From: Greg Kroah-Hartman Date: Thu, 4 Dec 2014 23:53:01 +0000 (-0800) Subject: 3.17-stable patches X-Git-Tag: v3.10.62~16 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=33706f3beb88939cb357e1c83ef5610262d02e85;p=thirdparty%2Fkernel%2Fstable-queue.git 3.17-stable patches added patches: acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch arm-8222-1-mvebu-enable-strex-backoff-delay.patch arm-8226-1-cacheflush-get-rid-of-restarting-block.patch arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch dmaengine-sun6i-fix-memcpy-operation.patch hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch input-synaptics-adjust-min-max-on-thinkpad-e540.patch input-xpad-use-proper-endpoint-type.patch iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch iwlwifi-pcie-fix-prph-dump-length.patch ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch net-ping-handle-protocol-mismatching-scenario.patch nfsd-correctly-define-v4.2-support-attributes.patch nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch of-fix-crash-if-an-earlycon-driver-is-not-found.patch of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch of-selftest-fix-off-by-one-error-in-removal-path.patch revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch rt2x00-do-not-align-payload-on-modern-h-w.patch scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch spi-dw-fix-dynamic-speed-change.patch spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch spi-sirf-fix-word-width-configuration.patch srp-target-retry-when-qp-creation-fails-with-enomem.patch target-don-t-call-tfo-write_pending-if-data_length-0.patch vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch --- diff --git a/queue-3.17/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch b/queue-3.17/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch new file mode 100644 index 00000000000..a0c3512149a --- /dev/null +++ b/queue-3.17/acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch @@ -0,0 +1,53 @@ +From 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Thu, 21 Aug 2014 14:41:26 +0800 +Subject: ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC + +From: Lv Zheng + +commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream. + +There is platform refusing to respond QR_EC when SCI_EVT isn't set +which is Acer Aspire V5-573G. + +By disallowing QR_EC to be issued before the previous one has been +completed we are able to reduce the possibilities to trigger issues on +such platforms. + +Note that this fix can only reduce the occurrence rate of this issue, but +this issue may still occur when such a platform doesn't clear SCI_EVT +before or immediately after completing the previous QR_EC transaction. +This patch cannot fix the CLEAR_ON_RESUME quirk which also relies on +the assumption that the platforms are able to respond even when SCI_EVT +isn't set. + +But this patch is still useful as it can help to reduce the number of +scheduled QR_EC work items. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611 +Reported-and-tested-by: Alexander Mezin +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/acpi/ec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -299,11 +299,11 @@ static int acpi_ec_transaction_unlocked( + /* following two actions should be kept atomic */ + ec->curr = t; + start_transaction(ec); ++ if (ec->curr->command == ACPI_EC_COMMAND_QUERY) ++ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); + spin_unlock_irqrestore(&ec->lock, tmp); + ret = ec_poll(ec); + spin_lock_irqsave(&ec->lock, tmp); +- if (ec->curr->command == ACPI_EC_COMMAND_QUERY) +- clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags); + ec->curr = NULL; + spin_unlock_irqrestore(&ec->lock, tmp); + return ret; diff --git a/queue-3.17/acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch b/queue-3.17/acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch new file mode 100644 index 00000000000..3e820db8e79 --- /dev/null +++ b/queue-3.17/acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch @@ -0,0 +1,52 @@ +From 78579b7c7eb45f0e7ec5e9437087ed21749f9a9c Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 19 Nov 2014 01:44:11 +0100 +Subject: ACPI / PM: Ignore wakeup setting if the ACPI companion can't wake up + +From: "Rafael J. Wysocki" + +commit 78579b7c7eb45f0e7ec5e9437087ed21749f9a9c upstream. + +As reported by Dmitry, on some Chromebooks there are devices with +corresponding ACPI objects and with unusual system wakeup +configuration. Namely, they technically are wakeup-capable, but the +wakeup is handled via a platform-specific out-of-band mechanism and +the ACPI PM layer has no information on the wakeup capability. As +a result, device_may_wakeup(dev) called from acpi_dev_suspend_late() +returns 'true' for those devices, but the wakeup.flags.valid flag is +unset for the corresponding ACPI device objects, so acpi_device_wakeup() +reproducibly fails for them causing acpi_dev_suspend_late() to return +an error code. The entire system suspend is then aborted and the +machines in question cannot suspend at all. + +Address the problem by ignoring the device_may_wakeup(dev) return +value in acpi_dev_suspend_late() if the ACPI companion of the device +being handled has wakeup.flags.valid unset (in which case it is clear +that the wakeup is supposed to be handled by other means). + +This fixes a regression introduced by commit a76e9bd89ae7 (i2c: +attach/detach I2C client device to the ACPI power domain) as the +affected systems could suspend and resume successfully before that +commit. + +Fixes: a76e9bd89ae7 (i2c: attach/detach I2C client device to the ACPI power domain) +Reported-by: Dmitry Torokhov +Reviewed-by: Dmitry Torokhov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -877,7 +877,7 @@ int acpi_dev_suspend_late(struct device + return 0; + + target_state = acpi_target_system_state(); +- wakeup = device_may_wakeup(dev); ++ wakeup = device_may_wakeup(dev) && acpi_device_can_wakeup(adev); + error = acpi_device_wakeup(adev, target_state, wakeup); + if (wakeup && error) + return error; diff --git a/queue-3.17/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch b/queue-3.17/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch new file mode 100644 index 00000000000..bbb98042362 --- /dev/null +++ b/queue-3.17/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch @@ -0,0 +1,51 @@ +From ef59a20ba375aeb97b3150a118318884743452a8 Mon Sep 17 00:00:00 2001 +From: Dmitry Eremin-Solenikov +Date: Fri, 21 Nov 2014 15:29:00 +0100 +Subject: ARM: 8216/1: xscale: correct auxiliary register in suspend/resume + +From: Dmitry Eremin-Solenikov + +commit ef59a20ba375aeb97b3150a118318884743452a8 upstream. + +According to the manuals I have, XScale auxiliary register should be +reached with opc_2 = 1 instead of crn = 1. cpu_xscale_proc_init +correctly uses c1, c0, 1 arguments, but cpu_xscale_do_suspend and +cpu_xscale_do_resume use c1, c1, 0. Correct suspend/resume functions to +also use c1, c0, 1. + +The issue was primarily noticed thanks to qemu reporing "unsupported +instruction" on the pxa suspend path. Confirmed in PXA210/250 and PXA255 +XScale Core manuals and in PXA270 and PXA320 Developers Guides. + +Harware tested by me on tosa (pxa255). Robert confirmed on pxa270 board. + +Tested-by: Robert Jarzmik +Signed-off-by: Dmitry Eremin-Solenikov +Acked-by: Robert Jarzmik +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/proc-xscale.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mm/proc-xscale.S ++++ b/arch/arm/mm/proc-xscale.S +@@ -535,7 +535,7 @@ ENTRY(cpu_xscale_do_suspend) + mrc p15, 0, r5, c15, c1, 0 @ CP access reg + mrc p15, 0, r6, c13, c0, 0 @ PID + mrc p15, 0, r7, c3, c0, 0 @ domain ID +- mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg ++ mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg + mrc p15, 0, r9, c1, c0, 0 @ control reg + bic r4, r4, #2 @ clear frequency change bit + stmia r0, {r4 - r9} @ store cp regs +@@ -552,7 +552,7 @@ ENTRY(cpu_xscale_do_resume) + mcr p15, 0, r6, c13, c0, 0 @ PID + mcr p15, 0, r7, c3, c0, 0 @ domain ID + mcr p15, 0, r1, c2, c0, 0 @ translation table base addr +- mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg ++ mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg + mov r0, r9 @ control register + b cpu_resume_mmu + ENDPROC(cpu_xscale_do_resume) diff --git a/queue-3.17/arm-8222-1-mvebu-enable-strex-backoff-delay.patch b/queue-3.17/arm-8222-1-mvebu-enable-strex-backoff-delay.patch new file mode 100644 index 00000000000..8363e3e9fa3 --- /dev/null +++ b/queue-3.17/arm-8222-1-mvebu-enable-strex-backoff-delay.patch @@ -0,0 +1,55 @@ +From 995ab5189d1d7264e79e665dfa032a19b3ac646e Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Tue, 25 Nov 2014 18:43:15 +0100 +Subject: ARM: 8222/1: mvebu: enable strex backoff delay + +From: Thomas Petazzoni + +commit 995ab5189d1d7264e79e665dfa032a19b3ac646e upstream. + +Under extremely rare conditions, in an MPCore node consisting of at +least 3 CPUs, two CPUs trying to perform a STREX to data on the same +shared cache line can enter a livelock situation. + +This patch enables the HW mechanism that overcomes the bug. This fixes +the incorrect setup of the STREX backoff delay bit due to a wrong +description in the specification. + +Note that enabling the STREX backoff delay mechanism is done by +leaving the bit *cleared*, while the bit was currently being set by +the proc-v7.S code. + +[Thomas: adapt to latest mainline, slightly reword the commit log, add +stable markers.] + +Fixes: de4901933f6d ("arm: mm: Add support for PJ4B cpu and init routines") + +Signed-off-by: Nadav Haklai +Signed-off-by: Thomas Petazzoni +Acked-by: Gregory CLEMENT +Acked-by: Jason Cooper +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/proc-v7.S | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -270,7 +270,6 @@ __v7_pj4b_setup: + /* Auxiliary Debug Modes Control 1 Register */ + #define PJ4B_STATIC_BP (1 << 2) /* Enable Static BP */ + #define PJ4B_INTER_PARITY (1 << 8) /* Disable Internal Parity Handling */ +-#define PJ4B_BCK_OFF_STREX (1 << 5) /* Enable the back off of STREX instr */ + #define PJ4B_CLEAN_LINE (1 << 16) /* Disable data transfer for clean line */ + + /* Auxiliary Debug Modes Control 2 Register */ +@@ -293,7 +292,6 @@ __v7_pj4b_setup: + /* Auxiliary Debug Modes Control 1 Register */ + mrc p15, 1, r0, c15, c1, 1 + orr r0, r0, #PJ4B_CLEAN_LINE +- orr r0, r0, #PJ4B_BCK_OFF_STREX + orr r0, r0, #PJ4B_INTER_PARITY + bic r0, r0, #PJ4B_STATIC_BP + mcr p15, 1, r0, c15, c1, 1 diff --git a/queue-3.17/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch b/queue-3.17/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch new file mode 100644 index 00000000000..16433f1dc4e --- /dev/null +++ b/queue-3.17/arm-8226-1-cacheflush-get-rid-of-restarting-block.patch @@ -0,0 +1,113 @@ +From 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 Mon Sep 17 00:00:00 2001 +From: Vladimir Murzin +Date: Thu, 27 Nov 2014 11:39:04 +0100 +Subject: ARM: 8226/1: cacheflush: get rid of restarting block + +From: Vladimir Murzin + +commit 3f4aa45ceea5789a4aade536acc27f2e0d3da5e1 upstream. + +We cannot restart cacheflush safely if a process provides user-defined +signal handler and signal is pending. In this case -EINTR is returned +and it is expected that process re-invokes syscall. However, there are +a few problems with that: + * looks like nobody bothers checking return value from cacheflush + * but if it did, we don't provide the restart address for that, so the + process has to use the same range again + * ...and again, what might lead to looping forever + +So, remove cacheflush restarting code and terminate cache flushing +as early as fatal signal is pending. + +Reported-by: Chanho Min +Signed-off-by: Vladimir Murzin +Acked-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/thread_info.h | 11 ----------- + arch/arm/kernel/traps.c | 31 ++----------------------------- + 2 files changed, 2 insertions(+), 40 deletions(-) + +--- a/arch/arm/include/asm/thread_info.h ++++ b/arch/arm/include/asm/thread_info.h +@@ -44,16 +44,6 @@ struct cpu_context_save { + __u32 extra[2]; /* Xscale 'acc' register, etc */ + }; + +-struct arm_restart_block { +- union { +- /* For user cache flushing */ +- struct { +- unsigned long start; +- unsigned long end; +- } cache; +- }; +-}; +- + /* + * low level task data that entry.S needs immediate access to. + * __switch_to() assumes cpu_context follows immediately after cpu_domain. +@@ -79,7 +69,6 @@ struct thread_info { + unsigned long thumbee_state; /* ThumbEE Handler Base register */ + #endif + struct restart_block restart_block; +- struct arm_restart_block arm_restart_block; + }; + + #define INIT_THREAD_INFO(tsk) \ +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -513,8 +513,6 @@ static int bad_syscall(int n, struct pt_ + return regs->ARM_r0; + } + +-static long do_cache_op_restart(struct restart_block *); +- + static inline int + __do_cache_op(unsigned long start, unsigned long end) + { +@@ -523,24 +521,8 @@ __do_cache_op(unsigned long start, unsig + do { + unsigned long chunk = min(PAGE_SIZE, end - start); + +- if (signal_pending(current)) { +- struct thread_info *ti = current_thread_info(); +- +- ti->restart_block = (struct restart_block) { +- .fn = do_cache_op_restart, +- }; +- +- ti->arm_restart_block = (struct arm_restart_block) { +- { +- .cache = { +- .start = start, +- .end = end, +- }, +- }, +- }; +- +- return -ERESTART_RESTARTBLOCK; +- } ++ if (fatal_signal_pending(current)) ++ return 0; + + ret = flush_cache_user_range(start, start + chunk); + if (ret) +@@ -553,15 +535,6 @@ __do_cache_op(unsigned long start, unsig + return 0; + } + +-static long do_cache_op_restart(struct restart_block *unused) +-{ +- struct arm_restart_block *restart_block; +- +- restart_block = ¤t_thread_info()->arm_restart_block; +- return __do_cache_op(restart_block->cache.start, +- restart_block->cache.end); +-} +- + static inline int + do_cache_op(unsigned long start, unsigned long end, int flags) + { diff --git a/queue-3.17/arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch b/queue-3.17/arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch new file mode 100644 index 00000000000..00eeb6c9570 --- /dev/null +++ b/queue-3.17/arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch @@ -0,0 +1,34 @@ +From 2eb04ae010a8fb165ba7aa56e9aa8e7980887dee Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Mon, 27 Oct 2014 16:32:35 +0100 +Subject: ARM: mvebu: add missing of_node_put() call in coherency.c + +From: Thomas Petazzoni + +commit 2eb04ae010a8fb165ba7aa56e9aa8e7980887dee upstream. + +There is a missing of_node_put() to decrement the device_node +reference counter after a of_find_matching_node() in coherency_init(). + +Fixes: 501f928e0097 ("ARM: mvebu: add a coherency_available() call") +Signed-off-by: Thomas Petazzoni +Acked-by: Gregory CLEMENT +Link: https://lkml.kernel.org/r/1414423955-5933-4-git-send-email-thomas.petazzoni@free-electrons.com +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-mvebu/coherency.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/mach-mvebu/coherency.c ++++ b/arch/arm/mach-mvebu/coherency.c +@@ -400,6 +400,8 @@ int __init coherency_init(void) + type == COHERENCY_FABRIC_TYPE_ARMADA_380) + armada_375_380_coherency_init(np); + ++ of_node_put(np); ++ + return 0; + } + diff --git a/queue-3.17/brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch b/queue-3.17/brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch new file mode 100644 index 00000000000..f39e8c0907a --- /dev/null +++ b/queue-3.17/brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch @@ -0,0 +1,42 @@ +From a1d69c60c44134f64945bbf6a6dfda22eaf4a214 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 19 Nov 2014 22:13:10 +0100 +Subject: brcmfmac: don't include linux/unaligned/access_ok.h + +From: Johannes Berg + +commit a1d69c60c44134f64945bbf6a6dfda22eaf4a214 upstream. + +This is a specific implementation, is the +multiplexer that has the arch-specific knowledge of which +of the implementations needs to be used, so include that. + +This issue was revealed by kbuild testing +when was added in +resulting in redefinition of get_unaligned_be16 (and +probably others). + +Reported-by: Fengguang Wu +Signed-off-by: Johannes Berg +Signed-off-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/pcie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c +@@ -19,10 +19,10 @@ + #include + #include + #include +-#include + #include + #include + #include ++#include + + #include + #include diff --git a/queue-3.17/brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch b/queue-3.17/brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch new file mode 100644 index 00000000000..e918f41a90d --- /dev/null +++ b/queue-3.17/brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch @@ -0,0 +1,81 @@ +From 0cd75b19899fd86b51a6480fb8c00dcd85a54591 Mon Sep 17 00:00:00 2001 +From: Arend van Spriel +Date: Tue, 11 Nov 2014 13:58:44 +0100 +Subject: brcmfmac: fix conversion of channel width 20MHZ_NOHT + +From: Arend van Spriel + +commit 0cd75b19899fd86b51a6480fb8c00dcd85a54591 upstream. + +The function chandef_to_chanspec() failed when converting a +chandef with bandwidth set to NL80211_CHAN_WIDTH_20_NOHT. This +was reported by user running the device in AP mode. + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 304 at + drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c:381 + chandef_to_chanspec.isra.11+0x158/0x184() + +Modules linked in: + +CPU: 0 PID: 304 Comm: hostapd Not tainted 3.16.0-rc7-abb+g64aa90f #8 + +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (warn_slowpath_common+0x6c/0x8c) +[] (warn_slowpath_common) from [] (warn_slowpath_null+0x1c/0x24) +[] (warn_slowpath_null) from [] (chandef_to_chanspec.isra.11+0x158/0x184) +[] (chandef_to_chanspec.isra.11) from [] (brcmf_cfg80211_start_ap+0x1e4/0x614) +[] (brcmf_cfg80211_start_ap) from [] (nl80211_start_ap+0x288/0x414) +[] (nl80211_start_ap) from [] (genl_rcv_msg+0x21c/0x38c) +[] (genl_rcv_msg) from [] (netlink_rcv_skb+0xac/0xc0) +[] (netlink_rcv_skb) from [] (genl_rcv+0x20/0x34) +[] (genl_rcv) from [] (netlink_unicast+0x150/0x20c) +[] (netlink_unicast) from [] (netlink_sendmsg+0x2b8/0x398) +[] (netlink_sendmsg) from [] (sock_sendmsg+0x84/0xa8) +[] (sock_sendmsg) from [] (___sys_sendmsg.part.29+0x268/0x278) +[] (___sys_sendmsg.part.29) from [] (__sys_sendmsg+0x4c/0x7c) +[] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x44) +---[ end trace 965ee2158c9905a2 ]--- + +Reported-by: Pontus Fuchs +Reviewed-by: Hante Meuleman +Reviewed-by: Daniel (Deognyoun) Kim +Reviewed-by: Franky (Zhenhui) Lin +Reviewed-by: Pieter-Paul Giesberts +Signed-off-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +@@ -298,6 +298,7 @@ static u16 chandef_to_chanspec(struct br + primary_offset = ch->center_freq1 - ch->chan->center_freq; + switch (ch->width) { + case NL80211_CHAN_WIDTH_20: ++ case NL80211_CHAN_WIDTH_20_NOHT: + ch_inf.bw = BRCMU_CHAN_BW_20; + WARN_ON(primary_offset != 0); + break; +@@ -322,6 +323,10 @@ static u16 chandef_to_chanspec(struct br + ch_inf.sb = BRCMU_CHAN_SB_LU; + } + break; ++ case NL80211_CHAN_WIDTH_80P80: ++ case NL80211_CHAN_WIDTH_160: ++ case NL80211_CHAN_WIDTH_5: ++ case NL80211_CHAN_WIDTH_10: + default: + WARN_ON_ONCE(1); + } +@@ -332,6 +337,7 @@ static u16 chandef_to_chanspec(struct br + case IEEE80211_BAND_5GHZ: + ch_inf.band = BRCMU_CHAN_BAND_5G; + break; ++ case IEEE80211_BAND_60GHZ: + default: + WARN_ON_ONCE(1); + } diff --git a/queue-3.17/brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch b/queue-3.17/brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch new file mode 100644 index 00000000000..19780e151b9 --- /dev/null +++ b/queue-3.17/brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch @@ -0,0 +1,34 @@ +From 4c69f05eaa428e37890daf88b86a567ce615570b Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 14 Nov 2014 14:12:21 -0800 +Subject: brcmfmac: fix error handling of irq_of_parse_and_map + +From: Dmitry Torokhov + +commit 4c69f05eaa428e37890daf88b86a567ce615570b upstream. + +Return value of irq_of_parse_and_map() is unsigned int, with 0 +indicating failure, so testing for negative result never works. + +Signed-off-by: Dmitry Torokhov +Acked-by: Arend van Spriel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/brcm80211/brcmfmac/of.