From 21c88c48e5a1565db6b830de11c3f2a97728c07f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 16 Sep 2023 14:20:01 +0200 Subject: [PATCH] 5.15-stable patches added patches: arc-atomics-add-compiler-barrier-to-atomic-operations.patch ata-pata_falcon-fix-io-base-selection-for-q40.patch ata-pata_ftide010-add-missing-module_description.patch ata-sata_gemini-add-missing-module_description.patch btrfs-fix-start-transaction-qgroup-rsv-double-free.patch btrfs-free-qgroup-rsv-on-io-failure.patch dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch jbd2-fix-checkpoint-cleanup-performance-regression.patch lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch --- ...ompiler-barrier-to-atomic-operations.patch | 100 ++++++++++++++ ...falcon-fix-io-base-selection-for-q40.patch | 123 ++++++++++++++++++ ...de010-add-missing-module_description.patch | 34 +++++ ...emini-add-missing-module_description.patch | 34 +++++ ...t-transaction-qgroup-rsv-double-free.patch | 97 ++++++++++++++ .../btrfs-free-qgroup-rsv-on-io-failure.patch | 46 +++++++ ...ination-and-source-data-size-setting.patch | 64 +++++++++ ...d-reserved-gdt-blocks-to-system-zone.patch | 101 ++++++++++++++ ...ng-decrement-in-fuse_direntplus_link.patch | 47 +++++++ ...n-before-removing-it-from-checkpoint.patch | 72 ++++++++++ ...point-cleanup-performance-regression.patch | 123 ++++++++++++++++++ ...initialization-in-test_number_prefix.patch | 53 ++++++++ queue-5.15/series | 12 ++ 13 files changed, 906 insertions(+) create mode 100644 queue-5.15/arc-atomics-add-compiler-barrier-to-atomic-operations.patch create mode 100644 queue-5.15/ata-pata_falcon-fix-io-base-selection-for-q40.patch create mode 100644 queue-5.15/ata-pata_ftide010-add-missing-module_description.patch create mode 100644 queue-5.15/ata-sata_gemini-add-missing-module_description.patch create mode 100644 queue-5.15/btrfs-fix-start-transaction-qgroup-rsv-double-free.patch create mode 100644 queue-5.15/btrfs-free-qgroup-rsv-on-io-failure.patch create mode 100644 queue-5.15/dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch create mode 100644 queue-5.15/ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch create mode 100644 queue-5.15/fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch create mode 100644 queue-5.15/jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch create mode 100644 queue-5.15/jbd2-fix-checkpoint-cleanup-performance-regression.patch create mode 100644 queue-5.15/lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch diff --git a/queue-5.15/arc-atomics-add-compiler-barrier-to-atomic-operations.patch b/queue-5.15/arc-atomics-add-compiler-barrier-to-atomic-operations.patch new file mode 100644 index 00000000000..0b2465de6d2 --- /dev/null +++ b/queue-5.15/arc-atomics-add-compiler-barrier-to-atomic-operations.patch @@ -0,0 +1,100 @@ +From 42f51fb24fd39cc547c086ab3d8a314cc603a91c Mon Sep 17 00:00:00 2001 +From: Pavel Kozlov +Date: Tue, 15 Aug 2023 19:11:36 +0400 +Subject: ARC: atomics: Add compiler barrier to atomic operations... + +From: Pavel Kozlov + +commit 42f51fb24fd39cc547c086ab3d8a314cc603a91c upstream. + +... to avoid unwanted gcc optimizations + +SMP kernels fail to boot with commit 596ff4a09b89 +("cpumask: re-introduce constant-sized cpumask optimizations"). + +| +| percpu: BUG: failure at mm/percpu.c:2981/pcpu_build_alloc_info()! +| + +The write operation performed by the SCOND instruction in the atomic +inline asm code is not properly passed to the compiler. The compiler +cannot correctly optimize a nested loop that runs through the cpumask +in the pcpu_build_alloc_info() function. + +Fix this by add a compiler barrier (memory clobber in inline asm). + +Apparently atomic ops used to have memory clobber implicitly via +surrounding smp_mb(). However commit b64be6836993c431e +("ARC: atomics: implement relaxed variants") removed the smp_mb() for +the relaxed variants, but failed to add the explicit compiler barrier. + +Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/135 +Cc: # v6.3+ +Fixes: b64be6836993c43 ("ARC: atomics: implement relaxed variants") +Signed-off-by: Pavel Kozlov +Signed-off-by: Vineet Gupta +[vgupta: tweaked the changelog and added Fixes tag] +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/include/asm/atomic-llsc.h | 6 +++--- + arch/arc/include/asm/atomic64-arcv2.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/arc/include/asm/atomic-llsc.h ++++ b/arch/arc/include/asm/atomic-llsc.h +@@ -18,7 +18,7 @@ static inline void arch_atomic_##op(int + : [val] "=&r" (val) /* Early clobber to prevent reg reuse */ \ + : [ctr] "r" (&v->counter), /* Not "m": llock only supports reg direct addr mode */ \ + [i] "ir" (i) \ +- : "cc"); \ ++ : "cc", "memory"); \ + } \ + + #define ATOMIC_OP_RETURN(op, c_op, asm_op) \ +@@ -34,7 +34,7 @@ static inline int arch_atomic_##op##_ret + : [val] "=&r" (val) \ + : [ctr] "r" (&v->counter), \ + [i] "ir" (i) \ +- : "cc"); \ ++ : "cc", "memory"); \ + \ + return val; \ + } +@@ -56,7 +56,7 @@ static inline int arch_atomic_fetch_##op + [orig] "=&r" (orig) \ + : [ctr] "r" (&v->counter), \ + [i] "ir" (i) \ +- : "cc"); \ ++ : "cc", "memory"); \ + \ + return orig; \ + } +--- a/arch/arc/include/asm/atomic64-arcv2.h ++++ b/arch/arc/include/asm/atomic64-arcv2.h +@@ -60,7 +60,7 @@ static inline void arch_atomic64_##op(s6 + " bnz 1b \n" \ + : "=&r"(val) \ + : "r"(&v->counter), "ir"(a) \ +- : "cc"); \ ++ : "cc", "memory"); \ + } \ + + #define ATOMIC64_OP_RETURN(op, op1, op2) \ +@@ -77,7 +77,7 @@ static inline s64 arch_atomic64_##op##_r + " bnz 1b \n" \ + : [val] "=&r"(val) \ + : "r"(&v->counter), "ir"(a) \ +- : "cc"); /* memory clobber comes from smp_mb() */ \ ++ : "cc", "memory"); \ + \ + return val; \ + } +@@ -99,7 +99,7 @@ static inline s64 arch_atomic64_fetch_## + " bnz 1b \n" \ + : "=&r"(orig), "=&r"(val) \ + : "r"(&v->counter), "ir"(a) \ +- : "cc"); /* memory clobber comes from smp_mb() */ \ ++ : "cc", "memory"); \ + \ + return orig; \ + } diff --git a/queue-5.15/ata-pata_falcon-fix-io-base-selection-for-q40.patch b/queue-5.15/ata-pata_falcon-fix-io-base-selection-for-q40.patch new file mode 100644 index 00000000000..1c43b9de37e --- /dev/null +++ b/queue-5.15/ata-pata_falcon-fix-io-base-selection-for-q40.patch @@ -0,0 +1,123 @@ +From 8a1f00b753ecfdb117dc1a07e68c46d80e7923ea Mon Sep 17 00:00:00 2001 +From: Michael Schmitz +Date: Sun, 27 Aug 2023 16:13:47 +1200 +Subject: ata: pata_falcon: fix IO base selection for Q40 + +From: Michael Schmitz + +commit 8a1f00b753ecfdb117dc1a07e68c46d80e7923ea upstream. + +With commit 44b1fbc0f5f3 ("m68k/q40: Replace q40ide driver +with pata_falcon and falconide"), the Q40 IDE driver was +replaced by pata_falcon.c. + +Both IO and memory resources were defined for the Q40 IDE +platform device, but definition of the IDE register addresses +was modeled after the Falcon case, both in use of the memory +resources and in including register shift and byte vs. word +offset in the address. + +This was correct for the Falcon case, which does not apply +any address translation to the register addresses. In the +Q40 case, all of device base address, byte access offset +and register shift is included in the platform specific +ISA access translation (in asm/mm_io.h). + +As a consequence, such address translation gets applied +twice, and register addresses are mangled. + +Use the device base address from the platform IO resource +for Q40 (the IO address translation will then add the correct +ISA window base address and byte access offset), with register +shift 1. Use MMIO base address and register shift 2 as before +for Falcon. + +Encode PIO_OFFSET into IO port addresses for all registers +for Q40 except the data transfer register. Encode the MMIO +offset there (pata_falcon_data_xfer() directly uses raw IO +with no address translation). + +Reported-by: William R Sowerbutts +Closes: https://lore.kernel.org/r/CAMuHMdUU62jjunJh9cqSqHT87B0H0A4udOOPs=WN7WZKpcagVA@mail.gmail.com +Link: https://lore.kernel.org/r/CAMuHMdUU62jjunJh9cqSqHT87B0H0A4udOOPs=WN7WZKpcagVA@mail.gmail.com +Fixes: 44b1fbc0f5f3 ("m68k/q40: Replace q40ide driver with pata_falcon and falconide") +Cc: stable@vger.kernel.org +Cc: Finn Thain +Cc: Geert Uytterhoeven +Tested-by: William R Sowerbutts +Signed-off-by: Michael Schmitz +Reviewed-by: Sergey Shtylyov +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_falcon.c | 50 ++++++++++++++++++++++++++-------------------- + 1 file changed, 29 insertions(+), 21 deletions(-) + +--- a/drivers/ata/pata_falcon.c ++++ b/drivers/ata/pata_falcon.c +@@ -123,8 +123,8 @@ static int __init pata_falcon_init_one(s + struct resource *base_res, *ctl_res, *irq_res; + struct ata_host *host; + struct ata_port *ap; +- void __iomem *base; +- int irq = 0; ++ void __iomem *base, *ctl_base; ++ int irq = 0, io_offset = 1, reg_shift = 2; /* Falcon defaults */ + + dev_info(&pdev->dev, "Atari Falcon and Q40/Q60 PATA controller\n"); + +@@ -165,26 +165,34 @@ static int __init pata_falcon_init_one(s + ap->pio_mask = ATA_PIO4; + ap->flags |= ATA_FLAG_SLAVE_POSS | ATA_FLAG_NO_IORDY; + +- base = (void __iomem *)base_mem_res->start; + /* N.B. this assumes data_addr will be used for word-sized I/O only */ +- ap->ioaddr.data_addr = base + 0 + 0 * 