From 3aff9a7f2ab14b8059befb8d6e2b48bf28b54d66 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 18 Jul 2013 17:56:23 -0700 Subject: [PATCH] 3.10-stable patches added patches: arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch arm-dts-imx-cpus-cpu-nodes-dts-updates.patch arm-mm-fix-boot-on-sa1110-assabet.patch arm-shmobile-emev2-gio3-resource-fix.patch arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch handle-big-endianness-in-ntlm-ntlmv2-authentication.patch memcg-kmem-fix-reference-count-handling-on-the-error-path.patch mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch ubifs-correct-mount-message.patch --- ...d-the-user-mode-pc-in-the-call-chain.patch | 35 +++++ ...allocator-handle-suspended-animation.patch | 83 ++++++++++++ ...ut-of-bound-access-in-asid-allocator.patch | 76 +++++++++++ ...15-fix-erratum-798181-implementation.patch | 127 ++++++++++++++++++ ...uency-need-be-run-on-all-online-cpus.patch | 41 ++++++ ...m-dts-imx-cpus-cpu-nodes-dts-updates.patch | 106 +++++++++++++++ .../arm-mm-fix-boot-on-sa1110-assabet.patch | 32 +++++ ...arm-shmobile-emev2-gio3-resource-fix.patch | 43 ++++++ ...ile-r8a73a4-fix-resources-for-scifb0.patch | 36 +++++ ...locking-in-pl330_free_chan_resources.patch | 68 ++++++++++ ...anness-in-ntlm-ntlmv2-authentication.patch | 80 +++++++++++ ...nce-count-handling-on-the-error-path.patch | 60 +++++++++ ...em-count-overflow-when-offline-pages.patch | 79 +++++++++++ queue-3.10/series | 14 ++ queue-3.10/ubifs-correct-mount-message.patch | 34 +++++ 15 files changed, 914 insertions(+) create mode 100644 queue-3.10/arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch create mode 100644 queue-3.10/arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch create mode 100644 queue-3.10/arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch create mode 100644 queue-3.10/arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch create mode 100644 queue-3.10/arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch create mode 100644 queue-3.10/arm-dts-imx-cpus-cpu-nodes-dts-updates.patch create mode 100644 queue-3.10/arm-mm-fix-boot-on-sa1110-assabet.patch create mode 100644 queue-3.10/arm-shmobile-emev2-gio3-resource-fix.patch create mode 100644 queue-3.10/arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch create mode 100644 queue-3.10/drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch create mode 100644 queue-3.10/handle-big-endianness-in-ntlm-ntlmv2-authentication.patch create mode 100644 queue-3.10/memcg-kmem-fix-reference-count-handling-on-the-error-path.patch create mode 100644 queue-3.10/mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch create mode 100644 queue-3.10/ubifs-correct-mount-message.patch diff --git a/queue-3.10/arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch b/queue-3.10/arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch new file mode 100644 index 00000000000..ad755f71bb8 --- /dev/null +++ b/queue-3.10/arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch @@ -0,0 +1,35 @@ +From c5f927a6f62196226915f12194c9d0df4e2210d7 Mon Sep 17 00:00:00 2001 +From: Jed Davis +Date: Thu, 20 Jun 2013 10:16:29 +0100 +Subject: ARM: 7765/1: perf: Record the user-mode PC in the call chain. + +From: Jed Davis + +commit c5f927a6f62196226915f12194c9d0df4e2210d7 upstream. + +With this change, we no longer lose the innermost entry in the user-mode +part of the call chain. See also the x86 port, which includes the ip. + +It's possible to partially work around this problem by post-processing +the data to use the PERF_SAMPLE_IP value, but this works only if the CPU +wasn't in the kernel when the sample was taken. + +Signed-off-by: Jed Davis +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/perf_event.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/kernel/perf_event.c ++++ b/arch/arm/kernel/perf_event.c +@@ -569,6 +569,7 @@ perf_callchain_user(struct perf_callchai + return; + } + ++ perf_callchain_store(entry, regs->ARM_pc); + tail = (struct frame_tail __user *)regs->ARM_fp - 1; + + while ((entry->nr < PERF_MAX_STACK_DEPTH) && diff --git a/queue-3.10/arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch b/queue-3.10/arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch new file mode 100644 index 00000000000..f00026d911f --- /dev/null +++ b/queue-3.10/arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch @@ -0,0 +1,83 @@ +From ae120d9edfe96628f03d87634acda0bfa7110632 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 21 Jun 2013 12:06:19 +0100 +Subject: ARM: 7767/1: let the ASID allocator handle suspended animation + +From: Marc Zyngier + +commit ae120d9edfe96628f03d87634acda0bfa7110632 upstream. + +When a CPU is running a process, the ASID for that process is +held in a per-CPU variable (the "active ASIDs" array). When +the ASID allocator handles a rollover, it copies the active +ASIDs into a "reserved ASIDs" array to ensure that a process +currently running on another CPU will continue to run unaffected. +The active array is zero-ed to indicate that a rollover occurred. + +Because of this mechanism, a reserved ASID is only remembered for +a single rollover. A subsequent rollover will completely refill +the reserved ASIDs array. + +In a severely oversubscribed environment where a CPU can be +prevented from running for extended periods of time (think virtual +machines), the above has a horrible side effect: + +[P{a} denotes process P running with ASID a] + + CPU-0 CPU-1 + + A{x} [active = ] + + [suspended] runs B{y} [active = ] + + [rollover: + active = <0 0> + reserved = ] + + runs B{y} [active = <0 y> + reserved = ] + + [rollover: + active = <0 0> + reserved = <0 y>] + + runs C{x} [active = <0 x>] + + [resumes] + + runs A{x} + +At that stage, both A and C have the same ASID, with deadly +consequences. + +The fix is to preserve reserved ASIDs across rollovers if +the CPU doesn't have an active ASID when the rollover occurs. + +Acked-by: Will Deacon +Acked-by: Catalin Carinas +Signed-off-by: Marc Zyngier +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/context.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arm/mm/context.c ++++ b/arch/arm/mm/context.c +@@ -128,6 +128,15 @@ static void flush_context(unsigned int c + asid = 0; + } else { + asid = atomic64_xchg(&per_cpu(active_asids, i), 0); ++ /* ++ * If this CPU has already been through a ++ * rollover, but hasn't run another task in ++ * the meantime, we must preserve its reserved ++ * ASID, as this is the only trace we have of ++ * the process it is still running. ++ */ ++ if (asid == 0) ++ asid = per_cpu(reserved_asids, i); + __set_bit(ASID_TO_IDX(asid), asid_map); + } + per_cpu(reserved_asids, i) = asid; diff --git a/queue-3.10/arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch b/queue-3.10/arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch new file mode 100644 index 00000000000..9d79be661c5 --- /dev/null +++ b/queue-3.10/arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch @@ -0,0 +1,76 @@ +From b8e4a4740fa2b17c0a447b3ab783b3dc10702e27 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 21 Jun 2013 12:06:55 +0100 +Subject: ARM: 7768/1: prevent risks of out-of-bound access in ASID allocator + +From: Marc Zyngier + +commit b8e4a4740fa2b17c0a447b3ab783b3dc10702e27 upstream. + +On a CPU that never ran anything, both the active and reserved ASID +fields are set to zero. In this case the ASID_TO_IDX() macro will +return -1, which is not a very useful value to index a bitmap. + +Instead of trying to offset the ASID so that ASID #1 is actually +bit 0 in the asid_map bitmap, just always ignore bit 0 and start +the search from bit 1. This makes the code a bit more readable, +and without risk of OoB access. + +Acked-by: Will Deacon +Acked-by: Catalin Marinas +Reported-by: Catalin Marinas +Signed-off-by: Marc Zyngier +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/context.