]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.1-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Sep 2015 06:22:32 +0000 (23:22 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Sep 2015 06:22:32 +0000 (23:22 -0700)
added patches:
arm-8384-1-vdso-force-use-of-bfd-linker.patch
arm-8385-1-vdso-group-link-options.patch
arm-dts-dra7-fix-broken-pbias-device-creation.patch
arm-dts-omap243x-fix-broken-pbias-device-creation.patch
arm-dts-omap4-fix-broken-pbias-device-creation.patch
arm-dts-omap5-fix-broken-pbias-device-creation.patch
arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch
arm-invalidate-l1-before-enabling-coherency.patch
arm-v7-setup-function-should-invalidate-l1-cache.patch
crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch
crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch
libfc-fix-fc_exch_recv_req-error-path.patch
libfc-fix-fc_fcp_cleanup_each_cmd.patch
libiscsi-fix-host-busy-blocking-during-connection-teardown.patch
mfd-arizona-fix-initialisation-of-the-pm-runtime.patch
mips-fix-seccomp-syscall-argument-for-mips64.patch
regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch
revert-libata-eh-set-information-field-for-autosense.patch
revert-libata-implement-ncq-autosense.patch
revert-libata-implement-support-for-sense-data-reporting.patch
revert-x86-sigcontext-cleanups.patch
sd-fix-maximum-i-o-size-for-block_pc-requests.patch

23 files changed:
queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch [new file with mode: 0644]
queue-4.1/arm-8385-1-vdso-group-link-options.patch [new file with mode: 0644]
queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch [new file with mode: 0644]
queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch [new file with mode: 0644]
queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch [new file with mode: 0644]
queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch [new file with mode: 0644]
queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch [new file with mode: 0644]
queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch [new file with mode: 0644]
queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch [new file with mode: 0644]
queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch [new file with mode: 0644]
queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch [new file with mode: 0644]
queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch [new file with mode: 0644]
queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch [new file with mode: 0644]
queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch [new file with mode: 0644]
queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch [new file with mode: 0644]
queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch [new file with mode: 0644]
queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch [new file with mode: 0644]
queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch [new file with mode: 0644]
queue-4.1/revert-libata-implement-ncq-autosense.patch [new file with mode: 0644]
queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch [new file with mode: 0644]
queue-4.1/revert-x86-sigcontext-cleanups.patch [new file with mode: 0644]
queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch [new file with mode: 0644]
queue-4.1/series

diff --git a/queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch b/queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch
new file mode 100644 (file)
index 0000000..89ebf2b
--- /dev/null
@@ -0,0 +1,67 @@
+From d2b30cd4b7223a96e606dfc8120626f66d81e091 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathan_lynch@mentor.com>
+Date: Wed, 3 Jun 2015 00:41:15 +0100
+Subject: ARM: 8384/1: VDSO: force use of BFD linker
+
+From: Nathan Lynch <nathan_lynch@mentor.com>
+
+commit d2b30cd4b7223a96e606dfc8120626f66d81e091 upstream.
+
+When using a toolchain with gold as the default linker, the VDSO build
+fails:
+
+  VDSO    arch/arm/vdso/vdso.so.raw
+  HOSTCC  arch/arm/vdso/vdsomunge
+  MUNGE   arch/arm/vdso/vdso.so.dbg
+  OBJCOPY arch/arm/vdso/vdso.so
+BFD: arch/arm/vdso/vdso.so: Not enough room for program headers, try
+linking with -N
+
+For whatever reason, ld.gold is omitting an exidx program header that
+ld.bfd emits, and even when I work around that, I don't get a working
+VDSO.
+
+For now, instead of supporting gold (which will fail to link the
+kernel anyway since it does not implement --pic-veneer), direct the
+compiler to use the traditional bfd linker.  This is accomplished by
+using -fuse-ld, which is implemented in GCC 4.8 and later.
+
+Note: one limitation of this is that if the toolchain is configured
+to use gold by default, and the bfd linker is not in $PATH, the VDSO
+build will fail:
+
+  VDSO    arch/arm/vdso/vdso.so.raw
+collect2: fatal error: cannot find 'ld'
+
+This will happen if CROSS_COMPILE begins with a path such as
+/opt/bin/arm-linux-gnu- but /opt/bin is not in $PATH.  This is
+considered an acceptable corner-case limitation and is easily worked
+around.
+
+Additonal note: we use cc-option instead of cc-ldoption so that
+-fuse-ld=bfd is placed in the command line if the compiler recognizes
+the option.  Using cc-ldoption results in an attempt to link, which
+fails in the situation just described, causing -fuse-ld=bfd to be
+omitted and gold to be used for the VDSO link, which is what we're
+trying to prevent.
+
+Reported-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/vdso/Makefile |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/vdso/Makefile
++++ b/arch/arm/vdso/Makefile
+@@ -14,6 +14,7 @@ VDSO_LDFLAGS += -Wl,-z,max-page-size=409
+ VDSO_LDFLAGS += -nostdlib -shared
+ VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+ VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--build-id)
++VDSO_LDFLAGS += $(call cc-option, -fuse-ld=bfd)
+ obj-$(CONFIG_VDSO) += vdso.o
+ extra-$(CONFIG_VDSO) += vdso.lds
diff --git a/queue-4.1/arm-8385-1-vdso-group-link-options.patch b/queue-4.1/arm-8385-1-vdso-group-link-options.patch
new file mode 100644 (file)
index 0000000..942cde7
--- /dev/null
@@ -0,0 +1,56 @@
+From d33ce23b2160d26b27a47092da5d556b5b11a12a Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathan_lynch@mentor.com>
+Date: Wed, 3 Jun 2015 00:46:04 +0100
+Subject: ARM: 8385/1: VDSO: group link options
+
+From: Nathan Lynch <nathan_lynch@mentor.com>
+
+commit d33ce23b2160d26b27a47092da5d556b5b11a12a upstream.
+
+Currently the VDSO's link options are kind of a mess spread between
+
+ccflags-y and cmd_vdsold.  Collect linker directives into one
+variable, VDSO_LDFLAGS, and use that in cmd_vdsold.
+
+Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/vdso/Makefile |   17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/vdso/Makefile
++++ b/arch/arm/vdso/Makefile
+@@ -6,9 +6,14 @@ obj-vdso := vgettimeofday.o datapage.o
+ targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.so.raw vdso.lds
+ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
+-ccflags-y := -shared -fPIC -fno-common -fno-builtin -fno-stack-protector
+-ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 -DDISABLE_BRANCH_PROFILING
+-ccflags-y += -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++ccflags-y := -fPIC -fno-common -fno-builtin -fno-stack-protector
++ccflags-y += -DDISABLE_BRANCH_PROFILING
++
++VDSO_LDFLAGS := -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1
++VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096
++VDSO_LDFLAGS += -nostdlib -shared
++VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--build-id)
+ obj-$(CONFIG_VDSO) += vdso.o
+ extra-$(CONFIG_VDSO) += vdso.lds
+@@ -40,10 +45,8 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ # Actual build commands
+ quiet_cmd_vdsold = VDSO    $@
+-      cmd_vdsold = $(CC) $(c_flags) -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) \
+-                   $(call cc-ldoption, -Wl$(comma)--build-id) \
+-                   -Wl,-Bsymbolic -Wl,-z,max-page-size=4096 \
+-                   -Wl,-z,common-page-size=4096 -o $@
++      cmd_vdsold = $(CC) $(c_flags) $(VDSO_LDFLAGS) \
++                   -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) -o $@
+ quiet_cmd_vdsomunge = MUNGE   $@
+       cmd_vdsomunge = $(objtree)/$(obj)/vdsomunge $< $@
diff --git a/queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch
new file mode 100644 (file)
index 0000000..13e2fa9
--- /dev/null
@@ -0,0 +1,42 @@
+From cd4556733b30cc363adc7b1cea3bffa7e2dd0c7c Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 17:46:41 +0530
+Subject: ARM: dts: dra7: Fix broken pbias device creation
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit cd4556733b30cc363adc7b1cea3bffa7e2dd0c7c upstream.
+
+commit <d919501feffa> ("ARM: dts: dra7: add minimal l4 bus
+layout with control module support") moved pbias_regulator dt node
+from being a child node of ocp to be the child node of
+scm_conf. After this device for pbias_regulator is
+not created.
+
+Fix it by adding "simple-bus" compatible property to
+scm_conf dt node.
+
+Fixes: d919501feffa ("ARM: dts: dra7: add minimal l4 bus
+layout with control module support")
+
+Suggested-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Tested-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/dra7.dtsi |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -116,7 +116,7 @@
+                               ranges = <0 0x2000 0x2000>;
+                               scm_conf: scm_conf@0 {
+-                                      compatible = "syscon";
++                                      compatible = "syscon", "simple-bus";
+                                       reg = <0x0 0x1400>;
+                                       #address-cells = <1>;
+                                       #size-cells = <1>;
diff --git a/queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch
new file mode 100644 (file)
index 0000000..c56ae8f
--- /dev/null
@@ -0,0 +1,41 @@
+From 4317c8c9121e4685561422ac267b292df8e80806 Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 17:46:38 +0530
+Subject: ARM: dts: omap243x: Fix broken pbias device creation
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit 4317c8c9121e4685561422ac267b292df8e80806 upstream.
+
+commit <72b10ac00eb1> ("ARM: dts: omap24xx: add minimal l4 bus
+layout with control module support") moved pbias_regulator dt node
+from being a child node of ocp to be the child node of
+scm_conf. After this device for pbias_regulator is
+not created.
+
+Fix it by adding "simple-bus" compatible property to
+scm_conf dt node.
+
+Fixes: 72b10ac00eb1 ("ARM: dts: omap24xx: add minimal l4 bus
+layout with control module support")
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap2430.dtsi |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap2430.dtsi
++++ b/arch/arm/boot/dts/omap2430.dtsi
+@@ -51,7 +51,8 @@
+                               };
+                               scm_conf: scm_conf@270 {
+-                                      compatible = "syscon";
++                                      compatible = "syscon",
++                                                   "simple-bus";
+                                       reg = <0x270 0x240>;
+                                       #address-cells = <1>;
+                                       #size-cells = <1>;
diff --git a/queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch
new file mode 100644 (file)
index 0000000..23063df
--- /dev/null
@@ -0,0 +1,41 @@
+From 89a898df87e114952191ab0e061aa18e3c617880 Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 17:46:39 +0530
+Subject: ARM: dts: OMAP4: Fix broken pbias device creation
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit 89a898df87e114952191ab0e061aa18e3c617880 upstream.
+
+commit <7415b0b4c645> ("ARM: dts: omap4: add minimal l4 bus layout
+with control module support") moved pbias_regulator dt node
+from being a child node of ocp to be the child node of
+omap4_padconf_global. After this device for pbias_regulator
+is not created.
+
+Fix it by adding "simple-bus" compatible property to
+omap4_padconf_global dt node.
+
+Fixes: 7415b0b4c645 ("ARM: dts: omap4: add minimal l4 bus layout
+with control module support")
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap4.dtsi |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -191,7 +191,8 @@
+                               };
+                               omap4_padconf_global: omap4_padconf_global@5a0 {
+-                                      compatible = "syscon";
++                                      compatible = "syscon",
++                                                   "simple-bus";
+                                       reg = <0x5a0 0x170>;
+                                       #address-cells = <1>;
+                                       #size-cells = <1>;
diff --git a/queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch
new file mode 100644 (file)
index 0000000..f0bc61e
--- /dev/null
@@ -0,0 +1,41 @@
+From 70caac3f25291cf715cf8f2d8c7db46f6cbefe7c Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 17:46:40 +0530
+Subject: ARM: dts: OMAP5: Fix broken pbias device creation
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit 70caac3f25291cf715cf8f2d8c7db46f6cbefe7c upstream.
