From: Greg Kroah-Hartman Date: Tue, 25 Sep 2012 22:18:13 +0000 (-0700) Subject: 3.5-stable patches X-Git-Tag: v3.0.44~67 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1f5e7cc10d7f85d3738db2191dee80587d243de4;p=thirdparty%2Fkernel%2Fstable-queue.git 3.5-stable patches added patches: arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch arm-imx-armadillo5x0-fix-illegal-register-access.patch bluetooth-fix-not-removing-power_off-delayed-work.patch bluetooth-mgmt-fix-enabling-le-while-powered-off.patch bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch c-r-prctl-fix-build-error-for-no-mmu-case.patch hpwdt-fix-kdump-issue-in-hpwdt.patch input-i8042-disable-mux-on-toshiba-c850d.patch mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch perf-x86-ibs-check-syscall-attribute-flags.patch rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch scsi-hpsa-fix-handling-of-protocol-error.patch scsi-lpfc-fix-problems-with-werror.patch scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch tracing-don-t-call-page_to_pfn-if-page-is-null.patch --- diff --git a/queue-3.5/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch b/queue-3.5/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch new file mode 100644 index 00000000000..bdf167bf840 --- /dev/null +++ b/queue-3.5/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch @@ -0,0 +1,35 @@ +From e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 Mon Sep 17 00:00:00 2001 +From: Matthew Leach +Date: Tue, 11 Sep 2012 17:56:57 +0100 +Subject: ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores + +From: Matthew Leach + +commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream. + +This patch zeroes the SCTLR.TRE bit prior to setting the mapping as +cacheable for ARMv7 cores in the decompressor, ensuring that the +memory region attributes are obtained from the C and B bits, not from +the page tables. + +Cc: Nicolas Pitre +Reviewed-by: Will Deacon +Signed-off-by: Matthew Leach +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/compressed/head.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -653,6 +653,7 @@ __armv7_mmu_cache_on: + mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs + #endif + mrc p15, 0, r0, c1, c0, 0 @ read control reg ++ bic r0, r0, #1 << 28 @ clear SCTLR.TRE + orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement + orr r0, r0, #0x003c @ write buffer + #ifdef CONFIG_MMU diff --git a/queue-3.5/arm-imx-armadillo5x0-fix-illegal-register-access.patch b/queue-3.5/arm-imx-armadillo5x0-fix-illegal-register-access.patch new file mode 100644 index 00000000000..e1e434a992f --- /dev/null +++ b/queue-3.5/arm-imx-armadillo5x0-fix-illegal-register-access.patch @@ -0,0 +1,39 @@ +From 35495173e1df621dff0e9a244accbe32cd28a98f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 16 Sep 2012 22:28:35 -0300 +Subject: ARM: imx: armadillo5x0: Fix illegal register access + +From: Fabio Estevam + +commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream. + +Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable ) +it is necessary to pass the CCM register base as a variable. + +Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and +avoid illegal accesses. + +Also applies to v3.5 + +Reported-by: Arnd Bergmann +Signed-off-by: Fabio Estevam +Acked-by: Arnd Bergmann +Signed-off-by: Sascha Hauer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/mach-armadillo5x0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/mach-imx/mach-armadillo5x0.c ++++ b/arch/arm/mach-imx/mach-armadillo5x0.c +@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(voi + imx31_add_mxc_nand(&armadillo5x0_nand_board_info); + + /* set NAND page size to 2k if not configured via boot mode pins */ +- __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR); ++ __raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) | ++ (1 << 30), mx3_ccm_base + MXC_CCM_RCSR); + + /* RTC */ + /* Get RTC IRQ and register the chip */ diff --git a/queue-3.5/bluetooth-fix-not-removing-power_off-delayed-work.patch b/queue-3.5/bluetooth-fix-not-removing-power_off-delayed-work.patch new file mode 100644 index 00000000000..90b9dc484e8 --- /dev/null +++ b/queue-3.5/bluetooth-fix-not-removing-power_off-delayed-work.patch @@ -0,0 +1,76 @@ +From 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a Mon Sep 17 00:00:00 2001 +From: Vinicius Costa Gomes +Date: Fri, 14 Sep 2012 16:34:46 -0300 +Subject: Bluetooth: Fix not removing power_off delayed work + +From: Vinicius Costa Gomes + +commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream. + +For example, when a usb reset is received (I could reproduce it +running something very similar to this[1] in a loop) it could be +that the device is unregistered while the power_off delayed work +is still scheduled to run. + +Backtrace: + +WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d() +Hardware name: To Be Filled By O.E.M. +ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26 +Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper +Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2 +Call Trace: + [] ? free_obj_work+0x57/0x91 + [] warn_slowpath_common+0x7e/0x97 + [] warn_slowpath_fmt+0x41/0x43 + [] debug_print_object+0x7c/0x8d + [] ? __queue_work+0x259/0x259 + [] ? debug_check_no_obj_freed+0x6f/0x1b5 + [] debug_check_no_obj_freed+0x98/0x1b5 + [] ? bt_host_release+0x10/0x1e [bluetooth] + [] kfree+0x90/0xe6 + [] bt_host_release+0x10/0x1e [bluetooth] + [] device_release+0x4a/0x7e + [] kobject_release+0x11d/0x154 + [] kobject_put+0x4a/0x4f + [] put_device+0x12/0x14 + [] hci_free_dev+0x22/0x26 [bluetooth] + [] btusb_disconnect+0x96/0x9f [btusb] + [] usb_unbind_interface+0x57/0x106 + [] __device_release_driver+0x83/0xd6 + [] device_release_driver+0x20/0x2d + [] usb_driver_release_interface+0x44/0x7b + [] usb_forced_unbind_intf+0x45/0x4e + [] usb_reset_device+0xa6/0x12e + [] usbdev_do_ioctl+0x319/0xe20 + [] ? avc_has_perm_flags+0xc9/0x12e + [] ? avc_has_perm_flags+0x25/0x12e + [] ? do_page_fault+0x31e/0x3a1 + [] usbdev_ioctl+0x9/0xd + [] vfs_ioctl+0x21/0x34 + [] do_vfs_ioctl+0x408/0x44b + [] ? file_has_perm+0x76/0x81 + [] sys_ioctl+0x51/0x76 + [] system_call_fastpath+0x16/0x1b + +[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c + +Signed-off-by: Vinicius Costa Gomes +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -753,6 +753,8 @@ static int hci_dev_do_close(struct hci_d + + cancel_work_sync(&hdev->le_scan); + ++ cancel_delayed_work(&hdev->power_off); ++ + hci_req_cancel(hdev, ENODEV); + hci_req_lock(hdev); + diff --git a/queue-3.5/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch b/queue-3.5/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch new file mode 100644 index 00000000000..30b5136690d --- /dev/null +++ b/queue-3.5/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch @@ -0,0 +1,46 @@ +From 562fcc246ebe31ade6e1be08585673b9b2785498 Mon Sep 17 00:00:00 2001 +From: Andrzej Kaczmarek +Date: Wed, 29 Aug 2012 10:02:09 +0200 +Subject: Bluetooth: mgmt: Fix enabling LE while powered off + +From: Andrzej Kaczmarek + +commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream. + +When new BT USB adapter is plugged in it's configured while still being powered +off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't +write changes to controller. As a result it's not possible to start device +discovery session on LE controller as it uses interleaved discovery which +requires LE Supported Host flag in extended features. + +This patch ensures HCI Write LE Host Supported is sent when Set Powered is +called to power on controller and clear HCI_AUTO_OFF flag. + +Signed-off-by: Andrzej Kaczmarek +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2885,6 +2885,16 @@ int mgmt_powered(struct hci_dev *hdev, u + hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp); + } + ++ if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { ++ struct hci_cp_write_le_host_supported cp; ++ ++ cp.le = 1; ++ cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR); ++ ++ hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, ++ sizeof(cp), &cp); ++ } ++ + update_class(hdev); + update_name(hdev, hdev->dev_name); + update_eir(hdev); diff --git a/queue-3.5/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch b/queue-3.5/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch new file mode 100644 index 00000000000..9e3299724d8 --- /dev/null +++ b/queue-3.5/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch @@ -0,0 +1,43 @@ +From 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 Mon Sep 17 00:00:00 2001 +From: Andrzej Kaczmarek +Date: Wed, 29 Aug 2012 10:02:08 +0200 +Subject: Bluetooth: mgmt: Fix enabling SSP while powered off + +From: Andrzej Kaczmarek + +commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream. + +When new BT USB adapter is plugged in it's configured while still being powered +off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't +write changes to controller. As a result remote devices won't use Secure Simple +Pairing with our device due to SSP Host Support flag disabled in extended +features and may also reject SSP attempt from our side (with possible fallback +to legacy pairing). + +This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is +called to power on controller and clear HCI_AUTO_OFF flag. + +Signed-off-by: Andrzej Kaczmarek +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2879,6 +2879,12 @@ int mgmt_powered(struct hci_dev *hdev, u + if (scan) + hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); + ++ if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { ++ u8 ssp = 1; ++ ++ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp); ++ } ++ + update_class(hdev); + update_name(hdev, hdev->dev_name); + update_eir(hdev); diff --git a/queue-3.5/c-r-prctl-fix-build-error-for-no-mmu-case.patch b/queue-3.5/c-r-prctl-fix-build-error-for-no-mmu-case.patch new file mode 100644 index 00000000000..de6da20b9f5 --- /dev/null +++ b/queue-3.5/c-r-prctl-fix-build-error-for-no-mmu-case.patch @@ -0,0 +1,43 @@ +From be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a Mon Sep 17 00:00:00 2001 +From: Mark Salter +Date: Mon, 24 Sep 2012 17:17:38 -0700 +Subject: c/r: prctl: fix build error for no-MMU case + +From: Mark Salter + +commit be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a upstream. + +Commit 1ad75b9e1628 ("c/r: prctl: add minimal address test to +PR_SET_MM") added some address checking to prctl_set_mm() used by +checkpoint-restore. This causes a build error for no-MMU systems: + + kernel/sys.c: In function 'prctl_set_mm': + kernel/sys.c:1868:34: error: 'mmap_min_addr' undeclared (first use in this function) + +The test for mmap_min_addr doesn't make a lot of sense for no-MMU code +as noted in commit 6e1415467614 ("NOMMU: Optimise away the +{dac_,}mmap_min_addr tests"). + +This patch defines mmap_min_addr as 0UL in the no-MMU case so that the +compiler will optimize away tests for "addr < mmap_min_addr". + +Signed-off-by: Mark Salter +Reviewed-by: Cyrill Gorcunov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/security.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -118,6 +118,7 @@ void reset_security_ops(void); + extern unsigned long mmap_min_addr; + extern unsigned long dac_mmap_min_addr; + #else ++#define mmap_min_addr 0UL + #define dac_mmap_min_addr 0UL + #endif + diff --git a/queue-3.5/hpwdt-fix-kdump-issue-in-hpwdt.patch b/queue-3.5/hpwdt-fix-kdump-issue-in-hpwdt.patch new file mode 100644 index 00000000000..195e42c48f8 --- /dev/null +++ b/queue-3.5/hpwdt-fix-kdump-issue-in-hpwdt.patch @@ -0,0 +1,37 @@ +From 308b135e4fcc00c80c07e0e04e7afa8edf78583c Mon Sep 17 00:00:00 2001 +From: Toshi Kani +Date: Mon, 27 Aug 2012 12:52:24 -0600 +Subject: hpwdt: Fix kdump issue in hpwdt + +From: Toshi Kani + +commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream. + +kdump can be interrupted by watchdog timer when the timer is left +activated on the crash kernel. Changed the hpwdt driver to disable +watchdog timer at boot-time. This assures that watchdog timer is +disabled until /dev/watchdog is opened, and prevents watchdog timer +to be left running on the crash kernel. + +Signed-off-by: Toshi Kani +Tested-by: Lisa Mitchell +Signed-off-by: Thomas Mingarelli +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/hpwdt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(stru + hpwdt_timer_reg = pci_mem_addr + 0x70; + hpwdt_timer_con = pci_mem_addr + 0x72; + ++ /* Make sure that timer is disabled until /dev/watchdog is opened */ ++ hpwdt_stop(); ++ + /* Make sure that we have a valid soft_margin */ + if (hpwdt_change_timer(soft_margin)) + hpwdt_change_timer(DEFAULT_MARGIN); diff --git a/queue-3.5/input-i8042-disable-mux-on-toshiba-c850d.patch b/queue-3.5/input-i8042-disable-mux-on-toshiba-c850d.patch new file mode 100644 index 00000000000..fcb0e2e589b --- /dev/null +++ b/queue-3.5/input-i8042-disable-mux-on-toshiba-c850d.patch @@ -0,0 +1,35 @@ +From 8669cf6793bb38307a30fb6b9565ddc8840ebd3f Mon Sep 17 00:00:00 2001 +From: Anisse Astier +Date: Wed, 19 Sep 2012 11:10:48 -0700 +Subject: Input: i8042 - disable mux on Toshiba C850D + +From: Anisse Astier + +commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream. + +On Toshiba Satellite C850D, the touchpad and the keyboard might randomly +not work at boot. Preventing MUX mode activation solves this issue. + +Signed-off-by: Anisse Astier +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -335,6 +335,12 @@ static const struct dmi_system_id __init + }, + { + .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), ++ }, ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"), + DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"), + }, diff --git a/queue-3.5/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch b/queue-3.5/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch new file mode 100644 index 00000000000..da79ee22b3f --- /dev/null +++ b/queue-3.5/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch @@ -0,0 +1,41 @@ +From af89fa3986b9d034a286544ab1ed95096496a2f9 Mon Sep 17 00:00:00 2001 +From: Jovi Zhang +Date: Wed, 22 Aug 2012 10:34:08 +0800 +Subject: MIPS: mm: Add compound tail page _mapcount when mapped + +From: Jovi Zhang + +commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream. + +See commit b6999b191 which did the same modification for x86's mm/gup, + +Quote from commit b6999b191: + "If compound pages are used and the page is a + tail page, gup_huge_pmd() increases _mapcount to record tail page are + mapped while gup_huge_pud does not do that." + +[ralf@linux-mips.org: fixed rejects caused by the original patch getting +linewrapped.] + +Signed-off-by: Jovi Zhang +Cc: Youquan Song +Cc: Andi Kleen +Patchwork: https://patchwork.linux-mips.org/patch/4291/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/gup.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/mm/gup.c ++++ b/arch/mips/mm/gup.c +@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig + do { + VM_BUG_ON(compound_head(page) != head); + pages[*nr] = page; ++ if (PageTail(page)) ++ get_huge_page_tail(page); + (*nr)++; + page++; + refs++; diff --git a/queue-3.5/perf-x86-ibs-check-syscall-attribute-flags.patch b/queue-3.5/perf-x86-ibs-check-syscall-attribute-flags.patch new file mode 100644 index 00000000000..808de46caa8 --- /dev/null +++ b/queue-3.5/perf-x86-ibs-check-syscall-attribute-flags.patch @@ -0,0 +1,65 @@ +From bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb Mon Sep 17 00:00:00 2001 +From: Robert Richter +Date: Wed, 25 Jul 2012 19:12:45 +0200 +Subject: perf/x86/ibs: Check syscall attribute flags + +From: Robert Richter + +commit bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb upstream. + +Current implementation simply ignores attribute flags. Thus, there is +no notification to userland of unsupported features. Check syscall's +attribute flags to let userland know if a feature is supported by the +kernel. This is also needed to distinguish between future kernels what +might support a feature. + +Signed-off-by: Robert Richter +Signed-off-by: Peter Zijlstra +Link: http://lkml.kernel.org/r/20120910093018.GO8285@erda.amd.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event_amd_ibs.c | 12 ++++++++++++ + include/linux/perf_event.h | 2 ++ + 2 files changed, 14 insertions(+) + +--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c ++++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c +@@ -207,6 +207,15 @@ static int perf_ibs_precise_event(struct + return -EOPNOTSUPP; + } + ++static const struct perf_event_attr ibs_notsupp = { ++ .exclude_user = 1, ++ .exclude_kernel = 1, ++ .exclude_hv = 1, ++ .exclude_idle = 1, ++ .exclude_host = 1, ++ .exclude_guest = 1, ++}; ++ + static int perf_ibs_init(struct perf_event *event) + { + struct hw_perf_event *hwc = &event->hw; +@@ -227,6 +236,9 @@ static int perf_ibs_init(struct perf_eve + if (event->pmu != &perf_ibs->pmu) + return -ENOENT; + ++ if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp)) ++ return -EINVAL; ++ + if (config & ~perf_ibs->config_mask) + return -EINVAL; + +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -274,6 +274,8 @@ struct perf_event_attr { + __u64 branch_sample_type; /* enum branch_sample_type */ + }; + ++#define perf_flags(attr) (*(&(attr)->read_format + 1)) ++ + /* + * Ioctls that can be done on a perf event fd: + */ diff --git a/queue-3.5/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch b/queue-3.5/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch new file mode 100644 index 00000000000..a945b640d76 --- /dev/null +++ b/queue-3.5/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch @@ -0,0 +1,77 @@ +From 022e1d0680c7b4366017393417b8758be5abcee8 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 11 Sep 2012 11:11:13 -0500 +Subject: rtlwifi: rtl8192ce: Log message that B_CUT device may not work + +From: Larry Finger + +commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream. + +There are a number of problems that occur for the latest version +of the Realtek RTL8188CE device with the in-kernel driver. These +include selection of the wrong firmware, and system lockup. A full +fix is known, but is too invasive for inclusion in stable. This patch +fixes the problem with loading the wrong firmware, and logs a message +that the device may not work for kernels 3.6 and older. + +Signed-off-by: Larry Finger +Cc: Anisse Astier +Cc: Li Chaoming +Tested-by: Anisse Astier +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 + + drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 ++++++++++-- + drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 ++++-- + 3 files changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h +@@ -117,6 +117,7 @@ + + #define CHIP_VER_B BIT(4) + #define CHIP_92C_BITMASK BIT(0) ++#define CHIP_UNKNOWN BIT(7) + #define CHIP_92C_1T2R 0x03 + #define CHIP_92C 0x01 + #define CHIP_88C 0x00 +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_ + version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C : + VERSION_A_CHIP_88C; + } else { +- version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C : +- VERSION_B_CHIP_88C; ++ version = (enum version_8192c) (CHIP_VER_B | ++ ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) | ++ ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0)); ++ if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 & ++ CHIP_VER_RTL_MASK)) { ++ version = (enum version_8192c)(version | ++ ((((value32 & CHIP_VER_RTL_MASK) == BIT(12)) ++ ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) | ++ CHIP_VENDOR_UMC)); ++ } + } + + switch (version) { +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c +@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211 + + /* request fw */ + if (IS_VENDOR_UMC_A_CUT(rtlhal->version) && +- !IS_92C_SERIAL(rtlhal->version)) ++ !IS_92C_SERIAL(rtlhal->version)) { + rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin"; +- else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) ++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) { + rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin"; ++ pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n"); ++ } + + rtlpriv->max_fw_size = 0x4000; + pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name); diff --git a/queue-3.5/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch b/queue-3.5/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch new file mode 100644 index 00000000000..b5e3d07c1ab --- /dev/null +++ b/queue-3.5/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch @@ -0,0 +1,75 @@ +From d6532207116307eb7ecbfa7b9e02c53230096a50 Mon Sep 17 00:00:00 2001 +From: Eddie Wai +Date: Tue, 21 Aug 2012 10:35:53 -0700 +Subject: SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload + +From: Eddie Wai + +commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream. + +This patch fixes the following kernel panic invoked by uninitialized fields +in the chip initialization for the 1G bnx2 iSCSI offload. + +One of the bits in the chip initialization is being used by the latest +firmware to control overflow packets. When this control bit gets enabled +erroneously, it would ultimately result in a bad packet placement which would +cause the bnx2 driver to dereference a NULL ptr in the placement handler. + +This can happen under certain stress I/O environment under the Linux +iSCSI offload operation. + +This change only affects Broadcom's 5709 chipset. + +Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP: + [] :bnx2:bnx2_poll_work+0xd0d/0x13c5 +Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2 +RIP: 0010:[] [] :bnx2:bnx2_poll_work+0xd0d/0x13c5 +RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216 +RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000 +RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220 +RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000 +R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010 +R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558 +FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000 +CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b +CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0 +Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820) +Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520 + ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20 + 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8 +Call Trace: + [] show_schedstat+0x1c2/0x25b + [] :bnx2:bnx2_poll+0xf6/0x231 + [] net_rx_action+0xac/0x1b1 + [] __do_softirq+0x89/0x133 + [] call_softirq+0x1c/0x28 + [] do_softirq+0x2c/0x7d + [] do_IRQ+0xee/0xf7 + [] ret_from_intr+0x0/0xa + [] acpi_processor_idle_simple+0x1c5/0x341 + [] acpi_processor_idle_simple+0x182/0x341 + [] acpi_processor_idle_simple+0x0/0x341 + [] cpu_idle+0x95/0xb8 + [] start_secondary+0x479/0x488 + +Signed-off-by: Eddie Wai +Reviewed-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/bnx2i/bnx2i_hwi.c ++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c +@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct + int rc = 0; + u64 mask64; + ++ memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1)); ++ memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2)); ++ + bnx2i_adjust_qp_size(hba); + + iscsi_init.flags = diff --git a/queue-3.5/scsi-hpsa-fix-handling-of-protocol-error.patch b/queue-3.5/scsi-hpsa-fix-handling-of-protocol-error.patch new file mode 100644 index 00000000000..bcd1371d33a --- /dev/null +++ b/queue-3.5/scsi-hpsa-fix-handling-of-protocol-error.patch @@ -0,0 +1,45 @@ +From 256d0eaac87da1e993190846064f339f4c7a63f5 Mon Sep 17 00:00:00 2001 +From: "Stephen M. Cameron" +Date: Fri, 14 Sep 2012 16:34:25 -0500 +Subject: SCSI: hpsa: fix handling of protocol error + +From: "Stephen M. Cameron" + +commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream. + +If a command status of CMD_PROTOCOL_ERR is received, this +information should be conveyed to the SCSI mid layer, not +dropped on the floor. CMD_PROTOCOL_ERR may be received +from the Smart Array for any commands destined for an external +RAID controller such as a P2000, or commands destined for tape +drives or CD/DVD-ROM drives, if for instance a cable is +disconnected. This mostly affects multipath configurations, as +disconnecting a cable on a non-multipath configuration is not +going to do anything good regardless of whether CMD_PROTOCOL_ERR +is handled correctly or not. Not handling CMD_PROTOCOL_ERR +correctly in a multipath configaration involving external RAID +controllers may cause data corruption, so this is quite a serious +bug. This bug should not normally cause a problem for direct +attached disk storage. + +Signed-off-by: Stephen M. Cameron +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/hpsa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct + } + break; + case CMD_PROTOCOL_ERR: ++ cmd->result = DID_ERROR << 16; + dev_warn(&h->pdev->dev, "cp %p has " +- "protocol error \n", cp); ++ "protocol error\n", cp); + break; + case CMD_HARDWARE_ERR: + cmd->result = DID_ERROR << 16; diff --git a/queue-3.5/scsi-lpfc-fix-problems-with-werror.patch b/queue-3.5/scsi-lpfc-fix-problems-with-werror.patch new file mode 100644 index 00000000000..bb3ef8f0fcb --- /dev/null +++ b/queue-3.5/scsi-lpfc-fix-problems-with-werror.patch @@ -0,0 +1,40 @@ +From 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Thu, 21 Jun 2012 07:50:02 +0000 +Subject: SCSI: lpfc: fix problems with -Werror + +From: James Bottomley + +commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream. + +Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage +with random gcc incarnations. These look like gcc problems, but we shouldn't +break the build because of a bad gcc. Fix this by adding a make flag + +WARNINGS_BECOME_ERRORS=1 + +which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror + +Reported-by: Fengguang Wu +Cc: Alex Iannicelli +Cc: James Smart +Cc: Jonathan Nieder +Cc: Mike Pagano +Signed-off-by: James Bottomley + +--- + drivers/scsi/lpfc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/lpfc/Makefile ++++ b/drivers/scsi/lpfc/Makefile +@@ -22,7 +22,9 @@ + ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage + ccflags-$(GCOV) += -O0 + ++ifdef WARNINGS_BECOME_ERRORS + ccflags-y += -Werror ++endif + + obj-$(CONFIG_SCSI_LPFC) := lpfc.o + diff --git a/queue-3.5/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch b/queue-3.5/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch new file mode 100644 index 00000000000..640e55af554 --- /dev/null +++ b/queue-3.5/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch @@ -0,0 +1,38 @@ +From 10cce6d8b5af0b32bc4254ae4a28423a74c0921c Mon Sep 17 00:00:00 2001 +From: "sreekanth.reddy@lsi.com" +Date: Wed, 22 Aug 2012 16:55:13 +0530 +Subject: SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA + +From: "sreekanth.reddy@lsi.com" + +commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream. + +This patch checks whether HBA is SAS2008 B0 controller. +if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX, +as SAS2008 B0 controller doesn't support MSIX interrupts. + +[jejb: fix whitespace problems] +Signed-off-by: Sreekanth Reddy +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_A + u16 message_control; + + ++ /* Check whether controller SAS2008 B0 controller, ++ if it is SAS2008 B0 controller use IO-APIC instead of MSIX */ ++ if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 && ++ ioc->pdev->revision == 0x01) { ++ return -EINVAL; ++ } ++ + base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX); + if (!base) { + dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not " diff --git a/queue-3.5/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch b/queue-3.5/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch new file mode 100644 index 00000000000..ab5f9f7bf0b --- /dev/null +++ b/queue-3.5/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch @@ -0,0 +1,56 @@ +From 27e99ade81368e6fdda3212bff9345177cf9e57a Mon Sep 17 00:00:00 2001 +From: Wang Sen +Date: Mon, 30 Jul 2012 14:25:06 +0800 +Subject: SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list + +From: Wang Sen + +commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream. + +When using the commands below to write some data to a virtio-scsi LUN of the +QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash. + + # sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.) + # sudo mount /dev/sdb /mnt + # dd if=/dev/zero of=/mnt/file bs=1M count=1024 + +In current implementation, sg_set_buf is called to add buffers to sg list which +is put into the virtqueue eventually. But if there are some HighMem pages in +table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may +return NULL value. This will cause QEMU exit when virtqueue_map_sg is called +in QEMU because an invalid GPA is passed by virtqueue. + +Two solutions are discussed here: +http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html + +Finally, value assignment approach was adopted because: + +Value assignment creates a well-formed scatterlist, because the termination +marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the +source sg_list is just copied to the the last entry in destination list. Note +that, for now, virtio_ring does not care about the form of the scatterlist and +simply processes the first out_num + in_num consecutive elements of the sg[] +array. + +I have tested the patch on my workstation. QEMU would not crash any more. + +Signed-off-by: Wang Sen +Acked-by: Paolo Bonzini +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/virtio_scsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scat + int i; + + for_each_sg(table->sgl, sg_elem, table->nents, i) +- sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length); ++ sg[idx++] = *sg_elem; + + *p_idx = idx; + } diff --git a/queue-3.5/series b/queue-3.5/series index 658eab6fc5a..7b3c5ffc4b4 100644 --- a/queue-3.5/series +++ b/queue-3.5/series @@ -118,3 +118,20 @@ ibmveth-fix-alignment-of-rx-queue-bug.patch mac80211-clear-bssid-on-auth-assoc-failure.patch brcmfmac-fix-big-endian-bug-in-i-scan.patch brcmfmac-fix-big-endian-host-configuration-data.patch +scsi-lpfc-fix-problems-with-werror.patch +scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch +scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch +scsi-hpsa-fix-handling-of-protocol-error.patch +scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch +bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch +bluetooth-fix-not-removing-power_off-delayed-work.patch +bluetooth-mgmt-fix-enabling-le-while-powered-off.patch +c-r-prctl-fix-build-error-for-no-mmu-case.patch +hpwdt-fix-kdump-issue-in-hpwdt.patch +arm-imx-armadillo5x0-fix-illegal-register-access.patch +arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch +tracing-don-t-call-page_to_pfn-if-page-is-null.patch +input-i8042-disable-mux-on-toshiba-c850d.patch +mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch +perf-x86-ibs-check-syscall-attribute-flags.patch +rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch diff --git a/queue-3.5/tracing-don-t-call-page_to_pfn-if-page-is-null.patch b/queue-3.5/tracing-don-t-call-page_to_pfn-if-page-is-null.patch new file mode 100644 index 00000000000..ae7dd8b9c6a --- /dev/null +++ b/queue-3.5/tracing-don-t-call-page_to_pfn-if-page-is-null.patch @@ -0,0 +1,47 @@ +From 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa Mon Sep 17 00:00:00 2001 +From: Wen Congyang +Date: Thu, 20 Sep 2012 14:04:47 +0800 +Subject: tracing: Don't call page_to_pfn() if page is NULL + +From: Wen Congyang + +commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream. + +When allocating memory fails, page is NULL. page_to_pfn() will +cause the kernel panicked if we don't use sparsemem vmemmap. + +Link: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com + +Cc: Frederic Weisbecker +Cc: Ingo Molnar +Cc: Andrew Morton +Acked-by: Mel Gorman +Reviewed-by: Minchan Kim +Signed-off-by: Wen Congyang +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/events/kmem.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/trace/events/kmem.h ++++ b/include/trace/events/kmem.h +@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc, + + TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s", + __entry->page, +- page_to_pfn(__entry->page), ++ __entry->page ? page_to_pfn(__entry->page) : 0, + __entry->order, + __entry->migratetype, + show_gfp_flags(__entry->gfp_flags)) +@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page, + + TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d", + __entry->page, +- page_to_pfn(__entry->page), ++ __entry->page ? page_to_pfn(__entry->page) : 0, + __entry->order, + __entry->migratetype, + __entry->order == 0)