--- /dev/null
+From bf6932f44a7b3fa7e2246a8b18a44670e5eab6c2 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Sat, 21 Jul 2012 08:55:18 +0100
+Subject: iscsi-target: Drop bogus struct file usage for iSCSI/SCTP
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+commit bf6932f44a7b3fa7e2246a8b18a44670e5eab6c2 upstream.
+
+From Al Viro:
+
+ BTW, speaking of struct file treatment related to sockets -
+ there's this piece of code in iscsi:
+ /*
+ * The SCTP stack needs struct socket->file.
+ */
+ if ((np->np_network_transport == ISCSI_SCTP_TCP) ||
+ (np->np_network_transport == ISCSI_SCTP_UDP)) {
+ if (!new_sock->file) {
+ new_sock->file = kzalloc(
+ sizeof(struct file), GFP_KERNEL);
+
+For one thing, as far as I can see it'not true - sctp does *not* depend on
+socket->file being non-NULL; it does, in one place, check socket->file->f_flags
+for O_NONBLOCK, but there it treats NULL socket->file as "flag not set".
+Which is the case here anyway - the fake struct file created in
+__iscsi_target_login_thread() (and in iscsi_target_setup_login_socket(), with
+the same excuse) do *not* get that flag set.
+
+Moreover, it's a bloody serious violation of a bunch of asserts in VFS;
+all struct file instances should come from filp_cachep, via get_empty_filp()
+(or alloc_file(), which is a wrapper for it). FWIW, I'm very tempted to
+do this and be done with the entire mess:
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Andy Grover <agrover@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 22 +----------
+ drivers/target/iscsi/iscsi_target_core.h | 2 -
+ drivers/target/iscsi/iscsi_target_login.c | 60 +-----------------------------
+ 3 files changed, 6 insertions(+), 78 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -427,19 +427,8 @@ int iscsit_reset_np_thread(
+
+ int iscsit_del_np_comm(struct iscsi_np *np)
+ {
+- if (!np->np_socket)
+- return 0;
+-
+- /*
+- * Some network transports allocate their own struct sock->file,
+- * see if we need to free any additional allocated resources.
+- */
+- if (np->np_flags & NPF_SCTP_STRUCT_FILE) {
+- kfree(np->np_socket->file);
+- np->np_socket->file = NULL;
+- }
+-
+- sock_release(np->np_socket);
++ if (np->np_socket)
++ sock_release(np->np_socket);
+ return 0;
+ }
+
+@@ -4094,13 +4083,8 @@ int iscsit_close_connection(
+ kfree(conn->conn_ops);
+ conn->conn_ops = NULL;
+
+- if (conn->sock) {
+- if (conn->conn_flags & CONNFLAG_SCTP_STRUCT_FILE) {
+- kfree(conn->sock->file);
+- conn->sock->file = NULL;
+- }
++ if (conn->sock)
+ sock_release(conn->sock);
+- }
+ conn->thread_set = NULL;
+
+ pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -224,7 +224,6 @@ enum iscsi_timer_flags_table {
+ /* Used for struct iscsi_np->np_flags */
+ enum np_flags_table {
+ NPF_IP_NETWORK = 0x00,
+- NPF_SCTP_STRUCT_FILE = 0x01 /* Bugfix */
+ };
+
+ /* Used for struct iscsi_np->np_thread_state */
+@@ -511,7 +510,6 @@ struct iscsi_conn {
+ u16 local_port;
+ int net_size;
+ u32 auth_id;
+-#define CONNFLAG_SCTP_STRUCT_FILE 0x01
+ u32 conn_flags;
+ /* Used for iscsi_tx_login_rsp() */
+ u32 login_itt;
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -795,22 +795,6 @@ int iscsi_target_setup_login_socket(
+ }
+ np->np_socket = sock;
+ /*
+- * The SCTP stack needs struct socket->file.
+- */
+- if ((np->np_network_transport == ISCSI_SCTP_TCP) ||
+- (np->np_network_transport == ISCSI_SCTP_UDP)) {
+- if (!sock->file) {
+- sock->file = kzalloc(sizeof(struct file), GFP_KERNEL);
+- if (!sock->file) {
+- pr_err("Unable to allocate struct"
+- " file for SCTP\n");
+- ret = -ENOMEM;
+- goto fail;
+- }
+- np->np_flags |= NPF_SCTP_STRUCT_FILE;
+- }
+- }
+- /*
+ * Setup the np->np_sockaddr from the passed sockaddr setup
+ * in iscsi_target_configfs.c code..
+ */
+@@ -869,21 +853,15 @@ int iscsi_target_setup_login_socket(
+
+ fail:
+ np->np_socket = NULL;
+- if (sock) {
+- if (np->np_flags & NPF_SCTP_STRUCT_FILE) {
+- kfree(sock->file);
+- sock->file = NULL;
+- }
+-
++ if (sock)
+ sock_release(sock);
+- }
+ return ret;
+ }
+
+ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ {
+ u8 buffer[ISCSI_HDR_LEN], iscsi_opcode, zero_tsih = 0;
+- int err, ret = 0, set_sctp_conn_flag, stop;
++ int err, ret = 0, stop;
+ struct iscsi_conn *conn = NULL;
+ struct iscsi_login *login;
+ struct iscsi_portal_group *tpg = NULL;
+@@ -894,7 +872,6 @@ static int __iscsi_target_login_thread(s
+ struct sockaddr_in6 sock_in6;
+
+ flush_signals(current);
+- set_sctp_conn_flag = 0;
+ sock = np->np_socket;
+
+ spin_lock_bh(&np->np_thread_lock);
+@@ -917,35 +894,12 @@ static int __iscsi_target_login_thread(s
+ spin_unlock_bh(&np->np_thread_lock);
+ goto out;
+ }
+- /*
+- * The SCTP stack needs struct socket->file.
+- */
+- if ((np->np_network_transport == ISCSI_SCTP_TCP) ||
+- (np->np_network_transport == ISCSI_SCTP_UDP)) {
+- if (!new_sock->file) {
+- new_sock->file = kzalloc(
+- sizeof(struct file), GFP_KERNEL);
+- if (!new_sock->file) {
+- pr_err("Unable to allocate struct"
+- " file for SCTP\n");
+- sock_release(new_sock);
+- /* Get another socket */
+- return 1;
+- }
+- set_sctp_conn_flag = 1;
+- }
+- }
+-
+ iscsi_start_login_thread_timer(np);
+
+ conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+ if (!conn) {
+ pr_err("Could not allocate memory for"
+ " new connection\n");
+- if (set_sctp_conn_flag) {
+- kfree(new_sock->file);
+- new_sock->file = NULL;
+- }
+ sock_release(new_sock);
+ /* Get another socket */
+ return 1;
+@@ -955,9 +909,6 @@ static int __iscsi_target_login_thread(s
+ conn->conn_state = TARG_CONN_STATE_FREE;
+ conn->sock = new_sock;
+
+- if (set_sctp_conn_flag)
+- conn->conn_flags |= CONNFLAG_SCTP_STRUCT_FILE;
+-
+ pr_debug("Moving to TARG_CONN_STATE_XPT_UP.\n");
+ conn->conn_state = TARG_CONN_STATE_XPT_UP;
+
+@@ -1205,13 +1156,8 @@ old_sess_out:
+ iscsi_release_param_list(conn->param_list);
+ conn->param_list = NULL;
+ }
+- if (conn->sock) {
+- if (conn->conn_flags & CONNFLAG_SCTP_STRUCT_FILE) {
+- kfree(conn->sock->file);
+- conn->sock->file = NULL;
+- }
++ if (conn->sock)
+ sock_release(conn->sock);
+- }
+ kfree(conn);
+
+ if (tpg) {
--- /dev/null
+From 473b095a72a95ba719905b1f2e82cd18d099a427 Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@amd.com>
+Date: Tue, 3 Jul 2012 17:27:49 +0800
+Subject: mmc: sdhci: fix incorrect command used in tuning
+
+From: Aaron Lu <aaron.lu@amd.com>
+
+commit 473b095a72a95ba719905b1f2e82cd18d099a427 upstream.
