From dab166f6f65997b8fc08bd31df3f74b408dc3521 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 18 Jan 2013 13:58:26 -0800 Subject: [PATCH] 3.7-stable patches added patches: alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch drm-radeon-fix-a-bogus-kfree.patch drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch s390-time-fix-sched_clock-overflow.patch target-add-link_magic-for-fabric-allow_link-destination.patch usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch --- ...ion-of-m-audio-fast-track-pro-driver.patch | 51 +++++++ queue-3.7/drm-radeon-fix-a-bogus-kfree.patch | 41 ++++++ ...null-pointer-dereference-in-ums-mode.patch | 42 ++++++ ...vec-in-ext4_da_block_invalidatepages.patch | 38 +++++ ...gned-msi-x-interrupts-if-setup-fails.patch | 95 +++++++++++++ ...devices-with-rmrrs-from-being-placed.patch | 68 +++++++++ .../s390-time-fix-sched_clock-overflow.patch | 89 ++++++++++++ queue-3.7/series | 10 ++ ...ic-for-fabric-allow_link-destination.patch | 108 ++++++++++++++ ...bling-streaming-not-only-in-udc-mode.patch | 56 ++++++++ ...-when-integrated-graphics-is-present.patch | 132 ++++++++++++++++++ 11 files changed, 730 insertions(+) create mode 100644 queue-3.7/alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch create mode 100644 queue-3.7/drm-radeon-fix-a-bogus-kfree.patch create mode 100644 queue-3.7/drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch create mode 100644 queue-3.7/ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch create mode 100644 queue-3.7/igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch create mode 100644 queue-3.7/intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch create mode 100644 queue-3.7/s390-time-fix-sched_clock-overflow.patch create mode 100644 queue-3.7/target-add-link_magic-for-fabric-allow_link-destination.patch create mode 100644 queue-3.7/usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch create mode 100644 queue-3.7/x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch diff --git a/queue-3.7/alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch b/queue-3.7/alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch new file mode 100644 index 00000000000..a50e99e670b --- /dev/null +++ b/queue-3.7/alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch @@ -0,0 +1,51 @@ +From b98ae2729dea161edc96c9d177459b6c28bcbba5 Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Fri, 4 Jan 2013 17:02:18 +0100 +Subject: ALSA: usb - fix race in creation of M-Audio Fast track pro driver + +From: David Henningsson + +commit b98ae2729dea161edc96c9d177459b6c28bcbba5 upstream. + +A patch in the 3.2 kernel caused regression with hotplugging the +M-Audio Fast track pro, or sound after suspend. I don't have the +device so I haven't done a full analysis, but it seems userspace +(both udev and pulseaudio) got confused when a card was created, +immediately destroyed, and then created again. + +However, at least one person in the bug report (martin djfun) +reports that this patch resolves the issue for him. It also leaves +a message in the log: +"snd-usb-audio: probe of 1-1.1:1.1 failed with error -5" which is +a bit misleading. It is better than non-working audio, but maybe +there's a more elegant solution? + +BugLink: https://bugs.launchpad.net/bugs/1095315 +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -387,11 +387,13 @@ static int snd_usb_fasttrackpro_boot_qui + * rules + */ + err = usb_driver_set_configuration(dev, 2); +- if (err < 0) { ++ if (err < 0) + snd_printdd("error usb_driver_set_configuration: %d\n", + err); +- return -ENODEV; +- } ++ /* Always return an error, so that we stop creating a device ++ that will just be destroyed and recreated with a new ++ configuration */ ++ return -ENODEV; + } else + snd_printk(KERN_INFO "usb-audio: Fast Track Pro config OK\n"); + diff --git a/queue-3.7/drm-radeon-fix-a-bogus-kfree.patch b/queue-3.7/drm-radeon-fix-a-bogus-kfree.patch new file mode 100644 index 00000000000..07273917f78 --- /dev/null +++ b/queue-3.7/drm-radeon-fix-a-bogus-kfree.patch @@ -0,0 +1,41 @@ +From a6b7e1a02b77ab8fe8775d20a88c53d8ba55482e Mon Sep 17 00:00:00 2001 +From: Ilija Hadzic +Date: Mon, 7 Jan 2013 18:21:58 -0500 +Subject: drm/radeon: fix a bogus kfree + +From: Ilija Hadzic + +commit a6b7e1a02b77ab8fe8775d20a88c53d8ba55482e upstream. + +parser->chunks[.].kpage[.] is not always kmalloc-ed +by the parser initialization, so parser_fini should +not try to kfree it if it didn't allocate it. + +This patch fixes a kernel oops that can be provoked +in UMS mode. + +Signed-off-by: Ilija Hadzic +Signed-off-by: Alex Deucher +Signed-off-by: Shuah Khan +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r600_cs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -2429,8 +2429,10 @@ static void r600_cs_parser_fini(struct r + kfree(parser->relocs); + for (i = 0; i < parser->nchunks; i++) { + kfree(parser->chunks[i].kdata); +- kfree(parser->chunks[i].kpage[0]); +- kfree(parser->chunks[i].kpage[1]); ++ if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) { ++ kfree(parser->chunks[i].kpage[0]); ++ kfree(parser->chunks[i].kpage[1]); ++ } + } + kfree(parser->chunks); + kfree(parser->chunks_array); diff --git a/queue-3.7/drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch b/queue-3.7/drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch new file mode 100644 index 00000000000..56701c678c6 --- /dev/null +++ b/queue-3.7/drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch @@ -0,0 +1,42 @@ +From ff4bd0827764e10a428a9d39e6814c5478863f94 Mon Sep 17 00:00:00 2001 +From: Ilija Hadzic +Date: Mon, 7 Jan 2013 18:21:57 -0500 +Subject: drm/radeon: fix NULL pointer dereference in UMS mode + +From: Ilija Hadzic + +commit ff4bd0827764e10a428a9d39e6814c5478863f94 upstream. + +In UMS mode parser->rdev is NULL, so dereferencing +will cause an oops. + +Signed-off-by: Ilija Hadzic +Signed-off-by: Alex Deucher +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_cs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -266,7 +266,7 @@ int radeon_cs_parser_init(struct radeon_ + p->chunks[p->chunk_ib_idx].length_dw); + return -EINVAL; + } +- if ((p->rdev->flags & RADEON_IS_AGP)) { ++ if (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) { + p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL); + p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL || +@@ -570,7 +570,8 @@ static int radeon_cs_update_pages(struct + struct radeon_cs_chunk *ibc = &p->chunks[p->chunk_ib_idx]; + int i; + int size = PAGE_SIZE; +- bool copy1 = (p->rdev->flags & RADEON_IS_AGP) ? false : true; ++ bool copy1 = (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) ? ++ false : true; + + for (i = ibc->last_copied_page + 1; i < pg_idx; i++) { + if (DRM_COPY_FROM_USER(p->ib.ptr + (i * (PAGE_SIZE/4)), diff --git a/queue-3.7/ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch b/queue-3.7/ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch new file mode 100644 index 00000000000..eccb2780219 --- /dev/null +++ b/queue-3.7/ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch @@ -0,0 +1,38 @@ +From 66bea92c69477a75a5d37b9bfed5773c92a3c4b4 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Wed, 14 Nov 2012 22:22:05 -0500 +Subject: ext4: init pagevec in ext4_da_block_invalidatepages + +From: Eric Sandeen + +commit 66bea92c69477a75a5d37b9bfed5773c92a3c4b4 upstream. + +ext4_da_block_invalidatepages is missing a pagevec_init(), +which means that pvec->cold contains random garbage. + +This affects whether the page goes to the front or +back of the LRU when ->cold makes it to +free_hot_cold_page() + +Reviewed-by: Lukas Czerner +Reviewed-by: Carlos Maiolino +Signed-off-by: Eric Sandeen +Signed-off-by: "Theodore Ts'o" +Signed-off-by: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1503,6 +1503,8 @@ static void ext4_da_block_invalidatepage + + index = mpd->first_page; + end = mpd->next_page - 1; ++ ++ pagevec_init(&pvec, 0); + while (index <= end) { + nr_pages = pagevec_lookup(&pvec, mapping, index, PAGEVEC_SIZE); + if (nr_pages == 0) diff --git a/queue-3.7/igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch b/queue-3.7/igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch new file mode 100644 index 00000000000..4b571a39689 --- /dev/null +++ b/queue-3.7/igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch @@ -0,0 +1,95 @@ +From 52285b762b3681669215bf1d17ca6143448ab7d3 Mon Sep 17 00:00:00 2001 +From: Stefan Assmann +Date: Tue, 4 Dec 2012 06:00:17 +0000 +Subject: igb: release already assigned MSI-X interrupts if setup fails + +From: Stefan Assmann + +commit 52285b762b3681669215bf1d17ca6143448ab7d3 upstream. + +During MSI-X setup the system might run out of vectors. If this happens the +already assigned vectors for this NIC should be freed before trying the +disable MSI-X. Failing to do so results in the following oops. + +kernel BUG at drivers/pci/msi.c:341! +[...] +Call Trace: + [] pci_disable_msix+0x3d/0x60 + [] igb_reset_interrupt_capability+0x27/0x5c [igb] + [] igb_clear_interrupt_scheme+0x26/0x2d [igb] + [] igb_request_irq+0x73/0x297 [igb] + [] __igb_open+0xc8/0x223 [igb] + [] igb_open+0x13/0x15 [igb] + [] __dev_open+0xbf/0x120 + [] __dev_change_flags+0xa1/0x180 + [] dev_change_flags+0x28/0x70 + [] devinet_ioctl+0x5b7/0x620 + [] inet_ioctl+0x88/0xa0 + [] sock_do_ioctl+0x30/0x70 + [] sock_ioctl+0x72/0x270 + [] do_vfs_ioctl+0x8c/0x340 + [] sys_ioctl+0xa1/0xb0 + [] system_call_fastpath+0x16/0x1b +Code: 48 89 df e8 1f 40 ed ff 4d 39 e6 49 8b 45 10 75 b6 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f c9 c3 48 8b 7b 20 e8 3e 91 db ff eb ae <0f> 0b eb fe 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00 +RIP [] free_msi_irqs+0x124/0x130 + RSP + +Signed-off-by: Stefan Assmann +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Abdallah Chatila + +--- + drivers/net/ethernet/intel/igb/igb_main.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -909,17 +909,18 @@ static int igb_request_msix(struct igb_a + { + struct net_device *netdev = adapter->netdev; + struct e1000_hw *hw = &adapter->hw; +- int i, err = 0, vector = 0; ++ int i, err = 0, vector = 0, free_vector = 0; + + err = request_irq(adapter->msix_entries[vector].vector, + igb_msix_other, 0, netdev->name, adapter); + if (err) +- goto out; +- vector++; ++ goto err_out; + + for (i = 0; i < adapter->num_q_vectors; i++) { + struct igb_q_vector *q_vector = adapter->q_vector[i]; + ++ vector++; ++ + q_vector->itr_register = hw->hw_addr + E1000_EITR(vector); + + if (q_vector->rx.ring && q_vector->tx.ring) +@@ -938,13 +939,22 @@ static int igb_request_msix(struct igb_a + igb_msix_ring, 0, q_vector->name, + q_vector); + if (err) +- goto out; +- vector++; ++ goto err_free; + } + + igb_configure_msix(adapter); + return 0; +-out: ++ ++err_free: ++ /* free already assigned IRQs */ ++ free_irq(adapter->msix_entries[free_vector++].vector, adapter); ++ ++ vector--; ++ for (i = 0; i < vector; i++) { ++ free_irq(adapter->msix_entries[free_vector++].vector, ++ adapter->q_vector[i]); ++ } ++err_out: + return err; + } + diff --git a/queue-3.7/intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch b/queue-3.7/intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch new file mode 100644 index 00000000000..091ea3ce026 --- /dev/null +++ b/queue-3.7/intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch @@ -0,0 +1,68 @@ +From ea2447f700cab264019b52e2b417d689e052dcfd Mon Sep 17 00:00:00 2001 +From: Tom Mingarelli +Date: Tue, 20 Nov 2012 19:43:17 +0000 +Subject: intel-iommu: Prevent devices with RMRRs from being placed + into SI Domain + +From: Tom Mingarelli + +commit ea2447f700cab264019b52e2b417d689e052dcfd upstream. + +This patch is to prevent non-USB devices that have RMRRs associated with them from +being placed into the SI Domain during init. This fixes the issue where the RMRR info +for devices being placed in and out of the SI Domain gets lost. + +Signed-off-by: Thomas Mingarelli +Tested-by: Shuah Khan +Reviewed-by: Donald Dutile +Reviewed-by: Alex Williamson +Signed-off-by: Joerg Roedel +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2327,8 +2327,39 @@ static int domain_add_dev_info(struct dm + return 0; + } + ++static bool device_has_rmrr(struct pci_dev *dev) ++{ ++ struct dmar_rmrr_unit *rmrr; ++ int i; ++ ++ for_each_rmrr_units(rmrr) { ++ for (i = 0; i < rmrr->devices_cnt; i++) { ++ /* ++ * Return TRUE if this RMRR contains the device that ++ * is passed in. ++ */ ++ if (rmrr->devices[i] == dev) ++ return true; ++ } ++ } ++ return false; ++} ++ + static int iommu_should_identity_map(struct pci_dev *pdev, int startup) + { ++ ++ /* ++ * We want to prevent any device associated with an RMRR from ++ * getting placed into the SI Domain. This is done because ++ * problems exist when devices are moved in and out of domains ++ * and their respective RMRR info is lost. We exempt USB devices ++ * from this process due to their usage of RMRRs that are known ++ * to not be needed after BIOS hand-off to OS. ++ */ ++ if (device_has_rmrr(pdev) && ++ (pdev->class >> 8) != PCI_CLASS_SERIAL_USB) ++ return 0; ++ + if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev)) + return 1; + diff --git a/queue-3.7/s390-time-fix-sched_clock-overflow.patch b/queue-3.7/s390-time-fix-sched_clock-overflow.patch new file mode 100644 index 00000000000..d10d5d67bd1 --- /dev/null +++ b/queue-3.7/s390-time-fix-sched_clock-overflow.patch @@ -0,0 +1,89 @@ +From ed4f20943cd4c7b55105c04daedf8d63ab6d499c Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 14 Jan 2013 16:55:55 +0100 +Subject: s390/time: fix sched_clock() overflow + +From: Heiko Carstens + +commit ed4f20943cd4c7b55105c04daedf8d63ab6d499c upstream. + +Converting a 64 Bit TOD format value to nanoseconds means that the value +must be divided by 4.096. In order to achieve that we multiply with 125 +and divide by 512. +When used within sched_clock() this triggers an overflow after appr. +417 days. Resulting in a sched_clock() return value that is much smaller +than previously and therefore may cause all sort of weird things in +subsystems that rely on a monotonic sched_clock() behaviour. + +To fix this implement a tod_to_ns() helper function which converts TOD +values without overflow and call this function from both places that +open coded the conversion: sched_clock() and kvm_s390_handle_wait(). + +Reviewed-by: Martin Schwidefsky +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/timex.h | 28 ++++++++++++++++++++++++++++ + arch/s390/kernel/time.c | 2 +- + arch/s390/kvm/interrupt.c | 2 +- + 3 files changed, 30 insertions(+), 2 deletions(-) + +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -128,4 +128,32 @@ static inline unsigned long long get_clo + return get_clock_xt() - sched_clock_base_cc; + } + ++/** ++ * tod_to_ns - convert a TOD format value to nanoseconds ++ * @todval: to be converted TOD format value ++ * Returns: number of nanoseconds that correspond to the TOD format value ++ * ++ * Converting a 64 Bit TOD format value to nanoseconds means that the value ++ * must be divided by 4.096. In order to achieve that we multiply with 125 ++ * and divide by 512: ++ * ++ * ns = (todval * 125) >> 9; ++ * ++ * In order to avoid an overflow with the multiplication we can rewrite this. ++ * With a split todval == 2^32 * th + tl (th upper 32 bits, tl lower 32 bits) ++ * we end up with ++ * ++ * ns = ((2^32 * th + tl) * 125 ) >> 9; ++ * -> ns = (2^23 * th * 125) + ((tl * 125) >> 9); ++ * ++ */ ++static inline unsigned long long tod_to_ns(unsigned long long todval) ++{ ++ unsigned long long ns; ++ ++ ns = ((todval >> 32) << 23) * 125; ++ ns += ((todval & 0xffffffff) * 125) >> 9; ++ return ns; ++} ++ + #endif +--- a/arch/s390/kernel/time.c ++++ b/arch/s390/kernel/time.c +@@ -63,7 +63,7 @@ static DEFINE_PER_CPU(struct clock_event + */ + unsigned long long notrace __kprobes sched_clock(void) + { +- return (get_clock_monotonic() * 125) >> 9; ++ return tod_to_ns(get_clock_monotonic()); + } + + /* +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -408,7 +408,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu + return 0; + } + +- sltime = ((vcpu->arch.sie_block->ckc - now)*125)>>9; ++ sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now); + + hrtimer_start(&vcpu->arch.ckc_timer, ktime_set (0, sltime) , HRTIMER_MODE_REL); + VCPU_EVENT(vcpu, 5, "enabled wait via clock comparator: %llx ns", sltime); diff --git a/queue-3.7/series b/queue-3.7/series index f2d4a5886a1..96847b39984 100644 --- a/queue-3.7/series +++ b/queue-3.7/series @@ -8,3 +8,13 @@ tcm_fc-do-not-report-target-role-when-target-is-not-defined.patch target-fix-missing-cmd_t_active-bit-regression-for-pending-writes.patch target-fix-use-after-free-in-lun-reset-handling.patch target-release-se_cmd-when-lun-lookup-fails-for-tmr.patch +s390-time-fix-sched_clock-overflow.patch +x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch +alsa-usb-fix-race-in-creation-of-m-audio-fast-track-pro-driver.patch +ext4-init-pagevec-in-ext4_da_block_invalidatepages.patch +usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch +drm-radeon-fix-null-pointer-dereference-in-ums-mode.patch +drm-radeon-fix-a-bogus-kfree.patch +target-add-link_magic-for-fabric-allow_link-destination.patch +intel-iommu-prevent-devices-with-rmrrs-from-being-placed.patch +igb-release-already-assigned-msi-x-interrupts-if-setup-fails.patch diff --git a/queue-3.7/target-add-link_magic-for-fabric-allow_link-destination.patch b/queue-3.7/target-add-link_magic-for-fabric-allow_link-destination.patch new file mode 100644 index 00000000000..f15c23f04af --- /dev/null +++ b/queue-3.7/target-add-link_magic-for-fabric-allow_link-destination.patch @@ -0,0 +1,108 @@ +From 0ff8754981261a80f4b77db2536dfea92c2d4539 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 4 Dec 2012 23:43:57 -0800 +Subject: target: Add link_magic for fabric allow_link destination + target_items + +From: Nicholas Bellinger + +commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream. + +This patch adds [dev,lun]_link_magic value assignment + checks within generic +target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure +destination config_item *target_item sent from configfs_symlink() -> +config_item_operations->allow_link() is the underlying se_device->dev_group +and se_lun->lun_group that we expect to symlink. + +Reported-by: Sebastian Andrzej Siewior +Cc: Sebastian Andrzej Siewior +Signed-off-by: Nicholas Bellinger +Signed-off-by: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_device.c | 1 + + drivers/target/target_core_fabric_configfs.c | 12 ++++++++++++ + drivers/target/target_core_tpg.c | 1 + + drivers/target/target_core_transport.c | 1 + + include/target/target_core_base.h | 4 ++++ + 5 files changed, 19 insertions(+) + +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -1624,6 +1624,7 @@ int core_dev_setup_virtual_lun0(void) + ret = PTR_ERR(dev); + goto out; + } ++ dev->dev_link_magic = SE_DEV_LINK_MAGIC; + se_dev->se_dev_ptr = dev; + g_lun0_dev = dev; + +--- a/drivers/target/target_core_fabric_configfs.c ++++ b/drivers/target/target_core_fabric_configfs.c +@@ -71,6 +71,12 @@ static int target_fabric_mappedlun_link( + struct se_portal_group *se_tpg; + struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s; + int ret = 0, lun_access; ++ ++ if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) { ++ pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:" ++ " %p to struct lun: %p\n", lun_ci, lun); ++ return -EFAULT; ++ } + /* + * Ensure that the source port exists + */ +@@ -745,6 +751,12 @@ static int target_fabric_port_link( + struct target_fabric_configfs *tf; + int ret; + ++ if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { ++ pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" ++ " %p to struct se_device: %p\n", se_dev_ci, dev); ++ return -EFAULT; ++ } ++ + tpg_ci = &lun_ci->ci_parent->ci_group->cg_item; + se_tpg = container_of(to_config_group(tpg_ci), + struct se_portal_group, tpg_group); +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -672,6 +672,7 @@ int core_tpg_register( + for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) { + lun = se_tpg->tpg_lun_list[i]; + lun->unpacked_lun = i; ++ lun->lun_link_magic = SE_LUN_LINK_MAGIC; + lun->lun_status = TRANSPORT_LUN_STATUS_FREE; + atomic_set(&lun->lun_acl_count, 0); + init_completion(&lun->lun_shutdown_comp); +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1071,6 +1071,7 @@ struct se_device *transport_add_device_t + dev->se_hba = hba; + dev->se_sub_dev = se_dev; + dev->transport = transport; ++ dev->dev_link_magic = SE_DEV_LINK_MAGIC; + INIT_LIST_HEAD(&dev->dev_list); + INIT_LIST_HEAD(&dev->dev_sep_list); + INIT_LIST_HEAD(&dev->dev_tmr_list); +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -734,6 +734,8 @@ struct se_subsystem_dev { + }; + + struct se_device { ++#define SE_DEV_LINK_MAGIC 0xfeeddeef ++ u32 dev_link_magic; + /* RELATIVE TARGET PORT IDENTIFER Counter */ + u16 dev_rpti_counter; + /* Used for SAM Task Attribute ordering */ +@@ -820,6 +822,8 @@ struct se_port_stat_grps { + }; + + struct se_lun { ++#define SE_LUN_LINK_MAGIC 0xffff7771 ++ u32 lun_link_magic; + /* See transport_lun_status_table */ + enum transport_lun_status_table lun_status; + u32 lun_access; diff --git a/queue-3.7/usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch b/queue-3.7/usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch new file mode 100644 index 00000000000..ab0e652a1e2 --- /dev/null +++ b/queue-3.7/usb-chipidea-allow-disabling-streaming-not-only-in-udc-mode.patch @@ -0,0 +1,56 @@ +From 929473ea05db455ad88cdc081f2adc556b8dc48f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sat, 22 Dec 2012 09:24:11 -0200 +Subject: usb: chipidea: Allow disabling streaming not only in udc mode + +From: Fabio Estevam + +commit 929473ea05db455ad88cdc081f2adc556b8dc48f upstream. + +When running a scp transfer using a USB/Ethernet adapter the following crash +happens: + +$ scp test.tar.gz fabio@192.168.1.100:/home/fabio +fabio@192.168.1.100's password: +test.tar.gz 0% 0 0.0KB/s --:-- ETA +------------[ cut here ]------------ +WARNING: at net/sched/sch_generic.c:255 dev_watchdog+0x2cc/0x2f0() +NETDEV WATCHDOG: eth0 (asix): transmit queue 0 timed out +Modules linked in: +Backtrace: +[<80011c94>] (dump_backtrace+0x0/0x10c) from [<804d3a5c>] (dump_stack+0x18/0x1c) + r6:000000ff r5:80412388 r4:80685dc0 r3:80696cc0 +[<804d3a44>] (dump_stack+0x0/0x1c) from [<80021868>] +(warn_slowpath_common+0x54/0x6c) +[<80021814>] (warn_slowpath_common+0x0/0x6c) from [<80021924>] +(warn_slowpath_fmt+0x38/0x40) +... + +Setting SDIS (Stream Disable Mode- bit 4 of USBMODE register) fixes the problem. + +However, in current code CI13XXX_DISABLE_STREAMING flag is only set in udc mode, +so allow disabling streaming also in host mode. + +Tested on a mx6qsabrelite board. + +Suggested-by: Peter Chen +Signed-off-by: Fabio Estevam +Reviewed-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/host.