Calls to dlpar_detach_node do not iterate over child nodes detaching them as
well. By iterating and detaching the child nodes we ensure that they have the
OF_DETACHED flag set and that their reference counts are decremented such that
the node will be freed from memory by of_node_release.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The node to be detached is retrieved via its phandle by a call to
of_find_node_by_phandle which increments the ref count. We need a matching
call to of_node_put to decrement the ref count and ensure the node is
actually freed.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Currently the device nodes created in the device subtree returned by a call to
dlpar_configure_connector are all named in the root node. This is because the
the node name in the work area returned by ibm,configure-connector rtas call
only contains the node name and not the entire node path. Passing the parent
node where the new subtree will be created to dlpar_configure_connector allows
the correct node path to be prefixed in the full_name field.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Currently the OF_DYNAMIC and kref initialization for a node happens in
dlpar_attach_node. However, a node passed to dlpar_attach_node may be a tree
containing child nodes, and no initialization traversal is done on the
tree. Since the children never get their kref initialized or the OF_DYNAMIC
flag set these nodes are prevented from ever being released from memory
should they become detached. This initialization step is better done at the
time each node is allocated in dlpar_parse_cc_node.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

On the first call to ibm,update-properties for a node the first property
returned is the full node path. Currently this is not parsed correctly by the
update_dt_node function. Commit 2e9b7b02 attempted to fix this, but was
incorrect as it made a wrong assumption about the layout of the first
property in the work area. Further, if ibm,update-properties must be called
multiple times for the same node this special property should only be skipped
after the initial call. The first property descriptor returned consists of
the property name, property value length, and property value. The property
name is an empty string, property length is encoded in 4 byte integer, and
the property value is the node path.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The work area buffer returned by the ibm,update-properties rtas call contains
20 bytes of header information prior to the property value descriptor data.
Currently update_dt_node tries to advance over this header using sizeof(upwa).
The update_props_workarea struct contains 20 bytes worth of fields, that map
to the relevant header data, but the sizeof the structure is 24 bytes due to
4 bytes of padding at the end of the structure. Packing the structure ensures
that we don't advance too far over the rtas buffer.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The rc variable is initially used to store the return code from the
ibm,update-properties rtas call which returns 0 or 1 on success. A return
code of 1 indicates that ibm,update-properties must be called again for the
node. However, the rc variable is overwritten by a call to update_dt_prop
which returns 0 on success. This results in ibm,update-properties not being
called again for the given node when the rtas call rc was previously 1.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The update_dt_prop helper function fails to set the IN/OUT parameter prop to
NULL after a complete property has been parsed from the work area returned by
the ibm,update-properties rtas function. This results in the property list of
the device node being updated is corrupted and becomes a loop since the same
property structure is used repeatedly.
Signed-off-by: NTyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

In the program check handler we handle some causes with interrupts off
and others with interrupts on.

We need to enable interrupts to handle the emulation cases, because they
access userspace memory and might sleep.

For faults in the kernel we don't want to do any emulation, and
emulate_instruction() enforces that. do_mathemu() doesn't but probably
should.

The other disadvantage of enabling interrupts for kernel faults is that
we may take another interrupt, and recurse. As seen below:

  --- Exception: e40 at c000000000004ee0 performance_monitor_relon_pSeries_1
  [link register   ] c00000000000f858 .arch_local_irq_restore+0x38/0x90
  [c000000fb185dc10] 0000000000000000 (unreliable)
  [c000000fb185dc80] c0000000007d8558 .program_check_exception+0x298/0x2d0
  [c000000fb185dd00] c000000000002f40 emulation_assist_common+0x140/0x180
  --- Exception: e40 at c000000000004ee0 performance_monitor_relon_pSeries_1
  [link register   ] c00000000000f858 .arch_local_irq_restore+0x38/0x90
  [c000000fb185dff0] 00000000008b9190 (unreliable)
  [c000000fb185e060] c0000000007d8558 .program_check_exception+0x298/0x2d0

So avoid both problems by checking if the fault was in the kernel and
skipping the enable of interrupts and the emulation. Go straight to
delivering the SIGILL, which for kernel faults calls die() and so on,
dropping us in the debugger etc.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

This makes back traces and profiles easier to read.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The symbols that name some of our exception trampolines are ahead of the
location they name. In most cases this is OK because the code is tightly
packed, but in some cases it means the symbol floats ahead of the
correct location, eg:

  c000000000000ea0 <performance_monitor_pSeries_1>:
          ...
  c000000000000f00:       7d b2 43 a6     mtsprg  2,r13

Fix them all by moving the symbol after the set of the location.

