commit 82bd2e971090261c9535934d1c7110321ef9d226 Author: Greg Kroah-Hartman Date: Wed Jan 14 09:44:21 2009 -0800 Linux 2.6.27.11 commit 938d1732649548da9887c7159a1d4f95d9e11995 Author: Joerg Roedel Date: Fri Dec 19 14:42:15 2008 +0100 AMD IOMMU: fix wrong loop counter in free_pagetables Upstream commit 3cc3d84bffbd93bdb671ac7961b12cd98fbb9266 This fixes a bug which causes the driver to go in an endless loop if initialization fails and its resources are freed. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 4d624f54bd2bb311501c33ac0e17aec45ea91d2c Author: Joerg Roedel Date: Fri Dec 19 14:42:14 2008 +0100 AMD IOMMU: initialize phys_addr correctly in iommu_page_map Upstream commit bb9d4ff80bc032d7961815c2ff5eaf458ae3adff Due to this bug mappings for devices requested by the ACPI table are incorrect. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 171075a35117b9eeacc3251816fda5572486c6cf Author: Joerg Roedel Date: Fri Dec 19 14:42:13 2008 +0100 AMD IOMMU: allocate rlookup_table with __GFP_ZERO Upstream commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b This is pointer list and if we dereference an uninitialized pointer later this results in a kernel crash at boot. Happens typically after 3-5 hours of rebooting. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 8fb9f8d889b104a9acebaff83b637bcc56706576 Author: Joerg Roedel Date: Fri Dec 19 14:42:12 2008 +0100 AMD IOMMU: reset command buffer pointers manually Upstream commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4 Under special circumstances the IOMMU does not reset the head and tail pointer of its command ringbuffer to zero when the command base is written. This causes the IOMMU to fetch random memory and executes it as an command. Since these commands are likely illegal IOMMU stops fetching further commands including IOTLB flushes. This leads to completion wait errors at boot and in some cases to data corruption and kernel crashes. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 9d8ce36fb8cd27442e1b700f3068908a63de2fff Author: Jarek Poplawski Date: Tue Dec 16 15:42:20 2008 -0800 drivers/net: starfire: Fix napi ->poll() weight handling commit 9a3de25544dadab1971847f28f33b1cd0d1770a6 upstream. starfire napi ->poll() handler can return work == weight after calling netif_rx_complete() (if there is no more work). It is illegal and this patch fixes it. Reported-by: Alexander Huemer Tested-by: Alexander Huemer Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 398604a3a6b864d7a09c67772a7d44cf88ce24a0 Author: Kyle McMartin Date: Tue Dec 23 08:44:30 2008 -0500 parisc: disable UP-optimized flush_tlb_mm commit 5289f46b9de04bde181d833d48df9671b69c4b08 upstream. flush_tlb_mm's "optimized" uniprocessor case of allocating a new context for userspace is exposing a race where we can suddely return to a syscall with the protection id and space id out of sync, trapping on the next userspace access. Debugged-by: James Bottomley Tested-by: Helge Deller Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 94ee84a2496c44f7353ef5fc2f5b265716c82df1 Author: Herton Ronaldo Krzesinski Date: Tue Dec 23 16:53:00 2008 -0200 ALSA: hda - Add missing terminators in patch_sigmatel.c commit 574f3c4f5c55e99ea60f71fd98cc54931d4b2eae upstream. Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e66ee18bccb2caeb2b41474631f8db29150b9a7c Author: Stephen M. Cameron Date: Thu Dec 18 14:55:11 2008 +0100 cciss: fix problem that deleting multiple logical drives could cause a panic commit d8a0be6ab7ba1ffa43e7ea0dcdde3e8b68d4f762 upstream. Fix problem that deleting multiple logical drives could cause a panic. It fixes a panic which can be easily reproduced in the following way: Just create several "arrays," each with multiple logical drives via hpacucli, then delete the first array, and it will blow up in deregister_disk(), in the call to get_host() when it tries to dig the hba pointer out of a NULL queue pointer. The problem has been present since my code to make rebuild_lun_table behave better went in. Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 7acf32cddc84fd1db656822a7beb722c754bd33c Author: Hillier, Gernot Date: Wed Sep 17 16:03:06 2008 +0200 SCSI: aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S commit b21227c5fcadab206e2a2373e5b288a351919abb upstream. A lot of 64bit machines with Adaptec 2200S and 2120S controllers don't recognize SCSI disks any more with the patch commit 94cf6ba11b068b8a8f68a1e88bffb6827e92124b Author: Salyzyn, Mark Date: Thu Dec 13 16:14:18 2007 -0800 [SCSI] aacraid: fix driver failure with Dell PowerEdge Expandable RAID Controller 3/Di but fail with tons of "aac_srb: aac_fib_send failed with status: 8195" instead. This patch disables the quirk introduced in the change cited above for those two controllers again. [thenzl: added 2120S Controller] Signed-off-by: Gernot Hillier Signed-off-by: Tomas Henzl Acked-by: Matt Domsch Cc: AACRAID list Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit af58ad34e8319acbd10d3404b61983ee4ae9e9bd Author: Brian King Date: Tue Dec 9 20:03:50 2008 +0900 SCSI: ibmvstgt: move crq_queue_create to the end of initialization commit 57458036af75c6dbb62bee04b3982e92261eddb1 upstream. Calling crq_queue_create could lead to the creation of a rport. We need to set up everything before creating a rport. This moves crq_queue_create to the end of initialization to avoid a race which causes an oops if lost. Signed-off-by: Brian King Signed-off-by: FUJITA Tomonori Reported-by: Olaf Hering Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 437ae2fcbfc1e2d8edea897a372d37f827cdcb41 Author: Stanley Miao Date: Fri Dec 19 22:08:22 2008 +0800 ALSA: Fix a Oops bug in omap soc driver. commit 19b3f31609dc8be3a56c78dcb7da723f10f7009c upstream. There will be a Oops or frequent underrun messages when playing music with omap soc driver, this is because a data region is incorretly sized, other data region will be overwriten when writing to this data region. Signed-off-by: Stanley Miao Acked-by: Jarkko Nikula Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 902439b20fdb34fcc0e077a9180d5ec25c80be96 Author: NeilBrown Date: Fri Dec 19 16:25:01 2008 +1100 md: Don't read past end of bitmap when reading bitmap. commit a2ed9615e3222645007fc19991aedf30eed3ecfd upstream. When we read the write-intent-bitmap off the device, we currently read a whole number of pages. When PAGE_SIZE is 4K, this works due to the alignment we enforce on the superblock and bitmap. When PAGE_SIZE is 64K, this case read past the end-of-device which causes an error. When we write the superblock, we ensure to clip the last page to just be the required size. Copy that code into the read path to just read the required number of sectors. Signed-off-by: Neil Brown Signed-off-by: Greg Kroah-Hartman commit 3eb62a1a8c1655cf88e44158938a28ef774fdc08 Author: Dan Williams Date: Wed Dec 3 17:16:55 2008 -0700 ioat: wait for self-test completion commit 532d3b1f86f41834a25373e3ded981d68e4ce17f upstream. As part of the ioat_dma self-test it performs a printk from a completion callback. Depending on the system console configuration this output can take longer than a millisecond causing the self-test to fail. Introduce a completion with a generous timeout to mitigate this failure. Acked-by: Maciej Sosnowski Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit ad4efe4fc5363e79bf6db87b012b73189806f4c7 Author: Dan Williams Date: Wed Dec 3 17:17:07 2008 -0700 dmaengine: protect 'id' from concurrent registrations commit b0b42b16ff2b90f17bc1a4308366c9beba4b276e upstream. There is a possibility to have two devices registered with the same id. Acked-by: Maciej Sosnowski Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit cf7af4a82fe408a8c9628480ac3dc272e087ce75 Author: Dan Williams Date: Mon Dec 8 13:46:00 2008 -0700 async_xor: dma_map destination DMA_BIDIRECTIONAL commit a06d568f7c5e40e34ea64881842deb8f4382babf upstream. Mapping the destination multiple times is a misuse of the dma-api. Since the destination may be reused as a source, ensure that it is only mapped once and that it is mapped bidirectionally. This appears to add ugliness on the unmap side in that it always reads back the destination address from the descriptor, but gcc can determine that dma_unmap is a nop and not emit the code that calculates its arguments. Cc: Saeed Bishara Acked-by: Yuri Tikhonov Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 65e8fedf5e9d81cce3505a4dfce77096eac89711 Author: Johannes Berg Date: Tue Sep 23 19:18:43 2008 +0200 iwlagn: downgrade BUG_ON in interrupt commit 55d6a3cd0cc85ed90c39cf32e16f622bd003117b upstream. This BUG_ON really shouldn't trigger, but if it does, as on my machine, it leaves you wondering what happened because you won't see it. Let's instead leak a bit of state and memory and at least make it possible to report it to the kerneloops project to track it. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Cc: François Valenduc Signed-off-by: Greg Kroah-Hartman commit 89b2d02846a92d7fbf0c4717a037793d166f6dd7 Author: Guillaume Knispel Date: Tue Dec 9 15:28:34 2008 +0100 powerpc: Fix corruption error in rh_alloc_fixed() commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream. There is an error in rh_alloc_fixed() of the Remote Heap code: If there is at least one free block blk won't be NULL at the end of the search loop, so -ENOMEM won't be returned and the else branch of "if (bs == s || be == e)" will be taken, corrupting the management structures. Signed-off-by: Guillaume Knispel Acked-by: Timur Tabi Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit 857b603afbf74abcfc1bcb784a57c25d49831aff Author: Ozan Sener Date: Mon Dec 8 19:15:45 2008 +0200 USB: Unusual devs patch for Nokia 3500c commit 48e1a540e1e9ea62a2b3088a69ecf934f3172b14 upstream. T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0421 ProdID=0060 Rev= 5.51 S: Manufacturer=Nokia S: Product=Nokia 3500c S: SerialNumber=357687010280751 C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms From: Ozan Sener Signed-off-by: Greg Kroah-Hartman commit a5b74b42dcdf3cc5c448b41e103f95353597637e Author: CSÉCSY László Date: Tue Dec 9 23:39:14 2008 +0100 USB: storage: unusual_devs.h: Nokia 3109c addition commit 1393fce7189427bdb4d6115ca5566ca8d0fc86f3 upstream. 2.6.26(.x, cannot remember) could handle the microSD card in my Nokia 3109c attached via USB as mass storage, 2.6.27(.x, up to and included 2.6.27.8) cannot. Please find the attached patch which fixes this regression, and a copy of /proc/bus/usb/devices with my phone plugged in running with this patch on Frugalware. T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0421 ProdID=0063 Rev= 6.01 S: Manufacturer=Nokia S: Product=Nokia 3109c S: SerialNumber=359561013742570 C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms From: CSÉCSY László Cc: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit fd83ffad9272ab4f8839db1aa42471cecdff4ad6 Author: Alan Stern Date: Mon Dec 1 10:23:43 2008 -0500 usb-storage: update unusual_devs entry for Nokia 5310 commit a4b188095912eee83d065f000dfe06f25919750b upstream. This patch (as1179) updates the unusual_devs entry for Nokia's 5310 phone to include a more recent firmware revision. This fixes Bugzilla #12099. Signed-off-by: Alan Stern Tested-by: Robson Roberto Souza Peixoto Signed-off-by: Greg Kroah-Hartman commit 45de143048a09879c15ded80bef4304d9d2e5b50 Author: David Brownell Date: Mon Nov 24 23:11:03 2008 -0800 USB: gadget: fix rndis working at high speed commit 7c12414955e9b44a3e33d54e578bf008caa4475d upstream. Fix a bug specific to highspeed mode in the recently updated RNDIS support: it wasn't setting up the high speed notification endpoint, which prevented high speed RNDIS links from working. Signed-off-by: David Brownell Tested-by: Anand Gadiyar Signed-off-by: Greg Kroah-Hartman