Finally we have a build fix for fsl-mxc-udc UDC driver.
We also have a fix for ep0 maxburst setting on DWC3
which could confuse the HW if we tell it we had way
too many streams on that endpoint when it _has_ to be
only one.
cppi_dma support for MUSB got a fix when running as a
module. By dropping the wrong __init annotation, the
function will be available even when we're modules and
we're done with .init.text section.
Last, but not least, we have a fix on FunctionFS which
was causing a bug on our option parsing algorithm.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJQ+T2OAAoJEIaOsuA1yqRE/eEP/jJTOGu8LJegFohGFSVY80RK
IuMhPCRa3uE26YFaP6OQOFHwVSrzMYfITcptQQsrQKv6zE25m+ZYOpD7pL8MQV8q
YNhvBS44G7j42akQVoE0kqN00PCWyQgjGxx93+NSOik8IOUy4s9Em8yTkAsXwGa6
CHId1KmEgEq3IbT/+XJAEjMvV7FHONF7p08LK1riPRtIC7sb6BODjdAPKj5Hv5r6
o2xta0LslSNHMIs8CUpeK6qol9n6n9Oz7NRj2yEFiC/bebLjQ0X0Eo44QfwkLtqj
u3hFL1BPfv39U47fmAugZqeelKfmPgpohY+CUrCc2Wqrvo1aae7nEJrU4xQV02WH
kFj1I8EVtcSmq9TvnXaAW75MNPRUtKAJsxWTTVqTIzPBRYvVv0i+8whDDSiEj+xN
FlqzpHd1ojKnqk+BS9nI9XXPGFV022xecPGj5rg9gTEuoutYndHl2LDBB+u6lraP
FnhUHkQ4UtJH3yzuZ3Xv7ugrGK9FQX3zJKtXJXS85QTNtFlL80cK3Ph12d6xOCs1
oGadH0wdCOE4lEjeTloaaC+/tMuiSWzLPQBcIUC5IAXrH9zLXuFnkB6RFEqspSJH
ebFeJRNKodOaZxge4YbO2/kaY2MQa1hJfzlJtXexZNCKxK7iA+fL9a70KgmWJUs+
DwPlhoa+JFwJLSYVnOow
=4n68
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-v3.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v3.8-rc5
Finally we have a build fix for fsl-mxc-udc UDC driver.
We also have a fix for ep0 maxburst setting on DWC3
which could confuse the HW if we tell it we had way
too many streams on that endpoint when it _has_ to be
only one.
cppi_dma support for MUSB got a fix when running as a
module. By dropping the wrong __init annotation, the
function will be available even when we're modules and
we're done with .init.text section.
Last, but not least, we have a fix on FunctionFS which
was causing a bug on our option parsing algorithm.
Add the UART2 muxing data to the board file (this used to be,
erroneously, done in the bootloader).
Cc: stable <stable@vger.kernel.org> [3.7]
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
The iterator correctly handles of_node_put() calls.
Remove it before continue'ing the loop.
Without this patch you get the following with
CONFIG_OF_DYNAMIC set:
ERROR: Bad of_node_put() on /ocp/timer@44e31000!
[<c001329c>] (unwind_backtrace+0x0/0xe0) from [<c03dd8f0>] (of_node_release+0x2c/0xa0)!
[<c03dd8f0>] (of_node_release+0x2c/0xa0) from [<c03ddea0>] (of_find_matching_node_and_match+0x78/0x90)!
[<c03ddea0>] (of_find_matching_node_and_match+0x78/0x90) from [<c06d349c>] (omap_get_timer_dt+0x78/0x90)!
[<c06d349c>] (omap_get_timer_dt+0x78/0x90) from [<c06d3664>] (omap_dm_timer_init_one.clone.2+0x34/0x2bc)!
[<c06d3664>] (omap_dm_timer_init_one.clone.2+0x34/0x2bc) from [<c06d3a2c>] (omap2_gptimer_clocksource_init.clone.4+0x24/0xa8)!
[<c06d3a2c>] (omap2_gptimer_clocksource_init.clone.4+0x24/0xa8) from [<c06cca58>] (time_init+0x20/0x30)!
[<c06cca58>] (time_init+0x20/0x30) from [<c06c9690>] (start_kernel+0x1a8/0x2fc)!