+
+For SD hosts using retuning mode 1, when retuning timer expired, it will
+need to do retuning in sdhci_request before processing the actual
+request. But the retuning command is fixed: cmd19 for SD card and cmd21
+for eMMC card, so we can't use the original request's command to do the
+tuning.
+
+And since the tuning command depends on the card type attached to the
+host, we will need to know the card type to use the correct tuning
+command.
+
+Signed-off-by: Aaron Lu <aaron.lu@amd.com>
+Reviewed-by: Philip Rakity <prakity@marvell.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -27,6 +27,7 @@
+
+ #include <linux/mmc/mmc.h>
+ #include <linux/mmc/host.h>
++#include <linux/mmc/card.h>
+
+ #include "sdhci.h"
+
+@@ -1245,6 +1246,7 @@ static void sdhci_request(struct mmc_hos
+ struct sdhci_host *host;
+ bool present;
+ unsigned long flags;
++ u32 tuning_opcode;
+
+ host = mmc_priv(mmc);
+
+@@ -1292,8 +1294,12 @@ static void sdhci_request(struct mmc_hos
+ */
+ if ((host->flags & SDHCI_NEEDS_RETUNING) &&
+ !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) {
++ /* eMMC uses cmd21 while sd and sdio use cmd19 */
++ tuning_opcode = mmc->card->type == MMC_TYPE_MMC ?
++ MMC_SEND_TUNING_BLOCK_HS200 :
++ MMC_SEND_TUNING_BLOCK;
+ spin_unlock_irqrestore(&host->lock, flags);
+- sdhci_execute_tuning(mmc, mrq->cmd->opcode);
++ sdhci_execute_tuning(mmc, tuning_opcode);
+ spin_lock_irqsave(&host->lock, flags);
+
+ /* Restore original mmc_request structure */
--- /dev/null
+From 55fc05b7414274f17795cd0e8a3b1546f3649d5e Mon Sep 17 00:00:00 2001
+From: Daniel Drake <dsd@laptop.org>
+Date: Tue, 3 Jul 2012 23:13:39 +0100
+Subject: mmc: sdhci-pci: CaFe has broken card detection
+
+From: Daniel Drake <dsd@laptop.org>
+
+commit 55fc05b7414274f17795cd0e8a3b1546f3649d5e upstream.
+
+At http://dev.laptop.org/ticket/11980 we have determined that the
+Marvell CaFe SDHCI controller reports bad card presence during
+resume. It reports that no card is present even when it is.
+This is a regression -- resume worked back around 2.6.37.
+
+Around 400ms after resuming, a "card inserted" interrupt is
+generated, at which point it starts reporting presence.
+
+Work around this hardware oddity by setting the
+SDHCI_QUIRK_BROKEN_CARD_DETECTION flag.
+Thanks to Chris Ball for helping with diagnosis.
+
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/host/sdhci-pci.c
++++ b/drivers/mmc/host/sdhci-pci.c
+@@ -157,6 +157,7 @@ static const struct sdhci_pci_fixes sdhc
+ static const struct sdhci_pci_fixes sdhci_cafe = {
+ .quirks = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER |
+ SDHCI_QUIRK_NO_BUSY_IRQ |
++ SDHCI_QUIRK_BROKEN_CARD_DETECTION |
+ SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
+ };
+
--- /dev/null
+From 6bd825f02966be8ba544047cab313d6032c23819 Mon Sep 17 00:00:00 2001
+From: Timur Tabi <timur@freescale.com>
+Date: Thu, 5 Jul 2012 10:08:28 -0500
+Subject: powerpc/85xx: use the BRx registers to enable indirect mode on the P1022DS
+
+From: Timur Tabi <timur@freescale.com>
+
+commit 6bd825f02966be8ba544047cab313d6032c23819 upstream.
+
+In order to enable the DIU video controller on the P1022DS, the FPGA needs
+to be switched to "indirect mode", where the localbus is disabled and
+the FPGA is accessed via writes to localbus chip select signals CS0 and CS1.
+
+To obtain the address of CS0 and CS1, the platform driver uses an "indirect
+pixis mode" device tree node. This node assumes that the localbus 'ranges'
+property is sorted in chip-select order. That is, reg value 0 maps to
+CS0, reg value 1 maps to CS1, etc. This is how the 'ranges' property is
+supposed to be arranged.
+
+Unfortunately, the 'ranges' property is often mis-arranged, and not just on
+the P1022DS. Linux normally does not care, since it does not program the
+localbus. But the indirect-mode code on the P1022DS does care.
+
+The "proper" fix is to have U-Boot fix the 'ranges' property, but this would
+be too cumbersome. The names and 'reg' properties of all the localbus
+devices would also need to be updated, and determining which localbus device
+maps to which chip select is board-specific.
+
+Instead, we determine the CS0/CS1 base addresses the same way that U-boot
+does -- by reading the BRx registers directly and mapping them to physical
+addresses. This code is simpler and more reliable, and it does not require
+a U-boot or device tree change.
+
+Since the indirect pixis device tree node is no longer needed, the node is
+deleted from the DTS.
+
+Signed-off-by: Timur Tabi <timur@freescale.com>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/boot/dts/p1022ds.dtsi | 16 ----
+ arch/powerpc/platforms/85xx/p1022_ds.c | 106 ++++++++++++++++++++++++++++-----
+ 2 files changed, 93 insertions(+), 29 deletions(-)
+
+--- a/arch/powerpc/boot/dts/p1022ds.dtsi
++++ b/arch/powerpc/boot/dts/p1022ds.dtsi
+@@ -33,22 +33,6 @@
+ */
+
+ &board_lbc {
+- /*
+- * This node is used to access the pixis via "indirect" mode,
+- * which is done by writing the pixis register index to chip
+- * select 0 and the value to/from chip select 1. Indirect
+- * mode is the only way to access the pixis when DIU video
+- * is enabled. Note that this assumes that the first column
+- * of the 'ranges' property above is the chip select number.
+- */
+- board-control@0,0 {
+- compatible = "fsl,p1022ds-indirect-pixis";
+- reg = <0x0 0x0 1 /* CS0 */
+- 0x1 0x0 1>; /* CS1 */
+- interrupt-parent = <&mpic>;
+- interrupts = <8 0 0 0>;
+- };
+-
+ nor@0,0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+--- a/arch/powerpc/platforms/85xx/p1022_ds.c
++++ b/arch/powerpc/platforms/85xx/p1022_ds.c
+@@ -27,6 +27,7 @@
+ #include <sysdev/fsl_pci.h>
+ #include <asm/udbg.h>
+ #include <asm/fsl_guts.h>
++#include <asm/fsl_lbc.h>
+ #include "smp.h"
+
+ #include "mpc85xx.h"
+@@ -142,17 +143,73 @@ static void p1022ds_set_gamma_table(enum
+ {
+ }
+
++struct fsl_law {
++ u32 lawbar;
++ u32 reserved1;
++ u32 lawar;
++ u32 reserved[5];
++};
++
++#define LAWBAR_MASK 0x00F00000
++#define LAWBAR_SHIFT 12
++
++#define LAWAR_EN 0x80000000
++#define LAWAR_TGT_MASK 0x01F00000
++#define LAW_TRGT_IF_LBC (0x04 << 20)
++
++#define LAWAR_MASK (LAWAR_EN | LAWAR_TGT_MASK)
++#define LAWAR_MATCH (LAWAR_EN | LAW_TRGT_IF_LBC)
++
++#define BR_BA 0xFFFF8000
++
++/*
++ * Map a BRx value to a physical address
++ *
++ * The localbus BRx registers only store the lower 32 bits of the address. To
++ * obtain the upper four bits, we need to scan the LAW table. The entry which
++ * maps to the localbus will contain the upper four bits.
++ */
++static phys_addr_t lbc_br_to_phys(const void *ecm, unsigned int count, u32 br)
++{
++#ifndef CONFIG_PHYS_64BIT
++ /*
++ * If we only have 32-bit addressing, then the BRx address *is* the
++ * physical address.
++ */
++ return br & BR_BA;
++#else
++ const struct fsl_law *law = ecm + 0xc08;
++ unsigned int i;
++
++ for (i = 0; i < count; i++) {
++ u64 lawbar = in_be32(&law[i].lawbar);
++ u32 lawar = in_be32(&law[i].lawar);
++
++ if ((lawar & LAWAR_MASK) == LAWAR_MATCH)
++ /* Extract the upper four bits */
++ return (br & BR_BA) | ((lawbar & LAWBAR_MASK) << 12);
++ }
++
++ return 0;
++#endif
++}
++
+ /**
+ * p1022ds_set_monitor_port: switch the output to a different monitor port
+- *
+ */
+ static void p1022ds_set_monitor_port(enum fsl_diu_monitor_port port)
+ {
+ struct device_node *guts_node;
+- struct device_node *indirect_node = NULL;
++ struct device_node *lbc_node = NULL;
++ struct device_node *law_node = NULL;
+ struct ccsr_guts __iomem *guts;
++ struct fsl_lbc_regs *lbc = NULL;
++ void *ecm = NULL;
+ u8 __iomem *lbc_lcs0_ba = NULL;
+ u8 __iomem *lbc_lcs1_ba = NULL;
++ phys_addr_t cs0_addr, cs1_addr;
++ const __be32 *iprop;
++ unsigned int num_laws;
+ u8 b;
+
+ /* Map the global utilities registers. */
+@@ -168,25 +225,43 @@ static void p1022ds_set_monitor_port(enu
+ goto exit;
+ }
+
+- indirect_node = of_find_compatible_node(NULL, NULL,
+- "fsl,p1022ds-indirect-pixis");
+- if (!indirect_node) {
+- pr_err("p1022ds: missing pixis indirect mode node\n");
++ lbc_node = of_find_compatible_node(NULL, NULL, "fsl,p1022-elbc");
++ if (!lbc_node) {
++ pr_err("p1022ds: missing localbus node\n");
++ goto exit;
++ }
++
++ lbc = of_iomap(lbc_node, 0);
++ if (!lbc) {
++ pr_err("p1022ds: could not map localbus node\n");
+ goto exit;
+ }
+
+- lbc_lcs0_ba = of_iomap(indirect_node, 0);
+- if (!lbc_lcs0_ba) {
+- pr_err("p1022ds: could not map localbus chip select 0\n");
++ law_node = of_find_compatible_node(NULL, NULL, "fsl,ecm-law");
++ if (!law_node) {
++ pr_err("p1022ds: missing local access window node\n");
+ goto exit;
+ }
+
+- lbc_lcs1_ba = of_iomap(indirect_node, 1);
+- if (!lbc_lcs1_ba) {
+- pr_err("p1022ds: could not map localbus chip select 1\n");
++ ecm = of_iomap(law_node, 0);
++ if (!ecm) {
++ pr_err("p1022ds: could not map local access window node\n");
+ goto exit;
+ }
+
++ iprop = of_get_property(law_node, "fsl,num-laws", 0);
++ if (!iprop) {
++ pr_err("p1022ds: LAW node is missing fsl,num-laws property\n");
++ goto exit;
++ }
++ num_laws = be32_to_cpup(iprop);
++
++ cs0_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[0].br));
++ cs1_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[1].br));
++
++ lbc_lcs0_ba = ioremap(cs0_addr, 1);
++ lbc_lcs1_ba = ioremap(cs1_addr, 1);
++
+ /* Make sure we're in indirect mode first. */
+ if ((in_be32(&guts->pmuxcr) & PMUXCR_ELBCDIU_MASK) !=
+ PMUXCR_ELBCDIU_DIU) {
+@@ -254,10 +329,15 @@ exit:
+ iounmap(lbc_lcs1_ba);
+ if (lbc_lcs0_ba)
+ iounmap(lbc_lcs0_ba);
++ if (lbc)
++ iounmap(lbc);
++ if (ecm)
++ iounmap(ecm);
+ if (guts)
+ iounmap(guts);
+
+- of_node_put(indirect_node);
++ of_node_put(law_node);
++ of_node_put(lbc_node);
+ of_node_put(guts_node);
+ }
+
--- /dev/null
+From b416c9a10baae6a177b4f9ee858b8d309542fbef Mon Sep 17 00:00:00 2001
+From: Tiejun Chen <tiejun.chen@windriver.com>
+Date: Wed, 11 Jul 2012 14:22:46 +1000
+Subject: powerpc: Add "memory" attribute for mfmsr()
+
+From: Tiejun Chen <tiejun.chen@windriver.com>
+
+commit b416c9a10baae6a177b4f9ee858b8d309542fbef upstream.
