History

Merge branch 'for-linus2' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe: "Round 2 of this. I cut back to the bare necessities, the patch is still larger than it usually would be at this time, due to the number of NVMe fixes in there. This pull request contains: - The 4 core fixes from Ming, that fix both problems with exceeding the virtual boundary limit in case of merging, and the gap checking for cloned bio's. - NVMe fixes from Keith and Christoph: - Regression on larger user commands, causing problems with reading log pages (for instance). This touches both NVMe, and the block core since that is now generally utilized also for these types of commands. - Hot removal fixes. - User exploitable issue with passthrough IO commands, if !length is given, causing us to fault on writing to the zero page. - Fix for a hang under error conditions - And finally, the current series regression for umount with cgroup writeback, where the final flush would happen async and hence open up window after umount where the device wasn't consistent. fsck right after umount would show this. From Tejun" * 'for-linus2' of git://git.kernel.dk/linux-block: block: support large requests in blk_rq_map_user_iov block: fix blk_rq_get_max_sectors for driver private requests nvme: fix max_segments integer truncation nvme: set queue limits for the admin queue writeback: flush inode cgroup wb switches instead of pinning super_block NVMe: Fix 0-length integrity payload NVMe: Don't allow unsupported flags NVMe: Move error handling to failed reset handler NVMe: Simplify device reset failure NVMe: Fix namespace removal deadlock NVMe: Use IDA for namespace disk naming NVMe: Don't unmap controller registers on reset block: merge: get the 1st and last bvec via helpers block: get the 1st and last bvec via helpers block: check virt boundary in bio_will_gap() block: bio: introduce helpers to get the 1st and last bvec

Linus Torvalds committed 10 years ago

Commit e5322c52 parents bdf9d29 4d6af7310 files · +341 −148Browse files

Unified · Split

10 files
  1. block/blk-map.c +61 −30
  2. block/blk-merge.c +2 −6
  3. drivers/nvme/host/core.c +78 −33
  4. drivers/nvme/host/nvme.h +8 −0
  5. drivers/nvme/host/pci.c +90 −59
  6. fs/fs-writeback.c +41 −13
  7. fs/super.c +1 −0
  8. include/linux/bio.h +37 −0
  9. include/linux/blkdev.h +18 −7
  10. include/linux/writeback.h +5 −0
block/blk-map.c+61−30
@@ -57,6 +57,49 @@ static int __blk_rq_unmap_user(struct bio *bio) · 56 unmodified lines
5757 return ret;
5858 }
5959
60+static int __blk_rq_map_user_iov(struct request *rq,
61+ struct rq_map_data *map_data, struct iov_iter *iter,
62+ gfp_t gfp_mask, bool copy)
63+{
64+ struct request_queue *q = rq->q;
65+ struct bio *bio, *orig_bio;
66+ int ret;
67+
68+ if (copy)
69+ bio = bio_copy_user_iov(q, map_data, iter, gfp_mask);
70+ else
71+ bio = bio_map_user_iov(q, iter, gfp_mask);
72+
73+ if (IS_ERR(bio))
74+ return PTR_ERR(bio);
75+
76+ if (map_data && map_data->null_mapped)
77+ bio_set_flag(bio, BIO_NULL_MAPPED);
78+
79+ iov_iter_advance(iter, bio->bi_iter.bi_size);
80+ if (map_data)
81+ map_data->offset += bio->bi_iter.bi_size;
82+
83+ orig_bio = bio;
84+ blk_queue_bounce(q, &bio);
85+
86+ /*
87+ * We link the bounce buffer in and could have to traverse it
88+ * later so we have to get a ref to prevent it from being freed
89+ */
90+ bio_get(bio);
91+
92+ ret = blk_rq_append_bio(q, rq, bio);
93+ if (ret) {
94+ bio_endio(bio);
95+ __blk_rq_unmap_user(orig_bio);
96+ bio_put(bio);
97+ return ret;
98+ }
99+
100+ return 0;
101+}
102+
60103 /**
61104 * blk_rq_map_user_iov - map user data to a request, for REQ_TYPE_BLOCK_PC usage
62105 * @q: request queue where request should be inserted
@@ -82,10 +125,11 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, · 19 unmodified lines
82125 struct rq_map_data *map_data,
83126 const struct iov_iter *iter, gfp_t gfp_mask)
84127 {
85− struct bio *bio;
86− int unaligned = 0;
87− struct iov_iter i;
88128 struct iovec iov, prv = {.iov_base = NULL, .iov_len = 0};
129+ bool copy = (q->dma_pad_mask & iter->count) || map_data;
130+ struct bio *bio = NULL;
131+ struct iov_iter i;
132+ int ret;
89133
90134 if (!iter || !iter->count)
91135 return -EINVAL;
@@ -101,42 +145,29 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, · 9 unmodified lines
101145 */
102146 if ((uaddr & queue_dma_alignment(q)) ||
103147 iovec_gap_to_prv(q, &prv, &iov))
104− unaligned = 1;
148+ copy = true;
105149
106150 prv.iov_base = iov.iov_base;
107151 prv.iov_len = iov.iov_len;
108152 }
109153
110− if (unaligned || (q->dma_pad_mask & iter->count) || map_data)
111− bio = bio_copy_user_iov(q, map_data, iter, gfp_mask);
112− else
113− bio = bio_map_user_iov(q, iter, gfp_mask);
114−
115− if (IS_ERR(bio))
116− return PTR_ERR(bio);
117−
118− if (map_data && map_data->null_mapped)
119− bio_set_flag(bio, BIO_NULL_MAPPED);
120−
121− if (bio->bi_iter.bi_size != iter->count) {
122− /*
123− * Grab an extra reference to this bio, as bio_unmap_user()
124− * expects to be able to drop it twice as it happens on the
125− * normal IO completion path
126− */
127− bio_get(bio);
128− bio_endio(bio);
129− __blk_rq_unmap_user(bio);
130− return -EINVAL;
131− }
154+ i = *iter;
155+ do {
156+ ret =__blk_rq_map_user_iov(rq, map_data, &i, gfp_mask, copy);
157+ if (ret)
158+ goto unmap_rq;
159+ if (!bio)
160+ bio = rq->bio;
161+ } while (iov_iter_count(&i));
132162
133163 if (!bio_flagged(bio, BIO_USER_MAPPED))
134164 rq->cmd_flags |= REQ_COPY_USER;
135−
136− blk_queue_bounce(q, &bio);
137− bio_get(bio);
138− blk_rq_bio_prep(q, rq, bio);
139165 return 0;
166+
167+unmap_rq:
168+ __blk_rq_unmap_user(bio);
169+ rq->bio = NULL;
170+ return -EINVAL;
140171 }
141172 EXPORT_SYMBOL(blk_rq_map_user_iov);
142173
block/blk-merge.c+2−6
@@ -304,7 +304,6 @@ static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio, · 303 unmodified lines
304304 struct bio *nxt)
305305 {
306306 struct bio_vec end_bv = { NULL }, nxt_bv;
307− struct bvec_iter iter;
308307
309308 if (!blk_queue_cluster(q))
310309 return 0;
@@ -316,11 +315,8 @@ static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio, · 5 unmodified lines
316315 if (!bio_has_data(bio))
317316 return 1;
318317
319− bio_for_each_segment(end_bv, bio, iter)
320− if (end_bv.bv_len == iter.bi_size)
321− break;
322−
323− nxt_bv = bio_iovec(nxt);
318+ bio_get_last_bvec(bio, &end_bv);
319+ bio_get_first_bvec(nxt, &nxt_bv);
324320
325321 if (!BIOVEC_PHYS_MERGEABLE(&end_bv, &nxt_bv))
326322 return 0;
drivers/nvme/host/core.c+78−33
@@ -55,8 +55,9 @@ static void nvme_free_ns(struct kref *kref) · 54 unmodified lines
5555 ns->disk->private_data = NULL;
5656 spin_unlock(&dev_list_lock);
5757
58− nvme_put_ctrl(ns->ctrl);
5958 put_disk(ns->disk);
59+ ida_simple_remove(&ns->ctrl->ns_ida, ns->instance);
60+ nvme_put_ctrl(ns->ctrl);
6061 kfree(ns);
6162 }
6263
@@ -183,7 +184,7 @@ int __nvme_submit_user_cmd(struct request_queue *q, struct nvme_command *cmd, · 120 unmodified lines
183184 goto out_unmap;
184185 }
185186
186− if (meta_buffer) {
187+ if (meta_buffer && meta_len) {
187188 struct bio_integrity_payload *bip;
188189
189190 meta = kmalloc(meta_len, GFP_KERNEL);
@@ -373,6 +374,8 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) · 183 unmodified lines
373374
374375 if (copy_from_user(&io, uio, sizeof(io)))
375376 return -EFAULT;
377+ if (io.flags)
378+ return -EINVAL;
376379
377380 switch (io.opcode) {
378381 case nvme_cmd_write:
@@ -424,6 +427,8 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, · 45 unmodified lines
424427 return -EACCES;
425428 if (copy_from_user(&cmd, ucmd, sizeof(cmd)))
426429 return -EFAULT;
430+ if (cmd.flags)
431+ return -EINVAL;
427432
428433 memset(&c, 0, sizeof(c));
429434 c.common.opcode = cmd.opcode;
@@ -556,6 +561,10 @@ static int nvme_revalidate_disk(struct gendisk *disk) · 126 unmodified lines
556561 u16 old_ms;
557562 unsigned short bs;
558563
564+ if (test_bit(NVME_NS_DEAD, &ns->flags)) {
565+ set_capacity(disk, 0);
566+ return -ENODEV;
567+ }
559568 if (nvme_identify_ns(ns->ctrl, ns->ns_id, &id)) {
560569 dev_warn(ns->ctrl->dev, "%s: Identify failure nvme%dn%d\n",
561570 __func__, ns->ctrl->instance, ns->ns_id);
@@ -831,6 +840,23 @@ int nvme_shutdown_ctrl(struct nvme_ctrl *ctrl) · 269 unmodified lines
831840 return ret;
832841 }
833842
843+static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
844+ struct request_queue *q)
845+{
846+ if (ctrl->max_hw_sectors) {
847+ u32 max_segments =
848+ (ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1;
849+
850+ blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
851+ blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
852+ }
853+ if (ctrl->stripe_size)
854+ blk_queue_chunk_sectors(q, ctrl->stripe_size >> 9);
855+ if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
856+ blk_queue_flush(q, REQ_FLUSH | REQ_FUA);
857+ blk_queue_virt_boundary(q, ctrl->page_size - 1);
858+}
859+
834860 /*
835861 * Initialize the cached copies of the Identify data and various controller
836862 * register in our nvme_ctrl structure. This should be called as soon as
@@ -888,6 +914,8 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) · 51 unmodified lines
888914 }
889915 }
890916
917+ nvme_set_queue_limits(ctrl, ctrl->admin_q);
918+
891919 kfree(id);
892920 return 0;
893921 }
@@ -1118,9 +1146,13 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) · 224 unmodified lines
11181146 if (!ns)
