From: Greg Kroah-Hartman Date: Fri, 17 May 2013 18:37:43 +0000 (-0700) Subject: 3.9-stable patches X-Git-Tag: v3.0.79~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c3ca1f69f17dcfb5a77989035a9145ce6abfe1a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.9-stable patches added patches: acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch cpufreq-intel_pstate-fix-ffmpeg-regression.patch cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch cpufreq-intel_pstate-use-lowest-requested-max-performance.patch drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch drm-radeon-check-incoming-cliprects-pointer.patch drm-radeon-restore-nomodeset-operation-v2.patch ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch iscsi-target-fix-processing-of-ooo-commands.patch parisc-fix-native-set-up-in-build.patch parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch parisc-make-default-cross-compiler-search-more-robust-v3.patch parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch parisc-use-long-branch-in-fork_like-macro.patch target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch usermodehelper-check-subprocess_info-path-null.patch --- diff --git a/queue-3.9/acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch b/queue-3.9/acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch new file mode 100644 index 00000000000..8a99b718f32 --- /dev/null +++ b/queue-3.9/acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch @@ -0,0 +1,58 @@ +From 28fe5c825f8e15744d04c7c1b8df197950923ecd Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Mon, 6 May 2013 03:23:40 +0000 +Subject: ACPI / EC: Restart transaction even when the IBF flag set + +From: Lan Tianyu + +commit 28fe5c825f8e15744d04c7c1b8df197950923ecd upstream. + +The EC driver works abnormally with IBF flag always set. +IBF means "The host has written a byte of data to the command +or data port, but the embedded controller has not yet read it". +If IBF is set in the EC status and not cleared, this will cause +all subsequent EC requests to fail with a timeout error. + +Change the EC driver so that it doesn't refuse to restart a +transaction if IBF is set in the status. Also increase the +number of transaction restarts to 5, as it turns out that 2 +is not sufficient in some cases. + +This bug happens on several different machines (Asus V1S, +Dell Latitude E6530, Samsung R719, Acer Aspire 5930G, +Sony Vaio SR19VN and others). + +[rjw: Changelog] +References: https://bugzilla.kernel.org/show_bug.cgi?id=14733 +References: https://bugzilla.kernel.org/show_bug.cgi?id=15560 +References: https://bugzilla.kernel.org/show_bug.cgi?id=15946 +References: https://bugzilla.kernel.org/show_bug.cgi?id=42945 +References: https://bugzilla.kernel.org/show_bug.cgi?id=48221 +Signed-off-by: Lan Tianyu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -223,7 +223,7 @@ static int ec_check_sci_sync(struct acpi + static int ec_poll(struct acpi_ec *ec) + { + unsigned long flags; +- int repeat = 2; /* number of command restarts */ ++ int repeat = 5; /* number of command restarts */ + while (repeat--) { + unsigned long delay = jiffies + + msecs_to_jiffies(ec_delay); +@@ -241,8 +241,6 @@ static int ec_poll(struct acpi_ec *ec) + } + advance_transaction(ec, acpi_ec_read_status(ec)); + } while (time_before(jiffies, delay)); +- if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) +- break; + pr_debug(PREFIX "controller reset, restart transaction\n"); + spin_lock_irqsave(&ec->lock, flags); + start_transaction(ec); diff --git a/queue-3.9/asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch b/queue-3.9/asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch new file mode 100644 index 00000000000..78030d54872 --- /dev/null +++ b/queue-3.9/asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch @@ -0,0 +1,44 @@ +From 61559af111e41761f5f4f20ce0897345eb59076e Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 9 May 2013 21:14:20 +0800 +Subject: ASoC: da7213: Fix setting dmic_samplephase and dmic_clk_rate + +From: Axel Lin + +commit 61559af111e41761f5f4f20ce0897345eb59076e upstream. + +When set dmic_samplephase and dmic_clk_rate bits for dmic_cfg, +current code checks pdata->dmic_data_sel which is wrong. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/da7213.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/da7213.c ++++ b/sound/soc/codecs/da7213.c +@@ -1488,17 +1488,17 @@ static int da7213_probe(struct snd_soc_c + DA7213_DMIC_DATA_SEL_SHIFT); + break; + } +- switch (pdata->dmic_data_sel) { ++ switch (pdata->dmic_samplephase) { + case DA7213_DMIC_SAMPLE_ON_CLKEDGE: + case DA7213_DMIC_SAMPLE_BETWEEN_CLKEDGE: +- dmic_cfg |= (pdata->dmic_data_sel << ++ dmic_cfg |= (pdata->dmic_samplephase << + DA7213_DMIC_SAMPLEPHASE_SHIFT); + break; + } +- switch (pdata->dmic_data_sel) { ++ switch (pdata->dmic_clk_rate) { + case DA7213_DMIC_CLK_3_0MHZ: + case DA7213_DMIC_CLK_1_5MHZ: +- dmic_cfg |= (pdata->dmic_data_sel << ++ dmic_cfg |= (pdata->dmic_clk_rate << + DA7213_DMIC_CLK_RATE_SHIFT); + break; + } diff --git a/queue-3.9/cpufreq-intel_pstate-fix-ffmpeg-regression.patch b/queue-3.9/cpufreq-intel_pstate-fix-ffmpeg-regression.patch new file mode 100644 index 00000000000..c7cf66194b2 --- /dev/null +++ b/queue-3.9/cpufreq-intel_pstate-fix-ffmpeg-regression.patch @@ -0,0 +1,56 @@ +From ca182aee389f8026401510f4c63841cb02c820e8 Mon Sep 17 00:00:00 2001 +From: Dirk Brandewie +Date: Tue, 7 May 2013 08:20:27 -0700 +Subject: cpufreq / intel_pstate: fix ffmpeg regression + +From: Dirk Brandewie + +commit ca182aee389f8026401510f4c63841cb02c820e8 upstream. + +The ffmpeg benchmark in the phoronix test suite has threads on +multiple cores that rely on the progress on of threads on other cores +and ping pong back and forth fast enough to make the core appear less +busy than it "should" be. If the core has been at minimum p-state for +a while bump the pstate up to kick the core to see if it is in this +ping pong state. If the core is truly idle the p-state will be +reduced at the next sample time. If the core makes more progress it +will send more work to the thread bringing both threads out of the +ping pong scenario and the p-state will be selected normally. + +This fixes a performance regression of approximately 30% + +Signed-off-by: Dirk Brandewie +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -551,22 +551,16 @@ static void intel_pstate_timer_func(unsi + struct cpudata *cpu = (struct cpudata *) __data; + + intel_pstate_sample(cpu); ++ intel_pstate_adjust_busy_pstate(cpu); + +- if (!cpu->idle_mode) +- intel_pstate_adjust_busy_pstate(cpu); +- else +- intel_pstate_adjust_idle_pstate(cpu); +- +-#if defined(XPERF_FIX) + if (cpu->pstate.current_pstate == cpu->pstate.min_pstate) { + cpu->min_pstate_count++; + if (!(cpu->min_pstate_count % 5)) { + intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate); +- intel_pstate_idle_mode(cpu); + } + } else + cpu->min_pstate_count = 0; +-#endif ++ + intel_pstate_set_sample_time(cpu); + } + diff --git a/queue-3.9/cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch b/queue-3.9/cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch new file mode 100644 index 00000000000..2748ddeaba1 --- /dev/null +++ b/queue-3.9/cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch @@ -0,0 +1,106 @@ +From 1abc4b20b85b42e8573957e54b193385cf48b0d6 Mon Sep 17 00:00:00 2001 +From: Dirk Brandewie +Date: Tue, 7 May 2013 08:20:25 -0700 +Subject: cpufreq / intel_pstate: remove idle time and duration from sample and calculations + +From: Dirk Brandewie + +commit 1abc4b20b85b42e8573957e54b193385cf48b0d6 upstream. + +Idle time is taken into account in the APERF/MPERF ratio calculation +there is no reason for the driver to track it seperately. This +reduces the work in the driver and makes the code more readable. + +Removal of the tracking of sample duration removes the possibility of +the divide by zero exception when the duration is sub 1us + +References: https://bugzilla.kernel.org/show_bug.cgi?id=56691 +Reported-by: Mike Lothian +Signed-off-by: Dirk Brandewie +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 43 ++++++----------------------------------- + 1 file changed, 7 insertions(+), 36 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -48,12 +48,7 @@ static inline int32_t div_fp(int32_t x, + } + + struct sample { +- ktime_t start_time; +- ktime_t end_time; + int core_pct_busy; +- int pstate_pct_busy; +- u64 duration_us; +- u64 idletime_us; + u64 aperf; + u64 mperf; + int freq; +@@ -91,8 +86,6 @@ struct cpudata { + int min_pstate_count; + int idle_mode; + +- ktime_t prev_sample; +- u64 prev_idle_time_us; + u64 prev_aperf; + u64 prev_mperf; + int sample_ptr; +@@ -450,48 +443,26 @@ static inline void intel_pstate_calc_bus + struct sample *sample) + { + u64 core_pct; +- sample->pstate_pct_busy = 100 - div64_u64( +- sample->idletime_us * 100, +- sample->duration_us); + core_pct = div64_u64(sample->aperf * 100, sample->mperf); + sample->freq = cpu->pstate.max_pstate * core_pct * 1000; + +- sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct), +- 100); ++ sample->core_pct_busy = core_pct; + } + + static inline void intel_pstate_sample(struct cpudata *cpu) + { +- ktime_t now; +- u64 idle_time_us; + u64 aperf, mperf; + +- now = ktime_get(); +- idle_time_us = get_cpu_idle_time_us(cpu->cpu, NULL); +- + rdmsrl(MSR_IA32_APERF, aperf); + rdmsrl(MSR_IA32_MPERF, mperf); +- /* for the first sample, don't actually record a sample, just +- * set the baseline */ +- if (cpu->prev_idle_time_us > 0) { +- cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT; +- cpu->samples[cpu->sample_ptr].start_time = cpu->prev_sample; +- cpu->samples[cpu->sample_ptr].end_time = now; +- cpu->samples[cpu->sample_ptr].duration_us = +- ktime_us_delta(now, cpu->prev_sample); +- cpu->samples[cpu->sample_ptr].idletime_us = +- idle_time_us - cpu->prev_idle_time_us; +- +- cpu->samples[cpu->sample_ptr].aperf = aperf; +- cpu->samples[cpu->sample_ptr].mperf = mperf; +- cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf; +- cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf; ++ cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT; ++ cpu->samples[cpu->sample_ptr].aperf = aperf; ++ cpu->samples[cpu->sample_ptr].mperf = mperf; ++ cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf; ++ cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf; + +- intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]); +- } ++ intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]); + +- cpu->prev_sample = now; +- cpu->prev_idle_time_us = idle_time_us; + cpu->prev_aperf = aperf; + cpu->prev_mperf = mperf; + } diff --git a/queue-3.9/cpufreq-intel_pstate-use-lowest-requested-max-performance.patch b/queue-3.9/cpufreq-intel_pstate-use-lowest-requested-max-performance.patch new file mode 100644 index 00000000000..b3e86f69e3d --- /dev/null +++ b/queue-3.9/cpufreq-intel_pstate-use-lowest-requested-max-performance.patch @@ -0,0 +1,70 @@ +From d8f469e9cff3bc4a6317d923e9506be046aa7bdc Mon Sep 17 00:00:00 2001 +From: Dirk Brandewie +Date: Tue, 7 May 2013 08:20:26 -0700 +Subject: cpufreq / intel_pstate: use lowest requested max performance + +From: Dirk Brandewie + +commit