+
+commit <ed8509edddeb> ("ARM: dts: omap5: add minimal l4 bus
+layout with control module support") moved pbias_regulator dt node
+from being a child node of ocp to be the child node of
+omap5_padconf_global. After this device for pbias_regulator is
+not created.
+
+Fix it by adding "simple-bus" compatible property to
+omap5_padconf_global dt node.
+
+Fixes: ed8509edddeb ("ARM: dts: omap5: add minimal l4 bus
+layout with control module support")
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap5.dtsi |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap5.dtsi
++++ b/arch/arm/boot/dts/omap5.dtsi
+@@ -180,7 +180,8 @@
+                               };
+                               omap5_padconf_global: omap5_padconf_global@5a0 {
+-                                      compatible = "syscon";
++                                      compatible = "syscon",
++                                                   "simple-bus";
+                                       reg = <0x5a0 0xec>;
+                                       #address-cells = <1>;
+                                       #size-cells = <1>;
diff --git a/queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch b/queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch
new file mode 100644 (file)
index 0000000..002487f
--- /dev/null
@@ -0,0 +1,39 @@
+From 1a9fa190956f45c1e58c4d8bfa5ac051691ea590 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Wed, 5 Aug 2015 18:54:37 +0200
+Subject: ARM: imx6: correct i.MX6 PCIe interrupt routing
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 1a9fa190956f45c1e58c4d8bfa5ac051691ea590 upstream.
+
+The PCIe interrupts are also routed through the GPC. This has been
+missed from the conversion to stacked IRQ domains as the PCIe
+controller uses an explicit interrupt map and thus doesn't inherit
+the SoC global interrupt parent.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6qdl.dtsi |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -153,10 +153,10 @@
+                       interrupt-names = "msi";
+                       #interrupt-cells = <1>;
+                       interrupt-map-mask = <0 0 0 0x7>;
+-                      interrupt-map = <0 0 0 1 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+-                                      <0 0 0 2 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+-                                      <0 0 0 3 &intc GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+-                                      <0 0 0 4 &intc GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++                      interrupt-map = <0 0 0 1 &gpc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
++                                      <0 0 0 2 &gpc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++                                      <0 0 0 3 &gpc GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++                                      <0 0 0 4 &gpc GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+                       clocks = <&clks IMX6QDL_CLK_PCIE_AXI>,
+                                <&clks IMX6QDL_CLK_LVDS1_GATE>,
+                                <&clks IMX6QDL_CLK_PCIE_REF_125M>;
diff --git a/queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch b/queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch
new file mode 100644 (file)
index 0000000..a0fa6c8
--- /dev/null
@@ -0,0 +1,69 @@
+From bac51ad9d14f6baed3730ef53bedc1eb2238563a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Thu, 9 Jul 2015 00:30:24 +0100
+Subject: ARM: invalidate L1 before enabling coherency
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit bac51ad9d14f6baed3730ef53bedc1eb2238563a upstream.
+
+We must invalidate the L1 cache before enabling coherency, otherwise
+secondary CPUs can inject invalid cache lines into the coherent CPU
+cluster, which could then be migrated to other CPUs.  This fixes a
+recent regression with SoCFPGA randomly failing to boot.
+
+Fixes: 02b4e2756e01 ("ARM: v7 setup function should invalidate L1 cache")
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-v7.S |   14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -268,7 +268,10 @@ __v7_ca15mp_setup:
+ __v7_b15mp_setup:
+ __v7_ca17mp_setup:
+       mov     r10, #0
+-1:
++1:    adr     r12, __v7_setup_stack           @ the local stack
++      stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
++      bl      v7_invalidate_l1
++      ldmia   r12, {r0-r5, lr}
+ #ifdef CONFIG_SMP
+       ALT_SMP(mrc     p15, 0, r0, c1, c0, 1)
+       ALT_UP(mov      r0, #(1 << 6))          @ fake it for UP
+@@ -277,7 +280,7 @@ __v7_ca17mp_setup:
+       orreq   r0, r0, r10                     @ Enable CPU-specific SMP bits
+       mcreq   p15, 0, r0, c1, c0, 1
+ #endif
+-      b       __v7_setup
++      b       __v7_setup_cont
+ __v7_pj4b_setup:
+ #ifdef CONFIG_CPU_PJ4B
+@@ -335,10 +338,11 @@ __v7_pj4b_setup:
+ __v7_setup:
+       adr     r12, __v7_setup_stack           @ the local stack
+-      stmia   r12, {r0-r5, r7, r9, r11, lr}
++      stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
+       bl      v7_invalidate_l1
+-      ldmia   r12, {r0-r5, r7, r9, r11, lr}
++      ldmia   r12, {r0-r5, lr}
++__v7_setup_cont:
+       mrc     p15, 0, r0, c0, c0, 0           @ read main ID register
+       and     r10, r0, #0xff000000            @ ARM?
+       teq     r10, #0x41000000
+@@ -460,7 +464,7 @@ ENDPROC(__v7_setup)
+       .align  2
+ __v7_setup_stack:
+-      .space  4 * 11                          @ 11 registers
++      .space  4 * 7                           @ 12 registers
+       __INITDATA
diff --git a/queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch b/queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch
new file mode 100644 (file)
index 0000000..5c6ba38
--- /dev/null
@@ -0,0 +1,518 @@
+From 02b4e2756e01c623cc4dbceae4b07be75252db5b Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 19 May 2015 17:06:44 +0100
+Subject: ARM: v7 setup function should invalidate L1 cache
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 02b4e2756e01c623cc4dbceae4b07be75252db5b upstream.
+
+All ARMv5 and older CPUs invalidate their caches in the early assembly
+setup function, prior to enabling the MMU.  This is because the L1
+cache should not contain any data relevant to the execution of the
+kernel at this point; all data should have been flushed out to memory.
+
+This requirement should also be true for ARMv6 and ARMv7 CPUs - indeed,
+these typically do not search their caches when caching is disabled (as
+it needs to be when the MMU is disabled) so this change should be safe.
+
+ARMv7 allows there to be CPUs which search their caches while caching is
+disabled, and it's permitted that the cache is uninitialised at boot;
+for these, the architecture reference manual requires that an
+implementation specific code sequence is used immediately after reset
+to ensure that the cache is placed into a sane state.  Such
+functionality is definitely outside the remit of the Linux kernel, and
+must be done by the SoC's firmware before _any_ CPU gets to the Linux
+kernel.
+
+Changing the data cache clean+invalidate to a mere invalidate allows us
+to get rid of a lot of platform specific hacks around this issue for
+their secondary CPU bringup paths - some of which were buggy.
+
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Tested-by: Dinh Nguyen <dinguyen@opensource.altera.com>
+Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Tested-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Tested-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Michal Simek <michal.simek@xilinx.com>
+Tested-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-bcm/Makefile            |    2 +-
+ arch/arm/mach-bcm/brcmstb.h           |   19 -------------------
+ arch/arm/mach-bcm/headsmp-brcmstb.S   |   33 ---------------------------------
+ arch/arm/mach-bcm/platsmp-brcmstb.c   |    4 +---
+ arch/arm/mach-berlin/headsmp.S        |    6 ------
+ arch/arm/mach-berlin/platsmp.c        |    3 +--
+ arch/arm/mach-hisi/Makefile           |    2 +-
+ arch/arm/mach-hisi/core.h             |    1 -
+ arch/arm/mach-hisi/headsmp.S          |   16 ----------------
+ arch/arm/mach-hisi/platsmp.c          |    4 ++--
+ arch/arm/mach-imx/headsmp.S           |    1 -
+ arch/arm/mach-mvebu/headsmp-a9.S      |    1 -
+ arch/arm/mach-prima2/headsmp.S        |    1 -
+ arch/arm/mach-rockchip/core.h         |    1 -
+ arch/arm/mach-rockchip/headsmp.S      |    8 --------
+ arch/arm/mach-rockchip/platsmp.c      |    5 ++---
+ arch/arm/mach-shmobile/common.h       |    1 -
+ arch/arm/mach-shmobile/headsmp-scu.S  |    4 ++--
+ arch/arm/mach-shmobile/headsmp.S      |    7 -------
+ arch/arm/mach-shmobile/platsmp-apmu.c |    2 +-
+ arch/arm/mach-socfpga/core.h          |    1 -
+ arch/arm/mach-socfpga/headsmp.S       |    5 -----
+ arch/arm/mach-socfpga/platsmp.c       |    2 +-
+ arch/arm/mach-tegra/Makefile          |    2 +-
+ arch/arm/mach-tegra/headsmp.S         |   12 ------------
+ arch/arm/mach-tegra/reset.c           |    2 +-
+ arch/arm/mach-tegra/reset.h           |    1 -
+ arch/arm/mach-zynq/common.h           |    2 --
+ arch/arm/mach-zynq/headsmp.S          |    5 -----
+ arch/arm/mach-zynq/platsmp.c          |    5 ++---
+ arch/arm/mm/proc-v7.S                 |    2 +-
+ 31 files changed, 17 insertions(+), 143 deletions(-)
+
+--- a/arch/arm/mach-bcm/Makefile
++++ b/arch/arm/mach-bcm/Makefile
+@@ -43,5 +43,5 @@ obj-$(CONFIG_ARCH_BCM_63XX)  := bcm63xx.o
+ ifeq ($(CONFIG_ARCH_BRCMSTB),y)
+ CFLAGS_platsmp-brcmstb.o      += -march=armv7-a
+ obj-y                         += brcmstb.o
+-obj-$(CONFIG_SMP)             += headsmp-brcmstb.o platsmp-brcmstb.o
++obj-$(CONFIG_SMP)             += platsmp-brcmstb.o
+ endif
+--- a/arch/arm/mach-bcm/brcmstb.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-/*
+- * Copyright (C) 2013-2014 Broadcom Corporation
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation version 2.
+- *
+- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+- * kind, whether express or implied; without even the implied warranty
+- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+- * GNU General Public License for more details.
+- */
+-
+-#ifndef __BRCMSTB_H__
+-#define __BRCMSTB_H__
+-
+-void brcmstb_secondary_startup(void);
+-
+-#endif /* __BRCMSTB_H__ */
+--- a/arch/arm/mach-bcm/headsmp-brcmstb.S
++++ /dev/null
+@@ -1,33 +0,0 @@
+-/*
+- * SMP boot code for secondary CPUs
+- * Based on arch/arm/mach-tegra/headsmp.S
+- *
+- * Copyright (C) 2010 NVIDIA, Inc.
+- * Copyright (C) 2013-2014 Broadcom Corporation
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation version 2.
+- *
+- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+- * kind, whether express or implied; without even the implied warranty
+- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+- * GNU General Public License for more details.
+- */
+-
+-#include <asm/assembler.h>
+-#include <linux/linkage.h>
+-#include <linux/init.h>
+-
+-        .section ".text.head", "ax"
+-
+-ENTRY(brcmstb_secondary_startup)
+-        /*
+-         * Ensure CPU is in a sane state by disabling all IRQs and switching
+-         * into SVC mode.
+-         */
+-        setmode       PSR_I_BIT | PSR_F_BIT | SVC_MODE, r0
+-
+-        bl      v7_invalidate_l1
+-        b       secondary_startup
+-ENDPROC(brcmstb_secondary_startup)
+--- a/arch/arm/mach-bcm/platsmp-brcmstb.c
++++ b/arch/arm/mach-bcm/platsmp-brcmstb.c
+@@ -30,8 +30,6 @@
+ #include <asm/mach-types.h>
+ #include <asm/smp_plat.h>
+-#include "brcmstb.h"
+-
+ enum {
+       ZONE_MAN_CLKEN_MASK             = BIT(0),
+       ZONE_MAN_RESET_CNTL_MASK        = BIT(1),
+@@ -153,7 +151,7 @@ static void brcmstb_cpu_boot(u32 cpu)
+        * Set the reset vector to point to the secondary_startup
+        * routine
+        */
+-      cpu_set_boot_addr(cpu, virt_to_phys(brcmstb_secondary_startup));
++      cpu_set_boot_addr(cpu, virt_to_phys(secondary_startup));
+       /* Unhalt the cpu */
+       cpu_rst_cfg_set(cpu, 0);
+--- a/arch/arm/mach-berlin/headsmp.S
++++ b/arch/arm/mach-berlin/headsmp.S
+@@ -12,12 +12,6 @@
+ #include <linux/init.h>
+ #include <asm/assembler.h>
+-ENTRY(berlin_secondary_startup)
+- ARM_BE8(setend be)
+-      bl      v7_invalidate_l1
+-      b       secondary_startup
+-ENDPROC(berlin_secondary_startup)
+-
+ /*
+  * If the following instruction is set in the reset exception vector, CPUs
+  * will fetch the value of the software reset address vector when being
+--- a/arch/arm/mach-berlin/platsmp.c
++++ b/arch/arm/mach-berlin/platsmp.c
+@@ -22,7 +22,6 @@
+ #define RESET_VECT            0x00
+ #define SW_RESET_ADDR         0x94
+-extern void berlin_secondary_startup(void);
+ extern u32 boot_inst;
+ static void __iomem *cpu_ctrl;
+@@ -85,7 +84,7 @@ static void __init berlin_smp_prepare_cp
+        * Write the secondary startup address into the SW reset address
+        * vector. This is used by boot_inst.
+        */
+-      writel(virt_to_phys(berlin_secondary_startup), vectors_base + SW_RESET_ADDR);
++      writel(virt_to_phys(secondary_startup), vectors_base + SW_RESET_ADDR);
+       iounmap(vectors_base);
+ unmap_scu:
+--- a/arch/arm/mach-hisi/Makefile
++++ b/arch/arm/mach-hisi/Makefile
+@@ -6,4 +6,4 @@ CFLAGS_platmcpm.o      := -march=armv7-a
+ obj-y += hisilicon.o
+ obj-$(CONFIG_MCPM)            += platmcpm.o
+-obj-$(CONFIG_SMP)             += platsmp.o hotplug.o headsmp.o
++obj-$(CONFIG_SMP)             += platsmp.o hotplug.o
+--- a/arch/arm/mach-hisi/core.h
++++ b/arch/arm/mach-hisi/core.h
+@@ -12,7 +12,6 @@ extern void hi3xxx_cpu_die(unsigned int
+ extern int hi3xxx_cpu_kill(unsigned int cpu);
+ extern void hi3xxx_set_cpu(int cpu, bool enable);
+-extern void hisi_secondary_startup(void);
+ extern struct smp_operations hix5hd2_smp_ops;
+ extern void hix5hd2_set_cpu(int cpu, bool enable);
+ extern void hix5hd2_cpu_die(unsigned int cpu);
+--- a/arch/arm/mach-hisi/headsmp.S
++++ /dev/null
+@@ -1,16 +0,0 @@
+-/*
+- *  Copyright (c) 2014 Hisilicon Limited.
+- *  Copyright (c) 2014 Linaro Ltd.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-#include <linux/linkage.h>
+-#include <linux/init.h>
+-
+-      __CPUINIT
+-
+-ENTRY(hisi_secondary_startup)
+-      bl      v7_invalidate_l1
+-      b       secondary_startup
+--- a/arch/arm/mach-hisi/platsmp.c
++++ b/arch/arm/mach-hisi/platsmp.c
+@@ -118,7 +118,7 @@ static int hix5hd2_boot_secondary(unsign
+ {
+       phys_addr_t jumpaddr;
+-      jumpaddr = virt_to_phys(hisi_secondary_startup);
++      jumpaddr = virt_to_phys(secondary_startup);
+       hix5hd2_set_scu_boot_addr(HIX5HD2_BOOT_ADDRESS, jumpaddr);
+       hix5hd2_set_cpu(cpu, true);
+       arch_send_wakeup_ipi_mask(cpumask_of(cpu));
+@@ -156,7 +156,7 @@ static int hip01_boot_secondary(unsigned
+       struct device_node *node;
+-      jumpaddr = virt_to_phys(hisi_secondary_startup);
++      jumpaddr = virt_to_phys(secondary_startup);
+       hip01_set_boot_addr(HIP01_BOOT_ADDRESS, jumpaddr);
+       node = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
+--- a/arch/arm/mach-imx/headsmp.S
++++ b/arch/arm/mach-imx/headsmp.S
+@@ -25,7 +25,6 @@ diag_reg_offset:
+       .endm
+ ENTRY(v7_secondary_startup)
+-      bl      v7_invalidate_l1
+       set_diag_reg
+       b       secondary_startup
+ ENDPROC(v7_secondary_startup)
+--- a/arch/arm/mach-mvebu/headsmp-a9.S
++++ b/arch/arm/mach-mvebu/headsmp-a9.S
+@@ -21,7 +21,6 @@
+ ENTRY(mvebu_cortex_a9_secondary_startup)
+ ARM_BE8(setend        be)
+-      bl      v7_invalidate_l1
+       bl      armada_38x_scu_power_up
+       b       secondary_startup
+ ENDPROC(mvebu_cortex_a9_secondary_startup)
+--- a/arch/arm/mach-prima2/headsmp.S
++++ b/arch/arm/mach-prima2/headsmp.S
+@@ -15,7 +15,6 @@
+  * ready for them to initialise.
+  */
+ ENTRY(sirfsoc_secondary_startup)
+-      bl v7_invalidate_l1
+         mrc     p15, 0, r0, c0, c0, 5
+         and     r0, r0, #15
+         adr     r4, 1f
+--- a/arch/arm/mach-rockchip/core.h
++++ b/arch/arm/mach-rockchip/core.h
+@@ -17,4 +17,3 @@ extern char rockchip_secondary_trampolin
+ extern char rockchip_secondary_trampoline_end;
+ extern unsigned long rockchip_boot_fn;
+-extern void rockchip_secondary_startup(void);
+--- a/arch/arm/mach-rockchip/headsmp.S
++++ b/arch/arm/mach-rockchip/headsmp.S
+@@ -15,14 +15,6 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+-ENTRY(rockchip_secondary_startup)
+-      mrc     p15, 0, r0, c0, c0, 0   @ read main ID register
+-      ldr     r1, =0x00000c09         @ Cortex-A9 primary part number
+-      teq     r0, r1
+-      beq     v7_invalidate_l1
+-      b       secondary_startup
+-ENDPROC(rockchip_secondary_startup)
+-
+ ENTRY(rockchip_secondary_trampoline)
+       ldr     pc, 1f
+ ENDPROC(rockchip_secondary_trampoline)
+--- a/arch/arm/mach-rockchip/platsmp.c
++++ b/arch/arm/mach-rockchip/platsmp.c
+@@ -149,8 +149,7 @@ static int __cpuinit rockchip_boot_secon
+                * sram_base_addr + 8: start address for pc
+                * */
+               udelay(10);
+-              writel(virt_to_phys(rockchip_secondary_startup),
+-                      sram_base_addr + 8);
++              writel(virt_to_phys(secondary_startup), sram_base_addr + 8);
+               writel(0xDEADBEAF, sram_base_addr + 4);
+               dsb_sev();
+       }
+@@ -189,7 +188,7 @@ static int __init rockchip_smp_prepare_s
+       }
+       /* set the boot function for the sram code */
+-      rockchip_boot_fn = virt_to_phys(rockchip_secondary_startup);
++      rockchip_boot_fn = virt_to_phys(secondary_startup);
+       /* copy the trampoline to sram, that runs during startup of the core */
+       memcpy(sram_base_addr, &rockchip_secondary_trampoline, trampoline_sz);
+--- a/arch/arm/mach-shmobile/common.h
++++ b/arch/arm/mach-shmobile/common.h
+@@ -14,7 +14,6 @@ extern void shmobile_smp_sleep(void);
+ extern void shmobile_smp_hook(unsigned int cpu, unsigned long fn,
+                             unsigned long arg);
+ extern int shmobile_smp_cpu_disable(unsigned int cpu);
+-extern void shmobile_invalidate_start(void);
+ extern void shmobile_boot_scu(void);
+ extern void shmobile_smp_scu_prepare_cpus(unsigned int max_cpus);
+ extern void shmobile_smp_scu_cpu_die(unsigned int cpu);
+--- a/arch/arm/mach-shmobile/headsmp-scu.S
++++ b/arch/arm/mach-shmobile/headsmp-scu.S
+@@ -22,7 +22,7 @@
+  * Boot code for secondary CPUs.
+  *
+  * First we turn on L1 cache coherency for our CPU. Then we jump to
+- * shmobile_invalidate_start that invalidates the cache and hands over control
++ * secondary_startup that invalidates the cache and hands over control
+  * to the common ARM startup code.
+  */
+ ENTRY(shmobile_boot_scu)
+@@ -36,7 +36,7 @@ ENTRY(shmobile_boot_scu)
+       bic     r2, r2, r3              @ Clear bits of our CPU (Run Mode)
+       str     r2, [r0, #8]            @ write back
+-      b       shmobile_invalidate_start
++      b       secondary_startup
+ ENDPROC(shmobile_boot_scu)
+       .text
+--- a/arch/arm/mach-shmobile/headsmp.S
++++ b/arch/arm/mach-shmobile/headsmp.S
+@@ -16,13 +16,6 @@
+ #include <asm/assembler.h>
+ #include <asm/memory.h>
+-#ifdef CONFIG_SMP
+-ENTRY(shmobile_invalidate_start)
+-      bl      v7_invalidate_l1
+-      b       secondary_startup
+-ENDPROC(shmobile_invalidate_start)
+-#endif
+-
+ /*
+  * Reset vector for secondary CPUs.
+  * This will be mapped at address 0 by SBAR register.
+--- a/arch/arm/mach-shmobile/platsmp-apmu.c
++++ b/arch/arm/mach-shmobile/platsmp-apmu.c
+@@ -133,7 +133,7 @@ void __init shmobile_smp_apmu_prepare_cp
+ int shmobile_smp_apmu_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+       /* For this particular CPU register boot vector */
+-      shmobile_smp_hook(cpu, virt_to_phys(shmobile_invalidate_start), 0);
++      shmobile_smp_hook(cpu, virt_to_phys(secondary_startup), 0);
+       return apmu_wrap(cpu, apmu_power_on);
+ }
+--- a/arch/arm/mach-socfpga/core.h
++++ b/arch/arm/mach-socfpga/core.h
+@@ -31,7 +31,6 @@
+ #define RSTMGR_MPUMODRST_CPU1         0x2     /* CPU1 Reset */
+-extern void socfpga_secondary_startup(void);
+ extern void __iomem *socfpga_scu_base_addr;
+ extern void socfpga_init_clocks(void);
+--- a/arch/arm/mach-socfpga/headsmp.S
++++ b/arch/arm/mach-socfpga/headsmp.S
+@@ -30,8 +30,3 @@ ENTRY(secondary_trampoline)
+ 1:    .long   .
