--- /dev/null
+From gregkh@mini.kroah.org Mon Jan 12 17:23:56 2009
+Message-Id: <20090113012006.063755472@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/21] 2.6.27-stable review
+
+This is the start of the stable review cycle for the 2.6.27.11 release.
+
+It basically flushes out all of the 2.6.27 patches that went into the
+2.6.28 release. Almost none of the patches marked for the stable series
+that have gone in after 2.6.28 came out has gone into this tree yet.
+That will come in the next releases, this is just to get these older
+fixes out to those who need them now.
+
+There are 21 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Thursday, January 15, 2009, 00:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.11-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+greg k-h
+
+------------
+
+ Makefile | 2 +-
+ arch/powerpc/lib/rheap.c | 1 +
+ arch/x86/kernel/amd_iommu.c | 4 ++--
+ arch/x86/kernel/amd_iommu_init.c | 7 ++++++-
+ crypto/async_tx/async_xor.c | 11 +++++++++--
+ drivers/block/cciss.c | 5 +++++
+ drivers/dma/dmaengine.c | 3 +++
+ drivers/dma/ioat_dma.c | 5 ++++-
+ drivers/dma/iop-adma.c | 16 +++++++++++++---
+ drivers/dma/mv_xor.c | 15 ++++++++++++---
+ drivers/md/bitmap.c | 22 +++++++++++++++++-----
+ drivers/net/starfire.c | 5 +++++
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 7 +++----
+ drivers/scsi/aacraid/linit.c | 4 ++--
+ drivers/scsi/ibmvscsi/ibmvstgt.c | 16 +++++++++-------
+ drivers/usb/gadget/f_rndis.c | 4 ++++
+ drivers/usb/storage/unusual_devs.h | 16 +++++++++++++++-
+ include/asm-parisc/tlbflush.h | 5 ++++-
+ sound/pci/hda/patch_sigmatel.c | 1 +
+ sound/soc/omap/omap-pcm.c | 2 +-
+ 20 files changed, 117 insertions(+), 34 deletions(-)
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012356.909056684@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 01/21] USB: gadget: fix rndis working at high speed
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-gadget-fix-rndis-working-at-high-speed.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 7c12414955e9b44a3e33d54e578bf008caa4475d upstream.
+
+Fix a bug specific to highspeed mode in the recently updated RNDIS
+support: it wasn't setting up the high speed notification endpoint,
+which prevented high speed RNDIS links from working.
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Tested-by: Anand Gadiyar <gadiyar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/f_rndis.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/gadget/f_rndis.c
++++ b/drivers/usb/gadget/f_rndis.c
+@@ -651,6 +651,8 @@ rndis_bind(struct usb_configuration *c,
+ fs_in_desc.bEndpointAddress;
+ hs_out_desc.bEndpointAddress =
+ fs_out_desc.bEndpointAddress;
++ hs_notify_desc.bEndpointAddress =
++ fs_notify_desc.bEndpointAddress;
+
+ /* copy descriptors, and track endpoint copies */
+ f->hs_descriptors = usb_copy_descriptors(eth_hs_function);
+@@ -662,6 +664,8 @@ rndis_bind(struct usb_configuration *c,
+ f->hs_descriptors, &hs_in_desc);
+ rndis->hs.out = usb_find_endpoint(eth_hs_function,
+ f->hs_descriptors, &hs_out_desc);
++ rndis->hs.notify = usb_find_endpoint(eth_hs_function,
++ f->hs_descriptors, &hs_notify_desc);
+ }
+
+ rndis->port.open = rndis_open;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.073560835@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 02/21] usb-storage: update unusual_devs entry for Nokia 5310
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-update-unusual_devs-entry-for-nokia-5310.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a4b188095912eee83d065f000dfe06f25919750b upstream.
+
+This patch (as1179) updates the unusual_devs entry for Nokia's 5310
+phone to include a more recent firmware revision.
