From: Greg Kroah-Hartman Date: Mon, 19 Mar 2018 14:11:45 +0000 (+0100) Subject: 4.15-stable patches X-Git-Tag: v4.15.12~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c624aba8df00ef076967fc14a3f281356252faec;p=thirdparty%2Fkernel%2Fstable-queue.git 4.15-stable patches added patches: irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch nvme-fix-subsystem-multiple-controllers-support-check.patch --- diff --git a/queue-4.15/irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch b/queue-4.15/irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch new file mode 100644 index 00000000000..66ed5159e76 --- /dev/null +++ b/queue-4.15/irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch @@ -0,0 +1,66 @@ +From 4f2c7583e33eb08dc09dd2e25574b80175ba7d93 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 6 Mar 2018 15:51:32 +0000 +Subject: irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis + +From: Ard Biesheuvel + +commit 4f2c7583e33eb08dc09dd2e25574b80175ba7d93 upstream. + +When struct its_device instances are created, the nr_ites member +will be set to a power of 2 that equals or exceeds the requested +number of MSIs passed to the msi_prepare() callback. At the same +time, the LPI map is allocated to be some multiple of 32 in size, +where the allocated size may be less than the requested size +depending on whether a contiguous range of sufficient size is +available in the global LPI bitmap. + +This may result in the situation where the nr_ites < nr_lpis, and +since nr_ites is what we program into the hardware when we map the +device, the additional LPIs will be non-functional. + +For bog standard hardware, this does not really matter. However, +in cases where ITS device IDs are shared between different PCIe +devices, we may end up allocating these additional LPIs without +taking into account that they don't actually work. + +So let's make nr_ites at least 32. This ensures that all allocated +LPIs are 'live', and that its_alloc_device_irq() will fail when +attempts are made to allocate MSIs beyond what was allocated in +the first place. + +Signed-off-by: Ard Biesheuvel +[maz: updated comment] +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-gic-v3-its.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1412,7 +1412,7 @@ static struct irq_chip its_irq_chip = { + * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations. + */ + #define IRQS_PER_CHUNK_SHIFT 5 +-#define IRQS_PER_CHUNK (1 << IRQS_PER_CHUNK_SHIFT) ++#define IRQS_PER_CHUNK (1UL << IRQS_PER_CHUNK_SHIFT) + #define ITS_MAX_LPI_NRBITS 16 /* 64K LPIs */ + + static unsigned long *lpi_bitmap; +@@ -2119,11 +2119,10 @@ static struct its_device *its_create_dev + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + /* +- * At least one bit of EventID is being used, hence a minimum +- * of two entries. No, the architecture doesn't let you +- * express an ITT with a single entry. ++ * We allocate at least one chunk worth of LPIs bet device, ++ * and thus that many ITEs. The device may require less though. + */ +- nr_ites = max(2UL, roundup_pow_of_two(nvecs)); ++ nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs)); + sz = nr_ites * its->ite_size; + sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1; + itt = kzalloc(sz, GFP_KERNEL); diff --git a/queue-4.15/nvme-fix-subsystem-multiple-controllers-support-check.patch b/queue-4.15/nvme-fix-subsystem-multiple-controllers-support-check.patch new file mode 100644 index 00000000000..1aa5dd36afd --- /dev/null +++ b/queue-4.15/nvme-fix-subsystem-multiple-controllers-support-check.patch @@ -0,0 +1,66 @@ +From b837b28394fb76993c28bb242db7061ee0417da6 Mon Sep 17 00:00:00 2001 +From: Israel Rukshin +Date: Thu, 4 Jan 2018 17:56:14 +0200 +Subject: nvme: fix subsystem multiple controllers support check + +From: Israel Rukshin + +commit b837b28394fb76993c28bb242db7061ee0417da6 upstream. + +There is a problem when another module (e.g. nvmet) takes a reference on +the nvme block device and the physical nvme drive is removed. In that +case nvme_free_ctrl() will not be called and the controller state will be +"deleting" or "dead" unless nvmet module releases the block device. +Later on, the same nvme drive probes back and nvme_init_subsystem() will +be called and fail due to duplicate subnqn (if the nvme device doesn't +support subsystem with multiple controllers). This will cause a probe +failure. This commit changes the check of multiple controllers support +at nvme_init_subsystem() by not counting all the controllers at "dead" or +"deleting" state (this is safe because controllers at this state will +never be active again). + +Fixes: ab9e00cc72fa ("nvme: track subsystems") +Reviewed-by: Max Gurtovoy +Signed-off-by: Israel Rukshin +Signed-off-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/core.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2052,6 +2052,22 @@ static const struct attribute_group *nvm + NULL, + }; + ++static int nvme_active_ctrls(struct nvme_subsystem *subsys) ++{ ++ int count = 0; ++ struct nvme_ctrl *ctrl; ++ ++ mutex_lock(&subsys->lock); ++ list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry) { ++ if (ctrl->state != NVME_CTRL_DELETING && ++ ctrl->state != NVME_CTRL_DEAD) ++ count++; ++ } ++ mutex_unlock(&subsys->lock); ++ ++ return count; ++} ++ + static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + { + struct nvme_subsystem *subsys, *found; +@@ -2090,7 +2106,7 @@ static int nvme_init_subsystem(struct nv + * Verify that the subsystem actually supports multiple + * controllers, else bail out. + */ +- if (!(id->cmic & (1 << 1))) { ++ if (nvme_active_ctrls(found) && !(id->cmic & (1 << 1))) { + dev_err(ctrl->device, + "ignoring ctrl due to duplicate subnqn (%s).\n", + found->subnqn); diff --git a/queue-4.15/series b/queue-4.15/series index 7a3f8ae3b26..bcf459995de 100644 --- a/queue-4.15/series +++ b/queue-4.15/series @@ -26,3 +26,5 @@ lock_parent-needs-to-recheck-if-dentry-got-__dentry_kill-ed-under-it.patch fs-aio-add-explicit-rcu-grace-period-when-freeing-kioctx.patch fs-aio-use-rcu-accessors-for-kioctx_table-table.patch rdmavt-fix-synchronization-around-percpu_ref.patch +irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch +nvme-fix-subsystem-multiple-controllers-support-check.patch