Merge tag 'iommu-fixes-v4.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull IOMMU fixes from Joerg Roedel:
 "Three fixes:

   - Fix use of smp_processor_id() in preemptible code in the IOVA
     allocation code.  This got introduced with the scalability
     improvements in this release cycle.

   - A VT-d fix for out-of-bounds access of the iommu->domains array.
     The bug showed during suspend/resume.

   - AMD IOMMU fix to print the correct device id in the ACPI parsing
     code"

* tag 'iommu-fixes-v4.7-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/amd: Initialize devid variable before using it
  iommu/vt-d: Fix overflow of iommu->domains array
  iommu/iova: Disable preemption around use of this_cpu_ptr()

3 files changed, 8 insertions, 4 deletions

diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 9e0034196e10..d091defc3426 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1107,13 +1107,13 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
                                 break;
                         }
 
+                        devid = e->devid;
                         DUMP_printk("  DEV_ACPI_HID(%s[%s])\t\tdevid: %02x:%02x.%x\n",
                                     hid, uid,
                                     PCI_BUS_NUM(devid),
                                     PCI_SLOT(devid),
                                     PCI_FUNC(devid));
 
-                        devid  = e->devid;
                         flags = e->flags;
 
                         ret = add_acpi_hid_device(hid, uid, &devid, false);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 10700945994e..cfe410eedaf0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4607,7 +4607,7 @@ static void free_all_cpu_cached_iovas(unsigned int cpu)
                 if (!iommu)
                         continue;
 
-                for (did = 0; did < 0xffff; did++) {
+                for (did = 0; did < cap_ndoms(iommu->cap); did++) {
                         domain = get_iommu_domain(iommu, did);
 
                         if (!domain)
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index ba764a0835d3..e23001bfcfee 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -420,8 +420,10 @@ retry:
 
                 /* Try replenishing IOVAs by flushing rcache. */
                 flushed_rcache = true;
+                preempt_disable();
                 for_each_online_cpu(cpu)
                         free_cpu_cached_iovas(cpu, iovad);
+                preempt_enable();
                 goto retry;
         }
 
@@ -749,7 +751,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
         bool can_insert = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_full(cpu_rcache->loaded)) {
@@ -779,6 +781,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
                 iova_magazine_push(cpu_rcache->loaded, iova_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         if (mag_to_free) {
                 iova_magazine_free_pfns(mag_to_free, iovad);
@@ -812,7 +815,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
         bool has_pfn = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_empty(cpu_rcache->loaded)) {
@@ -834,6 +837,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
                 iova_pfn = iova_magazine_pop(cpu_rcache->loaded, limit_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         return iova_pfn;
 }