1. 06 Apr, 2017 14 commits
    • Robin Murphy's avatar
      iommu/io-pgtable-arm: Avoid shift overflow in block size · 022f4e4f
      Robin Murphy authored
      The recursive nature of __arm_lpae_{map,unmap}() means that
      ARM_LPAE_BLOCK_SIZE() is evaluated for every level, including those
      where block mappings aren't possible. This in itself is harmless enough,
      as we will only ever be called with valid sizes from the pgsize_bitmap,
      and thus always recurse down past any imaginary block sizes. The only
      problem is that most of those imaginary sizes overflow the type used for
      the calculation, and thus trigger warnings under UBsan:
      
      [   63.020939] ================================================================================
      [   63.021284] UBSAN: Undefined behaviour in drivers/iommu/io-pgtable-arm.c:312:22
      [   63.021602] shift exponent 39 is too large for 32-bit type 'int'
      [   63.021909] CPU: 0 PID: 1119 Comm: lkvm Not tainted 4.7.0-rc3+ #819
      [   63.022163] Hardware name: FVP Base (DT)
      [   63.022345] Call trace:
      [   63.022629] [<ffffff900808f258>] dump_backtrace+0x0/0x3a8
      [   63.022975] [<ffffff900808f614>] show_stack+0x14/0x20
      [   63.023294] [<ffffff90086bc9dc>] dump_stack+0x104/0x148
      [   63.023609] [<ffffff9008713ce8>] ubsan_epilogue+0x18/0x68
      [   63.023956] [<ffffff9008714410>] __ubsan_handle_shift_out_of_bounds+0x18c/0x1bc
      [   63.024365] [<ffffff900890fcb0>] __arm_lpae_map+0x720/0xae0
      [   63.024732] [<ffffff9008910170>] arm_lpae_map+0x100/0x190
      [   63.025049] [<ffffff90089183d8>] arm_smmu_map+0x78/0xc8
      [   63.025390] [<ffffff9008906c18>] iommu_map+0x130/0x230
      [   63.025763] [<ffffff9008bf7564>] vfio_iommu_type1_attach_group+0x4bc/0xa00
      [   63.026156] [<ffffff9008bf3c78>] vfio_fops_unl_ioctl+0x320/0x580
      [   63.026515] [<ffffff9008377420>] do_vfs_ioctl+0x140/0xd28
      [   63.026858] [<ffffff9008378094>] SyS_ioctl+0x8c/0xa0
      [   63.027179] [<ffffff9008086e70>] el0_svc_naked+0x24/0x28
      [   63.027412] ================================================================================
      
      Perform the shift in a 64-bit type to prevent the theoretical overflow
      and keep the peace. As it turns out, this generates identical code for
      32-bit ARM, and marginally shorter AArch64 code, so it's good all round.
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      022f4e4f
    • Will Deacon's avatar
      iommu: Allow default domain type to be set on the kernel command line · fccb4e3b
      Will Deacon authored
      The IOMMU core currently initialises the default domain for each group
      to IOMMU_DOMAIN_DMA, under the assumption that devices will use
      IOMMU-backed DMA ops by default. However, in some cases it is desirable
      for the DMA ops to bypass the IOMMU for performance reasons, reserving
      use of translation for subsystems such as VFIO that require it for
      enforcing device isolation.
      
      Rather than modify each IOMMU driver to provide different semantics for
      DMA domains, instead we introduce a command line parameter that can be
      used to change the type of the default domain. Passthrough can then be
      specified using "iommu.passthrough=1" on the kernel command line.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      fccb4e3b
    • Will Deacon's avatar
      iommu/arm-smmu-v3: Install bypass STEs for IOMMU_DOMAIN_IDENTITY domains · beb3c6a0
      Will Deacon authored
      In preparation for allowing the default domain type to be overridden,
      this patch adds support for IOMMU_DOMAIN_IDENTITY domains to the
      ARM SMMUv3 driver.
      
      An identity domain is created by placing the corresponding stream table
      entries into "bypass" mode, which allows transactions to flow through
      the SMMU without any translation.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      beb3c6a0
    • Will Deacon's avatar
      iommu/arm-smmu-v3: Make arm_smmu_install_ste_for_dev return void · 67560edc
      Will Deacon authored
      arm_smmu_install_ste_for_dev cannot fail and always returns 0, however
      the fact that it returns int means that callers end up implementing
      redundant error handling code which complicates STE tracking and is
      never executed.
      
      This patch changes the return type of arm_smmu_install_ste_for_dev
      to void, to make it explicit that it cannot fail.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      67560edc
    • Will Deacon's avatar
      iommu/arm-smmu: Install bypass S2CRs for IOMMU_DOMAIN_IDENTITY domains · 61bc6711
      Will Deacon authored
      In preparation for allowing the default domain type to be overridden,
      this patch adds support for IOMMU_DOMAIN_IDENTITY domains to the
      ARM SMMU driver.
      
      An identity domain is created by placing the corresponding S2CR
      registers into "bypass" mode, which allows transactions to flow through
      the SMMU without any translation.
      Reviewed-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      61bc6711
    • Will Deacon's avatar
      iommu/arm-smmu: Restrict domain attributes to UNMANAGED domains · 0834cc28
      Will Deacon authored
      The ARM SMMU drivers provide a DOMAIN_ATTR_NESTING domain attribute,
      which allows callers of the IOMMU API to request that the page table
      for a domain is installed at stage-2, if supported by the hardware.
      
      Since setting this attribute only makes sense for UNMANAGED domains,
      this patch returns -ENODEV if the domain_{get,set}_attr operations are
      called on other domain types.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      0834cc28
    • Robin Murphy's avatar
      iommu/arm-smmu: Add global SMR masking property · 56fbf600
      Robin Murphy authored
      The current SMR masking support using a 2-cell iommu-specifier is
      primarily intended to handle individual masters with large and/or
      complex Stream ID assignments; it quickly gets a bit clunky in other SMR
      use-cases where we just want to consistently mask out the same part of
      every Stream ID (e.g. for MMU-500 configurations where the appended TBU
      number gets in the way unnecessarily). Let's add a new property to allow
      a single global mask value to better fit the latter situation.
      Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
      Tested-by: default avatarNipun Gupta <nipun.gupta@nxp.com>
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      56fbf600
    • Robin Murphy's avatar
      iommu/arm-smmu: Poll for TLB sync completion more effectively · 8513c893
      Robin Murphy authored
      On relatively slow development platforms and software models, the
      inefficiency of our TLB sync loop tends not to show up - for instance on
      a Juno r1 board I typically see the TLBI has completed of its own accord
      by the time we get to the sync, such that the latter finishes instantly.
      
      However, on larger systems doing real I/O, it's less realistic for the
      TLBs to go idle immediately, and at that point falling into the 1MHz
      polling loop turns out to throw away performance drastically. Let's
      strike a balance by polling more than once between pauses, such that we
      have much more chance of catching normal operations completing before
      committing to the fixed delay, but also backing off exponentially, since
      if a sync really hasn't completed within one or two "reasonable time"
      periods, it becomes increasingly unlikely that it ever will.
      Reviewed-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      8513c893
    • Robin Murphy's avatar
      iommu/arm-smmu: Use per-context TLB sync as appropriate · 11febfca
      Robin Murphy authored
      TLB synchronisation typically involves the SMMU blocking all incoming
      transactions until the TLBs report completion of all outstanding
      operations. In the common SMMUv2 configuration of a single distributed
      SMMU serving multiple peripherals, that means that a single unmap
      request has the potential to bring the hammer down on the entire system
      if synchronised globally. Since stage 1 contexts, and stage 2 contexts
      under SMMUv2, offer local sync operations, let's make use of those
      wherever we can in the hope of minimising global disruption.
      
      To that end, rather than add any more branches to the already unwieldy
      monolithic TLB maintenance ops, break them up into smaller, neater,
      functions which we can then mix and match as appropriate.
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      11febfca
    • Robin Murphy's avatar
      iommu/arm-smmu: Tidy up context bank indexing · 452107c7
      Robin Murphy authored
      ARM_AMMU_CB() is calculated relative to ARM_SMMU_CB_BASE(), but the
      latter is never of use on its own, and what we end up with is the same
      ARM_SMMU_CB_BASE() + ARM_AMMU_CB() expression being duplicated at every
      callsite. Folding the two together gives us a self-contained context
      bank accessor which is much more pleasant to work with.
      
      Secondly, we might as well simplify CB_BASE itself at the same time.
      We use the address space size for its own sake precisely once, at probe
      time, and every other usage is to dynamically calculate CB_BASE over
      and over and over again. Let's flip things around so that we just
      maintain the CB_BASE address directly.
      Reviewed-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      452107c7
    • Robin Murphy's avatar
      iommu/arm-smmu: Simplify ASID/VMID handling · 280b683c
      Robin Murphy authored
      Calculating ASIDs/VMIDs dynamically from arm_smmu_cfg was a neat trick,
      but the global uniqueness workaround makes it somewhat more awkward, and
      means we end up having to pass extra state around in certain cases just
      to keep a handle on the offset.
      
      We already have 16 bits going spare in arm_smmu_cfg; let's just
      precalculate an ASID/VMID, plop it in there, and tidy up the users
      accordingly. We'd also need something like this anyway if we ever get
      near to thinking about SVM, so it's no bad thing.
      Reviewed-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      280b683c
    • Sunil Goutham's avatar
      iommu/arm-smmu: Fix 16-bit ASID configuration · 125458ab
      Sunil Goutham authored
      16-bit ASID should be enabled before initializing TTBR0/1,
      otherwise only LSB 8-bit ASID will be considered. Hence
      moving configuration of TTBCR register ahead of TTBR0/1
      while initializing context bank.
      Signed-off-by: default avatarSunil Goutham <sgoutham@cavium.com>
      [will: rewrote comment]
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      125458ab
    • Robert Richter's avatar
      iommu/arm-smmu: Print message when Cavium erratum 27704 was detected · 53c35dce
      Robert Richter authored
      Firmware is responsible for properly enabling smmu workarounds. Print
      a message for better diagnostics when Cavium erratum 27704 was
      detected.
      Reviewed-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarRobert Richter <rrichter@cavium.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      53c35dce
    • Robin Murphy's avatar
      iommu: Better document the IOMMU_PRIV flag · adf5e516
      Robin Murphy authored
      This is a fairly subtle thing - let's make sure it's described as
      clearly as possible to avoid potential misunderstandings.
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      adf5e516
  2. 26 Mar, 2017 8 commits
    • Linus Torvalds's avatar
      Linux 4.11-rc4 · c02ed2e7
      Linus Torvalds authored
      c02ed2e7
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 0dc82fa5
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "A smattering of different small fixes for some random driver
        subsystems. Nothing all that major, just resolutions for reported
        issues and bugs.
      
        All have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
        extcon: int3496: Set the id pin to direction-input if necessary
        extcon: int3496: Use gpiod_get instead of gpiod_get_index
        extcon: int3496: Add dependency on X86 as it's Intel specific
        extcon: int3496: Add GPIO ACPI mapping table
        extcon: int3496: Rename GPIO pins in accordance with binding
        vmw_vmci: handle the return value from pci_alloc_irq_vectors correctly
        ppdev: fix registering same device name
        parport: fix attempt to write duplicate procfiles
        auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches
        Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
        Drivers: hv: vmbus: Don't leak channel ids
        Drivers: hv: util: don't forget to init host_ts.lock
        Drivers: hv: util: move waiting for release to hv_utils_transport itself
        vmbus: remove hv_event_tasklet_disable/enable
        vmbus: use rcu for per-cpu channel list
        mei: don't wait for os version message reply
        mei: fix deadlock on mei reset
        intel_th: pci: Add Gemini Lake support
        intel_th: pci: Add Denverton SOC support
        intel_th: Don't leak module refcount on failure to activate
        ...
      0dc82fa5
    • Linus Torvalds's avatar
      Merge tag 'driver-core-4.11-rc4' of... · 9e54ef9d
      Linus Torvalds authored
      Merge tag 'driver-core-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fix from Greg KH:
       "Here is a single kernfs fix for 4.11-rc4 that resolves a reported
        issue.
      
        It has been in linux-next with no reported issues"
      
      * tag 'driver-core-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        kernfs: Check KERNFS_HAS_RELEASE before calling kernfs_release_file()
      9e54ef9d
    • Linus Torvalds's avatar
      Merge tag 'tty-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · f1638fc6
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some tty and serial driver fixes for 4.11-rc4.
      
        One of these fix a long-standing issue in the ldisc code that was
        found by Dmitry Vyukov with his great fuzzing work. The other fixes
        resolve other reported issues, and there is one revert of a patch in
        4.11-rc1 that wasn't correct.
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: fix data race in tty_ldisc_ref_wait()
        tty: don't panic on OOM in tty_set_ldisc()
        Revert "tty: serial: pl011: add ttyAMA for matching pl011 console"
        tty: acpi/spcr: QDF2400 E44 checks for wrong OEM revision
        serial: 8250_dw: Fix breakage when HAVE_CLK=n
        serial: 8250_dw: Honor clk_round_rate errors in dw8250_set_termios
      f1638fc6
    • Linus Torvalds's avatar
      Merge tag 'staging-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 53b4d591
      Linus Torvalds authored
      Pull IIO driver fixes from Greg KH:
       "Here are some small IIO driver fixes for 4.11-rc4 that resolve a
        number of tiny reported issues. All of these have been in linux-next
        for a while with no reported issues"
      
      * tag 'staging-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        iio: imu: st_lsm6dsx: fix FIFO_CTRL2 overwrite during watermark configuration
        iio: adc: ti_am335x_adc: fix fifo overrun recovery
        iio: sw-device: Fix config group initialization
        iio: magnetometer: ak8974: remove incorrect __exit markups
        iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
      53b4d591
    • Linus Torvalds's avatar
      Merge tag 'usb-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · e431e0e4
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are a number of small USB and PHY driver fixes for 4.11-rc4.
      
        Nothing major here, just an bunch of small fixes, and a handfull of
        good fixes from Johan for devices with crazy descriptors. There are a
        few new device ids in here as well.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'usb-4.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
        usb: gadget: f_hid: fix: Don't access hidg->req without spinlock held
        usb: gadget: udc: remove pointer dereference after free
        usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
        usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
        usb: gadget: acm: fix endianness in notifications
        usb: dwc3: gadget: delay unmap of bounced requests
        USB: serial: qcserial: add Dell DW5811e
        usb: hub: Fix crash after failure to read BOS descriptor
        ACM gadget: fix endianness in notifications
        USB: usbtmc: fix probe error path
        USB: usbtmc: add missing endpoint sanity check
        USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
        usb: musb: fix possible spinlock deadlock
        usb: musb: dsps: fix iounmap in error and exit paths
        usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
        usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
        uwb: i1480-dfu: fix NULL-deref at probe
        uwb: hwa-rc: fix NULL-deref at probe
        USB: wusbcore: fix NULL-deref at probe
        USB: uss720: fix NULL-deref at probe
        ...
      e431e0e4
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 42234bf8
      Linus Torvalds authored
      Pull more powerpc fixes from Michael Ellerman:
       "These are all pretty minor. The fix for idle wakeup would be a bad bug
        but has not been observed in practice.
      
        The update to the gcc-plugins docs was Cc'ed to Kees and Jon, Kees
        OK'ed it going via powerpc and I didn't hear from Jon.
      
         - cxl: Route eeh events to all slices for pci_channel_io_perm_failure state
      
         - powerpc/64s: Fix idle wakeup potential to clobber registers
      
         - Revert "powerpc/64: Disable use of radix under a hypervisor"
      
         - gcc-plugins: update architecture list in documentation
      
        Thanks to: Andrew Donnellan, Nicholas Piggin, Paul Mackerras, Vaibhav
        Jain"
      
      * tag 'powerpc-4.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        gcc-plugins: update architecture list in documentation
        Revert "powerpc/64: Disable use of radix under a hypervisor"
        powerpc/64s: Fix idle wakeup potential to clobber registers
        cxl: Route eeh events to all slices for pci_channel_io_perm_failure state
      42234bf8
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 1c23de63
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a memory leak on an error path, and two races when modifying
        inodes relating to the inline_data and metadata checksum features"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix two spelling nits
        ext4: lock the xattr block before checksuming it
        jbd2: don't leak memory if setting up journal fails
        ext4: mark inode dirty after converting inline directory
      1c23de63
  3. 25 Mar, 2017 18 commits