d8f469e9cff3bc4a6317d923e9506be046aa7bdc upstream. + +There are two ways that the maximum p-state can be clamped, via a +policy change and via the sysfs file. + +The acpi-thermal driver adjusts the p-state policy in response to +thermal events. These changes override the users settings at the +moment. + +Use the lowest of the two requested values this ensures that we will +not exceed the requested pstate from either mechanism. + +Reported-by: Srinivas Pandruvada +Signed-off-by: Dirk Brandewie +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -117,6 +117,8 @@ struct perf_limits { + int min_perf_pct; + int32_t max_perf; + int32_t min_perf; ++ int max_policy_pct; ++ int max_sysfs_pct; + }; + + static struct perf_limits limits = { +@@ -125,6 +127,8 @@ static struct perf_limits limits = { + .max_perf = int_tofp(1), + .min_perf_pct = 0, + .min_perf = 0, ++ .max_policy_pct = 100, ++ .max_sysfs_pct = 100, + }; + + static inline void pid_reset(struct _pid *pid, int setpoint, int busy, +@@ -295,7 +299,8 @@ static ssize_t store_max_perf_pct(struct + if (ret != 1) + return -EINVAL; + +- limits.max_perf_pct = clamp_t(int, input, 0 , 100); ++ limits.max_sysfs_pct = clamp_t(int, input, 0 , 100); ++ limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct); + limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100)); + return count; + } +@@ -641,8 +646,9 @@ static int intel_pstate_set_policy(struc + limits.min_perf_pct = clamp_t(int, limits.min_perf_pct, 0 , 100); + limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100)); + +- limits.max_perf_pct = policy->max * 100 / policy->cpuinfo.max_freq; +- limits.max_perf_pct = clamp_t(int, limits.max_perf_pct, 0 , 100); ++ limits.max_policy_pct = policy->max * 100 / policy->cpuinfo.max_freq; ++ limits.max_policy_pct = clamp_t(int, limits.max_policy_pct, 0 , 100); ++ limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct); + limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100)); + + if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) { diff --git a/queue-3.9/drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch b/queue-3.9/drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch new file mode 100644 index 00000000000..974d0fd78ed --- /dev/null +++ b/queue-3.9/drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch @@ -0,0 +1,42 @@ +From a5f2b3d6a738e7d4180012fe7b541172f8c8dcea Mon Sep 17 00:00:00 2001 +From: Chen Gang +Date: Thu, 16 May 2013 14:04:25 -0500 +Subject: drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow + +From: Chen Gang + +commit a5f2b3d6a738e7d4180012fe7b541172f8c8dcea upstream. + +When calling memcpy, read_data and write_data need additional 2 bytes. + + write_data: + for checking: "if (size > IPMI_MAX_MSG_LENGTH)" + for operating: "memcpy(bt->write_data + 3, data + 1, size - 1)" + + read_data: + for checking: "if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH)" + for operating: "memcpy(data + 2, bt->read_data + 4, msg_len - 2)" + +Signed-off-by: Chen Gang +Signed-off-by: Corey Minyard +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_bt_sm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/ipmi/ipmi_bt_sm.c ++++ b/drivers/char/ipmi/ipmi_bt_sm.c +@@ -95,9 +95,9 @@ struct si_sm_data { + enum bt_states state; + unsigned char seq; /* BT sequence number */ + struct si_sm_io *io; +- unsigned char write_data[IPMI_MAX_MSG_LENGTH]; ++ unsigned char write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */ + int write_count; +- unsigned char read_data[IPMI_MAX_MSG_LENGTH]; ++ unsigned char read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */ + int read_count; + int truncated; + long timeout; /* microseconds countdown */ diff --git a/queue-3.9/drm-radeon-check-incoming-cliprects-pointer.patch b/queue-3.9/drm-radeon-check-incoming-cliprects-pointer.patch new file mode 100644 index 00000000000..51193f1ac98 --- /dev/null +++ b/queue-3.9/drm-radeon-check-incoming-cliprects-pointer.patch @@ -0,0 +1,31 @@ +From fefaedcfb82d2e57c2320acf60604ab03b750cc0 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Sun, 12 May 2013 22:00:51 -0700 +Subject: drm/radeon: check incoming cliprects pointer + +From: Kees Cook + +commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream. + +The "boxes" parameter points into userspace memory. It should be verified +like any other operation against user memory. + +Signed-off-by: Kees Cook +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r300_cmdbuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c ++++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c +@@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeo + OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1)); + + for (i = 0; i < nr; ++i) { +- if (DRM_COPY_FROM_USER_UNCHECKED ++ if (DRM_COPY_FROM_USER + (&box, &cmdbuf->boxes[n + i], sizeof(box))) { + DRM_ERROR("copy cliprect faulted\n"); + return -EFAULT; diff --git a/queue-3.9/drm-radeon-restore-nomodeset-operation-v2.patch b/queue-3.9/drm-radeon-restore-nomodeset-operation-v2.patch new file mode 100644 index 00000000000..4b1b79f261a --- /dev/null +++ b/queue-3.9/drm-radeon-restore-nomodeset-operation-v2.patch @@ -0,0 +1,54 @@ +From e9ced8e040ebe40e9953db90acbe7d0b58702ebb Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Wed, 15 May 2013 01:23:36 +0000 +Subject: drm/radeon: restore nomodeset operation (v2) + +From: Dave Airlie + +commit e9ced8e040ebe40e9953db90acbe7d0b58702ebb upstream. + +When UMS was deprecated it removed support for nomodeset commandline +we really want this in distro land so we can debug stuff, everyone +should fallback to vesa correctly. + +v2: oops -1 isn't used anymore, restore original behaviour +-1 is default, so we can boot with nomodeset on the command line, +then use radeon.modeset=1 to override it for debugging later. + +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_drv.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_drv.c ++++ b/drivers/gpu/drm/radeon/radeon_drv.c +@@ -144,7 +144,7 @@ static inline void radeon_unregister_atp + #endif + + int radeon_no_wb; +-int radeon_modeset = 1; ++int radeon_modeset = -1; + int radeon_dynclks = -1; + int radeon_r4xx_atom = 0; + int radeon_agpmode = 0; +@@ -449,6 +449,16 @@ static struct pci_driver radeon_kms_pci_ + + static int __init radeon_init(void) + { ++#ifdef CONFIG_VGA_CONSOLE ++ if (vgacon_text_force() && radeon_modeset == -1) { ++ DRM_INFO("VGACON disable radeon kernel modesetting.\n"); ++ radeon_modeset = 0; ++ } ++#endif ++ /* set to modesetting by default if not nomodeset */ ++ if (radeon_modeset == -1) ++ radeon_modeset = 1; ++ + if (radeon_modeset == 1) { + DRM_INFO("radeon kernel modesetting enabled.\n"); + driver = &kms_driver; diff --git a/queue-3.9/ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch b/queue-3.9/ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch new file mode 100644 index 00000000000..037d01b2196 --- /dev/null +++ b/queue-3.9/ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch @@ -0,0 +1,52 @@ +From 6368087e851e697679af059b4247aca33a69cef3 Mon Sep 17 00:00:00 2001 +From: Benjamin LaHaise +Date: Thu, 16 May 2013 14:04:27 -0500 +Subject: ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex + +From: Benjamin LaHaise + +commit 6368087e851e697679af059b4247aca33a69cef3 upstream. + +When a 32 bit version of ipmitool is used on a 64 bit kernel, the +ipmi_devintf code fails to correctly acquire ipmi_mutex. This results in +incomplete data being retrieved in some cases, or other possible failures. +Add a wrapper around compat_ipmi_ioctl() to take ipmi_mutex to fix this. + +Signed-off-by: Benjamin LaHaise +Signed-off-by: Corey Minyard +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_devintf.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_devintf.c ++++ b/drivers/char/ipmi/ipmi_devintf.c +@@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct fil + return ipmi_ioctl(filep, cmd, arg); + } + } ++ ++static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd, ++ unsigned long arg) ++{ ++ int ret; ++ ++ mutex_lock(&ipmi_mutex); ++ ret = compat_ipmi_ioctl(filep, cmd, arg); ++ mutex_unlock(&ipmi_mutex); ++ ++ return ret; ++} + #endif + + static const struct file_operations ipmi_fops = { + .owner = THIS_MODULE, + .unlocked_ioctl = ipmi_unlocked_ioctl, + #ifdef CONFIG_COMPAT +- .compat_ioctl = compat_ipmi_ioctl, ++ .compat_ioctl = unlocked_compat_ipmi_ioctl, + #endif + .open = ipmi_open, + .release = ipmi_release, diff --git a/queue-3.9/iscsi-target-fix-processing-of-ooo-commands.patch b/queue-3.9/iscsi-target-fix-processing-of-ooo-commands.patch new file mode 100644 index 00000000000..644d3ed3f5b --- /dev/null +++ b/queue-3.9/iscsi-target-fix-processing-of-ooo-commands.patch @@ -0,0 +1,50 @@ +From 3eccfdb01da58fbd0f789ae6ca61cee3769e26de Mon Sep 17 00:00:00 2001 +From: Shlomo Pongratz +Date: Sun, 5 May 2013 17:36:26 +0300 +Subject: iscsi-target: Fix processing of OOO commands + +From: Shlomo Pongratz + +commit 3eccfdb01da58fbd0f789ae6ca61cee3769e26de upstream. + +Fix two issues in OOO commands processing done at iscsit_attach_ooo_cmdsn. + +Handle command serial numbers wrap around by using iscsi_sna_lt and not regular comparisson. + +The routine iterates until it finds an entry whose serial number is greater than the serial number of +the new one, thus the new entry should be inserted before that entry and not after. + +Signed-off-by: Shlomo Pongratz +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_erl1.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_erl1.c ++++ b/drivers/target/iscsi/iscsi_target_erl1.c +@@ -819,7 +819,7 @@ static int iscsit_attach_ooo_cmdsn( + /* + * CmdSN is greater than the tail of the list. + */ +- if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn) ++ if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn)) + list_add_tail(&ooo_cmdsn->ooo_list, + &sess->sess_ooo_cmdsn_list); + else { +@@ -829,11 +829,12 @@ static int iscsit_attach_ooo_cmdsn( + */ + list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list, + ooo_list) { +- if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn) ++ if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn)) + continue; + ++ /* Insert before this entry */ + list_add(&ooo_cmdsn->ooo_list, +- &ooo_tmp->ooo_list); ++ ooo_tmp->ooo_list.prev); + break; + } + } diff --git a/queue-3.9/parisc-fix-native-set-up-in-build.patch b/queue-3.9/parisc-fix-native-set-up-in-build.patch new file mode 100644 index 00000000000..56e289ec521 --- /dev/null +++ b/queue-3.9/parisc-fix-native-set-up-in-build.patch @@ -0,0 +1,34 @@ +From 93782eba49e23c3f311a6b05a19ba15927ec4e8b Mon Sep 17 00:00:00 2001 +From: Mike Frysinger +Date: Sat, 4 May 2013 16:50:58 +0000 +Subject: parisc: fix NATIVE set up in build + +From: Mike Frysinger + +commit 93782eba49e23c3f311a6b05a19ba15927ec4e8b upstream. + +The ifeq operator does not accept globs, so this little bit of code will +never match (unless uname literally prints out "parsic*"). Rewrite to +use a pattern matching operator so that NATIVE is set to 1 on parisc. + +Signed-off-by: Mike Frysinger +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/Makefile | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/parisc/Makefile ++++ b/arch/parisc/Makefile +@@ -24,9 +24,7 @@ CHECKFLAGS += -D__hppa__=1 + LIBGCC = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name) + + MACHINE := $(shell uname -m) +-ifeq ($(MACHINE),parisc*) +-NATIVE := 1 +-endif ++NATIVE := $(if $(filter parisc%,$(MACHINE)),1,0) + + ifdef CONFIG_64BIT + UTS_MACHINE := parisc64 diff --git a/queue-3.9/parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch b/queue-3.9/parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch new file mode 100644 index 00000000000..9888eb15d91 --- /dev/null +++ b/queue-3.9/parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch @@ -0,0 +1,388 @@ +From f0a18819e261afc5fdbd8c5c6f9943123c5461ba Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Fri, 10 May 2013 23:21:38 +0000 +Subject: parisc: fix SMP races when updating PTE and TLB entries in entry.S + +From: John David Anglin + +commit f0a18819e261afc5fdbd8c5c6f9943123c5461ba upstream. + +Currently, race conditions exist in the handling of TLB interruptions in +entry.S. In particular, dirty bit updates can be lost if an accessed +interruption occurs just after the dirty bit interruption on a different +cpu. Lost dirty bit updates result in user pages not being flushed and +general system instability. This change adds lock and unlock macros to +synchronize all PTE and TLB updates done in entry.S. As a result, +userspace stability is significantly improved. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/entry.S | 155 ++++++++++++++++++++++++--------------------- + 1 file changed, 83 insertions(+), 72 deletions(-) + +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -444,9 +444,41 @@ + L2_ptep \pgd,\pte,\index,\va,\fault + .endm + ++ /* Acquire pa_dbit_lock lock. */ ++ .macro dbit_lock spc,tmp,tmp1 ++#ifdef CONFIG_SMP ++ cmpib,COND(=),n 0,\spc,2f ++ load32 PA(pa_dbit_lock),\tmp ++1: LDCW 0(\tmp),\tmp1 ++ cmpib,COND(=) 0,\tmp1,1b ++ nop ++2: ++#endif ++ .endm ++ ++ /* Release pa_dbit_lock lock without reloading lock address. */ ++ .macro dbit_unlock0 spc,tmp ++#ifdef CONFIG_SMP ++ or,COND(=) %r0,\spc,%r0 ++ stw \spc,0(\tmp) ++#endif ++ .endm ++ ++ /* Release pa_dbit_lock lock. */ ++ .macro dbit_unlock1 spc,tmp ++#ifdef CONFIG_SMP ++ load32 PA(pa_dbit_lock),\tmp ++ dbit_unlock0 \spc,\tmp ++#endif ++ .endm ++ + /* Set the _PAGE_ACCESSED bit of the PTE. Be clever and + * don't needlessly dirty the cache line if it was already set */ +- .macro update_ptep ptep,pte,tmp,tmp1 ++ .macro update_ptep spc,ptep,pte,tmp,tmp1 ++#ifdef CONFIG_SMP ++ or,COND(=) %r0,\spc,%r0 ++ LDREG 0(\ptep),\pte ++#endif + ldi _PAGE_ACCESSED,\tmp1 + or \tmp1,\pte,\tmp + and,COND(<>) \tmp1,\pte,%r0 +@@ -455,7 +487,11 @@ + + /* Set the dirty bit (and accessed bit). No need to be + * clever, this is only used from the dirty fault */ +- .macro update_dirty ptep,pte,tmp ++ .macro update_dirty spc,ptep,pte,tmp ++#ifdef CONFIG_SMP ++ or,COND(=) %r0,\spc,%r0 ++ LDREG 0(\ptep),\pte ++#endif + ldi _PAGE_ACCESSED|_PAGE_DIRTY,\tmp + or \tmp,\pte,\pte + STREG \pte,0(\ptep) +@@ -1103,11 +1139,13 @@ dtlb_miss_20w: + + L3_ptep ptp,pte,t0,va,dtlb_check_alias_20w + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + idtlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1127,11 +1165,13 @@ nadtlb_miss_20w: + + L3_ptep ptp,pte,t0,va,nadtlb_check_alias_20w + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + idtlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1153,7 +1193,8 @@ dtlb_miss_11: + + L2_ptep ptp,pte,t0,va,dtlb_check_alias_11 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb_11 spc,pte,prot + +@@ -1164,6 +1205,7 @@ dtlb_miss_11: + idtlbp prot,(%sr1,va) + + mtsp t0, %sr1 /* Restore sr1 */ ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1184,7 +1226,8 @@ nadtlb_miss_11: + + L2_ptep ptp,pte,t0,va,nadtlb_check_alias_11 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb_11 spc,pte,prot + +@@ -1196,6 +1239,7 @@ nadtlb_miss_11: + idtlbp prot,(%sr1,va) + + mtsp t0, %sr1 /* Restore sr1 */ ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1216,13 +1260,15 @@ dtlb_miss_20: + + L2_ptep ptp,pte,t0,va,dtlb_check_alias_20 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + f_extend pte,t0 + + idtlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1242,13 +1288,15 @@ nadtlb_miss_20: + + L2_ptep ptp,pte,t0,va,nadtlb_check_alias_20 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + f_extend pte,t0 + + idtlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1349,11 +1397,13 @@ itlb_miss_20w: + + L3_ptep ptp,pte,t0,va,itlb_fault + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + iitlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1371,11 +1421,13 @@ naitlb_miss_20w: + + L3_ptep ptp,pte,t0,va,naitlb_check_alias_20w + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + iitlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1397,7 +1449,8 @@ itlb_miss_11: + + L2_ptep ptp,pte,t0,va,itlb_fault + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb_11 spc,pte,prot + +@@ -1408,6 +1461,7 @@ itlb_miss_11: + iitlbp prot,(%sr1,va) + + mtsp t0, %sr1 /* Restore sr1 */ ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1419,7 +1473,8 @@ naitlb_miss_11: + + L2_ptep ptp,pte,t0,va,naitlb_check_alias_11 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb_11 spc,pte,prot + +@@ -1430,6 +1485,7 @@ naitlb_miss_11: + iitlbp prot,(%sr1,va) + + mtsp t0, %sr1 /* Restore sr1 */ ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1451,13 +1507,15 @@ itlb_miss_20: + + L2_ptep ptp,pte,t0,va,itlb_fault + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + f_extend pte,t0 + + iitlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1469,13 +1527,15 @@ naitlb_miss_20: + + L2_ptep ptp,pte,t0,va,naitlb_check_alias_20 + +- update_ptep ptp,pte,t0,t1 ++ dbit_lock spc,t0,t1 ++ update_ptep spc,ptp,pte,t0,t1 + + make_insert_tlb spc,pte,prot + + f_extend pte,t0 + + iitlbt pte,prot ++ dbit_unlock1 spc,t0 + + rfir + nop +@@ -1499,29 +1559,13 @@ dbit_trap_20w: + + L3_ptep ptp,pte,t0,va,dbit_fault + +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nolock_20w +- load32 PA(pa_dbit_lock),t0 +- +-dbit_spin_20w: +- LDCW 0(t0),t1 +- cmpib,COND(=) 0,t1,dbit_spin_20w +- nop +- +-dbit_nolock_20w: +-#endif +- update_dirty ptp,pte,t1 ++ dbit_lock spc,t0,t1 ++ update_dirty spc,ptp,pte,t1 + + make_insert_tlb spc,pte,prot + + idtlbt pte,prot +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nounlock_20w +- ldi 1,t1 +- stw t1,0(t0) +- +-dbit_nounlock_20w: +-#endif ++ dbit_unlock0 spc,t0 + + rfir + nop +@@ -1535,18 +1579,8 @@ dbit_trap_11: + + L2_ptep ptp,pte,t0,va,dbit_fault + +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nolock_11 +- load32 PA(pa_dbit_lock),t0 +- +-dbit_spin_11: +- LDCW 0(t0),t1 +- cmpib,= 0,t1,dbit_spin_11 +- nop +- +-dbit_nolock_11: +-#endif +- update_dirty ptp,pte,t1 ++ dbit_lock spc,t0,t1 ++ update_dirty spc,ptp,pte,t1 + + make_insert_tlb_11 spc,pte,prot + +@@ -1557,13 +1591,7 @@ dbit_nolock_11: + idtlbp prot,(%sr1,va) + + mtsp t1, %sr1 /* Restore sr1 */ +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nounlock_11 +- ldi 1,t1 +- stw t1,0(t0) +- +-dbit_nounlock_11: +-#endif ++ dbit_unlock0 spc,t0 + + rfir + nop +@@ -1575,32 +1603,15 @@ dbit_trap_20: + + L2_ptep ptp,pte,t0,va,dbit_fault + +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nolock_20 +- load32 PA(pa_dbit_lock),t0 +- +-dbit_spin_20: +- LDCW 0(t0),t1 +- cmpib,= 0,t1,dbit_spin_20 +- nop +- +-dbit_nolock_20: +-#endif +- update_dirty ptp,pte,t1 ++ dbit_lock spc,t0,t1 ++ update_dirty spc,ptp,pte,t1 + + make_insert_tlb spc,pte,prot + + f_extend pte,t1 + + idtlbt pte,prot +- +-#ifdef CONFIG_SMP +- cmpib,COND(=),n 0,spc,dbit_nounlock_20 +- ldi 1,t1 +- stw t1,0(t0) +- +-dbit_nounlock_20: +-#endif ++ dbit_unlock0 spc,t0 + + rfir + nop diff --git a/queue-3.9/parisc-make-default-cross-compiler-search-more-robust-v3.patch b/queue-3.9/parisc-make-default-cross-compiler-search-more-robust-v3.patch new file mode 100644 index 00000000000..9b010b67fd1 --- /dev/null +++ b/queue-3.9/parisc-make-default-cross-compiler-search-more-robust-v3.patch @@ -0,0 +1,78 @@ +From 6880b0150a7c25fd75c5ece80abc49ebf53c38c1 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 11 May 2013 19:04:09 +0000 +Subject: parisc: make default cross compiler search more robust (v3) + +From: Helge Deller + +commit 6880b0150a7c25fd75c5ece80abc49ebf53c38c1 upstream. + +People/distros vary how they prefix the toolchain name for 64bit builds. +Rather than enforce one convention over another, add a for loop which +does a search for all the general prefixes. + +For 64bit builds, we now search for (in order): + hppa64-unknown-linux-gnu + hppa64-linux-gnu + hppa64-linux + +For 32bit builds, we look for: + hppa-unknown-linux-gnu + hppa-linux-gnu + hppa-linux + hppa2.0-unknown-linux-gnu + hppa2.0-linux-gnu + hppa2.0-linux + hppa1.1-unknown-linux-gnu + hppa1.1-linux-gnu + hppa1.1-linux + +This patch was initiated by Mike Frysinger, with feedback from Jeroen +Roovers, John David Anglin and Helge Deller. + +Signed-off-by: Mike Frysinger +Signed-off-by: Jeroen Roovers +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/Makefile | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +--- a/arch/parisc/Makefile ++++ b/arch/parisc/Makefile +@@ -23,24 +23,21 @@ NM = sh $(srctree)/arch/parisc/nm + CHECKFLAGS += -D__hppa__=1 + LIBGCC = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name) + +-MACHINE := $(shell uname -m) +-NATIVE := $(if $(filter parisc%,$(MACHINE)),1,0) +- + ifdef CONFIG_64BIT + UTS_MACHINE := parisc64 + CHECKFLAGS += -D__LP64__=1 -m64 +-WIDTH := 64 ++CC_ARCHES = hppa64 + else # 32-bit +-WIDTH := ++CC_ARCHES = hppa hppa2.0 hppa1.1 + endif + +-# attempt to help out folks who are cross-compiling +-ifeq ($(NATIVE),1) +-CROSS_COMPILE := hppa$(WIDTH)-linux- +-else +- ifeq ($(CROSS_COMPILE),) +- CROSS_COMPILE := hppa$(WIDTH)-linux-gnu- +- endif ++ifneq ($(SUBARCH),$(UTS_MACHINE)) ++ ifeq ($(CROSS_COMPILE),) ++ CC_SUFFIXES = linux linux-gnu unknown-linux-gnu ++ CROSS_COMPILE := $(call cc-cross-prefix, \ ++ $(foreach a,$(CC_ARCHES), \ ++ $(foreach s,$(CC_SUFFIXES),$(a)-$(s)-))) ++ endif + endif + + OBJCOPY_FLAGS =-O binary -R .note -R .comment -S diff --git a/queue-3.9/parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch b/queue-3.9/parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch new file mode 100644 index 00000000000..cabf3be3855 --- /dev/null +++ b/queue-3.9/parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch @@ -0,0 +1,68 @@ +From c207a76bf155cb5cf24cf849c08f6555e9180594 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Tue, 7 May 2013 00:07:25 +0000 +Subject: parisc: only re-enable interrupts if we need to schedule or deliver signals when returning to userspace + +From: John David Anglin + +commit c207a76bf155cb5cf24cf849c08f6555e9180594 upstream. + +Helge and I have found that we have a kernel stack overflow problem +which causes a variety of random failures. +Currently, we re-enable interrupts when returning from an external +interrupt incase we need to schedule or delivery +signals. As a result, a potentially unlimited number of interrupts +can occur while we are running on the kernel +stack. It is very limited in space (currently, 16k). This change +defers enabling interrupts until we have +actually decided to schedule or delivery signals. This only occurs +when we about to return to userspace. This +limits the number of interrupts on the kernel stack to one. In other +cases, interrupts remain disabled until the +final return from interrupt (rfi). + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/entry.S | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -825,11 +825,6 @@ ENTRY(syscall_exit_rfi) + STREG %r19,PT_SR7(%r16) + + intr_return: +- /* NOTE: Need to enable interrupts incase we schedule. */ +- ssm PSW_SM_I, %r0 +- +-intr_check_resched: +- + /* check for reschedule */ + mfctl %cr30,%r1 + LDREG TI_FLAGS(%r1),%r19 /* sched.h: TIF_NEED_RESCHED */ +@@ -856,6 +851,11 @@ intr_check_sig: + LDREG PT_IASQ1(%r16), %r20 + cmpib,COND(=),n 0,%r20,intr_restore /* backward */ + ++ /* NOTE: We need to enable interrupts if we have to deliver ++ * signals. We used to do this earlier but it caused kernel ++ * stack overflows. */ ++ ssm PSW_SM_I, %r0 ++ + copy %r0, %r25 /* long in_syscall = 0 */ + #ifdef CONFIG_64BIT + ldo -16(%r30),%r29 /* Reference param save area */ +@@ -907,6 +907,10 @@ intr_do_resched: + cmpib,COND(=) 0, %r20, intr_do_preempt + nop + ++ /* NOTE: We need to enable interrupts if we schedule. We used ++ * to do this earlier but it caused kernel stack overflows. */ ++ ssm PSW_SM_I, %r0 ++ + #ifdef CONFIG_64BIT + ldo -16(%r30),%r29 /* Reference param save area */ + #endif diff --git a/queue-3.9/parisc-use-long-branch-in-fork_like-macro.patch b/queue-3.9/parisc-use-long-branch-in-fork_like-macro.patch new file mode 100644 index 00000000000..fa8b6e3ee2b --- /dev/null +++ b/queue-3.9/parisc-use-long-branch-in-fork_like-macro.patch @@ -0,0 +1,35 @@ +From bbbfde782084b4f0d85ddffb88f1cf4650ff40e4 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sat, 4 May 2013 19:16:41 +0000 +Subject: parisc: use long branch in fork_like macro + +From: John David Anglin + +commit bbbfde782084b4f0d85ddffb88f1cf4650ff40e4 upstream. + +The "b" branch instruction used in the fork_like macro only can handle +17-bit pc-relative offsets. +This fails with an out of range offset with some .config files. +Rewrite to use the "be" instruction which +can branch to any address in a space. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/entry.S | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -1709,7 +1709,8 @@ ENTRY(sys_\name\()_wrapper) + ldo TASK_REGS(%r1),%r1 + reg_save %r1 + mfctl %cr27, %r28 +- b sys_\name ++ ldil L%sys_\name, %r31 ++ be R%sys_\name(%sr4,%r31) + STREG %r28, PT_CR27(%r1) + ENDPROC(sys_\name\()_wrapper) + .endm diff --git a/queue-3.9/series b/queue-3.9/series index 829d7ce6d8c..c00f836b403 100644 --- a/queue-3.9/series +++ b/queue-3.9/series @@ -80,3 +80,21 @@ drbd-fix-for-deadlock-when-using-automatic-split-brain-recovery.patch vsock-drop-bogus-__init-annotation-from-vsock_init_tables.patch arm-exynos5-fix-kernel-dump-in-aftr-idle-mode.patch drivers-rtc-rtc-pcf2123.c-fix-error-return-code-in-pcf2123_probe.patch +cpufreq-intel_pstate-remove-idle-time-and-duration-from-sample-and-calculations.patch +cpufreq-intel_pstate-use-lowest-requested-max-performance.patch +cpufreq-intel_pstate-fix-ffmpeg-regression.patch +iscsi-target-fix-processing-of-ooo-commands.patch +target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch +target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch +acpi-ec-restart-transaction-even-when-the-ibf-flag-set.patch +drivers-char-ipmi-memcpy-need-additional-2-bytes-to-avoid-memory-overflow.patch +ipmi-ipmi_devintf-compat_ioctl-method-fails-to-take-ipmi_mutex.patch +asoc-da7213-fix-setting-dmic_samplephase-and-dmic_clk_rate.patch +drm-radeon-check-incoming-cliprects-pointer.patch +drm-radeon-restore-nomodeset-operation-v2.patch +usermodehelper-check-subprocess_info-path-null.patch +parisc-only-re-enable-interrupts-if-we-need-to-schedule-or-deliver-signals-when-returning-to-userspace.patch +parisc-fix-smp-races-when-updating-pte-and-tlb-entries-in-entry.s.patch +parisc-use-long-branch-in-fork_like-macro.patch +parisc-fix-native-set-up-in-build.patch +parisc-make-default-cross-compiler-search-more-robust-v3.patch diff --git a/queue-3.9/target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch b/queue-3.9/target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch new file mode 100644 index 00000000000..064185604a3 --- /dev/null +++ b/queue-3.9/target-close-target_put_sess_cmd-vs.-core_tmr_abort_task-race.patch @@ -0,0 +1,113 @@ +From ccf5ae83a6cf3d9cfe9a7038bfe7cd38ab03d5e1 Mon Sep 17 00:00:00 2001 +From: Joern Engel +Date: Mon, 13 May 2013 16:30:06 -0400 +Subject: target: close target_put_sess_cmd() vs. core_tmr_abort_task() race + +From: Joern Engel + +commit ccf5ae83a6cf3d9cfe9a7038bfe7cd38ab03d5e1 upstream. + +It is possible for one thread to to take se_sess->sess_cmd_lock in +core_tmr_abort_task() before taking a reference count on +se_cmd->cmd_kref, while another thread in target_put_sess_cmd() drops +se_cmd->cmd_kref before taking se_sess->sess_cmd_lock. + +This introduces kref_put_spinlock_irqsave() and uses it in +target_put_sess_cmd() to close the race window. + +Signed-off-by: Joern Engel +Acked-by: Greg Kroah-Hartman +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 11 +++++------ + include/linux/kref.h | 33 +++++++++++++++++++++++++++++++++ + 2 files changed, 38 insertions(+), 6 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2213,21 +2213,19 @@ static void target_release_cmd_kref(stru + { + struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref); + struct