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c +@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_de + return; + + irq = irq_of_parse_and_map(np, 0); +- if (irq < 0) { +- brcmf_err("interrupt could not be mapped: err=%d\n", irq); ++ if (!irq) { ++ brcmf_err("interrupt could not be mapped\n"); + devm_kfree(dev, sdiodev->pdata); + return; + } diff --git a/queue-3.17/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch b/queue-3.17/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch new file mode 100644 index 00000000000..041f63358df --- /dev/null +++ b/queue-3.17/can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch @@ -0,0 +1,72 @@ +From 5247a589c24022ab34e780039cc8000c48f2035e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20K=C3=B6rper?= +Date: Fri, 31 Oct 2014 07:33:54 +0100 +Subject: can: dev: avoid calling kfree_skb() from interrupt context +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Thomas=20K=C3=B6rper?= + +commit 5247a589c24022ab34e780039cc8000c48f2035e upstream. + +ikfree_skb() is Called in can_free_echo_skb(), which might be called from (TX +Error) interrupt, which triggers the folloing warning: + +[ 1153.360705] ------------[ cut here ]------------ +[ 1153.360715] WARNING: CPU: 0 PID: 31 at net/core/skbuff.c:563 skb_release_head_state+0xb9/0xd0() +[ 1153.360772] Call Trace: +[ 1153.360778] [] dump_stack+0x41/0x52 +[ 1153.360782] [] warn_slowpath_common+0x7e/0xa0 +[ 1153.360784] [] ? skb_release_head_state+0xb9/0xd0 +[ 1153.360786] [] ? skb_release_head_state+0xb9/0xd0 +[ 1153.360788] [] warn_slowpath_null+0x22/0x30 +[ 1153.360791] [] skb_release_head_state+0xb9/0xd0 +[ 1153.360793] [] skb_release_all+0x10/0x30 +[ 1153.360795] [] kfree_skb+0x36/0x80 +[ 1153.360799] [] ? can_free_echo_skb+0x28/0x40 [can_dev] +[ 1153.360802] [] can_free_echo_skb+0x28/0x40 [can_dev] +[ 1153.360805] [] esd_pci402_interrupt+0x34c/0x57a [esd402] +[ 1153.360809] [] handle_irq_event_percpu+0x35/0x180 +[ 1153.360811] [] ? handle_irq_event_percpu+0xa3/0x180 +[ 1153.360813] [] handle_irq_event+0x31/0x50 +[ 1153.360816] [] handle_fasteoi_irq+0x6f/0x120 +[ 1153.360818] [] ? handle_edge_irq+0x110/0x110 +[ 1153.360822] [] handle_irq+0x71/0x90 +[ 1153.360823] [] do_IRQ+0x3c/0xd0 +[ 1153.360829] [] common_interrupt+0x2c/0x34 +[ 1153.360834] [] ? finish_task_switch+0x47/0xf0 +[ 1153.360836] [] __schedule+0x35b/0x7e0 +[ 1153.360839] [] ? console_unlock+0x2c4/0x4d0 +[ 1153.360842] [] ? n_tty_receive_buf_common+0x890/0x890 +[ 1153.360845] [] ? process_one_work+0x196/0x370 +[ 1153.360847] [] schedule+0x23/0x60 +[ 1153.360849] [] worker_thread+0x161/0x460 +[ 1153.360852] [] ? __wake_up_locked+0x1f/0x30 +[ 1153.360854] [] ? rescuer_thread+0x2f0/0x2f0 +[ 1153.360856] [] kthread+0xa1/0xc0 +[ 1153.360859] [] ret_from_kernel_thread+0x21/0x30 +[ 1153.360861] [] ? kthread_create_on_node+0x110/0x110 +[ 1153.360863] ---[ end trace 5ff83639cbb74b35 ]--- + +This patch replaces the kfree_skb() by dev_kfree_skb_any(). + +Signed-off-by: Thomas Körper +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -383,7 +383,7 @@ void can_free_echo_skb(struct net_device + BUG_ON(idx >= priv->echo_skb_max); + + if (priv->echo_skb[idx]) { +- kfree_skb(priv->echo_skb[idx]); ++ dev_kfree_skb_any(priv->echo_skb[idx]); + priv->echo_skb[idx] = NULL; + } + } diff --git a/queue-3.17/dmaengine-sun6i-fix-memcpy-operation.patch b/queue-3.17/dmaengine-sun6i-fix-memcpy-operation.patch new file mode 100644 index 00000000000..f86ce1a9f34 --- /dev/null +++ b/queue-3.17/dmaengine-sun6i-fix-memcpy-operation.patch @@ -0,0 +1,159 @@ +From 1f9cd915b64bb95f7b41667b4bf8b22f0a0a557b Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Tue, 11 Nov 2014 19:35:52 +0100 +Subject: dmaengine: sun6i: Fix memcpy operation + +From: Maxime Ripard + +commit 1f9cd915b64bb95f7b41667b4bf8b22f0a0a557b upstream. + +The prep_memcpy call was not setting any meaningful burst and width because it +was relying on the dma_slave_config was not set already. + +Rework the needed conversion functions, and hardcode the width and burst to +use. + +Signed-off-by: Maxime Ripard +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/sun6i-dma.c | 67 +++++++++++++++++++++++------------------------- + 1 file changed, 33 insertions(+), 34 deletions(-) + +--- a/drivers/dma/sun6i-dma.c ++++ b/drivers/dma/sun6i-dma.c +@@ -230,30 +230,25 @@ static inline void sun6i_dma_dump_chan_r + readl(pchan->base + DMA_CHAN_CUR_PARA)); + } + +-static inline int convert_burst(u32 maxburst, u8 *burst) ++static inline s8 convert_burst(u32 maxburst) + { + switch (maxburst) { + case 1: +- *burst = 0; +- break; ++ return 0; + case 8: +- *burst = 2; +- break; ++ return 2; + default: + return -EINVAL; + } +- +- return 0; + } + +-static inline int convert_buswidth(enum dma_slave_buswidth addr_width, u8 *width) ++static inline s8 convert_buswidth(enum dma_slave_buswidth addr_width) + { + if ((addr_width < DMA_SLAVE_BUSWIDTH_1_BYTE) || + (addr_width > DMA_SLAVE_BUSWIDTH_4_BYTES)) + return -EINVAL; + +- *width = addr_width >> 1; +- return 0; ++ return addr_width >> 1; + } + + static void *sun6i_dma_lli_add(struct sun6i_dma_lli *prev, +@@ -284,26 +279,25 @@ static inline int sun6i_dma_cfg_lli(stru + struct dma_slave_config *config) + { + u8 src_width, dst_width, src_burst, dst_burst; +- int ret; + + if (!config) + return -EINVAL; + +- ret = convert_burst(config->src_maxburst, &src_burst); +- if (ret) +- return ret; +- +- ret = convert_burst(config->dst_maxburst, &dst_burst); +- if (ret) +- return ret; +- +- ret = convert_buswidth(config->src_addr_width, &src_width); +- if (ret) +- return ret; +- +- ret = convert_buswidth(config->dst_addr_width, &dst_width); +- if (ret) +- return ret; ++ src_burst = convert_burst(config->src_maxburst); ++ if (src_burst) ++ return src_burst; ++ ++ dst_burst = convert_burst(config->dst_maxburst); ++ if (dst_burst) ++ return dst_burst; ++ ++ src_width = convert_buswidth(config->src_addr_width); ++ if (src_width) ++ return src_width; ++ ++ dst_width = convert_buswidth(config->dst_addr_width); ++ if (dst_width) ++ return dst_width; + + lli->cfg = DMA_CHAN_CFG_SRC_BURST(src_burst) | + DMA_CHAN_CFG_SRC_WIDTH(src_width) | +@@ -542,11 +536,10 @@ static struct dma_async_tx_descriptor *s + { + struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device); + struct sun6i_vchan *vchan = to_sun6i_vchan(chan); +- struct dma_slave_config *sconfig = &vchan->cfg; + struct sun6i_dma_lli *v_lli; + struct sun6i_desc *txd; + dma_addr_t p_lli; +- int ret; ++ s8 burst, width; + + dev_dbg(chan2dev(chan), + "%s; chan: %d, dest: %pad, src: %pad, len: %zu. flags: 0x%08lx\n", +@@ -565,14 +558,21 @@ static struct dma_async_tx_descriptor *s + goto err_txd_free; + } + +- ret = sun6i_dma_cfg_lli(v_lli, src, dest, len, sconfig); +- if (ret) +- goto err_dma_free; ++ v_lli->src = src; ++ v_lli->dst = dest; ++ v_lli->len = len; ++ v_lli->para = NORMAL_WAIT; + ++ burst = convert_burst(8); ++ width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES); + v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) | + DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) | + DMA_CHAN_CFG_DST_LINEAR_MODE | +- DMA_CHAN_CFG_SRC_LINEAR_MODE; ++ DMA_CHAN_CFG_SRC_LINEAR_MODE | ++ DMA_CHAN_CFG_SRC_BURST(burst) | ++ DMA_CHAN_CFG_SRC_WIDTH(width) | ++ DMA_CHAN_CFG_DST_BURST(burst) | ++ DMA_CHAN_CFG_DST_WIDTH(width); + + sun6i_dma_lli_add(NULL, v_lli, p_lli, txd); + +@@ -580,8 +580,6 @@ static struct dma_async_tx_descriptor *s + + return vchan_tx_prep(&vchan->vc, &txd->vd, flags); + +-err_dma_free: +- dma_pool_free(sdev->pool, v_lli, p_lli); + err_txd_free: + kfree(txd); + return NULL; +@@ -938,6 +936,7 @@ static int sun6i_dma_probe(struct platfo + sdc->slave.device_prep_dma_memcpy = sun6i_dma_prep_dma_memcpy; + sdc->slave.device_control = sun6i_dma_control; + sdc->slave.chancnt = NR_MAX_VCHANS; ++ sdc->slave.copy_align = 4; + + sdc->slave.dev = &pdev->dev; + diff --git a/queue-3.17/hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch b/queue-3.17/hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch new file mode 100644 index 00000000000..df89b12f39e --- /dev/null +++ b/queue-3.17/hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch @@ -0,0 +1,45 @@ +From 6b19b66013cfe608d63f0dab38834bbaceb0217a Mon Sep 17 00:00:00 2001 +From: Arnaud Ebalard +Date: Wed, 19 Nov 2014 22:52:36 +0100 +Subject: hwmon: (g762) fix call to devm_hwmon_device_register_with_groups() + +From: Arnaud Ebalard + +commit 6b19b66013cfe608d63f0dab38834bbaceb0217a upstream. + +g762_remove() needs to first call hwmon_device_unregister() and then +g762_of_clock_disable(). For that reason, it is not possible to +convert it to devm_hwmon_device_register_with_groups() and the +the non device managed version must be used. + +This is correctly stated in commit message for 398e16db6262 ("hwmon: +(g762) Convert to hwmon_device_register_with_groups") but the +associated changes do in fact introduce a call to the device managed +version of the function. + +This patch fixes that typo by switching to the non devm_ version. + +Fixes: 398e16db6262 ("hwmon: (g762) Convert to hwmon_device_register_with_groups") +Signed-off-by: Arnaud Ebalard +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/g762.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/g762.c ++++ b/drivers/hwmon/g762.c +@@ -1084,10 +1084,8 @@ static int g762_probe(struct i2c_client + if (ret) + goto clock_dis; + +- data->hwmon_dev = devm_hwmon_device_register_with_groups(dev, +- client->name, +- data, +- g762_groups); ++ data->hwmon_dev = hwmon_device_register_with_groups(dev, client->name, ++ data, g762_groups); + if (IS_ERR(data->hwmon_dev)) { + ret = PTR_ERR(data->hwmon_dev); + goto clock_dis; diff --git a/queue-3.17/input-synaptics-adjust-min-max-on-thinkpad-e540.patch b/queue-3.17/input-synaptics-adjust-min-max-on-thinkpad-e540.patch new file mode 100644 index 00000000000..eb03d873af1 --- /dev/null +++ b/queue-3.17/input-synaptics-adjust-min-max-on-thinkpad-e540.patch @@ -0,0 +1,40 @@ +From bce4f9e764c36bc35dd5c9cf9e057c09f422397d Mon Sep 17 00:00:00 2001 +From: Ben Sagal +Date: Sun, 16 Nov 2014 17:23:40 -0800 +Subject: Input: synaptics - adjust min/max on Thinkpad E540 + +From: Ben Sagal + +commit bce4f9e764c36bc35dd5c9cf9e057c09f422397d upstream. + +The LEN2006 Synaptics touchpad (as found in Thinkpad E540) returns wrong +min max values. + +touchpad-edge-detector output: +> Touchpad SynPS/2 Synaptics TouchPad on /dev/input/event6 +> Move one finger around the touchpad to detect the actual edges +> Kernel says: x [1472..5674], y [1408..4684] +> Touchpad sends: x [1264..5675], y [1171..4688] + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88211 +Signed-off-by: Binyamin Sagal +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -143,6 +143,10 @@ static const struct min_max_quirk min_ma + (const char * const []){"LEN2001", NULL}, + 1024, 5022, 2508, 4832 + }, ++ { ++ (const char * const []){"LEN2006", NULL}, ++ 1264, 5675, 1171, 4688 ++ }, + { } + }; + diff --git a/queue-3.17/input-xpad-use-proper-endpoint-type.patch b/queue-3.17/input-xpad-use-proper-endpoint-type.patch new file mode 100644 index 00000000000..20201a81cc2 --- /dev/null +++ b/queue-3.17/input-xpad-use-proper-endpoint-type.patch @@ -0,0 +1,50 @@ +From a1f9a4072655843fc03186acbad65990cc05dd2d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 25 Nov 2014 00:38:17 -0800 +Subject: Input: xpad - use proper endpoint type + +From: Greg Kroah-Hartman + +commit a1f9a4072655843fc03186acbad65990cc05dd2d upstream. + +The xpad wireless endpoint is not a bulk endpoint on my devices, but +rather an interrupt one, so the USB core complains when it is submitted. +I'm guessing that the author really did mean that this should be an +interrupt urb, but as there are a zillion different xpad devices out +there, let's cover out bases and handle both bulk and interrupt +endpoints just as easily. + +Signed-off-by: "Pierre-Loup A. Griffais" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/xpad.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -1143,9 +1143,19 @@ static int xpad_probe(struct usb_interfa + } + + ep_irq_in = &intf->cur_altsetting->endpoint[1].desc; +- usb_fill_bulk_urb(xpad->bulk_out, udev, +- usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress), +- xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad); ++ if (usb_endpoint_is_bulk_out(ep_irq_in)) { ++ usb_fill_bulk_urb(xpad->bulk_out, udev, ++ usb_sndbulkpipe(udev, ++ ep_irq_in->bEndpointAddress), ++ xpad->bdata, XPAD_PKT_LEN, ++ xpad_bulk_out, xpad); ++ } else { ++ usb_fill_int_urb(xpad->bulk_out, udev, ++ usb_sndintpipe(udev, ++ ep_irq_in->bEndpointAddress), ++ xpad->bdata, XPAD_PKT_LEN, ++ xpad_bulk_out, xpad, 0); ++ } + + /* + * Submit the int URB immediately rather than waiting for open diff --git a/queue-3.17/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch b/queue-3.17/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch new file mode 100644 index 00000000000..fd294d87767 --- /dev/null +++ b/queue-3.17/iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch @@ -0,0 +1,96 @@ +From 3b726ae2de02a406cc91903f80132daee37b6f1b Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Tue, 28 Oct 2014 13:45:03 -0700 +Subject: iser-target: Handle DEVICE_REMOVAL event on network portal listener correctly + +From: Sagi Grimberg + +commit 3b726ae2de02a406cc91903f80132daee37b6f1b upstream. + +In this case the cm_id->context is the isert_np, and the cm_id->qp +is NULL, so use that to distinct the cases. + +Since we don't expect any other events on this cm_id we can +just return -1 for explicit termination of the cm_id by the +cma layer. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/isert/ib_isert.c | 29 +++++++++++++++++++---------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -810,14 +810,25 @@ wake_up: + complete(&isert_conn->conn_wait); + } + +-static void ++static int + isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect) + { +- struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context; ++ struct isert_conn *isert_conn; ++ ++ if (!cma_id->qp) { ++ struct isert_np *isert_np = cma_id->context; ++ ++ isert_np->np_cm_id = NULL; ++ return -1; ++ } ++ ++ isert_conn = (struct isert_conn *)cma_id->context; + + isert_conn->disconnect = disconnect; + INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work); + schedule_work(&isert_conn->conn_logout_work); ++ ++ return 0; + } + + static int +@@ -832,6 +843,9 @@ isert_cma_handler(struct rdma_cm_id *cma + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: + ret = isert_connect_request(cma_id, event); ++ if (ret) ++ pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n", ++ event->event, ret); + break; + case RDMA_CM_EVENT_ESTABLISHED: + isert_connected_handler(cma_id); +@@ -841,7 +855,7 @@ isert_cma_handler(struct rdma_cm_id *cma + case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */ + disconnect = true; + case RDMA_CM_EVENT_TIMEWAIT_EXIT: /* FALLTHRU */ +- isert_disconnected_handler(cma_id, disconnect); ++ ret = isert_disconnected_handler(cma_id, disconnect); + break; + case RDMA_CM_EVENT_CONNECT_ERROR: + default: +@@ -849,12 +863,6 @@ isert_cma_handler(struct rdma_cm_id *cma + break; + } + +- if (ret != 0) { +- pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n", +- event->event, ret); +- dump_stack(); +- } +- + return ret; + } + +@@ -3210,7 +3218,8 @@ isert_free_np(struct iscsi_np *np) + { + struct isert_np *isert_np = (struct isert_np *)np->np_context; + +- rdma_destroy_id(isert_np->np_cm_id); ++ if (isert_np->np_cm_id) ++ rdma_destroy_id(isert_np->np_cm_id); + + np->np_context = NULL; + kfree(isert_np); diff --git a/queue-3.17/iwlwifi-pcie-fix-prph-dump-length.patch b/queue-3.17/iwlwifi-pcie-fix-prph-dump-length.patch new file mode 100644 index 00000000000..32e7440e8ed --- /dev/null +++ b/queue-3.17/iwlwifi-pcie-fix-prph-dump-length.patch @@ -0,0 +1,36 @@ +From 87dd634ae72bb8f6d0dd12f1cbbc67c7da6dba3b Mon Sep 17 00:00:00 2001 +From: Liad Kaufman +Date: Mon, 10 Nov 2014 19:25:22 +0200 +Subject: iwlwifi: pcie: fix prph dump length + +From: Liad Kaufman + +commit 87dd634ae72bb8f6d0dd12f1cbbc67c7da6dba3b upstream. + +The length counting previously done had an error in it, causing +the length down the data dumping function to be shorter than it +should be, causing the end of the data to get truncated off and +lost. + +Fixes: 67c65f2cf710 ("iwlwifi: dump periphery registers to fw-error-dump") +Signed-off-by: Liad Kaufman +Reviewed-by: Johannes Berg +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/trans.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -1891,8 +1891,7 @@ static u32 iwl_trans_pcie_dump_prph(stru + int reg; + __le32 *val; + +- prph_len += sizeof(*data) + sizeof(*prph) + +- num_bytes_in_chunk; ++ prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk; + + (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH); + (*data)->len = cpu_to_le32(sizeof(*prph) + diff --git a/queue-3.17/ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch b/queue-3.17/ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch new file mode 100644 index 00000000000..25804b02bf0 --- /dev/null +++ b/queue-3.17/ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch @@ -0,0 +1,49 @@ +From 4556dc591691fca743518edb24f15fbc83b5c8ef Mon Sep 17 00:00:00 2001 +From: Vlad Yasevich +Date: Fri, 21 Nov 2014 23:52:52 -0800 +Subject: ixgbe: Correctly disable VLAN filter in promiscuous mode + +From: Vlad Yasevich + +commit 4556dc591691fca743518edb24f15fbc83b5c8ef upstream. + +IXGBE adapter seems to require that VLAN filtering be enabled if +VMDQ or SRIOV are enabled. When those functions are disabled, +VLAN filtering may be disabled in promiscuous mode. + +Prior to commit a9b8943ee129 ("ixgbe: remove vlan_filter_disable +and enable functions") + +The logic was correct. However, after the commit the logic +got reversed and VLAN filtered in now turned on when VMDQ/SRIOV +is disabled. + +This patch changes the condition to enable hw vlan filtered +when VMDQ or SRIOV is enabled. + +Fixes: a9b8943ee129 ("ixgbe: remove vlan_filter_disable and enable functions") +CC: Jacob Keller +Signed-off-by: Vladislav Yasevich +Acked-by: Emil Tantilov +Tested-by: Phil Schmitt +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -4059,8 +4059,8 @@ void ixgbe_set_rx_mode(struct net_device + * if SR-IOV and VMDQ are disabled - otherwise ensure + * that hardware VLAN filters remain enabled. + */ +- if (!(adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED | +- IXGBE_FLAG_SRIOV_ENABLED))) ++ if (adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED | ++ IXGBE_FLAG_SRIOV_ENABLED)) + vlnctrl |= (IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN); + } else { + if (netdev->flags & IFF_ALLMULTI) { diff --git a/queue-3.17/ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch b/queue-3.17/ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch new file mode 100644 index 00000000000..9711fa01a79 --- /dev/null +++ b/queue-3.17/ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch @@ -0,0 +1,114 @@ +From b5b2ffc0574e1f271d79b6b992ee382dc9d5eaa8 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 21 Nov 2014 23:52:53 -0800 +Subject: ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe + +From: Daniel Borkmann + +commit b5b2ffc0574e1f271d79b6b992ee382dc9d5eaa8 upstream. + +While working on a different issue, I noticed an annoying use +after free bug on my machine when unloading the ixgbe driver: + +[ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2 +[ 8642.742716] ixgbe 0000:02:00.1: complete +[ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90 +[ 8642.744828] IP: [] ixgbe_remove+0xfc/0x1b0 [ixgbe] +[ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060 +[ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC +[ 8642.748039] Modules linked in: [...] +[ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49 +[ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013 +[ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000 +[ 8642.756831] RIP: 0010:[] [] ixgbe_remove+0xfc/0x1b0 [ixgbe] +[...] +[ 8642.774335] Stack: +[ 8642.775805] ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000 +[ 8642.777326] ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098 +[ 8642.778848] ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f +[ 8642.780365] Call Trace: +[ 8642.781869] [] pci_device_remove+0x3f/0xc0 +[ 8642.783395] [] __device_release_driver+0x7f/0xf0 +[ 8642.784876] [] driver_detach+0xb8/0xc0 +[ 8642.786352] [] bus_remove_driver+0x59/0xe0 +[ 8642.787783] [] driver_unregister+0x30/0x70 +[ 8642.789202] [] pci_unregister_driver+0x25/0xa0 +[ 8642.790657] [] ixgbe_exit_module+0x1c/0xc8e [ixgbe] +[ 8642.792064] [] SyS_delete_module+0x132/0x1c0 +[ 8642.793450] [] ? do_notify_resume+0x61/0xa0 +[ 8642.794837] [] system_call_fastpath+0x12/0x17 + +The issue is that test_and_set_bit() done on adapter->state is being +performed *after* the netdevice has been freed via free_netdev(). + +When netdev is being allocated on initialization time, it allocates +a private area, here struct ixgbe_adapter, that resides after the +net_device structure. In ixgbe_probe(), the device init routine, +we set up the adapter after alloc_etherdev_mq() on the private area +and add a reference for the pci_dev as well via pci_set_drvdata(). + +Both in the error path of ixgbe_probe(), but also on module unload +when ixgbe_remove() is being called, commit 41c62843eb6a ("ixgbe: +Fix rcu warnings induced by LER") accesses adapter after free_netdev(). +The patch stores the result in a bool and thus fixes above oops on my +side. + +Fixes: 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER") +Cc: Mark Rustad +Signed-off-by: Daniel Borkmann +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8084,6 +8084,7 @@ static int ixgbe_probe(struct pci_dev *p + int i, err, pci_using_dac, expected_gts; + unsigned int indices = MAX_TX_QUEUES; + u8 part_str[IXGBE_PBANUM_LENGTH]; ++ bool disable_dev = false; + #ifdef IXGBE_FCOE + u16 device_caps; + #endif +@@ -8477,13 +8478,14 @@ err_sw_init: + iounmap(adapter->io_addr); + kfree(adapter->mac_table); + err_ioremap: ++ disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, + pci_select_bars(pdev, IORESOURCE_MEM)); + err_pci_reg: + err_dma: +- if (!adapter || !test_and_set_bit(__IXGBE_DISABLED, &adapter->state)) ++ if (!adapter || disable_dev) + pci_disable_device(pdev); + return err; + } +@@ -8501,6 +8503,7 @@ static void ixgbe_remove(struct pci_dev + { + struct ixgbe_adapter *adapter = pci_get_drvdata(pdev); + struct net_device *netdev = adapter->netdev; ++ bool disable_dev; + + ixgbe_dbg_adapter_exit(adapter); + +@@ -8550,11 +8553,12 @@ static void ixgbe_remove(struct pci_dev + e_dev_info("complete\n"); + + kfree(adapter->mac_table); ++ disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state); + free_netdev(netdev); + + pci_disable_pcie_error_reporting(pdev); + +- if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state)) ++ if (disable_dev) + pci_disable_device(pdev); + } + diff --git a/queue-3.17/mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch b/queue-3.17/mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch new file mode 100644 index 00000000000..5fc60f75415 --- /dev/null +++ b/queue-3.17/mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch @@ -0,0 +1,57 @@ +From 4f031fa9f188b2b0641ac20087d9e16bcfb4e49d Mon Sep 17 00:00:00 2001 +From: Ronald Wahl +Date: Thu, 6 Nov 2014 11:52:13 +0100 +Subject: mac80211: Fix regression that triggers a kernel BUG with CCMP + +From: Ronald Wahl + +commit 4f031fa9f188b2b0641ac20087d9e16bcfb4e49d upstream. + +Commit 7ec7c4a9a686c608315739ab6a2b0527a240883c (mac80211: port CCMP to +cryptoapi's CCM driver) introduced a regression when decrypting empty +packets (data_len == 0). This will lead to backtraces like: + +(scatterwalk_start) from [] (scatterwalk_map_and_copy+0x2c/0xa8) +(scatterwalk_map_and_copy) from [] (crypto_ccm_decrypt+0x7c/0x25c) +(crypto_ccm_decrypt) from [] (ieee80211_aes_ccm_decrypt+0x160/0x170) +(ieee80211_aes_ccm_decrypt) from [] (ieee80211_crypto_ccmp_decrypt+0x1ac/0x238) +(ieee80211_crypto_ccmp_decrypt) from [] (ieee80211_rx_handlers+0x870/0x1d24) +(ieee80211_rx_handlers) from [] (ieee80211_prepare_and_rx_handle+0x8a0/0x91c) +(ieee80211_prepare_and_rx_handle) from [] (ieee80211_rx+0x568/0x730) +(ieee80211_rx) from [] (__carl9170_rx+0x94c/0xa20) +(__carl9170_rx) from [] (carl9170_rx_stream+0x1fc/0x320) +(carl9170_rx_stream) from [] (carl9170_usb_tasklet+0x80/0xc8) +(carl9170_usb_tasklet) from [] (tasklet_hi_action+0x88/0xcc) +(tasklet_hi_action) from [] (__do_softirq+0xcc/0x200) +(__do_softirq) from [] (irq_exit+0x80/0xe0) +(irq_exit) from [] (handle_IRQ+0x64/0x80) +(handle_IRQ) from [] (__irq_svc+0x40/0x4c) +(__irq_svc) from [] (arch_cpu_idle+0x2c/0x34) + +Such packets can appear for example when using the carl9170 wireless driver +because hardware sometimes generates garbage when the internal FIFO overruns. + +This patch adds an additional length check. + +Fixes: 7ec7c4a9a686 ("mac80211: port CCMP to cryptoapi's CCM driver") +Acked-by: Ard Biesheuvel +Signed-off-by: Ronald Wahl +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/aes_ccm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/mac80211/aes_ccm.c ++++ b/net/mac80211/aes_ccm.c +@@ -53,6 +53,9 @@ int ieee80211_aes_ccm_decrypt(struct cry + __aligned(__alignof__(struct aead_request)); + struct aead_request *aead_req = (void *) aead_req_data; + ++ if (data_len == 0) ++ return -EINVAL; ++ + memset(aead_req, 0, sizeof(aead_req_data)); + + sg_init_one(&pt, data, data_len); diff --git a/queue-3.17/net-ping-handle-protocol-mismatching-scenario.patch b/queue-3.17/net-ping-handle-protocol-mismatching-scenario.patch new file mode 100644 index 00000000000..28fc31c6ab8 --- /dev/null +++ b/queue-3.17/net-ping-handle-protocol-mismatching-scenario.patch @@ -0,0 +1,41 @@ +From 91a0b603469069cdcce4d572b7525ffc9fd352a6 Mon Sep 17 00:00:00 2001 +From: Jane Zhou +Date: Mon, 24 Nov 2014 11:44:08 -0800 +Subject: net/ping: handle protocol mismatching scenario + +From: Jane Zhou + +commit 91a0b603469069cdcce4d572b7525ffc9fd352a6 upstream. + +ping_lookup() may return a wrong sock if sk_buff's and sock's protocols +dont' match. For example, sk_buff's protocol is ETH_P_IPV6, but sock's +sk_family is AF_INET, in that case, if sk->sk_bound_dev_if is zero, a wrong +sock will be returned. +the fix is to "continue" the searching, if no matching, return NULL. + +Cc: "David S. Miller" +Cc: Alexey Kuznetsov +Cc: James Morris +Cc: Hideaki YOSHIFUJI +Cc: Patrick McHardy +Cc: netdev@vger.kernel.org +Signed-off-by: Jane Zhou +Signed-off-by: Yiwei Zhao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ping.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct n + &ipv6_hdr(skb)->daddr)) + continue; + #endif ++ } else { ++ continue; + } + + if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) diff --git a/queue-3.17/nfsd-correctly-define-v4.2-support-attributes.patch b/queue-3.17/nfsd-correctly-define-v4.2-support-attributes.patch new file mode 100644 index 00000000000..af61f87ebe5 --- /dev/null +++ b/queue-3.17/nfsd-correctly-define-v4.2-support-attributes.patch @@ -0,0 +1,41 @@ +From 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Sat, 8 Nov 2014 13:11:03 +0100 +Subject: nfsd: correctly define v4.2 support attributes + +From: Christoph Hellwig + +commit 6d0ba0432a5e10bc714ba9c5adc460e726e5fbb4 upstream. + +Even when security labels are disabled we support at least the same +attributes as v4.1. + +Signed-off-by: Christoph Hellwig +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfsd.h | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -335,12 +335,15 @@ void nfsd_lockd_shutdown(void); + (NFSD4_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SUPPATTR_EXCLCREAT) + + #ifdef CONFIG_NFSD_V4_SECURITY_LABEL +-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \ +- (NFSD4_1_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SECURITY_LABEL) ++#define NFSD4_2_SECURITY_ATTRS FATTR4_WORD2_SECURITY_LABEL + #else +-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0 ++#define NFSD4_2_SECURITY_ATTRS 0 + #endif + ++#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \ ++ (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \ ++ NFSD4_2_SECURITY_ATTRS) ++ + static inline u32 nfsd_suppattrs0(u32 minorversion) + { + return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0 diff --git a/queue-3.17/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch b/queue-3.17/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch new file mode 100644 index 00000000000..2c364e901ed --- /dev/null +++ b/queue-3.17/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch @@ -0,0 +1,50 @@ +From c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 19 Nov 2014 12:47:50 -0500 +Subject: nfsd: Fix slot wake up race in the nfsv4.1 callback code + +From: Trond Myklebust + +commit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream. + +The currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no +locking in order to guarantee atomicity, and so allows for races of +the form. + +Task 1 Task 2 +====== ====== +if (test_and_set_bit(0) != 0) { + clear_bit(0) + rpc_wake_up_next(queue) + rpc_sleep_on(queue) + return false; +} + +This patch breaks the race condition by adding a retest of the bit +after the call to rpc_sleep_on(). + +Signed-off-by: Trond Myklebust +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4callback.