From: Greg Kroah-Hartman Date: Thu, 9 Feb 2012 16:22:17 +0000 (-0800) Subject: 3.2-stable patches X-Git-Tag: v3.0.21~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f464ca34b64d6f1103ae2d8fae8dad1d778c1721;p=thirdparty%2Fkernel%2Fstable-queue.git 3.2-stable patches added patches: alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch asoc-wm8962-fix-word-length-configuration.patch asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch iommu-amd-work-around-broken-ivrs-tables.patch iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch mm-fix-up-thp-spin_is_locked-bugs.patch pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch target-add-workaround-for-zero-length-control-cdb-handling.patch target-allow-persistent-reserve-in-for-non-reservation-holder.patch target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch target-return-correct-asc-for-unimplemented-vpd-pages.patch target-use-correct-preempted-registration-sense-code.patch --- diff --git a/queue-3.2/alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch b/queue-3.2/alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch new file mode 100644 index 00000000000..62fab6eac7e --- /dev/null +++ b/queue-3.2/alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch @@ -0,0 +1,64 @@ +From 2492250e4412c6411324c14ab289629360640b0a Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Sat, 4 Feb 2012 20:56:47 +0100 +Subject: ALSA: oxygen, virtuoso: fix exchanged L/R volumes of aux and CD inputs + +From: Clemens Ladisch + +commit 2492250e4412c6411324c14ab289629360640b0a upstream. + +The driver accidentally exchanged the left/right fields for stereo AC'97 +mixer registers. This affected only the aux and CD inputs because the +line input bypasses the AC'97 codec and the mic input is mono; cards +without AC'97 (Xonar DS/DG/HDAV Slim, HG2PCI, HiFier) were not affected. + +Reported-and-tested-by: Abby Cedar +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/oxygen_mixer.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/sound/pci/oxygen/oxygen_mixer.c ++++ b/sound/pci/oxygen/oxygen_mixer.c +@@ -618,9 +618,12 @@ static int ac97_volume_get(struct snd_kc + mutex_lock(&chip->mutex); + reg = oxygen_read_ac97(chip, codec, index); + mutex_unlock(&chip->mutex); +- value->value.integer.value[0] = 31 - (reg & 0x1f); +- if (stereo) +- value->value.integer.value[1] = 31 - ((reg >> 8) & 0x1f); ++ if (!stereo) { ++ value->value.integer.value[0] = 31 - (reg & 0x1f); ++ } else { ++ value->value.integer.value[0] = 31 - ((reg >> 8) & 0x1f); ++ value->value.integer.value[1] = 31 - (reg & 0x1f); ++ } + return 0; + } + +@@ -636,14 +639,14 @@ static int ac97_volume_put(struct snd_kc + + mutex_lock(&chip->mutex); + oldreg = oxygen_read_ac97(chip, codec, index); +- newreg = oldreg; +- newreg = (newreg & ~0x1f) | +- (31 - (value->value.integer.value[0] & 0x1f)); +- if (stereo) +- newreg = (newreg & ~0x1f00) | +- ((31 - (value->value.integer.value[1] & 0x1f)) << 8); +- else +- newreg = (newreg & ~0x1f00) | ((newreg & 0x1f) << 8); ++ if (!stereo) { ++ newreg = oldreg & ~0x1f; ++ newreg |= 31 - (value->value.integer.value[0] & 0x1f); ++ } else { ++ newreg = oldreg & ~0x1f1f; ++ newreg |= (31 - (value->value.integer.value[0] & 0x1f)) << 8; ++ newreg |= 31 - (value->value.integer.value[1] & 0x1f); ++ } + change = newreg != oldreg; + if (change) + oxygen_write_ac97(chip, codec, index, newreg); diff --git a/queue-3.2/asoc-wm8962-fix-word-length-configuration.patch b/queue-3.2/asoc-wm8962-fix-word-length-configuration.patch new file mode 100644 index 00000000000..9ec387b2660 --- /dev/null +++ b/queue-3.2/asoc-wm8962-fix-word-length-configuration.patch @@ -0,0 +1,36 @@ +From 2b6712b19531e22455e7fa18371c5ba9eec76699 Mon Sep 17 00:00:00 2001 +From: Susan Gao +Date: Mon, 30 Jan 2012 13:57:04 -0800 +Subject: ASoC: wm8962: Fix word length configuration + +From: Susan Gao + +commit 2b6712b19531e22455e7fa18371c5ba9eec76699 upstream. + +Signed-off-by: Susan Gao +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8962.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -3172,13 +3172,13 @@ static int wm8962_hw_params(struct snd_p + case SNDRV_PCM_FORMAT_S16_LE: + break; + case SNDRV_PCM_FORMAT_S20_3LE: +- aif0 |= 0x40; ++ aif0 |= 0x4; + break; + case SNDRV_PCM_FORMAT_S24_LE: +- aif0 |= 0x80; ++ aif0 |= 0x8; + break; + case SNDRV_PCM_FORMAT_S32_LE: +- aif0 |= 0xc0; ++ aif0 |= 0xc; + break; + default: + return -EINVAL; diff --git a/queue-3.2/asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch b/queue-3.2/asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch new file mode 100644 index 00000000000..84e11ae3116 --- /dev/null +++ b/queue-3.2/asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch @@ -0,0 +1,39 @@ +From db966f8abb9ba74f7d5a7230f51572f52c31c4e5 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 6 Feb 2012 12:07:08 +0000 +Subject: ASoC: wm8994: Enabling VMID should take a runtime PM reference + +From: Mark Brown + +commit db966f8abb9ba74f7d5a7230f51572f52c31c4e5 upstream. + +We can enable VMID independently of the bias in some use cases so we need +to ensure that the core device is powered up. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8994.