[SCSI] esas2r: Directly call kernel functions for atomic bit operations

Previously the code embedded the kernel's test_bit/clear_bit
functions in wrappers that accepted u32 parameters.  The
wrapper cast these parameters to longs before passing them
to the kernel's bit functions.   This did not work properly
on platforms with 64-bit longs.

Signed-off-by: Bradley Grove <bgrove@attotech.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Update lpfc version to driver version 8.3.43

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed not processing task management IOCB response status

This patch implements the changes requested by Jeremy Linton:
http://marc.info/?l=linux-scsi&m=136242124409687&w=2

The patch revises the command issuing behavior, detecting cases where the
Task Mgmt command may have completed but with a non-successful status, which it
previously treated as a successful TMF. The patch also corrects a flushing of
I/O that was done which should only be done on successful TMF completion.

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed spinlock hang.

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed invalid Total_Data_Placed value received for els and ct command responses

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed invalid fcp_rsp length fir FCP_ICMND

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed invalid mailbox timeouts

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fixed spinlock inversion problem.

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc 8.3.43: Fix crash after xri limit is reached.

Signed-off-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] Derive the FLUSH_TIMEOUT from the basic I/O timeout

Rather than having a separate constant for specifying the timeout on FLUSH
operations, use the basic I/O timeout value that is already configurable
on a per target basis to derive the FLUSH timeout. Looking at the current
definitions of these timeout values, the FLUSH operation is supposed to have
a value that is twice the normal timeout value. This patch preserves this
relationship while leveraging the flexibility of specifying the I/O timeout.

Based on a prior patch by KY Srinivasan <kys@microsoft.com>

Reviewed-by: KY Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Firmware logging support.

Supports below logging facilities,
Inbound outbound queues dump.
Non fatal dump in case of IO failures.
Fatal dump in case of firmware failure.

[jejb: checkpatch spacing fixes]
Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Phy settings support for motherboard controller.

Phy profile implementation to support phy settings feature
for motherboard controllers.

[jejb: checkpatch fixes]
Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: IButton security feature support for motherboard controllers.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Print SAS address of IO failed device.

[jejb: checkpatch fixes]
Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: 4G boundary fix.

Firmware is having an issue.  When a single IO request crosses
4G boundary, system will crash.  To avoid the issue single sg is
converted into extended sg.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Queue rotation logic for inbound and outbound queues.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Set device state response logic fix.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Display controller BIOS version.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Indirect SMP request fix.

Fix for indirect data transfer mode in case of SMP request.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] pm80xx: Device id changes to support series 8 controllers.

Updated pci id table with device, vendor, subdevice and subvendor ids
for 8074, 8076, 8077 SAS/SATA 12G controllers. Added 12G related macros.

Signed-off-by: Anandkumar.Santhanam@pmcs.com
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] iscsi_tcp: consider session state in iscsi_sw_sk_state_check

It seems some iSCSI targets (including the Linux kernel target) close
the TCP connection from the target side immediately after processing a
session logout.

When a TCP FIN comes in right after the iSCSI logout response,
iscsi_sw_sk_state_check sees the local socket as not yet being in
CLOSE_WAIT or CLOSE and logs an error.  But the initiator would close
the connection right after processing the logout response anyway, and
the error is confusing to admins who just requested that the session be
shut down.

This adds a check of the session state, and suppresses the error if we
are in the process of logging out.

Signed-off-by: Chris Leech <cleech@redhat.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] sd: Add error handling during flushing caches

It makes no sense to flush the cache of a device without medium.
Errors during suspend must be handled according to their causes.
Errors due to missing media or unplugged devices must be ignored.
Errors due to devices being offlined must also be ignored.
The error returns must be modified so that the generic layer
understands them.

[jejb: fix up whitespace and other formatting problems]
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] sd: Reduce buffer size for vpd request

Somehow older areca firmware versions have issues with
scsi_get_vpd_page() and a large buffer, the firmware
seems to crash and the scsi error-handler will start endless
recovery retries.
Limiting the buf-size to 64-bytes fixes this issue with older
firmware versions (<1.49 for my controller).

Fixes a regression with areca controllers and older firmware versions
introduced by commit: 66c28f97120e8a621afd5aa7a31c4b85c547d33d

Reported-by: Nix <nix@esperi.org.uk>
Tested-by: Nix <nix@esperi.org.uk>
Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
Cc: stable@vger.kernel.org # delay inclusion for 2 months for testing
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_debug: fix sparse warnings related to data integrity field

Each member in data integrity field tuple is big-endian.  But the
endianness of the values being compared with these members are not
annotated.  So this fixes these sparse warnings.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_debug: fix invalid value check for guard module parameter

In the module initialization, invalid value for guard module parameter
is detected by the following check:

        if (scsi_debug_guard > 1) {
                printk(KERN_ERR "scsi_debug_init: guard must be 0 or 1\n");
                return -EINVAL;
        }

But this check isn't enough, because the type of scsi_debug_guard is
'int' and scsi_debug_guard could be a negative value.

