From: Greg Kroah-Hartman Date: Sun, 10 Apr 2016 18:01:09 +0000 (-0700) Subject: 4.5-stable patches X-Git-Tag: v4.5.1~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=584c08f4dddba4e5d4b9d6557d203b2baf87d6f6;p=thirdparty%2Fkernel%2Fstable-queue.git 4.5-stable patches added patches: acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch iser-target-fix-identification-of-login-rx-descriptor-type.patch iser-target-rework-connection-termination.patch iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch nfsd-fix-deadlock-secinfo-readdir-compound.patch nfsd4-fix-bad-bounds-checking.patch target-fix-target_release_cmd_kref-shutdown-comp-leak.patch --- diff --git a/queue-4.5/acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch b/queue-4.5/acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch new file mode 100644 index 00000000000..0092a026c71 --- /dev/null +++ b/queue-4.5/acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch @@ -0,0 +1,40 @@ +From fbda4b38fa3995aa0777fe9cbbdcb223c6292083 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 23 Mar 2016 00:11:20 +0100 +Subject: ACPI / PM: Runtime resume devices when waking from hibernate + +From: Lukas Wunner + +commit fbda4b38fa3995aa0777fe9cbbdcb223c6292083 upstream. + +Commit 58a1fbbb2ee8 ("PM / PCI / ACPI: Kick devices that might have been +reset by firmware") added a runtime resume for devices that were runtime +suspended when the system entered suspend-to-RAM. + +Briefly, the motivation was to ensure that devices did not remain in a +reset-power-on state after resume, potentially preventing deep SoC-wide +low-power states from being entered on idle. + +Currently we're not doing the same when leaving suspend-to-disk and this +asymmetry is a problem if drivers rely on the automatic resume triggered +by pm_complete_with_resume_check(). Fix it. + +Fixes: 58a1fbbb2ee8 (PM / PCI / ACPI: Kick devices that might have been reset by firmware) +Signed-off-by: Lukas Wunner +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sleep.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -714,6 +714,7 @@ static int acpi_hibernation_enter(void) + + static void acpi_hibernation_leave(void) + { ++ pm_set_resume_via_firmware(); + /* + * If ACPI is not enabled by the BIOS and the boot kernel, we need to + * enable it here. diff --git a/queue-4.5/arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch b/queue-4.5/arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch new file mode 100644 index 00000000000..a4c938056fd --- /dev/null +++ b/queue-4.5/arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch @@ -0,0 +1,32 @@ +From ae3fc8ea08e405682f1fa959f94b6e4126afbc1b Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Fri, 11 Mar 2016 11:43:39 +0100 +Subject: ARM: dts: at91: sama5d3 Xplained: don't disable hsmci regulator + +From: Ludovic Desroches + +commit ae3fc8ea08e405682f1fa959f94b6e4126afbc1b upstream. + +If enabling the hsmci regulator on card detection, the board can reboot +on sd card insertion. Keeping the regulator always enabled fixes this +issue. + +Signed-off-by: Ludovic Desroches +Fixes: 1b53e3416dd0 ("ARM: at91/dt: sama5d3 xplained: add fixed regulator for vmmc0") +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -303,6 +303,7 @@ + regulator-name = "mmc0-card-supply"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ regulator-always-on; + }; + + gpio_keys { diff --git a/queue-4.5/arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch b/queue-4.5/arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch new file mode 100644 index 00000000000..095ab592b74 --- /dev/null +++ b/queue-4.5/arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch @@ -0,0 +1,31 @@ +From b02acd4e62602a6ab307da84388a16bf60106c48 Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Fri, 11 Mar 2016 11:35:10 +0100 +Subject: ARM: dts: at91: sama5d4 Xplained: don't disable hsmci regulator + +From: Ludovic Desroches + +commit b02acd4e62602a6ab307da84388a16bf60106c48 upstream. + +If enabling the hsmci regulator on card detection, the board can reboot +on sd card insertion. Keeping the regulator always enabled fixes this +issue. + +Signed-off-by: Ludovic Desroches +Fixes: 8d545f32bd77 ("ARM: at91/dt: sama5d4 xplained: add regulators for v(q)mmc1 supplies") +Signed-off-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -268,5 +268,6 @@ + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc_3v3_reg>; ++ regulator-always-on; + }; + }; diff --git a/queue-4.5/clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch b/queue-4.5/clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch new file mode 100644 index 00000000000..754f7a33f07 --- /dev/null +++ b/queue-4.5/clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch @@ -0,0 +1,48 @@ +From 773b3966dd3cdaeb68e7f2edfe5656abac1dc411 Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Mon, 15 Feb 2016 19:03:57 -0800 +Subject: clk: bcm2835: Fix setting of PLL divider clock rates + +From: Eric Anholt + +commit 773b3966dd3cdaeb68e7f2edfe5656abac1dc411 upstream. + +Our dividers weren't being set successfully because CM_PASSWORD wasn't +included in the register write. It looks easier to just compute the +divider to write ourselves than to update clk-divider for the ability +to OR in some arbitrary bits on write. + +Fixes about half of the video modes on my HDMI monitor (everything +except 720x400). + +Signed-off-by: Eric Anholt +Signed-off-by: Michael Turquette +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/bcm/clk-bcm2835.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate( + struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw); + struct bcm2835_cprman *cprman = divider->cprman; + const struct bcm2835_pll_divider_data *data = divider->data; +- u32 cm; +- int ret; ++ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS; + +- ret = clk_divider_ops.set_rate(hw, rate, parent_rate); +- if (ret) +- return ret; ++ div = DIV_ROUND_UP_ULL(parent_rate, rate); + ++ div = min(div, max_div); ++ if (div == max_div) ++ div = 0; ++ ++ cprman_write(cprman, data->a2w_reg, div); + cm = cprman_read(cprman, data->cm_reg); + cprman_write(cprman, data->cm_reg, cm | data->load_mask); + cprman_write(cprman, data->cm_reg, cm & ~data->load_mask); diff --git a/queue-4.5/clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch b/queue-4.5/clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch new file mode 100644 index 00000000000..c53a8942ff6 --- /dev/null +++ b/queue-4.5/clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch @@ -0,0 +1,33 @@ +From e8b63288b37dbb8457b510c9d96f6006da4653f6 Mon Sep 17 00:00:00 2001 +From: Alexander Kochetkov +Date: Tue, 26 Jan 2016 16:34:00 +0300 +Subject: clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks + +From: Alexander Kochetkov + +commit e8b63288b37dbb8457b510c9d96f6006da4653f6 upstream. + +hclk_cpubus needs to keep running because it is needed for devices like +the rom, i2s0 or spdif to be accessible via cpu. Without that all +accesses to devices (readl/writel) return wrong data. So add it +to the list of critical clocks. + +Fixes: 78eaf6095cc763c ("clk: rockchip: disable unused clocks") +Signed-off-by: Alexander Kochetkov +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3188.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -748,6 +748,7 @@ static const char *const rk3188_critical + "hclk_peri", + "pclk_cpu", + "pclk_peri", ++ "hclk_cpubus" + }; + + static void __init rk3188_common_clk_init(struct device_node *np) diff --git a/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch b/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch new file mode 100644 index 00000000000..5cbc003a057 --- /dev/null +++ b/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch @@ -0,0 +1,79 @@ +From c6d5fe2ca8286f35a79f7345c9378c39d48a1527 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Tue, 19 Jan 2016 10:09:22 +0100 +Subject: clk: rockchip: rk3368: fix cpuclk core dividers + +From: Heiko Stuebner + +commit c6d5fe2ca8286f35a79f7345c9378c39d48a1527 upstream. + +Similar to commit 9880d4277f6a ("clk: rockchip: fix rk3288 cpuclk core +dividers") it seems the cpuclk dividers are one to high on the rk3368 +as well. + +And again similar to the previous fix, we opt to make the divider list +contain the values to be written to use the same paradigm for them on all +supported socs. + +Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller") +Reported-by: Zhang Qing +Signed-off-by: Heiko Stuebner +Reviewed-by: zhangqing +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3368.c | 40 +++++++++++++++++++------------------- + 1 file changed, 20 insertions(+), 20 deletions(-) + +--- a/drivers/clk/rockchip/clk-rk3368.c ++++ b/drivers/clk/rockchip/clk-rk3368.c +@@ -218,29 +218,29 @@ static const struct rockchip_cpuclk_reg_ + } + + static struct rockchip_cpuclk_rate_table rk3368_cpuclkb_rates[] __initdata = { +- RK3368_CPUCLKB_RATE(1512000000, 2, 6, 6), +- RK3368_CPUCLKB_RATE(1488000000, 2, 5, 5), +- RK3368_CPUCLKB_RATE(1416000000, 2, 5, 5), +- RK3368_CPUCLKB_RATE(1200000000, 2, 4, 4), +- RK3368_CPUCLKB_RATE(1008000000, 2, 4, 4), +- RK3368_CPUCLKB_RATE( 816000000, 2, 3, 3), +- RK3368_CPUCLKB_RATE( 696000000, 2, 3, 3), +- RK3368_CPUCLKB_RATE( 600000000, 2, 2, 2), +- RK3368_CPUCLKB_RATE( 408000000, 2, 2, 2), +- RK3368_CPUCLKB_RATE( 312000000, 2, 2, 2), ++ RK3368_CPUCLKB_RATE(1512000000, 1, 5, 5), ++ RK3368_CPUCLKB_RATE(1488000000, 1, 4, 4), ++ RK3368_CPUCLKB_RATE(1416000000, 1, 4, 4), ++ RK3368_CPUCLKB_RATE(1200000000, 1, 3, 3), ++ RK3368_CPUCLKB_RATE(1008000000, 1, 3, 3), ++ RK3368_CPUCLKB_RATE( 816000000, 1, 2, 2), ++ RK3368_CPUCLKB_RATE( 696000000, 1, 2, 2), ++ RK3368_CPUCLKB_RATE( 600000000, 1, 1, 1), ++ RK3368_CPUCLKB_RATE( 408000000, 1, 1, 1), ++ RK3368_CPUCLKB_RATE( 312000000, 1, 1, 1), + }; + + static struct rockchip_cpuclk_rate_table rk3368_cpuclkl_rates[] __initdata = { +- RK3368_CPUCLKL_RATE(1512000000, 2, 7, 7), +- RK3368_CPUCLKL_RATE(1488000000, 2, 6, 6), +- RK3368_CPUCLKL_RATE(1416000000, 2, 6, 6), +- RK3368_CPUCLKL_RATE(1200000000, 2, 5, 5), +- RK3368_CPUCLKL_RATE(1008000000, 2, 5, 5), +- RK3368_CPUCLKL_RATE( 816000000, 2, 4, 4), +- RK3368_CPUCLKL_RATE( 696000000, 2, 3, 3), +- RK3368_CPUCLKL_RATE( 600000000, 2, 3, 3), +- RK3368_CPUCLKL_RATE( 408000000, 2, 2, 2), +- RK3368_CPUCLKL_RATE( 312000000, 2, 2, 2), ++ RK3368_CPUCLKL_RATE(1512000000, 1, 6, 6), ++ RK3368_CPUCLKL_RATE(1488000000, 1, 5, 5), ++ RK3368_CPUCLKL_RATE(1416000000, 1, 5, 5), ++ RK3368_CPUCLKL_RATE(1200000000, 1, 4, 4), ++ RK3368_CPUCLKL_RATE(1008000000, 1, 4, 4), ++ RK3368_CPUCLKL_RATE( 816000000, 1, 3, 3), ++ RK3368_CPUCLKL_RATE( 696000000, 1, 2, 2), ++ RK3368_CPUCLKL_RATE( 600000000, 1, 2, 2), ++ RK3368_CPUCLKL_RATE( 408000000, 1, 1, 1), ++ RK3368_CPUCLKL_RATE( 312000000, 1, 1, 1), + }; + + static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { diff --git a/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch b/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch new file mode 100644 index 00000000000..c838e57edb8 --- /dev/null +++ b/queue-4.5/clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch @@ -0,0 +1,34 @@ +From 535ebd428aeb07c3327947281306f2943f2c9faa Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Tue, 19 Jan 2016 10:01:08 +0100 +Subject: clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster + +From: Heiko Stuebner + +commit 535ebd428aeb07c3327947281306f2943f2c9faa upstream. + +Both clusters have their mux bit in bit 7 of their respective register. +For whatever reason the big cluster currently lists bit 15 which is +definitly wrong. + +Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller") +Reported-by: Zhang Qing +Signed-off-by: Heiko Stuebner +Reviewed-by: zhangqing +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3368.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/rockchip/clk-rk3368.c ++++ b/drivers/clk/rockchip/clk-rk3368.c +@@ -165,7 +165,7 @@ static const struct rockchip_cpuclk_reg_ + .core_reg = RK3368_CLKSEL_CON(0), + .div_core_shift = 0, + .div_core_mask = 0x1f, +- .mux_core_shift = 15, ++ .mux_core_shift = 7, + }; + + static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = { diff --git a/queue-4.5/clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch b/queue-4.5/clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch new file mode 100644 index 00000000000..1f33cede6ad --- /dev/null +++ b/queue-4.5/clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch @@ -0,0 +1,32 @@ +From fd0c0740fac17a014704ef89d8c8b1768711ca59 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Wed, 20 Jan 2016 21:47:57 +0100 +Subject: clk: rockchip: rk3368: fix hdmi_cec gate-register + +From: Heiko Stuebner + +commit fd0c0740fac17a014704ef89d8c8b1768711ca59 upstream. + +Fix a typo making the sclk_hdmi_cec access a wrong register to handle +its gate. + +Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller") +Signed-off-by: Heiko Stuebner +Reviewed-by: zhangqing +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3368.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/rockchip/clk-rk3368.c ++++ b/drivers/clk/rockchip/clk-rk3368.c +@@ -442,7 +442,7 @@ static struct rockchip_clk_branch rk3368 + GATE(SCLK_HDMI_HDCP, "sclk_hdmi_hdcp", "xin24m", 0, + RK3368_CLKGATE_CON(4), 13, GFLAGS), + GATE(SCLK_HDMI_CEC, "sclk_hdmi_cec", "xin32k", 0, +- RK3368_CLKGATE_CON(5), 12, GFLAGS), ++ RK3368_CLKGATE_CON(4), 12, GFLAGS), + + COMPOSITE_NODIV(0, "vip_src", mux_pll_src_cpll_gpll_p, 0, + RK3368_CLKSEL_CON(21), 15, 1, MFLAGS, diff --git a/queue-4.5/clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch b/queue-4.5/clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch new file mode 100644 index 00000000000..97f152be0f2 --- /dev/null +++ b/queue-4.5/clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch @@ -0,0 +1,37 @@ +From 0f28d98463498c61c61a38aacbf9f69e92e85e9d Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Wed, 20 Jan 2016 19:22:38 +0100 +Subject: clk: rockchip: rk3368: fix parents of video encoder/decoder + +From: Heiko Stuebner + +commit 0f28d98463498c61c61a38aacbf9f69e92e85e9d upstream. + +The vdpu and vepu clocks can also be parented to the npll and current +parent list also is wrong as it would use the npll as "usbphy" source, +so adapt the parent to the correct one. + +Fixes: 3536c97a52db ("clk: rockchip: add rk3368 clock controller") +Signed-off-by: Heiko Stuebner +Reviewed-by: zhangqing +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3368.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/rockchip/clk-rk3368.c ++++ b/drivers/clk/rockchip/clk-rk3368.c +@@ -384,10 +384,10 @@ static struct rockchip_clk_branch rk3368 + * Clock-Architecture Diagram 3 + */ + +- COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_usb_p, 0, ++ COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_npll_usb_p, 0, + RK3368_CLKSEL_CON(15), 6, 2, MFLAGS, 0, 5, DFLAGS, + RK3368_CLKGATE_CON(4), 6, GFLAGS), +- COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb_p, 0, ++ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_npll_usb_p, 0, + RK3368_CLKSEL_CON(15), 14, 2, MFLAGS, 8, 5, DFLAGS, + RK3368_CLKGATE_CON(4), 7, GFLAGS), + diff --git a/queue-4.5/iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch b/queue-4.5/iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch new file mode 100644 index 00000000000..23ff33c5737 --- /dev/null +++ b/queue-4.5/iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch @@ -0,0 +1,71 @@ +From aea92980601f7ddfcb3c54caa53a43726314fe46 Mon Sep 17 00:00:00 2001 +From: Jenny Derzhavetz +Date: Wed, 24 Feb 2016 19:23:59 +0200 +Subject: iser-target: Add new state ISER_CONN_BOUND to isert_conn + +From: Jenny Derzhavetz + +commit aea92980601f7ddfcb3c54caa53a43726314fe46 upstream. + +We need an indication that isert_conn->iscsi_conn binding has +happened so we'll know not to invoke a connection reinstatement +on an unbound connection which will lead to a bogus isert_conn->conn +dereferece. + +Signed-off-by: Jenny Derzhavetz +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/isert/ib_isert.c | 7 +++++-- + drivers/infiniband/ulp/isert/ib_isert.h | 1 + + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -825,7 +825,7 @@ isert_put_conn(struct isert_conn *isert_ + * @isert_conn: isert connection struct + * + * Notes: +- * In case the connection state is FULL_FEATURE, move state ++ * In case the connection state is BOUND, move state + * to TEMINATING and start teardown sequence (rdma_disconnect). + * In case the connection state is UP, complete flush as well. + * +@@ -841,6 +841,7 @@ isert_conn_terminate(struct isert_conn * + case ISER_CONN_TERMINATING: + break; + case ISER_CONN_UP: ++ case ISER_CONN_BOUND: + case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ + isert_info("Terminating conn %p state %d\n", + isert_conn, isert_conn->state); +@@ -2075,7 +2076,8 @@ isert_cq_comp_err(struct isert_conn *ise + isert_completion_put(desc, isert_cmd, ib_dev, true); + } else { + isert_conn->post_recv_buf_count--; +- if (!isert_conn->post_recv_buf_count) ++ if (!isert_conn->post_recv_buf_count && ++ isert_conn->state >= ISER_CONN_BOUND) + iscsit_cause_connection_reinstatement(isert_conn->conn, 0); + } + } +@@ -3215,6 +3217,7 @@ accept_wait: + + conn->context = isert_conn; + isert_conn->conn = conn; ++ isert_conn->state = ISER_CONN_BOUND; + + isert_set_conn_info(np, conn, isert_conn); + +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -84,6 +84,7 @@ enum iser_ib_op_code { + enum iser_conn_state { + ISER_CONN_INIT, + ISER_CONN_UP, ++ ISER_CONN_BOUND, + ISER_CONN_FULL_FEATURE, + ISER_CONN_TERMINATING, + ISER_CONN_DOWN, diff --git a/queue-4.5/iser-target-fix-identification-of-login-rx-descriptor-type.patch b/queue-4.5/iser-target-fix-identification-of-login-rx-descriptor-type.patch new file mode 100644 index 00000000000..455ac659a3f --- /dev/null +++ b/queue-4.5/iser-target-fix-identification-of-login-rx-descriptor-type.patch @@ -0,0 +1,35 @@ +From b89a7c25462b164db280abc3b05d4d9d888d40e9 Mon Sep 17 00:00:00 2001 +From: Jenny Derzhavetz +Date: Wed, 24 Feb 2016 19:23:58 +0200 +Subject: iser-target: Fix identification of login rx descriptor type + +From: Jenny Derzhavetz + +commit b89a7c25462b164db280abc3b05d4d9d888d40e9 upstream. + +Once connection request is accepted, one rx descriptor +is posted to receive login request. This descriptor has rx type, +but is outside the main pool of rx descriptors, and thus +was mistreated as tx type. + +Signed-off-by: Jenny Derzhavetz +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/isert/ib_isert.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2048,7 +2048,8 @@ is_isert_tx_desc(struct isert_conn *iser + void *start = isert_conn->rx_descs; + int len = ISERT_QP_MAX_RECV_DTOS * sizeof(*isert_conn->rx_descs); + +- if (wr_id >= start && wr_id < start + len) ++ if ((wr_id >= start && wr_id < start + len) || ++ (wr_id == isert_conn->login_req_buf)) + return false; + + return true; diff --git a/queue-4.5/iser-target-rework-connection-termination.patch b/queue-4.5/iser-target-rework-connection-termination.patch new file mode 100644 index 00000000000..0e1caee4020 --- /dev/null +++ b/queue-4.5/iser-target-rework-connection-termination.patch @@ -0,0 +1,227 @@ +From 6d1fba0c2cc7efe42fd761ecbba833ed0ea7b07e Mon Sep 17 00:00:00 2001 +From: Jenny Derzhavetz +Date: Wed, 24 Feb 2016 19:24:01 +0200 +Subject: iser-target: Rework connection termination + +From: Jenny Derzhavetz + +commit 6d1fba0c2cc7efe42fd761ecbba833ed0ea7b07e upstream. + +When we receive an event that triggers connection termination, +we have a a couple of things we may want to do: +1. In case we are already terminating, bailout early +2. In case we are connected but not bound, disconnect and schedule + a connection cleanup silently (don't reinstate) +3. In case we are connected and bound, disconnect and reinstate the connection + +This rework fixes a bug that was detected against a mis-behaved +initiator which rejected our rdma_cm accept, in this stage the +isert_conn is no bound and reinstate caused a bogus dereference. + +What's great about this is that we don't need the +post_recv_buf_count anymore, so get rid of it. + +Signed-off-by: Jenny Derzhavetz +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/isert/ib_isert.c | 107 +++++++++++++++----------------- + drivers/infiniband/ulp/isert/ib_isert.h | 1 + 2 files changed, 52 insertions(+), 56 deletions(-) + +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -65,6 +65,7 @@ isert_rdma_accept(struct isert_conn *ise + struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); + + static void isert_release_work(struct work_struct *work); ++static void isert_wait4flush(struct isert_conn *isert_conn); + + static inline bool + isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd) +@@ -820,6 +821,25 @@ isert_put_conn(struct isert_conn *isert_ + kref_put(&isert_conn->kref, isert_release_kref); + } + ++static void ++isert_handle_unbound_conn(struct isert_conn *isert_conn) ++{ ++ struct isert_np *isert_np = isert_conn->cm_id->context; ++ ++ mutex_lock(&isert_np->mutex); ++ if (!list_empty(&isert_conn->node)) { ++ /* ++ * This means iscsi doesn't know this connection ++ * so schedule a cleanup ourselves ++ */ ++ list_del_init(&isert_conn->node); ++ isert_put_conn(isert_conn); ++ complete(&isert_conn->wait); ++ queue_work(isert_release_wq, &isert_conn->release_work); ++ } ++ mutex_unlock(&isert_np->mutex); ++} ++ + /** + * isert_conn_terminate() - Initiate connection termination + * @isert_conn: isert connection struct +@@ -837,24 +857,19 @@ isert_conn_terminate(struct isert_conn * + { + int err; + +- switch (isert_conn->state) { +- case ISER_CONN_TERMINATING: +- break; +- case ISER_CONN_UP: +- case ISER_CONN_BOUND: +- case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ +- isert_info("Terminating conn %p state %d\n", +- isert_conn, isert_conn->state); +- isert_conn->state = ISER_CONN_TERMINATING; +- err = rdma_disconnect(isert_conn->cm_id); +- if (err) +- isert_warn("Failed rdma_disconnect isert_conn %p\n", +- isert_conn); +- break; +- default: +- isert_warn("conn %p teminating in state %d\n", +- isert_conn, isert_conn->state); +- } ++ if (isert_conn->state >= ISER_CONN_TERMINATING) ++ return; ++ ++ isert_info("Terminating conn %p state %d\n", ++ isert_conn, isert_conn->state); ++ isert_conn->state = ISER_CONN_TERMINATING; ++ err = rdma_disconnect(isert_conn->cm_id); ++ if (err) ++ isert_warn("Failed rdma_disconnect isert_conn %p\n", ++ isert_conn); ++ ++ isert_info("conn %p completing wait\n", isert_conn); ++ complete(&isert_conn->wait); + } + + static int +@@ -888,30 +903,27 @@ static int + isert_disconnected_handler(struct rdma_cm_id *cma_id, + enum rdma_cm_event_type event) + { +- struct isert_np *isert_np = cma_id->context; + struct isert_conn *isert_conn = cma_id->qp->qp_context; +- bool terminating = false; + + mutex_lock(&isert_conn->mutex); +- terminating = (isert_conn->state == ISER_CONN_TERMINATING); +- isert_conn_terminate(isert_conn); +- mutex_unlock(&isert_conn->mutex); +- +- isert_info("conn %p completing wait\n", isert_conn); +- complete(&isert_conn->wait); +- +- if (terminating) +- goto out; +- +- mutex_lock(&isert_np->mutex); +- if (!list_empty(&isert_conn->node)) { +- list_del_init(&isert_conn->node); +- isert_put_conn(isert_conn); +- queue_work(isert_release_wq, &isert_conn->release_work); ++ switch (isert_conn->state) { ++ case ISER_CONN_TERMINATING: ++ break; ++ case ISER_CONN_UP: ++ isert_conn_terminate(isert_conn); ++ isert_wait4flush(isert_conn); ++ isert_handle_unbound_conn(isert_conn); ++ break; ++ case ISER_CONN_BOUND: ++ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ ++ iscsit_cause_connection_reinstatement(isert_conn->conn, 0); ++ break; ++ default: ++ isert_warn("conn %p teminating in state %d\n", ++ isert_conn, isert_conn->state); + } +- mutex_unlock(&isert_np->mutex); ++ mutex_unlock(&isert_conn->mutex); + +-out: + return 0; + } + +@@ -985,13 +997,10 @@ isert_post_recvm(struct isert_conn *iser + rx_wr--; + rx_wr->next = NULL; /* mark end of work requests list */ + +- isert_conn->post_recv_buf_count += count; + ret = ib_post_recv(isert_conn->qp, isert_conn->rx_wr, + &rx_wr_failed); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed with ret: %d\n", ret); +- isert_conn->post_recv_buf_count -= count; +- } + + return ret; + } +@@ -1007,12 +1016,9 @@ isert_post_recv(struct isert_conn *isert + rx_wr.num_sge = 1; + rx_wr.next = NULL; + +- isert_conn->post_recv_buf_count++; + ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_failed); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed with ret: %d\n", ret); +- isert_conn->post_recv_buf_count--; +- } + + return ret; + } +@@ -1132,12 +1138,9 @@ isert_rdma_post_recvl(struct isert_conn + rx_wr.sg_list = &sge; + rx_wr.num_sge = 1; + +- isert_conn->post_recv_buf_count++; + ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_fail); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed: %d\n", ret); +- isert_conn->post_recv_buf_count--; +- } + + return ret; + } +@@ -1633,7 +1636,6 @@ isert_rcv_completion(struct iser_rx_desc + ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen, + DMA_FROM_DEVICE); + +- isert_conn->post_recv_buf_count--; + } + + static int +@@ -2073,11 +2075,6 @@ isert_cq_comp_err(struct isert_conn *ise + isert_unmap_tx_desc(desc, ib_dev); + else + isert_completion_put(desc, isert_cmd, ib_dev, true); +- } else { +- isert_conn->post_recv_buf_count--; +- if (!isert_conn->post_recv_buf_count && +- isert_conn->state >= ISER_CONN_BOUND) +- iscsit_cause_connection_reinstatement(isert_conn->conn, 0); + } + } + +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -180,7 +180,6 @@ struct isert_device; + + struct isert_conn { + enum iser_conn_state state; +- int post_recv_buf_count; + u32 responder_resources; + u32 initiator_depth; + bool pi_support; diff --git a/queue-4.5/iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch b/queue-4.5/iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch new file mode 100644 index 00000000000..bd80573d953 --- /dev/null +++ b/queue-4.5/iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch @@ -0,0 +1,55 @@ +From f81bf458208ef6d12b2fc08091204e3859dcdba4 Mon Sep 17 00:00:00 2001 +From: Jenny Derzhavetz +Date: Wed, 24 Feb 2016 19:24:00 +0200 +Subject: iser-target: Separate flows for np listeners and connections cma events + +From: Jenny Derzhavetz + +commit f81bf458208ef6d12b2fc08091204e3859dcdba4 upstream. + +No need to restrict this check to specific events. + +Signed-off-by: Jenny Derzhavetz +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/isert/ib_isert.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -889,14 +889,9 @@ isert_disconnected_handler(struct rdma_c + enum rdma_cm_event_type event) + { + struct isert_np *isert_np = cma_id->context; +- struct isert_conn *isert_conn; ++ struct isert_conn *isert_conn = cma_id->qp->qp_context; + bool terminating = false; + +- if (isert_np->cm_id == cma_id) +- return isert_np_cma_handler(cma_id->context, event); +- +- isert_conn = cma_id->qp->qp_context; +- + mutex_lock(&isert_conn->mutex); + terminating = (isert_conn->state == ISER_CONN_TERMINATING); + isert_conn_terminate(isert_conn); +@@ -935,12 +930,16 @@ isert_connect_error(struct rdma_cm_id *c + static int + isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + { ++ struct isert_np *isert_np = cma_id->context; + int ret = 0; + + isert_info("%s (%d): status %d id %p np %p\n", + rdma_event_msg(event->event), event->event, + event->status, cma_id, cma_id->context); + ++ if (isert_np->cm_id == cma_id) ++ return isert_np_cma_handler(cma_id->context, event->event); ++ + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: + ret = isert_connect_request(cma_id, event); diff --git a/queue-4.5/nfsd-fix-deadlock-secinfo-readdir-compound.patch b/queue-4.5/nfsd-fix-deadlock-secinfo-readdir-compound.patch new file mode 100644 index 00000000000..9805a6f99e2 --- /dev/null +++ b/queue-4.5/nfsd-fix-deadlock-secinfo-readdir-compound.patch @@ -0,0 +1,34 @@ +From 2f6fc056e899bd0144a08da5cacaecbe8997cd74 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Wed, 2 Mar 2016 16:36:21 -0800 +Subject: nfsd: fix deadlock secinfo+readdir compound + +From: J. Bruce Fields + +commit 2f6fc056e899bd0144a08da5cacaecbe8997cd74 upstream. + +nfsd_lookup_dentry exits with the parent filehandle locked. fh_put also +unlocks if necessary (nfsd filehandle locking is probably too lenient), +so it gets unlocked eventually, but if the following op in the compound +needs to lock it again, we can deadlock. + +A fuzzer ran into this; normal clients don't send a secinfo followed by +a readdir in the same compound. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -878,6 +878,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, st + &exp, &dentry); + if (err) + return err; ++ fh_unlock(&cstate->current_fh); + if (d_really_is_negative(dentry)) { + exp_put(exp); + err = nfserr_noent; diff --git a/queue-4.5/nfsd4-fix-bad-bounds-checking.patch b/queue-4.5/nfsd4-fix-bad-bounds-checking.patch new file mode 100644 index 00000000000..16499861388 --- /dev/null +++ b/queue-4.5/nfsd4-fix-bad-bounds-checking.patch @@ -0,0 +1,70 @@ +From 4aed9c46afb80164401143aa0fdcfe3798baa9d5 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Mon, 29 Feb 2016 20:21:21 -0500 +Subject: nfsd4: fix bad bounds checking + +From: J. Bruce Fields + +commit 4aed9c46afb80164401143aa0fdcfe3798baa9d5 upstream. + +A number of spots in the xdr decoding follow a pattern like + + n = be32_to_cpup(p++); + READ_BUF(n + 4); + +where n is a u32. The only bounds checking is done in READ_BUF itself, +but since it's checking (n + 4), it won't catch cases where n is very +large, (u32)(-4) or higher. I'm not sure exactly what the consequences +are, but we've seen crashes soon after. + +Instead, just break these up into two READ_BUF()s. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4xdr.