Signed-off-by: Pantelis Antoniou <panto@antoniou-consulting.com>
Acked-by: Jon Hunter <jon-hunter@ti.com>
[tony@atomide.com: updated description per Jon]
Signed-off-by: Tony Lindgren <tony@atomide.com>
Otherwise we will get:
WARNING: vmlinux.o(.text+0x1d4f0): Section mismatch in reference from the
function omap_init_ocp2scp() to the function .init.text:omap_device_build()
The function omap_init_ocp2scp() references
the function __init omap_device_build().
This is often because omap_init_ocp2scp lacks a __init
annotation or the annotation of omap_device_build is wrong.
Signed-off-by: Tony Lindgren <tony@atomide.com>
If some other kernel subsystem has a module notifier, and adds a kprobe
to a ftrace mcount point (now that kprobes work on ftrace points),
when the ftrace notifier runs it will fail and disable ftrace, as well
as kprobes that are attached to ftrace points.
Here's the error:
WARNING: at kernel/trace/ftrace.c:1618 ftrace_bug+0x239/0x280()
Hardware name: Bochs
Modules linked in: fat(+) stap_56d28a51b3fe546293ca0700b10bcb29__8059(F) nfsv4 auth_rpcgss nfs dns_resolver fscache xt_nat iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack lockd sunrpc ppdev parport_pc parport microcode virtio_net i2c_piix4 drm_kms_helper ttm drm i2c_core [last unloaded: bid_shared]
Pid: 8068, comm: modprobe Tainted: GF 3.7.0-0.rc8.git0.1.fc19.x86_64 #1
Call Trace:
[<ffffffff8105e70f>] warn_slowpath_common+0x7f/0xc0
[<ffffffff81134106>] ? __probe_kernel_read+0x46/0x70
[<ffffffffa0180000>] ? 0xffffffffa017ffff
[<ffffffffa0180000>] ? 0xffffffffa017ffff
[<ffffffff8105e76a>] warn_slowpath_null+0x1a/0x20
[<ffffffff810fd189>] ftrace_bug+0x239/0x280
[<ffffffff810fd626>] ftrace_process_locs+0x376/0x520
[<ffffffff810fefb7>] ftrace_module_notify+0x47/0x50
[<ffffffff8163912d>] notifier_call_chain+0x4d/0x70
[<ffffffff810882f8>] __blocking_notifier_call_chain+0x58/0x80
[<ffffffff81088336>] blocking_notifier_call_chain+0x16/0x20
[<ffffffff810c2a23>] sys_init_module+0x73/0x220
[<ffffffff8163d719>] system_call_fastpath+0x16/0x1b
---[ end trace 9ef46351e53bbf80 ]---
ftrace failed to modify [<ffffffffa0180000>] init_once+0x0/0x20 [fat]
actual: cc:bb:d2:4b:e1
A kprobe was added to the init_once() function in the fat module on load.
But this happened before ftrace could have touched the code. As ftrace
didn't run yet, the kprobe system had no idea it was a ftrace point and
simply added a breakpoint to the code (0xcc in the cc:bb:d2:4b:e1).
Then when ftrace went to modify the location from a call to mcount/fentry
into a nop, it didn't see a call op, but instead it saw the breakpoint op
and not knowing what to do with it, ftrace shut itself down.
The solution is to simply give the ftrace module notifier the max priority.
This should have been done regardless, as the core code ftrace modification
also happens very early on in boot up. This makes the module modification
closer to core modification.