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/arch/arm/mm/context.c ++++ b/arch/arm/mm/context.c +@@ -39,10 +39,7 @@ + * non 64-bit operations. + */ + #define ASID_FIRST_VERSION (1ULL << ASID_BITS) +-#define NUM_USER_ASIDS (ASID_FIRST_VERSION - 1) +- +-#define ASID_TO_IDX(asid) ((asid & ~ASID_MASK) - 1) +-#define IDX_TO_ASID(idx) ((idx + 1) & ~ASID_MASK) ++#define NUM_USER_ASIDS ASID_FIRST_VERSION + + static DEFINE_RAW_SPINLOCK(cpu_asid_lock); + static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION); +@@ -137,7 +134,7 @@ static void flush_context(unsigned int c + */ + if (asid == 0) + asid = per_cpu(reserved_asids, i); +- __set_bit(ASID_TO_IDX(asid), asid_map); ++ __set_bit(asid & ~ASID_MASK, asid_map); + } + per_cpu(reserved_asids, i) = asid; + } +@@ -176,17 +173,19 @@ static u64 new_context(struct mm_struct + /* + * Allocate a free ASID. If we can't find one, take a + * note of the currently active ASIDs and mark the TLBs +- * as requiring flushes. ++ * as requiring flushes. We always count from ASID #1, ++ * as we reserve ASID #0 to switch via TTBR0 and indicate ++ * rollover events. + */ +- asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS); ++ asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1); + if (asid == NUM_USER_ASIDS) { + generation = atomic64_add_return(ASID_FIRST_VERSION, + &asid_generation); + flush_context(cpu); +- asid = find_first_zero_bit(asid_map, NUM_USER_ASIDS); ++ asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1); + } + __set_bit(asid, asid_map); +- asid = generation | IDX_TO_ASID(asid); ++ asid |= generation; + cpumask_clear(mm_cpumask(mm)); + } + diff --git a/queue-3.10/arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch b/queue-3.10/arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch new file mode 100644 index 00000000000..95829274668 --- /dev/null +++ b/queue-3.10/arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch @@ -0,0 +1,127 @@ +From 0d0752bca1f9a91fb646647aa4abbb21156f316c Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 21 Jun 2013 12:07:27 +0100 +Subject: ARM: 7769/1: Cortex-A15: fix erratum 798181 implementation + +From: Marc Zyngier + +commit 0d0752bca1f9a91fb646647aa4abbb21156f316c upstream. + +Looking into the active_asids array is not enough, as we also need +to look into the reserved_asids array (they both represent processes +that are currently running). + +Also, not holding the ASID allocator lock is racy, as another CPU +could schedule that process and trigger a rollover, making the erratum +workaround miss an IPI. + +Exposing this outside of context.c is a little ugly on the side, so +let's define a new entry point that the erratum workaround can call +to obtain the cpumask. + +Acked-by: Will Deacon +Acked-by: Catalin Marinas +Signed-off-by: Marc Zyngier +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/mmu_context.h | 10 +++++++++- + arch/arm/kernel/smp_tlb.c | 18 ++---------------- + arch/arm/mm/context.c | 29 ++++++++++++++++++++++++++++- + 3 files changed, 39 insertions(+), 18 deletions(-) + +--- a/arch/arm/include/asm/mmu_context.h ++++ b/arch/arm/include/asm/mmu_context.h +@@ -27,7 +27,15 @@ void __check_vmalloc_seq(struct mm_struc + void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk); + #define init_new_context(tsk,mm) ({ atomic64_set(&mm->context.id, 0); 0; }) + +-DECLARE_PER_CPU(atomic64_t, active_asids); ++#ifdef CONFIG_ARM_ERRATA_798181 ++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm, ++ cpumask_t *mask); ++#else /* !CONFIG_ARM_ERRATA_798181 */ ++static inline void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm, ++ cpumask_t *mask) ++{ ++} ++#endif /* CONFIG_ARM_ERRATA_798181 */ + + #else /* !CONFIG_CPU_HAS_ASID */ + +--- a/arch/arm/kernel/smp_tlb.c ++++ b/arch/arm/kernel/smp_tlb.c +@@ -103,7 +103,7 @@ static void broadcast_tlb_a15_erratum(vo + + static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm) + { +- int cpu, this_cpu; ++ int this_cpu; + cpumask_t mask = { CPU_BITS_NONE }; + + if (!erratum_a15_798181()) +@@ -111,21 +111,7 @@ static void broadcast_tlb_mm_a15_erratum + + dummy_flush_tlb_a15_erratum(); + this_cpu = get_cpu(); +- for_each_online_cpu(cpu) { +- if (cpu == this_cpu) +- continue; +- /* +- * We only need to send an IPI if the other CPUs are running +- * the same ASID as the one being invalidated. There is no +- * need for locking around the active_asids check since the +- * switch_mm() function has at least one dmb() (as required by +- * this workaround) in case a context switch happens on +- * another CPU after the condition below. +- */ +- if (atomic64_read(&mm->context.id) == +- atomic64_read(&per_cpu(active_asids, cpu))) +- cpumask_set_cpu(cpu, &mask); +- } ++ a15_erratum_get_cpumask(this_cpu, mm, &mask); + smp_call_function_many(&mask, ipi_flush_tlb_a15_erratum, NULL, 1); + put_cpu(); + } +--- a/arch/arm/mm/context.c ++++ b/arch/arm/mm/context.c +@@ -45,10 +45,37 @@ static DEFINE_RAW_SPINLOCK(cpu_asid_lock + static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION); + static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS); + +-DEFINE_PER_CPU(atomic64_t, active_asids); ++static DEFINE_PER_CPU(atomic64_t, active_asids); + static DEFINE_PER_CPU(u64, reserved_asids); + static cpumask_t tlb_flush_pending; + ++#ifdef CONFIG_ARM_ERRATA_798181 ++void a15_erratum_get_cpumask(int this_cpu, struct mm_struct *mm, ++ cpumask_t *mask) ++{ ++ int cpu; ++ unsigned long flags; ++ u64 context_id, asid; ++ ++ raw_spin_lock_irqsave(&cpu_asid_lock, flags); ++ context_id = mm->context.id.counter; ++ for_each_online_cpu(cpu) { ++ if (cpu == this_cpu) ++ continue; ++ /* ++ * We only need to send an IPI if the other CPUs are ++ * running the same ASID as the one being invalidated. ++ */ ++ asid = per_cpu(active_asids, cpu).counter; ++ if (asid == 0) ++ asid = per_cpu(reserved_asids, cpu); ++ if (context_id == asid) ++ cpumask_set_cpu(cpu, mask); ++ } ++ raw_spin_unlock_irqrestore(&cpu_asid_lock, flags); ++} ++#endif ++ + #ifdef CONFIG_ARM_LPAE + static void cpu_set_reserved_ttbr0(void) + { diff --git a/queue-3.10/arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch b/queue-3.10/arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch new file mode 100644 index 00000000000..ed2c1a20ca9 --- /dev/null +++ b/queue-3.10/arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch @@ -0,0 +1,41 @@ +From cbbe6f82b489e7ceba4ad7c833bd3a76cd0084cb Mon Sep 17 00:00:00 2001 +From: Jason Liu +Date: Mon, 1 Jul 2013 09:53:30 +0100 +Subject: ARM: 7778/1: smp_twd: twd_update_frequency need be run on all online CPUs + +From: Jason Liu + +commit cbbe6f82b489e7ceba4ad7c833bd3a76cd0084cb upstream. + +When the local timer freq changed, the twd_update_frequency function +should be run all the CPUs include itself, otherwise, the twd freq will +not get updated and the local timer will not run correcttly. + +smp_call_function will run functions on all other CPUs, but not include +himself, this is not correct,use on_each_cpu instead to fix this issue. + +Acked-by: Linus Walleij +Cc: Linus Walleij +Cc: Rob Herring +Cc: Shawn Guo +Cc: Arnd Bergmann +Acked-by: Shawn Guo +Signed-off-by: Jason Liu +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/smp_twd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/kernel/smp_twd.c ++++ b/arch/arm/kernel/smp_twd.c +@@ -120,7 +120,7 @@ static int twd_rate_change(struct notifi + * changing cpu. + */ + if (flags == POST_RATE_CHANGE) +- smp_call_function(twd_update_frequency, ++ on_each_cpu(twd_update_frequency, + (void *)&cnd->new_rate, 1); + + return NOTIFY_OK; diff --git a/queue-3.10/arm-dts-imx-cpus-cpu-nodes-dts-updates.patch b/queue-3.10/arm-dts-imx-cpus-cpu-nodes-dts-updates.patch new file mode 100644 index 00000000000..8266987f9b6 --- /dev/null +++ b/queue-3.10/arm-dts-imx-cpus-cpu-nodes-dts-updates.patch @@ -0,0 +1,106 @@ +From 7925e89f54fc49bcd1e73f0a65c4a3eb35b9cfb1 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Thu, 18 Apr 2013 18:34:06 +0100 +Subject: ARM: dts: imx: cpus/cpu nodes dts updates + +From: Lorenzo Pieralisi + +commit 7925e89f54fc49bcd1e73f0a65c4a3eb35b9cfb1 upstream. + +This patch updates the in-kernel dts files according to the latest cpus +and cpu bindings updates for ARM. + +Signed-off-by: Lorenzo Pieralisi +Acked-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx23.dtsi | 8 ++++++-- + arch/arm/boot/dts/imx28.dtsi | 8 ++++++-- + arch/arm/boot/dts/imx6dl.dtsi | 2 ++ + arch/arm/boot/dts/imx6q.dtsi | 4 ++++ + 4 files changed, 18 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/imx23.dtsi ++++ b/arch/arm/boot/dts/imx23.dtsi +@@ -23,8 +23,12 @@ + }; + + cpus { +- cpu@0 { +- compatible = "arm,arm926ejs"; ++ #address-cells = <0>; ++ #size-cells = <0>; ++ ++ cpu { ++ compatible = "arm,arm926ej-s"; ++ device_type = "cpu"; + }; + }; + +--- a/arch/arm/boot/dts/imx28.dtsi ++++ b/arch/arm/boot/dts/imx28.dtsi +@@ -32,8 +32,12 @@ + }; + + cpus { +- cpu@0 { +- compatible = "arm,arm926ejs"; ++ #address-cells = <0>; ++ #size-cells = <0>; ++ ++ cpu { ++ compatible = "arm,arm926ej-s"; ++ device_type = "cpu"; + }; + }; + +--- a/arch/arm/boot/dts/imx6dl.dtsi ++++ b/arch/arm/boot/dts/imx6dl.dtsi +@@ -18,12 +18,14 @@ + + cpu@0 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <0>; + next-level-cache = <&L2>; + }; + + cpu@1 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <1>; + next-level-cache = <&L2>; + }; +--- a/arch/arm/boot/dts/imx6q.dtsi ++++ b/arch/arm/boot/dts/imx6q.dtsi +@@ -18,6 +18,7 @@ + + cpu@0 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <0>; + next-level-cache = <&L2>; + operating-points = < +@@ -39,18 +40,21 @@ + + cpu@1 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <1>; + next-level-cache = <&L2>; + }; + + cpu@2 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <2>; + next-level-cache = <&L2>; + }; + + cpu@3 { + compatible = "arm,cortex-a9"; ++ device_type = "cpu"; + reg = <3>; + next-level-cache = <&L2>; + }; diff --git a/queue-3.10/arm-mm-fix-boot-on-sa1110-assabet.patch b/queue-3.10/arm-mm-fix-boot-on-sa1110-assabet.patch new file mode 100644 index 00000000000..a8a3faa368c --- /dev/null +++ b/queue-3.10/arm-mm-fix-boot-on-sa1110-assabet.patch @@ -0,0 +1,32 @@ +From 319e0b4f02f73983c03a2ca38595fc6367929edf Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 9 Jul 2013 09:52:55 +0100 +Subject: ARM: mm: fix boot on SA1110 Assabet + +From: Russell King + +commit 319e0b4f02f73983c03a2ca38595fc6367929edf upstream. + +Commit 83db0384 (mm/ARM: use common help functions to free reserved +pages) broke booting on the Assabet by trying to convert a PFN to +a virtual address using the __va() macro. This macro takes the +physical address, not a PFN. Fix this. + +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -600,7 +600,7 @@ void __init mem_init(void) + + #ifdef CONFIG_SA1111 + /* now that our DMA memory is actually so designated, we can free it */ +- free_reserved_area(__va(PHYS_PFN_OFFSET), swapper_pg_dir, 0, NULL); ++ free_reserved_area(__va(PHYS_OFFSET), swapper_pg_dir, 0, NULL); + #endif + + free_highpages(); diff --git a/queue-3.10/arm-shmobile-emev2-gio3-resource-fix.patch b/queue-3.10/arm-shmobile-emev2-gio3-resource-fix.patch new file mode 100644 index 00000000000..b00f3d72158 --- /dev/null +++ b/queue-3.10/arm-shmobile-emev2-gio3-resource-fix.patch @@ -0,0 +1,43 @@ +From 1eb14ea1e6bcd11d6d0ba937fc39808bb4d3453e Mon Sep 17 00:00:00 2001 +From: Magnus Damm +Date: Mon, 1 Jul 2013 20:48:07 +0900 +Subject: ARM: shmobile: emev2 GIO3 resource fix + +From: Magnus Damm + +commit 1eb14ea1e6bcd11d6d0ba937fc39808bb4d3453e upstream. + +Fix GIO3 base addresses for EMEV2. + +This bug was introduced by 088efd9273b5076a0aead479aa31f1066d182b3e +("mach-shmobile: Emma Mobile EV2 GPIO support V3") which was included in v3.5. + +Signed-off-by: Magnus Damm +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/setup-emev2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-shmobile/setup-emev2.c ++++ b/arch/arm/mach-shmobile/setup-emev2.c +@@ -287,14 +287,14 @@ static struct gpio_em_config gio3_config + static struct resource gio3_resources[] = { + [0] = { + .name = "GIO_096", +- .start = 0xe0050100, +- .end = 0xe005012b, ++ .start = 0xe0050180, ++ .end = 0xe00501ab, + .flags = IORESOURCE_MEM, + }, + [1] = { + .name = "GIO_096", +- .start = 0xe0050140, +- .end = 0xe005015f, ++ .start = 0xe00501c0, ++ .end = 0xe00501df, + .flags = IORESOURCE_MEM, + }, + [2] = { diff --git a/queue-3.10/arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch b/queue-3.10/arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch new file mode 100644 index 00000000000..8d9cefafab0 --- /dev/null +++ b/queue-3.10/arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch @@ -0,0 +1,36 @@ +From f820b60582f75e73e83b8505d7e48fe59770f558 Mon Sep 17 00:00:00 2001 +From: Takanari Hayama +Date: Mon, 1 Jul 2013 16:38:53 +0900 +Subject: ARM: shmobile: r8a73a4: Fix resources for SCIFB0 + +From: Takanari