MAX_BEARERS];
/**
* media_name_valid - validate media name
@@ -108,9 +108,11 @@ int tipc_register_media(u32 media_type,
int res = -EINVAL;
write_lock_bh(&tipc_net_lock);
- if (!media_list)
- goto exit;
+ if (tipc_mode != TIPC_NET_MODE) {
+ warn("Media <%s> rejected, not in networked mode yet\n", name);
+ goto exit;
+ }
if (!media_name_valid(name)) {
warn("Media <%s> rejected, illegal name\n", name);
goto exit;
@@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name)
-int tipc_bearer_init(void)
-{
- int res;
-
- write_lock_bh(&tipc_net_lock);
- tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC);
- media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC);
- if (tipc_bearers && media_list) {
- res = 0;
- } else {
- kfree(tipc_bearers);
- kfree(media_list);
- tipc_bearers = NULL;
- media_list = NULL;
- res = -ENOMEM;
- }
- write_unlock_bh(&tipc_net_lock);
- return res;
-}
-
void tipc_bearer_stop(void)
{
u32 i;
- if (!tipc_bearers)
- return;
-
for (i = 0; i < MAX_BEARERS; i++) {
if (tipc_bearers[i].active)
tipc_bearers[i].publ.blocked = 1;
@@ -695,10 +674,6 @@ void tipc_bearer_stop(void)
if (tipc_bearers[i].active)
bearer_disable(tipc_bearers[i].publ.name);
}
- kfree(tipc_bearers);
- kfree(media_list);
- tipc_bearers = NULL;
- media_list = NULL;
media_count = 0;
}
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index ca57348..000228e 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -114,7 +114,7 @@ struct bearer_name {
struct link;
-extern struct bearer *tipc_bearers;
+extern struct bearer tipc_bearers[];
void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a);
struct sk_buff *tipc_media_get_names(void);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7906608..f25b1cd 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -116,7 +116,8 @@
*/
DEFINE_RWLOCK(tipc_net_lock);
-struct network tipc_net = { NULL };
+struct _zone *tipc_zones[256] = { NULL, };
+struct network tipc_net = { tipc_zones };
struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref)
{
@@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 dest)
}
}
-static int net_init(void)
-{
- memset(&tipc_net, 0, sizeof(tipc_net));
- tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC);
- if (!tipc_net.zones) {
- return -ENOMEM;
- }
- return 0;
-}
-
static void net_stop(void)
{
u32 z_num;
- if (!tipc_net.zones)
- return;
-
- for (z_num = 1; z_num <= tipc_max_zones; z_num++) {
+ for (z_num = 1; z_num <= tipc_max_zones; z_num++)
tipc_zone_delete(tipc_net.zones[z_num]);
- }
- kfree(tipc_net.zones);
- tipc_net.zones = NULL;
}
static void net_route_named_msg(struct sk_buff *buf)
@@ -282,9 +267,7 @@ int tipc_net_start(u32 addr)
tipc_named_reinit();
tipc_port_reinit();
- if ((res = tipc_bearer_init()) ||
- (res = net_init()) ||
- (res = tipc_cltr_init()) ||
+ if ((res = tipc_cltr_init()) ||
(res = tipc_bclink_init())) {
return res;
}

25
debian/patches/bugfix/mips/drm-ttm-build-fix.patch vendored Normal file
View File

@ -0,0 +1,25 @@
drm/ttm: Fix build failure due to missing struct page
drm/ttm fails to build on MIPS because "struct page" is not known:
| In file included from drivers/gpu/drm/ttm/ttm_memory.c:28:
| include/drm/ttm/ttm_memory.h:154: warning: 'struct page' declared inside parameter list
| include/drm/ttm/ttm_memory.h:154: warning: its scope is only this definition or declaration, which is probably not what you want
| include/drm/ttm/ttm_memory.h:156: warning: 'struct page' declared inside parameter list
| drivers/gpu/drm/ttm/ttm_memory.c:540: error: conflicting types for 'ttm_mem_global_alloc_page'
| include/drm/ttm/ttm_memory.h:154: error: previous declaration of 'ttm_mem_global_alloc_page' was here
| drivers/gpu/drm/ttm/ttm_memory.c:561: error: conflicting types for 'ttm_mem_global_free_page'
| include/drm/ttm/ttm_memory.h:156: error: previous declaration of 'ttm_mem_global_free_page' was here
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
--- a/include/drm/ttm/ttm_memory.h
+++ b/include/drm/ttm/ttm_memory.h
@@ -33,6 +33,7 @@
#include <linux/wait.h>
#include <linux/errno.h>
#include <linux/kobject.h>
+#include <linux/mm.h>
/**
* struct ttm_mem_shrink - callback to shrink TTM memory usage.

