[PATCH] arm64: add pmem module for kernel update

2020-12-30 Thread Zhuling 
Category: feature
Bugzilla: NA
CVE: NA

Use reserved memory to create a pmem device to store the
processes information that dumped before kernel update.
When you want to use this feature you need to declare by
"pmemmem=pmem_size:pmem_phystart" in cmdline.
(exp: pmemmem=100M:0x2020)

Signed-off-by: Zhuling 
---
 arch/arm64/kernel/setup.c |   5 +++
 arch/arm64/mm/init.c  |  90 +++
 drivers/nvdimm/Kconfig|  11 +
 drivers/nvdimm/Makefile   |   3 ++
 drivers/nvdimm/kup_pmem.c | 106 ++
 include/linux/ioport.h|   1 +
 include/linux/mm.h|   4 ++
 lib/Kconfig   |   6 +++
 8 files changed, 226 insertions(+)
 create mode 100644 drivers/nvdimm/kup_pmem.c

diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 133257f..0bd9429 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -237,6 +237,11 @@ static void __init request_standard_resources(void)
if (kernel_data.start >= res->start &&
kernel_data.end <= res->end)
request_resource(res, _data);
+#ifdef CONFIG_KUP_PMEM_MEMORY
+   if (pmem_res.end)
+   insert_resource(_resource, _res);
+#endif
+
 #ifdef CONFIG_KEXEC_CORE
/* Userspace will find "Crash kernel" region in /proc/iomem. */
if (crashk_res.end && crashk_res.start >= res->start &&
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 0955406..9d1395e 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -62,6 +62,18 @@ EXPORT_SYMBOL(memstart_addr);
 phys_addr_t arm64_dma_phys_limit __ro_after_init;
 static phys_addr_t arm64_dma32_phys_limit __ro_after_init;

+#ifdef CONFIG_KUP_PMEM_MEMORY
+static unsigned long long pmem_size, pmem_phystart;
+
+struct resource pmem_res = {
+   .name = "Kpmem Dev",
+   .start = 0,
+   .end = 0,
+   .flags = IORESOURCE_MEM,
+   .desc = IORES_DESC_KPMEM_DEV
+};
+#endif
+
 #ifdef CONFIG_KEXEC_CORE
 /*
  * reserve_crashkernel() - reserves memory for crash kernel
@@ -123,6 +135,80 @@ static void __init reserve_crashkernel(void)
 }
 #endif /* CONFIG_KEXEC_CORE */

+#ifdef CONFIG_KUP_PMEM_MEMORY
+/*
+ * reserve_pmem() - reserves memory for pmem
+ *
+ * This function reserves memory area given in "pmemmem=" kernel command
+ * line parameter. The memory reserved is used by pmem restore progress
+ * when kernel update.
+ */
+static int __init parse_pmem(char *par)
+{
+   char *cur = par;
+
+   if (!par)
+   return 0;
+
+   pmem_size = 0;
+   pmem_phystart = 0;
+
+   pmem_size = memparse(par, );
+   if (par == cur) {
+   pr_warn("pmem: memory value expected\n");
+   return -EINVAL;
+   }
+
+   if (*cur == ':')
+   pmem_phystart = memparse(cur+1, );
+   else if (*cur != ' ' && *cur != '\0') {
+   pr_warn("pmem: unrecognized char %c\n", *cur);
+   return -EINVAL;
+   }
+
+   return 0;
+}
+early_param("pmemmem", parse_pmem);
+
+static void __init reserve_pmem(void)
+{
+   if (!pmem_size || !pmem_phystart) {
+   return;
+   }
+
+   pmem_size = PAGE_ALIGN(pmem_size);
+
+   if (!memblock_is_region_memory(pmem_phystart, pmem_size)) {
+   pr_warn("cannot reserve pmem: region is not memory!\n");
+   return;
+   }
+
+   if (memblock_is_region_reserved(pmem_phystart, pmem_size)) {
+   pr_warn("cannot reserve pmem: region overlaps reserved 
memory!\n");
+   return;
+   }
+
+   if (!IS_ALIGNED(pmem_phystart, SZ_2M)) {
+   pr_warn("cannot reserve pmem: base address is not 2MB 
aligned\n");
+   return;
+   }
+   memblock_reserve(pmem_phystart, pmem_size);
+   memblock_remove(pmem_phystart, pmem_size);
+   pr_info("pmem reserved: 0x%016llx - 0x%016llx (%lld MB)\n",
+   pmem_phystart, pmem_phystart + pmem_size, pmem_size >> 20);
+
+   pmem_res.start = pmem_phystart;
+   pmem_res.end = pmem_phystart + pmem_size - 1;
+}
+#else
+static void __init reserve_pmem(void)
+{
+}
+static void __init reserve_pmem_pages(void)
+{
+}
+#endif /*CONFIG_KUP_PMEM_MEMORY*/
+
 #ifdef CONFIG_CRASH_DUMP
 static int __init early_init_dt_scan_elfcorehdr(unsigned long node,
const char *uname, int depth, void *data)
@@ -390,6 +476,10 @@ void __init arm64_memblock_init(void)

reserve_elfcorehdr();

+#ifdef CONFIG_KUP_PMEM_MEMORY
+   reserve_pmem();
+#endif
+
high_memory = __va(memblock_end_of_DRAM() - 1) + 1;

dma_contiguous_reserve(arm64_dma32_phys_limit);
diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig
index b7d1eb3..7f5fa22 100644
--- a/drivers/nvdimm/Kconfig
+++ b/drivers/nvdimm/Kconfig
@@ -119,6 +119,17 @@ config NVDIMM_KEYS
depends on ENCRYPTED_KEYS
depends on (LIBNVDIMM=ENCRYPTED_KEYS)

[PATCH 10/10] fs/dax: remove useless functions

2020-12-30 Thread Shiyang Ruan 
Since owner tarcking is triggerred by pmem device, these functions are
useless.  So remove it.