+       .long   socfpga_cpu1start_addr
+ ENTRY(secondary_trampoline_end)
+-
+-ENTRY(socfpga_secondary_startup)
+-       bl      v7_invalidate_l1
+-       b       secondary_startup
+-ENDPROC(socfpga_secondary_startup)
+--- a/arch/arm/mach-socfpga/platsmp.c
++++ b/arch/arm/mach-socfpga/platsmp.c
+@@ -40,7 +40,7 @@ static int socfpga_boot_secondary(unsign
+               memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
+-              writel(virt_to_phys(socfpga_secondary_startup),
++              writel(virt_to_phys(secondary_startup),
+                      sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff));
+               flush_cache_all();
+--- a/arch/arm/mach-tegra/Makefile
++++ b/arch/arm/mach-tegra/Makefile
+@@ -19,7 +19,7 @@ obj-$(CONFIG_ARCH_TEGRA_3x_SOC)              += pm-t
+ ifeq ($(CONFIG_CPU_IDLE),y)
+ obj-$(CONFIG_ARCH_TEGRA_3x_SOC)               += cpuidle-tegra30.o
+ endif
+-obj-$(CONFIG_SMP)                     += platsmp.o headsmp.o
++obj-$(CONFIG_SMP)                     += platsmp.o
+ obj-$(CONFIG_HOTPLUG_CPU)               += hotplug.o
+ obj-$(CONFIG_ARCH_TEGRA_114_SOC)      += sleep-tegra30.o
+--- a/arch/arm/mach-tegra/headsmp.S
++++ /dev/null
+@@ -1,12 +0,0 @@
+-#include <linux/linkage.h>
+-#include <linux/init.h>
+-
+-#include "sleep.h"
+-
+-        .section ".text.head", "ax"
+-
+-ENTRY(tegra_secondary_startup)
+-        check_cpu_part_num 0xc09, r8, r9
+-        bleq    v7_invalidate_l1
+-        b       secondary_startup
+-ENDPROC(tegra_secondary_startup)
+--- a/arch/arm/mach-tegra/reset.c
++++ b/arch/arm/mach-tegra/reset.c
+@@ -94,7 +94,7 @@ void __init tegra_cpu_reset_handler_init
+       __tegra_cpu_reset_handler_data[TEGRA_RESET_MASK_PRESENT] =
+               *((u32 *)cpu_possible_mask);
+       __tegra_cpu_reset_handler_data[TEGRA_RESET_STARTUP_SECONDARY] =
+-              virt_to_phys((void *)tegra_secondary_startup);
++              virt_to_phys((void *)secondary_startup);
+ #endif
+ #ifdef CONFIG_PM_SLEEP
+--- a/arch/arm/mach-tegra/reset.h
++++ b/arch/arm/mach-tegra/reset.h
+@@ -37,7 +37,6 @@ void __tegra_cpu_reset_handler_start(voi
+ void __tegra_cpu_reset_handler(void);
+ void __tegra20_cpu1_resettable_status_offset(void);
+ void __tegra_cpu_reset_handler_end(void);
+-void tegra_secondary_startup(void);
+ #ifdef CONFIG_PM_SLEEP
+ #define tegra_cpu_lp1_mask \
+--- a/arch/arm/mach-zynq/common.h
++++ b/arch/arm/mach-zynq/common.h
+@@ -17,8 +17,6 @@
+ #ifndef __MACH_ZYNQ_COMMON_H__
+ #define __MACH_ZYNQ_COMMON_H__
+-void zynq_secondary_startup(void);
+-
+ extern int zynq_slcr_init(void);
+ extern int zynq_early_slcr_init(void);
+ extern void zynq_slcr_system_reset(void);
+--- a/arch/arm/mach-zynq/headsmp.S
++++ b/arch/arm/mach-zynq/headsmp.S
+@@ -22,8 +22,3 @@ zynq_secondary_trampoline_jump:
+ .globl zynq_secondary_trampoline_end
+ zynq_secondary_trampoline_end:
+ ENDPROC(zynq_secondary_trampoline)
+-
+-ENTRY(zynq_secondary_startup)
+-      bl      v7_invalidate_l1
+-      b       secondary_startup
+-ENDPROC(zynq_secondary_startup)
+--- a/arch/arm/mach-zynq/platsmp.c
++++ b/arch/arm/mach-zynq/platsmp.c
+@@ -87,10 +87,9 @@ int zynq_cpun_start(u32 address, int cpu
+ }
+ EXPORT_SYMBOL(zynq_cpun_start);
+-static int zynq_boot_secondary(unsigned int cpu,
+-                                              struct task_struct *idle)
++static int zynq_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+-      return zynq_cpun_start(virt_to_phys(zynq_secondary_startup), cpu);
++      return zynq_cpun_start(virt_to_phys(secondary_startup), cpu);
+ }
+ /*
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -336,7 +336,7 @@ __v7_pj4b_setup:
+ __v7_setup:
+       adr     r12, __v7_setup_stack           @ the local stack
+       stmia   r12, {r0-r5, r7, r9, r11, lr}
+-      bl      v7_flush_dcache_louis
++      bl      v7_invalidate_l1
+       ldmia   r12, {r0-r5, r7, r9, r11, lr}
+       mrc     p15, 0, r0, c0, c0, 0           @ read main ID register
diff --git a/queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch b/queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch
new file mode 100644 (file)
index 0000000..999a9f0
--- /dev/null
@@ -0,0 +1,50 @@
+From b310c178e6d897f82abb9da3af1cd7c02b09f592 Mon Sep 17 00:00:00 2001
+From: Horia Geant? <horia.geanta@freescale.com>
+Date: Tue, 11 Aug 2015 20:19:20 +0300
+Subject: crypto: caam - fix memory corruption in ahash_final_ctx
+
+From: Horia Geant? <horia.geanta@freescale.com>
+
+commit b310c178e6d897f82abb9da3af1cd7c02b09f592 upstream.
+
+When doing pointer operation for accessing the HW S/G table,
+a value representing number of entries (and not number of bytes)
+must be used.
+
+Fixes: 045e36780f115 ("crypto: caam - ahash hmac support")
+Signed-off-by: Horia Geant? <horia.geanta@freescale.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/caam/caamhash.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -909,13 +909,14 @@ static int ahash_final_ctx(struct ahash_
+                         state->buflen_1;
+       u32 *sh_desc = ctx->sh_desc_fin, *desc;
+       dma_addr_t ptr = ctx->sh_desc_fin_dma;
+-      int sec4_sg_bytes;
++      int sec4_sg_bytes, sec4_sg_src_index;
+       int digestsize = crypto_ahash_digestsize(ahash);
+       struct ahash_edesc *edesc;
+       int ret = 0;
+       int sh_len;
+-      sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry);
++      sec4_sg_src_index = 1 + (buflen ? 1 : 0);
++      sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry);
+       /* allocate space for base edesc and hw desc commands, link tables */
+       edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN +
+@@ -942,7 +943,7 @@ static int ahash_final_ctx(struct ahash_
+       state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1,
+                                               buf, state->buf_dma, buflen,
+                                               last_buflen);
+-      (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN;
++      (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN;
+       edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg,
+                                           sec4_sg_bytes, DMA_TO_DEVICE);
diff --git a/queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch b/queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch
new file mode 100644 (file)
index 0000000..d3d7592
--- /dev/null
@@ -0,0 +1,186 @@
+From d3392f41f6d3cd0a034bd0aca47fabea2b47218e Mon Sep 17 00:00:00 2001
+From: Jan Stancek <jstancek@redhat.com>
+Date: Sat, 8 Aug 2015 08:47:28 +0200
+Subject: crypto: nx - respect sg limit bounds when building sg lists for SHA
+
+From: Jan Stancek <jstancek@redhat.com>
+
+commit d3392f41f6d3cd0a034bd0aca47fabea2b47218e upstream.
+
+Commit 000851119e80 changed sha256/512 update functions to
+pass more data to nx_build_sg_list(), which ends with
+sg list overflows and usually with update functions failing
+for data larger than max_sg_len * NX_PAGE_SIZE.
+
+This happens because:
+- both "total" and "to_process" are updated, which leads to
+  "to_process" getting overflowed for some data lengths
+  For example:
+    In first iteration "total" is 50, and let's assume "to_process"
+    is 30 due to sg limits. At the end of first iteration "total" is
+    set to 20. At start of 2nd iteration "to_process" overflows on:
+      to_process = total - to_process;
+- "in_sg" is not reset to nx_ctx->in_sg after each iteration
+- nx_build_sg_list() is hitting overflow because the amount of data
+  passed to it would require more than sgmax elements
+- as consequence of previous item, data stored in overflowed sg list
+  may no longer be aligned to SHA*_BLOCK_SIZE
+
+This patch changes sha256/512 update functions so that "to_process"
+respects sg limits and never tries to pass more data to
+nx_build_sg_list() to avoid overflows. "to_process" is calculated
+as minimum of "total" and sg limits at start of every iteration.
+
+Fixes: 000851119e80 ("crypto: nx - Fix SHA concurrence issue and sg
+                     limit bounds")
+Signed-off-by: Jan Stancek <jstancek@redhat.com>
+Cc: Leonidas Da Silva Barbosa <leosilva@linux.vnet.ibm.com>
+Cc: Marcelo Henrique Cerri <mhcerri@linux.vnet.ibm.com>
+Cc: Fionnuala Gunter <fin@linux.vnet.ibm.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/nx/nx-sha256.c |   27 ++++++++++++++++-----------
+ drivers/crypto/nx/nx-sha512.c |   28 ++++++++++++++++------------
+ 2 files changed, 32 insertions(+), 23 deletions(-)
+
+--- a/drivers/crypto/nx/nx-sha256.c
++++ b/drivers/crypto/nx/nx-sha256.c
+@@ -71,7 +71,6 @@ static int nx_sha256_update(struct shash
+       struct sha256_state *sctx = shash_desc_ctx(desc);
+       struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
+       struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
+-      struct nx_sg *in_sg;
+       struct nx_sg *out_sg;
+       u64 to_process = 0, leftover, total;
+       unsigned long irq_flags;
+@@ -97,7 +96,6 @@ static int nx_sha256_update(struct shash
+       NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE;
+       NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION;
+-      in_sg = nx_ctx->in_sg;
+       max_sg_len = min_t(u64, nx_ctx->ap->sglen,
+                       nx_driver.of.max_sg_len/sizeof(struct nx_sg));
+       max_sg_len = min_t(u64, max_sg_len,
+@@ -114,17 +112,12 @@ static int nx_sha256_update(struct shash
+       }
+       do {
+-              /*
+-               * to_process: the SHA256_BLOCK_SIZE data chunk to process in
+-               * this update. This value is also restricted by the sg list
+-               * limits.
+-               */
+-              to_process = total - to_process;
+-              to_process = to_process & ~(SHA256_BLOCK_SIZE - 1);
++              int used_sgs = 0;
++              struct nx_sg *in_sg = nx_ctx->in_sg;
+               if (buf_len) {
+                       data_len = buf_len;
+-                      in_sg = nx_build_sg_list(nx_ctx->in_sg,
++                      in_sg = nx_build_sg_list(in_sg,
+                                                (u8 *) sctx->buf,
+                                                &data_len,
+                                                max_sg_len);
+@@ -133,15 +126,27 @@ static int nx_sha256_update(struct shash
+                               rc = -EINVAL;
+                               goto out;
+                       }
++                      used_sgs = in_sg - nx_ctx->in_sg;
+               }
++              /* to_process: SHA256_BLOCK_SIZE aligned chunk to be
++               * processed in this iteration. This value is restricted
++               * by sg list limits and number of sgs we already used
++               * for leftover data. (see above)
++               * In ideal case, we could allow NX_PAGE_SIZE * max_sg_len,
++               * but because data may not be aligned, we need to account
++               * for that too. */
++              to_process = min_t(u64, total,
++                      (max_sg_len - 1 - used_sgs) * NX_PAGE_SIZE);
++              to_process = to_process & ~(SHA256_BLOCK_SIZE - 1);
++
+               data_len = to_process - buf_len;
+               in_sg = nx_build_sg_list(in_sg, (u8 *) data,
+                                        &data_len, max_sg_len);
+               nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
+-              to_process = (data_len + buf_len);
++              to_process = data_len + buf_len;
+               leftover = total - to_process;
+               /*
+--- a/drivers/crypto/nx/nx-sha512.c
++++ b/drivers/crypto/nx/nx-sha512.c
+@@ -71,7 +71,6 @@ static int nx_sha512_update(struct shash
+       struct sha512_state *sctx = shash_desc_ctx(desc);
+       struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
+       struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
+-      struct nx_sg *in_sg;
+       struct nx_sg *out_sg;
+       u64 to_process, leftover = 0, total;
+       unsigned long irq_flags;
+@@ -97,7 +96,6 @@ static int nx_sha512_update(struct shash
+       NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE;
+       NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION;
+-      in_sg = nx_ctx->in_sg;
+       max_sg_len = min_t(u64, nx_ctx->ap->sglen,
+                       nx_driver.of.max_sg_len/sizeof(struct nx_sg));
+       max_sg_len = min_t(u64, max_sg_len,
+@@ -114,18 +112,12 @@ static int nx_sha512_update(struct shash
+       }
+       do {
+-              /*
+-               * to_process: the SHA512_BLOCK_SIZE data chunk to process in
+-               * this update. This value is also restricted by the sg list
+-               * limits.
