r4315 - in
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian: .
patches patches/series
Simon Horman
horms at costa.debian.org
Thu Oct 6 09:33:01 UTC 2005
Author: horms
Date: 2005-10-06 09:33:00 +0000 (Thu, 06 Oct 2005)
New Revision: 4315
Added:
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-MPOL_F_VERIFY.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/forcedeth-init-link-settings-in-nv_open.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-fput-in-32bit-ioctl-on-x86-64.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-sockfd_put-in-32bit-compat-routing_ioctl.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sungem-enable-and-map-pci-rom-properly.dpatch
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sunhme-enable-and-map-pci-rom-properly.dpatch
Modified:
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
Log:
* lost-fput-in-32bit-ioctl-on-x86-64.patch
[SECURITY] lost fput in 32bit ioctl on x86-6; local DoS4
From 2.6.13.2
* lost-sockfd_put-in-32bit-compat-routing_ioctl.patch
[SECURITY] lost sockfd_put() in routing_ioctl(); local DoS
From 2.6.13.2
* forcedeth-init-link-settings-in-nv_open.patch
forcedeth: Initialize link settings in every nv_open()
From 2.6.13.2
* sungem-enable-and-map-pci-rom-properly.patch
Sun GEM ethernet: enable and map PCI ROM properly
From 2.6.13.2
* sunhme-enable-and-map-pci-rom-properly.patch
Sun HME: enable and map PCI ROM properly
From 2.6.13.2
* fix-MPOL_F_VERIFY.patch
Fix MPOL_F_VERIFY
From 2.6.13.2
* fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.patch
Fix up more strange byte writes to the PCI_ROM_ADDRESS config word
From 2.6.13.2
* usb-ftdi_sio-baud-fix.patch
USB: ftdi_sio: custom baud rate fix
From 2.6.13.2
Modified: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/changelog 2005-10-06 09:33:00 UTC (rev 4315)
@@ -255,14 +255,46 @@
Reassembly trim not clearing CHECKSUM_HW
From 2.6.13.1
+
+ * lost-fput-in-32bit-ioctl-on-x86-64.patch
+ [SECURITY] lost fput in 32bit ioctl on x86-6; local DoS4
+ From 2.6.13.2
+
+ * lost-sockfd_put-in-32bit-compat-routing_ioctl.patch
+ [SECURITY] lost sockfd_put() in routing_ioctl(); local DoS
+ From 2.6.13.2
+
+ * forcedeth-init-link-settings-in-nv_open.patch
+ forcedeth: Initialize link settings in every nv_open()
+ From 2.6.13.2
+
+ * sungem-enable-and-map-pci-rom-properly.patch
+ Sun GEM ethernet: enable and map PCI ROM properly
+ From 2.6.13.2
+
+ * sunhme-enable-and-map-pci-rom-properly.patch
+ Sun HME: enable and map PCI ROM properly
+ From 2.6.13.2
+
+ * fix-MPOL_F_VERIFY.patch
+ Fix MPOL_F_VERIFY
+ From 2.6.13.2
+
+ * fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.patch
+ Fix up more strange byte writes to the PCI_ROM_ADDRESS config word
+ From 2.6.13.2
+
+ * usb-ftdi_sio-baud-fix.patch
+ USB: ftdi_sio: custom baud rate fix
+ From 2.6.13.2
+
[ dann frazier ]
* mempolicy-check-mode.dpatch
[SECURITY] Input validation in sys_set_mempolicy(); local DoS.
See CAN-2005-3053
+ -- Simon Horman <horms at debian.org> Thu, 6 Oct 2005 18:18:56 +0900
- -- Simon Horman <horms at debian.org> Thu, 6 Oct 2005 13:22:56 +0900
-
kernel-source-2.6.8 (2.6.8-16) unstable; urgency=low
* smbfs-overrun.dpatch:
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-MPOL_F_VERIFY.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-MPOL_F_VERIFY.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-MPOL_F_VERIFY.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,38 @@
+From stable-bounces at linux.kernel.org Tue Sep 13 05:01:26 2005
+From: Andi Kleen <ak at suse.de>
+To: stable at kernel.org
+Date: Tue, 13 Sep 2005 14:01:08 +0200
+Cc: linux-kernel at vger.kernel.org
+Subject: [PATCH] Fix MPOL_F_VERIFY
+
+There was a pretty bad bug in there that the code would
+always check the full VMA, not the range the user requested.
