--- /dev/null
+From 28fe5c825f8e15744d04c7c1b8df197950923ecd Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Mon, 6 May 2013 03:23:40 +0000
+Subject: ACPI / EC: Restart transaction even when the IBF flag set
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 28fe5c825f8e15744d04c7c1b8df197950923ecd upstream.
+
+The EC driver works abnormally with IBF flag always set.
+IBF means "The host has written a byte of data to the command
+or data port, but the embedded controller has not yet read it".
+If IBF is set in the EC status and not cleared, this will cause
+all subsequent EC requests to fail with a timeout error.
+
+Change the EC driver so that it doesn't refuse to restart a
+transaction if IBF is set in the status. Also increase the
+number of transaction restarts to 5, as it turns out that 2
+is not sufficient in some cases.
+
+This bug happens on several different machines (Asus V1S,
+Dell Latitude E6530, Samsung R719, Acer Aspire 5930G,
+Sony Vaio SR19VN and others).
+
+[rjw: Changelog]
+References: https://bugzilla.kernel.org/show_bug.cgi?id=14733
+References: https://bugzilla.kernel.org/show_bug.cgi?id=15560
+References: https://bugzilla.kernel.org/show_bug.cgi?id=15946
+References: https://bugzilla.kernel.org/show_bug.cgi?id=42945
+References: https://bugzilla.kernel.org/show_bug.cgi?id=48221
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ec.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -223,7 +223,7 @@ static int ec_check_sci_sync(struct acpi
+ static int ec_poll(struct acpi_ec *ec)
+ {
+ unsigned long flags;
+- int repeat = 2; /* number of command restarts */
++ int repeat = 5; /* number of command restarts */
+ while (repeat--) {
+ unsigned long delay = jiffies +
+ msecs_to_jiffies(ec_delay);
+@@ -241,8 +241,6 @@ static int ec_poll(struct acpi_ec *ec)
+ }
+ advance_transaction(ec, acpi_ec_read_status(ec));
+ } while (time_before(jiffies, delay));
+- if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
+- break;
+ pr_debug(PREFIX "controller reset, restart transaction\n");
+ spin_lock_irqsave(&ec->lock, flags);
+ start_transaction(ec);
--- /dev/null
+From 61559af111e41761f5f4f20ce0897345eb59076e Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Thu, 9 May 2013 21:14:20 +0800
+Subject: ASoC: da7213: Fix setting dmic_samplephase and dmic_clk_rate
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 61559af111e41761f5f4f20ce0897345eb59076e upstream.
+
+When set dmic_samplephase and dmic_clk_rate bits for dmic_cfg,
+current code checks pdata->dmic_data_sel which is wrong.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/da7213.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/da7213.c
++++ b/sound/soc/codecs/da7213.c
+@@ -1488,17 +1488,17 @@ static int da7213_probe(struct snd_soc_c
+ DA7213_DMIC_DATA_SEL_SHIFT);
+ break;
+ }
+- switch (pdata->dmic_data_sel) {
++ switch (pdata->dmic_samplephase) {
+ case DA7213_DMIC_SAMPLE_ON_CLKEDGE:
+ case DA7213_DMIC_SAMPLE_BETWEEN_CLKEDGE:
+- dmic_cfg |= (pdata->dmic_data_sel <<
++ dmic_cfg |= (pdata->dmic_samplephase <<
+ DA7213_DMIC_SAMPLEPHASE_SHIFT);
+ break;
+ }
+- switch (pdata->dmic_data_sel) {
++ switch (pdata->dmic_clk_rate) {
+ case DA7213_DMIC_CLK_3_0MHZ:
+ case DA7213_DMIC_CLK_1_5MHZ:
+- dmic_cfg |= (pdata->dmic_data_sel <<
++ dmic_cfg |= (pdata->dmic_clk_rate <<
+ DA7213_DMIC_CLK_RATE_SHIFT);
+ break;
+ }
--- /dev/null
+From ca182aee389f8026401510f4c63841cb02c820e8 Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Tue, 7 May 2013 08:20:27 -0700
+Subject: cpufreq / intel_pstate: fix ffmpeg regression
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit ca182aee389f8026401510f4c63841cb02c820e8 upstream.
+
+The ffmpeg benchmark in the phoronix test suite has threads on
+multiple cores that rely on the progress on of threads on other cores
+and ping pong back and forth fast enough to make the core appear less
+busy than it "should" be. If the core has been at minimum p-state for
+a while bump the pstate up to kick the core to see if it is in this
+ping pong state. If the core is truly idle the p-state will be
+reduced at the next sample time. If the core makes more progress it
+will send more work to the thread bringing both threads out of the
+ping pong scenario and the p-state will be selected normally.