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -801,8 +801,12 @@ static bool nfsd41_cb_get_slot(struct nf + { + if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { + rpc_sleep_on(&clp->cl_cb_waitq, task, NULL); +- dprintk("%s slot is busy\n", __func__); +- return false; ++ /* Race breaker */ ++ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { ++ dprintk("%s slot is busy\n", __func__); ++ return false; ++ } ++ rpc_wake_up_queued_task(&clp->cl_cb_waitq, task); + } + return true; + } diff --git a/queue-3.17/of-fix-crash-if-an-earlycon-driver-is-not-found.patch b/queue-3.17/of-fix-crash-if-an-earlycon-driver-is-not-found.patch new file mode 100644 index 00000000000..d73324dbc7e --- /dev/null +++ b/queue-3.17/of-fix-crash-if-an-earlycon-driver-is-not-found.patch @@ -0,0 +1,40 @@ +From ab74d00a39f70e1bc34a01322bb59f3750ca7a8c Mon Sep 17 00:00:00 2001 +From: Kevin Cernekee +Date: Sun, 9 Nov 2014 00:55:47 -0800 +Subject: of: Fix crash if an earlycon driver is not found + +From: Kevin Cernekee + +commit ab74d00a39f70e1bc34a01322bb59f3750ca7a8c upstream. + +__earlycon_of_table_sentinel.compatible is a char[128], not a pointer, so +it will never be NULL. Checking it against NULL causes the match loop to +run past the end of the array, and eventually match a bogus entry, under +the following conditions: + + - Kernel command line specifies "earlycon" with no parameters + - DT has a stdout-path pointing to a UART node + - The UART driver doesn't use OF_EARLYCON_DECLARE (or maybe the console + driver is compiled out) + +Fix this by checking to see if match->compatible is a non-empty string. + +Signed-off-by: Kevin Cernekee +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/fdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_ser + if (offset < 0) + return -ENODEV; + +- while (match->compatible) { ++ while (match->compatible[0]) { + unsigned long addr; + if (fdt_node_check_compatible(fdt, offset, match->compatible)) { + match++; diff --git a/queue-3.17/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch b/queue-3.17/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch new file mode 100644 index 00000000000..eecfb9e0d7f --- /dev/null +++ b/queue-3.17/of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch @@ -0,0 +1,46 @@ +From 66865de4314caca30598244b86817e774c188afa Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Sat, 1 Nov 2014 17:35:31 -0600 +Subject: of/irq: Drop obsolete 'interrupts' vs 'interrupts-extended' text + +From: Bjorn Helgaas + +commit 66865de4314caca30598244b86817e774c188afa upstream. + +a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property +first") updated the description to say that: + + - Both 'interrupts' and 'interrupts-extended' may be present + - Software should prefer 'interrupts-extended' + - Software that doesn't comprehend 'interrupts-extended' may use + 'interrupts' + +But there is still a paragraph at the end that prohibits having both and +says 'interrupts' should be preferred. + +Remove the contradictory text. + +Fixes: a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property first") +Signed-off-by: Bjorn Helgaas +Acked-by: Brian Norris +Acked-by: Mark Rutland +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/interrupt-controller/interrupts.txt | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt ++++ b/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt +@@ -30,10 +30,6 @@ should only be used when a device has mu + Example: + interrupts-extended = <&intc1 5 1>, <&intc2 1 0>; + +-A device node may contain either "interrupts" or "interrupts-extended", but not +-both. If both properties are present, then the operating system should log an +-error and use only the data in "interrupts". +- + 2) Interrupt controller nodes + ----------------------------- + diff --git a/queue-3.17/of-selftest-fix-off-by-one-error-in-removal-path.patch b/queue-3.17/of-selftest-fix-off-by-one-error-in-removal-path.patch new file mode 100644 index 00000000000..d54cc076104 --- /dev/null +++ b/queue-3.17/of-selftest-fix-off-by-one-error-in-removal-path.patch @@ -0,0 +1,44 @@ +From c1a2086e2d8c4eb4e8630ba752e911ec180dec67 Mon Sep 17 00:00:00 2001 +From: Grant Likely +Date: Wed, 19 Nov 2014 16:22:32 +0000 +Subject: of/selftest: Fix off-by-one error in removal path + +From: Grant Likely + +commit c1a2086e2d8c4eb4e8630ba752e911ec180dec67 upstream. + +The removal path for selftest data has an off by one error that causes +the code to dereference beyond the end of the nodes[] array on the first +pass through. The old code only worked by chance on a lot of platforms, +but the bug was recently exposed on aarch64. + +The fix is simple. Decrement the node count before dereferencing, not +after. + +Reported-by: Kevin Hilman +Cc: Rob Herring +Cc: Gaurav Minocha + +--- + drivers/of/selftest.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/of/selftest.c ++++ b/drivers/of/selftest.c +@@ -799,7 +799,7 @@ static void selftest_data_remove(void) + return; + } + +- while (last_node_index >= 0) { ++ while (last_node_index-- > 0) { + if (nodes[last_node_index]) { + np = of_find_node_by_path(nodes[last_node_index]->full_name); + if (strcmp(np->full_name, "/aliases") != 0) { +@@ -812,7 +812,6 @@ static void selftest_data_remove(void) + } + } + } +- last_node_index--; + } + } + diff --git a/queue-3.17/revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch b/queue-3.17/revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch new file mode 100644 index 00000000000..f2f561a7a84 --- /dev/null +++ b/queue-3.17/revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch @@ -0,0 +1,47 @@ +From 9b41ebd3cf0f68d8cad779d3eeba336f78262e43 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Tue, 18 Nov 2014 11:27:13 +0200 +Subject: Revert "xhci: clear root port wake on bits if controller isn't wake-up capable" + +From: Lu Baolu + +commit 9b41ebd3cf0f68d8cad779d3eeba336f78262e43 upstream. + +commit ff8cbf250b44 ("xhci: clear root port wake on bits if controller isn't") +can cause device detection error if runtime PM is enabled, and S3 wake +is disabled. Revert it. +https://bugzilla.kernel.org/show_bug.cgi?id=85701 + +This commit got into stable and should be reverted from there as well. + +Signed-off-by: Lu Baolu +Reported-by: Dmitry Nezhevenko +[Mathias Nyman: reword commit message] +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -22,7 +22,6 @@ + + + #include +-#include + #include + + #include "xhci.h" +@@ -1142,9 +1141,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd + * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME + * is enabled, so also enable remote wake here. + */ +- if (hcd->self.root_hub->do_remote_wakeup +- && device_may_wakeup(hcd->self.controller)) { +- ++ if (hcd->self.root_hub->do_remote_wakeup) { + if (t1 & PORT_CONNECT) { + t2 |= PORT_WKOC_E | PORT_WKDISC_E; + t2 &= ~PORT_WKCONN_E; diff --git a/queue-3.17/rt2x00-do-not-align-payload-on-modern-h-w.patch b/queue-3.17/rt2x00-do-not-align-payload-on-modern-h-w.patch new file mode 100644 index 00000000000..25428629b3f --- /dev/null +++ b/queue-3.17/rt2x00-do-not-align-payload-on-modern-h-w.patch @@ -0,0 +1,117 @@ +From cfd9167af14eb4ec21517a32911d460083ee3d59 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 11 Nov 2014 14:28:47 +0100 +Subject: rt2x00: do not align payload on modern H/W + +From: Stanislaw Gruszka + +commit cfd9167af14eb4ec21517a32911d460083ee3d59 upstream. + +RT2800 and newer hardware require padding between header and payload if +header length is not multiple of 4. + +For historical reasons we also align payload to to 4 bytes boundary, but +such alignment is not needed on modern H/W. + +Patch fixes skb_under_panic problems reported from time to time: + +https://bugzilla.kernel.org/show_bug.cgi?id=84911 +https://bugzilla.kernel.org/show_bug.cgi?id=72471 +http://marc.info/?l=linux-wireless&m=139108549530402&w=2 +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591 + +Panic happened because we eat 4 bytes of skb headroom on each +(re)transmission when sending frame without the payload and the header +length not being multiple of 4 (i.e. QoS header has 26 bytes). On such +case because paylad_aling=2 is bigger than header_align=0 we increase +header_align by 4 bytes. To prevent that we could change the check to: + + if (payload_length && payload_align > header_align) + header_align += 4; + +but not aligning payload at all is more effective and alignment is not +really needed by H/W (that has been tested on OpenWrt project for few +years now). + +Reported-and-tested-by: Antti S. Lankila +Debugged-by: Antti S. Lankila +Reported-by: Henrik Asp +Originally-From: Helmut Schaa +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00queue.c | 50 +++++++----------------------- + 1 file changed, 12 insertions(+), 38 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c +@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_b + skb_trim(skb, frame_length); + } + +-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length) ++/* ++ * H/W needs L2 padding between the header and the paylod if header size ++ * is not 4 bytes aligned. ++ */ ++void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len) + { +- unsigned int payload_length = skb->len - header_length; +- unsigned int