se_session *se_sess = se_cmd->se_sess; +- unsigned long flags; + +- spin_lock_irqsave(&se_sess->sess_cmd_lock, flags); + if (list_empty(&se_cmd->se_cmd_list)) { +- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); ++ spin_unlock(&se_sess->sess_cmd_lock); + se_cmd->se_tfo->release_cmd(se_cmd); + return; + } + if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) { +- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); ++ spin_unlock(&se_sess->sess_cmd_lock); + complete(&se_cmd->cmd_wait_comp); + return; + } + list_del(&se_cmd->se_cmd_list); +- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); ++ spin_unlock(&se_sess->sess_cmd_lock); + + se_cmd->se_tfo->release_cmd(se_cmd); + } +@@ -2238,7 +2236,8 @@ static void target_release_cmd_kref(stru + */ + int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd) + { +- return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref); ++ return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref, ++ &se_sess->sess_cmd_lock); + } + EXPORT_SYMBOL(target_put_sess_cmd); + +--- a/include/linux/kref.h ++++ b/include/linux/kref.h +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + struct kref { + atomic_t refcount; +@@ -95,6 +96,38 @@ static inline int kref_put(struct kref * + return kref_sub(kref, 1, release); + } + ++/** ++ * kref_put_spinlock_irqsave - decrement refcount for object. ++ * @kref: object. ++ * @release: pointer to the function that will clean up the object when the ++ * last reference to the object is released. ++ * This pointer is required, and it is not acceptable to pass kfree ++ * in as this function. ++ * @lock: lock to take in release case ++ * ++ * Behaves identical to kref_put with one exception. If the reference count ++ * drops to zero, the lock will be taken atomically wrt dropping the reference ++ * count. The release function has to call spin_unlock() without _irqrestore. ++ */ ++static inline int kref_put_spinlock_irqsave(struct kref *kref, ++ void (*release)(struct kref *kref), ++ spinlock_t *lock) ++{ ++ unsigned long flags; ++ ++ WARN_ON(release == NULL); ++ if (atomic_add_unless(&kref->refcount, -1, 1)) ++ return 0; ++ spin_lock_irqsave(lock, flags); ++ if (atomic_dec_and_test(&kref->refcount)) { ++ release(kref); ++ local_irq_restore(flags); ++ return 1; ++ } ++ spin_unlock_irqrestore(lock, flags); ++ return 0; ++} ++ + static inline int kref_put_mutex(struct kref *kref, + void (*release)(struct kref *kref), + struct mutex *lock) diff --git a/queue-3.9/target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch b/queue-3.9/target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch new file mode 100644 index 00000000000..b83def7883a --- /dev/null +++ b/queue-3.9/target-iblock-fix-wce-1-dpofua-1-backend-write-regression.patch @@ -0,0 +1,47 @@ +From d2bdbee0d91a5d3ba2e439ce889e20bfe6fd4f1b Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 14 May 2013 23:41:04 -0700 +Subject: target/iblock: Fix WCE=1 + DPOFUA=1 backend WRITE regression + +From: Nicholas Bellinger + +commit d2bdbee0d91a5d3ba2e439ce889e20bfe6fd4f1b upstream. + +This patch fixes a regression bug introduced in v3.9-rc1 where if the +underlying struct block_device for a IBLOCK backend is configured with +WCE=1 + DPOFUA=1 settings, the rw = WRITE assignment no longer occurs +in iblock_execute_rw(), and rw = 0 is passed to iblock_submit_bios() +in effect causing a READ bio operation to occur. + +The offending commit is: + +commit d0c8b259f8970d39354c1966853363345d401330 +Author: Nicholas Bellinger +Date: Tue Jan 29 22:10:06 2013 -0800 + + target/iblock: Use backend REQ_FLUSH hint for WriteCacheEnabled status + +Note the WCE=1 + DPOFUA=0, WCE=0 + DPOFUA=1, and WCE=0 + DPOFUA=0 cases +are not affected by this regression bug. + +Reported-by: Chris Boot +Tested-by: Chris Boot +Reported-by: Hannes Reinecke +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_iblock.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/target/target_core_iblock.c ++++ b/drivers/target/target_core_iblock.c +@@ -679,6 +679,8 @@ iblock_execute_rw(struct se_cmd *cmd) + rw = WRITE_FUA; + else if (!(q->flush_flags & REQ_FLUSH)) + rw = WRITE_FUA; ++ else ++ rw = WRITE; + } else { + rw = WRITE; + } diff --git a/queue-3.9/usermodehelper-check-subprocess_info-path-null.patch b/queue-3.9/usermodehelper-check-subprocess_info-path-null.patch new file mode 100644 index 00000000000..6ae06d24d48 --- /dev/null +++ b/queue-3.9/usermodehelper-check-subprocess_info-path-null.patch @@ -0,0 +1,45 @@ +From 264b83c07a84223f0efd0d1db9ccc66d6f88288f Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 16 May 2013 17:43:55 +0200 +Subject: usermodehelper: check subprocess_info->path != NULL + +From: Oleg Nesterov + +commit 264b83c07a84223f0efd0d1db9ccc66d6f88288f upstream. + +argv_split(empty_or_all_spaces) happily succeeds, it simply returns +argc == 0 and argv[0] == NULL. Change call_usermodehelper_exec() to +check sub_info->path != NULL to avoid the crash. + +This is the minimal fix, todo: + + - perhaps we should change argv_split() to return NULL or change the + callers. + + - kill or justify ->path[0] check + + - narrow the scope of helper_lock() + +Signed-off-by: Oleg Nesterov +Acked-By: Lucas De Marchi +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/kmod.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/kmod.c ++++ b/kernel/kmod.c +@@ -570,6 +570,11 @@ int call_usermodehelper_exec(struct subp + int retval = 0; + + helper_lock(); ++ if (!sub_info->path) { ++ retval = -EINVAL; ++ goto out; ++ } ++ + if (sub_info->path[0] == '\0') + goto out; +