4; +- ap->ioaddr.error_addr = base + 1 + 1 * 4; +- ap->ioaddr.feature_addr = base + 1 + 1 * 4; +- ap->ioaddr.nsect_addr = base + 1 + 2 * 4; +- ap->ioaddr.lbal_addr = base + 1 + 3 * 4; +- ap->ioaddr.lbam_addr = base + 1 + 4 * 4; +- ap->ioaddr.lbah_addr = base + 1 + 5 * 4; +- ap->ioaddr.device_addr = base + 1 + 6 * 4; +- ap->ioaddr.status_addr = base + 1 + 7 * 4; +- ap->ioaddr.command_addr = base + 1 + 7 * 4; +- +- base = (void __iomem *)ctl_mem_res->start; +- ap->ioaddr.altstatus_addr = base + 1; +- ap->ioaddr.ctl_addr = base + 1; +- +- ata_port_desc(ap, "cmd 0x%lx ctl 0x%lx", +- (unsigned long)base_mem_res->start, +- (unsigned long)ctl_mem_res->start); ++ ap->ioaddr.data_addr = (void __iomem *)base_mem_res->start; ++ ++ if (base_res) { /* only Q40 has IO resources */ ++ io_offset = 0x10000; ++ reg_shift = 0; ++ base = (void __iomem *)base_res->start; ++ ctl_base = (void __iomem *)ctl_res->start; ++ } else { ++ base = (void __iomem *)base_mem_res->start; ++ ctl_base = (void __iomem *)ctl_mem_res->start; ++ } ++ ++ ap->ioaddr.error_addr = base + io_offset + (1 << reg_shift); ++ ap->ioaddr.feature_addr = base + io_offset + (1 << reg_shift); ++ ap->ioaddr.nsect_addr = base + io_offset + (2 << reg_shift); ++ ap->ioaddr.lbal_addr = base + io_offset + (3 << reg_shift); ++ ap->ioaddr.lbam_addr = base + io_offset + (4 << reg_shift); ++ ap->ioaddr.lbah_addr = base + io_offset + (5 << reg_shift); ++ ap->ioaddr.device_addr = base + io_offset + (6 << reg_shift); ++ ap->ioaddr.status_addr = base + io_offset + (7 << reg_shift); ++ ap->ioaddr.command_addr = base + io_offset + (7 << reg_shift); ++ ++ ap->ioaddr.altstatus_addr = ctl_base + io_offset; ++ ap->ioaddr.ctl_addr = ctl_base + io_offset; ++ ++ ata_port_desc(ap, "cmd %px ctl %px data %px", ++ base, ctl_base, ap->ioaddr.data_addr); + + irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); + if (irq_res && irq_res->start > 0) { diff --git a/queue-5.15/ata-pata_ftide010-add-missing-module_description.patch b/queue-5.15/ata-pata_ftide010-add-missing-module_description.patch new file mode 100644 index 00000000000..edf013eb8bc --- /dev/null +++ b/queue-5.15/ata-pata_ftide010-add-missing-module_description.patch @@ -0,0 +1,34 @@ +From 7274eef5729037300f29d14edeb334a47a098f65 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Thu, 24 Aug 2023 07:41:59 +0900 +Subject: ata: pata_ftide010: Add missing MODULE_DESCRIPTION + +From: Damien Le Moal + +commit 7274eef5729037300f29d14edeb334a47a098f65 upstream. + +Add the missing MODULE_DESCRIPTION() to avoid warnings such as: + +WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/ata/pata_ftide010.o + +when compiling with W=1. + +Fixes: be4e456ed3a5 ("ata: Add driver for Faraday Technology FTIDE010") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_ftide010.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/pata_ftide010.c ++++ b/drivers/ata/pata_ftide010.c +@@ -570,6 +570,7 @@ static struct platform_driver pata_ftide + }; + module_platform_driver(pata_ftide010_driver); + ++MODULE_DESCRIPTION("low level driver for Faraday Technology FTIDE010"); + MODULE_AUTHOR("Linus Walleij "); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("platform:" DRV_NAME); diff --git a/queue-5.15/ata-sata_gemini-add-missing-module_description.patch b/queue-5.15/ata-sata_gemini-add-missing-module_description.patch new file mode 100644 index 00000000000..907f9a5ff3d --- /dev/null +++ b/queue-5.15/ata-sata_gemini-add-missing-module_description.patch @@ -0,0 +1,34 @@ +From 8566572bf3b4d6e416a4bf2110dbb4817d11ba59 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Thu, 24 Aug 2023 07:43:18 +0900 +Subject: ata: sata_gemini: Add missing MODULE_DESCRIPTION + +From: Damien Le Moal + +commit 8566572bf3b4d6e416a4bf2110dbb4817d11ba59 upstream. + +Add the missing MODULE_DESCRIPTION() to avoid warnings such as: + +WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/ata/sata_gemini.o + +when compiling with W=1. + +Fixes: be4e456ed3a5 ("ata: Add driver for Faraday Technology FTIDE010") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/sata_gemini.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/sata_gemini.c ++++ b/drivers/ata/sata_gemini.c +@@ -435,6 +435,7 @@ static struct platform_driver gemini_sat + }; + module_platform_driver(gemini_sata_driver); + ++MODULE_DESCRIPTION("low level driver for Cortina Systems Gemini SATA bridge"); + MODULE_AUTHOR("Linus Walleij "); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("platform:" DRV_NAME); diff --git a/queue-5.15/btrfs-fix-start-transaction-qgroup-rsv-double-free.patch b/queue-5.15/btrfs-fix-start-transaction-qgroup-rsv-double-free.patch new file mode 100644 index 00000000000..ed53ae30a2a --- /dev/null +++ b/queue-5.15/btrfs-fix-start-transaction-qgroup-rsv-double-free.patch @@ -0,0 +1,97 @@ +From a6496849671a5bc9218ecec25a983253b34351b1 Mon Sep 17 00:00:00 2001 +From: Boris Burkov +Date: Fri, 21 Jul 2023 09:02:07 -0700 +Subject: btrfs: fix start transaction qgroup rsv double free + +From: Boris Burkov + +commit a6496849671a5bc9218ecec25a983253b34351b1 upstream. + +btrfs_start_transaction reserves metadata space of the PERTRANS type +before it identifies a transaction to start/join. This allows flushing +when reserving that space without a deadlock. However, it results in a +race which temporarily breaks qgroup rsv accounting. + +T1 T2 +start_transaction +do_stuff + start_transaction + qgroup_reserve_meta_pertrans +commit_transaction + qgroup_free_meta_all_pertrans + hit an error starting txn + goto reserve_fail + qgroup_free_meta_pertrans (already freed!) + +The basic issue is that there is nothing preventing another commit from +committing before start_transaction finishes (in fact sometimes we +intentionally wait for it) so any error path that frees the reserve is +at risk of this race. + +While this exact space was getting freed anyway, and it's not a huge +deal to double free it (just a warning, the free code catches this), it +can result in incorrectly freeing some other pertrans reservation in +this same reservation, which could then lead to spuriously granting +reservations we might not have the space for. Therefore, I do believe it +is worth fixing. + +To fix it, use the existing prealloc->pertrans conversion mechanism. +When we first reserve the space, we reserve prealloc space and only when +we are sure we have a transaction do we convert it to pertrans. This way +any racing commits do not blow away our reservation, but we still get a +pertrans reservation that is freed when _this_ transaction gets committed. + +This issue can be reproduced by running generic/269 with either qgroups +or squotas enabled via mkfs on the scratch device. + +Reviewed-by: Josef Bacik +CC: stable@vger.kernel.org # 5.10+ +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/transaction.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -605,8 +605,13 @@ start_transaction(struct btrfs_root *roo + u64 delayed_refs_bytes = 0; + + qgroup_reserved = num_items * fs_info->nodesize; +- ret = btrfs_qgroup_reserve_meta_pertrans(root, qgroup_reserved, +- enforce_qgroups); ++ /* ++ * Use prealloc for now, as there might be a currently running ++ * transaction that could free this reserved space prematurely ++ * by committing. ++ */ ++ ret = btrfs_qgroup_reserve_meta_prealloc(root, qgroup_reserved, ++ enforce_qgroups, false); + if (ret) + return ERR_PTR(ret); + +@@ -719,6 +724,14 @@ again: + h->reloc_reserved = reloc_reserved; + } + ++ /* ++ * Now that we have found a transaction to be a part of, convert the ++ * qgroup reservation from prealloc to pertrans. A different transaction ++ * can't race in and free our pertrans out from under us. ++ */ ++ if (qgroup_reserved) ++ btrfs_qgroup_convert_reserved_meta(root, qgroup_reserved); ++ + got_it: + if (!current->journal_info) + current->journal_info = h; +@@ -766,7 +779,7 @@ alloc_fail: + btrfs_block_rsv_release(fs_info, &fs_info->trans_block_rsv, + num_bytes, NULL); + reserve_fail: +- btrfs_qgroup_free_meta_pertrans(root, qgroup_reserved); ++ btrfs_qgroup_free_meta_prealloc(root, qgroup_reserved); + return ERR_PTR(ret); + } + diff --git a/queue-5.15/btrfs-free-qgroup-rsv-on-io-failure.patch b/queue-5.15/btrfs-free-qgroup-rsv-on-io-failure.patch new file mode 100644 index 00000000000..c23e739aa24 --- /dev/null +++ b/queue-5.15/btrfs-free-qgroup-rsv-on-io-failure.patch @@ -0,0 +1,46 @@ +From e28b02118b94e42be3355458a2406c6861e2dd32 Mon Sep 17 00:00:00 2001 +From: Boris Burkov +Date: Fri, 21 Jul 2023 09:02:06 -0700 +Subject: btrfs: free qgroup rsv on io failure + +From: Boris Burkov + +commit e28b02118b94e42be3355458a2406c6861e2dd32 upstream. + +If we do a write whose bio suffers an error, we will never reclaim the +qgroup reserved space for it. We allocate the space in the write_iter +codepath, then release the reservation as we allocate the ordered +extent, but we only create a delayed ref if the ordered extent finishes. +If it has an error, we simply leak the rsv. This is apparent in running +any error injecting (dmerror) fstests like btrfs/146 or btrfs/160. Such +tests fail due to dmesg on umount complaining about the leaked qgroup +data space. + +When we clean up other aspects of space on failed