linux-toradex.git/arch, branch v4.4.4

x86/irq: Plug vector cleanup race

2016-03-03T23:07:32+00:00

commit 98229aa36caa9c769b13565523de9b813013c703 upstream.

We still can end up with a stale vector due to the following:

CPU0                          CPU1                      CPU2
lock_vector()
data->move_in_progress=0
sendIPI()
unlock_vector()
                              set_affinity()
                              assign_irq_vector()
                              lock_vector()             handle_IPI
                              move_in_progress = 1      lock_vector()
                              unlock_vector()
                                                        move_in_progress == 1

So we need to serialize the vector assignment against a pending cleanup. The
solution is rather simple now. We not only check for the move_in_progress flag
in assign_irq_vector(), we also check whether there is still a cleanup pending
in the old_domain cpumask. If so, we return -EBUSY to the caller and let him
deal with it. Though we have to be careful in the cpu unplug case. If the
cleanout has not yet completed then the following setaffinity() call would
return -EBUSY. Add code which prevents this.

Full context is here: http://lkml.kernel.org/r/5653B688.4050809@stratus.com

Reported-and-tested-by: Joe Lawrence 
Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160107.207265407@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Call irq_force_move_complete with irq descriptor

2016-03-03T23:07:31+00:00

commit 90a2282e23f0522e4b3f797ad447c5e91bf7fe32 upstream.

First of all there is no point in looking up the irq descriptor again, but we
also need the descriptor for the final cleanup race fix in the next
patch. Make that change seperate. No functional difference.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160107.125211743@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Remove outgoing CPU from vector cleanup mask

2016-03-03T23:07:31+00:00

commit 56d7d2f4bbd00fb198b7907cb3ab657d06115a42 upstream.

We want to synchronize new vector assignments with a pending cleanup. Remove a
dying cpu from a pending cleanup mask.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160107.045961667@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Remove the cpumask allocation from send_cleanup_vector()

2016-03-03T23:07:31+00:00

commit 5da0c1217f05d2ccc9a8ed6e6e5c23a8a1d24dd6 upstream.

There is no need to allocate a new cpumask for sending the cleanup vector. The
old_domain mask is now protected by the vector_lock, so we can safely remove
the offline cpus from it and send the IPI with the resulting mask.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.967993932@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Clear move_in_progress before sending cleanup IPI

2016-03-03T23:07:31+00:00

commit c1684f5035b60e9f98566493e869496fb5de1d89 upstream.

send_cleanup_vector() fiddles with the old_domain mask unprotected because it
relies on the protection by the move_in_progress flag. But this is fatal, as
the flag is reset after the IPI has been sent. So a cpu which receives the IPI
can still see the flag set and therefor ignores the cleanup request. If no
other cleanup request happens then the vector stays stale on that cpu and in
case of an irq removal the vector still persists. That can lead to use after
free when the next cleanup IPI happens.

Protect the code with vector_lock and clear move_in_progress before sending
the IPI.

This does not plug the race which Joe reported because:

CPU0                          CPU1                      CPU2
lock_vector()
data->move_in_progress=0
sendIPI()
unlock_vector()
                              set_affinity()
                              assign_irq_vector()
                              lock_vector()             handle_IPI
                              move_in_progress = 1      lock_vector()
                              unlock_vector()
                                                        move_in_progress == 1

The full fix comes with a later patch.

Reported-and-tested-by: Joe Lawrence 
Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.892412198@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Remove offline cpus from vector cleanup

2016-03-03T23:07:31+00:00

commit 847667ef10356b824a11c853fc8a8b1b437b6a8d upstream.

No point of keeping offline cpus in the cleanup mask.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.808642683@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Get rid of code duplication

2016-03-03T23:07:31+00:00

commit ab25ac02148b600e645f77cfb8b8ea415ed75bb4 upstream.

Reusing an existing vector and assigning a new vector has duplicated
code. Consolidate it.

This is also a preparatory patch for finally plugging the cleanup race.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.721599216@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Copy vectormask instead of an AND operation

2016-03-03T23:07:31+00:00

commit 9ac15b7a8af4cf3337a101498c0ed690d23ade75 upstream.

In the case that the new vector mask is a subset of the existing mask there is
no point to do a AND operation of currentmask & newmask. The result is
newmask. So we can simply copy the new mask to the current mask and be done
with it. Preparatory patch for further consolidation.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.640253454@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Check vector allocation early

2016-03-03T23:07:31+00:00

commit 3716fd27a604d61a91cda47083504971486b80f1 upstream.

__assign_irq_vector() uses the vector_cpumask which is assigned by
apic->vector_allocation_domain() without doing basic sanity checks. That can
result in a situation where the final assignement of a newly found vector
fails in apic->cpu_mask_to_apicid_and(). So we have to do rollbacks for no
reason.

apic->cpu_mask_to_apicid_and() only fails if

  vector_cpumask & requested_cpumask & cpu_online_mask

is empty.

Check for this condition right away and if the result is empty try immediately
the next possible cpu in the requested mask. So in case of a failure the old
setting is unchanged and we can remove the rollback code.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.561877324@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

x86/irq: Reorganize the search in assign_irq_vector

2016-03-03T23:07:31+00:00

commit 95ffeb4b5baca266e1d0d2bc90f1513e6f419cdd upstream.

Split out the code which advances the target cpu for the search so we can
reuse it for the next patch which adds an early validation check for the
vectormask which we get from the apic.

Add comments while at it.

Signed-off-by: Thomas Gleixner 
Tested-by: Borislav Petkov 
Tested-by: Joe Lawrence 
Cc: Jiang Liu 
Cc: Jeremiah Mahler 
Cc: andy.shevchenko@gmail.com
Cc: Guenter Roeck 
Link: http://lkml.kernel.org/r/20151231160106.484562040@linutronix.de
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman