- Nov 20, 2019
-
-
Colin Ian King authored
There are a few statements that are indented incorrectly, fix these. Link: https://lore.kernel.org/r/20191114180007.325856-1-colin.king@canonical.com Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
Pan Bian authored
The variable init_fw_cb is released twice, resulting in a double free bug. The call to the function dma_free_coherent() before goto is removed to get rid of potential double free. Fixes: 2a49a78e ("[SCSI] qla4xxx: added IPv6 support.") Link: https://lore.kernel.org/r/1572945927-27796-1-git-send-email-bianpan2016@163.com Signed-off-by:
Pan Bian <bianpan2016@163.com> Acked-by:
Manish Rangankar <mrangankar@marvell.com> Signed-off-by:
-
Deepak Ukey authored
Added the correct method to collect the fatal dump. Link: https://lore.kernel.org/r/20191114100910.6153-14-deepak.ukey@microchip.com Reported-by:
kbuild test robot <lkp@intel.com> Acked-by:
Jack Wang <jinpu.wang@cloud.ionos.com> Signed-off-by:
Deepak Ukey <deepak.ukey@microchip.com> Signed-off-by:
Viswas G <Viswas.G@microchip.com> Signed-off-by:
-
Vikram Auradkar authored
With MSI-x enabled, the interrupt instances are <prefix><index> where the prefix is fixed for all module instances, making it a little harder to track down what's what. Link: https://lore.kernel.org/r/20191114100910.6153-13-deepak.ukey@microchip.com Acked-by:
Vikram Auradkar <auradkar@google.com> Signed-off-by:
-
Deepak Ukey authored
Added support to check controller fatal error through sysfs. Link: https://lore.kernel.org/r/20191114100910.6153-12-deepak.ukey@microchip.com Acked-by:
-
peter chang authored
Occasionally, 6G capable drives fail to train at 6G on links that look good from a signal-integrity perspective. PMC suggests configuring the port to not even expect 12G. Link: https://lore.kernel.org/r/20191114100910.6153-11-deepak.ukey@microchip.com Acked-by:
peter chang <dpf@google.com> Signed-off-by:
-
peter chang authored
Added the fix so the if driver properly sent the abort it tries to remove it from the firmware's list of outstanding commands regardless of the abort status. This means that the task gets freed 'now' rather than possibly getting freed later when the scsi layer thinks it's leaked but still valid. Link: https://lore.kernel.org/r/20191114100910.6153-10-deepak.ukey@microchip.com Acked-by:
-
peter chang authored
The commands to the controller are sent in fixed sized chunks which are set per-chip-generation and stashed in iomb_size. The driver fills in structs matching the register layout and memcpy this to memory shared with the controller. However, there are two problem cases: 1) Things like phy_start_req are too large because they share the sas_identify_frame definition with libsas, and it includes the crc word. This means that it's overwriting the start of the next command block, that's ok except if it happens at the end of the shared memory area. 2) Things like set_nvm_data_req which are shared between the HAL layers. This means that it's sending 'random' data for things that are in the reserved area. So far we haven't found a case where the controller FW cares, but sending possible gibberish (for most of the structures this is in the reserved area so previously zeroed) is not recommended. Link: https://lore.kernel.org/r/20191114100910.6153-9-deepak.ukey@microchip.com Acked-by:
-
Vikram Auradkar authored
sas_task structure should not be used after task_done is called. If the device is gone or not attached, we call task_done on t and continue to use in the sas_task in rest of the function. task_done is pointing to sas_ata_task_done, may free the memory associated with the task before returning. Link: https://lore.kernel.org/r/20191114100910.6153-8-deepak.ukey@microchip.com Acked-by:
-
ianyar authored
The function mpi_uninit_check takes longer for inbound doorbell register to be cleared. Increased the timeout substantially so that the driver does not fail to load. Link: https://lore.kernel.org/r/20191114100910.6153-7-deepak.ukey@microchip.com Acked-by:
ianyar <ianyar@google.com> Signed-off-by:
-
peter chang authored
The default logging doesn't include the device name, so it's difficult to determine which controller is being logged about in error scenarios. The logging level was only settable via sysfs, which made it inconvenient for actual debugging. This changes the default to only cover error handling. Link: https://lore.kernel.org/r/20191114100910.6153-6-deepak.ukey@microchip.com Acked-by:
-
Vikram Auradkar authored
For delays longer than 20ms [um]delay isn't recommended. pm80xx_chip_soft_rst starts off with a 500ms delay before it even gets around to checking for the results of the reset. As long as it's at least 500ms it doesn't matter what the scheduler is doing. The delay in the pm8001_exec_internal_task_abort does nothing, and theory is this is a delay to avoid a double-free. Link: https://lore.kernel.org/r/20191114100910.6153-5-deepak.ukey@microchip.com Acked-by:
-
John Sperbeck authored
In pm8001_task_exec(), if the PHY is down, then we return the current value of 'rc'. We need to make sure it's initialized. Link: https://lore.kernel.org/r/20191114100910.6153-4-deepak.ukey@microchip.com Acked-by:
John Sperbeck <jsperbeck@google.com> Signed-off-by:
-
peter chang authored
After the completing the mpi_phy_start_resp, make phy enable completion as NULL. Link: https://lore.kernel.org/r/20191114100910.6153-3-deepak.ukey@microchip.com Acked-by:
-
