rpms/kernel/F-9 kernel.spec, 1.875, 1.876 linux-2.6-firewire-git-pending.patch, 1.32, 1.33

[Jarod Wilson]

Author: jwilson

Update of /cvs/pkgs/rpms/kernel/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv23228

Modified Files:
	kernel.spec linux-2.6-firewire-git-pending.patch 
Log Message:
* Wed Dec 10 2008 Jarod Wilson <jarod at redhat.com> 2.6.27.8-63
- Plug DMA memory leak in firewire drivers (F10#475156)



Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/kernel.spec,v
retrieving revision 1.875
retrieving revision 1.876
diff -u -r1.875 -r1.876
--- kernel.spec	9 Dec 2008 05:03:41 -0000	1.875
+++ kernel.spec	10 Dec 2008 22:42:04 -0000	1.876
@@ -1904,6 +1904,9 @@
 %kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL}.xen -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.xen.conf %{with_xen} xen
 
 %changelog
+* Wed Dec 10 2008 Jarod Wilson <jarod at redhat.com> 2.6.27.8-63
+- Plug DMA memory leak in firewire drivers (F10#475156)
+
 * Mon Dec 08 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.27.8-62
 - ATM security fix (CVE-2008-5079)
 - Update ALSA fixups so the snd-pcsp driver can be built.

linux-2.6-firewire-git-pending.patch:

Index: linux-2.6-firewire-git-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/linux-2.6-firewire-git-pending.patch,v
retrieving revision 1.32
retrieving revision 1.33
diff -u -r1.32 -r1.33
--- linux-2.6-firewire-git-pending.patch	30 Oct 2008 04:41:11 -0000	1.32
+++ linux-2.6-firewire-git-pending.patch	10 Dec 2008 22:42:04 -0000	1.33
@@ -128,3 +128,106 @@
  	 * the version stored in the OHCI registers.
  	 */
  
+----------------------
+Date: Wed, 10 Dec 2008 00:20:38 +0100 (CET)
+From: Stefan Richter <stefanr at s5r6.in-berlin.de>
+Subject: firewire: fw-ohci: fix possible IOMMU resource exhaustion
+
+There is a DMA map/ unmap imbalance whenever a block write request
+packet is sent and then dequeued with ohci_cancel_packet.  The latter
+may happen frequently if the AR resp tasklet is executed before the AT
+req tasklet for the same transaction.
+
+Add the missing dma_unmap_single.
+
+Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
+---
+ drivers/firewire/fw-ohci.c        |   11 +++++++----
+ drivers/firewire/fw-transaction.c |    3 +++
+ drivers/firewire/fw-transaction.h |    2 ++
+ 3 files changed, 12 insertions(+), 4 deletions(-)
+
+Index: linux/drivers/firewire/fw-ohci.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-ohci.c
++++ linux/drivers/firewire/fw-ohci.c
+@@ -974,6 +974,7 @@ at_context_queue_packet(struct context *
+ 			packet->ack = RCODE_SEND_ERROR;
+ 			return -1;
+ 		}
++		packet->payload_bus = payload_bus;
+ 
+ 		d[2].req_count    = cpu_to_le16(packet->payload_length);
+ 		d[2].data_address = cpu_to_le32(payload_bus);
+@@ -1025,7 +1026,6 @@ static int handle_at_packet(struct conte
+ 	struct driver_data *driver_data;
+ 	struct fw_packet *packet;
+ 	struct fw_ohci *ohci = context->ohci;
+-	dma_addr_t payload_bus;
+ 	int evt;
+ 
+ 	if (last->transfer_status == 0)
+@@ -1038,9 +1038,8 @@ static int handle_at_packet(struct conte
+ 		/* This packet was cancelled, just continue. */
+ 		return 1;
+ 
+-	payload_bus = le32_to_cpu(last->data_address);
+-	if (payload_bus != 0)
+-		dma_unmap_single(ohci->card.device, payload_bus,
++	if (packet->payload_bus)
++		dma_unmap_single(ohci->card.device, packet->payload_bus,
+ 				 packet->payload_length, DMA_TO_DEVICE);
+ 
+ 	evt = le16_to_cpu(last->transfer_status) & 0x1f;
+@@ -1697,6 +1696,10 @@ static int ohci_cancel_packet(struct fw_
+ 	if (packet->ack != 0)
+ 		goto out;
+ 
++	if (packet->payload_bus)
++		dma_unmap_single(ohci->card.device, packet->payload_bus,
++				 packet->payload_length, DMA_TO_DEVICE);
++
+ 	log_ar_at_event('T', packet->speed, packet->header, 0x20);
+ 	driver_data->packet = NULL;
+ 	packet->ack = RCODE_CANCELLED;
+Index: linux/drivers/firewire/fw-transaction.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-transaction.c
++++ linux/drivers/firewire/fw-transaction.c
+@@ -208,6 +208,7 @@ fw_fill_request(struct fw_packet *packet
+ 	packet->speed = speed;
+ 	packet->generation = generation;
+ 	packet->ack = 0;
++	packet->payload_bus = 0;
+ }
+ 
+ /**
+@@ -582,6 +583,8 @@ fw_fill_response(struct fw_packet *respo
+ 		BUG();
+ 		return;
+ 	}
++
++	response->payload_bus = 0;
+ }
+ EXPORT_SYMBOL(fw_fill_response);
+ 
+Index: linux/drivers/firewire/fw-transaction.h
+===================================================================
+--- linux.orig/drivers/firewire/fw-transaction.h
++++ linux/drivers/firewire/fw-transaction.h
+@@ -27,6 +27,7 @@
+ #include <linux/list.h>
+ #include <linux/spinlock_types.h>
+ #include <linux/timer.h>
++#include <linux/types.h>
+ #include <linux/workqueue.h>
+ 
+ #define TCODE_IS_READ_REQUEST(tcode)	(((tcode) & ~1) == 4)
+@@ -153,6 +154,7 @@ struct fw_packet {
+ 	size_t header_length;
+ 	void *payload;
+ 	size_t payload_length;
++	dma_addr_t payload_bus;
+ 	u32 timestamp;
+ 
+ 	/*