+
+When the VMA to be checked was merged with the previous VMA this
+could lead to spurious failures.
+
+Signed-off-by: Andi Kleen <ak at suse.de>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ mm/mempolicy.c | 7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletion(-)
+
+Backported to use verify_pages() instead of check_pgd_range()
+for Debian's 2.6.8
+
+--- from-0001/mm/mempolicy.c
++++ to-work/mm/mempolicy.c 2005-10-06 18:29:35.000000000 +0900
+@@ -279,7 +279,12 @@ check_range(struct mm_struct *mm, unsign
+ if (prev && prev->vm_end < vma->vm_start)
+ return ERR_PTR(-EFAULT);
+ if ((flags & MPOL_MF_STRICT) && !is_vm_hugetlb_page(vma)) {
+- err = verify_pages(vma->vm_start, vma->vm_end, nodes);
++ unsigned long endvma = vma->vm_end;
++ if (endvma > end)
++ endvma = end;
++ if (vma->vm_start > start)
++ start = vma->vm_start;
++ err = verify_pages(start, endvma, nodes);
+ if (err) {
+ first = ERR_PTR(err);
+ break;
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,47 @@
+From stable-bounces at linux.kernel.org Tue Sep 13 08:02:00 2005
+Date: Tue, 13 Sep 2005 08:01:49 -0700 (PDT)
+From: Linus Torvalds <torvalds at osdl.org>
+To: stable at kernel.org
+Cc:
+Subject: Fix up more strange byte writes to the PCI_ROM_ADDRESS config word
+
+It's a dword thing, and the value we write is a dword. Doing a byte
+write to it is nonsensical, and writes only the low byte, which only
+contains the enable bit. So we enable a nonsensical address (usually
+zero), which causes the controller no end of problems.
+
+Trivial fix, but nasty to find.
+
+Signed-off-by: Linus Torvalds <torvalds at osdl.org>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ drivers/ide/pci/cmd64x.c | 2 +-
+ drivers/ide/pci/hpt34x.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+Index: linux-2.6.13.y/drivers/ide/pci/cmd64x.c
+===================================================================
+--- linux-2.6.13.y.orig/drivers/ide/pci/cmd64x.c
++++ linux-2.6.13.y/drivers/ide/pci/cmd64x.c
+@@ -608,7 +608,7 @@ static unsigned int __devinit init_chips
+
+ #ifdef __i386__
+ if (dev->resource[PCI_ROM_RESOURCE].start) {
+- pci_write_config_byte(dev, PCI_ROM_ADDRESS, dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
++ pci_write_config_dword(dev, PCI_ROM_ADDRESS, dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
+ printk(KERN_INFO "%s: ROM enabled at 0x%08lx\n", name, dev->resource[PCI_ROM_RESOURCE].start);
+ }
+ #endif
+Index: linux-2.6.13.y/drivers/ide/pci/hpt34x.c
+===================================================================
+--- linux-2.6.13.y.orig/drivers/ide/pci/hpt34x.c
++++ linux-2.6.13.y/drivers/ide/pci/hpt34x.c
+@@ -173,7 +173,7 @@ static unsigned int __devinit init_chips
+
+ if (cmd & PCI_COMMAND_MEMORY) {
+ if (pci_resource_start(dev, PCI_ROM_RESOURCE)) {
+- pci_write_config_byte(dev, PCI_ROM_ADDRESS,
++ pci_write_config_dword(dev, PCI_ROM_ADDRESS,
+ dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
+ printk(KERN_INFO "HPT345: ROM enabled at 0x%08lx\n",
+ dev->resource[PCI_ROM_RESOURCE].start);
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/forcedeth-init-link-settings-in-nv_open.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/forcedeth-init-link-settings-in-nv_open.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/forcedeth-init-link-settings-in-nv_open.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,41 @@
+From stable-bounces at linux.kernel.org Sun Sep 11 13:33:43 2005
+Date: Sun, 11 Sep 2005 21:33:28 +0100
+From: Daniel Drake <dsd at gentoo.org>
+To: stable at kernel.org
+Cc: manfred at colorfullife.com
+Subject: [PATCH] forcedeth: Initialize link settings in every nv_open()
+
+From: Manfred Spraul <manfred at colorfullife.com>
+
+R�diger found a bug in nv_open that explains some of the reports
+with duplex mismatches:
+nv_open calls nv_update_link_speed for initializing the hardware link speed
+registers. If current link setting matches the values in np->linkspeed and
+np->duplex, then the function does nothing.
