--- /dev/null
+From eeecef0af5ea4efd763c9554cf2bd80fc4a0efd3 Mon Sep 17 00:00:00 2001
+From: Eric Sandeen <sandeen@redhat.com>
+Date: Sat, 18 Aug 2012 22:29:40 -0400
+Subject: jbd2: don't write superblock when if its empty
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+commit eeecef0af5ea4efd763c9554cf2bd80fc4a0efd3 upstream.
+
+This sequence:
+
+# truncate --size=1g fsfile
+# mkfs.ext4 -F fsfile
+# mount -o loop,ro fsfile /mnt
+# umount /mnt
+# dmesg | tail
+
+results in an IO error when unmounting the RO filesystem:
+
+[ 318.020828] Buffer I/O error on device loop1, logical block 196608
+[ 318.027024] lost page write due to I/O error on loop1
+[ 318.032088] JBD2: Error -5 detected when updating journal superblock for loop1-8.
+
+This was a regression introduced by commit 24bcc89c7e7c: "jbd2: split
+updating of journal superblock and marking journal empty".
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/journal.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1317,6 +1317,11 @@ static void jbd2_mark_journal_empty(jour
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+ read_lock(&journal->j_state_lock);
++ /* Is it already empty? */
++ if (sb->s_start == 0) {
++ read_unlock(&journal->j_state_lock);
++ return;
++ }
+ jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n",
+ journal->j_tail_sequence);
+
--- /dev/null
+From ca16f580a5db7e60bfafe59a50bb133bd3347491 Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Thu, 4 Oct 2012 12:03:25 +0930
+Subject: lguest: fix occasional crash in example launcher.
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit ca16f580a5db7e60bfafe59a50bb133bd3347491 upstream.
+
+We usually got away with ->next on the final entry being NULL, but it
+finally bit me.
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/lguest/lguest.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/lguest/lguest.c
++++ b/tools/lguest/lguest.c
+@@ -1299,6 +1299,7 @@ static struct device *new_device(const c
+ dev->feature_len = 0;
+ dev->num_vq = 0;
+ dev->running = false;
++ dev->next = NULL;
+
+ /*
+ * Append to device list. Prepending to a single-linked list is
--- /dev/null
+From 4eae518d4b01b0cbf2f0d8edb5a6f3d6245ee8fb Mon Sep 17 00:00:00 2001
+From: Yuta Ando <yuta.and@gmail.com>
+Date: Mon, 1 Oct 2012 23:24:30 +0900
+Subject: localmodconfig: Fix localyesconfig to set to 'y' not 'm'
+
+From: Yuta Ando <yuta.and@gmail.com>
+
+commit 4eae518d4b01b0cbf2f0d8edb5a6f3d6245ee8fb upstream.
+
+The kbuild target 'localyesconfig' has been same as 'localmodconfig'
+since the commit 50bce3e "kconfig/streamline_config.pl: merge
+local{mod,yes}config". The commit expects this script generates
+different configure depending on target, but it was not yet implemented.
+
+So I added code that sets to 'yes' when target is 'localyesconfig'.
+
+Link: http://lkml.kernel.org/r/1349101470-12243-1-git-send-email-yuta.and@gmail.com
+
+Signed-off-by: Yuta Ando <yuta.and@gmail.com>
+Cc: linux-kbuild@vger.kernel.org
+Signed-off-by: Steven Rostedt <rostedt@rostedt.homelinux.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/kconfig/streamline_config.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -463,6 +463,8 @@ while(<CIN>) {
+ if (defined($configs{$1})) {
+ if ($localyesconfig) {
+ $setconfigs{$1} = 'y';
++ print "$1=y\n";
++ next;
+ } else {
+ $setconfigs{$1} = $2;
+ }
--- /dev/null
+From 997a031107ec962967ce36db9bc500f1fad491c1 Mon Sep 17 00:00:00 2001
+From: Feng Hong <hongfeng@marvell.com>
+Date: Wed, 19 Sep 2012 14:16:00 +0200
+Subject: PM / Sleep: use resume event when call dpm_resume_early
+
+From: Feng Hong <hongfeng@marvell.com>
+
+commit 997a031107ec962967ce36db9bc500f1fad491c1 upstream.
+
+When dpm_suspend_noirq fail, state is PMSG_SUSPEND,
+should change to PMSG_RESUME when dpm_resume_early is called
+
+Signed-off-by: Feng Hong <hongfeng@marvell.com>
+Signed-off-by: Raul Xiong <xjian@marvell.com>
+Signed-off-by: Neil Zhang <zhangwm@marvell.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -984,7 +984,7 @@ int dpm_suspend_end(pm_message_t state)
+
+ error = dpm_suspend_noirq(state);
+ if (error) {
+- dpm_resume_early(state);
++ dpm_resume_early(resume_event(state));
+ return error;
+ }
+
--- /dev/null
+From 1e38b7140185e384da216aff66a711df09b5afc9 Mon Sep 17 00:00:00 2001
+From: Gavin Shan <shangw@linux.vnet.ibm.com>
+Date: Mon, 17 Sep 2012 04:34:28 +0000
+Subject: powerpc/eeh: Fix crash on converting OF node to edev
+
+From: Gavin Shan <shangw@linux.vnet.ibm.com>
+
+commit 1e38b7140185e384da216aff66a711df09b5afc9 upstream.