This fixes it by changing the type of scsi_debug_guard to 'unsigned int'
instead of adding extra check for a negative value.

Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_debug: avoid partial copying PI from prot_sglist to dif_storep

If data integrity support is enabled, prot_verify_write() is called in
response to WRITE commands and it verifies protection info from
prot_sglist by comparing against data sglist, and copies protection info
to dif_storep.

When multiple blocks are transfered by a WRITE command, it verifies and
copies these blocks one by one.  So if it fails to verify protection
info in the middle of blocks, the actual data transfer to fake_storep
isn't proceeded at all although protection info for some blocks are
already copied to dif_storep.  Therefore, it breaks the data integrity
between fake_storep and dif_storep.

This fixes it by ensuring that copying protection info to dif_storep is
done after all blocks are successfully verified.  Reusing dif_copy_prot()
with supporting the opposite direction simplifies this fix.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_debug: factor out copying PI from dif_storep to prot_sglist

If data integrity support is enabled, prot_verify_read() is called in
response to READ commands and it verifies protection info from dif_storep
by comparing against fake_storep, and copies protection info to
prot_sglist.

This factors out the portion of copying protection info into a separate
function.  It will also be reused in the next change after supporting
the opposite direction (copying prot_sglist to dif_storep).

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_debug: fix buffer overrun when DIF/DIX is enabled and virtual_gb > 0

If the module parameter virtual_gb is greater than 0, the READ command
may request the blocks which exceed actual ramdisk storage (fake_storep).
prot_verify_read() should treat those blocks as wrap around the end of
fake_storep.  But it actually causes fake_storep and dif_storep buffer
overruns.

This fixes these buffer overruns.  In order to simplify the fix,
this also introduces fake_store() and dif_store() which return
corresponding wrap around addresses.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Bump driver version

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix SGL posting for unaligned ICD values

If certain configuration it is possible that ICD range is not page-aligned.
SGL posting failed in these configuration and driver load was not success.
This fix aligns ICD range values and SGL posting for IO is done.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix AER handling in driver

Signed-off-by: Minh Tran <minhduc.tran@emulex.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Invalidate WRB in Abort/Reset Path

When iSCSI stack invokes Abort or Reset handlers, the aborted tasks
Invalid Bit in WRB needs to be set. Else FW will not be aware of
the command invalidated which leads to BAD_WRB error posted by FW.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix Insufficient Buffer Error returned in MBX Completion

When MBX_Cmd completion happens with error code Insufficient Buffer,
the MBX_Cmd is posted again with the new buffer size posted by FW.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix log level for protocol specific logs

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix MSIx creation for SKH-R adapter

The MSIx to be created for SKH-R adapter should be based on
eq_count returned by get_fw_config.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Display Port Identifier for each iSCSI function

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Dispaly CID available for connection offload

Display CID available on each iSCSI Fn which can be used to
offload a connection. The display is split across available CID
on each chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix chute cleanup during drivers unload.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix connection offload to support Dual Chute.

The connection is offload to each chute in a round-robin manner
if both the chute is loaded with iSCSI protocol

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix CID allocation/freeing to support Dual chute mode

Configuration parameters returns the number of connection that
can be offloaded one each chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix WRB_Q posting to support Dual Chute mode

Configuration parameters return number of CID each chute supports. The WRB_Q
is created for the passed CID count. If both the Chute has iSCSI Protocol then
WRB_Q creation is in a round robin mechanism.

For BE-X family iSCSI protocol is loaded only on single chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix SGL Initilization and posting Pages for Dual Chute

Initialization of SGL and related PAGE posting is to be done for the chute.
Based on configuration value of each Chute,SGL initialization and page posting
is done.

For BE-X family iSCSI protocol is loaded only on single chute

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix Template HDR support for Dual Chute mode

Template HDR is created for each chute which has iSCSI Protocol loaded.
For BE-X family iSCSI protocol is loaded only on single chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix changes in ASYNC Path for SKH-R adapter

DEF_Q[HDR/DATA] is created on the chute on which iSCSI Protocol is loaded.
When a connection is offloaded, the DEF_Q HDR/Data ID needs to be passed.
FW posts ASYNC message received from target on the passed DEF_Q. Connection
can be offloaded on any of the chute so DEF_Q is created on each Chute.

Change in the ASYNC path initialization based on the configuration parameters
returned for each chute.

For BE-X family iSCSI protocol is loaded only on single chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Config parameters update for Dual Chute Support

On the adapter iSCSI protocol can be loaded on either one or both
the CHUTE.Check on which CHUTE iSCSI Protocol is loaded and get
configuration parameters based on which driver initization is done.

