--- /dev/null
+From ad0a45fd9c14feebd000b6e84189d0edff265170 Mon Sep 17 00:00:00 2001
+From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+Date: Sun, 19 Mar 2017 00:51:59 +0530
+Subject: cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
+
+From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+
+commit ad0a45fd9c14feebd000b6e84189d0edff265170 upstream.
+
+If a given cpu is not in cpu_present and cpu hotplug
+is disabled, arch can skip setting up the cpu_dev.
+
+Arch cpuidle driver should pass correct cpu mask
+for registration, but failing to do so by the driver
+causes error to propagate and crash like this:
+
+[ 30.076045] Unable to handle kernel paging request for data at address 0x00000048
+[ 30.076100] Faulting instruction address: 0xc0000000007b2f30
+cpu 0x4d: Vector: 300 (Data Access) at [c000003feb18b670]
+ pc: c0000000007b2f30: kobject_get+0x20/0x70
+ lr: c0000000007b3c94: kobject_add_internal+0x54/0x3f0
+ sp: c000003feb18b8f0
+ msr: 9000000000009033
+ dar: 48
+ dsisr: 40000000
+ current = 0xc000003fd2ed8300
+ paca = 0xc00000000fbab500 softe: 0 irq_happened: 0x01
+ pid = 1, comm = swapper/0
+Linux version 4.11.0-rc2-svaidy+ (sv@sagarika) (gcc version 6.2.0
+20161005 (Ubuntu 6.2.0-5ubuntu12) ) #10 SMP Sun Mar 19 00:08:09 IST 2017
+enter ? for help
+[c000003feb18b960] c0000000007b3c94 kobject_add_internal+0x54/0x3f0
+[c000003feb18b9f0] c0000000007b43a4 kobject_init_and_add+0x64/0xa0
+[c000003feb18ba70] c000000000e284f4 cpuidle_add_sysfs+0xb4/0x130
+[c000003feb18baf0] c000000000e26038 cpuidle_register_device+0x118/0x1c0
+[c000003feb18bb30] c000000000e26c48 cpuidle_register+0x78/0x120
+[c000003feb18bbc0] c00000000168fd9c powernv_processor_idle_init+0x110/0x1c4
+[c000003feb18bc40] c00000000000cff8 do_one_initcall+0x68/0x1d0
+[c000003feb18bd00] c0000000016242f4 kernel_init_freeable+0x280/0x360
+[c000003feb18bdc0] c00000000000d864 kernel_init+0x24/0x160
+[c000003feb18be30] c00000000000b4e8 ret_from_kernel_thread+0x5c/0x74
+
+Validating cpu_dev fixes the crash and reports correct error message like:
+
+[ 30.163506] Failed to register cpuidle device for cpu136
+[ 30.173329] Registration of powernv driver failed.
+
+Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
+[ rjw: Comment massage ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/sysfs.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/cpuidle/sysfs.c
++++ b/drivers/cpuidle/sysfs.c
+@@ -615,6 +615,18 @@ int cpuidle_add_sysfs(struct cpuidle_dev
+ struct device *cpu_dev = get_cpu_device((unsigned long)dev->cpu);
+ int error;
+
++ /*
++ * Return if cpu_device is not setup for this CPU.
++ *
++ * This could happen if the arch did not set up cpu_device
++ * since this CPU is not in cpu_present mask and the
++ * driver did not send a correct CPU mask during registration.
++ * Without this check we would end up passing bogus
++ * value for &cpu_dev->kobj in kobject_init_and_add()
++ */
++ if (!cpu_dev)
++ return -ENODEV;
++
+ kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
+ if (!kdev)
+ return -ENOMEM;
--- /dev/null
+From 0134ed4fb9e78672ee9f7b18007114404c81e63f Mon Sep 17 00:00:00 2001
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Fri, 10 Mar 2017 13:24:22 -0700
+Subject: device-dax: fix pmd/pte fault fallback handling
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+commit 0134ed4fb9e78672ee9f7b18007114404c81e63f upstream.
+
+Jeff Moyer reports:
+
+ With a device dax alignment of 4KB or 2MB, I get sigbus when running
+ the attached fio job file for the current kernel (4.11.0-rc1+). If
+ I specify an alignment of 1GB, it works.
+
+ I turned on debug output, and saw that it was failing in the huge
+ fault code.
+
+ dax dax1.0: dax_open
+ dax dax1.0: dax_mmap
+ dax dax1.0: dax_dev_huge_fault: fio: write (0x7f08f0a00000 -
+ dax dax1.0: __dax_dev_pud_fault: phys_to_pgoff(0xffffffffcf60
+ dax dax1.0: dax_release
+
+ fio config for reproduce:
+ [global]
+ ioengine=dev-dax
+ direct=0
+ filename=/dev/dax0.0
+ bs=2m
+
+ [write]
+ rw=write
+
+ [read]
+ stonewall
+ rw=read
+
+The driver fails to fallback when taking a fault that is larger than
+the device alignment, or handling a larger fault when a smaller
+mapping is already established. While we could support larger
+mappings for a device with a smaller alignment, that change is
+too large for the immediate fix. The simplest change is to force
+fallback until the fault size matches the alignment.
+
+Fixes: dee410792419 ("/dev/dax, core: file operations and dax-mmap")
+Cc: <stable@vger.kernel.org>
+Reported-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dax/dax.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/dax/dax.c
++++ b/drivers/dax/dax.c
+@@ -427,6 +427,7 @@ static int __dax_dev_fault(struct dax_de
+ int rc = VM_FAULT_SIGBUS;
+ phys_addr_t phys;
+ pfn_t pfn;
++ unsigned int fault_size = PAGE_SIZE;
+
+ if (check_vma(dax_dev, vma, __func__))
+ return VM_FAULT_SIGBUS;
+@@ -437,6 +438,9 @@ static int __dax_dev_fault(struct dax_de
+ return VM_FAULT_SIGBUS;
+ }
+
++ if (fault_size != dax_region->align)
++ return VM_FAULT_SIGBUS;
++
+ phys = pgoff_to_phys(dax_dev, vmf->pgoff, PAGE_SIZE);
+ if (phys == -1) {
+ dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+@@ -482,6 +486,7 @@ static int __dax_dev_pmd_fault(struct da
+ phys_addr_t phys;
+ pgoff_t pgoff;
+ pfn_t pfn;
++ unsigned int fault_size = PMD_SIZE;
+
+ if (check_vma(dax_dev, vma, __func__))
+ return VM_FAULT_SIGBUS;
+@@ -498,6 +503,16 @@ static int __dax_dev_pmd_fault(struct da
+ return VM_FAULT_SIGBUS;
+ }
+
++ if (fault_size < dax_region->align)
++ return VM_FAULT_SIGBUS;
++ else if (fault_size > dax_region->align)
++ return VM_FAULT_FALLBACK;
++
++ /* if we are outside of the VMA */
++ if (pmd_addr < vma->vm_start ||
++ (pmd_addr + PMD_SIZE) > vma->vm_end)
++ return VM_FAULT_SIGBUS;
++
+ pgoff = linear_page_index(vma, pmd_addr);
+ phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
+ if (phys == -1) {
--- /dev/null
+From b581a5854eee4b7851dedb0f8c2ceb54fb902c06 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Wed, 1 Mar 2017 17:33:27 +0100
+Subject: libceph: don't set weight to IN when OSD is destroyed
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit b581a5854eee4b7851dedb0f8c2ceb54fb902c06 upstream.
+
+Since ceph.git commit 4e28f9e63644 ("osd/OSDMap: clear osd_info,
+osd_xinfo on osd deletion"), weight is set to IN when OSD is deleted.
+This changes the result of applying an incremental for clients, not
+just OSDs. Because CRUSH computations are obviously affected,
+pre-4e28f9e63644 servers disagree with post-4e28f9e63644 clients on
+object placement, resulting in misdirected requests.
+
+Mirrors ceph.git commit a6009d1039a55e2c77f431662b3d6cc5a8e8e63f.
+
+Fixes: 930c53286977 ("libceph: apply new_state before new_up_client on incrementals")
+Link: http://tracker.ceph.com/issues/19122
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Sage Weil <sage@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/osdmap.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1334,7 +1334,6 @@ static int decode_new_up_state_weight(vo
+ if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
+ (xorstate & CEPH_OSD_EXISTS)) {
+ pr_info("osd%d does not exist\n", osd);
+- map->osd_weight[osd] = CEPH_OSD_IN;
+ ret = set_primary_affinity(map, osd,
+ CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
+ if (ret)
--- /dev/null
+From 2602b740e45cc64feb55d5a9ee8db744ab3becbb Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Mon, 13 Mar 2017 14:36:32 +0200
+Subject: mmc: block: Fix is_waiting_last_req set incorrectly
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 2602b740e45cc64feb55d5a9ee8db744ab3becbb upstream.
+
+Commit 15520111500c ("mmc: core: Further fix thread wake-up") allowed a
+queue to release the host with is_waiting_last_req set to true. A queue
+waiting to claim the host will not reset it, which can result in the
+queue getting stuck in a loop.
