]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
start 2.6.27.11 review cycle
authorGreg Kroah-Hartman <gregkh@suse.de>
Tue, 13 Jan 2009 01:31:59 +0000 (17:31 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 13 Jan 2009 01:31:59 +0000 (17:31 -0800)
23 files changed:
review-2.6.27/alsa-fix-a-oops-bug-in-omap-soc-driver.patch [moved from queue-2.6.27/alsa-fix-a-oops-bug-in-omap-soc-driver.patch with 100% similarity]
review-2.6.27/alsa-hda-add-missing-terminators-in-patch_sigmatel.c.patch [moved from queue-2.6.27/alsa-hda-add-missing-terminators-in-patch_sigmatel.c.patch with 100% similarity]
review-2.6.27/amd-iommu-allocate-rlookup_table-with-__gfp_zero.patch [moved from queue-2.6.27/amd-iommu-allocate-rlookup_table-with-__gfp_zero.patch with 100% similarity]
review-2.6.27/amd-iommu-fix-wrong-loop-counter-in-free_pagetables.patch [moved from queue-2.6.27/amd-iommu-fix-wrong-loop-counter-in-free_pagetables.patch with 100% similarity]
review-2.6.27/amd-iommu-initialize-phys_addr-correctly-in-iommu_page_map.patch [moved from queue-2.6.27/amd-iommu-initialize-phys_addr-correctly-in-iommu_page_map.patch with 100% similarity]
review-2.6.27/amd-iommu-reset-command-buffer-pointers-manually.patch [moved from queue-2.6.27/amd-iommu-reset-command-buffer-pointers-manually.patch with 100% similarity]
review-2.6.27/async_xor-dma_map-destination-dma_bidirectional.patch [moved from queue-2.6.27/async_xor-dma_map-destination-dma_bidirectional.patch with 100% similarity]
review-2.6.27/cciss-fix-problem-that-deleting-multiple-logical-drives-could-cause-a-panic.patch [moved from queue-2.6.27/cciss-fix-problem-that-deleting-multiple-logical-drives-could-cause-a-panic.patch with 100% similarity]
review-2.6.27/dmaengine-protect-id-from-concurrent-registrations.patch [moved from queue-2.6.27/dmaengine-protect-id-from-concurrent-registrations.patch with 100% similarity]
review-2.6.27/drivers-net-starfire-fix-napi-poll-weight-handling.patch [moved from queue-2.6.27/drivers-net-starfire-fix-napi-poll-weight-handling.patch with 100% similarity]
review-2.6.27/ioat-wait-for-self-test-completion.patch [moved from queue-2.6.27/ioat-wait-for-self-test-completion.patch with 100% similarity]
review-2.6.27/iwlagn-downgrade-bug_on-in-interrupt.patch [moved from queue-2.6.27/iwlagn-downgrade-bug_on-in-interrupt.patch with 100% similarity]
review-2.6.27/mbox [new file with mode: 0644]
review-2.6.27/md-don-t-read-past-end-of-bitmap-when-reading-bitmap.patch [moved from queue-2.6.27/md-don-t-read-past-end-of-bitmap-when-reading-bitmap.patch with 100% similarity]
review-2.6.27/parisc-disable-up-optimized-flush_tlb_mm.patch [moved from queue-2.6.27/parisc-disable-up-optimized-flush_tlb_mm.patch with 100% similarity]
review-2.6.27/powerpc-fix-corruption-error-in-rh_alloc_fixed.patch [moved from queue-2.6.27/powerpc-fix-corruption-error-in-rh_alloc_fixed.patch with 100% similarity]
review-2.6.27/scsi-aacraid-disable-dell-percraid-quirk-on-adaptec-2200s-and-2120s.patch [moved from queue-2.6.27/scsi-aacraid-disable-dell-percraid-quirk-on-adaptec-2200s-and-2120s.patch with 100% similarity]
review-2.6.27/scsi-ibmvstgt-move-crq_queue_create-to-the-end-of-initialization.patch [moved from queue-2.6.27/scsi-ibmvstgt-move-crq_queue_create-to-the-end-of-initialization.patch with 100% similarity]
review-2.6.27/series [moved from queue-2.6.27/series with 100% similarity]
review-2.6.27/usb-gadget-fix-rndis-working-at-high-speed.patch [moved from queue-2.6.27/usb-gadget-fix-rndis-working-at-high-speed.patch with 100% similarity]
review-2.6.27/usb-storage-unusual_devs.h-nokia-3109c-addition.patch [moved from queue-2.6.27/usb-storage-unusual_devs.h-nokia-3109c-addition.patch with 100% similarity]
review-2.6.27/usb-storage-update-unusual_devs-entry-for-nokia-5310.patch [moved from queue-2.6.27/usb-storage-update-unusual_devs-entry-for-nokia-5310.patch with 100% similarity]
review-2.6.27/usb-unusual-devs-patch-for-nokia-3500c.patch [moved from queue-2.6.27/usb-unusual-devs-patch-for-nokia-3500c.patch with 100% similarity]

diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox
new file mode 100644 (file)
index 0000000..5c99c51
--- /dev/null
@@ -0,0 +1,1665 @@
+From gregkh@mini.kroah.org Mon Jan 12 17:23:56 2009
+Message-Id: <20090113012006.063755472@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/21] 2.6.27-stable review
+
+This is the start of the stable review cycle for the 2.6.27.11 release.