+-               */
+-              to_process = total - leftover;
+-              to_process = to_process & ~(SHA512_BLOCK_SIZE - 1);
+-              leftover = total - to_process;
++              int used_sgs = 0;
++              struct nx_sg *in_sg = nx_ctx->in_sg;
+               if (buf_len) {
+                       data_len = buf_len;
+-                      in_sg = nx_build_sg_list(nx_ctx->in_sg,
++                      in_sg = nx_build_sg_list(in_sg,
+                                                (u8 *) sctx->buf,
+                                                &data_len, max_sg_len);
+@@ -133,8 +125,20 @@ static int nx_sha512_update(struct shash
+                               rc = -EINVAL;
+                               goto out;
+                       }
++                      used_sgs = in_sg - nx_ctx->in_sg;
+               }
++              /* to_process: SHA512_BLOCK_SIZE aligned chunk to be
++               * processed in this iteration. This value is restricted
++               * by sg list limits and number of sgs we already used
++               * for leftover data. (see above)
++               * In ideal case, we could allow NX_PAGE_SIZE * max_sg_len,
++               * but because data may not be aligned, we need to account
++               * for that too. */
++              to_process = min_t(u64, total,
++                      (max_sg_len - 1 - used_sgs) * NX_PAGE_SIZE);
++              to_process = to_process & ~(SHA512_BLOCK_SIZE - 1);
++
+               data_len = to_process - buf_len;
+               in_sg = nx_build_sg_list(in_sg, (u8 *) data,
+                                        &data_len, max_sg_len);
+@@ -146,7 +150,7 @@ static int nx_sha512_update(struct shash
+                       goto out;
+               }
+-              to_process = (data_len + buf_len);
++              to_process = data_len + buf_len;
+               leftover = total - to_process;
+               /*
diff --git a/queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch b/queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch
new file mode 100644 (file)
index 0000000..75dbb82
--- /dev/null
@@ -0,0 +1,63 @@
+From f6979adeaab578f8ca14fdd32b06ddee0d9d3314 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Fri, 5 Jun 2015 14:20:46 -0700
+Subject: libfc: Fix fc_exch_recv_req() error path
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit f6979adeaab578f8ca14fdd32b06ddee0d9d3314 upstream.
+
+Due to patch "libfc: Do not invoke the response handler after
+fc_exch_done()" (commit ID 7030fd62) the lport_recv() call
+in fc_exch_recv_req() is passed a dangling pointer. Avoid this
+by moving the fc_frame_free() call from fc_invoke_resp() to its
+callers. This patch fixes the following crash:
+
+general protection fault: 0000 [#3] PREEMPT SMP
+RIP: fc_lport_recv_req+0x72/0x280 [libfc]
+Call Trace:
+ fc_exch_recv+0x642/0xde0 [libfc]
+ fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe]
+ kthread+0x10a/0x120
+ ret_from_fork+0x42/0x70
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Vasu Dev <vasu.dev@intel.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/libfc/fc_exch.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -733,8 +733,6 @@ static bool fc_invoke_resp(struct fc_exc
+       if (resp) {
+               resp(sp, fp, arg);
+               res = true;
+-      } else if (!IS_ERR(fp)) {
+-              fc_frame_free(fp);
+       }
+       spin_lock_bh(&ep->ex_lock);
+@@ -1596,7 +1594,8 @@ static void fc_exch_recv_seq_resp(struct
+        * If new exch resp handler is valid then call that
+        * first.
+        */
+-      fc_invoke_resp(ep, sp, fp);
++      if (!fc_invoke_resp(ep, sp, fp))
++              fc_frame_free(fp);
+       fc_exch_release(ep);
+       return;
+@@ -1695,7 +1694,8 @@ static void fc_exch_abts_resp(struct fc_
+       fc_exch_hold(ep);
+       if (!rc)
+               fc_exch_delete(ep);
+-      fc_invoke_resp(ep, sp, fp);
++      if (!fc_invoke_resp(ep, sp, fp))
++              fc_frame_free(fp);
+       if (has_rec)
+               fc_exch_timer_set(ep, ep->r_a_tov);
+       fc_exch_release(ep);
diff --git a/queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch b/queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch
new file mode 100644 (file)
index 0000000..4671577
--- /dev/null
@@ -0,0 +1,76 @@
+From 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Fri, 5 Jun 2015 14:20:51 -0700
+Subject: libfc: Fix fc_fcp_cleanup_each_cmd()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 upstream.
+
+Since fc_fcp_cleanup_cmd() can sleep this function must not
+be called while holding a spinlock. This patch avoids that
+fc_fcp_cleanup_each_cmd() triggers the following bug:
+
+BUG: scheduling while atomic: sg_reset/1512/0x00000202
+1 lock held by sg_reset/1512:
+ #0:  (&(&fsp->scsi_pkt_lock)->rlock){+.-...}, at: [<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
+Preemption disabled at:[<ffffffffc0225cd5>] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]
+Call Trace:
+ [<ffffffff816c612c>] dump_stack+0x4f/0x7b
+ [<ffffffff810828bc>] __schedule_bug+0x6c/0xd0
+ [<ffffffff816c87aa>] __schedule+0x71a/0xa10
+ [<ffffffff816c8ad2>] schedule+0x32/0x80
+ [<ffffffffc0217eac>] fc_seq_set_resp+0xac/0x100 [libfc]
+ [<ffffffffc0218b11>] fc_exch_done+0x41/0x60 [libfc]
+ [<ffffffffc0225cff>] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc]
+ [<ffffffffc0225f43>] fc_eh_device_reset+0x1c3/0x270 [libfc]
+ [<ffffffff814a2cc9>] scsi_try_bus_device_reset+0x29/0x60
+ [<ffffffff814a3908>] scsi_ioctl_reset+0x258/0x2d0
+ [<ffffffff814a2650>] scsi_ioctl+0x150/0x440
+ [<ffffffff814b3a9d>] sd_ioctl+0xad/0x120
+ [<ffffffff8132f266>] blkdev_ioctl+0x1b6/0x810
+ [<ffffffff811da608>] block_ioctl+0x38/0x40
+ [<ffffffff811b4e08>] do_vfs_ioctl+0x2f8/0x530
+ [<ffffffff811b50c1>] SyS_ioctl+0x81/0xa0
+ [<ffffffff816cf8b2>] system_call_fastpath+0x16/0x7a
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Vasu Dev <vasu.dev@intel.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/libfc/fc_fcp.c |   19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/libfc/fc_fcp.c
++++ b/drivers/scsi/libfc/fc_fcp.c
+@@ -1039,11 +1039,26 @@ restart:
+               fc_fcp_pkt_hold(fsp);
+               spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
+-              if (!fc_fcp_lock_pkt(fsp)) {
++              spin_lock_bh(&fsp->scsi_pkt_lock);
++              if (!(fsp->state & FC_SRB_COMPL)) {
++                      fsp->state |= FC_SRB_COMPL;
++                      /*
++                       * TODO: dropping scsi_pkt_lock and then reacquiring
++                       * again around fc_fcp_cleanup_cmd() is required,
++                       * since fc_fcp_cleanup_cmd() calls into
++                       * fc_seq_set_resp() and that func preempts cpu using
++                       * schedule. May be schedule and related code should be
++                       * removed instead of unlocking here to avoid scheduling
++                       * while atomic bug.
++                       */
++                      spin_unlock_bh(&fsp->scsi_pkt_lock);
++
+                       fc_fcp_cleanup_cmd(fsp, error);
++
++                      spin_lock_bh(&fsp->scsi_pkt_lock);
+                       fc_io_compl(fsp);
+-                      fc_fcp_unlock_pkt(fsp);
+               }
++              spin_unlock_bh(&fsp->scsi_pkt_lock);
+               fc_fcp_pkt_release(fsp);
+               spin_lock_irqsave(&si->scsi_queue_lock, flags);
diff --git a/queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch b/queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch
new file mode 100644 (file)
index 0000000..e0603e0
--- /dev/null
@@ -0,0 +1,108 @@
+From 660d0831d1494a6837b2f810d08b5be092c1f31d Mon Sep 17 00:00:00 2001
+From: John Soni Jose <sony.john@avagotech.com>
+Date: Wed, 24 Jun 2015 06:41:58 +0530
+Subject: libiscsi: Fix host busy blocking during connection teardown
+
+From: John Soni Jose <sony.john@avagotech.com>
+
+commit 660d0831d1494a6837b2f810d08b5be092c1f31d upstream.
+
+In case of hw iscsi offload, an host can have N-number of active
+connections. There can be IO's running on some connections which
+make host->host_busy always TRUE. Now if logout from a connection
+is tried then the code gets into an infinite loop as host->host_busy
+is always TRUE.
+
+ iscsi_conn_teardown(....)
+ {
+   .........
+    /*
+     * Block until all in-progress commands for this connection
+     * time out or fail.
+     */
+     for (;;) {
+      spin_lock_irqsave(session->host->host_lock, flags);
+      if (!atomic_read(&session->host->host_busy)) { /* OK for ERL == 0 */
+             spin_unlock_irqrestore(session->host->host_lock, flags);
+              break;
+      }
+     spin_unlock_irqrestore(session->host->host_lock, flags);
+     msleep_interruptible(500);
+     iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): "
+                 "host_busy %d host_failed %d\n",
+                 atomic_read(&session->host->host_busy),
+                 session->host->host_failed);
+
+       ................
+       ...............
+     }
+  }
+
+This is not an issue with software-iscsi/iser as each cxn is a separate
+host.
+
+Fix:
+Acquiring eh_mutex in iscsi_conn_teardown() before setting
+session->state = ISCSI_STATE_TERMINATE.
+
+Signed-off-by: John Soni Jose <sony.john@avagotech.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Reviewed-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/libiscsi.c |   25 ++-----------------------
+ 1 file changed, 2 insertions(+), 23 deletions(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2941,10 +2941,10 @@ void iscsi_conn_teardown(struct iscsi_cl
+ {
+       struct iscsi_conn *conn = cls_conn->dd_data;
+       struct iscsi_session *session = conn->session;
+-      unsigned long flags;
+       del_timer_sync(&conn->transport_timer);
++      mutex_lock(&session->eh_mutex);
+       spin_lock_bh(&session->frwd_lock);
+       conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
+       if (session->leadconn == conn) {
+@@ -2956,28 +2956,6 @@ void iscsi_conn_teardown(struct iscsi_cl
+       }
+       spin_unlock_bh(&session->frwd_lock);
+-      /*
+-       * Block until all in-progress commands for this connection
+-       * time out or fail.