+
+The kernel crash was reported by Alexy. He was testing some feature
+with private kernel, in which Alexy added some code in pci_pm_reset()
+to read the CSR after writting it. The bug could be reproduced on
+Fiber Channel card (Fibre Channel: Emulex Corporation Saturn-X:
+LightPulse Fibre Channel Host Adapter (rev 03)) by the following
+commands.
+
+ # echo 1 > /sys/devices/pci0004:01/0004:01:00.0/reset
+ # rmmod lpfc
+ # modprobe lpfc
+
+The history behind the test case is that those additional config
+space reading operations in pci_pm_reset() would cause EEH error,
+but we didn't detect EEH error until "modprobe lpfc". For the case,
+all the PCI devices on PCI bus (0004:01) were removed and added after
+PE reset. Then the EEH devices would be figured out again based on
+the OF nodes. Unfortunately, there were some child OF nodes under
+PCI device (0004:01:00.0), but they didn't have attached PCI_DN since
+they're invisible from PCI domain. However, we were still trying to
+convert OF node to EEH device without checking on the attached PCI_DN.
+Eventually, it caused the kernel crash as follows:
+
+Unable to handle kernel paging request for data at address 0x00000030
+Faulting instruction address: 0xc00000000004d888
+cpu 0x0: Vector: 300 (Data Access) at [c000000fc797b950]
+ pc: c00000000004d888: .eeh_add_device_tree_early+0x78/0x140
+ lr: c00000000004d880: .eeh_add_device_tree_early+0x70/0x140
+ sp: c000000fc797bbd0
+ msr: 8000000000009032
+ dar: 30
+ dsisr: 40000000
+ current = 0xc000000fc78d9f70
+ paca = 0xc00000000edb0000 softe: 0 irq_happened: 0x00
+ pid = 2951, comm = eehd
+enter ? for help
+[c000000fc797bc50] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140
+[c000000fc797bcd0] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140
+[c000000fc797bd50] c000000000051b54 .pcibios_add_pci_devices+0x34/0x190
+[c000000fc797bde0] c00000000004fb10 .eeh_reset_device+0x100/0x160
+[c000000fc797be70] c0000000000502dc .eeh_handle_event+0x19c/0x300
+[c000000fc797bf00] c000000000050570 .eeh_event_handler+0x130/0x1a0
+[c000000fc797bf90] c000000000020138 .kernel_thread+0x54/0x70
+
+The patch changes of_node_to_eeh_dev() and just returns NULL if the
+passed OF node doesn't have attached PCI_DN.
+
+Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/pci-bridge.h | 8 ++++++++
+ arch/powerpc/platforms/pseries/eeh.c | 2 +-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/pci-bridge.h
++++ b/arch/powerpc/include/asm/pci-bridge.h
+@@ -181,6 +181,14 @@ static inline int pci_device_from_OF_nod
+ #if defined(CONFIG_EEH)
+ static inline struct eeh_dev *of_node_to_eeh_dev(struct device_node *dn)
+ {
++ /*
++ * For those OF nodes whose parent isn't PCI bridge, they
++ * don't have PCI_DN actually. So we have to skip them for
++ * any EEH operations.
++ */
++ if (!dn || !PCI_DN(dn))
++ return NULL;
++
+ return PCI_DN(dn)->edev;
+ }
+ #endif
+--- a/arch/powerpc/platforms/pseries/eeh.c
++++ b/arch/powerpc/platforms/pseries/eeh.c
+@@ -1029,7 +1029,7 @@ static void eeh_add_device_early(struct
+ {
+ struct pci_controller *phb;
+
+- if (!dn || !of_node_to_eeh_dev(dn))
++ if (!of_node_to_eeh_dev(dn))
+ return;
+ phb = of_node_to_eeh_dev(dn)->phb;
+
--- /dev/null
+From 7c4a6106d6451fc03c491e61df37c044505d843a Mon Sep 17 00:00:00 2001
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+Date: Thu, 4 Oct 2012 17:15:48 -0700
+Subject: rapidio/rionet: fix multicast packet transmit logic
+
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+
+commit 7c4a6106d6451fc03c491e61df37c044505d843a upstream.
+
+Fix multicast packet transmit logic to account for repetitive transmission
+of single skb:
+- correct check for available buffers (this bug may produce NULL pointer
+ crash dump in case of heavy traffic);
+- update skb user count (incorrect user counter causes a warning dump from
+ net_tx_action routine during multicast transfers in systems with three or
+ more rionet participants).
+
+Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/rionet.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/rionet.c
++++ b/drivers/net/rionet.c
+@@ -79,6 +79,7 @@ static int rionet_capable = 1;
+ * on system trade-offs.
