--- /dev/null
+From 2492250e4412c6411324c14ab289629360640b0a Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 4 Feb 2012 20:56:47 +0100
+Subject: ALSA: oxygen, virtuoso: fix exchanged L/R volumes of aux and CD inputs
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 2492250e4412c6411324c14ab289629360640b0a upstream.
+
+The driver accidentally exchanged the left/right fields for stereo AC'97
+mixer registers. This affected only the aux and CD inputs because the
+line input bypasses the AC'97 codec and the mic input is mono; cards
+without AC'97 (Xonar DS/DG/HDAV Slim, HG2PCI, HiFier) were not affected.
+
+Reported-and-tested-by: Abby Cedar <abbycedar@yahoo.com.au>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/oxygen/oxygen_mixer.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen_mixer.c
++++ b/sound/pci/oxygen/oxygen_mixer.c
+@@ -618,9 +618,12 @@ static int ac97_volume_get(struct snd_kc
+ mutex_lock(&chip->mutex);
+ reg = oxygen_read_ac97(chip, codec, index);
+ mutex_unlock(&chip->mutex);
+- value->value.integer.value[0] = 31 - (reg & 0x1f);
+- if (stereo)
+- value->value.integer.value[1] = 31 - ((reg >> 8) & 0x1f);
++ if (!stereo) {
++ value->value.integer.value[0] = 31 - (reg & 0x1f);
++ } else {
++ value->value.integer.value[0] = 31 - ((reg >> 8) & 0x1f);
++ value->value.integer.value[1] = 31 - (reg & 0x1f);
++ }
+ return 0;
+ }
+
+@@ -636,14 +639,14 @@ static int ac97_volume_put(struct snd_kc
+
+ mutex_lock(&chip->mutex);
+ oldreg = oxygen_read_ac97(chip, codec, index);
+- newreg = oldreg;
+- newreg = (newreg & ~0x1f) |
+- (31 - (value->value.integer.value[0] & 0x1f));
+- if (stereo)
+- newreg = (newreg & ~0x1f00) |
+- ((31 - (value->value.integer.value[1] & 0x1f)) << 8);
+- else
+- newreg = (newreg & ~0x1f00) | ((newreg & 0x1f) << 8);
++ if (!stereo) {
++ newreg = oldreg & ~0x1f;
++ newreg |= 31 - (value->value.integer.value[0] & 0x1f);
++ } else {
++ newreg = oldreg & ~0x1f1f;
++ newreg |= (31 - (value->value.integer.value[0] & 0x1f)) << 8;
++ newreg |= 31 - (value->value.integer.value[1] & 0x1f);
++ }
+ change = newreg != oldreg;
+ if (change)
+ oxygen_write_ac97(chip, codec, index, newreg);
--- /dev/null
+From 2b6712b19531e22455e7fa18371c5ba9eec76699 Mon Sep 17 00:00:00 2001
+From: Susan Gao <sgao@opensource.wolfsonmicro.com>
+Date: Mon, 30 Jan 2012 13:57:04 -0800
+Subject: ASoC: wm8962: Fix word length configuration
+
+From: Susan Gao <sgao@opensource.wolfsonmicro.com>
+
+commit 2b6712b19531e22455e7fa18371c5ba9eec76699 upstream.
+
+Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8962.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3172,13 +3172,13 @@ static int wm8962_hw_params(struct snd_p
+ case SNDRV_PCM_FORMAT_S16_LE:
+ break;
+ case SNDRV_PCM_FORMAT_S20_3LE:
+- aif0 |= 0x40;
++ aif0 |= 0x4;
+ break;
+ case SNDRV_PCM_FORMAT_S24_LE:
+- aif0 |= 0x80;
++ aif0 |= 0x8;
+ break;
+ case SNDRV_PCM_FORMAT_S32_LE:
+- aif0 |= 0xc0;
++ aif0 |= 0xc;
+ break;
+ default:
+ return -EINVAL;
--- /dev/null
+From db966f8abb9ba74f7d5a7230f51572f52c31c4e5 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 6 Feb 2012 12:07:08 +0000
+Subject: ASoC: wm8994: Enabling VMID should take a runtime PM reference
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit db966f8abb9ba74f7d5a7230f51572f52c31c4e5 upstream.
+
+We can enable VMID independently of the bias in some use cases so we need
+to ensure that the core device is powered up.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -729,6 +729,8 @@ static void vmid_reference(struct snd_so
+ {
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
++ pm_runtime_get_sync(codec->dev);
++
+ wm8994->vmid_refcount++;
+
+ dev_dbg(codec->dev, "Referencing VMID, refcount is now %d\n",
+@@ -796,6 +798,8 @@ static void vmid_dereference(struct snd_
+ WM8994_VMID_BUF_ENA |
+ WM8994_VMID_RAMP_MASK, 0);
+ }
++
++ pm_runtime_put(codec->dev);
+ }
+
+ static int vmid_event(struct snd_soc_dapm_widget *w,
--- /dev/null
+From f647e1526fd6c7c8ab720781c40d11e11f930e93 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 7 Feb 2012 17:24:19 +0000
+Subject: ASoC: wm8994: Fix typo in VMID ramp setting
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit f647e1526fd6c7c8ab720781c40d11e11f930e93 upstream.
