--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 2 19:45:56 2008
+From: Michael Buesch <mb@bu3sch.de>
+Date: Thu, 3 Jul 2008 02:45:47 GMT
+Subject: b43legacy: Fix possible NULL pointer dereference in DMA code
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807030245.m632jlDH007664@hera.kernel.org>
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 2f9ec47d0954f9d2e5a00209c2689cbc477a8c89 upstream
+
+This fixes a possible NULL pointer dereference in an error path of the
+DMA allocation error checking code. This is also necessary for a future
+DMA API change that is on its way into the mainline kernel that adds
+an additional dev parameter to dma_mapping_error().
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43legacy/dma.c
++++ b/drivers/net/wireless/b43legacy/dma.c
+@@ -876,6 +876,7 @@ struct b43legacy_dmaring *b43legacy_setu
+ if (!ring)
+ goto out;
+ ring->type = type;
++ ring->dev = dev;
+
+ nr_slots = B43legacy_RXRING_SLOTS;
+ if (for_tx)
+@@ -922,7 +923,6 @@ struct b43legacy_dmaring *b43legacy_setu
+ DMA_TO_DEVICE);
+ }
+
+- ring->dev = dev;
+ ring->nr_slots = nr_slots;
+ ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index);
+ ring->index = controller_index;
--- /dev/null
+From 292d73551d0aa19526c3417e791c529b49ebadf3 Mon Sep 17 00:00:00 2001
+From: maximilian attems <max@stro.at>
+Date: Fri, 4 Jul 2008 09:59:43 -0700
+Subject: hdaps: add support for various newer Lenovo thinkpads
+
+From: maximilian attems <max@stro.at>
+
+commit 292d73551d0aa19526c3417e791c529b49ebadf3 upstream
+
+Adds R61, T61p, X61s, X61, Z61m, Z61p models to whitelist.
+
+Fixes this:
+
+cullen@lenny:~$ sudo modprobe hdaps
+FATAL: Error inserting hdaps (/lib/modules/2.6.22-10-generic/kernel/drivers/hwmon/hdaps.ko): No such device
+
+[25192.888000] hdaps: supported laptop not found!
+[25192.888000] hdaps: driver init failed (ret=-19)!
+
+Originally based on an Ubuntu patch that got it wrong, the dmidecode
+output of the corresponding laptops shows LENOVO as the manufacturer.
+https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/133636
+
+tested on X61s:
+[ 184.893588] hdaps: inverting axis readings.
+[ 184.893588] hdaps: LENOVO ThinkPad X61s detected.
+[ 184.893588] input: hdaps as /class/input/input12
+[ 184.924326] hdaps: driver successfully loaded.
+
+Cc: Klaus S. Madsen <ubuntu@hjernemadsen.org>
+Cc: Chuck Short <zulcss@ubuntu.com>
+Cc: Jean Delvare <khali@linux-fr.org>
+Cc: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: maximilian attems <max@stro.at>
+Cc: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/hdaps.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hwmon/hdaps.c
++++ b/drivers/hwmon/hdaps.c
+@@ -515,16 +515,24 @@ static struct dmi_system_id __initdata h
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R50"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R51"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad R52"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61i"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad R61"),
+ HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T41p"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T41"),
+ HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T42p"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T42"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T43"),
+ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T60"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61p"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X40"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad X41"),
+ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X60"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61s"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad X61"),
+ HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad Z60m"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61m"),
++ HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad Z61p"),
+ { .ident = NULL }
+ };
+
--- /dev/null
+From 2d5c1be8870383622809c25935fff00d2630c7a5 Mon Sep 17 00:00:00 2001
+From: John Blackwood <john.blackwood@ccur.com>
+Date: Fri, 4 Jul 2008 10:00:05 -0700
+Subject: mm: switch node meminfo Active & Inactive pages to Kbytes
+
+From: John Blackwood <john.blackwood@ccur.com>
+
+commit 2d5c1be8870383622809c25935fff00d2630c7a5 upstream
+
+There is a bug in the output of /sys/devices/system/node/node[n]/meminfo
+where the Active and Inactive values are in pages instead of Kbytes.
