From: Greg Kroah-Hartman Date: Fri, 11 Sep 2015 06:22:32 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v3.10.88~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ea04701c62d6831a9ab5f029cc052ab54544d10c;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: arm-8384-1-vdso-force-use-of-bfd-linker.patch arm-8385-1-vdso-group-link-options.patch arm-dts-dra7-fix-broken-pbias-device-creation.patch arm-dts-omap243x-fix-broken-pbias-device-creation.patch arm-dts-omap4-fix-broken-pbias-device-creation.patch arm-dts-omap5-fix-broken-pbias-device-creation.patch arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch arm-invalidate-l1-before-enabling-coherency.patch arm-v7-setup-function-should-invalidate-l1-cache.patch crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch libfc-fix-fc_exch_recv_req-error-path.patch libfc-fix-fc_fcp_cleanup_each_cmd.patch libiscsi-fix-host-busy-blocking-during-connection-teardown.patch mfd-arizona-fix-initialisation-of-the-pm-runtime.patch mips-fix-seccomp-syscall-argument-for-mips64.patch regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch revert-libata-eh-set-information-field-for-autosense.patch revert-libata-implement-ncq-autosense.patch revert-libata-implement-support-for-sense-data-reporting.patch revert-x86-sigcontext-cleanups.patch sd-fix-maximum-i-o-size-for-block_pc-requests.patch --- diff --git a/queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch b/queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch new file mode 100644 index 00000000000..89ebf2b59ee --- /dev/null +++ b/queue-4.1/arm-8384-1-vdso-force-use-of-bfd-linker.patch @@ -0,0 +1,67 @@ +From d2b30cd4b7223a96e606dfc8120626f66d81e091 Mon Sep 17 00:00:00 2001 +From: Nathan Lynch +Date: Wed, 3 Jun 2015 00:41:15 +0100 +Subject: ARM: 8384/1: VDSO: force use of BFD linker + +From: Nathan Lynch + +commit d2b30cd4b7223a96e606dfc8120626f66d81e091 upstream. + +When using a toolchain with gold as the default linker, the VDSO build +fails: + + VDSO arch/arm/vdso/vdso.so.raw + HOSTCC arch/arm/vdso/vdsomunge + MUNGE arch/arm/vdso/vdso.so.dbg + OBJCOPY arch/arm/vdso/vdso.so +BFD: arch/arm/vdso/vdso.so: Not enough room for program headers, try +linking with -N + +For whatever reason, ld.gold is omitting an exidx program header that +ld.bfd emits, and even when I work around that, I don't get a working +VDSO. + +For now, instead of supporting gold (which will fail to link the +kernel anyway since it does not implement --pic-veneer), direct the +compiler to use the traditional bfd linker. This is accomplished by +using -fuse-ld, which is implemented in GCC 4.8 and later. + +Note: one limitation of this is that if the toolchain is configured +to use gold by default, and the bfd linker is not in $PATH, the VDSO +build will fail: + + VDSO arch/arm/vdso/vdso.so.raw +collect2: fatal error: cannot find 'ld' + +This will happen if CROSS_COMPILE begins with a path such as +/opt/bin/arm-linux-gnu- but /opt/bin is not in $PATH. This is +considered an acceptable corner-case limitation and is easily worked +around. + +Additonal note: we use cc-option instead of cc-ldoption so that +-fuse-ld=bfd is placed in the command line if the compiler recognizes +the option. Using cc-ldoption results in an attempt to link, which +fails in the situation just described, causing -fuse-ld=bfd to be +omitted and gold to be used for the VDSO link, which is what we're +trying to prevent. + +Reported-by: Stefan Agner +Signed-off-by: Nathan Lynch +Signed-off-by: Russell King +Cc: Alexander Kochetkov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/vdso/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/vdso/Makefile ++++ b/arch/arm/vdso/Makefile +@@ -14,6 +14,7 @@ VDSO_LDFLAGS += -Wl,-z,max-page-size=409 + VDSO_LDFLAGS += -nostdlib -shared + VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) + VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--build-id) ++VDSO_LDFLAGS += $(call cc-option, -fuse-ld=bfd) + + obj-$(CONFIG_VDSO) += vdso.o + extra-$(CONFIG_VDSO) += vdso.lds diff --git a/queue-4.1/arm-8385-1-vdso-group-link-options.patch b/queue-4.1/arm-8385-1-vdso-group-link-options.patch new file mode 100644 index 00000000000..942cde74a94 --- /dev/null +++ b/queue-4.1/arm-8385-1-vdso-group-link-options.patch @@ -0,0 +1,56 @@ +From d33ce23b2160d26b27a47092da5d556b5b11a12a Mon Sep 17 00:00:00 2001 +From: Nathan Lynch +Date: Wed, 3 Jun 2015 00:46:04 +0100 +Subject: ARM: 8385/1: VDSO: group link options + +From: Nathan Lynch + +commit d33ce23b2160d26b27a47092da5d556b5b11a12a upstream. + +Currently the VDSO's link options are kind of a mess spread between + +ccflags-y and cmd_vdsold. Collect linker directives into one +variable, VDSO_LDFLAGS, and use that in cmd_vdsold. + +Signed-off-by: Nathan Lynch +Signed-off-by: Russell King +Cc: Alexander Kochetkov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/vdso/Makefile | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/arch/arm/vdso/Makefile ++++ b/arch/arm/vdso/Makefile +@@ -6,9 +6,14 @@ obj-vdso := vgettimeofday.o datapage.o + targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.so.raw vdso.lds + obj-vdso := $(addprefix $(obj)/, $(obj-vdso)) + +-ccflags-y := -shared -fPIC -fno-common -fno-builtin -fno-stack-protector +-ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 -DDISABLE_BRANCH_PROFILING +-ccflags-y += -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) ++ccflags-y := -fPIC -fno-common -fno-builtin -fno-stack-protector ++ccflags-y += -DDISABLE_BRANCH_PROFILING ++ ++VDSO_LDFLAGS := -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1 ++VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096 ++VDSO_LDFLAGS += -nostdlib -shared ++VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) ++VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--build-id) + + obj-$(CONFIG_VDSO) += vdso.o + extra-$(CONFIG_VDSO) += vdso.lds +@@ -40,10 +45,8 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + + # Actual build commands + quiet_cmd_vdsold = VDSO $@ +- cmd_vdsold = $(CC) $(c_flags) -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) \ +- $(call cc-ldoption, -Wl$(comma)--build-id) \ +- -Wl,-Bsymbolic -Wl,-z,max-page-size=4096 \ +- -Wl,-z,common-page-size=4096 -o $@ ++ cmd_vdsold = $(CC) $(c_flags) $(VDSO_LDFLAGS) \ ++ -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) -o $@ + + quiet_cmd_vdsomunge = MUNGE $@ + cmd_vdsomunge = $(objtree)/$(obj)/vdsomunge $< $@ diff --git a/queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch new file mode 100644 index 00000000000..13e2fa9b88d --- /dev/null +++ b/queue-4.1/arm-dts-dra7-fix-broken-pbias-device-creation.patch @@ -0,0 +1,42 @@ +From cd4556733b30cc363adc7b1cea3bffa7e2dd0c7c Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 17:46:41 +0530 +Subject: ARM: dts: dra7: Fix broken pbias device creation + +From: Kishon Vijay Abraham I + +commit cd4556733b30cc363adc7b1cea3bffa7e2dd0c7c upstream. + +commit ("ARM: dts: dra7: add minimal l4 bus +layout with control module support") moved pbias_regulator dt node +from being a child node of ocp to be the child node of +scm_conf. After this device for pbias_regulator is +not created. + +Fix it by adding "simple-bus" compatible property to +scm_conf dt node. + +Fixes: d919501feffa ("ARM: dts: dra7: add minimal l4 bus +layout with control module support") + +Suggested-by: Tero Kristo +Signed-off-by: Kishon Vijay Abraham I +Tested-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/dra7.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -116,7 +116,7 @@ + ranges = <0 0x2000 0x2000>; + + scm_conf: scm_conf@0 { +- compatible = "syscon"; ++ compatible = "syscon", "simple-bus"; + reg = <0x0 0x1400>; + #address-cells = <1>; + #size-cells = <1>; diff --git a/queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch new file mode 100644 index 00000000000..c56ae8f1e91 --- /dev/null +++ b/queue-4.1/arm-dts-omap243x-fix-broken-pbias-device-creation.patch @@ -0,0 +1,41 @@ +From 4317c8c9121e4685561422ac267b292df8e80806 Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 17:46:38 +0530 +Subject: ARM: dts: omap243x: Fix broken pbias device creation + +From: Kishon Vijay Abraham I + +commit 4317c8c9121e4685561422ac267b292df8e80806 upstream. + +commit <72b10ac00eb1> ("ARM: dts: omap24xx: add minimal l4 bus +layout with control module support") moved pbias_regulator dt node +from being a child node of ocp to be the child node of +scm_conf. After this device for pbias_regulator is +not created. + +Fix it by adding "simple-bus" compatible property to +scm_conf dt node. + +Fixes: 72b10ac00eb1 ("ARM: dts: omap24xx: add minimal l4 bus +layout with control module support") + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/omap2430.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap2430.dtsi ++++ b/arch/arm/boot/dts/omap2430.dtsi +@@ -51,7 +51,8 @@ + }; + + scm_conf: scm_conf@270 { +- compatible = "syscon"; ++ compatible = "syscon", ++ "simple-bus"; + reg = <0x270 0x240>; + #address-cells = <1>; + #size-cells = <1>; diff --git a/queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch new file mode 100644 index 00000000000..23063df58a7 --- /dev/null +++ b/queue-4.1/arm-dts-omap4-fix-broken-pbias-device-creation.patch @@ -0,0 +1,41 @@ +From 89a898df87e114952191ab0e061aa18e3c617880 Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 17:46:39 +0530 +Subject: ARM: dts: OMAP4: Fix broken pbias device creation + +From: Kishon Vijay Abraham I + +commit 89a898df87e114952191ab0e061aa18e3c617880 upstream. + +commit <7415b0b4c645> ("ARM: dts: omap4: add minimal l4 bus layout +with control module support") moved pbias_regulator dt node +from being a child node of ocp to be the child node of +omap4_padconf_global. After this device for pbias_regulator +is not created. + +Fix it by adding "simple-bus" compatible property to +omap4_padconf_global dt node. + +Fixes: 7415b0b4c645 ("ARM: dts: omap4: add minimal l4 bus layout +with control module support") + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/omap4.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -191,7 +191,8 @@ + }; + + omap4_padconf_global: omap4_padconf_global@5a0 { +- compatible = "syscon"; ++ compatible = "syscon", ++ "simple-bus"; + reg = <0x5a0 0x170>; + #address-cells = <1>; + #size-cells = <1>; diff --git a/queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch b/queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch new file mode 100644 index 00000000000..f0bc61eec84 --- /dev/null +++ b/queue-4.1/arm-dts-omap5-fix-broken-pbias-device-creation.patch @@ -0,0 +1,41 @@ +From 70caac3f25291cf715cf8f2d8c7db46f6cbefe7c Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 17:46:40 +0530 +Subject: ARM: dts: OMAP5: Fix broken pbias device creation + +From: Kishon Vijay Abraham I + +commit 70caac3f25291cf715cf8f2d8c7db46f6cbefe7c upstream. + +commit ("ARM: dts: omap5: add minimal l4 bus +layout with control module support") moved pbias_regulator dt node +from being a child node of ocp to be the child node of +omap5_padconf_global. After this device for pbias_regulator is +not created. + +Fix it by adding "simple-bus" compatible property to +omap5_padconf_global dt node. + +Fixes: ed8509edddeb ("ARM: dts: omap5: add minimal l4 bus +layout with control module support") + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/omap5.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap5.dtsi ++++ b/arch/arm/boot/dts/omap5.dtsi +@@ -180,7 +180,8 @@ + }; + + omap5_padconf_global: omap5_padconf_global@5a0 { +- compatible = "syscon"; ++ compatible = "syscon", ++ "simple-bus"; + reg = <0x5a0 0xec>; + #address-cells = <1>; + #size-cells = <1>; diff --git a/queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch b/queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch new file mode 100644 index 00000000000..002487f611a --- /dev/null +++ b/queue-4.1/arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch @@ -0,0 +1,39 @@ +From 1a9fa190956f45c1e58c4d8bfa5ac051691ea590 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Wed, 5 Aug 2015 18:54:37 +0200 +Subject: ARM: imx6: correct i.MX6 PCIe interrupt routing + +From: Lucas Stach + +commit 1a9fa190956f45c1e58c4d8bfa5ac051691ea590 upstream. + +The PCIe interrupts are also routed through the GPC. This has been +missed from the conversion to stacked IRQ domains as the PCIe +controller uses an explicit interrupt map and thus doesn't inherit +the SoC global interrupt parent. + +Signed-off-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6qdl.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/imx6qdl.dtsi ++++ b/arch/arm/boot/dts/imx6qdl.dtsi +@@ -153,10 +153,10 @@ + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 2 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 3 &intc GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 4 &intc GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>; ++ interrupt-map = <0 0 0 1 &gpc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 2 &gpc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 3 &gpc GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 4 &gpc GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX6QDL_CLK_PCIE_AXI>, + <&clks IMX6QDL_CLK_LVDS1_GATE>, + <&clks IMX6QDL_CLK_PCIE_REF_125M>; diff --git a/queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch b/queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch new file mode 100644 index 00000000000..a0fa6c87990 --- /dev/null +++ b/queue-4.1/arm-invalidate-l1-before-enabling-coherency.patch @@ -0,0 +1,69 @@ +From bac51ad9d14f6baed3730ef53bedc1eb2238563a Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 9 Jul 2015 00:30:24 +0100 +Subject: ARM: invalidate L1 before enabling coherency + +From: Russell King + +commit bac51ad9d14f6baed3730ef53bedc1eb2238563a upstream. + +We must invalidate the L1 cache before enabling coherency, otherwise +secondary CPUs can inject invalid cache lines into the coherent CPU +cluster, which could then be migrated to other CPUs. This fixes a +recent regression with SoCFPGA randomly failing to boot. + +Fixes: 02b4e2756e01 ("ARM: v7 setup function should invalidate L1 cache") +Signed-off-by: Russell King +Cc: Alexander Kochetkov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/proc-v7.S | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -268,7 +268,10 @@ __v7_ca15mp_setup: + __v7_b15mp_setup: + __v7_ca17mp_setup: + mov r10, #0 +-1: ++1: adr r12, __v7_setup_stack @ the local stack ++ stmia r12, {r0-r5, lr} @ v7_invalidate_l1 touches r0-r6 ++ bl v7_invalidate_l1 ++ ldmia r12, {r0-r5, lr} + #ifdef CONFIG_SMP + ALT_SMP(mrc p15, 0, r0, c1, c0, 1) + ALT_UP(mov r0, #(1 << 6)) @ fake it for UP +@@ -277,7 +280,7 @@ __v7_ca17mp_setup: + orreq r0, r0, r10 @ Enable CPU-specific SMP bits + mcreq p15, 0, r0, c1, c0, 1 + #endif +- b __v7_setup ++ b __v7_setup_cont + + __v7_pj4b_setup: + #ifdef CONFIG_CPU_PJ4B +@@ -335,10 +338,11 @@ __v7_pj4b_setup: + + __v7_setup: + adr r12, __v7_setup_stack @ the local stack +- stmia r12, {r0-r5, r7, r9, r11, lr} ++ stmia r12, {r0-r5, lr} @ v7_invalidate_l1 touches r0-r6 + bl v7_invalidate_l1 +- ldmia r12, {r0-r5, r7, r9, r11, lr} ++ ldmia r12, {r0-r5, lr} + ++__v7_setup_cont: + mrc p15, 0, r0, c0, c0, 0 @ read main ID register + and r10, r0, #0xff000000 @ ARM? + teq r10, #0x41000000 +@@ -460,7 +464,7 @@ ENDPROC(__v7_setup) + + .align 2 + __v7_setup_stack: +- .space 4 * 11 @ 11 registers ++ .space 4 * 7 @ 12 registers + + __INITDATA + diff --git a/queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch b/queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch new file mode 100644 index 00000000000..5c6ba38ca73 --- /dev/null +++ b/queue-4.1/arm-v7-setup-function-should-invalidate-l1-cache.patch @@ -0,0 +1,518 @@ +From 02b4e2756e01c623cc4dbceae4b07be75252db5b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 19 May 2015 17:06:44 +0100 +Subject: ARM: v7 setup function should invalidate L1 cache + +From: Russell King + +commit 02b4e2756e01c623cc4dbceae4b07be75252db5b upstream. + +All ARMv5 and older CPUs invalidate their caches in the early assembly +setup function, prior to enabling the MMU. This is because the L1 +cache should not contain any data relevant to the execution of the +kernel at this point; all data should have been flushed out to memory. + +This requirement should also be true for ARMv6 and ARMv7 CPUs - indeed, +these typically do not search their caches when caching is disabled (as +it needs to be when the MMU is disabled) so this change should be safe. + +ARMv7 allows there to be CPUs which search their caches while caching is +disabled, and it's permitted that the cache is uninitialised at boot; +for these, the architecture reference manual requires that an +implementation specific code sequence is used immediately after reset +to ensure that the cache is placed into a sane state. Such +functionality is definitely outside the remit of the Linux kernel, and +must be done by the SoC's firmware before _any_ CPU gets to the Linux +kernel. + +Changing the data cache clean+invalidate to a mere invalidate allows us +to get rid of a lot of platform specific hacks around this issue for +their secondary CPU bringup paths - some of which were buggy. + +Reviewed-by: Florian Fainelli +Tested-by: Florian Fainelli +Tested-by: Heiko Stuebner +Tested-by: Dinh Nguyen +Acked-by: Sebastian Hesselbarth +Tested-by: Sebastian Hesselbarth +Acked-by: Shawn Guo +Tested-by: Thierry Reding +Acked-by: Thierry Reding +Tested-by: Geert Uytterhoeven +Tested-by: Michal Simek +Tested-by: Wei Xu +Signed-off-by: Russell King +Cc: Alexander Kochetkov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-bcm/Makefile | 2 +- + arch/arm/mach-bcm/brcmstb.h | 19 ------------------- + arch/arm/mach-bcm/headsmp-brcmstb.S | 33 --------------------------------- + arch/arm/mach-bcm/platsmp-brcmstb.c | 4 +--- + arch/arm/mach-berlin/headsmp.S | 6 ------ + arch/arm/mach-berlin/platsmp.c | 3 +-- + arch/arm/mach-hisi/Makefile | 2 +- + arch/arm/mach-hisi/core.h | 1 - + arch/arm/mach-hisi/headsmp.S | 16 ---------------- + arch/arm/mach-hisi/platsmp.c | 4 ++-- + arch/arm/mach-imx/headsmp.S | 1 - + arch/arm/mach-mvebu/headsmp-a9.S | 1 - + arch/arm/mach-prima2/headsmp.S | 1 - + arch/arm/mach-rockchip/core.h | 1 - + arch/arm/mach-rockchip/headsmp.S | 8 -------- + arch/arm/mach-rockchip/platsmp.c | 5 ++--- + arch/arm/mach-shmobile/common.h | 1 - + arch/arm/mach-shmobile/headsmp-scu.S | 4 ++-- + arch/arm/mach-shmobile/headsmp.S | 7 ------- + arch/arm/mach-shmobile/platsmp-apmu.c | 2 +- + arch/arm/mach-socfpga/core.h | 1 - + arch/arm/mach-socfpga/headsmp.S | 5 ----- + arch/arm/mach-socfpga/platsmp.c | 2 +- + arch/arm/mach-tegra/Makefile | 2 +- + arch/arm/mach-tegra/headsmp.S | 12 ------------ + arch/arm/mach-tegra/reset.c | 2 +- + arch/arm/mach-tegra/reset.h | 1 - + arch/arm/mach-zynq/common.h | 2 -- + arch/arm/mach-zynq/headsmp.S | 5 ----- + arch/arm/mach-zynq/platsmp.c | 5 ++--- + arch/arm/mm/proc-v7.S | 2 +- + 31 files changed, 17 insertions(+), 143 deletions(-) + +--- a/arch/arm/mach-bcm/Makefile ++++ b/arch/arm/mach-bcm/Makefile +@@ -43,5 +43,5 @@ obj-$(CONFIG_ARCH_BCM_63XX) := bcm63xx.o + ifeq ($(CONFIG_ARCH_BRCMSTB),y) + CFLAGS_platsmp-brcmstb.o += -march=armv7-a + obj-y += brcmstb.o +-obj-$(CONFIG_SMP) += headsmp-brcmstb.o platsmp-brcmstb.o ++obj-$(CONFIG_SMP) += platsmp-brcmstb.o + endif +--- a/arch/arm/mach-bcm/brcmstb.