10 Jun, 2014

1 commit

  • This patch fixes a bug where se_cmd descriptors associated with a
    Task Management Request (TMR) where not setting CMD_T_ACTIVE before
    being dispatched into target_tmr_work() process context.

    This is required in order for transport_generic_free_cmd() ->
    transport_wait_for_tasks() to wait on se_cmd->t_transport_stop_comp
    if a session reset event occurs while an ABORT_TASK is outstanding
    waiting for another I/O to complete.

    Cc: Thomas Glanzmann
    Cc: Charalampos Pournaris
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

07 Jun, 2014

4 commits

  • Convert "x == true" to "x" and "x == false" to "!x".

    Signed-off-by: Christophe Vu-Brugier
    Signed-off-by: Nicholas Bellinger

    Christophe Vu-Brugier
     
  • Signed-off-by: Christophe Vu-Brugier
    Signed-off-by: Nicholas Bellinger

    Christophe Vu-Brugier
     
  • This patch changes ft_queue_status() to set SAM_STAT_TASK_SET_FULL
    status upon lport->tt.seq_send( failure, and return -EAGAIN to notify
    target-core to attempt to requeue the response.

    It also does the same for a fc_frame_alloc() failures, in order to
    signal the initiator that it should try to reduce it's current
    queue_depth, to lower the number of outstanding I/Os on the wire.

    Reported-by: Vasu Dev
    Reviewed-by: Vasu Dev
    Cc: Jun Wu
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch changes ft_queue_data_in() to set SAM_STAT_TASK_SET_FULL
    status upon a lport->tt.seq_send() failure, where it will now stop
    sending subsequent DataIN, and immediately attempt to send the
    response with exception status.

    Sending a response with SAM_STAT_TASK_SET_FULL status is useful in
    order to signal the initiator that it should try to reduce it's
    current queue_depth, to lower the number of outstanding I/Os on
    the wire.

    Also, add a check to skip sending DataIN if TASK_SET_FULL status
    has already been set due to a response lport->tt.seq_send()
    failure, that has asked target-core to requeue a response.

    Reported-by: Vasu Dev
    Reviewed-by: Vasu Dev
    Cc: Jun Wu
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

06 Jun, 2014

3 commits

  • This patch adds an explicit check in chap_server_compute_md5() to ensure
    the CHAP_C value received from the initiator during mutual authentication
    does not match the original CHAP_C provided by the target.

    This is in line with RFC-3720, section 8.2.1:

    Originators MUST NOT reuse the CHAP challenge sent by the Responder
    for the other direction of a bidirectional authentication.
    Responders MUST check for this condition and close the iSCSI TCP
    connection if it occurs.

    Reported-by: Tejas Vaykole
    Cc: stable@vger.kernel.org # 3.1+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch removes a no-op iscsit_clear_tpg_np_login_threads() call
    in iscsit_tpg_del_portal_group(), which is unnecessary because
    iscsit_tpg_del_portal_group() can only ever be removed from configfs
    once all of the child network portals have been released.

    Also, go ahed and make iscsit_clear_tpg_np_login_threads() declared
    as static.

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • The target is failing to handle list of CHAP_A key-value pair form
    initiator.The target is expecting CHAP_A=5 always. In other cases,
    where initiator sends list (for example) CHAP_A=6,5 target is failing
    the security negotiation. Which is incorrect.

    This patch handles the case (RFC 3720 section 11.1.4).
    where in the initiator may send list of CHAP_A values and target replies
    with appropriate CHAP_A value in response

    (Drop whitespaces + rename to chap_check_algorithm + save original
    pointer + add explicit check for CHAP_A key - nab)

    Signed-off-by: Tejas Vaykole
    Signed-off-by: Nicholas Bellinger

    Tejas Vaykole
     

04 Jun, 2014

3 commits

  • If the message "Unable to allocate…" pops up, it's useful to know
    whether the problem is that the system is genuinely out of memory, or
    that some bug has led to a crazy allocation length.

    In particular this helped debug a corruption of login headers in
    iscsi_login_non_zero_tsih_s1().

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • This patch changes iscsi_target_handle_csg_zero() to explicitly
    reject login requests in SecurityNegotiation with a zero-length
    payload, following the language in RFC-3720 Section 8.2:

    Whenever an iSCSI target gets a response whose keys, or their
    values, are not according to the step definition, it MUST answer
    with a Login reject with the "Initiator Error" or "Missing Parameter"
    status.

    Previously when a zero-length login request in CSG=0 was received,
    the target would send a login response with CSG=0 + T_BIT=0 asking
    the initiator to complete authentication, and not fail the login
    until MAX_LOGIN_PDUS was reached. This change will now immediately
    fail the login attempt with ISCSI_STATUS_CLS_INITIATOR_ERR status.

    Reported-by: Tejas Vaykole
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch converts qla2xxx target code to use generic percpu_ida
    tag allocation provided by target-core, thus removing the original
    kmem_cache_zalloc() for each struct qla_tgt_cmd descriptor in the
    incoming ATIO packet fast-path.

    This includes the conversion of qlt_handle_cmd_for_atio() to perform
    qla_tgt_sess lookup before dispatching a command descriptor into
    qla_tgt_wq process context, along with handling the case where no
    active session exists, and subsequently kicking off a seperate
    process context for qlt_create_sess_from_atio() to create a new one.

    It also includes moving tag allocation into generic code within
    qlt_get_tag(), so that the same logic can be shared between
    qlt_handle_cmd_for_atio() + qlt_create_sess_from_atio() contexts.
    Also, __qlt_do_work() has been made generic between both normal
    process context in qlt_do_work() + qlt_create_sess_from_atio().

    Next, update qlt_free_cmd() to release the percpu-ida tags, and
    drop the now-unused global qla_tgt_cmd_cachep.

    Finally in tcm_qla2xxx code, tcm_qla2xxx_check_initiator_node_acl()
    has been updated to use transport_init_session_tags() along with a
    hardcoded TCM_QLA2XXX_DEFAULT_TAGS=2088 as the number of qla_tgt_cmd
    descriptors to pre-allocate per qla_tgt_sess instance.

    (Use ha->fw_xcb_count if available to calculate num_tags, and
    also factor in extra pad tags - Quinn)

    Cc: Saurav Kashyap
    Cc: Quinn Tran
    Cc: Giridhar Malavali
    Cc: Chad Dupuis
    Cc: Roland Dreier
    Cc: Christoph Hellwig
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

03 Jun, 2014

6 commits

  • This patch updates virtscsi_probe() to setup necessary Scsi_Host
    level protection resources. (currently hardcoded to 1)

    It changes virtscsi_add_cmd() to attach outgoing / incoming
    protection SGLs preceeding the data payload, and is using the
    new virtio_scsi_cmd_req_pi->pi_bytes[out,in] field to signal
    to signal to vhost/scsi bytes to expect for protection data.

    (Add missing #include for blk_integrity - sfr + nab)

    Acked-by: Paolo Bonzini
    Cc: Michael S. Tsirkin
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Sagi Grimberg
    Cc: H. Peter Anvin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch updates vhost_scsi_handle_vq() to check for the existance
    of virtio_scsi_cmd_req_pi comparing vq->iov[0].iov_len in order to
    calculate seperate data + protection SGLs from data_num.

    Also update tcm_vhost_submission_work() to pass the pre-allocated
    cmd->tvc_prot_sgl[] memory into target_submit_cmd_map_sgls(), and
    update vhost_scsi_get_tag() parameters to accept scsi_tag, lun, and
    task_attr.

    Cc: Michael S. Tsirkin
    Cc: Paolo Bonzini
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Sagi Grimberg
    Cc: H. Peter Anvin
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds vhost_scsi_map_iov_to_prot() to perform the mapping of
    T10 data integrity memory between virtio iov + struct scatterlist using
    get_user_pages_fast() following existing code.

    As with vhost_scsi_map_iov_to_sgl(), this does sanity checks against the
    total prot_sgl_count vs. pre-allocated SGLs, and loops across protection
    iovs using vhost_scsi_map_to_sgl() to perform the actual memory mapping.

    Also update tcm_vhost_release_cmd() to release associated tvc_prot_sgl[]
    struct page.

    Cc: Michael S. Tsirkin
    Cc: Paolo Bonzini
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Sagi Grimberg
    Cc: H. Peter Anvin
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch updates tcm_vhost_make_nexus() to pre-allocate per descriptor
    tcm_vhost_cmd->tvc_prot_sgl[] used to expose protection SGLs from within
    virtio-scsi guest memory to vhost-scsi.

    Cc: Michael S. Tsirkin
    Cc: Paolo Bonzini
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • Move the overflow check for sgl_count > TCM_VHOST_PREALLOC_SGLS into
    vhost_scsi_map_iov_to_sgl() so that it's based on the total number
    of SGLs for all IOVs, instead of single IOVs.

    Also, rename TCM_VHOST_PREALLOC_PAGES -> TCM_VHOST_PREALLOC_UPAGES
    to better describe pointers to user-space pages.

    Cc: Michael S. Tsirkin
    Cc: Paolo Bonzini
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds a virtio_scsi_cmd_req_pi header as recommened by
    Paolo that contains pi_bytesout + pi_bytesin elements used for
    signaling when protection information buffers (in bytes) are
    expected to preceed the data payload buffers.

    Also add new VIRTIO_SCSI_F_T10_PI feature bit to be used to signal
    host support.

    Cc: Paolo Bonzini
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Sagi Grimberg
    Cc: H. Peter Anvin
    Acked-by: Rusty Russell
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

21 May, 2014

3 commits

  • In case user chose to set T10-PI enable on the target while
    the IB device does not support it, gracefully reject the request.

    Reported-by: Slava Shwartsman
    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.15+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • disconnected_handler works are scheduled on system_wq.
    When attempting to unload, first make sure all works
    have cleaned up.

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • There are 4 RDMA_CM events that all basically mean that
    the user should teardown the IB connection:
    - DISCONNECTED
    - ADDR_CHANGE
    - DEVICE_REMOVAL
    - TIMEWAIT_EXIT

    Only in DISCONNECTED/ADDR_CHANGE it makes sense to
    call rdma_disconnect (send DREQ/DREP to our initiator).
    So we keep the same teardown handler for all of them
    but only indicate calling rdma_disconnect for the relevant
    events.

    This patch also removes redundant debug prints for each single
    event.

    v2 changes:
    - Call isert_disconnected_handler() for DEVICE_REMOVAL (Or + Sag)

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     

20 May, 2014

2 commits

  • In ungraceful teardowns isert close flows seem racy such that
    isert_wait_conn hangs as RDMA_CM_EVENT_DISCONNECTED never
    gets invoked (no one called rdma_disconnect).

    Both graceful and ungraceful teardowns will have rx flush errors
    (isert posts a batch once connection is established). Once all
    flush errors are consumed we invoke isert_wait_conn and it will
    be responsible for calling rdma_disconnect. This way it can be
    sure that rdma_disconnect was called and it won't wait forever.

    This patch also removes the logout_posted indicator. either the
    logout completion was consumed and no problem decrementing the
    post_send_buf_count, or it was consumed as a flush error. no point
    of keeping it for isert_wait_conn as there is no danger that
    isert_conn will be accidentally removed while it is running.

    (Drop unnecessary sleep_on_conn_wait_comp check in
    isert_cq_rx_comp_err - nab)

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • In case np_thread state is in RESET/SHUTDOWN/EXIT states,
    no point for isert to stall there as we may get a hang in
    case no one will wake it up later.

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     

18 May, 2014

1 commit

  • On each processed XCOPY command, two "kmalloc-512" memory objects are
    leaked. These represent two allocations of struct xcopy_pt_cmd in
    target_core_xcopy.c.

    The reason for the memory leak is that the cmd_kref field is not
    initialized (thus, it is zero because the allocations were done with
    kzalloc). When we decrement zero kref in target_put_sess_cmd, the result
    is not zero, thus target_release_cmd_kref is not called.

    This patch fixes the bug by moving kref initialization from
    target_get_sess_cmd to transport_init_se_cmd (this function is called from
    target_core_xcopy.c, so it will correctly initialize cmd_kref). It can be
    easily verified that all code that calls target_get_sess_cmd also calls
    transport_init_se_cmd earlier, thus moving kref_init shouldn't introduce
    any new problems.

    Signed-off-by: Mikulas Patocka
    Cc: stable@vger.kernel.org # 3.12+
    Signed-off-by: Nicholas Bellinger

    Mikulas Patocka
     

16 May, 2014

8 commits

  • Just like for pSCSI, if the transport sets get_write_cache, then it is
    not valid to enable write cache emulation for it. Return an error.

    see https://bugzilla.redhat.com/show_bug.cgi?id=1082675

    Reviewed-by: Chris Leech
    Signed-off-by: Andy Grover
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Andy Grover
     
  • This patch explicitly disables Immediate + Unsolicited Data for ISER
    connections during login in iscsi_login_zero_tsih_s2() when protection
    has been enabled for the session by the underlying hardware.

    This is currently required because protection / signature memory regions
    (MRs) expect T10 PI to occur on RDMA READs + RDMA WRITEs transfers, and
    not on a immediate data payload associated with ISCSI_OP_SCSI_CMD, or
    unsolicited data-out associated with a ISCSI_OP_SCSI_DATA_OUT.

    v2 changes:
    - Add TARGET_PROT_DOUT_INSERT check (Sagi)
    - Add pr_debug noisemaker (Sagi)
    - Add goto to avoid early return from MRDSL check (nab)

    Cc: Sagi Grimberg
    Cc: Or Gerlitz
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes a free-after-use regression in ft_free_cmd(), where
    ft_sess_put() is called with cmd->sess after percpu_ida_free() has
    already released the tag.

    Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(),
    and pass it directly to ft_sess_put().

    The regression was originally introduced in v3.13-rc1 commit:

    commit 5f544cfac956971099e906f94568bc3fd1a7108a
    Author: Nicholas Bellinger
    Date: Mon Sep 23 12:12:42 2013 -0700

    tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd

    Reported-by: Jun Wu
    Cc: Mark Rustad
    Cc: Robert Love
    Cc: #3.13+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch changes an incorrect use of BUG_ON to instead generate a
    REJECT + PROTOCOL_ERROR in iscsit_process_nop_out() code. This case
    can occur with traditional TCP where a flood of zeros in the data
    stream can reach this block for what is presumed to be a NOP-OUT with
    a solicited reply, but without a valid iscsi_cmd pointer.

    This incorrect BUG_ON was introduced during the v3.11-rc timeframe
    with the following commit:

    commit 778de368964c5b7e8100cde9f549992d521e9c89
    Author: Nicholas Bellinger
    Date: Fri Jun 14 16:07:47 2013 -0700

    iscsi/isert-target: Refactor ISCSI_OP_NOOP RX handling

    Reported-by: Arshad Hussain
    Cc: stable@vger.kernel.org # 3.11+
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • When the target is in stop stage, iSER transport initiates RDMA disconnects.
    The iSER initiator may wish to establish a new connection over the
    still existing network portal. In this case iSER transport should not
    accept and resume new RDMA connections. In order to learn that, iscsi_np
    is added with enabled flag so the iSER transport can check when deciding
    weather to accept and resume a new connection request.

    The iscsi_np is enabled after successful transport setup, and disabled
    before iscsi_np login threads are cleaned up.

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • RDMA CM and iSCSI target flows are asynchronous and completely
    uncorrelated. Relying on the fact that iscsi_accept_np will be called
    after CM connection request event and will wait for it is a mistake.