+
+The VMID ramp rate is supposed to be 0x3, not 11b. Fix that.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -744,7 +744,7 @@ static void vmid_reference(struct snd_so
+ WM8994_VMID_RAMP_MASK,
+ WM8994_STARTUP_BIAS_ENA |
+ WM8994_VMID_BUF_ENA |
+- (0x11 << WM8994_VMID_RAMP_SHIFT));
++ (0x3 << WM8994_VMID_RAMP_SHIFT));
+
+ /* Main bias enable, VMID=2x40k */
+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_1,
--- /dev/null
+From 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 1 Feb 2012 23:46:58 +0000
+Subject: ASoC: wm_hubs: Correct line input to line output 2 paths
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e upstream.
+
+The second line output mixer has the controls for the line input bypasses
+in the opposite order.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_hubs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM
+ };
+
+ static const struct snd_kcontrol_new line2_mix[] = {
+-SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
+-SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 2, 1, 0),
++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 1, 1, 0),
+ SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0),
+ };
+
--- /dev/null
+From ee76744c51ec342df9822b4a85dbbfc3887b6d60 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 31 Jan 2012 11:55:32 +0000
+Subject: ASoC: wm_hubs: Fix routing of input PGAs to line output
+ mixer
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit ee76744c51ec342df9822b4a85dbbfc3887b6d60 upstream.
+
+IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1
+and IN2 to LINEOUT2.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_hubs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM
+ };
+
+ static const struct snd_kcontrol_new line2_mix[] = {
+-SOC_DAPM_SINGLE("IN2R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
+-SOC_DAPM_SINGLE("IN2L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0),
++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0),
+ SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0),
+ };
+
+@@ -846,8 +846,8 @@ static const struct snd_soc_dapm_route l
+ };
+
+ static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
+- { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" },
+- { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" },
++ { "LINEOUT2 Mixer", "IN1L Switch", "IN1L PGA" },
++ { "LINEOUT2 Mixer", "IN1R Switch", "IN1R PGA" },
+ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" },
--- /dev/null
+From af1be04901e27ce669b4ecde1c953d5c939498f5 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Wed, 18 Jan 2012 14:03:11 +0100
+Subject: iommu/amd: Work around broken IVRS tables
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit af1be04901e27ce669b4ecde1c953d5c939498f5 upstream.
+
+On some systems the IVRS table does not contain all PCI
+devices present in the system. In case a device not present
+in the IVRS table is translated by the IOMMU no DMA is
+possible from that device by default.
+This patch fixes this by removing the DTE entry for every
+PCI device present in the system and not covered by IVRS.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2479,6 +2479,9 @@ static unsigned device_dma_ops_init(void
+
+ for_each_pci_dev(pdev) {
+ if (!check_device(&pdev->dev)) {
++
++ iommu_ignore_device(&pdev->dev);
++
+ unhandled += 1;
+ continue;
+ }
--- /dev/null
+From 05df1f3c2afaef5672627f2b7095f0d4c4dbc3a0 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Thu, 26 Jan 2012 18:25:37 +0100
+Subject: iommu/msm: Fix error handling in msm_iommu_unmap()
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 05df1f3c2afaef5672627f2b7095f0d4c4dbc3a0 upstream.
+
+Error handling in msm_iommu_unmap() is broken. On some error
+conditions retval is set to a non-zero value which causes
+the function to return 'len' at the end. This hides the
+error from the user. Zero should be returned in those error
+cases.
+
+Cc: David Brown <davidb@codeaurora.org>
+Cc: Stepan Moskovchenko <stepanm@codeaurora.org>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Acked-by: David Brown <davidb@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/msm_iommu.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/iommu/msm_iommu.c
++++ b/drivers/iommu/msm_iommu.c
+@@ -481,23 +481,19 @@ static int msm_iommu_unmap(struct iommu_
+
+ priv = domain->priv;
+
+- if (!priv) {
+- ret = -ENODEV;
++ if (!priv)
+ goto fail;
+- }
+
+ fl_table = priv->pgtable;
+
+ if (len != SZ_16M && len != SZ_1M &&
+ len != SZ_64K && len != SZ_4K) {
+ pr_debug("Bad length: %d\n", len);
+- ret = -EINVAL;
+ goto fail;
+ }
+
+ if (!fl_table) {
+ pr_debug("Null page table\n");
+- ret = -EINVAL;
+ goto fail;
+ }
+
+@@ -506,7 +502,6 @@ static int msm_iommu_unmap(struct iommu_
+
+ if (*fl_pte == 0) {
+ pr_debug("First level PTE is 0\n");
+- ret = -ENODEV;
+ goto fail;
+ }
+
--- /dev/null
+From 2f9bc894c67dbacae5a6a9875818d2a18a918d18 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 23:33:48 -0800
+Subject: iscsi-target: Fix discovery with INADDR_ANY and IN6ADDR_ANY_INIT
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 2f9bc894c67dbacae5a6a9875818d2a18a918d18 upstream.
+
+This patch addresses a bug with sendtargets discovery where INADDR_ANY (0.0.0.0)
++ IN6ADDR_ANY_INIT ([0:0:0:0:0:0:0:0]) network portals where incorrectly being
+reported back to initiators instead of the address of the connecting interface.
+To address this, save local socket ->getname() output during iscsi login setup,
+and makes iscsit_build_sendtargets_response() return these TargetAddress keys
+when INADDR_ANY or IN6ADDR_ANY_INIT portals are in use.
