From: Greg Kroah-Hartman Date: Sun, 8 Jun 2014 02:04:35 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.14.7~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c15ed09d6771047817198ecb5055f856f31277db;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: arm-8051-1-put_user-fix-possible-data-corruption-in-put_user.patch arm-8064-1-fix-v7-m-signal-return.patch arm-imx-fix-error-handling-in-ipu-device-registration.patch arm-omap2-nand-fix-nand-on-omap2-and-omap3-boards.patch arm-omap3-clock-back-propagate-rate-change-from-cam_mclk-to-dpll4_m5-on-all-omap3-platforms.patch arm-omap4-fix-the-boot-regression-with-cpu_idle-enabled.patch arm-omap5-hwmod_data-correct-idlemode-for-mcpdm.patch cpufreq-cpu0-drop-wrong-devm-usage.patch cpufreq-remove-race-while-accessing-cur_policy.patch dm-cache-always-split-discards-on-cache-block-boundaries.patch dm-thin-add-no_space_timeout-dm-thin-pool-module-param.patch firewire-revert-to-4-gb-rdma-fix-protocols-using-memory-space.patch mips-fix-typo-when-reporting-cache-and-ftlb-errors-for-imgtec-cores.patch --- diff --git a/queue-3.14/arm-8051-1-put_user-fix-possible-data-corruption-in-put_user.patch b/queue-3.14/arm-8051-1-put_user-fix-possible-data-corruption-in-put_user.patch new file mode 100644 index 00000000000..9a825534514 --- /dev/null +++ b/queue-3.14/arm-8051-1-put_user-fix-possible-data-corruption-in-put_user.patch @@ -0,0 +1,37 @@ +From 537094b64b229bf3ad146042f83e74cf6abe59df Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin +Date: Wed, 7 May 2014 08:07:25 +0100 +Subject: ARM: 8051/1: put_user: fix possible data corruption in put_user + +From: Andrey Ryabinin + +commit 537094b64b229bf3ad146042f83e74cf6abe59df upstream. + +According to arm procedure call standart r2 register is call-cloberred. +So after the result of x expression was put into r2 any following +function call in p may overwrite r2. To fix this, the result of p +expression must be saved to the temporary variable before the +assigment x expression to __r2. + +Signed-off-by: Andrey Ryabinin +Reviewed-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/uaccess.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -171,8 +171,9 @@ extern int __put_user_8(void *, unsigned + #define __put_user_check(x,p) \ + ({ \ + unsigned long __limit = current_thread_info()->addr_limit - 1; \ ++ const typeof(*(p)) __user *__tmp_p = (p); \ + register const typeof(*(p)) __r2 asm("r2") = (x); \ +- register const typeof(*(p)) __user *__p asm("r0") = (p);\ ++ register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \ + register unsigned long __l asm("r1") = __limit; \ + register int __e asm("r0"); \ + switch (sizeof(*(__p))) { \ diff --git a/queue-3.14/arm-8064-1-fix-v7-m-signal-return.patch b/queue-3.14/arm-8064-1-fix-v7-m-signal-return.patch new file mode 100644 index 00000000000..197267d69bb --- /dev/null +++ b/queue-3.14/arm-8064-1-fix-v7-m-signal-return.patch @@ -0,0 +1,46 @@ +From 483a6c9d447f625b991fa04a1530493d893984db Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Sat, 24 May 2014 17:38:01 +0100 +Subject: ARM: 8064/1: fix v7-M signal return +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rabin Vincent + +commit 483a6c9d447f625b991fa04a1530493d893984db upstream. + +According to the ARM ARM, the behaviour is UNPREDICTABLE if the PC read +from the exception return stack is not half word aligned. See the +pseudo code for ExceptionReturn() and PopStack(). + +The signal handler's address has the bit 0 set, and setup_return() +directly writes this to regs->ARM_pc. Current hardware happens to +discard this bit, but QEMU's emulation doesn't and this makes processes +crash. Mask out bit 0 before the exception return in order to get +predictable behaviour. + +Fixes: 19c4d593f0b4 ("ARM: ARMv7-M: Add support for exception handling") + +Acked-by: Uwe Kleine-König +Signed-off-by: Rabin Vincent +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/entry-header.S | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm/kernel/entry-header.S ++++ b/arch/arm/kernel/entry-header.S +@@ -132,6 +132,10 @@ + orrne r5, V7M_xPSR_FRAMEPTRALIGN + biceq r5, V7M_xPSR_FRAMEPTRALIGN + ++ @ ensure bit 0 is cleared in the PC, otherwise behaviour is ++ @ unpredictable ++ bic r4, #1 ++ + @ write basic exception frame + stmdb r2!, {r1, r3-r5} + ldmia sp, {r1, r3-r5} diff --git a/queue-3.14/arm-imx-fix-error-handling-in-ipu-device-registration.patch b/queue-3.14/arm-imx-fix-error-handling-in-ipu-device-registration.patch new file mode 100644 index 00000000000..7a043868703 --- /dev/null +++ b/queue-3.14/arm-imx-fix-error-handling-in-ipu-device-registration.patch @@ -0,0 +1,39 @@ +From d1d70e5dc2cfa9047bb935c41ba808ebb8135696 Mon Sep 17 00:00:00 2001 +From: Emil Goode +Date: Mon, 19 May 2014 15:07:54 +0800 +Subject: ARM: imx: fix error handling in ipu device registration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Emil Goode + +commit d1d70e5dc2cfa9047bb935c41ba808ebb8135696 upstream. + +If we fail to allocate struct platform_device pdev we +dereference it after the goto label err. + +This bug was found using coccinelle. + +Fixes: afa77ef (ARM: mx3: dynamically allocate "ipu-core" devices) +Signed-off-by: Emil Goode +Acked-by: Uwe Kleine-König +Signed-off-by: Shawn Guo +Signed-off-by: Olof Johansson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/devices/platform-ipu-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-imx/devices/platform-ipu-core.c ++++ b/arch/arm/mach-imx/devices/platform-ipu-core.c +@@ -77,7 +77,7 @@ struct platform_device *__init imx_alloc + + pdev = platform_device_alloc("mx3-camera", 0); + if (!pdev) +- goto err; ++ return ERR_PTR(-ENOMEM); + + pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL); + if (!pdev->dev.dma_mask) diff --git a/queue-3.14/arm-omap2-nand-fix-nand-on-omap2-and-omap3-boards.patch b/queue-3.14/arm-omap2-nand-fix-nand-on-omap2-and-omap3-boards.patch new file mode 100644 index 00000000000..3659ad7426a --- /dev/null +++ b/queue-3.14/arm-omap2-nand-fix-nand-on-omap2-and-omap3-boards.patch @@ -0,0 +1,39 @@ +From 5005e0b76781c37d0a16dd6dd17d015098e8ce92 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Fri, 16 May 2014 14:45:40 -0700 +Subject: ARM: OMAP2+: nand: Fix NAND on OMAP2 and OMAP3 boards + +From: Roger Quadros + +commit 5005e0b76781c37d0a16dd6dd17d015098e8ce92 upstream. + +Commit c66d039197e4 broke NAND for non-DT boot on all OMAP2 and OMAP3 +boards using board_nand_init(). Following error is seen at boot + +[ 0.154998] (null): Unsupported NAND ECC scheme selected + +For OMAP2 and OMAP3 platforms, the ecc_opt parameter in platform data +must be set to OMAP_ECC_HAM1_CODE_HW to work properly. + +Tested on omap3-beagle c4. + +Fixes: c66d039197e4 (mtd: nand: omap: combine different flavours of 1-bit hamming ecc schemes) +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/board-flash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/board-flash.c ++++ b/arch/arm/mach-omap2/board-flash.c +@@ -142,7 +142,7 @@ __init board_nand_init(struct mtd_partit + board_nand_data.nr_parts = nr_parts; + board_nand_data.devsize = nand_type; + +- board_nand_data.ecc_opt = OMAP_ECC_BCH8_CODE_HW; ++ board_nand_data.ecc_opt = OMAP_ECC_HAM1_CODE_HW; + gpmc_nand_init(&board_nand_data, gpmc_t); + } + #endif /* CONFIG_MTD_NAND_OMAP2 || CONFIG_MTD_NAND_OMAP2_MODULE */ diff --git a/queue-3.14/arm-omap3-clock-back-propagate-rate-change-from-cam_mclk-to-dpll4_m5-on-all-omap3-platforms.patch b/queue-3.14/arm-omap3-clock-back-propagate-rate-change-from-cam_mclk-to-dpll4_m5-on-all-omap3-platforms.patch new file mode 100644 index 00000000000..f6b3c22c3be --- /dev/null +++ b/queue-3.14/arm-omap3-clock-back-propagate-rate-change-from-cam_mclk-to-dpll4_m5-on-all-omap3-platforms.patch @@ -0,0 +1,38 @@ +From 98d7e1aee6dd534f468993f8c6a1bc730d4cfa81 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 21 Apr 2014 15:06:23 +0200 +Subject: ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5 on all OMAP3 platforms +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +commit 98d7e1aee6dd534f468993f8c6a1bc730d4cfa81 upstream. + +Commit 7b2e1277598e4187c9be3e61fd9b0f0423f97986 ("ARM: OMAP3: clock: +Back-propagate rate change from cam_mclk to dpll4_m5") enabled clock +rate back-propagation from cam_mclk do dpll4_m5 on OMAP3630 only. +Perform back-propagation on other OMAP3 platforms as well. + +Reported-by: Jean-Philippe François +Signed-off-by: Laurent Pinchart +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/cclock3xxx_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/cclock3xxx_data.c ++++ b/arch/arm/mach-omap2/cclock3xxx_data.c +@@ -456,7 +456,8 @@ static struct clk_hw_omap dpll4_m5x2_ck_ + .clkdm_name = "dpll4_clkdm", + }; + +-DEFINE_STRUCT_CLK(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, dpll4_m5x2_ck_ops); ++DEFINE_STRUCT_CLK_FLAGS(dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, ++ dpll4_m5x2_ck_ops, CLK_SET_RATE_PARENT); + + static struct clk dpll4_m5x2_ck_3630 = { + .name = "dpll4_m5x2_ck", diff --git a/queue-3.14/arm-omap4-fix-the-boot-regression-with-cpu_idle-enabled.patch b/queue-3.14/arm-omap4-fix-the-boot-regression-with-cpu_idle-enabled.patch new file mode 100644 index 00000000000..eca1975e2e9 --- /dev/null +++ b/queue-3.14/arm-omap4-fix-the-boot-regression-with-cpu_idle-enabled.patch @@ -0,0 +1,122 @@ +From 4b353a706a86598ba47307c47301c3c428b79e09 Mon Sep 17 00:00:00 2001 +From: Santosh Shilimkar +Date: Mon, 12 May 2014 17:37:59 -0400 +Subject: ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled + +From: Santosh Shilimkar + +commit 4b353a706a86598ba47307c47301c3c428b79e09 upstream. + +On OMAP4 panda board, there have been several bug reports about boot +hang and lock-ups with CPU_IDLE enabled. The root cause of the issue +is missing interrupts while in idle state. Commit cb7094e8 {cpuidle / omap4 : +use CPUIDLE_FLAG_TIMER_STOP flag} moved the broadcast notifiers to common +code for right reasons but on OMAP4 which suffers from a nasty ROM code +bug with GIC, commit ff999b8a {ARM: OMAP4460: Workaround for ROM bug ..}, +we loose interrupts which leads to issues like lock-up, hangs etc. + +Patch reverts commit cb7094 {cpuidle / omap4 : use CPUIDLE_FLAG_TIMER_STOP +flag} and 54769d6 {cpuidle: OMAP4: remove timer broadcast initialization} to +avoid the issue. With this change, OMAP4 panda boards, the mentioned +issues are getting fixed. We no longer loose interrupts which was the cause +of the regression. + +Fixes: cb7094e8 (cpuidle / omap4 : use CPUIDLE_FLAG_TIMER_STOP flag) +Fixes: ff999b8a (cpuidle: OMAP4: remove timer broadcast initialization) +Cc: Roger Quadros +Cc: Kevin Hilman +Cc: Tony Lindgren +Cc: Daniel Lezcano +Reported-tested-by: Roger Quadros +Reported-tested-by: Kevin Hilman +Tested-by: Tony Lindgren +Signed-off-by: Santosh Shilimkar +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/cpuidle44xx.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -83,6 +84,7 @@ static int omap_enter_idle_coupled(struc + { + struct idle_statedata *cx = state_ptr + index; + u32 mpuss_can_lose_context = 0; ++ int cpu_id = smp_processor_id(); + + /* + * CPU0 has to wait and stay ON until CPU1 is OFF state. +@@ -110,6 +112,8 @@ static int omap_enter_idle_coupled(struc + mpuss_can_lose_context = (cx->mpu_state == PWRDM_POWER_RET) && + (cx->mpu_logic_state == PWRDM_POWER_OFF); + ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu_id); ++ + /* + * Call idle CPU PM enter notifier chain so that + * VFP and per CPU interrupt context is saved. +@@ -165,6 +169,8 @@ static int omap_enter_idle_coupled(struc + if (dev->cpu == 0 && mpuss_can_lose_context) + cpu_cluster_pm_exit(); + ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu_id); ++ + fail: + cpuidle_coupled_parallel_barrier(dev, &abort_barrier); + cpu_done[dev->cpu] = false; +@@ -172,6 +178,16 @@ fail: + return index; + } + ++/* ++ * For each cpu, setup the broadcast timer because local timers ++ * stops for the states above C1. ++ */ ++static void omap_setup_broadcast_timer(void *arg) ++{ ++ int cpu = smp_processor_id(); ++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ON, &cpu); ++} ++ + static struct cpuidle_driver omap4_idle_driver = { + .name = "omap4_idle", + .owner = THIS_MODULE, +@@ -189,8 +205,7 @@ static struct cpuidle_driver omap4_idle_ + /* C2 - CPU0 OFF + CPU1 OFF + MPU CSWR */ + .exit_latency = 328 + 440, + .target_residency = 960, +- .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED | +- CPUIDLE_FLAG_TIMER_STOP, ++ .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED, + .enter = omap_enter_idle_coupled, + .name = "C2", + .desc = "CPUx OFF, MPUSS CSWR", +@@ -199,8 +214,7 @@ static struct cpuidle_driver omap4_idle_ + /* C3 - CPU0 OFF + CPU1 OFF + MPU OSWR */ + .exit_latency = 460 + 518, + .target_residency = 1100, +- .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED | +- CPUIDLE_FLAG_TIMER_STOP, ++ .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_COUPLED, + .enter = omap_enter_idle_coupled, + .name = "C3", + .desc = "CPUx OFF, MPUSS OSWR", +@@ -231,5 +245,8 @@ int __init omap4_idle_init(void) + if (!cpu_clkdm[0] || !cpu_clkdm[1]) + return -ENODEV; + ++ /* Configure the broadcast timer on each cpu */ ++ on_each_cpu(omap_setup_broadcast_timer, NULL, 1); ++ + return cpuidle_register(&omap4_idle_driver, cpu_online_mask); + } diff --git a/queue-3.14/arm-omap5-hwmod_data-correct-idlemode-for-mcpdm.patch b/queue-3.14/arm-omap5-hwmod_data-correct-idlemode-for-mcpdm.patch new file mode 100644 index 00000000000..ad7e4b6bb7d --- /dev/null +++ b/queue-3.14/arm-omap5-hwmod_data-correct-idlemode-for-mcpdm.patch @@ -0,0 +1,31 @@ +From 0f9e19ad88eee820f517b85531b555a0fa73e7e4 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 9 May 2014 11:10:05 +0300 +Subject: ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM + +From: Peter Ujfalusi + +commit 0f9e19ad88eee820f517b85531b555a0fa73e7e4 upstream. + +McPDM need to be configured to NO_IDLE mode when it is in used otherwise +vital clocks will be gated which results 'slow motion' audio playback. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/omap_hwmod_54xx_data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c +@@ -895,7 +895,7 @@ static struct omap_hwmod omap54xx_mcpdm_ + * current exception. + */ + +- .flags = HWMOD_EXT_OPT_MAIN_CLK, ++ .flags = HWMOD_EXT_OPT_MAIN_CLK | HWMOD_SWSUP_SIDLE, + .main_clk = "pad_clks_ck", + .prcm = { + .omap4 = { diff --git a/queue-3.14/cpufreq-cpu0-drop-wrong-devm-usage.patch b/queue-3.14/cpufreq-cpu0-drop-wrong-devm-usage.patch new file mode 100644 index 00000000000..338860f8414 --- /dev/null +++ b/queue-3.14/cpufreq-cpu0-drop-wrong-devm-usage.patch @@ -0,0 +1,76 @@ +From e3beb0ac521d50d158a9d253373eae8421ac3998 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 16 May 2014 12:20:42 +0200 +Subject: cpufreq: cpu0: drop wrong devm usage + +From: Lucas Stach + +commit e3beb0ac521d50d158a9d253373eae8421ac3998 upstream. + +This driver is using devres managed calls incorrectly, giving the cpu0 +device as first parameter instead of the cpufreq platform device. +This results in resources not being freed if the cpufreq platform device +is unbound, for example if probing has to be deferred for a missing +regulator. + +Signed-off-by: Lucas Stach +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq-cpu0.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/cpufreq/cpufreq-cpu0.c ++++ b/drivers/cpufreq/cpufreq-cpu0.c +@@ -131,7 +131,7 @@ static int cpu0_cpufreq_probe(struct pla + return -ENOENT; + } + +- cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu0"); ++ cpu_reg = regulator_get_optional(cpu_dev, "cpu0"); + if (IS_ERR(cpu_reg)) { + /* + * If cpu0 regulator supply node is present, but regulator is +@@ -146,23 +146,23 @@ static int cpu0_cpufreq_probe(struct pla + PTR_ERR(cpu_reg)); + } + +- cpu_clk = devm_clk_get(cpu_dev, NULL); ++ cpu_clk = clk_get(cpu_dev, NULL); + if (IS_ERR(cpu_clk)) { + ret = PTR_ERR(cpu_clk); + pr_err("failed to get cpu0 clock: %d\n", ret); +- goto out_put_node; ++ goto out_put_reg; + } + + ret = of_init_opp_table(cpu_dev); + if (ret) { + pr_err("failed to init OPP table: %d\n", ret); +- goto out_put_node; ++ goto out_put_clk; + } + + ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table); + if (ret) { + pr_err("failed to init cpufreq table: %d\n", ret); +- goto out_put_node; ++ goto out_put_clk; + } + + of_property_read_u32(np, "voltage-tolerance", &voltage_tolerance); +@@ -217,6 +217,12 @@ static int cpu0_cpufreq_probe(struct pla + + out_free_table: + dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table); ++out_put_clk: ++ if (!IS_ERR(cpu_clk)) ++ clk_put(cpu_clk); ++out_put_reg: ++ if (!IS_ERR(cpu_reg)) ++ regulator_put(cpu_reg); + out_put_node: + of_node_put(np); + return ret; diff --git a/queue-3.14/cpufreq-remove-race-while-accessing-cur_policy.patch b/queue-3.14/cpufreq-remove-race-while-accessing-cur_policy.patch new file mode 100644 index 00000000000..c3f9bc0996f --- /dev/null +++ b/queue-3.14/cpufreq-remove-race-while-accessing-cur_policy.patch @@ -0,0 +1,88 @@ +From c5450db85b828d0c46ac8fc570fb8a51bf07ac40 Mon Sep 17 00:00:00 2001 +From: Bibek Basu +Date: Mon, 19 May 2014 10:24:01 +0530 +Subject: cpufreq: remove race while accessing cur_policy + +From: Bibek Basu + +commit c5450db85b828d0c46ac8fc570fb8a51bf07ac40 upstream. + +While accessing cur_policy during executing events +CPUFREQ_GOV_START, CPUFREQ_GOV_STOP, CPUFREQ_GOV_LIMITS, +same mutex lock is not taken, dbs_data->mutex, which leads +to race and data corruption while running continious suspend +resume test. This is seen with ondemand governor with suspend +resume test using rtcwake. + + Unable to handle kernel NULL pointer dereference at virtual address 00000028 + pgd = ed610000 + [00000028] *pgd=adf11831, *pte=00000000, *ppte=00000000 + Internal error: Oops: 17 [#1] PREEMPT SMP ARM + Modules linked in: nvhost_vi + CPU: 1 PID: 3243 Comm: rtcwake Not tainted 3.10.24-gf5cf9e5 #1 + task: ee708040 ti: ed61c000 task.ti: ed61c000 + PC is at cpufreq_governor_dbs+0x400/0x634 + LR is at cpufreq_governor_dbs+0x3f8/0x634 + pc : [] lr : [] psr: 600f0013 + sp : ed61dcb0 ip : 000493e0 fp : c1cc14f0 + r10: 00000000 r9 : 00000000 r8 : 00000000 + r7 : eb725280 r6 : c1cc1560 r5 : eb575200 r4 : ebad7740 + r3 : ee708040 r2 : ed61dca8 r1 : 001ebd24 r0 : 00000000 + Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user + Control: 10c5387d Table: ad61006a DAC: 00000015 + [] (cpufreq_governor_dbs+0x400/0x634) from [] (__cpufreq_governor+0x98/0x1b4) + [] (__cpufreq_governor+0x98/0x1b4) from [] (__cpufreq_set_policy+0x250/0x320) + [] (__cpufreq_set_policy+0x250/0x320) from [] (cpufreq_update_policy+0xcc/0x168) + [] (cpufreq_update_policy+0xcc/0x168) from [] (cpu_freq_notify+0x68/0xdc) + [] (cpu_freq_notify+0x68/0xdc) from [] (notifier_call_chain+0x4c/0x8c) + [] (notifier_call_chain+0x4c/0x8c) from [] (__blocking_notifier_call_chain+0x50/0x68) + [] (__blocking_notifier_call_chain+0x50/0x68) from [] (blocking_notifier_call_chain+0x20/0x28) + [] (blocking_notifier_call_chain+0x20/0x28) from [] (pm_qos_update_bounded_target+0xd8/0x310) + [] (pm_qos_update_bounded_target+0xd8/0x310) from [] (__pm_qos_update_request+0x64/0x70) + [] (__pm_qos_update_request+0x64/0x70) from [] (tegra_pm_notify+0x114/0x134) + [] (tegra_pm_notify+0x114/0x134) from [] (notifier_call_chain+0x4c/0x8c) + [] (notifier_call_chain+0x4c/0x8c) from [] (__blocking_notifier_call_chain+0x50/0x68) + [] (__blocking_notifier_call_chain+0x50/0x68) from [] (blocking_notifier_call_chain+0x20/0x28) + [] (blocking_notifier_call_chain+0x20/0x28) from [] (pm_notifier_call_chain+0x1c/0x34) + [] (pm_notifier_call_chain+0x1c/0x34) from [] (enter_state+0xec/0x128) + [] (enter_state+0xec/0x128) from [] (pm_suspend+0x38/0xa4) + [] (pm_suspend+0x38/0xa4) from [] (state_store+0x70/0xc0) + [] (state_store+0x70/0xc0) from [] (kobj_attr_store+0x14/0x20) + [] (kobj_attr_store+0x14/0x20) from [] (sysfs_write_file+0x104/0x184) + [] (sysfs_write_file+0x104/0x184) from [] (vfs_write+0xd0/0x19c) + [] (vfs_write+0xd0/0x19c) from [] (SyS_write+0x4c/0x78) + [] (SyS_write+0x4c/0x78) from [] (ret_fast_syscall+0x0/0x30) + Code: e1a00006 eb084346 e59b0020 e5951024 (e5903028) + ---[ end trace 0488523c8f6b0f9d ]--- + +Signed-off-by: Bibek Basu +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq_governor.