+
+This fixes a performance regression of approximately 30%
+
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -551,22 +551,16 @@ static void intel_pstate_timer_func(unsi
+ struct cpudata *cpu = (struct cpudata *) __data;
+
+ intel_pstate_sample(cpu);
++ intel_pstate_adjust_busy_pstate(cpu);
+
+- if (!cpu->idle_mode)
+- intel_pstate_adjust_busy_pstate(cpu);
+- else
+- intel_pstate_adjust_idle_pstate(cpu);
+-
+-#if defined(XPERF_FIX)
+ if (cpu->pstate.current_pstate == cpu->pstate.min_pstate) {
+ cpu->min_pstate_count++;
+ if (!(cpu->min_pstate_count % 5)) {
+ intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
+- intel_pstate_idle_mode(cpu);
+ }
+ } else
+ cpu->min_pstate_count = 0;
+-#endif
++
+ intel_pstate_set_sample_time(cpu);
+ }
+
--- /dev/null
+From 1abc4b20b85b42e8573957e54b193385cf48b0d6 Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Tue, 7 May 2013 08:20:25 -0700
+Subject: cpufreq / intel_pstate: remove idle time and duration from sample and calculations
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit 1abc4b20b85b42e8573957e54b193385cf48b0d6 upstream.
+
+Idle time is taken into account in the APERF/MPERF ratio calculation
+there is no reason for the driver to track it seperately. This
+reduces the work in the driver and makes the code more readable.
+
+Removal of the tracking of sample duration removes the possibility of
+the divide by zero exception when the duration is sub 1us
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=56691
+Reported-by: Mike Lothian <mike@fireburn.co.uk>
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 43 ++++++-----------------------------------
+ 1 file changed, 7 insertions(+), 36 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -48,12 +48,7 @@ static inline int32_t div_fp(int32_t x,
+ }
+
+ struct sample {
+- ktime_t start_time;
+- ktime_t end_time;
+ int core_pct_busy;
+- int pstate_pct_busy;
+- u64 duration_us;
+- u64 idletime_us;
+ u64 aperf;
+ u64 mperf;
+ int freq;
+@@ -91,8 +86,6 @@ struct cpudata {
+ int min_pstate_count;
+ int idle_mode;
+
+- ktime_t prev_sample;
+- u64 prev_idle_time_us;
+ u64 prev_aperf;
+ u64 prev_mperf;
+ int sample_ptr;
+@@ -450,48 +443,26 @@ static inline void intel_pstate_calc_bus
+ struct sample *sample)
+ {
+ u64 core_pct;
+- sample->pstate_pct_busy = 100 - div64_u64(
+- sample->idletime_us * 100,
+- sample->duration_us);
+ core_pct = div64_u64(sample->aperf * 100, sample->mperf);
+ sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
+
+- sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct),
+- 100);
++ sample->core_pct_busy = core_pct;
+ }
+
+ static inline void intel_pstate_sample(struct cpudata *cpu)
+ {
+- ktime_t now;
+- u64 idle_time_us;
+ u64 aperf, mperf;
+
+- now = ktime_get();
+- idle_time_us = get_cpu_idle_time_us(cpu->cpu, NULL);
+-
+ rdmsrl(MSR_IA32_APERF, aperf);
+ rdmsrl(MSR_IA32_MPERF, mperf);
+- /* for the first sample, don't actually record a sample, just
+- * set the baseline */
+- if (cpu->prev_idle_time_us > 0) {
+- cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
+- cpu->samples[cpu->sample_ptr].start_time = cpu->prev_sample;
+- cpu->samples[cpu->sample_ptr].end_time = now;
+- cpu->samples[cpu->sample_ptr].duration_us =
+- ktime_us_delta(now, cpu->prev_sample);
+- cpu->samples[cpu->sample_ptr].idletime_us =
+- idle_time_us - cpu->prev_idle_time_us;
+-
+- cpu->samples[cpu->sample_ptr].aperf = aperf;
+- cpu->samples[cpu->sample_ptr].mperf = mperf;
+- cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
+- cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
++ cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
++ cpu->samples[cpu->sample_ptr].aperf = aperf;
++ cpu->samples[cpu->sample_ptr].mperf = mperf;
++ cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
++ cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
+
+- intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
+- }
++ intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
+
+- cpu->prev_sample = now;
+- cpu->prev_idle_time_us = idle_time_us;
+ cpu->prev_aperf = aperf;
+ cpu->prev_mperf = mperf;
+ }
--- /dev/null
+From d8f469e9cff3bc4a6317d923e9506be046aa7bdc Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Tue, 7 May 2013 08:20:26 -0700
+Subject: cpufreq / intel_pstate: use lowest requested max performance
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit d8f469e9cff3bc4a6317d923e9506be046aa7bdc upstream.
+
+There are two ways that the maximum p-state can be clamped, via a
+policy change and via the sysfs file.
+
+The acpi-thermal driver adjusts the p-state policy in response to
+thermal events. These changes override the users settings at the
+moment.
+
+Use the lowest of the two requested values this ensures that we will
+not exceed the requested pstate from either mechanism.