+
+Fixes: 15520111500c ("mmc: core: Further fix thread wake-up")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1791,6 +1791,7 @@ int mmc_blk_issue_rq(struct mmc_queue *m
+ ret = mmc_blk_issue_flush(mq, req);
+ } else {
+ ret = mmc_blk_issue_rw_rq(mq, req);
++ card->host->context_info.is_waiting_last_req = false;
+ }
+
+ out:
--- /dev/null
+From c46f09175dabd5dd6a1507f36250bfa734a0156e Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Wed, 1 Mar 2017 17:27:00 +0900
+Subject: scsi: sd: Check for unaligned partial completion
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+commit c46f09175dabd5dd6a1507f36250bfa734a0156e upstream.
+
+Commit <f2e767bb5d6e> ("mpt3sas: Force request partial completion
+alignment") was not considering the case of commands not operating on
+logical block size units (e.g. REQ_OP_ZONE_REPORT and its 64B aligned
+partial replies). In this case, forcing alignment of resid to the device
+logical block size can break the command result, e.g. in the case of
+REQ_OP_ZONE_REPORT, the exact number of zone reported by the device.
+
+Move the partial completion alignement check of mpt3sas to a generic
+implementation in sd_done(). The check is added within the default
+section of the initial req_op() switch case so that the report and reset
+zone commands are ignored. In addition, as sd_done() is not called for
+passthrough requests, resid corrections are not done as intended by the
+initial mpt3sas patch.
+
+Fixes: f2e767bb5d6e ("mpt3sas: Force request partial completion alignment")
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 15 ---------------
+ drivers/scsi/sd.c | 17 +++++++++++++++++
+ 2 files changed, 17 insertions(+), 15 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4658,7 +4658,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ struct MPT3SAS_DEVICE *sas_device_priv_data;
+ u32 response_code = 0;
+ unsigned long flags;
+- unsigned int sector_sz;
+
+ mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
+ scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
+@@ -4717,20 +4716,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ }
+
+ xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
+-
+- /* In case of bogus fw or device, we could end up having
+- * unaligned partial completion. We can force alignment here,
+- * then scsi-ml does not need to handle this misbehavior.
+- */
+- sector_sz = scmd->device->sector_size;
+- if (unlikely(scmd->request->cmd_type == REQ_TYPE_FS && sector_sz &&
+- xfer_cnt % sector_sz)) {
+- sdev_printk(KERN_INFO, scmd->device,
+- "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n",
+- xfer_cnt, sector_sz);
+- xfer_cnt = round_down(xfer_cnt, sector_sz);
+- }
+-
+ scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt);
+ if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
+ log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1790,6 +1790,8 @@ static int sd_done(struct scsi_cmnd *SCp
+ {
+ int result = SCpnt->result;
+ unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
++ unsigned int sector_size = SCpnt->device->sector_size;
++ unsigned int resid;
+ struct scsi_sense_hdr sshdr;
+ struct scsi_disk *sdkp = scsi_disk(SCpnt->request->rq_disk);
+ struct request *req = SCpnt->request;
+@@ -1820,6 +1822,21 @@ static int sd_done(struct scsi_cmnd *SCp
+ scsi_set_resid(SCpnt, blk_rq_bytes(req));
+ }
+ break;
++ default:
++ /*
++ * In case of bogus fw or device, we could end up having
++ * an unaligned partial completion. Check this here and force
++ * alignment.
++ */
++ resid = scsi_get_resid(SCpnt);
++ if (resid & (sector_size - 1)) {
++ sd_printk(KERN_INFO, sdkp,
++ "Unaligned partial completion (resid=%u, sector_sz=%u)\n",
++ resid, sector_size);
++ resid = min(scsi_bufflen(SCpnt),
++ round_up(resid, sector_size));
++ scsi_set_resid(SCpnt, resid);
++ }
+ }
+
+ if (result) {
intel_th-don-t-leak-module-refcount-on-failure-to-activate.patch
drivers-hv-vmbus-don-t-leak-channel-ids.patch
drivers-hv-vmbus-don-t-leak-memory-when-a-channel-is-rescinded.patch
+mmc-block-fix-is_waiting_last_req-set-incorrectly.patch
+libceph-don-t-set-weight-to-in-when-osd-is-destroyed.patch
+device-dax-fix-pmd-pte-fault-fallback-handling.patch
+scsi-sd-check-for-unaligned-partial-completion.patch
+cpuidle-validate-cpu_dev-in-cpuidle_add_sysfs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