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-/* +- * Copyright (C) 2013-2014 Broadcom Corporation +- * +- * This program is free software; you can redistribute it and/or +- * modify it under the terms of the GNU General Public License as +- * published by the Free Software Foundation version 2. +- * +- * This program is distributed "as is" WITHOUT ANY WARRANTY of any +- * kind, whether express or implied; without even the implied warranty +- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- */ +- +-#ifndef __BRCMSTB_H__ +-#define __BRCMSTB_H__ +- +-void brcmstb_secondary_startup(void); +- +-#endif /* __BRCMSTB_H__ */ +--- a/arch/arm/mach-bcm/headsmp-brcmstb.S ++++ /dev/null +@@ -1,33 +0,0 @@ +-/* +- * SMP boot code for secondary CPUs +- * Based on arch/arm/mach-tegra/headsmp.S +- * +- * Copyright (C) 2010 NVIDIA, Inc. +- * Copyright (C) 2013-2014 Broadcom Corporation +- * +- * This program is free software; you can redistribute it and/or +- * modify it under the terms of the GNU General Public License as +- * published by the Free Software Foundation version 2. +- * +- * This program is distributed "as is" WITHOUT ANY WARRANTY of any +- * kind, whether express or implied; without even the implied warranty +- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- */ +- +-#include +-#include +-#include +- +- .section ".text.head", "ax" +- +-ENTRY(brcmstb_secondary_startup) +- /* +- * Ensure CPU is in a sane state by disabling all IRQs and switching +- * into SVC mode. +- */ +- setmode PSR_I_BIT | PSR_F_BIT | SVC_MODE, r0 +- +- bl v7_invalidate_l1 +- b secondary_startup +-ENDPROC(brcmstb_secondary_startup) +--- a/arch/arm/mach-bcm/platsmp-brcmstb.c ++++ b/arch/arm/mach-bcm/platsmp-brcmstb.c +@@ -30,8 +30,6 @@ + #include + #include + +-#include "brcmstb.h" +- + enum { + ZONE_MAN_CLKEN_MASK = BIT(0), + ZONE_MAN_RESET_CNTL_MASK = BIT(1), +@@ -153,7 +151,7 @@ static void brcmstb_cpu_boot(u32 cpu) + * Set the reset vector to point to the secondary_startup + * routine + */ +- cpu_set_boot_addr(cpu, virt_to_phys(brcmstb_secondary_startup)); ++ cpu_set_boot_addr(cpu, virt_to_phys(secondary_startup)); + + /* Unhalt the cpu */ + cpu_rst_cfg_set(cpu, 0); +--- a/arch/arm/mach-berlin/headsmp.S ++++ b/arch/arm/mach-berlin/headsmp.S +@@ -12,12 +12,6 @@ + #include + #include + +-ENTRY(berlin_secondary_startup) +- ARM_BE8(setend be) +- bl v7_invalidate_l1 +- b secondary_startup +-ENDPROC(berlin_secondary_startup) +- + /* + * If the following instruction is set in the reset exception vector, CPUs + * will fetch the value of the software reset address vector when being +--- a/arch/arm/mach-berlin/platsmp.c ++++ b/arch/arm/mach-berlin/platsmp.c +@@ -22,7 +22,6 @@ + #define RESET_VECT 0x00 + #define SW_RESET_ADDR 0x94 + +-extern void berlin_secondary_startup(void); + extern u32 boot_inst; + + static void __iomem *cpu_ctrl; +@@ -85,7 +84,7 @@ static void __init berlin_smp_prepare_cp + * Write the secondary startup address into the SW reset address + * vector. This is used by boot_inst. + */ +- writel(virt_to_phys(berlin_secondary_startup), vectors_base + SW_RESET_ADDR); ++ writel(virt_to_phys(secondary_startup), vectors_base + SW_RESET_ADDR); + + iounmap(vectors_base); + unmap_scu: +--- a/arch/arm/mach-hisi/Makefile ++++ b/arch/arm/mach-hisi/Makefile +@@ -6,4 +6,4 @@ CFLAGS_platmcpm.o := -march=armv7-a + + obj-y += hisilicon.o + obj-$(CONFIG_MCPM) += platmcpm.o +-obj-$(CONFIG_SMP) += platsmp.o hotplug.o headsmp.o ++obj-$(CONFIG_SMP) += platsmp.o hotplug.o +--- a/arch/arm/mach-hisi/core.h ++++ b/arch/arm/mach-hisi/core.h +@@ -12,7 +12,6 @@ extern void hi3xxx_cpu_die(unsigned int + extern int hi3xxx_cpu_kill(unsigned int cpu); + extern void hi3xxx_set_cpu(int cpu, bool enable); + +-extern void hisi_secondary_startup(void); + extern struct smp_operations hix5hd2_smp_ops; + extern void hix5hd2_set_cpu(int cpu, bool enable); + extern void hix5hd2_cpu_die(unsigned int cpu); +--- a/arch/arm/mach-hisi/headsmp.S ++++ /dev/null +@@ -1,16 +0,0 @@ +-/* +- * Copyright (c) 2014 Hisilicon Limited. +- * Copyright (c) 2014 Linaro Ltd. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +-#include +-#include +- +- __CPUINIT +- +-ENTRY(hisi_secondary_startup) +- bl v7_invalidate_l1 +- b secondary_startup +--- a/arch/arm/mach-hisi/platsmp.c ++++ b/arch/arm/mach-hisi/platsmp.c +@@ -118,7 +118,7 @@ static int hix5hd2_boot_secondary(unsign + { + phys_addr_t jumpaddr; + +- jumpaddr = virt_to_phys(hisi_secondary_startup); ++ jumpaddr = virt_to_phys(secondary_startup); + hix5hd2_set_scu_boot_addr(HIX5HD2_BOOT_ADDRESS, jumpaddr); + hix5hd2_set_cpu(cpu, true); + arch_send_wakeup_ipi_mask(cpumask_of(cpu)); +@@ -156,7 +156,7 @@ static int hip01_boot_secondary(unsigned + struct device_node *node; + + +- jumpaddr = virt_to_phys(hisi_secondary_startup); ++ jumpaddr = virt_to_phys(secondary_startup); + hip01_set_boot_addr(HIP01_BOOT_ADDRESS, jumpaddr); + + node = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +--- a/arch/arm/mach-imx/headsmp.S ++++ b/arch/arm/mach-imx/headsmp.S +@@ -25,7 +25,6 @@ diag_reg_offset: + .endm + + ENTRY(v7_secondary_startup) +- bl v7_invalidate_l1 + set_diag_reg + b secondary_startup + ENDPROC(v7_secondary_startup) +--- a/arch/arm/mach-mvebu/headsmp-a9.S ++++ b/arch/arm/mach-mvebu/headsmp-a9.S +@@ -21,7 +21,6 @@ + + ENTRY(mvebu_cortex_a9_secondary_startup) + ARM_BE8(setend be) +- bl v7_invalidate_l1 + bl armada_38x_scu_power_up + b secondary_startup + ENDPROC(mvebu_cortex_a9_secondary_startup) +--- a/arch/arm/mach-prima2/headsmp.S ++++ b/arch/arm/mach-prima2/headsmp.S +@@ -15,7 +15,6 @@ + * ready for them to initialise. + */ + ENTRY(sirfsoc_secondary_startup) +- bl v7_invalidate_l1 + mrc p15, 0, r0, c0, c0, 5 + and r0, r0, #15 + adr r4, 1f +--- a/arch/arm/mach-rockchip/core.h ++++ b/arch/arm/mach-rockchip/core.h +@@ -17,4 +17,3 @@ extern char rockchip_secondary_trampolin + extern char rockchip_secondary_trampoline_end; + + extern unsigned long rockchip_boot_fn; +-extern void rockchip_secondary_startup(void); +--- a/arch/arm/mach-rockchip/headsmp.S ++++ b/arch/arm/mach-rockchip/headsmp.S +@@ -15,14 +15,6 @@ + #include + #include + +-ENTRY(rockchip_secondary_startup) +- mrc p15, 0, r0, c0, c0, 0 @ read main ID register +- ldr r1, =0x00000c09 @ Cortex-A9 primary part number +- teq r0, r1 +- beq v7_invalidate_l1 +- b secondary_startup +-ENDPROC(rockchip_secondary_startup) +- + ENTRY(rockchip_secondary_trampoline) + ldr pc, 1f + ENDPROC(rockchip_secondary_trampoline) +--- a/arch/arm/mach-rockchip/platsmp.c ++++ b/arch/arm/mach-rockchip/platsmp.c +@@ -149,8 +149,7 @@ static int __cpuinit rockchip_boot_secon + * sram_base_addr + 8: start address for pc + * */ + udelay(10); +- writel(virt_to_phys(rockchip_secondary_startup), +- sram_base_addr + 8); ++ writel(virt_to_phys(secondary_startup), sram_base_addr + 8); + writel(0xDEADBEAF, sram_base_addr + 4); + dsb_sev(); + } +@@ -189,7 +188,7 @@ static int __init rockchip_smp_prepare_s + } + + /* set the boot function for the sram code */ +- rockchip_boot_fn = virt_to_phys(rockchip_secondary_startup); ++ rockchip_boot_fn = virt_to_phys(secondary_startup); + + /* copy the trampoline to sram, that runs during startup of the core */ + memcpy(sram_base_addr, &rockchip_secondary_trampoline, trampoline_sz); +--- a/arch/arm/mach-shmobile/common.h ++++ b/arch/arm/mach-shmobile/common.h +@@ -14,7 +14,6 @@ extern void shmobile_smp_sleep(void); + extern void shmobile_smp_hook(unsigned int cpu, unsigned long fn, + unsigned long arg); + extern int shmobile_smp_cpu_disable(unsigned int cpu); +-extern void shmobile_invalidate_start(void); + extern void shmobile_boot_scu(void); + extern void shmobile_smp_scu_prepare_cpus(unsigned int max_cpus); + extern void shmobile_smp_scu_cpu_die(unsigned int cpu); +--- a/arch/arm/mach-shmobile/headsmp-scu.S ++++ b/arch/arm/mach-shmobile/headsmp-scu.S +@@ -22,7 +22,7 @@ + * Boot code for secondary CPUs. + * + * First we turn on L1 cache coherency for our CPU. Then we jump to +- * shmobile_invalidate_start that invalidates the cache and hands over control ++ * secondary_startup that invalidates the cache and hands over control + * to the common ARM startup code. + */ + ENTRY(shmobile_boot_scu) +@@ -36,7 +36,7 @@ ENTRY(shmobile_boot_scu) + bic r2, r2, r3 @ Clear bits of our CPU (Run Mode) + str r2, [r0, #8] @ write back + +- b shmobile_invalidate_start ++ b secondary_startup + ENDPROC(shmobile_boot_scu) + + .text +--- a/arch/arm/mach-shmobile/headsmp.S ++++ b/arch/arm/mach-shmobile/headsmp.S +@@ -16,13 +16,6 @@ + #include + #include + +-#ifdef CONFIG_SMP +-ENTRY(shmobile_invalidate_start) +- bl v7_invalidate_l1 +- b secondary_startup +-ENDPROC(shmobile_invalidate_start) +-#endif +- + /* + * Reset vector for secondary CPUs. + * This will be mapped at address 0 by SBAR register. +--- a/arch/arm/mach-shmobile/platsmp-apmu.c ++++ b/arch/arm/mach-shmobile/platsmp-apmu.c +@@ -133,7 +133,7 @@ void __init shmobile_smp_apmu_prepare_cp + int shmobile_smp_apmu_boot_secondary(unsigned int cpu, struct task_struct *idle) + { + /* For this particular CPU register boot vector */ +- shmobile_smp_hook(cpu, virt_to_phys(shmobile_invalidate_start), 0); ++ shmobile_smp_hook(cpu, virt_to_phys(secondary_startup), 0); + + return apmu_wrap(cpu, apmu_power_on); + } +--- a/arch/arm/mach-socfpga/core.h ++++ b/arch/arm/mach-socfpga/core.h +@@ -31,7 +31,6 @@ + + #define RSTMGR_MPUMODRST_CPU1 0x2 /* CPU1 Reset */ + +-extern void socfpga_secondary_startup(void); + extern void __iomem *socfpga_scu_base_addr; + + extern void socfpga_init_clocks(void); +--- a/arch/arm/mach-socfpga/headsmp.S ++++ b/arch/arm/mach-socfpga/headsmp.S +@@ -30,8 +30,3 @@ ENTRY(secondary_trampoline) + 1: .long . + .long socfpga_cpu1start_addr + ENTRY(secondary_trampoline_end) +- +-ENTRY(socfpga_secondary_startup) +- bl v7_invalidate_l1 +- b secondary_startup +-ENDPROC(socfpga_secondary_startup) +--- a/arch/arm/mach-socfpga/platsmp.c ++++ b/arch/arm/mach-socfpga/platsmp.c +@@ -40,7 +40,7 @@ static int socfpga_boot_secondary(unsign + + memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); + +- writel(virt_to_phys(socfpga_secondary_startup), ++ writel(virt_to_phys(secondary_startup), + sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff)); + + flush_cache_all(); +--- a/arch/arm/mach-tegra/Makefile ++++ b/arch/arm/mach-tegra/Makefile +@@ -19,7 +19,7 @@ obj-$(CONFIG_ARCH_TEGRA_3x_SOC) += pm-t + ifeq ($(CONFIG_CPU_IDLE),y) + obj-$(CONFIG_ARCH_TEGRA_3x_SOC) += cpuidle-tegra30.o + endif +-obj-$(CONFIG_SMP) += platsmp.o headsmp.o ++obj-$(CONFIG_SMP) += platsmp.o + obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o + + obj-$(CONFIG_ARCH_TEGRA_114_SOC) += sleep-tegra30.o +--- a/arch/arm/mach-tegra/headsmp.S ++++ /dev/null +@@ -1,12 +0,0 @@ +-#include +-#include +- +-#include "sleep.h" +- +- .section ".text.head", "ax" +- +-ENTRY(tegra_secondary_startup) +- check_cpu_part_num 0xc09, r8, r9 +- bleq v7_invalidate_l1 +- b secondary_startup +-ENDPROC(tegra_secondary_startup) +--- a/arch/arm/mach-tegra/reset.c ++++ b/arch/arm/mach-tegra/reset.c +@@ -94,7 +94,7 @@ void __init tegra_cpu_reset_handler_init + __tegra_cpu_reset_handler_data[TEGRA_RESET_MASK_PRESENT] = + *((u32 *)cpu_possible_mask); + __tegra_cpu_reset_handler_data[TEGRA_RESET_STARTUP_SECONDARY] = +- virt_to_phys((void *)tegra_secondary_startup); ++ virt_to_phys((void *)secondary_startup); + #endif + + #ifdef CONFIG_PM_SLEEP +--- a/arch/arm/mach-tegra/reset.h ++++ b/arch/arm/mach-tegra/reset.h +@@ -37,7 +37,6 @@ void __tegra_cpu_reset_handler_start(voi + void __tegra_cpu_reset_handler(void); + void __tegra20_cpu1_resettable_status_offset(void); + void __tegra_cpu_reset_handler_end(void); +-void tegra_secondary_startup(void); + + #ifdef CONFIG_PM_SLEEP + #define tegra_cpu_lp1_mask \ +--- a/arch/arm/mach-zynq/common.h ++++ b/arch/arm/mach-zynq/common.h +@@ -17,8 +17,6 @@ + #ifndef __MACH_ZYNQ_COMMON_H__ + #define __MACH_ZYNQ_COMMON_H__ + +-void zynq_secondary_startup(void); +- + extern int zynq_slcr_init(void); + extern int zynq_early_slcr_init(void); + extern void zynq_slcr_system_reset(void); +--- a/arch/arm/mach-zynq/headsmp.S ++++ b/arch/arm/mach-zynq/headsmp.S +@@ -22,8 +22,3 @@ zynq_secondary_trampoline_jump: + .globl zynq_secondary_trampoline_end + zynq_secondary_trampoline_end: + ENDPROC(zynq_secondary_trampoline) +- +-ENTRY(zynq_secondary_startup) +- bl v7_invalidate_l1 +- b secondary_startup +-ENDPROC(zynq_secondary_startup) +--- a/arch/arm/mach-zynq/platsmp.c ++++ b/arch/arm/mach-zynq/platsmp.c +@@ -87,10 +87,9 @@ int zynq_cpun_start(u32 address, int cpu + } + EXPORT_SYMBOL(zynq_cpun_start); + +-static int zynq_boot_secondary(unsigned int cpu, +- struct task_struct *idle) ++static int zynq_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- return zynq_cpun_start(virt_to_phys(zynq_secondary_startup), cpu); ++ return zynq_cpun_start(virt_to_phys(secondary_startup), cpu); + } + + /* +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -336,7 +336,7 @@ __v7_pj4b_setup: + __v7_setup: + adr r12, __v7_setup_stack @ the local stack + stmia r12, {r0-r5, r7, r9, r11, lr} +- bl v7_flush_dcache_louis ++ bl v7_invalidate_l1 + ldmia r12, {r0-r5, r7, r9, r11, lr} + + mrc p15, 0, r0, c0, c0, 0 @ read main ID register diff --git a/queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch b/queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch new file mode 100644 index 00000000000..999a9f0c1e5 --- /dev/null +++ b/queue-4.1/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch @@ -0,0 +1,50 @@ +From b310c178e6d897f82abb9da3af1cd7c02b09f592 Mon Sep 17 00:00:00 2001 +From: Horia Geant? +Date: Tue, 11 Aug 2015 20:19:20 +0300 +Subject: crypto: caam - fix memory corruption in ahash_final_ctx + +From: Horia Geant? + +commit b310c178e6d897f82abb9da3af1cd7c02b09f592 upstream. + +When doing pointer operation for accessing the HW S/G table, +a value representing number of entries (and not number of bytes) +must be used. + +Fixes: 045e36780f115 ("crypto: caam - ahash hmac support") +Signed-off-by: Horia Geant? +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/caam/caamhash.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -909,13 +909,14 @@ static int ahash_final_ctx(struct ahash_ + state->buflen_1; + u32 *sh_desc = ctx->sh_desc_fin, *desc; + dma_addr_t ptr = ctx->sh_desc_fin_dma; +- int sec4_sg_bytes; ++ int sec4_sg_bytes, sec4_sg_src_index; + int digestsize = crypto_ahash_digestsize(ahash); + struct ahash_edesc *edesc; + int ret = 0; + int sh_len; + +- sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry); ++ sec4_sg_src_index = 1 + (buflen ? 1 : 0); ++ sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry); + + /* allocate space for base edesc and hw desc commands, link tables */ + edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN + +@@ -942,7 +943,7 @@ static int ahash_final_ctx(struct ahash_ + state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1, + buf, state->buf_dma, buflen, + last_buflen); +- (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN; ++ (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN; + + edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, + sec4_sg_bytes, DMA_TO_DEVICE); diff --git a/queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch b/queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch new file mode 100644 index 00000000000..d3d75928031 --- /dev/null +++ b/queue-4.1/crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch @@ -0,0 +1,186 @@ +From d3392f41f6d3cd0a034bd0aca47fabea2b47218e Mon Sep 17 00:00:00 2001 +From: Jan Stancek +Date: Sat, 8 Aug 2015 08:47:28 +0200 +Subject: crypto: nx - respect sg limit bounds when building sg lists for SHA + +From: Jan Stancek + +commit d3392f41f6d3cd0a034bd0aca47fabea2b47218e upstream. + +Commit 000851119e80 changed sha256/512 update functions to +pass more data to nx_build_sg_list(), which ends with +sg list overflows and usually with update functions failing +for data larger than max_sg_len * NX_PAGE_SIZE. + +This happens because: +- both "total" and "to_process" are updated, which leads to + "to_process" getting overflowed for some data lengths + For example: + In first iteration "total" is 50, and let's assume "to_process" + is 30 due to sg limits. At the end of first iteration "total" is + set to 20. At start of 2nd iteration "to_process" overflows on: + to_process = total - to_process; +- "in_sg" is not reset to nx_ctx->in_sg after each iteration +- nx_build_sg_list() is hitting overflow because the amount of data + passed to it would require more than sgmax elements +- as consequence of previous item, data stored in overflowed sg list + may no longer be aligned to SHA*_BLOCK_SIZE + +This patch changes sha256/512 update functions so that "to_process" +respects sg limits and never tries to pass more data to +nx_build_sg_list() to avoid overflows. "to_process" is calculated +as minimum of "total" and sg limits at start of every iteration. + +Fixes: 000851119e80 ("crypto: nx - Fix SHA concurrence issue and sg + limit bounds") +Signed-off-by: Jan Stancek +Cc: Leonidas Da Silva Barbosa +Cc: Marcelo Henrique Cerri +Cc: Fionnuala Gunter +Cc: "David S. Miller" +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/nx/nx-sha256.c | 27 ++++++++++++++++----------- + drivers/crypto/nx/nx-sha512.c | 28 ++++++++++++++++------------ + 2 files changed, 32 insertions(+), 23 deletions(-) + +--- a/drivers/crypto/nx/nx-sha256.c ++++ b/drivers/crypto/nx/nx-sha256.c +@@ -71,7 +71,6 @@ static int nx_sha256_update(struct shash + struct sha256_state *sctx = shash_desc_ctx(desc); + struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base); + struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb; +- struct nx_sg *in_sg; + struct nx_sg *out_sg; + u64 to_process = 0, leftover, total; + unsigned long irq_flags; +@@ -97,7 +96,6 @@ static int nx_sha256_update(struct shash + NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE; + NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION; + +- in_sg = nx_ctx->in_sg; + max_sg_len = min_t(u64, nx_ctx->ap->sglen, + nx_driver.of.max_sg_len/sizeof(struct nx_sg)); + max_sg_len = min_t(u64, max_sg_len, +@@ -114,17 +112,12 @@ static int nx_sha256_update(struct shash + } + + do { +- /* +- * to_process: the SHA256_BLOCK_SIZE data chunk to process in +- * this update. This value is also restricted by the sg list +- * limits. +- */ +- to_process = total - to_process; +- to_process = to_process & ~(SHA256_BLOCK_SIZE - 1); ++ int used_sgs = 0; ++ struct nx_sg *in_sg = nx_ctx->in_sg; + + if (buf_len) { + data_len = buf_len; +- in_sg = nx_build_sg_list(nx_ctx->in_sg, ++ in_sg = nx_build_sg_list(in_sg, + (u8 *) sctx->buf, + &data_len, + max_sg_len); +@@ -133,15 +126,27 @@ static int nx_sha256_update(struct shash + rc = -EINVAL; + goto out; + } ++ used_sgs = in_sg - nx_ctx->in_sg; + } + ++ /* to_process: SHA256_BLOCK_SIZE aligned chunk to be ++ * processed in this iteration. This value is restricted ++ * by sg list limits and number of sgs we already used ++ * for leftover data. (see above) ++ * In ideal case, we could allow NX_PAGE_SIZE * max_sg_len, ++ * but because data may not be aligned, we need to account ++ * for that too. */ ++ to_process = min_t(u64, total, ++ (max_sg_len - 1 - used_sgs) * NX_PAGE_SIZE); ++ to_process = to_process & ~(SHA256_BLOCK_SIZE - 1); ++ + data_len = to_process - buf_len; + in_sg = nx_build_sg_list(in_sg, (u8 *) data, + &data_len, max_sg_len); + + nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg); + +- to_process = (data_len + buf_len); ++ to_process = data_len + buf_len; + leftover = total - to_process; + + /* +--- a/drivers/crypto/nx/nx-sha512.c ++++ b/drivers/crypto/nx/nx-sha512.c +@@ -71,7 +71,6 @@ static int nx_sha512_update(struct shash + struct sha512_state *sctx = shash_desc_ctx(desc); + struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base); + struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb; +- struct nx_sg *in_sg; + struct nx_sg *out_sg; + u64 to_process, leftover = 0, total; + unsigned long irq_flags; +@@ -97,7 +96,6 @@ static int nx_sha512_update(struct shash + NX_CPB_FDM(csbcpb) |= NX_FDM_INTERMEDIATE; + NX_CPB_FDM(csbcpb) |= NX_FDM_CONTINUATION; + +- in_sg = nx_ctx->in_sg; + max_sg_len = min_t(u64, nx_ctx->ap->sglen, + nx_driver.of.max_sg_len/sizeof(struct nx_sg)); + max_sg_len = min_t(u64, max_sg_len, +@@ -114,18 +112,12 @@ static int nx_sha512_update(struct shash + } + + do { +- /* +- * to_process: the SHA512_BLOCK_SIZE data chunk to process in +- * this update. This value is also restricted by the sg list +- * limits. +- */ +- to_process = total - leftover; +- to_process = to_process & ~(SHA512_BLOCK_SIZE - 1); +- leftover = total - to_process; ++ int used_sgs = 0; ++ struct nx_sg *in_sg = nx_ctx->in_sg; + + if (buf_len) { + data_len = buf_len; +- in_sg = nx_build_sg_list(nx_ctx->in_sg, ++ in_sg = nx_build_sg_list(in_sg, + (u8 *) sctx->buf, + &data_len, max_sg_len); + +@@ -133,8 +125,20 @@ static int nx_sha512_update(struct shash + rc = -EINVAL; + goto out; + } ++ used_sgs = in_sg - nx_ctx->in_sg; + } + ++ /* to_process: SHA512_BLOCK_SIZE aligned chunk to be ++ * processed in this iteration. This value is restricted ++ * by sg list limits and number of sgs we already used ++ * for leftover data. (see above) ++ * In ideal case, we could allow NX_PAGE_SIZE * max_sg_len, ++ * but because data may not be aligned, we need to account ++ * for that too. */ ++ to_process = min_t(u64, total, ++ (max_sg_len - 1 - used_sgs) * NX_PAGE_SIZE); ++ to_process = to_process & ~(SHA512_BLOCK_SIZE - 1); ++ + data_len = to_process - buf_len; + in_sg = nx_build_sg_list(in_sg, (u8 *) data, + &data_len, max_sg_len); +@@ -146,7 +150,7 @@ static int nx_sha512_update(struct shash + goto out; + } + +- to_process = (data_len + buf_len); ++ to_process = data_len + buf_len; + leftover = total - to_process; + + /* diff --git a/queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch b/queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch new file mode 100644 index 00000000000..75dbb825fdb --- /dev/null +++ b/queue-4.1/libfc-fix-fc_exch_recv_req-error-path.patch @@ -0,0 +1,63 @@ +From f6979adeaab578f8ca14fdd32b06ddee0d9d3314 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 5 Jun 2015 14:20:46 -0700 +Subject: libfc: Fix fc_exch_recv_req() error path + +From: Bart Van Assche + +commit f6979adeaab578f8ca14fdd32b06ddee0d9d3314 upstream. + +Due to patch "libfc: Do not invoke the response handler after +fc_exch_done()" (commit ID 7030fd62) the lport_recv() call +in fc_exch_recv_req() is passed a dangling pointer. Avoid this +by moving the fc_frame_free() call from fc_invoke_resp() to its +callers. This patch fixes the following crash: + +general protection fault: 0000 [#3] PREEMPT SMP +RIP: fc_lport_recv_req+0x72/0x280 [libfc] +Call Trace: + fc_exch_recv+0x642/0xde0 [libfc] + fcoe_percpu_receive_thread+0x46a/0x5ed [fcoe] + kthread+0x10a/0x120 + ret_from_fork+0x42/0x70 + +Signed-off-by: Bart Van Assche +Signed-off-by: Vasu Dev +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libfc/fc_exch.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -733,8 +733,6 @@ static bool fc_invoke_resp(struct fc_exc + if (resp) { + resp(sp, fp, arg); + res = true; +- } else if (!IS_ERR(fp)) { +- fc_frame_free(fp); + } + + spin_lock_bh(&ep->ex_lock); +@@ -1596,7 +1594,8 @@ static void fc_exch_recv_seq_resp(struct + * If new exch resp handler is valid then call that + * first. + */ +- fc_invoke_resp(ep, sp, fp); ++ if (!fc_invoke_resp(ep, sp, fp)) ++ fc_frame_free(fp); + + fc_exch_release(ep); + return; +@@ -1695,7 +1694,8 @@ static void fc_exch_abts_resp(struct fc_ + fc_exch_hold(ep); + if (!rc) + fc_exch_delete(ep); +- fc_invoke_resp(ep, sp, fp); ++ if (!fc_invoke_resp(ep, sp, fp)) ++ fc_frame_free(fp); + if (has_rec) + fc_exch_timer_set(ep, ep->r_a_tov); + fc_exch_release(ep); diff --git a/queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch b/queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch new file mode 100644 index 00000000000..46715771bbd --- /dev/null +++ b/queue-4.1/libfc-fix-fc_fcp_cleanup_each_cmd.patch @@ -0,0 +1,76 @@ +From 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 5 Jun 2015 14:20:51 -0700 +Subject: libfc: Fix fc_fcp_cleanup_each_cmd() + +From: Bart Van Assche + +commit 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 upstream. + +Since fc_fcp_cleanup_cmd() can sleep this function must not +be called while holding a spinlock. This patch avoids that +fc_fcp_cleanup_each_cmd() triggers the following bug: + +BUG: scheduling while atomic: sg_reset/1512/0x00000202 +1 lock held by sg_reset/1512: + #0: (&(&fsp->scsi_pkt_lock)->rlock){+.-...}, at: [] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc] +Preemption disabled at:[] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc] +Call Trace: + [] dump_stack+0x4f/0x7b + [] __schedule_bug+0x6c/0xd0 + [] __schedule+0x71a/0xa10 + [] schedule+0x32/0x80 + [] fc_seq_set_resp+0xac/0x100 [libfc] + [] fc_exch_done+0x41/0x60 [libfc] + [] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc] + [] fc_eh_device_reset+0x1c3/0x270 [libfc] + [] scsi_try_bus_device_reset+0x29/0x60 + [] scsi_ioctl_reset+0x258/0x2d0 + [] scsi_ioctl+0x150/0x440 + [] sd_ioctl+0xad/0x120 + [] blkdev_ioctl+0x1b6/0x810 + [] block_ioctl+0x38/0x40 + [] do_vfs_ioctl+0x2f8/0x530 + [] SyS_ioctl+0x81/0xa0 + [] system_call_fastpath+0x16/0x7a + +Signed-off-by: Bart Van Assche +Signed-off-by: Vasu Dev +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libfc/fc_fcp.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/libfc/fc_fcp.c ++++ b/drivers/scsi/libfc/fc_fcp.c +@@ -1039,11 +1039,26 @@ restart: + fc_fcp_pkt_hold(fsp); + spin_unlock_irqrestore(&si->scsi_queue_lock, flags); + +- if (!fc_fcp_lock_pkt(fsp)) { ++ spin_lock_bh(&fsp->scsi_pkt_lock); ++ if (!(fsp->state & FC_SRB_COMPL)) { ++ fsp->state |= FC_SRB_COMPL; ++ /* ++ * TODO: dropping scsi_pkt_lock and then reacquiring ++ * again around fc_fcp_cleanup_cmd() is required, ++ * since fc_fcp_cleanup_cmd() calls into ++ * fc_seq_set_resp() and that func preempts cpu using ++ * schedule. May be schedule and related code should be ++ * removed instead of unlocking here to avoid scheduling ++ * while atomic bug. ++ */ ++ spin_unlock_bh(&fsp->scsi_pkt_lock); ++ + fc_fcp_cleanup_cmd(fsp, error); ++ ++ spin_lock_bh(&fsp->scsi_pkt_lock); + fc_io_compl(fsp); +- fc_fcp_unlock_pkt(fsp); + } ++ spin_unlock_bh(&fsp->scsi_pkt_lock); + + fc_fcp_pkt_release(fsp); + spin_lock_irqsave(&si->scsi_queue_lock, flags); diff --git a/queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch b/queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch new file mode 100644 index 00000000000..e0603e03ffb --- /dev/null +++ b/queue-4.1/libiscsi-fix-host-busy-blocking-during-connection-teardown.patch @@ -0,0 +1,108 @@ +From 660d0831d1494a6837b2f810d08b5be092c1f31d Mon Sep 17 00:00:00 2001 +From: John Soni Jose +Date: Wed, 24 Jun 2015 06:41:58 +0530 +Subject: libiscsi: Fix host busy blocking during connection teardown + +From: John Soni Jose + +commit 660d0831d1494a6837b2f810d08b5be092c1f31d upstream. + +In case of hw iscsi offload, an host can have N-number of active +connections. There can be IO's running on some connections which +make host->host_busy always TRUE. Now if logout from a connection +is tried then the code gets into an infinite loop as host->host_busy +is always TRUE. + + iscsi_conn_teardown(....) + { + ......... + /* + * Block until all in-progress commands for this connection + * time out or fail. + */ + for (;;) { + spin_lock_irqsave(session->host->host_lock, flags); + if (!atomic_read(&session->host->host_busy)) { /* OK for ERL == 0 */ + spin_unlock_irqrestore(session->host->host_lock, flags); + break; + } + spin_unlock_irqrestore(session->host->host_lock, flags); + msleep_interruptible(500); + iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): " + "host_busy %d host_failed %d\n", + atomic_read(&session->host->host_busy), + session->host->host_failed); + + ................ + ............... + } + } + +This is not an issue with software-iscsi/iser as each cxn is a separate +host. + +Fix: +Acquiring eh_mutex in iscsi_conn_teardown() before setting +session->state = ISCSI_STATE_TERMINATE. + +Signed-off-by: John Soni Jose +Reviewed-by: Mike Christie +Reviewed-by: Chris Leech +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libiscsi.c | 25 ++----------------------- + 1 file changed, 2 insertions(+), 23 deletions(-) + +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -2941,10 +2941,10 @@ void iscsi_conn_teardown(struct iscsi_cl + { + struct iscsi_conn *conn = cls_conn->dd_data; + struct iscsi_session *session = conn->session; +- unsigned long flags; + + del_timer_sync(&conn->transport_timer); + ++ mutex_lock(&session->eh_mutex); + spin_lock_bh(&session->frwd_lock); + conn->c_stage = ISCSI_CONN_CLEANUP_WAIT; + if (session->leadconn == conn) { +@@ -2956,28 +2956,6 @@ void iscsi_conn_teardown(struct iscsi_cl + } + spin_unlock_bh(&session->frwd_lock); + +- /* +- * Block until all in-progress commands for this connection +- * time out or fail. +- */ +- for (;;) { +- spin_lock_irqsave(session->host->host_lock, flags); +- if (!atomic_read(&session->host->host_busy)) { /* OK for ERL == 0 */ +- spin_unlock_irqrestore(session->host->host_lock, flags); +- break; +- } +- spin_unlock_irqrestore(session->host->host_lock, flags); +- msleep_interruptible(500); +- iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): " +- "host_busy %d host_failed %d\n", +- atomic_read(&session->host->host_busy), +- session->host->host_failed); +- /* +- * force eh_abort() to unblock +- */ +- wake_up(&conn->ehwait); +- } +- + /* flush queued up work because we free the connection below */ + iscsi_suspend_tx(conn); + +@@ -2994,6 +2972,7 @@ void iscsi_conn_teardown(struct iscsi_cl + if (session->leadconn == conn) + session->leadconn = NULL; + spin_unlock_bh(&session->frwd_lock); ++ mutex_unlock(&session->eh_mutex); + + iscsi_destroy_conn(cls_conn); + } diff --git a/queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch b/queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch new file mode 100644 index 00000000000..11b2ee1362a --- /dev/null +++ b/queue-4.1/mfd-arizona-fix-initialisation-of-the-pm-runtime.patch @@ -0,0 +1,80 @@ +From 72e43164fd472f6c2659c8313b87da962322dbcf Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Sun, 14 Jun 2015 15:41:50 +0100 +Subject: mfd: arizona: Fix initialisation of the PM runtime + +From: Charles Keepax + +commit 72e43164fd472f6c2659c8313b87da962322dbcf upstream. + +The PM runtime core by default assumes a chip is suspended when runtime +PM is enabled. Currently the arizona driver enables runtime PM when the +chip is fully active and then disables the DCVDD regulator at the end of +arizona_dev_init. This however has several problems, firstly the if we +reach the end of arizona_dev_init, we did not properly follow all the +proceedures for shutting down the chip, and most notably we never marked +the chip as cache only so any writes occurring between then and the next +PM runtime resume will be lost. Secondly, if we are already resumed when +we reach the end of dev_init, then at best we get unbalanced regulator +enable/disables at work we lose DCVDD whilst we need it. + +Additionally, since the commit 4f0216409f7c ("mfd: arizona: Add better +support for system suspend"), the PM runtime operations may +disable/enable the IRQ, so the IRQs must now be enabled before we call +any PM operations. + +This patch adds a call to pm_runtime_set_active to inform the PM core +that the device is starting up active and moves the PM enabling to +around the IRQ initialisation to avoid any PM callbacks happening until +the IRQs are initialised. + +Signed-off-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/arizona-core.