--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:35 2008
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 13 May 2008 19:10:11 GMT
+Subject: md: fix raid5 'repair' operations
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJABfs007550@hera.kernel.org>
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit c8894419acf5e56851de9741c5047bebd78acd1f upstream
+Date: Mon, 12 May 2008 14:02:12 -0700
+Subject: md: fix raid5 'repair' operations
+
+commit bd2ab67030e9116f1e4aae1289220255412b37fd "md: close a livelock window
+in handle_parity_checks5" introduced a bug in handling 'repair' operations.
+After a repair operation completes we clear the state bits tracking this
+operation. However, they are cleared too early and this results in the code
+deciding to re-run the parity check operation. Since we have done the repair
+in memory the second check does not find a mismatch and thus does not do a
+writeback.
+
+Test results:
+$ echo repair > /sys/block/md0/md/sync_action
+$ cat /sys/block/md0/md/mismatch_cnt
+51072
+$ echo repair > /sys/block/md0/md/sync_action
+$ cat /sys/block/md0/md/mismatch_cnt
+0
+
+(also fix incorrect indentation)
+
+Tested-by: George Spelvin <linux@horizon.com>
+Acked-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2354,8 +2354,8 @@ static void handle_parity_checks5(raid5_
+
+ /* complete a check operation */
+ if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
+- clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
+- clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
++ clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
++ clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
+ if (s->failed == 0) {
+ if (sh->ops.zero_sum_result == 0)
+ /* parity is correct (on disc,
+@@ -2385,16 +2385,6 @@ static void handle_parity_checks5(raid5_
+ canceled_check = 1; /* STRIPE_INSYNC is not set */
+ }
+
+- /* check if we can clear a parity disk reconstruct */
+- if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
+- test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
+-
+- clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
+- clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
+- clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
+- clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
+- }
+-
+ /* start a new check operation if there are no failures, the stripe is
+ * not insync, and a repair is not in flight
+ */
+@@ -2409,6 +2399,17 @@ static void handle_parity_checks5(raid5_
+ }
+ }
+
++ /* check if we can clear a parity disk reconstruct */
++ if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
++ test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
++
++ clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
++ clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
++ clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
++ clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
++ }
++
++
+ /* Wait for check parity and compute block operations to complete
+ * before write-back. If a failure occurred while the check operation
+ * was in flight we need to cycle this stripe through handle_stripe
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:24 2008
+From: Maciej W. Rozycki <macro@linux-mips.org>
+Date: Tue, 13 May 2008 19:10:10 GMT
+Subject: rtc: rtc_time_to_tm: use unsigned arithmetic
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJAAWD007525@hera.kernel.org>
+
+From: Maciej W. Rozycki <macro@linux-mips.org>
+
+commit 945185a69daa457c4c5e46e47f4afad7dcea734f upstream
+Date: Mon, 12 May 2008 14:02:24 -0700
+Subject: rtc: rtc_time_to_tm: use unsigned arithmetic
+
+The input argument to rtc_time_to_tm() is unsigned as well as are members of
+the output structure. However signed arithmetic is used within for
+calculations leading to incorrect results for input values outside the signed
+positive range. If this happens the time of day returned is out of range.
+
+Found the problem when fiddling with the RTC and the driver where year was set
+to an unexpectedly large value like 2070, e.g.:
+
+rtc0: setting system clock to 2070-01-01 1193046:71582832:26 UTC (3155760954)
+
+while it should be:
+
+rtc0: setting system clock to 2070-01-01 00:15:54 UTC (3155760954)
+
+Changing types to unsigned fixes the problem.
+
+[akpm@linux-foundation.org: remove old-fashioned `register' keyword]
+Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: David Brownell <david-b@pacbell.net>
+Cc: Dmitri Vorobiev <dmitri.vorobiev@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-lib.c
++++ b/drivers/rtc/rtc-lib.c
+@@ -51,7 +51,7 @@ EXPORT_SYMBOL(rtc_year_days);
+ */
+ void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
+ {
+- register int days, month, year;
++ unsigned int days, month, year;
+
+ days = time / 86400;
+ time -= days * 86400;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:47 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Tue, 13 May 2008 19:10:24 GMT
+Subject: SCSI: aha152x: fix init suspiciously returned 1, it should follow 0/-E convention
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJAOak007649@hera.kernel.org>
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit ad2fa42d044b98469449880474a9662fb689f7f9 upstream
+
+Reported-by: Frank de Jong <frapex@xs4all.nl>
+> [1.] One line summary of the problem:
+> linux-2.6.25.3, aha152x'->init suspiciously returned 1, it should
+> follow 0/-E convention. The module / driver works okay. Unloading the
+> module is impossible.