36
debian/patches/bugfix/mips/enable-pata-platform.patch vendored Normal file
View File

@ -0,0 +1,36 @@
From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Subject: mips: enable PATA platform on SWARM and LITTLESUR
according to include/asm/sibyte/swarm.h both systems provide a
platform device for the ide controler. Until now the IDE subsystem was
used which is deprecated by now. The same structure can be used with the
PATA driver.
This was tested on SWARM.
Signed-off-by: Sebastian Andrzej Siewior <sebatian@breakpoint.cc>
---
arch/mips/Kconfig | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 29e8692..98628ec 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -499,6 +500,7 @@ config SIBYTE_SWARM
bool "Sibyte BCM91250A-SWARM"
select BOOT_ELF32
select DMA_COHERENT
+ select HAVE_PATA_PLATFORM
select NR_CPUS_DEFAULT_2
select SIBYTE_SB1250
select SWAP_IO_SPACE
@@ -513,6 +514,7 @@ config SIBYTE_LITTLESUR
depends on EXPERIMENTAL
select BOOT_ELF32
select DMA_COHERENT
+ select HAVE_PATA_PLATFORM
select NR_CPUS_DEFAULT_2
select SIBYTE_SB1250
select SWAP_IO_SPACE
--
1.6.6.1

44
debian/patches/bugfix/powerpc/kgdb-dont-needlessly-skip-PAGE_USER-test-for-Fsl-booke.patch vendored Normal file
View File

@ -0,0 +1,44 @@
From 56151e753468e34aeb322af4b0309ab727c97d2e Mon Sep 17 00:00:00 2001
From: Wufei <fei.wu@windriver.com>
Date: Wed, 28 Apr 2010 17:42:32 -0400
Subject: [PATCH] kgdb: don't needlessly skip PAGE_USER test for Fsl booke
The bypassing of this test is a leftover from 2.4 vintage
kernels, and is no longer appropriate, or even used by KGDB.
Currently KGDB uses probe_kernel_write() for all access to
memory via the KGDB core, so it can simply be deleted.
This fixes CVE-2010-1446.
CC: Benjamin Herrenschmidt <benh@kernel.crashing.org>
CC: Paul Mackerras <paulus@samba.org>
CC: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Wufei <fei.wu@windriver.com>
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
---
arch/powerpc/mm/fsl_booke_mmu.c | 5 -----
1 files changed, 0 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
index c539472..1ce9dd5 100644
--- a/arch/powerpc/mm/fsl_booke_mmu.c
+++ b/arch/powerpc/mm/fsl_booke_mmu.c
@@ -155,15 +155,10 @@ static void settlbcam(int index, unsigned long virt, phys_addr_t phys,
if (cur_cpu_spec->cpu_features & MMU_FTR_BIG_PHYS)
TLBCAM[index].MAS7 = (u64)phys >> 32;
-#ifndef CONFIG_KGDB /* want user access for breakpoints */
if (flags & _PAGE_USER) {
TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
}
-#else
- TLBCAM[index].MAS3 |= MAS3_UX | MAS3_UR;
- TLBCAM[index].MAS3 |= ((flags & _PAGE_RW) ? MAS3_UW : 0);
-#endif
tlbcam_addrs[index].start = virt;
tlbcam_addrs[index].limit = virt + size - 1;
--
1.7.0.3

42
debian/patches/bugfix/x86/PCI-Disable-MSI-for-MCP55-on-P5N32-E-SLI.patch vendored Normal file
View File

@ -0,0 +1,42 @@
From c0613ff21bef2595aebd8f33f36e52a7528e8cb0 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Wed, 7 Apr 2010 03:22:51 +0100
Subject: [PATCH] PCI: Disable MSI for MCP55 on P5N32-E SLI
As reported in <http://bugs.debian.org/552299>, MSI appears to be
broken for this on-board device. We already have a quirk for the
P5N32-SLI Premium; extend it to cover both variants of the board.
Reported-by: Romain DEGEZ <romain.degez@smartjog.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/pci/quirks.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 27c0e6e..4807825 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2218,15 +2218,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
ht_enable_msi_mapping);
-/* The P5N32-SLI Premium motherboard from Asus has a problem with msi
+/* The P5N32-SLI motherboards from Asus have a problem with msi
* for the MCP55 NIC. It is not yet determined whether the msi problem
* also affects other devices. As for now, turn off msi for this device.
*/
static void __devinit nvenet_msi_disable(struct pci_dev *dev)
{
- if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) {
+ if (dmi_name_in_vendors("P5N32-SLI PREMIUM") ||
+ dmi_name_in_vendors("P5N32-E SLI")) {
dev_info(&dev->dev,
- "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n");
+ "Disabling msi for MCP55 NIC on P5N32-SLI\n");
dev->no_msi = 1;
}
}
--
1.7.0.3

11729
debian/patches/features/all/drm-radeon-evergreen.patch vendored Normal file
View File