+
+It basically flushes out all of the 2.6.27 patches that went into the
+2.6.28 release.  Almost none of the patches marked for the stable series
+that have gone in after 2.6.28 came out has gone into this tree yet.
+That will come in the next releases, this is just to get these older
+fixes out to those who need them now.
+
+There are 21 patches in this series, all will be posted as a response to
+this one.  If anyone has any issues with these being applied, please let
+us know.  If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line.  If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list.  If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Thursday, January 15, 2009, 00:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+       kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.11-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+greg k-h
+
+------------
+
+ Makefile                              |    2 +-
+ arch/powerpc/lib/rheap.c              |    1 +
+ arch/x86/kernel/amd_iommu.c           |    4 ++--
+ arch/x86/kernel/amd_iommu_init.c      |    7 ++++++-
+ crypto/async_tx/async_xor.c           |   11 +++++++++--
+ drivers/block/cciss.c                 |    5 +++++
+ drivers/dma/dmaengine.c               |    3 +++
+ drivers/dma/ioat_dma.c                |    5 ++++-
+ drivers/dma/iop-adma.c                |   16 +++++++++++++---
+ drivers/dma/mv_xor.c                  |   15 ++++++++++++---
+ drivers/md/bitmap.c                   |   22 +++++++++++++++++-----
+ drivers/net/starfire.c                |    5 +++++
+ drivers/net/wireless/iwlwifi/iwl-tx.c |    7 +++----
+ drivers/scsi/aacraid/linit.c          |    4 ++--
+ drivers/scsi/ibmvscsi/ibmvstgt.c      |   16 +++++++++-------
+ drivers/usb/gadget/f_rndis.c          |    4 ++++
+ drivers/usb/storage/unusual_devs.h    |   16 +++++++++++++++-
+ include/asm-parisc/tlbflush.h         |    5 ++++-
+ sound/pci/hda/patch_sigmatel.c        |    1 +
+ sound/soc/omap/omap-pcm.c             |    2 +-
+ 20 files changed, 117 insertions(+), 34 deletions(-)
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012356.909056684@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 01/21] USB: gadget: fix rndis working at high speed
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-gadget-fix-rndis-working-at-high-speed.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 7c12414955e9b44a3e33d54e578bf008caa4475d upstream.
+
+Fix a bug specific to highspeed mode in the recently updated RNDIS
+support:  it wasn't setting up the high speed notification endpoint,
+which prevented high speed RNDIS links from working.
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Tested-by: Anand Gadiyar <gadiyar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/f_rndis.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/gadget/f_rndis.c
++++ b/drivers/usb/gadget/f_rndis.c
+@@ -651,6 +651,8 @@ rndis_bind(struct usb_configuration *c, 
+                               fs_in_desc.bEndpointAddress;
+               hs_out_desc.bEndpointAddress =
+                               fs_out_desc.bEndpointAddress;
++              hs_notify_desc.bEndpointAddress =
++                              fs_notify_desc.bEndpointAddress;
+               /* copy descriptors, and track endpoint copies */
+               f->hs_descriptors = usb_copy_descriptors(eth_hs_function);
+@@ -662,6 +664,8 @@ rndis_bind(struct usb_configuration *c, 
+                               f->hs_descriptors, &hs_in_desc);
+               rndis->hs.out = usb_find_endpoint(eth_hs_function,
+                               f->hs_descriptors, &hs_out_desc);
++              rndis->hs.notify = usb_find_endpoint(eth_hs_function,
++                              f->hs_descriptors, &hs_notify_desc);
+       }
+       rndis->port.open = rndis_open;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.073560835@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 02/21] usb-storage: update unusual_devs entry for Nokia 5310
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-update-unusual_devs-entry-for-nokia-5310.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a4b188095912eee83d065f000dfe06f25919750b upstream.
+
+This patch (as1179) updates the unusual_devs entry for Nokia's 5310
+phone to include a more recent firmware revision.
+
+This fixes Bugzilla #12099.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Robson Roberto Souza Peixoto <robsonpeixoto@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -168,7 +168,7 @@ UNUSUAL_DEV(  0x0421, 0x005d, 0x0001, 0x
+               US_FL_FIX_CAPACITY ),
+ /* Patch for Nokia 5310 capacity */
+-UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
++UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0701,
+               "Nokia",
+               "5310",
+               US_SC_DEVICE, US_PR_DEVICE, NULL,
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.249558215@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Phil Dibowitz <phil@ipom.com>
+Subject: [patch 03/21] USB: storage: unusual_devs.h: Nokia 3109c addition
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-storage-unusual_devs.h-nokia-3109c-addition.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: CSÉCSY László <boobaa@frugalware.org>
+
+commit 1393fce7189427bdb4d6115ca5566ca8d0fc86f3 upstream.
