2008-11-15 05:25:00

by Greg KH

[permalink] [raw]
Subject: [patch 00/22] 2.6.27.7-stable review

This is the start of the stable review cycle for the 2.6.27.7 release.
There are 22 patches in this series, all will be posted as a response to
this one. If anyone has any issues with these being applied, please let
us know. If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line. If you wish to be a reviewer, please email [email protected] to
add your name to the list. If you want to be off the reviewer list,
also email us.

Responses should be made by Monday, Nov 17, 2008, 06:00:00 UTC.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.7-rc1.gz
and the diffstat can be found below.


thanks,

greg k-h

Makefile | 2 +-
arch/arm/mm/cache-feroceon-l2.c | 4 +-
arch/powerpc/include/asm/mpic.h | 2 +
arch/powerpc/platforms/85xx/mpc85xx_ds.c | 3 +-
arch/powerpc/platforms/86xx/pic.c | 3 +-
arch/powerpc/sysdev/mpic.c | 59 +++++++++++++++++++++++--
block/blk-merge.c | 19 +++++++-
drivers/acpi/ec.c | 13 ++++-
drivers/acpi/system.c | 25 +++++++---
drivers/char/ipmi/ipmi_msghandler.c | 20 +++++----
drivers/char/ipmi/ipmi_si_intf.c | 16 ++++---
drivers/hwmon/ibmaem.c | 18 ++++---
drivers/input/mouse/alps.c | 1 +
drivers/misc/sony-laptop.c | 6 ++-
drivers/net/Kconfig | 1 +
drivers/net/bnx2x_init.h | 9 ++--
drivers/net/bnx2x_main.c | 6 ++-
drivers/net/wireless/ath5k/base.c | 67 +++++++++++++++--------------
drivers/net/wireless/ath5k/base.h | 3 +-
drivers/net/wireless/ath5k/hw.c | 22 +++------
drivers/net/wireless/ath5k/initvals.c | 2 +
drivers/net/wireless/hostap/hostap_wlan.h | 5 ++-
drivers/net/wireless/iwlwifi/iwl-agn.c | 6 ++-
drivers/net/wireless/rtl8187_dev.c | 3 +
fs/namespace.c | 7 +++-
include/linux/bio.h | 7 +++
mm/hugetlb.c | 5 +-
mm/page_isolation.c | 5 +-
scripts/package/builddeb | 24 +++++++++-
29 files changed, 251 insertions(+), 112 deletions(-)


2008-11-15 05:25:33

by Greg KH

[permalink] [raw]
Subject: [patch 01/22] touch_mnt_namespace when the mount flags change

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Williams <[email protected]>

commit 0e55a7cca4b66f625d67b292f80b6a976e77c51b upstream

Daemons that need to be launched while the rootfs is read-only can now
poll /proc/mounts to be notified when their O_RDWR requests may no
longer end in EROFS.

Cc: Kay Sievers <[email protected]>
Cc: Neil Brown <[email protected]>
Signed-off-by: Dan Williams <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/namespace.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1553,8 +1553,13 @@ static noinline int do_remount(struct na
if (!err)
nd->path.mnt->mnt_flags = mnt_flags;
up_write(&sb->s_umount);
- if (!err)
+ if (!err) {
security_sb_post_remount(nd->path.mnt, flags, data);
+
+ spin_lock(&vfsmount_lock);
+ touch_mnt_namespace(nd->path.mnt->mnt_ns);
+ spin_unlock(&vfsmount_lock);
+ }
return err;
}


--

2008-11-15 05:25:50

by Greg KH

[permalink] [raw]
Subject: [patch 02/22] iwlagn: avoid sleep in softirq context

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: John W. Linville <[email protected]>

commit 964d2777438bf7687324243d38ade538d9bbfe3c upstream.

__ieee80211_tasklet_handler -> __ieee80211_rx ->
__ieee80211_rx_handle_packet -> ieee80211_invoke_rx_handlers ->
ieee80211_rx_h_decrypt -> ieee80211_crypto_tkip_decrypt ->
ieee80211_tkip_decrypt_data -> iwl4965_mac_update_tkip_key ->
iwl_scan_cancel_timeout -> msleep

Ooops!

Avoid the sleep by changing iwl_scan_cancel_timeout with
iwl_scan_cancel and simply returning on failure if the scan persists.
This will cause hardware decryption to fail and we'll handle a few more
frames with software decryption.

Signed-off-by: John W. Linville <[email protected]>
Cc: Holger Macht <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/iwlwifi/iwl-agn.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3275,7 +3275,11 @@ static void iwl4965_mac_update_tkip_key(
return;
}

- iwl_scan_cancel_timeout(priv, 100);
+ if (iwl_scan_cancel(priv)) {
+ /* cancel scan failed, just live w/ bad key and rely
+ briefly on SW decryption */
+ return;
+ }

key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);

--

2008-11-15 05:26:32

by Greg KH

[permalink] [raw]
Subject: [patch 04/22] ath5k: Fix reset sequence for AR5212 in general and RF5111 in particular

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Elias Oltmanns <[email protected]>

commit 7d19267b8d1e12c0baebf9be96e04cddffe63f67 upstream

Take care to handle register 0xa228 exactly as in the HAL released by
Atheros. This change is required to make ath5k work again on my system
since commit 2203d6be (ath5k: Misc hw_reset updates), thus fixing a
regression in 2.6.27 and therefore hopefully eligible for inclusion into
a stable release.

v2: Only overwrite initial register values on later revisions of AR5212
chips.
v3: Use standard macros to manipulate the register.

Signed-off-by: Elias Oltmanns <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/ath5k/hw.c | 22 +++++++---------------
drivers/net/wireless/ath5k/initvals.c | 2 ++
2 files changed, 9 insertions(+), 15 deletions(-)

--- a/drivers/net/wireless/ath5k/hw.c
+++ b/drivers/net/wireless/ath5k/hw.c
@@ -826,9 +826,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
mdelay(1);

/*
- * Write some more initial register settings
+ * Write some more initial register settings for revised chips
*/
- if (ah->ah_version == AR5K_AR5212) {
+ if (ah->ah_version == AR5K_AR5212 &&
+ ah->ah_phy_revision > 0x41) {
ath5k_hw_reg_write(ah, 0x0002a002, 0x982c);

if (channel->hw_value == CHANNEL_G)
@@ -847,19 +848,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
else
ath5k_hw_reg_write(ah, 0x00000000, 0x994c);

- /* Some bits are disabled here, we know nothing about
- * register 0xa228 yet, most of the times this ends up
- * with a value 0x9b5 -haven't seen any dump with
- * a different value- */
- /* Got this from decompiling binary HAL */
- data = ath5k_hw_reg_read(ah, 0xa228);
- data &= 0xfffffdff;
- ath5k_hw_reg_write(ah, data, 0xa228);
-
- data = ath5k_hw_reg_read(ah, 0xa228);
- data &= 0xfffe03ff;
- ath5k_hw_reg_write(ah, data, 0xa228);
- data = 0;
+ /* Got this from legacy-hal */
+ AR5K_REG_DISABLE_BITS(ah, 0xa228, 0x200);
+
+ AR5K_REG_MASKED_BITS(ah, 0xa228, 2 << 10, ~0x1fc00);

/* Just write 0x9b5 ? */
/* ath5k_hw_reg_write(ah, 0x000009b5, 0xa228); */
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -810,6 +810,8 @@ static const struct ath5k_ini_mode ar521
{ 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 } },
{ AR5K_PHY(642),
{ 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788, 0xd03e6788 } },
+ { 0xa228,
+ { 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5, 0x000001b5 } },
{ 0xa23c,
{ 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af, 0x13c889af } },
};

--

2008-11-15 05:26:47

by Greg KH

[permalink] [raw]
Subject: [patch 05/22] bnx2x: Removing the PMF indication when unloading

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eilon Greenstein <[email protected]>

commit 9a0354405feb0f8bd460349a93db05e4cca8d166 upstream.