File diff suppressed because it is too large Load Diff

638
debian/patches/features/all/ipheth-add.patch vendored Normal file
View File

@ -0,0 +1,638 @@
Subject: drivers/net/usb: Add new driver ipheth
Date: Sun, 18 Apr 2010 08:35:16 -0000
From: Diego Giagio <diego@giagio.com>
Add new driver to use tethering with an iPhone device. After initial submission,
apply fixes to fit the new driver into the kernel standards.
There are still a couple of minor (almost cosmetic-level) issues, but the driver
is fully functional right now.
Signed-off-by: L. Alberto Giménez <agimenez@sysvalve.es>
Signed-off-by: Diego Giagio <diego@giagio.com>
---
drivers/net/Makefile | 1 +
drivers/net/usb/Kconfig | 12 +
drivers/net/usb/Makefile | 1 +
drivers/net/usb/ipheth.c | 568 ++++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 582 insertions(+), 0 deletions(-)
create mode 100644 drivers/net/usb/ipheth.c
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50..12b280a 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150) += usb/
obj-$(CONFIG_USB_HSO) += usb/
obj-$(CONFIG_USB_USBNET) += usb/
obj-$(CONFIG_USB_ZD1201) += usb/
+obj-$(CONFIG_USB_IPHETH) += usb/
obj-y += wireless/
obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4..63be4ca 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,16 @@ config USB_CDC_PHONET
cellular modem, as found on most Nokia handsets with the
"PC suite" USB profile.
+config USB_IPHETH
+ tristate "Apple iPhone USB Ethernet driver"
+ default n
+ ---help---
+ Module used to share Internet connection (tethering) from your
+ iPhone (Original, 3G and 3GS) to your system.
+ Note that you need userspace libraries and programs that are needed
+ to pair your device with your system and that understand the iPhone
+ protocol.
+
+ For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+
endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea629..edb09c0 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,5 @@ obj-$(CONFIG_USB_NET_MCS7830) += mcs7830.o
obj-$(CONFIG_USB_USBNET) += usbnet.o
obj-$(CONFIG_USB_NET_INT51X1) += int51x1.o
obj-$(CONFIG_USB_CDC_PHONET) += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH) += ipheth.o
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 0000000..fd10331
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,568 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ * may be used to endorse or promote products derived from this software
+ * without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+
+#define USB_VENDOR_APPLE 0x05ac
+#define USB_PRODUCT_IPHONE 0x1290
+#define USB_PRODUCT_IPHONE_3G 0x1292
+#define USB_PRODUCT_IPHONE_3GS 0x1294
+
+#define IPHETH_USBINTF_CLASS 255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO 1
+
+#define IPHETH_BUF_SIZE 1516
+#define IPHETH_TX_TIMEOUT (5 * HZ)
+
+#define IPHETH_INTFNUM 2
+#define IPHETH_ALT_INTFNUM 1
+
+#define IPHETH_CTRL_ENDP 0x00
+#define IPHETH_CTRL_BUF_SIZE 0x40
+#define IPHETH_CTRL_TIMEOUT (5 * HZ)
+
+#define IPHETH_CMD_GET_MACADDR 0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON 0x04
+
+static struct usb_device_id ipheth_table[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(
+ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+ IPHETH_USBINTF_PROTO) },
+ { USB_DEVICE_AND_INTERFACE_INFO(
+ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+ IPHETH_USBINTF_PROTO) },
+ { USB_DEVICE_AND_INTERFACE_INFO(
+ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+ IPHETH_USBINTF_PROTO) },
+ { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+
+struct ipheth_device {
+ struct usb_device *udev;
+ struct usb_interface *intf;
+ struct net_device *net;
+ struct sk_buff *tx_skb;
+ struct urb *tx_urb;
+ struct urb *rx_urb;
+ unsigned char *tx_buf;
+ unsigned char *rx_buf;
+ unsigned char *ctrl_buf;
+ u8 bulk_in;
+ u8 bulk_out;
+ struct delayed_work carrier_work;
+};
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+ struct urb *tx_urb = NULL;
+ struct urb *rx_urb = NULL;
+ u8 *tx_buf = NULL;
+ u8 *rx_buf = NULL;
+
+ tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (tx_urb == NULL)
+ goto error;
+
+ rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (rx_urb == NULL)
+ goto error;
+
+ tx_buf = usb_buffer_alloc(iphone->udev,
+ IPHETH_BUF_SIZE,
+ GFP_KERNEL,
+ &tx_urb->transfer_dma);
+ if (tx_buf == NULL)
+ goto error;
+
+ rx_buf = usb_buffer_alloc(iphone->udev,
+ IPHETH_BUF_SIZE,
+ GFP_KERNEL,
+ &rx_urb->transfer_dma);
+ if (rx_buf == NULL)
+ goto error;
+
+
+ iphone->tx_urb = tx_urb;
+ iphone->rx_urb = rx_urb;
+ iphone->tx_buf = tx_buf;
+ iphone->rx_buf = rx_buf;
+ return 0;