+
+This fixes Bugzilla #12099.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Robson Roberto Souza Peixoto <robsonpeixoto@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -168,7 +168,7 @@ UNUSUAL_DEV( 0x0421, 0x005d, 0x0001, 0x
+ US_FL_FIX_CAPACITY ),
+
+ /* Patch for Nokia 5310 capacity */
+-UNUSUAL_DEV( 0x0421, 0x006a, 0x0000, 0x0591,
++UNUSUAL_DEV( 0x0421, 0x006a, 0x0000, 0x0701,
+ "Nokia",
+ "5310",
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.249558215@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Phil Dibowitz <phil@ipom.com>
+Subject: [patch 03/21] USB: storage: unusual_devs.h: Nokia 3109c addition
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-unusual_devs.h-nokia-3109c-addition.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: CSÉCSY László <boobaa@frugalware.org>
+
+commit 1393fce7189427bdb4d6115ca5566ca8d0fc86f3 upstream.
+
+2.6.26(.x, cannot remember) could handle the microSD card in my Nokia
+3109c attached via USB as mass storage, 2.6.27(.x, up to and included
+2.6.27.8) cannot. Please find the attached patch which fixes this
+regression, and a copy of /proc/bus/usb/devices with my phone plugged in
+running with this patch on Frugalware.
+
+T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=0421 ProdID=0063 Rev= 6.01
+S: Manufacturer=Nokia
+S: Product=Nokia 3109c
+S: SerialNumber=359561013742570
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+
+From: CSÉCSY László <boobaa@frugalware.org>
+Cc: Phil Dibowitz <phil@ipom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -253,6 +253,13 @@ UNUSUAL_DEV( 0x0421, 0x04fa, 0x0550, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
++UNUSUAL_DEV( 0x0421, 0x0063, 0x0001, 0x0601,
++ "Nokia",
++ "Nokia 3109c",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_FIX_CAPACITY ),
++
+ /* Patch for Nokia 5310 capacity */
+ UNUSUAL_DEV( 0x0421, 0x006a, 0x0000, 0x0591,
+ "Nokia",
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.459682604@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 04/21] USB: Unusual devs patch for Nokia 3500c
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-unusual-devs-patch-for-nokia-3500c.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ozan Sener <themgzzy@gmail.com>
+
+commit 48e1a540e1e9ea62a2b3088a69ecf934f3172b14 upstream.
+
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=0421 ProdID=0060 Rev= 5.51
+S: Manufacturer=Nokia
+S: Product=Nokia 3500c
+S: SerialNumber=357687010280751
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+
+From: Ozan Sener <themgzzy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -253,6 +253,13 @@ UNUSUAL_DEV( 0x0421, 0x04fa, 0x0550, 0x
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Ozan Sener <themgzzy@gmail.com> */
++UNUSUAL_DEV( 0x0421, 0x0060, 0x0551, 0x0551,
++ "Nokia",
++ "3500c",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_FIX_CAPACITY ),
++
+ /* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
+ UNUSUAL_DEV( 0x0421, 0x0063, 0x0001, 0x0601,
+ "Nokia",
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.627146072@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Guillaume Knispel <gknispel@proformatique.com>,
+ Timur Tabi <timur@freescale.com>,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 05/21] powerpc: Fix corruption error in rh_alloc_fixed()
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-corruption-error-in-rh_alloc_fixed.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Guillaume Knispel <gknispel@proformatique.com>
+
+commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream.
+
+There is an error in rh_alloc_fixed() of the Remote Heap code:
+If there is at least one free block blk won't be NULL at the end of the
+search loop, so -ENOMEM won't be returned and the else branch of
+"if (bs == s || be == e)" will be taken, corrupting the management
+structures.
+
+Signed-off-by: Guillaume Knispel <gknispel@proformatique.com>
+Acked-by: Timur Tabi <timur@freescale.com>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/lib/rheap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/lib/rheap.c
++++ b/arch/powerpc/lib/rheap.c
+@@ -556,6 +556,7 @@ unsigned long rh_alloc_fixed(rh_info_t *
+ be = blk->start + blk->size;
+ if (s >= bs && e <= be)
+ break;
++ blk = NULL;
+ }
+
+ if (blk == NULL)
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.802100369@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ =?ISO-8859-15?q?Fran=C3=A7ois=20Valenduc?= <francois.valenduc@tvcablenet.be>
+Subject: [patch 06/21] iwlagn: downgrade BUG_ON in interrupt
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=iwlagn-downgrade-bug_on-in-interrupt.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 55d6a3cd0cc85ed90c39cf32e16f622bd003117b upstream.