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/cpufreq/cpufreq_governor.c ++++ b/drivers/cpufreq/cpufreq_governor.c +@@ -366,6 +366,11 @@ int cpufreq_governor_dbs(struct cpufreq_ + break; + + case CPUFREQ_GOV_LIMITS: ++ mutex_lock(&dbs_data->mutex); ++ if (!cpu_cdbs->cur_policy) { ++ mutex_unlock(&dbs_data->mutex); ++ break; ++ } + mutex_lock(&cpu_cdbs->timer_mutex); + if (policy->max < cpu_cdbs->cur_policy->cur) + __cpufreq_driver_target(cpu_cdbs->cur_policy, +@@ -375,6 +380,7 @@ int cpufreq_governor_dbs(struct cpufreq_ + policy->min, CPUFREQ_RELATION_L); + dbs_check_cpu(dbs_data, cpu); + mutex_unlock(&cpu_cdbs->timer_mutex); ++ mutex_unlock(&dbs_data->mutex); + break; + } + return 0; diff --git a/queue-3.14/dm-cache-always-split-discards-on-cache-block-boundaries.patch b/queue-3.14/dm-cache-always-split-discards-on-cache-block-boundaries.patch new file mode 100644 index 00000000000..fe773ce9090 --- /dev/null +++ b/queue-3.14/dm-cache-always-split-discards-on-cache-block-boundaries.patch @@ -0,0 +1,33 @@ +From f1daa838e861ae1a0fb7cd9721a21258430fcc8c Mon Sep 17 00:00:00 2001 +From: Heinz Mauelshagen +Date: Fri, 23 May 2014 14:10:01 -0400 +Subject: dm cache: always split discards on cache block boundaries + +From: Heinz Mauelshagen + +commit f1daa838e861ae1a0fb7cd9721a21258430fcc8c upstream. + +The DM cache target cannot cope with discards that span multiple cache +blocks, so each discard bio that spans more than one cache block must +get split by the DM core. + +Signed-off-by: Heinz Mauelshagen +Acked-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2195,6 +2195,8 @@ static int cache_create(struct cache_arg + ti->num_discard_bios = 1; + ti->discards_supported = true; + ti->discard_zeroes_data_unsupported = true; ++ /* Discard bios must be split on a block boundary */ ++ ti->split_discard_bios = true; + + cache->features = ca->features; + ti->per_bio_data_size = get_per_bio_data_size(cache); diff --git a/queue-3.14/dm-thin-add-no_space_timeout-dm-thin-pool-module-param.patch b/queue-3.14/dm-thin-add-no_space_timeout-dm-thin-pool-module-param.patch new file mode 100644 index 00000000000..7b7f508127c --- /dev/null +++ b/queue-3.14/dm-thin-add-no_space_timeout-dm-thin-pool-module-param.patch @@ -0,0 +1,82 @@ +From 80c578930ce77ba8bcfb226a184b482020bdda7b Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Tue, 20 May 2014 13:38:33 -0400 +Subject: dm thin: add 'no_space_timeout' dm-thin-pool module param + +From: Mike Snitzer + +commit 80c578930ce77ba8bcfb226a184b482020bdda7b upstream. + +Commit 85ad643b ("dm thin: add timeout to stop out-of-data-space mode +holding IO forever") introduced a fixed 60 second timeout. Users may +want to either disable or modify this timeout. + +Allow the out-of-data-space timeout to be configured using the +'no_space_timeout' dm-thin-pool module param. Setting it to 0 will +disable the timeout, resulting in IO being queued until more data space +is added to the thin-pool. + +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/device-mapper/thin-provisioning.txt | 5 ++++- + drivers/md/dm-thin.c | 12 +++++++++--- + 2 files changed, 13 insertions(+), 4 deletions(-) + +--- a/Documentation/device-mapper/thin-provisioning.txt ++++ b/Documentation/device-mapper/thin-provisioning.txt +@@ -309,7 +309,10 @@ ii) Status + error_if_no_space|queue_if_no_space + If the pool runs out of data or metadata space, the pool will + either queue or error the IO destined to the data device. The +- default is to queue the IO until more space is added. ++ default is to queue the IO until more space is added or the ++ 'no_space_timeout' expires. The 'no_space_timeout' dm-thin-pool ++ module parameter can be used to change this timeout -- it ++ defaults to 60 seconds but may be disabled using a value of 0. + + iii) Messages + +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -25,7 +25,9 @@ + #define MAPPING_POOL_SIZE 1024 + #define PRISON_CELLS 1024 + #define COMMIT_PERIOD HZ +-#define NO_SPACE_TIMEOUT (HZ * 60) ++#define NO_SPACE_TIMEOUT_SECS 60 ++ ++static unsigned no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS; + + DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle, + "A percentage of time allocated for copy on write"); +@@ -1529,6 +1531,7 @@ static void set_pool_mode(struct pool *p + struct pool_c *pt = pool->ti->private; + bool needs_check = dm_pool_metadata_needs_check(pool->pmd); + enum pool_mode old_mode = get_pool_mode(pool); ++ unsigned long no_space_timeout = ACCESS_ONCE(no_space_timeout_secs) * HZ; + + /* + * Never allow the pool to transition to PM_WRITE mode if user +@@ -1591,8 +1594,8 @@ static void set_pool_mode(struct pool *p + pool->process_prepared_mapping = process_prepared_mapping; + pool->process_prepared_discard = process_prepared_discard_passdown; + +- if (!pool->pf.error_if_no_space) +- queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT); ++ if (!pool->pf.error_if_no_space && no_space_timeout) ++ queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout); + break; + + case PM_WRITE: +@@ -3326,6 +3329,9 @@ static void dm_thin_exit(void) + module_init(dm_thin_init); + module_exit(dm_thin_exit); + ++module_param_named(no_space_timeout, no_space_timeout_secs, uint, S_IRUGO | S_IWUSR); ++MODULE_PARM_DESC(no_space_timeout, "Out of data space queue IO timeout in seconds"); ++ + MODULE_DESCRIPTION(DM_NAME " thin provisioning target"); + MODULE_AUTHOR("Joe Thornber "); + MODULE_LICENSE("GPL"); diff --git a/queue-3.14/firewire-revert-to-4-gb-rdma-fix-protocols-using-memory-space.patch b/queue-3.14/firewire-revert-to-4-gb-rdma-fix-protocols-using-memory-space.patch new file mode 100644 index 00000000000..1848ad41867 --- /dev/null +++ b/queue-3.14/firewire-revert-to-4-gb-rdma-fix-protocols-using-memory-space.patch @@ -0,0 +1,86 @@ +From 2fe2023adf695d08af5b598b2be3b288a95d563c Mon Sep 17 00:00:00 2001 +From: Stefan Richter +Date: Thu, 29 May 2014 15:23:26 +0200 +Subject: firewire: revert to 4 GB RDMA, fix protocols using Memory Space + +From: Stefan Richter + +commit 2fe2023adf695d08af5b598b2be3b288a95d563c upstream. + +Undo a feature introduced in v3.14 by commit fcd46b34425d +"firewire: Enable remote DMA above 4 GB". That change raised the +minimum address at which protocol drivers and user programs can register +for request reception from 0x0001'0000'0000 to 0x8000'0000'0000. +It turned out that at least one vendor-specific protocol exists which +uses lower addresses: https://bugzilla.kernel.org/show_bug.cgi?id=76921 + +For the time being, revert most of commit fcd46b34425d so that affected +protocols work like with kernel v3.13 and before. Just keep the valid +documentation parts from the regressing commit, and the ability to +identify controllers which could be programmed to accept >32 bit +physical DMA addresses. The rest of fcd46b34425d should probably be +brought back as an optional instead of default feature. + +Reported-by: Fabien Spindler +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/debugging-via-ohci1394.txt | 13 ++++++++----- + drivers/firewire/core.h | 4 ++-- + drivers/firewire/ohci.c | 2 +- + 3 files changed, 11 insertions(+), 8 deletions(-) + +--- a/Documentation/debugging-via-ohci1394.txt ++++ b/Documentation/debugging-via-ohci1394.txt +@@ -25,9 +25,11 @@ using data transfer rates in the order o + With most FireWire controllers, memory access is limited to the low 4 GB + of physical address space. This can be a problem on IA64 machines where + memory is located mostly above that limit, but it is rarely a problem on +-more common hardware such as x86, x86-64 and PowerPC. However, at least +-Agere/LSI FW643e and FW643e2 controllers are known to support access to +-physical addresses above 4 GB. ++more common hardware such as x86, x86-64 and PowerPC. ++ ++At least LSI FW643e and FW643e2 controllers are known to support access to ++physical addresses above 4 GB, but this feature is currently not enabled by ++Linux. + + Together with a early initialization of the OHCI-1394 controller for debugging, + this facility proved most useful for examining long debugs logs in the printk +@@ -101,8 +103,9 @@ Step-by-step instructions for using fire + compliant, they are based on TI PCILynx chips and require drivers for Win- + dows operating systems. + +- The mentioned kernel log message contains ">4 GB phys DMA" in case of +- OHCI-1394 controllers which support accesses above this limit. ++ The mentioned kernel log message contains the string "physUB" if the ++ controller implements a writable Physical Upper Bound register. This is ++ required for physical DMA above 4 GB (but not utilized by Linux