Link: http://lkml.kernel.org/r/20130107140333.593683061@goodmis.org
Cc: stable@vger.kernel.org
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Reported-by: Frank Ch. Eigler <fche@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Basic test logs are available here:
http://www.pwsan.com/omap/testlogs/prcm_fixes_c_v3.8-rc/20130121073904/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJQ/WNjAAoJEMePsQ0LvSpLV3QP/jBxqb1eDRn+9P58y793XZ8K
0/eAHGkoNTPvBMOtTFnblg4uGNHu6zpCkrWcu0xE8WXNh9wkadXnWHI3iEyoUr2r
lRePxBbdIrWzVxQvxxa4ebHiJo/kmk5fs7Pv+xFVRUTHRnQgsCf0aX0RUGwA1XmC
2Qz79coH/MtceGSquOguc//9PWsiQebZtjl/PIz5V3HL3xxlKsA/p9vtpoVFSt8x
QgVgtYKB8lMidwToEzR+xErj4t4ollGGs7v02Mx3+4BNqZtsx8ZFrEgxMhBM0cbQ
s/wa9hB7z6wPM5CDhMbjmhcD6GHFoT/XELkFfn7QQCW3mr1Dur0hzH2n/KBE9bCV
E9vyE65d8FM9J5+2HpCQdMdxG74kBajzUKEtQ6O4E8zBEyBgav3u3z/efvM1STyH
Aeo9HtwDswGJm0Ijt9lI52/foIXQfU63TutvEo5bTGgHsucs0TKns25IElyyrzmh
n3zig72WNi47ZnYL/jMuJZZ8YSv1CMDSTOBJdhhr+j/aEXxbKa51TbNCm346u567
W3KjNobRIoZqht+k2dMt5fCAxta/cyNvrTy+o3kFk/POaV7i5XXfQTDyHiBVAqBA
fHple1lg2QB9rJBMswBuNaEHDhCj+lMVukkQC/NZKSe1C4+woplXm2FutQJZFflT
rY9wA3LHkCGkHsxcSpBw
=RtJt
-----END PGP SIGNATURE-----
Merge tag 'omap-fixes-b-for-v3.8-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending into omap-for-v3.8-rc4/fixes
A few OMAP integration fixes for v3.8-rc, for OMAP4 audio and OMAP2 reboot.
Basic test logs are available here:
http://www.pwsan.com/omap/testlogs/prcm_fixes_c_v3.8-rc/20130121073904/
The init_completion() call does reinit not only the variable carrying
the flag that the completion finished, but also initialized the
waitqueue associated with the completion. On the contrary, the
INIT_COMPLETION() call only reinits the flag.
In case there was anything still stuck in the waitqueue, subsequent call
to init_completion() would be able to create possible race condition. This
patch uses the proper function and moves init_completion() into .probe() call
of the driver, to be issued only once.
Note that such scenario is impossible, since two threads can never enter the
mxs_i2c_xfer_msg(), since whole this section is protected by mutex in I2C core.
This by no means allows this issue to exit though.
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
srcip_matches() previously had code like this:
srcip_matches(..., struct sockaddr *rhs) {
/* ... */
struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *) &rhs;
return ipv6_addr_equal(..., &vaddr6->sin6_addr);
}
which interpreted the values on the stack after the 'rhs' pointer as an
ipv6 address. The correct thing to do is to use 'rhs', not '&rhs'.
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Pull drm fixes from Dave Airlie:
"A bunch of intel and radeon fixes, along with two fixes to TTM code.
The correct fix for the Intel ironlake failure is in this, and should
make things more stable, along with some misc radeon fixes."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
ttm: on move memory failure don't leave a node dangling
ttm: don't destroy old mm_node on memcpy failure
Revert "drm/radeon: do not move bo to different placement at each cs"
drm/i915: fix FORCEWAKE posting reads
drm/i915: Invalidate the relocation presumed_offsets along the slow path
drm/i915/eDP: do not write power sequence registers for ghost eDP
drm/radeon: improve semaphore debugging on lockup
drm/radeon: allow FP16 color clear registers on r500
drm/radeon: clear reset flags if engines are idle
drm/i915: Record DERRMR, FORCEWAKE and RING_CTL in error-state
Commit 1fb9341ac3 ("module: put modules in list much earlier") moved
some of the module initialization code around, and in the process
changed the exit paths too. But for the duplicate export symbol error
case the change made the ddebug_cleanup path jump to after the module
mutex unlock, even though it happens with the mutex held.
Rusty has some patches to split this function up into some helper
functions, hopefully the mess of complex goto targets will go away
eventually.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
if we have a move notify callback, when moving fails, we call move notify
the opposite way around, however this ends up with *mem containing the mm_node
from the bo, which means we double free it. This is a follow on to the previous
fix.
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
When we are using memcpy to move objects around, and we fail to memcpy
due to lack of memory to populate or failure to finish the copy, we don't
want to destroy the mm_node that has been copied into old_copy.
While working on a new kms driver that uses memcpy, if I overallocated bo's
up to the memory limits, and eviction failed, then machine would oops soon
after due to having an active bo with an already freed drm_mm embedded in it,
freeing it a second time didn't end well.
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
More important fixes for 3.9:
- error_state improvements to help debug the new scanline wait code added
for gen6+ - bug reports started popping up :( patch from Chris Wilson.