+
+Reported-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -117,6 +117,8 @@ struct perf_limits {
+ int min_perf_pct;
+ int32_t max_perf;
+ int32_t min_perf;
++ int max_policy_pct;
++ int max_sysfs_pct;
+ };
+
+ static struct perf_limits limits = {
+@@ -125,6 +127,8 @@ static struct perf_limits limits = {
+ .max_perf = int_tofp(1),
+ .min_perf_pct = 0,
+ .min_perf = 0,
++ .max_policy_pct = 100,
++ .max_sysfs_pct = 100,
+ };
+
+ static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
+@@ -295,7 +299,8 @@ static ssize_t store_max_perf_pct(struct
+ if (ret != 1)
+ return -EINVAL;
+
+- limits.max_perf_pct = clamp_t(int, input, 0 , 100);
++ limits.max_sysfs_pct = clamp_t(int, input, 0 , 100);
++ limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
+ limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
+ return count;
+ }
+@@ -641,8 +646,9 @@ static int intel_pstate_set_policy(struc
+ limits.min_perf_pct = clamp_t(int, limits.min_perf_pct, 0 , 100);
+ limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
+
+- limits.max_perf_pct = policy->max * 100 / policy->cpuinfo.max_freq;
+- limits.max_perf_pct = clamp_t(int, limits.max_perf_pct, 0 , 100);
++ limits.max_policy_pct = policy->max * 100 / policy->cpuinfo.max_freq;
++ limits.max_policy_pct = clamp_t(int, limits.max_policy_pct, 0 , 100);
++ limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
+ limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
+
+ if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
--- /dev/null
+From a5f2b3d6a738e7d4180012fe7b541172f8c8dcea Mon Sep 17 00:00:00 2001
+From: Chen Gang <gang.chen@asianux.com>
+Date: Thu, 16 May 2013 14:04:25 -0500
+Subject: drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow
+
+From: Chen Gang <gang.chen@asianux.com>
+
+commit a5f2b3d6a738e7d4180012fe7b541172f8c8dcea upstream.
+
+When calling memcpy, read_data and write_data need additional 2 bytes.
+
+ write_data:
+ for checking: "if (size > IPMI_MAX_MSG_LENGTH)"
+ for operating: "memcpy(bt->write_data + 3, data + 1, size - 1)"
+
+ read_data:
+ for checking: "if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH)"
+ for operating: "memcpy(data + 2, bt->read_data + 4, msg_len - 2)"
+
+Signed-off-by: Chen Gang <gang.chen@asianux.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ipmi/ipmi_bt_sm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_bt_sm.c
++++ b/drivers/char/ipmi/ipmi_bt_sm.c
+@@ -95,9 +95,9 @@ struct si_sm_data {
+ enum bt_states state;
+ unsigned char seq; /* BT sequence number */
+ struct si_sm_io *io;
+- unsigned char write_data[IPMI_MAX_MSG_LENGTH];
++ unsigned char write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
+ int write_count;
+- unsigned char read_data[IPMI_MAX_MSG_LENGTH];
++ unsigned char read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
+ int read_count;
+ int truncated;
+ long timeout; /* microseconds countdown */
--- /dev/null
+From fefaedcfb82d2e57c2320acf60604ab03b750cc0 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Sun, 12 May 2013 22:00:51 -0700
+Subject: drm/radeon: check incoming cliprects pointer
+
+From: Kees Cook <keescook@chromium.org>
+
+commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.
+
+The "boxes" parameter points into userspace memory. It should be verified
+like any other operation against user memory.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r300_cmdbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
++++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
+@@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeo
+ OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
+
+ for (i = 0; i < nr; ++i) {
+- if (DRM_COPY_FROM_USER_UNCHECKED
++ if (DRM_COPY_FROM_USER
+ (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
+ DRM_ERROR("copy cliprect faulted\n");
+ return -EFAULT;
--- /dev/null
+From e9ced8e040ebe40e9953db90acbe7d0b58702ebb Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 15 May 2013 01:23:36 +0000
+Subject: drm/radeon: restore nomodeset operation (v2)
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit e9ced8e040ebe40e9953db90acbe7d0b58702ebb upstream.
+
+When UMS was deprecated it removed support for nomodeset commandline
+we really want this in distro land so we can debug stuff, everyone
+should fallback to vesa correctly.
+
+v2: oops -1 isn't used anymore, restore original behaviour
+-1 is default, so we can boot with nomodeset on the command line,
+then use radeon.modeset=1 to override it for debugging later.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_drv.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -144,7 +144,7 @@ static inline void radeon_unregister_atp
+ #endif
+
+ int radeon_no_wb;
+-int radeon_modeset = 1;
++int radeon_modeset = -1;
+ int radeon_dynclks = -1;
+ int radeon_r4xx_atom = 0;
+ int radeon_agpmode = 0;
+@@ -449,6 +449,16 @@ static struct pci_driver radeon_kms_pci_
+
+ static int __init radeon_init(void)
+ {
++#ifdef CONFIG_VGA_CONSOLE
++ if (vgacon_text_force() && radeon_modeset == -1) {
++ DRM_INFO("VGACON disable radeon kernel modesetting.\n");
++ radeon_modeset = 0;
++ }
++#endif
++ /* set to modesetting by default if not nomodeset */
++ if (radeon_modeset == -1)
++ radeon_modeset = 1;
++
+ if (radeon_modeset == 1) {
+ DRM_INFO("radeon kernel modesetting enabled.\n");
+ driver = &kms_driver;
--- /dev/null
+From 6368087e851e697679af059b4247aca33a69cef3 Mon Sep 17 00:00:00 2001
+From: Benjamin LaHaise <bcrl@kvack.org>
+Date: Thu, 16 May 2013 14:04:27 -0500
+Subject: ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex
+
+From: Benjamin LaHaise <bcrl@kvack.org>
+
+commit 6368087e851e697679af059b4247aca33a69cef3 upstream.
