--- /dev/null
+From ca763d0a53b264a650342cee206512bc92ac7050 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Thu, 9 Feb 2017 11:46:18 -0500
+Subject: dm cache: fix corruption seen when using cache > 2TB
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit ca763d0a53b264a650342cee206512bc92ac7050 upstream.
+
+A rounding bug due to compiler generated temporary being 32bit was found
+in remap_to_cache(). A localized cast in remap_to_cache() fixes the
+corruption but this preferred fix (changing from uint32_t to sector_t)
+eliminates potential for future rounding errors elsewhere.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-cache-target.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -251,7 +251,7 @@ struct cache {
+ /*
+ * Fields for converting from sectors to blocks.
+ */
+- uint32_t sectors_per_block;
++ sector_t sectors_per_block;
+ int sectors_per_block_shift;
+
+ spinlock_t lock;
+@@ -3547,11 +3547,11 @@ static void cache_status(struct dm_targe
+
+ residency = policy_residency(cache->policy);
+
+- DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ",
++ DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ",
+ (unsigned)DM_CACHE_METADATA_BLOCK_SIZE,
+ (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata),
+ (unsigned long long)nr_blocks_metadata,
+- cache->sectors_per_block,
++ (unsigned long long)cache->sectors_per_block,
+ (unsigned long long) from_cblock(residency),
+ (unsigned long long) from_cblock(cache->cache_size),
+ (unsigned) atomic_read(&cache->stats.read_hit),
--- /dev/null
+From 6085831883c25860264721df15f05bbded45e2a2 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 15 Feb 2017 12:06:19 -0500
+Subject: dm stats: fix a leaked s->histogram_boundaries array
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6085831883c25860264721df15f05bbded45e2a2 upstream.
+
+Fixes: dfcfac3e4cd9 ("dm stats: collect and report histogram of IO latencies")
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-stats.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -175,6 +175,7 @@ static void dm_stat_free(struct rcu_head
+ int cpu;
+ struct dm_stat *s = container_of(head, struct dm_stat, rcu_head);
+
++ kfree(s->histogram_boundaries);
+ kfree(s->program_id);
+ kfree(s->aux_data);
+ for_each_possible_cpu(cpu) {
--- /dev/null
+From 907565337ebf998a68cb5c5b2174ce5e5da065eb Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Thu, 3 Nov 2016 10:29:28 -0600
+Subject: Fix: Disable sys_membarrier when nohz_full is enabled
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit 907565337ebf998a68cb5c5b2174ce5e5da065eb upstream.
+
+Userspace applications should be allowed to expect the membarrier system
+call with MEMBARRIER_CMD_SHARED command to issue memory barriers on
+nohz_full CPUs, but synchronize_sched() does not take those into
+account.
+
+Given that we do not want unrelated processes to be able to affect
+real-time sensitive nohz_full CPUs, simply return ENOSYS when membarrier
+is invoked on a kernel with enabled nohz_full CPUs.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+CC: Josh Triplett <josh@joshtriplett.org>
+CC: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Chris Metcalf <cmetcalf@mellanox.com>
+Cc: Rik van Riel <riel@redhat.com>
+Acked-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Reviewed-by: Josh Triplett <josh@joshtriplett.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/membarrier.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/membarrier.c
++++ b/kernel/membarrier.c
+@@ -16,6 +16,7 @@
+
+ #include <linux/syscalls.h>
+ #include <linux/membarrier.h>
++#include <linux/tick.h>
+
+ /*
+ * Bitmask made from a "or" of all commands within enum membarrier_cmd,
+@@ -51,6 +52,9 @@
+ */
+ SYSCALL_DEFINE2(membarrier, int, cmd, int, flags)
+ {
++ /* MEMBARRIER_CMD_SHARED is not compatible with nohz_full. */
++ if (tick_nohz_full_enabled())
++ return -ENOSYS;
+ if (unlikely(flags))
+ return -EINVAL;
+ switch (cmd) {
--- /dev/null
+From 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 27 Feb 2017 14:28:24 -0800
+Subject: ipc/shm: Fix shmat mmap nil-page protection
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 upstream.