header_align = ALIGN_SIZE(skb, 0); +- unsigned int payload_align = ALIGN_SIZE(skb, header_length); +- unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0; +- +- /* +- * Adjust the header alignment if the payload needs to be moved more +- * than the header. +- */ +- if (payload_align > header_align) +- header_align += 4; ++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0; + +- /* There is nothing to do if no alignment is needed */ +- if (!header_align) ++ if (!l2pad) + return; + +- /* Reserve the amount of space needed in front of the frame */ +- skb_push(skb, header_align); +- +- /* +- * Move the header. +- */ +- memmove(skb->data, skb->data + header_align, header_length); +- +- /* Move the payload, if present and if required */ +- if (payload_length && payload_align) +- memmove(skb->data + header_length + l2pad, +- skb->data + header_length + l2pad + payload_align, +- payload_length); +- +- /* Trim the skb to the correct size */ +- skb_trim(skb, header_length + l2pad + payload_length); ++ skb_push(skb, l2pad); ++ memmove(skb->data, skb->data + l2pad, hdr_len); + } + +-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length) ++void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len) + { +- /* +- * L2 padding is only present if the skb contains more than just the +- * IEEE 802.11 header. +- */ +- unsigned int l2pad = (skb->len > header_length) ? +- L2PAD_SIZE(header_length) : 0; ++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0; + + if (!l2pad) + return; + +- memmove(skb->data + l2pad, skb->data, header_length); ++ memmove(skb->data + l2pad, skb->data, hdr_len); + skb_pull(skb, l2pad); + } + diff --git a/queue-3.17/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch b/queue-3.17/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch new file mode 100644 index 00000000000..981d12172b7 --- /dev/null +++ b/queue-3.17/scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch @@ -0,0 +1,36 @@ +From 1899045510ff109980d9cc34e330fd8ca3631871 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?= + +Date: Tue, 18 Nov 2014 20:23:32 +0100 +Subject: scsi: add Intel Multi-Flex to scsi scan blacklist +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Christian=20S=C3=BCnkenberg?= + +commit 1899045510ff109980d9cc34e330fd8ca3631871 upstream. + +Intel Multi-Flex LUNs choke on REPORT SUPPORTED OPERATION CODES +resulting in sd_mod hanging for several minutes on startup. +The issue was introduced with WRITE SAME discovery heuristics. + +Fixes: 5db44863b6eb ("[SCSI] sd: Implement support for WRITE SAME") +Signed-off-by: Christian Sünkenberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_devinfo.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -202,6 +202,7 @@ static struct { + {"IOMEGA", "Io20S *F", NULL, BLIST_KEY}, + {"INSITE", "Floptical F*8I", NULL, BLIST_KEY}, + {"INSITE", "I325VM", NULL, BLIST_KEY}, ++ {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC}, + {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36}, + {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN}, + {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, diff --git a/queue-3.17/series b/queue-3.17/series index 36694951145..80ffbdeae70 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -66,3 +66,38 @@ alsa-hda-limit-40bit-dma-for-amd-hdmi-controllers.patch alsa-hda-one-more-hp-machine-needs-to-change-mute-led-quirk.patch aio-fix-uncorrent-dirty-pages-accouting-when-truncating-aio-ring-buffer.patch btrfs-fix-lockups-from-btrfs_clear_path_blocking.patch +acpi-ec-add-support-to-disallow-qr_ec-to-be-issued-before-completing-previous-qr_ec.patch +acpi-pm-ignore-wakeup-setting-if-the-acpi-companion-can-t-wake-up.patch +brcmfmac-fix-conversion-of-channel-width-20mhz_noht.patch +brcmfmac-fix-error-handling-of-irq_of_parse_and_map.patch +brcmfmac-don-t-include-linux-unaligned-access_ok.h.patch +of-irq-drop-obsolete-interrupts-vs-interrupts-extended-text.patch +of-fix-crash-if-an-earlycon-driver-is-not-found.patch +of-selftest-fix-off-by-one-error-in-removal-path.patch +arm-mvebu-add-missing-of_node_put-call-in-coherency.c.patch +arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch +arm-8222-1-mvebu-enable-strex-backoff-delay.patch +arm-8226-1-cacheflush-get-rid-of-restarting-block.patch +input-synaptics-adjust-min-max-on-thinkpad-e540.patch +input-xpad-use-proper-endpoint-type.patch +srp-target-retry-when-qp-creation-fails-with-enomem.patch +target-don-t-call-tfo-write_pending-if-data_length-0.patch +iser-target-handle-device_removal-event-on-network-portal-listener-correctly.patch +spi-dw-fix-dynamic-speed-change.patch +spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch +spi-sirf-fix-word-width-configuration.patch +mac80211-fix-regression-that-triggers-a-kernel-bug-with-ccmp.patch +vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch +scsi-add-intel-multi-flex-to-scsi-scan-blacklist.patch +can-dev-avoid-calling-kfree_skb-from-interrupt-context.patch +dmaengine-sun6i-fix-memcpy-operation.patch +rt2x00-do-not-align-payload-on-modern-h-w.patch +iwlwifi-pcie-fix-prph-dump-length.patch +nfsd-correctly-define-v4.2-support-attributes.patch +nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch +sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch +hwmon-g762-fix-call-to-devm_hwmon_device_register_with_groups.patch +net-ping-handle-protocol-mismatching-scenario.patch +revert-xhci-clear-root-port-wake-on-bits-if-controller-isn-t-wake-up-capable.patch +ixgbe-correctly-disable-vlan-filter-in-promiscuous-mode.patch +ixgbe-fix-use-after-free-adapter-state-test-in-ixgbe_remove-ixgbe_probe.patch diff --git a/queue-3.17/sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch b/queue-3.17/sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch new file mode 100644 index 00000000000..335c256adaf --- /dev/null +++ b/queue-3.17/sound-radeon-move-64-bit-msi-quirk-from-arch-to-driver.patch @@ -0,0 +1,69 @@ +From db79afa1e57925ba96ab18514c0ebe42a28e393e Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Mon, 24 Nov 2014 14:17:08 +1100 +Subject: sound/radeon: Move 64-bit MSI quirk from arch to driver + +From: Benjamin Herrenschmidt + +commit db79afa1e57925ba96ab18514c0ebe42a28e393e upstream. + +A number of radeon cards have a HW limitation causing them to be +unable to generate the full 64-bit of address bits for MSIs. This +breaks MSIs on some platforms such as POWER machines. + +We used to have a powerpc specific quirk to address that on a +single card, but this doesn't scale very well, this is better +put under control of the drivers who know precisely what a given +HW revision can do. + +We now have a generic quirk in the PCI code. We should set it +appropriately for all radeon's from the audio driver. + +Signed-off-by: Benjamin Herrenschmidt +Reviewed-by: Takashi Iwai +Reviewed-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 10 ++++++++-- + sound/pci/hda/hda_priv.h | 1 + + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -296,7 +296,8 @@ enum { + + /* quirks for ATI/AMD HDMI */ + #define AZX_DCAPS_PRESET_ATI_HDMI \ +- (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB) ++ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB|\ ++ AZX_DCAPS_NO_MSI64) + + /* quirks for Nvidia */ + #define AZX_DCAPS_PRESET_NVIDIA \ +@@ -1508,9 +1509,14 @@ static int azx_first_init(struct azx *ch + return -ENXIO; + } + +- if (chip->msi) ++ if (chip->msi) { ++ if (chip->driver_caps & AZX_DCAPS_NO_MSI64) { ++ dev_dbg(card->dev, "Disabling 64bit MSI\n"); ++ pci->no_64bit_msi = true; ++ } + if (pci_enable_msi(pci) < 0) + chip->msi = 0; ++ } + + if (azx_acquire_irq(chip, 0) < 0) + return -EBUSY; +--- a/sound/pci/hda/hda_priv.h ++++ b/sound/pci/hda/hda_priv.h +@@ -171,6 +171,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO + #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */ + #define AZX_DCAPS_I915_POWERWELL (1 << 27) /* HSW i915 powerwell support */ + #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */ ++#define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */ + + /* HD Audio class code */ + #define PCI_CLASS_MULTIMEDIA_HD_AUDIO 0x0403 diff --git a/queue-3.17/spi-dw-fix-dynamic-speed-change.patch b/queue-3.17/spi-dw-fix-dynamic-speed-change.patch new file mode 100644 index 00000000000..a5fd7defea5 --- /dev/null +++ b/queue-3.17/spi-dw-fix-dynamic-speed-change.patch @@ -0,0 +1,67 @@ +From 0a8727e69778683495058852f783eeda141a754e Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Thu, 6 Nov 2014 13:54:27 -0600 +Subject: spi: dw: Fix dynamic speed change. + +From: Thor Thayer + +commit 0a8727e69778683495058852f783eeda141a754e upstream. + +An IOCTL call that calls spi_setup() and then dw_spi_setup() will +overwrite the persisted last transfer speed. On each transfer, the +SPI speed is compared to the last transfer speed to determine if the +clock divider registers need to be updated (did the speed change?). +This bug was observed with the spidev driver using spi-config to +update the max transfer speed. + +This fix: Don't overwrite the persisted last transaction clock speed +when updating the SPI parameters in dw_spi_setup(). On the next +transaction, the new speed won't match the persisted last speed +and the hardware registers will be updated. +On initialization, the persisted last transaction clock +speed will be 0 but will be updated after the first SPI +transaction. + +Move zeroed clock divider check into clock change test because +chip->clk_div is zero on startup and would cause a divide-by-zero +error. The calculation was wrong as well (can't support odd #). + +Reported-by: Vlastimil Setka +Signed-off-by: Vlastimil Setka +Signed-off-by: Thor Thayer +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-dw.