ARCv2: SMP: Emulate IPI to self using software triggered interrupt

ARConnect/MCIP Inter-Core-Interrupt module can't send interrupt to
local core. So use core intc capability to trigger software
interrupt to self, using an unsued IRQ #21.

This showed up as csd deadlock with LTP trace_sched on a dual core
system. This test acts as scheduler fuzzer, triggering all sorts of
schedulting activity. Trouble starts with IPI to self, which doesn't get
delivered (effectively lost due to H/w capability), but the msg intended
to be sent remain enqueued in per-cpu @ipi_data.

All subsequent IPIs to this core from other cores get elided due to the
IPI coalescing optimization in ipi_send_msg_one() where a pending msg
implies an IPI already sent and assumes other core is yet to ack it.
After the elided IPI, other core simply goes into csd_lock_wait()
but never comes out as this core never sees the interrupt.

Fixes STAR 9001008624

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: <stable@vger.kernel.org>        [4.2]
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>

2 files changed, 21 insertions, 5 deletions

diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index b17830294706..c1264607bbff 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -45,11 +45,12 @@ VECTOR	reserved		; Reserved slots
 VECTOR  handle_interrupt        ; (16) Timer0
 VECTOR  handle_interrupt        ; unused (Timer1)
 VECTOR  handle_interrupt        ; unused (WDT)
-VECTOR  handle_interrupt        ; (19) ICI (inter core interrupt)
-VECTOR  handle_interrupt
-VECTOR  handle_interrupt
-VECTOR  handle_interrupt
-VECTOR  handle_interrupt        ; (23) End of fixed IRQs
+VECTOR  handle_interrupt        ; (19) Inter core Interrupt (IPI)
+VECTOR  handle_interrupt        ; (20) perf Interrupt
+VECTOR  handle_interrupt        ; (21) Software Triggered Intr (Self IPI)
+VECTOR  handle_interrupt        ; unused
+VECTOR  handle_interrupt        ; (23) unused
+# End of fixed IRQs
 
 .rept CONFIG_ARC_NUMBER_OF_INTERRUPTS - 8
         VECTOR  handle_interrupt
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 002c5fcf8947..9e1bd03b87a6 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -11,9 +11,12 @@
 #include <linux/smp.h>
 #include <linux/irq.h>
 #include <linux/spinlock.h>
+#include <asm/irqflags-arcv2.h>
 #include <asm/mcip.h>
 #include <asm/setup.h>
 
+#define SOFTIRQ_IRQ     21
+
 static char smp_cpuinfo_buf[128];
 static int idu_detected;
 
@@ -22,6 +25,7 @@ static DEFINE_RAW_SPINLOCK(mcip_lock);
 static void mcip_setup_per_cpu(int cpu)
 {
         smp_ipi_irq_setup(cpu, IPI_IRQ);
+        smp_ipi_irq_setup(cpu, SOFTIRQ_IRQ);
 }
 
 static void mcip_ipi_send(int cpu)
@@ -29,6 +33,12 @@ static void mcip_ipi_send(int cpu)
         unsigned long flags;
         int ipi_was_pending;
 
+        /* ARConnect can only send IPI to others */
+        if (unlikely(cpu == raw_smp_processor_id())) {
+                arc_softirq_trigger(SOFTIRQ_IRQ);
+                return;
+        }
+
         /*
          * NOTE: We must spin here if the other cpu hasn't yet
          * serviced a previous message. This can burn lots
@@ -63,6 +73,11 @@ static void mcip_ipi_clear(int irq)
         unsigned long flags;
         unsigned int __maybe_unused copy;
 
+        if (unlikely(irq == SOFTIRQ_IRQ)) {
+                arc_softirq_clear(irq);
+                return;
+        }
+
         raw_spin_lock_irqsave(&mcip_lock, flags);
 
         /* Who sent the IPI */