+
+When a 32 bit version of ipmitool is used on a 64 bit kernel, the
+ipmi_devintf code fails to correctly acquire ipmi_mutex. This results in
+incomplete data being retrieved in some cases, or other possible failures.
+Add a wrapper around compat_ipmi_ioctl() to take ipmi_mutex to fix this.
+
+Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ipmi/ipmi_devintf.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/ipmi/ipmi_devintf.c
++++ b/drivers/char/ipmi/ipmi_devintf.c
+@@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct fil
+ return ipmi_ioctl(filep, cmd, arg);
+ }
+ }
++
++static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
++ unsigned long arg)
++{
++ int ret;
++
++ mutex_lock(&ipmi_mutex);
++ ret = compat_ipmi_ioctl(filep, cmd, arg);
++ mutex_unlock(&ipmi_mutex);
++
++ return ret;
++}
+ #endif
+
+ static const struct file_operations ipmi_fops = {
+ .owner = THIS_MODULE,
+ .unlocked_ioctl = ipmi_unlocked_ioctl,
+ #ifdef CONFIG_COMPAT
+- .compat_ioctl = compat_ipmi_ioctl,
++ .compat_ioctl = unlocked_compat_ipmi_ioctl,
+ #endif
+ .open = ipmi_open,
+ .release = ipmi_release,
--- /dev/null
+From 3eccfdb01da58fbd0f789ae6ca61cee3769e26de Mon Sep 17 00:00:00 2001
+From: Shlomo Pongratz <shlomop@mellanox.com>
+Date: Sun, 5 May 2013 17:36:26 +0300
+Subject: iscsi-target: Fix processing of OOO commands
+
+From: Shlomo Pongratz <shlomop@mellanox.com>
+
+commit 3eccfdb01da58fbd0f789ae6ca61cee3769e26de upstream.
+
+Fix two issues in OOO commands processing done at iscsit_attach_ooo_cmdsn.
+
+Handle command serial numbers wrap around by using iscsi_sna_lt and not regular comparisson.
+
+The routine iterates until it finds an entry whose serial number is greater than the serial number of
+the new one, thus the new entry should be inserted before that entry and not after.
+
+Signed-off-by: Shlomo Pongratz <shlomop@mellanox.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_erl1.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_erl1.c
++++ b/drivers/target/iscsi/iscsi_target_erl1.c
+@@ -819,7 +819,7 @@ static int iscsit_attach_ooo_cmdsn(
+ /*
+ * CmdSN is greater than the tail of the list.
+ */
+- if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn)
++ if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
+ list_add_tail(&ooo_cmdsn->ooo_list,
+ &sess->sess_ooo_cmdsn_list);
+ else {
+@@ -829,11 +829,12 @@ static int iscsit_attach_ooo_cmdsn(
+ */
+ list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
+ ooo_list) {
+- if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
++ if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
+ continue;
+
++ /* Insert before this entry */
+ list_add(&ooo_cmdsn->ooo_list,
+- &ooo_tmp->ooo_list);
++ ooo_tmp->ooo_list.prev);
+ break;
+ }
+ }
--- /dev/null
+From 93782eba49e23c3f311a6b05a19ba15927ec4e8b Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Sat, 4 May 2013 16:50:58 +0000
+Subject: parisc: fix NATIVE set up in build
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 93782eba49e23c3f311a6b05a19ba15927ec4e8b upstream.
+
+The ifeq operator does not accept globs, so this little bit of code will
+never match (unless uname literally prints out "parsic*"). Rewrite to
+use a pattern matching operator so that NATIVE is set to 1 on parisc.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Makefile | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -24,9 +24,7 @@ CHECKFLAGS += -D__hppa__=1
+ LIBGCC = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
+
+ MACHINE := $(shell uname -m)
+-ifeq ($(MACHINE),parisc*)
+-NATIVE := 1
+-endif
++NATIVE := $(if $(filter parisc%,$(MACHINE)),1,0)
+
+ ifdef CONFIG_64BIT
+ UTS_MACHINE := parisc64
--- /dev/null
+From f0a18819e261afc5fdbd8c5c6f9943123c5461ba Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Fri, 10 May 2013 23:21:38 +0000
+Subject: parisc: fix SMP races when updating PTE and TLB entries in entry.S
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit f0a18819e261afc5fdbd8c5c6f9943123c5461ba upstream.