11191147 return;
11201148
1149+ ns->instance = ida_simple_get(&ctrl->ns_ida, 1, 0, GFP_KERNEL);
1150+ if (ns->instance < 0)
1151+ goto out_free_ns;
1152+
11211153 ns->queue = blk_mq_init_queue(ctrl->tagset);
11221154 if (IS_ERR(ns->queue))
1123− goto out_free_ns;
1155+ goto out_release_instance;
11241156 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, ns->queue);
11251157 ns->queue->queuedata = ns;
11261158 ns->ctrl = ctrl;
@@ -1134,17 +1166,9 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) · 7 unmodified lines
11341166 ns->disk = disk;
11351167 ns->lba_shift = 9; /* set to a default value for 512 until disk is validated */
11361168
1169+
11371170 blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
1138− if (ctrl->max_hw_sectors) {
1139− blk_queue_max_hw_sectors(ns->queue, ctrl->max_hw_sectors);
1140− blk_queue_max_segments(ns->queue,
1141− (ctrl->max_hw_sectors / (ctrl->page_size >> 9)) + 1);
1142− }
1143− if (ctrl->stripe_size)
1144− blk_queue_chunk_sectors(ns->queue, ctrl->stripe_size >> 9);
1145− if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
1146− blk_queue_flush(ns->queue, REQ_FLUSH | REQ_FUA);
1147− blk_queue_virt_boundary(ns->queue, ctrl->page_size - 1);
1171+ nvme_set_queue_limits(ctrl, ns->queue);
11481172
11491173 disk->major = nvme_major;
11501174 disk->first_minor = 0;
@@ -1153,7 +1177,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) · 2 unmodified lines
11531177 disk->queue = ns->queue;
11541178 disk->driverfs_dev = ctrl->device;
11551179 disk->flags = GENHD_FL_EXT_DEVT;
1156− sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance, nsid);
1180+ sprintf(disk->disk_name, "nvme%dn%d", ctrl->instance, ns->instance);
11571181
11581182 if (nvme_revalidate_disk(ns->disk))
11591183 goto out_free_disk;
@@ -1173,40 +1197,29 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) · 13 unmodified lines
11731197 kfree(disk);
11741198 out_free_queue:
11751199 blk_cleanup_queue(ns->queue);
1200+ out_release_instance:
1201+ ida_simple_remove(&ctrl->ns_ida, ns->instance);
11761202 out_free_ns:
11771203 kfree(ns);
11781204 }
11791205
11801206 static void nvme_ns_remove(struct nvme_ns *ns)
11811207 {
1182− bool kill = nvme_io_incapable(ns->ctrl) &&
1183− !blk_queue_dying(ns->queue);
1184−
1185− lockdep_assert_held(&ns->ctrl->namespaces_mutex);
1186−
1187− if (kill) {
1188− blk_set_queue_dying(ns->queue);
1208+ if (test_and_set_bit(NVME_NS_REMOVING, &ns->flags))
1209+ return;
11891210
1190− /*
1191− * The controller was shutdown first if we got here through
1192− * device removal. The shutdown may requeue outstanding
1193− * requests. These need to be aborted immediately so
1194− * del_gendisk doesn't block indefinitely for their completion.
1195− */
1196− blk_mq_abort_requeue_list(ns->queue);
1197− }
11981211 if (ns->disk->flags & GENHD_FL_UP) {
11991212 if (blk_get_integrity(ns->disk))
12001213 blk_integrity_unregister(ns->disk);
12011214 sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
12021215 &nvme_ns_attr_group);
12031216 del_gendisk(ns->disk);
1204− }
1205− if (kill || !blk_queue_dying(ns->queue)) {
12061217 blk_mq_abort_requeue_list(ns->queue);
12071218 blk_cleanup_queue(ns->queue);
12081219 }
1220+ mutex_lock(&ns->ctrl->namespaces_mutex);
12091221 list_del_init(&ns->list);
1222+ mutex_unlock(&ns->ctrl->namespaces_mutex);
12101223 nvme_put_ns(ns);
12111224 }
12121225
@@ -1300,10 +1313,8 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl) · 87 unmodified lines
13001313 {
13011314 struct nvme_ns *ns, *next;
13021315
1303− mutex_lock(&ctrl->namespaces_mutex);
13041316 list_for_each_entry_safe(ns, next, &ctrl->namespaces, list)
13051317 nvme_ns_remove(ns);
1306− mutex_unlock(&ctrl->namespaces_mutex);
13071318 }
13081319
13091320 static DEFINE_IDA(nvme_instance_ida);
@@ -1350,6 +1361,7 @@ static void nvme_free_ctrl(struct kref *kref) · 40 unmodified lines
13501361
13511362 put_device(ctrl->device);
13521363 nvme_release_instance(ctrl);
1364+ ida_destroy(&ctrl->ns_ida);
13531365
13541366 ctrl->ops->free_ctrl(ctrl);
13551367 }
@@ -1390,6 +1402,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, · 34 unmodified lines
13901402 }
13911403 get_device(ctrl->device);
13921404 dev_set_drvdata(ctrl->device, ctrl);
1405+ ida_init(&ctrl->ns_ida);
13931406
13941407 spin_lock(&dev_list_lock);
13951408 list_add_tail(&ctrl->node, &nvme_ctrl_list);
@@ -1402,6 +1415,38 @@ out: · 6 unmodified lines
14021415 return ret;
14031416 }
14041417
1418+/**
1419+ * nvme_kill_queues(): Ends all namespace queues
1420+ * @ctrl: the dead controller that needs to end
1421+ *
1422+ * Call this function when the driver determines it is unable to get the
1423+ * controller in a state capable of servicing IO.
1424+ */
1425+void nvme_kill_queues(struct nvme_ctrl *ctrl)
1426+{
1427+ struct nvme_ns *ns;
1428+
1429+ mutex_lock(&ctrl->namespaces_mutex);
1430+ list_for_each_entry(ns, &ctrl->namespaces, list) {
1431+ if (!kref_get_unless_zero(&ns->kref))
1432+ continue;
1433+
1434+ /*
1435+ * Revalidating a dead namespace sets capacity to 0. This will
1436+ * end buffered writers dirtying pages that can't be synced.
1437+ */
1438+ if (!test_and_set_bit(NVME_NS_DEAD, &ns->flags))
1439+ revalidate_disk(ns->disk);
1440+
1441+ blk_set_queue_dying(ns->queue);
1442+ blk_mq_abort_requeue_list(ns->queue);
1443+ blk_mq_start_stopped_hw_queues(ns->queue, true);
1444+
1445+ nvme_put_ns(ns);
1446+ }
1447+ mutex_unlock(&ctrl->namespaces_mutex);
1448+}
1449+
14051450 void nvme_stop_queues(struct nvme_ctrl *ctrl)
14061451 {
14071452 struct nvme_ns *ns;
drivers/nvme/host/nvme.h+8−0
@@ -72,6 +72,7 @@ struct nvme_ctrl { · 71 unmodified lines
7272 struct mutex namespaces_mutex;
7373 struct device *device; /* char device */
7474 struct list_head node;
75+ struct ida ns_ida;
7576
7677 char name[12];
7778 char serial[20];
@@ -102,6 +103,7 @@ struct nvme_ns { · 24 unmodified lines
102103 struct request_queue *queue;
103104 struct gendisk *disk;
104105 struct kref kref;
106+ int instance;
105107
106108 u8 eui[8];
107109 u8 uuid[16];
@@ -112,6 +114,11 @@ struct nvme_ns { · 4 unmodified lines
112114 bool ext;
113115 u8 pi_type;
114116 int type;
117+ unsigned long flags;
118+
119+#define NVME_NS_REMOVING 0
120+#define NVME_NS_DEAD 1
121+
115122 u64 mode_select_num_blocks;
116123 u32 mode_select_block_len;
117124 };
@@ -240,6 +247,7 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl); · 122 unmodified lines
240247
241248 void nvme_stop_queues(struct nvme_ctrl *ctrl);
242249 void nvme_start_queues(struct nvme_ctrl *ctrl);
250+void nvme_kill_queues(struct nvme_ctrl *ctrl);
243251
244252 struct request *nvme_alloc_request(struct request_queue *q,
245253 struct nvme_command *cmd, unsigned int flags);
drivers/nvme/host/pci.c+90−59
@@ -86,7 +86,6 @@ struct nvme_queue; · 85 unmodified lines
8686
8787 static int nvme_reset(struct nvme_dev *dev);
8888 static void nvme_process_cq(struct nvme_queue *nvmeq);
89−static void nvme_remove_dead_ctrl(struct nvme_dev *dev);
9089 static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown);
9190
9291 /*
@@ -120,6 +119,7 @@ struct nvme_dev { · 27 unmodified lines
120119 unsigned long flags;
121120
122121 #define NVME_CTRL_RESETTING 0
122+#define NVME_CTRL_REMOVING 1
123123
124124 struct nvme_ctrl ctrl;
125125 struct completion ioq_wait;
@@ -286,6 +286,17 @@ static int nvme_init_request(void *data, struct request *req, · 160 unmodified lines
286286 return 0;
287287 }
288288
289+static void nvme_queue_scan(struct nvme_dev *dev)
290+{
291+ /*
292+ * Do not queue new scan work when a controller is reset during
293+ * removal.
294+ */
295+ if (test_bit(NVME_CTRL_REMOVING, &dev->flags))
296+ return;
297+ queue_work(nvme_workq, &dev->scan_work);
298+}
299+
289300 static void nvme_complete_async_event(struct nvme_dev *dev,
290301 struct nvme_completion *cqe)
291302 {
@@ -300,7 +311,7 @@ static void nvme_complete_async_event(struct nvme_dev *dev, · 8 unmodified lines
300311 switch (result & 0xff07) {
301312 case NVME_AER_NOTICE_NS_CHANGED:
302313 dev_info(dev->dev, "rescanning\n");
303− queue_work(nvme_workq, &dev->scan_work);
314+ nvme_queue_scan(dev);
304315 default:
305316 dev_warn(dev->dev, "async event result %08x\n", result);
306317 }
@@ -679,7 +690,10 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx, · 372 unmodified lines
679690
680691 spin_lock_irq(&nvmeq->q_lock);
681692 if (unlikely(nvmeq->cq_vector < 0)) {
682− ret = BLK_MQ_RQ_QUEUE_BUSY;
693+ if (ns && !test_bit(NVME_NS_DEAD, &ns->flags))
694+ ret = BLK_MQ_RQ_QUEUE_BUSY;
695+ else
696+ ret = BLK_MQ_RQ_QUEUE_ERROR;
683697 spin_unlock_irq(&nvmeq->q_lock);
684698 goto out;
685699 }
@@ -1250,6 +1264,12 @@ static struct blk_mq_ops nvme_mq_ops = { · 564 unmodified lines
12501264 static void nvme_dev_remove_admin(struct nvme_dev *dev)
12511265 {
12521266 if (dev->ctrl.admin_q && !blk_queue_dying(dev->ctrl.admin_q)) {
1267+ /*
1268+ * If the controller was reset during removal, it's possible
1269+ * user requests may be waiting on a stopped queue. Start the
1270+ * queue to flush these to completion.
