dev-crash-driver.patch
dma: mv_xor: use proper dma memory management functions

Caught by self-check with DMA_API_DEBUG:
WARNING: at lib/dma-debug.c:878 check_unmap+0x37c/0x748()
mv_xor mv_xor.0: DMA-API: device driver frees DMA memory with wrong function [device address=0x000000001f3a1a40] [size=2000 bytes] [mapped as single] [unmapped as page]

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
dma: mv_xor: do not sync the DMA buffer after being deallocated

DMA_CHECK was unhappy:
mv_xor mv_xor.0: DMA-API: device driver tries to sync DMA memory it has not allocated [device address=0x000000001f3a1a40] [size=2000 bytes]

Deallocation, which involves a sync, happens automatically by
mv_xor_slot_cleanup() once the transfer is finished.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
dma: mv_xor: fix DMA-API error handling sanity check

Add error checking.
dma: mv_xor: get rid of a DMA-API sanity check warning

mv_xor mv_xor.0: DMA-API: device driver frees DMA memory with different direction [device address=0x000000001dea4000] [size=4096 bytes] [mapped with DMA_FROM_DEVICE] [unmapped with DMA_BIDIRECTIONAL]

Change xor self test destination buffer allocation direction to bidirectional,
as it's what mv_xor_run_tx_complete_actions() frees for multiple sources.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
pxa168_eth: Allocate receive queue initialized to zero

Zero is how rxq_deinit() finds out that a skb slot is unused.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
mv643xx_eth: Allocate receive queue initialized to zero

Zero is how rxq_deinit() finds out that a skb slot is unused.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
mv643xx_eth: Fix a DMA-API error handling warning

We check the failure status just prior to unmap, since it would be too much of
a hassle to roll back commands we already started to enqueue if we handled it
just after the map.

This way we at least avoid a lockup on reclaim, the card presumably didn't
succeed DMA-ing to a bogus address anyway.

------------[ cut here ]------------
WARNING: at lib/dma-debug.c:933 check_unmap+0x75c/0x840()
mv643xx_eth_port mv643xx_eth_port.0: DMA-API: device driver failed to check map error[device address=0x000000001cc3f1c2] [size=90 bytes] [mapped as single]
Modules linked in:
 bnep bluetooth rfkill marvell mv643xx_eth mv_cesa leds_gpio uinput mmc_block sata_mv mvsdio mmc_core usb_storage
[<c000f838>] (unwind_backtrace+0x0/0x124) from [<c001bbec>] (warn_slowpath_common+0x54/0x6c)
[<c001bbec>] (warn_slowpath_common+0x54/0x6c) from [<c001bc9c>] (warn_slowpath_fmt+0x34/0x44)
[<c001bc9c>] (warn_slowpath_fmt+0x34/0x44) from [<c0281040>] (check_unmap+0x75c/0x840)
[<c0281040>] (check_unmap+0x75c/0x840) from [<c02811f0>] (debug_dma_unmap_page+0x64/0x70)
[<c02811f0>] (debug_dma_unmap_page+0x64/0x70) from [<bf068fc0>] (txq_reclaim+0x218/0x264 [mv643xx_eth])
[<bf068fc0>] (txq_reclaim+0x218/0x264 [mv643xx_eth]) from [<bf069854>] (mv643xx_eth_poll+0x2a8/0x6b8 [mv643xx_eth])
[<bf069854>] (mv643xx_eth_poll+0x2a8/0x6b8 [mv643xx_eth]) from [<c040e808>] (net_rx_action+0x9c/0x338)
[<c040e808>] (net_rx_action+0x9c/0x338) from [<c002483c>] (__do_softirq+0x16c/0x398)
[<c002483c>] (__do_softirq+0x16c/0x398) from [<c0024e40>] (irq_exit+0x5c/0xc0)
[<c0024e40>] (irq_exit+0x5c/0xc0) from [<c0009ba4>] (handle_IRQ+0x6c/0x8c)
[<c0009ba4>] (handle_IRQ+0x6c/0x8c) from [<c05167b8>] (__irq_svc+0x38/0x80)
[<c05167b8>] (__irq_svc+0x38/0x80) from [<c02629e4>] (memcpy+0x24/0x3a4)
---[ end trace 0c94555a37c67b61 ]---
Mapped at:
 [<c0281818>] debug_dma_map_page+0x48/0x11c
 [<bf068494>] mv643xx_eth_xmit+0x41c/0x5a8 [mv643xx_eth]
 [<c0410a6c>] dev_hard_start_xmit+0x308/0x6cc
 [<c042c720>] sch_direct_xmit+0x74/0x2d4
 [<c041148c>] dev_queue_xmit+0x4b8/0x8dc

