summaryrefslogtreecommitdiffstats
path: root/drivers/iommu
AgeCommit message (Collapse)AuthorFilesLines
2015-10-27Merge tag 'iommu-fixes-v4.3-rc7' of ↵Linus Torvalds3-2/+10
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: "Two late fixes for the AMD IOMMU driver: - add an additional check to the io page-fault handler to avoid a BUG_ON being hit in handle_mm_fault() - fix a problem with devices writing to the system management area and were blocked by the IOMMU because the driver wrongly cleared out the DTE flags allowing that access" * tag 'iommu-fixes-v4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Don't clear DTE flags when modifying it iommu/amd: Fix BUG when faulting a PROT_NONE VMA
2015-10-22Merge tag 'for-linus-20151021' of git://git.infradead.org/intel-iommuLinus Torvalds1-4/+8
Pull intel-iommu bugfix from David Woodhouse: "This contains a single fix, for when the IOMMU API is used to overlay an existing mapping comprised of 4KiB pages, with a mapping that can use superpages. For the *first* superpage in the new mapping, we were correctly¹ freeing the old bottom-level page table page and clearing the link to it, before installing the superpage. For subsequent superpages, however, we weren't. This causes a memory leak, and a warning about setting a PTE which is already set. ¹ Well, not *entirely* correctly. We just free the page table pages right there and then, which is wrong. In fact they should only be freed *after* the IOTLB is flushed so we know the hardware will no longer be looking at them.... and in fact I note that the IOTLB flush is completely missing from the intel_iommu_map() code path, although it needs to be there if it's permitted to overwrite existing mappings. Fixing those is somewhat more intrusive though, and will probably need to wait for 4.4 at this point" * tag 'for-linus-20151021' of git://git.infradead.org/intel-iommu: iommu/vt-d: fix range computation when making room for large pages
2015-10-21iommu/amd: Don't clear DTE flags when modifying itJoerg Roedel2-2/+3
During device assignment/deassignment the flags in the DTE get lost, which might cause spurious faults, for example when the device tries to access the system management range. Fix this by not clearing the flags with the rest of the DTE. Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com> Tested-by: G. Richard Bellamy <rbellamy@pteradigm.com> Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-15iommu/amd: Fix BUG when faulting a PROT_NONE VMAJay Cornwall1-0/+7
handle_mm_fault indirectly triggers a BUG in do_numa_page when given a VMA without read/write/execute access. Check this condition in do_fault. do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page mm/memory.c 3147 static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, .... 3159 /* A PROT_NONE fault should not end up here */ 3160 BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))); Signed-off-by: Jay Cornwall <jay@jcornwall.me> Cc: <stable@vger.kernel.org> # v4.1+ Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-13iommu/vt-d: fix range computation when making room for large pagesChristian Zander1-4/+8
In preparation for the installation of a large page, any small page tables that may still exist in the target IOV address range are removed. However, if a scatter/gather list entry is large enough to fit more than one large page, the address space for any subsequent large pages is not cleared of conflicting small page tables. This can cause legitimate mapping requests to fail with errors of the form below, potentially followed by a series of IOMMU faults: ERROR: DMA PTE for vPFN 0xfde00 already set (to 7f83a4003 not 7e9e00083) In this example, a 4MiB scatter/gather list entry resulted in the successful installation of a large page @ vPFN 0xfdc00, followed by a failed attempt to install another large page @ vPFN 0xfde00, due to the presence of a pointer to a small page table @ 0x7f83a4000. To address this problem, compute the number of large pages that fit into a given scatter/gather list entry, and use it to derive the last vPFN covered by the large page(s). Cc: stable@vger.kernel.org Signed-off-by: Christian Zander <christian@nervanasys.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