Signed-off-by: Shiyang Ruan 
---
 fs/dax.c| 112 
 include/linux/dax.h |   2 -
 2 files changed, 114 deletions(-)

diff --git a/fs/dax.c b/fs/dax.c
index 799210cfa687..4267de360d79 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -323,48 +323,6 @@ static unsigned long dax_end_pfn(void *entry)
for (pfn = dax_to_pfn(entry); \
pfn < dax_end_pfn(entry); pfn++)
 
-/*
- * TODO: for reflink+dax we need a way to associate a single page with
- * multiple address_space instances at different linear_page_index()
- * offsets.
- */
-static void dax_associate_entry(void *entry, struct address_space *mapping,
-   struct vm_area_struct *vma, unsigned long address)
-{
-   unsigned long size = dax_entry_size(entry), pfn, index;
-   int i = 0;
-
-   if (IS_ENABLED(CONFIG_FS_DAX_LIMITED))
-   return;
-
-   index = linear_page_index(vma, address & ~(size - 1));
-   for_each_mapped_pfn(entry, pfn) {
-   struct page *page = pfn_to_page(pfn);
-
-   WARN_ON_ONCE(page->mapping);
-   page->mapping = mapping;
-   page->index = index + i++;
-   }
-}
-
-static void dax_disassociate_entry(void *entry, struct address_space *mapping,
-   bool trunc)
-{
-   unsigned long pfn;
-
-   if (IS_ENABLED(CONFIG_FS_DAX_LIMITED))
-   return;
-
-   for_each_mapped_pfn(entry, pfn) {
-   struct page *page = pfn_to_page(pfn);
-
-   WARN_ON_ONCE(trunc && page_ref_count(page) > 1);
-   WARN_ON_ONCE(page->mapping && page->mapping != mapping);
-   page->mapping = NULL;
-   page->index = 0;
-   }
-}
-
 static struct page *dax_busy_page(void *entry)
 {
unsigned long pfn;
@@ -399,72 +357,6 @@ unsigned long dax_load_pfn(struct address_space *mapping, 
unsigned long index)
return pfn;
 }
 
-/*
- * dax_lock_mapping_entry - Lock the DAX entry corresponding to a page
- * @page: The page whose entry we want to lock
- *
- * Context: Process context.
- * Return: A cookie to pass to dax_unlock_page() or 0 if the entry could
- * not be locked.
- */
-dax_entry_t dax_lock_page(struct page *page)
-{
-   XA_STATE(xas, NULL, 0);
-   void *entry;
-
-   /* Ensure page->mapping isn't freed while we look at it */
-   rcu_read_lock();
-   for (;;) {
-   struct address_space *mapping = READ_ONCE(page->mapping);
-
-   entry = NULL;
-   if (!mapping || !dax_mapping(mapping))
-   break;
-
-   /*
-* In the device-dax case there's no need to lock, a
-* struct dev_pagemap pin is sufficient to keep the
-* inode alive, and we assume we have dev_pagemap pin
-* otherwise we would not have a valid pfn_to_page()
-* translation.
-*/
-   entry = (void *)~0UL;
-   if (S_ISCHR(mapping->host->i_mode))
-   break;
-
-   xas.xa = >i_pages;
-   xas_lock_irq();
-   if (mapping != page->mapping) {
-   xas_unlock_irq();
-   continue;
-   }
-   xas_set(, page->index);
-   entry = xas_load();
-   if (dax_is_locked(entry)) {
-   rcu_read_unlock();
-   wait_entry_unlocked(, entry);
-   rcu_read_lock();
-   continue;
-   }
-   dax_lock_entry(, entry);
-   xas_unlock_irq();
-   break;
-   }
-   rcu_read_unlock();
-   return (dax_entry_t)entry;
-}
-
-void dax_unlock_page(struct page *page, dax_entry_t cookie)
-{
-   struct address_space *mapping = page->mapping;
-   XA_STATE(xas, >i_pages, page->index);
-
-   if (S_ISCHR(mapping->host->i_mode))
-   return;
-
-   dax_unlock_entry(, (void *)cookie);
-}
-
 /*
  * Find page cache entry at given index. If it is a DAX entry, return it
  * with the entry locked. If the page cache doesn't contain an entry at
@@ -543,7 +435,6 @@ static void *grab_mapping_entry(struct xa_state *xas,
xas_lock_irq(xas);
}
 
-   dax_disassociate_entry(entry, mapping, false);
xas_store(xas, NULL);   /* undo the PMD join */
dax_wake_entry(xas, entry, true);
mapping->nrexceptional--;
@@ -680,7 +571,6 @@ static int __dax_invalidate_entry(struct address_space 
*mapping,
(xas_get_mark(, PAGECACHE_TAG_DIRTY) ||
 xas_get_mark(, PAGECACHE_TAG_TOWRITE)))
goto out;
-   dax_disassociate_entry(entry, mapping, trunc);
xas_store(, NULL);

[PATCH 07/10] dm: Introduce ->rmap() to find bdev offset

2020-12-30 Thread Shiyang Ruan 
Pmem device could be a target of mapped device.  In order to obtain
superblock on the mapped device, we introduce this to translate offset
from target device to md device.

Currently, we implement it on linear target, which is easy to do the
translation.  Other targets will be supported in the future.  However,
some targets may not support it because of the non-linear mapping.

Signed-off-by: Shiyang Ruan 
---
 drivers/md/dm-linear.c| 8 
 include/linux/device-mapper.h | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
index 00774b5d7668..7a7719e9958d 100644
--- a/drivers/md/dm-linear.c
+++ b/drivers/md/dm-linear.c
@@ -119,6 +119,13 @@ static void linear_status(struct dm_target *ti, 
status_type_t type,
}
 }
 