+
+The issue is described here, with a nice testcase:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=192931
+
+The problem is that shmat() calls do_mmap_pgoff() with MAP_FIXED, and
+the address rounded down to 0. For the regular mmap case, the
+protection mentioned above is that the kernel gets to generate the
+address -- arch_get_unmapped_area() will always check for MAP_FIXED and
+return that address. So by the time we do security_mmap_addr(0) things
+get funky for shmat().
+
+The testcase itself shows that while a regular user crashes, root will
+not have a problem attaching a nil-page. There are two possible fixes
+to this. The first, and which this patch does, is to simply allow root
+to crash as well -- this is also regular mmap behavior, ie when hacking
+up the testcase and adding mmap(... |MAP_FIXED). While this approach
+is the safer option, the second alternative is to ignore SHM_RND if the
+rounded address is 0, thus only having MAP_SHARED flags. This makes the
+behavior of shmat() identical to the mmap() case. The downside of this
+is obviously user visible, but does make sense in that it maintains
+semantics after the round-down wrt 0 address and mmap.
+
+Passes shm related ltp tests.
+
+Link: http://lkml.kernel.org/r/1486050195-18629-1-git-send-email-dave@stgolabs.net
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Reported-by: Gareth Evans <gareth.evans@contextis.co.uk>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Michael Kerrisk <mtk.manpages@googlemail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ ipc/shm.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -1083,8 +1083,8 @@ out_unlock1:
+ * "raddr" thing points to kernel space, and there has to be a wrapper around
+ * this.
+ */
+-long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
+- unsigned long shmlba)
++long do_shmat(int shmid, char __user *shmaddr, int shmflg,
++ ulong *raddr, unsigned long shmlba)
+ {
+ struct shmid_kernel *shp;
+ unsigned long addr;
+@@ -1105,8 +1105,13 @@ long do_shmat(int shmid, char __user *sh
+ goto out;
+ else if ((addr = (ulong)shmaddr)) {
+ if (addr & (shmlba - 1)) {
+- if (shmflg & SHM_RND)
+- addr &= ~(shmlba - 1); /* round down */
++ /*
++ * Round down to the nearest multiple of shmlba.
++ * For sane do_mmap_pgoff() parameters, avoid
++ * round downs that trigger nil-page and MAP_FIXED.
++ */
++ if ((shmflg & SHM_RND) && addr >= shmlba)
++ addr &= ~(shmlba - 1);
+ else
+ #ifndef __ARCH_FORCE_SHMLBA
+ if (addr & ~PAGE_MASK)
--- /dev/null
+From dd8416c47715cf324c9a16f13273f9fda87acfed Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan@kernel.org>
+Date: Fri, 24 Feb 2017 14:59:59 -0800
+Subject: mm: do not access page->mapping directly on page_endio
+
+From: Minchan Kim <minchan@kernel.org>
+
+commit dd8416c47715cf324c9a16f13273f9fda87acfed upstream.
+
+With rw_page, page_endio is used for completing IO on a page and it
+propagates write error to the address space if the IO fails. The
+problem is it accesses page->mapping directly which might be okay for
+file-backed pages but it shouldn't for anonymous page. Otherwise, it
+can corrupt one of field from anon_vma under us and system goes panic
+randomly.
+
+swap_writepage
+ bdev_writepage
+ ops->rw_page
+
+I encountered the BUG during developing new zram feature and it was
+really hard to figure it out because it made random crash, somtime
+mmap_sem lockdep, sometime other places where places never related to
+zram/zsmalloc, and not reproducible with some configuration.
+
+When I consider how that bug is subtle and people do fast-swap test with
+brd, it's worth to add stable mark, I think.