2015-10-13Merge tag 'iommu-fixes-v4.3-rc5' of ↵Linus Torvalds6-19/+42
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "A few fixes piled up: - Fix for a suspend/resume issue where PCI probing code overwrote dev->irq for the MSI irq of the AMD IOMMU. - Fix for a kernel crash when a 32 bit PCI device was assigned to a KVM guest. - Fix for a possible memory leak in the VT-d driver - A couple of fixes for the ARM-SMMU driver" * tag 'iommu-fixes-v4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix NULL pointer deref on device detach iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devices iommu/vt-d: Fix memory leak in dmar_insert_one_dev_info() iommu/arm-smmu: Use correct address mask for CMD_TLBI_S2_IPA iommu/arm-smmu: Ensure IAS is set correctly for AArch32-capable SMMUs iommu/io-pgtable-arm: Don't use dma_to_phys()
2015-10-09iommu/amd: Fix NULL pointer deref on device detachJoerg Roedel1-0/+9
When a device group is detached from its domain, the iommu core code calls into the iommu driver to detach each device individually. Before this functionality went into the iommu core code, it was implemented in the drivers, also in the AMD IOMMU driver as the device alias handling code. This code is still present, as there might be aliases that don't exist as real PCI devices (and are therefore invisible to the iommu core code). Unfortunatly it might happen now, that a device is unbound multiple times from its domain, first by the alias handling code and then by the iommu core code (or vice verca). This ends up in the do_detach function which dereferences the dev_data->domain pointer. When the device is already detached, this pointer is NULL and we get a kernel oops. Removing the alias code completly is not an option, as that would also remove the code which handles invisible aliases. The code could be simplified, but this is too big of a change outside the merge window. For now, just check the dev_data->domain pointer in do_detach and bail out if it is NULL. Reported-by: Andreas Hartmann <andihartmann@freenet.de> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-09iommu/amd: Prevent binding other PCI drivers to IOMMU PCI devicesJiang Liu1-0/+3
AMD IOMMU driver makes use of IOMMU PCI devices, so prevent binding other PCI drivers to IOMMU PCI devices. This fixes a bug reported by Boris that system suspend/resume gets broken on AMD platforms. For more information, please refer to: https://lkml.org/lkml/2015/9/26/89 Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()") Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-07Merge branch 'for-joerg/arm-smmu/fixes' of ↵Joerg Roedel3-19/+29
git://git.kernel.org/pub/scm/linux/kernel/git/will/linux into iommu/fixes
2015-10-02Merge git://git.infradead.org/intel-iommuLinus Torvalds3-55/+75
Pull IOVA fixes from David Woodhouse: "The main fix here is the first one, fixing the over-allocation of size-aligned requests. The other patches simply make the existing IOVA code available to users other than the Intel VT-d driver, with no functional change. I concede the latter really *should* have been submitted during the merge window, but since it's basically risk-free and people are waiting to build on top of it and it's my fault I didn't get it in, I (and they) would be grateful if you'd take it" * git://git.infradead.org/intel-iommu: iommu: Make the iova library a module iommu: iova: Export symbols iommu: iova: Move iova cache management to the iova library iommu/iova: Avoid over-allocating when size-aligned
2015-09-29iommu/vt-d: Fix memory leak in dmar_insert_one_dev_info()Sudip Mukherjee1-0/+1
We are returning NULL if we are not able to attach the iommu to the domain but while returning we missed freeing info. Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-09-22iommu/arm-smmu: Use correct address mask for CMD_TLBI_S2_IPAWill Deacon1-3/+6
Stage-2 TLBI by IPA takes a 48-bit address field, as opposed to the 64-bit field used by the VA-based invalidation commands. This patch re-jigs the SMMUv3 command construction code so that the address field is correctly masked. Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-09-22iommu/arm-smmu: Ensure IAS is set correctly for AArch32-capable SMMUsWill Deacon1-3/+9
AArch32-capable SMMU implementations have a minimum IAS of 40 bits, so ensure that is reflected in the stage-2 page table configuration. Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-09-22iommu/io-pgtable-arm: Don't use dma_to_phys()Robin Murphy2-13/+14
In checking whether DMA addresses differ from physical addresses, using dma_to_phys() is actually the wrong thing to do, since it may hide any DMA offset, which is precisely one of the things we are checking for. Simply casting between the two address types, whilst ugly, is in fact the appropriate course of action. Further care (and ugliness) is also necessary in the comparison to avoid truncation if phys_addr_t and dma_addr_t differ in size. We can also reject any device with a fixed DMA offset up-front at page table creation, leaving the allocation-time check for the more subtle cases like bounce buffering due to an incorrect DMA mask. Furthermore, we can then fix the hackish KConfig dependency so that architectures without a dma_to_phys() implementation may still COMPILE_TEST (or even use!) the code. The true dependency is on the DMA API, so use the appropriate symbol for that. Signed-off-by: Robin Murphy <robin.murphy@arm.com> [will: folded in selftest fix from Yong Wu] Signed-off-by: Will Deacon <will.deacon@arm.com>
2015-09-11fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to voidJoe Perches1-1/+2
The seq_<foo> function return values were frequently misused. See: commit 1f33c41c03da ("seq_file: Rename seq_overflow() to seq_has_overflowed() and make public") All uses of these return values have been removed, so convert the return types to void. Miscellanea: o Move seq_put_decimal_<type> and seq_escape prototypes closer the other seq_vprintf prototypes o Reorder seq_putc and seq_puts to return early on overflow o Add argument names to seq_vprintf and seq_printf o Update the seq_escape kernel-doc o Convert a couple of leading spaces to tabs in seq_escape Signed-off-by: Joe Perches <joe@perches.com> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Mark Brown <broonie@kernel.org> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Joerg Roedel <jroedel@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-09-08Merge tag 'iommu-updates-v4.3' of ↵Linus Torvalds22-902/+925
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates for from Joerg Roedel: "This time the IOMMU updates are mostly cleanups or fixes. No big new features or drivers this time. In particular the changes include: - Bigger cleanup of the Domain<->IOMMU data structures and the code that manages them in the Intel VT-d driver. This makes the code easier to understand and maintain, and also easier to keep the data structures in sync. It is also a preparation step to make use of default domains from the IOMMU core in the Intel VT-d driver. - Fixes for a couple of DMA-API misuses in ARM IOMMU drivers, namely in the ARM and Tegra SMMU drivers. - Fix for a potential buffer overflow in the OMAP iommu driver's debug code - A couple of smaller fixes and cleanups in various drivers - One small new feature: Report domain-id usage in the Intel VT-d driver to easier detect bugs where these are leaked" * tag 'iommu-updates-v4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (83 commits) iommu/vt-d: Really use upper context table when necessary x86/vt-d: Fix documentation of DRHD iommu/fsl: Really fix init section(s) content iommu/io-pgtable-arm: Unmap and free table when overwriting with block iommu/io-pgtable-arm: Move init-fn declarations to io-pgtable.h iommu/msm: Use BUG_ON instead of if () BUG() iommu/vt-d: Access iomem correctly iommu/vt-d: Make two functions static iommu/vt-d: Use BUG_ON instead of if () BUG() iommu/vt-d: Return false instead of 0 in irq_remapping_cap() iommu/amd: Use BUG_ON instead of if () BUG() iommu/amd: Make a symbol static iommu/amd: Simplify allocation in irq_remapping_alloc() iommu/tegra-smmu: Parameterize number of TLB lines iommu/tegra-smmu: Factor out tegra_smmu_set_pde() iommu/tegra-smmu: Extract tegra_smmu_pte_get_use() iommu/tegra-smmu: Use __GFP_ZERO to allocate zeroed pages iommu/tegra-smmu: Remove PageReserved manipulation iommu/tegra-smmu: Convert to use DMA API iommu/tegra-smmu: smmu_flush_ptc() wants device addresses ...
