--- /dev/null
+From 8208d1708b88b412ca97f50a6d951242c88cbbac Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 18 Jan 2019 14:08:59 +0000
+Subject: irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 8208d1708b88b412ca97f50a6d951242c88cbbac upstream.
+
+The way we allocate events works fine in most cases, except
+when multiple PCI devices share an ITS-visible DevID, and that
+one of them is trying to use MultiMSI allocation.
+
+In that case, our allocation is not guaranteed to be zero-based
+anymore, and we have to make sure we allocate it on a boundary
+that is compatible with the PCI Multi-MSI constraints.
+
+Fix this by allocating the full region upfront instead of iterating
+over the number of MSIs. MSI-X are always allocated one by one,
+so this shouldn't change anything on that front.
+
+Fixes: b48ac83d6bbc2 ("irqchip: GICv3: ITS: MSI support")
+Cc: stable@vger.kernel.org
+Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+[ardb: rebased onto v4.9.153, should apply cleanly onto v4.4.y as well]
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1372,13 +1372,14 @@ static void its_free_device(struct its_d
+ kfree(its_dev);
+ }
+
+-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
+ {
+ int idx;
+
+- idx = find_first_zero_bit(dev->event_map.lpi_map,
+- dev->event_map.nr_lpis);
+- if (idx == dev->event_map.nr_lpis)
++ idx = bitmap_find_free_region(dev->event_map.lpi_map,
++ dev->event_map.nr_lpis,
++ get_count_order(nvecs));
++ if (idx < 0)
+ return -ENOSPC;
+
+ *hwirq = dev->event_map.lpi_base + idx;
+@@ -1464,20 +1465,20 @@ static int its_irq_domain_alloc(struct i
+ int err;
+ int i;
+
+- for (i = 0; i < nr_irqs; i++) {
+- err = its_alloc_device_irq(its_dev, &hwirq);
+- if (err)
+- return err;
++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
++ if (err)
++ return err;
+
+- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
++ for (i = 0; i < nr_irqs; i++) {
++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+ if (err)
+ return err;
+
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+- hwirq, &its_irq_chip, its_dev);
++ hwirq + i, &its_irq_chip, its_dev);
+ pr_debug("ID:%d pID:%d vID:%d\n",
+- (int)(hwirq - its_dev->event_map.lpi_base),
+- (int) hwirq, virq + i);
++ (int)(hwirq + i - its_dev->event_map.lpi_base),
++ (int)(hwirq + i), virq + i);
+ }
+
+ return 0;
--- /dev/null
+From ad1f824948e4ed886529219cf7cd717d078c630d Mon Sep 17 00:00:00 2001
+From: Israel Rukshin <israelr@mellanox.com>
+Date: Mon, 19 Nov 2018 10:58:51 +0000
+Subject: nvmet-rdma: Add unlikely for response allocated check
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+commit ad1f824948e4ed886529219cf7cd717d078c630d upstream.
+
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Raju Rangoju <rajur@chelsio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/target/rdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -189,7 +189,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp
+ {
+ unsigned long flags;
+
+- if (rsp->allocated) {
++ if (unlikely(rsp->allocated)) {
+ kfree(rsp);
+ return;
+ }
--- /dev/null
+From 5cbab6303b4791a3e6713dfe2c5fda6a867f9adc Mon Sep 17 00:00:00 2001
+From: Raju Rangoju <rajur@chelsio.com>
+Date: Thu, 3 Jan 2019 23:05:31 +0530
+Subject: nvmet-rdma: fix null dereference under heavy load
+
+From: Raju Rangoju <rajur@chelsio.com>
+
+commit 5cbab6303b4791a3e6713dfe2c5fda6a867f9adc upstream.
+
+Under heavy load if we don't have any pre-allocated rsps left, we
+dynamically allocate a rsp, but we are not actually allocating memory
+for nvme_completion (rsp->req.rsp). In such a case, accessing pointer
+fields (req->rsp->status) in nvmet_req_init() will result in crash.
