From: Greg Kroah-Hartman Date: Wed, 8 Mar 2017 13:12:35 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.53~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aaa63ff21bf98a86fb10db67554ee6690dfca46b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: dm-cache-fix-corruption-seen-when-using-cache-2tb.patch dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch ipc-shm-fix-shmat-mmap-nil-page-protection.patch mm-do-not-access-page-mapping-directly-on-page_endio.patch mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch mm-vmpressure-fix-sending-wrong-events-on-underflow.patch scsi-aacraid-reorder-adapter-status-check.patch scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch scsi-storvsc-properly-set-residual-data-length-on-errors.patch scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch scsi-use-scsi_device_from_queue-for-scsi_dh.patch sd-get-disk-reference-in-sd_check_events.patch --- diff --git a/queue-4.4/dm-cache-fix-corruption-seen-when-using-cache-2tb.patch b/queue-4.4/dm-cache-fix-corruption-seen-when-using-cache-2tb.patch new file mode 100644 index 00000000000..7b905d628d6 --- /dev/null +++ b/queue-4.4/dm-cache-fix-corruption-seen-when-using-cache-2tb.patch @@ -0,0 +1,47 @@ +From ca763d0a53b264a650342cee206512bc92ac7050 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Thu, 9 Feb 2017 11:46:18 -0500 +Subject: dm cache: fix corruption seen when using cache > 2TB + +From: Joe Thornber + +commit ca763d0a53b264a650342cee206512bc92ac7050 upstream. + +A rounding bug due to compiler generated temporary being 32bit was found +in remap_to_cache(). A localized cast in remap_to_cache() fixes the +corruption but this preferred fix (changing from uint32_t to sector_t) +eliminates potential for future rounding errors elsewhere. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -251,7 +251,7 @@ struct cache { + /* + * Fields for converting from sectors to blocks. + */ +- uint32_t sectors_per_block; ++ sector_t sectors_per_block; + int sectors_per_block_shift; + + spinlock_t lock; +@@ -3547,11 +3547,11 @@ static void cache_status(struct dm_targe + + residency = policy_residency(cache->policy); + +- DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ", ++ DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ", + (unsigned)DM_CACHE_METADATA_BLOCK_SIZE, + (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata), + (unsigned long long)nr_blocks_metadata, +- cache->sectors_per_block, ++ (unsigned long long)cache->sectors_per_block, + (unsigned long long) from_cblock(residency), + (unsigned long long) from_cblock(cache->cache_size), + (unsigned) atomic_read(&cache->stats.read_hit), diff --git a/queue-4.4/dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch b/queue-4.4/dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch new file mode 100644 index 00000000000..a9c8dcb6704 --- /dev/null +++ b/queue-4.4/dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch @@ -0,0 +1,28 @@ +From 6085831883c25860264721df15f05bbded45e2a2 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Wed, 15 Feb 2017 12:06:19 -0500 +Subject: dm stats: fix a leaked s->histogram_boundaries array + +From: Mikulas Patocka + +commit 6085831883c25860264721df15f05bbded45e2a2 upstream. + +Fixes: dfcfac3e4cd9 ("dm stats: collect and report histogram of IO latencies") +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-stats.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -175,6 +175,7 @@ static void dm_stat_free(struct rcu_head + int cpu; + struct dm_stat *s = container_of(head, struct dm_stat, rcu_head); + ++ kfree(s->histogram_boundaries); + kfree(s->program_id); + kfree(s->aux_data); + for_each_possible_cpu(cpu) { diff --git a/queue-4.4/fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch b/queue-4.4/fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch new file mode 100644 index 00000000000..b90cf7f1cc0 --- /dev/null +++ b/queue-4.4/fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch @@ -0,0 +1,53 @@ +From 907565337ebf998a68cb5c5b2174ce5e5da065eb Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Thu, 3 Nov 2016 10:29:28 -0600 +Subject: Fix: Disable sys_membarrier when nohz_full is enabled + +From: Mathieu Desnoyers + +commit 907565337ebf998a68cb5c5b2174ce5e5da065eb upstream. + +Userspace applications should be allowed to expect the membarrier system +call with MEMBARRIER_CMD_SHARED command to issue memory barriers on +nohz_full CPUs, but synchronize_sched() does not take those into +account. + +Given that we do not want unrelated processes to be able to affect +real-time sensitive nohz_full CPUs, simply return ENOSYS when membarrier +is invoked on a kernel with enabled nohz_full CPUs. + +Signed-off-by: Mathieu Desnoyers +CC: Josh Triplett +CC: Steven Rostedt +Signed-off-by: Paul E. McKenney +Cc: Frederic Weisbecker +Cc: Chris Metcalf +Cc: Rik van Riel +Acked-by: Lai Jiangshan +Reviewed-by: Josh Triplett +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/membarrier.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/membarrier.c ++++ b/kernel/membarrier.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + + /* + * Bitmask made from a "or" of all commands within enum membarrier_cmd, +@@ -51,6 +52,9 @@ + */ + SYSCALL_DEFINE2(membarrier, int, cmd, int, flags) + { ++ /* MEMBARRIER_CMD_SHARED is not compatible with nohz_full. */ ++ if (tick_nohz_full_enabled()) ++ return -ENOSYS; + if (unlikely(flags)) + return -EINVAL; + switch (cmd) { diff --git a/queue-4.4/ipc-shm-fix-shmat-mmap-nil-page-protection.patch b/queue-4.4/ipc-shm-fix-shmat-mmap-nil-page-protection.patch new file mode 100644 index 00000000000..4e2e1ffdad0 --- /dev/null +++ b/queue-4.4/ipc-shm-fix-shmat-mmap-nil-page-protection.patch @@ -0,0 +1,75 @@ +From 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 Mon Sep 17 00:00:00 2001 +From: Davidlohr Bueso +Date: Mon, 27 Feb 2017 14:28:24 -0800 +Subject: ipc/shm: Fix shmat mmap nil-page protection + +From: Davidlohr Bueso + +commit 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 upstream. + +The issue is described here, with a nice testcase: + + https://bugzilla.kernel.org/show_bug.cgi?id=192931 + +The problem is that shmat() calls do_mmap_pgoff() with MAP_FIXED, and +the address rounded down to 0. For the regular mmap case, the +protection mentioned above is that the kernel gets to generate the +address -- arch_get_unmapped_area() will always check for MAP_FIXED and +return that address. So by the time we do security_mmap_addr(0) things +get funky for shmat(). + +The testcase itself shows that while a regular user crashes, root will +not have a problem attaching a nil-page. There are two possible fixes +to this. The first, and which this patch does, is to simply allow root +to crash as well -- this is also regular mmap behavior, ie when hacking +up the testcase and adding mmap(... |MAP_FIXED). While this approach +is the safer option, the second alternative is to ignore SHM_RND if the +rounded address is 0, thus only having MAP_SHARED flags. This makes the +behavior of shmat() identical to the mmap() case. The downside of this +is obviously user visible, but does make sense in that it maintains +semantics after the round-down wrt 0 address and mmap. + +Passes shm related ltp tests. + +Link: http://lkml.kernel.org/r/1486050195-18629-1-git-send-email-dave@stgolabs.net +Signed-off-by: Davidlohr Bueso +Reported-by: Gareth Evans +Cc: Manfred Spraul +Cc: Michael Kerrisk +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/shm.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -1083,8 +1083,8 @@ out_unlock1: + * "raddr" thing points to kernel space, and there has to be a wrapper around + * this. + */ +-long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, +- unsigned long shmlba) ++long do_shmat(int shmid, char __user *shmaddr, int shmflg, ++ ulong *raddr, unsigned long shmlba) + { + struct shmid_kernel *shp; + unsigned long addr; +@@ -1105,8 +1105,13 @@ long do_shmat(int shmid, char __user *sh + goto out; + else if ((addr = (ulong)shmaddr)) { + if (addr & (shmlba - 1)) { +- if (shmflg & SHM_RND) +- addr &= ~(shmlba - 1); /* round down */ ++ /* ++ * Round down to the nearest multiple of shmlba. ++ * For sane do_mmap_pgoff() parameters, avoid ++ * round downs that trigger nil-page and MAP_FIXED. ++ */ ++ if ((shmflg & SHM_RND) && addr >= shmlba) ++ addr &= ~(shmlba - 1); + else + #ifndef __ARCH_FORCE_SHMLBA + if (addr & ~PAGE_MASK) diff --git a/queue-4.4/mm-do-not-access-page-mapping-directly-on-page_endio.patch b/queue-4.4/mm-do-not-access-page-mapping-directly-on-page_endio.patch new file mode 100644 index 00000000000..8dc0331d04c --- /dev/null +++ b/queue-4.4/mm-do-not-access-page-mapping-directly-on-page_endio.patch @@ -0,0 +1,57 @@ +From dd8416c47715cf324c9a16f13273f9fda87acfed Mon Sep 17 00:00:00 2001 +From: Minchan Kim +Date: Fri, 24 Feb 2017 14:59:59 -0800 +Subject: mm: do not access page->mapping directly on page_endio + +From: Minchan Kim + +commit dd8416c47715cf324c9a16f13273f9fda87acfed upstream. + +With rw_page, page_endio is used for completing IO on a page and it +propagates write error to the address space if the IO fails. The +problem is it accesses page->mapping directly which might be okay for +file-backed pages but it shouldn't for anonymous page. Otherwise, it +can corrupt one of field from anon_vma under us and system goes panic +randomly. + +swap_writepage + bdev_writepage + ops->rw_page + +I encountered the BUG during developing new zram feature and it was +really hard to figure it out because it made random crash, somtime +mmap_sem lockdep, sometime other places where places never related to +zram/zsmalloc, and not reproducible with some configuration. + +When I consider how that bug is subtle and people do fast-swap test with +brd, it's worth to add stable mark, I think. + +Fixes: dd6bd0d9c7db ("swap: use bdev_read_page() / bdev_write_page()") +Signed-off-by: Minchan Kim +Acked-by: Michal Hocko +Cc: Matthew Wilcox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/filemap.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -865,9 +865,12 @@ void page_endio(struct page *page, int r + unlock_page(page); + } else { /* rw == WRITE */ + if (err) { ++ struct address_space *mapping; ++ + SetPageError(page); +- if (page->mapping) +- mapping_set_error(page->mapping, err); ++ mapping = page_mapping(page); ++ if (mapping) ++ mapping_set_error(mapping, err); + } + end_page_writeback(page); + } diff --git a/queue-4.4/mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch b/queue-4.4/mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch new file mode 100644 index 00000000000..a99c2a13a29 --- /dev/null +++ b/queue-4.4/mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch @@ -0,0 +1,103 @@ +From e02dc017c3032dcdce1b993af0db135462e1b4b7 Mon Sep 17 00:00:00 2001 +From: Gavin Shan +Date: Fri, 24 Feb 2017 14:59:33 -0800 +Subject: mm/page_alloc: fix nodes for reclaim in fast path + +From: Gavin Shan + +commit e02dc017c3032dcdce1b993af0db135462e1b4b7 upstream. + +When @node_reclaim_node isn't 0, the page allocator tries to reclaim +pages if the amount of free memory in the zones are below the low +watermark. On Power platform, none of NUMA nodes are scanned for page +reclaim because no nodes match the condition in zone_allows_reclaim(). +On Power platform, RECLAIM_DISTANCE is set to 10 which is the distance +of