When the PMF flag is set, the driver can access the HW freely. When the
driver is unloaded, it should not access the HW. The problem caused fatal
errors when "ethtool -i" was called after the calling instance was unloaded
and another instance was already loaded

Signed-off-by: Eilon Greenstein <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Cc: Alex Chiang <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/bnx2x_main.c | 2 ++
1 file changed, 2 insertions(+)

--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -6480,6 +6480,7 @@ load_int_disable:
bnx2x_free_irq(bp);
load_error:
bnx2x_free_mem(bp);
+ bp->port.pmf = 0;

/* TBD we really need to reset the chip
if we want to recover from this */
@@ -6790,6 +6791,7 @@ unload_error:
/* Report UNLOAD_DONE to MCP */
if (!BP_NOMCP(bp))
bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+ bp->port.pmf = 0;

/* Free SKBs, SGEs, TPA pool and driver internals */
bnx2x_free_skbs(bp);

--

2008-11-15 05:27:47

by Greg KH

[permalink] [raw]
Subject: [patch 08/22] ARM: 5329/1: Feroceon: fix feroceon_l2_inv_range

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nicolas Pitre <[email protected]>

commit 72bc2b1ad62f4d2f0a51b35829093d41f55accce upstream

Same fix as commit c7cf72dcadb: when 'start' and 'end' are less than a
cacheline apart and 'start' is unaligned we are done after cleaning and
invalidating the first cacheline.

Signed-off-by: Nicolas Pitre <[email protected]>
Signed-off-by: Russell King <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/arm/mm/cache-feroceon-l2.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/mm/cache-feroceon-l2.c
+++ b/arch/arm/mm/cache-feroceon-l2.c
@@ -148,7 +148,7 @@ static void feroceon_l2_inv_range(unsign
/*
* Clean and invalidate partial last cache line.
*/
- if (end & (CACHE_LINE_SIZE - 1)) {
+ if (start < end && end & (CACHE_LINE_SIZE - 1)) {
l2_clean_inv_pa(end & ~(CACHE_LINE_SIZE - 1));
end &= ~(CACHE_LINE_SIZE - 1);
}
@@ -156,7 +156,7 @@ static void feroceon_l2_inv_range(unsign
/*
* Invalidate all full cache lines between 'start' and 'end'.
*/
- while (start != end) {
+ while (start < end) {
unsigned long range_end = calc_range_end(start, end);
l2_inv_pa_range(start, range_end - CACHE_LINE_SIZE);
start = range_end;

--

2008-11-15 05:28:08

by Greg KH

[permalink] [raw]
Subject: [patch 09/22] Fix platform drivers that crash on suspend/resume

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Darrick J. Wong <[email protected]>

commit fe2d5ffc74a1de6a31e9fd65b65cce72d881edf7 upstream.

It turns out that if one registers a struct platform_device, the
platform device code expects that platform_device.device->driver points
to a struct driver inside a struct platform_driver.

This is not the case with the ipmi-si, ipmi-msghandler and ibmaem
drivers, which causes the suspend/resume hook functions to jump off into
nowhere, causing a crash. Make this assumption hold true for these
three drivers.

Signed-off-by: Darrick J. Wong <[email protected]>
Acked-by: Corey Minyard <[email protected]>
Cc: Jean Delvare <[email protected]>
Cc: Kay Sievers <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/char/ipmi/ipmi_msghandler.c | 20 +++++++++++---------
drivers/char/ipmi/ipmi_si_intf.c | 16 +++++++++-------
drivers/hwmon/ibmaem.c | 18 ++++++++++--------
3 files changed, 30 insertions(+), 24 deletions(-)

--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -422,9 +422,11 @@ struct ipmi_smi {
/**
* The driver model view of the IPMI messaging driver.
*/
-static struct device_driver ipmidriver = {
- .name = "ipmi",
- .bus = &platform_bus_type
+static struct platform_driver ipmidriver = {
+ .driver = {
+ .name = "ipmi",
+ .bus = &platform_bus_type
+ }
};
static DEFINE_MUTEX(ipmidriver_mutex);

@@ -2384,9 +2386,9 @@ static int ipmi_bmc_register(ipmi_smi_t
* representing the interfaced BMC already
*/
if (bmc->guid_set)
- old_bmc = ipmi_find_bmc_guid(&ipmidriver, bmc->guid);
+ old_bmc = ipmi_find_bmc_guid(&ipmidriver.driver, bmc->guid);
else
- old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver,
+ old_bmc = ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
bmc->id.product_id,
bmc->id.device_id);

@@ -2416,7 +2418,7 @@ static int ipmi_bmc_register(ipmi_smi_t
snprintf(name, sizeof(name),
"ipmi_bmc.%4.4x", bmc->id.product_id);

- while (ipmi_find_bmc_prod_dev_id(&ipmidriver,
+ while (ipmi_find_bmc_prod_dev_id(&ipmidriver.driver,
bmc->id.product_id,
bmc->id.device_id)) {
if (!warn_printed) {
@@ -2446,7 +2448,7 @@ static int ipmi_bmc_register(ipmi_smi_t
" Unable to allocate platform device\n");
return -ENOMEM;
}
- bmc->dev->dev.driver = &ipmidriver;
+ bmc->dev->dev.driver = &ipmidriver.driver;
dev_set_drvdata(&bmc->dev->dev, bmc);
kref_init(&bmc->refcount);

@@ -4247,7 +4249,7 @@ static int ipmi_init_msghandler(void)
if (initialized)
return 0;

- rv = driver_register(&ipmidriver);
+ rv = driver_register(&ipmidriver.driver);
if (rv) {
printk(KERN_ERR PFX "Could not register IPMI driver\n");
return rv;
@@ -4308,7 +4310,7 @@ static __exit void cleanup_ipmi(void)
remove_proc_entry(proc_ipmi_root->name, NULL);
#endif /* CONFIG_PROC_FS */

- driver_unregister(&ipmidriver);
+ driver_unregister(&ipmidriver.driver);

initialized = 0;

--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -114,9 +114,11 @@ static char *si_to_str[] = { "kcs", "smi

#define DEVICE_NAME "ipmi_si"

-static struct device_driver ipmi_driver = {
- .name = DEVICE_NAME,
- .bus = &platform_bus_type
+static struct platform_driver ipmi_driver = {
+ .driver = {
+ .name = DEVICE_NAME,
+ .bus = &platform_bus_type
+ }
};


@@ -2868,7 +2870,7 @@ static int try_smi_init(struct smi_info
goto out_err;
}
new_smi->dev = &new_smi->pdev->dev;
- new_smi->dev->driver = &ipmi_driver;
+ new_smi->dev->driver = &ipmi_driver.driver;

rv = platform_device_add(new_smi->pdev);
if (rv) {
@@ -2983,7 +2985,7 @@ static __devinit int init_ipmi_si(void)
initialized = 1;