+
+Add "memory" attribute in inline assembly language as a compiler
+barrier to make sure 4.6.x GCC don't reorder mfmsr().
+
+Signed-off-by: Tiejun Chen <tiejun.chen@windriver.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/reg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -1022,7 +1022,8 @@
+ /* Macros for setting and retrieving special purpose registers */
+ #ifndef __ASSEMBLY__
+ #define mfmsr() ({unsigned long rval; \
+- asm volatile("mfmsr %0" : "=r" (rval)); rval;})
++ asm volatile("mfmsr %0" : "=r" (rval) : \
++ : "memory"); rval;})
+ #ifdef CONFIG_PPC_BOOK3S_64
+ #define __mtmsrd(v, l) asm volatile("mtmsrd %0," __stringify(l) \
+ : : "r" (v) : "memory")
--- /dev/null
+From 10db8d212864cb6741df7d7fafda5ab6661f6f88 Mon Sep 17 00:00:00 2001
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Date: Thu, 12 Jul 2012 17:14:36 +0000
+Subject: powerpc/eeh: Check handle_eeh_events() return value
+
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+
+commit 10db8d212864cb6741df7d7fafda5ab6661f6f88 upstream.
+
+Function eeh_event_handler() dereferences the pointer returned by
+handle_eeh_events() without checking, causing a crash if NULL was
+returned, which is expected in some situations.
+
+This patch fixes this bug by checking for the value returned by
+handle_eeh_events() before dereferencing it.
+
+Signed-off-by: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/eeh_event.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/eeh_event.c
++++ b/arch/powerpc/platforms/pseries/eeh_event.c
+@@ -85,8 +85,10 @@ static int eeh_event_handler(void * dumm
+ set_current_state(TASK_INTERRUPTIBLE); /* Don't add to load average */
+ edev = handle_eeh_events(event);
+
+- eeh_clear_slot(eeh_dev_to_of_node(edev), EEH_MODE_RECOVERING);
+- pci_dev_put(edev->pdev);
++ if (edev) {
++ eeh_clear_slot(eeh_dev_to_of_node(edev), EEH_MODE_RECOVERING);
++ pci_dev_put(edev->pdev);
++ }
+
+ kfree(event);
+ mutex_unlock(&eeh_event_mutex);
--- /dev/null
+From fd5a42980e1cf327b7240adf5e7b51ea41c23437 Mon Sep 17 00:00:00 2001
+From: roger blofeld <blofeldus@yahoo.com>
+Date: Thu, 21 Jun 2012 05:27:14 +0000
+Subject: powerpc/ftrace: Fix assembly trampoline register usage
+
+From: roger blofeld <blofeldus@yahoo.com>
+
+commit fd5a42980e1cf327b7240adf5e7b51ea41c23437 upstream.
+
+Just like the module loader, ftrace needs to be updated to use r12
+instead of r11 with newer gcc's.