+-       */
+-      for (;;) {
+-              spin_lock_irqsave(session->host->host_lock, flags);
+-              if (!atomic_read(&session->host->host_busy)) { /* OK for ERL == 0 */
+-                      spin_unlock_irqrestore(session->host->host_lock, flags);
+-                      break;
+-              }
+-              spin_unlock_irqrestore(session->host->host_lock, flags);
+-              msleep_interruptible(500);
+-              iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): "
+-                                "host_busy %d host_failed %d\n",
+-                                atomic_read(&session->host->host_busy),
+-                                session->host->host_failed);
+-              /*
+-               * force eh_abort() to unblock
+-               */
+-              wake_up(&conn->ehwait);
+-      }
+-
+       /* flush queued up work because we free the connection below */
+       iscsi_suspend_tx(conn);
+@@ -2994,6 +2972,7 @@ void iscsi_conn_teardown(struct iscsi_cl
+       if (session->leadconn == conn)
+               session->leadconn = NULL;
+       spin_unlock_bh(&session->frwd_lock);
++      mutex_unlock(&session->eh_mutex);
+       iscsi_destroy_conn(cls_conn);
+ }
diff --git a/queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch b/queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch
new file mode 100644 (file)
index 0000000..11b2ee1
--- /dev/null
@@ -0,0 +1,80 @@
+From 72e43164fd472f6c2659c8313b87da962322dbcf Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Sun, 14 Jun 2015 15:41:50 +0100
+Subject: mfd: arizona: Fix initialisation of the PM runtime
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 72e43164fd472f6c2659c8313b87da962322dbcf upstream.
+
+The PM runtime core by default assumes a chip is suspended when runtime
+PM is enabled. Currently the arizona driver enables runtime PM when the
+chip is fully active and then disables the DCVDD regulator at the end of
+arizona_dev_init. This however has several problems, firstly the if we
+reach the end of arizona_dev_init, we did not properly follow all the
+proceedures for shutting down the chip, and most notably we never marked
+the chip as cache only so any writes occurring between then and the next
+PM runtime resume will be lost. Secondly, if we are already resumed when
+we reach the end of dev_init, then at best we get unbalanced regulator
+enable/disables at work we lose DCVDD whilst we need it.
+
+Additionally, since the commit 4f0216409f7c ("mfd: arizona: Add better
+support for system suspend"), the PM runtime operations may
+disable/enable the IRQ, so the IRQs must now be enabled before we call
+any PM operations.
+
+This patch adds a call to pm_runtime_set_active to inform the PM core
+that the device is starting up active and moves the PM enabling to
+around the IRQ initialisation to avoid any PM callbacks happening until
+the IRQs are initialised.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/arizona-core.c |   14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -912,10 +912,6 @@ int arizona_dev_init(struct arizona *ari
+                            arizona->pdata.gpio_defaults[i]);
+       }
+-      pm_runtime_set_autosuspend_delay(arizona->dev, 100);
+-      pm_runtime_use_autosuspend(arizona->dev);
+-      pm_runtime_enable(arizona->dev);
+-
+       /* Chip default */
+       if (!arizona->pdata.clk32k_src)
+               arizona->pdata.clk32k_src = ARIZONA_32KZ_MCLK2;
+@@ -1012,11 +1008,17 @@ int arizona_dev_init(struct arizona *ari
+                                          arizona->pdata.spk_fmt[i]);
+       }
++      pm_runtime_set_active(arizona->dev);
++      pm_runtime_enable(arizona->dev);
++
+       /* Set up for interrupts */
+       ret = arizona_irq_init(arizona);
+       if (ret != 0)
+               goto err_reset;
++      pm_runtime_set_autosuspend_delay(arizona->dev, 100);
++      pm_runtime_use_autosuspend(arizona->dev);
++
+       arizona_request_irq(arizona, ARIZONA_IRQ_CLKGEN_ERR, "CLKGEN error",
+                           arizona_clkgen_err, arizona);
+       arizona_request_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, "Overclocked",
+@@ -1045,10 +1047,6 @@ int arizona_dev_init(struct arizona *ari
+               goto err_irq;
+       }
+-#ifdef CONFIG_PM
+-      regulator_disable(arizona->dcvdd);
+-#endif
+-
+       return 0;
+ err_irq:
diff --git a/queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch b/queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch
new file mode 100644 (file)
index 0000000..93aba04
--- /dev/null
@@ -0,0 +1,51 @@
+From 9f161439e4104b641a7bfb9b89581d801159fec8 Mon Sep 17 00:00:00 2001
+From: Markos Chandras <markos.chandras@imgtec.com>
+Date: Thu, 13 Aug 2015 08:47:59 +0100
+Subject: MIPS: Fix seccomp syscall argument for MIPS64
+
+From: Markos Chandras <markos.chandras@imgtec.com>
+
+commit 9f161439e4104b641a7bfb9b89581d801159fec8 upstream.
+
+Commit 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)")
+fixed indirect system calls on O32 but it also introduced a bug for MIPS64
+where it erroneously modified the v0 (syscall) register with the assumption
+that the sycall offset hasn't been taken into consideration. This breaks
+seccomp on MIPS64 n64 and n32 ABIs. We fix this by replacing the addition
+with a move instruction.
+
+Fixes: 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)")
+Reviewed-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/10951/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/scall64-64.S  |    2 +-
+ arch/mips/kernel/scall64-n32.S |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/scall64-64.S
++++ b/arch/mips/kernel/scall64-64.S
+@@ -80,7 +80,7 @@ syscall_trace_entry:
+       SAVE_STATIC
+       move    s0, t2
+       move    a0, sp
+-      daddiu  a1, v0, __NR_64_Linux
++      move    a1, v0
+       jal     syscall_trace_enter
+       bltz    v0, 2f                  # seccomp failed? Skip syscall
+--- a/arch/mips/kernel/scall64-n32.S
++++ b/arch/mips/kernel/scall64-n32.S
+@@ -72,7 +72,7 @@ n32_syscall_trace_entry:
+       SAVE_STATIC
+       move    s0, t2
+       move    a0, sp
+-      daddiu  a1, v0, __NR_N32_Linux
++      move    a1, v0
+       jal     syscall_trace_enter
+       bltz    v0, 2f                  # seccomp failed? Skip syscall
diff --git a/queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch b/queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch
new file mode 100644 (file)
index 0000000..021b7c9
--- /dev/null
@@ -0,0 +1,55 @@
+From 8ef9724bf9718af81cfc5132253372f79c71b7e2 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 26 Jul 2015 21:34:50 -0700
+Subject: regmap: regcache-rbtree: Clean new present bits on present bitmap resize
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 8ef9724bf9718af81cfc5132253372f79c71b7e2 upstream.
+
+When inserting a new register into a block, the present bit map size is
+increased using krealloc. krealloc does not clear the additionally
+allocated memory, leaving it filled with random values. Result is that
+some registers are considered cached even though this is not the case.
+
+Fix the problem by clearing the additionally allocated memory. Also, if
+the bitmap size does not increase, do not reallocate the bitmap at all
+to reduce overhead.
+
+Fixes: 3f4ff561bc88 ("regmap: rbtree: Make cache_present bitmap per node")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/regmap/regcache-rbtree.c |   19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -296,11 +296,20 @@ static int regcache_rbtree_insert_to_blo
+       if (!blk)
+               return -ENOMEM;
+-      present = krealloc(rbnode->cache_present,
+-                  BITS_TO_LONGS(blklen) * sizeof(*present), GFP_KERNEL);
+-      if (!present) {
+-              kfree(blk);
+-              return -ENOMEM;
++      if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
++              present = krealloc(rbnode->cache_present,
++                                 BITS_TO_LONGS(blklen) * sizeof(*present),
++                                 GFP_KERNEL);
++              if (!present) {
++                      kfree(blk);
++                      return -ENOMEM;
++              }
++
++              memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
++                     (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
++                     * sizeof(*present));
++      } else {
++              present = rbnode->cache_present;
+       }
+       /* insert the register value in the correct place in the rbnode block */
diff --git a/queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch b/queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch
new file mode 100644 (file)
index 0000000..c46c4b0
--- /dev/null
@@ -0,0 +1,159 @@
+From fe16d4f202c59a560533a223bc6375739ee30944 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 3 Aug 2015 11:41:33 -0400
+Subject: Revert "libata-eh: Set 'information' field for autosense"
+
+From: Tejun Heo <tj@kernel.org>
+
+commit fe16d4f202c59a560533a223bc6375739ee30944 upstream.
+
+This reverts commit a1524f226a02aa6edebd90ae0752e97cfd78b159.
+
+As implemented, ACS-4 sense reporting for ATA devices bypasses error
+diagnosis and handling in libata degrading EH behavior significantly.
+Revert the related changes for now.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c |    4 ++--
+ drivers/ata/libata-eh.c   |    3 ---
+ drivers/ata/libata-scsi.c |   12 ------------
+ drivers/ata/libata.h      |    5 +----
+ drivers/scsi/scsi_error.c |   31 -------------------------------
+ include/scsi/scsi_eh.h    |    1 -
+ 6 files changed, 3 insertions(+), 53 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -694,11 +694,11 @@ static int ata_rwcmd_protocol(struct ata
+  *    RETURNS:
+  *    Block address read from @tf.
+  */
+-u64 ata_tf_read_block(const struct ata_taskfile *tf, struct ata_device *dev)
++u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev)
+ {
+       u64 block = 0;
+-      if (!dev || tf->flags & ATA_TFLAG_LBA) {
++      if (tf->flags & ATA_TFLAG_LBA) {
+               if (tf->flags & ATA_TFLAG_LBA48) {
+                       block |= (u64)tf->hob_lbah << 40;
+                       block |= (u64)tf->hob_lbam << 32;
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1864,7 +1864,6 @@ void ata_eh_analyze_ncq_error(struct ata
+               ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n",
+                           sense_key, asc, ascq);
+               ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq);
+-              ata_scsi_set_sense_information(qc->scsicmd, &qc->result_tf);
+               qc->flags |= ATA_QCFLAG_SENSE_VALID;
+       }
+@@ -1907,8 +1906,6 @@ static unsigned int ata_eh_analyze_tf(st
+                       tmp = ata_eh_request_sense(qc, qc->scsicmd);
+                       if (tmp)
+                               qc->err_mask |= tmp;
+-                      else
+-                              ata_scsi_set_sense_information(qc->scsicmd, tf);
+               } else {
+                       ata_dev_warn(qc->dev, "sense data available but port frozen\n");
+               }
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -280,18 +280,6 @@ void ata_scsi_set_sense(struct scsi_cmnd
+       scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq);
+ }
+-void ata_scsi_set_sense_information(struct scsi_cmnd *cmd,
+-                                  const struct ata_taskfile *tf)
+-{
+-      u64 information;
+-
+-      if (!cmd)
+-              return;
+-
+-      information = ata_tf_read_block(tf, NULL);
+-      scsi_set_sense_information(cmd->sense_buffer, information);
+-}
+-
+ static ssize_t
+ ata_scsi_em_message_store(struct device *dev, struct device_attribute *attr,
+                         const char *buf, size_t count)
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -67,8 +67,7 @@ extern struct ata_queued_cmd *ata_qc_new
+ extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev,
+                          u64 block, u32 n_block, unsigned int tf_flags,
+                          unsigned int tag);
+-extern u64 ata_tf_read_block(const struct ata_taskfile *tf,
+-                           struct ata_device *dev);
++extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev);
+ extern unsigned ata_exec_internal(struct ata_device *dev,
+                                 struct ata_taskfile *tf, const u8 *cdb,
+                                 int dma_dir, void *buf, unsigned int buflen,
+@@ -139,8 +138,6 @@ extern int ata_scsi_add_hosts(struct ata
+ extern void ata_scsi_scan_host(struct ata_port *ap, int sync);
+ extern int ata_scsi_offline_dev(struct ata_device *dev);
+ extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq);
+-extern void ata_scsi_set_sense_information(struct scsi_cmnd *cmd,
+-                                         const struct ata_taskfile *tf);
+ extern void ata_scsi_media_change_notify(struct ata_device *dev);
+ extern void ata_scsi_hotplug(struct work_struct *work);
+ extern void ata_schedule_scsi_eh(struct Scsi_Host *shost);
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -26,7 +26,6 @@
+ #include <linux/blkdev.h>
+ #include <linux/delay.h>
+ #include <linux/jiffies.h>
+-#include <asm/unaligned.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_cmnd.h>
+@@ -2587,33 +2586,3 @@ void scsi_build_sense_buffer(int desc, u
+       }
+ }
+ EXPORT_SYMBOL(scsi_build_sense_buffer);
+-
+-/**
+- * scsi_set_sense_information - set the information field in a
+- *            formatted sense data buffer
+- * @buf:      Where to build sense data
+- * @info:     64-bit information value to be set
+- *
+- **/
+-void scsi_set_sense_information(u8 *buf, u64 info)
+-{
+-      if ((buf[0] & 0x7f) == 0x72) {
+-              u8 *ucp, len;
+-
+-              len = buf[7];
+-              ucp = (char *)scsi_sense_desc_find(buf, len + 8, 0);
+-              if (!ucp) {
+-                      buf[7] = len + 0xa;
+-                      ucp = buf + 8 + len;
+-              }
+-              ucp[0] = 0;
+-              ucp[1] = 0xa;
+-              ucp[2] = 0x80; /* Valid bit */
+-              ucp[3] = 0;
+-              put_unaligned_be64(info, &ucp[4]);
+-      } else if ((buf[0] & 0x7f) == 0x70) {
+-              buf[0] |= 0x80;
+-              put_unaligned_be64(info, &buf[3]);
+-      }
+-}
+-EXPORT_SYMBOL(scsi_set_sense_information);
+--- a/include/scsi/scsi_eh.h
++++ b/include/scsi/scsi_eh.h
+@@ -59,7 +59,6 @@ extern int scsi_get_sense_info_fld(const
+                                  u64 * info_out);
+ extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq);
+-extern void scsi_set_sense_information(u8 *buf, u64 info);
+ extern int scsi_ioctl_reset(struct scsi_device *, int __user *);
diff --git a/queue-4.1/revert-libata-implement-ncq-autosense.patch b/queue-4.1/revert-libata-implement-ncq-autosense.patch
new file mode 100644 (file)
index 0000000..fa6466c
--- /dev/null
@@ -0,0 +1,114 @@
+From 74a80d67b8316eb3fbeb73dafc060a5a0a708587 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 3 Aug 2015 11:46:39 -0400
+Subject: Revert "libata: Implement NCQ autosense"
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 74a80d67b8316eb3fbeb73dafc060a5a0a708587 upstream.