/* Register the device drivers. */
- rv = driver_register(&ipmi_driver);
+ rv = driver_register(&ipmi_driver.driver);
if (rv) {
printk(KERN_ERR
"init_ipmi_si: Unable to register driver: %d\n",
@@ -3052,7 +3054,7 @@ static __devinit int init_ipmi_si(void)
#ifdef CONFIG_PPC_OF
of_unregister_platform_driver(&ipmi_of_platform_driver);
#endif
- driver_unregister(&ipmi_driver);
+ driver_unregister(&ipmi_driver.driver);
printk(KERN_WARNING
"ipmi_si: Unable to find any System Interface(s)\n");
return -ENODEV;
@@ -3151,7 +3153,7 @@ static __exit void cleanup_ipmi_si(void)
cleanup_one_si(e);
mutex_unlock(&smi_infos_lock);

- driver_unregister(&ipmi_driver);
+ driver_unregister(&ipmi_driver.driver);
}
module_exit(cleanup_ipmi_si);

--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -88,9 +88,11 @@
static DEFINE_IDR(aem_idr);
static DEFINE_SPINLOCK(aem_idr_lock);

-static struct device_driver aem_driver = {
- .name = DRVNAME,
- .bus = &platform_bus_type,
+static struct platform_driver aem_driver = {
+ .driver = {
+ .name = DRVNAME,
+ .bus = &platform_bus_type,
+ }
};

struct aem_ipmi_data {
@@ -583,7 +585,7 @@ static int aem_init_aem1_inst(struct aem
data->pdev = platform_device_alloc(DRVNAME, data->id);
if (!data->pdev)
goto dev_err;
- data->pdev->dev.driver = &aem_driver;
+ data->pdev->dev.driver = &aem_driver.driver;

res = platform_device_add(data->pdev);
if (res)
@@ -716,7 +718,7 @@ static int aem_init_aem2_inst(struct aem
data->pdev = platform_device_alloc(DRVNAME, data->id);
if (!data->pdev)
goto dev_err;
- data->pdev->dev.driver = &aem_driver;
+ data->pdev->dev.driver = &aem_driver.driver;

res = platform_device_add(data->pdev);
if (res)
@@ -1085,7 +1087,7 @@ static int __init aem_init(void)
{
int res;

- res = driver_register(&aem_driver);
+ res = driver_register(&aem_driver.driver);
if (res) {
printk(KERN_ERR "Can't register aem driver\n");
return res;
@@ -1097,7 +1099,7 @@ static int __init aem_init(void)
return 0;

ipmi_reg_err:
- driver_unregister(&aem_driver);
+ driver_unregister(&aem_driver.driver);
return res;

}
@@ -1107,7 +1109,7 @@ static void __exit aem_exit(void)
struct aem_data *p1, *next1;

ipmi_smi_watcher_unregister(&driver_data.bmc_events);
- driver_unregister(&aem_driver);
+ driver_unregister(&aem_driver.driver);
list_for_each_entry_safe(p1, next1, &driver_data.aem_devices, list)
aem_delete(p1);
}

--

2008-11-15 05:28:28

by Greg KH

[permalink] [raw]
Subject: [patch 10/22] hostap: pad the skb->cb usage in lieu of a proper fix

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Johannes Berg <[email protected]>

commit f7cd168645dda3e9067f24fabbfa787f9a237488 upstream.

Like mac80211 did, this driver makes 'clever' use of skb->cb to pass
information along with an skb as it is requeued from the virtual device
to the physical wireless device. Unfortunately, that trick no longer
works...

Unlike mac80211, code complexity and driver apathy makes this hack
the best option we have in the short run. Hopefully someone will
eventually be motivated to code a proper fix before all the effected
hardware dies.

(Above text by me. Johannes officially disavows all knowledge of this
hack. -- JWL)

Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/hostap/hostap_wlan.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/hostap/hostap_wlan.h
+++ b/drivers/net/wireless/hostap/hostap_wlan.h
@@ -918,9 +918,12 @@ struct hostap_interface {

/*
* TX meta data - stored in skb->cb buffer, so this must not be increased over
- * the 40-byte limit
+ * the 48-byte limit.
+ * THE PADDING THIS STARTS WITH IS A HORRIBLE HACK THAT SHOULD NOT LIVE
+ * TO SEE THE DAY.
*/
struct hostap_skb_tx_data {
+ unsigned int __padding_for_default_qdiscs;
u32 magic; /* HOSTAP_SKB_TX_DATA_MAGIC */
u8 rate; /* transmit rate */
#define HOSTAP_TX_FLAGS_WDS BIT(0)

--

2008-11-15 05:27:32

by Greg KH

[permalink] [raw]
Subject: [patch 07/22] bnx2x: Calling netif_carrier_off at the end of the probe

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eilon Greenstein <[email protected]>

commit 12b56ea89e70d4b04f2f5199750310e82894ebbd upstream.

netif_carrier_off was called too early at the probe. In case of failure
or simply bad timing, this can cause a fatal error since linkwatch_event
might run too soon.

Signed-off-by: Eilon Greenstein <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Cc: Alex Chiang <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/bnx2x_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -10205,8 +10205,6 @@ static int __devinit bnx2x_init_one(stru
return -ENOMEM;
}

- netif_carrier_off(dev);
-
bp = netdev_priv(dev);
bp->msglevel = debug;

@@ -10230,6 +10228,8 @@ static int __devinit bnx2x_init_one(stru
goto init_one_exit;
}

+ netif_carrier_off(dev);
+
bp->common.name = board_info[ent->driver_data].name;
printk(KERN_INFO "%s: %s (%c%d) PCI-E x%d %s found at mem %lx,"
" IRQ %d, ", dev->name, bp->common.name,

--

2008-11-15 05:26:14

by Greg KH

[permalink] [raw]
Subject: [patch 03/22] ath5k: fix suspend-related oops on rmmod

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Elias Oltmanns <[email protected]>

Cumulative patch backporting the following two commits from upstream:

commit 8bdd5b9c6bd53add260756b6673a0545fbdbba21 upstream
Author: Bob Copeland <[email protected]>

Based on a patch by Elias Oltmanns, we call ath5k_init in resume even
if we didn't previously open the device. Besides starting up the
device unnecessarily, this also causes an oops on rmmod because
mac80211 will not invoke ath5k_stop and softirqs are left running after
the module has been unloaded. Add a new state bit, ATH_STAT_STARTED,
to indicate that we have been started up.

commit bc1b32d6bdd2d6f3fbee9a7c01c9b099f11c579c upstream
Author: Elias Oltmanns <[email protected]>

After a s2ram / resume cycle, resetting the key cache does not work
unless it is deferred until after the hardware has been reinitialised by
a call to ath5k_hw_reset(). This fixes a regression introduced by
"ath5k: fix suspend-related oops on rmmod".

Reported-by: Toralf F?rster <[email protected]>
Signed-off-by: Elias Oltmanns <[email protected]>
Signed-off-by: Bob Copeland <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>


---
drivers/net/wireless/ath5k/base.c | 67 +++++++++++++++++++-------------------
drivers/net/wireless/ath5k/base.h | 3 +
2 files changed, 36 insertions(+), 34 deletions(-)

--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -294,9 +294,9 @@ static inline u64 ath5k_extend_tsf(struc
}

/* Interrupt handling */
-static int ath5k_init(struct ath5k_softc *sc);
+static int ath5k_init(struct ath5k_softc *sc, bool is_resume);
static int ath5k_stop_locked(struct ath5k_softc *sc);
-static int ath5k_stop_hw(struct ath5k_softc *sc);
+static int ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend);
static irqreturn_t ath5k_intr(int irq, void *dev_id);
static void ath5k_tasklet_reset(unsigned long data);

@@ -584,7 +584,7 @@ ath5k_pci_suspend(struct pci_dev *pdev,

ath5k_led_off(sc);

- ath5k_stop_hw(sc);
+ ath5k_stop_hw(sc, true);

free_irq(pdev->irq, sc);
pci_save_state(pdev);
@@ -599,8 +599,7 @@ ath5k_pci_resume(struct pci_dev *pdev)
{
struct ieee80211_hw *hw = pci_get_drvdata(pdev);
struct ath5k_softc *sc = hw->priv;
- struct ath5k_hw *ah = sc->ah;
- int i, err;
+ int err;

pci_restore_state(pdev);

@@ -621,21 +620,11 @@ ath5k_pci_resume(struct pci_dev *pdev)
goto err_no_irq;
}

- err = ath5k_init(sc);
+ err = ath5k_init(sc, true);
if (err)
goto err_irq;
ath5k_led_enable(sc);

- /*
- * Reset the key cache since some parts do not
- * reset the contents on initial power up or resume.
- *
- * FIXME: This may need to be revisited when mac80211 becomes
- * aware of suspend/resume.
- */
- for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
- ath5k_hw_reset_key(ah, i);
-
return 0;
err_irq:
free_irq(pdev->irq, sc);
@@ -657,7 +646,6 @@ ath5k_attach(struct pci_dev *pdev, struc
struct ath5k_softc *sc = hw->priv;
struct ath5k_hw *ah = sc->ah;
u8 mac[ETH_ALEN];
- unsigned int i;
int ret;

ATH5K_DBG(sc, ATH5K_DEBUG_ANY, "devid 0x%x\n", pdev->device);
@@ -676,13 +664,6 @@ ath5k_attach(struct pci_dev *pdev, struc
__set_bit(ATH_STAT_MRRETRY, sc->status);

/*
- * Reset the key cache since some parts do not
- * reset the contents on initial power up.
- */
- for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
- ath5k_hw_reset_key(ah, i);
-
- /*
* Collect the channel list. The 802.11 layer
* is resposible for filtering this list based
* on settings like the phy mode and regulatory
@@ -2197,12 +2178,18 @@ ath5k_beacon_config(struct ath5k_softc *
\********************/

static int
-ath5k_init(struct ath5k_softc *sc)
+ath5k_init(struct ath5k_softc *sc, bool is_resume)
{
- int ret;
+ struct ath5k_hw *ah = sc->ah;
+ int ret, i;

mutex_lock(&sc->lock);

+ if (is_resume && !test_bit(ATH_STAT_STARTED, sc->status))
+ goto out_ok;
+
+ __clear_bit(ATH_STAT_STARTED, sc->status);
+
ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mode %d\n", sc->opmode);

/*
@@ -2220,7 +2207,7 @@ ath5k_init(struct ath5k_softc *sc)
*/
sc->curchan = sc->hw->conf.channel;
sc->curband = &sc->sbands[sc->curchan->band];
- ret = ath5k_hw_reset(sc->ah, sc->opmode, sc->curchan, false);
+ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, false);
if (ret) {
ATH5K_ERR(sc, "unable to reset hardware: %d\n", ret);
goto done;
@@ -2229,7 +2216,14 @@ ath5k_init(struct ath5k_softc *sc)
* This is needed only to setup initial state
* but it's best done after a reset.
*/
- ath5k_hw_set_txpower_limit(sc->ah, 0);
+ ath5k_hw_set_txpower_limit(ah, 0);
+
+ /*
+ * Reset the key cache since some parts do not reset the
+ * contents on initial power up or resume from suspend.
+ */
+ for (i = 0; i < AR5K_KEYTABLE_SIZE; i++)
+ ath5k_hw_reset_key(ah, i);

/*
* Setup the hardware after reset: the key cache
@@ -2249,13 +2243,17 @@ ath5k_init(struct ath5k_softc *sc)
AR5K_INT_RXORN | AR5K_INT_FATAL | AR5K_INT_GLOBAL |
AR5K_INT_MIB;

- ath5k_hw_set_intr(sc->ah, sc->imask);
+ ath5k_hw_set_intr(ah, sc->imask);
+
+ __set_bit(ATH_STAT_STARTED, sc->status);
+
/* Set ack to be sent at low bit-rates */
- ath5k_hw_set_ack_bitrate_high(sc->ah, false);
+ ath5k_hw_set_ack_bitrate_high(ah, false);

mod_timer(&sc->calib_tim, round_jiffies(jiffies +
msecs_to_jiffies(ath5k_calinterval * 1000)));

+out_ok:
ret = 0;
done:
mmiowb();
@@ -2310,7 +2308,7 @@ ath5k_stop_locked(struct ath5k_softc *sc
* stop is preempted).
*/
static int
-ath5k_stop_hw(struct ath5k_softc *sc)
+ath5k_stop_hw(struct ath5k_softc *sc, bool is_suspend)
{
int ret;

@@ -2341,6 +2339,9 @@ ath5k_stop_hw(struct ath5k_softc *sc)
}
}
ath5k_txbuf_free(sc, sc->bbuf);
+ if (!is_suspend)
+ __clear_bit(ATH_STAT_STARTED, sc->status);
+
mmiowb();
mutex_unlock(&sc->lock);

@@ -2719,12 +2720,12 @@ err:

static int ath5k_start(struct ieee80211_hw *hw)
{
- return ath5k_init(hw->priv);
+ return ath5k_init(hw->priv, false);
}

static void ath5k_stop(struct ieee80211_hw *hw)
{
- ath5k_stop_hw(hw->priv);
+ ath5k_stop_hw(hw->priv, false);
}

static int ath5k_add_interface(struct ieee80211_hw *hw,
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -132,11 +132,12 @@ struct ath5k_softc {
size_t desc_len; /* size of TX/RX descriptors */
u16 cachelsz; /* cache line size */

- DECLARE_BITMAP(status, 4);
+ DECLARE_BITMAP(status, 5);
#define ATH_STAT_INVALID 0 /* disable hardware accesses */
#define ATH_STAT_MRRETRY 1 /* multi-rate retry support */
#define ATH_STAT_PROMISC 2
#define ATH_STAT_LEDSOFT 3 /* enable LED gpio status */
+#define ATH_STAT_STARTED 4 /* opened & irqs enabled */

unsigned int filter_flags; /* HW flags, AR5K_RX_FILTER_* */
unsigned int curmode; /* current phy mode */

--

2008-11-15 05:27:03

by Greg KH

[permalink] [raw]
Subject: [patch 06/22] bnx2x: PCI configuration bug on big-endian

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eilon Greenstein <[email protected]>

commit 7d96567ac0527703cf1b80043fc0ebd7f21a10ad upstream.

The current code read nothing but zeros on big-endian (wrong part of the
32bits). This caused poor performance on big-endian machines. Though this
issue did not cause the system to crash, the performance is significantly
better with the fix so I view it as critical bug fix.

Signed-off-by: Eilon Greenstein <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Cc: Alex Chiang <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/bnx2x_init.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/net/bnx2x_init.h
+++ b/drivers/net/bnx2x_init.h
@@ -564,14 +564,15 @@ static const struct arb_line write_arb_a

static void bnx2x_init_pxp(struct bnx2x *bp)
{
+ u16 devctl;
int r_order, w_order;
u32 val, i;

pci_read_config_word(bp->pdev,
- bp->pcie_cap + PCI_EXP_DEVCTL, (u16 *)&val);
- DP(NETIF_MSG_HW, "read 0x%x from devctl\n", (u16)val);
- w_order = ((val & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
- r_order = ((val & PCI_EXP_DEVCTL_READRQ) >> 12);
+ bp->pcie_cap + PCI_EXP_DEVCTL, &devctl);
+ DP(NETIF_MSG_HW, "read 0x%x from devctl\n", devctl);
+ w_order = ((devctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
+ r_order = ((devctl & PCI_EXP_DEVCTL_READRQ) >> 12);

if (r_order > MAX_RD_ORD) {
DP(NETIF_MSG_HW, "read order of %d order adjusted to %d\n",

--

2008-11-15 05:28:47

by Greg KH

[permalink] [raw]
Subject: [patch 13/22] hugetlb: make unmap_ref_private multi-size-aware

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Adam Litke <[email protected]>

commit 7526674de0c921e7f1e9b6f71a1f9d832557b554 upstream.

Oops. Part of the hugetlb private reservation code was not fully
converted to use hstates.

When a huge page must be unmapped from VMAs due to a failed COW,
HPAGE_SIZE is used in the call to unmap_hugepage_range() regardless of
the page size being used. This works if the VMA is using the default
huge page size. Otherwise we might unmap too much, too little, or
trigger a BUG_ON. Rare but serious -- fix it.

Signed-off-by: Adam Litke <[email protected]>
Cc: Jon Tollefson <[email protected]>
Cc: Mel Gorman <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
mm/hugetlb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1797,6 +1797,7 @@ int unmap_ref_private(struct mm_struct *
struct page *page,
unsigned long address)
{
+ struct hstate *h = hstate_vma(vma);
struct vm_area_struct *iter_vma;
struct address_space *mapping;
struct prio_tree_iter iter;
@@ -1806,7 +1807,7 @@ int unmap_ref_private(struct mm_struct *
* vm_pgoff is in PAGE_SIZE units, hence the different calculation
* from page cache lookup which is in HPAGE_SIZE units.
*/
- address = address & huge_page_mask(hstate_vma(vma));
+ address = address & huge_page_mask(h);
pgoff = ((address - vma->vm_start) >> PAGE_SHIFT)
+ (vma->vm_pgoff >> PAGE_SHIFT);
mapping = (struct address_space *)page_private(page);
@@ -1825,7 +1826,7 @@ int unmap_ref_private(struct mm_struct *
*/
if (!is_vma_resv_set(iter_vma, HPAGE_RESV_OWNER))
unmap_hugepage_range(iter_vma,
- address, address + HPAGE_SIZE,
+ address, address + huge_page_size(h),
page);
}


--

2008-11-15 05:29:08

by Greg KH

[permalink] [raw]
Subject: [patch 12/22] ACPI: EC: make kernel messages more useful when GPE storm is detected

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Jenkins <[email protected]>

commit f8248434e6a11d7cd314281be3b39bbcf82fc243 upstream.

Make sure we can tell if the GPE storm workaround gets activated,
and avoid flooding the logs afterwards.

http://bugzilla.kernel.org/show_bug.cgi?id=11841
"plenty of line "ACPI: EC: non-query interrupt received,
switching to interrupt mode" in dmesg"

Signed-off-by: Alan Jenkins <[email protected]>
Acked-by: Alexey Starikovskiy <[email protected]>
Signed-off-by: Len Brown <[email protected]>
Cc: Rafael J. Wysocki <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/acpi/ec.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -286,7 +286,8 @@ static int acpi_ec_transaction_unlocked(
acpi_enable_gpe(NULL, ec->gpe, ACPI_NOT_ISR);
} else if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
t->irq_count > ACPI_EC_STORM_THRESHOLD) {
- pr_debug(PREFIX "GPE storm detected\n");
+ pr_info(PREFIX "GPE storm detected, "
+ "transactions will use polling mode\n");
set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
}
return ret;
@@ -566,9 +567,15 @@ static u32 acpi_ec_gpe_handler(void *dat
if (!test_bit(EC_FLAGS_GPE_MODE, &ec->flags) &&
!test_bit(EC_FLAGS_NO_GPE, &ec->flags)) {
/* this is non-query, must be confirmation */
- if (printk_ratelimit())
- pr_info(PREFIX "non-query interrupt received,"
+ if (!test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
+ if (printk_ratelimit())
+ pr_info(PREFIX "non-query interrupt received,"
+ " switching to interrupt mode\n");
+ } else {
+ /* hush, STORM switches the mode every transaction */
+ pr_debug(PREFIX "non-query interrupt received,"
" switching to interrupt mode\n");
+ }
set_bit(EC_FLAGS_GPE_MODE, &ec->flags);
}
return ACPI_INTERRUPT_HANDLED;

--

2008-11-15 05:29:27

by Greg KH

[permalink] [raw]
Subject: [patch 11/22] ACPI: avoid empty file name in sysfs

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Peter Gruber <[email protected]>

commit 4feba70a2c1a1a0c96909f657f48b2e11e682370 upstream.

Since commit bc45b1d39a925b56796bebf8a397a0491489d85c acpi tables are
allowed to have an empty signature and /sys/firmware/acpi/tables uses the
signature as filename. Applications using naive recursion through /sys
loop forever. A possible solution would be: (replacing the zero length
filename with the string "NULL")

http://bugzilla.kernel.org/show_bug.cgi?id=11539

Acked-by: Zhang Rui <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Len Brown <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/acpi/system.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)

--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -78,9 +78,15 @@ static ssize_t acpi_table_show(struct ko
container_of(bin_attr, struct acpi_table_attr, attr);
struct acpi_table_header *table_header = NULL;
acpi_status status;
+ char name[ACPI_NAME_SIZE];
+
+ if (strncmp(table_attr->name, "NULL", 4))
+ memcpy(name, table_attr->name, ACPI_NAME_SIZE);
+ else
+ memcpy(name, "\0\0\0\0", 4);

status =
- acpi_get_table(table_attr->name, table_attr->instance,
+ acpi_get_table(name, table_attr->instance,
&table_header);
if (ACPI_FAILURE(status))
return -ENODEV;
@@ -95,21 +101,24 @@ static void acpi_table_attr_init(struct
struct acpi_table_header *header = NULL;
struct acpi_table_attr *attr = NULL;

- memcpy(table_attr->name, table_header->signature, ACPI_NAME_SIZE);
+ if (table_header->signature[0] != '\0')
+ memcpy(table_attr->name, table_header->signature,
+ ACPI_NAME_SIZE);
+ else
+ memcpy(table_attr->name, "NULL", 4);

list_for_each_entry(attr, &acpi_table_attr_list, node) {
- if (!memcmp(table_header->signature, attr->name,
- ACPI_NAME_SIZE))
+ if (!memcmp(table_attr->name, attr->name, ACPI_NAME_SIZE))
if (table_attr->instance < attr->instance)
table_attr->instance = attr->instance;
}
table_attr->instance++;

if (table_attr->instance > 1 || (table_attr->instance == 1 &&
- !acpi_get_table(table_header->
- signature, 2,
- &header)))
- sprintf(table_attr->name + 4, "%d", table_attr->instance);
+ !acpi_get_table
+ (table_header->signature, 2, &header)))
+ sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
+ table_attr->instance);

table_attr->attr.size = 0;
table_attr->attr.read = acpi_table_show;

--

2008-11-15 05:29:58

by Greg KH

[permalink] [raw]
Subject: [patch 14/22] rtl8187: Add Abocom USB ID

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ivan Kuten <[email protected]>

commit 8f7c41d4cec91cdbfa89b4a77d5a628938875366 upstream.