+
+The driver is apparently returning 0 on failure and 1 on success.
+That's a bit unfortunate. Fix it by altering to -ENODEV and 0.
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aha152x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/aha152x.c
++++ b/drivers/scsi/aha152x.c
+@@ -3835,7 +3835,7 @@ static int __init aha152x_init(void)
+ iounmap(p);
+ }
+ if (!ok && setup_count == 0)
+- return 0;
++ return -ENODEV;
+
+ printk(KERN_INFO "aha152x: BIOS test: passed, ");
+ #else
+@@ -3914,7 +3914,7 @@ static int __init aha152x_init(void)
+ #endif
+ }
+
+- return 1;
++ return 0;
+ }
+
+ static void __exit aha152x_exit(void)
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:47 2008
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Tue, 13 May 2008 19:10:15 GMT
+Subject: SCSI: aha152x: Fix oops on module removal
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJAFIr007608@hera.kernel.org>
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit 64976a0387835a7ac61bbe2a99b27ccae34eac5d upstream
+
+Reported-by: Frank de Jong <frapex@xs4all.nl>
+> after trying to unload the module:
+> BUG: unable to handle kernel paging request at 00100100
+> IP: [<fb9ff667>] :aha152x:aha152x_exit+0x47/0x6a
+> *pde = 00000000
+> Oops: 0000 [#1] PREEMPT SMP
+> Modules linked in: aha152x(-) w83781d hwmon_vid tun ne 8390 bonding
+> usb_storage snd_usb_audio snd_usb_lib snd_rawmidi pwc snd_seq_device
+> compat_ioctl32 snd_hwdep videodev v4l1_compat 3c59x mii intel_agp
+> agpgart snd_pcm_oss snd_pcm snd_timer snd_page_alloc snd_mixer_oss snd
+>
+> Pid: 2837, comm: rmmod Not tainted (2.6.25.3 #1)
+> EIP: 0060:[<fb9ff667>] EFLAGS: 00210212 CPU: 0
+> EIP is at aha152x_exit+0x47/0x6a [aha152x]
+> EAX: 00000001 EBX: 000ffdc4 ECX: f7c517a8 EDX: 00000001
+> ESI: 00000000 EDI: 00000003 EBP: e7880000 ESP: e7881f58
+> DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+> Process rmmod (pid: 2837, ti=e7880000 task=f27eb580 task.ti=e7880000)
+> Stack: fba03700 c01419d2 31616861 00783235 e795ee70 c0157709 b7f24000 e79ae000
+> c0158271 ffffffff b7f25000 e79ae004 e795e370 b7f25000 e795e37c e795e370
+> 009ae000 fba03700 00000880 e7881fa8 00000000 bf93ec20 bf93ec20 c0102faa
+> Call Trace:
+> [<c01419d2>] sys_delete_module+0x112/0x1a0
+> [<c0157709>] remove_vma+0x39/0x50
+> [<c0158271>] do_munmap+0x181/0x1f0
+> [<c0102faa>] sysenter_past_esp+0x5f/0x85
+> [<c0490000>] rsc_parse+0x0/0x3c0
+
+The problem is that the driver calls aha152x_release() under a
+list_for_each_entry(). Unfortunately, aha152x_release() deletes from
+the list in question. Fix this by using list_for_each_entry_safe().
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/aha152x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/aha152x.c
++++ b/drivers/scsi/aha152x.c
+@@ -3919,9 +3919,9 @@ static int __init aha152x_init(void)
+
+ static void __exit aha152x_exit(void)
+ {
+- struct aha152x_hostdata *hd;
++ struct aha152x_hostdata *hd, *tmp;
+
+- list_for_each_entry(hd, &aha152x_host_list, host_list) {
++ list_for_each_entry_safe(hd, tmp, &aha152x_host_list, host_list) {
+ struct Scsi_Host *shost = container_of((void *)hd, struct Scsi_Host, hostdata);
+
+ aha152x_release(shost);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:58 2008
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Tue, 13 May 2008 19:10:30 GMT
+Subject: SCSI: libiscsi regression in 2.6.25: fix nop timer handling
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJAUhe007702@hera.kernel.org>
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit 4cf1043593db6a337f10e006c23c69e5fc93e722 upstream
+
+The following patch fixes a bug in the iscsi nop processing.