1271+ */
1272+ blk_mq_start_stopped_hw_queues(dev->ctrl.admin_q, true);
12531273 blk_cleanup_queue(dev->ctrl.admin_q);
12541274 blk_mq_free_tag_set(&dev->admin_tagset);
12551275 }
@@ -1690,14 +1710,14 @@ static int nvme_dev_add(struct nvme_dev *dev) · 434 unmodified lines
16901710 return 0;
16911711 dev->ctrl.tagset = &dev->tagset;
16921712 }
1693− queue_work(nvme_workq, &dev->scan_work);
1713+ nvme_queue_scan(dev);
16941714 return 0;
16951715 }
16961716
1697−static int nvme_dev_map(struct nvme_dev *dev)
1717+static int nvme_pci_enable(struct nvme_dev *dev)
16981718 {
16991719 u64 cap;
1700− int bars, result = -ENOMEM;
1720+ int result = -ENOMEM;
17011721 struct pci_dev *pdev = to_pci_dev(dev->dev);
17021722
17031723 if (pci_enable_device_mem(pdev))
@@ -1705,24 +1725,14 @@ static int nvme_dev_map(struct nvme_dev *dev) · 1 unmodified line
17051725
17061726 dev->entry[0].vector = pdev->irq;
17071727 pci_set_master(pdev);
1708− bars = pci_select_bars(pdev, IORESOURCE_MEM);
1709− if (!bars)
1710− goto disable_pci;
1711−
1712− if (pci_request_selected_regions(pdev, bars, "nvme"))
1713− goto disable_pci;
17141728
17151729 if (dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64)) &&
17161730 dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(32)))
17171731 goto disable;
17181732
1719− dev->bar = ioremap(pci_resource_start(pdev, 0), 8192);
1720− if (!dev->bar)
1721− goto disable;
1722−
17231733 if (readl(dev->bar + NVME_REG_CSTS) == -1) {
17241734 result = -ENODEV;
1725− goto unmap;
1735+ goto disable;
17261736 }
17271737
17281738 /*
@@ -1732,7 +1742,7 @@ static int nvme_dev_map(struct nvme_dev *dev) · 3 unmodified lines
17321742 if (!pdev->irq) {
17331743 result = pci_enable_msix(pdev, dev->entry, 1);
17341744 if (result < 0)
1735− goto unmap;
1745+ goto disable;
17361746 }
17371747
17381748 cap = lo_hi_readq(dev->bar + NVME_REG_CAP);
@@ -1759,17 +1769,19 @@ static int nvme_dev_map(struct nvme_dev *dev) · 20 unmodified lines
17591769 pci_save_state(pdev);
17601770 return 0;
17611771
1762− unmap:
1763− iounmap(dev->bar);
1764− dev->bar = NULL;
17651772 disable:
1766− pci_release_regions(pdev);
1767− disable_pci:
17681773 pci_disable_device(pdev);
17691774 return result;
17701775 }
17711776
17721777 static void nvme_dev_unmap(struct nvme_dev *dev)
1778+{
1779+ if (dev->bar)
1780+ iounmap(dev->bar);
1781+ pci_release_regions(to_pci_dev(dev->dev));
1782+}
1783+
1784+static void nvme_pci_disable(struct nvme_dev *dev)
17731785 {
17741786 struct pci_dev *pdev = to_pci_dev(dev->dev);
17751787
@@ -1778,12 +1790,6 @@ static void nvme_dev_unmap(struct nvme_dev *dev) · 2 unmodified lines
17781790 else if (pdev->msix_enabled)
17791791 pci_disable_msix(pdev);
17801792
1781− if (dev->bar) {
1782− iounmap(dev->bar);
1783− dev->bar = NULL;
1784− pci_release_regions(pdev);
1785− }
1786−
17871793 if (pci_is_enabled(pdev)) {
17881794 pci_disable_pcie_error_reporting(pdev);
17891795 pci_disable_device(pdev);
@@ -1842,7 +1848,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) · 52 unmodified lines
18421848 nvme_dev_list_remove(dev);
18431849
18441850 mutex_lock(&dev->shutdown_lock);
1845− if (dev->bar) {
1851+ if (pci_is_enabled(to_pci_dev(dev->dev))) {
18461852 nvme_stop_queues(&dev->ctrl);
18471853 csts = readl(dev->bar + NVME_REG_CSTS);
18481854 }
@@ -1855,7 +1861,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) · 6 unmodified lines
18551861 nvme_disable_io_queues(dev);
18561862 nvme_disable_admin_queue(dev, shutdown);
18571863 }
1858− nvme_dev_unmap(dev);
1864+ nvme_pci_disable(dev);
18591865
18601866 for (i = dev->queue_count - 1; i >= 0; i--)
18611867 nvme_clear_queue(dev->queues[i]);
@@ -1899,10 +1905,20 @@ static void nvme_pci_free_ctrl(struct nvme_ctrl *ctrl) · 37 unmodified lines
18991905 kfree(dev);
19001906 }
19011907
1908+static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status)
1909+{
1910+ dev_warn(dev->dev, "Removing after probe failure status: %d\n", status);
1911+
1912+ kref_get(&dev->ctrl.kref);
1913+ nvme_dev_disable(dev, false);
1914+ if (!schedule_work(&dev->remove_work))
1915+ nvme_put_ctrl(&dev->ctrl);
1916+}
1917+
19021918 static void nvme_reset_work(struct work_struct *work)
19031919 {
19041920 struct nvme_dev *dev = container_of(work, struct nvme_dev, reset_work);
1905− int result;
1921+ int result = -ENODEV;
19061922
19071923 if (WARN_ON(test_bit(NVME_CTRL_RESETTING, &dev->flags)))
19081924 goto out;
@@ -1911,37 +1927,37 @@ static void nvme_reset_work(struct work_struct *work) · 2 unmodified lines
19111927 * If we're called to reset a live controller first shut it down before
19121928 * moving on.
19131929 */
1914− if (dev->bar)
1930+ if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
19151931 nvme_dev_disable(dev, false);
19161932
19171933 set_bit(NVME_CTRL_RESETTING, &dev->flags);
19181934
1919− result = nvme_dev_map(dev);
1935+ result = nvme_pci_enable(dev);
19201936 if (result)
19211937 goto out;
19221938
19231939 result = nvme_configure_admin_queue(dev);
19241940 if (result)
1925− goto unmap;
1941+ goto out;
19261942
19271943 nvme_init_queue(dev->queues[0], 0);
19281944 result = nvme_alloc_admin_tags(dev);
19291945 if (result)
1930− goto disable;
1946+ goto out;
19311947
19321948 result = nvme_init_identify(&dev->ctrl);
19331949 if (result)
1934− goto free_tags;
1950+ goto out;
19351951
19361952 result = nvme_setup_io_queues(dev);
19371953 if (result)
1938− goto free_tags;
1954+ goto out;
19391955
19401956 dev->ctrl.event_limit = NVME_NR_AEN_COMMANDS;
19411957
19421958 result = nvme_dev_list_add(dev);
19431959 if (result)
1944− goto remove;
1960+ goto out;
19451961
19461962 /*
19471963 * Keep the controller around but remove all namespaces if we don't have
@@ -1958,19 +1974,8 @@ static void nvme_reset_work(struct work_struct *work) · 10 unmodified lines
19581974 clear_bit(NVME_CTRL_RESETTING, &dev->flags);
19591975 return;
19601976
1961− remove:
1962− nvme_dev_list_remove(dev);
1963− free_tags:
1964− nvme_dev_remove_admin(dev);
1965− blk_put_queue(dev->ctrl.admin_q);
1966− dev->ctrl.admin_q = NULL;
1967− dev->queues[0]->tags = NULL;
1968− disable:
1969− nvme_disable_admin_queue(dev, false);
1970− unmap:
1971− nvme_dev_unmap(dev);
19721977 out:
1973− nvme_remove_dead_ctrl(dev);
1978+ nvme_remove_dead_ctrl(dev, result);
19741979 }
19751980
19761981 static void nvme_remove_dead_ctrl_work(struct work_struct *work)
@@ -1978,19 +1983,12 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work) · 1 unmodified line
19781983 struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
19791984 struct pci_dev *pdev = to_pci_dev(dev->dev);
19801985
1986+ nvme_kill_queues(&dev->ctrl);
19811987 if (pci_get_drvdata(pdev))
19821988 pci_stop_and_remove_bus_device_locked(pdev);
19831989 nvme_put_ctrl(&dev->ctrl);
19841990 }
19851991
1986−static void nvme_remove_dead_ctrl(struct nvme_dev *dev)
1987−{
1988− dev_warn(dev->dev, "Removing after probe failure\n");
1989− kref_get(&dev->ctrl.kref);
1990− if (!schedule_work(&dev->remove_work))
1991− nvme_put_ctrl(&dev->ctrl);
1992−}
1993−
19941992 static int nvme_reset(struct nvme_dev *dev)
19951993 {
19961994 if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
@@ -2042,6 +2040,27 @@ static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = { · 45 unmodified lines
20422040 .free_ctrl = nvme_pci_free_ctrl,
20432041 };
20442042
2043+static int nvme_dev_map(struct nvme_dev *dev)
2044+{
2045+ int bars;
2046+ struct pci_dev *pdev = to_pci_dev(dev->dev);
2047+
2048+ bars = pci_select_bars(pdev, IORESOURCE_MEM);
2049+ if (!bars)
2050+ return -ENODEV;
2051+ if (pci_request_selected_regions(pdev, bars, "nvme"))
2052+ return -ENODEV;
2053+
2054+ dev->bar = ioremap(pci_resource_start(pdev, 0), 8192);
2055+ if (!dev->bar)
2056+ goto release;
2057+
2058+ return 0;
2059+ release:
2060+ pci_release_regions(pdev);
2061+ return -ENODEV;
2062+}
2063+
20452064 static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
20462065 {
20472066 int node, result = -ENOMEM;
@@ -2066,6 +2085,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 18 unmodified lines
20662085 dev->dev = get_device(&pdev->dev);
20672086 pci_set_drvdata(pdev, dev);
20682087
2088+ result = nvme_dev_map(dev);
2089+ if (result)
2090+ goto free;
2091+
20692092 INIT_LIST_HEAD(&dev->node);
20702093 INIT_WORK(&dev->scan_work, nvme_dev_scan);
20712094 INIT_WORK(&dev->reset_work, nvme_reset_work);
@@ -2089,6 +2112,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 17 unmodified lines
20892112 nvme_release_prp_pools(dev);
20902113 put_pci:
20912114 put_device(dev->dev);
2115+ nvme_dev_unmap(dev);
20922116 free:
20932117 kfree(dev->queues);
20942118 kfree(dev->entry);
@@ -2112,10 +2136,16 @@ static void nvme_shutdown(struct pci_dev *pdev) · 17 unmodified lines
21122136 nvme_dev_disable(dev, true);
21132137 }
21142138
2139+/*
2140+ * The driver's remove may be called on a device in a partially initialized
2141+ * state. This function must not have any dependencies on the device state in
2142+ * order to proceed.