+static sector_t linear_rmap(struct dm_target *ti, sector_t offset)
+{
+   struct linear_c *lc = (struct linear_c *) ti->private;
+
+   return offset - dm_target_offset(ti, lc->start);
+}
+
 static int linear_prepare_ioctl(struct dm_target *ti, struct block_device 
**bdev)
 {
struct linear_c *lc = (struct linear_c *) ti->private;
@@ -238,6 +245,7 @@ static struct target_type linear_target = {
.ctr= linear_ctr,
.dtr= linear_dtr,
.map= linear_map,
+   .rmap   = linear_rmap,
.status = linear_status,
.prepare_ioctl = linear_prepare_ioctl,
.iterate_devices = linear_iterate_devices,
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 61a66fb8ebb3..4a2afff6937e 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -58,6 +58,7 @@ typedef void (*dm_dtr_fn) (struct dm_target *ti);
  * = 2: The target wants to push back the io
  */
 typedef int (*dm_map_fn) (struct dm_target *ti, struct bio *bio);
+typedef sector_t (*dm_rmap_fn) (struct dm_target *ti, sector_t offset);
 typedef int (*dm_clone_and_map_request_fn) (struct dm_target *ti,
struct request *rq,
union map_info *map_context,
@@ -175,6 +176,7 @@ struct target_type {
dm_ctr_fn ctr;
dm_dtr_fn dtr;
dm_map_fn map;
+   dm_rmap_fn rmap;
dm_clone_and_map_request_fn clone_and_map_rq;
dm_release_clone_request_fn release_clone_rq;
dm_endio_fn end_io;
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 06/10] pmem: Implement ->corrupted_range() for pmem driver

2020-12-30 Thread Shiyang Ruan 
Obtain the superblock of a pmem disk, and call filesystem's
->corrupted_range() to handle the corrupted data.

Signed-off-by: Shiyang Ruan 
---
 block/genhd.c | 12 
 drivers/nvdimm/pmem.c | 24 
 include/linux/genhd.h |  1 +
 3 files changed, 37 insertions(+)

diff --git a/block/genhd.c b/block/genhd.c
index 9387f050c248..436adce123b2 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1058,6 +1058,18 @@ struct block_device *bdget_disk(struct gendisk *disk, 
int partno)
 }
 EXPORT_SYMBOL(bdget_disk);
 
+struct block_device *bdget_disk_sector(struct gendisk *disk, sector_t sector)
+{
+   struct block_device *bdev = NULL;
+   struct hd_struct *part = disk_map_sector_rcu(disk, sector);
+
+   if (part)
+   bdev = bdget_part(part);
+
+   return bdev;
+}
+EXPORT_SYMBOL(bdget_disk_sector);
+
 /*
  * print a full list of all partitions - intended for places where the root
  * filesystem can't be mounted and thus to give the victim some idea of what
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 4a114937c43b..4688bff19c20 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -253,6 +253,29 @@ static int pmem_rw_page(struct block_device *bdev, 
sector_t sector,
return blk_status_to_errno(rc);
 }
 
+static int pmem_corrupted_range(struct gendisk *disk, struct block_device 
*bdev,
+   loff_t disk_offset, size_t len, void *data)
+{
+   struct super_block *sb;
+   loff_t bdev_offset;
+   sector_t disk_sector = disk_offset >> SECTOR_SHIFT;
+   int rc = 0;
+
+   bdev = bdget_disk_sector(disk, disk_sector);
+   if (!bdev)
+   return -ENODEV;
+
+   bdev_offset = (disk_sector - get_start_sect(bdev)) << SECTOR_SHIFT;
+   sb = get_super(bdev);
+   if (sb && sb->s_op->corrupted_range) {
+   rc = sb->s_op->corrupted_range(sb, bdev, bdev_offset, len, 
data);
+   drop_super(sb);
+   }
+
+   bdput(bdev);
+   return rc;
+}
+
 /* see "strong" declaration in tools/testing/nvdimm/pmem-dax.c */
 __weak long __pmem_direct_access(struct pmem_device *pmem, pgoff_t pgoff,
long nr_pages, void **kaddr, pfn_t *pfn)
@@ -281,6 +304,7 @@ static const struct block_device_operations pmem_fops = {
.owner =THIS_MODULE,
.submit_bio =   pmem_submit_bio,
.rw_page =  pmem_rw_page,
+   .corrupted_range =  pmem_corrupted_range,
 };
 
 static int pmem_dax_zero_page_range(struct dax_device *dax_dev, pgoff_t pgoff,
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 03da3f603d30..ed06209008b8 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -303,6 +303,7 @@ static inline void add_disk_no_queue_reg(struct gendisk 
*disk)
 extern void del_gendisk(struct gendisk *gp);
 extern struct gendisk *get_gendisk(dev_t dev, int *partno);
 extern struct block_device *bdget_disk(struct gendisk *disk, int partno);
+extern struct block_device *bdget_disk_sector(struct gendisk *disk, sector_t 
sector);
 
 extern void set_device_ro(struct block_device *bdev, int flag);
 extern void set_disk_ro(struct gendisk *disk, int flag);
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 09/10] xfs: Implement ->corrupted_range() for XFS

2020-12-30 Thread Shiyang Ruan 
This function is used to handle errors which may cause data lost in
filesystem.  Such as memory failure in fsdax mode.

In XFS, it requires "rmapbt" feature in order to query for files or
metadata which associated to the corrupted data.  Then we could call fs
recover functions to try to repair the corrupted data.(did not
implemented in this patchset)

After that, the memory failure also needs to notify the processes who
are using those files.

Only support data device.  Realtime device is not supported for now.

Signed-off-by: Shiyang Ruan 
---
 fs/xfs/xfs_fsops.c |   5 +++
 fs/xfs/xfs_mount.h |   1 +
 fs/xfs/xfs_super.c | 107 +
 3 files changed, 113 insertions(+)

diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index ef1d5bb88b93..0a2038875d32 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -501,6 +501,11 @@ xfs_do_force_shutdown(
 "Corruption of in-memory data detected.  Shutting down filesystem");
if (XFS_ERRLEVEL_HIGH <= xfs_error_level)
xfs_stack_trace();
+   } else if (flags & SHUTDOWN_CORRUPT_META) {
+   xfs_alert_tag(mp, XFS_PTAG_SHUTDOWN_CORRUPT,
+"Corruption of on-disk metadata detected.  Shutting down filesystem");
+   if (XFS_ERRLEVEL_HIGH <= xfs_error_level)
+   xfs_stack_trace();
} else if (logerror) {
xfs_alert_tag(mp, XFS_PTAG_SHUTDOWN_LOGERROR,
"Log I/O Error Detected. Shutting down filesystem");
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index dfa429b77ee2..8f0df67ffcc1 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -274,6 +274,7 @@ void xfs_do_force_shutdown(struct xfs_mount *mp, int flags, 
char *fname,
 #define SHUTDOWN_LOG_IO_ERROR  0x0002  /* write attempt to the log failed */
 #define SHUTDOWN_FORCE_UMOUNT  0x0004  /* shutdown from a forced unmount */
 #define SHUTDOWN_CORRUPT_INCORE0x0008  /* corrupt in-memory data 
structures */
+#define SHUTDOWN_CORRUPT_META  0x0010  /* corrupt metadata on device */
 
 /*
  * Flags for xfs_mountfs
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index e3e229e52512..cbcad419bb9e 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -35,6 +35,11 @@
 #include "xfs_refcount_item.h"
 #include "xfs_bmap_item.h"
 #include "xfs_reflink.h"
+#include "xfs_alloc.h"
+#include "xfs_rmap.h"
+#include "xfs_rmap_btree.h"
+#include "xfs_rtalloc.h"
+#include "xfs_bit.h"
 
 #include 
 #include 
@@ -1103,6 +1108,107 @@ xfs_fs_free_cached_objects(
return xfs_reclaim_inodes_nr(XFS_M(sb), sc->nr_to_scan);
 }
 
+static int
+xfs_corrupt_helper(
+   struct xfs_btree_cur*cur,
+   struct xfs_rmap_irec*rec,
+   void*data)
+{
+   struct xfs_inode*ip;
+   struct address_space*mapping;
+   int rc = 0;
+   int *flags = data;
+
+   if (XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) ||
+   (rec->rm_flags & (XFS_RMAP_ATTR_FORK | XFS_RMAP_BMBT_BLOCK))) {
+   // TODO check and try to fix metadata
+   rc = -EFSCORRUPTED;
+   } else {
+   /*
+* Get files that incore, filter out others that are not in use.
+*/
+   rc = xfs_iget(cur->bc_mp, cur->bc_tp, rec->rm_owner,
+ XFS_IGET_INCORE, 0, );
+   if (rc || !ip)
+   return rc;
+   if (!VFS_I(ip)->i_mapping)
+   goto out;
+
+   mapping = VFS_I(ip)->i_mapping;
+   if (IS_DAX(VFS_I(ip)))
+   rc = mf_dax_mapping_kill_procs(mapping, rec->rm_offset,
+  *flags);
+   else
+   mapping_set_error(mapping, -EFSCORRUPTED);
+
+   // TODO try to fix data
+out:
+   xfs_irele(ip);
+   }
+
+   return rc;
+}
+
+static int
+xfs_fs_corrupted_range(
+   struct super_block  *sb,
+   struct block_device *bdev,
+   loff_t  offset,
+   size_t  len,
+   void*data)
+{
+   struct xfs_mount*mp = XFS_M(sb);
+   struct xfs_trans*tp = NULL;
+   struct xfs_btree_cur*cur = NULL;
+   struct xfs_rmap_irecrmap_low, rmap_high;
+   struct xfs_buf  *agf_bp = NULL;
+   xfs_fsblock_t   fsbno = XFS_B_TO_FSB(mp, offset);
+   xfs_filblks_t   bcnt = XFS_B_TO_FSB(mp, len);
+   xfs_agnumber_t  agno = XFS_FSB_TO_AGNO(mp, fsbno);
+   xfs_agblock_t   agbno = XFS_FSB_TO_AGBNO(mp, fsbno);
+   int error = 0;
+
+   if (mp->m_rtdev_targp && mp->m_rtdev_targp->bt_bdev == bdev) {
+   xfs_warn(mp, "corrupted_range support not available for

[PATCH 05/10] mm, pmem: Implement ->memory_failure() in pmem driver

2020-12-30 Thread Shiyang Ruan 
Call the ->memory_failure() which is implemented by pmem driver, in
order to finally notify filesystem to handle the corrupted data.  The
old collecting and killing processes are moved into
mf_dax_mapping_kill_procs(), which will be called by filesystem.

Signed-off-by: Shiyang Ruan 
---
 drivers/nvdimm/pmem.c | 24 +
 mm/memory-failure.c   | 50 +--
 2 files changed, 29 insertions(+), 45 deletions(-)

diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 875076b0ea6c..4a114937c43b 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -363,9 +363,33 @@ static void pmem_release_disk(void *__pmem)
put_disk(pmem->disk);
 }
 
+static int pmem_pagemap_memory_failure(struct dev_pagemap *pgmap,
+   unsigned long pfn, int flags)
+{
+   struct pmem_device *pdev;
+   struct gendisk *disk;
+   loff_t disk_offset;
+   int rc = 0;
+   unsigned long size = page_size(pfn_to_page(pfn));
+
+   pdev = container_of(pgmap, struct pmem_device, pgmap);
+   disk = pdev->disk;
+   if (!disk)
+   return -ENXIO;
+
+   disk_offset = PFN_PHYS(pfn) - pdev->phys_addr - pdev->data_offset;
+   if (disk->fops->corrupted_range) {
+   rc = disk->fops->corrupted_range(disk, NULL, disk_offset, size, 
);
+   if (rc == -ENODEV)
+   rc = -ENXIO;
+   }
+   return rc;
+}
+
 static const struct dev_pagemap_ops fsdax_pagemap_ops = {
.kill   = pmem_pagemap_kill,
.cleanup= pmem_pagemap_cleanup,
+   .memory_failure = pmem_pagemap_memory_failure,
 };
 
 static int pmem_attach_disk(struct device *dev,
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 37bc6e2a9564..0109ad607fb8 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1269,28 +1269,11 @@ static int memory_failure_dev_pagemap(unsigned long 
pfn, int flags,
struct dev_pagemap *pgmap)
 {
struct page *page = pfn_to_page(pfn);
-   const bool unmap_success = true;
-   unsigned long size = 0;
-   struct to_kill *tk;
-   LIST_HEAD(to_kill);
int rc = -EBUSY;
-   loff_t start;
-   dax_entry_t cookie;
-
-   /*
-* Prevent the inode from being freed while we are interrogating
-* the address_space, typically this would be handled by
-* lock_page(), but dax pages do not use the page lock. This
-* also prevents changes to the mapping of this pfn until
-* poison signaling is complete.
-*/
-   cookie = dax_lock_page(page);
-   if (!cookie)
-   goto out;
 
if (hwpoison_filter(page)) {
rc = 0;
-   goto unlock;
+   goto out;
}
 
if (pgmap->type == MEMORY_DEVICE_PRIVATE) {
@@ -1298,7 +1281,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, 
int flags,
 * TODO: Handle HMM pages which may need coordination
 * with device-side memory.
 */
-   goto unlock;
+   goto out;
}
 
/*
@@ -1307,33 +1290,10 @@ static int memory_failure_dev_pagemap(unsigned long 
pfn, int flags,
 */
SetPageHWPoison(page);
 
-   /*
-* Unlike System-RAM there is no possibility to swap in a
-* different physical page at a given virtual address, so all
-* userspace consumption of ZONE_DEVICE memory necessitates
-* SIGBUS (i.e. MF_MUST_KILL)
-*/
-   flags |= MF_ACTION_REQUIRED | MF_MUST_KILL;
-   collect_procs_file(page, page->mapping, page->index, _kill,
-  flags & MF_ACTION_REQUIRED);
+   /* call driver to handle the memory failure */
+   if (pgmap->ops->memory_failure)
+   rc = pgmap->ops->memory_failure(pgmap, pfn, flags);
 
-   list_for_each_entry(tk, _kill, nd)
-   if (tk->size_shift)
-   size = max(size, 1UL << tk->size_shift);
-   if (size) {
-   /*
-* Unmap the largest mapping to avoid breaking up
-* device-dax mappings which are constant size. The
-* actual size of the mapping being torn down is
-* communicated in siginfo, see kill_proc()
-*/
-   start = (page->index << PAGE_SHIFT) & ~(size - 1);
-   unmap_mapping_range(page->mapping, start, start + size, 0);
-   }
-   kill_procs(_kill, flags & MF_MUST_KILL, !unmap_success, pfn, flags);
-   rc = 0;
-unlock:
-   dax_unlock_page(page, cookie);
 out:
/* drop pgmap ref acquired in caller */
put_dev_pagemap(pgmap);
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 08/10] md: Implement ->corrupted_range()

2020-12-30 Thread Shiyang Ruan 
With the support of ->rmap(), it is possible to obtain the superblock on
a mapped device.

If a pmem device is used as one target of mapped device, we cannot
obtain its superblock directly.  With the help of SYSFS, the mapped
device can be found on the target devices.  So, we iterate the
bdev->bd_holder_disks to obtain its mapped device.

Signed-off-by: Shiyang Ruan 
---
 drivers/md/dm.c   | 54 +++
 drivers/nvdimm/pmem.c | 11 +++--
 fs/block_dev.c| 37 +
 include/linux/genhd.h |  2 ++
 4 files changed, 96 insertions(+), 8 deletions(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4e0cbfe3f14d..f9955be7afeb 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -507,6 +507,59 @@ static int dm_blk_report_zones(struct gendisk *disk, 
sector_t sector,
 #define dm_blk_report_zonesNULL
 #endif /* CONFIG_BLK_DEV_ZONED */
 
+struct dm_blk_corrupt {
+   struct block_device *bdev;
+   sector_t offset;
+};
+
+static int dm_blk_corrupt_fn(struct dm_target *ti, struct dm_dev *dev,
+   sector_t start, sector_t len, void *data)
+{
+   struct dm_blk_corrupt *bc = data;
+
+   return bc->bdev == (void *)dev->bdev &&
+   (start <= bc->offset && bc->offset < start + len);
+}
+
+static int dm_blk_corrupted_range(struct gendisk *disk,
+ struct block_device *target_bdev,
+ loff_t target_offset, size_t len, void *data)
+{
+   struct mapped_device *md = disk->private_data;
+   struct block_device *md_bdev = md->bdev;
+   struct dm_table *map;
+   struct dm_target *ti;
+   int srcu_idx, i, rc = -ENODEV;
+   bool found = false;
+   sector_t disk_sect, target_sect = to_sector(target_offset);
+
+   map = dm_get_live_table(md, _idx);
+   if (!map)
+   return rc;
+
+   for (i = 0; i < dm_table_get_num_targets(map); i++) {
+   ti = dm_table_get_target(map, i);
+   if (ti->type->iterate_devices && ti->type->rmap) {
+   struct dm_blk_corrupt bc = {target_bdev, target_sect};
+
+   found = ti->type->iterate_devices(ti, 
dm_blk_corrupt_fn, );
+   if (!found)
+   continue;
+   disk_sect = ti->type->rmap(ti, target_sect);
+   break;
+   }
+   }
+
+   if (found) {
+   loff_t disk_off = to_bytes(disk_sect);
+   loff_t bdev_off = to_bytes(disk_sect - get_start_sect(md_bdev));
+   rc = bd_corrupted_range(md_bdev, disk_off, bdev_off, len, data);
+   }
+
+   dm_put_live_table(md, srcu_idx);
+   return rc;
+}
+
 static int dm_prepare_ioctl(struct mapped_device *md, int *srcu_idx,
struct block_device **bdev)
 {
@@ -3084,6 +3137,7 @@ static const struct block_device_operations dm_blk_dops = 
{
.getgeo = dm_blk_getgeo,
.report_zones = dm_blk_report_zones,
.pr_ops = _pr_ops,
+   .corrupted_range = dm_blk_corrupted_range,
.owner = THIS_MODULE
 };
 
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 4688bff19c20..9f9a2f3bf73b 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -256,21 +256,16 @@ static int pmem_rw_page(struct block_device *bdev, 
sector_t sector,
 static int pmem_corrupted_range(struct gendisk *disk, struct block_device 
*bdev,
loff_t disk_offset, size_t len, void *data)
 {
-   struct super_block *sb;
loff_t bdev_offset;
sector_t disk_sector = disk_offset >> SECTOR_SHIFT;
-   int rc = 0;
+   int rc = -ENODEV;
 
bdev = bdget_disk_sector(disk, disk_sector);
if (!bdev)
-   return -ENODEV;
+   return rc;
 
bdev_offset = (disk_sector - get_start_sect(bdev)) << SECTOR_SHIFT;
-   sb = get_super(bdev);
-   if (sb && sb->s_op->corrupted_range) {
-   rc = sb->s_op->corrupted_range(sb, bdev, bdev_offset, len, 
data);
-   drop_super(sb);
-   }
+   rc = bd_corrupted_range(bdev, bdev_offset, bdev_offset, len, data);
 
bdput(bdev);
return rc;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9e84b1928b94..0e50f0e8e8af 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1171,6 +1171,27 @@ struct bd_holder_disk {
int refcnt;
 };
 
+static int bd_disk_holder_corrupted_range(struct block_device *bdev, loff_t 
off,
+ size_t len, void *data)
+{
+   struct bd_holder_disk *holder;
+   struct gendisk *disk;
+   int rc = 0;
+
+   if (list_empty(&(bdev->bd_holder_disks)))
+   return -ENODEV;
+
+   list_for_each_entry(holder, >bd_holder_disks, list) {
+   disk = holder->disk;
+   if

[PATCH 04/10] mm, fsdax: Refactor memory-failure handler for dax mapping

2020-12-30 Thread Shiyang Ruan 
The current memory_failure_dev_pagemap() can only handle single-mapped
dax page for fsdax mode.  The dax page could be mapped by multiple files
and offsets if we let reflink feature & fsdax mode work together.  So,
we refactor current implementation to support handle memory failure on
each file and offset.

Signed-off-by: Shiyang Ruan 
---
 fs/dax.c| 21 +++
 include/linux/dax.h |  1 +
 include/linux/mm.h  |  9 +
 mm/memory-failure.c | 91 ++---
 4 files changed, 100 insertions(+), 22 deletions(-)

diff --git a/fs/dax.c b/fs/dax.c
index 5b47834f2e1b..799210cfa687 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -378,6 +378,27 @@ static struct page *dax_busy_page(void *entry)
return NULL;
 }
 
+/*
+ * dax_load_pfn - Load pfn of the DAX entry corresponding to a page
+ * @mapping: The file whose entry we want to load
+ * @index:   The offset where the DAX entry located in
+ *
+ * Return:   pfn of the DAX entry
+ */
+unsigned long dax_load_pfn(struct address_space *mapping, unsigned long index)
+{
+   XA_STATE(xas, >i_pages, index);
+   void *entry;
+   unsigned long pfn;
+
+   xas_lock_irq();
+   entry = xas_load();
+   pfn = dax_to_pfn(entry);
+   xas_unlock_irq();
+
+   return pfn;
+}
+
 /*
  * dax_lock_mapping_entry - Lock the DAX entry corresponding to a page
  * @page: The page whose entry we want to lock
diff --git a/include/linux/dax.h b/include/linux/dax.h
index b52f084aa643..89e56ceeffc7 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -150,6 +150,7 @@ int dax_writeback_mapping_range(struct address_space 
*mapping,
 
 struct page *dax_layout_busy_page(struct address_space *mapping);
 struct page *dax_layout_busy_page_range(struct address_space *mapping, loff_t 
start, loff_t end);
+unsigned long dax_load_pfn(struct address_space *mapping, unsigned long index);
 dax_entry_t dax_lock_page(struct page *page);
 void dax_unlock_page(struct page *page, dax_entry_t cookie);
 #else
diff --git a/include/linux/mm.h b/include/linux/mm.h
index db6ae4d3fb4e..db3059a1853e 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1141,6 +1141,14 @@ static inline bool is_device_private_page(const struct 
page *page)
page->pgmap->type == MEMORY_DEVICE_PRIVATE;
 }
 
+static inline bool is_device_fsdax_page(const struct page *page)
+{
+   return IS_ENABLED(CONFIG_DEV_PAGEMAP_OPS) &&
+   IS_ENABLED(CONFIG_DEVICE_PRIVATE) &&
+   is_zone_device_page(page) &&
+   page->pgmap->type == MEMORY_DEVICE_FS_DAX;
+}
+
 static inline bool is_pci_p2pdma_page(const struct page *page)
 {
return IS_ENABLED(CONFIG_DEV_PAGEMAP_OPS) &&
@@ -3030,6 +3038,7 @@ enum mf_flags {
MF_MUST_KILL = 1 << 2,
MF_SOFT_OFFLINE = 1 << 3,
 };
+extern int mf_dax_mapping_kill_procs(struct address_space *mapping, pgoff_t 
index, int flags);
 extern int memory_failure(unsigned long pfn, int flags);
 extern void memory_failure_queue(unsigned long pfn, int flags);
 extern void memory_failure_queue_kick(int cpu);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 5d880d4eb9a2..37bc6e2a9564 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -56,6 +56,7 @@
 #include 
 #include 
 #include 
+#include 
 #include "internal.h"
 #include "ras/ras_event.h"
 
@@ -120,6 +121,9 @@ static int hwpoison_filter_dev(struct page *p)
if (PageSlab(p))
return -EINVAL;
 
+   if (is_device_fsdax_page(p))
+   return 0;
+
mapping = page_mapping(p);
if (mapping == NULL || mapping->host == NULL)
return -EINVAL;
@@ -290,9 +294,8 @@ void shake_page(struct page *p, int access)
 EXPORT_SYMBOL_GPL(shake_page);
 
 static unsigned long dev_pagemap_mapping_shift(struct page *page,
-   struct vm_area_struct *vma)
+   struct vm_area_struct *vma, unsigned long address)
 {
-   unsigned long address = vma_address(page, vma);
pgd_t *pgd;
p4d_t *p4d;
pud_t *pud;
@@ -333,8 +336,8 @@ static unsigned long dev_pagemap_mapping_shift(struct page 
*page,
  * Uses GFP_ATOMIC allocations to avoid potential recursions in the VM.
  */
 static void add_to_kill(struct task_struct *tsk, struct page *p,
-  struct vm_area_struct *vma,
-  struct list_head *to_kill)
+   struct address_space *mapping, pgoff_t pgoff,
+   struct vm_area_struct *vma, struct list_head *to_kill)
 {
struct to_kill *tk;
 