+
+Reported-by: Dax Kelson <dkelson@gurulabs.com>
+Reported-by: Andy Grover <agrover@redhat.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 37 ++++++++++++++++++++++++++----
+ drivers/target/iscsi/iscsi_target_core.h | 2 +
+ drivers/target/iscsi/iscsi_target_login.c | 31 +++++++++++++++++++++----
+ 3 files changed, 62 insertions(+), 8 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -3165,6 +3165,30 @@ static int iscsit_send_task_mgt_rsp(
+ return 0;
+ }
+
++static bool iscsit_check_inaddr_any(struct iscsi_np *np)
++{
++ bool ret = false;
++
++ if (np->np_sockaddr.ss_family == AF_INET6) {
++ const struct sockaddr_in6 sin6 = {
++ .sin6_addr = IN6ADDR_ANY_INIT };
++ struct sockaddr_in6 *sock_in6 =
++ (struct sockaddr_in6 *)&np->np_sockaddr;
++
++ if (!memcmp(sock_in6->sin6_addr.s6_addr,
++ sin6.sin6_addr.s6_addr, 16))
++ ret = true;
++ } else {
++ struct sockaddr_in * sock_in =
++ (struct sockaddr_in *)&np->np_sockaddr;
++
++ if (sock_in->sin_addr.s_addr == INADDR_ANY)
++ ret = true;
++ }
++
++ return ret;
++}
++
+ static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd)
+ {
+ char *payload = NULL;
+@@ -3214,12 +3238,17 @@ static int iscsit_build_sendtargets_resp
+ spin_lock(&tpg->tpg_np_lock);
+ list_for_each_entry(tpg_np, &tpg->tpg_gnp_list,
+ tpg_np_list) {
++ struct iscsi_np *np = tpg_np->tpg_np;
++ bool inaddr_any = iscsit_check_inaddr_any(np);
++
+ len = sprintf(buf, "TargetAddress="
+ "%s%s%s:%hu,%hu",
+- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ?
+- "[" : "", tpg_np->tpg_np->np_ip,
+- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ?
+- "]" : "", tpg_np->tpg_np->np_port,
++ (np->np_sockaddr.ss_family == AF_INET6) ?
++ "[" : "", (inaddr_any == false) ?
++ np->np_ip : conn->local_ip,
++ (np->np_sockaddr.ss_family == AF_INET6) ?
++ "]" : "", (inaddr_any == false) ?
++ np->np_port : conn->local_port,
+ tpg->tpgt);
+ len += 1;
+
+--- a/drivers/target/iscsi/iscsi_target_core.h
++++ b/drivers/target/iscsi/iscsi_target_core.h
+@@ -508,6 +508,7 @@ struct iscsi_conn {
+ u16 cid;
+ /* Remote TCP Port */
+ u16 login_port;
++ u16 local_port;
+ int net_size;
+ u32 auth_id;
+ #define CONNFLAG_SCTP_STRUCT_FILE 0x01
+@@ -527,6 +528,7 @@ struct iscsi_conn {
+ unsigned char bad_hdr[ISCSI_HDR_LEN];
+ #define IPV6_ADDRESS_SPACE 48
+ unsigned char login_ip[IPV6_ADDRESS_SPACE];
++ unsigned char local_ip[IPV6_ADDRESS_SPACE];
+ int conn_usage_count;
+ int conn_waiting_on_uc;
+ atomic_t check_immediate_queue;
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -616,8 +616,8 @@ static int iscsi_post_login_handler(
+ }
+
+ pr_debug("iSCSI Login successful on CID: %hu from %s to"
+- " %s:%hu,%hu\n", conn->cid, conn->login_ip, np->np_ip,
+- np->np_port, tpg->tpgt);
++ " %s:%hu,%hu\n", conn->cid, conn->login_ip,
++ conn->local_ip, conn->local_port, tpg->tpgt);
+
+ list_add_tail(&conn->conn_list, &sess->sess_conn_list);
+ atomic_inc(&sess->nconn);
+@@ -659,7 +659,8 @@ static int iscsi_post_login_handler(
+ sess->session_state = TARG_SESS_STATE_LOGGED_IN;
+
+ pr_debug("iSCSI Login successful on CID: %hu from %s to %s:%hu,%hu\n",
+- conn->cid, conn->login_ip, np->np_ip, np->np_port, tpg->tpgt);
++ conn->cid, conn->login_ip, conn->local_ip, conn->local_port,
++ tpg->tpgt);
+
+ spin_lock_bh(&sess->conn_lock);
+ list_add_tail(&conn->conn_list, &sess->sess_conn_list);
+@@ -1019,6 +1020,18 @@ static int __iscsi_target_login_thread(s
+ snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c",
+ &sock_in6.sin6_addr.in6_u);
+ conn->login_port = ntohs(sock_in6.sin6_port);
++
++ if (conn->sock->ops->getname(conn->sock,
++ (struct sockaddr *)&sock_in6, &err, 0) < 0) {
++ pr_err("sock_ops->getname() failed.\n");
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_TARGET_ERROR);
++ goto new_sess_out;
++ }
++ snprintf(conn->local_ip, sizeof(conn->local_ip), "%pI6c",
++ &sock_in6.sin6_addr.in6_u);
++ conn->local_port = ntohs(sock_in6.sin6_port);
++
+ } else {
+ memset(&sock_in, 0, sizeof(struct sockaddr_in));
+
+@@ -1031,6 +1044,16 @@ static int __iscsi_target_login_thread(s
+ }
+ sprintf(conn->login_ip, "%pI4", &sock_in.sin_addr.s_addr);
+ conn->login_port = ntohs(sock_in.sin_port);
++
++ if (conn->sock->ops->getname(conn->sock,
++ (struct sockaddr *)&sock_in, &err, 0) < 0) {
++ pr_err("sock_ops->getname() failed.\n");
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_TARGET_ERROR);
++ goto new_sess_out;
++ }
++ sprintf(conn->local_ip, "%pI4", &sock_in.sin_addr.s_addr);
++ conn->local_port = ntohs(sock_in.sin_port);
+ }
+
+ conn->network_transport = np->np_network_transport;
+@@ -1038,7 +1061,7 @@ static int __iscsi_target_login_thread(s
+ pr_debug("Received iSCSI login request from %s on %s Network"
+ " Portal %s:%hu\n", conn->login_ip,
+ (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP",
+- np->np_ip, np->np_port);
++ conn->local_ip, conn->local_port);
+
+ pr_debug("Moving to TARG_CONN_STATE_IN_LOGIN.\n");
+ conn->conn_state = TARG_CONN_STATE_IN_LOGIN;
--- /dev/null
+From cd931ee62fd0258fc85c76a7c5499fe85e0f3436 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 17:11:54 -0800
+Subject: iscsi-target: Fix double list_add with iscsit_alloc_buffs reject
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit cd931ee62fd0258fc85c76a7c5499fe85e0f3436 upstream.