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -729,6 +729,8 @@ static void vmid_reference(struct snd_so + { + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); + ++ pm_runtime_get_sync(codec->dev); ++ + wm8994->vmid_refcount++; + + dev_dbg(codec->dev, "Referencing VMID, refcount is now %d\n", +@@ -796,6 +798,8 @@ static void vmid_dereference(struct snd_ + WM8994_VMID_BUF_ENA | + WM8994_VMID_RAMP_MASK, 0); + } ++ ++ pm_runtime_put(codec->dev); + } + + static int vmid_event(struct snd_soc_dapm_widget *w, diff --git a/queue-3.2/asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch b/queue-3.2/asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch new file mode 100644 index 00000000000..d9e6ba6ed20 --- /dev/null +++ b/queue-3.2/asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch @@ -0,0 +1,29 @@ +From f647e1526fd6c7c8ab720781c40d11e11f930e93 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Tue, 7 Feb 2012 17:24:19 +0000 +Subject: ASoC: wm8994: Fix typo in VMID ramp setting + +From: Mark Brown + +commit f647e1526fd6c7c8ab720781c40d11e11f930e93 upstream. + +The VMID ramp rate is supposed to be 0x3, not 11b. Fix that. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -744,7 +744,7 @@ static void vmid_reference(struct snd_so + WM8994_VMID_RAMP_MASK, + WM8994_STARTUP_BIAS_ENA | + WM8994_VMID_BUF_ENA | +- (0x11 << WM8994_VMID_RAMP_SHIFT)); ++ (0x3 << WM8994_VMID_RAMP_SHIFT)); + + /* Main bias enable, VMID=2x40k */ + snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_1, diff --git a/queue-3.2/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch b/queue-3.2/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch new file mode 100644 index 00000000000..ed1911b0b95 --- /dev/null +++ b/queue-3.2/asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch @@ -0,0 +1,32 @@ +From 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 1 Feb 2012 23:46:58 +0000 +Subject: ASoC: wm_hubs: Correct line input to line output 2 paths + +From: Mark Brown + +commit 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e upstream. + +The second line output mixer has the controls for the line input bypasses +in the opposite order. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_hubs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM + }; + + static const struct snd_kcontrol_new line2_mix[] = { +-SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0), +-SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0), ++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 2, 1, 0), ++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 1, 1, 0), + SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0), + }; + diff --git a/queue-3.2/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch b/queue-3.2/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch new file mode 100644 index 00000000000..f8464a5691c --- /dev/null +++ b/queue-3.2/asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch @@ -0,0 +1,44 @@ +From ee76744c51ec342df9822b4a85dbbfc3887b6d60 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Tue, 31 Jan 2012 11:55:32 +0000 +Subject: ASoC: wm_hubs: Fix routing of input PGAs to line output + mixer + +From: Mark Brown + +commit ee76744c51ec342df9822b4a85dbbfc3887b6d60 upstream. + +IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1 +and IN2 to LINEOUT2. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_hubs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -587,8 +587,8 @@ SOC_DAPM_SINGLE("Left Output Switch", WM + }; + + static const struct snd_kcontrol_new line2_mix[] = { +-SOC_DAPM_SINGLE("IN2R Switch", WM8993_LINE_MIXER2, 2, 1, 0), +-SOC_DAPM_SINGLE("IN2L Switch", WM8993_LINE_MIXER2, 1, 1, 0), ++SOC_DAPM_SINGLE("IN1R Switch", WM8993_LINE_MIXER2, 2, 1, 0), ++SOC_DAPM_SINGLE("IN1L Switch", WM8993_LINE_MIXER2, 1, 1, 0), + SOC_DAPM_SINGLE("Output Switch", WM8993_LINE_MIXER2, 0, 1, 0), + }; + +@@ -846,8 +846,8 @@ static const struct snd_soc_dapm_route l + }; + + static const struct snd_soc_dapm_route lineout2_diff_routes[] = { +- { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" }, +- { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" }, ++ { "LINEOUT2 Mixer", "IN1L Switch", "IN1L PGA" }, ++ { "LINEOUT2 Mixer", "IN1R Switch", "IN1R PGA" }, + { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" }, diff --git a/queue-3.2/iommu-amd-work-around-broken-ivrs-tables.patch b/queue-3.2/iommu-amd-work-around-broken-ivrs-tables.patch new file mode 100644 index 00000000000..af1aabf868f --- /dev/null +++ b/queue-3.2/iommu-amd-work-around-broken-ivrs-tables.patch @@ -0,0 +1,35 @@ +From af1be04901e27ce669b4ecde1c953d5c939498f5 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Wed, 18 Jan 2012 14:03:11 +0100 +Subject: iommu/amd: Work around broken IVRS tables + +From: Joerg Roedel + +commit af1be04901e27ce669b4ecde1c953d5c939498f5 upstream. + +On some systems the IVRS table does not contain all PCI +devices present in the system. In case a device not present +in the IVRS table is translated by the IOMMU no DMA is +possible from that device by default. +This patch fixes this by removing the DTE entry for every +PCI device present in the system and not covered by IVRS. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2479,6 +2479,9 @@ static unsigned device_dma_ops_init(void + + for_each_pci_dev(pdev) { + if (!check_device(&pdev->dev)) { ++ ++ iommu_ignore_device(&pdev->dev); ++ + unhandled += 1; + continue; + } diff --git a/queue-3.2/iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch b/queue-3.2/iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch new file mode 100644 index 00000000000..a3fa799fbb2 --- /dev/null +++ b/queue-3.2/iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch @@ -0,0 +1,60 @@ +From 05df1f3c2afaef5672627f2b7095f0d4c4dbc3a0 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Thu, 26 Jan 2012 18:25:37 +0100 +Subject: iommu/msm: Fix error handling in msm_iommu_unmap() + +From: Joerg Roedel + +commit 05df1f3c2afaef5672627f2b7095f0d4c4dbc3a0 upstream. + +Error handling in msm_iommu_unmap() is broken. On some error +conditions retval is set to a non-zero value which causes +the function to return 'len' at the end. This hides the +error from the user. Zero should be returned in those error +cases. + +Cc: David Brown +Cc: Stepan Moskovchenko +Signed-off-by: Joerg Roedel +Acked-by: David Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/msm_iommu.