+
+Fixes: dd6bd0d9c7db ("swap: use bdev_read_page() / bdev_write_page()")
+Signed-off-by: Minchan Kim <minchan@kernel.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/filemap.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -865,9 +865,12 @@ void page_endio(struct page *page, int r
+ unlock_page(page);
+ } else { /* rw == WRITE */
+ if (err) {
++ struct address_space *mapping;
++
+ SetPageError(page);
+- if (page->mapping)
+- mapping_set_error(page->mapping, err);
++ mapping = page_mapping(page);
++ if (mapping)
++ mapping_set_error(mapping, err);
+ }
+ end_page_writeback(page);
+ }
--- /dev/null
+From e02dc017c3032dcdce1b993af0db135462e1b4b7 Mon Sep 17 00:00:00 2001
+From: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Date: Fri, 24 Feb 2017 14:59:33 -0800
+Subject: mm/page_alloc: fix nodes for reclaim in fast path
+
+From: Gavin Shan <gwshan@linux.vnet.ibm.com>
+
+commit e02dc017c3032dcdce1b993af0db135462e1b4b7 upstream.
+
+When @node_reclaim_node isn't 0, the page allocator tries to reclaim
+pages if the amount of free memory in the zones are below the low
+watermark. On Power platform, none of NUMA nodes are scanned for page
+reclaim because no nodes match the condition in zone_allows_reclaim().
+On Power platform, RECLAIM_DISTANCE is set to 10 which is the distance
+of Node-A to Node-A. So the preferred node even won't be scanned for
+page reclaim.
+
+ __alloc_pages_nodemask()
+ get_page_from_freelist()
+ zone_allows_reclaim()
+
+Anton proposed the test code as below:
+
+ # cat alloc.c
+ :
+ int main(int argc, char *argv[])
+ {
+ void *p;
+ unsigned long size;
+ unsigned long start, end;
+
+ start = time(NULL);
+ size = strtoul(argv[1], NULL, 0);
+ printf("To allocate %ldGB memory\n", size);
+
+ size <<= 30;
+ p = malloc(size);
+ assert(p);
+ memset(p, 0, size);
+
+ end = time(NULL);
+ printf("Used time: %ld seconds\n", end - start);
+ sleep(3600);
+ return 0;
+ }
+
+The system I use for testing has two NUMA nodes. Both have 128GB
+memory. In below scnario, the page caches on node#0 should be reclaimed
+when it encounters pressure to accommodate request of allocation.
+
+ # echo 2 > /proc/sys/vm/zone_reclaim_mode; \
+ sync; \
+ echo 3 > /proc/sys/vm/drop_caches; \
+ # taskset -c 0 cat file.32G > /dev/null; \
+ grep FilePages /sys/devices/system/node/node0/meminfo
+ Node 0 FilePages: 33619712 kB
+ # taskset -c 0 ./alloc 128
+ # grep FilePages /sys/devices/system/node/node0/meminfo
+ Node 0 FilePages: 33619840 kB
+ # grep MemFree /sys/devices/system/node/node0/meminfo
+ Node 0 MemFree: 186816 kB
+
+With the patch applied, the pagecache on node-0 is reclaimed when its
+free memory is running out. It's the expected behaviour.
+
+ # echo 2 > /proc/sys/vm/zone_reclaim_mode; \
+ sync; \
+ echo 3 > /proc/sys/vm/drop_caches
+ # taskset -c 0 cat file.32G > /dev/null; \
+ grep FilePages /sys/devices/system/node/node0/meminfo
+ Node 0 FilePages: 33605568 kB
+ # taskset -c 0 ./alloc 128
+ # grep FilePages /sys/devices/system/node/node0/meminfo
+ Node 0 FilePages: 1379520 kB
+ # grep MemFree /sys/devices/system/node/node0/meminfo
+ Node 0 MemFree: 317120 kB
+
+Fixes: 5f7a75acdb24 ("mm: page_alloc: do not cache reclaim distances")
+Link: http://lkml.kernel.org/r/1486532455-29613-1-git-send-email-gwshan@linux.vnet.ibm.com
+Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2467,7 +2467,7 @@ static bool zone_local(struct zone *loca
+
+ static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone)
+ {
+- return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <
++ return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <=
+ RECLAIM_DISTANCE;
+ }
+ #else /* CONFIG_NUMA */
--- /dev/null
+From e1587a4945408faa58d0485002c110eb2454740c Mon Sep 17 00:00:00 2001
+From: Vinayak Menon <vinmenon@codeaurora.org>
+Date: Fri, 24 Feb 2017 14:59:39 -0800
+Subject: mm: vmpressure: fix sending wrong events on underflow
+
+From: Vinayak Menon <vinmenon@codeaurora.org>
+
+commit e1587a4945408faa58d0485002c110eb2454740c upstream.