2015-09-02Merge branch 'for-4.3/sg' of git://git.kernel.dk/linux-blockLinus Torvalds2-3/+3
Pull SG updates from Jens Axboe: "This contains a set of scatter-gather related changes/fixes for 4.3: - Add support for limited chaining of sg tables even for architectures that do not set ARCH_HAS_SG_CHAIN. From Christoph. - Add sg chain support to target_rd. From Christoph. - Fixup open coded sg->page_link in crypto/omap-sham. From Christoph. - Fixup open coded crypto ->page_link manipulation. From Dan. - Also from Dan, automated fixup of manual sg_unmark_end() manipulations. - Also from Dan, automated fixup of open coded sg_phys() implementations. - From Robert Jarzmik, addition of an sg table splitting helper that drivers can use" * 'for-4.3/sg' of git://git.kernel.dk/linux-block: lib: scatterlist: add sg splitting function scatterlist: use sg_phys() crypto/omap-sham: remove an open coded access to ->page_link scatterlist: remove open coded sg_unmark_end instances crypto: replace scatterwalk_sg_chain with sg_chain target/rd: always chain S/G list scatterlist: allow limited chaining without ARCH_HAS_SG_CHAIN
2015-09-01Merge tag 'armsoc-drivers' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC driver updates from Olof Johansson: "Some releases this branch is nearly empty, others we have more stuff. It tends to gather drivers that need SoC modification or dependencies such that they have to (also) go in through our tree. For this release, we have merged in part of the reset controller tree (with handshake that the parts we have merged in will remain stable), as well as dependencies on a few clock branches. In general, new items here are: - Qualcomm driver for SMM/SMD, which is how they communicate with the coprocessors on (some) of their platforms - memory controller work for ARM's PL172 memory controller - reset drivers for various platforms - PMU power domain support for Marvell platforms - Tegra support for T132/T210 SoCs: PMC, fuse, memory controller per-SoC support" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (49 commits) ARM: tegra: cpuidle: implement cpuidle_state.enter_freeze() ARM: tegra: Disable cpuidle if PSCI is available soc/tegra: pmc: Use existing pclk reference soc/tegra: pmc: Remove unnecessary return statement soc: tegra: Remove redundant $(CONFIG_ARCH_TEGRA) in Makefile memory: tegra: Add Tegra210 support memory: tegra: Add support for a variable-size client ID bitfield clk: shmobile: rz: Add CPG/MSTP Clock Domain support clk: shmobile: rcar-gen2: Add CPG/MSTP Clock Domain support clk: shmobile: r8a7779: Add CPG/MSTP Clock Domain support clk: shmobile: r8a7778: Add CPG/MSTP Clock Domain support clk: shmobile: Add CPG/MSTP Clock Domain support ARM: dove: create a proper PMU driver for power domains, PMU IRQs and resets reset: reset-zynq: Adding support for Xilinx Zynq reset controller. docs: dts: Added documentation for Xilinx Zynq Reset Controller bindings. MIPS: ath79: Add the reset controller to the AR9132 dtsi reset: Add a driver for the reset controller on the AR71XX/AR9XXX devicetree: Add bindings for the ATH79 reset controller reset: socfpga: Update reset-socfpga to read the altr,modrst-offset property doc: dt: add documentation for lpc1850-rgu reset driver ...
2015-08-31Merge tag 'pci-v4.3-changes' of ↵Linus Torvalds1-10/+18
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: "PCI changes for the v4.3 merge window: Enumeration: - Allocate ATS struct during enumeration (Bjorn Helgaas) - Embed ATS info directly into struct pci_dev (Bjorn Helgaas) - Reduce size of ATS structure elements (Bjorn Helgaas) - Stop caching ATS Invalidate Queue Depth (Bjorn Helgaas) - iommu/vt-d: Cache PCI ATS state and Invalidate Queue Depth (Bjorn Helgaas) - Move MPS configuration check to pci_configure_device() (Bjorn Helgaas) - Set MPS to match upstream bridge (Keith Busch) - ARM/PCI: Set MPS before pci_bus_add_devices() (Murali Karicheri) - Add pci_scan_root_bus_msi() (Lorenzo Pieralisi) - ARM/PCI, designware, xilinx: Use pci_scan_root_bus_msi() (Lorenzo Pieralisi) Resource management: - Call pci_read_bridge_bases() from core instead of arch code (Lorenzo Pieralisi) PCI device hotplug: - pciehp: Remove unused interrupt events (Bjorn Helgaas) - pciehp: Remove ignored MRL sensor interrupt events (Bjorn Helgaas) - pciehp: Handle invalid data when reading from non-existent devices (Jarod Wilson) - pciehp: Simplify pcie_poll_cmd() (Yijing Wang) - Use "slot" and "pci_slot" for struct hotplug_slot and struct pci_slot (Yijing Wang) - Protect pci_bus->slots with pci_slot_mutex, not pci_bus_sem (Yijing Wang) - Hold pci_slot_mutex while searching bus->slots list (Yijing Wang) Power management: - Disable async suspend/resume for JMicron multi-function SATA/AHCI (Zhang Rui) Virtualization: - Add ACS quirks for Intel I219-LM/V (Alex Williamson) - Restore ACS configuration as part of pci_restore_state() (Alexander Duyck) MSI: - Add pcibios_alloc_irq() and pcibios_free_irq() (Jiang Liu) - x86: Implement pcibios_alloc_irq() and pcibios_free_irq() (Jiang Liu) - Add helpers to manage pci_dev->irq and pci_dev->irq_managed (Jiang Liu) - Free legacy IRQ when enabling MSI/MSI-X (Jiang Liu) - ARM/PCI: Remove msi_controller from struct pci_sys_data (Lorenzo Pieralisi) - Remove unused pcibios_msi_controller() hook (Lorenzo Pieralisi) Generic host bridge driver: - Remove dependency on ARM-specific struct hw_pci (Jayachandran C) - Build setup-irq.o for arm64 (Jayachandran C) - Add arm64 support (Jayachandran C) APM X-Gene host bridge driver: - Add APM X-Gene PCIe 64-bit prefetchable window (Duc Dang) - Add support for a 64-bit prefetchable memory window (Duc Dang) - Drop owner assignment from platform_driver (Krzysztof Kozlowski) Broadcom iProc host bridge driver: - Allow BCMA bus driver to be built as module (Hauke Mehrtens) - Delete unnecessary checks before phy calls (Markus Elfring) - Add arm64 support (Ray Jui) Synopsys DesignWare host bridge driver: - Don't complain missing *config* reg space if va_cfg0 is set (Murali Karicheri) TI DRA7xx host bridge driver: - Disable pm_runtime on get_sync failure (Kishon Vijay Abraham I) - Add PM support (Kishon Vijay Abraham I) - Clear MSE bit during suspend so clocks will idle (Kishon Vijay Abraham I) - Add support to make GPIO drive PERST# line (Kishon Vijay Abraham I) Xilinx AXI host bridge driver: - Check for MSI interrupt flag before handling as INTx (Russell Joyce) Miscellaneous: - Fix Intersil/Techwell TW686[4589] AV capture class code (Krzysztof Hałasa) - Use PCI_CLASS_SERIAL_USB instead of bare number (Bjorn Helgaas) - Fix generic NCR 53c810 class code quirk (Bjorn Helgaas) - Fix TI816X class code quirk (Bjorn Helgaas) - Remove unused "pci_probe" flags (Bjorn Helgaas) - Host bridge driver code simplifications (Fabio Estevam) - Add dev_flags bit to access VPD through function 0 (Mark Rustad) - Add VPD function 0 quirk for Intel Ethernet devices (Mark Rustad) - Kill off set_irq_flags() usage (Rob Herring) - Remove Intel Cherrytrail D3 delays (Srinidhi Kasagar) - Clean up pci_find_capability() (Wei Yang)" * tag 'pci-v4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (72 commits) PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI PCI: Set MPS to match upstream bridge PCI: Move MPS configuration check to pci_configure_device() PCI: Drop references acquired by of_parse_phandle() PCI/MSI: Remove unused pcibios_msi_controller() hook ARM/PCI: Remove msi_controller from struct pci_sys_data ARM/PCI, designware, xilinx: Use pci_scan_root_bus_msi() PCI: Add pci_scan_root_bus_msi() ARM/PCI: Replace panic with WARN messages on failures PCI: generic: Add arm64 support PCI: Build setup-irq.o for arm64 PCI: generic: Remove dependency on ARM-specific struct hw_pci PCI: imx6: Simplify a trivial if-return sequence PCI: spear: Use BUG_ON() instead of condition followed by BUG() PCI: dra7xx: Remove unneeded use of IS_ERR_VALUE() PCI: Remove pci_ats_enabled() PCI: Stop caching ATS Invalidate Queue Depth PCI: Move ATS declarations to linux/pci.h so they're all together PCI: Clean up ATS error handling PCI: Use pci_physfn() rather than looking up physfn by hand ...
2015-08-25Merge branches 'arm/omap', 'arm/msm', 'arm/smmu', 'arm/tegra', 'x86/vt-d', ↵Joerg Roedel22-902/+925
'x86/amd', 'ppc/pamu' and 'core' into next
2015-08-25iommu/vt-d: Really use upper context table when necessaryJoerg Roedel1-1/+1
There is a bug in iommu_context_addr() which will always use the lower context table, even when the upper context table needs to be used. Fix this issue. Fixes: 03ecc32c5274 ("iommu/vt-d: support extended root and context entries") Reported-by: Xiao, Nan <nan.xiao@hp.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-18iommu/fsl: Really fix init section(s) contentEmil Medve1-13/+13
'0f1fb99 iommu/fsl: Fix section mismatch' was intended to address the modpost warning and the potential crash. Crash which is actually easy to trigger with a 'unbind' followed by a 'bind' sequence. The fix is wrong as fsl_of_pamu_driver.driver gets added by bus_add_driver() to a couple of klist(s) which become invalid/corrupted as soon as the init sections are freed. Depending on when/how the init sections storage is reused various/random errors and crashes will happen 'cd70d46 iommu/fsl: Various cleanups' contains annotations that go further down the wrong path laid by '0f1fb99 iommu/fsl: Fix section mismatch' Now remove all the incorrect annotations from the above mentioned patches (not exactly a revert) and those previously existing in the code, This fixes the modpost warning(s), the unbind/bind sequence crashes and the random errors/crashes Fixes: 0f1fb99b62ce ("iommu/fsl: Fix section mismatch") Fixes: cd70d4659ff3 ("iommu/fsl: Various cleanups") Signed-off-by: Emil Medve <Emilian.Medve@Freescale.com> Acked-by: Varun Sethi <Varun.Sethi@freescale.com> Cc: stable@vger.kernel.org Tested-by: Madalin Bucur <Madalin.Bucur@freescale.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-18iommu/io-pgtable-arm: Unmap and free table when overwriting with blockWill Deacon1-1/+16
When installing a block mapping, we unconditionally overwrite a non-leaf PTE if we find one. However, this can cause a problem if the following sequence of events occur: (1) iommu_map called for a 4k (i.e. PAGE_SIZE) mapping at some address - We initialise the page table all the way down to a leaf entry - No TLB maintenance is required, because we're going from invalid to valid. (2) iommu_unmap is called on the mapping installed in (1) - We walk the page table to the final (leaf) entry and zero it - We only changed a valid leaf entry, so we invalidate leaf-only (3) iommu_map is called on the same address as (1), but this time for a 2MB (i.e. BLOCK_SIZE) mapping) - We walk the page table down to the penultimate level, where we find a table entry - We overwrite the table entry with a block mapping and return without any TLB maintenance and without freeing the memory used by the now-orphaned table. This last step can lead to a walk-cache caching the overwritten table entry, causing unexpected faults when the new mapping is accessed by a device. One way to fix this would be to collapse the page table when freeing the last page at a given level, but this would require expensive iteration on every map call. Instead, this patch detects the case when we are overwriting a table entry and explicitly unmaps the table first, which takes care of both freeing and TLB invalidation. Cc: <stable@vger.kernel.org> Reported-by: Brian Starkey <brian.starkey@arm.com> Tested-by: Brian Starkey <brian.starkey@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-17scatterlist: use sg_phys()Dan Williams2-3/+3
Coccinelle cleanup to replace open coded sg to physical address translations. This is in preparation for introducing scatterlists that reference __pfn_t. // sg_phys.cocci: convert usage page_to_phys(sg_page(sg)) to sg_phys(sg) // usage: make coccicheck COCCI=sg_phys.cocci MODE=patch virtual patch @@ struct scatterlist *sg; @@ - page_to_phys(sg_page(sg)) + sg->offset + sg_phys(sg) @@ struct scatterlist *sg; @@ - page_to_phys(sg_page(sg)) + sg_phys(sg) & PAGE_MASK Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Jens Axboe <axboe@fb.com>
2015-08-17Merge tag 'tegra-for-4.3-iommu' of ↵Joerg Roedel1-108/+198
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/tegra iommu/tegra-smmu: Changes for v4.3-rc1 A bunch of improvements by Russell King, along with a fix to restore display support when using the SMMU. This was due to the SMMU driver writing the wrong value of active TLB lines, effectively disabling the TLB and causing massive underflows on the display controller because of the latency introduced by the SMMU.
2015-08-13iommu/io-pgtable-arm: Move init-fn declarations to io-pgtable.hJoerg Roedel2-5/+5
Avoid extern declarations in c files. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/msm: Use BUG_ON instead of if () BUG()Joerg Roedel1-2/+2
Found by a coccicheck script. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/vt-d: Access iomem correctlyJoerg Roedel2-8/+11
This fixes wrong accesses to iomem introduced by the kdump fixing code. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/vt-d: Make two functions staticJoerg Roedel1-4/+4
These functions are only used in that file and can be static. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/vt-d: Use BUG_ON instead of if () BUG()Joerg Roedel1-2/+1
Found by a coccicheck script. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/vt-d: Return false instead of 0 in irq_remapping_cap()Joerg Roedel1-1/+1
The function return type is bool, so return false instead of 0. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/amd: Use BUG_ON instead of if () BUG()Joerg Roedel2-4/+4
Found by a coccicheck script. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/amd: Make a symbol staticJoerg Roedel1-1/+1
Symbol is only used in that file and can be static. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/amd: Simplify allocation in irq_remapping_alloc()Joerg Roedel1-11/+6
Allocate the irq data only in the loop. Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-08-13iommu/tegra-smmu: Parameterize number of TLB linesThierry Reding1-2/+7
The number of TLB lines was increased from 16 on Tegra30 to 32 on Tegra114 and later. Parameterize the value so that the initial default can be set accordingly. On Tegra30, initializing the value to 32 would effectively disable the TLB and hence cause massive latencies for memory accesses translated through the SMMU. This is especially noticeable for isochronuous clients such as display, whose FIFOs would continuously underrun. Fixes: 891846516317 ("memory: Add NVIDIA Tegra memory controller support") Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13memory: tegra: Add Tegra210 supportThierry Reding1-1/+1
Add the table of memory clients and SWGROUPs for Tegra210 to enable SMMU support for this new SoC. Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Factor out tegra_smmu_set_pde()Russell King1-21/+28
This code is used both when creating a new page directory entry and when tearing it down, with only the PDE value changing between both cases. Factor the code out so that it can be reused. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> [treding@nvidia.com: make commit message more accurate] Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Extract tegra_smmu_pte_get_use()Russell King1-6/+11
Extract the use count reference accounting into a separate function and separate it from allocating the PTE. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> [treding@nvidia.com: extract and write commit message] Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Use __GFP_ZERO to allocate zeroed pagesRussell King1-16/+2
Rather than explicitly zeroing pages allocated via alloc_page(), add __GFP_ZERO to the gfp mask to ask the allocator for zeroed pages. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Remove PageReserved manipulationRussell King1-5/+0
Remove the unnecessary manipulation of the PageReserved flags in the Tegra SMMU driver. None of this is required as the page(s) remain private to the SMMU driver. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Convert to use DMA APIRussell King1-54/+85
Use the DMA API instead of calling architecture internal functions in the Tegra SMMU driver. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: smmu_flush_ptc() wants device addressesRussell King1-6/+5
Pass smmu_flush_ptc() the device address rather than struct page pointer. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Split smmu_flush_ptc()Russell King1-13/+13
smmu_flush_ptc() is used in two modes: one is to flush an individual entry, the other is to flush all entries. We know at the call site which we require. Split the function into smmu_flush_ptc_all() and smmu_flush_ptc(). Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Move flush_dcache to tegra-smmu.cRussell King1-5/+25
Drivers should not be using __cpuc_* functions nor outer_cache_flush() directly. This change partly cleans up tegra-smmu.c. The only difference between cache handling of the tegra variants is Denver, which omits the call to outer_cache_flush(). This is due to Denver being an ARM64 CPU, and the ARM64 architecture does not provide this function. (This, in itself, is a good reason why these should not be used.) Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> [treding@nvidia.com: fix build failure on 64-bit ARM] Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Use kcalloc() to allocate counter arrayRussell King1-15/+6
Use kcalloc() to allocate the use-counter array for the page directory entries/page tables. Using kcalloc() allows us to be provided with zero-initialised memory from the allocators, rather than initialising it ourselves. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Store struct page pointer for page tablesRussell King1-10/+17
Store the struct page pointer for the second level page tables, rather than working back from the page directory entry. This is necessary as we want to eliminate the use of physical addresses used with arch-private functions, switching instead to use the streaming DMA API. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Fix page table lookup in unmap/iova_to_phys methodsRussell King1-9/+34
Fix the page table lookup in the unmap and iova_to_phys methods. Neither of these methods should allocate a page table; a missing page table should be treated the same as no mapping present. More importantly, using as_get_pte() for an IOVA corresponding with a non-present page table entry increments the use-count for the page table, on the assumption that the caller of as_get_pte() is going to setup a mapping. This is an incorrect assumption. Fix both of these bugs by providing a separate helper which only looks up the page table, but never allocates it. This is akin to pte_offset() for CPU page tables. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Add iova_pd_index() and iova_pt_index() helpersRussell King1-3/+13
Add a pair of helpers to get the page directory and page table indexes. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Factor out common PTE settingRussell King1-20/+17
Factor out the common PTE setting code into a separate function. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>
2015-08-13iommu/tegra-smmu: Fix unmap() methodRussell King1-14/+23
The Tegra SMMU unmap path has several problems: 1. as_pte_put() can perform a write-after-free 2. tegra_smmu_unmap() can perform cache maintanence on a page we have just freed. 3. when a page table is unmapped, there is no CPU cache maintanence of the write clearing the page directory entry, nor is there any maintanence of the IOMMU to ensure that it sees the page table has gone. Fix this by getting rid of as_pte_put(), and instead coding the PTE unmap separately from the PDE unmap, placing the PDE unmap after the PTE unmap has been completed. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Thierry Reding <treding@nvidia.com>