+ */
+ static struct rio_dev **rionet_active;
++static int nact; /* total number of active rionet peers */
+
+ #define is_rionet_capable(src_ops, dst_ops) \
+ ((src_ops & RIO_SRC_OPS_DATA_MSG) && \
+@@ -175,6 +176,7 @@ static int rionet_start_xmit(struct sk_b
+ struct ethhdr *eth = (struct ethhdr *)skb->data;
+ u16 destid;
+ unsigned long flags;
++ int add_num = 1;
+
+ local_irq_save(flags);
+ if (!spin_trylock(&rnet->tx_lock)) {
+@@ -182,7 +184,10 @@ static int rionet_start_xmit(struct sk_b
+ return NETDEV_TX_LOCKED;
+ }
+
+- if ((rnet->tx_cnt + 1) > RIONET_TX_RING_SIZE) {
++ if (is_multicast_ether_addr(eth->h_dest))
++ add_num = nact;
++
++ if ((rnet->tx_cnt + add_num) > RIONET_TX_RING_SIZE) {
+ netif_stop_queue(ndev);
+ spin_unlock_irqrestore(&rnet->tx_lock, flags);
+ printk(KERN_ERR "%s: BUG! Tx Ring full when queue awake!\n",
+@@ -191,11 +196,16 @@ static int rionet_start_xmit(struct sk_b
+ }
+
+ if (is_multicast_ether_addr(eth->h_dest)) {
++ int count = 0;
+ for (i = 0; i < RIO_MAX_ROUTE_ENTRIES(rnet->mport->sys_size);
+ i++)
+- if (rionet_active[i])
++ if (rionet_active[i]) {
+ rionet_queue_tx_msg(skb, ndev,
+ rionet_active[i]);
++ if (count)
++ atomic_inc(&skb->users);
++ count++;
++ }
+ } else if (RIONET_MAC_MATCH(eth->h_dest)) {
+ destid = RIONET_GET_DESTID(eth->h_dest);
+ if (rionet_active[destid])
+@@ -220,14 +230,17 @@ static void rionet_dbell_event(struct ri
+ if (info == RIONET_DOORBELL_JOIN) {
+ if (!rionet_active[sid]) {
+ list_for_each_entry(peer, &rionet_peers, node) {
+- if (peer->rdev->destid == sid)
++ if (peer->rdev->destid == sid) {
+ rionet_active[sid] = peer->rdev;
++ nact++;
++ }
+ }
+ rio_mport_send_doorbell(mport, sid,
+ RIONET_DOORBELL_JOIN);
+ }
+ } else if (info == RIONET_DOORBELL_LEAVE) {
+ rionet_active[sid] = NULL;
++ nact--;
+ } else {
+ if (netif_msg_intr(rnet))
+ printk(KERN_WARNING "%s: unhandled doorbell\n",
+@@ -523,6 +536,7 @@ static int rionet_probe(struct rio_dev *
+
+ rc = rionet_setup_netdev(rdev->net->hport, ndev);
+ rionet_check = 1;
++ nact = 0;
+ }
+
+ /*
kernel-sys.c-call-disable_nonboot_cpus-in-kernel_restart.patch
drivers-scsi-atp870u.c-fix-bad-use-of-udelay.patch
drivers-dma-dmaengine.c-lower-the-priority-of-failed-to-get-dma-channel-message.patch
+lguest-fix-occasional-crash-in-example-launcher.patch
+powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch
+rapidio-rionet-fix-multicast-packet-transmit-logic.patch
+pm-sleep-use-resume-event-when-call-dpm_resume_early.patch
+workqueue-add-missing-smp_wmb-in-process_one_work.patch
+jbd2-don-t-write-superblock-when-if-its-empty.patch
+localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch
--- /dev/null
+From 959d1af8cffc8fd38ed53e8be1cf4ab8782f9c00 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 3 Aug 2012 10:30:45 -0700
+Subject: workqueue: add missing smp_wmb() in process_one_work()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 959d1af8cffc8fd38ed53e8be1cf4ab8782f9c00 upstream.
+
+WORK_STRUCT_PENDING is used to claim ownership of a work item and
+process_one_work() releases it before starting execution. When
+someone else grabs PENDING, all pre-release updates to the work item
+should be visible and all updates made by the new owner should happen
+afterwards.
+
+Grabbing PENDING uses test_and_set_bit() and thus has a full barrier;
+however, clearing doesn't have a matching wmb. Given the preceding
+spin_unlock and use of clear_bit, I don't believe this can be a
+problem on an actual machine and there hasn't been any related report
+but it still is theretically possible for clear_pending to permeate
+upwards and happen before work->entry update.
+
+Add an explicit smp_wmb() before work_clear_pending().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1864,7 +1864,9 @@ __acquires(&gcwq->lock)
+
+ spin_unlock_irq(&gcwq->lock);
+
++ smp_wmb(); /* paired with test_and_set_bit(PENDING) */
+ work_clear_pending(work);
++
+ lock_map_acquire_read(&cwq->wq->lockdep_map);
+ lock_map_acquire(&lockdep_map);
+ trace_workqueue_execute_start(work);
projects / thirdparty / kernel / stable-queue.git / commitdiff