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -382,9 +382,6 @@ static void pump_transfers(unsigned long + chip = dws->cur_chip; + spi = message->spi; + +- if (unlikely(!chip->clk_div)) +- chip->clk_div = dws->max_freq / chip->speed_hz; +- + if (message->state == ERROR_STATE) { + message->status = -EIO; + goto early_exit; +@@ -425,7 +422,7 @@ static void pump_transfers(unsigned long + if (transfer->speed_hz) { + speed = chip->speed_hz; + +- if (transfer->speed_hz != speed) { ++ if ((transfer->speed_hz != speed) || (!chip->clk_div)) { + speed = transfer->speed_hz; + + /* clk_div doesn't support odd number */ +@@ -586,7 +583,6 @@ static int dw_spi_setup(struct spi_devic + dev_err(&spi->dev, "No max speed HZ parameter\n"); + return -EINVAL; + } +- chip->speed_hz = spi->max_speed_hz; + + chip->tmode = 0; /* Tx & Rx */ + /* Default SPI mode is SCPOL = 0, SCPH = 0 */ diff --git a/queue-3.17/spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch b/queue-3.17/spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch new file mode 100644 index 00000000000..8c3fd3d8bc2 --- /dev/null +++ b/queue-3.17/spi-fix-mapping-from-vmalloc-ed-buffer-to-scatter-list.patch @@ -0,0 +1,47 @@ +From c1aefbdd050e1fb15e92bcaf34d95b17ea952097 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Mon, 17 Nov 2014 09:14:31 +0000 +Subject: spi: Fix mapping from vmalloc-ed buffer to scatter list + +From: Charles Keepax + +commit c1aefbdd050e1fb15e92bcaf34d95b17ea952097 upstream. + +We can only use page_address on memory that has been mapped using kmap, +when the buffer passed to the SPI has been allocated by vmalloc the page +has not necessarily been mapped through kmap. This means sometimes +page_address will return NULL causing the pointer we pass to sg_set_buf +to be invalid. + +As we only call page_address so that we can pass a virtual address to +sg_set_buf which will then immediately call virt_to_page on it, fix this +by calling sg_set_page directly rather then relying on the sg_set_buf +helper. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -609,13 +609,13 @@ static int spi_map_buf(struct spi_master + sg_free_table(sgt); + return -ENOMEM; + } +- sg_buf = page_address(vm_page) + +- ((size_t)buf & ~PAGE_MASK); ++ sg_set_page(&sgt->sgl[i], vm_page, ++ min, offset_in_page(buf)); + } else { + sg_buf = buf; ++ sg_set_buf(&sgt->sgl[i], sg_buf, min); + } + +- sg_set_buf(&sgt->sgl[i], sg_buf, min); + + buf += min; + len -= min; diff --git a/queue-3.17/spi-sirf-fix-word-width-configuration.patch b/queue-3.17/spi-sirf-fix-word-width-configuration.patch new file mode 100644 index 00000000000..96f4d0b6fd3 --- /dev/null +++ b/queue-3.17/spi-sirf-fix-word-width-configuration.patch @@ -0,0 +1,42 @@ +From 9c4b19a07dddda3ba35a2eb9b4134d485908e2f5 Mon Sep 17 00:00:00 2001 +From: Qipan Li +Date: Mon, 17 Nov 2014 23:17:02 +0800 +Subject: spi: sirf: fix word width configuration + +From: Qipan Li + +commit 9c4b19a07dddda3ba35a2eb9b4134d485908e2f5 upstream. + +commit 8c328a262f ("spi: sirf: Avoid duplicate code in various +bits_per_word cases") is wrong in setting data width register of +fifo is not right, it should use sspi->word_width >> 1 to set +related bits. According to hardware spec, the mapping between +register value and data width: +0 - byte +1 - WORD +2 - DWORD + +Fixes: 8c328a262f ("spi: sirf: Avoid duplicate code in various bits_per_word cases") is wrong in setting data width register of +Signed-off-by: Qipan Li +Signed-off-by: Barry Song +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-sirf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-sirf.c ++++ b/drivers/spi/spi-sirf.c +@@ -565,9 +565,9 @@ spi_sirfsoc_setup_transfer(struct spi_de + + sspi->word_width = DIV_ROUND_UP(bits_per_word, 8); + txfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) | +- sspi->word_width; ++ (sspi->word_width >> 1); + rxfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) | +- sspi->word_width; ++ (sspi->word_width >> 1); + + if (!(spi->mode & SPI_CS_HIGH)) + regval |= SIRFSOC_SPI_CS_IDLE_STAT; diff --git a/queue-3.17/srp-target-retry-when-qp-creation-fails-with-enomem.patch b/queue-3.17/srp-target-retry-when-qp-creation-fails-with-enomem.patch new file mode 100644 index 00000000000..e2a74b6c0a5 --- /dev/null +++ b/queue-3.17/srp-target-retry-when-qp-creation-fails-with-enomem.patch @@ -0,0 +1,48 @@ +From ab477c1ff5e0a744c072404bf7db51bfe1f05b6e Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Sun, 19 Oct 2014 18:05:33 +0300 +Subject: srp-target: Retry when QP creation fails with ENOMEM + +From: Bart Van Assche + +commit ab477c1ff5e0a744c072404bf7db51bfe1f05b6e upstream. + +It is not guaranteed to that srp_sq_size is supported +by the HCA. So if we failed to create the QP with ENOMEM, +try with a smaller srp_sq_size. Keep it up until we hit +MIN_SRPT_SQ_SIZE, then fail the connection. + +Reported-by: Mark Lehrer +Signed-off-by: Bart Van Assche +Signed-off-by: Sagi Grimberg +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2092,6 +2092,7 @@ static int srpt_create_ch_ib(struct srpt + if (!qp_init) + goto out; + ++retry: + ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch, + ch->rq_size + srp_sq_size, 0); + if (IS_ERR(ch->cq)) { +@@ -2115,6 +2116,13 @@ static int srpt_create_ch_ib(struct srpt + ch->qp = ib_create_qp(sdev->pd, qp_init); + if (IS_ERR(ch->qp)) { + ret = PTR_ERR(ch->qp); ++ if (ret == -ENOMEM) { ++ srp_sq_size /= 2; ++ if (srp_sq_size >= MIN_SRPT_SQ_SIZE) { ++ ib_destroy_cq(ch->cq); ++ goto retry; ++ } ++ } + printk(KERN_ERR "failed to create_qp ret= %d\n", ret); + goto err_destroy_cq; + } diff --git a/queue-3.17/target-don-t-call-tfo-write_pending-if-data_length-0.patch b/queue-3.17/target-don-t-call-tfo-write_pending-if-data_length-0.patch new file mode 100644 index 00000000000..75d19d1db4c --- /dev/null +++ b/queue-3.17/target-don-t-call-tfo-write_pending-if-data_length-0.patch @@ -0,0 +1,35 @@ +From 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Tue, 14 Oct 2014 14:16:24 -0700 +Subject: target: Don't call TFO->write_pending if data_length == 0 + +From: Roland Dreier + +commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream. + +If an initiator sends a zero-length command (e.g. TEST UNIT READY) but +sets the transfer direction in the transport layer to indicate a +data-out phase, we still shouldn't try to transfer data. At best it's +a NOP, and depending on the transport, we might crash on an +uninitialized sg list. + +Reported-by: Craig Watson +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2295,7 +2295,7 @@ transport_generic_new_cmd(struct se_cmd + * and let it call back once the write buffers are ready. + */ + target_add_to_state_list(cmd); +- if (cmd->data_direction != DMA_TO_DEVICE) { ++ if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) { + target_execute_cmd(cmd); + return 0; + } diff --git a/queue-3.17/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch b/queue-3.17/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch new file mode 100644 index 00000000000..42f555aa7bc --- /dev/null +++ b/queue-3.17/vhost-scsi-take-configfs-group-dependency-during-vhost_scsi_set_endpoint.patch @@ -0,0 +1,88 @@ +From ab8edab132829b26dd13db6caca3c242cce35dc1 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Wed, 8 Oct 2014 06:19:20 +0000 +Subject: vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT + +From: Nicholas Bellinger + +commit ab8edab132829b26dd13db6caca3c242cce35dc1 upstream. + +This patch addresses a bug where individual vhost-scsi configfs endpoint +groups can be removed from below while active exports to QEMU userspace +still exist, resulting in an OOPs. + +It adds a configfs_depend_item() in vhost_scsi_set_endpoint() to obtain +an explicit dependency on se_tpg->tpg_group in order to prevent individual +vhost-scsi WWPN endpoints from being released via normal configfs methods +while an QEMU ioctl reference still exists. + +Also, add matching configfs_undepend_item() in vhost_scsi_clear_endpoint() +to release the dependency, once QEMU's reference to the individual group +at /sys/kernel/config/target/vhost/$WWPN/$TPGT is released. + +(Fix up vhost_scsi_clear_endpoint() error path - DanC) + +Cc: Michael S. Tsirkin +Cc: Paolo Bonzini +Cc: Stefan Hajnoczi +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/vhost/scsi.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -1312,6 +1312,7 @@ static int + vhost_scsi_set_endpoint(struct vhost_scsi *vs, + struct vhost_scsi_target *t) + { ++ struct se_portal_group *se_tpg; + struct tcm_vhost_tport *tv_tport; + struct tcm_vhost_tpg *tpg; + struct tcm_vhost_tpg **vs_tpg; +@@ -1359,6 +1360,21 @@ vhost_scsi_set_endpoint(struct vhost_scs + ret = -EEXIST; + goto out; + } ++ /* ++ * In order to ensure individual vhost-scsi configfs ++ * groups cannot be removed while in use by vhost ioctl, ++ * go ahead and take an explicit se_tpg->tpg_group.cg_item ++ * dependency now. ++ */ ++ se_tpg = &tpg->se_tpg; ++ ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys, ++ &se_tpg->tpg_group.cg_item); ++ if (ret) { ++ pr_warn("configfs_depend_item() failed: %d\n", ret); ++ kfree(vs_tpg); ++ mutex_unlock(&tpg->tv_tpg_mutex); ++ goto out; ++ } + tpg->tv_tpg_vhost_count++; + tpg->vhost_scsi = vs; + vs_tpg[tpg->tport_tpgt] = tpg; +@@ -1401,6 +1417,7 @@ static int + vhost_scsi_clear_endpoint(struct vhost_scsi *vs, + struct vhost_scsi_target *t) + { ++ struct se_portal_group *se_tpg; + struct tcm_vhost_tport *tv_tport; + struct tcm_vhost_tpg *tpg; + struct vhost_virtqueue *vq; +@@ -1449,6 +1466,13 @@ vhost_scsi_clear_endpoint(struct vhost_s + vs->vs_tpg[target] = NULL; + match = true; + mutex_unlock(&tpg->tv_tpg_mutex); ++ /* ++ * Release se_tpg->tpg_group.cg_item configfs dependency now ++ * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur. ++ */ ++ se_tpg = &tpg->se_tpg; ++ configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys, ++ &se_tpg->tpg_group.cg_item); + } + if (match) { + for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {