- Jul 06, 2023
-
-
Dan Carpenter authored
Smatch and Clang both complain that LOGIN_TEMPLATE_SIZE is more than sizeof(ha->plogi_els_payld.fl_csp). Smatch warning: drivers/scsi/qla2xxx/qla_iocb.c:3075 qla24xx_els_dcmd2_iocb() warn: '&ha->plogi_els_payld.fl_csp' sometimes too small '16' size = 112 Clang warning: include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] __read_overflow2_field(q_size_field, size); When I was reading this code I assumed the "- 4" meant that we were skipping the last 4 bytes but actually it turned out that we are skipping the first four bytes. I have re-written it remove the magic numbers, be more clear and silence the static checker warnings. Signed-off-by:Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/4aa0485e-766f-4b02-8d5d-c6781ea8f511@moroto.mountain Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Tuo Li authored
The variable phba->fcf.fcf_flag is often protected by the lock phba->hbalock() when is accessed. Here is an example in lpfc_unregister_fcf_rescan(): spin_lock_irq(&phba->hbalock); phba->fcf.fcf_flag |= FCF_INIT_DISC; spin_unlock_irq(&phba->hbalock); However, in the same function, phba->fcf.fcf_flag is assigned with 0 without holding the lock, and thus can cause a data race: phba->fcf.fcf_flag = 0; To fix this possible data race, a lock and unlock pair is added when accessing the variable phba->fcf.fcf_flag. Reported-by:
BassCheck <bass@buaa.edu.cn> Signed-off-by:
Tuo Li <islituo@gmail.com> Link: https://lore.kernel.org/r/20230630024748.1035993-1-islituo@gmail.com Reviewed-by:
Justin Tee <justin.tee@broadcom.com> Reviewed-by:
Laurence Oberman <loberman@redhat.com> Signed-off-by:
-
- Jun 29, 2023
-
-
Keoseong Park authored
Commit 2468da61 ("scsi: ufs: core: mcq: Configure operation and runtime interface") added ufshcd_mcq_select_mcq_mode(), but it's not used anywhere. So remove it. Signed-off-by:
Keoseong Park <keosung.park@samsung.com> Link: https://lore.kernel.org/r/20230627012931epcms2p76f458e0b2ce8a591b56bbcc6a2f1a3bb@epcms2p7 Reviewed-by:
Bart Van Assche <bvanassche@acm.org> Signed-off-by:
-
Rong Tao authored
This script is not used and requires additional development to sync with the SCSI target code. Signed-off-by:
Rong Tao <rongtao@cestc.cn> Link: https://lore.kernel.org/r/tencent_58D7935159C421036421B42CD04B0A959207@qq.com Reviewed-by:
-
Mike Christie authored
We want to pass in true for pr_preempt's argument if we are doing a PRO_PREEMPT_AND_ABORT, so just test sa against PRO_PREEMPT_AND_ABORT, and pass the result directly to pr_preempt. Reported-by:
kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202306221655.Kwtqi1gI-lkp@intel.com/ Signed-off-by:
Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230623161136.6270-1-michael.christie@oracle.com Reviewed-by:
Maurizio Lombardi <mlombard@redhat.com> Signed-off-by:
-
Abel Vesa authored
The check for 'qcom,ice' property is wrong. Fix it by checking using if-required clause and expand the clocks minItems and maxItems for platforms where 'qcom,ice' is not required so that it includes platforms with single reg entry and clocks that do not provide an ICE one. Fixes: 29a6d121 ("scsi: ufs: dt-bindings: qcom: Add ICE phandle") Signed-off-by:
Abel Vesa <abel.vesa@linaro.org> Link: https://lore.kernel.org/r/20230623113009.2512206-2-abel.vesa@linaro.org Reviewed-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by:
-
Damien Le Moal authored
Reading the 800+ pages of SPC often leads to a brain shutdown and to less than ideal code... This resulted in the checks of the rwcdlp and cdlp fields in scsi_cdl_check_cmd() to have identical if-else branches. Replace this with a comment describing the cases we are interested in and replace the if-else code block with a simple test of the cdlp field that is used as the function return value. Reported-by:
Julia Lawall <julia.lawall@inria.fr> Closes: https://lore.kernel.org/r/202306221657.BJHEADkz-lkp@intel.com/ Signed-off-by:
Damien Le Moal <dlemoal@kernel.org> Link: https://lore.kernel.org/r/20230623073057.816199-1-dlemoal@kernel.org Reviewed-by:
Christoph Hellwig <hch@lst.de> Signed-off-by:
-
Yueh-Shun Li authored
Spell "transmitting" properly. Found by searching for keyword "tranm". Signed-off-by:
Yueh-Shun Li <shamrocklee@posteo.net> Link: https://lore.kernel.org/r/20230622012627.15050-5-shamrocklee@posteo.net Signed-off-by:
-
- Jun 22, 2023
-
-
Gustavo A. R. Silva authored
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element arrays with flexible-array members in a couple of structures, and refactor the rest of the code, accordingly. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy(). This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/204 Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/ZJNdKDkuRbFZpASS@work Reviewed-by:
Kees Cook <keescook@chromium.org> Signed-off-by:
-
Azeem Shaikh authored
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by:
Azeem Shaikh <azeemshaikh38@gmail.com> Link: https://lore.kernel.org/r/20230621030033.3800351-3-azeemshaikh38@gmail.com Reviewed-by:
-
Azeem Shaikh authored
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by:
-
Arnd Bergmann authored
clang points out that the lpfc_name structure has an 8-byte alignment requirement on most architectures, but is embedded in a number of other structures that are forced to be only 1-byte aligned: drivers/scsi/lpfc/lpfc_hw.h:1516:30: error: field pe within 'struct lpfc_fdmi_reg_port_list' is less aligned than 'struct lpfc_fdmi_port_entry' and is usually due to 'struct lpfc_fdmi_reg_port_list' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct lpfc_fdmi_port_entry pe; drivers/scsi/lpfc/lpfc_hw.h:850:19: error: field portName within 'struct _ADISC' is less aligned than 'struct lpfc_name' and is usually due to 'struct _ADISC' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:851:19: error: field nodeName within 'struct _ADISC' is less aligned than 'struct lpfc_name' and is usually due to 'struct _ADISC' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:922:19: error: field portName within 'struct _RNID' is less aligned than 'struct lpfc_name' and is usually due to 'struct _RNID' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:923:19: error: field nodeName within 'struct _RNID' is less aligned than 'struct lpfc_name' and is usually due to 'struct _RNID' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] From the git history, I can see that all the __packed annotations were done specifically to avoid introducing implicit padding around the lpfc_name instances, though this was probably the wrong approach. To improve this, only annotate the one uint64_t field inside of lpfc_name as packed, with an explicit 4-byte alignment, as is the default already on the 32-bit x86 ABI but not on most others. With this, the other __packed annotations can be removed again, as this avoids the incorrect padding. Two other structures change their layout as a result of this change: - struct _LOGO never gained a __packed annotation even though it has the same alignment problem as the others but is not used anywhere in the driver today. - struct serv_param similarly has this issue, and it is used, my guess is that this is only an internal structure rather than part of a binary interface, so the padding has no negative effect here. Signed-off-by:Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20230616090705.2623408-1-arnd@kernel.org Reviewed-by:
-
- Jun 17, 2023
-
-
Martin K. Petersen authored
Martin Wilck <mwilck@suse.com> says: This patch series addresses some issues we saw in a test setup with a large number of SCSI LUNs. The first two patches simply increase the number of available sg and bsg devices. 3-5 fix a large delay we encountered between blocking a Fibre Channel remote port and the dev_loss_tmo. 6 renames scsi_target_block() to scsi_block_targets(), and makes additional changes to this API, as suggested in the review of the v2 series. 7 improves a warning message. Link: https://lore.kernel.org/r/20230614103616.31857-1-mwilck@suse.com Signed-off-by:
-
Martin Wilck authored
If __scsi_internal_device_block() returns an error, it is always -EINVAL because of an invalid state transition. For debugging purposes, it makes more sense to print the device state. Signed-off-by:
Martin Wilck <mwilck@suse.com> Link: https://lore.kernel.org/r/20230614103616.31857-8-mwilck@suse.com Reviewed-by:
Hannes Reinecke <hare@suse.de> Signed-off-by:
-
Martin Wilck authored
All callers (fc_remote_port_delete(), __iscsi_block_session(), __srp_start_tl_fail_timers(), srp_reconnect_rport(), snic_tgt_del()) pass parent devices of scsi_target devices to scsi_target_block(). Rename the function to scsi_block_targets(), and simplify it by assuming that it is always passed a parent device. Also, have callers pass the Scsi_Host pointer to scsi_block_targets(), as every caller has this pointer readily available. Suggested-by:
-
Martin Wilck authored
scsi_device_block() is only called from scsi_target_block(), which calls it repeatedly for every child device. For targets with many devices, waiting for every queue to quiesce may cause a substantial delay (we measured more than 100s delay for blocking a FC rport with 2048 LUNs). Just call blk_mq_wait_quiesce_done() once from scsi_target_block() after stopping all queues. Signed-off-by:
-
Martin Wilck authored
scsi_stop_queue() has just two callers, one with and one without "nowait". As blk_mq_quiesce_queue() comes down to blk_mq_quiesce_queue_nowait() followed by blk_mq_wait_quiesce_done(), we might as well open-code this in scsi_device_block(). Also, add a comment explaining why blk_mq_quiesce_queue_nowait() must be called with the state_mutex held, see https://lore.kernel.org/linux-scsi/3b8b13bf-a458-827a-b916-07d7eee8ae00@acm.org/ . Signed-off-by:
-
Martin Wilck authored
scsi_internal_device_block() is only called from device_block(). Merge the two functions, and call the result scsi_device_block(), as the name device_block() is confusingly generic. Signed-off-by:
-
Hannes Reinecke authored
Larger setups may need to allocate more than 32k sg devices, so increase the number of devices to the full range of minor device numbers. Signed-off-by:
Douglas Gilbert <dgilbert@interlog.com> Reviewed-by:
Ming Lei <ming.lei@redhat.com> Reviewed-by:
-
Hannes Reinecke authored
Larger setups may need to allocate more than 32k bsg devices, so increase the number of devices to the full range of minor device numbers. Signed-off-by:
-
Manish Rangankar authored
System crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up gets called for uninitialized wait queue sp->nvme_ls_waitq. qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0 qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] Remove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed previously in the commits tagged Fixed: below. Fixes: 219d27d7 ("scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands") Fixes: 5621b0dd ("scsi: qla2xxx: Simpify unregistration of FC-NVMe local/remote ports") Cc: stable@vger.kernel.org Signed-off-by:Manish Rangankar <mrangankar@marvell.com> Signed-off-by:
Nilesh Javali <njavali@marvell.com> Link: https://lore.kernel.org/r/20230615074633.12721-1-njavali@marvell.com Signed-off-by:
-
Martin K. Petersen authored
Nilesh Javali <njavali@marvell.com> says: Please apply the qla2xxx driver klocwork fixes to the scsi tree at your earliest convenience. Link: https://lore.kernel.org/r/20230607113843.37185-1-njavali@marvell.com Signed-off-by:
-
Adrian Hunter authored
Add PCI ID to support Intel Arrow Lake, same as MTL (Intel Meteor Lake). Signed-off-by:
Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230613170327.61186-1-adrian.hunter@intel.com Reviewed-by:
Avri Altman <avri.altman@wdc.com> Signed-off-by:
-
Johannes Thumshirn authored
Use PAGE_SECTORS_SHIFT instead of open-coding it. Signed-off-by:
Johannes Thumshirn <johannes.thumshirn@wdc.com> Link: https://lore.kernel.org/r/20230613-sd_zbc-page_sectors-v1-1-363460a4413d@wdc.com Reviewed-by:
Niklas Cassel <niklas.cassel@wdc.com> Signed-off-by:
-
Lu Hongfei authored
There are three flags that control Write Booster Feature: 1. WB ON/OFF 2. WB Hibern Flush ON/OFF (implicitly) 3. WB Flush ON/OFF (explicit) In the case of "Hibern Flush", one of the conditions for flush WB buffer is that avail_wb_buff < wb_flush_threshold. As we know, different users have different requirements for power consumption and performance. Therefore, we need the ability to manually set wb_flush_threshold, so that users can easily and flexibly adjust the wb_flush_threshold value, thereby achieving a balance between power consumption and performance. So the sysfs attribute that controls this is necessary. wb_flush_threshold represents the threshold for flushing WB buffer, whose value expressed in unit of 10% granularity, such as '1' representing 10%, '2' representing 20%, and so on. Signed-off-by:Lu Hongfei <luhongfei@vivo.com> Link: https://lore.kernel.org/r/20230613022240.16595-1-luhongfei@vivo.com Reviewed-by:
-
Abel Vesa authored
Now that there is a new dedicated ICE driver, drop the ufs-qcom-ice and use the new ICE api provided by the Qualcomm soc driver ice. The platforms that already have ICE support will use the API as library since there will not be a devicetree node, but instead they have reg range. In this case, the of_qcom_ice_get will return an ICE instance created for the consumer's device. But if there are platforms that do not have ice reg in the consumer devicetree node and instead provide a dedicated ICE devicetree node, the of_qcom_ice_get will look up the device based on qcom,ice property and will get the ICE instance registered by the probe function of the ice driver. The ICE clock is now handle by the new driver. This is done by enabling it on the creation of the ICE instance and then enabling/disabling it on UFS runtime resume/suspend. Signed-off-by:
Eric Biggers <ebiggers@google.com> Signed-off-by:
-
Abel Vesa authored
Starting with SM8550, the ICE will have its own devicetree node so add the qcom,ice property to reference it. Reviewed-by:
-
Po-Wen Kao authored
Enable UFSHCD_QUIRK_MCQ_BROKEN_RTC for MediaTek host. Signed-off-by:
Po-Wen Kao <powen.kao@mediatek.com> Link: https://lore.kernel.org/r/20230612085817.12275-5-powen.kao@mediatek.com Reviewed-by:
Stanley Chu <stanley.chu@mediatek.com> Signed-off-by:
-
Po-Wen Kao authored
Enable UFSHCD_QUIRK_MCQ_BROKEN_INTR for MediaTek host. Signed-off-by:
-
Po-Wen Kao authored
Some hosts do not implement SQ Run Time Command (SQRTC) register, thus we need this quirk to skip the related flow. Signed-off-by:
-
Po-Wen Kao authored
Quirk UFSHCD_QUIRK_MCQ_BROKEN_INTR is introduced for hosts that implement a different interrupt topology from the UFSHCI 4.0 spec. Some hosts raise per hw queue interrupt in addition to CQES (traditional) when ESI is disabled. Enabling this quirk will disable CQES and use only per hw queue interrupt. Signed-off-by:
-
Po-Wen Kao authored
This commit depends on "scsi: ufs: core: mcq: Fix the incorrect OCS value for the device command" which takes care of the OCS value of dev commands in MCQ mode. It is safe to share first hwq for dev command and I/O request here. Tested-by:
-
Stanley Chu authored
In MCQ mode, when a device command uses a hardware queue shared with other commands, a race condition may occur in the following scenario: 1. A device command is completed in CQx with CQE entry "e". 2. The interrupt handler copies the "cqe" pointer to "hba->dev_cmd.cqe" and completes "hba->dev_cmd.complete". 3. The "ufshcd_wait_for_dev_cmd()" function is awakened and retrieves the OCS value from "hba->dev_cmd.cqe". However, there is a possibility that the CQE entry "e" will be overwritten by newly completed commands in CQx, resulting in an incorrect OCS value being received by "ufshcd_wait_for_dev_cmd()". To avoid this race condition, the OCS value should be immediately copied to the struct "lrb" of the device command. Then "ufshcd_wait_for_dev_cmd()" can retrieve the OCS value from the struct "lrb". Fixes: 57b1c0ef ("scsi: ufs: core: mcq: Add support to allocate multiple queues") Suggested-by:Can Guo <quic_cang@quicinc.com> Signed-off-by:
-
Krzysztof Kozlowski authored
Clean up bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by:
Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by:
-
Damien Le Moal authored
The introduction of the macro IOPRIO_PRIO_LEVEL() in commit eca20409 ("scsi: block: ioprio: Clean up interface definition") results in an iopriority level to always be masked using the macro IOPRIO_LEVEL_MASK, and thus to the kernel always seeing an acceptable value for an I/O priority level when checked in ioprio_check_cap(). Before this patch, this function would return an error for some (but not all) invalid values for a level valid range of [0..7]. Restore and improve the detection of invalid priority levels by introducing the inline function ioprio_value() to check an ioprio class, level and hint value before combining these fields into a single value to be used with ioprio_set() or AIOs. If an invalid value for the class, level or hint of an ioprio is detected, ioprio_value() returns an ioprio using the class IOPRIO_CLASS_INVALID, indicating an invalid value and causing ioprio_check_cap() to return -EINVAL. Fixes: 6c913257 ("scsi: block: Introduce ioprio hints") Fixes: eca20409 ("scsi: block: ioprio: Clean up interface definition") Signed-off-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
- Jun 15, 2023
-
-
Nilesh Javali authored
Signed-off-by:
Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by:
-
Bikash Hazarika authored
Klocwork reported array 'port_dstate_str' of size 10 may use index value(s) 10..15. Add a fix to correct the index of array. Cc: stable@vger.kernel.org Signed-off-by:
Bikash Hazarika <bhazarika@marvell.com> Signed-off-by:
-
Shreyas Deodhar authored
Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. Cc: stable@vger.kernel.org Signed-off-by:
Shreyas Deodhar <sdeodhar@marvell.com> Signed-off-by:
-
Quinn Tran authored
Klocwork warning: Buffer Overflow - Array Index Out of Bounds Driver uses fc_els_flogi to calculate size of buffer. The actual buffer is nested inside of fc_els_flogi which is smaller. Replace structure name to allow proper size calculation. Cc: stable@vger.kernel.org Signed-off-by:
Quinn Tran <qutran@marvell.com> Signed-off-by:
-
Nilesh Javali authored
Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced. Check valid rport returned by fc_bsg_to_rport(). Cc: stable@vger.kernel.org Signed-off-by:
-
