--- /dev/null
+From 39141ddfb63a664f26d3f42f64ee386e879b492c Mon Sep 17 00:00:00 2001
+From: Paul Walmsley <paul@pwsan.com>
+Date: Tue, 23 Oct 2012 20:32:59 +0100
+Subject: ARM: 7566/1: vfp: fix save and restore when running on pre-VFPv3 and CONFIG_VFPv3 set
+
+From: Paul Walmsley <paul@pwsan.com>
+
+commit 39141ddfb63a664f26d3f42f64ee386e879b492c upstream.
+
+After commit 846a136881b8f73c1f74250bf6acfaa309cab1f2 ("ARM: vfp: fix
+saving d16-d31 vfp registers on v6+ kernels"), the OMAP 2430SDP board
+started crashing during boot with omap2plus_defconfig:
+
+[ 3.875122] mmcblk0: mmc0:e624 SD04G 3.69 GiB
+[ 3.915954] mmcblk0: p1
+[ 4.086639] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM
+[ 4.093719] Modules linked in:
+[ 4.096954] CPU: 0 Not tainted (3.6.0-02232-g759e00b #570)
+[ 4.103149] PC is at vfp_reload_hw+0x1c/0x44
+[ 4.107666] LR is at __und_usr_fault_32+0x0/0x8
+
+It turns out that the context save/restore fix unmasked a latent bug
+in commit 5aaf254409f8d58229107b59507a8235b715a960 ("ARM: 6203/1: Make
+VFPv3 usable on ARMv6"). When CONFIG_VFPv3 is set, but the kernel is
+booted on a pre-VFPv3 core, the code attempts to save and restore the
+d16-d31 VFP registers. These are only present on non-D16 VFPv3+, so
+this results in an undefined instruction exception. The code didn't
+crash before commit 846a136 because the save and restore code was
+only touching d0-d15, present on all VFP.
+
+Fix by implementing a request from Russell King to add a new HWCAP
+flag that affirmatively indicates the presence of the d16-d31
+registers:
+
+ http://marc.info/?l=linux-arm-kernel&m=135013547905283&w=2
+
+and some feedback from Måns to clarify the name of the HWCAP flag.
+
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dave Martin <dave.martin@linaro.org>
+Cc: Måns Rullgård <mans.rullgard@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/hwcap.h | 3 ++-
+ arch/arm/include/asm/vfpmacros.h | 12 ++++++------
+ arch/arm/vfp/vfpmodule.c | 9 ++++++---
+ 3 files changed, 14 insertions(+), 10 deletions(-)
+
+--- a/arch/arm/include/asm/hwcap.h
++++ b/arch/arm/include/asm/hwcap.h
+@@ -18,11 +18,12 @@
+ #define HWCAP_THUMBEE (1 << 11)
+ #define HWCAP_NEON (1 << 12)
+ #define HWCAP_VFPv3 (1 << 13)
+-#define HWCAP_VFPv3D16 (1 << 14)
++#define HWCAP_VFPv3D16 (1 << 14) /* also set for VFPv4-D16 */
+ #define HWCAP_TLS (1 << 15)
+ #define HWCAP_VFPv4 (1 << 16)
+ #define HWCAP_IDIVA (1 << 17)
+ #define HWCAP_IDIVT (1 << 18)
++#define HWCAP_VFPD32 (1 << 19) /* set if VFP has 32 regs (not 16) */
+ #define HWCAP_IDIV (HWCAP_IDIVA | HWCAP_IDIVT)
+
+ #if defined(__KERNEL__)
+--- a/arch/arm/include/asm/vfpmacros.h
++++ b/arch/arm/include/asm/vfpmacros.h
+@@ -27,9 +27,9 @@
+ #if __LINUX_ARM_ARCH__ <= 6
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+- tst \tmp, #HWCAP_VFPv3D16
+- ldceql p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+- addne \base, \base, #32*4 @ step over unused register space
++ tst \tmp, #HWCAP_VFPD32
++ ldcnel p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+@@ -51,9 +51,9 @@
+ #if __LINUX_ARM_ARCH__ <= 6
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+- tst \tmp, #HWCAP_VFPv3D16
+- stceql p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+- addne \base, \base, #32*4 @ step over unused register space
++ tst \tmp, #HWCAP_VFPD32
++ stcnel p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -701,11 +701,14 @@ static int __init vfp_init(void)
+ elf_hwcap |= HWCAP_VFPv3;
+
+ /*
+- * Check for VFPv3 D16. CPUs in this configuration
+- * only have 16 x 64bit registers.
