summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)AuthorFilesLines
2020-10-10arm: dts: aspeed-g6: Add ast2600-mctp nodeIwona Winiarska1-0/+15
AST2600 provides MCTP over PCIe controller allowing BMC to communicate with devices on host PCIe bus. We are also adding syscon node describing PCIe Host controller device which can be used to gather information on PCIe enumeration (and assigned address). Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
2020-10-10enable AST2600 I3CJae Hyun Yoo1-6/+13
This commit ports I3C related changes from Aspeed SDK v00.05.05. It also includes Vitor's I3C cdev implementation which isn't upstreamed yet so it should be refined later. Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Signed-off-by: Vitor Soares <soares@synopsys.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-10Add peci-cpupower driverZhikuiRen1-0/+1
peci-cpupower reads CPU energy counter through peci and computes average power in mW since last read. Signed-off-by: ZhikuiRen <zhikui.ren@intel.com>
2020-10-10ARM: dts: aspeed-g6: add video nodeJae Hyun Yoo1-0/+10
This commit adds video node. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-10ADC linux driver for AST2600Chen Yugang1-2/+12
Tested: it's tested with DC input. Signed-off-by: Chen Yugang <yugang.chen@linux.intel.com>
2020-10-10ARM: dts: aspeed-g6: add GFX nodeJae Hyun Yoo1-0/+9
This commit adds GFX node for AST2600 SoC. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-10arm: ast2600: add pwm_tacho driver from aspeedVernon Mauery1-0/+10
Add the pwm_tacho driver from Aspeed to get pwm working until an upstream PWM/Tacho driver is available. This was copied from the v5.02 BSP from Aspeed. Signed-off-by: Vernon Mauery <vernon.mauery@intel.com>
2020-10-10i2c: aspeed: add buffer mode transfer supportJae Hyun Yoo3-54/+72
Byte mode currently this driver uses makes lots of interrupt call which isn't good for performance and it makes the driver very timing sensitive. To improve performance of the driver, this commit adds buffer mode transfer support which uses I2C SRAM buffer instead of using a single byte buffer. AST2400: It has 2 KBytes (256 Bytes x 8 pages) of I2C SRAM buffer pool from 0x1e78a800 to 0x1e78afff that can be used for all busses with buffer pool manipulation. To simplify implementation for supporting both AST2400 and AST2500, it assigns each 128 Bytes per bus without using buffer pool manipulation so total 1792 Bytes of I2C SRAM buffer will be used. AST2500: It has 16 Bytes of individual I2C SRAM buffer per each bus and its range is from 0x1e78a200 to 0x1e78a2df, so it doesn't have 'buffer page selection' bit field in the Function control register, and neither 'base address pointer' bit field in the Pool buffer control register it has. To simplify implementation for supporting both AST2400 and AST2500, it writes zeros on those register bit fields but it's okay because it does nothing in AST2500. It provides buffer based master and slave data transfer. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-10Add AST2500 and AST2600 JTAG deviceErnesto Corona2-0/+29
Adding aspeed jtag device Signed-off-by: Ernesto Corona <ernesto.corona@intel.com>
2020-10-09ARM: kprobes: Avoid fortify_panic() when copying optprobe templateAndrew Jeffery2-20/+20
Setting both CONFIG_KPROBES=y and CONFIG_FORTIFY_SOURCE=y on ARM leads to a panic in memcpy() when injecting a kprobe despite the fixes found in commit e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") and commit 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction"). arch/arm/include/asm/kprobes.h effectively declares the target type of the optprobe_template_entry assembly label as a u32 which leads memcpy()'s __builtin_object_size() call to determine that the pointed-to object is of size four. However, the symbol is used as a handle for the optimised probe assembly template that is at least 96 bytes in size. The symbol's use despite its type blows up the memcpy() in ARM's arch_prepare_optimized_kprobe() with a false-positive fortify_panic() when it should instead copy the optimised probe template into place: ``` $ sudo perf probe -a aspeed_g6_pinctrl_probe [ 158.457252] detected buffer overflow in memcpy ``` OpenBMC-Staging-Count: 1 Fixes: e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") Fixes: 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction") Suggested-by: Kees Cook <keescook@chromium.org> Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Tested-by: Luka Oreskovic <luka.oreskovic@sartura.hr> Tested-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Acked-by: Masami Hiramatsu <mhiramat@kernel.org> Cc: Luka Oreskovic <luka.oreskovic@sartura.hr> Cc: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr> Link: https://lore.kernel.org/r/20201001042927.2147800-1-andrew@aj.id.au Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07Merge tag 'v5.8.14' into dev-5.8Joel Stanley23-56/+171
This is the 5.8.14 stable release Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07ARM: dts: aspeed: rainier: Don't shout addressesAndrew Jeffery1-2/+2
Make them lowercase. OpenBMC-Staging-Count: 1 Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Link: https://lore.kernel.org/r/20201002063414.275161-4-andrew@aj.id.au Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07ARM: config: Enable PSTORE in aspeed_g5_defconfigAndrew Jeffery1-0/+4
We're making use of it on IBM's Rainier system. OpenBMC-Staging-Count: 1 Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Link: https://lore.kernel.org/r/20201002063414.275161-3-andrew@aj.id.au Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07ARM: dts: aspeed: Add Bytedance g220a BMC machineLotus Xu2-0/+932
The g220a is a server platform with an ASPEED AST2500 BMC. OpenBMC-Staging-Count: 1 Signed-off-by: Lotus Xu <xuxiaohan@bytedance.com> Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Link: https://lore.kernel.org/r/20200929063955.1206-2-wangzhiqiang.bj@bytedance.com Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07ARM: dts: Add 64MiB OpenBMC flash layoutJohn Wang1-0/+35
This is an alternate layout used by OpenBMC systems The division of space is as follows: u-boot + env: 0.5MB kernel/FIT: 5MB rofs: 42.5MB rwfs: 16MB OpenBMC-Staging-Count: 1 Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com> Link: https://lore.kernel.org/r/20200929063955.1206-1-wangzhiqiang.bj@bytedance.com Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-07ARM: dts: aspeed: amd-ethanolx: Update KCS nodes to use v2 bindingKonstantin Aladyshev1-3/+3
KCS nodes compatible property in the 'aspeed-g5.dtsi' file was changed to use v2 binding in the commit fa4c8ec6feaa (ARM: dts: aspeed: Change KCS nodes to v2 binding). For the proper initialization of /dev/ipmi-kcs* devices KCS node variables also need to be changed to use v2 binding. OpenBMC-Staging-Count: 1 Signed-off-by: Konstantin Aladyshev <aladyshev22@gmail.com> Link: https://lore.kernel.org/r/20200930075153.2115-1-aladyshev22@gmail.com Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-10-06char: ipmi: Add clock control logic into Aspeed LPC KCS driverJae Hyun Yoo2-1/+11
If LPC KCS driver is registered ahead of lpc-ctrl module, LPC KCS block will be enabled without heart beating of LCLK until lpc-ctrl enables the LCLK. This issue causes improper handling on host interrupts when the host sends interrupt in that time frame. Then kernel eventually forcibly disables the interrupt with dumping stack and printing a 'nobody cared this irq' message out. To prevent this issue, all LPC sub-nodes should enable LCLK individually so this patch adds clock control logic into the LPC KCS driver. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
2020-10-06misc: Add clock control logic into Aspeed LPC SNOOP driverJae Hyun Yoo3-0/+3
If LPC SNOOP driver is registered ahead of lpc-ctrl module, LPC SNOOP block will be enabled without heart beating of LCLK until lpc-ctrl enables the LCLK. This issue causes improper handling on host interrupts when the host sends interrupt in that time frame. Then kernel eventually forcibly disables the interrupt with dumping stack and printing a 'nobody cared this irq' message out. To prevent this issue, all LPC sub-nodes should enable LCLK individually so this patch adds clock control logic into the LPC SNOOP driver. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
2020-10-06char: ipmi: Add clock control logic into Aspeed LPC BT driverJae Hyun Yoo3-0/+3
If LPC BT driver is registered ahead of lpc-ctrl module, LPC BT block will be enabled without heart beating of LCLK until lpc-ctrl enables the LCLK. This issue causes improper handling on host interrupts when the host sends interrupt in that time frame. Then kernel eventually forcibly disables the interrupt with dumping stack and printing a 'nobody cared this irq' message out. To prevent this issue, all LPC sub-nodes should enable LCLK individually so this patch adds clock control logic into the LPC BT driver. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
2020-10-06Add Aspeed PWM driver which uses FTTMR010 timer IPJae Hyun Yoo1-1/+1
This commit adds Aspeed PWM driver which uses timer pulse output feature in Aspeed SoCs. The timer IP is derived from Faraday Technologies FTTMR010 IP but has some customized register structure changes only for Aspeed SoCs. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-06arm: dts: aspeed: Swap the mac nodes numberingJae Hyun Yoo2-16/+16
This patch swaps the numbering of mac0 and mac1 to make a dedicated nic get assigned the first ethernet device number. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-06misc: aspeed: Add Aspeed UART routing control driver.Oskar Senft2-0/+12
This driver adds sysfs files that allow the BMC userspace to configure how UARTs and physical serial I/O ports are routed. Tested: Checked correct behavior (both read & write) on TYAN S7106 board by manually changing routing settings and confirming that bits flow as expected. Tested for UART1 and UART3 as this board doesn't have the other UARTs wired up in a testable way. Signed-off-by: Oskar Senft <osk@google.com> Signed-off-by: Yong Li <yong.b.li@linux.intel.com> Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
2020-10-06Add AST2500 eSPI driverHaiyue Wang2-0/+18
When PCH works under eSPI mode, the PMC (Power Management Controller) in PCH is waiting for SUS_ACK from BMC after it alerts SUS_WARN. It is in dead loop if no SUS_ACK assert. This is the basic requirement for the BMC works as eSPI slave. Also for the host power on / off actions, from BMC side, the following VW (Virtual Wire) messages are done in firmware: 1. SLAVE_BOOT_LOAD_DONE / SLAVE_BOOT_LOAD_STATUS 2. SUS_ACK 3. OOB_RESET_ACK 4. HOST_RESET_ACK Also, it provides monitoring interface of PLTRST_N signal through /dev/espi-pltrstn Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: James Feist <james.feist@linux.intel.com> Signed-off-by: Vernon Mauery <vernon.mauery@intel.com>
2020-10-06Aspeed LPC SIO driverYong Li2-0/+14
Add lpc sio device driver for AST2500/2400 Signed-off-by: Yong Li <yong.b.li@intel.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-06misc: aspeed: add lpc mbox driverJae Hyun Yoo3-0/+19
This commit adds back the lpc mbox driver which was removed from the openbmc linux dev-5.2 tree. This driver should be rewritten later. Signed-off-by: Cyril Bur <cyrilbur@gmail.com>" Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: Arun P. Mohanan <arun.p.m@linux.intel.com>
2020-10-06SGPIO DT and pinctrl fixupVernon Mauery3-38/+36
This commit fixes DT and pinctrl for SGPIO use. Signed-off-by: Vernon Mauery <vernon.mauery@intel.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-06New flash map for intelVernon Mauery2-0/+88
Signed-off-by: Vernon Mauery <vernon.mauery@intel.com> Signed-off-by: Vikram Bodireddy <vikram.bodireddy@intel.com>
2020-10-06arm: dts: aspeed-g5: add espiJuston Li1-0/+7
Signed-off-by: Juston Li <juston.li@intel.com>
2020-10-06Enable GPIOE0 and GPIOE2 pass-through by defaultJason M. Bills1-0/+4
This change sets the gpio DT pinctrl default configuration to enable GPIOE0 and GPIOE2 pass-through. Since this causes pinctrl_get_select_default() to be called automatically for the gpio driver to claim the GPIO pins in those groups, we also need to call pinctrl_put() to release claim on the pass-through GPIOs so they can be requested at runtime. Tested: Disabled pass-through in uboot and confirmed that after booting Linux, pass-through is enabled and 'cat /sys/kernel/debug/pinctrl/ 1e6e2000.syscon\:pinctrl-aspeed-g5-pinctrl/pinmux-pins' shows that the pass-through GPIOs are UNCLAIMED. Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
2020-10-06arm: dts: base aspeed g6 dtsi fixupsVernon Mauery1-2/+127
Additions to the base g6 dtsi file for Aspeed ast2600 systems. This mostly includes entries for the drivers that are not upstream. Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
2020-10-06arm: dts: add DTS for Intel ast2600 platformsVernon Mauery1-0/+579
Add the DTS file for Intel ast2600-based systems. Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> Signed-off-by: Chen Yugang <yugang.chen@linux.intel.com> Signed-off-by: Kuiying Wang <kuiying.wang@intel.com> Signed-off-by: arun-pm <arun.p.m@linux.intel.com> Signed-off-by: Ayushi Smriti <smriti.ayushi@intel.com> Signed-off-by: Arun P. Mohanan <arun.p.m@linux.intel.com> Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com> Signed-off-by: James Feist <james.feist@linux.intel.com>
2020-10-06arm: dts: intel s2600wf dts fixupsJae Hyun Yoo1-19/+343
Add fixups for Intel S2600WF dts. Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
2020-10-06arm: dts: add DTS for Intel ast2500 platformsYuan Li1-0/+517
Add the DTS file for Intel ast2500-based systems. Signed-off-by: Yuan Li <yuan.li@linux.intel.com> Signed-off-by: Yong Li <yong.b.li@linux.intel.com> Signed-off-by: James Feist <james.feist@linux.intel.com> Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com> Signed-off-by: Zhu, Yunge <yunge.zhu@linux.intel.com> Signed-off-by: Qiang XU <qiang.xu@linux.intel.com> Signed-off-by: Chen Yugang <yugang.chen@linux.intel.com> Signed-off-by: Zhikui Ren <zhikui.ren@intel.com> Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com> Signed-off-by: AppaRao Puli <apparao.puli@linux.intel.com> Signed-off-by: Arun P. Mohanan <arun.p.m@linux.intel.com>
2020-10-01KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetchMarc Zyngier4-5/+13
commit c4ad98e4b72cb5be30ea282fce935248f2300e62 upstream. KVM currently assumes that an instruction abort can never be a write. This is in general true, except when the abort is triggered by a S1PTW on instruction fetch that tries to update the S1 page tables (to set AF, for example). This can happen if the page tables have been paged out and brought back in without seeing a direct write to them (they are thus marked read only), and the fault handling code will make the PT executable(!) instead of writable. The guest gets stuck forever. In these conditions, the permission fault must be considered as a write so that the Stage-1 update can take place. This is essentially the I-side equivalent of the problem fixed by 60e21a0ef54c ("arm64: KVM: Take S1 walks into account when determining S2 write faults"). Update kvm_is_write_fault() to return true on IABT+S1PTW, and introduce kvm_vcpu_trap_is_exec_fault() that only return true when no faulting on a S1 fault. Additionally, kvm_vcpu_dabt_iss1tw() is renamed to kvm_vcpu_abt_iss1tw(), as the above makes it plain that it isn't specific to data abort. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Will Deacon <will@kernel.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200915104218.1284701-2-maz@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01mm: replace memmap_context by meminit_contextLaurent Dufour1-3/+3
commit c1d0da83358a2316d9be7f229f26126dbaa07468 upstream. Patch series "mm: fix memory to node bad links in sysfs", v3. Sometimes, firmware may expose interleaved memory layout like this: Early memory node ranges node 1: [mem 0x0000000000000000-0x000000011fffffff] node 2: [mem 0x0000000120000000-0x000000014fffffff] node 1: [mem 0x0000000150000000-0x00000001ffffffff] node 0: [mem 0x0000000200000000-0x000000048fffffff] node 2: [mem 0x0000000490000000-0x00000007ffffffff] In that case, we can see memory blocks assigned to multiple nodes in sysfs: $ ls -l /sys/devices/system/memory/memory21 total 0 lrwxrwxrwx 1 root root 0 Aug 24 05:27 node1 -> ../../node/node1 lrwxrwxrwx 1 root root 0 Aug 24 05:27 node2 -> ../../node/node2 -rw-r--r-- 1 root root 65536 Aug 24 05:27 online -r--r--r-- 1 root root 65536 Aug 24 05:27 phys_device -r--r--r-- 1 root root 65536 Aug 24 05:27 phys_index drwxr-xr-x 2 root root 0 Aug 24 05:27 power -r--r--r-- 1 root root 65536 Aug 24 05:27 removable -rw-r--r-- 1 root root 65536 Aug 24 05:27 state lrwxrwxrwx 1 root root 0 Aug 24 05:25 subsystem -> ../../../../bus/memory -rw-r--r-- 1 root root 65536 Aug 24 05:25 uevent -r--r--r-- 1 root root 65536 Aug 24 05:27 valid_zones The same applies in the node's directory with a memory21 link in both the node1 and node2's directory. This is wrong but doesn't prevent the system to run. However when later, one of these memory blocks is hot-unplugged and then hot-plugged, the system is detecting an inconsistency in the sysfs layout and a BUG_ON() is raised: kernel BUG at /Users/laurent/src/linux-ppc/mm/memory_hotplug.c:1084! LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: rpadlpar_io rpaphp pseries_rng rng_core vmx_crypto gf128mul binfmt_misc ip_tables x_tables xfs libcrc32c crc32c_vpmsum autofs4 CPU: 8 PID: 10256 Comm: drmgr Not tainted 5.9.0-rc1+ #25 Call Trace: add_memory_resource+0x23c/0x340 (unreliable) __add_memory+0x5c/0xf0 dlpar_add_lmb+0x1b4/0x500 dlpar_memory+0x1f8/0xb80 handle_dlpar_errorlog+0xc0/0x190 dlpar_store+0x198/0x4a0 kobj_attr_store+0x30/0x50 sysfs_kf_write+0x64/0x90 kernfs_fop_write+0x1b0/0x290 vfs_write+0xe8/0x290 ksys_write+0xdc/0x130 system_call_exception+0x160/0x270 system_call_common+0xf0/0x27c This has been seen on PowerPC LPAR. The root cause of this issue is that when node's memory is registered, the range used can overlap another node's range, thus the memory block is registered to multiple nodes in sysfs. There are two issues here: (a) The sysfs memory and node's layouts are broken due to these multiple links (b) The link errors in link_mem_sections() should not lead to a system panic. To address (a) register_mem_sect_under_node should not rely on the system state to detect whether the link operation is triggered by a hot plug operation or not. This is addressed by the patches 1 and 2 of this series. Issue (b) will be addressed separately. This patch (of 2): The memmap_context enum is used to detect whether a memory operation is due to a hot-add operation or happening at boot time. Make it general to the hotplug operation and rename it as meminit_context. There is no functional change introduced by this patch Suggested-by: David Hildenbrand <david@redhat.com> Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Oscar Salvador <osalvador@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "Rafael J . Wysocki" <rafael@kernel.org> Cc: Nathan Lynch <nathanl@linux.ibm.com> Cc: Scott Cheloha <cheloha@linux.ibm.com> Cc: Tony Luck <tony.luck@intel.com> Cc: Fenghua Yu <fenghua.yu@intel.com> Cc: <stable@vger.kernel.org> Link: https://lkml.kernel.org/r/20200915094143.79181-1-ldufour@linux.ibm.com Link: https://lkml.kernel.org/r/20200915132624.9723-1-ldufour@linux.ibm.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01mm/gup: fix gup_fast with dynamic page table foldingVasily Gorbik1-12/+30
commit d3f7b1bb204099f2f7306318896223e8599bb6a2 upstream. Currently to make sure that every page table entry is read just once gup_fast walks perform READ_ONCE and pass pXd value down to the next gup_pXd_range function by value e.g.: static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end, unsigned int flags, struct page **pages, int *nr) ... pudp = pud_offset(&p4d, addr); This function passes a reference on that local value copy to pXd_offset, and might get the very same pointer in return. This happens when the level is folded (on most arches), and that pointer should not be iterated. On s390 due to the fact that each task might have different 5,4 or 3-level address translation and hence different levels folded the logic is more complex and non-iteratable pointer to a local copy leads to severe problems. Here is an example of what happens with gup_fast on s390, for a task with 3-level paging, crossing a 2 GB pud boundary: // addr = 0x1007ffff000, end = 0x10080001000 static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end, unsigned int flags, struct page **pages, int *nr) { unsigned long next; pud_t *pudp; // pud_offset returns &p4d itself (a pointer to a value on stack) pudp = pud_offset(&p4d, addr); do { // on second iteratation reading "random" stack value pud_t pud = READ_ONCE(*pudp); // next = 0x10080000000, due to PUD_SIZE/MASK != PGDIR_SIZE/MASK on s390 next = pud_addr_end(addr, end); ... } while (pudp++, addr = next, addr != end); // pudp++ iterating over stack return 1; } This happens since s390 moved to common gup code with commit d1874a0c2805 ("s390/mm: make the pxd_offset functions more robust") and commit 1a42010cdc26 ("s390/mm: convert to the generic get_user_pages_fast code"). s390 tried to mimic static level folding by changing pXd_offset primitives to always calculate top level page table offset in pgd_offset and just return the value passed when pXd_offset has to act as folded. What is crucial for gup_fast and what has been overlooked is that PxD_SIZE/MASK and thus pXd_addr_end should also change correspondingly. And the latter is not possible with dynamic folding. To fix the issue in addition to pXd values pass original pXdp pointers down to gup_pXd_range functions. And introduce pXd_offset_lockless helpers, which take an additional pXd entry value parameter. This has already been discussed in https://lkml.kernel.org/r/20190418100218.0a4afd51@mschwideX1 Fixes: 1a42010cdc26 ("s390/mm: convert to the generic get_user_pages_fast code") Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Mike Rapoport <rppt@linux.ibm.com> Reviewed-by: John Hubbard <jhubbard@nvidia.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Russell King <linux@armlinux.org.uk> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Jeff Dike <jdike@addtoit.com> Cc: Richard Weinberger <richard@nod.at> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Claudio Imbrenda <imbrenda@linux.ibm.com> Cc: <stable@vger.kernel.org> [5.2+] Link: https://lkml.kernel.org/r/patch.git-943f1e5dcff2.your-ad-here.call-01599856292-ext-8676@work.hours Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01MIPS: Loongson2ef: Disable Loongson MMI instructionsJiaxun Yang1-0/+4
commit b13812ddea615b6507beef24f76540c0c1143c5c upstream. It was missed when I was forking Loongson2ef from Loongson64 but should be applied to Loongson2ef as march=loongson2f will also enable Loongson MMI in GCC-9+. Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Fixes: 71e2f4dd5a65 ("MIPS: Fork loongson2ef from loongson64") Reported-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Cc: stable@vger.kernel.org # v5.8+ Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01x86/ioapic: Unbreak check_timer()Thomas Gleixner1-0/+1
commit 86a82ae0b5095ea24c55898a3f025791e7958b21 upstream. Several people reported in the kernel bugzilla that between v4.12 and v4.13 the magic which works around broken hardware and BIOSes to find the proper timer interrupt delivery mode stopped working for some older affected platforms which need to fall back to ExtINT delivery mode. The reason is that the core code changed to keep track of the masked and disabled state of an interrupt line more accurately to avoid the expensive hardware operations. That broke an assumption in i8259_make_irq() which invokes disable_irq_nosync(); irq_set_chip_and_handler(); enable_irq(); Up to v4.12 this worked because enable_irq() unconditionally unmasked the interrupt line, but after the state tracking improvements this is not longer the case because the IO/APIC uses lazy disabling. So the line state is unmasked which means that enable_irq() does not call into the new irq chip to unmask it. In principle this is a shortcoming of the core code, but it's more than unclear whether the core code should try to reset state. At least this cannot be done unconditionally as that would break other existing use cases where the chip type is changed, e.g. when changing the trigger type, but the callers expect the state to be preserved. As the way how check_timer() is switching the delivery modes is truly unique, the obvious fix is to simply unmask the i8259 manually after changing the mode to ExtINT delivery and switching the irq chip to the legacy PIC. Note, that the fixes tag is not really precise, but identifies the commit which broke the assumptions in the IO/APIC and i8259 code and that's the kernel version to which this needs to be backported. Fixes: bf22ff45bed6 ("genirq: Avoid unnecessary low level irq function calls") Reported-by: p_c_chan@hotmail.com Reported-by: ecm4@mail.com Reported-by: perdigao1@yahoo.com Reported-by: matzes@users.sourceforge.net Reported-by: rvelascog@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: p_c_chan@hotmail.com Tested-by: matzes@users.sourceforge.net Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=197769 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01x86/irq: Make run_on_irqstack_cond() typesafeThomas Gleixner6-12/+68
commit a7b3474cbb2864d5500d5e4f48dd57c903975cab upstream. Sami reported that run_on_irqstack_cond() requires the caller to cast functions to mismatching types, which trips indirect call Control-Flow Integrity (CFI) in Clang. Instead of disabling CFI on that function, provide proper helpers for the three call variants. The actual ASM code stays the same as that is out of reach. [ bp: Fix __run_on_irqstack() prototype to match. ] Fixes: 931b94145981 ("x86/entry: Provide helpers for executing on the irqstack") Reported-by: Nathan Chancellor <natechancellor@gmail.com> Reported-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Borislav Petkov <bp@suse.de> Tested-by: Sami Tolvanen <samitolvanen@google.com> Cc: <stable@vger.kernel.org> Link: https://github.com/ClangBuiltLinux/linux/issues/1052 Link: https://lkml.kernel.org/r/87pn6eb5tv.fsf@nanos.tec.linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writebackMikulas Patocka1-1/+1
commit a1cd6c2ae47ee10ff21e62475685d5b399e2ed4a upstream. If we copy less than 8 bytes and if the destination crosses a cache line, __copy_user_flushcache would invalidate only the first cache line. This patch makes it invalidate the second cache line as well. Fixes: 0aed55af88345b ("x86, uaccess: introduce copy_from_iter_flushcache for pmem / cache-bypass operations") Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Dan Williams <dan.j.wiilliams@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jeff Moyer <jmoyer@redhat.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Toshi Kani <toshi.kani@hpe.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Matthew Wilcox <mawilcox@microsoft.com> Cc: Ross Zwisler <ross.zwisler@linux.intel.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: <stable@vger.kernel.org> Link: https://lkml.kernel.org/r/alpine.LRH.2.02.2009161451140.21915@file01.intranet.prod.int.rdu2.redhat.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01KVM: SVM: Add a dedicated INVD intercept routineTom Lendacky1-1/+7
[ Upstream commit 4bb05f30483fd21ea5413eaf1182768f251cf625 ] The INVD instruction intercept performs emulation. Emulation can't be done on an SEV guest because the guest memory is encrypted. Provide a dedicated intercept routine for the INVD intercept. And since the instruction is emulated as a NOP, just skip it instead. Fixes: 1654efcbc431 ("KVM: SVM: Add KVM_SEV_INIT command") Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Message-Id: <a0b9a19ffa7fef86a3cc700c7ea01cb2731e04e5.1600972918.git.thomas.lendacky@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKESean Christopherson1-1/+2
[ Upstream commit 8d214c481611b29458a57913bd786f0ac06f0605 ] Reset the MMU context during kvm_set_cr4() if SMAP or PKE is toggled. Recent commits to (correctly) not reload PDPTRs when SMAP/PKE are toggled inadvertantly skipped the MMU context reset due to the mask of bits that triggers PDPTR loads also being used to trigger MMU context resets. Fixes: 427890aff855 ("kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode") Fixes: cb957adb4ea4 ("kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode") Cc: Jim Mattson <jmattson@google.com> Cc: Peter Shier <pshier@google.com> Cc: Oliver Upton <oupton@google.com> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Message-Id: <20200923215352.17756-1-sean.j.christopherson@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()Wei Li1-0/+1
[ Upstream commit e393fbe6fa27af23f78df6e16a8fd2963578a8c4 ] Commit 442e14a2c55e ("MIPS: Add 1074K CPU support explicitly.") split 1074K from the 74K as an unique CPU type, while it missed to add the 'CPU_1074K' in __get_cpu_type(). So let's add it back. Fixes: 442e14a2c55e ("MIPS: Add 1074K CPU support explicitly.") Signed-off-by: Wei Li <liwei391@huawei.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01MIPS: Loongson-3: Fix fp register access if MSA enabledHuacai Chen1-16/+8
[ Upstream commit 01ce6d4d2c8157b076425e3dd8319948652583c5 ] If MSA is enabled, FPU_REG_WIDTH is 128 rather than 64, then get_fpr64() /set_fpr64() in the original unaligned instruction emulation code access the wrong fp registers. This is because the current code doesn't specify the correct index field, so fix it. Fixes: f83e4f9896eff614d0f2547a ("MIPS: Loongson-3: Add some unaligned instructions emulation") Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Pei Huang <huangpei@loongson.cn> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01riscv: Fix Kendryte K210 device treeDamien Le Moal1-2/+4
[ Upstream commit f025d9d9934b84cd03b7796072d10686029c408e ] The Kendryte K210 SoC CLINT is compatible with Sifive clint v0 (sifive,clint0). Fix the Kendryte K210 device tree clint entry to be inline with the sifive timer definition documented in Documentation/devicetree/bindings/timer/sifive,clint.yaml. The device tree clint entry is renamed similarly to u-boot device tree definition to improve compatibility with u-boot defined device tree. To ensure correct initialization, the interrup-cells attribute is added and the interrupt-extended attribute definition fixed. This fixes boot failures with Kendryte K210 SoC boards. Note that the clock referenced is kept as K210_CLK_ACLK, which does not necessarilly match the clint MTIME increment rate. This however does not seem to cause any problem for now. Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01s390/init: add missing __init annotationsIlya Leoshkevich1-3/+3
[ Upstream commit fcb2b70cdb194157678fb1a75f9ff499aeba3d2a ] Add __init to reserve_memory_end, reserve_oldmem and remove_oldmem. Sometimes these functions are not inlined, and then the build complains about section mismatch. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01RISC-V: Take text_mutex in ftrace_init_nop()Palmer Dabbelt2-0/+26
[ Upstream commit 66d18dbda8469a944dfec6c49d26d5946efba218 ] Without this we get lockdep failures. They're spurious failures as SMP isn't up when ftrace_init_nop() is called. As far as I can tell the easiest fix is to just take the lock, which also seems like the safest fix. Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com> Acked-by: Guo Ren <guoren@kernel.org> Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-28Merge tag 'v5.8.12' into dev-5.8Joel Stanley51-166/+216
This is the 5.8.12 stable release Signed-off-by: Joel Stanley <joel@jms.id.au>
2020-09-23powerpc/dma: Fix dma_map_ops::get_required_maskAlexey Kardashevskiy1-1/+2
commit 437ef802e0adc9f162a95213a3488e8646e5fc03 upstream. There are 2 problems with it: 1. "<" vs expected "<<" 2. the shift number is an IOMMU page number mask, not an address mask as the IOMMU page shift is missing. This did not hit us before f1565c24b596 ("powerpc: use the generic dma_ops_bypass mode") because we had additional code to handle bypass mask so this chunk (almost?) never executed.However there were reports that aacraid does not work with "iommu=nobypass". After f1565c24b596, aacraid (and probably others which call dma_get_required_mask() before setting the mask) was unable to enable 64bit DMA and fall back to using IOMMU which was known not to work, one of the problems is double free of an IOMMU page. This fixes DMA for aacraid, both with and without "iommu=nobypass" in the kernel command line. Verified with "stress-ng -d 4". Fixes: 6a5c7be5e484 ("powerpc: Override dma_get_required_mask by platform hook and ops") Cc: stable@vger.kernel.org # v3.2+ Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20200908015106.79661-1-aik@ozlabs.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-23arm64: paravirt: Initialize steal time when cpu is onlineAndrew Jones1-11/+15
commit 75df529bec9110dad43ab30e2d9490242529e8b8 upstream. Steal time initialization requires mapping a memory region which invokes a memory allocation. Doing this at CPU starting time results in the following trace when CONFIG_DEBUG_ATOMIC_SLEEP is enabled: BUG: sleeping function called from invalid context at mm/slab.h:498 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.9.0-rc5+ #1 Call trace: dump_backtrace+0x0/0x208 show_stack+0x1c/0x28 dump_stack+0xc4/0x11c ___might_sleep+0xf8/0x130 __might_sleep+0x58/0x90 slab_pre_alloc_hook.constprop.101+0xd0/0x118 kmem_cache_alloc_node_trace+0x84/0x270 __get_vm_area_node+0x88/0x210 get_vm_area_caller+0x38/0x40 __ioremap_caller+0x70/0xf8 ioremap_cache+0x78/0xb0 memremap+0x9c/0x1a8 init_stolen_time_cpu+0x54/0xf0 cpuhp_invoke_callback+0xa8/0x720 notify_cpu_starting+0xc8/0xd8 secondary_start_kernel+0x114/0x180 CPU1: Booted secondary processor 0x0000000001 [0x431f0a11] However we don't need to initialize steal time at CPU starting time. We can simply wait until CPU online time, just sacrificing a bit of accuracy by returning zero for steal time until we know better. While at it, add __init to the functions that are only called by pv_time_init() which is __init. Signed-off-by: Andrew Jones <drjones@redhat.com> Fixes: e0685fa228fd ("arm64: Retrieve stolen time as paravirtualized guest") Cc: stable@vger.kernel.org Reviewed-by: Steven Price <steven.price@arm.com> Link: https://lore.kernel.org/r/20200916154530.40809-1-drjones@redhat.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>