+
+Looks like this occurred back in 2.6.20 when the code was changed
+over to use node_page_state().
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/node.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -70,8 +70,8 @@ static ssize_t node_read_meminfo(struct
+ nid, K(i.totalram),
+ nid, K(i.freeram),
+ nid, K(i.totalram - i.freeram),
+- nid, node_page_state(nid, NR_ACTIVE),
+- nid, node_page_state(nid, NR_INACTIVE),
++ nid, K(node_page_state(nid, NR_ACTIVE)),
++ nid, K(node_page_state(nid, NR_INACTIVE)),
+ #ifdef CONFIG_HIGHMEM
+ nid, K(i.totalhigh),
+ nid, K(i.freehigh),
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 2 19:45:50 2008
+From: Ingo Molnar <mingo@elte.hu>
+Date: Thu, 3 Jul 2008 02:45:40 GMT
+Subject: netdrvr: 3c59x: remove irqs_disabled warning from local_bh_enable
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807030245.m632jeUj007618@hera.kernel.org>
+
+From: Ingo Molnar <mingo@elte.hu>
+
+commit c5643cab7bf663ae049b11be43de8819683176dd upstream
+
+Original Author: Michael Buesch <mb@bu3sch.de>
+
+net, vortex: fix lockup
+
+Ingo Molnar reported:
+
+-tip testing found that Johannes Berg's "softirq: remove irqs_disabled
+warning from local_bh_enable" enhancement to lockdep triggers a new
+warning on an old testbox that uses 3c59x vortex and netlogging:
+
+----->
+ calling vortex_init+0x0/0xb0
+ PCI: Found IRQ 10 for device 0000:00:0b.0
+ PCI: Sharing IRQ 10 with 0000:00:0a.0
+ PCI: Sharing IRQ 10 with 0000:00:0b.1
+ 3c59x: Donald Becker and others.
+ 0000:00:0b.0: 3Com PCI 3c556 Laptop Tornado at e0800400.
+ PCI: Enabling bus mastering for device 0000:00:0b.0
+ initcall vortex_init+0x0/0xb0 returned 0 after 47 msecs
+..
+ calling init_netconsole+0x0/0x1b0
+ netconsole: local port 4444
+ netconsole: local IP 10.0.1.9
+ netconsole: interface eth0
+ netconsole: remote port 4444
+ netconsole: remote IP 10.0.1.16
+ netconsole: remote ethernet address 00:19:xx:xx:xx:xx
+ netconsole: device eth0 not up yet, forcing it
+ eth0: setting half-duplex.
+ eth0: setting full-duplex.
+------------[ cut here ]------------
+ WARNING: at kernel/softirq.c:137 local_bh_enable_ip+0xd1/0xe0()
+ Pid: 1, comm: swapper Not tainted 2.6.26-rc6-tip #2091
+ [<c0125ecf>] warn_on_slowpath+0x4f/0x70
+ [<c0126834>] ? release_console_sem+0x1b4/0x1d0
+ [<c0126d00>] ? vprintk+0x2a0/0x450
+ [<c012fde5>] ? __mod_timer+0xa5/0xc0
+ [<c046f7fd>] ? mdio_sync+0x3d/0x50
+ [<c0160ef6>] ? marker_probe_cb+0x46/0xa0
+ [<c0126ed7>] ? printk+0x27/0x50
+ [<c046f4c3>] ? vortex_set_duplex+0x43/0xc0
+ [<c046f521>] ? vortex_set_duplex+0xa1/0xc0
+ [<c0471b92>] ? vortex_timer+0xe2/0x3e0
+ [<c012b361>] local_bh_enable_ip+0xd1/0xe0
+ [<c08d9f9f>] _spin_unlock_bh+0x2f/0x40
+ [<c0471b92>] vortex_timer+0xe2/0x3e0
+ [<c014743b>] ? trace_hardirqs_on+0xb/0x10
+ [<c0147358>] ? trace_hardirqs_on_caller+0x88/0x160
+ [<c012f8b2>] run_timer_softirq+0x162/0x1c0
+ [<c0471ab0>] ? vortex_timer+0x0/0x3e0
+ [<c012b361>] local_bh_enable_ip+0xd1/0xe0
+ [<c08d9f9f>] _spin_unlock_bh+0x2f/0x40
+ [<c0471b92>] vortex_timer+0xe2/0x3e0
+ [<c014743b>] ? trace_hardirqs_on+0xb/0x10
+ [<c0147358>] ? trace_hardirqs_on_caller+0x88/0x160
+ [<c012f8b2>] run_timer_softirq+0x162/0x1c0
+ [<c0471ab0>] ? vortex_timer+0x0/0x3e0
+ [<c0471ab0>] ? vortex_timer+0x0/0x3e0
+ [<c012b60a>] __do_softirq+0x9a/0x160
+ [<c012b570>] ? __do_softirq+0x0/0x160
+ [<c0106775>] call_on_stack+0x15/0x30
+ [<c012b4f5>] ? irq_exit+0x55/0x60
+ [<c0106e85>] ? do_IRQ+0x85/0xd0
+ [<c0147391>] ? trace_hardirqs_on_caller+0xc1/0x160
+ [<c0104888>] ? common_interrupt+0x28/0x30
+ [<c08d8ac8>] ? mutex_unlock+0x8/0x10
+ [<c08d8180>] ? _cond_resched+0x10/0x30
+ [<c07a3be7>] ? netpoll_setup+0x117/0x390
+ [<c0cbfcfe>] ? init_netconsole+0x14e/0x1b0
+ [<c013d539>] ? ktime_get+0x19/0x40
+ [<c0c9bab2>] ? kernel_init+0x1b2/0x2c0
+ [<c0cbfbb0>] ? init_netconsole+0x0/0x1b0
+ [<c0396aa4>] ? trace_hardirqs_on_thunk+0xc/0x10
+ [<c0103f12>] ? restore_nocheck_notrace+0x0/0xe
+ [<c0c9b900>] ? kernel_init+0x0/0x2c0
+ [<c0c9b900>] ? kernel_init+0x0/0x2c0
+ [<c0104aa7>] ? kernel_thread_helper+0x7/0x10
+ =======================
+---[ end trace 37f9c502aff112e0 ]---
+ console [netcon0] enabled
+ netconsole: network logging started
+ initcall init_netconsole+0x0/0x1b0 returned 0 after 2914 msecs
+
+looking at the driver I think the bug is real and the fix actually
+is trivial.
+
+vp->lock is also taken in hardware IRQ context, so we _have_ to always
+use irqsafe locking. As we run in a timer with IRQs disabled,
+we can simply use spin_lock.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/3c59x.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/3c59x.c
++++ b/drivers/net/3c59x.c
+@@ -1769,9 +1769,10 @@ vortex_timer(unsigned long data)
+ case XCVR_MII: case XCVR_NWAY:
+ {
+ ok = 1;
+- spin_lock_bh(&vp->lock);
++ /* Interrupts are already disabled */
++ spin_lock(&vp->lock);
+ vortex_check_media(dev, 0);
+- spin_unlock_bh(&vp->lock);
++ spin_unlock(&vp->lock);
+ }
+ break;
+ default: /* Other media types handled by Tx timeouts. */
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 4 00:23:45 2008
+From: Ben Dooks <ben-linux@fluff.org>
+Date: Fri, 4 Jul 2008 05:20:29 GMT
+Subject: OHCI: Fix problem if SM501 and another platform driver is selected
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807040520.m645KTqw005039@hera.kernel.org>
+
+From: Ben Dooks <ben-linux@fluff.org>
+
+commit 3ee38d8bf46b364b1ca364ddb7c379a4afcd8bbb upstream
+
+If the SM501 and another platform driver, such as the SM501
+then we end up defining PLATFORM_DRIVER twice. This patch
+seperated the SM501 onto a seperate define of SM501_OHCI_DRIVER
+so that it can be selected without overwriting the original
+definition.
