From: Greg Kroah-Hartman Date: Tue, 25 Sep 2012 22:18:30 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.44~66 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d2cb54c66334ddf9cc1bcc225f96c7fb818b387;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch bluetooth-fix-not-removing-power_off-delayed-work.patch bluetooth-mgmt-fix-enabling-le-while-powered-off.patch bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch hpwdt-fix-kdump-issue-in-hpwdt.patch input-i8042-disable-mux-on-toshiba-c850d.patch mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch scsi-hpsa-fix-handling-of-protocol-error.patch scsi-lpfc-fix-problems-with-werror.patch scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch tracing-don-t-call-page_to_pfn-if-page-is-null.patch --- diff --git a/queue-3.4/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch b/queue-3.4/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch new file mode 100644 index 00000000000..f3eb8f813ec --- /dev/null +++ b/queue-3.4/arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch @@ -0,0 +1,35 @@ +From e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 Mon Sep 17 00:00:00 2001 +From: Matthew Leach +Date: Tue, 11 Sep 2012 17:56:57 +0100 +Subject: ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores + +From: Matthew Leach + +commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream. + +This patch zeroes the SCTLR.TRE bit prior to setting the mapping as +cacheable for ARMv7 cores in the decompressor, ensuring that the +memory region attributes are obtained from the C and B bits, not from +the page tables. + +Cc: Nicolas Pitre +Reviewed-by: Will Deacon +Signed-off-by: Matthew Leach +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/compressed/head.S | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -648,6 +648,7 @@ __armv7_mmu_cache_on: + mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs + #endif + mrc p15, 0, r0, c1, c0, 0 @ read control reg ++ bic r0, r0, #1 << 28 @ clear SCTLR.TRE + orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement + orr r0, r0, #0x003c @ write buffer + #ifdef CONFIG_MMU diff --git a/queue-3.4/bluetooth-fix-not-removing-power_off-delayed-work.patch b/queue-3.4/bluetooth-fix-not-removing-power_off-delayed-work.patch new file mode 100644 index 00000000000..57cf6dbb7e0 --- /dev/null +++ b/queue-3.4/bluetooth-fix-not-removing-power_off-delayed-work.patch @@ -0,0 +1,76 @@ +From 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a Mon Sep 17 00:00:00 2001 +From: Vinicius Costa Gomes +Date: Fri, 14 Sep 2012 16:34:46 -0300 +Subject: Bluetooth: Fix not removing power_off delayed work + +From: Vinicius Costa Gomes + +commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream. + +For example, when a usb reset is received (I could reproduce it +running something very similar to this[1] in a loop) it could be +that the device is unregistered while the power_off delayed work +is still scheduled to run. + +Backtrace: + +WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d() +Hardware name: To Be Filled By O.E.M. +ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26 +Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper +Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2 +Call Trace: + [] ? free_obj_work+0x57/0x91 + [] warn_slowpath_common+0x7e/0x97 + [] warn_slowpath_fmt+0x41/0x43 + [] debug_print_object+0x7c/0x8d + [] ? __queue_work+0x259/0x259 + [] ? debug_check_no_obj_freed+0x6f/0x1b5 + [] debug_check_no_obj_freed+0x98/0x1b5 + [] ? bt_host_release+0x10/0x1e [bluetooth] + [] kfree+0x90/0xe6 + [] bt_host_release+0x10/0x1e [bluetooth] + [] device_release+0x4a/0x7e + [] kobject_release+0x11d/0x154 + [] kobject_put+0x4a/0x4f + [] put_device+0x12/0x14 + [] hci_free_dev+0x22/0x26 [bluetooth] + [] btusb_disconnect+0x96/0x9f [btusb] + [] usb_unbind_interface+0x57/0x106 + [] __device_release_driver+0x83/0xd6 + [] device_release_driver+0x20/0x2d + [] usb_driver_release_interface+0x44/0x7b + [] usb_forced_unbind_intf+0x45/0x4e + [] usb_reset_device+0xa6/0x12e + [] usbdev_do_ioctl+0x319/0xe20 + [] ? avc_has_perm_flags+0xc9/0x12e + [] ? avc_has_perm_flags+0x25/0x12e + [] ? do_page_fault+0x31e/0x3a1 + [] usbdev_ioctl+0x9/0xd + [] vfs_ioctl+0x21/0x34 + [] do_vfs_ioctl+0x408/0x44b + [] ? file_has_perm+0x76/0x81 + [] sys_ioctl+0x51/0x76 + [] system_call_fastpath+0x16/0x1b + +[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c + +Signed-off-by: Vinicius Costa Gomes +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -750,6 +750,8 @@ static int hci_dev_do_close(struct hci_d + + cancel_work_sync(&hdev->le_scan); + ++ cancel_delayed_work(&hdev->power_off); ++ + hci_req_cancel(hdev, ENODEV); + hci_req_lock(hdev); + diff --git a/queue-3.4/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch b/queue-3.4/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch new file mode 100644 index 00000000000..dffffc23214 --- /dev/null +++ b/queue-3.4/bluetooth-mgmt-fix-enabling-le-while-powered-off.patch @@ -0,0 +1,46 @@ +From 562fcc246ebe31ade6e1be08585673b9b2785498 Mon Sep 17 00:00:00 2001 +From: Andrzej Kaczmarek +Date: Wed, 29 Aug 2012 10:02:09 +0200 +Subject: Bluetooth: mgmt: Fix enabling LE while powered off + +From: Andrzej Kaczmarek + +commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream. + +When new BT USB adapter is plugged in it's configured while still being powered +off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't +write changes to controller. As a result it's not possible to start device +discovery session on LE controller as it uses interleaved discovery which +requires LE Supported Host flag in extended features. + +This patch ensures HCI Write LE Host Supported is sent when Set Powered is +called to power on controller and clear HCI_AUTO_OFF flag. + +Signed-off-by: Andrzej Kaczmarek +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2807,6 +2807,16 @@ int mgmt_powered(struct hci_dev *hdev, u + hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp); + } + ++ if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { ++ struct hci_cp_write_le_host_supported cp; ++ ++ cp.le = 1; ++ cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR); ++ ++ hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, ++ sizeof(cp), &cp); ++ } ++ + update_class(hdev); + update_name(hdev, hdev->dev_name); + update_eir(hdev); diff --git a/queue-3.4/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch b/queue-3.4/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch new file mode 100644 index 00000000000..30daec5074a --- /dev/null +++ b/queue-3.4/bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch @@ -0,0 +1,43 @@ +From 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 Mon Sep 17 00:00:00 2001 +From: Andrzej Kaczmarek +Date: Wed, 29 Aug 2012 10:02:08 +0200 +Subject: Bluetooth: mgmt: Fix enabling SSP while powered off + +From: Andrzej Kaczmarek + +commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream. + +When new BT USB adapter is plugged in it's configured while still being powered +off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't +write changes to controller. As a result remote devices won't use Secure Simple +Pairing with our device due to SSP Host Support flag disabled in extended +features and may also reject SSP attempt from our side (with possible fallback +to legacy pairing). + +This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is +called to power on controller and clear HCI_AUTO_OFF flag. + +Signed-off-by: Andrzej Kaczmarek +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2801,6 +2801,12 @@ int mgmt_powered(struct hci_dev *hdev, u + if (scan) + hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); + ++ if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { ++ u8 ssp = 1; ++ ++ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp); ++ } ++ + update_class(hdev); + update_name(hdev, hdev->dev_name); + update_eir(hdev); diff --git a/queue-3.4/hpwdt-fix-kdump-issue-in-hpwdt.patch b/queue-3.4/hpwdt-fix-kdump-issue-in-hpwdt.patch new file mode 100644 index 00000000000..e1006e67dd7 --- /dev/null +++ b/queue-3.4/hpwdt-fix-kdump-issue-in-hpwdt.patch @@ -0,0 +1,37 @@ +From 308b135e4fcc00c80c07e0e04e7afa8edf78583c Mon Sep 17 00:00:00 2001 +From: Toshi Kani +Date: Mon, 27 Aug 2012 12:52:24 -0600 +Subject: hpwdt: Fix kdump issue in hpwdt + +From: Toshi Kani + +commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream. + +kdump can be interrupted by watchdog timer when the timer is left +activated on the crash kernel. Changed the hpwdt driver to disable +watchdog timer at boot-time. This assures that watchdog timer is +disabled until /dev/watchdog is opened, and prevents watchdog timer +to be left running on the crash kernel. + +Signed-off-by: Toshi Kani +Tested-by: Lisa Mitchell +Signed-off-by: Thomas Mingarelli +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/hpwdt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -806,6 +806,9 @@ static int __devinit hpwdt_init_one(stru + hpwdt_timer_reg = pci_mem_addr + 0x70; + hpwdt_timer_con = pci_mem_addr + 0x72; + ++ /* Make sure that timer is disabled until /dev/watchdog is opened */ ++ hpwdt_stop(); ++ + /* Make sure that we have a valid soft_margin */ + if (hpwdt_change_timer(soft_margin)) + hpwdt_change_timer(DEFAULT_MARGIN); diff --git a/queue-3.4/input-i8042-disable-mux-on-toshiba-c850d.patch b/queue-3.4/input-i8042-disable-mux-on-toshiba-c850d.patch new file mode 100644 index 00000000000..fcb0e2e589b --- /dev/null +++ b/queue-3.4/input-i8042-disable-mux-on-toshiba-c850d.patch @@ -0,0 +1,35 @@ +From 8669cf6793bb38307a30fb6b9565ddc8840ebd3f Mon Sep 17 00:00:00 2001 +From: Anisse Astier +Date: Wed, 19 Sep 2012 11:10:48 -0700 +Subject: Input: i8042 - disable mux on Toshiba C850D + +From: Anisse Astier + +commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream. + +On Toshiba Satellite C850D, the touchpad and the keyboard might randomly +not work at boot. Preventing MUX mode activation solves this issue. + +Signed-off-by: Anisse Astier +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -335,6 +335,12 @@ static const struct dmi_system_id __init + }, + { + .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), ++ }, ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"), + DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"), + }, diff --git a/queue-3.4/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch b/queue-3.4/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch new file mode 100644 index 00000000000..da79ee22b3f --- /dev/null +++ b/queue-3.4/mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch @@ -0,0 +1,41 @@ +From af89fa3986b9d034a286544ab1ed95096496a2f9 Mon Sep 17 00:00:00 2001 +From: Jovi Zhang +Date: Wed, 22 Aug 2012 10:34:08 +0800 +Subject: MIPS: mm: Add compound tail page _mapcount when mapped + +From: Jovi Zhang + +commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream. + +See commit b6999b191 which did the same modification for x86's mm/gup, + +Quote from commit b6999b191: + "If compound pages are used and the page is a + tail page, gup_huge_pmd() increases _mapcount to record tail page are + mapped while gup_huge_pud does not do that." + +[ralf@linux-mips.org: fixed rejects caused by the original patch getting +linewrapped.] + +Signed-off-by: Jovi Zhang +Cc: Youquan Song +Cc: Andi Kleen +Patchwork: https://patchwork.linux-mips.org/patch/4291/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/mm/gup.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/mm/gup.c ++++ b/arch/mips/mm/gup.c +@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig + do { + VM_BUG_ON(compound_head(page) != head); + pages[*nr] = page; ++ if (PageTail(page)) ++ get_huge_page_tail(page); + (*nr)++; + page++; + refs++; diff --git a/queue-3.4/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch b/queue-3.4/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch new file mode 100644 index 00000000000..a945b640d76 --- /dev/null +++ b/queue-3.4/rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch @@ -0,0 +1,77 @@ +From 022e1d0680c7b4366017393417b8758be5abcee8 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 11 Sep 2012 11:11:13 -0500 +Subject: rtlwifi: rtl8192ce: Log message that B_CUT device may not work + +From: Larry Finger + +commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream. + +There are a number of problems that occur for the latest version +of the Realtek RTL8188CE device with the in-kernel driver. These +include selection of the wrong firmware, and system lockup. A full +fix is known, but is too invasive for inclusion in stable. This patch +fixes the problem with loading the wrong firmware, and logs a message +that the device may not work for kernels 3.6 and older. + +Signed-off-by: Larry Finger +Cc: Anisse Astier +Cc: Li Chaoming +Tested-by: Anisse Astier +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 + + drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 ++++++++++-- + drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 ++++-- + 3 files changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h +@@ -117,6 +117,7 @@ + + #define CHIP_VER_B BIT(4) + #define CHIP_92C_BITMASK BIT(0) ++#define CHIP_UNKNOWN BIT(7) + #define CHIP_92C_1T2R 0x03 + #define CHIP_92C 0x01 + #define CHIP_88C 0x00 +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c +@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_ + version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C : + VERSION_A_CHIP_88C; + } else { +- version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C : +- VERSION_B_CHIP_88C; ++ version = (enum version_8192c) (CHIP_VER_B | ++ ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) | ++ ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0)); ++ if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 & ++ CHIP_VER_RTL_MASK)) { ++ version = (enum version_8192c)(version | ++ ((((value32 & CHIP_VER_RTL_MASK) == BIT(12)) ++ ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) | ++ CHIP_VENDOR_UMC)); ++ } + } + + switch (version) { +--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c +@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211 + + /* request fw */ + if (IS_VENDOR_UMC_A_CUT(rtlhal->version) && +- !IS_92C_SERIAL(rtlhal->version)) ++ !IS_92C_SERIAL(rtlhal->version)) { + rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin"; +- else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) ++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) { + rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin"; ++ pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n"); ++ } + + rtlpriv->max_fw_size = 0x4000; + pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name); diff --git a/queue-3.4/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch b/queue-3.4/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch new file mode 100644 index 00000000000..b5e3d07c1ab --- /dev/null +++ b/queue-3.4/scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch @@ -0,0 +1,75 @@ +From d6532207116307eb7ecbfa7b9e02c53230096a50 Mon Sep 17 00:00:00 2001 +From: Eddie Wai +Date: Tue, 21 Aug 2012 10:35:53 -0700 +Subject: SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload + +From: Eddie Wai + +commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream. + +This patch fixes the following kernel panic invoked by uninitialized fields +in the chip initialization for the 1G bnx2 iSCSI offload. + +One of the bits in the chip initialization is being used by the latest +firmware to control overflow packets. When this control bit gets enabled +erroneously, it would ultimately result in a bad packet placement which would +cause the bnx2 driver to dereference a NULL ptr in the placement handler. + +This can happen under certain stress I/O environment under the Linux +iSCSI offload operation. + +This change only affects Broadcom's 5709 chipset. + +Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP: + [] :bnx2:bnx2_poll_work+0xd0d/0x13c5 +Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2 +RIP: 0010:[] [] :bnx2:bnx2_poll_work+0xd0d/0x13c5 +RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216 +RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000 +RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220 +RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000 +R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010 +R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558 +FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000 +CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b +CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0 +Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820) +Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520 + ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20 + 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8 +Call Trace: + [] show_schedstat+0x1c2/0x25b + [] :bnx2:bnx2_poll+0xf6/0x231 + [] net_rx_action+0xac/0x1b1 + [] __do_softirq+0x89/0x133 + [] call_softirq+0x1c/0x28 + [] do_softirq+0x2c/0x7d + [] do_IRQ+0xee/0xf7 + [] ret_from_intr+0x0/0xa + [] acpi_processor_idle_simple+0x1c5/0x341 + [] acpi_processor_idle_simple+0x182/0x341 + [] acpi_processor_idle_simple+0x0/0x341 + [] cpu_idle+0x95/0xb8 + [] start_secondary+0x479/0x488 + +Signed-off-by: Eddie Wai +Reviewed-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/bnx2i/bnx2i_hwi.c ++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c +@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct + int rc = 0; + u64 mask64; + ++ memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1)); ++ memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2)); ++ + bnx2i_adjust_qp_size(hba); + + iscsi_init.flags = diff --git a/queue-3.4/scsi-hpsa-fix-handling-of-protocol-error.patch b/queue-3.4/scsi-hpsa-fix-handling-of-protocol-error.patch new file mode 100644 index 00000000000..0b500c46c20 --- /dev/null +++ b/queue-3.4/scsi-hpsa-fix-handling-of-protocol-error.patch @@ -0,0 +1,45 @@ +From 256d0eaac87da1e993190846064f339f4c7a63f5 Mon Sep 17 00:00:00 2001 +From: "Stephen M. Cameron" +Date: Fri, 14 Sep 2012 16:34:25 -0500 +Subject: SCSI: hpsa: fix handling of protocol error + +From: "Stephen M. Cameron" + +commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream. + +If a command status of CMD_PROTOCOL_ERR is received, this +information should be conveyed to the SCSI mid layer, not +dropped on the floor. CMD_PROTOCOL_ERR may be received +from the Smart Array for any commands destined for an external +RAID controller such as a P2000, or commands destined for tape +drives or CD/DVD-ROM drives, if for instance a cable is +disconnected. This mostly affects multipath configurations, as +disconnecting a cable on a non-multipath configuration is not +going to do anything good regardless of whether CMD_PROTOCOL_ERR +is handled correctly or not. Not handling CMD_PROTOCOL_ERR +correctly in a multipath configaration involving external RAID +controllers may cause data corruption, so this is quite a serious +bug. This bug should not normally cause a problem for direct +attached disk storage. + +Signed-off-by: Stephen M. Cameron +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/hpsa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -1264,8 +1264,9 @@ static void complete_scsi_command(struct + } + break; + case CMD_PROTOCOL_ERR: ++ cmd->result = DID_ERROR << 16; + dev_warn(&h->pdev->dev, "cp %p has " +- "protocol error \n", cp); ++ "protocol error\n", cp); + break; + case CMD_HARDWARE_ERR: + cmd->result = DID_ERROR << 16; diff --git a/queue-3.4/scsi-lpfc-fix-problems-with-werror.patch b/queue-3.4/scsi-lpfc-fix-problems-with-werror.patch new file mode 100644 index 00000000000..bb3ef8f0fcb --- /dev/null +++ b/queue-3.4/scsi-lpfc-fix-problems-with-werror.patch @@ -0,0 +1,40 @@ +From 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Thu, 21 Jun 2012 07:50:02 +0000 +Subject: SCSI: lpfc: fix problems with -Werror + +From: James Bottomley + +commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream. + +Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage +with random gcc incarnations. These look like gcc problems, but we shouldn't +break the build because of a bad gcc. Fix this by adding a make flag + +WARNINGS_BECOME_ERRORS=1 + +which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror + +Reported-by: Fengguang Wu +Cc: Alex Iannicelli +Cc: James Smart +Cc: Jonathan Nieder +Cc: Mike Pagano +Signed-off-by: James Bottomley + +--- + drivers/scsi/lpfc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/lpfc/Makefile ++++ b/drivers/scsi/lpfc/Makefile +@@ -22,7 +22,9 @@ + ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage + ccflags-$(GCOV) += -O0 + ++ifdef WARNINGS_BECOME_ERRORS + ccflags-y += -Werror ++endif + + obj-$(CONFIG_SCSI_LPFC) := lpfc.o + diff --git a/queue-3.4/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch b/queue-3.4/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch new file mode 100644 index 00000000000..cb6ab9b7d48 --- /dev/null +++ b/queue-3.4/scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch @@ -0,0 +1,38 @@ +From 10cce6d8b5af0b32bc4254ae4a28423a74c0921c Mon Sep 17 00:00:00 2001 +From: "sreekanth.reddy@lsi.com" +Date: Wed, 22 Aug 2012 16:55:13 +0530 +Subject: SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA + +From: "sreekanth.reddy@lsi.com" + +commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream. + +This patch checks whether HBA is SAS2008 B0 controller. +if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX, +as SAS2008 B0 controller doesn't support MSIX interrupts. + +[jejb: fix whitespace problems] +Signed-off-by: Sreekanth Reddy +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -1202,6 +1202,13 @@ _base_check_enable_msix(struct MPT2SAS_A + u16 message_control; + + ++ /* Check whether controller SAS2008 B0 controller, ++ if it is SAS2008 B0 controller use IO-APIC instead of MSIX */ ++ if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 && ++ ioc->pdev->revision == 0x01) { ++ return -EINVAL; ++ } ++ + base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX); + if (!base) { + dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not " diff --git a/queue-3.4/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch b/queue-3.4/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch new file mode 100644 index 00000000000..ab5f9f7bf0b --- /dev/null +++ b/queue-3.4/scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch @@ -0,0 +1,56 @@ +From 27e99ade81368e6fdda3212bff9345177cf9e57a Mon Sep 17 00:00:00 2001 +From: Wang Sen +Date: Mon, 30 Jul 2012 14:25:06 +0800 +Subject: SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list + +From: Wang Sen + +commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream. + +When using the commands below to write some data to a virtio-scsi LUN of the +QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash. + + # sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.) + # sudo mount /dev/sdb /mnt + # dd if=/dev/zero of=/mnt/file bs=1M count=1024 + +In current implementation, sg_set_buf is called to add buffers to sg list which +is put into the virtqueue eventually. But if there are some HighMem pages in +table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may +return NULL value. This will cause QEMU exit when virtqueue_map_sg is called +in QEMU because an invalid GPA is passed by virtqueue. + +Two solutions are discussed here: +http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html + +Finally, value assignment approach was adopted because: + +Value assignment creates a well-formed scatterlist, because the termination +marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the +source sg_list is just copied to the the last entry in destination list. Note +that, for now, virtio_ring does not care about the form of the scatterlist and +simply processes the first out_num + in_num consecutive elements of the sg[] +array. + +I have tested the patch on my workstation. QEMU would not crash any more. + +Signed-off-by: Wang Sen +Acked-by: Paolo Bonzini +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/virtio_scsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scat + int i; + + for_each_sg(table->sgl, sg_elem, table->nents, i) +- sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length); ++ sg[idx++] = *sg_elem; + + *p_idx = idx; + } diff --git a/queue-3.4/series b/queue-3.4/series index bd707b542a6..542105ce9c2 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -92,3 +92,17 @@ ibmveth-fix-alignment-of-rx-queue-bug.patch mac80211-clear-bssid-on-auth-assoc-failure.patch brcmfmac-fix-big-endian-bug-in-i-scan.patch brcmfmac-fix-big-endian-host-configuration-data.patch +scsi-lpfc-fix-problems-with-werror.patch +scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch +scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch +scsi-hpsa-fix-handling-of-protocol-error.patch +scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch +bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch +bluetooth-fix-not-removing-power_off-delayed-work.patch +bluetooth-mgmt-fix-enabling-le-while-powered-off.patch +hpwdt-fix-kdump-issue-in-hpwdt.patch +arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch +tracing-don-t-call-page_to_pfn-if-page-is-null.patch +input-i8042-disable-mux-on-toshiba-c850d.patch +mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch +rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch diff --git a/queue-3.4/tracing-don-t-call-page_to_pfn-if-page-is-null.patch b/queue-3.4/tracing-don-t-call-page_to_pfn-if-page-is-null.patch new file mode 100644 index 00000000000..ae7dd8b9c6a --- /dev/null +++ b/queue-3.4/tracing-don-t-call-page_to_pfn-if-page-is-null.patch @@ -0,0 +1,47 @@ +From 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa Mon Sep 17 00:00:00 2001 +From: Wen Congyang +Date: Thu, 20 Sep 2012 14:04:47 +0800 +Subject: tracing: Don't call page_to_pfn() if page is NULL + +From: Wen Congyang + +commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream. + +When allocating memory fails, page is NULL. page_to_pfn() will +cause the kernel panicked if we don't use sparsemem vmemmap. + +Link: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com + +Cc: Frederic Weisbecker +Cc: Ingo Molnar +Cc: Andrew Morton +Acked-by: Mel Gorman +Reviewed-by: Minchan Kim +Signed-off-by: Wen Congyang +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/events/kmem.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/trace/events/kmem.h ++++ b/include/trace/events/kmem.h +@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc, + + TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s", + __entry->page, +- page_to_pfn(__entry->page), ++ __entry->page ? page_to_pfn(__entry->page) : 0, + __entry->order, + __entry->migratetype, + show_gfp_flags(__entry->gfp_flags)) +@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page, + + TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d", + __entry->page, +- page_to_pfn(__entry->page), ++ __entry->page ? page_to_pfn(__entry->page) : 0, + __entry->order, + __entry->migratetype, + __entry->order == 0)