+
+Currently, race conditions exist in the handling of TLB interruptions in
+entry.S. In particular, dirty bit updates can be lost if an accessed
+interruption occurs just after the dirty bit interruption on a different
+cpu. Lost dirty bit updates result in user pages not being flushed and
+general system instability. This change adds lock and unlock macros to
+synchronize all PTE and TLB updates done in entry.S. As a result,
+userspace stability is significantly improved.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/entry.S | 155 ++++++++++++++++++++++++---------------------
+ 1 file changed, 83 insertions(+), 72 deletions(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -444,9 +444,41 @@
+ L2_ptep \pgd,\pte,\index,\va,\fault
+ .endm
+
++ /* Acquire pa_dbit_lock lock. */
++ .macro dbit_lock spc,tmp,tmp1
++#ifdef CONFIG_SMP
++ cmpib,COND(=),n 0,\spc,2f
++ load32 PA(pa_dbit_lock),\tmp
++1: LDCW 0(\tmp),\tmp1
++ cmpib,COND(=) 0,\tmp1,1b
++ nop
++2:
++#endif
++ .endm
++
++ /* Release pa_dbit_lock lock without reloading lock address. */
++ .macro dbit_unlock0 spc,tmp
++#ifdef CONFIG_SMP
++ or,COND(=) %r0,\spc,%r0
++ stw \spc,0(\tmp)
++#endif
++ .endm
++
++ /* Release pa_dbit_lock lock. */
++ .macro dbit_unlock1 spc,tmp
++#ifdef CONFIG_SMP
++ load32 PA(pa_dbit_lock),\tmp
++ dbit_unlock0 \spc,\tmp
++#endif
++ .endm
++
+ /* Set the _PAGE_ACCESSED bit of the PTE. Be clever and
+ * don't needlessly dirty the cache line if it was already set */
+- .macro update_ptep ptep,pte,tmp,tmp1
++ .macro update_ptep spc,ptep,pte,tmp,tmp1
++#ifdef CONFIG_SMP
++ or,COND(=) %r0,\spc,%r0
++ LDREG 0(\ptep),\pte
++#endif
+ ldi _PAGE_ACCESSED,\tmp1
+ or \tmp1,\pte,\tmp
+ and,COND(<>) \tmp1,\pte,%r0
+@@ -455,7 +487,11 @@
+
+ /* Set the dirty bit (and accessed bit). No need to be
+ * clever, this is only used from the dirty fault */
+- .macro update_dirty ptep,pte,tmp
++ .macro update_dirty spc,ptep,pte,tmp
++#ifdef CONFIG_SMP
++ or,COND(=) %r0,\spc,%r0
++ LDREG 0(\ptep),\pte
++#endif
+ ldi _PAGE_ACCESSED|_PAGE_DIRTY,\tmp
+ or \tmp,\pte,\pte
+ STREG \pte,0(\ptep)
+@@ -1103,11 +1139,13 @@ dtlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,dtlb_check_alias_20w
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1127,11 +1165,13 @@ nadtlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,nadtlb_check_alias_20w
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1153,7 +1193,8 @@ dtlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,dtlb_check_alias_11
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1164,6 +1205,7 @@ dtlb_miss_11:
+ idtlbp prot,(%sr1,va)
+
+ mtsp t0, %sr1 /* Restore sr1 */
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1184,7 +1226,8 @@ nadtlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,nadtlb_check_alias_11
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1196,6 +1239,7 @@ nadtlb_miss_11:
+ idtlbp prot,(%sr1,va)
+
+ mtsp t0, %sr1 /* Restore sr1 */
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1216,13 +1260,15 @@ dtlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,dtlb_check_alias_20
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t0
+
+ idtlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1242,13 +1288,15 @@ nadtlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,nadtlb_check_alias_20
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t0
+
+ idtlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1349,11 +1397,13 @@ itlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,itlb_fault
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ iitlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1371,11 +1421,13 @@ naitlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,naitlb_check_alias_20w
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ iitlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1397,7 +1449,8 @@ itlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,itlb_fault
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1408,6 +1461,7 @@ itlb_miss_11:
+ iitlbp prot,(%sr1,va)
+
+ mtsp t0, %sr1 /* Restore sr1 */
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1419,7 +1473,8 @@ naitlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,naitlb_check_alias_11
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1430,6 +1485,7 @@ naitlb_miss_11:
+ iitlbp prot,(%sr1,va)
+
+ mtsp t0, %sr1 /* Restore sr1 */
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1451,13 +1507,15 @@ itlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,itlb_fault
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t0
+
+ iitlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1469,13 +1527,15 @@ naitlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,naitlb_check_alias_20
+
+- update_ptep ptp,pte,t0,t1
++ dbit_lock spc,t0,t1
++ update_ptep spc,ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t0
+
+ iitlbt pte,prot
++ dbit_unlock1 spc,t0
+
+ rfir
+ nop
+@@ -1499,29 +1559,13 @@ dbit_trap_20w:
+
+ L3_ptep ptp,pte,t0,va,dbit_fault
+
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nolock_20w
+- load32 PA(pa_dbit_lock),t0
+-
+-dbit_spin_20w:
+- LDCW 0(t0),t1
+- cmpib,COND(=) 0,t1,dbit_spin_20w
+- nop
+-
+-dbit_nolock_20w:
+-#endif
+- update_dirty ptp,pte,t1
++ dbit_lock spc,t0,t1
++ update_dirty spc,ptp,pte,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nounlock_20w
+- ldi 1,t1
+- stw t1,0(t0)
+-
+-dbit_nounlock_20w:
+-#endif
++ dbit_unlock0 spc,t0
+
+ rfir
+ nop
+@@ -1535,18 +1579,8 @@ dbit_trap_11:
+
+ L2_ptep ptp,pte,t0,va,dbit_fault
+
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nolock_11
+- load32 PA(pa_dbit_lock),t0
+-
+-dbit_spin_11:
+- LDCW 0(t0),t1
+- cmpib,= 0,t1,dbit_spin_11
+- nop
+-
+-dbit_nolock_11:
+-#endif
+- update_dirty ptp,pte,t1
++ dbit_lock spc,t0,t1
++ update_dirty spc,ptp,pte,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1557,13 +1591,7 @@ dbit_nolock_11:
+ idtlbp prot,(%sr1,va)
+
+ mtsp t1, %sr1 /* Restore sr1 */
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nounlock_11
+- ldi 1,t1
+- stw t1,0(t0)
+-
+-dbit_nounlock_11:
+-#endif
++ dbit_unlock0 spc,t0
+
+ rfir
+ nop
+@@ -1575,32 +1603,15 @@ dbit_trap_20:
+
+ L2_ptep ptp,pte,t0,va,dbit_fault
+
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nolock_20
+- load32 PA(pa_dbit_lock),t0
+-
+-dbit_spin_20:
+- LDCW 0(t0),t1
+- cmpib,= 0,t1,dbit_spin_20
+- nop
+-
+-dbit_nolock_20:
+-#endif
+- update_dirty ptp,pte,t1
++ dbit_lock spc,t0,t1
++ update_dirty spc,ptp,pte,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t1
+
+ idtlbt pte,prot
+-
+-#ifdef CONFIG_SMP
+- cmpib,COND(=),n 0,spc,dbit_nounlock_20
+- ldi 1,t1
+- stw t1,0(t0)
+-
+-dbit_nounlock_20:
+-#endif
++ dbit_unlock0 spc,t0
+
+ rfir
+ nop
--- /dev/null
+From 6880b0150a7c25fd75c5ece80abc49ebf53c38c1 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 11 May 2013 19:04:09 +0000
+Subject: parisc: make default cross compiler search more robust (v3)
+
+From: Helge Deller <deller@gmx.de>
+
+commit 6880b0150a7c25fd75c5ece80abc49ebf53c38c1 upstream.
+
+People/distros vary how they prefix the toolchain name for 64bit builds.
+Rather than enforce one convention over another, add a for loop which
+does a search for all the general prefixes.
+
+For 64bit builds, we now search for (in order):
+ hppa64-unknown-linux-gnu
+ hppa64-linux-gnu
+ hppa64-linux
+
+For 32bit builds, we look for:
+ hppa-unknown-linux-gnu
+ hppa-linux-gnu
+ hppa-linux
+ hppa2.0-unknown-linux-gnu
+ hppa2.0-linux-gnu
+ hppa2.0-linux
+ hppa1.1-unknown-linux-gnu
+ hppa1.1-linux-gnu
+ hppa1.1-linux
+
+This patch was initiated by Mike Frysinger, with feedback from Jeroen
+Roovers, John David Anglin and Helge Deller.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Jeroen Roovers <jer@gentoo.org>
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Makefile | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -23,24 +23,21 @@ NM = sh $(srctree)/arch/parisc/nm
+ CHECKFLAGS += -D__hppa__=1
+ LIBGCC = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
+
+-MACHINE := $(shell uname -m)
+-NATIVE := $(if $(filter parisc%,$(MACHINE)),1,0)
+-
+ ifdef CONFIG_64BIT
+ UTS_MACHINE := parisc64
+ CHECKFLAGS += -D__LP64__=1 -m64
+-WIDTH := 64
++CC_ARCHES = hppa64
+ else # 32-bit
+-WIDTH :=
++CC_ARCHES = hppa hppa2.0 hppa1.1
+ endif
+
+-# attempt to help out folks who are cross-compiling
+-ifeq ($(NATIVE),1)
+-CROSS_COMPILE := hppa$(WIDTH)-linux-
+-else
+- ifeq ($(CROSS_COMPILE),)
+- CROSS_COMPILE := hppa$(WIDTH)-linux-gnu-
+- endif
++ifneq ($(SUBARCH),$(UTS_MACHINE))
++ ifeq ($(CROSS_COMPILE),)
++ CC_SUFFIXES = linux linux-gnu unknown-linux-gnu
++ CROSS_COMPILE := $(call cc-cross-prefix, \
++ $(foreach a,$(CC_ARCHES), \
++ $(foreach s,$(CC_SUFFIXES),$(a)-$(s)-)))
++ endif
+ endif
+
+ OBJCOPY_FLAGS =-O binary -R .note -R .comment -S
--- /dev/null
+From c207a76bf155cb5cf24cf849c08f6555e9180594 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Tue, 7 May 2013 00:07:25 +0000
+Subject: parisc: only re-enable interrupts if we need to schedule or deliver signals when returning to userspace
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit c207a76bf155cb5cf24cf849c08f6555e9180594 upstream.
+
+Helge and I have found that we have a kernel stack overflow problem
+which causes a variety of random failures.