Hayama + +commit f820b60582f75e73e83b8505d7e48fe59770f558 upstream. + +Fix base address and IRQ resources associated with SCIFB0. + +This bug was introduced by e481a528901d0cd18b5b5fcbdc55207ea3b6ef68 +("ARM: shmobile: r8a73a4 SCIF support V3") which was included in v3.10. + +Signed-off-by: Takanari Hayama +Acked-by: Magnus Damm +[ horms+renesas@verge.net.au: Add information about commit and version + this bug was added in ] +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/setup-r8a73a4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-shmobile/setup-r8a73a4.c ++++ b/arch/arm/mach-shmobile/setup-r8a73a4.c +@@ -62,7 +62,7 @@ enum { SCIFA0, SCIFA1, SCIFB0, SCIFB1, S + static const struct plat_sci_port scif[] = { + SCIFA_DATA(SCIFA0, 0xe6c40000, gic_spi(144)), /* SCIFA0 */ + SCIFA_DATA(SCIFA1, 0xe6c50000, gic_spi(145)), /* SCIFA1 */ +- SCIFB_DATA(SCIFB0, 0xe6c50000, gic_spi(145)), /* SCIFB0 */ ++ SCIFB_DATA(SCIFB0, 0xe6c20000, gic_spi(148)), /* SCIFB0 */ + SCIFB_DATA(SCIFB1, 0xe6c30000, gic_spi(149)), /* SCIFB1 */ + SCIFB_DATA(SCIFB2, 0xe6ce0000, gic_spi(150)), /* SCIFB2 */ + SCIFB_DATA(SCIFB3, 0xe6cf0000, gic_spi(151)), /* SCIFB3 */ diff --git a/queue-3.10/drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch b/queue-3.10/drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch new file mode 100644 index 00000000000..adb215068fa --- /dev/null +++ b/queue-3.10/drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch @@ -0,0 +1,68 @@ +From da331ba8e9c5de72a27e50f71105395bba6eebe0 Mon Sep 17 00:00:00 2001 +From: Bartlomiej Zolnierkiewicz +Date: Wed, 3 Jul 2013 15:00:43 -0700 +Subject: drivers/dma/pl330.c: fix locking in pl330_free_chan_resources() + +From: Bartlomiej Zolnierkiewicz + +commit da331ba8e9c5de72a27e50f71105395bba6eebe0 upstream. + +tasklet_kill() may sleep so call it before taking pch->lock. + +Fixes following lockup: + + BUG: scheduling while atomic: cat/2383/0x00000002 + Modules linked in: + unwind_backtrace+0x0/0xfc + __schedule_bug+0x4c/0x58 + __schedule+0x690/0x6e0 + sys_sched_yield+0x70/0x78 + tasklet_kill+0x34/0x8c + pl330_free_chan_resources+0x24/0x88 + dma_chan_put+0x4c/0x50 + [...] + BUG: spinlock lockup suspected on CPU#0, swapper/0/0 + lock: 0xe52aa04c, .magic: dead4ead, .owner: cat/2383, .owner_cpu: 1 + unwind_backtrace+0x0/0xfc + do_raw_spin_lock+0x194/0x204 + _raw_spin_lock_irqsave+0x20/0x28 + pl330_tasklet+0x2c/0x5a8 + tasklet_action+0xfc/0x114 + __do_softirq+0xe4/0x19c + irq_exit+0x98/0x9c + handle_IPI+0x124/0x16c + gic_handle_irq+0x64/0x68 + __irq_svc+0x40/0x70 + cpuidle_wrap_enter+0x4c/0xa0 + cpuidle_enter_state+0x18/0x68 + cpuidle_idle_call+0xac/0xe0 + cpu_idle+0xac/0xf0 + +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Kyungmin Park +Acked-by: Jassi Brar +Cc: Vinod Koul +Cc: Tomasz Figa +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/pl330.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2485,10 +2485,10 @@ static void pl330_free_chan_resources(st + struct dma_pl330_chan *pch = to_pchan(chan); + unsigned long flags; + +- spin_lock_irqsave(&pch->lock, flags); +- + tasklet_kill(&pch->task); + ++ spin_lock_irqsave(&pch->lock, flags); ++ + pl330_release_channel(pch->pl330_chid); + pch->pl330_chid = NULL; + diff --git a/queue-3.10/handle-big-endianness-in-ntlm-ntlmv2-authentication.patch b/queue-3.10/handle-big-endianness-in-ntlm-ntlmv2-authentication.patch new file mode 100644 index 00000000000..74411212734 --- /dev/null +++ b/queue-3.10/handle-big-endianness-in-ntlm-ntlmv2-authentication.patch @@ -0,0 +1,80 @@ +From fdf96a907c1fbb93c633e2b7ede3b8df26d6a4c0 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Tue, 25 Jun 2013 14:03:16 -0500 +Subject: Handle big endianness in NTLM (ntlmv2) authentication + +From: Steve French + +commit fdf96a907c1fbb93c633e2b7ede3b8df26d6a4c0 upstream. + +This is RH bug 970891 +Uppercasing of username during calculation of ntlmv2 hash fails +because UniStrupr function does not handle big endian wchars. + +Also fix a comment in the same code to reflect its correct usage. + +[To make it easier for stable (rather than require 2nd patch) fixed +this patch of Shirish's to remove endian warning generated +by sparse -- steve f.] + +Reported-by: steve +Signed-off-by: Shirish Pargaonkar +Reviewed-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifs_unicode.h | 8 ++++---- + fs/cifs/cifsencrypt.c | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/cifs/cifs_unicode.h ++++ b/fs/cifs/cifs_unicode.h +@@ -327,14 +327,14 @@ UniToupper(register wchar_t uc) + /* + * UniStrupr: Upper case a unicode string + */ +-static inline wchar_t * +-UniStrupr(register wchar_t *upin) ++static inline __le16 * ++UniStrupr(register __le16 *upin) + { +- register wchar_t *up; ++ register __le16 *up; + + up = upin; + while (*up) { /* For all characters */ +- *up = UniToupper(*up); ++ *up = cpu_to_le16(UniToupper(le16_to_cpu(*up))); + up++; + } + return upin; /* Return input pointer */ +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -414,7 +414,7 @@ static int calc_ntlmv2_hash(struct cifs_ + int rc = 0; + int len; + char nt_hash[CIFS_NTHASH_SIZE]; +- wchar_t *user; ++ __le16 *user; + wchar_t *domain; + wchar_t *server; + +@@ -439,7 +439,7 @@ static int calc_ntlmv2_hash(struct cifs_ + return rc; + } + +- /* convert ses->user_name to unicode and uppercase */ ++ /* convert ses->user_name to unicode */ + len = ses->user_name ? strlen(ses->user_name) : 0; + user = kmalloc(2 + (len * 2), GFP_KERNEL); + if (user == NULL) { +@@ -448,7 +448,7 @@ static int calc_ntlmv2_hash(struct cifs_ + } + + if (len) { +- len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp); ++ len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp); + UniStrupr(user); + } else { + memset(user, '\0', 2); diff --git a/queue-3.10/memcg-kmem-fix-reference-count-handling-on-the-error-path.patch b/queue-3.10/memcg-kmem-fix-reference-count-handling-on-the-error-path.patch new file mode 100644 index 00000000000..6618ed2a014 --- /dev/null +++ b/queue-3.10/memcg-kmem-fix-reference-count-handling-on-the-error-path.patch @@ -0,0 +1,60 @@ +From f37a96914d1aea10fed8d9af10251f0b9caea31b Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Mon, 8 Jul 2013 16:00:29 -0700 +Subject: memcg, kmem: fix reference count handling on the error path + +From: Michal Hocko + +commit f37a96914d1aea10fed8d9af10251f0b9caea31b upstream. + +mem_cgroup_css_online calls mem_cgroup_put if memcg_init_kmem fails. +This is not correct because only memcg_propagate_kmem takes an +additional reference while mem_cgroup_sockets_init is allowed to fail as +well (although no current implementation fails) but it doesn't take any +reference. This all suggests that it should be memcg_propagate_kmem +that should clean up after itself so this patch moves mem_cgroup_put +over there. + +Unfortunately this is not that easy (as pointed out by Li Zefan) because +memcg_kmem_mark_dead marks the group dead (KMEM_ACCOUNTED_DEAD) if it is +marked active (KMEM_ACCOUNTED_ACTIVE) which is the case even if +memcg_propagate_kmem fails so the additional reference is dropped in +that case in kmem_cgroup_destroy which means that the reference would be +dropped two times. + +The easiest way then would be to simply remove mem_cgrroup_put from +mem_cgroup_css_online and rely on kmem_cgroup_destroy doing the right +thing. + +Signed-off-by: Michal Hocko +Signed-off-by: Li Zefan +Acked-by: KAMEZAWA Hiroyuki +Cc: Hugh Dickins +Cc: Tejun Heo +Cc: Glauber Costa +Cc: Johannes Weiner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6296,14 +6296,6 @@ mem_cgroup_css_online(struct cgroup *con + + error = memcg_init_kmem(memcg, &mem_cgroup_subsys); + mutex_unlock(&memcg_create_mutex); +- if (error) { +- /* +- * We call put now because our (and parent's) refcnts +- * are already in place. mem_cgroup_put() will internally +- * call __mem_cgroup_free, so return directly +- */ +- mem_cgroup_put(memcg); +- } + return error; + } + diff --git a/queue-3.10/mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch b/queue-3.10/mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch new file mode 100644 index 00000000000..89d707bc06b --- /dev/null +++ b/queue-3.10/mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch @@ -0,0 +1,79 @@ +From cea27eb2a202959783f81254c48c250ddd80e129 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Wed, 