+
+This reverts commit 42b966fbf35da9c87f08d98f9b8978edf9e717cf.
+
+As implemented, ACS-4 sense reporting for ATA devices bypasses error
+diagnosis and handling in libata degrading EH behavior significantly.
+Revert the related changes for now.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-eh.c   |   18 ------------------
+ drivers/ata/libata-scsi.c |    9 ++-------
+ drivers/ata/libata.h      |    1 -
+ include/linux/ata.h       |    2 --
+ 4 files changed, 2 insertions(+), 28 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1592,8 +1592,6 @@ static int ata_eh_read_log_10h(struct at
+       tf->hob_lbah = buf[10];
+       tf->nsect = buf[12];
+       tf->hob_nsect = buf[13];
+-      if (ata_id_has_ncq_autosense(dev->id))
+-              tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16];
+       return 0;
+ }
+@@ -1791,18 +1789,6 @@ void ata_eh_analyze_ncq_error(struct ata
+       memcpy(&qc->result_tf, &tf, sizeof(tf));
+       qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48;
+       qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ;
+-      if (qc->result_tf.auxiliary) {
+-              char sense_key, asc, ascq;
+-
+-              sense_key = (qc->result_tf.auxiliary >> 16) & 0xff;
+-              asc = (qc->result_tf.auxiliary >> 8) & 0xff;
+-              ascq = qc->result_tf.auxiliary & 0xff;
+-              ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n",
+-                          sense_key, asc, ascq);
+-              ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq);
+-              qc->flags |= ATA_QCFLAG_SENSE_VALID;
+-      }
+-
+       ehc->i.err_mask &= ~AC_ERR_DEV;
+ }
+@@ -1832,10 +1818,6 @@ static unsigned int ata_eh_analyze_tf(st
+               return ATA_EH_RESET;
+       }
+-      /* Set by NCQ autosense */
+-      if (qc->flags & ATA_QCFLAG_SENSE_VALID)
+-              return 0;
+-
+       if (stat & (ATA_ERR | ATA_DF))
+               qc->err_mask |= AC_ERR_DEV;
+       else
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -270,11 +270,8 @@ DEVICE_ATTR(unload_heads, S_IRUGO | S_IW
+           ata_scsi_park_show, ata_scsi_park_store);
+ EXPORT_SYMBOL_GPL(dev_attr_unload_heads);
+-void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq)
++static void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq)
+ {
+-      if (!cmd)
+-              return;
+-
+       cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
+       scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq);
+@@ -1780,9 +1777,7 @@ static void ata_scsi_qc_complete(struct
+           ((cdb[2] & 0x20) || need_sense)) {
+               ata_gen_passthru_sense(qc);
+       } else {
+-              if (qc->flags & ATA_QCFLAG_SENSE_VALID) {
+-                      cmd->result = SAM_STAT_CHECK_CONDITION;
+-              } else if (!need_sense) {
++              if (!need_sense) {
+                       cmd->result = SAM_STAT_GOOD;
+               } else {
+                       /* TODO: decide which descriptor format to use
+--- a/drivers/ata/libata.h
++++ b/drivers/ata/libata.h
+@@ -137,7 +137,6 @@ extern int ata_scsi_add_hosts(struct ata
+                             struct scsi_host_template *sht);
+ extern void ata_scsi_scan_host(struct ata_port *ap, int sync);
+ extern int ata_scsi_offline_dev(struct ata_device *dev);
+-extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq);
+ extern void ata_scsi_media_change_notify(struct ata_device *dev);
+ extern void ata_scsi_hotplug(struct work_struct *work);
+ extern void ata_schedule_scsi_eh(struct Scsi_Host *shost);
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -528,8 +528,6 @@ struct ata_bmdma_prd {
+ #define ata_id_cdb_intr(id)   (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)
+ #define ata_id_has_da(id)     ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4))
+ #define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))
+-#define ata_id_has_ncq_autosense(id) \
+-                              ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))
+ static inline bool ata_id_has_hipm(const u16 *id)
+ {
diff --git a/queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch b/queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch
new file mode 100644 (file)
index 0000000..b84fc63
--- /dev/null
@@ -0,0 +1,211 @@
+From 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 3 Aug 2015 11:45:34 -0400
+Subject: Revert "libata: Implement support for sense data reporting"
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f upstream.
+
+This reverts commit fe7173c206de63fc28475ee6ae42ff95c05692de.
+
+As implemented, ACS-4 sense reporting for ATA devices bypasses error
+diagnosis and handling in libata degrading EH behavior significantly.
+Revert the related changes for now.
+
+ATA_ID_COMMAND_SET_3/4 constants are not reverted as they're used by
+later changes.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c |   20 ----------
+ drivers/ata/libata-eh.c   |   86 +---------------------------------------------
+ include/linux/ata.h       |   16 --------
+ 3 files changed, 4 insertions(+), 118 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2147,24 +2147,6 @@ static int ata_dev_config_ncq(struct ata
+       return 0;
+ }
+-static void ata_dev_config_sense_reporting(struct ata_device *dev)
+-{
+-      unsigned int err_mask;
+-
+-      if (!ata_id_has_sense_reporting(dev->id))
+-              return;
+-
+-      if (ata_id_sense_reporting_enabled(dev->id))
+-              return;
+-
+-      err_mask = ata_dev_set_feature(dev, SETFEATURE_SENSE_DATA, 0x1);
+-      if (err_mask) {
+-              ata_dev_dbg(dev,
+-                          "failed to enable Sense Data Reporting, Emask 0x%x\n",
+-                          err_mask);
+-      }
+-}
+-
+ /**
+  *    ata_dev_configure - Configure the specified ATA/ATAPI device
+  *    @dev: Target device to configure
+@@ -2387,7 +2369,7 @@ int ata_dev_configure(struct ata_device
+                                       dev->devslp_timing[i] = sata_setting[j];
+                               }
+               }
+-              ata_dev_config_sense_reporting(dev);
++
+               dev->cdb_len = 16;
+       }
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1630,70 +1630,6 @@ unsigned int atapi_eh_tur(struct ata_dev
+ }
+ /**
+- *    ata_eh_request_sense - perform REQUEST_SENSE_DATA_EXT
+- *    @dev: device to perform REQUEST_SENSE_SENSE_DATA_EXT to
+- *    @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long)
+- *    @dfl_sense_key: default sense key to use
+- *
+- *    Perform REQUEST_SENSE_DATA_EXT after the device reported CHECK
+- *    SENSE.  This function is EH helper.
+- *
+- *    LOCKING:
+- *    Kernel thread context (may sleep).
+- *
+- *    RETURNS:
+- *    encoded sense data on success, 0 on failure or if sense data
+- *    is not available.
+- */
+-static u32 ata_eh_request_sense(struct ata_queued_cmd *qc,
+-                              struct scsi_cmnd *cmd)
+-{
+-      struct ata_device *dev = qc->dev;
+-      struct ata_taskfile tf;
+-      unsigned int err_mask;
+-
+-      if (!cmd)
+-              return 0;
+-
+-      DPRINTK("ATA request sense\n");
+-      ata_dev_warn(dev, "request sense\n");
+-      if (!ata_id_sense_reporting_enabled(dev->id)) {
+-              ata_dev_warn(qc->dev, "sense data reporting disabled\n");
+-              return 0;
+-      }
+-      ata_tf_init(dev, &tf);
+-
+-      tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+-      tf.flags |= ATA_TFLAG_LBA | ATA_TFLAG_LBA48;
+-      tf.command = ATA_CMD_REQ_SENSE_DATA;
+-      tf.protocol = ATA_PROT_NODATA;
+-
+-      err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+-      /*
+-       * ACS-4 states:
+-       * The device may set the SENSE DATA AVAILABLE bit to one in the
+-       * STATUS field and clear the ERROR bit to zero in the STATUS field
+-       * to indicate that the command returned completion without an error
+-       * and the sense data described in table 306 is available.
+-       *
+-       * IOW the 'ATA_SENSE' bit might not be set even though valid
+-       * sense data is available.
+-       * So check for both.
+-       */
+-      if ((tf.command & ATA_SENSE) ||
+-              tf.lbah != 0 || tf.lbam != 0 || tf.lbal != 0) {
+-              ata_scsi_set_sense(cmd, tf.lbah, tf.lbam, tf.lbal);
+-              qc->flags |= ATA_QCFLAG_SENSE_VALID;
+-              ata_dev_warn(dev, "sense data %02x/%02x/%02x\n",
+-                           tf.lbah, tf.lbam, tf.lbal);
+-      } else {
+-              ata_dev_warn(dev, "request sense failed stat %02x emask %x\n",
+-                           tf.command, err_mask);
+-      }
+-      return err_mask;
+-}
+-
+-/**
+  *    atapi_eh_request_sense - perform ATAPI REQUEST_SENSE
+  *    @dev: device to perform REQUEST_SENSE to
+  *    @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long)
+@@ -1896,22 +1832,7 @@ static unsigned int ata_eh_analyze_tf(st
+               return ATA_EH_RESET;
+       }
+-      /*
+-       * Sense data reporting does not work if the
+-       * device fault bit is set.