For BE-X family iSCSI protocol is loaded only on single chute.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix soft lock up issue during UE or if FW taking time to respond

The timeout set in MBX_CMD is 100sec and the ready bit checking in BMBX
mode is done for 4sec. After 4sec the task is scheduled out for 5 secs
to avoid kernel soft lockup stack trace. The loop of 4sec ready bit check
and then schedule out is done until the following conditon occur
- The Ready Bit is Set
- The timeout set in MBX_CMD expires

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix locking mechanism in Unsol Path

The default pdu is a common resource and needs to be protected
while manipulating it.

Signed-off-by: Minh Tran <minhduc.tran@emulex.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix negotiated parameters upload to FW

- Removed the check of MaxXmitDSL == 0 as this is not a possible
  case.
- Update connection offload data structure for SKH-R adapters.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix repeated issue of MAC ADDR get IOCTL

Storing MAC ADDR of each function in it's priv structure to
avoid issuing MAC_ADDR get IOCTL. Based on a flag set/unset
it's decided if MAC_ADDR is stored in priv structure or IOCTL
needs to be issued.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix the MCCQ count leakage

When MBX CMD is posted in MCCQ and if command times out,during
mccq resource cleanup for the timed out command  mccq->count
was not decremented. The led to BUG_ON being hit.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] be2iscsi: Fix Template HDR IOCTL

Allocating memory in the Host which will be used by the
TOE functionality during Session Offload. This fix will
allow performance improvement as adapter memory contention
will be reduced.

Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] MAINTAINER: Updated maintainer info for bnx2fc

Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] bnx2fc: Bump version from 1.0.14 to 2.4.1

Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] BNX2FC: hung task timeout warning observed when rmmod bnx2x with active FCoE targets

[v2] - removed the interface->enabled flag setting which prevented the
       fcoe ctlr link from being brought back up after a MTU change

A rtnl_lock deadlock was observed from the rmmod thread where it
tries to unregister the fcoe_ctlr device.  This unregistration
triggered a flush of the sysfs queue of the associated ctlr and led to
a call to the set_fcoe_ctlr_enabled routine.  This will eventually propagate
down to call the bnx2fc_disable routine and contented for the rtnl_lock
in the same context.

This patch creates a subset of the bnx2fc_enable/disable routine which
removes the unnecesary rtnl_lock and the bnx2fc_dev_lock acquisition from
the set_fcoe_ctlr_enabled path.

 kernel: INFO: task rmmod:7874 blocked for more than 120 seconds.
 kernel:      Tainted: G        W  ---------------    2.6.32-415.0.1.el6.x86_64 #1
 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 kernel: rmmod         D 000000000000000f     0  7874   6518 0x00000080
 kernel: ffff88022158f7d8 0000000000000086 0000000000000000 0000000000000000
 kernel: ffff88023fe72600 ffff88043c74d410 ffff88043c74d400 ffff88043c74d000
 kernel: ffff88021ecbe5f8 ffff88022158ffd8 000000000000fbc8 ffff88021ecbe5f8
 kernel: Call Trace:
 kernel: [<ffffffff81525985>] schedule_timeout+0x215/0x2e0
 kernel: [<ffffffff810680c0>] ? pick_next_task_fair+0xd0/0x130
 kernel: [<ffffffff81524858>] ? schedule+0x178/0x3b2
 kernel: [<ffffffff81525603>] wait_for_common+0x123/0x180
 kernel: [<ffffffff81066b40>] ? default_wake_function+0x0/0x20
 kernel: [<ffffffff811a486e>] ? ifind_fast+0x5e/0xb0
 kernel: [<ffffffff8152571d>] wait_for_completion+0x1d/0x20
 kernel: [<ffffffff81203868>] sysfs_addrm_finish+0x228/0x270
 kernel: [<ffffffff812014ab>] sysfs_hash_and_remove+0x5b/0x90
 kernel: [<ffffffff812056af>] sysfs_remove_group+0x5f/0x100
 kernel: [<ffffffff81367e8b>] device_remove_groups+0x3b/0x60
 kernel: [<ffffffff8136811d>] device_remove_attrs+0x3d/0x90
 kernel: [<ffffffff81368295>] device_del+0x125/0x1e0
 kernel: [<ffffffff81368372>] device_unregister+0x22/0x60
 kernel: [<ffffffffa038ead2>] fcoe_ctlr_device_delete+0xe2/0xf4 [libfcoe]
 kernel: [<ffffffffa03c43cb>] bnx2fc_interface_release+0x5b/0x90 [bnx2fc]
 kernel: [<ffffffffa03c4370>] ? bnx2fc_interface_release+0x0/0x90 [bnx2fc]
 kernel: [<ffffffff812835e7>] kref_put+0x37/0x70
 kernel: [<ffffffffa03c4192>] __bnx2fc_destroy+0x72/0xa0 [bnx2fc]
 kernel: [<ffffffffa03c5265>] bnx2fc_ulp_exit+0xf5/0x160 [bnx2fc]    <- got bnx2fc_dev_lock mutex_lock
 kernel: [<ffffffffa03b03c6>] cnic_ulp_exit+0xb6/0xc0 [cnic]
 kernel: [<ffffffffa03b5418>] cnic_netdev_event+0x368/0x370 [cnic]
 kernel: [<ffffffffa038c56c>] ? fcoe_del_netdev_mapping+0x8c/0xa0 [libfcoe]
 kernel: [<ffffffff8152a6e5>] notifier_call_chain+0x55/0x80
 kernel: [<ffffffff810a0a46>] raw_notifier_call_chain+0x16/0x20
 kernel: [<ffffffff81459beb>] call_netdevice_notifiers+0x1b/0x20
 kernel: [<ffffffff8145ab34>] rollback_registered_many+0x154/0x280
 kernel: [<ffffffff8145ad08>] rollback_registered+0x38/0x50
 kernel: [<ffffffff8145ad78>] unregister_netdevice_queue+0x58/0xa0
 kernel: [<ffffffff8145add0>] unregister_netdevice+0x10/0x20
 kernel: [<ffffffff8145adfe>] unregister_netdev+0x1e/0x30                  <- got rtnl_lock!!!!!!!!!
 kernel: [<ffffffffa0122278>] __bnx2x_remove+0x48/0x270 [bnx2x] <- got & rel rtnl_lock
 kernel: [<ffffffffa0122554>] bnx2x_remove_one+0x44/0x80 [bnx2x]
 kernel: [<ffffffff812a3af7>] pci_device_remove+0x37/0x70
 kernel: [<ffffffff8136b2ef>] __device_release_driver+0x6f/0xe0
 kernel: [<ffffffff8136b428>] driver_detach+0xc8/0xd0
 kernel: [<ffffffff8136a22e>] bus_remove_driver+0x8e/0x110
 kernel: [<ffffffff8136bc12>] driver_unregister+0x62/0xa0
 kernel: [<ffffffff812a3e04>] pci_unregister_driver+0x44/0xb0
 kernel: [<ffffffffa0191954>] bnx2x_cleanup+0x18/0x73 [bnx2x]
 kernel: [<ffffffff810b8be4>] sys_delete_module+0x194/0x260
 kernel: [<ffffffff810e1347>] ? audit_syscall_entry+0x1d7/0x200
 kernel: [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b

Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] bnx2fc: Fixed a SCSI CMD cmpl race condition between ABTS and CLEANUP

In the case when a SCSI_CMD times out, bnx2fc will initiate the sending of the
ABTS.  However, if the SCSI layer's SCSI command timer also times out, it'll
instantiate a task abort of the same xid.

The race condition this patch tries to fix is as follows:

SCSI_CMD timeout (20s)
thread 1                   thread 2
send ABTS
rx ABTS cmpl
                           task abort_eh
                           explicit LOGO since ABTS was engaged
                           CLEANUP cmpl
SCSI_CMD cmpl (ABTS cmpl)
instantiate RRQ
wait 10s
attempt to send RRQ (because of LOGO, it wouldn't continue)

Note that there is no call to scsi_done for this SCSI_CMD cmpletion
in this path.

The patch changes the path of execution to call scsi_done immediately
instead of instantiating the RRQ.

Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Add support to get CHAP details for flash target session

Add support to get local CHAP - index, username and password,
sysfs params of iscsi session corresponding to flash target entry.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Add support to set CHAP entries

Provide support to add/update the CHAP entries in adapter's flash
using iscsi tools, like Open-iSCSI.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_transport_iscsi: Add support to set CHAP entries

For offload iSCSI like qla4xxx, CHAP entries are stored in adapter's
flash.
This patch adds support to add/update CHAP entries in adapter's flash
using iscsi tools, like Open-iSCSI.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Use offset based on adapter type to set CHAP entry in flash

To write a CHAP entry in adapter's flash calculate the offset based
on the type of adapter.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Populate local CHAP credentials for flash target sessions

If any flash target entry is using CHAP authentication then set
CHAP username and password sysfs params for the corresponding
iscsi sessions.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Support setting of local CHAP index for flash target entry

Support setting of CHAP_OUT_IDX param for the target entry in flash.
Setting of valid local CHAP index with enable CHAP AUTH for that
flash target entry and disabling CHAP AUTH will invalidate the CHAP
index for the flash target entry.

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: Correct the check for local CHAP entry type

Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla4xxx: correctly update session discovery_parent_idx.

Earlier logic for driver created iscsi_session->discovery_parent_idx
was to store ram index of a sendtarget entry, but driver frees
sendtarget ram index as soon as firmware is done with discovery,
which is available for further use. So changing the logic to point
iscsi_session->discovery_parent_idx to store sendtarget flashnode index.

Signed-off-by: Manish Rangankar <manish.rangankar@qlogic.com>
Signed-off-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] megaraid_sas: fixes for few endianess issues

Fixed two issues in this patch-
1) In function megasas_get_pd_list(), data read(pd_addr->deviceId) from DMAed memory is converted to CPU's endianess.
2) While register AEN, removed some endianness conversion on some fields, since their endianess is already converted.

Signed-off-by: Sumit Saxena <sumit.saxena@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] buslogic: Added check for DMA mapping errors

Added check for DMA mapping errors for request sense data
buffer. Checking for mapping error can avoid potential wild
writes. This patch was prompted by the warning from
dma_unmap when kernel is compiled with CONFIG_DMA_API_DEBUG.

Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
Tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] fnic: Incremented driver version

Signed-off-by: Hiral Patel <hiralpat@cisco.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] fnic: Fnic Statistics Collection

This feature gathers active and cumulative per fnic stats for io,
abort, terminate, reset, vlan discovery path and it also includes
various important stats for debugging issues. It also provided
debugfs and ioctl interface for user to retrieve these stats.
It also provides functionality to reset cumulative stats through
user interface.

Signed-off-by: Hiral Patel <hiralpat@cisco.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] fnic: host reset returns nonzero value(errno) on success

Fixed appropriate error codes that returns negative error number on failure,
and 0 on success. fnic_reset() is used directly by the fc transport callback
issue_fc_host_lip which requires a negative error number on failure.

Signed-off-by: Narsimhulu Musini <nmusini@cisco.com>
Signed-off-by: Hiral Patel <hiralpat@cisco.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] export device_busy for sdev

If you mutiple devices connect to a host, we might be interested in
have an intensive I/O workload on one disk, and notice starvation on others.
This give the user more hint about current infight io for scsi device.

Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] scsi_dh_rdac: Add new IBM 1813 product id to rdac devlist

Signed-off-by: Sean Stewart <Sean.Stewart@netapp.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] lpfc: remove unnecessary read of PCI_CAP_ID_EXP

The PCIE capability offset is saved during PCI bus walking.  It will
remove an unnecessary search in the PCI configuration space if this
value is referenced instead of reacquiring it.  Also, pci_is_pcie is a
better way of determining if the device is PCIE or not (as it uses the
same saved PCIE capability offset).

Signed-off-by: Jon Mason <jdmason@kudzu.us>
Acked-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] hpsa: remove unused Smart Array ID

This patch removes the PCI ID of a cancelled Smart Array.

Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] sd: call blk_pm_runtime_init before add_disk

Sujit has found a race condition that would make q->nr_pending
unbalanced, it occurs as Sujit explained:

"
sd_probe_async() ->
add_disk() ->
disk_add_event() ->
schedule(disk_events_workfn)
sd_revalidate_disk()
blk_pm_runtime_init()
return;

Let's say the disk_events_workfn() calls sd_check_events() which tries
to send test_unit_ready() and because of sd_revalidate_disk() trying to
send another commands the test_unit_ready() might be re-queued as the
tagged command queuing is disabled.

So the race condition is -

Thread 1    | Thread 2
sd_revalidate_disk()   | sd_check_events()
...nr_pending = 0 as q->dev = NULL| scsi_queue_insert()
blk_runtime_pm_init()   |  blk_pm_requeue_request() ->
  | nr_pending = -1 since
  | q->dev != NULL
"

The problem is, the test_unit_ready request doesn't get counted the
first time it is queued, so the later decrement of q->nr_pending in
blk_pm_requeue_request makes it unbalanced.

Fix this by calling blk_pm_runtime_init before add_disk so that all
requests initiated there will all be counted.

Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Reported-and-tested-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] qla2xxx: Fix request queue null dereference.

If an invalid IOCB is returned on the response queue then the index into the
request queue map could be invalid and could return to us a bogus value. This
could cause us to try to deference an invalid pointer and cause an exception.

If we encounter this condition, simply return as no context can be established
for this response.

Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] BusLogic: Fix an oops when intializing multimaster adapter

This fixes an oops caused by buslogic driver when initializing a BusLogic
MultiMaster adapter. Initialization code used scope of a variable
incorrectly which created a NULL pointer. Oops message is below:

BUG: unable to handle kernel NULL pointer dereference at 0000000c
IP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583
*pde = 00000000
Oops: 002 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.11.1.puz1 #1
Hardware name:    /Canterwood, BIOS 6.00 PG 05/16/2003
task: f7050000 ti: f7054000 task.ti: f7054000
EIP: 0060:[<c150c137>] EFLAGS: 00010246 CPU:1
EIP is at blogic_init_mm_probeinfo.isra.17+0x20a/0x583
EAX: 00000013 EBX: 00000000 ECX: 00000000 EDX: f8001000
ESI: f71cb800 EDI: f7388000 EBP: 00007800 ESP: f7055c84
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 0000000c CR3: 0154f000 CR4: 000007d0
Stack:
 0000001c 00000000 c11a59f6 f7055c98 00008130 ffffffff ffffffff 00000000
 00000003 00000000 00000000 00000000 00000013 f8001000 00000001 000003d0
 00000000 00000000 00000000 c14e3f84 f78803c8 00000000 f738c000 000000e9
Call Trace:
 [<c11a59f6>] ? pci_get_subsys+0x33/0x38
 [<c150c4fb>] ? blogic_init_probeinfo_list+0x4b/0x19e
 [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623
 [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623
 [<c10fb99e>] ? sysfs_link_sibling+0x61/0x8d
 [<c10b0519>] ? kmem_cache_alloc+0x8b/0xb5
 [<c150cce5>] ? blogic_init+0xa1/0x10e8
 [<c10fc0a8>] ? sysfs_add_one+0x10/0x9d
 [<c10fc18a>] ? sysfs_addrm_finish+0x12/0x85
 [<c10fca37>] ? sysfs_do_create_link_sd+0x9d/0x1b4
 [<c117c272>] ? blk_register_queue+0x69/0xb3
 [<c10fcb68>] ? sysfs_create_link+0x1a/0x2c
 [<c1181a07>] ? add_disk+0x1a1/0x3c7
 [<c138737b>] ? klist_next+0x60/0xc3
 [<c122cc3a>] ? scsi_dh_detach+0x68/0x68
 [<c1213e36>] ? bus_for_each_dev+0x51/0x61
 [<c1000356>] ? do_one_initcall+0x22/0x12c
 [<c10f3688>] ? __proc_create+0x8c/0xba
 [<c150cc44>] ? blogic_setup+0x5f6/0x5f6
 [<c14e94aa>] ? repair_env_string+0xf/0x4d
 [<c14e949b>] ? do_early_param+0x71/0x71
 [<c103efaa>] ? parse_args+0x21f/0x33d
 [<c14e9a54>] ? kernel_init_freeable+0xdf/0x17d
 [<c14e949b>] ? do_early_param+0x71/0x71
 [<c1388b64>] ? kernel_init+0x8/0xc0
 [<c1392222>] ? ret_from_kernel_thread+0x6/0x28
 [<c1392227>] ? ret_from_kernel_thread+0x1b/0x28
 [<c1388b5c>] ? rest_init+0x6c/0x6c
Code: 89 44 24 10 0f b6 44 24 3d 89 44 24 0c c7 44 24 08 00 00 00 00 c7 44 24 04 38 62 46 c1 c7 04 24 02 00 00 00 e8 78 13 d2 ff 31 db <89> 6b 0c b0 20 89 ea ee
 c7 44 24 08 04 00 00 00 8d 44 24 4c 89
EIP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 SS:ESP 0068:f7055c84
CR2: 000000000000000c
---[ end trace 17f45f5196d40487 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009

Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
Cc: <stable@vger.kernel.org> # 3.11.x
Reported-by: Pierre Uszynski <pierre@rahul.net>
Tested-by: Pierre Uszynski <pierre@rahul.net>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Linux 3.12-rc5

Merge git://www.linux-watchdog.org/linux-watchdog

Pull watchdog fixes from Wim Van Sebroeck:
 "This will fix a deadlock on the ts72xx_wdt driver, fix bitmasks in the
  kempld_wdt driver and fix a section mismatch in the sunxi_wdt driver"

* git://www.linux-watchdog.org/linux-watchdog:
  watchdog: sunxi: Fix section mismatch
  watchdog: kempld_wdt: Fix bit mask definition
  watchdog: ts72xx_wdt: locking bug in ioctl

watchdog: sunxi: Fix section mismatch

This driver has a section mismatch, for probe and remove functions,
leading to the following warning during the compilation.

WARNING: drivers/watchdog/built-in.o(.data+0x24): Section mismatch in
reference from the variable sunxi_wdt_driver to the function
.init.text:sunxi_wdt_probe()
The variable sunxi_wdt_driver references
the function __init sunxi_wdt_probe()

Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

watchdog: kempld_wdt: Fix bit mask definition

STAGE_CFG bits are defined as [5:4] bits. However, '(((x) & 0x30) << 4)'
handles [9:8] bits. Thus, it should be fixed in order to handle
[5:4] bits.

Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

watchdog: ts72xx_wdt: locking bug in ioctl

Calling the WDIOC_GETSTATUS & WDIOC_GETBOOTSTATUS and twice will cause a
interruptible deadlock.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

Merge tag 'fixes-for-linus' of git://git./linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Olof Johansson:
 "A small batch of fixes this week, mostly OMAP related.  Nothing stands
  out as particularly controversial.

  Also a fix for a 3.12-rc1 timer regression for Exynos platforms,
  including the Chromebooks"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: exynos: dts: Update 5250 arch timer node with clock frequency
  ARM: OMAP2: RX-51: Add missing max_current to rx51_lp5523_led_config
  ARM: mach-omap2: board-generic: fix undefined symbol
  ARM: dts: Fix pinctrl mask for omap3
  ARM: OMAP3: Fix hardware detection for omap3630 when booted with device tree
  ARM: OMAP2: gpmc-onenand: fix sync mode setup with DT

ARM: exynos: dts: Update 5250 arch timer node with clock frequency

Without the "clock-frequency" property in arch timer node, could able
to see the below crash dump.