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoun + + READ_BUF(4); + rename->rn_snamelen = be32_to_cpup(p++); +- READ_BUF(rename->rn_snamelen + 4); ++ READ_BUF(rename->rn_snamelen); + SAVEMEM(rename->rn_sname, rename->rn_snamelen); ++ READ_BUF(4); + rename->rn_tnamelen = be32_to_cpup(p++); + READ_BUF(rename->rn_tnamelen); + SAVEMEM(rename->rn_tname, rename->rn_tnamelen); +@@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_co + READ_BUF(8); + setclientid->se_callback_prog = be32_to_cpup(p++); + setclientid->se_callback_netid_len = be32_to_cpup(p++); +- +- READ_BUF(setclientid->se_callback_netid_len + 4); ++ READ_BUF(setclientid->se_callback_netid_len); + SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len); ++ READ_BUF(4); + setclientid->se_callback_addr_len = be32_to_cpup(p++); + +- READ_BUF(setclientid->se_callback_addr_len + 4); ++ READ_BUF(setclientid->se_callback_addr_len); + SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len); ++ READ_BUF(4); + setclientid->se_callback_ident = be32_to_cpup(p++); + + DECODE_TAIL; +@@ -1835,8 +1837,9 @@ nfsd4_decode_compound(struct nfsd4_compo + + READ_BUF(4); + argp->taglen = be32_to_cpup(p++); +- READ_BUF(argp->taglen + 8); ++ READ_BUF(argp->taglen); + SAVEMEM(argp->tag, argp->taglen); ++ READ_BUF(8); + argp->minorversion = be32_to_cpup(p++); + argp->opcnt = be32_to_cpup(p++); + max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2); diff --git a/queue-4.5/series b/queue-4.5/series index 796df299fe2..da895b040d7 100644 --- a/queue-4.5/series +++ b/queue-4.5/series @@ -201,3 +201,19 @@ mmc-tegra-disable-uhs-i-modes-for-tegra114.patch mmc-tegra-properly-disable-card-clock.patch mmc-sdhci-fix-override-of-timeout-clk-wrt-max_busy_timeout.patch mmc-atmel-mci-check-pdata-for-null-before-dereferencing-it-at-dma-config.patch +clk-rockchip-rk3368-fix-cpuclk-mux-bit-of-big-cpu-cluster.patch +clk-rockchip-rk3368-fix-cpuclk-core-dividers.patch +clk-rockchip-rk3368-fix-parents-of-video-encoder-decoder.patch +clk-rockchip-rk3368-fix-hdmi_cec-gate-register.patch +clk-rockchip-add-hclk_cpubus-to-the-list-of-rk3188-critical-clocks.patch +clk-bcm2835-fix-setting-of-pll-divider-clock-rates.patch +target-fix-target_release_cmd_kref-shutdown-comp-leak.patch +iser-target-fix-identification-of-login-rx-descriptor-type.patch +iser-target-add-new-state-iser_conn_bound-to-isert_conn.patch +iser-target-separate-flows-for-np-listeners-and-connections-cma-events.patch +iser-target-rework-connection-termination.patch +nfsd4-fix-bad-bounds-checking.patch +nfsd-fix-deadlock-secinfo-readdir-compound.patch +arm-dts-at91-sama5d3-xplained-don-t-disable-hsmci-regulator.patch +arm-dts-at91-sama5d4-xplained-don-t-disable-hsmci-regulator.patch +acpi-pm-runtime-resume-devices-when-waking-from-hibernate.patch diff --git a/queue-4.5/target-fix-target_release_cmd_kref-shutdown-comp-leak.patch b/queue-4.5/target-fix-target_release_cmd_kref-shutdown-comp-leak.patch new file mode 100644 index 00000000000..6d1181358d9 --- /dev/null +++ b/queue-4.5/target-fix-target_release_cmd_kref-shutdown-comp-leak.patch @@ -0,0 +1,41 @@ +From 5e47f1985d7107331c3f64fb3ec83d66fd73577e Mon Sep 17 00:00:00 2001 +From: Himanshu Madhani +Date: Mon, 14 Mar 2016 22:47:37 -0700 +Subject: target: Fix target_release_cmd_kref shutdown comp leak + +From: Himanshu Madhani + +commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream. + +This patch fixes an active I/O shutdown bug for fabric +drivers using target_wait_for_sess_cmds(), where se_cmd +descriptor shutdown would result in hung tasks waiting +indefinitely for se_cmd->cmd_wait_comp to complete(). + +To address this bug, drop the incorrect list_del_init() +usage in target_wait_for_sess_cmds() and always complete() +during se_cmd target_release_cmd_kref() put, in order to +let caller invoke the final fabric release callback +into se_cmd->se_tfo->release_cmd() code. + +Reported-by: Himanshu Madhani +Tested-by: Himanshu Madhani +Signed-off-by: Himanshu Madhani +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2596,8 +2596,6 @@ void target_wait_for_sess_cmds(struct se + + list_for_each_entry_safe(se_cmd, tmp_cmd, + &se_sess->sess_wait_list, se_cmd_list) { +- list_del_init(&se_cmd->se_cmd_list); +- + pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:" + " %d\n", se_cmd, se_cmd->t_state, + se_cmd->se_tfo->get_cmd_state(se_cmd));