+
+error:
+ usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
+ rx_urb->transfer_dma);
+ usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+ tx_urb->transfer_dma);
+ usb_free_urb(rx_urb);
+ usb_free_urb(tx_urb);
+ return -ENOMEM;
+}
+
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+ usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+ iphone->rx_urb->transfer_dma);
+ usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+ iphone->tx_urb->transfer_dma);
+ usb_free_urb(iphone->rx_urb);
+ usb_free_urb(iphone->tx_urb);
+}
+
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+ usb_kill_urb(dev->tx_urb);
+ usb_kill_urb(dev->rx_urb);
+}
+
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+ struct ipheth_device *dev;
+ struct sk_buff *skb;
+ int status;
+ char *buf;
+ int len;
+
+ dev = urb->context;
+ if (dev == NULL)
+ return;
+
+ status = urb->status;
+ switch (status) {
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ return;
+ case 0:
+ break;
+ default:
+ err("%s: urb status: %d", __func__, urb->status);
+ return;
+ }
+
+ len = urb->actual_length;
+ buf = urb->transfer_buffer;
+
+ skb = dev_alloc_skb(NET_IP_ALIGN + len);
+ if (!skb) {
+ err("%s: dev_alloc_skb: -ENOMEM", __func__);
+ dev->net->stats.rx_dropped++;
+ return;
+ }
+
+ skb_reserve(skb, NET_IP_ALIGN);
+ memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+ skb->dev = dev->net;
+ skb->protocol = eth_type_trans(skb, dev->net);
+
+ dev->net->stats.rx_packets++;
+ dev->net->stats.rx_bytes += len;
+
+ netif_rx(skb);
+ ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+ struct ipheth_device *dev;
+
+ dev = urb->context;
+ if (dev == NULL)
+ return;
+
+ if (urb->status != 0 &&
+ urb->status != -ENOENT &&
+ urb->status != -ECONNRESET &&
+ urb->status != -ESHUTDOWN)
+ err("%s: urb status: %d", __func__, urb->status);
+
+ dev_kfree_skb_irq(dev->tx_skb);
+ netif_wake_queue(dev->net);
+}
+
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+ struct usb_device *udev = dev->udev;
+ int retval;
+
+ retval = usb_control_msg(udev,
+ usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+ IPHETH_CMD_CARRIER_CHECK, /* request */
+ 0xc0, /* request type */
+ 0x00, /* value */
+ 0x02, /* index */
+ dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+ IPHETH_CTRL_TIMEOUT);
+ if (retval < 0) {
+ err("%s: usb_control_msg: %d", __func__, retval);
+ return retval;
+ }
+
+ if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+ netif_carrier_on(dev->net);
+ else
+ netif_carrier_off(dev->net);
+
+ return 0;
+}
+
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+ struct ipheth_device *dev = container_of(work, struct ipheth_device,
+ carrier_work.work);
+
+ ipheth_carrier_set(dev);
+ schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+ struct usb_device *udev = dev->udev;
+ struct net_device *net = dev->net;
+ int retval;
+
+ retval = usb_control_msg(udev,
+ usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+ IPHETH_CMD_GET_MACADDR, /* request */
+ 0xc0, /* request type */
+ 0x00, /* value */
+ 0x02, /* index */
+ dev->ctrl_buf,
+ IPHETH_CTRL_BUF_SIZE,
+ IPHETH_CTRL_TIMEOUT);
+ if (retval < 0) {
+ err("%s: usb_control_msg: %d", __func__, retval);
+ } else if (retval < ETH_ALEN) {
+ err("%s: usb_control_msg: short packet: %d bytes",
+ __func__, retval);
+ retval = -EINVAL;
+ } else {
+ memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+ retval = 0;
+ }
+
+ return retval;
+}
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+ struct usb_device *udev = dev->udev;
+ int retval;
+
+ usb_fill_bulk_urb(dev->rx_urb, udev,
+ usb_rcvbulkpipe(udev, dev->bulk_in),
+ dev->rx_buf, IPHETH_BUF_SIZE,
+ ipheth_rcvbulk_callback,
+ dev);
+ dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ retval = usb_submit_urb(dev->rx_urb, mem_flags);
+ if (retval)
+ err("%s: usb_submit_urb: %d", __func__, retval);
+ return retval;
+}
+
+static int ipheth_open(struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+ struct usb_device *udev = dev->udev;
+ int retval = 0;
+
+ usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+
+ retval = ipheth_carrier_set(dev);
+ if (retval)
+ return retval;
+
+ retval = ipheth_rx_submit(dev, GFP_KERNEL);
+ if (retval)
+ return retval;
+
+ schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+ netif_start_queue(net);
+ return retval;
+}
+
+static int ipheth_close(struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+
+ cancel_delayed_work_sync(&dev->carrier_work);
+ netif_stop_queue(net);
+ return 0;
+}
+
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+ struct usb_device *udev = dev->udev;