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/drivers/mfd/arizona-core.c ++++ b/drivers/mfd/arizona-core.c +@@ -912,10 +912,6 @@ int arizona_dev_init(struct arizona *ari + arizona->pdata.gpio_defaults[i]); + } + +- pm_runtime_set_autosuspend_delay(arizona->dev, 100); +- pm_runtime_use_autosuspend(arizona->dev); +- pm_runtime_enable(arizona->dev); +- + /* Chip default */ + if (!arizona->pdata.clk32k_src) + arizona->pdata.clk32k_src = ARIZONA_32KZ_MCLK2; +@@ -1012,11 +1008,17 @@ int arizona_dev_init(struct arizona *ari + arizona->pdata.spk_fmt[i]); + } + ++ pm_runtime_set_active(arizona->dev); ++ pm_runtime_enable(arizona->dev); ++ + /* Set up for interrupts */ + ret = arizona_irq_init(arizona); + if (ret != 0) + goto err_reset; + ++ pm_runtime_set_autosuspend_delay(arizona->dev, 100); ++ pm_runtime_use_autosuspend(arizona->dev); ++ + arizona_request_irq(arizona, ARIZONA_IRQ_CLKGEN_ERR, "CLKGEN error", + arizona_clkgen_err, arizona); + arizona_request_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, "Overclocked", +@@ -1045,10 +1047,6 @@ int arizona_dev_init(struct arizona *ari + goto err_irq; + } + +-#ifdef CONFIG_PM +- regulator_disable(arizona->dcvdd); +-#endif +- + return 0; + + err_irq: diff --git a/queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch b/queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch new file mode 100644 index 00000000000..93aba049994 --- /dev/null +++ b/queue-4.1/mips-fix-seccomp-syscall-argument-for-mips64.patch @@ -0,0 +1,51 @@ +From 9f161439e4104b641a7bfb9b89581d801159fec8 Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Thu, 13 Aug 2015 08:47:59 +0100 +Subject: MIPS: Fix seccomp syscall argument for MIPS64 + +From: Markos Chandras + +commit 9f161439e4104b641a7bfb9b89581d801159fec8 upstream. + +Commit 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)") +fixed indirect system calls on O32 but it also introduced a bug for MIPS64 +where it erroneously modified the v0 (syscall) register with the assumption +that the sycall offset hasn't been taken into consideration. This breaks +seccomp on MIPS64 n64 and n32 ABIs. We fix this by replacing the addition +with a move instruction. + +Fixes: 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)") +Reviewed-by: James Hogan +Signed-off-by: Markos Chandras +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/10951/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/scall64-64.S | 2 +- + arch/mips/kernel/scall64-n32.S | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/scall64-64.S ++++ b/arch/mips/kernel/scall64-64.S +@@ -80,7 +80,7 @@ syscall_trace_entry: + SAVE_STATIC + move s0, t2 + move a0, sp +- daddiu a1, v0, __NR_64_Linux ++ move a1, v0 + jal syscall_trace_enter + + bltz v0, 2f # seccomp failed? Skip syscall +--- a/arch/mips/kernel/scall64-n32.S ++++ b/arch/mips/kernel/scall64-n32.S +@@ -72,7 +72,7 @@ n32_syscall_trace_entry: + SAVE_STATIC + move s0, t2 + move a0, sp +- daddiu a1, v0, __NR_N32_Linux ++ move a1, v0 + jal syscall_trace_enter + + bltz v0, 2f # seccomp failed? Skip syscall diff --git a/queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch b/queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch new file mode 100644 index 00000000000..021b7c92111 --- /dev/null +++ b/queue-4.1/regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch @@ -0,0 +1,55 @@ +From 8ef9724bf9718af81cfc5132253372f79c71b7e2 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 26 Jul 2015 21:34:50 -0700 +Subject: regmap: regcache-rbtree: Clean new present bits on present bitmap resize + +From: Guenter Roeck + +commit 8ef9724bf9718af81cfc5132253372f79c71b7e2 upstream. + +When inserting a new register into a block, the present bit map size is +increased using krealloc. krealloc does not clear the additionally +allocated memory, leaving it filled with random values. Result is that +some registers are considered cached even though this is not the case. + +Fix the problem by clearing the additionally allocated memory. Also, if +the bitmap size does not increase, do not reallocate the bitmap at all +to reduce overhead. + +Fixes: 3f4ff561bc88 ("regmap: rbtree: Make cache_present bitmap per node") +Signed-off-by: Guenter Roeck +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regcache-rbtree.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -296,11 +296,20 @@ static int regcache_rbtree_insert_to_blo + if (!blk) + return -ENOMEM; + +- present = krealloc(rbnode->cache_present, +- BITS_TO_LONGS(blklen) * sizeof(*present), GFP_KERNEL); +- if (!present) { +- kfree(blk); +- return -ENOMEM; ++ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { ++ present = krealloc(rbnode->cache_present, ++ BITS_TO_LONGS(blklen) * sizeof(*present), ++ GFP_KERNEL); ++ if (!present) { ++ kfree(blk); ++ return -ENOMEM; ++ } ++ ++ memset(present + BITS_TO_LONGS(rbnode->blklen), 0, ++ (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) ++ * sizeof(*present)); ++ } else { ++ present = rbnode->cache_present; + } + + /* insert the register value in the correct place in the rbnode block */ diff --git a/queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch b/queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch new file mode 100644 index 00000000000..c46c4b0edae --- /dev/null +++ b/queue-4.1/revert-libata-eh-set-information-field-for-autosense.patch @@ -0,0 +1,159 @@ +From fe16d4f202c59a560533a223bc6375739ee30944 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:41:33 -0400 +Subject: Revert "libata-eh: Set 'information' field for autosense" + +From: Tejun Heo + +commit fe16d4f202c59a560533a223bc6375739ee30944 upstream. + +This reverts commit a1524f226a02aa6edebd90ae0752e97cfd78b159. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 4 ++-- + drivers/ata/libata-eh.c | 3 --- + drivers/ata/libata-scsi.c | 12 ------------ + drivers/ata/libata.h | 5 +---- + drivers/scsi/scsi_error.c | 31 ------------------------------- + include/scsi/scsi_eh.h | 1 - + 6 files changed, 3 insertions(+), 53 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -694,11 +694,11 @@ static int ata_rwcmd_protocol(struct ata + * RETURNS: + * Block address read from @tf. + */ +-u64 ata_tf_read_block(const struct ata_taskfile *tf, struct ata_device *dev) ++u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) + { + u64 block = 0; + +- if (!dev || tf->flags & ATA_TFLAG_LBA) { ++ if (tf->flags & ATA_TFLAG_LBA) { + if (tf->flags & ATA_TFLAG_LBA48) { + block |= (u64)tf->hob_lbah << 40; + block |= (u64)tf->hob_lbam << 32; +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1864,7 +1864,6 @@ void ata_eh_analyze_ncq_error(struct ata + ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", + sense_key, asc, ascq); + ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); +- ata_scsi_set_sense_information(qc->scsicmd, &qc->result_tf); + qc->flags |= ATA_QCFLAG_SENSE_VALID; + } + +@@ -1907,8 +1906,6 @@ static unsigned int ata_eh_analyze_tf(st + tmp = ata_eh_request_sense(qc, qc->scsicmd); + if (tmp) + qc->err_mask |= tmp; +- else +- ata_scsi_set_sense_information(qc->scsicmd, tf); + } else { + ata_dev_warn(qc->dev, "sense data available but port frozen\n"); + } +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -280,18 +280,6 @@ void ata_scsi_set_sense(struct scsi_cmnd + scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); + } + +-void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, +- const struct ata_taskfile *tf) +-{ +- u64 information; +- +- if (!cmd) +- return; +- +- information = ata_tf_read_block(tf, NULL); +- scsi_set_sense_information(cmd->sense_buffer, information); +-} +- + static ssize_t + ata_scsi_em_message_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -67,8 +67,7 @@ extern struct ata_queued_cmd *ata_qc_new + extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev, + u64 block, u32 n_block, unsigned int tf_flags, + unsigned int tag); +-extern u64 ata_tf_read_block(const struct ata_taskfile *tf, +- struct ata_device *dev); ++extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev); + extern unsigned ata_exec_internal(struct ata_device *dev, + struct ata_taskfile *tf, const u8 *cdb, + int dma_dir, void *buf, unsigned int buflen, +@@ -139,8 +138,6 @@ extern int ata_scsi_add_hosts(struct ata + extern void ata_scsi_scan_host(struct ata_port *ap, int sync); + extern int ata_scsi_offline_dev(struct ata_device *dev); + extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); +-extern void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, +- const struct ata_taskfile *tf); + extern void ata_scsi_media_change_notify(struct ata_device *dev); + extern void ata_scsi_hotplug(struct work_struct *work); + extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -26,7 +26,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -2587,33 +2586,3 @@ void scsi_build_sense_buffer(int desc, u + } + } + EXPORT_SYMBOL(scsi_build_sense_buffer); +- +-/** +- * scsi_set_sense_information - set the information field in a +- * formatted sense data buffer +- * @buf: Where to build sense data +- * @info: 64-bit information value to be set +- * +- **/ +-void scsi_set_sense_information(u8 *buf, u64 info) +-{ +- if ((buf[0] & 0x7f) == 0x72) { +- u8 *ucp, len; +- +- len = buf[7]; +- ucp = (char *)scsi_sense_desc_find(buf, len + 8, 0); +- if (!ucp) { +- buf[7] = len + 0xa; +- ucp = buf + 8 + len; +- } +- ucp[0] = 0; +- ucp[1] = 0xa; +- ucp[2] = 0x80; /* Valid bit */ +- ucp[3] = 0; +- put_unaligned_be64(info, &ucp[4]); +- } else if ((buf[0] & 0x7f) == 0x70) { +- buf[0] |= 0x80; +- put_unaligned_be64(info, &buf[3]); +- } +-} +-EXPORT_SYMBOL(scsi_set_sense_information); +--- a/include/scsi/scsi_eh.h ++++ b/include/scsi/scsi_eh.h +@@ -59,7 +59,6 @@ extern int scsi_get_sense_info_fld(const + u64 * info_out); + + extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq); +-extern void scsi_set_sense_information(u8 *buf, u64 info); + + extern int scsi_ioctl_reset(struct scsi_device *, int __user *); + diff --git a/queue-4.1/revert-libata-implement-ncq-autosense.patch b/queue-4.1/revert-libata-implement-ncq-autosense.patch new file mode 100644 index 00000000000..fa6466cc64b --- /dev/null +++ b/queue-4.1/revert-libata-implement-ncq-autosense.patch @@ -0,0 +1,114 @@ +From 74a80d67b8316eb3fbeb73dafc060a5a0a708587 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:46:39 -0400 +Subject: Revert "libata: Implement NCQ autosense" + +From: Tejun Heo + +commit 74a80d67b8316eb3fbeb73dafc060a5a0a708587 upstream. + +This reverts commit 42b966fbf35da9c87f08d98f9b8978edf9e717cf. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 18 ------------------ + drivers/ata/libata-scsi.c | 9 ++------- + drivers/ata/libata.h | 1 - + include/linux/ata.h | 2 -- + 4 files changed, 2 insertions(+), 28 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1592,8 +1592,6 @@ static int ata_eh_read_log_10h(struct at + tf->hob_lbah = buf[10]; + tf->nsect = buf[12]; + tf->hob_nsect = buf[13]; +- if (ata_id_has_ncq_autosense(dev->id)) +- tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16]; + + return 0; + } +@@ -1791,18 +1789,6 @@ void ata_eh_analyze_ncq_error(struct ata + memcpy(&qc->result_tf, &tf, sizeof(tf)); + qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48; + qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ; +- if (qc->result_tf.auxiliary) { +- char sense_key, asc, ascq; +- +- sense_key = (qc->result_tf.auxiliary >> 16) & 0xff; +- asc = (qc->result_tf.auxiliary >> 8) & 0xff; +- ascq = qc->result_tf.auxiliary & 0xff; +- ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", +- sense_key, asc, ascq); +- ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); +- qc->flags |= ATA_QCFLAG_SENSE_VALID; +- } +- + ehc->i.err_mask &= ~AC_ERR_DEV; + } + +@@ -1832,10 +1818,6 @@ static unsigned int ata_eh_analyze_tf(st + return ATA_EH_RESET; + } + +- /* Set by NCQ autosense */ +- if (qc->flags & ATA_QCFLAG_SENSE_VALID) +- return 0; +- + if (stat & (ATA_ERR | ATA_DF)) + qc->err_mask |= AC_ERR_DEV; + else +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -270,11 +270,8 @@ DEVICE_ATTR(unload_heads, S_IRUGO | S_IW + ata_scsi_park_show, ata_scsi_park_store); + EXPORT_SYMBOL_GPL(dev_attr_unload_heads); + +-void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) ++static void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) + { +- if (!cmd) +- return; +- + cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION; + + scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); +@@ -1780,9 +1777,7 @@ static void ata_scsi_qc_complete(struct + ((cdb[2] & 0x20) || need_sense)) { + ata_gen_passthru_sense(qc); + } else { +- if (qc->flags & ATA_QCFLAG_SENSE_VALID) { +- cmd->result = SAM_STAT_CHECK_CONDITION; +- } else if (!need_sense) { ++ if (!need_sense) { + cmd->result = SAM_STAT_GOOD; + } else { + /* TODO: decide which descriptor format to use +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -137,7 +137,6 @@ extern int ata_scsi_add_hosts(struct ata + struct scsi_host_template *sht); + extern void ata_scsi_scan_host(struct ata_port *ap, int sync); + extern int ata_scsi_offline_dev(struct ata_device *dev); +-extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); + extern void ata_scsi_media_change_notify(struct ata_device *dev); + extern void ata_scsi_hotplug(struct work_struct *work); + extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -528,8 +528,6 @@ struct ata_bmdma_prd { + #define ata_id_cdb_intr(id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20) + #define ata_id_has_da(id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) + #define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)) +-#define ata_id_has_ncq_autosense(id) \ +- ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)) + + static inline bool ata_id_has_hipm(const u16 *id) + { diff --git a/queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch b/queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch new file mode 100644 index 00000000000..b84fc634ae8 --- /dev/null +++ b/queue-4.1/revert-libata-implement-support-for-sense-data-reporting.patch @@ -0,0 +1,211 @@ +From 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:45:34 -0400 +Subject: Revert "libata: Implement support for sense data reporting" + +From: Tejun Heo + +commit 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f upstream. + +This reverts commit fe7173c206de63fc28475ee6ae42ff95c05692de. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +ATA_ID_COMMAND_SET_3/4 constants are not reverted as they're used by +later changes. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 20 ---------- + drivers/ata/libata-eh.c | 86 +--------------------------------------------- + include/linux/ata.h | 16 -------- + 3 files changed, 4 insertions(+), 118 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2147,24 +2147,6 @@ static int ata_dev_config_ncq(struct ata + return 0; + } + +-static void ata_dev_config_sense_reporting(struct ata_device *dev) +-{ +- unsigned int err_mask; +- +- if (!ata_id_has_sense_reporting(dev->id)) +- return; +- +- if (ata_id_sense_reporting_enabled(dev->id)) +- return; +- +- err_mask = ata_dev_set_feature(dev, SETFEATURE_SENSE_DATA, 0x1); +- if (err_mask) { +- ata_dev_dbg(dev, +- "failed to enable Sense Data Reporting, Emask 0x%x\n", +- err_mask); +- } +-} +- + /** + * ata_dev_configure - Configure the specified ATA/ATAPI device + * @dev: Target device to configure +@@ -2387,7 +2369,7 @@ int ata_dev_configure(struct ata_device + dev->devslp_timing[i] = sata_setting[j]; + } + } +- ata_dev_config_sense_reporting(dev); ++ + dev->cdb_len = 16; + } + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1630,70 +1630,6 @@ unsigned int atapi_eh_tur(struct ata_dev + } + + /** +- * ata_eh_request_sense - perform REQUEST_SENSE_DATA_EXT +- * @dev: device to perform REQUEST_SENSE_SENSE_DATA_EXT to +- * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) +- * @dfl_sense_key: default sense key to use +- * +- * Perform REQUEST_SENSE_DATA_EXT after the device reported CHECK +- * SENSE. This function is EH helper. +- * +- * LOCKING: +- * Kernel thread context (may sleep). +- * +- * RETURNS: +- * encoded sense data on success, 0 on failure or if sense data +- * is not available. +- */ +-static u32 ata_eh_request_sense(struct ata_queued_cmd *qc, +- struct scsi_cmnd *cmd) +-{ +- struct ata_device *dev = qc->dev; +- struct ata_taskfile tf; +- unsigned int err_mask; +- +- if (!cmd) +- return 0; +- +- DPRINTK("ATA request sense\n"); +- ata_dev_warn(dev, "request sense\n"); +- if (!ata_id_sense_reporting_enabled(dev->id)) { +- ata_dev_warn(qc->dev, "sense data reporting disabled\n"); +- return 0; +- } +- ata_tf_init(dev, &tf); +- +- tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; +- tf.flags |= ATA_TFLAG_LBA | ATA_TFLAG_LBA48; +- tf.command = ATA_CMD_REQ_SENSE_DATA; +- tf.protocol = ATA_PROT_NODATA; +- +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); +- /* +- * ACS-4 states: +- * The device may set the SENSE DATA AVAILABLE bit to one in the +- * STATUS field and clear the ERROR bit to zero in the STATUS field +- * to indicate that the command returned completion without an error +- * and the sense data described in table 306 is available. +- * +- * IOW the 'ATA_SENSE' bit might not be set even though valid +- * sense data is available. +- * So check for both. +- */ +- if ((tf.command & ATA_SENSE) || +- tf.lbah != 0 || tf.lbam != 0 || tf.lbal != 0) { +- ata_scsi_set_sense(cmd, tf.lbah, tf.lbam, tf.lbal); +- qc->flags |= ATA_QCFLAG_SENSE_VALID; +- ata_dev_warn(dev, "sense data %02x/%02x/%02x\n", +- tf.lbah, tf.lbam, tf.lbal); +- } else { +- ata_dev_warn(dev, "request sense failed stat %02x emask %x\n", +- tf.command, err_mask); +- } +- return err_mask; +-} +- +-/** + * atapi_eh_request_sense - perform ATAPI REQUEST_SENSE + * @dev: device to perform REQUEST_SENSE to + * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) +@@ -1896,22 +1832,7 @@ static unsigned int ata_eh_analyze_tf(st + return ATA_EH_RESET; + } + +- /* +- * Sense data reporting does not work if the +- * device fault bit is set. +- */ +- if ((stat & ATA_SENSE) && !(stat & ATA_DF) && +- !