Commit Graph

166922 Commits

Author SHA1 Message Date
Anson Huang
4a85f59f3f LF-2777 arm64: dts: imx8qm: Update A53 opp table
The A53 900MHz opp is actually 896MHz when reading back from SCFW, so
use the 896MHz instead of 900MHz to make it accurate enough.

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>
(cherry picked from commit 58be8bf3e6e8f51ed3a3b8f992baaa9eeaf3516d)
2020-11-16 12:34:35 +08:00
Oliver F. Brown
02d63a2afb MLK-25000-2: imx8mp: Add IDs in ISP nodes
Adding "id" parameter in the ISP deivce nodes.

Signed-off-by: Oliver F. Brown <oliver.brown@nxp.com>
2020-11-13 07:58:53 -06:00
Thies Moeller
cbccc8fc02 MLK-24996: arm64: dts: imx8mp: Change the name for the Basler camera
Change the name of the Balser camera node from basler_camera to basler_camera_vvcam.

Signed-off-by: Oliver F. Brown <oliver.brown@nxp.com>
2020-11-13 07:58:53 -06:00
Shengjiu Wang
bf89c5f6cb MLK-25004-2: arm64: dts: imx8mp-evk-dsp: remove unused pll clock
Remove unused pll8k and pll11k clock.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Peng Zhang <peng.zhang_8@nxp.com>
2020-11-13 18:54:31 +08:00
Jacky Bai
8a28e705c2 MLK-24992-02 arm64: dts: freescale: Update the clock frequency to ND mode on imx8mp ddr4 evk
As the i.MX8MP DDR4 EVK board is running at ND mode, so the clock
frequency of bus & peripherals need to be updated to ND mode setting
accordingly. GIC, NOC & NOC_IO frequency is already configured as
ND mode setting when boot into linux kernel, so skip the configure
for them.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Anson Huang <anson.huang@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
2020-11-13 17:32:22 +08:00
Robin Gong
73408def6a LF-2661: arm64: dts: imx8mq: correct sdma device name
correct sdma device name as other socS, otherwise sdma firmware loaded in
Yocto will be failed since its rule is based on '30bd0000.dma-controller'
instead of '30bd0000.sdma' as other socS.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Shengjiu Wang <shengjiu.wang@nxp.com>
(cherry picked from commit 1d3c451b9703cd7b3b59c25f58bc541f8c30e8ae)
2020-11-13 02:20:25 +08:00
Li Jun
9edb51f39e MLK-24050-2 arm64: dts: imx8mp-evk: add usb phy tuning for certification
Add phy tuning result for USB certification, mainly for pass
eye pattern test, 6 parameters involved, details please check
its dt binding doc:
Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.txt

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
(cherry picked from commit 87c832bb437df4a88a6331217ca64f6771ca569f)
2020-11-12 14:07:24 +08:00
Robert Chiras
acc1b3c876 MLK-24344: arch: arm64: dts: imx8dxl: Fix lcdif pinctrl settings
The pinctrl settings for LCDIF were wrongly implemented, so correct
them.

Signed-off-by: Robert Chiras <robert.chiras@nxp.com>
Acked-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
2020-11-06 10:58:30 +02:00
Jian Li
876a268f04 MLK-24970 imx8mp: vpu: change vpu clock to max frequency in OD mode
Change to max frequency that defined in OD mode for higher performance.
G1: 800M
G2: 700M
VC8000E: 500M
VPU_BUS: 800M

Signed-off-by: Jian Li <jian.li@nxp.com>
Reviewed-by: Zhou Peng <eagle.zhou@nxp.com>
2020-11-06 15:29:10 +08:00
Viorel Suman
a51f268dd7 MLK-24957-2 arm64: dtsi: imx8mp: remove fsl,xcvr-fw property
Remove fsl,xcvr-fw property from xcvr node in sync
with the upstream accepted driver version.

Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
2020-11-02 20:07:35 +02:00
Anson Huang
f676b0e9ec MLK-24955 arm64: dts: imx8mp: Update pin function file according to Rev.D RM
Update i.MX8MP imx8mp-pinfunc.h file according latest reference manual Rev.D.

Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>
2020-11-02 16:50:36 +08:00
Fugang Duan
845620ec5d MLK-24940 arm: imx: correctly check the return value of "of_get_mac_address"
commit d01f449c00 ("of_net: add NVMEM support to of_get_mac_address")
introduces more return value types, so it has to use IS_ERR to check
the return value.

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
2020-10-30 11:08:17 +08:00
Sherry Sun
7d2f72ec41 MLK-24937-1 ARM64: imx_v8_defconfig: build mic_host/SCIF/COSM as modules
Since imx_mic_host module depends on COSM module, and COSM module
depends on SCIF module, so enable these modules and build them as
modules.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
2020-10-30 09:38:48 +08:00
Jian Li
e3746dc9f4 MLK-24928 lcdifv3 dts: increase lcdif FIFO panic level for 4K display
Can see lcdif underrun occasionally in 4k display when run stress case
Increase lcdif FIFO panic level to avoid underrun

Signed-off-by: Jian Li <jian.li@nxp.com>
Reviewed-by: Fancy Fang <chen.fang@nxp.com>
2020-10-28 15:39:32 +08:00
Bing Song
c630a43169 MLK-24924-1 dsp: dts: 8mp: change ocram layout for lpa
ATF put into the end of OCRAM on 8mp A1. Change the ocram layout
for lpa.

Signed-off-by: Bing Song <bing.song@nxp.com>
2020-10-28 09:13:04 +08:00
Peng Fan
358efb2c0a MLK-24921 arm64: dts: add i.MX8DXL ddr3 evk rpmsg dts
Add i.MX8DXL DDR3 EVK rpmsg dts for communicating with M4

Reviewed-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2020-10-27 13:40:08 +08:00
Richard Zhu
06d81e69dd MLK-24910-1 arm64: dts: imx8mp: set the max speed of pcie to gen3
Since the bug had been fixed on A1 chip, and PCIe GEN3 can can be
supported now.
Set the max speed of iMX8MP PCIe to GEN3.

Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Reviewed-by: Fugang Duan <fugang.duan@nxp.com>
2020-10-26 11:39:29 +08:00
Jacky Bai
9e0665fc3f MLK-24914 irqchip: gpcv2: Revert "MLK-23354 irqchip: gpcv2: Add wait mode workaround on imx8mp"
This reverts commit 3d65a35181.

The i.MX8MP A0 silicon will not be supported, so revert the SW workaround
for A0 to provide more robust & clean code support for i.MX8MP.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Tested-by: Jian Li <jian.li@nxp.com>
2020-10-23 17:17:50 +08:00
Xianzhong
b271f1feb0 MGS-6010 arm64: dts: imx8qm-mek: reserve 256M GPU memory above 4GB
add memory-region to reserve GPU memory above 4G region.

Signed-off-by: Xianzhong <xianzhong.li@nxp.com>
2020-10-22 17:14:28 +08:00
Jian Li
802187edf3 MLK-24900-2 drm/imx: lcdifv3: adjust panic threshold for ddr4 evk
DDR4 EVK need larger min/max panic threshold to avoid display flickering

Signed-off-by: Jian Li <jian.li@nxp.com>
Reviewed-by: Fancy Fang <chen.fang@nxp.com>
2020-10-20 13:09:40 +08:00
Jacky Bai
98d2a8d148 MLK-24898 arm64: dts: freescale: Add imx8mp ddr4 evk board support
Add the i.MX8MP DDR4 EVK board support, on this board, there are
no flexspi & eMMC, so disable these nodes.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
2020-10-19 17:00:13 +08:00
Robin Gong
d3cc9b105b MLK-24895: arm64: dts: imx8mm-ddr4-evk: correct ddr4 evk
Correct ddr4 evk board dts since it's based on old i.mx8mm-evk board.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Fugang Duan <fugang.duan@nxp.com>
2020-10-16 23:14:44 +08:00
Fugang Duan
512d0659ee MLK-24894 arm64: dts: imx8mm-evk: add nxp 88w8987 wireless support
Add nxp 88w8987 wireless support on imx8mm lpddr4 evk:
- covert to use pwrseq instead of regulator
- enable 32Khz input
- set 16k sample rate for bt sco

Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
2020-10-16 13:11:26 +08:00
Alice Guo
dd2aefcf94 MLK-22870 arm64: dts: add OCOTP clock
Use the kexec command to restart the root cell Linux, and the system
will hang up in imx8mm_soc_uid(). The reason is that ocotp root clk is
not enabled when the unique ID is read. Therefore, add CLK_OCOTP_ROOT to
init-on-array in root.dts to ensure that ocotp root clk in the root cell
Linux is always enabled.

Signed-off-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
2020-10-15 14:05:41 +08:00
Robin Gong
1657a49e90 MLK-24888: arm64: dts: imx8mm-evk: change to pca9450 pmic
changed to pca9450 pmic for new i.mx8mm-evk board.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>
2020-10-15 01:41:49 +08:00
Alice Guo
7574650275 MLK-22869 arch: arm64: imx8mn: fix i.MX8MN ocotp compatible string
In imx8mn.dtsi, "fsl,imx7d-ocotp" should not be added to compatible of
ocotp-ctrl because the ocotp of i.MX8MN is incompatible with i.MX7D, and
it is compatible with i.MX8MM.

And with the upper change, we could also see the real value of soc_uid
by cat /sys/devices/soc0/soc_uid.

Signed-off-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
2020-10-13 17:39:53 +08:00
Haibo Chen
f76fd2c91d MLK-24862-4 ARM64: imx_v8_defconfig: default build the goodix.c as module
Goodix GT1151Q touch chip seem not that sensitive with the reset
operation. So after power up, even without reset operation, still
can work well. So touch can probe before the panel. But panel will
do the reset operation when it probe, this reset operation will cost
over 10ms. During the reset operation, touch can't work, i2c data
operation will meet error, and the error log will print out into the
system boot log. To avoid this error log, default build the goodix
touch driver as module, and load automatically. This way, touch
always probe after panel finish the reset operation.

This method also keep align with the old OLED panel(rm67191).

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
2020-10-10 10:40:04 +08:00
Haibo Chen
623fa77605 MLK-24862-3 ARM64: dts: imx8mq-evk-dcss-rm67199.dts: force the irq trigger method to edge falling
Add the property "edge-failling-trigger" to force the driver use the
edge falling irq trigger method.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
2020-10-10 10:40:04 +08:00
Haibo Chen
bd81511b80 MLK-24862-1 ARM64: dts: imx8mq-evk-dcss-rm67199: add goodix touch support
The new OLED not only use a new DSI panel(Raydium RM67199), but
also use a new touch chip, goodix gt1151q. This touch chip also
share the reset pin with the panel. According to the test, this
touch chip is not that critical with the reset operation, so
let panel control the reset pin.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
2020-10-10 10:40:04 +08:00
Shengjiu Wang
41eeeb0492 MLK-24875-2: arm64: dts: imx8dxl-ddr3-evk: Add support of audio sound card
Compare with imx8dxl evk board, there is 4 sound card on ddr3-evk board,
The pin of MCLK_OUT0 is changed, and the headphone jack detect device is
changed from U82 to U84.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
2020-10-09 18:39:42 +08:00
Han Xu
6b8a945ec1 MLK-24870-2: arm64: dts: add dedicate compatible string for DXL FSPI
Added dedicate compatible string for DXL to use IPS to read data for
DXL.

Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Frank Li <frank.li@nxp.com>
2020-10-08 13:57:53 -05:00
Jason Liu
2f68e5475b Merge tag 'v5.4.70' into imx_5.4.y
* tag 'v5.4.70': (3051 commits)
  Linux 5.4.70
  netfilter: ctnetlink: add a range check for l3/l4 protonum
  ep_create_wakeup_source(): dentry name can change under you...
  ...

 Conflicts:
	arch/arm/mach-imx/pm-imx6.c
	arch/arm64/boot/dts/freescale/imx8mm-evk.dts
	arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts
	drivers/crypto/caam/caamalg.c
	drivers/gpu/drm/imx/dw_hdmi-imx.c
	drivers/gpu/drm/imx/imx-ldb.c
	drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
	drivers/mmc/host/sdhci-esdhc-imx.c
	drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
	drivers/net/ethernet/freescale/enetc/enetc.c
	drivers/net/ethernet/freescale/enetc/enetc_pf.c
	drivers/thermal/imx_thermal.c
	drivers/usb/cdns3/ep0.c
	drivers/xen/swiotlb-xen.c
	sound/soc/fsl/fsl_esai.c
	sound/soc/fsl/fsl_sai.c

Signed-off-by: Jason Liu <jason.hui.liu@nxp.com>
2020-10-08 17:46:51 +08:00
Daniel Baluta
024566cea6 MLK-24615-5 arm64: defconfig: Remove FSL_DAI config option
Because FSL DAI driver was removed, we no longer
need the FSL_DAI config option.

Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-07 15:40:50 +03:00
Daniel Baluta
c19a2d13c1 MLK-24615-3 arm64: dts: imx8mp-sof-wm8960: Remove FSL DAI generic node
This removes FSL DAI generic node (as per upstream guidance)
and moves all resource handling to dsp node.

Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-07 11:59:39 +03:00
Laurent Dufour
42b7153dd6 mm: replace memmap_context by meminit_context
commit c1d0da83358a2316d9be7f229f26126dbaa07468 upstream.

Patch series "mm: fix memory to node bad links in sysfs", v3.

Sometimes, firmware may expose interleaved memory layout like this:

 Early memory node ranges
   node   1: [mem 0x0000000000000000-0x000000011fffffff]
   node   2: [mem 0x0000000120000000-0x000000014fffffff]
   node   1: [mem 0x0000000150000000-0x00000001ffffffff]
   node   0: [mem 0x0000000200000000-0x000000048fffffff]
   node   2: [mem 0x0000000490000000-0x00000007ffffffff]

In that case, we can see memory blocks assigned to multiple nodes in
sysfs:

  $ ls -l /sys/devices/system/memory/memory21
  total 0
  lrwxrwxrwx 1 root root     0 Aug 24 05:27 node1 -> ../../node/node1
  lrwxrwxrwx 1 root root     0 Aug 24 05:27 node2 -> ../../node/node2
  -rw-r--r-- 1 root root 65536 Aug 24 05:27 online
  -r--r--r-- 1 root root 65536 Aug 24 05:27 phys_device
  -r--r--r-- 1 root root 65536 Aug 24 05:27 phys_index
  drwxr-xr-x 2 root root     0 Aug 24 05:27 power
  -r--r--r-- 1 root root 65536 Aug 24 05:27 removable
  -rw-r--r-- 1 root root 65536 Aug 24 05:27 state
  lrwxrwxrwx 1 root root     0 Aug 24 05:25 subsystem -> ../../../../bus/memory
  -rw-r--r-- 1 root root 65536 Aug 24 05:25 uevent
  -r--r--r-- 1 root root 65536 Aug 24 05:27 valid_zones

The same applies in the node's directory with a memory21 link in both
the node1 and node2's directory.

This is wrong but doesn't prevent the system to run.  However when
later, one of these memory blocks is hot-unplugged and then hot-plugged,
the system is detecting an inconsistency in the sysfs layout and a
BUG_ON() is raised:

  kernel BUG at /Users/laurent/src/linux-ppc/mm/memory_hotplug.c:1084!
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in: rpadlpar_io rpaphp pseries_rng rng_core vmx_crypto gf128mul binfmt_misc ip_tables x_tables xfs libcrc32c crc32c_vpmsum autofs4
  CPU: 8 PID: 10256 Comm: drmgr Not tainted 5.9.0-rc1+ #25
  Call Trace:
    add_memory_resource+0x23c/0x340 (unreliable)
    __add_memory+0x5c/0xf0
    dlpar_add_lmb+0x1b4/0x500
    dlpar_memory+0x1f8/0xb80
    handle_dlpar_errorlog+0xc0/0x190
    dlpar_store+0x198/0x4a0
    kobj_attr_store+0x30/0x50
    sysfs_kf_write+0x64/0x90
    kernfs_fop_write+0x1b0/0x290
    vfs_write+0xe8/0x290
    ksys_write+0xdc/0x130
    system_call_exception+0x160/0x270
    system_call_common+0xf0/0x27c

This has been seen on PowerPC LPAR.

The root cause of this issue is that when node's memory is registered,
the range used can overlap another node's range, thus the memory block
is registered to multiple nodes in sysfs.

There are two issues here:

 (a) The sysfs memory and node's layouts are broken due to these
     multiple links

 (b) The link errors in link_mem_sections() should not lead to a system
     panic.