+
+This BUG_ON really shouldn't trigger, but if it does, as on my machine,
+it leaves you wondering what happened because you won't see it. Let's
+instead leak a bit of state and memory and at least make it possible to
+report it to the kerneloops project to track it.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: François Valenduc <francois.valenduc@tvcablenet.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1192,10 +1192,9 @@ void iwl_tx_cmd_complete(struct iwl_priv
+ /* If a Tx command is being handled and it isn't in the actual
+ * command queue then there a command routing bug has been introduced
+ * in the queue management code. */
+- if (txq_id != IWL_CMD_QUEUE_NUM)
+- IWL_ERROR("Error wrong command queue %d command id 0x%X\n",
+- txq_id, pkt->hdr.cmd);
+- BUG_ON(txq_id != IWL_CMD_QUEUE_NUM);
++ if (WARN(txq_id != IWL_CMD_QUEUE_NUM,
++ "wrong command queue %d, command id 0x%X\n", txq_id, pkt->hdr.cmd))
++ return;
+
+ cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
+ cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012357.982639433@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Saeed Bishara <saeed@marvell.com>,
+ Yuri Tikhonov <yur@emcraft.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 07/21] async_xor: dma_map destination DMA_BIDIRECTIONAL
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=async_xor-dma_map-destination-dma_bidirectional.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit a06d568f7c5e40e34ea64881842deb8f4382babf upstream.
+
+Mapping the destination multiple times is a misuse of the dma-api.
+Since the destination may be reused as a source, ensure that it is only
+mapped once and that it is mapped bidirectionally. This appears to add
+ugliness on the unmap side in that it always reads back the destination
+address from the descriptor, but gcc can determine that dma_unmap is a
+nop and not emit the code that calculates its arguments.
+
+Cc: Saeed Bishara <saeed@marvell.com>
+Acked-by: Yuri Tikhonov <yur@emcraft.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/async_tx/async_xor.c | 11 +++++++++--
+ drivers/dma/iop-adma.c | 16 +++++++++++++---
+ drivers/dma/mv_xor.c | 15 ++++++++++++---
+ 3 files changed, 34 insertions(+), 8 deletions(-)
+
+--- a/crypto/async_tx/async_xor.c
++++ b/crypto/async_tx/async_xor.c
+@@ -53,10 +53,17 @@ do_async_xor(struct dma_chan *chan, stru
+ int xor_src_cnt;
+ dma_addr_t dma_dest;
+
+- dma_dest = dma_map_page(dma->dev, dest, offset, len, DMA_FROM_DEVICE);
+- for (i = 0; i < src_cnt; i++)
++ /* map the dest bidrectional in case it is re-used as a source */
++ dma_dest = dma_map_page(dma->dev, dest, offset, len, DMA_BIDIRECTIONAL);
++ for (i = 0; i < src_cnt; i++) {
++ /* only map the dest once */
++ if (unlikely(src_list[i] == dest)) {
++ dma_src[i] = dma_dest;
++ continue;
++ }
+ dma_src[i] = dma_map_page(dma->dev, src_list[i], offset,
+ len, DMA_TO_DEVICE);
++ }
+
+ while (src_cnt) {
+ async_flags = flags;
+--- a/drivers/dma/iop-adma.c
++++ b/drivers/dma/iop-adma.c
+@@ -85,18 +85,28 @@ iop_adma_run_tx_complete_actions(struct
+ enum dma_ctrl_flags flags = desc->async_tx.flags;
+ u32 src_cnt;
+ dma_addr_t addr;
++ dma_addr_t dest;
+
++ src_cnt = unmap->unmap_src_cnt;
++ dest = iop_desc_get_dest_addr(unmap, iop_chan);
+ if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+- addr = iop_desc_get_dest_addr(unmap, iop_chan);
+- dma_unmap_page(dev, addr, len, DMA_FROM_DEVICE);
++ enum dma_data_direction dir;
++
++ if (src_cnt > 1) /* is xor? */
++ dir = DMA_BIDIRECTIONAL;
++ else
++ dir = DMA_FROM_DEVICE;
++
++ dma_unmap_page(dev, dest, len, dir);
+ }
+
+ if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+- src_cnt = unmap->unmap_src_cnt;
+ while (src_cnt--) {
