--- /dev/null
+From 8208d1708b88b412ca97f50a6d951242c88cbbac Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 18 Jan 2019 14:08:59 +0000
+Subject: irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 8208d1708b88b412ca97f50a6d951242c88cbbac upstream.
+
+The way we allocate events works fine in most cases, except
+when multiple PCI devices share an ITS-visible DevID, and that
+one of them is trying to use MultiMSI allocation.
+
+In that case, our allocation is not guaranteed to be zero-based
+anymore, and we have to make sure we allocate it on a boundary
+that is compatible with the PCI Multi-MSI constraints.
+
+Fix this by allocating the full region upfront instead of iterating
+over the number of MSIs. MSI-X are always allocated one by one,
+so this shouldn't change anything on that front.
+
+Fixes: b48ac83d6bbc2 ("irqchip: GICv3: ITS: MSI support")
+Cc: stable@vger.kernel.org
+Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+[ardb: rebased onto v4.9.153, should apply cleanly onto v4.4.y as well]
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1230,13 +1230,14 @@ static void its_free_device(struct its_d
+ kfree(its_dev);
+ }
+
+-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
+ {
+ int idx;
+
+- idx = find_first_zero_bit(dev->event_map.lpi_map,
+- dev->event_map.nr_lpis);
+- if (idx == dev->event_map.nr_lpis)
++ idx = bitmap_find_free_region(dev->event_map.lpi_map,
++ dev->event_map.nr_lpis,
++ get_count_order(nvecs));
++ if (idx < 0)
+ return -ENOSPC;
+
+ *hwirq = dev->event_map.lpi_base + idx;
+@@ -1317,20 +1318,20 @@ static int its_irq_domain_alloc(struct i
+ int err;
+ int i;
+
+- for (i = 0; i < nr_irqs; i++) {
+- err = its_alloc_device_irq(its_dev, &hwirq);
+- if (err)
+- return err;
++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
++ if (err)
++ return err;
+
+- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
++ for (i = 0; i < nr_irqs; i++) {
++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+ if (err)
+ return err;
+
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+- hwirq, &its_irq_chip, its_dev);
++ hwirq + i, &its_irq_chip, its_dev);
+ pr_debug("ID:%d pID:%d vID:%d\n",
+- (int)(hwirq - its_dev->event_map.lpi_base),
+- (int) hwirq, virq + i);
++ (int)(hwirq + i - its_dev->event_map.lpi_base),
++ (int)(hwirq + i), virq + i);
+ }
+
+ return 0;
--- /dev/null
+From 60f1bf29c0b2519989927cae640cd1f50f59dc7f Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Fri, 11 Jan 2019 15:18:22 +0100
+Subject: s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 60f1bf29c0b2519989927cae640cd1f50f59dc7f upstream.
+
+When calling smp_call_ipl_cpu() from the IPL CPU, we will try to read
+from pcpu_devices->lowcore. However, due to prefixing, that will result
+in reading from absolute address 0 on that CPU. We have to go via the
+actual lowcore instead.
+
+This means that right now, we will read lc->nodat_stack == 0 and
+therfore work on a very wrong stack.
+
+This BUG essentially broke rebooting under QEMU TCG (which will report
+a low address protection exception). And checking under KVM, it is
+also broken under KVM. With 1 VCPU it can be easily triggered.
+
+:/# echo 1 > /proc/sys/kernel/sysrq
+:/# echo b > /proc/sysrq-trigger
+[ 28.476745] sysrq: SysRq : Resetting
+[ 28.476793] Kernel stack overflow.
+[ 28.476817] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476820] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476826] Krnl PSW : 0400c00180000000 0000000000115c0c (pcpu_delegate+0x12c/0x140)
+[ 28.476861] R:0 T:1 IO:0 EX:0 Key:0 M:0 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
+[ 28.476863] Krnl GPRS: ffffffffffffffff 0000000000000000 000000000010dff8 0000000000000000
+[ 28.476864] 0000000000000000 0000000000000000 0000000000ab7090 000003e0006efbf0
+[ 28.476864] 000000000010dff8 0000000000000000 0000000000000000 0000000000000000
+[ 28.476865] 000000007fffc000 0000000000730408 000003e0006efc58 0000000000000000
+[ 28.476887] Krnl Code: 0000000000115bfe: 4170f000 la %r7,0(%r15)
+[ 28.476887] 0000000000115c02: 41f0a000 la %r15,0(%r10)
+[ 28.476887] #0000000000115c06: e370f0980024 stg %r7,152(%r15)
+[ 28.476887] >0000000000115c0c: c0e5fffff86e brasl %r14,114ce8
+[ 28.476887] 0000000000115c12: 41f07000 la %r15,0(%r7)
+[ 28.476887] 0000000000115c16: a7f4ffa8 brc 15,115b66
+[ 28.476887] 0000000000115c1a: 0707 bcr 0,%r7
+[ 28.476887] 0000000000115c1c: 0707 bcr 0,%r7
+[ 28.476901] Call Trace:
+[ 28.476902] Last Breaking-Event-Address:
+[ 28.476920] [<0000000000a01c4a>] arch_call_rest_init+0x22/0x80
+[ 28.476927] Kernel panic - not syncing: Corrupt kernel stack, can't continue.
+[ 28.476930] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476932] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476932] Call Trace:
+
+Fixes: 2f859d0dad81 ("s390/smp: reduce size of struct pcpu")
+Cc: stable@vger.kernel.org # 4.0+
+Reported-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/s390/kernel/smp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -360,9 +360,13 @@ void smp_call_online_cpu(void (*func)(vo
+ */
+ void smp_call_ipl_cpu(void (*func)(void *), void *data)
+ {
++ struct lowcore *lc = pcpu_devices->lowcore;
++
++ if (pcpu_devices[0].address == stap())
++ lc = &S390_lowcore;
++
+ pcpu_delegate(&pcpu_devices[0], func, data,
+- pcpu_devices->lowcore->panic_stack -
+- PANIC_FRAME_OFFSET + PAGE_SIZE);
++ lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE);
+ }
+
+ int smp_find_processor_id(u16 address)
projects / thirdparty / kernel / stable-queue.git / commitdiff
