From: Greg Kroah-Hartman Date: Thu, 3 May 2012 20:20:56 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.3.5~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4a9f8dacc12c44a630bf1048a9b3c8513bf2f0a9;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch scsi-libsas-fix-false-positive-device-attached-conditions.patch scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch --- diff --git a/queue-3.0/arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch b/queue-3.0/arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch new file mode 100644 index 00000000000..8557c12629e --- /dev/null +++ b/queue-3.0/arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch @@ -0,0 +1,50 @@ +From 6a1c53124aa161eb624ce7b1e40ade728186d34c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 27 Apr 2012 12:45:07 +0100 +Subject: ARM: 7403/1: tls: remove covert channel via TPIDRURW + +From: Will Deacon + +commit 6a1c53124aa161eb624ce7b1e40ade728186d34c upstream. + +TPIDRURW is a user read/write register forming part of the group of +thread registers in more recent versions of the ARM architecture (~v6+). + +Currently, the kernel does not touch this register, which allows tasks +to communicate covertly by reading and writing to the register without +context-switching affecting its contents. + +This patch clears TPIDRURW when TPIDRURO is updated via the set_tls +macro, which is called directly from __switch_to. Since the current +behaviour makes the register useless to userspace as far as thread +pointers are concerned, simply clearing the register (rather than saving +and restoring it) will not cause any problems to userspace. + +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/tls.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm/include/asm/tls.h ++++ b/arch/arm/include/asm/tls.h +@@ -7,6 +7,8 @@ + + .macro set_tls_v6k, tp, tmp1, tmp2 + mcr p15, 0, \tp, c13, c0, 3 @ set TLS register ++ mov \tmp1, #0 ++ mcr p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register + .endm + + .macro set_tls_v6, tp, tmp1, tmp2 +@@ -15,6 +17,8 @@ + mov \tmp2, #0xffff0fff + tst \tmp1, #HWCAP_TLS @ hardware TLS available? + mcrne p15, 0, \tp, c13, c0, 3 @ yes, set TLS register ++ movne \tmp1, #0 ++ mcrne p15, 0, \tmp1, c13, c0, 2 @ clear user r/w TLS register + streq \tp, [\tmp2, #-15] @ set TLS value at 0xffff0ff0 + .endm + diff --git a/queue-3.0/scsi-libsas-fix-false-positive-device-attached-conditions.patch b/queue-3.0/scsi-libsas-fix-false-positive-device-attached-conditions.patch new file mode 100644 index 00000000000..f245893f735 --- /dev/null +++ b/queue-3.0/scsi-libsas-fix-false-positive-device-attached-conditions.patch @@ -0,0 +1,45 @@ +From 7d1d865181185bdf1316d236b1b4bd02c9020729 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Tue, 20 Mar 2012 10:50:27 -0700 +Subject: SCSI: libsas: fix false positive 'device attached' conditions + +From: Dan Williams + +commit 7d1d865181185bdf1316d236b1b4bd02c9020729 upstream. + +Normalize phy->attached_sas_addr to return a zero-address in the case +when device-type == NO_DEVICE or the linkrate is invalid to handle +expanders that put non-zero sas addresses in the discovery response: + + sas: ex 5001b4da000f903f phy02:U:0 attached: 0100000000000000 (no device) + sas: ex 5001b4da000f903f phy01:U:0 attached: 0100000000000000 (no device) + sas: ex 5001b4da000f903f phy03:U:0 attached: 0100000000000000 (no device) + sas: ex 5001b4da000f903f phy00:U:0 attached: 0100000000000000 (no device) + +Reported-by: Andrzej Jakowski +Signed-off-by: Dan Williams +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libsas/sas_expander.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -192,7 +192,14 @@ static void sas_set_ex_phy(struct domain + phy->attached_sata_ps = dr->attached_sata_ps; + phy->attached_iproto = dr->iproto << 1; + phy->attached_tproto = dr->tproto << 1; +- memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); ++ /* help some expanders that fail to zero sas_address in the 'no ++ * device' case ++ */ ++ if (phy->attached_dev_type == NO_DEVICE || ++ phy->linkrate < SAS_LINK_RATE_1_5_GBPS) ++ memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE); ++ else ++ memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE); + phy->attached_phy_id = dr->attached_phy_id; + phy->phy_change_count = dr->change_count; + phy->routing_attr = dr->routing_attr; diff --git a/queue-3.0/scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch b/queue-3.0/scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch new file mode 100644 index 00000000000..2eb167036db --- /dev/null +++ b/queue-3.0/scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch @@ -0,0 +1,56 @@ +From 1699490db339e2c6b3037ea8e7dcd6b2755b688e Mon Sep 17 00:00:00 2001 +From: Thomas Jackson +Date: Fri, 17 Feb 2012 18:33:10 -0800 +Subject: SCSI: libsas: fix sas_find_bcast_phy() in the presence of 'vacant' phys + +From: Thomas Jackson + +commit 1699490db339e2c6b3037ea8e7dcd6b2755b688e upstream. + +If an expander reports 'PHY VACANT' for a phy index prior to the one +that generated a BCN libsas fails rediscovery. Since a vacant phy is +defined as a valid phy index that will never have an attached device +just continue the search. + +Signed-off-by: Thomas Jackson +Signed-off-by: Dan Williams +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libsas/sas_expander.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -1632,9 +1632,17 @@ static int sas_find_bcast_phy(struct dom + int phy_change_count = 0; + + res = sas_get_phy_change_count(dev, i, &phy_change_count); +- if (res) +- goto out; +- else if (phy_change_count != ex->ex_phy[i].phy_change_count) { ++ switch (res) { ++ case SMP_RESP_PHY_VACANT: ++ case SMP_RESP_NO_PHY: ++ continue; ++ case SMP_RESP_FUNC_ACC: ++ break; ++ default: ++ return res; ++ } ++ ++ if (phy_change_count != ex->ex_phy[i].phy_change_count) { + if (update) + ex->ex_phy[i].phy_change_count = + phy_change_count; +@@ -1642,8 +1650,7 @@ static int sas_find_bcast_phy(struct dom + return 0; + } + } +-out: +- return res; ++ return 0; + } + + static int sas_get_ex_change_count(struct domain_device *dev, int *ecc) diff --git a/queue-3.0/series b/queue-3.0/series index 17c12e4d86d..f74721f7717 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -27,3 +27,6 @@ usb-gadget-storage-gadgets-send-wrong-error-code-for-unknown-commands.patch usb-gadget-uvc-uvc_request_data-length-field-must-be-signed.patch pipes-add-a-packetized-pipe-mode-for-writing.patch autofs-make-the-autofsv5-packet-file-descriptor-use-a-packetized-pipe.patch +arm-7403-1-tls-remove-covert-channel-via-tpidrurw.patch +scsi-libsas-fix-sas_find_bcast_phy-in-the-presence-of-vacant-phys.patch +scsi-libsas-fix-false-positive-device-attached-conditions.patch