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/iommu/msm_iommu.c ++++ b/drivers/iommu/msm_iommu.c +@@ -481,23 +481,19 @@ static int msm_iommu_unmap(struct iommu_ + + priv = domain->priv; + +- if (!priv) { +- ret = -ENODEV; ++ if (!priv) + goto fail; +- } + + fl_table = priv->pgtable; + + if (len != SZ_16M && len != SZ_1M && + len != SZ_64K && len != SZ_4K) { + pr_debug("Bad length: %d\n", len); +- ret = -EINVAL; + goto fail; + } + + if (!fl_table) { + pr_debug("Null page table\n"); +- ret = -EINVAL; + goto fail; + } + +@@ -506,7 +502,6 @@ static int msm_iommu_unmap(struct iommu_ + + if (*fl_pte == 0) { + pr_debug("First level PTE is 0\n"); +- ret = -ENODEV; + goto fail; + } + diff --git a/queue-3.2/iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch b/queue-3.2/iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch new file mode 100644 index 00000000000..afa336f93e1 --- /dev/null +++ b/queue-3.2/iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch @@ -0,0 +1,169 @@ +From 2f9bc894c67dbacae5a6a9875818d2a18a918d18 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Mon, 16 Jan 2012 23:33:48 -0800 +Subject: iscsi-target: Fix discovery with INADDR_ANY and IN6ADDR_ANY_INIT + +From: Nicholas Bellinger + +commit 2f9bc894c67dbacae5a6a9875818d2a18a918d18 upstream. + +This patch addresses a bug with sendtargets discovery where INADDR_ANY (0.0.0.0) ++ IN6ADDR_ANY_INIT ([0:0:0:0:0:0:0:0]) network portals where incorrectly being +reported back to initiators instead of the address of the connecting interface. +To address this, save local socket ->getname() output during iscsi login setup, +and makes iscsit_build_sendtargets_response() return these TargetAddress keys +when INADDR_ANY or IN6ADDR_ANY_INIT portals are in use. + +Reported-by: Dax Kelson +Reported-by: Andy Grover +Cc: David S. Miller +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 37 ++++++++++++++++++++++++++---- + drivers/target/iscsi/iscsi_target_core.h | 2 + + drivers/target/iscsi/iscsi_target_login.c | 31 +++++++++++++++++++++---- + 3 files changed, 62 insertions(+), 8 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -3165,6 +3165,30 @@ static int iscsit_send_task_mgt_rsp( + return 0; + } + ++static bool iscsit_check_inaddr_any(struct iscsi_np *np) ++{ ++ bool ret = false; ++ ++ if (np->np_sockaddr.ss_family == AF_INET6) { ++ const struct sockaddr_in6 sin6 = { ++ .sin6_addr = IN6ADDR_ANY_INIT }; ++ struct sockaddr_in6 *sock_in6 = ++ (struct sockaddr_in6 *)&np->np_sockaddr; ++ ++ if (!memcmp(sock_in6->sin6_addr.s6_addr, ++ sin6.sin6_addr.s6_addr, 16)) ++ ret = true; ++ } else { ++ struct sockaddr_in * sock_in = ++ (struct sockaddr_in *)&np->np_sockaddr; ++ ++ if (sock_in->sin_addr.s_addr == INADDR_ANY) ++ ret = true; ++ } ++ ++ return ret; ++} ++ + static int iscsit_build_sendtargets_response(struct iscsi_cmd *cmd) + { + char *payload = NULL; +@@ -3214,12 +3238,17 @@ static int iscsit_build_sendtargets_resp + spin_lock(&tpg->tpg_np_lock); + list_for_each_entry(tpg_np, &tpg->tpg_gnp_list, + tpg_np_list) { ++ struct iscsi_np *np = tpg_np->tpg_np; ++ bool inaddr_any = iscsit_check_inaddr_any(np); ++ + len = sprintf(buf, "TargetAddress=" + "%s%s%s:%hu,%hu", +- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ? +- "[" : "", tpg_np->tpg_np->np_ip, +- (tpg_np->tpg_np->np_sockaddr.ss_family == AF_INET6) ? +- "]" : "", tpg_np->tpg_np->np_port, ++ (np->np_sockaddr.ss_family == AF_INET6) ? ++ "[" : "", (inaddr_any == false) ? ++ np->np_ip : conn->local_ip, ++ (np->np_sockaddr.ss_family == AF_INET6) ? ++ "]" : "", (inaddr_any == false) ? ++ np->np_port : conn->local_port, + tpg->tpgt); + len += 1; + +--- a/drivers/target/iscsi/iscsi_target_core.h ++++ b/drivers/target/iscsi/iscsi_target_core.h +@@ -508,6 +508,7 @@ struct iscsi_conn { + u16 cid; + /* Remote TCP Port */ + u16 login_port; ++ u16 local_port; + int net_size; + u32 auth_id; + #define CONNFLAG_SCTP_STRUCT_FILE 0x01 +@@ -527,6 +528,7 @@ struct iscsi_conn { + unsigned char bad_hdr[ISCSI_HDR_LEN]; + #define IPV6_ADDRESS_SPACE 48 + unsigned char login_ip[IPV6_ADDRESS_SPACE]; ++ unsigned char local_ip[IPV6_ADDRESS_SPACE]; + int conn_usage_count; + int conn_waiting_on_uc; + atomic_t check_immediate_queue; +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -616,8 +616,8 @@ static int iscsi_post_login_handler( + } + + pr_debug("iSCSI Login successful on CID: %hu from %s to" +- " %s:%hu,%hu\n", conn->cid, conn->login_ip, np->np_ip, +- np->np_port, tpg->tpgt); ++ " %s:%hu,%hu\n", conn->cid, conn->login_ip, ++ conn->local_ip, conn->local_port, tpg->tpgt); + + list_add_tail(&conn->conn_list, &sess->sess_conn_list); + atomic_inc(&sess->nconn); +@@ -659,7 +659,8 @@ static int iscsi_post_login_handler( + sess->session_state = TARG_SESS_STATE_LOGGED_IN; + + pr_debug("iSCSI Login successful on CID: %hu from %s to %s:%hu,%hu\n", +- conn->cid, conn->login_ip, np->np_ip, np->np_port, tpg->tpgt); ++ conn->cid, conn->login_ip, conn->local_ip, conn->local_port, ++ tpg->tpgt); + + spin_lock_bh(&sess->conn_lock); + list_add_tail(&conn->conn_list, &sess->sess_conn_list); +@@ -1019,6 +1020,18 @@ static int __iscsi_target_login_thread(s + snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c", + &sock_in6.sin6_addr.in6_u); + conn->login_port = ntohs(sock_in6.sin6_port); ++ ++ if (conn->sock->ops->getname(conn->sock, ++ (struct sockaddr *)&sock_in6, &err, 0) < 0) { ++ pr_err("sock_ops->getname() failed.\n"); ++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, ++ ISCSI_LOGIN_STATUS_TARGET_ERROR); ++ goto new_sess_out; ++ } ++ snprintf(conn->local_ip, sizeof(conn->local_ip), "%pI6c", ++ &sock_in6.sin6_addr.in6_u); ++ conn->local_port = ntohs(sock_in6.sin6_port); ++ + } else { + memset(&sock_in, 0, sizeof(struct sockaddr_in)); + +@@ -1031,6 +1044,16 @@ static int __iscsi_target_login_thread(s + } + sprintf(conn->login_ip, "%pI4", &sock_in.sin_addr.s_addr); + conn->login_port = ntohs(sock_in.sin_port); ++ ++ if (conn->sock->ops->getname(conn->sock, ++ (struct sockaddr *)&sock_in, &err, 0) < 0) { ++ pr_err("sock_ops->getname() failed.\n"); ++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, ++ ISCSI_LOGIN_STATUS_TARGET_ERROR); ++ goto new_sess_out; ++ } ++ sprintf(conn->local_ip, "%pI4", &sock_in.sin_addr.s_addr); ++ conn->local_port = ntohs(sock_in.sin_port); + } + + conn->network_transport = np->np_network_transport; +@@ -1038,7 +1061,7 @@ static int __iscsi_target_login_thread(s + pr_debug("Received iSCSI login request from %s on %s Network" + " Portal %s:%hu\n", conn->login_ip, + (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP", +- np->np_ip, np->np_port); ++ conn->local_ip, conn->local_port); + + pr_debug("Moving to TARG_CONN_STATE_IN_LOGIN.\n"); + conn->conn_state = TARG_CONN_STATE_IN_LOGIN; diff --git a/queue-3.2/iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch b/queue-3.2/iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch new file mode 100644 index 00000000000..dc845496b87 --- /dev/null +++ b/queue-3.2/iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch @@ -0,0 +1,32 @@ +From cd931ee62fd0258fc85c76a7c5499fe85e0f3436 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Mon, 16 Jan 2012 17:11:54 -0800 +Subject: iscsi-target: Fix double list_add with iscsit_alloc_buffs reject + +From: Nicholas Bellinger + +commit cd931ee62fd0258fc85c76a7c5499fe85e0f3436 upstream. + +This patch fixes a bug where the iscsit_add_reject_from_cmd() call +from a failure to iscsit_alloc_buffs() was incorrectly passing +add_to_conn=1 and causing a double list_add after iscsi_cmd->i_list +had already been added in iscsit_handle_scsi_cmd(). + +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1062,7 +1062,7 @@ attach_cmd: + if (ret < 0) + return iscsit_add_reject_from_cmd( + ISCSI_REASON_BOOKMARK_NO_RESOURCES, +- 1, 1, buf, cmd); ++ 1, 0, buf, cmd); + /* + * Check the CmdSN against ExpCmdSN/MaxCmdSN here if + * the Immediate Bit is not set, and no Immediate diff --git a/queue-3.2/iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch b/queue-3.2/iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch new file mode 100644 index 00000000000..565da85745d --- /dev/null +++ b/queue-3.2/iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch @@ -0,0 +1,76 @@ +From c1ce4bd56f2846de55043374598fd929ad3b711b Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Mon, 16 Jan 2012 16:04:15 -0800 +Subject: iscsi-target: Fix reject release handling in iscsit_free_cmd() + +From: Nicholas Bellinger + +commit c1ce4bd56f2846de55043374598fd929ad3b711b upstream. + +This patch addresses a bug where iscsit_free_cmd() was incorrectly calling +iscsit_release_cmd() for ISCSI_OP_REJECT because iscsi_add_reject*() will +overwrite the original iscsi_cmd->iscsi_opcode assignment. This bug was +introduced with the following commit: + +commit 0be67f2ed8f577d2c72d917928394c5885fa9134 +Author: Nicholas Bellinger +Date: Sun Oct 9 01:48:14 2011 -0700 + + iscsi-target: Remove SCF_SE_LUN_CMD flag abuses + +and was manifesting itself as list corruption with the following: + +[ 131.191092] ------------[ cut here ]------------ +[ 131.191092] WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98() +[ 131.191092] Hardware name: VMware Virtual Platform +[ 131.191092] list_del corruption. prev->next should be ffff880022d3c100, but was 6b6b6b6b6b6b6b6b +[ 131.191092] Modules linked in: tcm_vhost ib_srpt ib_cm ib_sa ib_mad ib_core tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc crc32c iscsi_target_mod target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sr_mod cdrom sd_mod e1000 ata_piix libata mptspi mptscsih mptbase [last unloaded: scsi_wait_scan] +[ 131.191092] Pid: 2250, comm: iscsi_ttx Tainted: G W 3.2.0-rc4+ #42 +[ 131.191092] Call Trace: +[ 131.191092] [] warn_slowpath_common+0x80/0x98 +[ 131.191092] [] warn_slowpath_fmt+0x41/0x43 +[ 131.191092] [] __list_del_entry+0x8d/0x98 +[ 131.191092] [] transport_lun_remove_cmd+0x9b/0xb7 [target_core_mod] +[ 131.191092] [] transport_generic_free_cmd+0x5d/0x71 [target_core_mod] +[ 131.191092] [] iscsit_free_cmd+0x1e/0x27 [iscsi_target_mod] +[ 131.191092] [] iscsit_close_connection+0x14d/0x5b2 [iscsi_target_mod] +[ 131.191092] [] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod] +[ 131.191092] [] iscsi_target_tx_thread+0x15cb/0x1608 [iscsi_target_mod] +[ 131.191092] [] ? check_preempt_wakeup+0x121/0x185 +[ 131.191092] [] ? __dequeue_entity+0x2e/0x33 +[ 131.191092] [] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod] +[ 131.191092] [] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod] +[ 131.191092] [] ? schedule+0x55/0x57 +[ 131.191092] [] kthread+0x7d/0x85 +[ 131.191092] [] kernel_thread_helper+0x4/0x10 +[ 131.191092] [] ? kthread_worker_fn+0x16d/0x16d +[ 131.191092] [] ? gs_change+0x13/0x13 + +Reported-by: +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_util.