2143+ */
21152144 static void nvme_remove(struct pci_dev *pdev)
21162145 {
21172146 struct nvme_dev *dev = pci_get_drvdata(pdev);
21182147
2148+ set_bit(NVME_CTRL_REMOVING, &dev->flags);
21192149 pci_set_drvdata(pdev, NULL);
21202150 flush_work(&dev->scan_work);
21212151 nvme_remove_namespaces(&dev->ctrl);
@@ -2126,6 +2156,7 @@ static void nvme_remove(struct pci_dev *pdev) · 4 unmodified lines
21262156 nvme_free_queues(dev, 0);
21272157 nvme_release_cmb(dev);
21282158 nvme_release_prp_pools(dev);
2159+ nvme_dev_unmap(dev);
21292160 nvme_put_ctrl(&dev->ctrl);
21302161 }
21312162
fs/fs-writeback.c+41−13
@@ -223,6 +223,9 @@ static void wb_wait_for_completion(struct backing_dev_info *bdi, · 222 unmodified lines
223223 #define WB_FRN_HIST_MAX_SLOTS (WB_FRN_HIST_THR_SLOTS / 2 + 1)
224224 /* one round can affect upto 5 slots */
225225
226+static atomic_t isw_nr_in_flight = ATOMIC_INIT(0);
227+static struct workqueue_struct *isw_wq;
228+
226229 void __inode_attach_wb(struct inode *inode, struct page *page)
227230 {
228231 struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -317,7 +320,6 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) · 88 unmodified lines
317320 struct inode_switch_wbs_context *isw =
318321 container_of(work, struct inode_switch_wbs_context, work);
319322 struct inode *inode = isw->inode;
320− struct super_block *sb = inode->i_sb;
321323 struct address_space *mapping = inode->i_mapping;
322324 struct bdi_writeback *old_wb = inode->i_wb;
323325 struct bdi_writeback *new_wb = isw->new_wb;
@@ -424,8 +426,9 @@ skip_switch: · 100 unmodified lines
424426 wb_put(new_wb);
425427
426428 iput(inode);
427− deactivate_super(sb);
428429 kfree(isw);
430+
431+ atomic_dec(&isw_nr_in_flight);
429432 }
430433
431434 static void inode_switch_wbs_rcu_fn(struct rcu_head *rcu_head)
@@ -435,7 +438,7 @@ static void inode_switch_wbs_rcu_fn(struct rcu_head *rcu_head) · 3 unmodified lines
435438
436439 /* needs to grab bh-unsafe locks, bounce to work item */
437440 INIT_WORK(&isw->work, inode_switch_wbs_work_fn);
438− schedule_work(&isw->work);
441+ queue_work(isw_wq, &isw->work);
439442 }
440443
441444 /**
@@ -471,20 +474,20 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) · 29 unmodified lines
471474
472475 /* while holding I_WB_SWITCH, no one else can update the association */
473476 spin_lock(&inode->i_lock);
474−
475− if (inode->i_state & (I_WB_SWITCH | I_FREEING) ||
476− inode_to_wb(inode) == isw->new_wb)
477− goto out_unlock;
478−
479− if (!atomic_inc_not_zero(&inode->i_sb->s_active))
480− goto out_unlock;
481−
477+ if (!(inode->i_sb->s_flags & MS_ACTIVE) ||
478+ inode->i_state & (I_WB_SWITCH | I_FREEING) ||
479+ inode_to_wb(inode) == isw->new_wb) {
480+ spin_unlock(&inode->i_lock);
481+ goto out_free;
482+ }
482483 inode->i_state |= I_WB_SWITCH;
483484 spin_unlock(&inode->i_lock);
484485
485486 ihold(inode);
486487 isw->inode = inode;
487488
489+ atomic_inc(&isw_nr_in_flight);
490+
488491 /*
489492 * In addition to synchronizing among switchers, I_WB_SWITCH tells
490493 * the RCU protected stat update paths to grab the mapping's
@@ -494,8 +497,6 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) · 3 unmodified lines
494497 call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
495498 return;
496499
497−out_unlock:
498− spin_unlock(&inode->i_lock);
499500 out_free:
500501 if (isw->new_wb)
501502 wb_put(isw->new_wb);
@@ -847,6 +848,33 @@ restart: · 345 unmodified lines
847848 wb_put(last_wb);
848849 }
849850
851+/**
852+ * cgroup_writeback_umount - flush inode wb switches for umount
853+ *
854+ * This function is called when a super_block is about to be destroyed and
855+ * flushes in-flight inode wb switches. An inode wb switch goes through
856+ * RCU and then workqueue, so the two need to be flushed in order to ensure
857+ * that all previously scheduled switches are finished. As wb switches are
858+ * rare occurrences and synchronize_rcu() can take a while, perform
859+ * flushing iff wb switches are in flight.