+
+2.6.26(.x, cannot remember) could handle the microSD card in my Nokia
+3109c attached via USB as mass storage, 2.6.27(.x, up to and included
+2.6.27.8) cannot. Please find the attached patch which fixes this
+regression, and a copy of /proc/bus/usb/devices with my phone plugged in
+running with this patch on Frugalware.
+
+T:  Bus=02 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#=  4 Spd=12  MxCh= 0
+D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
+P:  Vendor=0421 ProdID=0063 Rev= 6.01
+S:  Manufacturer=Nokia
+S:  Product=Nokia 3109c
+S:  SerialNumber=359561013742570
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+
+From: CSÉCSY László <boobaa@frugalware.org>
+Cc: Phil Dibowitz <phil@ipom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -253,6 +253,13 @@ UNUSUAL_DEV(  0x0421, 0x04fa, 0x0550, 0x
+               US_SC_DEVICE, US_PR_DEVICE, NULL,
+               US_FL_FIX_CAPACITY ),
++/* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
++UNUSUAL_DEV(  0x0421, 0x0063, 0x0001, 0x0601,
++              "Nokia",
++              "Nokia 3109c",
++              US_SC_DEVICE, US_PR_DEVICE, NULL,
++              US_FL_FIX_CAPACITY ),
++
+ /* Patch for Nokia 5310 capacity */
+ UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
+       "Nokia",
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.459682604@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 04/21] USB: Unusual devs patch for Nokia 3500c
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=usb-unusual-devs-patch-for-nokia-3500c.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Ozan Sener <themgzzy@gmail.com>
+
+commit 48e1a540e1e9ea62a2b3088a69ecf934f3172b14 upstream.
+
+T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
+D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
+P:  Vendor=0421 ProdID=0060 Rev= 5.51
+S:  Manufacturer=Nokia
+S:  Product=Nokia 3500c
+S:  SerialNumber=357687010280751
+C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+
+From: Ozan Sener <themgzzy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -253,6 +253,13 @@ UNUSUAL_DEV(  0x0421, 0x04fa, 0x0550, 0x
+               US_SC_DEVICE, US_PR_DEVICE, NULL,
+               US_FL_FIX_CAPACITY ),
++/* Reported by Ozan Sener <themgzzy@gmail.com> */
++UNUSUAL_DEV(  0x0421, 0x0060, 0x0551, 0x0551,
++              "Nokia",
++              "3500c",
++              US_SC_DEVICE, US_PR_DEVICE, NULL,
++              US_FL_FIX_CAPACITY ),
++
+ /* Reported by CSECSY Laszlo <boobaa@frugalware.org> */
+ UNUSUAL_DEV(  0x0421, 0x0063, 0x0001, 0x0601,
+               "Nokia",
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.627146072@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Guillaume Knispel <gknispel@proformatique.com>,
+ Timur Tabi <timur@freescale.com>,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 05/21] powerpc: Fix corruption error in rh_alloc_fixed()
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-corruption-error-in-rh_alloc_fixed.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Guillaume Knispel <gknispel@proformatique.com>
+
+commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream.
+
+There is an error in rh_alloc_fixed() of the Remote Heap code:
+If there is at least one free block blk won't be NULL at the end of the
+search loop, so -ENOMEM won't be returned and the else branch of
+"if (bs == s || be == e)" will be taken, corrupting the management
+structures.
+
+Signed-off-by: Guillaume Knispel <gknispel@proformatique.com>
+Acked-by: Timur Tabi <timur@freescale.com>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/lib/rheap.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/lib/rheap.c
++++ b/arch/powerpc/lib/rheap.c
+@@ -556,6 +556,7 @@ unsigned long rh_alloc_fixed(rh_info_t *
+               be = blk->start + blk->size;
+               if (s >= bs && e <= be)
+                       break;
++              blk = NULL;
+       }
+       if (blk == NULL)
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:57 2009
+Message-Id: <20090113012357.802100369@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ =?ISO-8859-15?q?Fran=C3=A7ois=20Valenduc?= <francois.valenduc@tvcablenet.be>
+Subject: [patch 06/21] iwlagn: downgrade BUG_ON in interrupt
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=iwlagn-downgrade-bug_on-in-interrupt.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 55d6a3cd0cc85ed90c39cf32e16f622bd003117b upstream.