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -851,6 +851,17 @@ void iscsit_free_cmd(struct iscsi_cmd *c + case ISCSI_OP_SCSI_TMFUNC: + transport_generic_free_cmd(&cmd->se_cmd, 1); + break; ++ case ISCSI_OP_REJECT: ++ /* ++ * Handle special case for REJECT when iscsi_add_reject*() has ++ * overwritten the original iscsi_opcode assignment, and the ++ * associated cmd->se_cmd needs to be released. ++ */ ++ if (cmd->se_cmd.se_tfo != NULL) { ++ transport_generic_free_cmd(&cmd->se_cmd, 1); ++ break; ++ } ++ /* Fall-through */ + default: + iscsit_release_cmd(cmd); + break; diff --git a/queue-3.2/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch b/queue-3.2/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch new file mode 100644 index 00000000000..77a54674e9d --- /dev/null +++ b/queue-3.2/mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch @@ -0,0 +1,108 @@ +From dc9086004b3d5db75997a645b3fe08d9138b7ad0 Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Wed, 8 Feb 2012 17:13:38 -0800 +Subject: mm: compaction: check for overlapping nodes during isolation for migration + +From: Mel Gorman + +commit dc9086004b3d5db75997a645b3fe08d9138b7ad0 upstream. + +When isolating pages for migration, migration starts at the start of a +zone while the free scanner starts at the end of the zone. Migration +avoids entering a new zone by never going beyond the free scanned. + +Unfortunately, in very rare cases nodes can overlap. When this happens, +migration isolates pages without the LRU lock held, corrupting lists +which will trigger errors in reclaim or during page free such as in the +following oops + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 + IP: [] free_pcppages_bulk+0xcc/0x450 + PGD 1dda554067 PUD 1e1cb58067 PMD 0 + Oops: 0000 [#1] SMP + CPU 37 + Pid: 17088, comm: memcg_process_s Tainted: G X + RIP: free_pcppages_bulk+0xcc/0x450 + Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0) + Call Trace: + free_hot_cold_page+0x17e/0x1f0 + __pagevec_free+0x90/0xb0 + release_pages+0x22a/0x260 + pagevec_lru_move_fn+0xf3/0x110 + putback_lru_page+0x66/0xe0 + unmap_and_move+0x156/0x180 + migrate_pages+0x9e/0x1b0 + compact_zone+0x1f3/0x2f0 + compact_zone_order+0xa2/0xe0 + try_to_compact_pages+0xdf/0x110 + __alloc_pages_direct_compact+0xee/0x1c0 + __alloc_pages_slowpath+0x370/0x830 + __alloc_pages_nodemask+0x1b1/0x1c0 + alloc_pages_vma+0x9b/0x160 + do_huge_pmd_anonymous_page+0x160/0x270 + do_page_fault+0x207/0x4c0 + page_fault+0x25/0x30 + +The "X" in the taint flag means that external modules were loaded but but +is unrelated to the bug triggering. The real problem was because the PFN +layout looks like this + + Zone PFN ranges: + DMA 0x00000010 -> 0x00001000 + DMA32 0x00001000 -> 0x00100000 + Normal 0x00100000 -> 0x01e80000 + Movable zone start PFN for each node + early_node_map[14] active PFN ranges + 0: 0x00000010 -> 0x0000009b + 0: 0x00000100 -> 0x0007a1ec + 0: 0x0007a354 -> 0x0007a379 + 0: 0x0007f7ff -> 0x0007f800 + 0: 0x00100000 -> 0x00680000 + 1: 0x00680000 -> 0x00e80000 + 0: 0x00e80000 -> 0x01080000 + 1: 0x01080000 -> 0x01280000 + 0: 0x01280000 -> 0x01480000 + 1: 0x01480000 -> 0x01680000 + 0: 0x01680000 -> 0x01880000 + 1: 0x01880000 -> 0x01a80000 + 0: 0x01a80000 -> 0x01c80000 + 1: 0x01c80000 -> 0x01e80000 + +The fix is straight-forward. isolate_migratepages() has to make a +similar check to isolate_freepage to ensure that it never isolates pages +from a zone it does not hold the LRU lock for. + +This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x +and current mainline. + +Signed-off-by: Mel Gorman +Acked-by: Michal Nazarewicz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/compaction.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -330,8 +330,17 @@ static isolate_migrate_t isolate_migrate + continue; + nr_scanned++; + +- /* Get the page and skip if free */ ++ /* ++ * Get the page and ensure the page is within the same zone. ++ * See the comment in isolate_freepages about overlapping ++ * nodes. It is deliberate that the new zone lock is not taken ++ * as memory compaction should not move pages between nodes. ++ */ + page = pfn_to_page(low_pfn); ++ if (page_zone(page) != zone) ++ continue; ++ ++ /* Skip if free */ + if (PageBuddy(page)) + continue; + diff --git a/queue-3.2/mm-fix-up-thp-spin_is_locked-bugs.patch b/queue-3.2/mm-fix-up-thp-spin_is_locked-bugs.patch new file mode 100644 index 00000000000..231e76e5f3e --- /dev/null +++ b/queue-3.2/mm-fix-up-thp-spin_is_locked-bugs.patch @@ -0,0 +1,59 @@ +From b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Wed, 8 Feb 2012 17:13:40 -0800 +Subject: mm: fix UP THP spin_is_locked BUGs + +From: Hugh Dickins + +commit b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 upstream. + +Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y +CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false, +and so triggers some BUGs in Transparent HugePage codepaths. + +asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x); +but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE, +VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs. + +Signed-off-by: Hugh Dickins +Cc: Andrea Arcangeli +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 4 ++-- + mm/swap.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2064,7 +2064,7 @@ static void collect_mm_slot(struct mm_sl + { + struct mm_struct *mm = mm_slot->mm; + +- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock)); + + if (khugepaged_test_exit(mm)) { + /* free mm_slot */ +@@ -2094,7 +2094,7 @@ static unsigned int khugepaged_scan_mm_s + int progress = 0; + + VM_BUG_ON(!pages); +- VM_BUG_ON(!spin_is_locked(&khugepaged_mm_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock)); + + if (khugepaged_scan.mm_slot) + mm_slot = khugepaged_scan.mm_slot; +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -667,7 +667,7 @@ void lru_add_page_tail(struct zone* zone + VM_BUG_ON(!PageHead(page)); + VM_BUG_ON(PageCompound(page_tail)); + VM_BUG_ON(PageLRU(page_tail)); +- VM_BUG_ON(!spin_is_locked(&zone->lru_lock)); ++ VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&zone->lru_lock)); + + SetPageLRU(page_tail); + diff --git a/queue-3.2/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch b/queue-3.2/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch new file mode 100644 