While we're moving them anyway, rename them to loose the camelcase and
to make it clear that they are trampolines.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

We haven't updated these for a while it seems, it's nice to have in the
oops output.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The spec says it "may be problematic" if CPU x registers the VPA of
CPU y. Add a warning in case we ever do that.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

People have been dropping things in here without updating the index, do
it for them.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The VSX alignment handler needs to write out the existing VSX
state to memory before operating on it (flush_vsx_to_thread()).
If we take a VSX alignment exception in the kernel bad things
will happen. It looks like we could write the kernel state out
to the user process, or we could handle the kernel exception
using data from the user process (depending if MSR_VSX is set
or not).

Worse still, if the code to read or write the VSX state causes an
alignment exception, we will recurse forever. I ended up with
hundreds of megabytes of kernel stack to look through as a result.

Floating point and SPE code have similar issues but already include
a user check. Add the same check to emulate_vsx().

With this patch any unaligned VSX loads and stores in the kernel
will show up as a clear oops rather than silent corruption of
kernel or userspace VSX state, or worse, corruption of a potentially
unlimited amount of kernel memory.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

As a part of pseries_idle backend driver cleanup to make
the code common to both pseries and powernv platforms, it
is necessary to move the backend-driver code to drivers/cpuidle.

As a pre-requisite for that, it is essential to move plpar_wrapper.h
to include/asm.
Signed-off-by: NDeepthi Dharwar <deepthi@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

As a part of pseries_idle cleanup to make the backend driver
code common to both pseries and powernv.
Remove non-essential smt_snooze_delay declaration in pseries.h
header file and pseries.h file inclusion in
pseries/processor_idle.c
Signed-off-by: NDeepthi Dharwar <deepthi@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The stmw instruction was incorrectly decoded as an update form instruction
and thus the RA register was being clobbered.

Also, the utility routine to write memory to unaligned addresses breaks the
operation into smaller aligned accesses but was incorrectly incrementing
the address by only one; it needs to increment the address by the size of
the smaller aligned chunk.
Signed-off-by: NTom Musta <tmusta@us.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Memory I/O resources need to be marked as busy or else we cannot remove
them when doing memory hot remove.
Signed-off-by: NNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Latest FSL updates from Scott:

<<
Highlights include changes in compiler flag settings
on e500 family cores, booke64 hibernation support, support for two new
boards, and an erratum workaround.
>>

C293PCIE board is a series of Freescale PCIe add-in cards to perform
as public key crypto accelerator or secure key management module.

 - 512KB platform SRAM in addition to 512K L2 Cache/SRAM
 - 512MB soldered DDR3 32bit memory
 - CPLD System Logic
 - 64MB x16 NOR flash and 4GB x8 NAND flash
 - 16MB SPI flash
Signed-off-by: NMingkai Hu <Mingkai.Hu@freescale.com>
Signed-off-by: NPo Liu <Po.Liu@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

Signed-off-by: NMingkai Hu <Mingkai.Hu@freescale.com>
Signed-off-by: NPo Liu <Po.Liu@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

Add device tree for SEC 6.0 used on C29x silicon.
Signed-off-by: NMingkai Hu <Mingkai.Hu@freescale.com>
Signed-off-by: NPo Liu <Po.Liu@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

Update the 64-bit hibernation code to support Book E CPUs.
Some registers and instructions are not defined for Book3e
(SDR reg, tlbia instruction).

SDR: Storage Description Register. Book3S and Book3E have different
address translation mode, we do not need HTABORG & HTABSIZE to
translate virtual address to real address.