+
+This BUG_ON really shouldn't trigger, but if it does, as on my machine,
+it leaves you wondering what happened because you won't see it. Let's
+instead leak a bit of state and memory and at least make it possible to
+report it to the kerneloops project to track it.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: François Valenduc <francois.valenduc@tvcablenet.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-tx.c |    7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1192,10 +1192,9 @@ void iwl_tx_cmd_complete(struct iwl_priv
+       /* If a Tx command is being handled and it isn't in the actual
+        * command queue then there a command routing bug has been introduced
+        * in the queue management code. */
+-      if (txq_id != IWL_CMD_QUEUE_NUM)
+-              IWL_ERROR("Error wrong command queue %d command id 0x%X\n",
+-                        txq_id, pkt->hdr.cmd);
+-      BUG_ON(txq_id != IWL_CMD_QUEUE_NUM);
++      if (WARN(txq_id != IWL_CMD_QUEUE_NUM,
++               "wrong command queue %d, command id 0x%X\n", txq_id, pkt->hdr.cmd))
++              return;
+       cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
+       cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012357.982639433@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Saeed Bishara <saeed@marvell.com>,
+ Yuri Tikhonov <yur@emcraft.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 07/21] async_xor: dma_map destination DMA_BIDIRECTIONAL
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=async_xor-dma_map-destination-dma_bidirectional.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit a06d568f7c5e40e34ea64881842deb8f4382babf upstream.
+
+Mapping the destination multiple times is a misuse of the dma-api.
+Since the destination may be reused as a source, ensure that it is only
+mapped once and that it is mapped bidirectionally.  This appears to add
+ugliness on the unmap side in that it always reads back the destination
+address from the descriptor, but gcc can determine that dma_unmap is a
+nop and not emit the code that calculates its arguments.
+
+Cc: Saeed Bishara <saeed@marvell.com>
+Acked-by: Yuri Tikhonov <yur@emcraft.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/async_tx/async_xor.c |   11 +++++++++--
+ drivers/dma/iop-adma.c      |   16 +++++++++++++---
+ drivers/dma/mv_xor.c        |   15 ++++++++++++---
+ 3 files changed, 34 insertions(+), 8 deletions(-)
+
+--- a/crypto/async_tx/async_xor.c
++++ b/crypto/async_tx/async_xor.c
+@@ -53,10 +53,17 @@ do_async_xor(struct dma_chan *chan, stru
+       int xor_src_cnt;
+       dma_addr_t dma_dest;
+-      dma_dest = dma_map_page(dma->dev, dest, offset, len, DMA_FROM_DEVICE);
+-      for (i = 0; i < src_cnt; i++)
++      /* map the dest bidrectional in case it is re-used as a source */
++      dma_dest = dma_map_page(dma->dev, dest, offset, len, DMA_BIDIRECTIONAL);
++      for (i = 0; i < src_cnt; i++) {
++              /* only map the dest once */
++              if (unlikely(src_list[i] == dest)) {
++                      dma_src[i] = dma_dest;
++                      continue;
++              }
+               dma_src[i] = dma_map_page(dma->dev, src_list[i], offset,
+                                         len, DMA_TO_DEVICE);
++      }
+       while (src_cnt) {
+               async_flags = flags;
+--- a/drivers/dma/iop-adma.c
++++ b/drivers/dma/iop-adma.c
+@@ -85,18 +85,28 @@ iop_adma_run_tx_complete_actions(struct 
+                       enum dma_ctrl_flags flags = desc->async_tx.flags;
+                       u32 src_cnt;
+                       dma_addr_t addr;
++                      dma_addr_t dest;
++                      src_cnt = unmap->unmap_src_cnt;
++                      dest = iop_desc_get_dest_addr(unmap, iop_chan);
+                       if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+-                              addr = iop_desc_get_dest_addr(unmap, iop_chan);
+-                              dma_unmap_page(dev, addr, len, DMA_FROM_DEVICE);
++                              enum dma_data_direction dir;
++
++                              if (src_cnt > 1) /* is xor? */
++                                      dir = DMA_BIDIRECTIONAL;
++                              else
++                                      dir = DMA_FROM_DEVICE;
++
++                              dma_unmap_page(dev, dest, len, dir);
+                       }
+                       if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+-                              src_cnt = unmap->unmap_src_cnt;
+                               while (src_cnt--) {
+                                       addr = iop_desc_get_src_addr(unmap,
+                                                                    iop_chan,
+                                                                    src_cnt);
++                                      if (addr == dest)
++                                              continue;
+                                       dma_unmap_page(dev, addr, len,
+                                                      DMA_TO_DEVICE);
+                               }
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -311,17 +311,26 @@ mv_xor_run_tx_complete_actions(struct mv
+                       enum dma_ctrl_flags flags = desc->async_tx.flags;
+                       u32 src_cnt;
+                       dma_addr_t addr;
++                      dma_addr_t dest;
++                      src_cnt = unmap->unmap_src_cnt;
++                      dest = mv_desc_get_dest_addr(unmap);
+                       if (!(flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+-                              addr = mv_desc_get_dest_addr(unmap);
+-                              dma_unmap_page(dev, addr, len, DMA_FROM_DEVICE);
++                              enum dma_data_direction dir;
++
++                              if (src_cnt > 1) /* is xor ? */
++                                      dir = DMA_BIDIRECTIONAL;
++                              else
++                                      dir = DMA_FROM_DEVICE;
++                              dma_unmap_page(dev, dest, len, dir);
+                       }
+                       if (!(flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+-                              src_cnt = unmap->unmap_src_cnt;
+                               while (src_cnt--) {
+                                       addr = mv_desc_get_src_addr(unmap,
+                                                                   src_cnt);
++                                      if (addr == dest)
++                                              continue;
+                                       dma_unmap_page(dev, addr, len,
+                                                      DMA_TO_DEVICE);
+                               }
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.152631367@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Maciej Sosnowski <maciej.sosnowski@intel.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 08/21] dmaengine: protect id from concurrent registrations
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=dmaengine-protect-id-from-concurrent-registrations.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b0b42b16ff2b90f17bc1a4308366c9beba4b276e upstream.