index 00000000000..963d9ea6c83 --- /dev/null +++ b/queue-3.2/pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch @@ -0,0 +1,176 @@ +From 025e4ab3db07fcbf62c01e4f30d1012234beb980 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 8 Feb 2012 17:13:41 -0800 +Subject: pcmcia: fix socket refcount decrementing on each resume + +From: Russell King + +commit 025e4ab3db07fcbf62c01e4f30d1012234beb980 upstream. + +This fixes a memory-corrupting bug: not only does it cause the warning, +but as a result of dropping the refcount to zero, it causes the +pcmcia_socket0 device structure to be freed while it still has +references, causing slab caches corruption. A fatal oops quickly +follows this warning - often even just a 'dmesg' following the warning +causes the kernel to oops. + +While testing suspend/resume on an ARM device with PCMCIA support, and a +CF card inserted, I found that after five suspend and resumes, the +kernel would complain, and shortly die after with slab corruption. + + WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50() + +As the message doesn't give a clue about which kobject, and the built-in +debugging in drivers/base/power/main.c happens too late, this was added +right before each get_device(): + + printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount)); + +and on the 3rd s2ram cycle, the following behaviour observed: + +On the 3rd suspend/resume cycle: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 3 + dpm_suspend: c1a0d998 [pcmcia_socket0] 3 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3 + dpm_resume: c1a0d998 [pcmcia_socket0] 3 + dpm_complete: c1a0d998 [pcmcia_socket0] 2 + +4th: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 2 + dpm_suspend: c1a0d998 [pcmcia_socket0] 2 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2 + dpm_resume: c1a0d998 [pcmcia_socket0] 2 + dpm_complete: c1a0d998 [pcmcia_socket0] 1 + +5th: + + dpm_prepare: c1a0d998 [pcmcia_socket0] 1 + dpm_suspend: c1a0d998 [pcmcia_socket0] 1 + dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1 + dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1 + dpm_resume: c1a0d998 [pcmcia_socket0] 1 + dpm_complete: c1a0d998 [pcmcia_socket0] 0 + ------------[ cut here ]------------ + WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50() + Modules linked in: ucb1x00_core + Backtrace: + [] (dump_backtrace+0x0/0x110) from [] (dump_stack+0x18/0x1c) + [] (dump_stack+0x0/0x1c) from [] (warn_slowpath_common+0x50/0x68) + [] (warn_slowpath_common+0x0/0x68) from [] (warn_slowpath_null+0x24/0x28) + [] (warn_slowpath_null+0x0/0x28) from [] (kobject_get+0x28/0x50) + [] (kobject_get+0x0/0x50) from [] (get_device+0x1c/0x24) + [] (dpm_complete+0x0/0x1a0) from [] (dpm_resume_end+0x1c/0x20) + ... + +Looking at commit 7b24e7988263 ("pcmcia: split up central event handler"), +the following change was made to cs.c: + + return 0; + } + #endif +- +- send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW); ++ if (!(skt->state & SOCKET_CARDBUS) && (skt->callback)) ++ skt->callback->early_resume(skt); + return 0; + } + +And the corresponding change in ds.c is from: + +-static int ds_event(struct pcmcia_socket *skt, event_t event, int priority) +-{ +- struct pcmcia_socket *s = pcmcia_get_socket(skt); +... +- switch (event) { +... +- case CS_EVENT_PM_RESUME: +- if (verify_cis_cache(skt) != 0) { +- dev_dbg(&skt->dev, "cis mismatch - different card\n"); +- /* first, remove the card */ +- ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH); +- mutex_lock(&s->ops_mutex); +- destroy_cis_cache(skt); +- kfree(skt->fake_cis); +- skt->fake_cis = NULL; +- s->functions = 0; +- mutex_unlock(&s->ops_mutex); +- /* now, add the new card */ +- ds_event(skt, CS_EVENT_CARD_INSERTION, +- CS_EVENT_PRI_LOW); +- } +- break; +... +- } + +- pcmcia_put_socket(s); + +- return 0; +-} /* ds_event */ + +to: + ++static int pcmcia_bus_early_resume(struct pcmcia_socket *skt) ++{ ++ if (!verify_cis_cache(skt)) { ++ pcmcia_put_socket(skt); ++ return 0; ++ } + ++ dev_dbg(&skt->dev, "cis mismatch - different card\n"); + ++ /* first, remove the card */ ++ pcmcia_bus_remove(skt); ++ mutex_lock(&skt->ops_mutex); ++ destroy_cis_cache(skt); ++ kfree(skt->fake_cis); ++ skt->fake_cis = NULL; ++ skt->functions = 0; ++ mutex_unlock(&skt->ops_mutex); + ++ /* now, add the new card */ ++ pcmcia_bus_add(skt); ++ return 0; ++} + +As can be seen, the original function called pcmcia_get_socket() and +pcmcia_put_socket() around the guts, whereas the replacement code +calls pcmcia_put_socket() only in one path. This creates an imbalance +in the refcounting. + +Testing with pcmcia_put_socket() put removed shows that the bug is gone: + + dpm_suspend: c1a10998 [pcmcia_socket0] 5 + dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5 + dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5 + dpm_resume: c1a10998 [pcmcia_socket0] 5 + dpm_complete: c1a10998 [pcmcia_socket0] 5 + +Tested-by: Russell King +Signed-off-by: Russell King +Cc: Dominik Brodowski +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/ds.