--- /dev/null
+From 6a1c53124aa161eb624ce7b1e40ade728186d34c Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 27 Apr 2012 12:45:07 +0100
+Subject: ARM: 7403/1: tls: remove covert channel via TPIDRURW
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 6a1c53124aa161eb624ce7b1e40ade728186d34c upstream.
+
+TPIDRURW is a user read/write register forming part of the group of
+thread registers in more recent versions of the ARM architecture (~v6+).
+
+Currently, the kernel does not touch this register, which allows tasks
+to communicate covertly by reading and writing to the register without
+context-switching affecting its contents.
+
+This patch clears TPIDRURW when TPIDRURO is updated via the set_tls
+macro, which is called directly from __switch_to. Since the current
+behaviour makes the register useless to userspace as far as thread
+pointers are concerned, simply clearing the register (rather than saving
+and restoring it) will not cause any problems to userspace.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/tls.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/include/asm/tls.h
++++ b/arch/arm/include/asm/tls.h
+@@ -7,6 +7,8 @@
+
+ .macro set_tls_v6k, tp, tmp1, tmp2
+ mcr p15, 0, \tp, c13, c0, 3 @ set TLS register
++ mov \tmp1, #0
++ mcr p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register
+ .endm
+
+ .macro set_tls_v6, tp, tmp1, tmp2
+@@ -15,6 +17,8 @@
+ mov \tmp2, #0xffff0fff
+ tst \tmp1, #HWCAP_TLS @ hardware TLS available?
+ mcrne p15, 0, \tp, c13, c0, 3 @ yes, set TLS register
++ movne \tmp1, #0
++ mcrne p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register
+ streq \tp, [\tmp2, #-15] @ set TLS value at 0xffff0ff0
+ .endm
+
--- /dev/null
+From 7d1d865181185bdf1316d236b1b4bd02c9020729 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 20 Mar 2012 10:50:27 -0700
+Subject: SCSI: libsas: fix false positive 'device attached' conditions
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 7d1d865181185bdf1316d236b1b4bd02c9020729 upstream.
+
+Normalize phy->attached_sas_addr to return a zero-address in the case
+when device-type == NO_DEVICE or the linkrate is invalid to handle
+expanders that put non-zero sas addresses in the discovery response:
+
+ sas: ex 5001b4da000f903f phy02:U:0 attached: 0100000000000000 (no device)
+ sas: ex 5001b4da000f903f phy01:U:0 attached: 0100000000000000 (no device)
+ sas: ex 5001b4da000f903f phy03:U:0 attached: 0100000000000000 (no device)
+ sas: ex 5001b4da000f903f phy00:U:0 attached: 0100000000000000 (no device)
+
+Reported-by: Andrzej Jakowski <andrzej.jakowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -192,7 +192,14 @@ static void sas_set_ex_phy(struct domain
+ phy->attached_sata_ps = dr->attached_sata_ps;
+ phy->attached_iproto = dr->iproto << 1;
+ phy->attached_tproto = dr->tproto << 1;
+- memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
++ /* help some expanders that fail to zero sas_address in the 'no
++ * device' case
++ */
++ if (phy->attached_dev_type == NO_DEVICE ||
++ phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
++ memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
++ else
++ memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
+ phy->attached_phy_id = dr->attached_phy_id;
+ phy->phy_change_count = dr->change_count;
+ phy->routing_attr = dr->routing_attr;
--- /dev/null
+From 1699490db339e2c6b3037ea8e7dcd6b2755b688e Mon Sep 17 00:00:00 2001
+From: Thomas Jackson <thomas.p.jackson@intel.com>
+Date: Fri, 17 Feb 2012 18:33:10 -0800
+Subject: SCSI: libsas: fix sas_find_bcast_phy() in the presence of 'vacant' phys
+
+From: Thomas Jackson <thomas.p.jackson@intel.com>
+
+commit 1699490db339e2c6b3037ea8e7dcd6b2755b688e upstream.
+
+If an expander reports 'PHY VACANT' for a phy index prior to the one
+that generated a BCN libsas fails rediscovery. Since a vacant phy is
+defined as a valid phy index that will never have an attached device
+just continue the search.
+
+Signed-off-by: Thomas Jackson <thomas.p.jackson@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/libsas/sas_expander.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -1632,9 +1632,17 @@ static int sas_find_bcast_phy(struct dom
+ int phy_change_count = 0;
+
+ res = sas_get_phy_change_count(dev, i, &phy_change_count);
+- if (res)
+- goto out;
+- else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
++ switch (res) {
++ case SMP_RESP_PHY_VACANT:
++ case SMP_RESP_NO_PHY:
++ continue;
++ case SMP_RESP_FUNC_ACC:
++ break;
++ default:
++ return res;
++ }
++
++ if (phy_change_count != ex->ex_phy[i].phy_change_count) {
+ if (update)
+ ex->ex_phy[i].phy_change_count =
+ phy_change_count;
+@@ -1642,8 +1650,7 @@ static int sas_find_bcast_phy(struct dom
+ return 0;
+ }
+ }
+-out:
+- return res;
++ return 0;
+ }
+
+ static int sas_get_ex_change_count(struct domain_device *dev, int *ecc)
usb-gadget-uvc-uvc_request_data-length-field-must-be-signed.patch
pipes-add-a-packetized-pipe-mode-for-writing.patch
autofs-make-the-autofsv5-packet-file-descriptor-use-a-packetized-pipe.patch
+arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch
+scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch
+scsi-libsas-fix-false-positive-device-attached-conditions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
