linux-toradex.git, branch v2.6.25.4

Linux 2.6.25.4

2008-05-15T15:00:12+00:00

md: fix raid5 'repair' operations

2008-05-15T14:50:08+00:00

commit c8894419acf5e56851de9741c5047bebd78acd1f upstream
Date: Mon, 12 May 2008 14:02:12 -0700
Subject: md: fix raid5 'repair' operations

commit bd2ab67030e9116f1e4aae1289220255412b37fd "md: close a livelock window
in handle_parity_checks5" introduced a bug in handling 'repair' operations.
After a repair operation completes we clear the state bits tracking this
operation.  However, they are cleared too early and this results in the code
deciding to re-run the parity check operation.  Since we have done the repair
in memory the second check does not find a mismatch and thus does not do a
writeback.

Test results:
$ echo repair > /sys/block/md0/md/sync_action
$ cat /sys/block/md0/md/mismatch_cnt
51072
$ echo repair > /sys/block/md0/md/sync_action
$ cat /sys/block/md0/md/mismatch_cnt
0

(also fix incorrect indentation)

Tested-by: George Spelvin 
Acked-by: NeilBrown 
Signed-off-by: Dan Williams 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

rtc: rtc_time_to_tm: use unsigned arithmetic

2008-05-15T14:50:08+00:00

commit 945185a69daa457c4c5e46e47f4afad7dcea734f upstream
Date: Mon, 12 May 2008 14:02:24 -0700
Subject: rtc: rtc_time_to_tm: use unsigned arithmetic

The input argument to rtc_time_to_tm() is unsigned as well as are members of
the output structure.  However signed arithmetic is used within for
calculations leading to incorrect results for input values outside the signed
positive range.  If this happens the time of day returned is out of range.

Found the problem when fiddling with the RTC and the driver where year was set
to an unexpectedly large value like 2070, e.g.:

rtc0: setting system clock to 2070-01-01 1193046:71582832:26 UTC (3155760954)

while it should be:

rtc0: setting system clock to 2070-01-01 00:15:54 UTC (3155760954)

Changing types to unsigned fixes the problem.

[akpm@linux-foundation.org: remove old-fashioned `register' keyword]
Signed-off-by: Maciej W. Rozycki 
Cc: Alessandro Zummo 
Cc: David Brownell 
Cc: Dmitri Vorobiev 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

SCSI: aha152x: fix init suspiciously returned 1, it should follow 0/-E convention

2008-05-15T14:50:08+00:00

commit ad2fa42d044b98469449880474a9662fb689f7f9 upstream

Reported-by: Frank de Jong 
> [1.] One line summary of the problem:
> linux-2.6.25.3, aha152x'->init suspiciously returned 1, it should
> follow 0/-E convention. The module / driver works okay. Unloading the
> module is impossible.

The driver is apparently returning 0 on failure and 1 on success.
That's a bit unfortunate.  Fix it by altering to -ENODEV and 0.

Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: aha152x: Fix oops on module removal

2008-05-15T14:50:07+00:00

commit 64976a0387835a7ac61bbe2a99b27ccae34eac5d upstream

Reported-by: Frank de Jong 
> after trying to unload the module:
> BUG: unable to handle kernel paging request at 00100100
> IP: [] :aha152x:aha152x_exit+0x47/0x6a
> *pde = 00000000
> Oops: 0000 [#1] PREEMPT SMP
> Modules linked in: aha152x(-) w83781d hwmon_vid tun ne 8390 bonding
> usb_storage snd_usb_audio snd_usb_lib snd_rawmidi pwc snd_seq_device
> compat_ioctl32 snd_hwdep videodev v4l1_compat 3c59x mii intel_agp
> agpgart snd_pcm_oss snd_pcm snd_timer snd_page_alloc snd_mixer_oss snd
>
> Pid: 2837, comm: rmmod Not tainted (2.6.25.3 #1)
> EIP: 0060:[] EFLAGS: 00210212 CPU: 0
> EIP is at aha152x_exit+0x47/0x6a [aha152x]
> EAX: 00000001 EBX: 000ffdc4 ECX: f7c517a8 EDX: 00000001
> ESI: 00000000 EDI: 00000003 EBP: e7880000 ESP: e7881f58
>   DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Process rmmod (pid: 2837, ti=e7880000 task=f27eb580 task.ti=e7880000)
> Stack: fba03700 c01419d2 31616861 00783235 e795ee70 c0157709 b7f24000 e79ae000
>         c0158271 ffffffff b7f25000 e79ae004 e795e370 b7f25000 e795e37c e795e370
>         009ae000 fba03700 00000880 e7881fa8 00000000 bf93ec20 bf93ec20 c0102faa
> Call Trace:
>   [] sys_delete_module+0x112/0x1a0
>   [] remove_vma+0x39/0x50
>   [] do_munmap+0x181/0x1f0
>   [] sysenter_past_esp+0x5f/0x85
>   [] rsc_parse+0x0/0x3c0

