From: Greg Kroah-Hartman Date: Thu, 9 Feb 2012 16:22:44 +0000 (-0800) Subject: 3.0-stable patches X-Git-Tag: v3.0.21~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=34ace8322219b3b61352646ec21b72e7262e894e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: asoc-wm8962-fix-word-length-configuration.patch asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch mm-fix-up-thp-spin_is_locked-bugs.patch pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch target-allow-persistent-reserve-in-for-non-reservation-holder.patch target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch target-use-correct-preempted-registration-sense-code.patch --- diff --git a/queue-3.0/asoc-wm8962-fix-word-length-configuration.patch b/queue-3.0/asoc-wm8962-fix-word-length-configuration.patch new file mode 100644 index 00000000000..a865fb84e6c --- /dev/null +++ b/queue-3.0/asoc-wm8962-fix-word-length-configuration.patch @@ -0,0 +1,36 @@ +From 2b6712b19531e22455e7fa18371c5ba9eec76699 Mon Sep 17 00:00:00 2001 +From: Susan Gao +Date: Mon, 30 Jan 2012 13:57:04 -0800 +Subject: ASoC: wm8962: Fix word length configuration + +From: Susan Gao + +commit 2b6712b19531e22455e7fa18371c5ba9eec76699 upstream. + +Signed-off-by: Susan Gao +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8962.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2975,13 +2975,13 @@ static int wm8962_hw_params(struct snd_p + case SNDRV_PCM_FORMAT_S16_LE: + break; + case SNDRV_PCM_FORMAT_S20_3LE: +- aif0 |= 0x40; ++ aif0 |= 0x4; + break; + case SNDRV_PCM_FORMAT_S24_LE: +- aif0 |= 0x80; ++ aif0 |= 0x8; + break; + case SNDRV_PCM_FORMAT_S32_LE: +- aif0 |= 0xc0; ++ aif0 |= 0xc; + break; + default: + return -EINVAL; diff --git a/queue-3.0/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch b/queue-3.0/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch new file mode 100644 index 00000000000..aaf6240913b --- /dev/null +++ b/queue-3.0/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch @@ -0,0 +1,32 @@ +From 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 1 Feb 2012 23:46:58 +0000 +Subject: ASoC: wm_hubs: Correct line input to line output 2 paths + +From: Mark Brown + +commit 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e upstream. + +The second line output mixer has the controls for the line input bypasses +in the opposite order. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_hubs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -562,8 +562,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM + }; + + static const struct snd_kcontrol_new line2_mix[] = { +-SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0), +-SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0), ++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 2, 1, 0), ++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 1, 1, 0), + SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0), + }; + diff --git a/queue-3.0/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch b/queue-3.0/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch new file mode 100644 index 00000000000..f842c75c6d7 --- /dev/null +++ b/queue-3.0/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch @@ -0,0 +1,44 @@ +From ee76744c51ec342df9822b4a85dbbfc3887b6d60 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Tue, 31 Jan 2012 11:55:32 +0000 +Subject: ASoC: wm_hubs: Fix routing of input PGAs to line output + mixer + +From: Mark Brown + +commit ee76744c51ec342df9822b4a85dbbfc3887b6d60 upstream. + +IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1 +and IN2 to LINEOUT2. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_hubs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -562,8 +562,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM + }; + + static const struct snd_kcontrol_new line2_mix[] = { +-SOC_DAPM_SINGLE("IN2R Switch", WM8993_LINE_MIXER2, 2, 1, 0), +-SOC_DAPM_SINGLE("IN2L Switch", WM8993_LINE_MIXER2, 1, 1, 0), ++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0), ++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0), + SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0), + }; + +@@ -808,8 +808,8 @@ static const struct snd_soc_dapm_route l + }; + + static const struct snd_soc_dapm_route lineout2_diff_routes[] = { +- { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" }, +- { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" }, ++ { "LINEOUT2 