860+ */
861+void cgroup_writeback_umount(void)
862+{
863+ if (atomic_read(&isw_nr_in_flight)) {
864+ synchronize_rcu();
865+ flush_workqueue(isw_wq);
866+ }
867+}
868+
869+static int __init cgroup_writeback_init(void)
870+{
871+ isw_wq = alloc_workqueue("inode_switch_wbs", 0, 0);
872+ if (!isw_wq)
873+ return -ENOMEM;
874+ return 0;
875+}
876+fs_initcall(cgroup_writeback_init);
877+
850878 #else /* CONFIG_CGROUP_WRITEBACK */
851879
852880 static struct bdi_writeback *
fs/super.c+1−0
@@ -415,6 +415,7 @@ void generic_shutdown_super(struct super_block *sb) · 414 unmodified lines
415415 sb->s_flags &= ~MS_ACTIVE;
416416
417417 fsnotify_unmount_inodes(sb);
418+ cgroup_writeback_umount();
418419
419420 evict_inodes(sb);
420421
include/linux/bio.h+37−0
@@ -310,6 +310,43 @@ static inline void bio_clear_flag(struct bio *bio, unsigned int bit) · 309 unmodified lines
310310 bio->bi_flags &= ~(1U << bit);
311311 }
312312
313+static inline void bio_get_first_bvec(struct bio *bio, struct bio_vec *bv)
314+{
315+ *bv = bio_iovec(bio);
316+}
317+
318+static inline void bio_get_last_bvec(struct bio *bio, struct bio_vec *bv)
319+{
320+ struct bvec_iter iter = bio->bi_iter;
321+ int idx;
322+
323+ if (!bio_flagged(bio, BIO_CLONED)) {
324+ *bv = bio->bi_io_vec[bio->bi_vcnt - 1];
325+ return;
326+ }
327+
328+ if (unlikely(!bio_multiple_segments(bio))) {
329+ *bv = bio_iovec(bio);
330+ return;
331+ }
332+
333+ bio_advance_iter(bio, &iter, iter.bi_size);
334+
335+ if (!iter.bi_bvec_done)
336+ idx = iter.bi_idx - 1;
337+ else /* in the middle of bvec */
338+ idx = iter.bi_idx;
339+
340+ *bv = bio->bi_io_vec[idx];
341+
342+ /*
343+ * iter.bi_bvec_done records actual length of the last bvec
344+ * if this bio ends in the middle of one io vector
345+ */
346+ if (iter.bi_bvec_done)
347+ bv->bv_len = iter.bi_bvec_done;
348+}
349+
313350 enum bip_flags {
314351 BIP_BLOCK_INTEGRITY = 1 << 0, /* block layer owns integrity data */
315352 BIP_MAPPED_INTEGRITY = 1 << 1, /* ref tag has been remapped */
include/linux/blkdev.h+18−7
@@ -895,7 +895,7 @@ static inline unsigned int blk_rq_get_max_sectors(struct request *rq) · 894 unmodified lines
895895 {
896896 struct request_queue *q = rq->q;
897897
898− if (unlikely(rq->cmd_type == REQ_TYPE_BLOCK_PC))
898+ if (unlikely(rq->cmd_type != REQ_TYPE_FS))
899899 return q->limits.max_hw_sectors;
900900
901901 if (!q->limits.chunk_sectors || (rq->cmd_flags & REQ_DISCARD))
@@ -1372,6 +1372,13 @@ static inline void put_dev_sector(Sector p) · 470 unmodified lines
13721372 page_cache_release(p.v);
13731373 }
13741374
1375+static inline bool __bvec_gap_to_prev(struct request_queue *q,
1376+ struct bio_vec *bprv, unsigned int offset)
1377+{
1378+ return offset ||
1379+ ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q));
1380+}
1381+
13751382 /*
13761383 * Check if adding a bio_vec after bprv with offset would create a gap in
13771384 * the SG list. Most drivers don't care about this, but some do.
@@ -1381,18 +1388,22 @@ static inline bool bvec_gap_to_prev(struct request_queue *q, · 3 unmodified lines
13811388 {
13821389 if (!queue_virt_boundary(q))
13831390 return false;
1384− return offset ||
1385− ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q));
1391+ return __bvec_gap_to_prev(q, bprv, offset);
13861392 }
13871393
13881394 static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
13891395 struct bio *next)
13901396 {
1391− if (!bio_has_data(prev))
1392− return false;
1397+ if (bio_has_data(prev) && queue_virt_boundary(q)) {
1398+ struct bio_vec pb, nb;
1399+
1400+ bio_get_last_bvec(prev, &pb);
1401+ bio_get_first_bvec(next, &nb);
13931402
1394− return bvec_gap_to_prev(q, &prev->bi_io_vec[prev->bi_vcnt - 1],
1395− next->bi_io_vec[0].bv_offset);
1403+ return __bvec_gap_to_prev(q, &pb, nb.bv_offset);
1404+ }
1405+
1406+ return false;
13961407 }
13971408
13981409 static inline bool req_gap_back_merge(struct request *req, struct bio *bio)
include/linux/writeback.h+5−0
@@ -198,6 +198,7 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc, · 197 unmodified lines
198198 void wbc_detach_inode(struct writeback_control *wbc);
199199 void wbc_account_io(struct writeback_control *wbc, struct page *page,
200200 size_t bytes);
201+void cgroup_writeback_umount(void);
201202
202203 /**
203204 * inode_attach_wb - associate an inode with its wb
@@ -301,6 +302,10 @@ static inline void wbc_account_io(struct writeback_control *wbc, · 97 unmodified lines
301302 {
302303 }
303304
305+static inline void cgroup_writeback_umount(void)
306+{
307+}
308+
304309 #endif /* CONFIG_CGROUP_WRITEBACK */
305310
306311 /*