From: Greg Kroah-Hartman Date: Sat, 2 May 2015 17:17:57 +0000 (+0200) Subject: 4.0-stable patches X-Git-Tag: v3.10.77~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f3cf2c6512cc1d4de3d4178d8529e9d52e81d22;p=thirdparty%2Fkernel%2Fstable-queue.git 4.0-stable patches added patches: drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch i2c-core-export-bus-recovery-functions.patch i2c-mark-adapter-devices-with-pm_runtime_no_callbacks.patch i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch i2c-rk3x-report-number-of-messages-transmitted.patch ib-core-disallow-registering-0-sized-memory-region.patch ib-core-don-t-disallow-registering-region-starting-at-0x0.patch ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch ib-mlx4-fix-wqe-lso-segment-calculation.patch mvsas-fix-panic-on-expander-attached-sata-devices.patch rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch stk1160-make-sure-current-buffer-is-released.patch tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch --- diff --git a/queue-4.0/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch b/queue-4.0/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch new file mode 100644 index 00000000000..f2110d5ddea --- /dev/null +++ b/queue-4.0/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch @@ -0,0 +1,49 @@ +From 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Fri, 27 Feb 2015 11:26:04 -0800 +Subject: Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open() + +From: "K. Y. Srinivasan" + +commit 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf upstream. + +Correctly rollback state if the failure occurs after we have handed over +the ownership of the buffer to the host. + +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/channel.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -135,7 +135,7 @@ int vmbus_open(struct vmbus_channel *new + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto error0; ++ goto error_gpadl; + } + + init_completion(&open_info->waitevent); +@@ -151,7 +151,7 @@ int vmbus_open(struct vmbus_channel *new + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto error0; ++ goto error_gpadl; + } + + if (userdatalen) +@@ -195,6 +195,9 @@ error1: + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++error_gpadl: ++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); ++ + error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); diff --git a/queue-4.0/i2c-core-export-bus-recovery-functions.patch b/queue-4.0/i2c-core-export-bus-recovery-functions.patch new file mode 100644 index 00000000000..12a0d39ec32 --- /dev/null +++ b/queue-4.0/i2c-core-export-bus-recovery-functions.patch @@ -0,0 +1,54 @@ +From c1c21f4e60ed4523292f1a89ff45a208bddd3849 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 15 Apr 2015 19:18:39 +0100 +Subject: i2c: core: Export bus recovery functions + +From: Mark Brown + +commit c1c21f4e60ed4523292f1a89ff45a208bddd3849 upstream. + +Current -next fails to link an ARM allmodconfig because drivers that use +the core recovery functions can be built as modules but those functions +are not exported: + +ERROR: "i2c_generic_gpio_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined! +ERROR: "i2c_generic_scl_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined! +ERROR: "i2c_recover_bus" [drivers/i2c/busses/i2c-davinci.ko] undefined! + +Add exports to fix this. + +Fixes: 5f9296ba21b3c (i2c: Add bus recovery infrastructure) +Signed-off-by: Mark Brown +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -596,6 +596,7 @@ int i2c_generic_scl_recovery(struct i2c_ + adap->bus_recovery_info->set_scl(adap, 1); + return i2c_generic_recovery(adap); + } ++EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery); + + int i2c_generic_gpio_recovery(struct i2c_adapter *adap) + { +@@ -610,6 +611,7 @@ int i2c_generic_gpio_recovery(struct i2c + + return ret; + } ++EXPORT_SYMBOL_GPL(i2c_generic_gpio_recovery); + + int i2c_recover_bus(struct i2c_adapter *adap) + { +@@ -619,6 +621,7 @@ int i2c_recover_bus(struct i2c_adapter * + dev_dbg(&adap->dev, "Trying i2c bus recovery\n"); + return adap->bus_recovery_info->recover_bus(adap); + } ++EXPORT_SYMBOL_GPL(i2c_recover_bus); + + static