ordered_extents, also +free the qgroup rsv. + +Reviewed-by: Josef Bacik +CC: stable@vger.kernel.org # 5.10+ +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3226,6 +3226,13 @@ out: + btrfs_free_reserved_extent(fs_info, + ordered_extent->disk_bytenr, + ordered_extent->disk_num_bytes, 1); ++ /* ++ * Actually free the qgroup rsv which was released when ++ * the ordered extent was created. ++ */ ++ btrfs_qgroup_free_refroot(fs_info, inode->root->root_key.objectid, ++ ordered_extent->qgroup_rsv, ++ BTRFS_QGROUP_RSV_DATA); + } + } + diff --git a/queue-5.15/dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch b/queue-5.15/dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch new file mode 100644 index 00000000000..4bc599492a8 --- /dev/null +++ b/queue-5.15/dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch @@ -0,0 +1,64 @@ +From c6ec8c83a29fb3aec3efa6fabbf5344498f57c7f Mon Sep 17 00:00:00 2001 +From: Hien Huynh +Date: Thu, 6 Jul 2023 12:21:50 +0100 +Subject: dmaengine: sh: rz-dmac: Fix destination and source data size setting + +From: Hien Huynh + +commit c6ec8c83a29fb3aec3efa6fabbf5344498f57c7f upstream. + +Before setting DDS and SDS values, we need to clear its value first +otherwise, we get incorrect results when we change/update the DMA bus +width several times due to the 'OR' expression. + +Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") +Cc: stable@kernel.org +Signed-off-by: Hien Huynh +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230706112150.198941-3-biju.das.jz@bp.renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/sh/rz-dmac.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/dma/sh/rz-dmac.c ++++ b/drivers/dma/sh/rz-dmac.c +@@ -9,6 +9,7 @@ + * Copyright 2012 Javier Martin, Vista Silicon + */ + ++#include + #include + #include + #include +@@ -143,8 +144,8 @@ struct rz_dmac { + #define CHCFG_REQD BIT(3) + #define CHCFG_SEL(bits) ((bits) & 0x07) + #define CHCFG_MEM_COPY (0x80400008) +-#define CHCFG_FILL_DDS(a) (((a) << 16) & GENMASK(19, 16)) +-#define CHCFG_FILL_SDS(a) (((a) << 12) & GENMASK(15, 12)) ++#define CHCFG_FILL_DDS_MASK GENMASK(19, 16) ++#define CHCFG_FILL_SDS_MASK GENMASK(15, 12) + #define CHCFG_FILL_TM(a) (((a) & BIT(5)) << 22) + #define CHCFG_FILL_AM(a) (((a) & GENMASK(4, 2)) << 6) + #define CHCFG_FILL_LVL(a) (((a) & BIT(1)) << 5) +@@ -607,13 +608,15 @@ static int rz_dmac_config(struct dma_cha + if (val == CHCFG_DS_INVALID) + return -EINVAL; + +- channel->chcfg |= CHCFG_FILL_DDS(val); ++ channel->chcfg &= ~CHCFG_FILL_DDS_MASK; ++ channel->chcfg |= FIELD_PREP(CHCFG_FILL_DDS_MASK, val); + + val = rz_dmac_ds_to_val_mapping(config->src_addr_width); + if (val == CHCFG_DS_INVALID) + return -EINVAL; + +- channel->chcfg |= CHCFG_FILL_SDS(val); ++ channel->chcfg &= ~CHCFG_FILL_SDS_MASK; ++ channel->chcfg |= FIELD_PREP(CHCFG_FILL_SDS_MASK, val); + + return 0; + } diff --git a/queue-5.15/ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch b/queue-5.15/ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch new file mode 100644 index 00000000000..bd19ffc8b26 --- /dev/null +++ b/queue-5.15/ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch @@ -0,0 +1,101 @@ +From 68228da51c9a436872a4ef4b5a7692e29f7e5bc7 Mon Sep 17 00:00:00 2001 +From: Wang Jianjian +Date: Thu, 3 Aug 2023 00:28:39 +0800 +Subject: ext4: add correct group descriptors and reserved GDT blocks to system zone + +From: Wang Jianjian + +commit 68228da51c9a436872a4ef4b5a7692e29f7e5bc7 upstream. + +When setup_system_zone, flex_bg is not initialized so it is always 1. +Use a new helper function, ext4_num_base_meta_blocks() which does not +depend on sbi->s_log_groups_per_flex being initialized. + +[ Squashed two patches in the Link URL's below together into a single + commit, which is simpler to review/understand. Also fix checkpatch + warnings. --TYT ] + +Cc: stable@kernel.org +Signed-off-by: Wang Jianjian +Link: https://lore.kernel.org/r/tencent_21AF0D446A9916ED5C51492CC6C9A0A77B05@qq.com +Link: https://lore.kernel.org/r/tencent_D744D1450CC169AEA77FCF0A64719909ED05@qq.