+
+At the end of a window period, if the reclaimed pages is greater than
+scanned, an unsigned underflow can result in a huge pressure value and
+thus a critical event. Reclaimed pages is found to go higher than
+scanned because of the addition of reclaimed slab pages to reclaimed in
+shrink_node without a corresponding increment to scanned pages.
+
+Minchan Kim mentioned that this can also happen in the case of a THP
+page where the scanned is 1 and reclaimed could be 512.
+
+Link: http://lkml.kernel.org/r/1486641577-11685-1-git-send-email-vinmenon@codeaurora.org
+Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
+Cc: Shiraz Hashim <shashim@codeaurora.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmpressure.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/mm/vmpressure.c
++++ b/mm/vmpressure.c
+@@ -112,9 +112,16 @@ static enum vmpressure_levels vmpressure
+ unsigned long reclaimed)
+ {
+ unsigned long scale = scanned + reclaimed;
+- unsigned long pressure;
++ unsigned long pressure = 0;
+
+ /*
++ * reclaimed can be greater than scanned in cases
++ * like THP, where the scanned is 1 and reclaimed
++ * could be 512
++ */
++ if (reclaimed >= scanned)
++ goto out;
++ /*
+ * We calculate the ratio (in percents) of how many pages were
+ * scanned vs. reclaimed in a given time frame (window). Note that
+ * time is in VM reclaimer's "ticks", i.e. number of pages
+@@ -124,6 +131,7 @@ static enum vmpressure_levels vmpressure
+ pressure = scale - (reclaimed * scale / scanned);
+ pressure = pressure * 100 / scale;
+
++out:
+ pr_debug("%s: %3lu (s: %lu r: %lu)\n", __func__, pressure,
+ scanned, reclaimed);
+
--- /dev/null
+From c421530bf848604e97d0785a03b3fe2c62775083 Mon Sep 17 00:00:00 2001
+From: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Date: Thu, 16 Feb 2017 12:51:21 -0800
+Subject: scsi: aacraid: Reorder Adapter status check
+
+From: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+
+commit c421530bf848604e97d0785a03b3fe2c62775083 upstream.
+
+The driver currently checks the SELF_TEST_FAILED first and then
+KERNEL_PANIC next. Under error conditions(boot code failure) both
+SELF_TEST_FAILED and KERNEL_PANIC can be set at the same time.
+
+The driver has the capability to reset the controller on an KERNEL_PANIC,
+but not on SELF_TEST_FAILED.
+
+Fixed by first checking KERNEL_PANIC and then the others.
+
+Fixes: e8b12f0fb835223752 ([SCSI] aacraid: Add new code for PMC-Sierra's SRC base controller family)
+Signed-off-by: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Reviewed-by: David Carroll <David.Carroll@microsemi.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/aacraid/src.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/aacraid/src.c
++++ b/drivers/scsi/aacraid/src.c
+@@ -413,16 +413,23 @@ static int aac_src_check_health(struct a
+ u32 status = src_readl(dev, MUnit.OMR);
+
+ /*
++ * Check to see if the board panic'd.
++ */
++ if (unlikely(status & KERNEL_PANIC))
++ goto err_blink;
++
++ /*
+ * Check to see if the board failed any self tests.
+ */
+ if (unlikely(status & SELF_TEST_FAILED))
+- return -1;
++ goto err_out;
+
+ /*
+- * Check to see if the board panic'd.
++ * Check to see if the board failed any self tests.
+ */
+- if (unlikely(status & KERNEL_PANIC))
+- return (status >> 16) & 0xFF;
++ if (unlikely(status & MONITOR_PANIC))
++ goto err_out;
++
+ /*
+ * Wait for the adapter to be up and running.