+
+Signed-off-by: Ben Dooks <ben-linux@fluff.org>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ohci-hcd.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -1054,7 +1054,7 @@ MODULE_LICENSE ("GPL");
+
+ #ifdef CONFIG_MFD_SM501
+ #include "ohci-sm501.c"
+-#define PLATFORM_DRIVER ohci_hcd_sm501_driver
++#define SM501_OHCI_DRIVER ohci_hcd_sm501_driver
+ #endif
+
+ #if !defined(PCI_DRIVER) && \
+@@ -1062,6 +1062,7 @@ MODULE_LICENSE ("GPL");
+ !defined(OF_PLATFORM_DRIVER) && \
+ !defined(SA1111_DRIVER) && \
+ !defined(PS3_SYSTEM_BUS_DRIVER) && \
++ !defined(SM501_OHCI_DRIVER) && \
+ !defined(SSB_OHCI_DRIVER)
+ #error "missing bus glue for ohci-hcd"
+ #endif
+@@ -1121,9 +1122,18 @@ static int __init ohci_hcd_mod_init(void
+ goto error_ssb;
+ #endif
+
++#ifdef SM501_OHCI_DRIVER
++ retval = platform_driver_register(&SM501_OHCI_DRIVER);
++ if (retval < 0)
++ goto error_sm501;
++#endif
++
+ return retval;
+
+ /* Error path */
++#ifdef SM501_OHCI_DRIVER
++ error_sm501:
++#endif
+ #ifdef SSB_OHCI_DRIVER
+ error_ssb:
+ #endif
+@@ -1159,6 +1169,9 @@ module_init(ohci_hcd_mod_init);
+
+ static void __exit ohci_hcd_mod_exit(void)
+ {
++#ifdef SM501_OHCI_DRIVER
++ platform_driver_unregister(&SM501_OHCI_DRIVER);
++#endif
+ #ifdef SSB_OHCI_DRIVER
+ ssb_driver_unregister(&SSB_OHCI_DRIVER);
+ #endif
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 2 19:45:56 2008
+From: David S. Miller <davem@davemloft.net>
+Date: Thu, 3 Jul 2008 02:45:49 GMT
+Subject: SCSI: esp: Fix OOPS in esp_reset_cleanup().
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807030245.m632jnkA007691@hera.kernel.org>
+
+From: David S. Miller <davem@davemloft.net>
+
+commit eadc49b1a8d09480f14caea292142f103a89c77a upstream
+
+OOPS reported by Friedrich Oslage <bluebird@porno-bullen.de>
+
+The problem here is that tp->starget is set every time a lun
+is allocated for a particular target so we can catch the
+sdev_target parent value.
+
+The reset handler uses the NULL'ness of this value to determine
+which targets are active.
+
+But esp_slave_destroy() does not NULL out this value when appropriate.
+
+So for every target that doesn't respond, the SCSI bus scan causes
+a stale pointer to be left here, with ensuing crashes like you're
+seeing.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/esp_scsi.c | 8 ++++++++
+ drivers/scsi/esp_scsi.h | 1 +
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -2364,6 +2364,7 @@ static int esp_slave_alloc(struct scsi_d
+ dev->hostdata = lp;
+
+ tp->starget = dev->sdev_target;
++ tp->starget_ref++;
+
+ spi_min_period(tp->starget) = esp->min_period;
+ spi_max_offset(tp->starget) = 15;
+@@ -2412,10 +2413,17 @@ static int esp_slave_configure(struct sc
+
+ static void esp_slave_destroy(struct scsi_device *dev)
+ {
++ struct esp *esp = shost_priv(dev->host);
++ struct esp_target_data *tp = &esp->target[dev->id];
+ struct esp_lun_data *lp = dev->hostdata;
+
+ kfree(lp);
+ dev->hostdata = NULL;
++
++ BUG_ON(tp->starget_ref <= 0);
++
++ if (!--tp->starget_ref)
++ tp->starget = NULL;
+ }
+
+ static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -322,6 +322,7 @@ struct esp_target_data {
+ u8 nego_goal_tags;
+
+ struct scsi_target *starget;
++ int starget_ref;
+ };
+
+ struct esp_event_ent {
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 2 19:45:53 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Thu, 3 Jul 2008 02:45:44 GMT
+Subject: SCSI: esp: tidy up target reference counting
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807030245.m632jiU6007650@hera.kernel.org>
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit ec5e69f6d3f4350681d6f7eaae515cf014be9276 upstream
+
+The esp driver currently does hand rolled reference counting of its
+target. It's much easier to do what it needs to do if it's plugged into
+the mid-layer callbacks (target_alloc and target_destroy) which were
+designed for this case, so do it this way and get rid of the internal
+target reference count.
+
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/esp_scsi.c | 30 ++++++++++++++++++++----------
+ drivers/scsi/esp_scsi.h | 1 -
+ 2 files changed, 20 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -2352,6 +2352,24 @@ void scsi_esp_unregister(struct esp *esp
+ }
+ EXPORT_SYMBOL(scsi_esp_unregister);
+
++static int esp_target_alloc(struct scsi_target *starget)
++{
++ struct esp *esp = shost_priv(dev_to_shost(&starget->dev));
++ struct esp_target_data *tp = &esp->target[starget->id];
++
++ tp->starget = starget;
++
++ return 0;
++}
++
++static void esp_target_destroy(struct scsi_target *starget)
++{
++ struct esp *esp = shost_priv(dev_to_shost(&starget->dev));
++ struct esp_target_data *tp = &esp->target[starget->id];
++
++ tp->starget = NULL;
++}
++
+ static int esp_slave_alloc(struct scsi_device *dev)
+ {
+ struct esp *esp = shost_priv(dev->host);
+@@ -2363,9 +2381,6 @@ static int esp_slave_alloc(struct scsi_d
+ return -ENOMEM;
+ dev->hostdata = lp;
+
+- tp->starget = dev->sdev_target;
+- tp->starget_ref++;
+-
+ spi_min_period(tp->starget) = esp->min_period;
+ spi_max_offset(tp->starget) = 15;
+
+@@ -2413,17 +2428,10 @@ static int esp_slave_configure(struct sc
+
+ static void esp_slave_destroy(struct scsi_device *dev)
+ {
+- struct esp *esp = shost_priv(dev->host);
+- struct esp_target_data *tp = &esp->target[dev->id];
+ struct esp_lun_data *lp = dev->hostdata;
+
+ kfree(lp);
+ dev->hostdata = NULL;
+-
+- BUG_ON(tp->starget_ref <= 0);
+-
+- if (!--tp->starget_ref)
+- tp->starget = NULL;
+ }
+
+ static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
+@@ -2603,6 +2611,8 @@ struct scsi_host_template scsi_esp_templ
+ .name = "esp",
+ .info = esp_info,
+ .queuecommand = esp_queuecommand,
++ .target_alloc = esp_target_alloc,
++ .target_destroy = esp_target_destroy,
+ .slave_alloc = esp_slave_alloc,
+ .slave_configure = esp_slave_configure,
+ .slave_destroy = esp_slave_destroy,
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -322,7 +322,6 @@ struct esp_target_data {
+ u8 nego_goal_tags;
+
+ struct scsi_target *starget;
+- int starget_ref;
+ };
+
+ struct esp_event_ent {
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jul 2 19:45:59 2008
+From: Matthew Wilcox <matthew@wil.cx>
+Date: Thu, 3 Jul 2008 02:45:51 GMT
+Subject: SCSI: ses: Fix timeout
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807030245.m632jpfU007711@hera.kernel.org>
+
+From: Matthew Wilcox <matthew@wil.cx>
+
+commit c95e62ce8905aab62fed224eaaa9b8558a0ef652 upstream
+
+Timeouts are measured in jiffies, not in seconds.
+
+Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ses.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -61,7 +61,7 @@ static int ses_probe(struct device *dev)
+ return err;
+ }
+
+-#define SES_TIMEOUT 30
++#define SES_TIMEOUT (30 * HZ)
+ #define SES_RETRIES 3
+
+ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
scsi-esp-fix-oops-in-esp_reset_cleanup.patch
scsi-esp-tidy-up-target-reference-counting.patch
scsi-ses-fix-timeout.patch
+mm-switch-node-meminfo-active-inactive-pages-to-kbytes.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 4 00:24:03 2008
+From: David Brownell <david-b@pacbell.net>
+Date: Fri, 4 Jul 2008 05:20:28 GMT
+Subject: USB: ehci - fix timer regression
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807040520.m645KSLi005032@hera.kernel.org>
+
+From: David Brownell <david-b@pacbell.net>
+
+commit 056761e55c8687ddf3db14226213f2e8dc2689bc upstream
+
+This patch fixes a regression in the EHCI driver's TIMER_IO_WATCHDOG
+behavior. The patch "USB: EHCI: add separate IAA watchdog timer" changed
+how that timer is handled, so that short timeouts on the remaining
+timer (unfortunately, overloaded) would never be used.
+
+This takes a more direct approach, reorganizing the code slightly to
+be explicit about only the I/O watchdog role now being overridable.
+It also replaces a now-obsolete comment describing older timer behavior.
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Leonid <leonidv11@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci.h | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -176,6 +176,15 @@ timer_action_done (struct ehci_hcd *ehci
+ static inline void
+ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action)
+ {
++ /* Don't override timeouts which shrink or (later) disable
++ * the async ring; just the I/O watchdog. Note that if a
++ * SHRINK were pending, OFF would never be requested.
++ */
++ if (timer_pending(&ehci->watchdog)
++ && ((BIT(TIMER_ASYNC_SHRINK) | BIT(TIMER_ASYNC_OFF))
++ & ehci->actions))
++ return;
++
+ if (!test_and_set_bit (action, &ehci->actions)) {
+ unsigned long t;
+
+@@ -191,15 +200,7 @@ timer_action (struct ehci_hcd *ehci, enu
+ t = EHCI_SHRINK_JIFFIES;
+ break;
+ }
+- t += jiffies;
+- // all timings except IAA watchdog can be overridden.
+- // async queue SHRINK often precedes IAA. while it's ready
+- // to go OFF neither can matter, and afterwards the IO
+- // watchdog stops unless there's still periodic traffic.
+- if (time_before_eq(t, ehci->watchdog.expires)
+- && timer_pending (&ehci->watchdog))
+- return;
+- mod_timer (&ehci->watchdog, t);
++ mod_timer(&ehci->watchdog, t + jiffies);
+ }
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 4 00:24:13 2008
+From: Stefan Becker <Stefan.Becker@nokia.com>
+Date: Fri, 4 Jul 2008 05:20:27 GMT
+Subject: USB: fix interrupt disabling for HCDs with shared interrupt handlers
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807040520.m645KROT005018@hera.kernel.org>
+
+From: Stefan Becker <Stefan.Becker@nokia.com>
+
+commit de85422b94ddb23c021126815ea49414047c13dc upstream
+
+As has been discussed several times on LKML, IRQF_SHARED | IRQF_DISABLED
+doesn't work reliably, i.e. a shared interrupt handler CAN'T be certain to
+be called with interrupts disabled. Most USB HCD handlers use IRQF_DISABLED
+and therefore havoc can break out if they share their interrupt with a
+handler that doesn't use it.
+
+On my test machine the yenta_socket interrupt handler (no IRQF_DISABLED)
+was registered before ehci_hcd and one uhci_hcd instance. Therefore all
+usb_hcd_irq() invocations for ehci_hcd and for one uhci_hcd instance
+happened with interrupts enabled. That led to random lockups as USB core
+HCD functions that acquire the same spinlock could be called twice
+from interrupt handlers.
+
+This patch updates usb_hcd_irq() to always disable/restore interrupts.
+usb_add_hcd() will silently remove any IRQF_DISABLED requested from HCD code.
+
+Signed-off-by: Stefan Becker <stefan.becker@nokia.com>
+Acked-by: David Brownell <david-b@pacbell.net>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 42 ++++++++++++++++++++++++++++++------------
+ 1 file changed, 30 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1685,19 +1685,30 @@ EXPORT_SYMBOL_GPL(usb_bus_start_enum);
+ irqreturn_t usb_hcd_irq (int irq, void *__hcd)
+ {
+ struct usb_hcd *hcd = __hcd;
+- int start = hcd->state;
++ unsigned long flags;
++ irqreturn_t rc;
+
+- if (unlikely(start == HC_STATE_HALT ||
+- !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))
+- return IRQ_NONE;
+- if (hcd->driver->irq (hcd) == IRQ_NONE)
+- return IRQ_NONE;
+-
+- set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+-
+- if (unlikely(hcd->state == HC_STATE_HALT))
+- usb_hc_died (hcd);
+- return IRQ_HANDLED;
++ /* IRQF_DISABLED doesn't work correctly with shared IRQs
++ * when the first handler doesn't use it. So let's just
++ * assume it's never used.