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/balloc.c | 15 +++++++++++---- + fs/ext4/block_validity.c | 8 ++++---- + fs/ext4/ext4.h | 2 ++ + 3 files changed, 17 insertions(+), 8 deletions(-) + +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -909,11 +909,11 @@ unsigned long ext4_bg_num_gdb(struct sup + } + + /* +- * This function returns the number of file system metadata clusters at ++ * This function returns the number of file system metadata blocks at + * the beginning of a block group, including the reserved gdt blocks. + */ +-static unsigned ext4_num_base_meta_clusters(struct super_block *sb, +- ext4_group_t block_group) ++unsigned int ext4_num_base_meta_blocks(struct super_block *sb, ++ ext4_group_t block_group) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + unsigned num; +@@ -931,8 +931,15 @@ static unsigned ext4_num_base_meta_clust + } else { /* For META_BG_BLOCK_GROUPS */ + num += ext4_bg_num_gdb(sb, block_group); + } +- return EXT4_NUM_B2C(sbi, num); ++ return num; + } ++ ++static unsigned int ext4_num_base_meta_clusters(struct super_block *sb, ++ ext4_group_t block_group) ++{ ++ return EXT4_NUM_B2C(EXT4_SB(sb), ext4_num_base_meta_blocks(sb, block_group)); ++} ++ + /** + * ext4_inode_to_goal_block - return a hint for block allocation + * @inode: inode for block allocation +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -215,7 +215,6 @@ int ext4_setup_system_zone(struct super_ + struct ext4_system_blocks *system_blks; + struct ext4_group_desc *gdp; + ext4_group_t i; +- int flex_size = ext4_flex_bg_size(sbi); + int ret; + + system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL); +@@ -223,12 +222,13 @@ int ext4_setup_system_zone(struct super_ + return -ENOMEM; + + for (i=0; i < ngroups; i++) { ++ unsigned int meta_blks = ext4_num_base_meta_blocks(sb, i); ++ + cond_resched(); +- if (ext4_bg_has_super(sb, i) && +- ((i < 5) || ((i % flex_size) == 0))) { ++ if (meta_blks != 0) { + ret = add_system_zone(system_blks, + ext4_group_first_block_no(sb, i), +- ext4_bg_num_gdb(sb, i) + 1, 0); ++ meta_blks, 0); + if (ret) + goto err; + } +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -3120,6 +3120,8 @@ extern const char *ext4_decode_error(str + extern void ext4_mark_group_bitmap_corrupted(struct super_block *sb, + ext4_group_t block_group, + unsigned int flags); ++extern unsigned int ext4_num_base_meta_blocks(struct super_block *sb, ++ ext4_group_t block_group); + + extern __printf(7, 8) + void __ext4_error(struct super_block *, const char *, unsigned int, bool, diff --git a/queue-5.15/fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch b/queue-5.15/fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch new file mode 100644 index 00000000000..e533c7c7d0b --- /dev/null +++ b/queue-5.15/fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch @@ -0,0 +1,47 @@ +From b8bd342d50cbf606666488488f9fea374aceb2d5 Mon Sep 17 00:00:00 2001 +From: ruanmeisi +Date: Tue, 25 Apr 2023 19:13:54 +0800 +Subject: fuse: nlookup missing decrement in fuse_direntplus_link + +From: ruanmeisi + +commit b8bd342d50cbf606666488488f9fea374aceb2d5 upstream. + +During our debugging of glusterfs, we found an Assertion failed error: +inode_lookup >= nlookup, which was caused by the nlookup value in the +kernel being greater than that in the FUSE file system. + +The issue was introduced by fuse_direntplus_link, where in the function, +fuse_iget increments nlookup, and if d_splice_alias returns failure, +fuse_direntplus_link returns failure without decrementing nlookup +https://github.com/gluster/glusterfs/pull/4081 + +Signed-off-by: ruanmeisi +Fixes: 0b05b18381ee ("fuse: implement NFS-like readdirplus support") +Cc: # v3.9 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/readdir.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/fs/fuse/readdir.c ++++ b/fs/fuse/readdir.c +@@ -243,8 +243,16 @@ retry: + dput(dentry); + dentry = alias; + } +- if (IS_ERR(dentry)) ++ if (IS_ERR(dentry)) { ++ if (!IS_ERR(inode)) { ++ struct fuse_inode *fi = get_fuse_inode(inode); ++ ++ spin_lock(&fi->lock); ++ fi->nlookup--; ++ spin_unlock(&fi->lock); ++ } + return PTR_ERR(dentry); ++ } + } + if (fc->readdirplus_auto) + set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state); diff --git a/queue-5.15/jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch b/queue-5.15/jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch new file mode 100644 index 00000000000..6100bbc01c9 --- /dev/null +++ b/queue-5.15/jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch @@ -0,0 +1,72 @@ +From 590a809ff743e7bd890ba5fb36bc38e20a36de53 Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Fri, 14 Jul 2023 10:55:27 +0800 +Subject: jbd2: check 'jh->b_transaction' before removing it from checkpoint +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhihao Cheng + +commit 590a809ff743e7bd890ba5fb36bc38e20a36de53 upstream. + +Following process will corrupt ext4 image: +Step 1: +jbd2_journal_commit_transaction + __jbd2_journal_insert_checkpoint(jh, commit_transaction) + // Put jh into trans1->t_checkpoint_list + journal->j_checkpoint_transactions = commit_transaction + // Put trans1 into