+ int retval;
+
+ /* Paranoid */
+ if (skb->len > IPHETH_BUF_SIZE) {
+ WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+ dev->net->stats.tx_dropped++;
+ dev_kfree_skb_irq(skb);
+ return NETDEV_TX_OK;
+ }
+
+ memcpy(dev->tx_buf, skb->data, skb->len);
+ if (skb->len < IPHETH_BUF_SIZE)
+ memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+
+ usb_fill_bulk_urb(dev->tx_urb, udev,
+ usb_sndbulkpipe(udev, dev->bulk_out),
+ dev->tx_buf, IPHETH_BUF_SIZE,
+ ipheth_sndbulk_callback,
+ dev);
+ dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+ if (retval) {
+ err("%s: usb_submit_urb: %d", __func__, retval);
+ dev->net->stats.tx_errors++;
+ dev_kfree_skb_irq(skb);
+ } else {
+ dev->tx_skb = skb;
+
+ dev->net->stats.tx_packets++;
+ dev->net->stats.tx_bytes += skb->len;
+ netif_stop_queue(net);
+ }
+
+ return NETDEV_TX_OK;
+}
+
+static void ipheth_tx_timeout(struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+
+ err("%s: TX timeout", __func__);
+ dev->net->stats.tx_errors++;
+ usb_unlink_urb(dev->tx_urb);
+}
+
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+ return &dev->net->stats;
+}
+
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+ struct ipheth_device *dev = netdev_priv(net);
+ return netif_carrier_ok(dev->net);
+}
+
+static struct ethtool_ops ops = {
+ .get_link = ipheth_ethtool_op_get_link
+};
+
+static const struct net_device_ops ipheth_netdev_ops = {
+ .ndo_open = &ipheth_open,
+ .ndo_stop = &ipheth_close,
+ .ndo_start_xmit = &ipheth_tx,
+ .ndo_tx_timeout = &ipheth_tx_timeout,
+ .ndo_get_stats = &ipheth_stats,
+};
+
+static struct device_type ipheth_type = {
+ .name = "wwan",
+};
+
+static int ipheth_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct usb_host_interface *hintf;
+ struct usb_endpoint_descriptor *endp;
+ struct ipheth_device *dev;
+ struct net_device *netdev;
+ int i;
+ int retval;
+
+ netdev = alloc_etherdev(sizeof(struct ipheth_device));
+ if (!netdev)
+ return -ENOMEM;
+
+ netdev->netdev_ops = &ipheth_netdev_ops;
+ netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+ strcpy(netdev->name, "wwan%d");
+
+ dev = netdev_priv(netdev);
+ dev->udev = udev;
+ dev->net = netdev;
+ dev->intf = intf;
+
+ /* Set up endpoints */
+ hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+ if (hintf == NULL) {
+ retval = -ENODEV;
+ err("Unable to find alternate settings interface");
+ goto err_endpoints;
+ }
+
+ for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+ endp = &hintf->endpoint[i].desc;
+ if (usb_endpoint_is_bulk_in(endp))
+ dev->bulk_in = endp->bEndpointAddress;
+ else if (usb_endpoint_is_bulk_out(endp))
+ dev->bulk_out = endp->bEndpointAddress;
+ }
+ if (!(dev->bulk_in && dev->bulk_out)) {
+ retval = -ENODEV;
+ err("Unable to find endpoints");
+ goto err_endpoints;
+ }
+
+ dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+ if (dev->ctrl_buf == NULL) {
+ retval = -ENOMEM;
+ goto err_alloc_ctrl_buf;
+ }
+
+ retval = ipheth_get_macaddr(dev);
+ if (retval)
+ goto err_get_macaddr;
+
+ INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+
+ retval = ipheth_alloc_urbs(dev);
+ if (retval) {
+ err("error allocating urbs: %d", retval);
+ goto err_alloc_urbs;
+ }
+
+ usb_set_intfdata(intf, dev);
+
+ SET_NETDEV_DEV(netdev, &intf->dev);
+ SET_ETHTOOL_OPS(netdev, &ops);
+ SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+
+ retval = register_netdev(netdev);
+ if (retval) {
+ err("error registering netdev: %d", retval);
+ retval = -EIO;
+ goto err_register_netdev;
+ }
+
+ dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+ return 0;
+
+err_register_netdev:
+ ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+ kfree(dev->ctrl_buf);
+err_endpoints:
+ free_netdev(netdev);
+ return retval;
+}
+
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+ struct ipheth_device *dev;
+
+ dev = usb_get_intfdata(intf);
+ if (dev != NULL) {
+ unregister_netdev(dev->net);
+ ipheth_kill_urbs(dev);
+ ipheth_free_urbs(dev);
+ kfree(dev->ctrl_buf);
+ free_netdev(dev->net);
+ }
+ usb_set_intfdata(intf, NULL);
+ dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+
+static struct usb_driver ipheth_driver = {
+ .name = "ipheth",
+ .probe = ipheth_probe,
+ .disconnect = ipheth_disconnect,
+ .id_table = ipheth_table,
+};
+
+static int __init ipheth_init(void)
+{
+ int retval;
+
+ retval = usb_register(&ipheth_driver);
+ if (retval) {
+ err("usb_register failed: %d", retval);
+ return retval;
+ }
+ return 0;
+}
+
+static void __exit ipheth_exit(void)
+{
+ usb_deregister(&ipheth_driver);
+}
+
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");