+
+There is a possibility to have two devices registered with the same id.
+
+Acked-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/dmaengine.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -388,7 +388,10 @@ int dma_async_device_register(struct dma
+       init_completion(&device->done);
+       kref_init(&device->refcount);
++
++      mutex_lock(&dma_list_mutex);
+       device->dev_id = id++;
++      mutex_unlock(&dma_list_mutex);
+       /* represent channels in sysfs. Probably want devs too */
+       list_for_each_entry(chan, &device->channels, device_node) {
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.324529407@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Maciej Sosnowski <maciej.sosnowski@intel.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 09/21] ioat: wait for self-test completion
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=ioat-wait-for-self-test-completion.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 532d3b1f86f41834a25373e3ded981d68e4ce17f upstream.
+
+As part of the ioat_dma self-test it performs a printk from a completion
+callback.  Depending on the system console configuration this output can
+take longer than a millisecond causing the self-test to fail.  Introduce a
+completion with a generous timeout to mitigate this failure.
+
+Acked-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/ioat_dma.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -1337,10 +1337,12 @@ static void ioat_dma_start_null_desc(str
+  */
+ #define IOAT_TEST_SIZE 2000
++DECLARE_COMPLETION(test_completion);
+ static void ioat_dma_test_callback(void *dma_async_param)
+ {
+       printk(KERN_ERR "ioatdma: ioat_dma_test_callback(%p)\n",
+               dma_async_param);
++      complete(&test_completion);
+ }
+ /**
+@@ -1406,7 +1408,8 @@ static int ioat_dma_self_test(struct ioa
+               goto free_resources;
+       }
+       device->common.device_issue_pending(dma_chan);
+-      msleep(1);
++
++      wait_for_completion_timeout(&test_completion, msecs_to_jiffies(3000));
+       if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
+                                       != DMA_SUCCESS) {
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.496089677@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Brown <neilb@suse.de>
+Subject: [patch 10/21] md: Dont read past end of bitmap when reading bitmap.
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=md-don-t-read-past-end-of-bitmap-when-reading-bitmap.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit a2ed9615e3222645007fc19991aedf30eed3ecfd upstream.
+
+When we read the write-intent-bitmap off the device, we currently
+read a whole number of pages.
+When PAGE_SIZE is 4K, this works due to the alignment we enforce
+on the superblock and bitmap.
+When PAGE_SIZE is 64K, this case read past the end-of-device
+which causes an error.
+
+When we write the superblock, we ensure to clip the last page
+to just be the required size.  Copy that code into the read path
+to just read the required number of sectors.
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c |   22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -208,16 +208,19 @@ static void bitmap_checkfree(struct bitm
+  */
+ /* IO operations when bitmap is stored near all superblocks */
+-static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long index)
++static struct page *read_sb_page(mddev_t *mddev, long offset,
++                               struct page *page,
++                               unsigned long index, int size)
+ {
+       /* choose a good rdev and read the page from there */
+       mdk_rdev_t *rdev;
+       struct list_head *tmp;
+-      struct page *page = alloc_page(GFP_KERNEL);
+       sector_t target;
+       if (!page)
++              page = alloc_page(GFP_KERNEL);
++      if (!page)
+               return ERR_PTR(-ENOMEM);
+       rdev_for_each(rdev, tmp, mddev) {
+@@ -227,7 +230,9 @@ static struct page *read_sb_page(mddev_t
+               target = rdev->sb_start + offset + index * (PAGE_SIZE/512);
+-              if (sync_page_io(rdev->bdev, target, PAGE_SIZE, page, READ)) {
++              if (sync_page_io(rdev->bdev, target,
++                               roundup(size, bdev_hardsect_size(rdev->bdev)),
++                               page, READ)) {
+                       page->index = index;
+                       attach_page_buffers(page, NULL); /* so that free_buffer will
+                                                         * quietly no-op */
+@@ -544,7 +549,9 @@ static int bitmap_read_sb(struct bitmap 
+               bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
+       } else {
+-              bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0);
++              bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset,
++                                             NULL,
++                                             0, sizeof(bitmap_super_t));
+       }
+       if (IS_ERR(bitmap->sb_page)) {
+               err = PTR_ERR(bitmap->sb_page);
+@@ -957,11 +964,16 @@ static int bitmap_init_from_disk(struct 
+                                */
+                               page = bitmap->sb_page;
+                               offset = sizeof(bitmap_super_t);
++                              read_sb_page(bitmap->mddev, bitmap->offset,
++                                           page,
++                                           index, count);
+                       } else if (file) {
+                               page = read_page(file, index, bitmap, count);
+                               offset = 0;
+                       } else {
+-                              page = read_sb_page(bitmap->mddev, bitmap->offset, index);
++                              page = read_sb_page(bitmap->mddev, bitmap->offset,
++                                                  NULL,
++                                                  index, count);
+                               offset = 0;
+                       }
+                       if (IS_ERR(page)) { /* read error */
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:58 2009
+Message-Id: <20090113012358.659160410@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stanley Miao <stanley.miao@windriver.com>,
+ Jarkko Nikula <jarkko.nikula@nokia.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 11/21] ALSA: Fix a Oops bug in omap soc driver.