+ addr = iop_desc_get_src_addr(unmap,
+ iop_chan,
+ src_cnt);
++ if (addr == dest)
++ continue;
+ dma_unmap_page(dev, addr, len,
+ DMA_TO_DEVICE);
+ }
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -311,17 +311,26 @@ mv_xor_run_tx_complete_actions(struct mv
+ enum dma_ctrl_flags flags = desc->async_tx.flags;
+ u32 src_cnt;
+ dma_addr_t addr;
++ dma_addr_t dest;
+
++ src_cnt = unmap->unmap_src_cnt;
++ dest = mv_desc_get_dest_addr(unmap);
+ if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+- addr = mv_desc_get_dest_addr(unmap);
+- dma_unmap_page(dev, addr, len, DMA_FROM_DEVICE);
++ enum dma_data_direction dir;
++
++ if (src_cnt > 1) /* is xor ? */
++ dir = DMA_BIDIRECTIONAL;
++ else
++ dir = DMA_FROM_DEVICE;
++ dma_unmap_page(dev, dest, len, dir);
+ }
+
+ if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+- src_cnt = unmap->unmap_src_cnt;
+ while (src_cnt--) {
+ addr = mv_desc_get_src_addr(unmap,
+ src_cnt);
++ if (addr == dest)
++ continue;
+ dma_unmap_page(dev, addr, len,
+ DMA_TO_DEVICE);
+ }
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.152631367@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Maciej Sosnowski <maciej.sosnowski@intel.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 08/21] dmaengine: protect id from concurrent registrations
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=dmaengine-protect-id-from-concurrent-registrations.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b0b42b16ff2b90f17bc1a4308366c9beba4b276e upstream.
+
+There is a possibility to have two devices registered with the same id.
+
+Acked-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/dmaengine.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -388,7 +388,10 @@ int dma_async_device_register(struct dma
+
+ init_completion(&device->done);
+ kref_init(&device->refcount);
++
++ mutex_lock(&dma_list_mutex);
+ device->dev_id = id++;
++ mutex_unlock(&dma_list_mutex);
+
+ /* represent channels in sysfs. Probably want devs too */
+ list_for_each_entry(chan, &device->channels, device_node) {
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.324529407@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Maciej Sosnowski <maciej.sosnowski@intel.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 09/21] ioat: wait for self-test completion
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=ioat-wait-for-self-test-completion.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 532d3b1f86f41834a25373e3ded981d68e4ce17f upstream.
+
+As part of the ioat_dma self-test it performs a printk from a completion
+callback. Depending on the system console configuration this output can
+take longer than a millisecond causing the self-test to fail. Introduce a
+completion with a generous timeout to mitigate this failure.
+
+Acked-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/ioat_dma.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -1337,10 +1337,12 @@ static void ioat_dma_start_null_desc(str
+ */
+ #define IOAT_TEST_SIZE 2000
+
++DECLARE_COMPLETION(test_completion);
+ static void ioat_dma_test_callback(void *dma_async_param)
+ {
+ printk(KERN_ERR "ioatdma: ioat_dma_test_callback(%p)\n",
+ dma_async_param);
++ complete(&test_completion);
+ }
+
+ /**
+@@ -1406,7 +1408,8 @@ static int ioat_dma_self_test(struct ioa
+ goto free_resources;
+ }
+ device->common.device_issue_pending(dma_chan);
+- msleep(1);
++
++ wait_for_completion_timeout(&test_completion, msecs_to_jiffies(3000));
+
+ if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
+ != DMA_SUCCESS) {
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.496089677@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Brown <neilb@suse.de>
+Subject: [patch 10/21] md: Dont read past end of bitmap when reading bitmap.
