linux-toradex.git/arch, branch v2.6.27.11 Linux kernel for Apalis and Colibri modules AMD IOMMU: fix wrong loop counter in free_pagetables 2009-01-14T17:44:09+00:00 Joerg Roedel joerg.roedel@amd.com 2008-12-19T13:42:15+00:00 938d1732649548da9887c7159a1d4f95d9e11995 Upstream commit 3cc3d84bffbd93bdb671ac7961b12cd98fbb9266 This fixes a bug which causes the driver to go in an endless loop if initialization fails and its resources are freed. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
Upstream commit 3cc3d84bffbd93bdb671ac7961b12cd98fbb9266

This fixes a bug which causes the driver to go in an endless loop if
initialization fails and its resources are freed.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
AMD IOMMU: initialize phys_addr correctly in iommu_page_map 2009-01-14T17:44:08+00:00 Joerg Roedel joerg.roedel@amd.com 2008-12-19T13:42:14+00:00 4d624f54bd2bb311501c33ac0e17aec45ea91d2c Upstream commit bb9d4ff80bc032d7961815c2ff5eaf458ae3adff Due to this bug mappings for devices requested by the ACPI table are incorrect. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
Upstream commit bb9d4ff80bc032d7961815c2ff5eaf458ae3adff

Due to this bug mappings for devices requested by the ACPI table are
incorrect.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
AMD IOMMU: allocate rlookup_table with __GFP_ZERO 2009-01-14T17:44:08+00:00 Joerg Roedel joerg.roedel@amd.com 2008-12-19T13:42:13+00:00 171075a35117b9eeacc3251816fda5572486c6cf Upstream commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b This is pointer list and if we dereference an uninitialized pointer later this results in a kernel crash at boot. Happens typically after 3-5 hours of rebooting. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
Upstream commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b

This is pointer list and if we dereference an uninitialized pointer
later this results in a kernel crash at boot. Happens typically after
3-5 hours of rebooting.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
AMD IOMMU: reset command buffer pointers manually 2009-01-14T17:44:07+00:00 Joerg Roedel joerg.roedel@amd.com 2008-12-19T13:42:12+00:00 8fb9f8d889b104a9acebaff83b637bcc56706576 Upstream commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4 Under special circumstances the IOMMU does not reset the head and tail pointer of its command ringbuffer to zero when the command base is written. This causes the IOMMU to fetch random memory and executes it as an command. Since these commands are likely illegal IOMMU stops fetching further commands including IOTLB flushes. This leads to completion wait errors at boot and in some cases to data corruption and kernel crashes. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
Upstream commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4

Under special circumstances the IOMMU does not reset the head and tail
pointer of its command ringbuffer to zero when the command base is
written. This causes the IOMMU to fetch random memory and executes it as
an command. Since these commands are likely illegal IOMMU stops fetching
further commands including IOTLB flushes. This leads to completion wait
errors at boot and in some cases to data corruption and kernel crashes.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
powerpc: Fix corruption error in rh_alloc_fixed() 2009-01-14T17:44:01+00:00 Guillaume Knispel gknispel@proformatique.com 2008-12-09T14:28:34+00:00 89b2d02846a92d7fbf0c4717a037793d166f6dd7 commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream. There is an error in rh_alloc_fixed() of the Remote Heap code: If there is at least one free block blk won't be NULL at the end of the search loop, so -ENOMEM won't be returned and the else branch of "if (bs == s || be == e)" will be taken, corrupting the management structures. Signed-off-by: Guillaume Knispel <gknispel@proformatique.com> Acked-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit af4d3643864ee5fcba0c97d77a424fa0b0346f8e upstream.

There is an error in rh_alloc_fixed() of the Remote Heap code:
If there is at least one free block blk won't be NULL at the end of the
search loop, so -ENOMEM won't be returned and the else branch of
"if (bs == s || be == e)" will be taken, corrupting the management
structures.

Signed-off-by: Guillaume Knispel <gknispel@proformatique.com>
Acked-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
x86 Fix VMI crash on boot in 2.6.28-rc8 2008-12-18T17:13:36+00:00 Zachary Amsden zach@vmware.com 2008-12-13T20:36:58+00:00 feb374144807f9d83d48930c3bae32005441230f commit ae8d04e2ecbb233926860e9ce145eac19c7835dc upstream. VMI initialiation can relocate the fixmap, causing early_ioremap to malfunction if it is initialized before the relocation. To fix this, VMI activation is split into two phases; the detection, which must happen before setting up ioremap, and the activation, which must happen after parsing early boot parameters. This fixes a crash on boot when VMI is enabled under VMware. Signed-off-by: Zachary Amsden <zach@vmware.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit ae8d04e2ecbb233926860e9ce145eac19c7835dc upstream.

VMI initialiation can relocate the fixmap, causing early_ioremap to
malfunction if it is initialized before the relocation.  To fix this,
VMI activation is split into two phases; the detection, which must
happen before setting up ioremap, and the activation, which must happen
after parsing early boot parameters.

This fixes a crash on boot when VMI is enabled under VMware.

Signed-off-by: Zachary Amsden <zach@vmware.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
AMD IOMMU: enable device isolation per default 2008-12-18T17:13:34+00:00 Joerg Roedel joerg.roedel@amd.com 2008-11-17T14:09:20+00:00 771b8e4021178328d9c431d0b3ee7a5246fad856 commit 3ce1f93c6d53c3f91c3846cf66b018276c8ac2e7 upstream. Impact: makes device isolation the default for AMD IOMMU Some device drivers showed double-free bugs of DMA memory while testing them with AMD IOMMU. If all devices share the same protection domain this can lead to data corruption and data loss. Prevent this by putting each device into its own protection domain per default. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 3ce1f93c6d53c3f91c3846cf66b018276c8ac2e7 upstream.

Impact: makes device isolation the default for AMD IOMMU

Some device drivers showed double-free bugs of DMA memory while testing
them with AMD IOMMU. If all devices share the same protection domain
this can lead to data corruption and data loss. Prevent this by putting
each device into its own protection domain per default.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
powerpc: Use cpu_thread_in_core in smp_init for of_spin_map 2008-12-13T23:29:35+00:00 Milton Miller miltonm@bga.com 2008-10-20T15:37:03+00:00 ec9ea180923639380683ebb52d135bc01959f2b1 commit 6a75a6b8e85e92cc774d42a4e113c76c30b5a539 upstream. We used to assume that even numbered threads were the primary threads, ie those that would be listed and started as a cpu from open firmware. Replace a left over is even (% 2) check with a check for it being a primary thread and update the comments. Tested with a debug print on pseries, identical code found for cell. Signed-off-by: Milton Miller <miltonm@bga.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 6a75a6b8e85e92cc774d42a4e113c76c30b5a539 upstream.

We used to assume that even numbered threads were the primary
threads, ie those that would be listed and started as a cpu from
open firmware.  Replace a left over is even (% 2) check with a check
for it being a primary thread and update the comments.

Tested with a debug print on pseries, identical code found for cell.

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
powerpc/virtex5: Fix Virtex5 machine check handling 2008-12-13T23:29:34+00:00 Grant Likely grant.likely@secretlab.ca 2008-12-04T05:39:55+00:00 1d3bac578875da221abaabc7beba5f1d4f316acb commit 640d17d60e83401e10e66a0ab6e9e2d6350df656 upstream. The 440x5 core in the Virtex5 uses the 440A type machine check (ie, they have MCSRR0/MCSRR1). They thus need to call the appropriate fixup function to hook the right variant of the exception. Without this, all machine checks become fatal due to loss of context when entering the exception handler. Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 640d17d60e83401e10e66a0ab6e9e2d6350df656 upstream.

The 440x5 core in the Virtex5 uses the 440A type machine check
(ie, they have MCSRR0/MCSRR1). They thus need to call the
appropriate fixup function to hook the right variant of the
exception.

Without this, all machine checks become fatal due to loss
of context when entering the exception handler.

Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
uml: boot broken due to buffer overrun 2008-12-13T23:29:33+00:00 Balbir Singh balbir@linux.vnet.ibm.com 2008-12-09T21:14:07+00:00 cb01c9ddcbb5a1c8049bacf1f145b402f0ce3a0a commit 361371201b60ffd686a694c848c1d5ad6061725f upstream. mconsole_init() passed 256 bytes as length in os_create_unix_socket, while the sizeof UNIX_PATH_MAX is 108. This patch fixes that problem and avoids a big overrun bug reported on UML bootup. sockaddr_un.sun_path is UNIX_PATH_MAX long which causes the problem. Reported-by: Vikas K Managutte <vikki.km@gmail.com> Reported-by: Sarvesh Kumar Lal Das <skldas@gmail.com> Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com> Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi> Reviewed-by: WANG Cong <wangcong@zeuux.org> Cc: Jeff Dike <jdike@addtoit.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 361371201b60ffd686a694c848c1d5ad6061725f upstream.

mconsole_init() passed 256 bytes as length in os_create_unix_socket, while
the sizeof UNIX_PATH_MAX is 108. This patch fixes that problem and avoids
a big overrun bug reported on UML bootup.

sockaddr_un.sun_path is UNIX_PATH_MAX long which causes the problem.
Reported-by: Vikas K Managutte <vikki.km@gmail.com>
Reported-by: Sarvesh Kumar Lal Das <skldas@gmail.com>
Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
Reviewed-by: WANG Cong <wangcong@zeuux.org>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>