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-fix-a-oops-bug-in-omap-soc-driver.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Stanley Miao <stanley.miao@windriver.com>
+
+commit 19b3f31609dc8be3a56c78dcb7da723f10f7009c upstream.
+
+There will be a Oops or frequent underrun messages when playing music with
+omap soc driver, this is because a data region is incorretly sized, other data
+region will be overwriten when writing to this data region.
+
+Signed-off-by: Stanley Miao <stanley.miao@windriver.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@nokia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/omap/omap-pcm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/omap/omap-pcm.c
++++ b/sound/soc/omap/omap-pcm.c
+@@ -231,7 +231,7 @@ static int omap_pcm_open(struct snd_pcm_
+       if (ret < 0)
+               goto out;
+-      prtd = kzalloc(sizeof(prtd), GFP_KERNEL);
++      prtd = kzalloc(sizeof(*prtd), GFP_KERNEL);
+       if (prtd == NULL) {
+               ret = -ENOMEM;
+               goto out;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012358.848876633@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brian King <brking@linux.vnet.ibm.com>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 12/21] SCSI: ibmvstgt: move crq_queue_create to the end of initialization
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-ibmvstgt-move-crq_queue_create-to-the-end-of-initialization.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 57458036af75c6dbb62bee04b3982e92261eddb1 upstream.
+
+Calling crq_queue_create could lead to the creation of a rport. We
+need to set up everything before creating a rport. This moves
+crq_queue_create to the end of initialization to avoid a race which
+causes an oops if lost.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Reported-by: Olaf Hering <olh@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ibmvscsi/ibmvstgt.c |   16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/ibmvscsi/ibmvstgt.c
++++ b/drivers/scsi/ibmvscsi/ibmvstgt.c
+@@ -864,21 +864,23 @@ static int ibmvstgt_probe(struct vio_dev
+       INIT_WORK(&vport->crq_work, handle_crq);
+-      err = crq_queue_create(&vport->crq_queue, target);
++      err = scsi_add_host(shost, target->dev);
+       if (err)
+               goto free_srp_target;
+-      err = scsi_add_host(shost, target->dev);
++      err = scsi_tgt_alloc_queue(shost);
+       if (err)
+-              goto destroy_queue;
++              goto remove_host;
+-      err = scsi_tgt_alloc_queue(shost);
++      err = crq_queue_create(&vport->crq_queue, target);
+       if (err)
+-              goto destroy_queue;
++              goto free_queue;
+       return 0;
+-destroy_queue:
+-      crq_queue_destroy(target);
++free_queue:
++      scsi_tgt_free_queue(shost);
++remove_host:
++      scsi_remove_host(shost);
+ free_srp_target:
+       srp_target_free(target);
+ put_host:
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.021366913@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gernot Hillier <gernot.hillier@siemens.com>,
+ Tomas Henzl <thenzl@redhat.com>,
+ Matt Domsch <Matt_Domsch@dell.com>,
+ AACRAID list <aacraid@adaptec.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 13/21] SCSI: aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-aacraid-disable-dell-percraid-quirk-on-adaptec-2200s-and-2120s.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Hillier, Gernot <gernot.hillier@siemens.com>
+
+commit b21227c5fcadab206e2a2373e5b288a351919abb upstream.
+
+A lot of 64bit machines with Adaptec 2200S and 2120S controllers don't
+recognize SCSI disks any more with the patch
+
+commit 94cf6ba11b068b8a8f68a1e88bffb6827e92124b
+Author: Salyzyn, Mark <mark_salyzyn@adaptec.com>
+Date:   Thu Dec 13 16:14:18 2007 -0800
+
+    [SCSI] aacraid: fix driver failure with Dell PowerEdge Expandable RAID Controller 3/Di
+
+but fail with tons of "aac_srb: aac_fib_send failed with status: 8195"
+instead. This patch disables the quirk introduced in the change cited
+above for those two controllers again.