+
+This patch fixes a bug where the iscsit_add_reject_from_cmd() call
+from a failure to iscsit_alloc_buffs() was incorrectly passing
+add_to_conn=1 and causing a double list_add after iscsi_cmd->i_list
+had already been added in iscsit_handle_scsi_cmd().
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1062,7 +1062,7 @@ attach_cmd:
+ if (ret < 0)
+ return iscsit_add_reject_from_cmd(
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+- 1, 1, buf, cmd);
++ 1, 0, buf, cmd);
+ /*
+ * Check the CmdSN against ExpCmdSN/MaxCmdSN here if
+ * the Immediate Bit is not set, and no Immediate
--- /dev/null
+From c1ce4bd56f2846de55043374598fd929ad3b711b Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 16 Jan 2012 16:04:15 -0800
+Subject: iscsi-target: Fix reject release handling in iscsit_free_cmd()
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit c1ce4bd56f2846de55043374598fd929ad3b711b upstream.
+
+This patch addresses a bug where iscsit_free_cmd() was incorrectly calling
+iscsit_release_cmd() for ISCSI_OP_REJECT because iscsi_add_reject*() will
+overwrite the original iscsi_cmd->iscsi_opcode assignment. This bug was
+introduced with the following commit:
+
+commit 0be67f2ed8f577d2c72d917928394c5885fa9134
+Author: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun Oct 9 01:48:14 2011 -0700
+
+ iscsi-target: Remove SCF_SE_LUN_CMD flag abuses
+
+and was manifesting itself as list corruption with the following:
+
+[ 131.191092] ------------[ cut here ]------------
+[ 131.191092] WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98()
+[ 131.191092] Hardware name: VMware Virtual Platform
+[ 131.191092] list_del corruption. prev->next should be ffff880022d3c100, but was 6b6b6b6b6b6b6b6b
+[ 131.191092] Modules linked in: tcm_vhost ib_srpt ib_cm ib_sa ib_mad ib_core tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc crc32c iscsi_target_mod target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sr_mod cdrom sd_mod e1000 ata_piix libata mptspi mptscsih mptbase [last unloaded: scsi_wait_scan]
+[ 131.191092] Pid: 2250, comm: iscsi_ttx Tainted: G W 3.2.0-rc4+ #42
+[ 131.191092] Call Trace:
+[ 131.191092] [<ffffffff8103b553>] warn_slowpath_common+0x80/0x98
+[ 131.191092] [<ffffffff8103b5ff>] warn_slowpath_fmt+0x41/0x43
+[ 131.191092] [<ffffffff811d0279>] __list_del_entry+0x8d/0x98
+[ 131.191092] [<ffffffffa01395c9>] transport_lun_remove_cmd+0x9b/0xb7 [target_core_mod]
+[ 131.191092] [<ffffffffa013a55c>] transport_generic_free_cmd+0x5d/0x71 [target_core_mod]
+[ 131.191092] [<ffffffffa01a012b>] iscsit_free_cmd+0x1e/0x27 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a13be>] iscsit_close_connection+0x14d/0x5b2 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa0196a0c>] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a55d4>] iscsi_target_tx_thread+0x15cb/0x1608 [iscsi_target_mod]
+[ 131.191092] [<ffffffff8103609a>] ? check_preempt_wakeup+0x121/0x185
+[ 131.191092] [<ffffffff81030801>] ? __dequeue_entity+0x2e/0x33
+[ 131.191092] [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
+[ 131.191092] [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
+[ 131.191092] [<ffffffff8138f706>] ? schedule+0x55/0x57
+[ 131.191092] [<ffffffff81056c7d>] kthread+0x7d/0x85
+[ 131.191092] [<ffffffff81399534>] kernel_thread_helper+0x4/0x10
+[ 131.191092] [<ffffffff81056c00>] ? kthread_worker_fn+0x16d/0x16d
+[ 131.191092] [<ffffffff81399530>] ? gs_change+0x13/0x13
+
+Reported-by: <jrepac@yahoo.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_util.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -851,6 +851,17 @@ void iscsit_free_cmd(struct iscsi_cmd *c
+ case ISCSI_OP_SCSI_TMFUNC:
+ transport_generic_free_cmd(&cmd->se_cmd, 1);
+ break;
++ case ISCSI_OP_REJECT:
++ /*
++ * Handle special case for REJECT when iscsi_add_reject*() has
++ * overwritten the original iscsi_opcode assignment, and the
++ * associated cmd->se_cmd needs to be released.
++ */
++ if (cmd->se_cmd.se_tfo != NULL) {
++ transport_generic_free_cmd(&cmd->se_cmd, 1);
++ break;
++ }
++ /* Fall-through */
+ default:
+ iscsit_release_cmd(cmd);
+ break;
--- /dev/null
+From dc9086004b3d5db75997a645b3fe08d9138b7ad0 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Wed, 8 Feb 2012 17:13:38 -0800
+Subject: mm: compaction: check for overlapping nodes during isolation for migration
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit dc9086004b3d5db75997a645b3fe08d9138b7ad0 upstream.
+
+When isolating pages for migration, migration starts at the start of a
+zone while the free scanner starts at the end of the zone. Migration
+avoids entering a new zone by never going beyond the free scanned.
+
+Unfortunately, in very rare cases nodes can overlap. When this happens,
+migration isolates pages without the LRU lock held, corrupting lists
+which will trigger errors in reclaim or during page free such as in the
+following oops
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+ IP: [<ffffffff810f795c>] free_pcppages_bulk+0xcc/0x450
+ PGD 1dda554067 PUD 1e1cb58067 PMD 0
+ Oops: 0000 [#1] SMP
+ CPU 37
+ Pid: 17088, comm: memcg_process_s Tainted: G X
+ RIP: free_pcppages_bulk+0xcc/0x450
+ Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0)
+ Call Trace:
+ free_hot_cold_page+0x17e/0x1f0
+ __pagevec_free+0x90/0xb0
+ release_pages+0x22a/0x260
+ pagevec_lru_move_fn+0xf3/0x110
+ putback_lru_page+0x66/0xe0
+ unmap_and_move+0x156/0x180
+ migrate_pages+0x9e/0x1b0
+ compact_zone+0x1f3/0x2f0
+ compact_zone_order+0xa2/0xe0
+ try_to_compact_pages+0xdf/0x110
+ __alloc_pages_direct_compact+0xee/0x1c0
+ __alloc_pages_slowpath+0x370/0x830
+ __alloc_pages_nodemask+0x1b1/0x1c0
+ alloc_pages_vma+0x9b/0x160
+ do_huge_pmd_anonymous_page+0x160/0x270
+ do_page_fault+0x207/0x4c0
+ page_fault+0x25/0x30
+
+The "X" in the taint flag means that external modules were loaded but but
+is unrelated to the bug triggering. The real problem was because the PFN
+layout looks like this
+
+ Zone PFN ranges:
+ DMA 0x00000010 -> 0x00001000
+ DMA32 0x00001000 -> 0x00100000
+ Normal 0x00100000 -> 0x01e80000
+ Movable zone start PFN for each node
+ early_node_map[14] active PFN ranges
+ 0: 0x00000010 -> 0x0000009b
+ 0: 0x00000100 -> 0x0007a1ec
+ 0: 0x0007a354 -> 0x0007a379
+ 0: 0x0007f7ff -> 0x0007f800
+ 0: 0x00100000 -> 0x00680000
+ 1: 0x00680000 -> 0x00e80000
+ 0: 0x00e80000 -> 0x01080000
+ 1: 0x01080000 -> 0x01280000
+ 0: 0x01280000 -> 0x01480000
+ 1: 0x01480000 -> 0x01680000
+ 0: 0x01680000 -> 0x01880000
+ 1: 0x01880000 -> 0x01a80000
+ 0: 0x01a80000 -> 0x01c80000
+ 1: 0x01c80000 -> 0x01e80000
+
+The fix is straight-forward. isolate_migratepages() has to make a
+similar check to isolate_freepage to ensure that it never isolates pages
+from a zone it does not hold the LRU lock for.
+
+This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x
+and current mainline.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/compaction.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -330,8 +330,17 @@ static isolate_migrate_t isolate_migrate
+ continue;
+ nr_scanned++;
+
+- /* Get the page and skip if free */
++ /*
++ * Get the page and ensure the page is within the same zone.
++ * See the comment in isolate_freepages about overlapping
++ * nodes. It is deliberate that the new zone lock is not taken
++ * as memory compaction should not move pages between nodes.
++ */
+ page = pfn_to_page(low_pfn);
++ if (page_zone(page) != zone)
++ continue;
++
++ /* Skip if free */
+ if (PageBuddy(page))
+ continue;
+
--- /dev/null
+From b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Wed, 8 Feb 2012 17:13:40 -0800
+Subject: mm: fix UP THP spin_is_locked BUGs
+
+From: Hugh Dickins <hughd@google.com>
+
+commit b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 upstream.
+
+Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false,
+and so triggers some BUGs in Transparent HugePage codepaths.
