Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull second set of s390 patches from Martin Schwidefsky:
 "The second part of Heikos uaccess rework, the page table walker for
  uaccess is now a thing of the past (yay!)

  The code change to fix the theoretical TLB flush problem allows us to
  add a TLB flush optimization for zEC12, this machine has new
  instructions that allow to do CPU local TLB flushes for single pages
  and for all pages of a specific address space.

  Plus the usual bug fixing and some more cleanup"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/uaccess: rework uaccess code - fix locking issues
  s390/mm,tlb: optimize TLB flushing for zEC12
  s390/mm,tlb: safeguard against speculative TLB creation
  s390/irq: Use defines for external interruption codes
  s390/irq: Add defines for external interruption codes
  s390/sclp: add timeout for queued requests
  kvm/s390: also set guest pages back to stable on kexec/kdump
  lcs: Add missing destroy_timer_on_stack()
  s390/tape: Add missing destroy_timer_on_stack()
  s390/tape: Use del_timer_sync()
  s390/3270: fix crash with multiple reset device requests
  s390/bitops,atomic: add missing memory barriers
  s390/zcrypt: add length check for aligned data to avoid overflow in msg-type 6

5 files changed, 29 insertions, 50 deletions

diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 88cef505453b..19f623f1f21c 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -106,21 +106,24 @@ void bust_spinlocks(int yes)
  * Returns the address space associated with the fault.
  * Returns 0 for kernel space and 1 for user space.
  */
-static inline int user_space_fault(unsigned long trans_exc_code)
+static inline int user_space_fault(struct pt_regs *regs)
 {
+        unsigned long trans_exc_code;
+
         /*
          * The lowest two bits of the translation exception
          * identification indicate which paging table was used.
          */
-        trans_exc_code &= 3;
-        if (trans_exc_code == 2)
-                /* Access via secondary space, set_fs setting decides */
+        trans_exc_code = regs->int_parm_long & 3;
+        if (trans_exc_code == 3) /* home space -> kernel */
+                return 0;
+        if (user_mode(regs))
+                return 1;
+        if (trans_exc_code == 2) /* secondary space -> set_fs */
                 return current->thread.mm_segment.ar4;
-        /*
-         * Access via primary space or access register is from user space
-         * and access via home space is from the kernel.
-         */
-        return trans_exc_code != 3;
+        if (current->flags & PF_VCPU)
+                return 1;
+        return 0;
 }
 
 static inline void report_user_fault(struct pt_regs *regs, long signr)
@@ -172,7 +175,7 @@ static noinline void do_no_context(struct pt_regs *regs)
          * terminate things with extreme prejudice.
          */
         address = regs->int_parm_long & __FAIL_ADDR_MASK;
-        if (!user_space_fault(regs->int_parm_long))
+        if (!user_space_fault(regs))
                 printk(KERN_ALERT "Unable to handle kernel pointer dereference"
                        " at virtual kernel address %p\n", (void *)address);
         else
@@ -296,7 +299,7 @@ static inline int do_exception(struct pt_regs *regs, int access)
          * user context.
          */
         fault = VM_FAULT_BADCONTEXT;
-        if (unlikely(!user_space_fault(trans_exc_code) || in_atomic() || !mm))
+        if (unlikely(!user_space_fault(regs) || in_atomic() || !mm))
                 goto out;
 
         address = trans_exc_code & __FAIL_ADDR_MASK;
@@ -441,30 +444,6 @@ void __kprobes do_dat_exception(struct pt_regs *regs)
                 do_fault_error(regs, fault);
 }
 
-int __handle_fault(unsigned long uaddr, unsigned long pgm_int_code, int write)
-{
-        struct pt_regs regs;
-        int access, fault;
-
-        /* Emulate a uaccess fault from kernel mode. */
-        regs.psw.mask = PSW_KERNEL_BITS | PSW_MASK_DAT | PSW_MASK_MCHECK;
-        if (!irqs_disabled())
-                regs.psw.mask |= PSW_MASK_IO | PSW_MASK_EXT;
-        regs.psw.addr = (unsigned long) __builtin_return_address(0);
-        regs.psw.addr |= PSW_ADDR_AMODE;
-        regs.int_code = pgm_int_code;
-        regs.int_parm_long = (uaddr & PAGE_MASK) | 2;
-        access = write ? VM_WRITE : VM_READ;
-        fault = do_exception(&regs, access);
-        /*
-         * Since the fault happened in kernel mode while performing a uaccess
-         * all we need to do now is emulating a fixup in case "fault" is not
-         * zero.
-         * For the calling uaccess functions this results always in -EFAULT.
-         */
-        return fault ? -EFAULT : 0;
-}
-
 #ifdef CONFIG_PFAULT 
 /*
  * 'pfault' pseudo page faults routines.
@@ -645,7 +624,7 @@ static int __init pfault_irq_init(void)
 {
         int rc;
 