@@ -345,9 +348,12 @@ static void add_to_kill(struct task_struct *tsk, struct 
page *p,
}
 
tk->addr = page_address_in_vma(p, vma);
-   if (is_zone_device_page(p))
-   tk->size_shift = dev_pagemap_mapping_shift(p, vma);
-   else
+   if (is_zone_device_page(p)) {
+   if (is_device_fsdax_page(p))
+   tk->addr = vma->vm_start +
+

[PATCH 03/10] fs: Introduce ->corrupted_range() for superblock

2020-12-30 Thread Shiyang Ruan 
Memory failure occurs in fsdax mode will finally be handled in
filesystem.  We introduce this interface to find out files or metadata
affected by the corrupted range, and try to recover the corrupted data
if possiable.

Signed-off-by: Shiyang Ruan 
---
 include/linux/fs.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 8667d0cdc71e..282e2139b23e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1965,6 +1965,8 @@ struct super_operations {
  struct shrink_control *);
long (*free_cached_objects)(struct super_block *,
struct shrink_control *);
+   int (*corrupted_range)(struct super_block *sb, struct block_device 
*bdev,
+  loff_t offset, size_t len, void *data);
 };
 
 /*
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 02/10] blk: Introduce ->corrupted_range() for block device

2020-12-30 Thread Shiyang Ruan 
In fsdax mode, the memory failure happens on block device.  So, it is
needed to introduce an interface for block devices.  Each kind of block
device can handle the memory failure in ther own ways.

Signed-off-by: Shiyang Ruan 
---
 include/linux/blkdev.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 033eb5f73b65..45256fe84fa7 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1858,6 +1858,8 @@ struct block_device_operations {
int (*report_zones)(struct gendisk *, sector_t sector,
unsigned int nr_zones, report_zones_cb cb, void *data);
char *(*devnode)(struct gendisk *disk, umode_t *mode);
+   int (*corrupted_range)(struct gendisk *disk, struct block_device *bdev,
+  loff_t offset, size_t len, void *data);
struct module *owner;
const struct pr_ops *pr_ops;
 };
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 00/10] fsdax: introduce fs query to support reflink

2020-12-30 Thread Shiyang Ruan 
This patchset is aimed to support shared pages tracking for fsdax.

Change from RFC v3:
  - Do not lock dax entry in memory failure handler
  - Add a helper function for corrupted_range
  - Add restrictions in xfs code
  - Fix code style
  - remove the useless association and lock in fsdax

Change from RFC v2:
  - Adjust the order of patches
  - Divide the infrastructure and the drivers that use it
  - Rebased to v5.10

Change from RFC v1:
  - Introduce ->block_lost() for block device
  - Support mapped device
  - Add 'not available' warning for realtime device in XFS
  - Rebased to v5.10-rc1

This patchset moves owner tracking from dax_assocaite_entry() to pmem
device driver, by introducing an interface ->memory_failure() of struct
pagemap.  This interface is called by memory_failure() in mm, and
implemented by pmem device.  Then pmem device calls its ->corrupted_range()
to find the filesystem which the corrupted data located in, and call
filesystem handler to track files or metadata assocaited with this page.
Finally we are able to try to fix the corrupted data in filesystem and do
other necessary processing, such as killing processes who are using the
files affected.

The call trace is like this:
memory_failure()
 pgmap->ops->memory_failure()  => pmem_pgmap_memory_failure()
  gendisk->fops->corrupted_range() => - pmem_corrupted_range()
  - md_blk_corrupted_range()
   sb->s_ops->currupted_range()=> xfs_fs_corrupted_range()
xfs_rmap_query_range()
 xfs_currupt_helper()
  * corrupted on metadata
  try to recover data, call xfs_force_shutdown()
  * corrupted on file data 
  try to recover data, call mf_dax_mapping_kill_procs()

The fsdax & reflink support for XFS is not contained in this patchset.

(Rebased on v5.10)
--

Shiyang Ruan (10):
  pagemap: Introduce ->memory_failure()
  blk: Introduce ->corrupted_range() for block device
  fs: Introduce ->corrupted_range() for superblock
  mm, fsdax: Refactor memory-failure handler for dax mapping
  mm, pmem: Implement ->memory_failure() in pmem driver
  pmem: Implement ->corrupted_range() for pmem driver
  dm: Introduce ->rmap() to find bdev offset
  md: Implement ->corrupted_range()
  xfs: Implement ->corrupted_range() for XFS
  fs/dax: remove useless functions

 block/genhd.c |  12 
 drivers/md/dm-linear.c|   8 +++
 drivers/md/dm.c   |  54 ++
 drivers/nvdimm/pmem.c |  43 +++
 fs/block_dev.c|  37 ++
 fs/dax.c  | 115 -
 fs/xfs/xfs_fsops.c|   5 ++
 fs/xfs/xfs_mount.h|   1 +
 fs/xfs/xfs_super.c| 107 +++
 include/linux/blkdev.h|   2 +
 include/linux/dax.h   |   3 +-
 include/linux/device-mapper.h |   2 +
 include/linux/fs.h|   2 +
 include/linux/genhd.h |   3 +
 include/linux/memremap.h  |   8 +++
 include/linux/mm.h|   9 +++
 mm/memory-failure.c   | 131 ++
 17 files changed, 375 insertions(+), 167 deletions(-)

-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH 01/10] pagemap: Introduce ->memory_failure()

2020-12-30 Thread Shiyang Ruan 
When memory-failure occurs, we call this function which is implemented
by each kind of devices.  For the fsdax case, pmem device driver
implements it.  Pmem device driver will find out the block device where
the error page locates in, and try to get the filesystem on this block
device.  And finally call filesystem handler to deal with the error.
The filesystem will try to recover the corrupted data if possiable.

Signed-off-by: Shiyang Ruan 
---
 include/linux/memremap.h | 8 
 1 file changed, 8 insertions(+)

diff --git a/include/linux/memremap.h b/include/linux/memremap.h
index 79c49e7f5c30..0bcf2b1e20bd 100644
--- a/include/linux/memremap.h
+++ b/include/linux/memremap.h
@@ -87,6 +87,14 @@ struct dev_pagemap_ops {
 * the page back to a CPU accessible page.
 */
vm_fault_t (*migrate_to_ram)(struct vm_fault *vmf);
+
+   /*
+* Handle the memory failure happens on one page.  Notify the processes
+* who are using this page, and try to recover the data on this page
+* if necessary.
+*/
+   int (*memory_failure)(struct dev_pagemap *pgmap, unsigned long pfn,
+ int flags);
 };
 
 #define PGMAP_ALTMAP_VALID (1 << 0)
-- 
2.29.2


___
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-le...@lists.01.org

[PATCH AUTOSEL 5.10 31/31] device-dax: Fix range release

2020-12-30 Thread Sasha Levin 
From: Dan Williams 

[ Upstream commit 6268d7da4d192af339f4d688942b9ccb45a65e04 ]

There are multiple locations that open-code the release of the last
range in a device-dax instance. Consolidate this into a new
dev_dax_trim_range() helper.

This also addresses a kmemleak report:

# cat /sys/kernel/debug/kmemleak
[..]
unreferenced object 0x976bd46f6240 (size 64):
   comm "ndctl", pid 23556, jiffies 4299514316 (age 5406.733s)
   hex dump (first 32 bytes):
 00 00 00 00 00 00 00 00 00 00 20 c3 37 00 00 00  .. .7...
 ff ff ff 7f 38 00 00 00 00 00 00 00 00 00 00 00  8...
   backtrace:
 [<064003cf>] __kmalloc_track_caller+0x136/0x379
 [] krealloc+0x67/0x92
 [] __alloc_dev_dax_range+0x73/0x25c
 [<27d58626>] devm_create_dev_dax+0x27d/0x416
 [<434abd43>] __dax_pmem_probe+0x1c9/0x1000 [dax_pmem_core]
 [<83726c1c>] dax_pmem_probe+0x10/0x1f [dax_pmem]
 [] nvdimm_bus_probe+0x9d/0x340 [libnvdimm]
 [] really_probe+0x230/0x48d
 [<6cabd38e>] driver_probe_device+0x122/0x13b
 [<29c7b95a>] device_driver_attach+0x5b/0x60
 [<53e5659b>] bind_store+0xb7/0xc3
 [] drv_attr_store+0x27/0x31
 [<949069c5>] sysfs_kf_write+0x4a/0x57
 [<4a8b5adf>] kernfs_fop_write+0x150/0x1e5
 [] __vfs_write+0x1b/0x34
 [] vfs_write+0xd8/0x1d1

Reported-by: Jane Chu 
Cc: Zhen Lei 
Link: 
https://lore.kernel.org/r/160834570161.1791850.14911670304441510419.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams 
Signed-off-by: Sasha Levin 
---
 drivers/dax/bus.c | 44 +---
 1 file changed, 21 insertions(+), 23 deletions(-)

diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
index 27513d311242e..de7b74505e75e 100644
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -367,19 +367,28 @@ void kill_dev_dax(struct dev_dax *dev_dax)
 }
 EXPORT_SYMBOL_GPL(kill_dev_dax);
 
-static void free_dev_dax_ranges(struct dev_dax *dev_dax)
+static void trim_dev_dax_range(struct dev_dax *dev_dax)
 {
+   int i = dev_dax->nr_range - 1;
+   struct range *range = _dax->ranges[i].range;
struct dax_region *dax_region = dev_dax->region;
-   int i;
 
device_lock_assert(dax_region->dev);
-   for (i = 0; i < dev_dax->nr_range; i++) {
-   struct range *range = _dax->ranges[i].range;
-
-   __release_region(_region->res, range->start,
-   range_len(range));
+   dev_dbg(_dax->dev, "delete range[%d]: %#llx:%#llx\n", i,
+   (unsigned long long)range->start,
+   (unsigned long long)range->end);
+
+   __release_region(_region->res, range->start, range_len(range));
+   if (--dev_dax->nr_range == 0) {
+   kfree(dev_dax->ranges);
+   dev_dax->ranges = NULL;
}
-   dev_dax->nr_range = 0;
+}
+
+static void free_dev_dax_ranges(struct dev_dax *dev_dax)
+{
+   while (dev_dax->nr_range)
+   trim_dev_dax_range(dev_dax);
 }
 
 static void unregister_dev_dax(void *dev)
@@ -804,15 +813,10 @@ static int alloc_dev_dax_range(struct dev_dax *dev_dax, 
u64 start,
return 0;
 
rc = devm_register_dax_mapping(dev_dax, dev_dax->nr_range - 1);
-   if (rc) {
-   dev_dbg(dev, "delete range[%d]: %pa:%pa\n", dev_dax->nr_range - 
1,
-   >start, >end);
-   dev_dax->nr_range--;
-   __release_region(res, alloc->start, resource_size(alloc));
-   return rc;
-   }
+   if (rc)
+   trim_dev_dax_range(dev_dax);
 
-   return 0;
+   return rc;
 }
 
 static int adjust_dev_dax_range(struct dev_dax *dev_dax, struct resource *res, 
resource_size_t size)
@@ -885,12 +889,7 @@ static int dev_dax_shrink(struct dev_dax *dev_dax, 
resource_size_t size)
if (shrink >= range_len(range)) {
devm_release_action(dax_region->dev,
unregister_dax_mapping, >dev);
-   __release_region(_region->res, range->start,
-   range_len(range));
-   dev_dax->nr_range--;
-   dev_dbg(dev, "delete range[%d]: %#llx:%#llx\n", i,
-   (unsigned long long) range->start,
-   (unsigned long long) range->end);
+   trim_dev_dax_range(dev_dax);
to_shrink -= shrink;
if (!to_shrink)
break;
@@ -1274,7 +1273,6 @@ static void dev_dax_release(struct device *dev)
put_dax(dax_dev);
free_dev_dax_id(dev_dax);
dax_region_put(dax_region);
-   kfree(dev_dax->ranges);