+-       */
+-      if ((stat & ATA_SENSE) && !(stat & ATA_DF) &&
+-          !(qc->flags & ATA_QCFLAG_SENSE_VALID)) {
+-              if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) {
+-                      tmp = ata_eh_request_sense(qc, qc->scsicmd);
+-                      if (tmp)
+-                              qc->err_mask |= tmp;
+-              } else {
+-                      ata_dev_warn(qc->dev, "sense data available but port frozen\n");
+-              }
+-      }
+-
+-      /* Set by NCQ autosense or request sense above */
++      /* Set by NCQ autosense */
+       if (qc->flags & ATA_QCFLAG_SENSE_VALID)
+               return 0;
+@@ -2658,15 +2579,14 @@ static void ata_eh_link_report(struct at
+ #ifdef CONFIG_ATA_VERBOSE_ERROR
+               if (res->command & (ATA_BUSY | ATA_DRDY | ATA_DF | ATA_DRQ |
+-                                  ATA_SENSE | ATA_ERR)) {
++                                  ATA_ERR)) {
+                       if (res->command & ATA_BUSY)
+                               ata_dev_err(qc->dev, "status: { Busy }\n");
+                       else
+-                              ata_dev_err(qc->dev, "status: { %s%s%s%s%s}\n",
++                              ata_dev_err(qc->dev, "status: { %s%s%s%s}\n",
+                                 res->command & ATA_DRDY ? "DRDY " : "",
+                                 res->command & ATA_DF ? "DF " : "",
+                                 res->command & ATA_DRQ ? "DRQ " : "",
+-                                res->command & ATA_SENSE ? "SENSE " : "",
+                                 res->command & ATA_ERR ? "ERR " : "");
+               }
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -385,8 +385,6 @@ enum {
+       SATA_SSP                = 0x06, /* Software Settings Preservation */
+       SATA_DEVSLP             = 0x09, /* Device Sleep */
+-      SETFEATURE_SENSE_DATA = 0xC3, /* Sense Data Reporting feature */
+-
+       /* feature values for SET_MAX */
+       ATA_SET_MAX_ADDR        = 0x00,
+       ATA_SET_MAX_PASSWD      = 0x01,
+@@ -710,20 +708,6 @@ static inline bool ata_id_has_read_log_d
+       return id[ATA_ID_COMMAND_SET_3] & (1 << 3);
+ }
+-static inline bool ata_id_has_sense_reporting(const u16 *id)
+-{
+-      if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15)))
+-              return false;
+-      return id[ATA_ID_COMMAND_SET_3] & (1 << 6);
+-}
+-
+-static inline bool ata_id_sense_reporting_enabled(const u16 *id)
+-{
+-      if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15)))
+-              return false;
+-      return id[ATA_ID_COMMAND_SET_4] & (1 << 6);
+-}
+-
+ /**
+  *    ata_id_major_version    -       get ATA level of drive
+  *    @id: Identify data
diff --git a/queue-4.1/revert-x86-sigcontext-cleanups.patch b/queue-4.1/revert-x86-sigcontext-cleanups.patch
new file mode 100644 (file)
index 0000000..4d8321f
--- /dev/null
@@ -0,0 +1,126 @@
+From ed596cde9425509ec6ce88e19f03e9b13b6f518b Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 13 Aug 2015 08:25:20 -0700
+Subject: Revert x86 sigcontext cleanups
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit ed596cde9425509ec6ce88e19f03e9b13b6f518b upstream.
+
+This reverts commits 9a036b93a344 ("x86/signal/64: Remove 'fs' and 'gs'
+from sigcontext") and c6f2062935c8 ("x86/signal/64: Fix SS handling for
+signals delivered to 64-bit programs").
+
+They were cleanups, but they break dosemu by changing the signal return
+behavior (and removing 'fs' and 'gs' from the sigcontext struct - while
+not actually changing any behavior - causes build problems).
+
+Reported-and-tested-by: Stas Sergeev <stsp@list.ru>
+Acked-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/sigcontext.h      |    6 +++---
+ arch/x86/include/uapi/asm/sigcontext.h |   21 +++------------------
+ arch/x86/kernel/signal.c               |   26 +++++++++++---------------
+ 3 files changed, 17 insertions(+), 36 deletions(-)
+
+--- a/arch/x86/include/asm/sigcontext.h
++++ b/arch/x86/include/asm/sigcontext.h
+@@ -57,9 +57,9 @@ struct sigcontext {
+       unsigned long ip;
+       unsigned long flags;
+       unsigned short cs;
+-      unsigned short __pad2;  /* Was called gs, but was always zero. */
+-      unsigned short __pad1;  /* Was called fs, but was always zero. */
+-      unsigned short ss;
++      unsigned short gs;
++      unsigned short fs;
++      unsigned short __pad0;
+       unsigned long err;
+       unsigned long trapno;
+       unsigned long oldmask;
+--- a/arch/x86/include/uapi/asm/sigcontext.h
++++ b/arch/x86/include/uapi/asm/sigcontext.h
+@@ -177,24 +177,9 @@ struct sigcontext {
+       __u64 rip;
+       __u64 eflags;           /* RFLAGS */
+       __u16 cs;
+-
+-      /*
+-       * Prior to 2.5.64 ("[PATCH] x86-64 updates for 2.5.64-bk3"),
+-       * Linux saved and restored fs and gs in these slots.  This
+-       * was counterproductive, as fsbase and gsbase were never
+-       * saved, so arch_prctl was presumably unreliable.
+-       *
+-       * If these slots are ever needed for any other purpose, there
+-       * is some risk that very old 64-bit binaries could get
+-       * confused.  I doubt that many such binaries still work,
+-       * though, since the same patch in 2.5.64 also removed the
+-       * 64-bit set_thread_area syscall, so it appears that there is
+-       * no TLS API that works in both pre- and post-2.5.64 kernels.
+-       */
+-      __u16 __pad2;           /* Was gs. */
+-      __u16 __pad1;           /* Was fs. */
+-
+-      __u16 ss;
++      __u16 gs;
++      __u16 fs;
++      __u16 __pad0;
+       __u64 err;
+       __u64 trapno;
+       __u64 oldmask;
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -93,8 +93,15 @@ int restore_sigcontext(struct pt_regs *r
+               COPY(r15);
+ #endif /* CONFIG_X86_64 */
++#ifdef CONFIG_X86_32
+               COPY_SEG_CPL3(cs);
+               COPY_SEG_CPL3(ss);
++#else /* !CONFIG_X86_32 */
++              /* Kernel saves and restores only the CS segment register on signals,
++               * which is the bare minimum needed to allow mixed 32/64-bit code.
++               * App's signal handler can save/restore other segments if needed. */
++              COPY_SEG_CPL3(cs);
++#endif /* CONFIG_X86_32 */
+               get_user_ex(tmpflags, &sc->flags);
+               regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
+@@ -154,9 +161,8 @@ int setup_sigcontext(struct sigcontext _
+ #else /* !CONFIG_X86_32 */
+               put_user_ex(regs->flags, &sc->flags);
+               put_user_ex(regs->cs, &sc->cs);
+-              put_user_ex(0, &sc->__pad2);
+-              put_user_ex(0, &sc->__pad1);
+-              put_user_ex(regs->ss, &sc->ss);
++              put_user_ex(0, &sc->gs);
++              put_user_ex(0, &sc->fs);
+ #endif /* CONFIG_X86_32 */
+               put_user_ex(fpstate, &sc->fpstate);
+@@ -450,19 +456,9 @@ static int __setup_rt_frame(int sig, str
+       regs->sp = (unsigned long)frame;
+-      /*
+-       * Set up the CS and SS registers to run signal handlers in
+-       * 64-bit mode, even if the handler happens to be interrupting
+-       * 32-bit or 16-bit code.
+-       *
+-       * SS is subtle.  In 64-bit mode, we don't need any particular
+-       * SS descriptor, but we do need SS to be valid.  It's possible
+-       * that the old SS is entirely bogus -- this can happen if the
+-       * signal we're trying to deliver is #GP or #SS caused by a bad
+-       * SS value.
+-       */
++      /* Set up the CS register to run signal handlers in 64-bit mode,
++         even if the handler happens to be interrupting 32-bit code. */
+       regs->cs = __USER_CS;
+-      regs->ss = __USER_DS;
+       return 0;
+ }
diff --git a/queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch b/queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch
new file mode 100644 (file)
index 0000000..dbff0af
--- /dev/null
@@ -0,0 +1,59 @@
+From 4f258a46346c03fa0bbb6199ffaf4e1f9f599660 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Tue, 23 Jun 2015 12:13:59 -0400
+Subject: sd: Fix maximum I/O size for BLOCK_PC requests
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 4f258a46346c03fa0bbb6199ffaf4e1f9f599660 upstream.
+
+Commit bcdb247c6b6a ("sd: Limit transfer length") clamped the maximum
+size of an I/O request to the MAXIMUM TRANSFER LENGTH field in the BLOCK
+LIMITS VPD. This had the unfortunate effect of also limiting the maximum
+size of non-filesystem requests sent to the device through sg/bsg.
+
+Avoid using blk_queue_max_hw_sectors() and set the max_sectors queue
+limit directly.
+
+Also update the comment in blk_limits_max_hw_sectors() to clarify that
+max_hw_sectors defines the limit for the I/O controller only.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reported-by: Brian King <brking@linux.vnet.ibm.com>
+Tested-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-settings.c |    4 ++--
+ drivers/scsi/sd.c    |    6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -241,8 +241,8 @@ EXPORT_SYMBOL(blk_queue_bounce_limit);
+  * Description:
+  *    Enables a low level driver to set a hard upper limit,
+  *    max_hw_sectors, on the size of requests.  max_hw_sectors is set by
+- *    the device driver based upon the combined capabilities of I/O
+- *    controller and storage device.
++ *    the device driver based upon the capabilities of the I/O
++ *    controller.
+  *
+  *    max_sectors is a soft limit imposed by the block layer for
+  *    filesystem type requests.  This value can be overridden on a
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2770,9 +2770,9 @@ static int sd_revalidate_disk(struct gen
+       max_xfer = sdkp->max_xfer_blocks;
+       max_xfer <<= ilog2(sdp->sector_size) - 9;
+-      max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue),
+-                              max_xfer);
+-      blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer);
++      sdkp->disk->queue->limits.max_sectors =
++              min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), max_xfer);
++
+       set_capacity(disk, sdkp->capacity);
+       sd_config_write_same(sdkp);
+       kfree(buffer);
index 61ae218739fa92e7117536630428192a1416c9c5..89d756ad8230fca1a64ec3900ab86e3d87cbebd3 100644 (file)
@@ -22,3 +22,25 @@ hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch
 hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch
 drm-radeon-add-new-oland-pci-id.patch
 drm-vmwgfx-fix-execbuf-locking-issues.patch
+libfc-fix-fc_exch_recv_req-error-path.patch
+libfc-fix-fc_fcp_cleanup_each_cmd.patch
+arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch
+arm-dts-omap243x-fix-broken-pbias-device-creation.patch
+arm-dts-dra7-fix-broken-pbias-device-creation.patch
+arm-dts-omap4-fix-broken-pbias-device-creation.patch
+arm-dts-omap5-fix-broken-pbias-device-creation.patch
+arm-8385-1-vdso-group-link-options.patch
+arm-8384-1-vdso-force-use-of-bfd-linker.patch
+arm-v7-setup-function-should-invalidate-l1-cache.patch
+arm-invalidate-l1-before-enabling-coherency.patch
+mfd-arizona-fix-initialisation-of-the-pm-runtime.patch
+revert-x86-sigcontext-cleanups.patch
+regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch
+mips-fix-seccomp-syscall-argument-for-mips64.patch
+libiscsi-fix-host-busy-blocking-during-connection-teardown.patch
+sd-fix-maximum-i-o-size-for-block_pc-requests.patch
+crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch
+crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch
+revert-libata-eh-set-information-field-for-autosense.patch
+revert-libata-implement-support-for-sense-data-reporting.patch
+revert-libata-implement-ncq-autosense.patch