[<c0014e28>] (unwind_backtrace+0x0/0xf4) from [<c0011808>] (show_stack+0x10/0x14)
[<c0011808>] (show_stack+0x10/0x14) from [<c036ac1c>] (dump_stack+0x7c/0xb0)
[<c036ac1c>] (dump_stack+0x7c/0xb0) from [<c01ab760>] (Ldiv0_64+0x8/0x18)
[<c01ab760>] (Ldiv0_64+0x8/0x18) from [<c0062f60>] (clockevents_config.part.2+0x1c/0x74)
[<c0062f60>] (clockevents_config.part.2+0x1c/0x74) from [<c0062fd8>] (clockevents_config_and_register+0x20/0x2c)
[<c0062fd8>] (clockevents_config_and_register+0x20/0x2c) from [<c02b8e8c>] (arch_timer_setup+0xa8/0x134)
[<c02b8e8c>] (arch_timer_setup+0xa8/0x134) from [<c04b47b4>] (arch_timer_init+0x1f4/0x24c)
[<c04b47b4>] (arch_timer_init+0x1f4/0x24c) from [<c04b40d8>] (clocksource_of_init+0x34/0x58)
[<c04b40d8>] (clocksource_of_init+0x34/0x58) from [<c049ed8c>] (time_init+0x20/0x2c)
[<c049ed8c>] (time_init+0x20/0x2c) from [<c049b95c>] (start_kernel+0x1e0/0x39c)

THis is because the Exynos u-boot, for example on the Chromebooks, doesn't set
up the CNTFRQ register as expected by arch_timer. Instead, we have to specify
the frequency in the device tree like this.

Signed-off-by: Yuvaraj Kumar C D <yuvaraj.cd@samsung.com>
[olof: Changed subject, added comment, elaborated on commit message]
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'fixes-against-v3.12-rc3-take2' of git://git./linux/kernel/git/tmlind/linux-omap into fixes

From Tony Lindgren:

Few fixes for omap3 related hangs and errors that people have
noticed now that people are actually using the device tree
based booting for omap3.

Also one regression fix for timer compile for dra7xx when
omap5 is not selected, and a LED regression fix for n900.

* tag 'fixes-against-v3.12-rc3-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP2: RX-51: Add missing max_current to rx51_lp5523_led_config
  ARM: mach-omap2: board-generic: fix undefined symbol
  ARM: dts: Fix pinctrl mask for omap3
  ARM: OMAP3: Fix hardware detection for omap3630 when booted with device tree
  ARM: OMAP2: gpmc-onenand: fix sync mode setup with DT

Signed-off-by: Olof Johansson <olof@lixom.net>

Merge branch 'parisc-3.12' of git://git./linux/kernel/git/deller/parisc-linux

Pull parisc fixes from Helge Deller:
 "This patchset includes a bugfix to prevent a kernel crash when memory
  in page zero is accessed by the kernel itself, e.g.  via
  probe_kernel_read().

  Furthermore we now export flush_cache_page() which is needed
  (indirectly) by the lustre filesystem.  The other patches remove
  unused functions and optimizes the page fault handler to only evaluate
  variables if needed, which again protects against possible kernel
  crashes"

* 'parisc-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: let probe_kernel_read() capture access to page zero
  parisc: optimize variable initialization in do_page_fault
  parisc: fix interruption handler to respect pagefault_disable()
  parisc: mark parisc_terminate() noreturn and cold.
  parisc: remove unused syscall_ipi() function.
  parisc: kill SMP single function call interrupt
  parisc: Export flush_cache_page() (needed by lustre)

Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma

Pull slave-dmaengine fixes from Vinod Koul:
 "Another week, time to send another fixes request taking time out of
  extended weekend for the festivities in this part of the world.

  We have two fixes from Sergei for rcar driver and one fixing memory
  leak of edma driver by Geyslan"

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dma: edma.c: remove edma_desc leakage
  rcar-hpbdma: add parameter to set_slave() method
  rcar-hpbdma: remove shdma_free_irq() calls

parisc: let probe_kernel_read() capture access to page zero

Signed-off-by: Helge Deller <deller@gmx.de>

parisc: optimize variable initialization in do_page_fault

The attached change defers the initialization of the variables tsk, mm
and flags until they are needed. As a result, the code won't crash if a
kernel probe is done with a corrupt context and the code will be better
optimized.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>

parisc: fix interruption handler to respect pagefault_disable()

Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel.  The
problem is, that in print_worker_info() we try to read the workqueue info via
the probe_kernel_read() functions which use pagefault_disable() to avoid
crashes like this:
    probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq));
    probe_kernel_read(&wq, &pwq->wq, sizeof(wq));
    probe_kernel_read(name, wq->name, sizeof(name) - 1);

The problem here is, that the first probe_kernel_read(&pwq) might return zero
in pwq and as such the following probe_kernel_reads() try to access contents of
the page zero which is read protected and generate a kernel segfault.