+ */
+@@ -432,6 +439,12 @@ static int aac_src_check_health(struct a
+ * Everything is OK
+ */
+ return 0;
++
++err_out:
++ return -1;
++
++err_blink:
++ return (status > 16) & 0xFF;
+ }
+
+ /**
--- /dev/null
+From bba5dc332ec2d3a685cb4dae668c793f6a3713a3 Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Wed, 14 Dec 2016 18:46:02 -0800
+Subject: scsi: storvsc: properly handle SRB_ERROR when sense message is present
+
+From: Long Li <longli@microsoft.com>
+
+commit bba5dc332ec2d3a685cb4dae668c793f6a3713a3 upstream.
+
+When sense message is present on error, we should pass along to the upper
+layer to decide how to deal with the error.
+This patch fixes connectivity issues with Fiber Channel devices.
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -866,6 +866,13 @@ static void storvsc_handle_error(struct
+ switch (SRB_STATUS(vm_srb->srb_status)) {
+ case SRB_STATUS_ERROR:
+ /*
++ * Let upper layer deal with error when
++ * sense message is present.
++ */
++
++ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID)
++ break;
++ /*
+ * If there is an error; offline the device since all
+ * error recovery strategies would have already been
+ * deployed on the host side. However, if the command
--- /dev/null
+From 40630f462824ee24bc00d692865c86c3828094e0 Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Wed, 14 Dec 2016 18:46:03 -0800
+Subject: scsi: storvsc: properly set residual data length on errors
+
+From: Long Li <longli@microsoft.com>
+
+commit 40630f462824ee24bc00d692865c86c3828094e0 upstream.
+
+On I/O errors, the Windows driver doesn't set data_transfer_length
+on error conditions other than SRB_STATUS_DATA_OVERRUN.
+In these cases we need to set data_transfer_length to 0,
+indicating there is no data transferred. On SRB_STATUS_DATA_OVERRUN,
+data_transfer_length is set by the Windows driver to the actual data transferred.
+
+Reported-by: Shiva Krishna <Shiva.Krishna@nimblestorage.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -356,6 +356,7 @@ enum storvsc_request_type {
+ #define SRB_STATUS_SUCCESS 0x01
+ #define SRB_STATUS_ABORTED 0x02
+ #define SRB_STATUS_ERROR 0x04
++#define SRB_STATUS_DATA_OVERRUN 0x12
+
+ #define SRB_STATUS(status) \
+ (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN))
+@@ -936,6 +937,7 @@ static void storvsc_command_completion(s
+ struct hv_host_device *host_dev = shost_priv(scmnd->device->host);
+ struct scsi_sense_hdr sense_hdr;
+ struct vmscsi_request *vm_srb;
++ u32 data_transfer_length;
+ struct Scsi_Host *host;
+ struct storvsc_device *stor_dev;
+ struct hv_device *dev = host_dev->dev;
+@@ -946,6 +948,7 @@ static void storvsc_command_completion(s
+ host = stor_dev->host;
+
+ vm_srb = &cmd_request->vstor_packet.vm_srb;
++ data_transfer_length = vm_srb->data_transfer_length;
+
+ scmnd->result = vm_srb->scsi_status;
+
+@@ -956,13 +959,20 @@ static void storvsc_command_completion(s
+ &sense_hdr);
+ }
+
+- if (vm_srb->srb_status != SRB_STATUS_SUCCESS)
++ if (vm_srb->srb_status != SRB_STATUS_SUCCESS) {
+ storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc,
+ sense_hdr.ascq);
++ /*
++ * The Windows driver set data_transfer_length on
++ * SRB_STATUS_DATA_OVERRUN. On other errors, this value
++ * is untouched. In these cases we set it to 0.
++ */
++ if (vm_srb->srb_status != SRB_STATUS_DATA_OVERRUN)
++ data_transfer_length = 0;
++ }
+
+ scsi_set_resid(scmnd,
+- cmd_request->payload->range.len -
+- vm_srb->data_transfer_length);
++ cmd_request->payload->range.len - data_transfer_length);
+
+ scmnd->scsi_done(scmnd);
+
--- /dev/null
+From 3cd6d3d9b1abab8dcdf0800224ce26daac24eea2 Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Wed, 14 Dec 2016 18:46:01 -0800
+Subject: scsi: storvsc: use tagged SRB requests if supported by the device
+
+From: Long Li <longli@microsoft.com>
+
+commit 3cd6d3d9b1abab8dcdf0800224ce26daac24eea2 upstream.