To address (a) register_mem_sect_under_node should not rely on the
system state to detect whether the link operation is triggered by a hot
plug operation or not.  This is addressed by the patches 1 and 2 of this
series.

Issue (b) will be addressed separately.

This patch (of 2):

The memmap_context enum is used to detect whether a memory operation is
due to a hot-add operation or happening at boot time.

Make it general to the hotplug operation and rename it as
meminit_context.

There is no functional change introduced by this patch

Suggested-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J . Wysocki" <rafael@kernel.org>
Cc: Nathan Lynch <nathanl@linux.ibm.com>
Cc: Scott Cheloha <cheloha@linux.ibm.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200915094143.79181-1-ldufour@linux.ibm.com
Link: https://lkml.kernel.org/r/20200915132624.9723-1-ldufour@linux.ibm.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-07 08:01:29 +02:00
Daniel Baluta
2cc8fc5c0d MLK-24668-6 arm64: dts: imx8qxp-sof-cs4288: Remove FSL DAI generic node
This removes FSL DAI generic node (as per upstream guidance)
and move all resource handling to dsp node.

Reviewed-by: Paul Olaru <paul.olaru@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-06 13:30:05 +03:00
Daniel Baluta
d1a296c0ba MLK-24668-5 arm64: dts: imx8qm-sof-wm8960: Remove FSL DAI generic node
This removes FSL DAI generic node (as per upstream guidance)
and move all resource handling to dsp node.

Reviewed-by: Paul Olaru <paul.olaru@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-06 13:30:00 +03:00
Daniel Baluta
4b99159456 MLK-24668-4 arm64: dts: imx8qxp-sof-wm8960: Remove FSL DAI generic node
This removes FSL DAI generic node (as per upstream guidance)
and move all resource handling to dsp node.

Reviewed-by: Paul Olaru <paul.olaru@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-06 13:29:55 +03:00
Daniel Baluta
4bf6280655 MLK-24668-3 arm64: dts: imx8qxp-sof-cs4288: Remove FSL DAI generic node
This removes FSL DAI generic node (as per upstream guidance)
and move all resource handling to dsp node.

Reviewed-by: Paul Olaru <paul.olaru@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
2020-10-06 13:29:49 +03:00
Marc Zyngier
c9bfb7b4d9 KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch
commit c4ad98e4b72cb5be30ea282fce935248f2300e62 upstream.

KVM currently assumes that an instruction abort can never be a write.
This is in general true, except when the abort is triggered by
a S1PTW on instruction fetch that tries to update the S1 page tables
(to set AF, for example).

This can happen if the page tables have been paged out and brought
back in without seeing a direct write to them (they are thus marked
read only), and the fault handling code will make the PT executable(!)
instead of writable. The guest gets stuck forever.

In these conditions, the permission fault must be considered as
a write so that the Stage-1 update can take place. This is essentially
the I-side equivalent of the problem fixed by 60e21a0ef5 ("arm64: KVM:
Take S1 walks into account when determining S2 write faults").

Update kvm_is_write_fault() to return true on IABT+S1PTW, and introduce
kvm_vcpu_trap_is_exec_fault() that only return true when no faulting
on a S1 fault. Additionally, kvm_vcpu_dabt_iss1tw() is renamed to
kvm_vcpu_abt_iss1tw(), as the above makes it plain that it isn't
specific to data abort.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Will Deacon <will@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200915104218.1284701-2-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01 13:18:25 +02:00
Vasily Gorbik
4f5260ee0c mm/gup: fix gup_fast with dynamic page table folding
commit d3f7b1bb204099f2f7306318896223e8599bb6a2 upstream.

Currently to make sure that every page table entry is read just once
gup_fast walks perform READ_ONCE and pass pXd value down to the next
gup_pXd_range function by value e.g.:

  static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end,
                           unsigned int flags, struct page **pages, int *nr)
  ...
          pudp = pud_offset(&p4d, addr);

This function passes a reference on that local value copy to pXd_offset,
and might get the very same pointer in return.  This happens when the
level is folded (on most arches), and that pointer should not be
iterated.

On s390 due to the fact that each task might have different 5,4 or
3-level address translation and hence different levels folded the logic
is more complex and non-iteratable pointer to a local copy leads to
severe problems.