With this patch we fix the interruption handler to call parisc_terminate()
directly only if pagefault_disable() was not called (in which case
preempt_count()==0).  Otherwise we hand over to the pagefault handler which
will try to look up the faulting address in the fixup tables.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v3.0+
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>

parisc: mark parisc_terminate() noreturn and cold.

Signed-off-by: Helge Deller <deller@gmx.de>

parisc: remove unused syscall_ipi() function.

Signed-off-by: Helge Deller <deller@gmx.de>

parisc: kill SMP single function call interrupt

Commit 9a46ad6d6df3b54 "smp: make smp_call_function_many() use logic
similar to smp_call_function_single()" has unified the way to handle
single and multiple cross-CPU function calls. Now only one interrupt
is needed for architecture specific code to support generic SMP function
call interfaces, so kill the redundant single function call interrupt.

Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Cc: Jiang Liu <liuj97@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>

parisc: Export flush_cache_page() (needed by lustre)

ERROR: "flush_cache_page" [drivers/staging/lustre/lustre/libcfs/libcfs.ko] undefined!

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Helge Deller <deller@gmx.de>

vfs: allow O_PATH file descriptors for fstatfs()

Olga reported that file descriptors opened with O_PATH do not work with
fstatfs(), found during further development of ksh93's thread support.

There is no reason to not allow O_PATH file descriptors here (fstatfs is
very much a path operation), so use "fdget_raw()".  See commit
55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'")
for a very similar issue reported for fstat() by the same team.

Reported-and-tested-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@kernel.org # O_PATH introduced in 3.0+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge tag 'ext4_for_linus_stable' of git://git./linux/kernel/git/tytso/ext4

Pull ext4 bugfixes from Ted Ts'o:
 "A bug fix and performance regression fix for ext4"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix memory leak in xattr
  ext4: fix performance regression in writeback of random writes

Merge branch 'for-linus' of git://git./linux/kernel/git/mason/linux-btrfs

Pull btrfs fixes from Chris Mason:
 "We've got more bug fixes in my for-linus branch:

  One of these fixes another corner of the compression oops from last
  time.  Miao nailed down some problems with concurrent snapshot
  deletion and drive balancing.

  I kept out one of his patches for more testing, but these are all
  stable"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix oops caused by the space balance and dead roots
  Btrfs: insert orphan roots into fs radix tree
  Btrfs: limit delalloc pages outside of find_delalloc_range
  Btrfs: use right root when checking for hash collision

Merge tag 'sound-3.12' of git://git./linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "All stable fixes except for a trivial headset mic fixup: the removal
  of bogus frame checks in snd-usb-usx2y driver that have regressed in
  the recent kernel versions, the HD-audio HDMI channel map fix, and a
  few HD-audio device-specific fixes"

* tag 'sound-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - Sony VAIO Pro 13 (haswell) now has a working headset jack
  ALSA: hda - Add a headset mic model for ALC269 and friends
  ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell model)
  ALSA: hda - Add fixup for ASUS N56VZ
  ALSA: hda - hdmi: Fix channel map switch not taking effect
  ALSA: hda - Fix mono speakers and headset mic on Dell Vostro 5470
  ALSA: snd-usb-usx2y: remove bogus frame checks

Merge branch 'i2c/for-current' of git://git./linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:
 "We had various reports of problems with deferred probing in the I2C
  subsystem, so this pull requst is a little bigger than usual.

  Most issues should be addressed now so devices will be found
  correctly.  A few ususal driver bugfixes are in here, too"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: i2c-mux-pinctrl: use deferred probe when adapter not found
  i2c: i2c-arb-gpio-challenge: use deferred probe when adapter not found
  i2c: i2c-mux-gpio: use deferred probing
  i2c: i2c-mux-gpio: don't ignore of_get_named_gpio errors
  i2c: omap: Clear ARDY bit twice
  i2c: Not all adapters have a parent
  i2c: i2c-stu300: replace platform_driver_probe to support deferred probing
  i2c: i2c-mxs: replace platform_driver_probe to support deferred probing
  i2c: i2c-imx: replace platform_driver_probe to support deferred probing
  i2c: i2c-designware-platdrv: replace platform_driver_probe to support deferred probing

ext4: fix memory leak in xattr

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@vger.kernel.org

Merge branch 'core-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull gcc "asm goto" miscompilation workaround from Ingo Molnar:
 "This is the fix for the GCC miscompilation discussed in the following
  lkml thread:

    [x86] BUG: unable to handle kernel paging request at 00740060

  The bug in GCC has been fixed by Jakub and the fix will be part of the
  GCC 4.8.2 release expected to be released next week - so the quirk's
  version test checks for <= 4.8.1.

  The quirk is only added to compiler-gcc4.h and not to the higher level
  compiler.h because all asm goto uses are behind a feature check"

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  compiler/gcc4: Add quirk for 'asm goto' miscompilation bug

Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "A build fix and a reboot quirk"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/reboot: Add reboot quirk for Dell Latitude E5410
  x86, build, pci: Fix PCI_MSI build on !SMP