Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm

Pull ARM fixes from Russell King:
 "This resolves some further issues with the dma mask changes on ARM
  which have been found by TI and others, and also some corner cases
  with the updates to the virtual to physical address translations.

  Konstantin also found some problems with the unwinder, which now
  performs tighter verification that the stack is valid while unwinding"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: fix asm/memory.h build error
  ARM: 7917/1: cacheflush: correctly limit range of memory region being flushed
  ARM: 7913/1: fix framepointer check in unwind_frame
  ARM: 7912/1: check stack pointer in get_wchan
  ARM: 7909/1: mm: Call setup_dma_zone() post early_paging_init()
  ARM: 7908/1: mm: Fix the arm_dma_limit calculation
  ARM: another fix for the DMA mapping checks

9 files changed, 67 insertions, 78 deletions

diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 9ecccc865046..6976b03e5213 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -100,23 +100,19 @@
 #define TASK_UNMAPPED_BASE      UL(0x00000000)
 #endif
 
-#ifndef PHYS_OFFSET
-#define PHYS_OFFSET             UL(CONFIG_DRAM_BASE)
-#endif
-
 #ifndef END_MEM
 #define END_MEM                 (UL(CONFIG_DRAM_BASE) + CONFIG_DRAM_SIZE)
 #endif
 
 #ifndef PAGE_OFFSET
-#define PAGE_OFFSET             (PHYS_OFFSET)
+#define PAGE_OFFSET             PLAT_PHYS_OFFSET
 #endif
 
 /*
  * The module can be at any place in ram in nommu mode.
  */
 #define MODULES_END             (END_MEM)
-#define MODULES_VADDR           (PHYS_OFFSET)
+#define MODULES_VADDR           PAGE_OFFSET
 
 #define XIP_VIRT_ADDR(physaddr)  (physaddr)
 
@@ -157,6 +153,16 @@
 #endif
 #define ARCH_PGD_MASK           ((1 << ARCH_PGD_SHIFT) - 1)
 
+/*
+ * PLAT_PHYS_OFFSET is the offset (from zero) of the start of physical
+ * memory.  This is used for XIP and NoMMU kernels, or by kernels which
+ * have their own mach/memory.h.  Assembly code must always use
+ * PLAT_PHYS_OFFSET and not PHYS_OFFSET.
+ */
+#ifndef PLAT_PHYS_OFFSET
+#define PLAT_PHYS_OFFSET        UL(CONFIG_PHYS_OFFSET)
+#endif
+
 #ifndef __ASSEMBLY__
 
 /*
@@ -239,6 +245,8 @@ static inline unsigned long __phys_to_virt(phys_addr_t x)
 
 #else
 
+#define PHYS_OFFSET     PLAT_PHYS_OFFSET
+
 static inline phys_addr_t __virt_to_phys(unsigned long x)
 {
         return (phys_addr_t)x - PAGE_OFFSET + PHYS_OFFSET;
@@ -251,17 +259,6 @@ static inline unsigned long __phys_to_virt(phys_addr_t x)
 
 #endif
 #endif
-#endif /* __ASSEMBLY__ */
-
-#ifndef PHYS_OFFSET
-#ifdef PLAT_PHYS_OFFSET
-#define PHYS_OFFSET     PLAT_PHYS_OFFSET
-#else
-#define PHYS_OFFSET     UL(CONFIG_PHYS_OFFSET)
-#endif
-#endif
-
-#ifndef __ASSEMBLY__
 
 /*
  * PFNs are used to describe any physical page; this means
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index 14235ba64a90..716249cc2ee1 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -68,7 +68,7 @@ ENTRY(stext)
 
 #ifdef CONFIG_ARM_MPU
         /* Calculate the size of a region covering just the kernel */
-        ldr     r5, =PHYS_OFFSET                @ Region start: PHYS_OFFSET
+        ldr     r5, =PLAT_PHYS_OFFSET           @ Region start: PHYS_OFFSET
         ldr     r6, =(_end)                     @ Cover whole kernel
         sub     r6, r6, r5                      @ Minimum size of region to map
         clz     r6, r6                          @ Region size must be 2^N...
@@ -213,7 +213,7 @@ ENTRY(__setup_mpu)
         set_region_nr r0, #MPU_RAM_REGION
         isb
         /* Full access from PL0, PL1, shared for CONFIG_SMP, cacheable */
-        ldr     r0, =PHYS_OFFSET                @ RAM starts at PHYS_OFFSET
+        ldr     r0, =PLAT_PHYS_OFFSET           @ RAM starts at PHYS_OFFSET
         ldr     r5,=(MPU_AP_PL1RW_PL0RW | MPU_RGN_NORMAL)
 
         setup_region r0, r5, r6, MPU_DATA_SIDE  @ PHYS_OFFSET, shared, enabled
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 11d59b32fb8d..32f317e5828a 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -110,7 +110,7 @@ ENTRY(stext)
         sub     r4, r3, r4                      @ (PHYS_OFFSET - PAGE_OFFSET)
         add     r8, r8, r4                      @ PHYS_OFFSET
 #else
-        ldr     r8, =PHYS_OFFSET                @ always constant in this case
+        ldr     r8, =PLAT_PHYS_OFFSET           @ always constant in this case
 #endif
 
         /*
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 94f6b05f9e24..92f7b15dd221 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -404,6 +404,7 @@ EXPORT_SYMBOL(dump_fpu);
 unsigned long get_wchan(struct task_struct *p)
 {
         struct stackframe frame;
+        unsigned long stack_page;
         int count = 0;
         if (!p || p == current || p->state == TASK_RUNNING)
                 return 0;
@@ -412,9 +413,11 @@ unsigned long get_wchan(struct task_struct *p)
         frame.sp = thread_saved_sp(p);
         frame.lr = 0;                   /* recovered from the stack */
         frame.pc = thread_saved_pc(p);
+        stack_page = (unsigned long)task_stack_page(p);
         do {
-                int ret = unwind_frame(&frame);
-                if (ret < 0)
+                if (frame.sp < stack_page ||
+                    frame.sp >= stack_page + THREAD_SIZE ||
+                    unwind_frame(&frame) < 0)
                         return 0;
                 if (!in_sched_functions(frame.pc))
                         return frame.pc;
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 6a1b8a81b1ae..987a7f5bce5f 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -873,8 +873,6 @@ void __init setup_arch(char **cmdline_p)
         machine_desc = mdesc;
         machine_name = mdesc->name;
 
-        setup_dma_zone(mdesc);
-
         if (mdesc->reboot_mode != REBOOT_HARD)
                 reboot_mode = mdesc->reboot_mode;
 
@@ -892,6 +890,7 @@ void __init setup_arch(char **cmdline_p)
         sort(&meminfo.bank, meminfo.nr_banks, sizeof(meminfo.bank[0]), meminfo_cmp, NULL);
 
         early_paging_init(mdesc, lookup_processor_type(read_cpuid_id()));
+        setup_dma_zone(mdesc);
         sanity_check_meminfo();
         arm_memblock_init(&meminfo, mdesc);
 
diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index 00f79e59985b..af4e8c8a5422 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -31,7 +31,7 @@ int notrace unwind_frame(struct stackframe *frame)
         high = ALIGN(low, THREAD_SIZE);
 
         /* check current frame pointer is within bounds */
-        if (fp < (low + 12) || fp + 4 >= high)
+        if (fp < low + 12 || fp > high - 4)
                 return -EINVAL;
 
         /* restore the registers from the stack frame */
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index dbf0923e8d76..7940241f0576 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -509,9 +509,10 @@ static inline int
 __do_cache_op(unsigned long start, unsigned long end)
 {
         int ret;
-        unsigned long chunk = PAGE_SIZE;
 
         do {
+                unsigned long chunk = min(PAGE_SIZE, end - start);
+
                 if (signal_pending(current)) {
                         struct thread_info *ti = current_thread_info();
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f6b6bfa88ecf..f61a5707823a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -158,13 +158,49 @@ struct dma_map_ops arm_coherent_dma_ops = {
 };
 EXPORT_SYMBOL(arm_coherent_dma_ops);
 
