--- /dev/null
+From 18776c7316545482a02bfaa2629a2aa1afc48357 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 13 Nov 2008 23:38:52 +0000
+Subject: dm raid1: flush workqueue before destruction
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 18776c7316545482a02bfaa2629a2aa1afc48357 upstream.
+
+We queue work on keventd queue --- so this queue must be flushed in the
+destructor. Otherwise, keventd could access mirror_set after it was freed.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-raid1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -1598,6 +1598,7 @@ static void mirror_dtr(struct dm_target
+
+ del_timer_sync(&ms->timer);
+ flush_workqueue(ms->kmirrord_wq);
++ flush_scheduled_work();
+ dm_kcopyd_client_destroy(ms->kcopyd_client);
+ destroy_workqueue(ms->kmirrord_wq);
+ free_context(ms, ti, ms->nr_mirrors);
--- /dev/null
+From 27123cbc264de89ce6951b1b4c84c223eb0f1702 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Fri, 14 Nov 2008 08:10:19 +0100
+Subject: m68k: Fix off-by-one in m68k_setup_user_interrupt()
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 27123cbc264de89ce6951b1b4c84c223eb0f1702 upstream.
+
+commit 69961c375288bdab7604e0bb1c8d22999bb8a347 ("[PATCH] m68k/Atari:
+Interrupt updates") added a BUG_ON() with an incorrect upper bound
+comparison, which causes an early crash on VME boards, where IRQ_USER is
+8, cnt is 192 and NR_IRQS is 200.
+
+Reported-by: Stephen N Chivers <schivers@csc.com.au>
+Tested-by: Kars de Jong <jongk@linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/m68k/kernel/ints.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/m68k/kernel/ints.c
++++ b/arch/m68k/kernel/ints.c
+@@ -133,7 +133,7 @@ void __init m68k_setup_user_interrupt(un
+ {
+ int i;
+
+- BUG_ON(IRQ_USER + cnt >= NR_IRQS);
++ BUG_ON(IRQ_USER + cnt > NR_IRQS);
+ m68k_first_user_vec = vec;
+ for (i = 0; i < cnt; i++)
+ irq_controller[IRQ_USER + i] = &user_irq_controller;
--- /dev/null
+From df81d2371aeca0f7474f197a3090830899016e39 Mon Sep 17 00:00:00 2001
+From: Miquel van Smoorenburg <mikevs@xs4all.net>
+Date: Wed, 5 Nov 2008 00:09:12 +0100
+Subject: SCSI: dpt_i2o: fix transferred data length for scsi_set_resid()
+
+From: Miquel van Smoorenburg <mikevs@xs4all.net>
+
+commit df81d2371aeca0f7474f197a3090830899016e39 upstream.
+
+dpt_i2o.c::adpt_i2o_to_scsi() reads the value at (reply+5) which
+should contain the length in bytes of the transferred data. This
+would be correct if reply was a u32 *. However it is a void * here,
+so we need to read the value at (reply+20) instead.
+
+The value at (reply+5) is usually 0xff0000, which is apparently
+'large enough' and didn't cause any trouble until 2.6.27 where
+
+commit 427e59f09fdba387547106de7bab980b7fff77be
+Author: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Sat Mar 8 18:24:17 2008 -0600
+
+ [SCSI] make use of the residue value
+
+caused this to become visible through e.g. iostat -x .
+
+Signed-off-by: Miquel van Smoorenburg <mikevs@xs4all.net>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/dpt_i2o.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -2445,7 +2445,7 @@ static s32 adpt_i2o_to_scsi(void __iomem
+ hba_status = detailed_status >> 8;
+
+ // calculate resid for sg
+- scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+5));
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+20));
+
+ pHba = (adpt_hba*) cmd->device->host->hostdata[0];
+
+@@ -2456,7 +2456,7 @@ static s32 adpt_i2o_to_scsi(void __iomem
+ case I2O_SCSI_DSC_SUCCESS:
+ cmd->result = (DID_OK << 16);
+ // handle underflow
+- if(readl(reply+5) < cmd->underflow ) {
++ if (readl(reply+20) < cmd->underflow) {
+ cmd->result = (DID_ERROR <<16);
+ printk(KERN_WARNING"%s: SCSI CMD underflow\n",pHba->name);
+ }
--- /dev/null
+From 821b3996001508e872582dcafc7575021f122728 Mon Sep 17 00:00:00 2001
+From: Lalit Chandivade <lalit.chandivade@qlogic.com>
+Date: Fri, 24 Oct 2008 15:13:44 -0700
+Subject: SCSI: qla2xxx: Correct Atmel flash-part handling.
+
+From: Lalit Chandivade <lalit.chandivade@qlogic.com>
+
+commit 821b3996001508e872582dcafc7575021f122728 upstream.
+
+Use correct block size (4K) for erase command 0x20 for Atmel
+Flash. Use dword addresses for determining sector boundary.
+
+Signed-off-by: Lalit Chandivade <lalit.chandivade@qlogic.com>
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_sup.c | 19 +++++++------------
+ 2 files changed, 7 insertions(+), 13 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2546,7 +2546,6 @@ typedef struct scsi_qla_host {
+ uint8_t fcode_revision[16];
+ uint32_t fw_revision[4];
+
+- uint16_t fdt_odd_index;
+ uint32_t fdt_wrt_disable;
+ uint32_t fdt_erase_cmd;
+ uint32_t fdt_block_size;
+--- a/drivers/scsi/qla2xxx/qla_sup.c
++++ b/drivers/scsi/qla2xxx/qla_sup.c
+@@ -546,6 +546,7 @@ qla24xx_get_flash_manufacturer(scsi_qla_
+ void
+ qla2xxx_get_flash_info(scsi_qla_host_t *ha)
+ {
++#define FLASH_BLK_SIZE_4K 0x1000
+ #define FLASH_BLK_SIZE_32K 0x8000
+ #define FLASH_BLK_SIZE_64K 0x10000
+ uint16_t cnt, chksum;
+@@ -577,7 +578,6 @@ qla2xxx_get_flash_info(scsi_qla_host_t *
+ goto no_flash_data;
+ }
+
+- ha->fdt_odd_index = le16_to_cpu(fdt->man_id) == 0x1f;
+ ha->fdt_wrt_disable = fdt->wrt_disable_bits;
+ ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0300 | fdt->erase_cmd);
+ ha->fdt_block_size = le32_to_cpu(fdt->block_size);
+@@ -590,10 +590,10 @@ qla2xxx_get_flash_info(scsi_qla_host_t *
+ }
+
+ DEBUG2(qla_printk(KERN_DEBUG, ha, "Flash[FDT]: (0x%x/0x%x) erase=0x%x "
+- "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n",
++ "pro=%x upro=%x wrtd=0x%x blk=0x%x.\n",
+ le16_to_cpu(fdt->man_id), le16_to_cpu(fdt->id), ha->fdt_erase_cmd,
+ ha->fdt_protect_sec_cmd, ha->fdt_unprotect_sec_cmd,
+- ha->fdt_odd_index, ha->fdt_wrt_disable, ha->fdt_block_size));
++ ha->fdt_wrt_disable, ha->fdt_block_size));
+ return;
+
+ no_flash_data:
+@@ -614,8 +614,7 @@ no_flash_data:
+ ha->fdt_block_size = FLASH_BLK_SIZE_64K;
+ break;
+ case 0x1f: /* Atmel 26DF081A. */
+- ha->fdt_odd_index = 1;
+- ha->fdt_block_size = FLASH_BLK_SIZE_64K;
++ ha->fdt_block_size = FLASH_BLK_SIZE_4K;
+ ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0320);
+ ha->fdt_unprotect_sec_cmd = flash_conf_to_access_addr(0x0339);
+ ha->fdt_protect_sec_cmd = flash_conf_to_access_addr(0x0336);
+@@ -710,13 +709,9 @@ qla24xx_write_flash_data(scsi_qla_host_t
+ qla24xx_unprotect_flash(ha);
+
+ for (liter = 0; liter < dwords; liter++, faddr++, dwptr++) {
+- if (ha->fdt_odd_index) {
+- findex = faddr << 2;
+- fdata = findex & sec_mask;
+- } else {
+- findex = faddr;
+- fdata = (findex & sec_mask) << 2;
+- }
++
++ findex = faddr;
++ fdata = (findex & sec_mask) << 2;
+
+ /* Are we at the beginning of a sector? */
+ if ((findex & rest_addr) == 0) {
--- /dev/null
+From 680d7db88ace53c673e1c437c9b6abcc053e8d6f Mon Sep 17 00:00:00 2001
+From: Shyam Sundar <shyam.sundar@qlogic.com>
+Date: Fri, 24 Oct 2008 15:13:46 -0700
+Subject: SCSI: qla2xxx: Do not honour max_vports from firmware for 2G ISPs and below.
+
+From: Shyam Sundar <shyam.sundar@qlogic.com>
+
+commit 680d7db88ace53c673e1c437c9b6abcc053e8d6f upstream.
+
+For 23XX ISPs, max_vports may return an invalid value.
+Do not honour it.
+
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -974,7 +974,6 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
+ &ha->fw_minor_version,
+ &ha->fw_subminor_version,
+ &ha->fw_attributes, &ha->fw_memory_size);
+- qla2x00_resize_request_q(ha);
+ ha->flags.npiv_supported = 0;
+ if ((IS_QLA24XX(ha) || IS_QLA25XX(ha) ||
+ IS_QLA84XX(ha)) &&
+@@ -986,6 +985,7 @@ qla2x00_setup_chip(scsi_qla_host_t *ha)
+ ha->max_npiv_vports =
+ MIN_MULTI_ID_FABRIC - 1;
+ }
++ qla2x00_resize_request_q(ha);
+
+ if (ql2xallocfwdump)
+ qla2x00_alloc_fw_dump(ha);
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -1964,7 +1964,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_
+ *cur_iocb_cnt = mcp->mb[7];
+ if (orig_iocb_cnt)
+ *orig_iocb_cnt = mcp->mb[10];
+- if (max_npiv_vports)
++ if (ha->flags.npiv_supported && max_npiv_vports)
+ *max_npiv_vports = mcp->mb[11];
+ }
+
--- /dev/null
+From 5bff55db3dc4d659f46b4d2fce2f61c1964c2762 Mon Sep 17 00:00:00 2001
+From: Michael Reed <mdr@sgi.com>
+Date: Fri, 24 Oct 2008 15:13:47 -0700
+Subject: SCSI: qla2xxx: Return a FAILED status when abort mailbox-command fails.
+
+From: Michael Reed <mdr@sgi.com>
+
+commit 5bff55db3dc4d659f46b4d2fce2f61c1964c2762 upstream.
+
+Mike Reed noted
+(https://bugzilla.novell.com/show_bug.cgi?id=421330) that the
+driver was incorrectly returning a SUCCESS status if the driver's
+request to the firmware to abort a command failed. By doing so,
+the mid-layer believed, incorrectly, that the command has
+completed and has been returned (ultimately clearing
+scsi_cmnd.request_buffer) yet the driver still has the command.
+What should correctly happen is a mid-layer escalation
+(device-reset, etc.) of recovery during which the driver will
+eventually return the outstanding commands to the mid-layer.
+
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -730,6 +730,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
+ if (ha->isp_ops->abort_command(ha, sp)) {
+ DEBUG2(printk("%s(%ld): abort_command "
+ "mbx failed.\n", __func__, ha->host_no));
++ ret = FAILED;
+ } else {
+ DEBUG3(printk("%s(%ld): abort_command "
+ "mbx success.\n", __func__, ha->host_no));
v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch
s390-cpu-topology-fix-locking.patch
acpi-load-device-driver-according-to-the-status-of-acpi-device.patch
+m68k-fix-off-by-one-in-m68k_setup_user_interrupt.patch
+scsi-qla2xxx-return-a-failed-status-when-abort-mailbox-command-fails.patch
+scsi-qla2xxx-do-not-honour-max_vports-from-firmware-for-2g-isps-and-below.patch
+scsi-qla2xxx-correct-atmel-flash-part-handling.patch
+scsi-dpt_i2o-fix-transferred-data-length-for-scsi_set_resid.patch
+dm-raid1-flush-workqueue-before-destruction.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