Mixer", "IN1L Switch", "IN1L PGA" }, ++ { "LINEOUT2 Mixer", "IN1R Switch", "IN1R PGA" }, + { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" }, diff --git a/queue-3.0/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch b/queue-3.0/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch new file mode 100644 index 00000000000..0f5c3874cb2 --- /dev/null +++ b/queue-3.0/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch @@ -0,0 +1,108 @@ +From dc9086004b3d5db75997a645b3fe08d9138b7ad0 Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Wed, 8 Feb 2012 17:13:38 -0800 +Subject: mm: compaction: check for overlapping nodes during isolation for migration + +From: Mel Gorman + +commit dc9086004b3d5db75997a645b3fe08d9138b7ad0 upstream. + +When isolating pages for migration, migration starts at the start of a +zone while the free scanner starts at the end of the zone. Migration +avoids entering a new zone by never going beyond the free scanned. + +Unfortunately, in very rare cases nodes can overlap. When this happens, +migration isolates pages without the LRU lock held, corrupting lists +which will trigger errors in reclaim or during page free such as in the +following oops + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 + IP: [] free_pcppages_bulk+0xcc/0x450 + PGD 1dda554067 PUD 1e1cb58067 PMD 0 + Oops: 0000 [#1] SMP + CPU 37 + Pid: 17088, comm: memcg_process_s Tainted: G X + RIP: free_pcppages_bulk+0xcc/0x450 + Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0) + Call Trace: + free_hot_cold_page+0x17e/0x1f0 + __pagevec_free+0x90/0xb0 + release_pages+0x22a/0x260 + pagevec_lru_move_fn+0xf3/0x110 + putback_lru_page+0x66/0xe0 + unmap_and_move+0x156/0x180 + migrate_pages+0x9e/0x1b0 + compact_zone+0x1f3/0x2f0 + compact_zone_order+0xa2/0xe0 + try_to_compact_pages+0xdf/0x110 + __alloc_pages_direct_compact+0xee/0x1c0 + __alloc_pages_slowpath+0x370/0x830 + __alloc_pages_nodemask+0x1b1/0x1c0 + alloc_pages_vma+0x9b/0x160 + do_huge_pmd_anonymous_page+0x160/0x270 + do_page_fault+0x207/0x4c0 + page_fault+0x25/0x30 + +The "X" in the taint flag means that external modules were loaded but but +is unrelated to the bug triggering. The real problem was because the PFN +layout looks like this + + Zone PFN ranges: + DMA 0x00000010 -> 0x00001000 + DMA32 0x00001000 -> 0x00100000 + Normal 0x00100000 -> 0x01e80000 + Movable zone start PFN for each node + early_node_map[14] active PFN ranges + 0: 0x00000010 -> 0x0000009b + 0: 0x00000100 -> 0x0007a1ec + 0: 0x0007a354 -> 0x0007a379 + 0: 0x0007f7ff -> 0x0007f800 + 0: 0x00100000 -> 0x00680000 + 1: 0x00680000 -> 0x00e80000 + 0: 0x00e80000 -> 0x01080000 + 1: 0x01080000 -> 0x01280000 + 0: 0x01280000 -> 0x01480000 + 1: 0x01480000 -> 0x01680000 + 0: 0x01680000 -> 0x01880000 + 1: 0x01880000 -> 0x01a80000 + 0: 0x01a80000 -> 0x01c80000 + 1: 0x01c80000 -> 0x01e80000 + +The fix is straight-forward. isolate_migratepages() has to make a +similar check to isolate_freepage to ensure that it never isolates pages +from a zone it does not hold the LRU lock for. + +This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x +and current mainline. + +Signed-off-by: Mel Gorman +Acked-by: Michal Nazarewicz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/compaction.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -337,8 +337,17 @@ static isolate_migrate_t isolate_migrate + continue; + nr_scanned++; + +- /* Get the page and skip if free */ ++ /* ++ * Get the page and ensure the page is within the same zone. ++ * See the comment in isolate_freepages about overlapping ++ * nodes. It is deliberate that the new zone lock is not taken ++ * as memory compaction should not move pages between nodes. ++ */ + page = pfn_to_page(low_pfn); ++ if (page_zone(page) != zone) ++ continue; ++ ++ /* Skip if free */ + if (PageBuddy(page)) + continue; + diff --git a/queue-3.0/mm-fix-up-thp-spin_is_locked-bugs.patch b/queue-3.0/mm-fix-up-thp-spin_is_locked-bugs.patch new file mode 100644 index 00000000000..276fb052b51 --- /dev/null +++ b/queue-3.0/mm-fix-up-thp-spin_is_locked-bugs.patch @@ -0,0 +1,59 @@ +From b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Wed, 8 Feb 2012 17:13:40 -0800 +Subject: mm: fix UP THP spin_is_locked BUGs + +From: Hugh Dickins + +commit b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 upstream. + +Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y +CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false, +and so triggers some BUGs in Transparent HugePage codepaths. + +asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x); +but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE, +VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs. + +Signed-off-by: Hugh Dickins +Cc: Andrea Arcangeli +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 4 ++-- + mm/swap.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2020,7 +2020,7 @@ static void collect_mm_slot(struct mm_sl + { + struct mm_struct *mm = mm_slot->mm; + +- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock)); + + if (khugepaged_test_exit(mm)) { + /* free mm_slot */ +@@ -2048,7 +2048,7 @@ static unsigned int khugepaged_scan_mm_s + int progress = 0; + + VM_BUG_ON(!pages); +- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock)); + + if (khugepaged_scan.mm_slot) + mm_slot = khugepaged_scan.mm_slot; +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -667,7 +667,7 @@ void lru_add_page_tail(struct zone* zone + VM_BUG_ON(!PageHead(page)); + VM_BUG_ON(PageCompound(page_tail)); + VM_BUG_ON(PageLRU(page_tail)); +- VM_BUG_ON(!spin_is_locked(&zone->lru_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&zone->lru_lock)); + + SetPageLRU(page_tail); + diff --git a/queue-3.0/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch b/queue-3.0/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch new file mode 100644 index 00000000000..963d9ea6c83 --- /dev/null +++ b/queue-3.0/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch @@ -0,0 +1,176 @@ +From 025e4ab3db07fcbf62c01e4f30d1012234beb980 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 8 Feb 2012 17:13:41 -0800 +Subject: pcmcia: fix socket refcount decrementing on each resume + +From: Russell King + +commit 025e4ab3db07fcbf62c01e4f30d1012234beb980 upstream. + +This fixes a memory-corrupting bug: not only does it cause the warning, +but as a result of dropping the refcount to zero, it causes the +pcmcia_socket0 device structure to be freed while it still has +references, causing slab caches corruption. A fatal oops quickly +follows this warning - often even just a 'dmesg' following the warning +causes the kernel to oops. + +While testing suspend/resume on an ARM device with PCMCIA support, and a +CF card inserted, I found that after five suspend and resumes, the +kernel would complain, and shortly die after with slab corruption. + + WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50() + +As the message doesn't give a clue about which kobject, and the built-in +debugging in drivers/base/power/main.c happens too late, this was added +right before each get_device(): + + printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount)); + +and on the 3rd s2ram cycle, the following behaviour observed: + +On the 3rd suspend/resume cycle: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 3 + dpm_suspend: c1a0d998 [pcmcia_socket0] 3 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3 + dpm_resume: c1a0d998 [pcmcia_socket0] 3 + dpm_complete: c1a0d998 [pcmcia_socket0] 2 + +4th: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 2 + dpm_suspend: c1a0d998 [pcmcia_socket0] 2 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2 + dpm_resume: c1a0d998 [pcmcia_socket0] 2 + dpm_complete: c1a0d998 [pcmcia_socket0] 1 + +5th: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 1 + dpm_suspend: c1a0d998 [pcmcia_socket0] 1 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1 + dpm_resume: c1a0d998 [pcmcia_socket0] 1 + dpm_complete: c1a0d998 [pcmcia_socket0] 0 + ------------[ cut here ]------------ + WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50() + Modules linked in: ucb1x00_core + Backtrace: + [] (dump_backtrace+0x0/0x110) from [] (dump_stack+0x18/0x1c) + [] (dump_stack+0x0/0x1c) from [] (warn_slowpath_common+0x50/0x68) + [] (warn_slowpath_common+0x0/0x68) from [] (warn_slowpath_null+0x24/0x28) + [] (warn_slowpath_null+0x0/0x28) from [] (kobject_get+0x28/0x50) + [] (kobject_get+0x0/0x50) from [] (get_device+0x1c/0x24) + [] (dpm_complete+0x0/0x1a0) from [] (dpm_resume_end+0x1c/0x20) + ... + +Looking at commit 7b24e7988263 ("pcmcia: split up central event handler"), +the following change was made to cs.c: + + return 0; + } + #endif +- +- send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW); ++ if (!(skt->state & SOCKET_CARDBUS) && (skt->callback)) ++ skt->callback->early_resume(skt); + return 0; + } + +And the corresponding change in ds.c is from: + +-static int ds_event(struct pcmcia_socket *skt, event_t event, int priority) +-{ +- struct pcmcia_socket *s = pcmcia_get_socket(skt); +... +- switch (event) { +... +- case CS_EVENT_PM_RESUME: +- if (verify_cis_cache(skt) != 0) { +- dev_dbg(&skt->dev, "cis mismatch - different card\n"); +- /* first, remove the card */ +- ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH); +- mutex_lock(&s->ops_mutex); +- destroy_cis_cache(skt); +- kfree(skt->fake_cis); +- skt->fake_cis = NULL; +- s->functions = 0; +- mutex_unlock(&s->ops_mutex); +- /* now, add the new card */ +- ds_event(skt, CS_EVENT_CARD_INSERTION, +- CS_EVENT_PRI_LOW); +- } +- break; +... +- } + +- pcmcia_put_socket(s); + +- return 0; +-} /* ds_event */ + +to: + ++static int pcmcia_bus_early_resume(struct pcmcia_socket *skt) ++{ ++ if (!verify_cis_cache(skt)) { ++ pcmcia_put_socket(skt); ++ return 0; ++ } + ++ dev_dbg(&skt->dev, "cis mismatch - different card\n"); + ++ /* first, remove the card */ ++ pcmcia_bus_remove(skt); ++ mutex_lock(&skt->ops_mutex); ++ destroy_cis_cache(skt); ++ kfree(skt->fake_cis); ++ skt->fake_cis = NULL; ++ skt->functions = 0; ++ mutex_unlock(&skt->ops_mutex); + ++ /* now, add the new card */ ++ pcmcia_bus_add(skt); ++ return 0; ++} + +As can be seen, the original function called pcmcia_get_socket() and +pcmcia_put_socket() around the guts, whereas the replacement code +calls pcmcia_put_socket() only in one path. This creates an imbalance +in the refcounting. + +Testing with pcmcia_put_socket() put removed shows that the bug is gone: + + dpm_suspend: c1a10998 [pcmcia_socket0] 5 + dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5 + dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5 + dpm_resume: c1a10998 [pcmcia_socket0] 5 + dpm_complete: c1a10998 [pcmcia_socket0] 5 + +Tested-by: Russell King +Signed-off-by: Russell King +Cc: Dominik Brodowski +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/ds.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/pcmcia/ds.c ++++ b/drivers/pcmcia/ds.c +@@ -1269,10 +1269,8 @@ static int pcmcia_bus_add(struct pcmcia_ + + static int pcmcia_bus_early_resume(struct pcmcia_socket *skt) + { +- if (!verify_cis_cache(skt)) { +- pcmcia_put_socket(skt); ++ if (!verify_cis_cache(skt)) + return 0; +- } + + dev_dbg(&skt->dev, "cis mismatch - different card\n"); + diff --git a/queue-3.0/series b/queue-3.0/series index 145f5a28872..952667f2cc6 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -33,3 +33,12 @@ cifs-fix-oops-in-session-setup-code-for-null-user-mounts.patch atmel_lcdfb-fix-usage-of-contrast_ctr-in-suspend-resume.patch lockdep-bug-exclude-taint_firmware_workaround-from-disabling-lockdep.patch hwmon-w83627ehf-fix-number-of-fans-for-nct6776f.patch +asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch +asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch +asoc-wm8962-fix-word-length-configuration.patch +pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch +mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch +mm-fix-up-thp-spin_is_locked-bugs.patch +target-use-correct-preempted-registration-sense-code.patch +target-allow-persistent-reserve-in-for-non-reservation-holder.patch +target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch diff --git a/queue-3.0/target-allow-persistent-reserve-in-for-non-reservation-holder.patch b/queue-3.0/target-allow-persistent-reserve-in-for-non-reservation-holder.patch new file mode 100644 index 00000000000..ed69502f8fe --- /dev/null +++ b/queue-3.0/target-allow-persistent-reserve-in-for-non-reservation-holder.patch @@ -0,0 +1,32 @@ +From 6816966a8418b980481b4dced7eddd1796b145e8 Mon Sep 17 00:00:00 2001 +From: Marco Sanvido +Date: Tue, 3 Jan 2012 17:12:58 -0800 +Subject: target: Allow PERSISTENT RESERVE IN for non-reservation holder + +From: Marco Sanvido + +commit 6816966a8418b980481b4dced7eddd1796b145e8 upstream. + +Initiators that aren't the active reservation holder should be able to +do a PERSISTENT RESERVE IN command in all cases, so add it to the list +of allowed CDBs in core_scsi3_pr_seq_non_holder(). + +Signed-off-by: Marco Sanvido +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -471,6 +471,7 @@ static int core_scsi3_pr_seq_non_holder( + case READ_MEDIA_SERIAL_NUMBER: + case REPORT_LUNS: + case REQUEST_SENSE: ++ case PERSISTENT_RESERVE_IN: + ret = 0; /*/ Allowed CDBs */ + break; + default: diff --git a/queue-3.0/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch b/queue-3.0/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch new file mode 100644 index 00000000000..95ad2b11c9d --- /dev/null +++ b/queue-3.0/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch @@ -0,0 +1,66 @@ +From 9fbc8909876a2160044e71d376848973b9bfdc3f Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Mon, 9 Jan 2012 17:54:00 -0800 +Subject: target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB} + +From: Roland Dreier + +commit 9fbc8909876a2160044e71d376848973b9bfdc3f upstream. + +According to SPC-4, the sense key for commands that are failed with +INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be +ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh). Without this +patch, a tcm_loop LUN incorrectly gives: + + # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0 + Sense Information: + Fixed format, current; Sense key: Aborted Command + Additional sense: Invalid field in cdb + Raw sense data (in hex): + 70 00 0b 00 00 00 00 0a 00 00 00 00 24 00 00 00 + 00 00 + +While a real SCSI disk gives: + + Sense Information: + Fixed format, current; Sense key: Illegal Request + Additional sense: Invalid field in cdb + Raw sense data (in hex): + 70 00 05 00 00 00 00 18 00 00 00 00 24 00 00 00 + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +with the main point being that the real disk gives a sense key of +ILLEGAL REQUEST (5h). + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -5709,8 +5709,8 @@ int transport_send_check_condition_and_s + /* CURRENT ERROR */ + buffer[offset] = 0x70; + buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10; +- /* ABORTED COMMAND */ +- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND; ++ /* ILLEGAL REQUEST */ ++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST; + /* INVALID FIELD IN CDB */ + buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24; + break; +@@ -5718,8 +5718,8 @@ int transport_send_check_condition_and_s + /* CURRENT ERROR */ + buffer[offset] = 0x70; + buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10; +- /* ABORTED COMMAND */ +- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND; ++ /* ILLEGAL REQUEST */ ++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST; + /* INVALID FIELD IN PARAMETER LIST */ + buffer[offset+SPC_ASC_KEY_OFFSET] = 0x26; + break; diff --git a/queue-3.0/target-use-correct-preempted-registration-sense-code.patch b/queue-3.0/target-use-correct-preempted-registration-sense-code.patch new file mode 100644 index 00000000000..d59d4785a19 --- /dev/null +++ b/queue-3.0/target-use-correct-preempted-registration-sense-code.patch @@ -0,0 +1,57 @@ +From 9e08e34e3735ae057eb3834da3570995811b7eb9 Mon Sep 17 00:00:00 2001 +From: Marco Sanvido +Date: Tue, 3 Jan 2012 17:12:57 -0800 +Subject: target: Use correct preempted registration sense code + +From: Marco Sanvido + +commit 9e08e34e3735ae057eb3834da3570995811b7eb9 upstream. + +The comments quote the right parts of the spec: + + * d) Establish a unit attention condition for the + * initiator port associated with every I_T nexus + * that lost its registration other than the I_T + * nexus on which the PERSISTENT RESERVE OUT command + * was received, with the additional sense code set + * to REGISTRATIONS PREEMPTED. + +and + + * e) Establish a unit attention condition for the initiator + * port associated with every I_T nexus that lost its + * persistent reservation and/or registration, with the + * additional sense code set to REGISTRATIONS PREEMPTED; + +but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED +instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED. Fix this. + +Signed-off-by: Marco Sanvido +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -3079,7 +3079,7 @@ static int core_scsi3_pro_preempt( + if (!(calling_it_nexus)) + core_scsi3_ua_allocate(pr_reg_nacl, + pr_res_mapped_lun, 0x2A, +- ASCQ_2AH_RESERVATIONS_PREEMPTED); ++ ASCQ_2AH_REGISTRATIONS_PREEMPTED); + } + spin_unlock(&pr_tmpl->registration_lock); + /* +@@ -3191,7 +3191,7 @@ static int core_scsi3_pro_preempt( + * additional sense code set to REGISTRATIONS PREEMPTED; + */ + core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun, 0x2A, +- ASCQ_2AH_RESERVATIONS_PREEMPTED); ++ ASCQ_2AH_REGISTRATIONS_PREEMPTED); + } + spin_unlock(&pr_tmpl->registration_lock); + /*