journal->j_checkpoint_transactions + +Step 2: +do_get_write_access + test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty + __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2 + +Step 3: +drop_cache + journal_shrink_one_cp_list + jbd2_journal_try_remove_checkpoint + if (!trylock_buffer(bh)) // lock bh, true + if (buffer_dirty(bh)) // buffer is not dirty + __jbd2_journal_remove_checkpoint(jh) + // remove jh from trans1->t_checkpoint_list + +Step 4: +jbd2_log_do_checkpoint + trans1 = journal->j_checkpoint_transactions + // jh is not in trans1->t_checkpoint_list + jbd2_cleanup_journal_tail(journal) // trans1 is done + +Step 5: Power cut, trans2 is not committed, jh is lost in next mounting. + +Fix it by checking 'jh->b_transaction' before remove it from checkpoint. + +Cc: stable@kernel.org +Fixes: 46f881b5b175 ("jbd2: fix a race when checking checkpoint buffer busy") +Signed-off-by: Zhihao Cheng +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230714025528.564988-3-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/checkpoint.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c +index 936c6d758a65..f033ac807013 100644 +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -639,6 +639,8 @@ int jbd2_journal_try_remove_checkpoint(struct journal_head *jh) + { + struct buffer_head *bh = jh2bh(jh); + ++ if (jh->b_transaction) ++ return -EBUSY; + if (!trylock_buffer(bh)) + return -EBUSY; + if (buffer_dirty(bh)) { +-- +2.42.0 + diff --git a/queue-5.15/jbd2-fix-checkpoint-cleanup-performance-regression.patch b/queue-5.15/jbd2-fix-checkpoint-cleanup-performance-regression.patch new file mode 100644 index 00000000000..422c4224341 --- /dev/null +++ b/queue-5.15/jbd2-fix-checkpoint-cleanup-performance-regression.patch @@ -0,0 +1,123 @@ +From 373ac521799d9e97061515aca6ec6621789036bb Mon Sep 17 00:00:00 2001 +From: Zhang Yi +Date: Fri, 14 Jul 2023 10:55:26 +0800 +Subject: jbd2: fix checkpoint cleanup performance regression + +From: Zhang Yi + +commit 373ac521799d9e97061515aca6ec6621789036bb upstream. + +journal_clean_one_cp_list() has been merged into +journal_shrink_one_cp_list(), but do chekpoint buffer cleanup from the +committing process is just a best effort, it should stop scan once it +meet a busy buffer, or else it will cause a lot of invalid buffer scan +and checks. We catch a performance regression when doing fs_mark tests +below. + +Test cmd: + ./fs_mark -d scratch -s 1024 -n 10000 -t 1 -D 100 -N 100 + +Before merging checkpoint buffer cleanup: + FSUse% Count Size Files/sec App Overhead + 95 10000 1024 8304.9 49033 + +After merging checkpoint buffer cleanup: + FSUse% Count Size Files/sec App Overhead + 95 10000 1024 7649.0 50012 + FSUse% Count Size Files/sec App Overhead + 95 10000 1024 2107.1 50871 + +After merging checkpoint buffer cleanup, the total loop count in +journal_shrink_one_cp_list() could be up to 6,261,600+ (50,000+ ~ +100,000+ in general), most of them are invalid. This patch fix it +through passing 'shrink_type' into journal_shrink_one_cp_list() and add +a new 'SHRINK_BUSY_STOP' to indicate it should stop once meet a busy +buffer. After fix, the loop count descending back to 10,000+. + +After this fix: + FSUse% Count Size Files/sec App Overhead + 95 10000 1024 8558.4 49109 + +Cc: stable@kernel.org +Fixes: b98dba273a0e ("jbd2: remove journal_clean_one_cp_list()") +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230714025528.564988-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/checkpoint.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +--- a/fs/jbd2/checkpoint.c ++++ b/fs/jbd2/checkpoint.c +@@ -349,6 +349,8 @@ int jbd2_cleanup_journal_tail(journal_t + + /* Checkpoint list management */ + ++enum shrink_type {SHRINK_DESTROY, SHRINK_BUSY_STOP, SHRINK_BUSY_SKIP}; ++ + /* + * journal_shrink_one_cp_list + * +@@ -360,7 +362,8 @@ int jbd2_cleanup_journal_tail(journal_t + * Called with j_list_lock held. + */ + static unsigned long journal_shrink_one_cp_list(struct journal_head *jh, +- bool destroy, bool *released) ++ enum shrink_type type, ++ bool *released) + { + struct journal_head *last_jh; + struct journal_head *next_jh = jh; +@@ -376,12 +379,15 @@ static unsigned long journal_shrink_one_ + jh = next_jh; + next_jh = jh->b_cpnext; + +- if (destroy) { ++ if (type == SHRINK_DESTROY) { + ret = __jbd2_journal_remove_checkpoint(jh); + } else { + ret = jbd2_journal_try_remove_checkpoint(jh); +- if (ret < 0) +- continue; ++ if (ret < 0) { ++ if (type == SHRINK_BUSY_SKIP) ++ continue; ++ break; ++ } + } + + nr_freed++; +@@ -445,7 +451,7 @@ again: + tid = transaction->t_tid; + + freed = journal_shrink_one_cp_list(transaction->t_checkpoint_list, +- false, &released); ++ SHRINK_BUSY_SKIP, &released); + nr_freed += freed; + (*nr_to_scan) -= min(*nr_to_scan, freed); + if (*nr_to_scan == 0) +@@ -485,19 +491,21 @@ out: + void __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy) + { + transaction_t *transaction, *last_transaction, *next_transaction; ++ enum shrink_type type; + bool released; + + transaction = journal->j_checkpoint_transactions; + if (!transaction) + return; + ++ type = destroy ? SHRINK_DESTROY : SHRINK_BUSY_STOP; + last_transaction = transaction->t_cpprev; + next_transaction = transaction; + do { + transaction = next_transaction; + next_transaction = transaction->t_cpnext; + journal_shrink_one_cp_list(transaction->t_checkpoint_list, +- destroy, &released); ++ type, &released); + /* + * This function only frees up some memory if possible so we + * dont have an obligation to finish processing. Bail out if diff --git a/queue-5.15/lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch b/queue-5.15/lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch new file mode 100644 index 00000000000..8031f4628ae --- /dev/null +++ b/queue-5.15/lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch @@ -0,0 +1,53 @@ +From 92382d744176f230101d54f5c017bccd62770f01 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 7 Aug 2023 08:36:28 -0700 +Subject: lib: test_scanf: Add explicit type cast to result initialization in test_number_prefix() + +From: Nathan Chancellor + +commit 92382d744176f230101d54f5c017bccd62770f01 upstream. + +A recent change in clang allows it to consider more expressions as +compile time constants, which causes it to point out an implicit +conversion in the scanf tests: + + lib/test_scanf.c:661:2: warning: implicit conversion from 'int' to 'unsigned char' changes value from -168 to 88 [-Wconstant-conversion] + 661 | test_number_prefix(unsigned char, "0xA7", "%2hhx%hhx", 0, 0xa7, 2, check_uchar); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + lib/test_scanf.c:609:29: note: expanded from macro 'test_number_prefix' + 609 | T result[2] = {~expect[0], ~expect[1]}; \ + | ~ ^~~~~~~~~~ + 1 warning generated. + +The result of the bitwise negation is the type of the operand after +going through the integer promotion rules, so this truncation is +expected but harmless, as the initial values in the result array get +overwritten by _test() anyways. Add an explicit cast to the expected +type in test_number_prefix() to silence the warning. There is no +functional change, as all the tests still pass with GCC 13.1.0 and clang +18.0.0. + +Cc: stable@vger.kernel.org +Link: https://github.com/ClangBuiltLinux/linuxq/issues/1899 +Link: https://github.com/llvm/llvm-project/commit/610ec954e1f81c0e8fcadedcd25afe643f5a094e +Suggested-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20230807-test_scanf-wconstant-conversion-v2-1-839ca39083e1@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + lib/test_scanf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/test_scanf.c ++++ b/lib/test_scanf.c +@@ -606,7 +606,7 @@ static void __init numbers_slice(void) + #define test_number_prefix(T, str, scan_fmt, expect0, expect1, n_args, fn) \ + do { \ + const T expect[2] = { expect0, expect1 }; \ +- T result[2] = {~expect[0], ~expect[1]}; \ ++ T result[2] = { (T)~expect[0], (T)~expect[1] }; \ + \ + _test(fn, &expect, str, scan_fmt, n_args, &result[0], &result[1]); \ + } while (0) diff --git a/queue-5.15/series b/queue-5.15/series index 0776109379c..546a1a79645 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -461,3 +461,15 @@ net-hns3-fix-the-port-information-display-when-sfp-i.patch net-hns3-remove-gso-partial-feature-bit.patch sh-boards-fix-ceu-buffer-size-passed-to-dma_declare_.patch net-mlx5-free-irq-rmap-and-notifier-on-kernel-shutdown.patch +arc-atomics-add-compiler-barrier-to-atomic-operations.patch +dmaengine-sh-rz-dmac-fix-destination-and-source-data-size-setting.patch +jbd2-fix-checkpoint-cleanup-performance-regression.patch +jbd2-check-jh-b_transaction-before-removing-it-from-checkpoint.patch +ext4-add-correct-group-descriptors-and-reserved-gdt-blocks-to-system-zone.patch +lib-test_scanf-add-explicit-type-cast-to-result-initialization-in-test_number_prefix.patch +ata-pata_falcon-fix-io-base-selection-for-q40.patch +ata-sata_gemini-add-missing-module_description.patch +ata-pata_ftide010-add-missing-module_description.patch +fuse-nlookup-missing-decrement-in-fuse_direntplus_link.patch +btrfs-fix-start-transaction-qgroup-rsv-double-free.patch +btrfs-free-qgroup-rsv-on-io-failure.patch -- 2.47.3