+
+[thenzl: added 2120S Controller]
+Signed-off-by: Gernot Hillier <gernot.hillier@siemens.com>
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Acked-by: Matt Domsch <Matt_Domsch@dell.com>
+Cc: AACRAID list <aacraid@adaptec.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aacraid/linit.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -175,8 +175,8 @@ static struct aac_driver_ident aac_drive
+       { aac_rx_init, "percraid", "DELL    ", "PERCRAID        ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* PERC 3/Di (Boxster/PERC3DiB) */
+       { aac_rx_init, "aacraid",  "ADAPTEC ", "catapult        ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* catapult */
+       { aac_rx_init, "aacraid",  "ADAPTEC ", "tomcat          ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* tomcat */
+-      { aac_rx_init, "aacraid",  "ADAPTEC ", "Adaptec 2120S   ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2120S (Crusader) */
+-      { aac_rx_init, "aacraid",  "ADAPTEC ", "Adaptec 2200S   ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2200S (Vulcan) */
++      { aac_rx_init, "aacraid",  "ADAPTEC ", "Adaptec 2120S   ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG },                     /* Adaptec 2120S (Crusader) */
++      { aac_rx_init, "aacraid",  "ADAPTEC ", "Adaptec 2200S   ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG },                     /* Adaptec 2200S (Vulcan) */
+       { aac_rx_init, "aacraid",  "ADAPTEC ", "Adaptec 2200S   ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Adaptec 2200S (Vulcan-2m) */
+       { aac_rx_init, "aacraid",  "Legend  ", "Legend S220     ", 1, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Legend S220 (Legend Crusader) */
+       { aac_rx_init, "aacraid",  "Legend  ", "Legend S230     ", 2, AAC_QUIRK_31BIT | AAC_QUIRK_34SG | AAC_QUIRK_SCSI_32 }, /* Legend S230 (Legend Vulcan) */
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.195161986@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Stephen M. Cameron" <scameron@beardog.cca.cpqcorp.net>,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 14/21] cciss: fix problem that deleting multiple logical drives could cause a panic
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=cciss-fix-problem-that-deleting-multiple-logical-drives-could-cause-a-panic.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net>
+
+commit d8a0be6ab7ba1ffa43e7ea0dcdde3e8b68d4f762 upstream.
+
+Fix problem that deleting multiple logical drives could cause a panic.
+
+It fixes a panic which can be easily reproduced in the following way: Just
+create several "arrays," each with multiple logical drives via hpacucli,
+then delete the first array, and it will blow up in deregister_disk(), in
+the call to get_host() when it tries to dig the hba pointer out of a NULL
+queue pointer.
+
+The problem has been present since my code to make rebuild_lun_table
+behave better went in.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/cciss.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1692,6 +1692,11 @@ static int rebuild_lun_table(ctlr_info_t
+       for (i = 0; i <= h->highest_lun; i++) {
+               int j;
+               drv_found = 0;
++
++              /* skip holes in the array from already deleted drives */
++              if (h->drv[i].raid_level == -1)
++                      continue;
++
+               for (j = 0; j < num_luns; j++) {
+                       memcpy(&lunid, &ld_buff->LUN[j][0], 4);
+                       lunid = le32_to_cpu(lunid);
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.386390126@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herton Ronaldo Krzesinski <herton@mandriva.com.br>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 15/21] ALSA: hda - Add missing terminators in patch_sigmatel.c
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-add-missing-terminators-in-patch_sigmatel.c.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+
+commit 574f3c4f5c55e99ea60f71fd98cc54931d4b2eae upstream.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -638,6 +638,7 @@ static struct hda_verb stac92hd71bxx_cor
+       { 0x0a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+       { 0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+       { 0x0f, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
++      {}
+ };
+ #define HD_DISABLE_PORTF 3
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.556556652@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kyle McMartin <kyle@mcmartin.ca>
+Subject: [patch 16/21] parisc: disable UP-optimized flush_tlb_mm
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=parisc-disable-up-optimized-flush_tlb_mm.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Kyle McMartin <kyle@infradead.org>
+
+commit 5289f46b9de04bde181d833d48df9671b69c4b08 upstream.
+
+flush_tlb_mm's "optimized" uniprocessor case of allocating a new
+context for userspace is exposing a race where we can suddely return
+to a syscall with the protection id and space id out of sync, trapping
+on the next userspace access.
+
+Debugged-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-parisc/tlbflush.h |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/asm-parisc/tlbflush.h
++++ b/include/asm-parisc/tlbflush.h
+@@ -44,9 +44,12 @@ static inline void flush_tlb_mm(struct m
+ {
+       BUG_ON(mm == &init_mm); /* Should never happen */
+-#ifdef CONFIG_SMP
++#if 1 || defined(CONFIG_SMP)
+       flush_tlb_all();
+ #else
++      /* FIXME: currently broken, causing space id and protection ids
++       *  to go out of sync, resulting in faults on userspace accesses.
