- 16 Jun, 2023 15 commits
-
-
Manish Rangankar authored
System crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up gets called for uninitialized wait queue sp->nvme_ls_waitq. qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0 qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] Remove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed previously in the commits tagged Fixed: below. Fixes: 219d27d7 ("scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands") Fixes: 5621b0dd ("scsi: qla2xxx: Simpify unregistration of FC-NVMe local/remote ports") Cc: stable@vger.kernel.org Signed-off-by:Manish Rangankar <mrangankar@marvell.com> Signed-off-by:
Nilesh Javali <njavali@marvell.com> Link: https://lore.kernel.org/r/20230615074633.12721-1-njavali@marvell.comSigned-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Martin K. Petersen authored
Nilesh Javali <njavali@marvell.com> says: Please apply the qla2xxx driver klocwork fixes to the scsi tree at your earliest convenience. Link: https://lore.kernel.org/r/20230607113843.37185-1-njavali@marvell.comSigned-off-by:
-
Adrian Hunter authored
Add PCI ID to support Intel Arrow Lake, same as MTL (Intel Meteor Lake). Signed-off-by:
Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230613170327.61186-1-adrian.hunter@intel.comReviewed-by:
Bart Van Assche <bvanassche@acm.org> Reviewed-by:
Avri Altman <avri.altman@wdc.com> Signed-off-by:
-
Johannes Thumshirn authored
Use PAGE_SECTORS_SHIFT instead of open-coding it. Signed-off-by:
Johannes Thumshirn <johannes.thumshirn@wdc.com> Link: https://lore.kernel.org/r/20230613-sd_zbc-page_sectors-v1-1-363460a4413d@wdc.comReviewed-by:
Niklas Cassel <niklas.cassel@wdc.com> Signed-off-by:
-
Lu Hongfei authored
There are three flags that control Write Booster Feature: 1. WB ON/OFF 2. WB Hibern Flush ON/OFF (implicitly) 3. WB Flush ON/OFF (explicit) In the case of "Hibern Flush", one of the conditions for flush WB buffer is that avail_wb_buff < wb_flush_threshold. As we know, different users have different requirements for power consumption and performance. Therefore, we need the ability to manually set wb_flush_threshold, so that users can easily and flexibly adjust the wb_flush_threshold value, thereby achieving a balance between power consumption and performance. So the sysfs attribute that controls this is necessary. wb_flush_threshold represents the threshold for flushing WB buffer, whose value expressed in unit of 10% granularity, such as '1' representing 10%, '2' representing 20%, and so on. Signed-off-by:Lu Hongfei <luhongfei@vivo.com> Link: https://lore.kernel.org/r/20230613022240.16595-1-luhongfei@vivo.comReviewed-by:
-
Abel Vesa authored
Now that there is a new dedicated ICE driver, drop the ufs-qcom-ice and use the new ICE api provided by the Qualcomm soc driver ice. The platforms that already have ICE support will use the API as library since there will not be a devicetree node, but instead they have reg range. In this case, the of_qcom_ice_get will return an ICE instance created for the consumer's device. But if there are platforms that do not have ice reg in the consumer devicetree node and instead provide a dedicated ICE devicetree node, the of_qcom_ice_get will look up the device based on qcom,ice property and will get the ICE instance registered by the probe function of the ice driver. The ICE clock is now handle by the new driver. This is done by enabling it on the creation of the ICE instance and then enabling/disabling it on UFS runtime resume/suspend. Signed-off-by:
Abel Vesa <abel.vesa@linaro.org> Link: https://lore.kernel.org/r/20230612192847.1599416-3-abel.vesa@linaro.orgReviewed-by:
Eric Biggers <ebiggers@google.com> Signed-off-by:
-
Abel Vesa authored
Starting with SM8550, the ICE will have its own devicetree node so add the qcom,ice property to reference it. Reviewed-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by:
-
Po-Wen Kao authored
Enable UFSHCD_QUIRK_MCQ_BROKEN_RTC for MediaTek host. Signed-off-by:
Po-Wen Kao <powen.kao@mediatek.com> Link: https://lore.kernel.org/r/20230612085817.12275-5-powen.kao@mediatek.comReviewed-by:
Stanley Chu <stanley.chu@mediatek.com> Signed-off-by:
-
Po-Wen Kao authored
Enable UFSHCD_QUIRK_MCQ_BROKEN_INTR for MediaTek host. Signed-off-by:
-
Po-Wen Kao authored
Some hosts do not implement SQ Run Time Command (SQRTC) register, thus we need this quirk to skip the related flow. Signed-off-by:
-
Po-Wen Kao authored
Quirk UFSHCD_QUIRK_MCQ_BROKEN_INTR is introduced for hosts that implement a different interrupt topology from the UFSHCI 4.0 spec. Some hosts raise per hw queue interrupt in addition to CQES (traditional) when ESI is disabled. Enabling this quirk will disable CQES and use only per hw queue interrupt. Signed-off-by:
-
Po-Wen Kao authored
This commit depends on "scsi: ufs: core: mcq: Fix the incorrect OCS value for the device command" which takes care of the OCS value of dev commands in MCQ mode. It is safe to share first hwq for dev command and I/O request here. Tested-by:
-
Stanley Chu authored
In MCQ mode, when a device command uses a hardware queue shared with other commands, a race condition may occur in the following scenario: 1. A device command is completed in CQx with CQE entry "e". 2. The interrupt handler copies the "cqe" pointer to "hba->dev_cmd.cqe" and completes "hba->dev_cmd.complete". 3. The "ufshcd_wait_for_dev_cmd()" function is awakened and retrieves the OCS value from "hba->dev_cmd.cqe". However, there is a possibility that the CQE entry "e" will be overwritten by newly completed commands in CQx, resulting in an incorrect OCS value being received by "ufshcd_wait_for_dev_cmd()". To avoid this race condition, the OCS value should be immediately copied to the struct "lrb" of the device command. Then "ufshcd_wait_for_dev_cmd()" can retrieve the OCS value from the struct "lrb". Fixes: 57b1c0ef ("scsi: ufs: core: mcq: Add support to allocate multiple queues") Suggested-by:Can Guo <quic_cang@quicinc.com> Signed-off-by:
-
Krzysztof Kozlowski authored
Clean up bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by:
Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by:
-
Damien Le Moal authored
The introduction of the macro IOPRIO_PRIO_LEVEL() in commit eca20409 ("scsi: block: ioprio: Clean up interface definition") results in an iopriority level to always be masked using the macro IOPRIO_LEVEL_MASK, and thus to the kernel always seeing an acceptable value for an I/O priority level when checked in ioprio_check_cap(). Before this patch, this function would return an error for some (but not all) invalid values for a level valid range of [0..7]. Restore and improve the detection of invalid priority levels by introducing the inline function ioprio_value() to check an ioprio class, level and hint value before combining these fields into a single value to be used with ioprio_set() or AIOs. If an invalid value for the class, level or hint of an ioprio is detected, ioprio_value() returns an ioprio using the class IOPRIO_CLASS_INVALID, indicating an invalid value and causing ioprio_check_cap() to return -EINVAL. Fixes: 6c913257 ("scsi: block: Introduce ioprio hints") Fixes: eca20409 ("scsi: block: ioprio: Clean up interface definition") Signed-off-by:
Damien Le Moal <dlemoal@kernel.org> Link: https://lore.kernel.org/r/20230608095556.124001-1-dlemoal@kernel.orgReviewed-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
- 15 Jun, 2023 8 commits
-
-
Nilesh Javali authored
Signed-off-by:
Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by:
-
Bikash Hazarika authored
Klocwork reported array 'port_dstate_str' of size 10 may use index value(s) 10..15. Add a fix to correct the index of array. Cc: stable@vger.kernel.org Signed-off-by:
Bikash Hazarika <bhazarika@marvell.com> Signed-off-by:
-
Shreyas Deodhar authored
Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. Cc: stable@vger.kernel.org Signed-off-by:
Shreyas Deodhar <sdeodhar@marvell.com> Signed-off-by:
-
Quinn Tran authored
Klocwork warning: Buffer Overflow - Array Index Out of Bounds Driver uses fc_els_flogi to calculate size of buffer. The actual buffer is nested inside of fc_els_flogi which is smaller. Replace structure name to allow proper size calculation. Cc: stable@vger.kernel.org Signed-off-by:
Quinn Tran <qutran@marvell.com> Signed-off-by:
-
Nilesh Javali authored
Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced. Check valid rport returned by fc_bsg_to_rport(). Cc: stable@vger.kernel.org Signed-off-by:
-
Nilesh Javali authored
Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL. Cc: stable@vger.kernel.org Signed-off-by:
-
Bikash Hazarika authored
Klocwork tool reported 'cur_dsd' may be dereferenced. Add fix to validate pointer before dereferencing the pointer. Cc: stable@vger.kernel.org Signed-off-by:
-
Nilesh Javali authored
Klocwork reports array 'vha->host_str' of size 16 may use index value(s) 16..19. Use snprintf() instead of sprintf(). Cc: stable@vger.kernel.org Co-developed-by:
-
- 08 Jun, 2023 8 commits
-
-
Christophe JAILLET authored
'new_fcports' is unused, so drop it. Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/49bb77624c9edc8d9bf8fe71d0c8a4cd7e582175.1685854354.git.christophe.jaillet@wanadoo.frSigned-off-by:
-
Gustavo A. R. Silva authored
One-element arrays as fake flex arrays are deprecated and we are moving towards adopting C99 flexible-array members, instead. So, replace one-element array declaration in struct ct_sns_gpnft_rsp, which is ultimately being used inside a union: drivers/scsi/qla2xxx/qla_def.h: 3240 struct ct_sns_gpnft_pkt { 3241 union { 3242 struct ct_sns_req req; 3243 struct ct_sns_gpnft_rsp rsp; 3244 } p; 3245 }; Refactor the rest of the code, accordingly. This issue was found with the help of Coccinelle. Link: https://github.com/KSPP/linux/issues/245 Link: https://github.com/KSPP/linux/issues/193Reviewed-by:Kees Cook <keescook@chromium.org> Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/ZH+/rZ1R1cBjIxjS@workSigned-off-by:
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. hisi_sas_remove() returned zero unconditionally so this was changed to return void. Then it has the right prototype to be used directly as remove callback for the two hisi_sas drivers. Signed-off-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20230518202043.261739-1-u.kleine-koenig@pengutronix.deSigned-off-by:
-
Gustavo A. R. Silva authored
Prevent any potential integer wrapping issue, and avoid a -Wstringop-overflow warning by using the check_mul_overflow() helper. drivers/scsi/lpfc/lpfc.h: 837:#define LPFC_RAS_MIN_BUFF_POST_SIZE (256 * 1024) drivers/scsi/lpfc/lpfc_debugfs.c: 2266 size = LPFC_RAS_MIN_BUFF_POST_SIZE * phba->cfg_ras_fwlog_buffsize; this can wrap to negative if cfg_ras_fwlog_buffsize is large enough. And even when in practice this is not possible (due to phba->cfg_ras_fwlog_buffsize never being larger than 4[1]), the compiler is legitimately warning us about potentially buggy code. Fix the following warning seen under GCC-13: In function ‘lpfc_debugfs_ras_log_data’, inlined from ‘lpfc_debugfs_ras_log_open’ at drivers/scsi/lpfc/lpfc_debugfs.c:2271:15: drivers/scsi/lpfc/lpfc_debugfs.c:2210:25: warning: ‘memcpy’ specified bound between 18446744071562067968 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Wstringop-overflow=] 2210 | memcpy(buffer + copied, dmabuf->virt, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2211 | size - copied - 1); | ~~~~~~~~~~~~~~~~~~ Link: https://github.com/KSPP/linux/issues/305 Link: https://lore.kernel.org/linux-hardening/CABPRKS8zyzrbsWt4B5fp7kMowAZFiMLKg5kW26uELpg1cDKY3A@mail.gmail.com/ [1] Co-developed-by:Justin Tee <justin.tee@broadcom.com> Signed-off-by:
-
Justin Tee authored
Prefer struct_size() over open-coded versions of idiom: sizeof(struct-with-flex-array) + sizeof(typeof-flex-array-elements) * count where count is the max number of items the flexible array is supposed to contain. Link: https://github.com/KSPP/linux/issues/160Co-developed-by:
-
Stanley Chu authored
Currently, ufshcd_mcq_poll_cqe_nolock() is only called by ufshcd_mcq_poll_cqe_lock() with the addition of a spinlock wrapper for ufshcd_mcq_poll_cqe_nolock(). Combining these two functions into one results in cleaner code. Reviewed-by:
Bao D. Nguyen <quic_nguyenb@quicinc.com> Signed-off-by:
Keoseong Park <keosung.park@samsung.com> Acked-by:
Bean Huo <beanhuo@micron.com> Reviewed-by:
-
zhanghui authored
When qdepth is not power of 2, not every bit of the mask is 1, so in sq_tail_slot some bits will be cleared unexpectedly. Signed-off-by:
zhanghui <zhanghui31@xiaomi.com> Link: https://lore.kernel.org/r/20230601124613.1446-1-zhanghui31@xiaomi.comReviewed-by:
-
Bart Van Assche authored
ufshcd_add_command_trace() traces SCSI commands. Remove a ufshcd_add_command_trace() call from a code path that is not related to SCSI commands. Signed-off-by:
-
- 01 Jun, 2023 9 commits
-
-
Martin K. Petersen authored
Bart Van Assche <bvanassche@acm.org> says: Please consider these four UFS host controller driver patches for the next merge window. Link: https://lore.kernel.org/r/20230524203659.1394307-1-bvanassche@acm.orgSigned-off-by:
-
Bart Van Assche authored
All UFS host drivers call ufshcd_shutdown(). Hence, instead of calling ufshcd_shutdown() from the host driver .shutdown() callback, inline that function into ufshcd_wl_shutdown(). Reviewed-by:
-
Bart Van Assche authored
Move the definition of ufshcd_wl_shutdown() to make the next patch in this series easier to review. Reviewed-by:
-
Bart Van Assche authored
ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0 Fixes: 5a0b0cb9 ("[SCSI] ufs: Add support for sending NOP OUT UPIU") Signed-off-by:
-
Bart Van Assche authored
One UFS vendor asked to increase the UFS timeout from 1 s to 3 s. Another UFS vendor asked to increase the UFS timeout from 1 s to 10 s. Hence this patch that increases the UFS timeout to 10 s. This patch can cause the total timeout to exceed 20 s, the Android shutdown timeout. This is fine since the loop around ufshcd_execute_start_stop() exists to deal with unit attentions and because unit attentions are reported quickly. Fixes: dcd5b763 ("scsi: ufs: Reduce the START STOP UNIT timeout") Fixes: 8f2c9642 ("scsi: ufs: core: Reduce the power mode change timeout") Acked-by:
-
Sathya Prakash authored
Copy the sense data to internal driver buffer when the firmware completes any SCSI I/O command sent through admin queue with sense data for further use. Fixes: 506bc1a0 ("scsi: mpi3mr: Add support for MPT commands") Cc: <stable@vger.kernel.org> Signed-off-by:
Sathya Prakash <sathya.prakash@broadcom.com> Signed-off-by:
Sumit Saxena <sumit.saxena@broadcom.com> Link: https://lore.kernel.org/r/20230531184025.3803-1-sumit.saxena@broadcom.comSigned-off-by:
-
Martin K. Petersen authored
Bao D. Nguyen <quic_nguyenb@quicinc.com> says: This patch series enables support for ufshcd_abort() and error handler in MCQ mode. Link: https://lore.kernel.org/r/cover.1685396241.git.quic_nguyenb@quicinc.comSigned-off-by:
-
Bao D. Nguyen authored
Add support for error handling for MCQ mode. Suggested-by:
-
Bao D. Nguyen authored
In preparation for adding MCQ error handler support, update the MCQ code to use the ufshcd_mcq_poll_cqe_lock() in interrupt context instead of using ufshcd_mcq_poll_cqe_nolock(). This is to keep synchronization between MCQ interrupt and error handler contexts because both need to access the MCQ hardware in separate contexts. Signed-off-by:
-