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/pcmcia/ds.c ++++ b/drivers/pcmcia/ds.c +@@ -1269,10 +1269,8 @@ static int pcmcia_bus_add(struct pcmcia_ + + static int pcmcia_bus_early_resume(struct pcmcia_socket *skt) + { +- if (!verify_cis_cache(skt)) { +- pcmcia_put_socket(skt); ++ if (!verify_cis_cache(skt)) + return 0; +- } + + dev_dbg(&skt->dev, "cis mismatch - different card\n"); + diff --git a/queue-3.2/series b/queue-3.2/series index 88e9d17bf5f..f221446be50 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -50,3 +50,23 @@ cifs-fix-oops-in-session-setup-code-for-null-user-mounts.patch atmel_lcdfb-fix-usage-of-contrast_ctr-in-suspend-resume.patch lockdep-bug-exclude-taint_firmware_workaround-from-disabling-lockdep.patch lockdep-bug-exclude-taint_oot_module-from-disabling-lock-debugging.patch +iscsi-target-fix-reject-release-handling-in-iscsit_free_cmd.patch +iscsi-target-fix-double-list_add-with-iscsit_alloc_buffs-reject.patch +iscsi-target-fix-discovery-with-inaddr_any-and-in6addr_any_init.patch +asoc-wm_hubs-fix-routing-of-input-pgas-to-line-output.patch +asoc-wm_hubs-correct-line-input-to-line-output-2-paths.patch +asoc-wm8962-fix-word-length-configuration.patch +asoc-wm8994-enabling-vmid-should-take-a-runtime-pm-reference.patch +asoc-wm8994-fix-typo-in-vmid-ramp-setting.patch +pcmcia-fix-socket-refcount-decrementing-on-each-resume.patch +alsa-oxygen-virtuoso-fix-exchanged-l-r-volumes-of-aux-and-cd-inputs.patch +iommu-amd-work-around-broken-ivrs-tables.patch +iommu-msm-fix-error-handling-in-msm_iommu_unmap.patch +mm-compaction-check-for-overlapping-nodes-during-isolation-for-migration.patch +mm-fix-up-thp-spin_is_locked-bugs.patch +target-use-correct-preempted-registration-sense-code.patch +target-allow-persistent-reserve-in-for-non-reservation-holder.patch +target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch +target-add-workaround-for-zero-length-control-cdb-handling.patch +target-return-correct-asc-for-unimplemented-vpd-pages.patch +target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch diff --git a/queue-3.2/target-add-workaround-for-zero-length-control-cdb-handling.patch b/queue-3.2/target-add-workaround-for-zero-length-control-cdb-handling.patch new file mode 100644 index 00000000000..505e94f0d7b --- /dev/null +++ b/queue-3.2/target-add-workaround-for-zero-length-control-cdb-handling.patch @@ -0,0 +1,59 @@ +From 91ec1d3535b2acf12c599045cc19ad9be3c6a47b Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Fri, 13 Jan 2012 12:01:34 -0800 +Subject: target: Add workaround for zero-length control CDB handling + +From: Nicholas Bellinger + +commit 91ec1d3535b2acf12c599045cc19ad9be3c6a47b upstream. + +This patch adds a work-around for handling zero allocation length +control CDBs (type SCF_SCSI_CONTROL_SG_IO_CDB) that was causing an +OOPs with the following raw calls: + + # sg_raw -v /dev/sdd 3 0 0 0 0 0 + # sg_raw -v /dev/sdd 0x1a 0 1 0 0 0 + +This patch will follow existing zero-length handling for data I/O +and silently return with GOOD status. This addresses the zero length +issue, but the proper long-term resolution for handling arbitary +allocation lengths will be to refactor out data-phase handling in +individual CDB emulation logic within target_core_cdb.c + +Reported-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3701,6 +3701,11 @@ transport_allocate_control_task(struct s + struct se_task *task; + unsigned long flags; + ++ /* Workaround for handling zero-length control CDBs */ ++ if ((cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB) && ++ !cmd->data_length) ++ return 0; ++ + task = transport_generic_get_task(cmd, cmd->data_direction); + if (!task) + return -ENOMEM; +@@ -3772,6 +3777,14 @@ int transport_generic_new_cmd(struct se_ + else if (!task_cdbs && (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)) { + cmd->t_state = TRANSPORT_COMPLETE; + atomic_set(&cmd->t_transport_active, 1); ++ ++ if (cmd->t_task_cdb[0] == REQUEST_SENSE) { ++ u8 ua_asc = 0, ua_ascq = 0; ++ ++ core_scsi3_ua_clear_for_request_sense(cmd, ++ &ua_asc, &ua_ascq); ++ } ++ + INIT_WORK(&cmd->work, target_complete_ok_work); + queue_work(target_completion_wq, &cmd->work); + return 0; diff --git a/queue-3.2/target-allow-persistent-reserve-in-for-non-reservation-holder.patch b/queue-3.2/target-allow-persistent-reserve-in-for-non-reservation-holder.patch new file mode 100644 index 00000000000..a344acd3ade --- /dev/null +++ b/queue-3.2/target-allow-persistent-reserve-in-for-non-reservation-holder.patch @@ -0,0 +1,32 @@ +From 6816966a8418b980481b4dced7eddd1796b145e8 Mon Sep 17 00:00:00 2001 +From: Marco Sanvido +Date: Tue, 3 Jan 2012 17:12:58 -0800 +Subject: target: Allow PERSISTENT RESERVE IN for non-reservation holder + +From: Marco Sanvido + +commit 6816966a8418b980481b4dced7eddd1796b145e8 upstream. + +Initiators that aren't the active reservation holder should be able to +do a PERSISTENT RESERVE IN command in all cases, so add it to the list +of allowed CDBs in core_scsi3_pr_seq_non_holder(). + +Signed-off-by: Marco Sanvido +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -481,6 +481,7 @@ static int core_scsi3_pr_seq_non_holder( + case READ_MEDIA_SERIAL_NUMBER: + case REPORT_LUNS: + case REQUEST_SENSE: ++ case PERSISTENT_RESERVE_IN: + ret = 0; /*/ Allowed CDBs */ + break; + default: diff --git a/queue-3.2/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch b/queue-3.2/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch new file mode 100644 index 00000000000..b3c119c67ae --- /dev/null +++ b/queue-3.2/target-correct-sense-key-for-invalid-field-in-parameter-list-cdb.patch @@ -0,0 +1,66 @@ +From 9fbc8909876a2160044e71d376848973b9bfdc3f Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Mon, 9 Jan 2012 17:54:00 -0800 +Subject: target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB} + +From: Roland Dreier + +commit 9fbc8909876a2160044e71d376848973b9bfdc3f upstream. + +According to SPC-4, the sense key for commands that are failed with +INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be +ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh). Without this +patch, a tcm_loop LUN incorrectly gives: + + # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0 + Sense Information: + Fixed format, current; Sense key: Aborted Command + Additional sense: Invalid field in cdb + Raw sense data (in hex): + 70 00 0b 00 00 00 00 0a 00 00 00 00 24 00 00 00 + 00 00 + +While a real SCSI disk gives: + + Sense