+
+Properly set SRB flags when hosting device supports tagged queuing.
+This patch improves the performance on Fiber Channel disks.
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -135,6 +135,8 @@ struct hv_fc_wwn_packet {
+ #define SRB_FLAGS_PORT_DRIVER_RESERVED 0x0F000000
+ #define SRB_FLAGS_CLASS_DRIVER_RESERVED 0xF0000000
+
++#define SP_UNTAGGED ((unsigned char) ~0)
++#define SRB_SIMPLE_TAG_REQUEST 0x20
+
+ /*
+ * Platform neutral description of a scsi request -
+@@ -1409,6 +1411,13 @@ static int storvsc_queuecommand(struct S
+ vm_srb->win8_extension.srb_flags |=
+ SRB_FLAGS_DISABLE_SYNCH_TRANSFER;
+
++ if (scmnd->device->tagged_supported) {
++ vm_srb->win8_extension.srb_flags |=
++ (SRB_FLAGS_QUEUE_ACTION_ENABLE | SRB_FLAGS_NO_QUEUE_FREEZE);
++ vm_srb->win8_extension.queue_tag = SP_UNTAGGED;
++ vm_srb->win8_extension.queue_action = SRB_SIMPLE_TAG_REQUEST;
++ }
++
+ /* Build the SRB */
+ switch (scmnd->sc_data_direction) {
+ case DMA_TO_DEVICE:
--- /dev/null
+From 857de6e00778738dc3d61f75acbac35bdc48e533 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Fri, 17 Feb 2017 09:02:45 +0100
+Subject: scsi: use 'scsi_device_from_queue()' for scsi_dh
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 857de6e00778738dc3d61f75acbac35bdc48e533 upstream.
+
+The device handler needs to check if a given queue belongs to a scsi
+device; only then does it make sense to attach a device handler.
+
+[mkp: dropped flags]
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_dh.c | 22 ++++------------------
+ drivers/scsi/scsi_lib.c | 23 +++++++++++++++++++++++
+ include/scsi/scsi_device.h | 1 +
+ 3 files changed, 28 insertions(+), 18 deletions(-)
+
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -289,20 +289,6 @@ int scsi_unregister_device_handler(struc
+ }
+ EXPORT_SYMBOL_GPL(scsi_unregister_device_handler);
+
+-static struct scsi_device *get_sdev_from_queue(struct request_queue *q)
+-{
+- struct scsi_device *sdev;
+- unsigned long flags;
+-
+- spin_lock_irqsave(q->queue_lock, flags);
+- sdev = q->queuedata;
+- if (!sdev || !get_device(&sdev->sdev_gendev))
+- sdev = NULL;
+- spin_unlock_irqrestore(q->queue_lock, flags);
+-
+- return sdev;
+-}
+-
+ /*
+ * scsi_dh_activate - activate the path associated with the scsi_device
+ * corresponding to the given request queue.
+@@ -321,7 +307,7 @@ int scsi_dh_activate(struct request_queu
+ struct scsi_device *sdev;
+ int err = SCSI_DH_NOSYS;
+
+- sdev = get_sdev_from_queue(q);
++ sdev = scsi_device_from_queue(q);
+ if (!sdev) {
+ if (fn)
+ fn(data, err);
+@@ -368,7 +354,7 @@ int scsi_dh_set_params(struct request_qu
+ struct scsi_device *sdev;
+ int err = -SCSI_DH_NOSYS;
+
+- sdev = get_sdev_from_queue(q);
++ sdev = scsi_device_from_queue(q);
+ if (!sdev)
+ return err;
+
+@@ -391,7 +377,7 @@ int scsi_dh_attach(struct request_queue
+ struct scsi_device_handler *scsi_dh;
+ int err = 0;
+
+- sdev = get_sdev_from_queue(q);
++ sdev = scsi_device_from_queue(q);
+ if (!sdev)
+ return -ENODEV;
+
+@@ -429,7 +415,7 @@ const char *scsi_dh_attached_handler_nam
+ struct scsi_device *sdev;
+ const char *handler_name = NULL;
+
+- sdev = get_sdev_from_queue(q);
++ sdev = scsi_device_from_queue(q);
+ if (!sdev)
+ return NULL;
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2215,6 +2215,29 @@ void scsi_mq_destroy_tags(struct Scsi_Ho
+ blk_mq_free_tag_set(&shost->tag_set);
+ }
+
++/**
++ * scsi_device_from_queue - return sdev associated with a request_queue
++ * @q: The request queue to return the sdev from
++ *
++ * Return the sdev associated with a request queue or NULL if the
++ * request_queue does not reference a SCSI device.