+Currently, we re-enable interrupts when returning from an external
+interrupt incase we need to schedule or delivery
+signals. As a result, a potentially unlimited number of interrupts
+can occur while we are running on the kernel
+stack. It is very limited in space (currently, 16k). This change
+defers enabling interrupts until we have
+actually decided to schedule or delivery signals. This only occurs
+when we about to return to userspace. This
+limits the number of interrupts on the kernel stack to one. In other
+cases, interrupts remain disabled until the
+final return from interrupt (rfi).
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/entry.S | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -825,11 +825,6 @@ ENTRY(syscall_exit_rfi)
+ STREG %r19,PT_SR7(%r16)
+
+ intr_return:
+- /* NOTE: Need to enable interrupts incase we schedule. */
+- ssm PSW_SM_I, %r0
+-
+-intr_check_resched:
+-
+ /* check for reschedule */
+ mfctl %cr30,%r1
+ LDREG TI_FLAGS(%r1),%r19 /* sched.h: TIF_NEED_RESCHED */
+@@ -856,6 +851,11 @@ intr_check_sig:
+ LDREG PT_IASQ1(%r16), %r20
+ cmpib,COND(=),n 0,%r20,intr_restore /* backward */
+
++ /* NOTE: We need to enable interrupts if we have to deliver
++ * signals. We used to do this earlier but it caused kernel
++ * stack overflows. */
++ ssm PSW_SM_I, %r0
++
+ copy %r0, %r25 /* long in_syscall = 0 */
+ #ifdef CONFIG_64BIT
+ ldo -16(%r30),%r29 /* Reference param save area */
+@@ -907,6 +907,10 @@ intr_do_resched:
+ cmpib,COND(=) 0, %r20, intr_do_preempt
+ nop
+
++ /* NOTE: We need to enable interrupts if we schedule. We used
++ * to do this earlier but it caused kernel stack overflows. */
++ ssm PSW_SM_I, %r0
++
+ #ifdef CONFIG_64BIT
+ ldo -16(%r30),%r29 /* Reference param save area */
+ #endif
--- /dev/null
+From bbbfde782084b4f0d85ddffb88f1cf4650ff40e4 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sat, 4 May 2013 19:16:41 +0000
+Subject: parisc: use long branch in fork_like macro
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit bbbfde782084b4f0d85ddffb88f1cf4650ff40e4 upstream.
+
+The "b" branch instruction used in the fork_like macro only can handle
+17-bit pc-relative offsets.
+This fails with an out of range offset with some .config files.
+Rewrite to use the "be" instruction which
+can branch to any address in a space.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/entry.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -1709,7 +1709,8 @@ ENTRY(sys_\name\()_wrapper)
+ ldo TASK_REGS(%r1),%r1
+ reg_save %r1
+ mfctl %cr27, %r28
+- b sys_\name
++ ldil L%sys_\name, %r31
++ be R%sys_\name(%sr4,%r31)
+ STREG %r28, PT_CR27(%r1)
+ ENDPROC(sys_\name\()_wrapper)
+ .endm
vsock-drop-bogus-__init-annotation-from-vsock_init_tables.patch
arm-exynos5-fix-kernel-dump-in-aftr-idle-mode.patch
drivers-rtc-rtc-pcf2123.c-fix-error-return-code-in-pcf2123_probe.patch
+cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch
+cpufreq-intel_pstate-use-lowest-requested-max-performance.patch
+cpufreq-intel_pstate-fix-ffmpeg-regression.patch
+iscsi-target-fix-processing-of-ooo-commands.patch
+target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch
+target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch
+acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch
+drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch
+ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch
+asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch
+drm-radeon-check-incoming-cliprects-pointer.patch
+drm-radeon-restore-nomodeset-operation-v2.patch
+usermodehelper-check-subprocess_info-path-null.patch
+parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch
+parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch
+parisc-use-long-branch-in-fork_like-macro.patch
+parisc-fix-native-set-up-in-build.patch
+parisc-make-default-cross-compiler-search-more-robust-v3.patch
--- /dev/null
+From ccf5ae83a6cf3d9cfe9a7038bfe7cd38ab03d5e1 Mon Sep 17 00:00:00 2001
+From: Joern Engel <joern@logfs.org>
+Date: Mon, 13 May 2013 16:30:06 -0400
+Subject: target: close target_put_sess_cmd() vs. core_tmr_abort_task() race
+
+From: Joern Engel <joern@logfs.org>
+
+commit ccf5ae83a6cf3d9cfe9a7038bfe7cd38ab03d5e1 upstream.
+
+It is possible for one thread to to take se_sess->sess_cmd_lock in
+core_tmr_abort_task() before taking a reference count on
+se_cmd->cmd_kref, while another thread in target_put_sess_cmd() drops
+se_cmd->cmd_kref before taking se_sess->sess_cmd_lock.
+
+This introduces kref_put_spinlock_irqsave() and uses it in
+target_put_sess_cmd() to close the race window.