Information: + Fixed format, current; Sense key: Illegal Request + Additional sense: Invalid field in cdb + Raw sense data (in hex): + 70 00 05 00 00 00 00 18 00 00 00 00 24 00 00 00 + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +with the main point being that the real disk gives a sense key of +ILLEGAL REQUEST (5h). + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -4403,8 +4403,8 @@ int transport_send_check_condition_and_s + /* CURRENT ERROR */ + buffer[offset] = 0x70; + buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10; +- /* ABORTED COMMAND */ +- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND; ++ /* ILLEGAL REQUEST */ ++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST; + /* INVALID FIELD IN CDB */ + buffer[offset+SPC_ASC_KEY_OFFSET] = 0x24; + break; +@@ -4412,8 +4412,8 @@ int transport_send_check_condition_and_s + /* CURRENT ERROR */ + buffer[offset] = 0x70; + buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10; +- /* ABORTED COMMAND */ +- buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND; ++ /* ILLEGAL REQUEST */ ++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST; + /* INVALID FIELD IN PARAMETER LIST */ + buffer[offset+SPC_ASC_KEY_OFFSET] = 0x26; + break; diff --git a/queue-3.2/target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch b/queue-3.2/target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch new file mode 100644 index 00000000000..9bed18e2ef4 --- /dev/null +++ b/queue-3.2/target-fail-inquiry-commands-with-evpd-0-but-page-code-0.patch @@ -0,0 +1,40 @@ +From bf0053550aebe56f3bb5dd793e9de69238b5b945 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Tue, 17 Jan 2012 18:00:57 -0800 +Subject: target: Fail INQUIRY commands with EVPD==0 but PAGE CODE!=0 + +From: Roland Dreier + +commit bf0053550aebe56f3bb5dd793e9de69238b5b945 upstream. + +My draft of SPC-4 says: + + If the PAGE CODE field is not set to zero when the EVPD bit is set + to zero, the command shall be terminated with CHECK CONDITION + status, with the sense key set to ILLEGAL REQUEST, and the + additional sense code set to INVALID FIELD IN CDB. + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_cdb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -701,6 +701,13 @@ int target_emulate_inquiry(struct se_tas + int p, ret; + + if (!(cdb[1] & 0x1)) { ++ if (cdb[2]) { ++ pr_err("INQUIRY with EVPD==0 but PAGE CODE=%02x\n", ++ cdb[2]); ++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD; ++ return -EINVAL; ++ } ++ + ret = target_emulate_inquiry_std(cmd); + goto out; + } diff --git a/queue-3.2/target-return-correct-asc-for-unimplemented-vpd-pages.patch b/queue-3.2/target-return-correct-asc-for-unimplemented-vpd-pages.patch new file mode 100644 index 00000000000..33f43644178 --- /dev/null +++ b/queue-3.2/target-return-correct-asc-for-unimplemented-vpd-pages.patch @@ -0,0 +1,35 @@ +From bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Tue, 17 Jan 2012 18:00:56 -0800 +Subject: target: Return correct ASC for unimplemented VPD pages + +From: Roland Dreier + +commit bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 upstream. + +My draft of SPC-4 says: + + If the device server does not implement the requested vital product + data page, then the command shall be terminated with CHECK CONDITION + status, with the sense key set to ILLEGAL REQUEST, and the + additional sense code set to INVALID FIELD IN CDB. + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_cdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -732,7 +732,7 @@ int target_emulate_inquiry(struct se_tas + } + + pr_err("Unknown VPD Code: 0x%02x\n", cdb[2]); +- cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE; ++ cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD; + ret = -EINVAL; + + out_unmap: diff --git a/queue-3.2/target-use-correct-preempted-registration-sense-code.patch b/queue-3.2/target-use-correct-preempted-registration-sense-code.patch new file mode 100644 index 00000000000..24f14885f09 --- /dev/null +++ b/queue-3.2/target-use-correct-preempted-registration-sense-code.patch @@ -0,0 +1,57 @@ +From 9e08e34e3735ae057eb3834da3570995811b7eb9 Mon Sep 17 00:00:00 2001 +From: Marco Sanvido +Date: Tue, 3 Jan 2012 17:12:57 -0800 +Subject: target: Use correct preempted registration sense code + +From: Marco Sanvido + +commit 9e08e34e3735ae057eb3834da3570995811b7eb9 upstream. + +The comments quote the right parts of the spec: + + * d) Establish a unit attention condition for the + * initiator port associated with every I_T nexus + * that lost its registration other than the I_T + * nexus on which the PERSISTENT RESERVE OUT command + * was received, with the additional sense code set + * to REGISTRATIONS PREEMPTED. + +and + + * e) Establish a unit attention condition for the initiator + * port associated with every I_T nexus that lost its + * persistent reservation and/or registration, with the + * additional sense code set to REGISTRATIONS PREEMPTED; + +but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED +instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED. Fix this. + +Signed-off-by: Marco Sanvido +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -3138,7 +3138,7 @@ static int core_scsi3_pro_preempt( + if (!calling_it_nexus) + core_scsi3_ua_allocate(pr_reg_nacl, + pr_res_mapped_lun, 0x2A, +- ASCQ_2AH_RESERVATIONS_PREEMPTED); ++ ASCQ_2AH_REGISTRATIONS_PREEMPTED); + } + spin_unlock(&pr_tmpl->registration_lock); + /* +@@ -3251,7 +3251,7 @@ static int core_scsi3_pro_preempt( + * additional sense code set to REGISTRATIONS PREEMPTED; + */ + core_scsi3_ua_allocate(pr_reg_nacl, pr_res_mapped_lun, 0x2A, +- ASCQ_2AH_RESERVATIONS_PREEMPTED); ++ ASCQ_2AH_REGISTRATIONS_PREEMPTED); + } + spin_unlock(&pr_tmpl->registration_lock); + /*