(qc->flags & ATA_QCFLAG_SENSE_VALID)) { +- if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) { +- tmp = ata_eh_request_sense(qc, qc->scsicmd); +- if (tmp) +- qc->err_mask |= tmp; +- } else { +- ata_dev_warn(qc->dev, "sense data available but port frozen\n"); +- } +- } +- +- /* Set by NCQ autosense or request sense above */ ++ /* Set by NCQ autosense */ + if (qc->flags & ATA_QCFLAG_SENSE_VALID) + return 0; + +@@ -2658,15 +2579,14 @@ static void ata_eh_link_report(struct at + + #ifdef CONFIG_ATA_VERBOSE_ERROR + if (res->command & (ATA_BUSY | ATA_DRDY | ATA_DF | ATA_DRQ | +- ATA_SENSE | ATA_ERR)) { ++ ATA_ERR)) { + if (res->command & ATA_BUSY) + ata_dev_err(qc->dev, "status: { Busy }\n"); + else +- ata_dev_err(qc->dev, "status: { %s%s%s%s%s}\n", ++ ata_dev_err(qc->dev, "status: { %s%s%s%s}\n", + res->command & ATA_DRDY ? "DRDY " : "", + res->command & ATA_DF ? "DF " : "", + res->command & ATA_DRQ ? "DRQ " : "", +- res->command & ATA_SENSE ? "SENSE " : "", + res->command & ATA_ERR ? "ERR " : ""); + } + +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -385,8 +385,6 @@ enum { + SATA_SSP = 0x06, /* Software Settings Preservation */ + SATA_DEVSLP = 0x09, /* Device Sleep */ + +- SETFEATURE_SENSE_DATA = 0xC3, /* Sense Data Reporting feature */ +- + /* feature values for SET_MAX */ + ATA_SET_MAX_ADDR = 0x00, + ATA_SET_MAX_PASSWD = 0x01, +@@ -710,20 +708,6 @@ static inline bool ata_id_has_read_log_d + return id[ATA_ID_COMMAND_SET_3] & (1 << 3); + } + +-static inline bool ata_id_has_sense_reporting(const u16 *id) +-{ +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) +- return false; +- return id[ATA_ID_COMMAND_SET_3] & (1 << 6); +-} +- +-static inline bool ata_id_sense_reporting_enabled(const u16 *id) +-{ +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) +- return false; +- return id[ATA_ID_COMMAND_SET_4] & (1 << 6); +-} +- + /** + * ata_id_major_version - get ATA level of drive + * @id: Identify data diff --git a/queue-4.1/revert-x86-sigcontext-cleanups.patch b/queue-4.1/revert-x86-sigcontext-cleanups.patch new file mode 100644 index 00000000000..4d8321f522c --- /dev/null +++ b/queue-4.1/revert-x86-sigcontext-cleanups.patch @@ -0,0 +1,126 @@ +From ed596cde9425509ec6ce88e19f03e9b13b6f518b Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 13 Aug 2015 08:25:20 -0700 +Subject: Revert x86 sigcontext cleanups + +From: Linus Torvalds + +commit ed596cde9425509ec6ce88e19f03e9b13b6f518b upstream. + +This reverts commits 9a036b93a344 ("x86/signal/64: Remove 'fs' and 'gs' +from sigcontext") and c6f2062935c8 ("x86/signal/64: Fix SS handling for +signals delivered to 64-bit programs"). + +They were cleanups, but they break dosemu by changing the signal return +behavior (and removing 'fs' and 'gs' from the sigcontext struct - while +not actually changing any behavior - causes build problems). + +Reported-and-tested-by: Stas Sergeev +Acked-by: Andy Lutomirski +Cc: Ingo Molnar +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/sigcontext.h | 6 +++--- + arch/x86/include/uapi/asm/sigcontext.h | 21 +++------------------ + arch/x86/kernel/signal.c | 26 +++++++++++--------------- + 3 files changed, 17 insertions(+), 36 deletions(-) + +--- a/arch/x86/include/asm/sigcontext.h ++++ b/arch/x86/include/asm/sigcontext.h +@@ -57,9 +57,9 @@ struct sigcontext { + unsigned long ip; + unsigned long flags; + unsigned short cs; +- unsigned short __pad2; /* Was called gs, but was always zero. */ +- unsigned short __pad1; /* Was called fs, but was always zero. */ +- unsigned short ss; ++ unsigned short gs; ++ unsigned short fs; ++ unsigned short __pad0; + unsigned long err; + unsigned long trapno; + unsigned long oldmask; +--- a/arch/x86/include/uapi/asm/sigcontext.h ++++ b/arch/x86/include/uapi/asm/sigcontext.h +@@ -177,24 +177,9 @@ struct sigcontext { + __u64 rip; + __u64 eflags; /* RFLAGS */ + __u16 cs; +- +- /* +- * Prior to 2.5.64 ("[PATCH] x86-64 updates for 2.5.64-bk3"), +- * Linux saved and restored fs and gs in these slots. This +- * was counterproductive, as fsbase and gsbase were never +- * saved, so arch_prctl was presumably unreliable. +- * +- * If these slots are ever needed for any other purpose, there +- * is some risk that very old 64-bit binaries could get +- * confused. I doubt that many such binaries still work, +- * though, since the same patch in 2.5.64 also removed the +- * 64-bit set_thread_area syscall, so it appears that there is +- * no TLS API that works in both pre- and post-2.5.64 kernels. +- */ +- __u16 __pad2; /* Was gs. */ +- __u16 __pad1; /* Was fs. */ +- +- __u16 ss; ++ __u16 gs; ++ __u16 fs; ++ __u16 __pad0; + __u64 err; + __u64 trapno; + __u64 oldmask; +--- a/arch/x86/kernel/signal.c ++++ b/arch/x86/kernel/signal.c +@@ -93,8 +93,15 @@ int restore_sigcontext(struct pt_regs *r + COPY(r15); + #endif /* CONFIG_X86_64 */ + ++#ifdef CONFIG_X86_32 + COPY_SEG_CPL3(cs); + COPY_SEG_CPL3(ss); ++#else /* !CONFIG_X86_32 */ ++ /* Kernel saves and restores only the CS segment register on signals, ++ * which is the bare minimum needed to allow mixed 32/64-bit code. ++ * App's signal handler can save/restore other segments if needed. */ ++ COPY_SEG_CPL3(cs); ++#endif /* CONFIG_X86_32 */ + + get_user_ex(tmpflags, &sc->flags); + regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS); +@@ -154,9 +161,8 @@ int setup_sigcontext(struct sigcontext _ + #else /* !CONFIG_X86_32 */ + put_user_ex(regs->flags, &sc->flags); + put_user_ex(regs->cs, &sc->cs); +- put_user_ex(0, &sc->__pad2); +- put_user_ex(0, &sc->__pad1); +- put_user_ex(regs->ss, &sc->ss); ++ put_user_ex(0, &sc->gs); ++ put_user_ex(0, &sc->fs); + #endif /* CONFIG_X86_32 */ + + put_user_ex(fpstate, &sc->fpstate); +@@ -450,19 +456,9 @@ static int __setup_rt_frame(int sig, str + + regs->sp = (unsigned long)frame; + +- /* +- * Set up the CS and SS registers to run signal handlers in +- * 64-bit mode, even if the handler happens to be interrupting +- * 32-bit or 16-bit code. +- * +- * SS is subtle. In 64-bit mode, we don't need any particular +- * SS descriptor, but we do need SS to be valid. It's possible +- * that the old SS is entirely bogus -- this can happen if the +- * signal we're trying to deliver is #GP or #SS caused by a bad +- * SS value. +- */ ++ /* Set up the CS register to run signal handlers in 64-bit mode, ++ even if the handler happens to be interrupting 32-bit code. */ + regs->cs = __USER_CS; +- regs->ss = __USER_DS; + + return 0; + } diff --git a/queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch b/queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch new file mode 100644 index 00000000000..dbff0af1d7d --- /dev/null +++ b/queue-4.1/sd-fix-maximum-i-o-size-for-block_pc-requests.patch @@ -0,0 +1,59 @@ +From 4f258a46346c03fa0bbb6199ffaf4e1f9f599660 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Tue, 23 Jun 2015 12:13:59 -0400 +Subject: sd: Fix maximum I/O size for BLOCK_PC requests + +From: "Martin K. Petersen" + +commit 4f258a46346c03fa0bbb6199ffaf4e1f9f599660 upstream. + +Commit bcdb247c6b6a ("sd: Limit transfer length") clamped the maximum +size of an I/O request to the MAXIMUM TRANSFER LENGTH field in the BLOCK +LIMITS VPD. This had the unfortunate effect of also limiting the maximum +size of non-filesystem requests sent to the device through sg/bsg. + +Avoid using blk_queue_max_hw_sectors() and set the max_sectors queue +limit directly. + +Also update the comment in blk_limits_max_hw_sectors() to clarify that +max_hw_sectors defines the limit for the I/O controller only. + +Signed-off-by: Martin K. Petersen +Reported-by: Brian King +Tested-by: Brian King +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-settings.c | 4 ++-- + drivers/scsi/sd.c | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -241,8 +241,8 @@ EXPORT_SYMBOL(blk_queue_bounce_limit); + * Description: + * Enables a low level driver to set a hard upper limit, + * max_hw_sectors, on the size of requests. max_hw_sectors is set by +- * the device driver based upon the combined capabilities of I/O +- * controller and storage device. ++ * the device driver based upon the capabilities of the I/O ++ * controller. + * + * max_sectors is a soft limit imposed by the block layer for + * filesystem type requests. This value can be overridden on a +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2770,9 +2770,9 @@ static int sd_revalidate_disk(struct gen + max_xfer = sdkp->max_xfer_blocks; + max_xfer <<= ilog2(sdp->sector_size) - 9; + +- max_xfer = min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), +- max_xfer); +- blk_queue_max_hw_sectors(sdkp->disk->queue, max_xfer); ++ sdkp->disk->queue->limits.max_sectors = ++ min_not_zero(queue_max_hw_sectors(sdkp->disk->queue), max_xfer); ++ + set_capacity(disk, sdkp->capacity); + sd_config_write_same(sdkp); + kfree(buffer); diff --git a/queue-4.1/series b/queue-4.1/series index 61ae218739f..89d756ad823 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -22,3 +22,25 @@ hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch drm-radeon-add-new-oland-pci-id.patch drm-vmwgfx-fix-execbuf-locking-issues.patch +libfc-fix-fc_exch_recv_req-error-path.patch +libfc-fix-fc_fcp_cleanup_each_cmd.patch +arm-imx6-correct-i.mx6-pcie-interrupt-routing.patch +arm-dts-omap243x-fix-broken-pbias-device-creation.patch +arm-dts-dra7-fix-broken-pbias-device-creation.patch +arm-dts-omap4-fix-broken-pbias-device-creation.patch +arm-dts-omap5-fix-broken-pbias-device-creation.patch +arm-8385-1-vdso-group-link-options.patch +arm-8384-1-vdso-force-use-of-bfd-linker.patch +arm-v7-setup-function-should-invalidate-l1-cache.patch +arm-invalidate-l1-before-enabling-coherency.patch +mfd-arizona-fix-initialisation-of-the-pm-runtime.patch +revert-x86-sigcontext-cleanups.patch +regmap-regcache-rbtree-clean-new-present-bits-on-present-bitmap-resize.patch +mips-fix-seccomp-syscall-argument-for-mips64.patch +libiscsi-fix-host-busy-blocking-during-connection-teardown.patch +sd-fix-maximum-i-o-size-for-block_pc-requests.patch +crypto-nx-respect-sg-limit-bounds-when-building-sg-lists-for-sha.patch +crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch +revert-libata-eh-set-information-field-for-autosense.patch +revert-libata-implement-support-for-sense-data-reporting.patch +revert-libata-implement-ncq-autosense.patch