Node-A to Node-A. So the preferred node even won't be scanned for +page reclaim. + + __alloc_pages_nodemask() + get_page_from_freelist() + zone_allows_reclaim() + +Anton proposed the test code as below: + + # cat alloc.c + : + int main(int argc, char *argv[]) + { + void *p; + unsigned long size; + unsigned long start, end; + + start = time(NULL); + size = strtoul(argv[1], NULL, 0); + printf("To allocate %ldGB memory\n", size); + + size <<= 30; + p = malloc(size); + assert(p); + memset(p, 0, size); + + end = time(NULL); + printf("Used time: %ld seconds\n", end - start); + sleep(3600); + return 0; + } + +The system I use for testing has two NUMA nodes. Both have 128GB +memory. In below scnario, the page caches on node#0 should be reclaimed +when it encounters pressure to accommodate request of allocation. + + # echo 2 > /proc/sys/vm/zone_reclaim_mode; \ + sync; \ + echo 3 > /proc/sys/vm/drop_caches; \ + # taskset -c 0 cat file.32G > /dev/null; \ + grep FilePages /sys/devices/system/node/node0/meminfo + Node 0 FilePages: 33619712 kB + # taskset -c 0 ./alloc 128 + # grep FilePages /sys/devices/system/node/node0/meminfo + Node 0 FilePages: 33619840 kB + # grep MemFree /sys/devices/system/node/node0/meminfo + Node 0 MemFree: 186816 kB + +With the patch applied, the pagecache on node-0 is reclaimed when its +free memory is running out. It's the expected behaviour. + + # echo 2 > /proc/sys/vm/zone_reclaim_mode; \ + sync; \ + echo 3 > /proc/sys/vm/drop_caches + # taskset -c 0 cat file.32G > /dev/null; \ + grep FilePages /sys/devices/system/node/node0/meminfo + Node 0 FilePages: 33605568 kB + # taskset -c 0 ./alloc 128 + # grep FilePages /sys/devices/system/node/node0/meminfo + Node 0 FilePages: 1379520 kB + # grep MemFree /sys/devices/system/node/node0/meminfo + Node 0 MemFree: 317120 kB + +Fixes: 5f7a75acdb24 ("mm: page_alloc: do not cache reclaim distances") +Link: http://lkml.kernel.org/r/1486532455-29613-1-git-send-email-gwshan@linux.vnet.ibm.com +Signed-off-by: Gavin Shan +Acked-by: Mel Gorman +Acked-by: Michal Hocko +Cc: Anton Blanchard +Cc: Michael Ellerman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2467,7 +2467,7 @@ static bool zone_local(struct zone *loca + + static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone) + { +- return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) < ++ return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <= + RECLAIM_DISTANCE; + } + #else /* CONFIG_NUMA */ diff --git a/queue-4.4/mm-vmpressure-fix-sending-wrong-events-on-underflow.patch b/queue-4.4/mm-vmpressure-fix-sending-wrong-events-on-underflow.patch new file mode 100644 index 00000000000..217396ea78c --- /dev/null +++ b/queue-4.4/mm-vmpressure-fix-sending-wrong-events-on-underflow.patch @@ -0,0 +1,65 @@ +From e1587a4945408faa58d0485002c110eb2454740c Mon Sep 17 00:00:00 2001 +From: Vinayak Menon +Date: Fri, 24 Feb 2017 14:59:39 -0800 +Subject: mm: vmpressure: fix sending wrong events on underflow + +From: Vinayak Menon + +commit e1587a4945408faa58d0485002c110eb2454740c upstream. + +At the end of a window period, if the reclaimed pages is greater than +scanned, an unsigned underflow can result in a huge pressure value and +thus a critical event. Reclaimed pages is found to go higher than +scanned because of the addition of reclaimed slab pages to reclaimed in +shrink_node without a corresponding increment to scanned pages. + +Minchan Kim mentioned that this can also happen in the case of a THP +page where the scanned is 1 and reclaimed could be 512. + +Link: http://lkml.kernel.org/r/1486641577-11685-1-git-send-email-vinmenon@codeaurora.org +Signed-off-by: Vinayak Menon +Acked-by: Minchan Kim +Acked-by: Michal Hocko +Cc: Johannes Weiner +Cc: Mel Gorman +Cc: Vlastimil Babka +Cc: Rik van Riel +Cc: Vladimir Davydov +Cc: Anton Vorontsov +Cc: Shiraz Hashim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmpressure.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/mm/vmpressure.c ++++ b/mm/vmpressure.c +@@ -112,9 +112,16 @@ static enum vmpressure_levels vmpressure + unsigned long reclaimed) + { + unsigned long scale = scanned + reclaimed; +- unsigned long pressure; ++ unsigned long pressure = 0; + + /* ++ * reclaimed can be greater than scanned in cases ++ * like THP, where the scanned is 1 and reclaimed ++ * could be 512 ++ */ ++ if (reclaimed >= scanned) ++ goto out; ++ /* + * We calculate the ratio (in percents) of how many pages were + * scanned vs. reclaimed in a given time frame (window). Note that + * time is in VM reclaimer's "ticks", i.e. number of pages +@@ -124,6 +131,7 @@ static enum vmpressure_levels vmpressure + pressure = scale - (reclaimed * scale / scanned); + pressure = pressure * 100 / scale; + ++out: + pr_debug("%s: %3lu (s: %lu r: %lu)\n", __func__, pressure, + scanned, reclaimed); + diff --git a/queue-4.4/scsi-aacraid-reorder-adapter-status-check.patch b/queue-4.4/scsi-aacraid-reorder-adapter-status-check.patch new file mode 100644 index 00000000000..9805f8353a6 --- /dev/null +++ b/queue-4.4/scsi-aacraid-reorder-adapter-status-check.patch @@ -0,0 +1,72 @@ +From c421530bf848604e97d0785a03b3fe2c62775083 Mon Sep 17 00:00:00 2001 +From: Raghava Aditya Renukunta +Date: Thu, 16 Feb 2017 12:51:21 -0800 +Subject: scsi: aacraid: Reorder Adapter status check + +From: Raghava Aditya Renukunta + +commit c421530bf848604e97d0785a03b3fe2c62775083 upstream. + +The driver currently checks the SELF_TEST_FAILED first and then +KERNEL_PANIC next. Under error conditions(boot code failure) both +SELF_TEST_FAILED and KERNEL_PANIC can be set at the same time. + +The driver has the capability to reset the controller on an KERNEL_PANIC, +but not on SELF_TEST_FAILED. + +Fixed by first checking KERNEL_PANIC and then the others. + +Fixes: e8b12f0fb835223752 ([SCSI] aacraid: Add new code for PMC-Sierra's SRC base controller family) +Signed-off-by: Raghava Aditya Renukunta +Reviewed-by: David Carroll +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aacraid/src.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -413,16 +413,23 @@ static int aac_src_check_health(struct a + u32 status = src_readl(dev, MUnit.OMR); + + /* ++ * Check to see if the board panic'd. ++ */ ++ if (unlikely(status & KERNEL_PANIC)) ++ goto err_blink; ++ ++ /* + * Check to see if the board failed any self tests. + */ + if (unlikely(status & SELF_TEST_FAILED)) +- return -1; ++ goto err_out; + + /* +- * Check to see if the board panic'd. ++ * Check to see if the board failed any self tests. + */ +- if (unlikely(status & KERNEL_PANIC)) +- return (status >> 16) & 0xFF; ++ if (unlikely(status & MONITOR_PANIC)) ++ goto err_out; ++ + /* + * Wait for the adapter to be up and running. + */ +@@ -432,6 +439,12 @@ static int aac_src_check_health(struct a + * Everything is OK + */ + return 0; ++ ++err_out: ++ return -1; ++ ++err_blink: ++ return (status > 16) & 0xFF; + } + + /** diff --git a/queue-4.4/scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch b/queue-4.4/scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch new file mode 100644 index 00000000000..f106f0a948e --- /dev/null +++ b/queue-4.4/scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch @@ -0,0 +1,39 @@ +From bba5dc332ec2d3a685cb4dae668c793f6a3713a3 Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Wed, 14 Dec 2016 18:46:02 -0800 +Subject: scsi: storvsc: properly handle SRB_ERROR when sense message is present + +From: Long Li + +commit bba5dc332ec2d3a685cb4dae668c793f6a3713a3 upstream. + +When sense message is present on error, we should pass along to the upper +layer to decide how to deal with the