Signed-off-by: Ivan Kuten <[email protected]>
Signed-off-by: Larry Finger <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/rtl8187_dev.c | 2 ++
1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -45,6 +45,8 @@ static struct usb_device_id rtl8187_tabl
{USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
/* Sitecom */
{USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
+ /* Abocom */
+ {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
{}
};


--

2008-11-15 05:29:45

by Greg KH

[permalink] [raw]
Subject: [patch 15/22] rtl8187 : support for Sitecom WL-168 0001 v4

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Bob Jolliffe <[email protected]>

commit f3c769185a28b7947d97b3552a977102c1fac3f2 upstream.

the Sitecom 0001 v4 with product id 0x0df6:0028, uses Realtek's
RTL8187B and work fine with new 2.6.27 driver.

Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/wireless/rtl8187_dev.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -45,6 +45,7 @@ static struct usb_device_id rtl8187_tabl
{USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
/* Sitecom */
{USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
+ {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
/* Abocom */
{USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
{}

--

2008-11-15 05:30:33

by Greg KH

[permalink] [raw]
Subject: [patch 16/22] kbuild: Fixup deb-pkg target to generate separate firmware deb

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jonathan McDowell <[email protected]>

commit bf1b36445dc868cbbde194aa1dd87e38fe24cf16 upstream.

The below is a simplistic fix for "make deb-pkg"; it splits the
firmware out to a linux-firmware-image package and adds an
(unversioned) Suggests to the linux package for this firmware.

Signed-Off-By: Jonathan McDowell <[email protected]>
Acked-by: Frans Pop <[email protected]>
Signed-off-by: Sam Ravnborg <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
scripts/package/builddeb | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)

--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -15,15 +15,18 @@ set -e
version=$KERNELRELEASE
revision=`cat .version`
tmpdir="$objtree/debian/tmp"
+fwdir="$objtree/debian/fwtmp"
packagename=linux-$version
+fwpackagename=linux-firmware-image

if [ "$ARCH" == "um" ] ; then
packagename=user-mode-linux-$version
fi

# Setup the directory structure
-rm -rf "$tmpdir"
+rm -rf "$tmpdir" "$fwdir"
mkdir -p "$tmpdir/DEBIAN" "$tmpdir/lib" "$tmpdir/boot"
+mkdir -p "$fwdir/DEBIAN" "$fwdir/lib"
if [ "$ARCH" == "um" ] ; then
mkdir -p "$tmpdir/usr/lib/uml/modules/$version" "$tmpdir/usr/share/doc/$packagename" "$tmpdir/usr/bin"
fi
@@ -107,6 +110,7 @@ Standards-Version: 3.6.1

Package: $packagename
Provides: kernel-image-$version, linux-image-$version
+Suggests: $fwpackagename
Architecture: any
Description: Linux kernel, version $version
This package contains the Linux kernel, modules and corresponding other
@@ -118,8 +122,24 @@ fi
chown -R root:root "$tmpdir"
chmod -R go-w "$tmpdir"

+# Do we have firmware? Move it out of the way and build it into a package.
+if [ -e "$tmpdir/lib/firmware" ]; then
+ mv "$tmpdir/lib/firmware" "$fwdir/lib/"
+
+ cat <<EOF >> debian/control
+
+Package: $fwpackagename
+Architecture: all
+Description: Linux kernel firmware, version $version
+ This package contains firmware from the Linux kernel, version $version
+EOF
+
+ dpkg-gencontrol -isp -p$fwpackagename -P"$fwdir"
+ dpkg --build "$fwdir" ..
+fi
+
# Perform the final magic
-dpkg-gencontrol -isp
+dpkg-gencontrol -isp -p$packagename
dpkg --build "$tmpdir" ..

exit 0

--

2008-11-15 05:30:51

by Greg KH

[permalink] [raw]
Subject: [patch 17/22] block: fix nr_phys_segments miscalculation bug

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: FUJITA Tomonori <[email protected]>

commit 8677142710516d986d932d6f1fba7be8382c1fec upstream
backported by Nikanth Karthikesan <[email protected]> to the 2.6.27.y tree.

block: fix nr_phys_segments miscalculation bug

This fixes the bug reported by Nikanth Karthikesan <[email protected]>:

http://lkml.org/lkml/2008/10/2/203

The root cause of the bug is that blk_phys_contig_segment
miscalculates q->max_segment_size.

blk_phys_contig_segment checks:

req->biotail->bi_size + next_req->bio->bi_size > q->max_segment_size

But blk_recalc_rq_segments might expect that req->biotail and the
previous bio in the req are supposed be merged into one
segment. blk_recalc_rq_segments might also expect that next_req->bio
and the next bio in the next_req are supposed be merged into one
segment. In such case, we merge two requests that can't be merged
here. Later, blk_rq_map_sg gives more segments than it should.

We need to keep track of segment size in blk_recalc_rq_segments and
use it to see if two requests can be merged. This patch implements it
in the similar way that we used to do for hw merging (virtual
merging).

Signed-off-by: FUJITA Tomonori <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
Cc: Nikanth Karthikesan <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
block/blk-merge.c | 19 +++++++++++++++++--
include/linux/bio.h | 7 +++++++
2 files changed, 24 insertions(+), 2 deletions(-)

--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -95,6 +95,9 @@ new_hw_segment:
nr_hw_segs++;
}

+ if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
+ rq->bio->bi_seg_front_size = seg_size;
+
nr_phys_segs++;
bvprv = bv;
seg_size = bv->bv_len;
@@ -106,6 +109,10 @@ new_hw_segment:
rq->bio->bi_hw_front_size = hw_seg_size;
if (hw_seg_size > rq->biotail->bi_hw_back_size)
rq->biotail->bi_hw_back_size = hw_seg_size;
+ if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
+ rq->bio->bi_seg_front_size = seg_size;
+ if (seg_size > rq->biotail->bi_seg_back_size)
+ rq->biotail->bi_seg_back_size = seg_size;
rq->nr_phys_segments = nr_phys_segs;
rq->nr_hw_segments = nr_hw_segs;
}
@@ -133,7 +140,8 @@ static int blk_phys_contig_segment(struc

if (!BIOVEC_PHYS_MERGEABLE(__BVEC_END(bio), __BVEC_START(nxt)))
return 0;
- if (bio->bi_size + nxt->bi_size > q->max_segment_size)
+ if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
+ q->max_segment_size)
return 0;