++ */
++struct scsi_device *scsi_device_from_queue(struct request_queue *q)
++{
++ struct scsi_device *sdev = NULL;
++
++ if (q->mq_ops) {
++ if (q->mq_ops == &scsi_mq_ops)
++ sdev = q->queuedata;
++ } else if (q->request_fn == scsi_request_fn)
++ sdev = q->queuedata;
++ if (!sdev || !get_device(&sdev->sdev_gendev))
++ sdev = NULL;
++
++ return sdev;
++}
++EXPORT_SYMBOL_GPL(scsi_device_from_queue);
++
+ /*
+ * Function: scsi_block_requests()
+ *
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -307,6 +307,7 @@ extern void scsi_remove_device(struct sc
+ extern int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh);
+ void scsi_attach_vpd(struct scsi_device *sdev);
+
++extern struct scsi_device *scsi_device_from_queue(struct request_queue *q);
+ extern int scsi_device_get(struct scsi_device *);
+ extern void scsi_device_put(struct scsi_device *);
+ extern struct scsi_device *scsi_device_lookup(struct Scsi_Host *,
--- /dev/null
+From eb72d0bb84eee5d0dc3044fd17b75e7101dabb57 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Tue, 26 Apr 2016 08:06:58 +0200
+Subject: sd: get disk reference in sd_check_events()
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit eb72d0bb84eee5d0dc3044fd17b75e7101dabb57 upstream.
+
+sd_check_events() is called asynchronously, and might race
+with device removal. So always take a disk reference when
+processing the event to avoid the device being removed while
+the event is processed.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Jinpu Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1398,11 +1398,15 @@ static int media_not_present(struct scsi
+ **/
+ static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing)
+ {
+- struct scsi_disk *sdkp = scsi_disk(disk);
+- struct scsi_device *sdp = sdkp->device;
++ struct scsi_disk *sdkp = scsi_disk_get(disk);
++ struct scsi_device *sdp;
+ struct scsi_sense_hdr *sshdr = NULL;
+ int retval;
+
++ if (!sdkp)
++ return 0;
++
++ sdp = sdkp->device;
+ SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_check_events\n"));
+
+ /*
+@@ -1459,6 +1463,7 @@ out:
+ kfree(sshdr);
+ retval = sdp->changed ? DISK_EVENT_MEDIA_CHANGE : 0;
+ sdp->changed = 0;
++ scsi_disk_put(sdkp);
+ return retval;
+ }
+
iommu-vt-d-fix-some-macros-that-are-incorrectly-specified-in-intel-iommu.patch
iommu-vt-d-tylersburg-isoch-identity-map-check-is-done-too-late.patch
cifs-fix-splice-read-for-non-cached-files.patch
+mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch
+mm-vmpressure-fix-sending-wrong-events-on-underflow.patch
+mm-do-not-access-page-mapping-directly-on-page_endio.patch
+ipc-shm-fix-shmat-mmap-nil-page-protection.patch
+dm-cache-fix-corruption-seen-when-using-cache-2tb.patch
+dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch
+scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch
+scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch
+scsi-storvsc-properly-set-residual-data-length-on-errors.patch
+scsi-aacraid-reorder-adapter-status-check.patch
+scsi-use-scsi_device_from_queue-for-scsi_dh.patch
+sd-get-disk-reference-in-sd_check_events.patch
+fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