++       */
+       if (mm) {
+               if (mm->context != 0)
+                       free_sid(mm->context);
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:23:59 2009
+Message-Id: <20090113012359.750452954@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarek Poplawski <jarkao2@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [patch 17/21] drivers/net: starfire: Fix napi ->poll() weight handling
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=drivers-net-starfire-fix-napi-poll-weight-handling.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+commit 9a3de25544dadab1971847f28f33b1cd0d1770a6 upstream.
+
+starfire napi ->poll() handler can return work == weight after calling
+netif_rx_complete() (if there is no more work). It is illegal and this
+patch fixes it.
+
+Reported-by: Alexander Huemer <alexander.huemer@sbg.ac.at>
+Tested-by: Alexander Huemer <alexander.huemer@sbg.ac.at>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/starfire.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/starfire.c
++++ b/drivers/net/starfire.c
+@@ -1509,6 +1509,11 @@ static int __netdev_rx(struct net_device
+               desc->status = 0;
+               np->rx_done = (np->rx_done + 1) % DONE_Q_SIZE;
+       }
++
++      if (*quota == 0) {      /* out of rx quota */
++              retcode = 1;
++              goto out;
++      }
+       writew(np->rx_done, np->base + CompletionQConsumerIdx);
+  out:
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.024156235@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 18/21] AMD IOMMU: reset command buffer pointers manually
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-reset-command-buffer-pointers-manually.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4
+
+Under special circumstances the IOMMU does not reset the head and tail
+pointer of its command ringbuffer to zero when the command base is
+written. This causes the IOMMU to fetch random memory and executes it as
+an command. Since these commands are likely illegal IOMMU stops fetching
+further commands including IOTLB flushes. This leads to completion wait
+errors at boot and in some cases to data corruption and kernel crashes.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -407,6 +407,10 @@ static u8 * __init alloc_command_buffer(
+       memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+                       &entry, sizeof(entry));
++      /* set head and tail to zero manually */
++      writel(0x00, iommu->mmio_base + MMIO_CMD_HEAD_OFFSET);
++      writel(0x00, iommu->mmio_base + MMIO_CMD_TAIL_OFFSET);
++
+       iommu_feature_enable(iommu, CONTROL_CMDBUF_EN);
+       return cmd_buf;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.203177740@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 19/21] AMD IOMMU: allocate rlookup_table with __GFP_ZERO
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-allocate-rlookup_table-with-__gfp_zero.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b
+
+This is pointer list and if we dereference an uninitialized pointer
+later this results in a kernel crash at boot. Happens typically after
+3-5 hours of rebooting.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -930,7 +930,8 @@ int __init amd_iommu_init(void)
+               goto free;
+       /* IOMMU rlookup table - find the IOMMU for a specific device */
+-      amd_iommu_rlookup_table = (void *)__get_free_pages(GFP_KERNEL,
++      amd_iommu_rlookup_table = (void *)__get_free_pages(
++                      GFP_KERNEL | __GFP_ZERO,
+                       get_order(rlookup_table_size));
+       if (amd_iommu_rlookup_table == NULL)
+               goto free;
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.481325160@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 20/21] AMD IOMMU: initialize phys_addr correctly in iommu_page_map
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-initialize-phys_addr-correctly-in-iommu_page_map.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit bb9d4ff80bc032d7961815c2ff5eaf458ae3adff
+
+Due to this bug mappings for devices requested by the ACPI table are
+incorrect.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -235,7 +235,7 @@ static int iommu_map(struct protection_d
+       u64 __pte, *pte, *page;
+       bus_addr  = PAGE_ALIGN(bus_addr);
+-      phys_addr = PAGE_ALIGN(bus_addr);
++      phys_addr = PAGE_ALIGN(phys_addr);
+       /* only support 512GB address spaces for now */
+       if (bus_addr > IOMMU_MAP_SIZE_L3 || !(prot & IOMMU_PROT_MASK))
+
+
+From gregkh@mini.kroah.org Mon Jan 12 17:24:00 2009
+Message-Id: <20090113012400.629752200@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Mon, 12 Jan 2009 17:20:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [patch 21/21] AMD IOMMU: fix wrong loop counter in free_pagetables
+References: <20090113012006.063755472@mini.kroah.org>
+Content-Disposition: inline; filename=amd-iommu-fix-wrong-loop-counter-in-free_pagetables.patch
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+Upstream commit 3cc3d84bffbd93bdb671ac7961b12cd98fbb9266
+
+This fixes a bug which causes the driver to go in an endless loop if
+initialization fails and its resources are freed.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -487,7 +487,7 @@ static void dma_ops_free_pagetable(struc
+                       continue;
+               p2 = IOMMU_PTE_PAGE(p1[i]);
+-              for (j = 0; j < 512; ++i) {
++              for (j = 0; j < 512; ++j) {
+                       if (!IOMMU_PTE_PRESENT(p2[j]))
+                               continue;
+                       p3 = IOMMU_PTE_PAGE(p2[j]);
+
+
similarity index 100%
rename from queue-2.6.27/series
rename to review-2.6.27/series