/*
@@ -377,6 +385,8 @@ static int ll_merge_requests_fn(struct r
{
int total_phys_segments;
int total_hw_segments;
+ unsigned int seg_size =
+ req->biotail->bi_seg_back_size + next->bio->bi_seg_front_size;

/*
* First check if the either of the requests are re-queued
@@ -392,8 +402,13 @@ static int ll_merge_requests_fn(struct r
return 0;

total_phys_segments = req->nr_phys_segments + next->nr_phys_segments;
- if (blk_phys_contig_segment(q, req->biotail, next->bio))
+ if (blk_phys_contig_segment(q, req->biotail, next->bio)) {
+ if (req->nr_phys_segments == 1)
+ req->bio->bi_seg_front_size = seg_size;
+ if (next->nr_phys_segments == 1)
+ next->biotail->bi_seg_back_size = seg_size;
total_phys_segments--;
+ }

if (total_phys_segments > q->max_phys_segments)
return 0;
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -98,6 +98,13 @@ struct bio {
unsigned int bi_size; /* residual I/O count */

/*
+ * To keep track of the max segment size, we account for the
+ * sizes of the first and last mergeable segments in this bio.
+ */
+ unsigned int bi_seg_front_size;
+ unsigned int bi_seg_back_size;
+
+ /*
* To keep track of the max hw size, we account for the
* sizes of the first and last virtually mergeable segments
* in this bio

--

2008-11-15 05:31:17

by Greg KH

[permalink] [raw]
Subject: [patch 18/22] powerpc/mpic: Fix regression caused by change of default IRQ affinity

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kumar Gala <[email protected]>

commit 3c10c9c45e290022ca7d2aa1ad33a0b6ed767520 upstream.

The Freescale implementation of MPIC only allows a single CPU destination
for non-IPI interrupts. We add a flag to the mpic_init to distinquish
these variants of MPIC. We pull in the irq_choose_cpu from sparc64 to
select a single CPU as the destination of the interrupt.

This is to deal with the fact that the default smp affinity was
changed by commit 18404756765c713a0be4eb1082920c04822ce588 ("genirq
Expose default irq affinity mask (take 3)") to be all CPUs.

Signed-off-by: Kumar Gala <[email protected]>
Signed-off-by: Paul Mackerras <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
arch/powerpc/include/asm/mpic.h | 2 +
arch/powerpc/platforms/85xx/mpc85xx_ds.c | 3 +
arch/powerpc/platforms/86xx/pic.c | 3 +
arch/powerpc/sysdev/mpic.c | 59 ++++++++++++++++++++++++++++---
4 files changed, 61 insertions(+), 6 deletions(-)

--- a/arch/powerpc/include/asm/mpic.h
+++ b/arch/powerpc/include/asm/mpic.h
@@ -355,6 +355,8 @@ struct mpic
#define MPIC_NO_BIAS 0x00000400
/* Ignore NIRQS as reported by FRR */
#define MPIC_BROKEN_FRR_NIRQS 0x00000800
+/* Destination only supports a single CPU at a time */
+#define MPIC_SINGLE_DEST_CPU 0x00001000

/* MPIC HW modification ID */
#define MPIC_REGSET_MASK 0xf0000000
--- a/arch/powerpc/platforms/85xx/mpc85xx_ds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_ds.c
@@ -78,7 +78,8 @@ void __init mpc85xx_ds_pic_init(void)

mpic = mpic_alloc(np, r.start,
MPIC_PRIMARY | MPIC_WANTS_RESET |
- MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS,
+ MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS |
+ MPIC_SINGLE_DEST_CPU,
0, 256, " OpenPIC ");
BUG_ON(mpic == NULL);
of_node_put(np);
--- a/arch/powerpc/platforms/86xx/pic.c
+++ b/arch/powerpc/platforms/86xx/pic.c
@@ -44,7 +44,8 @@ void __init mpc86xx_init_irq(void)

mpic = mpic_alloc(np, res.start,
MPIC_PRIMARY | MPIC_WANTS_RESET |
- MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS,
+ MPIC_BIG_ENDIAN | MPIC_BROKEN_FRR_NIRQS |
+ MPIC_SINGLE_DEST_CPU,
0, 256, " MPIC ");
of_node_put(np);
BUG_ON(mpic == NULL);
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -563,6 +563,51 @@ static void __init mpic_scan_ht_pics(str

#endif /* CONFIG_MPIC_U3_HT_IRQS */

+#ifdef CONFIG_SMP
+static int irq_choose_cpu(unsigned int virt_irq)
+{
+ cpumask_t mask = irq_desc[virt_irq].affinity;
+ int cpuid;
+
+ if (cpus_equal(mask, CPU_MASK_ALL)) {
+ static int irq_rover;
+ static DEFINE_SPINLOCK(irq_rover_lock);
+ unsigned long flags;
+
+ /* Round-robin distribution... */
+ do_round_robin
+ spin_lock_irqsave(&irq_rover_lock, flags);
+
+ while (!cpu_online(irq_rover)) {
+ if (++irq_rover >= NR_CPUS)
+ irq_rover = 0;
+ }
+ cpuid = irq_rover;
+ do {
+ if (++irq_rover >= NR_CPUS)
+ irq_rover = 0;
+ } while (!cpu_online(irq_rover));
+
+ spin_unlock_irqrestore(&irq_rover_lock, flags);
+ } else {
+ cpumask_t tmp;
+
+ cpus_and(tmp, cpu_online_map, mask);
+
+ if (cpus_empty(tmp))
+ goto do_round_robin;
+
+ cpuid = first_cpu(tmp);
+ }
+
+ return cpuid;
+}
+#else
+static int irq_choose_cpu(unsigned int virt_irq)
+{
+ return hard_smp_processor_id();
+}
+#endif

#define mpic_irq_to_hw(virq) ((unsigned int)irq_map[virq].hwirq)

@@ -777,12 +822,18 @@ void mpic_set_affinity(unsigned int irq,
struct mpic *mpic = mpic_from_irq(irq);
unsigned int src = mpic_irq_to_hw(irq);

- cpumask_t tmp;
+ if (mpic->flags & MPIC_SINGLE_DEST_CPU) {
+ int cpuid = irq_choose_cpu(irq);
+
+ mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION), 1 << cpuid);
+ } else {
+ cpumask_t tmp;

- cpus_and(tmp, cpumask, cpu_online_map);
+ cpus_and(tmp, cpumask, cpu_online_map);

- mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION),
- mpic_physmask(cpus_addr(tmp)[0]));
+ mpic_irq_write(src, MPIC_INFO(IRQ_DESTINATION),
+ mpic_physmask(cpus_addr(tmp)[0]));
+ }
}

static unsigned int mpic_type_to_vecpri(struct mpic *mpic, unsigned int type)

--

2008-11-15 05:31:40

by Greg KH

[permalink] [raw]
Subject: [patch 19/22] Input: ALPS - add signature for DualPoint found in Dell Latitude E6500

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Elvis Pranskevichus <[email protected]>

commit 0d46ed1c747edfe6476961d4d9f732ceb7a29074 upstream.