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=md-don-t-read-past-end-of-bitmap-when-reading-bitmap.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit a2ed9615e3222645007fc19991aedf30eed3ecfd upstream.
+
+When we read the write-intent-bitmap off the device, we currently
+read a whole number of pages.
+When PAGE_SIZE is 4K, this works due to the alignment we enforce
+on the superblock and bitmap.
+When PAGE_SIZE is 64K, this case read past the end-of-device
+which causes an error.
+
+When we write the superblock, we ensure to clip the last page
+to just be the required size. Copy that code into the read path
+to just read the required number of sectors.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -208,16 +208,19 @@ static void bitmap_checkfree(struct bitm
+ */
+
+ /* IO operations when bitmap is stored near all superblocks */
+-static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long index)
++static struct page *read_sb_page(mddev_t *mddev, long offset,
++ struct page *page,
++ unsigned long index, int size)
+ {
+ /* choose a good rdev and read the page from there */
+
+ mdk_rdev_t *rdev;
+ struct list_head *tmp;
+- struct page *page = alloc_page(GFP_KERNEL);
+ sector_t target;
+
+ if (!page)
++ page = alloc_page(GFP_KERNEL);
++ if (!page)
+ return ERR_PTR(-ENOMEM);
+
+ rdev_for_each(rdev, tmp, mddev) {
+@@ -227,7 +230,9 @@ static struct page *read_sb_page(mddev_t
+
+ target = rdev->sb_start + offset + index * (PAGE_SIZE/512);
+
+- if (sync_page_io(rdev->bdev, target, PAGE_SIZE, page, READ)) {
++ if (sync_page_io(rdev->bdev, target,
++ roundup(size, bdev_hardsect_size(rdev->bdev)),
++ page, READ)) {
+ page->index = index;
+ attach_page_buffers(page, NULL); /* so that free_buffer will
+ * quietly no-op */
+@@ -544,7 +549,9 @@ static int bitmap_read_sb(struct bitmap
+
+ bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
+ } else {
+- bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0);
++ bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset,
++ NULL,
++ 0, sizeof(bitmap_super_t));
+ }
+ if (IS_ERR(bitmap->sb_page)) {
+ err = PTR_ERR(bitmap->sb_page);
+@@ -957,11 +964,16 @@ static int bitmap_init_from_disk(struct
+ */
+ page = bitmap->sb_page;
+ offset = sizeof(bitmap_super_t);
++ read_sb_page(bitmap->mddev, bitmap->offset,
++ page,
++ index, count);
+ } else if (file) {
+ page = read_page(file, index, bitmap, count);
+ offset = 0;
+ } else {
+- page = read_sb_page(bitmap->mddev, bitmap->offset, index);
++ page = read_sb_page(bitmap->mddev, bitmap->offset,
++ NULL,
++ index, count);
+ offset = 0;
+ }
+ if (IS_ERR(page)) { /* read error */
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.659160410@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stanley Miao <stanley.miao@windriver.com>,
+ Jarkko Nikula <jarkko.nikula@nokia.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 11/21] ALSA: Fix a Oops bug in omap soc driver.
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-fix-a-oops-bug-in-omap-soc-driver.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stanley Miao <stanley.miao@windriver.com>
+
+commit 19b3f31609dc8be3a56c78dcb7da723f10f7009c upstream.
+
+There will be a Oops or frequent underrun messages when playing music with
+omap soc driver, this is because a data region is incorretly sized, other data
+region will be overwriten when writing to this data region.
+
+Signed-off-by: Stanley Miao <stanley.miao@windriver.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@nokia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/omap/omap-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/omap/omap-pcm.c
++++ b/sound/soc/omap/omap-pcm.c
+@@ -231,7 +231,7 @@ static int omap_pcm_open(struct snd_pcm_
+ if (ret < 0)
+ goto out;
+
+- prtd = kzalloc(sizeof(prtd), GFP_KERNEL);
++ prtd = kzalloc(sizeof(*prtd), GFP_KERNEL);
+ if (prtd == NULL) {
+ ret = -ENOMEM;
+ goto out;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012358.848876633@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brian King <brking@linux.vnet.ibm.com>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 12/21] SCSI: ibmvstgt: move crq_queue_create to the end of initialization
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-ibmvstgt-move-crq_queue_create-to-the-end-of-initialization.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 57458036af75c6dbb62bee04b3982e92261eddb1 upstream.
