| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
i.MX arm64 device tree change for 5.17:
- New SoC support: i.MX8 ULP.
- New board support: i.MX8MM/MN based TQMa8Mx boards, iMX8MN BSH SMM S2,
i.MX8 ULP EVK.
- A series from Adam Ford to enable Camera and USB support for
imx8mm-beacon device.
- Add overlays for various serdes protocols on LS1028A QDS board using
different PHY cards.
- A series from Biwen Li to update LS1028A devices around RTC, flextimer
and PWM support.
- A series from Joakim Zhang to update ENET/FEC suppport on i.MX8M
devices.
- A couple of changes from Lucas Stach to update nitrogen8-som Ethernet
PHY and I2C1 pad configuration.
- A series from Martin Kepplinger to split out a shared imx8mq-librem5-r3
dtsi for Librem5 devices.
- Add cache descriptions for i.MX8 SoCs.
- A series from Vladimir Oltean to update ls1028a-rdb device tree in
order to share the DTS between Linux and U-Boot.
- Random device addtion to various i.MX8 and LX2160A based devices.
* tag 'imx-dt64-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (56 commits)
arm64: dts: imx8mp-evk: configure multiple queues on eqos
arm64: dts: ls1028a-qds: add overlays for various serdes protocols
arm64: dts: ls1028a-qds: enable lpuart1
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus
arm64: dts: ls1028a-rdb: enable pwm0
arm64: dts: ls1028a: add flextimer based pwm nodes
arm64: dts: ls1028a: add ftm_alarm1 node to be used as wakeup source
arm64: dts: ls1028a: Add PCIe EP nodes
arm64: dts: lx2162a-qds: add interrupt line for RTC node
arm64: dts: lx2162a-qds: support SD UHS-I and eMMC HS400 modes
arm64: dts: lx2160a: enable usb3-lpm-capable for usb3 nodes
arm64: dts: lx2160a-qds: Add mdio mux nodes
arm64: dts: lx2160a: add optee-tz node
arm64: dts: lx2160a-rdb: Add Inphi PHY node
arm64: dts: imx8mm: don't assign PLL2 in SoC dtsi
arm64: dts: nitrogen8-som: correct i2c1 pad-ctrl
arm64: dts: nitrogen8-som: correct network PHY reset
arm64: dts: imx8mn-bsh-smm-s2/pro: Add iMX8MN BSH SMM S2 boards
arm64: dts: imx8mm/n: Remove the 'pm-ignore-notify' property
arm64: dts: imx8ulp: add power domain entry for usdhc
...
Link: https://lore.kernel.org/r/20211218071427.26745-5-shawnguo@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
i.MX arm device tree change for 5.17:
- New board support: TQ-Systems MBa6x, Y Soft IOTA Crux/Crux+ board,
JOZ Access Point, Phytec PEB-WLBT-05 support, BSH SMM-M2 IMX6ULZ
SystemMaster.
- Update SPBA bus node name to match binding schema.
- A series from Christoph Niedermaier to update imx6qdl-dhcom board
around Ethernet and USB support.
- A series from Giulio Benetti to clean up undocumented/unused fixed
clock compatibles.
- A series from Laurent Pinchart to update i.MX7 MIPI_CSI support.
- A couple of changes from Russell to update phy-mode for
vf610-zii-dev-rev-b board.
- Add Wacom digitizer support for imx7d-remarkable2 device.
* tag 'imx-dt-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (36 commits)
ARM: dts: imx6: phytec: Add PEB-WLBT-05 support
ARM: dts: imx6qdl: phytec: Add support for optional PEB-AV-02 LCD adapter
ARM: dts: imx6qdl: phytec: Add support for optional PEB-EVAL-01 board
ARM: dts: imx6qdl-dhcom: Add USB overcurrent pin on SoM layer
ARM: dts: imx7d-remarkable2: add wacom digitizer device
ARM: dts: imx6ulz-bsh-smm-m2: Add BSH SMM-M2 IMX6ULZ SystemMaster
ARM: dts: imx6qdl-dhcom: Identify the PHY by ethernet-phy-id0007.c0f0
ARM: dts: imx6qdl-dhcom: Align PHY reset timing with other DHCOM SoMs
ARM: dts: imx6qdl: drop "fsl,imx-ckih1"
ARM: dts: imx6qdl: drop "fsl,imx-ckil"
ARM: dts: imx6qdl: drop "fsl,imx-osc"
ARM: dts: imx53: drop "fsl,imx-ckih2"
ARM: dts: imx53: drop "fsl,imx-ckih1"
ARM: dts: imx53: drop "fsl,imx-ckil"
ARM: dts: imx53: drop "fsl,imx-osc"
ARM: dts: imx51: drop "fsl,imx-ckih2"
ARM: dts: imx51: drop "fsl,imx-ckih1"
ARM: dts: imx51: drop "fsl,imx-ckil"
ARM: dts: imx51: drop "fsl,imx-osc"
ARM: dts: imx50: drop "fsl,imx-ckih2"
...
Link: https://lore.kernel.org/r/20211218071427.26745-4-shawnguo@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
"spidev" is not a real device, but a Linux implementation detail. It has
never been documented either. The kernel has WARNed on the use of it for
over 6 years. Time to remove its usage from the tree.
Signed-off-by: Rob Herring <robh@kernel.org>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20211217221232.3664417-1-robh@kernel.org'
Reviwed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
mvebu dt for 5.17 (part 1)
Add generic compatible to UART nodes on Armada 38x
* tag 'mvebu-dt-5.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu:
ARM: dts: armada-38x: Add generic compatible to UART nodes
Link: https://lore.kernel.org/r/875yrnm8uq.fsf@BL-laptop
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
mvebu dt64 for 5.17 (part 1)
Enable more network hardware and gpios on CN9130-CRB
Add new clock node needed by comphy on armada-37xx
* tag 'mvebu-dt64-5.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu:
arm64: dts: marvell: cn9130: enable CP0 GPIO controllers
arm64: dts: marvell: cn9130: add GPIO and SPI aliases
arm64: dts: marvell: armada-37xx: Add xtal clock to comphy node
arm/arm64: dts: Add MV88E6393X to CN9130-CRB device tree
arm/arm64: dts: Enable CP0 GPIOs for CN9130-CRB
Link: https://lore.kernel.org/r/878rwjm8vj.fsf@BL-laptop
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Devicetree changes for TI K3 platforms for v5.17 merge window:
* New Platforms:
- J721s2 SoC, SoM and Common Processor Board support
* New features:
- CAN support on AM64 EVM and SK
- TimeSync Router on AM64
* Fixes:
- Correct d-cache-sets info on J7200
- Fix L2 cache-sets value for J721e/J7200/AM64
- Fixes for dtbs_check warnings wrt serdes_ln_ctrl node on J721e/J7200
- Disable McASP on IoT2050 board to fix dtbs_check warnings
* tag 'ti-k3-dt-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux:
arch: arm64: ti: Add support J721S2 Common Processor Board
arm64: dts: ti: Add initial support for J721S2 System on Module
arm64: dts: ti: Add initial support for J721S2 SoC
dt-bindings: pinctrl: k3: Introduce pinmux definitions for J721S2
dt-bindings: arm: ti: Add bindings for J721s2 SoC
arm64: dts: ti: iot2050: Disable mcasp nodes at dtsi level
arm64: dts: ti: k3-am642-evm/sk: Add support for main domain mcan nodes in EVM and disable them on SK
arm64: dts: ti: k3-am64-main: Add support for MCAN
arm64: dts: ti: k3-j721e-common-proc-board: Add support for mcu and main mcan nodes
arm64: dts: ti: k3-j721e: Add support for MCAN nodes
arm64: dts: ti: am654-base-board/am65-iot2050-common: Disable mcan nodes
arm64: dts: ti: k3-am65-mcu: Add Support for MCAN
arm64: dts: ti: k3-am64-main: add timesync router node
arm64: dts: ti: k3-j7200: Correct the d-cache-sets info
arm64: dts: ti: k3-j721e: Fix the L2 cache sets
arm64: dts: ti: k3-j7200: Fix the L2 cache sets
arm64: dts: ti: k3-am642: Fix the L2 cache sets
arm64: dts: ti: j721e-main: Fix 'dtbs_check' in serdes_ln_ctrl node
arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node
arm64: dts: ti: k3-j721e: correct cache-sets info
Link: https://lore.kernel.org/r/20211217172806.10023-2-vigneshr@ti.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
arm64: tegra: Device tree changes for v5.17-rc1
The vast majority of this contains various updates and cleanups to the
Tegra device trees that will eventually help validate all of them using
the dt-schema infrastructure.
Another notable chunk of this contains additional Tegra234 support as
well as support for the new Jetson AGX Orin Developer Kit.
* tag 'tegra-for-5.17-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (47 commits)
arm64: tegra: Add host1x hotflush reset on Tegra210
arm64: tegra: Hook up MMC and BPMP to memory controller
arm64: tegra: Add memory controller on Tegra234
arm64: tegra: Add EMC general interrupt on Tegra194
arm64: tegra: Update SDMMC4 speeds for Tegra194
arm64: tegra: Add dma-coherent for Tegra194 VIC
arm64: tegra: Rename Ethernet PHY nodes
arm64: tegra: Remove unused only-1-8-v properties
arm64: tegra: Sort Tegra210 XUSB clocks correctly
arm64: tegra: Add missing TSEC properties on Tegra210
arm64: tegra: jetson-nano: Remove extra PLL power supplies for PCIe and XUSB
arm64: tegra: smaug: Remove extra PLL power supplies for XUSB
arm64: tegra: jetson-tx1: Remove extra PLL power supplies for PCIe and XUSB
arm64: tegra: Rename GPIO hog nodes to match schema
arm64: tegra: Remove unsupported regulator properties
arm64: tegra: Rename TCU node to "serial"
arm64: tegra: Remove undocumented Tegra194 PCIe "core_m" clock
arm64: tegra: Drop unused properties for Tegra194 PCIe
arm64: tegra: Fix Tegra194 HSP compatible string
arm64: tegra: Drop unsupported nvidia,lpdr property
...
Link: https://lore.kernel.org/r/20211217162253.1801077-4-thierry.reding@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
AT91 SoC #1 for 5.17:
- one low priority fix about of_node_put() missing in PM code
* tag 'at91-soc-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux:
ARM: at91: pm: Add of_node_put() before goto
Link: https://lore.kernel.org/r/20211217164134.28566-1-nicolas.ferre@microchip.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
The barrier is there for power_off rather than power_state.
Probably typo in commit 358b28f09f0ab074 ("arm/arm64: KVM: Allow
a VCPU to fully reset itself").
Signed-off-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211208193257.667613-3-tabba@google.com
|
|
The comment for kvm_reset_vcpu() refers to the sysreg table as
being the table above, probably because of the code extracted at
commit f4672752c321ea36 ("arm64: KVM: virtual CPU reset").
Fix the comment to remove the potentially confusing reference.
Signed-off-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211208193257.667613-2-tabba@google.com
|
|
Replace the hardcoded value with the existing definition.
No functional change intended.
Signed-off-by: Fuad Tabba <tabba@google.com>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211208192810.657360-1-tabba@google.com
|
|
Adding PCI device ids and enabling ADL-N platform.
ADL-N from i915 point of view is subplatform of ADL-P.
BSpec: 68397
Changes since V2:
- Added version log history
Changes since V1:
- replace IS_ALDERLAKE_N with IS_ADLP_N - Jani Nikula
Signed-off-by: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay@intel.com>
Reviewed-by: Anusha Srivatsa <anusha.srivatsa@intel.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211210051802.4063958-1-tejaskumarx.surendrakumar.upadhyay@intel.com
|
|
When a trap 7 (Instruction access rights) occurs, this means the CPU
couldn't execute an instruction due to missing execute permissions on
the memory region. In this case it seems the CPU didn't even fetched
the instruction from memory and thus did not store it in the cr19 (IIR)
register before calling the trap handler. So, the trap handler will find
some random old stale value in cr19.
This patch simply overwrites the stale IIR value with a constant magic
"bad food" value (0xbaadf00d), in the hope people don't start to try to
understand the various random IIR values in trap 7 dumps.
Noticed-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Synthesize a triple fault if L2 guest state is invalid at the time of
VM-Enter, which can happen if L1 modifies SMRAM or if userspace stuffs
guest state via ioctls(), e.g. KVM_SET_SREGS. KVM should never emulate
invalid guest state, since from L1's perspective, it's architecturally
impossible for L2 to have invalid state while L2 is running in hardware.
E.g. attempts to set CR0 or CR4 to unsupported values will either VM-Exit
or #GP.
Modifying vCPU state via RSM+SMRAM and ioctl() are the only paths that
can trigger this scenario, as nested VM-Enter correctly rejects any
attempt to enter L2 with invalid state.
RSM is a straightforward case as (a) KVM follows AMD's SMRAM layout and
behavior, and (b) Intel's SDM states that loading reserved CR0/CR4 bits
via RSM results in shutdown, i.e. there is precedent for KVM's behavior.
Following AMD's SMRAM layout is important as AMD's layout saves/restores
the descriptor cache information, including CS.RPL and SS.RPL, and also
defines all the fields relevant to invalid guest state as read-only, i.e.
so long as the vCPU had valid state before the SMI, which is guaranteed
for L2, RSM will generate valid state unless SMRAM was modified. Intel's
layout saves/restores only the selector, which means that scenarios where
the selector and cached RPL don't match, e.g. conforming code segments,
would yield invalid guest state. Intel CPUs fudge around this issued by
stuffing SS.RPL and CS.RPL on RSM. Per Intel's SDM on the "Default
Treatment of RSM", paraphrasing for brevity:
IF internal storage indicates that the [CPU was post-VMXON]
THEN
enter VMX operation (root or non-root);
restore VMX-critical state as defined in Section 34.14.1;
set to their fixed values any bits in CR0 and CR4 whose values must
be fixed in VMX operation [unless coming from an unrestricted guest];
IF RFLAGS.VM = 0 AND (in VMX root operation OR the
“unrestricted guest” VM-execution control is 0)
THEN
CS.RPL := SS.DPL;
SS.RPL := SS.DPL;
FI;
restore current VMCS pointer;
FI;
Note that Intel CPUs also overwrite the fixed CR0/CR4 bits, whereas KVM
will sythesize TRIPLE_FAULT in this scenario. KVM's behavior is allowed
as both Intel and AMD define CR0/CR4 SMRAM fields as read-only, i.e. the
only way for CR0 and/or CR4 to have illegal values is if they were
modified by the L1 SMM handler, and Intel's SDM "SMRAM State Save Map"
section states "modifying these registers will result in unpredictable
behavior".
KVM's ioctl() behavior is less straightforward. Because KVM allows
ioctls() to be executed in any order, rejecting an ioctl() if it would
result in invalid L2 guest state is not an option as KVM cannot know if
a future ioctl() would resolve the invalid state, e.g. KVM_SET_SREGS, or
drop the vCPU out of L2, e.g. KVM_SET_NESTED_STATE. Ideally, KVM would
reject KVM_RUN if L2 contained invalid guest state, but that carries the
risk of a false positive, e.g. if RSM loaded invalid guest state and KVM
exited to userspace. Setting a flag/request to detect such a scenario is
undesirable because (a) it's extremely unlikely to add value to KVM as a
whole, and (b) KVM would need to consider ioctl() interactions with such
a flag, e.g. if userspace migrated the vCPU while the flag were set.
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211207193006.120997-3-seanjc@google.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Revert a relatively recent change that set vmx->fail if the vCPU is in L2
and emulation_required is true, as that behavior is completely bogus.
Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong:
(a) it's impossible to have both a VM-Fail and VM-Exit
(b) vmcs.EXIT_REASON is not modified on VM-Fail
(c) emulation_required refers to guest state and guest state checks are
always VM-Exits, not VM-Fails.
For KVM specifically, emulation_required is handled before nested exits
in __vmx_handle_exit(), thus setting vmx->fail has no immediate effect,
i.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored.
Setting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit()
firing when tearing down the VM as KVM never expects vmx->fail to be set
when L2 is active, KVM always reflects those errors into L1.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 21158 at arch/x86/kvm/vmx/nested.c:4548
nested_vmx_vmexit+0x16bd/0x17e0
arch/x86/kvm/vmx/nested.c:4547
Modules linked in:
CPU: 0 PID: 21158 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547
Code: <0f> 0b e9 2e f8 ff ff e8 57 b3 5d 00 0f 0b e9 00 f1 ff ff 89 e9 80
Call Trace:
vmx_leave_nested arch/x86/kvm/vmx/nested.c:6220 [inline]
nested_vmx_free_vcpu+0x83/0xc0 arch/x86/kvm/vmx/nested.c:330
vmx_free_vcpu+0x11f/0x2a0 arch/x86/kvm/vmx/vmx.c:6799
kvm_arch_vcpu_destroy+0x6b/0x240 arch/x86/kvm/x86.c:10989
kvm_vcpu_destroy+0x29/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441
kvm_free_vcpus arch/x86/kvm/x86.c:11426 [inline]
kvm_arch_destroy_vm+0x3ef/0x6b0 arch/x86/kvm/x86.c:11545
kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1189 [inline]
kvm_put_kvm+0x751/0xe40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1220
kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3489
__fput+0x3fc/0x870 fs/file_table.c:280
task_work_run+0x146/0x1c0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0x705/0x24f0 kernel/exit.c:832
do_group_exit+0x168/0x2d0 kernel/exit.c:929
get_signal+0x1740/0x2120 kernel/signal.c:2852
arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300
do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fixes: c8607e4a086f ("KVM: x86: nVMX: don't fail nested VM entry on invalid guest state if !from_vmentry")
Reported-by: syzbot+f1d2136db9c80d4733e8@syzkaller.appspotmail.com
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211207193006.120997-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
The kvm_run struct's if_flag is a part of the userspace/kernel API. The
SEV-ES patches failed to set this flag because it's no longer needed by
QEMU (according to the comment in the source code). However, other
hypervisors may make use of this flag. Therefore, set the flag for
guests with encrypted registers (i.e., with guest_state_protected set).
Fixes: f1c6366e3043 ("KVM: SVM: Add required changes to support intercepts under SEV-ES")
Signed-off-by: Marc Orr <marcorr@google.com>
Message-Id: <20211209155257.128747-1-marcorr@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
|
|
After dropping mmu_lock in the TDP MMU, restart the iterator during
tdp_iter_next() and do not advance the iterator. Advancing the iterator
results in skipping the top-level SPTE and all its children, which is
fatal if any of the skipped SPTEs were not visited before yielding.
When zapping all SPTEs, i.e. when min_level == root_level, restarting the
iter and then invoking tdp_iter_next() is always fatal if the current gfn
has as a valid SPTE, as advancing the iterator results in try_step_side()
skipping the current gfn, which wasn't visited before yielding.
Sprinkle WARNs on iter->yielded being true in various helpers that are
often used in conjunction with yielding, and tag the helper with
__must_check to reduce the probabily of improper usage.
Failing to zap a top-level SPTE manifests in one of two ways. If a valid
SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(),
the shadow page will be leaked and KVM will WARN accordingly.
WARNING: CPU: 1 PID: 3509 at arch/x86/kvm/mmu/tdp_mmu.c:46 [kvm]
RIP: 0010:kvm_mmu_uninit_tdp_mmu+0x3e/0x50 [kvm]
Call Trace:
<TASK>
kvm_arch_destroy_vm+0x130/0x1b0 [kvm]
kvm_destroy_vm+0x162/0x2a0 [kvm]
kvm_vcpu_release+0x34/0x60 [kvm]
__fput+0x82/0x240
task_work_run+0x5c/0x90
do_exit+0x364/0xa10
? futex_unqueue+0x38/0x60
do_group_exit+0x33/0xa0
get_signal+0x155/0x850
arch_do_signal_or_restart+0xed/0x750
exit_to_user_mode_prepare+0xc5/0x120
syscall_exit_to_user_mode+0x1d/0x40
do_syscall_64+0x48/0xc0
entry_SYSCALL_64_after_hwframe+0x44/0xae
If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by
kvm_tdp_mmu_put_root(), KVM triggers a use-after-free in the form of
marking a struct page as dirty/accessed after it has been put back on the
free list. This directly triggers a WARN due to encountering a page with
page_count() == 0, but it can also lead to data corruption and additional
errors in the kernel.
WARNING: CPU: 7 PID: 1995658 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:171
RIP: 0010:kvm_is_zone_device_pfn.part.0+0x9e/0xd0 [kvm]
Call Trace:
<TASK>
kvm_set_pfn_dirty+0x120/0x1d0 [kvm]
__handle_changed_spte+0x92e/0xca0 [kvm]
__handle_changed_spte+0x63c/0xca0 [kvm]
__handle_changed_spte+0x63c/0xca0 [kvm]
__handle_changed_spte+0x63c/0xca0 [kvm]
zap_gfn_range+0x549/0x620 [kvm]
kvm_tdp_mmu_put_root+0x1b6/0x270 [kvm]
mmu_free_root_page+0x219/0x2c0 [kvm]
kvm_mmu_free_roots+0x1b4/0x4e0 [kvm]
kvm_mmu_unload+0x1c/0xa0 [kvm]
kvm_arch_destroy_vm+0x1f2/0x5c0 [kvm]
kvm_put_kvm+0x3b1/0x8b0 [kvm]
kvm_vcpu_release+0x4e/0x70 [kvm]
__fput+0x1f7/0x8c0
task_work_run+0xf8/0x1a0
do_exit+0x97b/0x2230
do_group_exit+0xda/0x2a0
get_signal+0x3be/0x1e50
arch_do_signal_or_restart+0x244/0x17f0
exit_to_user_mode_prepare+0xcb/0x120
syscall_exit_to_user_mode+0x1d/0x40
do_syscall_64+0x4d/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
Note, the underlying bug existed even before commit 1af4a96025b3 ("KVM:
x86/mmu: Yield in TDU MMU iter even if no SPTES changed") moved calls to
tdp_mmu_iter_cond_resched() to the beginning of loops, as KVM could still
incorrectly advance past a top-level entry when yielding on a lower-level
entry. But with respect to leaking shadow pages, the bug was introduced
by yielding before processing the current gfn.
Alternatively, tdp_mmu_iter_cond_resched() could simply fall through, or
callers could jump to their "retry" label. The downside of that approach
is that tdp_mmu_iter_cond_resched() _must_ be called before anything else
in the loop, and there's no easy way to enfornce that requirement.
Ideally, KVM would handling the cond_resched() fully within the iterator
macro (the code is actually quite clean) and avoid this entire class of
bugs, but that is extremely difficult do while also supporting yielding
after tdp_mmu_set_spte_atomic() fails. Yielding after failing to set a
SPTE is very desirable as the "owner" of the REMOVED_SPTE isn't strictly
bounded, e.g. if it's zapping a high-level shadow page, the REMOVED_SPTE
may block operations on the SPTE for a significant amount of time.
Fixes: faaf05b00aec ("kvm: x86/mmu: Support zapping SPTEs in the TDP MMU")
Fixes: 1af4a96025b3 ("KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed")
Reported-by: Ignat Korchagin <ignat@cloudflare.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211214033528.123268-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
i.MX fixes for 5.16, round 3:
- Fix imx6qdl-wandboard Ethernet support by adding 'qca,clk-out-frequency'
property.
- Fix scl-gpios property typo in LX2160A device tree.
* tag 'imx-fixes-5.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
arm64: dts: lx2160a: fix scl-gpios property name
ARM: dts: imx6qdl-wandboard: Fix Ethernet support
soc: imx: Register SoC device only on i.MX boards
soc: imx: imx8m-blk-ctrl: Fix imx8mm mipi reset
ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
arm64: dts: imx8mq: remove interconnect property from lcdif
arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys
arm64: dts: lx2160abluebox3: update RGMII delays for sja1105 switch
ARM: dts: ls1021a-tsn: update RGMII delays for sja1105 switch
ARM: dts: imx6qp-prtwd3: update RGMII delays for sja1105 switch
Link: https://lore.kernel.org/r/20211218052003.GA25102@dragon
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Commit in Fixes accesses pt_regs before checking whether it is NULL or
not. Make sure the NULL pointer check happens first.
Fixes: 0a5b288e85bb ("x86/mce: Prevent severity computation from being instrumented")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20211217102029.GA29708@kili
|
|
The fixed counter 3 is used for the Topdown metrics, which hasn't been
enabled for KVM guests. Userspace accessing to it will fail as it's not
included in get_fixed_pmc(). This breaks KVM selftests on ICX+ machines,
which have this counter.
To reproduce it on ICX+ machines, ./state_test reports:
==== Test Assertion Failure ====
lib/x86_64/processor.c:1078: r == nmsrs
pid=4564 tid=4564 - Argument list too long
1 0x000000000040b1b9: vcpu_save_state at processor.c:1077
2 0x0000000000402478: main at state_test.c:209 (discriminator 6)
3 0x00007fbe21ed5f92: ?? ??:0
4 0x000000000040264d: _start at ??:?
Unexpected result from KVM_GET_MSRS, r: 17 (failed MSR was 0x30c)
With this patch, it works well.
Signed-off-by: Wei Wang <wei.w.wang@intel.com>
Message-Id: <20211217124934.32893-1-wei.w.wang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Signal processor STORE STATUS requires a physical address where register
contents are supposed to be written to, however the kernel must read the
data via the corresponding virtual address.
Also the allocated save_area, where register contents are copied to,
resides in virtual address space.
Fix this by using proper __pa() conversion, or correct memblock_alloc()
invocation.
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
|
|
The clgfi instruction used within the ChaCha20 assembly is only
available for z9-109 and newer machines, and therefore this will
generate a compile error if compiled e.g. with MARCH_Z900.
Given that the assembler code will only be executed on machines with
vector instructions, which became much later available than z9-109,
use insn notation to generate the clgfi instruction, and avoid compile
errors due to unknown instructions.
Fixes: b087dfab4d39 ("s390/crypto: add SIMD implementation for ChaCha20")
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
|
|
We need the tty/serial fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
pmd_huge() is defined to false when HUGETLB_PAGE is not configured, but
the vmap code still installs huge PMDs. This leads to false bad PMD
errors when vunmapping because it is not seen as a huge PTE, and the bad
PMD check catches it. The end result may not be much more serious than
some bad pmd warning messages, because the pmd_none_or_clear_bad() does
what we wanted and clears the huge PTE anyway.
Fix this by checking pmd_is_leaf(), which checks for a PTE regardless of
config options. The whole huge/large/leaf stuff is a tangled mess but
that's kernel-wide and not something we can improve much in arch/powerpc
code.
pmd_page(), pud_page(), etc., called by vmalloc_to_page() on huge vmaps
can similarly trigger a false VM_BUG_ON when CONFIG_HUGETLB_PAGE=n, so
those checks are adjusted. The checks were added by commit d6eacedd1f0e
("powerpc/book3s: Use config independent helpers for page table walk"),
while implementing a similar fix for other page table walking functions.
Fixes: d909f9109c30 ("powerpc/64s/radix: Enable HAVE_ARCH_HUGE_VMAP")
Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211216103342.609192-1-npiggin@gmail.com
|
|
Use the macro 'swap()' defined in 'include/linux/minmax.h' to avoid
opencoding it.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: David Yang <davidcomponentone@gmail.com>
Signed-off-by: Yang Guang <yang.guang5@zte.com.cn>
[mpe: Add include of linux/minmax.h]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/71a702c2189b16c152affd8a8cda1d84ce32741c.1639792543.git.yang.guang5@zte.com.cn
|
|
'mpic->protected' is a bitmap. So use 'bitmap_zalloc()' to simplify
code and improve the semantic, instead of hand writing it.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/aa145f674e08044c98f13f1a985faa9cc29c3708.1639777976.git.christophe.jaillet@wanadoo.fr
|
|
Both __pkru_allows_write() and arch_set_user_pkey_access() shift
PKRU_WD_BIT (a signed constant) by up to 30 bits, hitting the
sign bit.
Use unsigned constants instead.
Clearly pkey 15 has not been used in combination with UBSAN yet.
Noticed by code inspection only. I can't actually provoke the
compiler into generating incorrect logic as far as this shift is
concerned.
[
dhansen: add stable@ tag, plus minor changelog massaging,
For anyone doing backports, these #defines were in
arch/x86/include/asm/pgtable.h before 784a46618f6.
]
Fixes: 33a709b25a76 ("mm/gup, x86/mm/pkeys: Check VMAs and PTEs for protection keys")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20211216000856.4480-1-andrew.cooper3@citrix.com
|
|
Pull kvm fixes from Paolo Bonzini:
"Two small fixes, one of which was being worked around in selftests"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: Retry page fault if MMU reload is pending and root has no sp
KVM: selftests: vmx_pmu_msrs_test: Drop tests mangling guest visible CPUIDs
KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES
|
|
Pull MIPS fix from Thomas Bogendoerfer:
- only enable pci_remap_iospace() for Ralink devices
* tag 'mips-fixes_5.16_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: Only define pci_remap_iospace() for Ralink
|
|
The current 'rx-internal-delay-ps' property value on the Realtek switch
node, 2000, will be divided by 300, resulting in 6.66, which will be
rounded to the closest step value, 7. Change it to 2100 to be accurate.
See ef136837aaf6 ("net: dsa: rtl8365mb: set RGMII RX delay in steps of
0.3 ns") for reference.
Flow control needs to be enabled on both sides of the internal and
external switch. It is already enabled on the CPU port of the Realtek
switch so we also enable it on the external switch port of the Broadcom
switch as well.
Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Pull powerpc fixes from Michael Ellerman:
"Fix a recently introduced oops at boot on 85xx in some configurations.
Fix crashes when loading some livepatch modules with
STRICT_MODULE_RWX.
Thanks to Joe Lawrence, Russell Currey, and Xiaoming Ni"
* tag 'powerpc-5.16-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/module_64: Fix livepatching for RO modules
powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n
|
|
Rename the SATA controller unit name from ahci to sata in preparation
for adding the Broadcom SATA3 controller YAML binding which will bring
validation.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Rename the msi controller unit name to 'msi' to avoid collisions with
the 'msi-controller' boolean property.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Rename the msi controller unit name to 'msi' to avoid collisions with
the 'msi-controller' boolean property.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Update the PCIe PHY node unit name and its sub-nodes to help with
upcoming changes converting the Cygnus PCIe PHY DT binding to YAML and
later the iProc PCIe controller binding to YAML.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Rename the msi controller unit name to 'msi' to avoid collisions with
the 'msi-controller' boolean property. We also need to re-arrange the
'ranges' property to show the two cells as being separate instead of
combined since the DT checker is not able to differentiate otherwise.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
|
|
Play nice with a NULL shadow page when checking for an obsolete root in
the page fault handler by flagging the page fault as stale if there's no
shadow page associated with the root and KVM_REQ_MMU_RELOAD is pending.
Invalidating memslots, which is the only case where _all_ roots need to
be reloaded, requests all vCPUs to reload their MMUs while holding
mmu_lock for lock.
The "special" roots, e.g. pae_root when KVM uses PAE paging, are not
backed by a shadow page. Running with TDP disabled or with nested NPT
explodes spectaculary due to dereferencing a NULL shadow page pointer.
Skip the KVM_REQ_MMU_RELOAD check if there is a valid shadow page for the
root. Zapping shadow pages in response to guest activity, e.g. when the
guest frees a PGD, can trigger KVM_REQ_MMU_RELOAD even if the current
vCPU isn't using the affected root. I.e. KVM_REQ_MMU_RELOAD can be seen
with a completely valid root shadow page. This is a bit of a moot point
as KVM currently unloads all roots on KVM_REQ_MMU_RELOAD, but that will
be cleaned up in the future.
Fixes: a955cad84cda ("KVM: x86/mmu: Retry page fault if root is invalidated by memslot update")
Cc: stable@vger.kernel.org
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211209060552.2956723-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
The ability to write to MSR_IA32_PERF_CAPABILITIES from the host should
not depend on guest visible CPUID entries, even if just to allow
creating/restoring guest MSRs and CPUIDs in any sequence.
Fixes: 27461da31089 ("KVM: x86/pmu: Support full width counting")
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20211216165213.338923-3-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Fix conflicts between memslot overhaul and commit 511d25d6b789f ("KVM:
PPC: Book3S: Suppress warnings when allocating too big memory slots")
from the powerpc tree.
|
|
Pull RISC-V fixes from Palmer Dabbelt:
- A handful of DT updates for the SiFive HiFive Unmatched, that fix the
regulator handling. These should stop some warning spew.
- A pair of fixes for both the SiFive Hifive Unleashed and Unmatched,
that correctly hook up the MMC card detect signal.
* tag 'riscv-for-linus-5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: dts: sifive unmatched: Link the tmp451 with its power supply
riscv: dts: sifive unmatched: Fix regulator for board rev3
riscv: dts: sifive unmatched: Expose the PMIC sub-functions
riscv: dts: sifive unmatched: Expose the board ID eeprom
riscv: dts: sifive unmatched: Name gpio lines
riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot
riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot
|
|
Add generic compatible string "ns16550a" to serial port nodes of Armada
38x.
This makes it possible to use earlycon.
Fixes: 0d3d96ab0059 ("ARM: mvebu: add Device Tree description of the Armada 380/385 SoCs")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
CN9130 has a built-in CP115 which has 2 GPIO controllers, but unlike in
Armada 7k and 8k both are left disabled by the SoC DTSI.
This first of all makes no sense as they are always present due to being
SoC built-in and its an issue as boards like CN9130-CRB use the CPO GPIO2
pins for regulators and SD card support without enabling them first.
So, enable both of them like Armada 7k and 8k do.
Fixes: 6b8970bd8d7a ("arm64: dts: marvell: Add support for Marvell CN9130 SoC support")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
CN9130 has one CP115 built in, which like the CP110 has 2 GPIO and 2 SPI
controllers built-in.
However, unlike the Armada 7k and 8k the SoC DTSI doesn't add the required
aliases as both the Orion SPI driver and MVEBU GPIO drivers require the
aliases to be present.
So add the required aliases for GPIO and SPI controllers.
Fixes: 6b8970bd8d7a ("arm64: dts: marvell: Add support for Marvell CN9130 SoC support")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
Kernel driver phy-mvebu-a3700-comphy.c needs to know the rate of the
reference xtal clock. So add missing xtal clock source into comphy device
tree node. If the property is not present, the driver defaults to 25 MHz
xtal rate (which, as far as we know, is used by all the existing boards).
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
The CN9130-CRB boards have a MV88E6393X switch connected to eth0. Add
the necessary dts nodes and properties for this.
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
Enable the CP0 GPIO devices for the CN9130-CRB. This is needed for a
number of the peripheral devices to function.
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
|
|
Enable at least the same amount of algs as the hardware IPs are
supporting so that they are able to fallback to the software
implementations in case they need it.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20211215134311.304427-1-tudor.ambarus@microchip.com
|
|
sama7g5ek comes with a SPI NOR flash connected to the QSPI
controller. Enable the SPI NOR subsystem and the QSPI controller.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20211209153744.357465-2-tudor.ambarus@microchip.com
|
|
Not all .S files include asm/assembler.h, however the SYM_FUNC_*
definitions invoke the 'bti' macro. Include asm/assembler.h in
asm/linkage.h.
Fixes: 9be34be87cc8 ("arm64: Add macro version of the BTI instruction")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
|
|
Renesas ARM defconfig updates for v5.17
- Enable support for the new R-Car S4-8 SoC in the arm64 defconfig.
* tag 'renesas-arm-defconfig-for-v5.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
arm64: defconfig: Enable R-Car S4-8
Link: https://lore.kernel.org/r/cover.1639736717.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
Arnd Bergmann
Rob Herring
Fuad Tabba
Tejas Upadhyay
Helge Deller
Sean Christopherson
Marc Orr
Borislav Petkov
Wei Wang
Heiko Carstens
Greg Kroah-Hartman
Nicholas Piggin
Yang Guang
Christophe JAILLET
Andrew Cooper
Linus Torvalds
Arınç ÜNAL
Florian Fainelli
Vitaly Kuznetsov
Paolo Bonzini
Marek Behún
Robert Marko
Pali Rohár
Chris Packham
Tudor Ambarus
Catalin Marinas