+
+To fix this, allocate the memory for nvme_completion by calling
+nvmet_rdma_alloc_rsp()
+
+Fixes: 8407879c("nvmet-rdma:fix possible bogus dereference under heavy load")
+
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Raju Rangoju <rajur@chelsio.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/target/rdma.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -137,6 +137,10 @@ static void nvmet_rdma_recv_done(struct
+ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
+ static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
+ static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
++static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
++ struct nvmet_rdma_rsp *r);
++static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
++ struct nvmet_rdma_rsp *r);
+
+ static struct nvmet_fabrics_ops nvmet_rdma_ops;
+
+@@ -175,9 +179,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_que
+ spin_unlock_irqrestore(&queue->rsps_lock, flags);
+
+ if (unlikely(!rsp)) {
+- rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
++ int ret;
++
++ rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
+ if (unlikely(!rsp))
+ return NULL;
++ ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
++ if (unlikely(ret)) {
++ kfree(rsp);
++ return NULL;
++ }
++
+ rsp->allocated = true;
+ }
+
+@@ -190,6 +202,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp
+ unsigned long flags;
+
+ if (unlikely(rsp->allocated)) {
++ nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
+ kfree(rsp);
+ return;
+ }
--- /dev/null
+From 60f1bf29c0b2519989927cae640cd1f50f59dc7f Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Fri, 11 Jan 2019 15:18:22 +0100
+Subject: s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 60f1bf29c0b2519989927cae640cd1f50f59dc7f upstream.
+
+When calling smp_call_ipl_cpu() from the IPL CPU, we will try to read
+from pcpu_devices->lowcore. However, due to prefixing, that will result
+in reading from absolute address 0 on that CPU. We have to go via the
+actual lowcore instead.
+
+This means that right now, we will read lc->nodat_stack == 0 and
+therfore work on a very wrong stack.
+
+This BUG essentially broke rebooting under QEMU TCG (which will report
+a low address protection exception). And checking under KVM, it is
+also broken under KVM. With 1 VCPU it can be easily triggered.
+
+:/# echo 1 > /proc/sys/kernel/sysrq
+:/# echo b > /proc/sysrq-trigger
+[ 28.476745] sysrq: SysRq : Resetting
+[ 28.476793] Kernel stack overflow.
+[ 28.476817] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476820] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476826] Krnl PSW : 0400c00180000000 0000000000115c0c (pcpu_delegate+0x12c/0x140)
+[ 28.476861] R:0 T:1 IO:0 EX:0 Key:0 M:0 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
+[ 28.476863] Krnl GPRS: ffffffffffffffff 0000000000000000 000000000010dff8 0000000000000000
+[ 28.476864] 0000000000000000 0000000000000000 0000000000ab7090 000003e0006efbf0
+[ 28.476864] 000000000010dff8 0000000000000000 0000000000000000 0000000000000000
+[ 28.476865] 000000007fffc000 0000000000730408 000003e0006efc58 0000000000000000
+[ 28.476887] Krnl Code: 0000000000115bfe: 4170f000 la %r7,0(%r15)
+[ 28.476887] 0000000000115c02: 41f0a000 la %r15,0(%r10)
+[ 28.476887] #0000000000115c06: e370f0980024 stg %r7,152(%r15)
+[ 28.476887] >0000000000115c0c: c0e5fffff86e brasl %r14,114ce8
+[ 28.476887] 0000000000115c12: 41f07000 la %r15,0(%r7)
+[ 28.476887] 0000000000115c16: a7f4ffa8 brc 15,115b66
+[ 28.476887] 0000000000115c1a: 0707 bcr 0,%r7
+[ 28.476887] 0000000000115c1c: 0707 bcr 0,%r7
+[ 28.476901] Call Trace:
+[ 28.476902] Last Breaking-Event-Address:
+[ 28.476920] [<0000000000a01c4a>] arch_call_rest_init+0x22/0x80
+[ 28.476927] Kernel panic - not syncing: Corrupt kernel stack, can't continue.
+[ 28.476930] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476932] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476932] Call Trace:
+
+Fixes: 2f859d0dad81 ("s390/smp: reduce size of struct pcpu")
+Cc: stable@vger.kernel.org # 4.0+
+Reported-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/s390/kernel/smp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -357,9 +357,13 @@ void smp_call_online_cpu(void (*func)(vo
+ */
+ void smp_call_ipl_cpu(void (*func)(void *), void *data)
+ {
++ struct lowcore *lc = pcpu_devices->lowcore;
++
++ if (pcpu_devices[0].address == stap())
++ lc = &S390_lowcore;
++
+ pcpu_delegate(&pcpu_devices[0], func, data,
+- pcpu_devices->lowcore->panic_stack -
+- PANIC_FRAME_OFFSET + PAGE_SIZE);
++ lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE);
+ }
+
+ int smp_find_processor_id(u16 address)
vt-invoke-notifier-on-screen-size-change.patch
perf-unwind-unwind-with-libdw-doesn-t-take-symfs-int.patch
perf-unwind-take-pgoff-into-account-when-reporting-e.patch
+irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch
+s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu.patch
+nvmet-rdma-add-unlikely-for-response-allocated-check.patch
+nvmet-rdma-fix-null-dereference-under-heavy-load.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