- fix a panel power sequence confusion between the eDP and lvds detection
code resulting in black screens - regression introduce in 3.8 (Jani
Nikula)
- Chris fixed the root-cause of the ilk relocation vs. evict bug.
- Another piece of cargo-culted rc6 lore from Jani, fixes up a regression
where a system refused to go into rc6 after suspend sometimes.
* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
drm/i915: fix FORCEWAKE posting reads
drm/i915: Invalidate the relocation presumed_offsets along the slow path
drm/i915/eDP: do not write power sequence registers for ghost eDP
drm/i915: Record DERRMR, FORCEWAKE and RING_CTL in error-state
A number of fixes, and one revert for a patch having some wierd side effects.
* 'drm-fixes-3.8' of git://people.freedesktop.org/~agd5f/linux:
Revert "drm/radeon: do not move bo to different placement at each cs"
drm/radeon: improve semaphore debugging on lockup
drm/radeon: allow FP16 color clear registers on r500
drm/radeon: clear reset flags if engines are idle
problem introduced recently by kvm id changes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJQ/IaJAAoJENkgDmzRrbjxOjAQAIrI9+Jo3Lsxk1v9gXeo9xn2
ST4LNv7/oW2+3NFBOkKsGVpcXe1JtGySIXyx9k+dELPa5xe4Rs4HE3pHQj/VoEx8
FKz3oUXSHkuh+paKuFXvZ2u/z0/FI99GmqHPObvGQ4iS3hTXAibzO83yYYPxwApq
Zq4kof/dAcVVPLm8fGVAMPA2Rbh/WmjDfrIv8gv71QkDjtRLzcr40VIgky5cvu7V
FWcBl4/DVoKkGnDPsLDhLK9QGqgBGhFIlNIcVX4Jv50DiCibOyzdjeUXYxMftoGr
Rw56hHwGpPdqbRIjBkR071vIl/mlXTmxIv+d77vZNBin2MIBwAzCQXo8I1/HojCK
/wKhI+RFj0J5DaDo/BTB80cmI3X2oah5sRUebW6vd9HjunhFFndg4mVeDNPa0E0+
F72xWlj79BjdIOuD06TLg6Tg2klL49nC8bUc0wrsh6onEjhd9v7Cp/X/rxi5cKYW
eEv3oLkKwUHoheF9gBlpnT0Yyl/HpFe+nemblzj/ybRKnk4A5vtJqV9eZnqoOS16
lgIkKOpgXT9dzSom2EL/f4sMCeLLYC44DQwOvxNKt/BdMY0r5y8OLaJORXQGfEDF
Ztvu2G8PmELxV0B3JZcGR/zOcKxpOBsrGoVn0/EQIul3A/0C0ID7i5zwJAyX6LP7
V+6vyF2eHMf10tB0rbfB
=SpOo
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux
Pull module fixes and a virtio block fix from Rusty Russell:
"Various minor fixes, but a slightly more complex one to fix the
per-cpu overload problem introduced recently by kvm id changes."
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
module: put modules in list much earlier.
module: add new state MODULE_STATE_UNFORMED.
module: prevent warning when finit_module a 0 sized file
virtio-blk: Don't free ida when disk is in use
Improve driver logging to be more helpful
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There is a race between disabling and enabling the tx queue, resulting
in tx timeouts. Since all the tx timeout does is re-enable the tx
queue, simple remove the start/stop of the queue and the tx timeout
routine.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If ntb_netdev is unable to pass a new skb to the ntb transport for
future rx packets, it should free the newly alloc'ed skb in the error
case. Found by Kernel memory leak detector.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove init/exit from probe/remove routines to correct warnings of
"Section mismatch".
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If the NTB client driver enqueues the maximum number of rx buffers, it
will not be able to re-enqueue another in its callback handler due to a
lack of free entries. This can be avoided by adding the current entry
to the free queue prior to calling the client callback handler. With
this change, ntb_netdev will no longer encounter a rx error on its first
packet.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CPU reads across NTB are slow(er) and can hang the local system if an
ECC error is encountered on the remote. To work around the need for a
read, have the remote side write its current position in the rx buffer
to the local system's buffer and use that to see if there is room when
transmitting.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Correct gcc warning of using too much stack debugfs_read. This is done
by kmallocing the buffer instead of using the char array on stack.