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -129,6 +129,9 @@ static int host_start(struct ci13xxx *ci + else + ci->hcd = hcd; + ++ if (ci->platdata->flags & CI13XXX_DISABLE_STREAMING) ++ hw_write(ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS); ++ + return ret; + } + diff --git a/queue-3.7/x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch b/queue-3.7/x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch new file mode 100644 index 00000000000..e6675fda623 --- /dev/null +++ b/queue-3.7/x86-sandy-bridge-reserve-pages-when-integrated-graphics-is-present.patch @@ -0,0 +1,132 @@ +From a9acc5365dbda29f7be2884efb63771dc24bd815 Mon Sep 17 00:00:00 2001 +From: Jesse Barnes +Date: Wed, 14 Nov 2012 20:43:31 +0000 +Subject: x86/Sandy Bridge: reserve pages when integrated graphics is present + +From: Jesse Barnes + +commit a9acc5365dbda29f7be2884efb63771dc24bd815 upstream. + +SNB graphics devices have a bug that prevent them from accessing certain +memory ranges, namely anything below 1M and in the pages listed in the +table. So reserve those at boot if set detect a SNB gfx device on the +CPU to avoid GPU hangs. + +Stephane Marchesin had a similar patch to the page allocator awhile +back, but rather than reserving pages up front, it leaked them at +allocation time. + +[ hpa: made a number of stylistic changes, marked arrays as static + const, and made less verbose; use "memblock=debug" for full + verbosity. ] + +Signed-off-by: Jesse Barnes +Signed-off-by: H. Peter Anvin +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 78 insertions(+) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -614,6 +614,81 @@ static __init void reserve_ibft_region(v + + static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10; + ++static bool __init snb_gfx_workaround_needed(void) ++{ ++ int i; ++ u16 vendor, devid; ++ static const u16 snb_ids[] = { ++ 0x0102, ++ 0x0112, ++ 0x0122, ++ 0x0106, ++ 0x0116, ++ 0x0126, ++ 0x010a, ++ }; ++ ++ /* Assume no if something weird is going on with PCI */ ++ if (!early_pci_allowed()) ++ return false; ++ ++ vendor = read_pci_config_16(0, 2, 0, PCI_VENDOR_ID); ++ if (vendor != 0x8086) ++ return false; ++ ++ devid = read_pci_config_16(0, 2, 0, PCI_DEVICE_ID); ++ for (i = 0; i < ARRAY_SIZE(snb_ids); i++) ++ if (devid == snb_ids[i]) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * Sandy Bridge graphics has trouble with certain ranges, exclude ++ * them from allocation. ++ */ ++static void __init trim_snb_memory(void) ++{ ++ static const unsigned long bad_pages[] = { ++ 0x20050000, ++ 0x20110000, ++ 0x20130000, ++ 0x20138000, ++ 0x40004000, ++ }; ++ int i; ++ ++ if (!snb_gfx_workaround_needed()) ++ return; ++ ++ printk(KERN_DEBUG "reserving inaccessible SNB gfx pages\n"); ++ ++ /* ++ * Reserve all memory below the 1 MB mark that has not ++ * already been reserved. ++ */ ++ memblock_reserve(0, 1<<20); ++ ++ for (i = 0; i < ARRAY_SIZE(bad_pages); i++) { ++ if (memblock_reserve(bad_pages[i], PAGE_SIZE)) ++ printk(KERN_WARNING "failed to reserve 0x%08lx\n", ++ bad_pages[i]); ++ } ++} ++ ++/* ++ * Here we put platform-specific memory range workarounds, i.e. ++ * memory known to be corrupt or otherwise in need to be reserved on ++ * specific platforms. ++ * ++ * If this gets used more widely it could use a real dispatch mechanism. ++ */ ++static void __init trim_platform_memory_ranges(void) ++{ ++ trim_snb_memory(); ++} ++ + static void __init trim_bios_range(void) + { + /* +@@ -634,6 +709,7 @@ static void __init trim_bios_range(void) + * take them out. + */ + e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1); ++ + sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map); + } + +@@ -912,6 +988,8 @@ void __init setup_arch(char **cmdline_p) + + setup_real_mode(); + ++ trim_platform_memory_ranges(); ++ + init_gbpages(); + + /* max_pfn_mapped is updated here */ -- 2.47.3