+
+asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x);
+but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE,
+VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/huge_memory.c | 4 ++--
+ mm/swap.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2064,7 +2064,7 @@ static void collect_mm_slot(struct mm_sl
+ {
+ struct mm_struct *mm = mm_slot->mm;
+
+- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
+
+ if (khugepaged_test_exit(mm)) {
+ /* free mm_slot */
+@@ -2094,7 +2094,7 @@ static unsigned int khugepaged_scan_mm_s
+ int progress = 0;
+
+ VM_BUG_ON(!pages);
+- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
+
+ if (khugepaged_scan.mm_slot)
+ mm_slot = khugepaged_scan.mm_slot;
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -667,7 +667,7 @@ void lru_add_page_tail(struct zone* zone
+ VM_BUG_ON(!PageHead(page));
+ VM_BUG_ON(PageCompound(page_tail));
+ VM_BUG_ON(PageLRU(page_tail));
+- VM_BUG_ON(!spin_is_locked(&zone->lru_lock));
++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&zone->lru_lock));
+
+ SetPageLRU(page_tail);
+
--- /dev/null
+From 025e4ab3db07fcbf62c01e4f30d1012234beb980 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 8 Feb 2012 17:13:41 -0800
+Subject: pcmcia: fix socket refcount decrementing on each resume
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 025e4ab3db07fcbf62c01e4f30d1012234beb980 upstream.
+
+This fixes a memory-corrupting bug: not only does it cause the warning,
+but as a result of dropping the refcount to zero, it causes the
+pcmcia_socket0 device structure to be freed while it still has
+references, causing slab caches corruption. A fatal oops quickly
+follows this warning - often even just a 'dmesg' following the warning
+causes the kernel to oops.
+
+While testing suspend/resume on an ARM device with PCMCIA support, and a
+CF card inserted, I found that after five suspend and resumes, the
+kernel would complain, and shortly die after with slab corruption.
+
+ WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
+
+As the message doesn't give a clue about which kobject, and the built-in
+debugging in drivers/base/power/main.c happens too late, this was added
+right before each get_device():
+
+ printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount));
+
+and on the 3rd s2ram cycle, the following behaviour observed:
+
+On the 3rd suspend/resume cycle:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 3
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 3
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3
+ dpm_resume: c1a0d998 [pcmcia_socket0] 3
+ dpm_complete: c1a0d998 [pcmcia_socket0] 2
+
+4th:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 2
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 2
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2
+ dpm_resume: c1a0d998 [pcmcia_socket0] 2
+ dpm_complete: c1a0d998 [pcmcia_socket0] 1
+
+5th:
+
+ dpm_prepare: c1a0d998 [pcmcia_socket0] 1
+ dpm_suspend: c1a0d998 [pcmcia_socket0] 1
+ dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1
+ dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1
+ dpm_resume: c1a0d998 [pcmcia_socket0] 1
+ dpm_complete: c1a0d998 [pcmcia_socket0] 0
+ ------------[ cut here ]------------
+ WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
+ Modules linked in: ucb1x00_core
+ Backtrace:
+ [<c0212090>] (dump_backtrace+0x0/0x110) from [<c04799dc>] (dump_stack+0x18/0x1c)
+ [<c04799c4>] (dump_stack+0x0/0x1c) from [<c021cba0>] (warn_slowpath_common+0x50/0x68)
+ [<c021cb50>] (warn_slowpath_common+0x0/0x68) from [<c021cbdc>] (warn_slowpath_null+0x24/0x28)
+ [<c021cbb8>] (warn_slowpath_null+0x0/0x28) from [<c0335374>] (kobject_get+0x28/0x50)
+ [<c033534c>] (kobject_get+0x0/0x50) from [<c03804f4>] (get_device+0x1c/0x24)
+ [<c0388c90>] (dpm_complete+0x0/0x1a0) from [<c0389cc0>] (dpm_resume_end+0x1c/0x20)
+ ...
+
+Looking at commit 7b24e7988263 ("pcmcia: split up central event handler"),
+the following change was made to cs.c:
+
+ return 0;
+ }
+ #endif
+-
+- send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW);
++ if (!(skt->state & SOCKET_CARDBUS) && (skt->callback))
++ skt->callback->early_resume(skt);
+ return 0;
+ }
+
+And the corresponding change in ds.c is from:
+
+-static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
+-{
+- struct pcmcia_socket *s = pcmcia_get_socket(skt);
+...
+- switch (event) {
+...
+- case CS_EVENT_PM_RESUME:
+- if (verify_cis_cache(skt) != 0) {
+- dev_dbg(&skt->dev, "cis mismatch - different card\n");
+- /* first, remove the card */
+- ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH);
+- mutex_lock(&s->ops_mutex);
+- destroy_cis_cache(skt);
+- kfree(skt->fake_cis);
+- skt->fake_cis = NULL;
+- s->functions = 0;
+- mutex_unlock(&s->ops_mutex);
+- /* now, add the new card */
+- ds_event(skt, CS_EVENT_CARD_INSERTION,
+- CS_EVENT_PRI_LOW);
+- }
+- break;
+...
+- }
+
+- pcmcia_put_socket(s);
+
+- return 0;
+-} /* ds_event */
+
+to:
+
++static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
++{
++ if (!verify_cis_cache(skt)) {
++ pcmcia_put_socket(skt);
++ return 0;
++ }
+
++ dev_dbg(&skt->dev, "cis mismatch - different card\n");
+
++ /* first, remove the card */
++ pcmcia_bus_remove(skt);
++ mutex_lock(&skt->ops_mutex);
++ destroy_cis_cache(skt);
++ kfree(skt->fake_cis);
++ skt->fake_cis = NULL;
++ skt->functions = 0;
++ mutex_unlock(&skt->ops_mutex);
+
++ /* now, add the new card */
++ pcmcia_bus_add(skt);
++ return 0;
++}
+
+As can be seen, the original function called pcmcia_get_socket() and
+pcmcia_put_socket() around the guts, whereas the replacement code
+calls pcmcia_put_socket() only in one path. This creates an imbalance
+in the refcounting.
+
+Testing with pcmcia_put_socket() put removed shows that the bug is gone:
+
+ dpm_suspend: c1a10998 [pcmcia_socket0] 5
+ dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5
+ dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5
+ dpm_resume: c1a10998 [pcmcia_socket0] 5
+ dpm_complete: c1a10998 [pcmcia_socket0] 5
+
+Tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pcmcia/ds.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -1269,10 +1269,8 @@ static int pcmcia_bus_add(struct pcmcia_
+
+ static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
+ {
+- if (!verify_cis_cache(skt)) {
+- pcmcia_put_socket(skt);
++ if (!verify_cis_cache(skt))
+ return 0;
+- }
+
+ dev_dbg(&skt->dev, "cis mismatch - different card\n");
+
atmel_lcdfb-fix-usage-of-contrast_ctr-in-suspend-resume.patch
lockdep-bug-exclude-taint_firmware_workaround-from-disabling-lockdep.patch
lockdep-bug-exclude-taint_oot_module-from-disabling-lock-debugging.patch
+iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch
+iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch
+iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch
+asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch
+asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch
+asoc-wm8962-fix-word-length-configuration.patch
+asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch
+asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch
+pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch
+alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch
+iommu-amd-work-around-broken-ivrs-tables.patch
+iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch
+mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch
+mm-fix-up-thp-spin_is_locked-bugs.patch
+target-use-correct-preempted-registration-sense-code.patch
+target-allow-persistent-reserve-in-for-non-reservation-holder.patch
+target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch
+target-add-workaround-for-zero-length-control-cdb-handling.patch
+target-return-correct-asc-for-unimplemented-vpd-pages.patch
+target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch
--- /dev/null
+From 91ec1d3535b2acf12c599045cc19ad9be3c6a47b Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Fri, 13 Jan 2012 12:01:34 -0800
+Subject: target: Add workaround for zero-length control CDB handling
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 91ec1d3535b2acf12c599045cc19ad9be3c6a47b upstream.
+
+This patch adds a work-around for handling zero allocation length
+control CDBs (type SCF_SCSI_CONTROL_SG_IO_CDB) that was causing an
+OOPs with the following raw calls:
+
+ # sg_raw -v /dev/sdd 3 0 0 0 0 0
+ # sg_raw -v /dev/sdd 0x1a 0 1 0 0 0
+
+This patch will follow existing zero-length handling for data I/O
+and silently return with GOOD status. This addresses the zero length
+issue, but the proper long-term resolution for handling arbitary
+allocation lengths will be to refactor out data-phase handling in
+individual CDB emulation logic within target_core_cdb.c
+
+Reported-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3701,6 +3701,11 @@ transport_allocate_control_task(struct s
+ struct se_task *task;
+ unsigned long flags;
+
++ /* Workaround for handling zero-length control CDBs */
++ if ((cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) &&
++ !cmd->data_length)
++ return 0;
++
+ task = transport_generic_get_task(cmd, cmd->data_direction);
+ if (!task)
+ return -ENOMEM;
+@@ -3772,6 +3777,14 @@ int transport_generic_new_cmd(struct se_
+ else if (!task_cdbs && (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)) {
+ cmd->t_state = TRANSPORT_COMPLETE;
+ atomic_set(&cmd->t_transport_active, 1);
++
++ if (cmd->t_task_cdb[0] == REQUEST_SENSE) {
++ u8 ua_asc = 0, ua_ascq = 0;
++
++ core_scsi3_ua_clear_for_request_sense(cmd,
++ &ua_asc, &ua_ascq);
++ }
++
+ INIT_WORK(&cmd->work, target_complete_ok_work);
+ queue_work(target_completion_wq, &cmd->work);
+ return 0;
--- /dev/null
+From 6816966a8418b980481b4dced7eddd1796b145e8 Mon Sep 17 00:00:00 2001
+From: Marco Sanvido <marco@purestorage.com>
+Date: Tue, 3 Jan 2012 17:12:58 -0800
+Subject: target: Allow PERSISTENT RESERVE IN for non-reservation holder
+
+From: Marco Sanvido <marco@purestorage.com>
+
+commit 6816966a8418b980481b4dced7eddd1796b145e8 upstream.
+
+Initiators that aren't the active reservation holder should be able to
+do a PERSISTENT RESERVE IN command in all cases, so add it to the list
+of allowed CDBs in core_scsi3_pr_seq_non_holder().
+
+Signed-off-by: Marco Sanvido <marco@purestorage.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_pr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -481,6 +481,7 @@ static int core_scsi3_pr_seq_non_holder(
+ case READ_MEDIA_SERIAL_NUMBER:
+ case REPORT_LUNS:
+ case REQUEST_SENSE:
++ case PERSISTENT_RESERVE_IN:
+ ret = 0; /*/ Allowed CDBs */
+ break;
+ default:
--- /dev/null
+From 9fbc8909876a2160044e71d376848973b9bfdc3f Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Mon, 9 Jan 2012 17:54:00 -0800
+Subject: target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB}
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 9fbc8909876a2160044e71d376848973b9bfdc3f upstream.
+
+According to SPC-4, the sense key for commands that are failed with
+INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be
+ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh). Without this
+patch, a tcm_loop LUN incorrectly gives:
+
+ # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0
+ Sense Information:
+ Fixed format, current; Sense key: Aborted Command
+ Additional sense: Invalid field in cdb
+ Raw sense data (in hex):
+ 70 00 0b 00 00 00 00 0a 00 00 00 00 24 00 00 00
+ 00 00
+
+While a real SCSI disk gives:
+
+ Sense Information:
+ Fixed format, current; Sense key: Illegal Request
+ Additional sense: Invalid field in cdb
+ Raw sense data (in hex):
+ 70 00 05 00 00 00 00 18 00 00 00 00 24 00 00 00
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+with the main point being that the real disk gives a sense key of
+ILLEGAL REQUEST (5h).
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4403,8 +4403,8 @@ int transport_send_check_condition_and_s
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
+ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+- /* ABORTED COMMAND */
+- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
++ /* ILLEGAL REQUEST */
++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN CDB */
+ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24;
+ break;
+@@ -4412,8 +4412,8 @@ int transport_send_check_condition_and_s
+ /* CURRENT ERROR */
+ buffer[offset] = 0x70;
+ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+- /* ABORTED COMMAND */
+- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
++ /* ILLEGAL REQUEST */
++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ /* INVALID FIELD IN PARAMETER LIST */
+ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x26;
+ break;
--- /dev/null
+From bf0053550aebe56f3bb5dd793e9de69238b5b945 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 17 Jan 2012 18:00:57 -0800
+Subject: target: Fail INQUIRY commands with EVPD==0 but PAGE CODE!=0
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit bf0053550aebe56f3bb5dd793e9de69238b5b945 upstream.
+
+My draft of SPC-4 says:
+
+ If the PAGE CODE field is not set to zero when the EVPD bit is set
+ to zero, the command shall be terminated with CHECK CONDITION
+ status, with the sense key set to ILLEGAL REQUEST, and the
+ additional sense code set to INVALID FIELD IN CDB.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_cdb.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -701,6 +701,13 @@ int target_emulate_inquiry(struct se_tas
+ int p, ret;
+
+ if (!(cdb[1] & 0x1)) {
++ if (cdb[2]) {
++ pr_err("INQUIRY with EVPD==0 but PAGE CODE=%02x\n",
++ cdb[2]);
++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
++ return -EINVAL;
++ }
++
+ ret = target_emulate_inquiry_std(cmd);
+ goto out;
+ }
--- /dev/null
+From bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 17 Jan 2012 18:00:56 -0800
+Subject: target: Return correct ASC for unimplemented VPD pages
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 upstream.
+
+My draft of SPC-4 says:
+
+ If the device server does not implement the requested vital product
+ data page, then the command shall be terminated with CHECK CONDITION
+ status, with the sense key set to ILLEGAL REQUEST, and the
+ additional sense code set to INVALID FIELD IN CDB.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_cdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -732,7 +732,7 @@ int target_emulate_inquiry(struct se_tas
+ }
+
+ pr_err("Unknown VPD Code: 0x%02x\n", cdb[2]);
+- cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+ ret = -EINVAL;
+
+ out_unmap:
--- /dev/null
+From 9e08e34e3735ae057eb3834da3570995811b7eb9 Mon Sep 17 00:00:00 2001
+From: Marco Sanvido <marco@purestorage.com>
+Date: Tue, 3 Jan 2012 17:12:57 -0800
+Subject: target: Use correct preempted registration sense code
+
+From: Marco Sanvido <marco@purestorage.com>
+
+commit 9e08e34e3735ae057eb3834da3570995811b7eb9 upstream.
+
+The comments quote the right parts of the spec:
+
+ * d) Establish a unit attention condition for the
+ * initiator port associated with every I_T nexus
+ * that lost its registration other than the I_T
+ * nexus on which the PERSISTENT RESERVE OUT command
+ * was received, with the additional sense code set
+ * to REGISTRATIONS PREEMPTED.
+
+and
+
+ * e) Establish a unit attention condition for the initiator
+ * port associated with every I_T nexus that lost its
+ * persistent reservation and/or registration, with the
+ * additional sense code set to REGISTRATIONS PREEMPTED;
+
+but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED
+instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED. Fix this.
+
+Signed-off-by: Marco Sanvido <marco@purestorage.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_pr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3138,7 +3138,7 @@ static int core_scsi3_pro_preempt(
+ if (!calling_it_nexus)
+ core_scsi3_ua_allocate(pr_reg_nacl,
+ pr_res_mapped_lun, 0x2A,
+- ASCQ_2AH_RESERVATIONS_PREEMPTED);
++ ASCQ_2AH_REGISTRATIONS_PREEMPTED);
+ }
+ spin_unlock(&pr_tmpl->registration_lock);
+ /*
+@@ -3251,7 +3251,7 @@ static int core_scsi3_pro_preempt(
+ * additional sense code set to REGISTRATIONS PREEMPTED;
+ */
+ core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun, 0x2A,
+- ASCQ_2AH_RESERVATIONS_PREEMPTED);
++ ASCQ_2AH_REGISTRATIONS_PREEMPTED);
+ }
+ spin_unlock(&pr_tmpl->registration_lock);
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