++ * Check for VFPv3 D16 and VFPv4 D16. CPUs in
++ * this configuration only have 16 x 64bit
++ * registers.
+ */
+ if (((fmrx(MVFR0) & MVFR0_A_SIMD_MASK)) == 1)
+- elf_hwcap |= HWCAP_VFPv3D16;
++ elf_hwcap |= HWCAP_VFPv3D16; /* also v4-D16 */
++ else
++ elf_hwcap |= HWCAP_VFPD32;
+ }
+ #endif
+ /*
--- /dev/null
+From 91ab252ac5a5c3461dd6910797611e9172626aed Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Wed, 22 Aug 2012 06:49:47 +0000
+Subject: mmc: sh-mmcif: avoid oops on spurious interrupts (second try)
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 91ab252ac5a5c3461dd6910797611e9172626aed upstream.
+
+On some systems, e.g., kzm9g, MMCIF interfaces can produce spurious
+interrupts without any active request. To prevent the Oops, that results
+in such cases, don't dereference the mmc request pointer until we make
+sure, that we are indeed processing such a request.
+
+Reported-by: Tetsuyuki Kobayashi <koba@kmckk.co.jp>
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Tested-by: Tetsuyuki Kobayashi <koba@kmckk.co.jp>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sh_mmcif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sh_mmcif.c
++++ b/drivers/mmc/host/sh_mmcif.c
+@@ -1104,7 +1104,6 @@ static irqreturn_t sh_mmcif_irqt(int irq
+ {
+ struct sh_mmcif_host *host = dev_id;
+ struct mmc_request *mrq = host->mrq;
+- struct mmc_data *data = mrq->data;
+
+ cancel_delayed_work_sync(&host->timeout_work);
+
+@@ -1152,13 +1151,14 @@ static irqreturn_t sh_mmcif_irqt(int irq
+ case MMCIF_WAIT_FOR_READ_END:
+ case MMCIF_WAIT_FOR_WRITE_END:
+ if (host->sd_error)
+- data->error = sh_mmcif_error_manage(host);
++ mrq->data->error = sh_mmcif_error_manage(host);
+ break;
+ default:
+ BUG();
+ }
+
+ if (host->wait_for != MMCIF_WAIT_FOR_STOP) {
++ struct mmc_data *data = mrq->data;
+ if (!mrq->cmd->error && data && !data->error)
+ data->bytes_xfered =
+ data->blocks * data->blksz;
--- /dev/null
+From 6984f3c31bb57cb7491dbec1be44b74bd00f4648 Mon Sep 17 00:00:00 2001
+From: Chris Ball <cjb@laptop.org>
+Date: Mon, 3 Dec 2012 09:17:19 -0500
+Subject: Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts"
+
+From: Chris Ball <cjb@laptop.org>
+
+commit 6984f3c31bb57cb7491dbec1be44b74bd00f4648 upstream.
+
+This reverts commit 8464dd52d3198dd05, which was a misapplied debugging
+version of the patch, not the final patch itself.
+
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sh_mmcif.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/mmc/host/sh_mmcif.c
++++ b/drivers/mmc/host/sh_mmcif.c
+@@ -1229,10 +1229,6 @@ static irqreturn_t sh_mmcif_intr(int irq
+ host->sd_error = true;
+ dev_dbg(&host->pd->dev, "int err state = %08x\n", state);
+ }
+- if (host->state == STATE_IDLE) {
+- dev_info(&host->pd->dev, "Spurious IRQ status 0x%x", state);
+- return IRQ_HANDLED;
+- }
+ if (state & ~(INT_CMD12RBE | INT_CMD12CRE)) {
+ if (!host->dma_active)
+ return IRQ_WAKE_THREAD;
--- /dev/null
+tmpfs-fix-shared-mempolicy-leak.patch
+revert-misapplied-mmc-sh-mmcif-avoid-oops-on-spurious-interrupts.patch
+mmc-sh-mmcif-avoid-oops-on-spurious-interrupts-second-try.patch
+arm-7566-1-vfp-fix-save-and-restore-when-running-on-pre-vfpv3-and-config_vfpv3-set.patch
--- /dev/null
+From 18a2f371f5edf41810f6469cb9be39931ef9deb9 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Wed, 5 Dec 2012 14:01:41 -0800
+Subject: tmpfs: fix shared mempolicy leak
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.
+
+This fixes a regression in 3.7-rc, which has since gone into stable.
+
+Commit 00442ad04a5e ("mempolicy: fix a memory corruption by refcount
+imbalance in alloc_pages_vma()") changed get_vma_policy() to raise the
+refcount on a shmem shared mempolicy; whereas shmem_alloc_page() went
+on expecting alloc_page_vma() to drop the refcount it had acquired.
+This deserves a rework: but for now fix the leak in shmem_alloc_page().
+
+Hugh: shmem_swapin() did not need a fix, but surely it's clearer to use
+the same refcounting there as in shmem_alloc_page(), delete its onstack
+mempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() -
+those were invented to let swapin_readahead() make an unknown number of
+calls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e,
+alloc_pages_vma() has kept refcount in balance, so now no problem.
+
+Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mempolicy.h | 16 ----------------
+ mm/mempolicy.c | 22 ----------------------
+ mm/shmem.c | 26 ++++++++++++++++----------
+ 3 files changed, 16 insertions(+), 48 deletions(-)
+
+--- a/include/linux/mempolicy.h
++++ b/include/linux/mempolicy.h
+@@ -137,16 +137,6 @@ static inline void mpol_cond_put(struct
+ __mpol_put(pol);
+ }
+
+-extern struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol);
+-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol)
+-{
+- if (!frompol)
+- return frompol;
+- return __mpol_cond_copy(tompol, frompol);
+-}
+-
+ extern struct mempolicy *__mpol_dup(struct mempolicy *pol);
+ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
+ {
+@@ -270,12 +260,6 @@ static inline void mpol_cond_put(struct
+ {
+ }
+
+-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *to,
+- struct mempolicy *from)
+-{
+- return from;
+-}
+-
+ static inline void mpol_get(struct mempolicy *pol)
+ {
+ }
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2035,28 +2035,6 @@ struct mempolicy *__mpol_dup(struct memp
+ return new;
+ }
+
+-/*
+- * If *frompol needs [has] an extra ref, copy *frompol to *tompol ,
+- * eliminate the * MPOL_F_* flags that require conditional ref and
+- * [NOTE!!!] drop the extra ref. Not safe to reference *frompol directly
+- * after return. Use the returned value.
+- *
+- * Allows use of a mempolicy for, e.g., multiple allocations with a single
+- * policy lookup, even if the policy needs/has extra ref on lookup.
+- * shmem_readahead needs this.
+- */
+-struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol)
+-{
+- if (!mpol_needs_cond_ref(frompol))
+- return frompol;
+-
+- *tompol = *frompol;
+- tompol->flags &= ~MPOL_F_SHARED; /* copy doesn't need unref */
+- __mpol_put(frompol);
+- return tompol;
+-}
+-
+ /* Slow path of a mempolicy comparison */
+ bool __mpol_equal(struct mempolicy *a, struct mempolicy *b)
+ {
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -921,25 +921,29 @@ static struct mempolicy *shmem_get_sbmpo
+ static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
+ struct shmem_inode_info *info, pgoff_t index)
+ {
+- struct mempolicy mpol, *spol;
+ struct vm_area_struct pvma;
+-
+- spol = mpol_cond_copy(&mpol,
+- mpol_shared_policy_lookup(&info->policy, index));
++ struct page *page;
+
+ /* Create a pseudo vma that just contains the policy */
+ pvma.vm_start = 0;
+ /* Bias interleave by inode number to distribute better across nodes */
+ pvma.vm_pgoff = index + info->vfs_inode.i_ino;
+ pvma.vm_ops = NULL;
+- pvma.vm_policy = spol;
+- return swapin_readahead(swap, gfp, &pvma, 0);
++ pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, index);
++
++ page = swapin_readahead(swap, gfp, &pvma, 0);
++
++ /* Drop reference taken by mpol_shared_policy_lookup() */
++ mpol_cond_put(pvma.vm_policy);
++
++ return page;
+ }
+
+ static struct page *shmem_alloc_page(gfp_t gfp,
+ struct shmem_inode_info *info, pgoff_t index)
+ {
+ struct vm_area_struct pvma;
++ struct page *page;
+
+ /* Create a pseudo vma that just contains the policy */
+ pvma.vm_start = 0;
+@@ -948,10 +952,12 @@ static struct page *shmem_alloc_page(gfp
+ pvma.vm_ops = NULL;
+ pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, index);
+
+- /*
+- * alloc_page_vma() will drop the shared policy reference
+- */
+- return alloc_page_vma(gfp, &pvma, 0);
++ page = alloc_page_vma(gfp, &pvma, 0);
++
++ /* Drop reference taken by mpol_shared_policy_lookup() */
++ mpol_cond_put(pvma.vm_policy);
++
++ return page;
+ }
+ #else /* !CONFIG_NUMA */
+ #ifdef CONFIG_TMPFS
projects / thirdparty / kernel / stable-queue.git / commitdiff
