From: Greg Kroah-Hartman Date: Mon, 17 Nov 2008 05:45:16 +0000 (-0800) Subject: more .27 patches X-Git-Tag: v2.6.27.7~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b59eb123ad0ccd3e7ab70b34c6c1288542e2e22a;p=thirdparty%2Fkernel%2Fstable-queue.git more .27 patches --- diff --git a/queue-2.6.27/dm-raid1-flush-workqueue-before-destruction.patch b/queue-2.6.27/dm-raid1-flush-workqueue-before-destruction.patch new file mode 100644 index 00000000000..fc655147ad8 --- /dev/null +++ b/queue-2.6.27/dm-raid1-flush-workqueue-before-destruction.patch @@ -0,0 +1,30 @@ +From 18776c7316545482a02bfaa2629a2aa1afc48357 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 13 Nov 2008 23:38:52 +0000 +Subject: dm raid1: flush workqueue before destruction + +From: Mikulas Patocka + +commit 18776c7316545482a02bfaa2629a2aa1afc48357 upstream. + +We queue work on keventd queue --- so this queue must be flushed in the +destructor. Otherwise, keventd could access mirror_set after it was freed. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-raid1.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -1598,6 +1598,7 @@ static void mirror_dtr(struct dm_target + + del_timer_sync(&ms->timer); + flush_workqueue(ms->kmirrord_wq); ++ flush_scheduled_work(); + dm_kcopyd_client_destroy(ms->kcopyd_client); + destroy_workqueue(ms->kmirrord_wq); + free_context(ms, ti, ms->nr_mirrors); diff --git a/queue-2.6.27/m68k-fix-off-by-one-in-m68k_setup_user_interrupt.patch b/queue-2.6.27/m68k-fix-off-by-one-in-m68k_setup_user_interrupt.patch new file mode 100644 index 00000000000..d2c2802f2a7 --- /dev/null +++ b/queue-2.6.27/m68k-fix-off-by-one-in-m68k_setup_user_interrupt.patch @@ -0,0 +1,35 @@ +From 27123cbc264de89ce6951b1b4c84c223eb0f1702 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 14 Nov 2008 08:10:19 +0100 +Subject: m68k: Fix off-by-one in m68k_setup_user_interrupt() + +From: Geert Uytterhoeven + +commit 27123cbc264de89ce6951b1b4c84c223eb0f1702 upstream. + +commit 69961c375288bdab7604e0bb1c8d22999bb8a347 ("[PATCH] m68k/Atari: +Interrupt updates") added a BUG_ON() with an incorrect upper bound +comparison, which causes an early crash on VME boards, where IRQ_USER is +8, cnt is 192 and NR_IRQS is 200. + +Reported-by: Stephen N Chivers +Tested-by: Kars de Jong +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/m68k/kernel/ints.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/m68k/kernel/ints.c ++++ b/arch/m68k/kernel/ints.c +@@ -133,7 +133,7 @@ void __init m68k_setup_user_interrupt(un + { + int i; + +- BUG_ON(IRQ_USER + cnt >= NR_IRQS); ++ BUG_ON(IRQ_USER + cnt > NR_IRQS); + m68k_first_user_vec = vec; + for (i = 0; i < cnt; i++) + irq_controller[IRQ_USER + i] = &user_irq_controller; diff --git a/queue-2.6.27/scsi-dpt_i2o-fix-transferred-data-length-for-scsi_set_resid.patch b/queue-2.6.27/scsi-dpt_i2o-fix-transferred-data-length-for-scsi_set_resid.patch new file mode 100644 index 00000000000..10dd87403d2 --- /dev/null +++ b/queue-2.6.27/scsi-dpt_i2o-fix-transferred-data-length-for-scsi_set_resid.patch @@ -0,0 +1,53 @@ +From df81d2371aeca0f7474f197a3090830899016e39 Mon Sep 17 00:00:00 2001 +From: Miquel van Smoorenburg +Date: Wed, 5 Nov 2008 00:09:12 +0100 +Subject: SCSI: dpt_i2o: fix transferred data length for scsi_set_resid() + +From: Miquel van Smoorenburg + +commit df81d2371aeca0f7474f197a3090830899016e39 upstream. + +dpt_i2o.c::adpt_i2o_to_scsi() reads the value at (reply+5) which +should contain the length in bytes of the transferred data. This +would be correct if reply was a u32 *. However it is a void * here, +so we need to read the value at (reply+20) instead. + +The value at (reply+5) is usually 0xff0000, which is apparently +'large enough' and didn't cause any trouble until 2.6.27 where + +commit 427e59f09fdba387547106de7bab980b7fff77be +Author: James Bottomley +Date: Sat Mar 8 18:24:17 2008 -0600 + + [SCSI] make use of the residue value + +caused this to become visible through e.g. iostat -x . + +Signed-off-by: Miquel van Smoorenburg +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/dpt_i2o.