int i2c_device_probe(struct device *dev) + { diff --git a/queue-4.0/i2c-mark-adapter-devices-with-pm_runtime_no_callbacks.patch b/queue-4.0/i2c-mark-adapter-devices-with-pm_runtime_no_callbacks.patch new file mode 100644 index 00000000000..a37eb2ca013 --- /dev/null +++ b/queue-4.0/i2c-mark-adapter-devices-with-pm_runtime_no_callbacks.patch @@ -0,0 +1,41 @@ +From 6ada5c1e1b077ab98fc144d7ac132b4dcc0148ec Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Thu, 16 Apr 2015 13:05:19 +0100 +Subject: i2c: Mark adapter devices with pm_runtime_no_callbacks + +From: Charles Keepax + +commit 6ada5c1e1b077ab98fc144d7ac132b4dcc0148ec upstream. + +Commit 523c5b89640e ("i2c: Remove support for legacy PM") removed the PM +ops from the bus type, which causes the pm operations on the s3c2410 +adapter device to fail (-ENOSUPP in rpm_callback). The adapter device +doesn't get bound to a driver and as such can't have its own pm_runtime +callbacks. Previously this was fine as the bus callbacks would have been +used, but now this can cause devices which use PM runtime and are +attached over I2C to fail to resume. + +This commit fixes this issue by marking all adapter devices with +pm_runtime_no_callbacks, since they can't have any. + +Signed-off-by: Charles Keepax +Acked-by: Beata Michalska +Signed-off-by: Wolfram Sang +Fixes: 523c5b89640e +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -1410,6 +1410,8 @@ static int i2c_register_adapter(struct i + + dev_dbg(&adap->dev, "adapter [%s] registered\n", adap->name); + ++ pm_runtime_no_callbacks(&adap->dev); ++ + #ifdef CONFIG_I2C_COMPAT + res = class_compat_create_link(i2c_adapter_compat_class, &adap->dev, + adap->dev.parent); diff --git a/queue-4.0/i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch b/queue-4.0/i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch new file mode 100644 index 00000000000..0152453c717 --- /dev/null +++ b/queue-4.0/i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch @@ -0,0 +1,58 @@ +From 133778482ec6c8fde69406be380333963627c17a Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 23 Apr 2015 10:29:09 +0200 +Subject: i2c: mux: use proper dev when removing "channel-X" symlinks + +From: Wolfram Sang + +commit 133778482ec6c8fde69406be380333963627c17a upstream. + +Those symlinks are created for the mux_dev, so we need to remove it from +there. Currently, it breaks for muxes where the mux_dev is not the device +of the parent adapter like this: + +[ 78.234644] WARNING: CPU: 0 PID: 365 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x5c/0x78() +[ 78.242438] sysfs: cannot create duplicate filename '/devices/platform/i2cbus@8/channel-0' + +Remove confusing comments while we are here. + +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Fixes: c9449affad2ae0 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-mux.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/i2c-mux.c ++++ b/drivers/i2c/i2c-mux.c +@@ -32,8 +32,9 @@ struct i2c_mux_priv { + struct i2c_algorithm algo; + + struct i2c_adapter *parent; +- void *mux_priv; /* the mux chip/device */ +- u32 chan_id; /* the channel id */ ++ struct device *mux_dev; ++ void *mux_priv; ++ u32 chan_id; + + int (*select)(struct i2c_adapter *, void *mux_priv, u32 chan_id); + int (*deselect)(struct i2c_adapter *, void *mux_priv, u32 chan_id); +@@ -119,6 +120,7 @@ struct i2c_adapter *i2c_add_mux_adapter( + + /* Set up private adapter data */ + priv->parent = parent; ++ priv->mux_dev = mux_dev; + priv->mux_priv = mux_priv; + priv->chan_id = chan_id; + priv->select = select; +@@ -203,7 +205,7 @@ void i2c_del_mux_adapter(struct i2c_adap + char symlink_name[20]; + + snprintf(symlink_name, sizeof(symlink_name), "channel-%u", priv->chan_id); +- sysfs_remove_link(&adap->dev.parent->kobj, symlink_name); ++ sysfs_remove_link(&priv->mux_dev->kobj, symlink_name); + + sysfs_remove_link(&priv->adap.dev.kobj, "mux_device"); + i2c_del_adapter(adap); diff --git a/queue-4.0/i2c-rk3x-report-number-of-messages-transmitted.patch b/queue-4.0/i2c-rk3x-report-number-of-messages-transmitted.patch new file mode 100644 index 