-        rc = register_external_interrupt(0x2603, pfault_interrupt);
+        rc = register_external_irq(EXT_IRQ_CP_SERVICE, pfault_interrupt);
         if (rc)
                 goto out_extint;
         rc = pfault_init() == 0 ? 0 : -EOPNOTSUPP;
@@ -656,7 +635,7 @@ static int __init pfault_irq_init(void)
         return 0;
 
 out_pfault:
-        unregister_external_interrupt(0x2603, pfault_interrupt);
+        unregister_external_irq(EXT_IRQ_CP_SERVICE, pfault_interrupt);
 out_extint:
         pfault_disable = 1;
         return rc;
diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index d261c62e40a6..0727a55d87d9 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c
@@ -123,10 +123,7 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
         pmd_t *pmdp = (pmd_t *) ptep;
         pte_t pte = huge_ptep_get(ptep);
 
-        if (MACHINE_HAS_IDTE)
-                __pmd_idte(addr, pmdp);
-        else
-                __pmd_csp(pmdp);
+        pmdp_flush_direct(mm, addr, pmdp);
         pmd_val(*pmdp) = _SEGMENT_ENTRY_EMPTY;
         return pte;
 }
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index ad446b0c55b6..0c1073ed1e84 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -124,8 +124,6 @@ void __init paging_init(void)
         __ctl_load(S390_lowcore.kernel_asce, 13, 13);
         arch_local_irq_restore(4UL << (BITS_PER_LONG - 8));
 
-        atomic_set(&init_mm.context.attach_count, 1);
-
         sparse_memory_present_with_active_regions(MAX_NUMNODES);
         sparse_init();
         memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
@@ -136,6 +134,11 @@ void __init paging_init(void)
 
 void __init mem_init(void)
 {
+        if (MACHINE_HAS_TLB_LC)
+                cpumask_set_cpu(0, &init_mm.context.cpu_attach_mask);
+        cpumask_set_cpu(0, mm_cpumask(&init_mm));
+        atomic_set(&init_mm.context.attach_count, 1);
+
         max_mapnr = max_low_pfn;
         high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
 
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 5d8324cd866b..d7cfd57815fb 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -54,7 +54,7 @@ static void __crst_table_upgrade(void *arg)
         struct mm_struct *mm = arg;
 
         if (current->active_mm == mm)
-                update_mm(mm, current);
+                update_user_asce(mm, 1);
         __tlb_flush_local();
 }
 
@@ -107,8 +107,10 @@ void crst_table_downgrade(struct mm_struct *mm, unsigned long limit)
 {
         pgd_t *pgd;
 
-        if (current->active_mm == mm)
+        if (current->active_mm == mm) {
+                clear_user_asce(mm, 1);
                 __tlb_flush_mm(mm);
+        }
         while (mm->context.asce_limit > limit) {
                 pgd = mm->pgd;
                 switch (pgd_val(*pgd) & _REGION_ENTRY_TYPE_MASK) {
@@ -132,7 +134,7 @@ void crst_table_downgrade(struct mm_struct *mm, unsigned long limit)
                 crst_table_free(mm, (unsigned long *) pgd);
         }
         if (current->active_mm == mm)
-                update_mm(mm, current);
+                update_user_asce(mm, 1);
 }
 #endif
 
@@ -198,7 +200,7 @@ static int gmap_unlink_segment(struct gmap *gmap, unsigned long *table)
 static void gmap_flush_tlb(struct gmap *gmap)
 {
         if (MACHINE_HAS_IDTE)
-                __tlb_flush_idte((unsigned long) gmap->table |
+                __tlb_flush_asce(gmap->mm, (unsigned long) gmap->table |
                                  _ASCE_TYPE_REGION1);
         else
                 __tlb_flush_global();
@@ -217,7 +219,7 @@ void gmap_free(struct gmap *gmap)
 
         /* Flush tlb. */
         if (MACHINE_HAS_IDTE)
-                __tlb_flush_idte((unsigned long) gmap->table |
+                __tlb_flush_asce(gmap->mm, (unsigned long) gmap->table |
                                  _ASCE_TYPE_REGION1);
         else
                 __tlb_flush_global();
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index bcfb70b60be6..72b04de18283 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -138,7 +138,6 @@ static int vmem_add_mem(unsigned long start, unsigned long size, int ro)
         }
         ret = 0;
 out:
-        flush_tlb_kernel_range(start, end);
         return ret;
 }
 
@@ -265,7 +264,6 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
         memset((void *)start, 0, end - start);
         ret = 0;
 out:
-        flush_tlb_kernel_range(start, end);
         return ret;
 }