Also, shrinking the buffer to something closer to what is currently
being used.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Declare ntb_bus_type static to remove it from name space, and remove
unused ntb_get_max_spads function. Found via `make namespacecheck`.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use simple_open for debugfs instead of recreating it in the NTB driver.
Caught by coccicheck.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move all cancel_delayed_work_sync to a work thread to prevent sleeping
in interrupt context (when the NTB link goes down). Caught via
'Sleep inside atomic section checking'
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Since it is possible for the memory windows on the two NTB connected
systems to be different sizes, the divergent sizes must be accounted for
in the segmentation of the MW's on each side. Create separate size
variables and initialization as necessary.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mmiowb is not sufficient to flush the data and is causing data
corruption. Change to wmb and the data corruption is no more.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Attempts to probe client ntb drivers without ntb hardware present will
result in null pointer dereference due to the lack of the ntb bus device
being registers. Check to see if this is the case, and fail all calls
by the clients registering their drivers.
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull misc syscall fixes from Al Viro:
- compat syscall fixes (discussed back in December)
- a couple of "make life easier for sigaltstack stuff by reducing
inter-tree dependencies"
- fix up compiler/asmlinkage calling convention disagreement of
sys_clone()
- misc
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:
sys_clone() needs asmlinkage_protect
make sure that /linuxrc has std{in,out,err}
x32: fix sigtimedwait
x32: fix waitid()
switch compat_sys_wait4() and compat_sys_waitid() to COMPAT_SYSCALL_DEFINE
switch compat_sys_sigaltstack() to COMPAT_SYSCALL_DEFINE
CONFIG_GENERIC_SIGALTSTACK build breakage with asm-generic/syscalls.h
Ensure that kernel_init_freeable() is not inlined into non __init code
The ia64 function "thread_matches()" has no users since commit
e868a55c2a ("[IA64] remove find_thread_for_addr()"). Remove it.
This allows us to make ptrace_check_attach() static to kernel/ptrace.c,
which is good since we'll need to change the semantics of it and fix up
all the callers.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Operation-specific check (whether subvol is readonly or not) should go
after the mutual exclusiveness check.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
The error code that is returned in response to starting a mutually
exclusive operation when there is one already running got silently
changed from EINVAL to EINPROGRESS by 5ac00add. Returning EINPROGRESS
to, say, add_dev, when rm_dev is running is misleading. Furthermore,
the operation itself may want to use EINPROGRESS for other purposes.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Balance pause/resume logic got broken by 5ac00add (went in into 3.8-rc1
as part of dev-replace merge). Offending commit took a stab at making
mutually exclusive volume operations (add_dev, rm_dev, resize, balance,
replace_dev) not block behind volume_mutex if another such operation is
in progress and instead return an error right away. Balancing front-end
relied on the blocking behaviour, so the fix is ugly, but short of a
complete rework, it's the best we can do.
Reported-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Commit 8fb54284ba {ARM: mm: Add strongly ordered descriptor support}
added XN flag at section level but missed it at PTE level.
Fix it by adding the L_PTE_XN to MT_MEMORY_SO PTE descriptor.
Reported-by: Richard Woodruff <r-woodruff2@ti.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Subhash Jadavani reported this partial backtrace:
Now consider this call stack from MMC block driver (this is on the ARMv7
based board):
[<c001b50c>] (v7_dma_inv_range+0x30/0x48) from [<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c)
[<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c) from [<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c)
[<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c) from [<c0017ff8>] (dma_map_sg+0x3c/0x114)
This is caused by incrementing the struct page pointer, and running off
the end of the sparsemem page array. Fix this by incrementing by pfn
instead, and convert the pfn to a struct page.
Cc: <stable@vger.kernel.org>
Suggested-by: James Bottomley <JBottomley@Parallels.com>
Tested-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
The bit width check was introduced by 15afae60 (ACPI, APEI: Fix
incorrect APEI register bit width check and usage), and a fixup
for incorrect 32-bit width memory address was given by f712c71
(ACPI, APEI: Fixup common access width firmware bug). Now there
is a similar symptom:
[Firmware Bug]: APEI: Invalid bit width + offset in GAR [0x12345000/64/0/3/0]
Another bogus BIOS reports an incorrect 64-bit width in trigger table.
Thus, apply to a similar workaround for 64-bit width memory address.
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
Acked-by: Gary Hade <garyhade@us.ibm.com>
Acked-by: Myron Stowe <myron.stowe@redhat.com>
Acked-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Greg Kroah-Hartman