+Usually, doing nothing is the right thing, but not in nv_open: During
+nv_open, the registers must be initialized because the nic was reset.
+
+The attached patch fixes that by setting np->linkspeed to an invalid value
+before calling nv_update_link_speed from nv_open.
+
+Signed-Off-By: Manfred Spraul <manfred at colorfullife.com>
+Signed-off-by: Jeff Garzik <jgarzik at pobox.com>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ drivers/net/forcedeth.c | 3 +++
+ 1 files changed, 3 insertions(+)
+
+Index: linux-2.6.13.y/drivers/net/forcedeth.c
+===================================================================
+--- linux-2.6.13.y.orig/drivers/net/forcedeth.c
++++ linux-2.6.13.y/drivers/net/forcedeth.c
+@@ -1888,6 +1888,9 @@ static int nv_open(struct net_device *de
+ writel(NVREG_MIISTAT_MASK, base + NvRegMIIStatus);
+ dprintk(KERN_INFO "startup: got 0x%08x.\n", miistat);
+ }
++ /* set linkspeed to invalid value, thus force nv_update_linkspeed
++ * to init hw */
++ np->linkspeed = 0;
+ ret = nv_update_linkspeed(dev);
+ nv_start_rx(dev);
+ nv_start_tx(dev);
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-fput-in-32bit-ioctl-on-x86-64.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-fput-in-32bit-ioctl-on-x86-64.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-fput-in-32bit-ioctl-on-x86-64.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,66 @@
+From chrisw at osdl.org Fri Sep 9 13:05:53 2005
+Date: Fri, 9 Sep 2005 13:05:53 -0700
+From: Chris Wright <chrisw at osdl.org>
+To: Kirill Korotaev <dev at sw.ru>
+Cc: security at kernel.org, Linus Torvalds <torvalds at osdl.org>,
+ Andrew Morton <akpm at osdl.org>, Chris Wright <chrisw at osdl.org>,
+ Maxim Giryaev <gem at sw.ru>
+Subject: [PATCH] lost fput in 32bit ioctl on x86-64
+
+From: Maxim Giryaev <gem at sw.ru>
+
+This patch adds lost fput in 32bit tiocgdev ioctl on x86-64
+
+I believe this is a security issues, since user can fget() file as
+many times as he wants to. So file refcounter can be overlapped and
+first fput() will free resources though there will be still structures
+pointing to the file, mnt, dentry etc. Also fput() sets f_dentry and
+f_vfsmnt to NULL, so other file users will OOPS.
+
+The oops can be done under files_lock and others, so this is really
+exploitable DoS on SMP. Didn't checked it on practice actually.