Signed-off-by: Elvis Pranskevichus <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/input/mouse/alps.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -54,6 +54,7 @@ static const struct alps_model_info alps
{ { 0x20, 0x02, 0x0e }, 0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* XXX */
{ { 0x22, 0x02, 0x0a }, 0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT },
{ { 0x22, 0x02, 0x14 }, 0xff, 0xff, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude D600 */
+ { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude E6500 */
{ { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FW_BK_1 } /* Dell Vostro 1400 */
};


--

2008-11-15 05:31:55

by Greg KH

[permalink] [raw]
Subject: [patch 20/22] memory hotplug: fix page_zone() calculation in test_pages_isolated()

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Gerald Schaefer <[email protected]>

commit a70dcb969f64e2fa98c24f47854f20bf02ff0092 upstream.

My last bugfix here (adding zone->lock) introduced a new problem: Using
page_zone(pfn_to_page(pfn)) to get the zone after the for() loop is wrong.
pfn will then be >= end_pfn, which may be in a different zone or not
present at all. This may lead to an addressing exception in page_zone()
or spin_lock_irqsave().

Now I use __first_valid_page() again after the loop to find a valid page
for page_zone().

Signed-off-by: Gerald Schaefer <[email protected]>
Acked-by: Nathan Fontenot <[email protected]>
Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
mm/page_isolation.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -130,10 +130,11 @@ int test_pages_isolated(unsigned long st
if (page && get_pageblock_migratetype(page) != MIGRATE_ISOLATE)
break;
}
- if (pfn < end_pfn)
+ page = __first_valid_page(start_pfn, end_pfn - start_pfn);
+ if ((pfn < end_pfn) || !page)
return -EBUSY;
/* Check all pages are free or Marked as ISOLATED */
- zone = page_zone(pfn_to_page(pfn));
+ zone = page_zone(page);
spin_lock_irqsave(&zone->lock, flags);
ret = __test_page_isolated_in_pageblock(start_pfn, end_pfn);
spin_unlock_irqrestore(&zone->lock, flags);

--

2008-11-15 05:32:22

by Greg KH

[permalink] [raw]
Subject: [patch 21/22] r8169: select MII in Kconfig

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Francois Romieu <[email protected]>

commit b73724921d906d1642f9f6d054079c6b095903fe upstream.

drivers/built-in.o: In function `rtl8169_gset_xmii':
r8169.c:(.text+0x82259): undefined reference to `mii_ethtool_gset'

Signed-off-by: Hugh Dickins <[email protected]>
Acked-by: Francois Romieu <[email protected]>
Cc: Edward Hsu <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/Kconfig | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2046,6 +2046,7 @@ config R8169
tristate "Realtek 8169 gigabit ethernet support"
depends on PCI
select CRC32
+ select MII
---help---
Say Y here if you have a Realtek 8169 PCI Gigabit Ethernet adapter.


--

2008-11-15 05:32:39

by Greg KH

[permalink] [raw]
Subject: [patch 22/22] sony-laptop: ignore missing _DIS method on pic device

2.6.27-stable review patch. If anyone has any objections, please let us know.

------------------

From: Matthew Garrett <[email protected]>

commit 6158d3a2323835546c7cf83a170316fa77b726e0 upstream.

At least the Vaio VGN-Z540N doesn't have this method, so let's not fail
to suspend just because it doesn't exist.

Signed-off-by: Adam Jackson <[email protected]>
Acked-by: Mattia Dongili <[email protected]>
Cc: Len Brown <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Cc: Steve Conklin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>


---
drivers/misc/sony-laptop.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/misc/sony-laptop.c
+++ b/drivers/misc/sony-laptop.c
@@ -2315,8 +2315,10 @@ end:
*/
static int sony_pic_disable(struct acpi_device *device)
{
- if (ACPI_FAILURE(acpi_evaluate_object(device->handle,
- "_DIS", NULL, NULL)))
+ acpi_status ret = acpi_evaluate_object(device->handle, "_DIS", NULL,
+ NULL);
+
+ if (ACPI_FAILURE(ret) && ret != AE_NOT_FOUND)
return -ENXIO;

dprintk("Device disabled\n");

--

2008-11-16 10:43:40

by François Valenduc

[permalink] [raw]
Subject: Re: [patch 00/22] 2.6.27.7-stable review

Greg KH a ?crit :
> This is the start of the stable review cycle for the 2.6.27.7 release.
> There are 22 patches in this series, all will be posted as a response to
> this one. If anyone has any issues with these being applied, please let
> us know. If anyone is a maintainer of the proper subsystem, and wants
> to add a Signed-off-by: line to the patch, please respond with it.
>
> These patches are sent out with a number of different people on the Cc:
> line. If you wish to be a reviewer, please email [email protected] to
> add your name to the list. If you want to be off the reviewer list,
> also email us.
>
> Responses should be made by Monday, Nov 17, 2008, 06:00:00 UTC.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.7-rc1.gz
> and the diffstat can be found below.
>
>
> thanks,
>
> greg k-h
>
> Makefile | 2 +-
> arch/arm/mm/cache-feroceon-l2.c | 4 +-
> arch/powerpc/include/asm/mpic.h | 2 +
> arch/powerpc/platforms/85xx/mpc85xx_ds.c | 3 +-
> arch/powerpc/platforms/86xx/pic.c | 3 +-
> arch/powerpc/sysdev/mpic.c | 59 +++++++++++++++++++++++--
> block/blk-merge.c | 19 +++++++-
> drivers/acpi/ec.c | 13 ++++-
> drivers/acpi/system.c | 25 +++++++---
> drivers/char/ipmi/ipmi_msghandler.c | 20 +++++----
> drivers/char/ipmi/ipmi_si_intf.c | 16 ++++---
> drivers/hwmon/ibmaem.c | 18 ++++---
> drivers/input/mouse/alps.c | 1 +
> drivers/misc/sony-laptop.c | 6 ++-
> drivers/net/Kconfig | 1 +
> drivers/net/bnx2x_init.h | 9 ++--
> drivers/net/bnx2x_main.c | 6 ++-
> drivers/net/wireless/ath5k/base.c | 67 +++++++++++++++--------------
> drivers/net/wireless/ath5k/base.h | 3 +-
> drivers/net/wireless/ath5k/hw.c | 22 +++------
> drivers/net/wireless/ath5k/initvals.c | 2 +
> drivers/net/wireless/hostap/hostap_wlan.h | 5 ++-
> drivers/net/wireless/iwlwifi/iwl-agn.c | 6 ++-
> drivers/net/wireless/rtl8187_dev.c | 3 +
> fs/namespace.c | 7 +++-
> include/linux/bio.h | 7 +++
> mm/hugetlb.c | 5 +-
> mm/page_isolation.c | 5 +-
> scripts/package/builddeb | 24 +++++++++-
> 29 files changed, 251 insertions(+), 112 deletions(-)

Is it possible to add other EC related patches recently merged in the
mainline tree. These are the following:
ACPI: EC: revert msleep patch
ACPI: EC: wait for last write gpe
ACPI: EC: restart failed command
ACPI: EC: lower interrupt storm treshold
ACPI: EC: Don't do transaction from GPE handler in poll mode.

All these patches apply without any problem on the 2.7.26 kernel. Theses
patches solves bugs #12004, #11841 and #11994. In particular, the first
one allows my computer to power down, which was not possible when the
following commit was merged in the 2.6.27.5 kernel:

ACPI: EC: do transaction from interrupt context

commit 7c6db4e050601f359081fde418ca6dc4fc2d0011 upstream.

It is easier and faster to do transaction directly from interrupt
context rather than waking control thread.:


Thanks.

Fran?ois Valenduc