+
+Calling crq_queue_create could lead to the creation of a rport. We
+need to set up everything before creating a rport. This moves
+crq_queue_create to the end of initialization to avoid a race which
+causes an oops if lost.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Olaf Hering <olh@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ibmvscsi/ibmvstgt.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/ibmvscsi/ibmvstgt.c
++++ b/drivers/scsi/ibmvscsi/ibmvstgt.c
+@@ -864,21 +864,23 @@ static int ibmvstgt_probe(struct vio_dev
+
+ INIT_WORK(&vport->crq_work, handle_crq);
+
+- err = crq_queue_create(&vport->crq_queue, target);
++ err = scsi_add_host(shost, target->dev);
+ if (err)
+ goto free_srp_target;
+
+- err = scsi_add_host(shost, target->dev);
++ err = scsi_tgt_alloc_queue(shost);
+ if (err)
+- goto destroy_queue;
++ goto remove_host;
+
+- err = scsi_tgt_alloc_queue(shost);
++ err = crq_queue_create(&vport->crq_queue, target);
+ if (err)
+- goto destroy_queue;
++ goto free_queue;
+
+ return 0;
+-destroy_queue:
+- crq_queue_destroy(target);
++free_queue:
++ scsi_tgt_free_queue(shost);
++remove_host:
++ scsi_remove_host(shost);
+ free_srp_target:
+ srp_target_free(target);
+ put_host:
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.021366913@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gernot Hillier <gernot.hillier@siemens.com>,
+ Tomas Henzl <thenzl@redhat.com>,
+ Matt Domsch <Matt_Domsch@dell.com>,
+ AACRAID list <aacraid@adaptec.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 13/21] SCSI: aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-aacraid-disable-dell-percraid-quirk-on-adaptec-2200s-and-2120s.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hillier, Gernot <gernot.hillier@siemens.com>
+
+commit b21227c5fcadab206e2a2373e5b288a351919abb upstream.
+
+A lot of 64bit machines with Adaptec 2200S and 2120S controllers don't
+recognize SCSI disks any more with the patch
+
+commit 94cf6ba11b068b8a8f68a1e88bffb6827e92124b
+Author: Salyzyn, Mark <mark_salyzyn@adaptec.com>
+Date: Thu Dec 13 16:14:18 2007 -0800
+
+ [SCSI] aacraid: fix driver failure with Dell PowerEdge Expandable RAID Controller 3/Di
+
+but fail with tons of "aac_srb: aac_fib_send failed with status: 8195"
+instead. This patch disables the quirk introduced in the change cited
+above for those two controllers again.
+
+[thenzl: added 2120S Controller]
+Signed-off-by: Gernot Hillier <gernot.hillier@siemens.com>
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Acked-by: Matt Domsch <Matt_Domsch@dell.com>
+Cc: AACRAID list <aacraid@adaptec.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aacraid/linit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -175,8 +175,8 @@ static struct aac_driver_ident aac_drive
+ { aac_rx_init, "percraid", "DELL ", "PERCRAID ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* PERC 3/Di (Boxster/PERC3DiB) */
+ { aac_rx_init, "aacraid", "ADAPTEC ", "catapult ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* catapult */
+ { aac_rx_init, "aacraid", "ADAPTEC ", "tomcat ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* tomcat */
+- { aac_rx_init, "aacraid", "ADAPTEC ", "Adaptec 2120S ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2120S (Crusader) */
+- { aac_rx_init, "aacraid", "ADAPTEC ", "Adaptec 2200S ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2200S (Vulcan) */
++ { aac_rx_init, "aacraid", "ADAPTEC ", "Adaptec 2120S ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG }, /* Adaptec 2120S (Crusader) */
++ { aac_rx_init, "aacraid", "ADAPTEC ", "Adaptec 2200S ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG }, /* Adaptec 2200S (Vulcan) */
+ { aac_rx_init, "aacraid", "ADAPTEC ", "Adaptec 2200S ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2200S (Vulcan-2m) */
+ { aac_rx_init, "aacraid", "Legend ", "Legend S220 ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Legend S220 (Legend Crusader) */
+ { aac_rx_init, "aacraid", "Legend ", "Legend S230 ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Legend S230 (Legend Vulcan) */
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.195161986@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Stephen M. Cameron" <scameron@beardog.cca.cpqcorp.net>,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 14/21] cciss: fix problem that deleting multiple logical drives could cause a panic
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=cciss-fix-problem-that-deleting-multiple-logical-drives-could-cause-a-panic.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net>
+
+commit d8a0be6ab7ba1ffa43e7ea0dcdde3e8b68d4f762 upstream.