266
debian/patches/features/all/phylib-Add-module-table-to-all-existing-phy-drivers.patch vendored Normal file
View File

@ -0,0 +1,266 @@
From 4e4f10f6498bc5038c0a110b5f21682fcb5578d7 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw2@infradead.org>
Date: Fri, 2 Apr 2010 01:05:56 +0000
Subject: [PATCH 2/2] phylib: Add module table to all existing phy drivers
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/phy/bcm63xx.c | 8 ++++++++
drivers/net/phy/broadcom.c | 16 ++++++++++++++++
drivers/net/phy/cicada.c | 8 ++++++++
drivers/net/phy/davicom.c | 9 +++++++++
drivers/net/phy/et1011c.c | 7 +++++++
drivers/net/phy/icplus.c | 7 +++++++
drivers/net/phy/lxt.c | 8 ++++++++
drivers/net/phy/marvell.c | 13 +++++++++++++
drivers/net/phy/national.c | 7 +++++++
drivers/net/phy/qsemi.c | 7 +++++++
drivers/net/phy/realtek.c | 7 +++++++
drivers/net/phy/smsc.c | 11 +++++++++++
drivers/net/phy/ste10Xp.c | 8 ++++++++
drivers/net/phy/vitesse.c | 8 ++++++++
14 files changed, 124 insertions(+), 0 deletions(-)
diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
index 4fed95e..ac5e498 100644
--- a/drivers/net/phy/bcm63xx.c
+++ b/drivers/net/phy/bcm63xx.c
@@ -130,3 +130,11 @@ static void __exit bcm63xx_phy_exit(void)
module_init(bcm63xx_phy_init);
module_exit(bcm63xx_phy_exit);
+
+static struct mdio_device_id bcm63xx_tbl[] = {
+ { 0x00406000, 0xfffffc00 },
+ { 0x002bdc00, 0xfffffc00 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, bcm64xx_tbl);
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index f482fc4..cecdbbd 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -908,3 +908,19 @@ static void __exit broadcom_exit(void)
module_init(broadcom_init);
module_exit(broadcom_exit);
+
+static struct mdio_device_id broadcom_tbl[] = {
+ { 0x00206070, 0xfffffff0 },
+ { 0x002060e0, 0xfffffff0 },
+ { 0x002060c0, 0xfffffff0 },
+ { 0x002060b0, 0xfffffff0 },
+ { 0x0143bca0, 0xfffffff0 },
+ { 0x0143bcb0, 0xfffffff0 },
+ { PHY_ID_BCM50610, 0xfffffff0 },
+ { PHY_ID_BCM50610M, 0xfffffff0 },
+ { PHY_ID_BCM57780, 0xfffffff0 },
+ { PHY_ID_BCMAC131, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, broadcom_tbl);
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index a1bd599..efc608f 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -159,3 +159,11 @@ static void __exit cicada_exit(void)
module_init(cicada_init);
module_exit(cicada_exit);
+
+static struct mdio_device_id cicada_tbl[] = {
+ { 0x000fc410, 0x000ffff0 },
+ { 0x000fc440, 0x000fffc0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, cicada_tbl);
diff --git a/drivers/net/phy/davicom.c b/drivers/net/phy/davicom.c
index d926168..e02b18c 100644
--- a/drivers/net/phy/davicom.c
+++ b/drivers/net/phy/davicom.c
@@ -219,3 +219,12 @@ static void __exit davicom_exit(void)
module_init(davicom_init);
module_exit(davicom_exit);
+
+static struct mdio_device_id davicom_tbl[] = {
+ { 0x0181b880, 0x0ffffff0 },
+ { 0x0181b8a0, 0x0ffffff0 },
+ { 0x00181b80, 0x0ffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, davicom_tbl);
diff --git a/drivers/net/phy/et1011c.c b/drivers/net/phy/et1011c.c
index b031fa2..500f0fd 100644
--- a/drivers/net/phy/et1011c.c
+++ b/drivers/net/phy/et1011c.c
@@ -111,3 +111,10 @@ static void __exit et1011c_exit(void)
module_init(et1011c_init);
module_exit(et1011c_exit);
+
+static struct mdio_device_id et1011c_tbl[] = {
+ { 0x0282f014, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, et1011c_tbl);
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index af3f1f2..e661e90 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -132,3 +132,10 @@ static void __exit ip175c_exit(void)
module_init(ip175c_init);
module_exit(ip175c_exit);
+
+static struct mdio_device_id icplus_tbl[] = {
+ { 0x02430d80, 0x0ffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, icplus_tbl);
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
index 4cf3324..1d94f1d 100644
--- a/drivers/net/phy/lxt.c
+++ b/drivers/net/phy/lxt.c
@@ -174,3 +174,11 @@ static void __exit lxt_exit(void)
module_init(lxt_init);
module_exit(lxt_exit);
+
+static struct mdio_device_id lxt_tbl[] = {
+ { 0x78100000, 0xfffffff0 },
+ { 0x001378e0, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, lxt_tbl);
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 65ed385..c7e5b9f 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -649,3 +649,16 @@ static void __exit marvell_exit(void)
module_init(marvell_init);
module_exit(marvell_exit);
+
+static struct mdio_device_id marvell_tbl[] = {
+ { 0x01410c60, 0xfffffff0 },
+ { 0x01410c90, 0xfffffff0 },
+ { 0x01410cc0, 0xfffffff0 },
+ { 0x01410e10, 0xfffffff0 },
+ { 0x01410cb0, 0xfffffff0 },
+ { 0x01410cd0, 0xfffffff0 },
+ { 0x01410e30, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, marvell_tbl);
diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
index 6c636eb..729ab29 100644
--- a/drivers/net/phy/national.c
+++ b/drivers/net/phy/national.c
@@ -153,3 +153,10 @@ MODULE_LICENSE("GPL");
module_init(ns_init);
module_exit(ns_exit);
+
+static struct mdio_device_id ns_tbl[] = {
+ { DP83865_PHY_ID, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, ns_tbl);
diff --git a/drivers/net/phy/qsemi.c b/drivers/net/phy/qsemi.c
index 23062d0..3ec9610 100644
--- a/drivers/net/phy/qsemi.c
+++ b/drivers/net/phy/qsemi.c
@@ -138,3 +138,10 @@ static void __exit qs6612_exit(void)
module_init(qs6612_init);
module_exit(qs6612_exit);
+
+static struct mdio_device_id qs6612_tbl[] = {
+ { 0x00181440, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, qs6612_tbl);
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index a052a67..f567c0e 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -78,3 +78,10 @@ static void __exit realtek_exit(void)
module_init(realtek_init);
module_exit(realtek_exit);
+
+static struct mdio_device_id realtek_tbl[] = {
+ { 0x001cc912, 0x001fffff },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, realtek_tbl);
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index ed2644a..78fa988 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -253,3 +253,14 @@ MODULE_LICENSE("GPL");
module_init(smsc_init);
module_exit(smsc_exit);
+
+static struct mdio_device_id smsc_tbl[] = {
+ { 0x0007c0a0, 0xfffffff0 },
+ { 0x0007c0b0, 0xfffffff0 },
+ { 0x0007c0c0, 0xfffffff0 },
+ { 0x0007c0d0, 0xfffffff0 },
+ { 0x0007c0f0, 0xfffffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, smsc_tbl);
diff --git a/drivers/net/phy/ste10Xp.c b/drivers/net/phy/ste10Xp.c
index 6bdb0d5..7229009 100644
--- a/drivers/net/phy/ste10Xp.c
+++ b/drivers/net/phy/ste10Xp.c
@@ -132,6 +132,14 @@ static void __exit ste10Xp_exit(void)
module_init(ste10Xp_init);
module_exit(ste10Xp_exit);
+static struct mdio_device_id ste10Xp_tbl[] = {
+ { STE101P_PHY_ID, 0xfffffff0 },
+ { STE100P_PHY_ID, 0xffffffff },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, ste10Xp_tbl);
+
MODULE_DESCRIPTION("STMicroelectronics STe10Xp PHY driver");
MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index dd3b244..45cce50 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -191,3 +191,11 @@ static void __exit vsc82xx_exit(void)
module_init(vsc82xx_init);
module_exit(vsc82xx_exit);
+
+static struct mdio_device_id vitesse_tbl[] = {
+ { PHY_ID_VSC8244, 0x000fffc0 },
+ { PHY_ID_VSC8221, 0x000ffff0 },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, vitesse_tbl);
--
1.7.0.3

53
debian/patches/features/all/phylib-Support-phy-module-autoloading.patch vendored Normal file
View File

@ -0,0 +1,53 @@
From 8626d3b4328061f5b82b11ae1d6918a0c3602f42 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw2@infradead.org>
Date: Fri, 2 Apr 2010 01:05:27 +0000
Subject: [PATCH 1/2] phylib: Support phy module autoloading
We don't use the normal hotplug mechanism because it doesn't work. It will
load the module some time after the device appears, but that's not good
enough for us -- we need the driver loaded _immediately_ because otherwise
the NIC driver may just abort and then the phy 'device' goes away.
[bwh: s/phy/mdio/ in module alias, kerneldoc for struct mdio_device_id]
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Acked-by: Andy Fleming <afleming@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/phy/phy_device.c | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index db17945..1a99bb2 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -149,6 +149,7 @@ EXPORT_SYMBOL(phy_scan_fixups);
struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
{
struct phy_device *dev;
+
/* We allocate the device, and initialize the
* default values */
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -179,6 +180,17 @@ struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
mutex_init(&dev->lock);
INIT_DELAYED_WORK(&dev->state_queue, phy_state_machine);
+ /* Request the appropriate module unconditionally; don't
+ bother trying to do so only if it isn't already loaded,
+ because that gets complicated. A hotplug event would have
+ done an unconditional modprobe anyway.
+ We don't do normal hotplug because it won't work for MDIO
+ -- because it relies on the device staying around for long
+ enough for the driver to get loaded. With MDIO, the NIC
+ driver will get bored and give up as soon as it finds that
+ there's no driver _already_ loaded. */
+ request_module(MDIO_MODULE_PREFIX MDIO_ID_FMT, MDIO_ID_ARGS(phy_id));
+
return dev;
}
EXPORT_SYMBOL(phy_device_create);
--
1.7.0.3