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Bluetooth: btmrvl_sdio: look for sd8688 firmware in alternate place

linux-firmware ships the sd8688* firmware images that are shared with
libertas_sdio WiFi driver under libertas/. libertas_sdio looks in both places
and so should we.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
LR: dma: mv_xor: test for small transfers
LR: dma: mv_xor: remove minimal offload length threshold

This fatally confuses dma_async_memcpy_buf_to_pg which thinks it signals an out
of memory condition and retries indefinitelly, causing a soft lockup. The
threshold does not seem to be enforced by hardware (couldn't find anything like
that in a datasheet) and things seems to work fine without it. If there's a
performance penalty, it probably should be dealt with in dmaengine.

The following crash (with too small skb structure being dma_memcpy()'d) is
reprodcibly triggered by an accept() quickly followed by a read():
http://v3.sk/~lkundrak/so-beautiful/crasher.pl

BUG: soft lockup - CPU#0 stuck for 23s! [perl:715]
Modules linked in:
Pid: 715, comm:                 perl
CPU: 0    Not tainted  (3.6.7-2.fc18.armv5tel.kirkwood #1)
PC is at mv_xor_prep_dma_memcpy+0x14/0x168
LR is at dma_async_memcpy_pg_to_pg+0x100/0x1dc
sp : df197ce0  ip : c023816c  fp : 00000000
r10: c09a6720  r9 : 0000012a  r8 : 115d7000
r7 : ddd4f57c  r6 : ddd4f57c  r5 : ddd4f4a8  r4 : 00000034
r3 : 00000034  r2 : 115d7000  r1 : 116b912a  r0 : ddd4f57c
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 0005397f  Table: 1f218000  DAC: 00000015
[<c000edac>] (unwind_backtrace+0x0/0x124) from [<c0074ce4>] (watchdog_timer_fn+0xf0/0x144)
[<c0074ce4>] (watchdog_timer_fn+0xf0/0x144) from [<c003aa10>] (__run_hrtimer+0xb0/0x1d4)
[<c003aa10>] (__run_hrtimer+0xb0/0x1d4) from [<c003b224>] (hrtimer_interrupt+0x104/0x250)
[<c003b224>] (hrtimer_interrupt+0x104/0x250) from [<c0016024>] (orion_timer_interrupt+0x24/0x34)
[<c0016024>] (orion_timer_interrupt+0x24/0x34) from [<c0075470>] (handle_irq_event_percpu+0x38/0x23c)
[<c0075470>] (handle_irq_event_percpu+0x38/0x23c) from [<c00756a4>] (handle_irq_event+0x30/0x40)
[<c00756a4>] (handle_irq_event+0x30/0x40) from [<c0077cd4>] (handle_level_irq+0xcc/0xdc)
[<c0077cd4>] (handle_level_irq+0xcc/0xdc) from [<c0074e9c>] (generic_handle_irq+0x28/0x38)
[<c0074e9c>] (generic_handle_irq+0x28/0x38) from [<c0009b64>] (handle_IRQ+0x68/0x8c)
[<c0009b64>] (handle_IRQ+0x68/0x8c) from [<c0444794>] (__irq_svc+0x34/0x78)
[<c0444794>] (__irq_svc+0x34/0x78) from [<c0238180>] (mv_xor_prep_dma_memcpy+0x14/0x168)
[<c0238180>] (mv_xor_prep_dma_memcpy+0x14/0x168) from [<c0236010>] (dma_async_memcpy_pg_to_pg+0x100/0x1dc)
[<c0236010>] (dma_async_memcpy_pg_to_pg+0x100/0x1dc) from [<c0237594>] (dma_memcpy_pg_to_iovec+0xf0/0x180)
[<c0237594>] (dma_memcpy_pg_to_iovec+0xf0/0x180) from [<c03832f8>] (dma_skb_copy_datagram_iovec+0x100/0x1d4)
[<c03832f8>] (dma_skb_copy_datagram_iovec+0x100/0x1d4) from [<c03a9950>] (tcp_recvmsg+0x630/0xac0)
[<c03a9950>] (tcp_recvmsg+0x630/0xac0) from [<c03c8dd8>] (inet_recvmsg+0x48/0x5c)
[<c03c8dd8>] (inet_recvmsg+0x48/0x5c) from [<c035ba54>] (sock_aio_read+0x100/0x120)
[<c035ba54>] (sock_aio_read+0x100/0x120) from [<c00e53e0>] (do_sync_read+0x98/0xd4)
[<c00e53e0>] (do_sync_read+0x98/0xd4) from [<c00e5d54>] (vfs_read+0xb4/0x184)
[<c00e5d54>] (vfs_read+0xb4/0x184) from [<c00e5e60>] (sys_read+0x3c/0x70)
[<c00e5e60>] (sys_read+0x3c/0x70) from [<c0008c60>] (ret_fast_syscall+0x0/0x2c)
Kernel panic - not syncing: softlockup: hung tasks
[<c000edac>] (unwind_backtrace+0x0/0x124) from [<c043e0ac>] (panic+0x80/0x1e0)
[<c043e0ac>] (panic+0x80/0x1e0) from [<c0074d08>] (watchdog_timer_fn+0x114/0x144)
[<c0074d08>] (watchdog_timer_fn+0x114/0x144) from [<c003aa10>] (__run_hrtimer+0xb0/0x1d4)
[<c003aa10>] (__run_hrtimer+0xb0/0x1d4) from [<c003b224>] (hrtimer_interrupt+0x104/0x250)
[<c003b224>] (hrtimer_interrupt+0x104/0x250) from [<c0016024>] (orion_timer_interrupt+0x24/0x34)
[<c0016024>] (orion_timer_interrupt+0x24/0x34) from [<c0075470>] (handle_irq_event_percpu+0x38/0x23c)
[<c0075470>] (handle_irq_event_percpu+0x38/0x23c) from [<c00756a4>] (handle_irq_event+0x30/0x40)
[<c00756a4>] (handle_irq_event+0x30/0x40) from [<c0077cd4>] (handle_level_irq+0xcc/0xdc)
[<c0077cd4>] (handle_level_irq+0xcc/0xdc) from [<c0074e9c>] (generic_handle_irq+0x28/0x38)
[<c0074e9c>] (generic_handle_irq+0x28/0x38) from [<c0009b64>] (handle_IRQ+0x68/0x8c)
[<c0009b64>] (handle_IRQ+0x68/0x8c) from [<c0444794>] (__irq_svc+0x34/0x78)
[<c0444794>] (__irq_svc+0x34/0x78) from [<c0238180>] (mv_xor_prep_dma_memcpy+0x14/0x168)
[<c0238180>] (mv_xor_prep_dma_memcpy+0x14/0x168) from [<c0236010>] (dma_async_memcpy_pg_to_pg+0x100/0x1dc)
[<c0236010>] (dma_async_memcpy_pg_to_pg+0x100/0x1dc) from [<c0237594>] (dma_memcpy_pg_to_iovec+0xf0/0x180)
[<c0237594>] (dma_memcpy_pg_to_iovec+0xf0/0x180) from [<c03832f8>] (dma_skb_copy_datagram_iovec+0x100/0x1d4)
[<c03832f8>] (dma_skb_copy_datagram_iovec+0x100/0x1d4) from [<c03a9950>] (tcp_recvmsg+0x630/0xac0)
[<c03a9950>] (tcp_recvmsg+0x630/0xac0) from [<c03c8dd8>] (inet_recvmsg+0x48/0x5c)
[<c03c8dd8>] (inet_recvmsg+0x48/0x5c) from [<c035ba54>] (sock_aio_read+0x100/0x120)
[<c035ba54>] (sock_aio_read+0x100/0x120) from [<c00e53e0>] (do_sync_read+0x98/0xd4)
[<c00e53e0>] (do_sync_read+0x98/0xd4) from [<c00e5d54>] (vfs_read+0xb4/0x184)
[<c00e5d54>] (vfs_read+0xb4/0x184) from [<c00e5e60>] (sys_read+0x3c/0x70)
[<c00e5e60>] (sys_read+0x3c/0x70) from [<c0008c60>] (ret_fast_syscall+0x0/0x2c)
Rebooting in 1 seconds..

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
libertas: fix crash for SD8688

For SD8688, FUNC_INIT command is queued before fw_ready flag is
set. This causes the following crash as lbs_thread blocks any
command if fw_ready is not set.

[  209.338953] [<c0502248>] (__schedule+0x610/0x764) from [<bf20ae24>] (__lbs_cmd+0xb8/0x130 [libertas])
[  209.348340] [<bf20ae24>] (__lbs_cmd+0xb8/0x130 [libertas]) from [<bf222474>] (if_sdio_finish_power_on+0xec/0x1b0 [libertas_sdio])
[  209.360136] [<bf222474>] (if_sdio_finish_power_on+0xec/0x1b0 [libertas_sdio]) from [<bf2226c4>] (if_sdio_power_on+0x18c/0x20c [libertas_sdio])
[  209.373052] [<bf2226c4>] (if_sdio_power_on+0x18c/0x20c [libertas_sdio]) from [<bf222944>] (if_sdio_probe+0x200/0x31c [libertas_sdio])
[  209.385316] [<bf222944>] (if_sdio_probe+0x200/0x31c [libertas_sdio]) from [<bf01d820>] (sdio_bus_probe+0x94/0xfc [mmc_core])
[  209.396748] [<bf01d820>] (sdio_bus_probe+0x94/0xfc [mmc_core]) from [<c02e729c>] (driver_probe_device+0x12c/0x348)
[  209.407214] [<c02e729c>] (driver_probe_device+0x12c/0x348) from [<c02e7530>] (__driver_attach+0x78/0x9c)
[  209.416798] [<c02e7530>] (__driver_attach+0x78/0x9c) from [<c02e5658>] (bus_for_each_dev+0x50/0x88)
[  209.425946] [<c02e5658>] (bus_for_each_dev+0x50/0x88) from [<c02e6810>] (bus_add_driver+0x108/0x268)
[  209.435180] [<c02e6810>] (bus_add_driver+0x108/0x268) from [<c02e782c>] (driver_register+0xa4/0x134)
[  209.444426] [<c02e782c>] (driver_register+0xa4/0x134) from [<bf22601c>] (if_sdio_init_module+0x1c/0x3c [libertas_sdio])
[  209.455339] [<bf22601c>] (if_sdio_init_module+0x1c/0x3c [libertas_sdio]) from [<c00085b8>] (do_one_initcall+0x98/0x174)
[  209.466236] [<c00085b8>] (do_one_initcall+0x98/0x174) from [<c0076504>] (load_module+0x1c5c/0x1f80)
[  209.475390] [<c0076504>] (load_module+0x1c5c/0x1f80) from [<c007692c>] (sys_init_module+0x104/0x128)
[  209.484632] [<c007692c>] (sys_init_module+0x104/0x128) from [<c0008c40>] (ret_fast_syscall+0x0/0x38)

Fix it by setting fw_ready flag prior to queuing FUNC_INIT command.

Cc: <stable@vger.kernel.org> # 3.5+
Reported-by: Lubomir Rintel <lkundrak@v3.sk>
Tested-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Bing Zhao <bzhao@marvell.com>