+The target sends iscsi nops to ping the initiator and the
+initiator has to send nops to reply and can send nops to
+ping the target.
+
+In 2.6.25 we moved the nop processing to the kernel to handle
+problems when the userspace daemon is not up, but the target
+is pinging us, and to handle when scsi commands timeout, but
+the transport may be the cause (we can send a nop to check
+the transport). When we added this code we added a bug where
+if the transport timer wakes at the exact same time we are supposed to check
+for a nop timeout we drop the session instead of checking the transport.
+
+This patch checks if a iscsi ping is outstanding and if the ping has
+timed out, to determine if we need to signal a connection problem.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libiscsi.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1353,19 +1353,20 @@ static void iscsi_check_transport_timeou
+ {
+ struct iscsi_conn *conn = (struct iscsi_conn *)data;
+ struct iscsi_session *session = conn->session;
+- unsigned long timeout, next_timeout = 0, last_recv;
++ unsigned long recv_timeout, next_timeout = 0, last_recv;
+
+ spin_lock(&session->lock);
+ if (session->state != ISCSI_STATE_LOGGED_IN)
+ goto done;
+
+- timeout = conn->recv_timeout;
+- if (!timeout)
++ recv_timeout = conn->recv_timeout;
++ if (!recv_timeout)
+ goto done;
+
+- timeout *= HZ;
++ recv_timeout *= HZ;
+ last_recv = conn->last_recv;
+- if (time_before_eq(last_recv + timeout + (conn->ping_timeout * HZ),
++ if (conn->ping_mtask &&
++ time_before_eq(conn->last_ping + (conn->ping_timeout * HZ),
+ jiffies)) {
+ iscsi_conn_printk(KERN_ERR, conn, "ping timeout of %d secs "
+ "expired, last rx %lu, last ping %lu, "
+@@ -1376,15 +1377,15 @@ static void iscsi_check_transport_timeou
+ return;
+ }
+
+- if (time_before_eq(last_recv + timeout, jiffies)) {
++ if (time_before_eq(last_recv + recv_timeout, jiffies)) {
+ if (time_before_eq(conn->last_ping, last_recv)) {
+ /* send a ping to try to provoke some traffic */
+ debug_scsi("Sending nopout as ping on conn %p\n", conn);
+ iscsi_send_nopout(conn, NULL);
+ }
+- next_timeout = last_recv + timeout + (conn->ping_timeout * HZ);
++ next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
+ } else
+- next_timeout = last_recv + timeout;
++ next_timeout = last_recv + recv_timeout;
+
+ debug_scsi("Setting next tmo %lu\n", next_timeout);
+ mod_timer(&conn->transport_timer, next_timeout);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:47 2008
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Tue, 13 May 2008 19:10:25 GMT
+Subject: SCSI: libiscsi regression in 2.6.25: fix setting of recv timer
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJAP1R007667@hera.kernel.org>
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit c8611f975403dd20e6503aff8aded5dcb718f75b upstream
+
+If the ping tmo is longer than the recv tmo then we could miss a window
+where we were supposed to check the recv tmo. This happens because
+the ping code will set the next timeout for the ping timeout, and if the
+ping executes quickly there will be a long chunk of time before the
+timer wakes up again.
+
+This patch has the ping processing code kick off a recv
+tmo check when getting a nop in response to our ping.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libiscsi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -635,7 +635,9 @@ static int __iscsi_complete_pdu(struct i
+ if (iscsi_recv_pdu(conn->cls_conn, hdr, data,
+ datalen))
+ rc = ISCSI_ERR_CONN_FAILED;
+- }
++ } else
++ mod_timer(&conn->transport_timer,
++ jiffies + conn->recv_timeout);
+ iscsi_free_mgmt_task(conn, mtask);
+ break;
+ default:
+@@ -1378,11 +1380,9 @@ static void iscsi_check_transport_timeou
+ }
+
+ if (time_before_eq(last_recv + recv_timeout, jiffies)) {
+- if (time_before_eq(conn->last_ping, last_recv)) {
+- /* send a ping to try to provoke some traffic */
+- debug_scsi("Sending nopout as ping on conn %p\n", conn);
+- iscsi_send_nopout(conn, NULL);
+- }
++ /* send a ping to try to provoke some traffic */
++ debug_scsi("Sending nopout as ping on conn %p\n", conn);
++ iscsi_send_nopout(conn, NULL);
+ next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
+ } else
+ next_timeout = last_recv + recv_timeout;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue May 13 12:10:24 2008
+From: Jeremy Higdon <jeremy@sgi.com>
+Date: Tue, 13 May 2008 19:10:09 GMT
+Subject: SCSI: qla1280: Fix queue depth problem
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200805131910.m4DJA9Nl007490@hera.kernel.org>
+
+From: Jeremy Higdon <jeremy@sgi.com>
+
+commit af5741c6de4f4a1d8608b0f00867c77cb7123635 upstream
+
+The qla1280 driver was ANDing the output value of mailbox register
+0 with (1 << target-number) to determine whether to enable queueing
+on the target in question.
+
+But mailbox register 0 has the status code for the mailbox command
+(in this case, Set Target Parameters). Potential values are:
+/*
+ * ISP mailbox command complete status codes
+ */
+
+So clearly that is in error. I can't think what the author of that
+line was looking for in a mailbox register, so I just eliminated the
+AND. flag is used later in the function, and I think that the later
+usage was also wrong, though it was used to set values that aren't
+used. Oh well, an overhaul of this driver is not what I want to do
+now -- just a bugfix.
+
+After the fix, I found that my disks were getting a queue depth of
+255, which is far too many. Most SCSI disks are limited to 32 or
+64. In any case, there's no point, queueing up a bunch of commands
+to the adapter that will just result in queue full or starve other
+targets from being issued commands due to running out of internal
+memory. So I dropped default queue depth to 32 (from which 1 is
+subtracted elsewhere, giving net of 31).
+
+I tested with a Seagate ST336753LC, and results look good, so
+I'm satisfied with this patch.
+
+Signed-off-by: Jeremy Higdon <jeremy@sgi.com>
+Acked-by: Jes Sorensen <jes@sgi.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla1280.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla1280.c
++++ b/drivers/scsi/qla1280.c
+@@ -2012,7 +2012,7 @@ qla1280_set_defaults(struct scsi_qla_hos
+ nv->bus[bus].config_2.req_ack_active_negation = 1;
+ nv->bus[bus].config_2.data_line_active_negation = 1;
+ nv->bus[bus].selection_timeout = 250;
+- nv->bus[bus].max_queue_depth = 256;
++ nv->bus[bus].max_queue_depth = 32;
+
+ if (IS_ISP1040(ha)) {
+ nv->bus[bus].bus_reset_delay = 3;
+@@ -2056,7 +2056,7 @@ qla1280_config_target(struct scsi_qla_ho
+ status = qla1280_mailbox_command(ha, 0x0f, mb);
+
+ /* Save Tag queuing enable flag. */
+- flag = (BIT_0 << target) & mb[0];
++ flag = (BIT_0 << target);
+ if (nv->bus[bus].target[target].parameter.tag_queuing)
+ ha->bus_settings[bus].qtag_enables |= flag;
+
usb-airprime-unlock-mutex-instead-of-trying-to-lock-it-again.patch
r8169-fix-past-rtl_chip_info-array-size-for-unknown-chipsets.patch
r8169-fix-oops-in-r8169_get_mac_version.patch
+scsi-qla1280-fix-queue-depth-problem.patch
+scsi-libiscsi-regression-in-2.6.25-fix-nop-timer-handling.patch
+scsi-libiscsi-regression-in-2.6.25-fix-setting-of-recv-timer.patch
+scsi-aha152x-fix-oops-on-module-removal.patch
+scsi-aha152x-fix-init-suspiciously-returned-1-it-should-follow-0-e-convention.patch
+rtc-rtc_time_to_tm-use-unsigned-arithmetic.patch
+md-fix-raid5-repair-operations.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