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -2445,7 +2445,7 @@ static s32 adpt_i2o_to_scsi(void __iomem + hba_status = detailed_status >> 8; + + // calculate resid for sg +- scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+5)); ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - readl(reply+20)); + + pHba = (adpt_hba*) cmd->device->host->hostdata[0]; + +@@ -2456,7 +2456,7 @@ static s32 adpt_i2o_to_scsi(void __iomem + case I2O_SCSI_DSC_SUCCESS: + cmd->result = (DID_OK << 16); + // handle underflow +- if(readl(reply+5) < cmd->underflow ) { ++ if (readl(reply+20) < cmd->underflow) { + cmd->result = (DID_ERROR <<16); + printk(KERN_WARNING"%s: SCSI CMD underflow\n",pHba->name); + } diff --git a/queue-2.6.27/scsi-qla2xxx-correct-atmel-flash-part-handling.patch b/queue-2.6.27/scsi-qla2xxx-correct-atmel-flash-part-handling.patch new file mode 100644 index 00000000000..ec39235aee8 --- /dev/null +++ b/queue-2.6.27/scsi-qla2xxx-correct-atmel-flash-part-handling.patch @@ -0,0 +1,90 @@ +From 821b3996001508e872582dcafc7575021f122728 Mon Sep 17 00:00:00 2001 +From: Lalit Chandivade +Date: Fri, 24 Oct 2008 15:13:44 -0700 +Subject: SCSI: qla2xxx: Correct Atmel flash-part handling. + +From: Lalit Chandivade + +commit 821b3996001508e872582dcafc7575021f122728 upstream. + +Use correct block size (4K) for erase command 0x20 for Atmel +Flash. Use dword addresses for determining sector boundary. + +Signed-off-by: Lalit Chandivade +Signed-off-by: Andrew Vasquez +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_sup.c | 19 +++++++------------ + 2 files changed, 7 insertions(+), 13 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2546,7 +2546,6 @@ typedef struct scsi_qla_host { + uint8_t fcode_revision[16]; + uint32_t fw_revision[4]; + +- uint16_t fdt_odd_index; + uint32_t fdt_wrt_disable; + uint32_t fdt_erase_cmd; + uint32_t fdt_block_size; +--- a/drivers/scsi/qla2xxx/qla_sup.c ++++ b/drivers/scsi/qla2xxx/qla_sup.c +@@ -546,6 +546,7 @@ qla24xx_get_flash_manufacturer(scsi_qla_ + void + qla2xxx_get_flash_info(scsi_qla_host_t *ha) + { ++#define FLASH_BLK_SIZE_4K 0x1000 + #define FLASH_BLK_SIZE_32K 0x8000 + #define FLASH_BLK_SIZE_64K 0x10000 + uint16_t cnt, chksum; +@@ -577,7 +578,6 @@ qla2xxx_get_flash_info(scsi_qla_host_t * + goto no_flash_data; + } + +- ha->fdt_odd_index = le16_to_cpu(fdt->man_id) == 0x1f; + ha->fdt_wrt_disable = fdt->wrt_disable_bits; + ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0300 | fdt->erase_cmd); + ha->fdt_block_size = le32_to_cpu(fdt->block_size); +@@ -590,10 +590,10 @@ qla2xxx_get_flash_info(scsi_qla_host_t * + } + + DEBUG2(qla_printk(KERN_DEBUG, ha, "Flash[FDT]: (0x%x/0x%x) erase=0x%x " +- "pro=%x upro=%x idx=%d wrtd=0x%x blk=0x%x.\n", ++ "pro=%x upro=%x wrtd=0x%x blk=0x%x.\n", + le16_to_cpu(fdt->man_id), le16_to_cpu(fdt->id), ha->fdt_erase_cmd, + ha->fdt_protect_sec_cmd, ha->fdt_unprotect_sec_cmd, +- ha->fdt_odd_index, ha->fdt_wrt_disable, ha->fdt_block_size)); ++ ha->fdt_wrt_disable, ha->fdt_block_size)); + return; + + no_flash_data: +@@ -614,8 +614,7 @@ no_flash_data: + ha->fdt_block_size = FLASH_BLK_SIZE_64K; + break; + case 0x1f: /* Atmel 26DF081A. */ +- ha->fdt_odd_index = 1; +- ha->fdt_block_size = FLASH_BLK_SIZE_64K; ++ ha->fdt_block_size = FLASH_BLK_SIZE_4K; + ha->fdt_erase_cmd = flash_conf_to_access_addr(0x0320); + ha->fdt_unprotect_sec_cmd = flash_conf_to_access_addr(0x0339); + ha->fdt_protect_sec_cmd = flash_conf_to_access_addr(0x0336); +@@ -710,13 +709,9 @@ qla24xx_write_flash_data(scsi_qla_host_t + qla24xx_unprotect_flash(ha); + + for (liter = 0; liter < dwords; liter++, faddr++, dwptr++) { +- if (ha->fdt_odd_index) { +- findex = faddr << 2; +- fdata = findex & sec_mask; +- } else { +- findex = faddr; +- fdata = (findex & sec_mask) << 2; +- } ++ ++ findex = faddr; ++ fdata = (findex & sec_mask) << 2; + + /* Are we at the beginning of a sector? */ + if ((findex & rest_addr) == 0) { diff --git a/queue-2.6.27/scsi-qla2xxx-do-not-honour-max_vports-from-firmware-for-2g-isps-and-below.patch