The problem is that the driver calls aha152x_release() under a
list_for_each_entry().  Unfortunately, aha152x_release() deletes from
the list in question.  Fix this by using list_for_each_entry_safe().

Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: libiscsi regression in 2.6.25: fix setting of recv timer

2008-05-15T14:50:07+00:00

commit c8611f975403dd20e6503aff8aded5dcb718f75b upstream

If the ping tmo is longer than the recv tmo then we could miss a window
where we were supposed to check the recv tmo. This happens because
the ping code will set the next timeout for the ping timeout, and if the
ping executes quickly there will be a long chunk of time before the
timer wakes up again.

This patch has the ping processing code kick off a recv
tmo check when getting a nop in response to our ping.

Signed-off-by: Mike Christie 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: libiscsi regression in 2.6.25: fix nop timer handling

2008-05-15T14:50:07+00:00

commit 4cf1043593db6a337f10e006c23c69e5fc93e722 upstream

The following patch fixes a bug in the iscsi nop processing.
The target sends iscsi nops to ping the initiator and the
initiator has to send nops to reply and can send nops to
ping the target.

In 2.6.25 we moved the nop processing to the kernel to handle
problems when the userspace daemon is not up, but the target
is pinging us, and to handle when scsi commands timeout, but
the transport may be the cause (we can send a nop to check
the transport). When we added this code we added a bug where
if the transport timer wakes at the exact same time we are supposed to check
for a nop timeout we drop the session instead of checking the transport.

This patch checks if a iscsi ping is outstanding and if the ping has
timed out, to determine if we need to signal a connection problem.

Signed-off-by: Mike Christie 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

SCSI: qla1280: Fix queue depth problem

2008-05-15T14:50:07+00:00

commit af5741c6de4f4a1d8608b0f00867c77cb7123635 upstream

The qla1280 driver was ANDing the output value of mailbox register
0 with (1 << target-number) to determine whether to enable queueing
on the target in question.

But mailbox register 0 has the status code for the mailbox command
(in this case, Set Target Parameters).  Potential values are:
/*
 * ISP mailbox command complete status codes
 */

So clearly that is in error.  I can't think what the author of that
line was looking for in a mailbox register, so I just eliminated the
AND.  flag is used later in the function, and I think that the later
usage was also wrong, though it was used to set values that aren't
used.  Oh well, an overhaul of this driver is not what I want to do
now -- just a bugfix.

After the fix, I found that my disks were getting a queue depth of
255, which is far too many.  Most SCSI disks are limited to 32 or
64.  In any case, there's no point, queueing up a bunch of commands
to the adapter that will just result in queue full or starve other
targets from being issued commands due to running out of internal
memory.  So I dropped default queue depth to 32 (from which 1 is
subtracted elsewhere, giving net of 31).

I tested with a Seagate ST336753LC, and results look good, so
I'm satisfied with this patch.

Signed-off-by: Jeremy Higdon 
Acked-by: Jes Sorensen 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

r8169: fix oops in r8169_get_mac_version

2008-05-15T14:50:07+00:00

commit 21e197f231343201368338603cb0909a13961bac upstream.

r8169_get_mac_version crashes when it meets an unknown MAC
due to tp->pci_dev not being set. Initialize it early.

Signed-off-by: Ivan Vecera 
Acked-by: Francois Romieu 
Signed-off-by: Greg Kroah-Hartman

r8169: fix past rtl_chip_info array size for unknown chipsets

2008-05-15T14:50:06+00:00

commit cee60c377de6d9d10f0a2876794149bd79a15020 upstream.

'i' is unsigned.

Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
Acked-by: Francois Romieu 
Signed-off-by: Greg Kroah-Hartman