- 15 Mar, 2016 3 commits
-
-
Yaniv Gardi authored
A race condition exists between request requeueing and scsi layer error handling: When UFS driver queuecommand returns a busy status for a request, it will be requeued and its tag will be freed and set to -1. At the same time it is possible that the request will timeout and scsi layer will start error handling for it. The scsi layer reuses the request and its tag to send error related commands to the device, however its tag is no longer valid. As this request was never really sent to the device, there is no point to start error handling with the device. Implement the scsi error handling timeout callback and bypass SCSI error handling for request that were not actually sent to the device. For such requests simply reset the block layer timer. Otherwise, let SCSI layer perform the usual error handling. Reviewed-by:
Hannes Reinecke <hare@suse.de> Signed-off-by:
Gilad Broner <gbroner@codeaurora.org> Signed-off-by:
Yaniv Gardi <ygardi@codeaurora.org> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Yaniv Gardi authored
When control reaches to Linux UFS driver during UFS boot mode, UFS host controller interrupt status/enable registers may have left over settings. In order to avoid any spurious interrupts due to these left overs, it's important to clear these interrupt status/enable registers before enabling UFS interrupt handling. Reviewed-by:
Subhash Jadavani <subhashj@codeaurora.org> Signed-off-by:
-
Yaniv Gardi authored
Different platform may have different number of lanes for the UFS link. Add parameter to device tree specifying how many lanes should be configured for the UFS link. Reviewed-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
- 14 Mar, 2016 4 commits
-
-
Douglas Gilbert authored
One of the strange things that the original sg driver did was let the user provide both a data-out buffer (it followed the sg_header+cdb) _and_ specify a reply length greater than zero. What happened was that the user data-out buffer was copied into some kernel buffers and then the mid level was told a read type operation would take place with the data from the device overwriting the same kernel buffers. The user would then read those kernel buffers back into the user space. From what I can tell, the above action was broken by commit fad7f01e ("sg: set dxferp to NULL for READ with the older SG interface") in 2008 and syzkaller found that out recently. Make sure that a user space pointer is passed through when data follows the sg_header structure and command. Fix the abnormal case when a non-zero reply_len is also given. Fixes: fad7f01e Cc: <stable@vger.kernel.org> #v2.6.28+ Signed-off-by:
Douglas Gilbert <dgilbert@interlog.com> Reviewed-by:
Ewan Milne <emilne@redhat.com> Signed-off-by:
-
Vitaly Kuznetsov authored
Commit 3209f9d7 ("scsi: storvsc: Fix a bug in the handling of SRB status flags") filtered SRB_STATUS_AUTOSENSE_VALID out effectively making the (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID) case a dead code. The logic from this branch (e.g. storvsc_device_scan() call) is still required, fix the check. Cc: <stable@vger.kernel.org> #v4.4+ Fixes: 3209f9d7 ("scsi: storvsc: Fix a bug in the handling of SRB status flags") Signed-off-by:
Vitaly Kuznetsov <vkuznets@redhat.com> Acked-by:
K. Y. Srinivasan <kys@microsoft.com> Signed-off-by:
-
Maurizio Lombardi authored
In beiscsi_setup_boot_info(), the boot_kset pointer should be set to NULL in case of failure otherwise an invalid pointer dereference may occur later. Cc: <stable@vger.kernel.org> Signed-off-by:
Maurizio Lombardi <mlombard@redhat.com> Reviewed-by:
Johannes Thumshirn <jthumshirn@suse.de> Reviewed-by:
Jitendra Bhivare <jitendra.bhivare@broadcom.com> Signed-off-by:
-
Martin K. Petersen authored
Commit 39773722 ("sd: Make discard granularity match logical block size when LBPRZ=1") accidentally set the granularity to one byte instead of one logical block on devices that provide deterministic zeroes after UNMAP. Signed-off-by:
Mike Snitzer <snitzer@redhat.com> Reviewed-by:
Bart Van Assche <bart.vanassche@sandisk.com> Fixes: 39773722 Cc: <stable@vger.kernel.org> #v4.4+
-
- 11 Mar, 2016 2 commits
-
-
Hannes Reinecke authored
The test for the existence vpd_pg83 is inverted. Fixes: 7e47976b ("scsi_sysfs: add 'is_bin_visible' callback") Signed-off-by:
Hannes Reinecke <hare@suse.com> Reviewed-by:
-
Sumit Saxena authored
There are few MFI adapters which do not support MR_DCMD_PD_LIST_QUERY so if MFI adapters fail this DCMD, it should not be considered as FATAL and driver should not issue kill adapter and set per controller's instance variable- pd_list_not_supported so that same variable can be used inside functions- slave_alloc and slave_configure to allow firmware scan. Killing adapter because of DCMD failure when this DCMD is not supported causes driver's probe getting failed. This issue got introduced by commit 6d40afbc ("megaraid_sas: MFI IO timeout handling"). Killing adapter in case of this DCMD failure should be limited to Fusion adapters only. Per controller's instance variable allow_fw_scan is removed as pd_list_not_supported better reflect the purpose. Fixes: 6d40afbcSigned-off-by:
Sumit Saxena <sumit.saxena@broadcom.com> Reviewed-by:
Tomas Henzl <thenzl@redhat.com> Signed-off-by:
-
- 10 Mar, 2016 1 commit
-
-
Lars-Peter Clausen authored
Calling synchronize_irq() right before free_irq() is quite useless. On one hand the IRQ can easily fire again before free_irq() is entered, on the other hand free_irq() itself calls synchronize_irq() internally (in a race condition free way), before any state associated with the IRQ is freed. Patch was generated using the following semantic patch: // <smpl> @@ expression irq; @@ -synchronize_irq(irq); free_irq(irq, ...); // </smpl> Signed-off-by:
Lars-Peter Clausen <lars@metafoo.de> Acked-by:
Sreekanth Reddy <sreekanth.reddy@broadcom.com> Signed-off-by:
-
- 09 Mar, 2016 7 commits
-
-
Manoj N. Kumar authored
With the current value of cmd_per_lun at 16, the throughput over a single adapter is limited to around 150kIOPS. Increase the value of cmd_per_lun to 256 to improve throughput. With this change a single adapter is able to attain close to the maximum throughput (380kIOPS). Also change the number of RRQ entries that can be queued. Signed-off-by:
Manoj N. Kumar <manoj@linux.vnet.ibm.com> Acked-by:
Matthew R. Ochs <mrochs@linux.vnet.ibm.com> Reviewed-by:
Uma Krishnan <ukrishn@linux.vnet.ibm.com> Signed-off-by:
-
Manoj N. Kumar authored
When switching to the internal LUN defined on the IBM CXL flash adapter, there is an unnecessary scan occurring on the second port. This scan leads to the following extra lines in the log: Dec 17 10:09:00 tul83p1 kernel: [ 3708.561134] cxlflash 0008:00:00.0: cxlflash_queuecommand: (scp=c0000000fc1f0f00) 11/1/0/0 cdb=(A0000000-00000000-10000000-00000000) Dec 17 10:09:00 tul83p1 kernel: [ 3708.561147] process_cmd_err: cmd failed afu_rc=32 scsi_rc=0 fc_rc=0 afu_extra=0xE, scsi_extra=0x0, fc_extra=0x0 By definition, both of the internal LUNs are on the first port/channel. When the lun_mode is switched to internal LUN the same value for host->max_channel is retained. This causes an unnecessary scan over the second port/channel. This fix alters the host->max_channel to 0 (1 port), if internal LUNs are configured and switches it back to 1 (2 ports) while going back to external LUNs. Signed-off-by:
-
Uma Krishnan authored
In order to support cxlflash in the PowerVM environment, underlying hypervisor APIs have imposed a kernel API ordering change. For the superpipe access to LUN, user applications need a context. The cxlflash module creates this context by making a sequence of cxl calls. In the current code, a context is initialized via cxl_dev_context_init() followed by cxl_process_element(), a function that obtains the process element id. Finally, cxl_start_work() is called to attach the process element. In the PowerVM environment, a process element id cannot be obtained from the hypervisor until the process element is attached. The cxlflash module is unable to create contexts without a valid process element id. To fix this problem, cxl_start_work() is called before obtaining the process element id. Signed-off-by:
-
Matthew R. Ochs authored
The cxlflash_disk_attach() routine currently uses a cascading error gate strategy for its error cleanup path. While this strategy is commonly used to handle cleanup scenarios, it is too restrictive when function callouts need to be restructured. Problems range from inserting error path bugs in previously 'good' code to the cleanup path imposing design changes to how the normal path is structured. A less restrictive approach is needed to support ordering changes that come about when operating in different environments. To overcome this restriction, the error cleanup path is modified to have a single entrypoint and use conditional logic to cleanup where necessary. Entities that require multiple cleanup steps must be carefully vetted to ensure their APIs support state. In cases where they do not (none as of this commit) additional local variables can be used to maintain state on their behalf. Signed-off-by:
-
Matthew R. Ochs authored
Presently, context information structures are allocated and initialized in the same routine, create_context(). This imposes an ordering restriction such that all pieces of information needed to initialize a context must be known before the context is even allocated. This design point is not flexible when the order of context creation needs to be modified. Specifically, this can lead to problems when members of the context information structure are a part of an ordering dependency (i.e. - the 'work' structure embedded within the context). To remedy, the allocation is left as-is, inside of the existing create_context() routine and the initialization is transitioned to a new void routine, init_context(). At the same time, in anticipation of these routines not being called in sequence, a state boolean is added to the context information structure to track when the context has been initilized. The context teardown routine, destroy_context(), is modified to support being called with a non-initialized context. Signed-off-by:
-
Uma Krishnan authored
When operating in the PowerVM environment, the cxlflash module can receive an error from the hypervisor indicating that there are existing mappings in the page table for the process MMIO space. This issue exists because term_afu() currently invokes term_mc() before stop_afu(), allowing for the master context to be detached first and the problem state area to be unmapped second. To resolve this issue, stop_afu() should be called before term_mc(). Signed-off-by:
-
Manoj N. Kumar authored
The calls to pci_request_regions(), pci_resource_start(), pci_set_dma_mask(), pci_set_master() and pci_save_state() are all unnecessary for the IBM CXL flash adapter since data buffers are not required to be mapped to the device's memory. The use of services such as pci_set_dma_mask() are problematic on hypervisor managed systems as the IBM CXL flash adapter is operating under a virtual PCI Host Bridge (virtual PHB) which does not support these services. cxlflash 0001:00:00.0: init_pci: Failed to set PCI DMA mask rc=-5 The resolution is to simplify init_pci(), to a point where it does the bare minimum (pci_enable_device). Similarly, remove the call the pci_release_regions() from cxlflash_remove(). Signed-off-by:
-
- 08 Mar, 2016 1 commit
-
-
Lars-Peter Clausen authored
Calling synchronize_irq() right before free_irq() is quite useless. On one hand the IRQ can easily fire again before free_irq() is entered, on the other hand free_irq() itself calls synchronize_irq() internally (in a race condition free way), before any state associated with the IRQ is freed. Patch was generated using the following semantic patch: // <smpl> @@ expression irq; @@ -synchronize_irq(irq); free_irq(irq, ...); // </smpl> Signed-off-by:
-
- 05 Mar, 2016 9 commits
-
-
Hannes Reinecke authored
'device_add' will be evaluating the 'is_visible' callback when creating the sysfs attributes. As by this time the device handler has not been attached the 'access_state' attribute will never be visible. This patch moves the code around so that the device handler is present by the time 'is_visible' is evaluated to correctly display the 'access_state' attribute. Signed-off-by:
Christoph Hellwig <hch@lst.de> Reviewed-by:
-
Hannes Reinecke authored
Update the 'access_state' field of the SCSI device whenever the path state changes. Signed-off-by:
-
Hannes Reinecke authored
Track attached SCSI devices and update the 'access_state' whenever the path state of the device changes. Signed-off-by:
-
Hannes Reinecke authored
Track attached SCSI devices and update the 'access_state' field whenever an ALUA state change has been detected. Signed-off-by:
-
Hannes Reinecke authored
scsi_proto.h now contains definitions for the ALUA state, so we don't have to carry them in the device handler. Signed-off-by:
-
Hannes Reinecke authored
Add an 'access_state' field to struct scsi_device and display them in sysfs as 'access_state' and 'preferred_path' attribute. Signed-off-by:
-
Hannes Reinecke authored
Add 'is_bin_visible' callback to blank out unsupported vpd pages. Reviewed-by:
Shane Seymour <shane.seymour@hpe.com> Reviewed-by:
-
Arnd Bergmann authored
The mvumi scsi hides the references to its suspend/resume functions in an #ifdef but does not hide the implementation the same way: drivers/scsi/mvumi.c:2632:12: error: 'mvumi_suspend' defined but not used [-Werror=unused-function] drivers/scsi/mvumi.c:2651:12: error: 'mvumi_resume' defined but not used [-Werror=unused-function] This adds __maybe_unused annotations so the compiler knows it can silently drop them instead of warning, while avoiding the addition of another #ifdef. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Reviewed-by:
-
K. Y. Srinivasan authored
tree: https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fgit.kernel.org%2fpub%2fscm%2flinux%2fkernel%2fgit%2ftorvalds%2flinux.git&data=01%7c01%7ckys%40microsoft.com%7ce2e0622715844b79ad7108d32796ec3c%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=ubr4GbBaNS%2ftOz%2buJBk0CL9N0UNG9x2TidLgy6Yovg4%3d master head: 03c21cb7 commit: dac58241 storvsc: Properly support Fibre Channel devices date: 3 weeks ago config: x86_64-randconfig-s3-01281016 (attached as .config) reproduce: git checkout dac58241 # save the attached .config to linux build tree make ARCH=x86_64 All errors (new ones prefixed by >>): drivers/built-in.o: In function `storvsc_remove': >> storvsc_drv.c:(.text+0x213af7): undefined reference to `fc_remove_host' drivers/built-in.o: In function `storvsc_drv_init': >> storvsc_drv.c:(.init.text+0xcbcc): undefined reference to `fc_attach_transport' >> storvsc_drv.c:(.init.text+0xcc06): undefined reference to `fc_release_transport' drivers/built-in.o: In function `storvsc_drv_exit': >> storvsc_drv.c:(.exit.text+0x123c): undefined reference to `fc_release_transport' With this commit, the storvsc driver depends on FC atttributes. Make this dependency explicit. Signed-off-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
-
- 02 Mar, 2016 2 commits
-
-
Colin Ian King authored
The snic version number is expected to be 4 decimals in the form like a netmask string with each number stored in an element in array v. However, there is an off-by-one check on the number of elements in v allowing one to pass a 5 decimal version number causing v[4] to be referenced, causing a buffer overrun. Fix the off-by-one error by comparing to i > 3 rather than 4. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Reviewed-by:
-
Amitoj Kaur Chawla authored
The return value of of_ioremap on failure should be -ENODEV and not -1. Found using Coccinelle. A simplified version of the semantic patch used is: //<smpl> @@ expression *e; @@ e = of_ioremap(...); if (e == NULL) { ... return - -1 + -ENODEV ; } //</smpl> The single call site only checks that the return value is less than 0, hence no change is required at the call site. Signed-off-by:Amitoj Kaur Chawla <amitoj1606@gmail.com> Reviewed-by:
-
- 01 Mar, 2016 11 commits
-
-
Finn Thain authored
This bug causes the wrong command to have its sense pointer overwritten, which sometimes leads to a NULL pointer deref. Fix this by checking which command is being requeued before restoring the scsi_eh_save data. It turns out that some targets will disconnect a REQUEST SENSE command. The autosense algorithm doesn't anticipate this. Hence multiple commands can end up undergoing autosense simultaneously, and they will all try to use the same scsi_eh_save struct, which won't work. Defer autosense when the scsi_eh_save storage is in use by another command. Fixes: f27db8eb ("ncr5380: Fix autosense bugs") Reported-and-tested-by:
Michael Schmitz <schmitzmic@gmail.com> Cc: <stable@vger.kernel.org> # 4.5 Signed-off-by:
Finn Thain <fthain@telegraphics.com.au> Signed-off-by:
-
Finn Thain authored
Add missing checks for EH abort during arbitration and selection. Rework the handling of NCR5380_select() result to improve clarity. Fixes: 707d62b3 ("ncr5380: Fix EH during arbitration and selection") Tested-by:
-
Finn Thain authored
The list structures and related logic used in the NCR5380 driver mean that a command cannot be queued twice (i.e. can't appear on more than one queue and can't appear on the same queue more than once). The abort handler must forget the command so that the mid-layer can re-use it. E.g. the ML may send it back to the LLD via via scsi_eh_get_sense(). Fix this and also fix two error paths, so that commands get forgotten iff completed. Fixes: 8b00c3d5 ("ncr5380: Implement new eh_abort_handler") Tested-by:
-
Finn Thain authored
Calling NCR5380_select() from the abort handler causes various problems. Firstly, it means potentially re-entering NCR5380_select(). Secondly, it means that the lock is released, which permits the EH handlers to be re-entered. The combination results in crashes. Don't do it. Fixes: 8b00c3d5 ("ncr5380: Implement new eh_abort_handler") Reported-and-tested-by:
-
Finn Thain authored
The calls to NCR5380_transfer_pio() for DATA IN and DATA OUT phases will modify cmd->SCp.this_residual, cmd->SCp.ptr and cmd->SCp.buffer. That works as long as EH does not intervene, which became possible in atari_NCR5380.c when I changed the locking to bring it closer to NCR5380.c. If error recovery aborts the command, the scsi_cmnd in question and its buffer will be returned to the mid-layer. So the transfer has to cease, but it can't be stopped by the initiator because the target controls the bus phase. The problem does not arise if the lock is not released. That was fine for atari_scsi, because it implements DMA. For the other drivers, we have to release the lock and re-enable interrupts for long PIO data transfers. The solution is to split the transfer into small chunks. In between chunks the main loop releases the lock and re-enables interrupts. Thus interrupts can be serviced and eh_bus_reset_handler can intervene if need be. This fixes an oops in NCR5380_transfer_pio() that can happen when the EH abort handler is invoked during DATA IN or DATA OUT phase. Fixes: 11d2f63b ("ncr5380: Change instance->host_lock to hostdata->lock") Reported-and-tested-by:
-
Finn Thain authored
Commands subject to exception handling are to be returned to the scsi mid-layer. Make sure that the various command pointers and command lists in the low-level driver are correctly cleansed of affected commands. This fixes some bugs that I accidentally introduced in v4.5-rc1 including the removal of INIT_LIST_HEAD for the 'autosense' and 'disconnected' command lists, and the possible NULL pointer dereference in NCR5380_bus_reset() that was reported by Dan Carpenter. hostdata->sensing may also point to an affected command so this pointer also has to be cleared. The abort handler calls complete_cmd() to take care of this; let's have the bus reset handler do the same. The issue queue may also contain an affected command. If so, remove it. This also follows the abort handler logic. Reported-by:
Dan Carpenter <dan.carpenter@oracle.com> Fixes: 62717f53 ("ncr5380: Implement new eh_bus_reset_handler") Tested-by:
-
Nicholas Krause authored
This adds the missing error check and path for if the call to the function hwi_init_controller fails as this error path was clearly missed when writing beiscsi_eeh_resume and thus we must add it now in order to be able to handle this nonrecoverable failing function call gracefully in beiscsi_eeh_resume. Signed-off-by:
Nicholas Krause <xerofoify@gmail.com> Reviewed-by:
-
Usha Ketineni authored
Do not reset fip selection time for every advertisement in fcoe_ctlr_recv_adv() but set it only once for the first validated FCF. Otherwise FCF selection won't happen when the advertisements consistently arrive with sub FCOE_CTLR_START_DELAY periodicity. Tested-by:
Narendra K <narendra_k@dell.com> Acked-by:
Neil Horman <nhorman@tuxdriver.com> Reviewed-by:
Vasu Dev <vasu.dev@intel.com> Signed-off-by:
Usha Ketineni <usha.k.ketineni@intel.com> Signed-off-by:
-
John Garry authored
Signed-off-by:
John Garry <john.garry@huawei.com> Reviewed-by:
-
John Garry authored
In high-datarate aging tests, it is found that the SCSI framework can periodically issue lu resets as some commands timeout. Response TASK SET FULL and SAS_QUEUE_FULL may be returned many times for the same command, causing the timeouts. The SAS_QUEUE_FULL errors come from TRANS_TX_CREDIT_TIMEOUT_ERR, TRANS_TX_CLOSE_NORMAL_ERR, and TRANS_TX_ERR_FRAME_TXED errors. They do not mean that the queue is full in the host, but rather it is equivalent to meaning the queue is full for the sdev. To overcome this, the queue depth for the sdev is reduced to 64 (from 256, set in sas_slave_configure()). Normally error code SAS_QUEUE_FULL will result in the sdev queue depth falling, but it falls too slowly during high-datarate tests and commands timeout before it has fallen to an adequete level from original value. Signed-off-by:
-
John Garry authored
When TRANS_TX_ERR_FRAME_TXED error occurs in a slot, the command should be re-attempted. This error is equivalent to meaning that the queue is full in the sdev (and not the host). A superflous debug statement is also removed in the slot complete handler. Signed-off-by:
-