+
+Signed-off-by: Joern Engel <joern@logfs.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 11 +++++------
+ include/linux/kref.h | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+), 6 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2213,21 +2213,19 @@ static void target_release_cmd_kref(stru
+ {
+ struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
+ struct se_session *se_sess = se_cmd->se_sess;
+- unsigned long flags;
+
+- spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ if (list_empty(&se_cmd->se_cmd_list)) {
+- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++ spin_unlock(&se_sess->sess_cmd_lock);
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ return;
+ }
+ if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
+- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++ spin_unlock(&se_sess->sess_cmd_lock);
+ complete(&se_cmd->cmd_wait_comp);
+ return;
+ }
+ list_del(&se_cmd->se_cmd_list);
+- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++ spin_unlock(&se_sess->sess_cmd_lock);
+
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ }
+@@ -2238,7 +2236,8 @@ static void target_release_cmd_kref(stru
+ */
+ int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
+ {
+- return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
++ return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
++ &se_sess->sess_cmd_lock);
+ }
+ EXPORT_SYMBOL(target_put_sess_cmd);
+
+--- a/include/linux/kref.h
++++ b/include/linux/kref.h
+@@ -19,6 +19,7 @@
+ #include <linux/atomic.h>
+ #include <linux/kernel.h>
+ #include <linux/mutex.h>
++#include <linux/spinlock.h>
+
+ struct kref {
+ atomic_t refcount;
+@@ -95,6 +96,38 @@ static inline int kref_put(struct kref *
+ return kref_sub(kref, 1, release);
+ }
+
++/**
++ * kref_put_spinlock_irqsave - decrement refcount for object.
++ * @kref: object.
++ * @release: pointer to the function that will clean up the object when the
++ * last reference to the object is released.
++ * This pointer is required, and it is not acceptable to pass kfree
++ * in as this function.
++ * @lock: lock to take in release case
++ *
++ * Behaves identical to kref_put with one exception. If the reference count
++ * drops to zero, the lock will be taken atomically wrt dropping the reference
++ * count. The release function has to call spin_unlock() without _irqrestore.
++ */
++static inline int kref_put_spinlock_irqsave(struct kref *kref,
++ void (*release)(struct kref *kref),
++ spinlock_t *lock)
++{
++ unsigned long flags;
++
++ WARN_ON(release == NULL);
++ if (atomic_add_unless(&kref->refcount, -1, 1))
++ return 0;
++ spin_lock_irqsave(lock, flags);
++ if (atomic_dec_and_test(&kref->refcount)) {
++ release(kref);
++ local_irq_restore(flags);
++ return 1;
++ }
++ spin_unlock_irqrestore(lock, flags);
++ return 0;
++}
++
+ static inline int kref_put_mutex(struct kref *kref,
+ void (*release)(struct kref *kref),
+ struct mutex *lock)
--- /dev/null
+From d2bdbee0d91a5d3ba2e439ce889e20bfe6fd4f1b Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Tue, 14 May 2013 23:41:04 -0700
+Subject: target/iblock: Fix WCE=1 + DPOFUA=1 backend WRITE regression
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit d2bdbee0d91a5d3ba2e439ce889e20bfe6fd4f1b upstream.
+
+This patch fixes a regression bug introduced in v3.9-rc1 where if the
+underlying struct block_device for a IBLOCK backend is configured with
+WCE=1 + DPOFUA=1 settings, the rw = WRITE assignment no longer occurs
+in iblock_execute_rw(), and rw = 0 is passed to iblock_submit_bios()
+in effect causing a READ bio operation to occur.
+
+The offending commit is:
+
+commit d0c8b259f8970d39354c1966853363345d401330
+Author: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Tue Jan 29 22:10:06 2013 -0800
+
+ target/iblock: Use backend REQ_FLUSH hint for WriteCacheEnabled status
+
+Note the WCE=1 + DPOFUA=0, WCE=0 + DPOFUA=1, and WCE=0 + DPOFUA=0 cases
+are not affected by this regression bug.
+
+Reported-by: Chris Boot <bootc@bootc.net>
+Tested-by: Chris Boot <bootc@bootc.net>
+Reported-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_iblock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -679,6 +679,8 @@ iblock_execute_rw(struct se_cmd *cmd)
+ rw = WRITE_FUA;
+ else if (!(q->flush_flags & REQ_FLUSH))
+ rw = WRITE_FUA;
++ else
++ rw = WRITE;
+ } else {
+ rw = WRITE;
+ }
--- /dev/null
+From 264b83c07a84223f0efd0d1db9ccc66d6f88288f Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 16 May 2013 17:43:55 +0200
+Subject: usermodehelper: check subprocess_info->path != NULL
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 264b83c07a84223f0efd0d1db9ccc66d6f88288f upstream.
+
+argv_split(empty_or_all_spaces) happily succeeds, it simply returns
+argc == 0 and argv[0] == NULL. Change call_usermodehelper_exec() to
+check sub_info->path != NULL to avoid the crash.
+
+This is the minimal fix, todo:
+
+ - perhaps we should change argv_split() to return NULL or change the
+ callers.
+
+ - kill or justify ->path[0] check
+
+ - narrow the scope of helper_lock()
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-By: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/kmod.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -570,6 +570,11 @@ int call_usermodehelper_exec(struct subp
+ int retval = 0;
+
+ helper_lock();
++ if (!sub_info->path) {
++ retval = -EINVAL;
++ goto out;
++ }
++
+ if (sub_info->path[0] == '\0')
+ goto out;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