+
+(chrisw: Update to use fget_light/fput_light)
+
+Signed-Off-By: Kirill Korotaev <dev at sw.ru>
+Signed-Off-By: Maxim Giryaev <gem at sw.ru>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ arch/x86_64/ia32/ia32_ioctl.c | 17 +++++++++++++----
+ 1 files changed, 13 insertions(+), 4 deletions(-)
+
+Index: linux-2.6.13.y/arch/x86_64/ia32/ia32_ioctl.c
+===================================================================
+--- linux-2.6.13.y.orig/arch/x86_64/ia32/ia32_ioctl.c
++++ linux-2.6.13.y/arch/x86_64/ia32/ia32_ioctl.c
+@@ -24,17 +24,26 @@
+ static int tiocgdev(unsigned fd, unsigned cmd, unsigned int __user *ptr)
+ {
+
+- struct file *file = fget(fd);
++ struct file *file;
+ struct tty_struct *real_tty;
++ int fput_needed, ret;
+
++ file = fget_light(fd, &fput_needed);
+ if (!file)
+ return -EBADF;
++
++ ret = -EINVAL;
+ if (file->f_op->ioctl != tty_ioctl)
+- return -EINVAL;
++ goto out;
+ real_tty = (struct tty_struct *)file->private_data;
+ if (!real_tty)
+- return -EINVAL;
+- return put_user(new_encode_dev(tty_devnum(real_tty)), ptr);
++ goto out;
++
++ ret = put_user(new_encode_dev(tty_devnum(real_tty)), ptr);
++
++out:
++ fput_light(file, fput_needed);
++ return ret;
+ }
+
+ #define RTC_IRQP_READ32 _IOR('p', 0x0b, unsigned int) /* Read IRQ rate */
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-sockfd_put-in-32bit-compat-routing_ioctl.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-sockfd_put-in-32bit-compat-routing_ioctl.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/lost-sockfd_put-in-32bit-compat-routing_ioctl.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,53 @@
+From dev at sw.ru Fri Sep 9 02:55:06 2005
+Date: Fri, 09 Sep 2005 13:59:48 +0400
+From: Kirill Korotaev <dev at sw.ru>
+To: security at kernel.org, Linus Torvalds <torvalds at osdl.org>,
+ Andrew Morton <akpm at osdl.org>, Chris Wright <chrisw at osdl.org>,
+ "Maxim Giryaev" <gem at sw.ru>
+Subject: [PATCH] Lost sockfd_put() in routing_ioctl()
+
+From: "Maxim Giryaev" <gem at sw.ru>
+
+This patch adds lost sockfd_put() in 32bit compat rounting_ioctl() on
+64bit platforms, bug found by Vasiliy Averin <vvs at sw.ru>.
+
+I believe this is a security issues, since user can fget() file as many
+times as he wants to. So file refcounter can be overlapped and first
+fput() will free resources though there will be still structures
+pointing to the file, mnt, dentry etc.
+Also fput() sets f_dentry and f_vfsmnt to NULL,
+so other file users will OOPS.
+
+The oops can be done under files_lock and others, so this can be an
+exploitable DoS on SMP. Didn't checked it on practice actually.
+
+Signed-Off-By: Kirill Korotaev <dev at sw.ru>
+Signed-Off-By: Maxim Giryaev <gem at sw.ru>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ fs/compat_ioctl.c | 7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+Index: linux-2.6.13.y/fs/compat_ioctl.c
+===================================================================
+--- linux-2.6.13.y.orig/fs/compat_ioctl.c
++++ linux-2.6.13.y/fs/compat_ioctl.c
+@@ -798,13 +798,16 @@ static int routing_ioctl(unsigned int fd
+ r = (void *) &r4;
+ }
+
+- if (ret)
+- return -EFAULT;
++ if (ret) {
++ ret = -EFAULT;
++ goto out;
++ }
+
+ set_fs (KERNEL_DS);
+ ret = sys_ioctl (fd, cmd, (unsigned long) r);
+ set_fs (old_fs);
+
++out:
+ if (mysock)
+ sockfd_put(mysock);
+
Modified: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17 2005-10-06 09:33:00 UTC (rev 4315)
@@ -66,3 +66,11 @@
+ sparc-request_irq-in-RTC-fix.dpatch
+ sendmsg-stackoverflow.dpatch
+ ipv4-fragmentation-csum-handling.dpatch
++ fix-MPOL_F_VERIFY.dpatch
++ fix-more-byte-to-dword-writes-to-PCI_ROM_ADDRESS-config-word.dpatch
++ forcedeth-init-link-settings-in-nv_open.dpatch
++ lost-fput-in-32bit-ioctl-on-x86-64.dpatch
++ lost-sockfd_put-in-32bit-compat-routing_ioctl.dpatch
++ sungem-enable-and-map-pci-rom-properly.dpatch
++ sunhme-enable-and-map-pci-rom-properly.dpatch
+
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sungem-enable-and-map-pci-rom-properly.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sungem-enable-and-map-pci-rom-properly.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sungem-enable-and-map-pci-rom-properly.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,84 @@
+From stable-bounces at linux.kernel.org Sun Sep 11 14:09:08 2005
+Date: Sun, 11 Sep 2005 14:08:59 -0700 (PDT)
+From: Linus Torvalds <torvalds at osdl.org>
+To: stable at kernel.org
+Cc:
+Subject: Sun GEM ethernet: enable and map PCI ROM properly
+
+From: Linus Torvalds <torvalds at g5.osdl.org>
+
+This same patch was reported to fix the MAC address detection on sunhme
+(next patch). Most people seem to be running this on Sparcs or PPC
+machines, where we get the MAC address from their respective firmware
+rather than from the (previously broken) ROM mapping routines.