b/queue-2.6.27/scsi-qla2xxx-do-not-honour-max_vports-from-firmware-for-2g-isps-and-below.patch new file mode 100644 index 00000000000..6c159881110 --- /dev/null +++ b/queue-2.6.27/scsi-qla2xxx-do-not-honour-max_vports-from-firmware-for-2g-isps-and-below.patch @@ -0,0 +1,50 @@ +From 680d7db88ace53c673e1c437c9b6abcc053e8d6f Mon Sep 17 00:00:00 2001 +From: Shyam Sundar +Date: Fri, 24 Oct 2008 15:13:46 -0700 +Subject: SCSI: qla2xxx: Do not honour max_vports from firmware for 2G ISPs and below. + +From: Shyam Sundar + +commit 680d7db88ace53c673e1c437c9b6abcc053e8d6f upstream. + +For 23XX ISPs, max_vports may return an invalid value. +Do not honour it. + +Signed-off-by: Andrew Vasquez +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_init.c | 2 +- + drivers/scsi/qla2xxx/qla_mbx.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -974,7 +974,6 @@ qla2x00_setup_chip(scsi_qla_host_t *ha) + &ha->fw_minor_version, + &ha->fw_subminor_version, + &ha->fw_attributes, &ha->fw_memory_size); +- qla2x00_resize_request_q(ha); + ha->flags.npiv_supported = 0; + if ((IS_QLA24XX(ha) || IS_QLA25XX(ha) || + IS_QLA84XX(ha)) && +@@ -986,6 +985,7 @@ qla2x00_setup_chip(scsi_qla_host_t *ha) + ha->max_npiv_vports = + MIN_MULTI_ID_FABRIC - 1; + } ++ qla2x00_resize_request_q(ha); + + if (ql2xallocfwdump) + qla2x00_alloc_fw_dump(ha); +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -1964,7 +1964,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_ + *cur_iocb_cnt = mcp->mb[7]; + if (orig_iocb_cnt) + *orig_iocb_cnt = mcp->mb[10]; +- if (max_npiv_vports) ++ if (ha->flags.npiv_supported && max_npiv_vports) + *max_npiv_vports = mcp->mb[11]; + } + diff --git a/queue-2.6.27/scsi-qla2xxx-return-a-failed-status-when-abort-mailbox-command-fails.patch b/queue-2.6.27/scsi-qla2xxx-return-a-failed-status-when-abort-mailbox-command-fails.patch new file mode 100644 index 00000000000..b81e4808990 --- /dev/null +++ b/queue-2.6.27/scsi-qla2xxx-return-a-failed-status-when-abort-mailbox-command-fails.patch @@ -0,0 +1,38 @@ +From 5bff55db3dc4d659f46b4d2fce2f61c1964c2762 Mon Sep 17 00:00:00 2001 +From: Michael Reed +Date: Fri, 24 Oct 2008 15:13:47 -0700 +Subject: SCSI: qla2xxx: Return a FAILED status when abort mailbox-command fails. + +From: Michael Reed + +commit 5bff55db3dc4d659f46b4d2fce2f61c1964c2762 upstream. + +Mike Reed noted +(https://bugzilla.novell.com/show_bug.cgi?id=421330) that the +driver was incorrectly returning a SUCCESS status if the driver's +request to the firmware to abort a command failed. By doing so, +the mid-layer believed, incorrectly, that the command has +completed and has been returned (ultimately clearing +scsi_cmnd.request_buffer) yet the driver still has the command. +What should correctly happen is a mid-layer escalation +(device-reset, etc.) of recovery during which the driver will +eventually return the outstanding commands to the mid-layer. + +Signed-off-by: Andrew Vasquez +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -730,6 +730,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) + if (ha->isp_ops->abort_command(ha, sp)) { + DEBUG2(printk("%s(%ld): abort_command " + "mbx failed.\n", __func__, ha->host_no)); ++ ret = FAILED; + } else { + DEBUG3(printk("%s(%ld): abort_command " + "mbx success.\n", __func__, ha->host_no)); diff --git a/queue-2.6.27/series b/queue-2.6.27/series index f0388fef6c1..2a832f2d11a 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -25,3 +25,9 @@ fix-broken-ownership-of-proc-sys-files.patch v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch s390-cpu-topology-fix-locking.patch acpi-load-device-driver-according-to-the-status-of-acpi-device.patch +m68k-fix-off-by-one-in-m68k_setup_user_interrupt.patch +scsi-qla2xxx-return-a-failed-status-when-abort-mailbox-command-fails.patch +scsi-qla2xxx-do-not-honour-max_vports-from-firmware-for-2g-isps-and-below.patch +scsi-qla2xxx-correct-atmel-flash-part-handling.patch +scsi-dpt_i2o-fix-transferred-data-length-for-scsi_set_resid.patch +dm-raid1-flush-workqueue-before-destruction.patch