<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/arch/arm, branch v3.0.85</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>Kirkwood: Enable PCIe port 1 on QNAP TS-11x/TS-21x</title>
<updated>2013-06-07T19:46:36+00:00</updated>
<author>
<name>Martin Michlmayr</name>
<email>tbm@cyrius.com</email>
</author>
<published>2013-04-21T16:14:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=891694374dbdf88b12f41fa412ead40a4d255071'/>
<id>891694374dbdf88b12f41fa412ead40a4d255071</id>
<content type='text'>
commit 99e11334dcb846f9b76fb808196c7f47aa83abb3 upstream.

Enable KW_PCIE1 on QNAP TS-11x/TS-21x devices as newer revisions
(rev 1.3) have a USB 3.0 chip from Etron on PCIe port 1.  Thanks
to Marek Vasut for identifying this issue!

Signed-off-by: Martin Michlmayr &lt;tbm@cyrius.com&gt;
Tested-by: Marek Vasut &lt;marex@denx.de&gt;
Acked-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 99e11334dcb846f9b76fb808196c7f47aa83abb3 upstream.

Enable KW_PCIE1 on QNAP TS-11x/TS-21x devices as newer revisions
(rev 1.3) have a USB 3.0 chip from Etron on PCIe port 1.  Thanks
to Marek Vasut for identifying this issue!

Signed-off-by: Martin Michlmayr &lt;tbm@cyrius.com&gt;
Tested-by: Marek Vasut &lt;marex@denx.de&gt;
Acked-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: plat-orion: Fix num_resources and id for ge10 and ge11</title>
<updated>2013-06-07T19:46:34+00:00</updated>
<author>
<name>Gregory CLEMENT</name>
<email>gregory.clement@free-electrons.com</email>
</author>
<published>2013-05-19T20:12:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8a3e6d89936003e13011ab01dacdf96c66a0e465'/>
<id>8a3e6d89936003e13011ab01dacdf96c66a0e465</id>
<content type='text'>
commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream.

When platform data were moved from arch/arm/mach-mv78xx0/common.c to
arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion:
Consolidate ethernet platform data", there were few typo made on
gigabit Ethernet interface ge10 and ge11. This commit writes back
their initial value, which allows to use this interfaces again.

Signed-off-by: Gregory CLEMENT &lt;gregory.clement@free-electrons.com&gt;
Acked-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream.

When platform data were moved from arch/arm/mach-mv78xx0/common.c to
arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion:
Consolidate ethernet platform data", there were few typo made on
gigabit Ethernet interface ge10 and ge11. This commit writes back
their initial value, which allows to use this interfaces again.

Signed-off-by: Gregory CLEMENT &lt;gregory.clement@free-electrons.com&gt;
Acked-by: Andrew Lunn &lt;andrew@lunn.ch&gt;
Signed-off-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices</title>
<updated>2013-05-19T17:04:36+00:00</updated>
<author>
<name>Aaro Koskinen</name>
<email>aaro.koskinen@iki.fi</email>
</author>
<published>2013-05-08T23:48:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f3fb49dfccbf7bb7005bd57bb7385c3ee80d8c52'/>
<id>f3fb49dfccbf7bb7005bd57bb7385c3ee80d8c52</id>
<content type='text'>
commit e65f131a14726e5f1b880a528271a52428e5b3a5 upstream.

Commit 9fdca9df (spi: omap2-mcspi: convert to module_platform_driver)
broke the SPI display/panel driver probe on RX-51/N900. The exact cause is
not fully understood, but it seems to be related to the probe order. SPI
communication to the panel driver (spi1.2) fails unless the touchscreen
(spi1.0) has been probed/initialized before. When the omap2-mcspi driver
was converted to a platform driver, it resulted in that the devices are
probed immediately after the board registers them in the order they are
listed in the board file.

Fix the issue by moving the touchscreen before the panel in the SPI
device list.

The patch fixes the following failure:

[    1.260955] acx565akm spi1.2: invalid display ID
[    1.265899] panel-acx565akm display0: acx_panel_probe panel detect error
[    1.273071] omapdss CORE error: driver probe failed: -19

Tested-by: Sebastian Reichel &lt;sre@debian.org&gt;
Signed-off-by: Aaro Koskinen &lt;aaro.koskinen@iki.fi&gt;
Cc: Pali Rohár &lt;pali.rohar@gmail.com&gt;
Cc: Joni Lapilainen &lt;joni.lapilainen@gmail.com&gt;
Cc: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Cc: Felipe Balbi &lt;balbi@ti.com&gt;
Signed-off-by: Tony Lindgren &lt;tony@atomide.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e65f131a14726e5f1b880a528271a52428e5b3a5 upstream.

Commit 9fdca9df (spi: omap2-mcspi: convert to module_platform_driver)
broke the SPI display/panel driver probe on RX-51/N900. The exact cause is
not fully understood, but it seems to be related to the probe order. SPI
communication to the panel driver (spi1.2) fails unless the touchscreen
(spi1.0) has been probed/initialized before. When the omap2-mcspi driver
was converted to a platform driver, it resulted in that the devices are
probed immediately after the board registers them in the order they are
listed in the board file.

Fix the issue by moving the touchscreen before the panel in the SPI
device list.

The patch fixes the following failure:

[    1.260955] acx565akm spi1.2: invalid display ID
[    1.265899] panel-acx565akm display0: acx_panel_probe panel detect error
[    1.273071] omapdss CORE error: driver probe failed: -19

Tested-by: Sebastian Reichel &lt;sre@debian.org&gt;
Signed-off-by: Aaro Koskinen &lt;aaro.koskinen@iki.fi&gt;
Cc: Pali Rohár &lt;pali.rohar@gmail.com&gt;
Cc: Joni Lapilainen &lt;joni.lapilainen@gmail.com&gt;
Cc: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Cc: Felipe Balbi &lt;balbi@ti.com&gt;
Signed-off-by: Tony Lindgren &lt;tony@atomide.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: 7696/1: Fix kexec by setting outer_cache.inv_all for Feroceon</title>
<updated>2013-04-26T04:23:48+00:00</updated>
<author>
<name>Illia Ragozin</name>
<email>illia.ragozin@grapecom.com</email>
</author>
<published>2013-04-10T18:43:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=cef72624c31364e7020450571393a4d5a0e44b34'/>
<id>cef72624c31364e7020450571393a4d5a0e44b34</id>
<content type='text'>
commit cd272d1ea71583170e95dde02c76166c7f9017e6 upstream.

On Feroceon the L2 cache becomes non-coherent with the CPU
when the L1 caches are disabled. Thus the L2 needs to be invalidated
after both L1 caches are disabled.

On kexec before the starting the code for relocation the kernel,
the L1 caches are disabled in cpu_froc_fin (cpu_v7_proc_fin for Feroceon),
but after L2 cache is never invalidated, because inv_all is not set
in cache-feroceon-l2.c.
So kernel relocation and decompression may has (and usually has) errors.
Setting the function enables L2 invalidation and fixes the issue.

Signed-off-by: Illia Ragozin &lt;illia.ragozin@grapecom.com&gt;
Acked-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cd272d1ea71583170e95dde02c76166c7f9017e6 upstream.

On Feroceon the L2 cache becomes non-coherent with the CPU
when the L1 caches are disabled. Thus the L2 needs to be invalidated
after both L1 caches are disabled.

On kexec before the starting the code for relocation the kernel,
the L1 caches are disabled in cpu_froc_fin (cpu_v7_proc_fin for Feroceon),
but after L2 cache is never invalidated, because inv_all is not set
in cache-feroceon-l2.c.
So kernel relocation and decompression may has (and usually has) errors.
Setting the function enables L2 invalidation and fixes the issue.

Signed-off-by: Illia Ragozin &lt;illia.ragozin@grapecom.com&gt;
Acked-by: Jason Cooper &lt;jason@lakedaemon.net&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>signal: Define __ARCH_HAS_SA_RESTORER so we know whether to clear sa_restorer</title>
<updated>2013-04-05T17:16:35+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>ben@decadent.org.uk</email>
</author>
<published>2012-11-26T03:24:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1c190534db77a019936d95a1826a55bf34d7ed23'/>
<id>1c190534db77a019936d95a1826a55bf34d7ed23</id>
<content type='text'>
Vaguely based on upstream commit 574c4866e33d 'consolidate kernel-side
struct sigaction declarations'.

flush_signal_handlers() needs to know whether sigaction::sa_restorer
is defined, not whether SA_RESTORER is defined.  Define the
__ARCH_HAS_SA_RESTORER macro to indicate this.

Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Vaguely based on upstream commit 574c4866e33d 'consolidate kernel-side
struct sigaction declarations'.

flush_signal_handlers() needs to know whether sigaction::sa_restorer
is defined, not whether SA_RESTORER is defined.  Define the
__ARCH_HAS_SA_RESTORER macro to indicate this.

Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: fix scheduling while atomic warning in alignment handling code</title>
<updated>2013-03-14T18:32:04+00:00</updated>
<author>
<name>Russell King</name>
<email>rmk+kernel@arm.linux.org.uk</email>
</author>
<published>2013-02-25T16:10:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8b0b58069148d9540e70af1d4963b2fe515efe89'/>
<id>8b0b58069148d9540e70af1d4963b2fe515efe89</id>
<content type='text'>
commit b255188f90e2bade1bd11a986dd1ca4861869f4d upstream.

Paolo Pisati reports that IPv6 triggers this warning:

BUG: scheduling while atomic: swapper/0/0/0x40000100
Modules linked in:
[&lt;c001b1c4&gt;] (unwind_backtrace+0x0/0xf0) from [&lt;c0503c5c&gt;] (__schedule_bug+0x48/0x5c)
[&lt;c0503c5c&gt;] (__schedule_bug+0x48/0x5c) from [&lt;c0508608&gt;] (__schedule+0x700/0x740)
[&lt;c0508608&gt;] (__schedule+0x700/0x740) from [&lt;c007007c&gt;] (__cond_resched+0x24/0x34)
[&lt;c007007c&gt;] (__cond_resched+0x24/0x34) from [&lt;c05086dc&gt;] (_cond_resched+0x3c/0x44)
[&lt;c05086dc&gt;] (_cond_resched+0x3c/0x44) from [&lt;c0021f6c&gt;] (do_alignment+0x178/0x78c)
[&lt;c0021f6c&gt;] (do_alignment+0x178/0x78c) from [&lt;c00083e0&gt;] (do_DataAbort+0x34/0x98)
[&lt;c00083e0&gt;] (do_DataAbort+0x34/0x98) from [&lt;c0509a60&gt;] (__dabt_svc+0x40/0x60)
Exception stack(0xc0763d70 to 0xc0763db8)
3d60:                                     e97e805e e97e806e 2c000000 11000000
3d80: ea86bb00 0000002c 00000011 e97e807e c076d2a8 e97e805e e97e806e 0000002c
3da0: 3d000000 c0763dbc c04b98fc c02a8490 00000113 ffffffff
[&lt;c0509a60&gt;] (__dabt_svc+0x40/0x60) from [&lt;c02a8490&gt;] (__csum_ipv6_magic+0x8/0xc8)

Fix this by using probe_kernel_address() stead of __get_user().

Reported-by: Paolo Pisati &lt;p.pisati@gmail.com&gt;
Tested-by: Paolo Pisati &lt;p.pisati@gmail.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b255188f90e2bade1bd11a986dd1ca4861869f4d upstream.

Paolo Pisati reports that IPv6 triggers this warning:

BUG: scheduling while atomic: swapper/0/0/0x40000100
Modules linked in:
[&lt;c001b1c4&gt;] (unwind_backtrace+0x0/0xf0) from [&lt;c0503c5c&gt;] (__schedule_bug+0x48/0x5c)
[&lt;c0503c5c&gt;] (__schedule_bug+0x48/0x5c) from [&lt;c0508608&gt;] (__schedule+0x700/0x740)
[&lt;c0508608&gt;] (__schedule+0x700/0x740) from [&lt;c007007c&gt;] (__cond_resched+0x24/0x34)
[&lt;c007007c&gt;] (__cond_resched+0x24/0x34) from [&lt;c05086dc&gt;] (_cond_resched+0x3c/0x44)
[&lt;c05086dc&gt;] (_cond_resched+0x3c/0x44) from [&lt;c0021f6c&gt;] (do_alignment+0x178/0x78c)
[&lt;c0021f6c&gt;] (do_alignment+0x178/0x78c) from [&lt;c00083e0&gt;] (do_DataAbort+0x34/0x98)
[&lt;c00083e0&gt;] (do_DataAbort+0x34/0x98) from [&lt;c0509a60&gt;] (__dabt_svc+0x40/0x60)
Exception stack(0xc0763d70 to 0xc0763db8)
3d60:                                     e97e805e e97e806e 2c000000 11000000
3d80: ea86bb00 0000002c 00000011 e97e807e c076d2a8 e97e805e e97e806e 0000002c
3da0: 3d000000 c0763dbc c04b98fc c02a8490 00000113 ffffffff
[&lt;c0509a60&gt;] (__dabt_svc+0x40/0x60) from [&lt;c02a8490&gt;] (__csum_ipv6_magic+0x8/0xc8)

Fix this by using probe_kernel_address() stead of __get_user().

Reported-by: Paolo Pisati &lt;p.pisati@gmail.com&gt;
Tested-by: Paolo Pisati &lt;p.pisati@gmail.com&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: VFP: fix emulation of second VFP instruction</title>
<updated>2013-03-14T18:32:03+00:00</updated>
<author>
<name>Russell King</name>
<email>rmk+kernel@arm.linux.org.uk</email>
</author>
<published>2013-02-25T16:09:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=95a2b9b9ce9db0856f0603f394a628e1360f79ae'/>
<id>95a2b9b9ce9db0856f0603f394a628e1360f79ae</id>
<content type='text'>
commit 5e4ba617c1b584b2e376f31a63bd4e734109318a upstream.

Martin Storsjö reports that the sequence:

        ee312ac1        vsub.f32        s4, s3, s2
        ee702ac0        vsub.f32        s5, s1, s0
        e59f0028        ldr             r0, [pc, #40]
        ee111a90        vmov            r1, s3

on Raspberry Pi (implementor 41 architecture 1 part 20 variant b rev 5)
where s3 is a denormal and s2 is zero results in incorrect behaviour -
the instruction "vsub.f32 s5, s1, s0" is not executed:

        VFP: bounce: trigger ee111a90 fpexc d0000780
        VFP: emulate: INST=0xee312ac1 SCR=0x00000000
        ...

As we can see, the instruction triggering the exception is the "vmov"
instruction, and we emulate the "vsub.f32 s4, s3, s2" but fail to
properly take account of the FPEXC_FP2V flag in FPEXC.  This is because
the test for the second instruction register being valid is bogus, and
will always skip emulation of the second instruction.

Reported-by: Martin Storsjö &lt;martin@martin.st&gt;
Tested-by: Martin Storsjö &lt;martin@martin.st&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 5e4ba617c1b584b2e376f31a63bd4e734109318a upstream.

Martin Storsjö reports that the sequence:

        ee312ac1        vsub.f32        s4, s3, s2
        ee702ac0        vsub.f32        s5, s1, s0
        e59f0028        ldr             r0, [pc, #40]
        ee111a90        vmov            r1, s3

on Raspberry Pi (implementor 41 architecture 1 part 20 variant b rev 5)
where s3 is a denormal and s2 is zero results in incorrect behaviour -
the instruction "vsub.f32 s5, s1, s0" is not executed:

        VFP: bounce: trigger ee111a90 fpexc d0000780
        VFP: emulate: INST=0xee312ac1 SCR=0x00000000
        ...

As we can see, the instruction triggering the exception is the "vmov"
instruction, and we emulate the "vsub.f32 s4, s3, s2" but fail to
properly take account of the FPEXC_FP2V flag in FPEXC.  This is because
the test for the second instruction register being valid is bogus, and
will always skip emulation of the second instruction.

Reported-by: Martin Storsjö &lt;martin@martin.st&gt;
Tested-by: Martin Storsjö &lt;martin@martin.st&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: PXA3xx: program the CSMSADRCFG register</title>
<updated>2013-02-28T14:32:26+00:00</updated>
<author>
<name>Igor Grinberg</name>
<email>grinberg@compulab.co.il</email>
</author>
<published>2013-01-13T11:49:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=928de5bcadf8540f58ba6b12c6b7547d33dcde89'/>
<id>928de5bcadf8540f58ba6b12c6b7547d33dcde89</id>
<content type='text'>
commit d107a204154ddd79339203c2deeb7433f0cf6777 upstream.

The Chip Select Configuration Register must be programmed to 0x2 in
order to achieve the correct behavior of the Static Memory Controller.

Without this patch devices wired to DFI and accessed through SMC cannot
be accessed after resume from S2.

Do not rely on the boot loader to program the CSMSADRCFG register by
programming it in the kernel smemc module.

Signed-off-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Acked-by: Eric Miao &lt;eric.y.miao@gmail.com&gt;
Signed-off-by: Haojian Zhuang &lt;haojian.zhuang@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d107a204154ddd79339203c2deeb7433f0cf6777 upstream.

The Chip Select Configuration Register must be programmed to 0x2 in
order to achieve the correct behavior of the Static Memory Controller.

Without this patch devices wired to DFI and accessed through SMC cannot
be accessed after resume from S2.

Do not rely on the boot loader to program the CSMSADRCFG register by
programming it in the kernel smemc module.

Signed-off-by: Igor Grinberg &lt;grinberg@compulab.co.il&gt;
Acked-by: Eric Miao &lt;eric.y.miao@gmail.com&gt;
Signed-off-by: Haojian Zhuang &lt;haojian.zhuang@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: DMA: Fix struct page iterator in dma_cache_maint() to work with sparsemem</title>
<updated>2013-02-04T00:21:37+00:00</updated>
<author>
<name>Russell King</name>
<email>rmk+kernel@arm.linux.org.uk</email>
</author>
<published>2013-01-19T11:05:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7948bfddbe1bbfe7d25b6a269d1c1d264cf52768'/>
<id>7948bfddbe1bbfe7d25b6a269d1c1d264cf52768</id>
<content type='text'>
commit 15653371c67c3fbe359ae37b720639dd4c7b42c5 upstream.

Subhash Jadavani reported this partial backtrace:
  Now consider this call stack from MMC block driver (this is on the ARMv7
  based board):

  [&lt;c001b50c&gt;] (v7_dma_inv_range+0x30/0x48) from [&lt;c0017b8c&gt;] (dma_cache_maint_page+0x1c4/0x24c)
  [&lt;c0017b8c&gt;] (dma_cache_maint_page+0x1c4/0x24c) from [&lt;c0017c28&gt;] (___dma_page_cpu_to_dev+0x14/0x1c)
  [&lt;c0017c28&gt;] (___dma_page_cpu_to_dev+0x14/0x1c) from [&lt;c0017ff8&gt;] (dma_map_sg+0x3c/0x114)

This is caused by incrementing the struct page pointer, and running off
the end of the sparsemem page array.  Fix this by incrementing by pfn
instead, and convert the pfn to a struct page.

Suggested-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Tested-by: Subhash Jadavani &lt;subhashj@codeaurora.org&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 15653371c67c3fbe359ae37b720639dd4c7b42c5 upstream.

Subhash Jadavani reported this partial backtrace:
  Now consider this call stack from MMC block driver (this is on the ARMv7
  based board):

  [&lt;c001b50c&gt;] (v7_dma_inv_range+0x30/0x48) from [&lt;c0017b8c&gt;] (dma_cache_maint_page+0x1c4/0x24c)
  [&lt;c0017b8c&gt;] (dma_cache_maint_page+0x1c4/0x24c) from [&lt;c0017c28&gt;] (___dma_page_cpu_to_dev+0x14/0x1c)
  [&lt;c0017c28&gt;] (___dma_page_cpu_to_dev+0x14/0x1c) from [&lt;c0017ff8&gt;] (dma_map_sg+0x3c/0x114)

This is caused by incrementing the struct page pointer, and running off
the end of the sparsemem page array.  Fix this by incrementing by pfn
instead, and convert the pfn to a struct page.

Suggested-by: James Bottomley &lt;JBottomley@Parallels.com&gt;
Tested-by: Subhash Jadavani &lt;subhashj@codeaurora.org&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ARM: missing -&gt;mmap_sem around find_vma() in swp_emulate.c</title>
<updated>2013-01-11T17:03:48+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@ZenIV.linux.org.uk</email>
</author>
<published>2012-12-16T00:25:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0b6916a71e85cd2e51c7cc3062814374a42753b9'/>
<id>0b6916a71e85cd2e51c7cc3062814374a42753b9</id>
<content type='text'>
commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.

find_vma() is *not* safe when somebody else is removing vmas.  Not just
the return value might get bogus just as you are getting it (this instance
doesn't try to dereference the resulting vma), the search itself can get
buggered in rather spectacular ways.  IOW, -&gt;mmap_sem really, really is
not optional here.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.

find_vma() is *not* safe when somebody else is removing vmas.  Not just
the return value might get bogus just as you are getting it (this instance
doesn't try to dereference the resulting vma), the search itself can get
buggered in rather spectacular ways.  IOW, -&gt;mmap_sem really, really is
not optional here.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Russell King &lt;rmk+kernel@arm.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