++ */
++ local_irq_save(flags);
++
++ if (unlikely(hcd->state == HC_STATE_HALT ||
++ !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {
++ rc = IRQ_NONE;
++ } else if (hcd->driver->irq(hcd) == IRQ_NONE) {
++ rc = IRQ_NONE;
++ } else {
++ set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
++
++ if (unlikely(hcd->state == HC_STATE_HALT))
++ usb_hc_died(hcd);
++ rc = IRQ_HANDLED;
++ }
++
++ local_irq_restore(flags);
++ return rc;
+ }
+
+ /*-------------------------------------------------------------------------*/
+@@ -1861,6 +1872,13 @@ int usb_add_hcd(struct usb_hcd *hcd,
+
+ /* enable irqs just before we start the controller */
+ if (hcd->driver->irq) {
++
++ /* IRQF_DISABLED doesn't work as advertised when used together
++ * with IRQF_SHARED. As usb_hcd_irq() will always disable
++ * interrupts we can remove it here.
++ */
++ irqflags &= ~IRQF_DISABLED;
++
+ snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
+ hcd->driver->description, hcd->self.busnum);
+ if ((retval = request_irq(irqnum, &usb_hcd_irq, irqflags,
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 4 00:24:09 2008
+From: David Brownell <dbrownell@users.sourceforge.net>
+Date: Fri, 4 Jul 2008 05:20:28 GMT
+Subject: USB: ohci - record data toggle after unlink
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200807040520.m645KSQ0005026@hera.kernel.org>
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 29c8f6a727a683b5988877dd80dbdefd49e64a51 upstream
+
+This patch fixes a problem with OHCI where canceling bulk or
+interrupt URBs may lose track of the right data toggle. This
+seems to be a longstanding bug, possibly dating back to the
+Linux 2.4 kernel, which stayed hidden because
+
+ (a) about half the time the data toggle bit was correct;
+ (b) canceling such URBs is unusual; and
+ (c) the few drivers which cancel these URBs either
+ [1] do it only as part of shutting down, or
+ [2] have fault recovery logic, which recovers.
+
+For those transfer types, the toggle is normally written back
+into the ED when each TD is retired. But canceling bypasses
+the mechanism used to retire TDs ... so on average, half the
+time the toggle bit will be invalid after cancelation.
+
+The fix is simple: the toggle state of any canceled TDs are
+propagated back to the ED in the finish_unlinks function.
+
+(Issue found by leonidv11@gmail.com ...)
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Leonid <leonidv11@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ohci-q.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -952,6 +952,7 @@ rescan_this:
+ struct urb *urb;
+ urb_priv_t *urb_priv;
+ __hc32 savebits;
++ u32 tdINFO;
+
+ td = list_entry (entry, struct td, td_list);
+ urb = td->urb;
+@@ -966,6 +967,17 @@ rescan_this:
+ savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK);
+ *prev = td->hwNextTD | savebits;
+
++ /* If this was unlinked, the TD may not have been
++ * retired ... so manually save the data toggle.
++ * The controller ignores the value we save for
++ * control and ISO endpoints.
++ */
++ tdINFO = hc32_to_cpup(ohci, &td->hwINFO);
++ if ((tdINFO & TD_T) == TD_T_DATA0)
++ ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_C);
++ else if ((tdINFO & TD_T) == TD_T_DATA1)
++ ed->hwHeadP |= cpu_to_hc32(ohci, ED_C);
++
+ /* HC may have partly processed this TD */
+ td_done (ohci, urb, td);
+ urb_priv->td_cnt++;
projects / thirdparty / kernel / stable-queue.git / commitdiff