31
debian/patches/features/arm/dns323-rev-a1-gpio-request.patch vendored Normal file
View File

@ -0,0 +1,31 @@
From: Arnaud Patard <arnaud.patard@rtp-net.org>
Date: Sat, 3 Apr 2010 08:31:33 +0000 (+0200)
Subject: [ARM] dns323-setup.c: fix WARN() when booting
X-Git-Url: http://git.marvell.com/?p=orion.git;a=commitdiff_plain;h=5efda86f74aa62f589297d0638c400b3f3fc6c64
[ARM] dns323-setup.c: fix WARN() when booting
Since commit b2a731aa5cbca7e0252da75e16de7ae5feb1313a, dns323_init() is
setting the power led gpio direction with gpio_direction_output() but
doesn't request the gpio before (which is not permitted by the gpio
layer afaik). This behaviour is triggering a WARN() at boot time.
Tested-by: Christian Samsel <csamsel@gmxpro.de>
Cc: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: Nicolas Pitre <nico@marvell.com>
[ Part 2: "Attached Text" ]
---
diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c
index 421b82f..685f34a 100644
--- a/arch/arm/mach-orion5x/dns323-setup.c
+++ b/arch/arm/mach-orion5x/dns323-setup.c
@@ -439,6 +439,7 @@ static void __init dns323_init(void)
*/
if (dns323_dev_id() == MV88F5181_DEV_ID) {
dns323_leds[0].active_low = 1;
+ gpio_request(DNS323_GPIO_LED_POWER1, "Power Led Enable");
gpio_direction_output(DNS323_GPIO_LED_POWER1, 0);
}

35
debian/patches/series/base vendored
View File

@ -59,3 +59,38 @@
+ debian/arch-sh4-fix-uimage-build.patch
+ bugfix/all/stable/2.6.33.3.patch
+ features/all/phylib-Support-phy-module-autoloading.patch
+ features/all/phylib-Add-module-table-to-all-existing-phy-drivers.patch
+ bugfix/x86/PCI-Disable-MSI-for-MCP55-on-P5N32-E-SLI.patch
+ bugfix/all/phylib-fix-typo-in-bcm6xx-PHY-driver-table.patch
+ features/arm/dns323-rev-a1-gpio-request.patch
+ bugfix/all/drm-i915-Stop-trying-to-use-ACPI-lid-status-to-deter.patch
+ bugfix/all/forcedeth-fix-tx-limit2-flag-check.patch
+ bugfix/all/reiserfs-fix-permissions-on-reiserfs_priv.patch
+ bugfix/all/libata-ata_piix-clear-spurious-IRQ.patch
+ bugfix/all/block-blk_abort_request-lock-fix.patch
+ bugfix/mips/enable-pata-platform.patch
+ bugfix/all/rndis_host-Poll-status-channel-before-control-channel.patch
+ features/all/ipheth-add.patch
+ bugfix/all/ipheth-potential-null-dereferences-on-error-path.patch
+ bugfix/all/libata-fix-accesses-at-LBA28-boundary.patch
+ bugfix/all/thinkpad-acpi-add-x100e.patch
+ features/all/drm-radeon-evergreen.patch
+ bugfix/all/drm-radeon-kms-further-spread-spectrum-fixes.patch
+ bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
+ bugfix/all/p54pci-revise-tx-locking.patch
+ bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
+ bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
+ bugfix/all/p54pci-prevent-stuck-rx-ring.patch
+ bugfix/all/p54pci-fix-serious-sparse-warning.patch
+ bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
+ bugfix/all/p54pci-fix-regression.patch
+ bugfix/all/hugetlb-fix-infinite-loop-in-get_futex_key-when-backed-by-huge-pages.patch
+ bugfix/all/ext4-issue-discard-operation-before-releasing-blocks.patch
+ bugfix/all/libiscsi-regression-fix-header-digest-errors.patch
+ bugfix/all/sctp-fix-skb_over_panic-resulting-from-multiple-invalid-parameter-errors.patch
+ bugfix/all/cifs-allow-null-nd-on-create.patch
+ bugfix/all/tipc-fix-oops-on-send-prior-to-entering-networked-mode.patch
+ bugfix/powerpc/kgdb-dont-needlessly-skip-PAGE_USER-test-for-Fsl-booke.patch

3
debian/templates/control.main.in vendored
View File

@ -79,7 +79,8 @@ Description: Support files for Linux @upstreamversion@
Package: linux-base
Architecture: all
Depends: libapt-pkg-perl, libuuid-perl, ${misc:Depends}
Depends: libapt-pkg-perl, libuuid-perl, ${misc:Depends},
util-linux (>= 2.16-1) | udev (<< 146-1)
Description: Linux image base package
This package contains files and support scripts for all Linux
images.

1
debian/templates/temp.image.plain/postrm vendored
View File

@ -315,6 +315,7 @@ my @files_to_remove = qw{
modules.symbols build source modules.ofmap
modules.seriomap modules.alias.bin
modules.dep.bin modules.symbols.bin
modules.softdep
};
foreach my $extra_file (@files_to_remove) {