error. +This patch fixes connectivity issues with Fiber Channel devices. + +Signed-off-by: Long Li +Reviewed-by: K. Y. Srinivasan +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -866,6 +866,13 @@ static void storvsc_handle_error(struct + switch (SRB_STATUS(vm_srb->srb_status)) { + case SRB_STATUS_ERROR: + /* ++ * Let upper layer deal with error when ++ * sense message is present. ++ */ ++ ++ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) ++ break; ++ /* + * If there is an error; offline the device since all + * error recovery strategies would have already been + * deployed on the host side. However, if the command diff --git a/queue-4.4/scsi-storvsc-properly-set-residual-data-length-on-errors.patch b/queue-4.4/scsi-storvsc-properly-set-residual-data-length-on-errors.patch new file mode 100644 index 00000000000..312861f8957 --- /dev/null +++ b/queue-4.4/scsi-storvsc-properly-set-residual-data-length-on-errors.patch @@ -0,0 +1,76 @@ +From 40630f462824ee24bc00d692865c86c3828094e0 Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Wed, 14 Dec 2016 18:46:03 -0800 +Subject: scsi: storvsc: properly set residual data length on errors + +From: Long Li + +commit 40630f462824ee24bc00d692865c86c3828094e0 upstream. + +On I/O errors, the Windows driver doesn't set data_transfer_length +on error conditions other than SRB_STATUS_DATA_OVERRUN. +In these cases we need to set data_transfer_length to 0, +indicating there is no data transferred. On SRB_STATUS_DATA_OVERRUN, +data_transfer_length is set by the Windows driver to the actual data transferred. + +Reported-by: Shiva Krishna +Signed-off-by: Long Li +Reviewed-by: K. Y. Srinivasan +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -356,6 +356,7 @@ enum storvsc_request_type { + #define SRB_STATUS_SUCCESS 0x01 + #define SRB_STATUS_ABORTED 0x02 + #define SRB_STATUS_ERROR 0x04 ++#define SRB_STATUS_DATA_OVERRUN 0x12 + + #define SRB_STATUS(status) \ + (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN)) +@@ -936,6 +937,7 @@ static void storvsc_command_completion(s + struct hv_host_device *host_dev = shost_priv(scmnd->device->host); + struct scsi_sense_hdr sense_hdr; + struct vmscsi_request *vm_srb; ++ u32 data_transfer_length; + struct Scsi_Host *host; + struct storvsc_device *stor_dev; + struct hv_device *dev = host_dev->dev; +@@ -946,6 +948,7 @@ static void storvsc_command_completion(s + host = stor_dev->host; + + vm_srb = &cmd_request->vstor_packet.vm_srb; ++ data_transfer_length = vm_srb->data_transfer_length; + + scmnd->result = vm_srb->scsi_status; + +@@ -956,13 +959,20 @@ static void storvsc_command_completion(s + &sense_hdr); + } + +- if (vm_srb->srb_status != SRB_STATUS_SUCCESS) ++ if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { + storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, + sense_hdr.ascq); ++ /* ++ * The Windows driver set data_transfer_length on ++ * SRB_STATUS_DATA_OVERRUN. On other errors, this value ++ * is untouched. In these cases we set it to 0. ++ */ ++ if (vm_srb->srb_status != SRB_STATUS_DATA_OVERRUN) ++ data_transfer_length = 0; ++ } + + scsi_set_resid(scmnd, +- cmd_request->payload->range.len - +- vm_srb->data_transfer_length); ++ cmd_request->payload->range.len - data_transfer_length); + + scmnd->scsi_done(scmnd); + diff --git a/queue-4.4/scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch b/queue-4.4/scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch new file mode 100644 index 00000000000..16680fae7ac --- /dev/null +++ b/queue-4.4/scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch @@ -0,0 +1,47 @@ +From 3cd6d3d9b1abab8dcdf0800224ce26daac24eea2 Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Wed, 14 Dec 2016 18:46:01 -0800 +Subject: scsi: storvsc: use tagged SRB requests if supported by the device + +From: Long Li + +commit 3cd6d3d9b1abab8dcdf0800224ce26daac24eea2 upstream. + +Properly set SRB flags when hosting device supports tagged queuing. +This patch improves the performance on Fiber Channel disks. + +Signed-off-by: Long Li +Reviewed-by: K. Y. Srinivasan +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -135,6 +135,8 @@ struct hv_fc_wwn_packet { + #define SRB_FLAGS_PORT_DRIVER_RESERVED 0x0F000000 + #define SRB_FLAGS_CLASS_DRIVER_RESERVED 0xF0000000 + ++#define SP_UNTAGGED ((unsigned char) ~0) ++#define SRB_SIMPLE_TAG_REQUEST 0x20 + + /* + * Platform neutral description of a scsi request - +@@ -1409,6 +1411,13 @@ static int storvsc_queuecommand(struct S + vm_srb->win8_extension.srb_flags |= + SRB_FLAGS_DISABLE_SYNCH_TRANSFER; + ++ if (scmnd->device->tagged_supported) { ++ vm_srb->win8_extension.srb_flags |= ++ (SRB_FLAGS_QUEUE_ACTION_ENABLE | SRB_FLAGS_NO_QUEUE_FREEZE); ++ vm_srb->win8_extension.queue_tag = SP_UNTAGGED; ++ vm_srb->win8_extension.queue_action = SRB_SIMPLE_TAG_REQUEST; ++ } ++ + /* Build the SRB */ + switch (scmnd->sc_data_direction) { + case DMA_TO_DEVICE: diff --git a/queue-4.4/scsi-use-scsi_device_from_queue-for-scsi_dh.patch b/queue-4.4/scsi-use-scsi_device_from_queue-for-scsi_dh.patch new file mode 100644 index 00000000000..f8b596011a9 --- /dev/null +++ b/queue-4.4/scsi-use-scsi_device_from_queue-for-scsi_dh.patch @@ -0,0 +1,126 @@ +From 857de6e00778738dc3d61f75acbac35bdc48e533 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Fri, 17 Feb 2017 09:02:45 +0100 +Subject: scsi: use 'scsi_device_from_queue()' for scsi_dh + +From: Hannes Reinecke + +commit 857de6e00778738dc3d61f75acbac35bdc48e533 upstream. + +The device handler needs to check if a given queue belongs to a scsi +device; only then does it make sense to attach a device handler. + +[mkp: dropped flags] + +Signed-off-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_dh.c | 22 ++++------------------ + drivers/scsi/scsi_lib.c | 23 +++++++++++++++++++++++ + include/scsi/scsi_device.h | 1 + + 3 files changed, 28 insertions(+), 18 deletions(-) + +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -289,20 +289,6 @@ int scsi_unregister_device_handler(struc + } + EXPORT_SYMBOL_GPL(scsi_unregister_device_handler); + +-static struct scsi_device *get_sdev_from_queue(struct request_queue *q) +-{ +- struct scsi_device *sdev; +- unsigned long flags; +- +- spin_lock_irqsave(q->queue_lock, flags); +- sdev = q->queuedata; +- if (!sdev || !get_device(&sdev->sdev_gendev)) +- sdev = NULL; +- spin_unlock_irqrestore(q->queue_lock, flags); +- +- return sdev; +-} +- + /* + * scsi_dh_activate - activate the path associated with the scsi_device + * corresponding to the given request queue. +@@ -321,7 +307,7 @@ int scsi_dh_activate(struct request_queu + struct scsi_device *sdev; + int err = SCSI_DH_NOSYS; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) { + if (fn) + fn(data, err); +@@ -368,7 +354,7 @@ int scsi_dh_set_params(struct request_qu + struct scsi_device *sdev; + int err = -SCSI_DH_NOSYS; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return err; + +@@ -391,7 +377,7 @@ int scsi_dh_attach(struct request_queue + struct scsi_device_handler *scsi_dh; + int err = 0; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return -ENODEV; + +@@ -429,7 +415,7 @@ const char *scsi_dh_attached_handler_nam + struct scsi_device *sdev; + const char *handler_name = NULL; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return NULL; + +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -2215,6 +2215,29 @@ void scsi_mq_destroy_tags(struct Scsi_Ho + blk_mq_free_tag_set(&shost->tag_set); + } + ++/** ++ * scsi_device_from_queue - return sdev associated with a request_queue ++ * @q: The request queue to return the sdev from ++ * ++ * Return the sdev associated with a request queue or NULL if the ++ * request_queue does not reference a SCSI device. ++ */ ++struct scsi_device *scsi_device_from_queue(struct request_queue *q) ++{ ++ struct scsi_device *sdev = NULL; ++ ++ if (q->mq_ops) { ++ if (q->mq_ops == &scsi_mq_ops) ++ sdev = q->queuedata; ++ } else if (q->request_fn == scsi_request_fn) ++ sdev = q->queuedata; ++ if (!sdev || !get_device(&sdev->sdev_gendev)) ++ sdev = NULL; ++ ++ return sdev; ++} ++EXPORT_SYMBOL_GPL(scsi_device_from_queue); ++ + /* + * Function: scsi_block_requests() + * +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -307,6 +307,7 @@ extern void scsi_remove_device(struct sc + extern int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh); + void scsi_attach_vpd(struct scsi_device *sdev); + ++extern struct scsi_device *scsi_device_from_queue(struct request_queue *q); + extern int scsi_device_get(struct scsi_device *); + extern void scsi_device_put(struct scsi_device *); + extern struct scsi_device *scsi_device_lookup(struct Scsi_Host *, diff --git a/queue-4.4/sd-get-disk-reference-in-sd_check_events.patch b/queue-4.4/sd-get-disk-reference-in-sd_check_events.patch new file mode 100644 index 00000000000..b4b302102c6 --- /dev/null +++ b/queue-4.4/sd-get-disk-reference-in-sd_check_events.patch @@ -0,0 +1,53 @@ +From eb72d0bb84eee5d0dc3044fd17b75e7101dabb57 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Tue, 26 Apr 2016 08:06:58 +0200 +Subject: sd: get disk reference in sd_check_events() + +From: Hannes Reinecke + +commit eb72d0bb84eee5d0dc3044fd17b75e7101dabb57 upstream. + +sd_check_events() is called asynchronously, and might race +with device removal. So always take a disk reference when +processing the event to avoid the device being removed while +the event is processed. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Ewan D. Milne +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Cc: Jinpu Wang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1398,11 +1398,15 @@ static int media_not_present(struct scsi + **/ + static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing) + { +- struct scsi_disk *sdkp = scsi_disk(disk); +- struct scsi_device *sdp = sdkp->device; ++ struct scsi_disk *sdkp = scsi_disk_get(disk); ++ struct scsi_device *sdp; + struct scsi_sense_hdr *sshdr = NULL; + int retval; + ++ if (!sdkp) ++ return 0; ++ ++ sdp = sdkp->device; + SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_check_events\n")); + + /* +@@ -1459,6 +1463,7 @@ out: + kfree(sshdr); + retval = sdp->changed ? DISK_EVENT_MEDIA_CHANGE : 0; + sdp->changed = 0; ++ scsi_disk_put(sdkp); + return retval; + } + diff --git a/queue-4.4/series b/queue-4.4/series index 4e2b1a7ed11..ba065c5ca6a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -26,3 +26,16 @@ regulator-fix-regulator_summary-for-deviceless-consumers.patch iommu-vt-d-fix-some-macros-that-are-incorrectly-specified-in-intel-iommu.patch iommu-vt-d-tylersburg-isoch-identity-map-check-is-done-too-late.patch cifs-fix-splice-read-for-non-cached-files.patch +mm-page_alloc-fix-nodes-for-reclaim-in-fast-path.patch +mm-vmpressure-fix-sending-wrong-events-on-underflow.patch +mm-do-not-access-page-mapping-directly-on-page_endio.patch +ipc-shm-fix-shmat-mmap-nil-page-protection.patch +dm-cache-fix-corruption-seen-when-using-cache-2tb.patch +dm-stats-fix-a-leaked-s-histogram_boundaries-array.patch +scsi-storvsc-use-tagged-srb-requests-if-supported-by-the-device.patch +scsi-storvsc-properly-handle-srb_error-when-sense-message-is-present.patch +scsi-storvsc-properly-set-residual-data-length-on-errors.patch +scsi-aacraid-reorder-adapter-status-check.patch +scsi-use-scsi_device_from_queue-for-scsi_dh.patch +sd-get-disk-reference-in-sd_check_events.patch +fix-disable-sys_membarrier-when-nohz_full-is-enabled.patch