More registers are saved in BookE-64bit.(TCR, SPRG1)
Signed-off-by: NWang Dongsheng <dongsheng.wang@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

P1023RDB Specification:
-----------------------
Memory subsystem:
   512MB DDR3 (Fixed DDR on board)
   64MB NOR flash
   128MB NAND flash

Ethernet:
   eTSEC1: Connected to Atheros AR8035 GETH PHY
   eTSEC2: Connected to Atheros AR8035 GETH PHY

PCIe:
   Three mini-PCIe slots

USB:
   Two USB2.0 Type A ports

I2C:
   AT24C08 8K Board EEPROM (8 bit address)
Signed-off-by: NChunhe Lan <Chunhe.Lan@freescale.com>
Cc: Scott Wood <scottwood@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

Add this file to help detect cpu type in runtime.
These macros will be more favorable for driver
to apply errata and workaround to specified cpu type.
Signed-off-by: NHaijun Zhang <Haijun.Zhang@freescale.com>
Signed-off-by: NZhao Chenhui <chenhui.zhao@freescale.com>
Signed-off-by: NScott Wood <scottwood@freescale.com>

Unlike 64-bit, we don't currently support multiplatform between e500
and non-e500, so the -mcpu is not configurable at this time.

-msoft-float is specified when testing for -mcpu=8540 because otherwise
some older toolchains will fail with "error: E500 and FPRs not
supported".
Signed-off-by: NScott Wood <scottwood@freescale.com>

By default use -mcpu=powerpc64 rather than -mtune=power7

Add options for e5500/e6500, with fallbacks for older compilers.

Hide the POWER cpu options in booke configs.
Signed-off-by: NScott Wood <scottwood@freescale.com>

This caused lwsync to be converted to sync on 64-bit (on 32-bit lwsync
is generated at runtime, and so wasn't affected).  Not using lwsync
caused a significant slowdown on certain workloads.

Setting this flag for any e500-enabled build is also not friendly to
multiplatform kernels.
Signed-off-by: NScott Wood <scottwood@freescale.com>

Some CPUs (such as e500v1/v2) don't implement mftb and will take a
trap.  mfspr should work on everything that has a timebase, and is the
preferred instruction according to ISA v2.06.

Currently we get away with mftb on 85xx because the assembler converts
it to mfspr due to -Wa,-me500.  However, that flag has other effects
that are undesireable for certain targets (e.g.  lwsync is converted to
sync), and is hostile to multiplatform kernels.  Thus we would like to
stop setting it for all e500-family builds.

mftb/mftbu instances which are in 85xx code or common code are
converted.  Instances which will never run on 85xx are left alone.
Signed-off-by: NScott Wood <scottwood@freescale.com>

Erratum A-006598 says that 64-bit mftb is not atomic -- it's subject
to a similar race condition as doing mftbu/mftbl on 32-bit.  The lower
half of timebase is updated before the upper half; thus, we can share
the workaround for a similar bug on Cell.  This workaround involves
looping if the lower half of timebase is zero, thus avoiding the need
for a scratch register (other than CR0).  This workaround must be
avoided when the timebase is frozen, such as during the timebase sync
code.

This deals with kernel and vdso accesses, but other userspace accesses
will of course need to be fixed elsewhere.
Signed-off-by: NScott Wood <scottwood@freescale.com>

When reworking udbg_16550.c I forgot to remove the old and now useless
code for the CONFIG_PPC_EARLY_DEBUG_WSP case, which doesn't build as
a result. I also missed a cast.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Our ppc64 spinlocks and rwlocks use a trick where a lock token and
the paca index are placed in the lock with a single store. Since we
are using two u16s they need adjusting for little endian.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

We need to set ELF_DATA correctly on LE coredumps.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Add little endian support for demuxing SMP IPIs
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Alistair noticed we got a SIGILL on userspace mfpvr instructions.

Remove the little endian check in the emulation code, it is
probably there to protect against the old pseudo little endian
implementations but doesn't make sense for real little endian.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The lppaca, slb_shadow and dtl_entry hypervisor structures are
big endian, so we have to byte swap them in little endian builds.

LE KVM hosts will also need to be fixed but for now add an #error
to remind us.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Add endian annotation to various hypervisor structures which
are defined as big endian.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The device tree is big endian so make sure we byteswap on little
endian. We assume any pHyp calls also return big endian results in
memory.
Signed-off-by: NAlistair Popple <alistair@popple.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>