+
+Signed-off-by: Linus Torvalds <torvalds at osdl.org>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ drivers/net/sungem.c | 36 ++++++++++++++----------------------
+ 1 files changed, 14 insertions(+), 22 deletions(-)
+
+Backported to Debian's 2.6.8 by Horms
+
+Index: linux-2.6.13.y/drivers/net/sungem.c
+===================================================================
+--- from-0001/drivers/net/sungem.c
++++ to-0008/drivers/net/sungem.c 2005-10-06 17:52:16.000000000 +0900
+@@ -2553,7 +2553,7 @@ static int gem_ioctl(struct net_device *
+
+ #if (!defined(__sparc__) && !defined(CONFIG_PPC))
+ /* Fetch MAC address from vital product data of PCI ROM. */
+-static void find_eth_addr_in_vpd(void *rom_base, int len, unsigned char *dev_addr)
++static int find_eth_addr_in_vpd(void *rom_base, int len, unsigned char *dev_addr)
+ {
+ int this_offset;
+
+@@ -2574,35 +2574,27 @@ static void find_eth_addr_in_vpd(void *r
+
+ for (i = 0; i < 6; i++)
+ dev_addr[i] = readb(p + i);
+- break;
++ return 1;
+ }
++ return 0;
+ }
+
+ static void get_gem_mac_nonobp(struct pci_dev *pdev, unsigned char *dev_addr)
+ {
+- u32 rom_reg_orig;
+- void *p;
+-
+- if (pdev->resource[PCI_ROM_RESOURCE].parent == NULL) {
+- if (pci_assign_resource(pdev, PCI_ROM_RESOURCE) < 0)
+- goto use_random;
+- }
+-
+- pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_reg_orig);
+- pci_write_config_dword(pdev, pdev->rom_base_reg,
+- rom_reg_orig | PCI_ROM_ADDRESS_ENABLE);
++ size_t size;
++ void __iomem *p = pci_map_rom(pdev, &size);
+
+- p = ioremap(pci_resource_start(pdev, PCI_ROM_RESOURCE), (64 * 1024));
+- if (p != NULL && readb(p) == 0x55 && readb(p + 1) == 0xaa)
+- find_eth_addr_in_vpd(p, (64 * 1024), dev_addr);
++ if (p) {
++ int found;
+
+- if (p != NULL)
+- iounmap(p);
+-
+- pci_write_config_dword(pdev, pdev->rom_base_reg, rom_reg_orig);
+- return;
++ found = readb(p) == 0x55 &&
++ readb(p + 1) == 0xaa &&
++ find_eth_addr_in_vpd(p, (64 * 1024), dev_addr);
++ pci_unmap_rom(pdev, p);
++ if (found)
++ return;
++ }
+
+-use_random:
+ /* Sun MAC prefix then 3 random bytes. */
+ dev_addr[0] = 0x08;
+ dev_addr[1] = 0x00;
Added: dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sunhme-enable-and-map-pci-rom-properly.dpatch
===================================================================
--- dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sunhme-enable-and-map-pci-rom-properly.dpatch 2005-10-06 08:20:30 UTC (rev 4314)
+++ dists/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/sunhme-enable-and-map-pci-rom-properly.dpatch 2005-10-06 09:33:00 UTC (rev 4315)
@@ -0,0 +1,96 @@
+From stable-bounces at linux.kernel.org Sun Sep 11 14:10:11 2005
+Date: Sun, 11 Sep 2005 14:10:02 -0700 (PDT)
+From: Linus Torvalds <torvalds at osdl.org>
+To: stable at kernel.org
+Cc:
+Subject: Sun HME: enable and map PCI ROM properly
+
+From: Willy Tarreau <willy at w.ods.org>
+
+This ports the Sun GEM ROM mapping/enable fixes it sunhme (which used
+the same PCI ROM mapping code).