yet). + + 2) Establish a working FireWire cable connection: + +--- a/drivers/firewire/core.h ++++ b/drivers/firewire/core.h +@@ -237,8 +237,8 @@ static inline bool is_next_generation(in + + #define LOCAL_BUS 0xffc0 + +-/* arbitrarily chosen maximum range for physical DMA: 128 TB */ +-#define FW_MAX_PHYSICAL_RANGE (128ULL << 40) ++/* OHCI-1394's default upper bound for physical DMA: 4 GB */ ++#define FW_MAX_PHYSICAL_RANGE (1ULL << 32) + + void fw_core_handle_request(struct fw_card *card, struct fw_packet *request); + void fw_core_handle_response(struct fw_card *card, struct fw_packet *packet); +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -3716,7 +3716,7 @@ static int pci_probe(struct pci_dev *dev + version >> 16, version & 0xff, ohci->card.index, + ohci->n_ir, ohci->n_it, ohci->quirks, + reg_read(ohci, OHCI1394_PhyUpperBound) ? +- ", >4 GB phys DMA" : ""); ++ ", physUB" : ""); + + return 0; + diff --git a/queue-3.14/mips-fix-typo-when-reporting-cache-and-ftlb-errors-for-imgtec-cores.patch b/queue-3.14/mips-fix-typo-when-reporting-cache-and-ftlb-errors-for-imgtec-cores.patch new file mode 100644 index 00000000000..626b25bd2f8 --- /dev/null +++ b/queue-3.14/mips-fix-typo-when-reporting-cache-and-ftlb-errors-for-imgtec-cores.patch @@ -0,0 +1,47 @@ +From 721a9205396c4ef2a811dd665ec2a232163b583d Mon Sep 17 00:00:00 2001 +From: Markos Chandras +Date: Wed, 21 May 2014 12:35:00 +0100 +Subject: MIPS: Fix typo when reporting cache and ftlb errors for ImgTec cores + +From: Markos Chandras + +commit 721a9205396c4ef2a811dd665ec2a232163b583d upstream. + +Introduced by the following two commits: +75b5b5e0a262790fa11043fe45700499c7e3d818 +"MIPS: Add support for FTLBs" +6de20451857ed14a4eecc28d08f6de5925d1cf96 +"MIPS: Add printing of ES bit for Imgtec cores when cache error occurs" + +Signed-off-by: Markos Chandras +Reported-by: Matheus Almeida +Cc: linux-mips@linux-mips.org +Cc: Markos Chandras +Patchwork: https://patchwork.linux-mips.org/patch/6980/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/traps.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -1429,7 +1429,7 @@ asmlinkage void cache_parity_error(void) + reg_val & (1<<30) ? "secondary" : "primary", + reg_val & (1<<31) ? "data" : "insn"); + if (cpu_has_mips_r2 && +- ((current_cpu_data.processor_id && 0xff0000) == PRID_COMP_MIPS)) { ++ ((current_cpu_data.processor_id & 0xff0000) == PRID_COMP_MIPS)) { + pr_err("Error bits: %s%s%s%s%s%s%s%s\n", + reg_val & (1<<29) ? "ED " : "", + reg_val & (1<<28) ? "ET " : "", +@@ -1469,7 +1469,7 @@ asmlinkage void do_ftlb(void) + + /* For the moment, report the problem and hang. */ + if (cpu_has_mips_r2 && +- ((current_cpu_data.processor_id && 0xff0000) == PRID_COMP_MIPS)) { ++ ((current_cpu_data.processor_id & 0xff0000) == PRID_COMP_MIPS)) { + pr_err("FTLB error exception, cp0_ecc=0x%08x:\n", + read_c0_ecc()); + pr_err("cp0_errorepc == %0*lx\n", field, read_c0_errorepc()); diff --git a/queue-3.14/series b/queue-3.14/series index a739c4bbbf7..ebeb25ba440 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -14,3 +14,16 @@ drm-radeon-also-try-gart-for-cpu-accessed-buffers.patch drm-radeon-handle-non-vga-class-pci-devices-with-atrm.patch drm-radeon-pm-don-t-allow-debugfs-sysfs-access-when-px-card-is-off-v2.patch scsi-scsi_transport_sas-move-bsg-destructor-into-sas_rphy_remove.patch +arm-imx-fix-error-handling-in-ipu-device-registration.patch +arm-omap5-hwmod_data-correct-idlemode-for-mcpdm.patch +arm-omap2-nand-fix-nand-on-omap2-and-omap3-boards.patch +arm-omap3-clock-back-propagate-rate-change-from-cam_mclk-to-dpll4_m5-on-all-omap3-platforms.patch +arm-omap4-fix-the-boot-regression-with-cpu_idle-enabled.patch +arm-8051-1-put_user-fix-possible-data-corruption-in-put_user.patch +arm-8064-1-fix-v7-m-signal-return.patch +cpufreq-cpu0-drop-wrong-devm-usage.patch +cpufreq-remove-race-while-accessing-cur_policy.patch +firewire-revert-to-4-gb-rdma-fix-protocols-using-memory-space.patch +mips-fix-typo-when-reporting-cache-and-ftlb-errors-for-imgtec-cores.patch +dm-thin-add-no_space_timeout-dm-thin-pool-module-param.patch +dm-cache-always-split-discards-on-cache-block-boundaries.patch