+
+Signed-off-by: Roger Blofeld <blofeldus@yahoo.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/ftrace.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/kernel/ftrace.c
++++ b/arch/powerpc/kernel/ftrace.c
+@@ -245,9 +245,9 @@ __ftrace_make_nop(struct module *mod,
+
+ /*
+ * On PPC32 the trampoline looks like:
+- * 0x3d, 0x60, 0x00, 0x00 lis r11,sym@ha
+- * 0x39, 0x6b, 0x00, 0x00 addi r11,r11,sym@l
+- * 0x7d, 0x69, 0x03, 0xa6 mtctr r11
++ * 0x3d, 0x80, 0x00, 0x00 lis r12,sym@ha
++ * 0x39, 0x8c, 0x00, 0x00 addi r12,r12,sym@l
++ * 0x7d, 0x89, 0x03, 0xa6 mtctr r12
+ * 0x4e, 0x80, 0x04, 0x20 bctr
+ */
+
+@@ -262,9 +262,9 @@ __ftrace_make_nop(struct module *mod,
+ pr_devel(" %08x %08x ", jmp[0], jmp[1]);
+
+ /* verify that this is what we expect it to be */
+- if (((jmp[0] & 0xffff0000) != 0x3d600000) ||
+- ((jmp[1] & 0xffff0000) != 0x396b0000) ||
+- (jmp[2] != 0x7d6903a6) ||
++ if (((jmp[0] & 0xffff0000) != 0x3d800000) ||
++ ((jmp[1] & 0xffff0000) != 0x398c0000) ||
++ (jmp[2] != 0x7d8903a6) ||
+ (jmp[3] != 0x4e800420)) {
+ printk(KERN_ERR "Not a trampoline\n");
+ return -EINVAL;
--- /dev/null
+target-add-generation-of-logical-block-address-out-of-range.patch
+iscsi-target-drop-bogus-struct-file-usage-for-iscsi-sctp.patch
+mmc-sdhci-pci-cafe-has-broken-card-detection.patch
+mmc-sdhci-fix-incorrect-command-used-in-tuning.patch
+powerpc-ftrace-fix-assembly-trampoline-register-usage.patch
+powerpc-add-memory-attribute-for-mfmsr.patch
+powerpc-eeh-check-handle_eeh_events-return-value.patch
+powerpc-85xx-use-the-brx-registers-to-enable-indirect-mode-on-the-p1022ds.patch
--- /dev/null
+From e2397c704429025bc6b331a970f699e52f34283e Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Mon, 16 Jul 2012 15:34:21 -0700
+Subject: target: Add generation of LOGICAL BLOCK ADDRESS OUT OF RANGE
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit e2397c704429025bc6b331a970f699e52f34283e upstream.
+
+Many SCSI commands are defined to return a CHECK CONDITION / ILLEGAL
+REQUEST with ASC set to LOGICAL BLOCK ADDRESS OUT OF RANGE if the
+initiator sends a command that accesses a too-big LBA. Add an enum
+value and case entries so that target code can return this status.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 10 ++++++++++
+ include/target/target_core_base.h | 1 +
+ 2 files changed, 11 insertions(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1976,6 +1976,7 @@ void transport_generic_request_failure(s
+ case TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE:
+ case TCM_UNKNOWN_MODE_PAGE:
+ case TCM_WRITE_PROTECTED:
++ case TCM_ADDRESS_OUT_OF_RANGE:
+ case TCM_CHECK_CONDITION_ABORT_CMD:
+ case TCM_CHECK_CONDITION_UNIT_ATTENTION:
+ case TCM_CHECK_CONDITION_NOT_READY:
+@@ -4656,6 +4657,15 @@ int transport_send_check_condition_and_s
+ /* WRITE PROTECTED */
+ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x27;
+ break;
++ case TCM_ADDRESS_OUT_OF_RANGE:
++ /* CURRENT ERROR */
++ buffer[offset] = 0x70;
++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
++ /* ILLEGAL REQUEST */
++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
++ /* LOGICAL BLOCK ADDRESS OUT OF RANGE */
++ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x21;
++ break;
+ case TCM_CHECK_CONDITION_UNIT_ATTENTION:
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -229,6 +229,7 @@ enum tcm_sense_reason_table {
+ TCM_CHECK_CONDITION_UNIT_ATTENTION = 0x0e,
+ TCM_CHECK_CONDITION_NOT_READY = 0x0f,
+ TCM_RESERVATION_CONFLICT = 0x10,
++ TCM_ADDRESS_OUT_OF_RANGE = 0x11,
+ };
+
+ enum target_sc_flags_table {
projects / thirdparty / kernel / stable-queue.git / commitdiff