Here is an example of what happens with gup_fast on s390, for a task
with 3-level paging, crossing a 2 GB pud boundary:

  // addr = 0x1007ffff000, end = 0x10080001000
  static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end,
                           unsigned int flags, struct page **pages, int *nr)
  {
        unsigned long next;
        pud_t *pudp;

        // pud_offset returns &p4d itself (a pointer to a value on stack)
        pudp = pud_offset(&p4d, addr);
        do {
                // on second iteratation reading "random" stack value
                pud_t pud = READ_ONCE(*pudp);

                // next = 0x10080000000, due to PUD_SIZE/MASK != PGDIR_SIZE/MASK on s390
                next = pud_addr_end(addr, end);
                ...
        } while (pudp++, addr = next, addr != end); // pudp++ iterating over stack

        return 1;
  }

This happens since s390 moved to common gup code with commit
d1874a0c28 ("s390/mm: make the pxd_offset functions more robust") and
commit 1a42010cdc ("s390/mm: convert to the generic
get_user_pages_fast code").

s390 tried to mimic static level folding by changing pXd_offset
primitives to always calculate top level page table offset in pgd_offset
and just return the value passed when pXd_offset has to act as folded.

What is crucial for gup_fast and what has been overlooked is that
PxD_SIZE/MASK and thus pXd_addr_end should also change correspondingly.
And the latter is not possible with dynamic folding.

To fix the issue in addition to pXd values pass original pXdp pointers
down to gup_pXd_range functions.  And introduce pXd_offset_lockless
helpers, which take an additional pXd entry value parameter.  This has
already been discussed in

  https://lkml.kernel.org/r/20190418100218.0a4afd51@mschwideX1

Fixes: 1a42010cdc ("s390/mm: convert to the generic get_user_pages_fast code")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: <stable@vger.kernel.org>	[5.2+]
Link: https://lkml.kernel.org/r/patch.git-943f1e5dcff2.your-ad-here.call-01599856292-ext-8676@work.hours
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01 13:18:24 +02:00
Thomas Gleixner
6890a6f566 x86/ioapic: Unbreak check_timer()
commit 86a82ae0b5095ea24c55898a3f025791e7958b21 upstream.

Several people reported in the kernel bugzilla that between v4.12 and v4.13
the magic which works around broken hardware and BIOSes to find the proper
timer interrupt delivery mode stopped working for some older affected
platforms which need to fall back to ExtINT delivery mode.

The reason is that the core code changed to keep track of the masked and
disabled state of an interrupt line more accurately to avoid the expensive
hardware operations.

That broke an assumption in i8259_make_irq() which invokes

     disable_irq_nosync();
     irq_set_chip_and_handler();
     enable_irq();

Up to v4.12 this worked because enable_irq() unconditionally unmasked the
interrupt line, but after the state tracking improvements this is not
longer the case because the IO/APIC uses lazy disabling. So the line state
is unmasked which means that enable_irq() does not call into the new irq
chip to unmask it.

In principle this is a shortcoming of the core code, but it's more than
unclear whether the core code should try to reset state. At least this
cannot be done unconditionally as that would break other existing use cases
where the chip type is changed, e.g. when changing the trigger type, but
the callers expect the state to be preserved.

As the way how check_timer() is switching the delivery modes is truly
unique, the obvious fix is to simply unmask the i8259 manually after
changing the mode to ExtINT delivery and switching the irq chip to the
legacy PIC.

Note, that the fixes tag is not really precise, but identifies the commit
which broke the assumptions in the IO/APIC and i8259 code and that's the
kernel version to which this needs to be backported.

Fixes: bf22ff45be ("genirq: Avoid unnecessary low level irq function calls")
Reported-by: p_c_chan@hotmail.com
Reported-by: ecm4@mail.com
Reported-by: perdigao1@yahoo.com
Reported-by: matzes@users.sourceforge.net
Reported-by: rvelascog@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: p_c_chan@hotmail.com
Tested-by: matzes@users.sourceforge.net
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=197769
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01 13:18:22 +02:00
Mikulas Patocka
361a4b17e8 arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback
commit a1cd6c2ae47ee10ff21e62475685d5b399e2ed4a upstream.

If we copy less than 8 bytes and if the destination crosses a cache
line, __copy_user_flushcache would invalidate only the first cache line.

This patch makes it invalidate the second cache line as well.

Fixes: 0aed55af88 ("x86, uaccess: introduce copy_from_iter_flushcache for pmem / cache-bypass operations")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Dan Williams <dan.j.wiilliams@intel.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Matthew Wilcox <mawilcox@microsoft.com>
Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/alpine.LRH.2.02.2009161451140.21915@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01 13:18:21 +02:00
Tom Lendacky
5d4431c9de KVM: SVM: Add a dedicated INVD intercept routine
[ Upstream commit 4bb05f30483fd21ea5413eaf1182768f251cf625 ]

The INVD instruction intercept performs emulation. Emulation can't be done
on an SEV guest because the guest memory is encrypted.

Provide a dedicated intercept routine for the INVD intercept. And since
the instruction is emulated as a NOP, just skip it instead.

Fixes: 1654efcbc4 ("KVM: SVM: Add KVM_SEV_INIT command")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <a0b9a19ffa7fef86a3cc700c7ea01cb2731e04e5.1600972918.git.thomas.lendacky@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:21 +02:00
Sean Christopherson
16788dc19f KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
[ Upstream commit 8d214c481611b29458a57913bd786f0ac06f0605 ]

Reset the MMU context during kvm_set_cr4() if SMAP or PKE is toggled.
Recent commits to (correctly) not reload PDPTRs when SMAP/PKE are
toggled inadvertantly skipped the MMU context reset due to the mask
of bits that triggers PDPTR loads also being used to trigger MMU context
resets.

Fixes: 427890aff855 ("kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode")
Fixes: cb957adb4ea4 ("kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode")
Cc: Jim Mattson <jmattson@google.com>
Cc: Peter Shier <pshier@google.com>
Cc: Oliver Upton <oupton@google.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200923215352.17756-1-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:21 +02:00
Wei Li
5c58104841 MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()
[ Upstream commit e393fbe6fa27af23f78df6e16a8fd2963578a8c4 ]

Commit 442e14a2c5 ("MIPS: Add 1074K CPU support explicitly.") split
1074K from the 74K as an unique CPU type, while it missed to add the
'CPU_1074K' in __get_cpu_type(). So let's add it back.

Fixes: 442e14a2c5 ("MIPS: Add 1074K CPU support explicitly.")
Signed-off-by: Wei Li <liwei391@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:20 +02:00
Ilya Leoshkevich
43d750a099 s390/init: add missing __init annotations
[ Upstream commit fcb2b70cdb194157678fb1a75f9ff499aeba3d2a ]

Add __init to reserve_memory_end, reserve_oldmem and remove_oldmem.
Sometimes these functions are not inlined, and then the build
complains about section mismatch.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:14 +02:00
Palmer Dabbelt
66d987b80d RISC-V: Take text_mutex in ftrace_init_nop()
[ Upstream commit 66d18dbda8469a944dfec6c49d26d5946efba218 ]

Without this we get lockdep failures.  They're spurious failures as SMP isn't
up when ftrace_init_nop() is called.  As far as I can tell the easiest fix is
to just take the lock, which also seems like the safest fix.

Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Acked-by: Guo Ren <guoren@kernel.org>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:14 +02:00
Thomas Gleixner
bc65336acd x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline
[ Upstream commit a7ef9ba986b5fae9d80f8a7b31db0423687efe4e ]

Prevent the compiler from uninlining and creating traceable/probable
functions as this is invoked _after_ context tracking switched to
CONTEXT_USER and rcu idle.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200505134340.902709267@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:09 +02:00
Paul Mackerras
ad9940e377 KVM: PPC: Book3S HV: Close race with page faults around memslot flushes
[ Upstream commit 11362b1befeadaae4d159a8cddcdaf6b8afe08f9 ]

There is a potential race condition between hypervisor page faults
and flushing a memslot.  It is possible for a page fault to read the
memslot before a memslot is updated and then write a PTE to the
partition-scoped page tables after kvmppc_radix_flush_memslot has
completed.  (Note that this race has never been explicitly observed.)

To close this race, it is sufficient to increment the MMU sequence
number while the kvm->mmu_lock is held.  That will cause
mmu_notifier_retry() to return true, and the page fault will then
return to the guest without inserting a PTE.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:18:05 +02:00