    When attempting to login to a few targets this flow is racy and
    unpredictable, but for parallel login to dozens of targets will
    race and hang every time.

    The correct synchronizing mechanism in this case is pending on
    a semaphore rather than a wait_for_event. We keep the pending
    interruptible for iscsi_np cleanup stage.

    (Squash patch to remove dead code into parent - nab)

    Reported-by: Slava Shwartsman
    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • Should be adding list_add_tail($new, $head) and not
    the other way around.

    Signed-off-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.10+
    Signed-off-by: Nicholas Bellinger

    Sagi Grimberg
     
  • Userspace tools assume if a value is read from configfs, it is valid
    and will not cause an error if the same value is written back. The only
    valid value for pi_prot_type for backends not supporting DIF is 0, so allow
    this particular value to be set without returning an error.

    Reported-by: Krzysztof Chojnowski
    Signed-off-by: Andy Grover
    Reviewed-by: Sagi Grimberg
    Cc: stable@vger.kernel.org # 3.14+
    Signed-off-by: Nicholas Bellinger

    Andy Grover
     

28 Apr, 2014

9 commits

  • Linus Torvalds
     
  • The asm-generic, big-endian version of zero_bytemask creates a mask of
    bytes preceding the first zero-byte by left shifting ~0ul based on the
    position of the first zero byte.

    Unfortunately, if the first (top) byte is zero, the output of
    prep_zero_mask has only the top bit set, resulting in undefined C
    behaviour as we shift left by an amount equal to the width of the type.
    As it happens, GCC doesn't manage to spot this through the call to fls(),
    but the issue remains if architectures choose to implement their shift
    instructions differently.

    An example would be arch/arm/ (AArch32), where LSL Rd, Rn, #32 results
    in Rd == 0x0, whilst on arch/arm64 (AArch64) LSL Xd, Xn, #64 results in
    Xd == Xn.

    Rather than check explicitly for the problematic shift, this patch adds
    an extra shift by 1, replacing fls with __fls. Since zero_bytemask is
    never called with a zero argument (has_zero() is used to check the data
    first), we don't need to worry about calling __fls(0), which is
    undefined.

    Cc:
    Cc: Victor Kamensky
    Signed-off-by: Will Deacon
    Signed-off-by: Linus Torvalds

    Will Deacon
     
  • This merges the patch to fix possible loss of dirty bit on munmap() or
    madvice(DONTNEED). If there are concurrent writers on other CPU's that
    have the unmapped/unneeded page in their TLBs, their writes to the page
    could possibly get lost if a third CPU raced with the TLB flush and did
    a page_mkclean() before the page was fully written.

    Admittedly, if you unmap() or madvice(DONTNEED) an area _while_ another
    thread is still busy writing to it, you deserve all the lost writes you
    could get. But we kernel people hold ourselves to higher quality
    standards than "crazy people deserve to lose", because, well, we've seen
    people do all kinds of crazy things.

    So let's get it right, just because we can, and we don't have to worry
    about it.

    * safe-dirty-tlb-flush:
    mm: split 'tlb_flush_mmu()' into tlb flushing and memory freeing parts

    Linus Torvalds
     
  • Pull btrfs fixes from Chris Mason.

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: limit the path size in send to PATH_MAX
    Btrfs: correctly set profile flags on seqlock retry
    Btrfs: use correct key when repeating search for extent item
    Btrfs: fix inode caching vs tree log
    Btrfs: fix possible memory leaks in open_ctree()
    Btrfs: avoid triggering bug_on() when we fail to start inode caching task
    Btrfs: move btrfs_{set,clear}_and_info() to ctree.h
    btrfs: replace error code from btrfs_drop_extents
    btrfs: Change the hole range to a more accurate value.
    btrfs: fix use-after-free in mount_subvol()

    Linus Torvalds
     
  • Pull arm fixes from Russell King:
    "A number of fixes for the PJ4/iwmmxt changes which arm-soc forced me
    to take during the merge window. This stuff should have been better
    tested and sorted out *before* the merge window"

    * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
    ARM: 8042/1: iwmmxt: allow to build iWMMXt on Marvell PJ4B
    ARM: 8041/1: pj4: fix cpu_is_pj4 check
    ARM: 8040/1: pj4: properly detect existence of iWMMXt coprocessor
    ARM: 8039/1: pj4: enable iWMMXt only if CONFIG_IWMMXT is set
    ARM: 8038/1: iwmmxt: explicitly check for supported architectures

    Linus Torvalds
     
  • Pull arm64 fixes from Catalin Marinas:
    - compat renameat2 syscall wiring and __NR_compat_syscalls fix
    - TLB fix for transparent huge pages following switch to generic
    mmu_gather
    - spinlock initialisation for init_mm's context
    - move of_clk_init() earlier
    - Kconfig duplicate entry fix

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    arm64: init: Move of_clk_init to time_init
    arm64: initialize spinlock for init_mm's context
    arm64: debug: remove noisy, pointless warning
    arm64: mm: Add THP TLB entries to general mmu_gather
    arm64: add renameat2 compat syscall
    ARM64: Remove duplicated Kconfig entry for "kernel/power/Kconfig"
    arm64: __NR_compat_syscalls fix

    Linus Torvalds
     
  • Pull irq fixes from Thomas Gleixner:
    "A slighlty large fix for a subtle issue in the CPU hotplug code of
    certain ARM SoCs, where the not yet online cpu needs to setup the cpu
    local timer and needs to set the interrupt affinity to itself.
    Setting interrupt affinity to a not online cpu is prohibited and
    therefor the timer interrupt ends up on the wrong cpu, which leads to
    nasty complications.

    The SoC folks tried to hack around that in the SoC code in some more
    than nasty ways. The proper solution is to have a way to enforce the
    affinity setting to a not online cpu. The core patch to the genirq
    code provides that facility and the follow up patches make use of it
    in the GIC interrupt controller and the exynos timer driver.

    The change to the core code has no implications to existing users,
    except for the rename of the locked function and therefor the
    necessary fixup in mips/cavium. Aside of that, no runtime impact is
    possible, as none of the existing interrupt chips implements anything
    which depends on the force argument of the irq_set_affinity()
    callback"

    * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    clocksource: Exynos_mct: Register clock event after request_irq()
    clocksource: Exynos_mct: Use irq_force_affinity() in cpu bringup
    irqchip: Gic: Support forced affinity setting
    genirq: Allow forcing cpu affinity of interrupts

    Linus Torvalds
     
  • Pull tty/serial fixes from Greg KH:
    "Here are a few tty/serial fixes for 3.15-rc3 that resolve a number of
    reported issues in the 8250 and samsung serial drivers, as well as a
    character loss fix for the tty core that was caused by the lock
    removal patches a release ago"

    * tag 'tty-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    serial_core: fix uart PORT_UNKNOWN handling
    serial: samsung: Change barrier() to cpu_relax() in console output
    serial: samsung: don't check config for every character
    serial: samsung: Use the passed in "port", fixing kgdb w/ no console
    serial: 8250: Fix thread unsafe __dma_tx_complete function
    8250_core: Fix unwanted TX chars write
    tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc

    Linus Torvalds
     
  • Pull staging / IIO driver fixes from Greg KH:
    "Here are some small staging and IIO driver fixes for 3.15-rc3.

    Nothing major at all, just some assorted issues that people have
    reported"

    * tag 'staging-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data
    iio: adc: mxs-lradc: fix warning when buidling on avr32
    iio: cm36651: Fix i2c client leak and possible NULL pointer dereference
    iio: querying buffer scan_mask should return 0/1
    staging:iio:ad2s1200 fix a missing break
    iio: adc: at91_adc: correct default shtim value
    ARM: at91: at91sam9260: change at91_adc name
    ARM: at91: at91sam9g45: change at91_adc name
    iio: cm32181: Fix read integration time function
    iio: adc: at91_adc: Repair broken platform_data support

    Linus Torvalds