00000000000..68f989b525c --- /dev/null +++ b/queue-4.0/i2c-rk3x-report-number-of-messages-transmitted.patch @@ -0,0 +1,33 @@ +From c6cbfb91b878224e78408a2e15901c79de77115a Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 20 Apr 2015 15:14:47 -0700 +Subject: i2c: rk3x: report number of messages transmitted + +From: Dmitry Torokhov + +commit c6cbfb91b878224e78408a2e15901c79de77115a upstream. + +master_xfer() method should return number of i2c messages transferred, +but on Rockchip we were usually returning just 1, which caused trouble +with users that actually check number of transferred messages vs. +checking for negative error codes. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-rk3x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -833,7 +833,7 @@ static int rk3x_i2c_xfer(struct i2c_adap + clk_disable(i2c->clk); + spin_unlock_irqrestore(&i2c->lock, flags); + +- return ret; ++ return ret < 0 ? ret : num; + } + + static u32 rk3x_i2c_func(struct i2c_adapter *adap) diff --git a/queue-4.0/ib-core-disallow-registering-0-sized-memory-region.patch b/queue-4.0/ib-core-disallow-registering-0-sized-memory-region.patch new file mode 100644 index 00000000000..86d86703b54 --- /dev/null +++ b/queue-4.0/ib-core-disallow-registering-0-sized-memory-region.patch @@ -0,0 +1,43 @@ +From 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 Mon Sep 17 00:00:00 2001 +From: Yann Droneaud +Date: Mon, 13 Apr 2015 14:56:22 +0200 +Subject: IB/core: disallow registering 0-sized memory region + +From: Yann Droneaud + +commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream. + +If ib_umem_get() is called with a size equal to 0 and an +non-page aligned address, one page will be pinned and a +0-sized umem will be returned to the caller. + +This should not be allowed: it's not expected for a memory +region to have a size equal to 0. + +This patch adds a check to explicitly refuse to register +a 0-sized region. + +Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com +Cc: Shachar Raindel +Cc: Jack Morgenstein +Cc: Or Gerlitz +Signed-off-by: Yann Droneaud +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/umem.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -99,6 +99,9 @@ struct ib_umem *ib_umem_get(struct ib_uc + if (dmasync) + dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + ++ if (!size) ++ return ERR_PTR(-EINVAL); ++ + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. diff --git a/queue-4.0/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch b/queue-4.0/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch new file mode 100644 index 00000000000..6b83898660f --- /dev/null +++ b/queue-4.0/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch @@ -0,0 +1,55 @@ +From 66578b0b2f69659f00b6169e6fe7377c4b100d18 Mon Sep 17 00:00:00 2001 +From: Yann Droneaud +Date: Mon, 13 Apr 2015 14:56:23 +0200 +Subject: IB/core: don't disallow registering region starting at 0x0 + +From: Yann Droneaud + +commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream. + +In a call to ib_umem_get(), if address is 0x0 and size is +already page aligned, check added in commit 8494057ab5e4 +("IB/uverbs: Prevent integer overflow in ib_umem_get address +arithmetic") will refuse to register a memory region that +could otherwise be valid (provided vm.mmap_min_addr sysctl +and mmap_low_allowed SELinux knobs allow userspace to map +something at address 0x0). + +This patch allows back such registration: ib_umem_get() +should probably don't care of the base address provided it +can be pinned with get_user_pages(). + +There's two possible overflows, in (addr + size) and in +PAGE_ALIGN(addr + size), this patch keep ensuring none +of them happen while allowing to pin memory at address +0x0. Anyway, the case of size equal 0 is no more (partially) +handled as 0-length memory region are disallowed by an +earlier check. + +Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com +Cc: Shachar Raindel +Cc: Jack Morgenstein +Cc: Or Gerlitz +Signed-off-by: Yann Droneaud +Reviewed-by: Sagi Grimberg +Reviewed-by: Haggai Eran +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/umem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -106,8 +106,8 @@ struct ib_umem *ib_umem_get(struct ib_uc + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. + */ +- if ((PAGE_ALIGN(addr + size) <= size) || +- (PAGE_ALIGN(addr + size) <= addr)) ++ if (((addr + size) < addr) || ++ PAGE_ALIGN(addr + size) < (addr + size)) + return ERR_PTR(-EINVAL); + + if (!can_do_mlock()) diff --git a/queue-4.0/ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch b/queue-4.0/ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch new file mode 100644 index 00000000000..d7932bdbf50 --- /dev/null +++ b/queue-4.0/ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch @@ -0,0 +1,34 @@ +From a065fe6aa25ba6ba93c02dc13486131bb3c64d5f Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Tue, 14 Apr 2015 18:08:13 +0300 +Subject: IB/iser: Fix wrong calculation of protection buffer length + +From: Sagi Grimberg + +commit a065fe6aa25ba6ba93c02dc13486131bb3c64d5f upstream. + +This length miss-calculation may cause a silent data corruption +in the DIX case and cause the device to reference unmapped area. + +Fixes: d77e65350f2d ('libiscsi, iser: Adjust data_length to include protection information') +Signed-off-by: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/iser/iser_initiator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/iser/iser_initiator.c ++++ b/drivers/infiniband/ulp/iser/iser_initiator.c +@@ -409,8 +409,8 @@ int iser_send_command(struct iscsi_conn + if (scsi_prot_sg_count(sc)) { + prot_buf->buf = scsi_prot_sglist(sc); + prot_buf->size = scsi_prot_sg_count(sc); +- prot_buf->data_len = data_buf->data_len >> +- ilog2(sc->device->sector_size) * 8; ++ prot_buf->data_len = (data_buf->data_len >> ++ ilog2(sc->device->sector_size)) * 8; + } + + if (hdr->flags & ISCSI_FLAG_CMD_READ) { diff --git a/queue-4.0/ib-mlx4-fix-wqe-lso-segment-calculation.patch b/queue-4.0/ib-mlx4-fix-wqe-lso-segment-calculation.patch new file mode 100644 index 00000000000..9b44061ca9c --- /dev/null +++ b/queue-4.0/ib-mlx4-fix-wqe-lso-segment-calculation.patch @@ -0,0 +1,48 @@ +From ca9b590caa17bcbbea119594992666e96cde9c2f Mon Sep 17 00:00:00 2001 +From: Erez Shitrit +Date: Thu, 2 Apr 2015 13:39:05 +0300 +Subject: IB/mlx4: Fix WQE LSO segment calculation + +From: Erez Shitrit + +commit ca9b590caa17bcbbea119594992666e96cde9c2f upstream. + +The current code decreases from the mss size (which is the gso_size +from the kernel skb) the size of the packet headers. + +It shouldn't do that because the mss that comes from the stack +(e.g IPoIB) includes only the tcp payload without the headers. + +The result is indication to the HW that each packet that the HW sends +is smaller than what it could be, and too many packets will be sent +for big messages. + +An easy way to demonstrate one more aspect of the problem is by +configuring the ipoib mtu to be less than 2*hlen (2*56) and then +run app sending big TCP messages. This will tell the HW to send packets +with giant (negative value which under unsigned arithmetics becomes +a huge positive one) length and the QP moves to SQE state. + +Fixes: b832be1e4007 ('IB/mlx4: Add IPoIB LSO support') +Reported-by: Matthew Finlay +Signed-off-by: Erez Shitrit +Signed-off-by: Or Gerlitz +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/qp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2605,8 +2605,7 @@ static int build_lso_seg(struct mlx4_wqe + + memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); + +- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | +- wr->wr.ud.hlen); ++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); + *lso_seg_len = halign; + return 0; + } diff --git a/queue-4.0/mvsas-fix-panic-on-expander-attached-sata-devices.patch b/queue-4.0/mvsas-fix-panic-on-expander-attached-sata-devices.patch new file mode 100644 index 00000000000..ed15c95e9e3 --- /dev/null +++ b/queue-4.0/mvsas-fix-panic-on-expander-attached-sata-devices.patch @@ -0,0 +1,54 @@ +From 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Wed, 15 Apr 2015 22:16:01 -0700 +Subject: mvsas: fix panic on expander attached SATA devices + +From: James Bottomley + +commit 