--- /dev/null
+From 511885d7061eda3eb1faf3f57dcc936ff75863f1 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Wed, 24 Jul 2019 08:23:23 -0700
+Subject: lib/timerqueue: Rely on rbtree semantics for next timer
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit 511885d7061eda3eb1faf3f57dcc936ff75863f1 upstream.
+
+Simplify the timerqueue code by using cached rbtrees and rely on the tree
+leftmost node semantics to get the timer with earliest expiration time.
+This is a drop in conversion, and therefore semantics remain untouched.
+
+The runtime overhead of cached rbtrees is be pretty much the same as the
+current head->next method, noting that when removing the leftmost node,
+a common operation for the timerqueue, the rb_next(leftmost) is O(1) as
+well, so the next timer will either be the right node or its parent.
+Therefore no extra pointer chasing. Finally, the size of the struct
+timerqueue_head remains the same.
+
+Passes several hours of rcutorture.
+
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190724152323.bojciei3muvfxalm@linux-r8p5
+Reference: CVE-2021-20317
+Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/timerqueue.h | 13 ++++++-------
+ lib/timerqueue.c | 30 ++++++++++++------------------
+ 2 files changed, 18 insertions(+), 25 deletions(-)
+
+--- a/include/linux/timerqueue.h
++++ b/include/linux/timerqueue.h
+@@ -12,8 +12,7 @@ struct timerqueue_node {
+ };
+
+ struct timerqueue_head {
+- struct rb_root head;
+- struct timerqueue_node *next;
++ struct rb_root_cached rb_root;
+ };
+
+
+@@ -29,13 +28,14 @@ extern struct timerqueue_node *timerqueu
+ *
+ * @head: head of timerqueue
+ *
+- * Returns a pointer to the timer node that has the
+- * earliest expiration time.
++ * Returns a pointer to the timer node that has the earliest expiration time.
+ */
+ static inline
+ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head)
+ {
+- return head->next;
++ struct rb_node *leftmost = rb_first_cached(&head->rb_root);
++
++ return rb_entry(leftmost, struct timerqueue_node, node);
+ }
+
+ static inline void timerqueue_init(struct timerqueue_node *node)
+@@ -45,7 +45,6 @@ static inline void timerqueue_init(struc
+
+ static inline void timerqueue_init_head(struct timerqueue_head *head)
+ {
+- head->head = RB_ROOT;
+- head->next = NULL;
++ head->rb_root = RB_ROOT_CACHED;
+ }
+ #endif /* _LINUX_TIMERQUEUE_H */
+--- a/lib/timerqueue.c
++++ b/lib/timerqueue.c
+@@ -39,9 +39,10 @@
+ */
+ bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *node)
+ {
+- struct rb_node **p = &head->head.rb_node;
++ struct rb_node **p = &head->rb_root.rb_root.rb_node;
+ struct rb_node *parent = NULL;
+- struct timerqueue_node *ptr;
++ struct timerqueue_node *ptr;
++ bool leftmost = true;
+
+ /* Make sure we don't add nodes that are already added */
+ WARN_ON_ONCE(!RB_EMPTY_NODE(&node->node));
+@@ -49,19 +50,17 @@ bool timerqueue_add(struct timerqueue_he
+ while (*p) {
+ parent = *p;
+ ptr = rb_entry(parent, struct timerqueue_node, node);
+- if (node->expires < ptr->expires)
++ if (node->expires < ptr->expires) {
+ p = &(*p)->rb_left;
+- else
++ } else {
+ p = &(*p)->rb_right;
++ leftmost = false;
++ }
+ }
+ rb_link_node(&node->node, parent, p);
+- rb_insert_color(&node->node, &head->head);
++ rb_insert_color_cached(&node->node, &head->rb_root, leftmost);
+
+- if (!head->next || node->expires < head->next->expires) {
+- head->next = node;
+- return true;
+- }
+- return false;
++ return leftmost;
+ }
+ EXPORT_SYMBOL_GPL(timerqueue_add);
+
+@@ -78,15 +77,10 @@ bool timerqueue_del(struct timerqueue_he
+ {
+ WARN_ON_ONCE(RB_EMPTY_NODE(&node->node));
+
+- /* update next pointer */
+- if (head->next == node) {
+- struct rb_node *rbn = rb_next(&node->node);
+-
+- head->next = rb_entry_safe(rbn, struct timerqueue_node, node);
+- }
+- rb_erase(&node->node, &head->head);
++ rb_erase_cached(&node->node, &head->rb_root);
+ RB_CLEAR_NODE(&node->node);
+- return head->next != NULL;
++
++ return !RB_EMPTY_ROOT(&head->rb_root.rb_root);
+ }
+ EXPORT_SYMBOL_GPL(timerqueue_del);
+
--- /dev/null
+From 7a8526a5cd51cf5f070310c6c37dd7293334ac49 Mon Sep 17 00:00:00 2001
+From: Kate Hsuan <hpa@redhat.com>
+Date: Fri, 3 Sep 2021 17:44:11 +0800
+Subject: libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
+
+From: Kate Hsuan <hpa@redhat.com>
+
+commit 7a8526a5cd51cf5f070310c6c37dd7293334ac49 upstream.
+
+Many users are reporting that the Samsung 860 and 870 SSD are having
+various issues when combined with AMD/ATI (vendor ID 0x1002) SATA
+controllers and only completely disabling NCQ helps to avoid these
+issues.
+
+Always disabling NCQ for Samsung 860/870 SSDs regardless of the host
+SATA adapter vendor will cause I/O performance degradation with well
+behaved adapters. To limit the performance impact to ATI adapters,
+introduce the ATA_HORKAGE_NO_NCQ_ON_ATI flag to force disable NCQ
+only for these adapters.
+
+Also, two libata.force parameters (noncqati and ncqati) are introduced
+to disable and enable the NCQ for the system which equipped with ATI
+SATA adapter and Samsung 860 and 870 SSDs. The user can determine NCQ
+function to be enabled or disabled according to the demand.
+
+After verifying the chipset from the user reports, the issue appears
+on AMD/ATI SB7x0/SB8x0/SB9x0 SATA Controllers and does not appear on
+recent AMD SATA adapters. The vendor ID of ATI should be 0x1002.
+Therefore, ATA_HORKAGE_NO_NCQ_ON_AMD was modified to
+ATA_HORKAGE_NO_NCQ_ON_ATI.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201693
+Signed-off-by: Kate Hsuan <hpa@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210903094411.58749-1-hpa@redhat.com
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Krzysztof Olędzki <ole@ans.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c | 34 ++++++++++++++++++++++++++++++++--
+ include/linux/libata.h | 1 +
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2268,6 +2268,25 @@ static void ata_dev_config_ncq_prio(stru
+
+ }
+
++static bool ata_dev_check_adapter(struct ata_device *dev,
++ unsigned short vendor_id)
++{
++ struct pci_dev *pcidev = NULL;
++ struct device *parent_dev = NULL;
++
++ for (parent_dev = dev->tdev.parent; parent_dev != NULL;
++ parent_dev = parent_dev->parent) {
++ if (dev_is_pci(parent_dev)) {
++ pcidev = to_pci_dev(parent_dev);
++ if (pcidev->vendor == vendor_id)
++ return true;
++ break;
++ }
++ }
++
++ return false;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -2284,6 +2303,13 @@ static int ata_dev_config_ncq(struct ata
+ snprintf(desc, desc_sz, "NCQ (not used)");
+ return 0;
+ }
++
++ if (dev->horkage & ATA_HORKAGE_NO_NCQ_ON_ATI &&
++ ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) {
++ snprintf(desc, desc_sz, "NCQ (not used)");
++ return 0;
++ }
++
+ if (ap->flags & ATA_FLAG_NCQ) {
+ hdepth = min(ap->scsi_host->can_queue, ATA_MAX_QUEUE);
+ dev->flags |= ATA_DFLAG_NCQ;
+@@ -4575,9 +4601,11 @@ static const struct ata_blacklist_entry
+ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+- ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ ATA_HORKAGE_ZERO_AFTER_TRIM |
++ ATA_HORKAGE_NO_NCQ_ON_ATI, },
+ { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+- ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ ATA_HORKAGE_ZERO_AFTER_TRIM |
++ ATA_HORKAGE_NO_NCQ_ON_ATI, },
+ { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+@@ -6934,6 +6962,8 @@ static int __init ata_parse_force_one(ch
+ { "ncq", .horkage_off = ATA_HORKAGE_NONCQ },
+ { "noncqtrim", .horkage_on = ATA_HORKAGE_NO_NCQ_TRIM },
+ { "ncqtrim", .horkage_off = ATA_HORKAGE_NO_NCQ_TRIM },
++ { "noncqati", .horkage_on = ATA_HORKAGE_NO_NCQ_ON_ATI },
++ { "ncqati", .horkage_off = ATA_HORKAGE_NO_NCQ_ON_ATI },
+ { "dump_id", .horkage_on = ATA_HORKAGE_DUMP_ID },
+ { "pio0", .xfer_mask = 1 << (ATA_SHIFT_PIO + 0) },
+ { "pio1", .xfer_mask = 1 << (ATA_SHIFT_PIO + 1) },
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -440,6 +440,7 @@ enum {
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
+ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */
++ ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27), /* Disable NCQ on ATI chipset */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
projects / thirdparty / kernel / stable-queue.git / commitdiff