+static int __dma_supported(struct device *dev, u64 mask, bool warn)
+{
+        unsigned long max_dma_pfn;
+
+        /*
+         * If the mask allows for more memory than we can address,
+         * and we actually have that much memory, then we must
+         * indicate that DMA to this device is not supported.
+         */
+        if (sizeof(mask) != sizeof(dma_addr_t) &&
+            mask > (dma_addr_t)~0 &&
+            dma_to_pfn(dev, ~0) < max_pfn) {
+                if (warn) {
+                        dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
+                                 mask);
+                        dev_warn(dev, "Driver did not use or check the return value from dma_set_coherent_mask()?\n");
+                }
+                return 0;
+        }
+
+        max_dma_pfn = min(max_pfn, arm_dma_pfn_limit);
+
+        /*
+         * Translate the device's DMA mask to a PFN limit.  This
+         * PFN number includes the page which we can DMA to.
+         */
+        if (dma_to_pfn(dev, mask) < max_dma_pfn) {
+                if (warn)
+                        dev_warn(dev, "Coherent DMA mask %#llx (pfn %#lx-%#lx) covers a smaller range of system memory than the DMA zone pfn 0x0-%#lx\n",
+                                 mask,
+                                 dma_to_pfn(dev, 0), dma_to_pfn(dev, mask) + 1,
+                                 max_dma_pfn + 1);
+                return 0;
+        }
+
+        return 1;
+}
+
 static u64 get_coherent_dma_mask(struct device *dev)
 {
         u64 mask = (u64)DMA_BIT_MASK(32);
 
         if (dev) {
-                unsigned long max_dma_pfn;
-
                 mask = dev->coherent_dma_mask;
 
                 /*
@@ -176,34 +212,8 @@ static u64 get_coherent_dma_mask(struct device *dev)
                         return 0;
                 }
 
-                max_dma_pfn = min(max_pfn, arm_dma_pfn_limit);
-
-                /*
-                 * If the mask allows for more memory than we can address,
-                 * and we actually have that much memory, then fail the
-                 * allocation.
-                 */
-                if (sizeof(mask) != sizeof(dma_addr_t) &&
-                    mask > (dma_addr_t)~0 &&
-                    dma_to_pfn(dev, ~0) > max_dma_pfn) {
-                        dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
-                                 mask);
-                        dev_warn(dev, "Driver did not use or check the return value from dma_set_coherent_mask()?\n");
-                        return 0;
-                }
-
-                /*
-                 * Now check that the mask, when translated to a PFN,
-                 * fits within the allowable addresses which we can
-                 * allocate.
-                 */
-                if (dma_to_pfn(dev, mask) < max_dma_pfn) {
-                        dev_warn(dev, "Coherent DMA mask %#llx (pfn %#lx-%#lx) covers a smaller range of system memory than the DMA zone pfn 0x0-%#lx\n",
-                                 mask,
-                                 dma_to_pfn(dev, 0), dma_to_pfn(dev, mask) + 1,
-                                 arm_dma_pfn_limit + 1);
+                if (!__dma_supported(dev, mask, true))
                         return 0;
-                }
         }
 
         return mask;
@@ -1032,28 +1042,7 @@ void arm_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
  */
 int dma_supported(struct device *dev, u64 mask)
 {
-        unsigned long limit;
-
-        /*
-         * If the mask allows for more memory than we can address,
-         * and we actually have that much memory, then we must
-         * indicate that DMA to this device is not supported.
-         */
-        if (sizeof(mask) != sizeof(dma_addr_t) &&
-            mask > (dma_addr_t)~0 &&
-            dma_to_pfn(dev, ~0) > arm_dma_pfn_limit)
-                return 0;
-
-        /*
-         * Translate the device's DMA mask to a PFN limit.  This
-         * PFN number includes the page which we can DMA to.
-         */
-        limit = dma_to_pfn(dev, mask);
-
-        if (limit < arm_dma_pfn_limit)
-                return 0;
-
-        return 1;
+        return __dma_supported(dev, mask, false);
 }
 EXPORT_SYMBOL(dma_supported);
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 3e8f106ee5fe..1f7b19a47060 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -229,7 +229,7 @@ void __init setup_dma_zone(const struct machine_desc *mdesc)
 #ifdef CONFIG_ZONE_DMA
         if (mdesc->dma_zone_size) {
                 arm_dma_zone_size = mdesc->dma_zone_size;
-                arm_dma_limit = PHYS_OFFSET + arm_dma_zone_size - 1;
+                arm_dma_limit = __pv_phys_offset + arm_dma_zone_size - 1;
         } else
                 arm_dma_limit = 0xffffffff;
         arm_dma_pfn_limit = arm_dma_limit >> PAGE_SHIFT;