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 upstream. + +mvsas is giving a General protection fault when it encounters an expander +attached ATA device. Analysis of mvs_task_prep_ata() shows that the driver is +assuming all ATA devices are locally attached and obtaining the phy mask by +indexing the local phy table (in the HBA structure) with the phy id. Since +expanders have many more phys than the HBA, this is causing the index into the +HBA phy table to overflow and returning rubbish as the pointer. + +mvs_task_prep_ssp() instead does the phy mask using the port properties. +Mirror this in mvs_task_prep_ata() to fix the panic. + +Reported-by: Adam Talbot +Tested-by: Adam Talbot +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mvsas/mv_sas.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_ta + static int mvs_task_prep_ata(struct mvs_info *mvi, + struct mvs_task_exec_info *tei) + { +- struct sas_ha_struct *sha = mvi->sas; + struct sas_task *task = tei->task; + struct domain_device *dev = task->dev; + struct mvs_device *mvi_dev = dev->lldd_dev; + struct mvs_cmd_hdr *hdr = tei->hdr; + struct asd_sas_port *sas_port = dev->port; +- struct sas_phy *sphy = dev->phy; +- struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number]; + struct mvs_slot_info *slot; + void *buf_prd; + u32 tag = tei->tag, hdr_tag; +@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_ + slot->tx = mvi->tx_prod; + del_q = TXQ_MODE_I | tag | + (TXQ_CMD_STP << TXQ_CMD_SHIFT) | +- (MVS_PHY_ID << TXQ_PHY_SHIFT) | ++ ((sas_port->phy_mask & TXQ_PHY_MASK) << TXQ_PHY_SHIFT) | + (mvi_dev->taskfileset << TXQ_SRS_SHIFT); + mvi->tx[mvi->tx_prod] = cpu_to_le32(del_q); + diff --git a/queue-4.0/rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch b/queue-4.0/rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch new file mode 100644 index 00000000000..6681677cf8b --- /dev/null +++ b/queue-4.0/rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch @@ -0,0 +1,48 @@ +From 80ccf4ad06dc9d2f06a8347b2d309cdc959f72b3 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Tue, 10 Feb 2015 07:41:56 -0300 +Subject: [media] rc: img-ir: fix error in parameters passed to irq_free() + +From: Sifan Naeem + +commit 80ccf4ad06dc9d2f06a8347b2d309cdc959f72b3 upstream. + +img_ir_remove() passes a pointer to the ISR function as the 2nd +parameter to irq_free() instead of a pointer to the device data +structure. +This issue causes unloading img-ir module to fail with the below +warning after building and loading img-ir as a module. + +WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278 +__free_irq+0xb4/0x214() Trying to free already-free IRQ 58 +Modules linked in: img_ir(-) +CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ... +Call Trace: +... +[<8048d420>] __free_irq+0xb4/0x214 +[<8048d6b4>] free_irq+0xac/0xf4 +[] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>] +platform_drv_remove+0x30/0x54 ... + +Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver") + +Signed-off-by: Sifan Naeem +Acked-by: James Hogan +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/img-ir/img-ir-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/img-ir/img-ir-core.c ++++ b/drivers/media/rc/img-ir/img-ir-core.c +@@ -146,7 +146,7 @@ static int img_ir_remove(struct platform + { + struct img_ir_priv *priv = platform_get_drvdata(pdev); + +- free_irq(priv->irq, img_ir_isr); ++ free_irq(priv->irq, priv); + img_ir_remove_hw(priv); + img_ir_remove_raw(priv); + diff --git a/queue-4.0/series b/queue-4.0/series index 15cce50660f..9bb989b8c3a 100644 --- a/queue-4.0/series +++ b/queue-4.0/series @@ -172,3 +172,17 @@ serial-imx-fix-clearing-of-receiver-overrun-flag.patch serial-8250-check-uart_scr-is-writable.patch sd-unregister-integrity-profile.patch sd-fix-missing-ato-tag-check.patch +drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch +mvsas-fix-panic-on-expander-attached-sata-devices.patch +rc-img-ir-fix-error-in-parameters-passed-to-irq_free.patch +stk1160-make-sure-current-buffer-is-released.patch +ib-core-disallow-registering-0-sized-memory-region.patch +ib-core-don-t-disallow-registering-region-starting-at-0x0.patch +ib-mlx4-fix-wqe-lso-segment-calculation.patch +ib-iser-fix-wrong-calculation-of-protection-buffer-length.patch +tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch +tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch +i2c-mux-use-proper-dev-when-removing-channel-x-symlinks.patch +i2c-rk3x-report-number-of-messages-transmitted.patch +i2c-mark-adapter-devices-with-pm_runtime_no_callbacks.patch +i2c-core-export-bus-recovery-functions.patch diff --git a/queue-4.0/stk1160-make-sure-current-buffer-is-released.patch b/queue-4.0/stk1160-make-sure-current-buffer-is-released.patch new file mode 100644 index 00000000000..9dba2271cb0 --- /dev/null +++ b/queue-4.0/stk1160-make-sure-current-buffer-is-released.patch @@ -0,0 +1,55 @@ +From aeff09276748b66072f2db2e668cec955cf41959 Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Tue, 10 Mar 2015 11:37:14 -0300 +Subject: [media] stk1160: Make sure current buffer is released + +From: Ezequiel Garcia + +commit aeff09276748b66072f2db2e668cec955cf41959 upstream. + +The available (i.e. not used) buffers are returned by stk1160_clear_queue(), +on the stop_streaming() path. However, this is insufficient and the current +buffer must be released as well. Fix it. + +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/stk1160/stk1160-v4l.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -240,6 +240,11 @@ static int stk1160_stop_streaming(struct + if (mutex_lock_interruptible(&dev->v4l_lock)) + return -ERESTARTSYS; + ++ /* ++ * Once URBs are cancelled, the URB complete handler ++ * won't be running. This is required to safely release the ++ * current buffer (dev->isoc_ctl.buf). ++ */ + stk1160_cancel_isoc(dev); + + /* +@@ -620,8 +625,16 @@ void stk1160_clear_queue(struct stk1160 + stk1160_info("buffer [%p/%d] aborted\n", + buf, buf->vb.v4l2_buf.index); + } +- /* It's important to clear current buffer */ +- dev->isoc_ctl.buf = NULL; ++ ++ /* It's important to release the current buffer */ ++ if (dev->isoc_ctl.buf) { ++ buf = dev->isoc_ctl.buf; ++ dev->isoc_ctl.buf = NULL; ++ ++ vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR); ++ stk1160_info("buffer [%p/%d] aborted\n", ++ buf, buf->vb.v4l2_buf.index); ++ } + spin_unlock_irqrestore(&dev->buf_lock, flags); + } + diff --git a/queue-4.0/tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch b/queue-4.0/tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch new file mode 100644 index 00000000000..188d8e8b71d --- /dev/null +++ b/queue-4.0/tracing-fix-incorrect-enabling-of-trace-events-by-boot-cmdline.patch @@ -0,0 +1,60 @@ +From 84fce9db4d7eaebd6cb2ee30c15da6d4e4daf846 Mon Sep 17 00:00:00 2001 +From: Joonsoo Kim +Date: Thu, 16 Apr 2015 13:44:44 +0900 +Subject: tracing: Fix incorrect enabling of trace events by boot cmdline + +From: Joonsoo Kim + +commit 84fce9db4d7eaebd6cb2ee30c15da6d4e4daf846 upstream. + +There is a problem that trace events are not properly enabled with +boot cmdline. The problem is that if we pass "trace_event=kmem:mm_page_alloc" +to the boot cmdline, it enables all kmem trace events, and not just +the page_alloc event. + +This is caused by the parsing mechanism. When we parse the cmdline, the buffer +contents is modified due to tokenization. And, if we use this buffer +again, we will get the wrong result. + +Unfortunately, this buffer is be accessed three times to set trace events +properly at boot time. So, we need to handle this situation. + +There is already code handling ",", but we need another for ":". +This patch adds it. + +Link: http://lkml.kernel.org/r/1429159484-22977-1-git-send-email-iamjoonsoo.kim@lge.com + +Signed-off-by: Joonsoo Kim +[ added missing return ret; ] +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -565,6 +565,7 @@ static int __ftrace_set_clr_event(struct + static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set) + { + char *event = NULL, *sub = NULL, *match; ++ int ret; + + /* + * The buf format can be : +@@ -590,7 +591,13 @@ static int ftrace_set_clr_event(struct t + event = NULL; + } + +- return __ftrace_set_clr_event(tr, match, sub, event, set); ++ ret = __ftrace_set_clr_event(tr, match, sub, event, set); ++ ++ /* Put back the colon to allow this to be called again */ ++ if (buf) ++ *(buf - 1) = ':'; ++ ++ return ret; + } + + /** diff --git a/queue-4.0/tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch b/queue-4.0/tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch new file mode 100644 index 00000000000..0328f03e6b8 --- /dev/null +++ b/queue-4.0/tracing-handle-ftrace_dump-atomic-context-in-graph_trace_open.patch @@ -0,0 +1,85 @@ +From ef99b88b16bee753fa51207abdc58ae660453ec6 Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Mon, 13 Apr 2015 22:30:12 +0200 +Subject: tracing: Handle ftrace_dump() atomic context in graph_trace_open() + +From: Rabin Vincent + +commit ef99b88b16bee753fa51207abdc58ae660453ec6 upstream. + +graph_trace_open() can be called in atomic context from ftrace_dump(). +Use GFP_ATOMIC for the memory allocations when that's the case, in order +to avoid the following splat. + + BUG: sleeping function called from invalid context at mm/slab.c:2849 + in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/0 + Backtrace: + .. + [<8004dc94>] (__might_sleep) from [<801371f4>] (kmem_cache_alloc_trace+0x160/0x238) + r7:87800040 r6:000080d0 r5:810d16e8 r4:000080d0 + [<80137094>] (kmem_cache_alloc_trace) from [<800cbd60>] (graph_trace_open+0x30/0xd0) + r10:00000100 r9:809171a8 r8:00008e28 r7:810d16f0 r6:00000001 r5:810d16e8 + r4:810d16f0 + [<800cbd30>] (graph_trace_open) from [<800c79c4>] (trace_init_global_iter+0x50/0x9c) + r8:00008e28 r7:808c853c r6:00000001 r5:810d16e8 r4:810d16f0 r3:800cbd30 + [<800c7974>] (trace_init_global_iter) from [<800c7aa0>] (ftrace_dump+0x90/0x2ec) + r4:810d2580 r3:00000000 + [<800c7a10>] (ftrace_dump) from [<80414b2c>] (sysrq_ftrace_dump+0x1c/0x20) + r10:00000100 r9:809171a8 r8:808f6e7c r7:00000001 r6:00000007 r5:0000007a + r4:808d5394 + [<80414b10>] (sysrq_ftrace_dump) from [<800169b8>] (return_to_handler+0x0/0x18) + [<80415498>] (__handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18) + r8:808c8100 r7:808c8444 r6:00000101 r5:00000010 r4:84eb3210 + [<80415668>] (handle_sysrq) from [<800169b8>] (return_to_handler+0x0/0x18) + [<8042a760>] (pl011_int) from [<800169b8>] (return_to_handler+0x0/0x18) + r10:809171bc r9:809171a8 r8:00000001 r7:00000026 r6:808c6000 r5:84f01e60 + r4:8454fe00 + [<8007782c>] (handle_irq_event_percpu) from [<80077b44>] (handle_irq_event+0x4c/0x6c) + r10:808c7ef0 r9:87283e00 r8:00000001 r7:00000000 r6:8454fe00 r5:84f01e60 + r4:84f01e00 + [<80077af8>] (handle_irq_event) from [<8007aa28>] (handle_fasteoi_irq+0xf0/0x1ac) + r6:808f52a4 r5:84f01e60 r4:84f01e00 r3:00000000 + [<8007a938>] (handle_fasteoi_irq) from [<80076dc0>] (generic_handle_irq+0x3c/0x4c) + r6:00000026 r5:00000000 r4:00000026 r3:8007a938 + [<80076d84>] (generic_handle_irq) from [<80077128>] (__handle_domain_irq+0x8c/0xfc) + r4:808c1e38 r3:0000002e + [<8007709c>] (__handle_domain_irq) from [<800087b8>] (gic_handle_irq+0x34/0x6c) + r10:80917748 r9:00000001 r8:88802100 r7:808c7ef0 r6:808c8fb0 r5:00000015 + r4:8880210c r3:808c7ef0 + [<80008784>] (gic_handle_irq) from [<80014044>] (__irq_svc+0x44/0x7c) + +Link: http://lkml.kernel.org/r/1428953721-31349-1-git-send-email-rabin@rab.in +Link: http://lkml.kernel.org/r/1428957012-2319-1-git-send-email-rabin@rab.in + +Signed-off-by: Rabin Vincent +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_functions_graph.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/trace/trace_functions_graph.c ++++ b/kernel/trace/trace_functions_graph.c +@@ -1309,15 +1309,19 @@ void graph_trace_open(struct trace_itera + { + /* pid and depth on the last trace processed */ + struct fgraph_data *data; ++ gfp_t gfpflags; + int cpu; + + iter->private = NULL; + +- data = kzalloc(sizeof(*data), GFP_KERNEL); ++ /* We can be called in atomic context via ftrace_dump() */ ++ gfpflags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL; ++ ++ data = kzalloc(sizeof(*data), gfpflags); + if (!data) + goto out_err; + +- data->cpu_data = alloc_percpu(struct fgraph_cpu_data); ++ data->cpu_data = alloc_percpu_gfp(struct fgraph_cpu_data, gfpflags); + if (!data->cpu_data) + goto out_err_free; +