+
+Fix problem that deleting multiple logical drives could cause a panic.
+
+It fixes a panic which can be easily reproduced in the following way: Just
+create several "arrays," each with multiple logical drives via hpacucli,
+then delete the first array, and it will blow up in deregister_disk(), in
+the call to get_host() when it tries to dig the hba pointer out of a NULL
+queue pointer.
+
+The problem has been present since my code to make rebuild_lun_table
+behave better went in.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/cciss.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1692,6 +1692,11 @@ static int rebuild_lun_table(ctlr_info_t
+ for (i = 0; i <= h->highest_lun; i++) {
+ int j;
+ drv_found = 0;
++
++ /* skip holes in the array from already deleted drives */
++ if (h->drv[i].raid_level == -1)
++ continue;
++
+ for (j = 0; j < num_luns; j++) {
+ memcpy(&lunid, &ld_buff->LUN[j][0], 4);
+ lunid = le32_to_cpu(lunid);
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.386390126@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herton Ronaldo Krzesinski <herton@mandriva.com.br>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 15/21] ALSA: hda - Add missing terminators in patch_sigmatel.c
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-add-missing-terminators-in-patch_sigmatel.c.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+
+commit 574f3c4f5c55e99ea60f71fd98cc54931d4b2eae upstream.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -638,6 +638,7 @@ static struct hda_verb stac92hd71bxx_cor
+ { 0x0a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+ { 0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+ { 0x0f, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
++ {}
+ };
+
+ #define HD_DISABLE_PORTF 3
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.556556652@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kyle McMartin <kyle@mcmartin.ca>
+Subject: [patch 16/21] parisc: disable UP-optimized flush_tlb_mm
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=parisc-disable-up-optimized-flush_tlb_mm.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Kyle McMartin <kyle@infradead.org>
+
+commit 5289f46b9de04bde181d833d48df9671b69c4b08 upstream.
+
+flush_tlb_mm's "optimized" uniprocessor case of allocating a new
+context for userspace is exposing a race where we can suddely return
+to a syscall with the protection id and space id out of sync, trapping
+on the next userspace access.
+
+Debugged-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-parisc/tlbflush.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/asm-parisc/tlbflush.h
++++ b/include/asm-parisc/tlbflush.h
+@@ -44,9 +44,12 @@ static inline void flush_tlb_mm(struct m
+ {
+ BUG_ON(mm == &init_mm); /* Should never happen */
+
+-#ifdef CONFIG_SMP
++#if 1 || defined(CONFIG_SMP)
+ flush_tlb_all();
+ #else
++ /* FIXME: currently broken, causing space id and protection ids
++ * to go out of sync, resulting in faults on userspace accesses.
++ */
+ if (mm) {
+ if (mm->context != 0)
+ free_sid(mm->context);
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.750452954@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarek Poplawski <jarkao2@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 17/21] drivers/net: starfire: Fix napi ->poll() weight handling
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=drivers-net-starfire-fix-napi-poll-weight-handling.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+commit 9a3de25544dadab1971847f28f33b1cd0d1770a6 upstream.
+
+starfire napi ->poll() handler can return work == weight after calling
+netif_rx_complete() (if there is no more work). It is illegal and this
+patch fixes it.