+
+Without this, I get NULL MAC addresses for all 4 ports (it's a SUN QFE).
+With it, I get the correct addresses (the ones printed on the label on
+the card).
+
+Signed-off-by: Linus Torvalds <torvalds at osdl.org>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ drivers/net/sunhme.c | 45 ++++++++++++++++++---------------------------
+ 1 files changed, 18 insertions(+), 27 deletions(-)
+
+Backported to Debian's 2.6.8 by Horms
+
+--- from-0001/drivers/net/sunhme.c
++++ to-work/drivers/net/sunhme.c 2005-10-06 17:59:57.000000000 +0900
+@@ -2949,7 +2949,7 @@ static int is_quattro_p(struct pci_dev *
+ }
+
+ /* Fetch MAC address from vital product data of PCI ROM. */
+-static void find_eth_addr_in_vpd(void *rom_base, int len, int index, unsigned char *dev_addr)
++static int find_eth_addr_in_vpd(void *rom_base, int len, int index, unsigned char *dev_addr)
+ {
+ int this_offset;
+
+@@ -2972,42 +2972,33 @@ static void find_eth_addr_in_vpd(void *r
+
+ for (i = 0; i < 6; i++)
+ dev_addr[i] = readb(p + i);
+- break;
++ return 1;
+ }
+ index--;
++ return 0;
+ }
+ }
+
+ static void get_hme_mac_nonsparc(struct pci_dev *pdev, unsigned char *dev_addr)
+ {
+- u32 rom_reg_orig;
+- void *p;
+- int index;
+-
+- index = 0;
+- if (is_quattro_p(pdev))
+- index = PCI_SLOT(pdev->devfn);
+-
+- if (pdev->resource[PCI_ROM_RESOURCE].parent == NULL) {
+- if (pci_assign_resource(pdev, PCI_ROM_RESOURCE) < 0)
+- goto use_random;
++ size_t size;
++ void __iomem *p = pci_map_rom(pdev, &size);
++
++ if (p) {
++ int index = 0;
++ int found;
++
++ if (is_quattro_p(pdev))
++ index = PCI_SLOT(pdev->devfn);
++
++ found = readb(p) == 0x55 &&
++ readb(p + 1) == 0xaa &&
++ find_eth_addr_in_vpd(p, (64 * 1024), index, dev_addr);
++ pci_unmap_rom(pdev, p);
++ if (found)
++ return;
+ }
+
+- pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_reg_orig);
+- pci_write_config_dword(pdev, pdev->rom_base_reg,
+- rom_reg_orig | PCI_ROM_ADDRESS_ENABLE);
+-
+- p = ioremap(pci_resource_start(pdev, PCI_ROM_RESOURCE), (64 * 1024));
+- if (p != NULL && readb(p) == 0x55 && readb(p + 1) == 0xaa)
+- find_eth_addr_in_vpd(p, (64 * 1024), index, dev_addr);
+-
+- if (p != NULL)
+- iounmap(p);
+-
+- pci_write_config_dword(pdev, pdev->rom_base_reg, rom_reg_orig);
+- return;
+-
+-use_random:
+ /* Sun MAC prefix then 3 random bytes. */
+ dev_addr[0] = 0x08;
+ dev_addr[1] = 0x00;
More information about the Kernel-svn-changes
mailing list