3 Jul 2013 15:02:40 -0700 +Subject: mm/memory-hotplug: fix lowmem count overflow when offline pages + +From: Wanpeng Li + +commit cea27eb2a202959783f81254c48c250ddd80e129 upstream. + +The logic for the memory-remove code fails to correctly account the +Total High Memory when a memory block which contains High Memory is +offlined as shown in the example below. The following patch fixes it. + +Before logic memory remove: + +MemTotal: 7603740 kB +MemFree: 6329612 kB +Buffers: 94352 kB +Cached: 872008 kB +SwapCached: 0 kB +Active: 626932 kB +Inactive: 519216 kB +Active(anon): 180776 kB +Inactive(anon): 222944 kB +Active(file): 446156 kB +Inactive(file): 296272 kB +Unevictable: 0 kB +Mlocked: 0 kB +HighTotal: 7294672 kB +HighFree: 5704696 kB +LowTotal: 309068 kB +LowFree: 624916 kB + +After logic memory remove: + +MemTotal: 7079452 kB +MemFree: 5805976 kB +Buffers: 94372 kB +Cached: 872000 kB +SwapCached: 0 kB +Active: 626936 kB +Inactive: 519236 kB +Active(anon): 180780 kB +Inactive(anon): 222944 kB +Active(file): 446156 kB +Inactive(file): 296292 kB +Unevictable: 0 kB +Mlocked: 0 kB +HighTotal: 7294672 kB +HighFree: 5181024 kB +LowTotal: 4294752076 kB +LowFree: 624952 kB + +[mhocko@suse.cz: fix CONFIG_HIGHMEM=n build] +Signed-off-by: Wanpeng Li +Reviewed-by: Michal Hocko +Cc: KAMEZAWA Hiroyuki +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -6142,6 +6142,10 @@ __offline_isolated_pages(unsigned long s + list_del(&page->lru); + rmv_page_order(page); + zone->free_area[order].nr_free--; ++#ifdef CONFIG_HIGHMEM ++ if (PageHighMem(page)) ++ totalhigh_pages -= 1 << order; ++#endif + for (i = 0; i < (1 << order); i++) + SetPageReserved((page+i)); + pfn += (1 << order); diff --git a/queue-3.10/series b/queue-3.10/series index 22a1563ba94..66319e1cd94 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -56,3 +56,17 @@ ext4-fix-overflow-when-counting-used-blocks-on-32-bit-architectures.patch ext4-fix-ext4_get_group_number.patch ext4-don-t-show-usrquota-grpquota-twice-in-proc-mounts.patch ext4-don-t-allow-ext4_free_blocks-to-fail-due-to-enomem.patch +arm-7765-1-perf-record-the-user-mode-pc-in-the-call-chain.patch +arm-7767-1-let-the-asid-allocator-handle-suspended-animation.patch +arm-7768-1-prevent-risks-of-out-of-bound-access-in-asid-allocator.patch +arm-7769-1-cortex-a15-fix-erratum-798181-implementation.patch +arm-7778-1-smp_twd-twd_update_frequency-need-be-run-on-all-online-cpus.patch +arm-dts-imx-cpus-cpu-nodes-dts-updates.patch +arm-shmobile-r8a73a4-fix-resources-for-scifb0.patch +arm-shmobile-emev2-gio3-resource-fix.patch +arm-mm-fix-boot-on-sa1110-assabet.patch +drivers-dma-pl330.c-fix-locking-in-pl330_free_chan_resources.patch +memcg-kmem-fix-reference-count-handling-on-the-error-path.patch +mm-memory-hotplug-fix-lowmem-count-overflow-when-offline-pages.patch +handle-big-endianness-in-ntlm-ntlmv2-authentication.patch +ubifs-correct-mount-message.patch diff --git a/queue-3.10/ubifs-correct-mount-message.patch b/queue-3.10/ubifs-correct-mount-message.patch new file mode 100644 index 00000000000..b00fcce451a --- /dev/null +++ b/queue-3.10/ubifs-correct-mount-message.patch @@ -0,0 +1,34 @@ +From beadadfa5467e09e36891f39cae1f5d8d3bbf17e Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 2 Apr 2013 12:24:37 +0200 +Subject: UBIFS: correct mount message + +From: Richard Genoud + +commit beadadfa5467e09e36891f39cae1f5d8d3bbf17e upstream. + +When mounting an UBIFS R/W volume, we have the message: +UBIFS: mounted UBI device 0, volume 1, name "rootfs"(null) +With this patch, we'll have: +UBIFS: mounted UBI device 0, volume 1, name "rootfs" +Which is, I think, what was intended. + +Signed-off-by: Richard Genoud +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1412,7 +1412,7 @@ static int mount_ubifs(struct ubifs_info + + ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"%s", + c->vi.ubi_num, c->vi.vol_id, c->vi.name, +- c->ro_mount ? ", R/O mode" : NULL); ++ c->ro_mount ? ", R/O mode" : ""); + x = (long long)c->main_lebs * c->leb_size; + y = (long long)c->log_lebs * c->leb_size + c->max_bud_bytes; + ubifs_msg("LEB size: %d bytes (%d KiB), min./max. I/O unit sizes: %d bytes/%d bytes", -- 2.47.3