+
+Reported-by: Alexander Huemer <alexander.huemer@sbg.ac.at>
+Tested-by: Alexander Huemer <alexander.huemer@sbg.ac.at>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/starfire.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/starfire.c
++++ b/drivers/net/starfire.c
+@@ -1509,6 +1509,11 @@ static int __netdev_rx(struct net_device
+ desc->status = 0;
+ np->rx_done = (np->rx_done + 1) % DONE_Q_SIZE;
+ }
++
++ if (*quota == 0) { /* out of rx quota */
++ retcode = 1;
++ goto out;
++ }
+ writew(np->rx_done, np->base + CompletionQConsumerIdx);
+
+ out:
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.024156235@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 18/21] AMD IOMMU: reset command buffer pointers manually
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-reset-command-buffer-pointers-manually.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4
+
+Under special circumstances the IOMMU does not reset the head and tail
+pointer of its command ringbuffer to zero when the command base is
+written. This causes the IOMMU to fetch random memory and executes it as
+an command. Since these commands are likely illegal IOMMU stops fetching
+further commands including IOTLB flushes. This leads to completion wait
+errors at boot and in some cases to data corruption and kernel crashes.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -407,6 +407,10 @@ static u8 * __init alloc_command_buffer(
+ memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+ &entry, sizeof(entry));
+
++ /* set head and tail to zero manually */
++ writel(0x00, iommu->mmio_base + MMIO_CMD_HEAD_OFFSET);
++ writel(0x00, iommu->mmio_base + MMIO_CMD_TAIL_OFFSET);
++
+ iommu_feature_enable(iommu, CONTROL_CMDBUF_EN);
+
+ return cmd_buf;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.203177740@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 19/21] AMD IOMMU: allocate rlookup_table with __GFP_ZERO
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-allocate-rlookup_table-with-__gfp_zero.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b
+
+This is pointer list and if we dereference an uninitialized pointer
+later this results in a kernel crash at boot. Happens typically after
+3-5 hours of rebooting.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -930,7 +930,8 @@ int __init amd_iommu_init(void)
+ goto free;
+
+ /* IOMMU rlookup table - find the IOMMU for a specific device */
+- amd_iommu_rlookup_table = (void *)__get_free_pages(GFP_KERNEL,
++ amd_iommu_rlookup_table = (void *)__get_free_pages(
++ GFP_KERNEL | __GFP_ZERO,
+ get_order(rlookup_table_size));
+ if (amd_iommu_rlookup_table == NULL)
+ goto free;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.481325160@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 20/21] AMD IOMMU: initialize phys_addr correctly in iommu_page_map
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-initialize-phys_addr-correctly-in-iommu_page_map.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit bb9d4ff80bc032d7961815c2ff5eaf458ae3adff
+
+Due to this bug mappings for devices requested by the ACPI table are
+incorrect.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -235,7 +235,7 @@ static int iommu_map(struct protection_d
+ u64 __pte, *pte, *page;
+
+ bus_addr = PAGE_ALIGN(bus_addr);
+- phys_addr = PAGE_ALIGN(bus_addr);
++ phys_addr = PAGE_ALIGN(phys_addr);
+
+ /* only support 512GB address spaces for now */
+ if (bus_addr > IOMMU_MAP_SIZE_L3 || !(prot & IOMMU_PROT_MASK))
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.629752200@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 21/21] AMD IOMMU: fix wrong loop counter in free_pagetables
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-fix-wrong-loop-counter-in-free_pagetables.patch
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit 3cc3d84bffbd93bdb671ac7961b12cd98fbb9266
+
+This fixes a bug which causes the driver to go in an endless loop if
+initialization fails and its resources are freed.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -487,7 +487,7 @@ static void dma_ops_free_pagetable(struc
+ continue;
+
+ p2 = IOMMU_PTE_PAGE(p1[i]);
+- for (j = 0; j < 512; ++i) {
++ for (j = 0; j < 512; ++j) {
+ if (!IOMMU_PTE_PRESENT(p2[j]))
+ continue;
+ p3 = IOMMU_PTE_PAGE(p2[j]);
+
+