peter chang authored
Driver was missing complete() call in mpi_sata_completion which result in SATA abort error handling timing out. That causes the device to be left in the in_recovery state so subsequent commands sent to the device fail and the OS removes access to it. Link: https://lore.kernel.org/r/20191114100910.6153-2-deepak.ukey@microchip.com Acked-by:
-
Subhash Jadavani authored
During clock gating (ufshcd_gate_work()), we first put the link hibern8 by calling ufshcd_uic_hibern8_enter() and if ufshcd_uic_hibern8_enter() returns success (0) then we gate all the clocks. Now let’s zoom in to what ufshcd_uic_hibern8_enter() does internally: It calls __ufshcd_uic_hibern8_enter() and if failure is encountered, link recovery shall put the link back to the highest HS gear and returns success (0) to ufshcd_uic_hibern8_enter() which is the issue as link is still in active state due to recovery! Now ufshcd_uic_hibern8_enter() returns success to ufshcd_gate_work() and hence it goes ahead with gating the UFS clock while link is still in active state hence I believe controller would raise UIC error interrupts. But when we service the interrupt, clocks might have already been disabled! This change fixes for this by returning failure from __ufshcd_uic_hibern8_enter() if recovery succeeds as link is still not in hibern8, upon receiving the error ufshcd_hibern8_enter() would initiate retry to put the link state back into hibern8. Link: https://lore.kernel.org/r/1573798172-20534-8-git-send-email-cang@codeaurora.org Reviewed-by:
Avri Altman <avri.altman@wdc.com> Reviewed-by:
Bean Huo <beanhuo@micron.com> Signed-off-by:
Subhash Jadavani <subhashj@codeaurora.org> Signed-off-by:
Can Guo <cang@codeaurora.org> Signed-off-by:
-
Asutosh Das authored
This change attempts to abort gating of clocks if a request to turn-on clocks is pending. This would in turn avoid turning OFF and back ON the clocks. Link: https://lore.kernel.org/r/1573798172-20534-7-git-send-email-cang@codeaurora.org Reviewed-by:
Asutosh Das <asutoshd@codeaurora.org> Signed-off-by:
-
Venkat Gopalakrishnan authored
Return IRQ_HANDLED only if the irq is really handled, this will help in catching spurious interrupts that go unhandled. Link: https://lore.kernel.org/r/1573798172-20534-6-git-send-email-cang@codeaurora.org Reviewed-by:
Venkat Gopalakrishnan <venkatg@codeaurora.org> Signed-off-by:
-
- Nov 19, 2019
-
-
Can Guo authored
ufshcd_print_host_regs() can be called by interrupt handler, but it may sleep due to ufshcd_dump_regs() allocates the dump buffer memory with flag GFP_KERNEL. Fix it by changing GFP_KERNEL to GFP_ATMOIC. Link: https://lore.kernel.org/r/1573798172-20534-5-git-send-email-cang@codeaurora.org Reviewed-by:
-
Can Guo authored
Fix up possible unclocked register access to auto hibern8 register in resume path and through sysfs entry. Meanwhile, enable auto hibern8 only after device is fully initialized in probe path. Link: https://lore.kernel.org/r/1573798172-20534-4-git-send-email-cang@codeaurora.org Reviewed-by:
Stanley Chu <stanley.chu@mediatek.com> Signed-off-by:
-
Can Guo authored
Add reset control for host controller so that host controller can be reset as required in its power up sequence. Link: https://lore.kernel.org/r/1573798172-20534-3-git-send-email-cang@codeaurora.org Reviewed-by:
-
Can Guo authored
In order to recover from hibern8 exit failure, perform a reset in link recovery path before issuing link start-up. Link: https://lore.kernel.org/r/1573798172-20534-2-git-send-email-cang@codeaurora.org Reviewed-by:
-
- Nov 13, 2019
-
-
Finn Thain authored
Remove SG_NONE and a related misleading comment. Update documentation. This patch does not affect behaviour as zero initialization is redundant. Cc: Jonathan Corbet <corbet@lwn.net> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Viresh Kumar <vireshk@kernel.org> Cc: Oliver Neukum <oneukum@suse.com> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: usb-storage@lists.one-eyed-alien.net Link: https://lore.kernel.org/r/b4779b7a6563f6bd8d259ee457871c1c463c420e.1572656814.git.fthain@telegraphics.com.au Signed-off-by:
Finn Thain <fthain@telegraphics.com.au> Signed-off-by:
-
Finn Thain authored
Since the scsi subsystem adopted the blk-mq API, a host with zero sg_tablesize crashes with a NULL pointer dereference. blk_queue_max_segments: set to minimum 1 scsi 0:0:0:0: Direct-Access QEMU QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 scsi target0:0:0: Beginning Domain Validation scsi target0:0:0: Domain Validation skipping write tests scsi target0:0:0: Ending Domain Validation blk_queue_max_segments: set to minimum 1 scsi 0:0:1:0: Direct-Access QEMU QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 scsi target0:0:1: Beginning Domain Validation scsi target0:0:1: Domain Validation skipping write tests scsi target0:0:1: Ending Domain Validation blk_queue_max_segments: set to minimum 1 scsi 0:0:2:0: CD-ROM QEMU QEMU CD-ROM 2.5+ PQ: 0 ANSI: 5 scsi target0:0:2: Beginning Domain Validation scsi target0:0:2: Domain Validation skipping write tests scsi target0:0:2: Ending Domain Validation blk_queue_max_segments: set to minimum 1 blk_queue_max_segments: set to minimum 1 blk_queue_max_segments: set to minimum 1 blk_queue_max_segments: set to minimum 1 sr 0:0:2:0: Power-on or device reset occurred sd 0:0:0:0: Power-on or device reset occurred sd 0:0:1:0: Power-on or device reset occurred sd 0:0:0:0: [sda] 10485762 512-byte logical blocks: (5.37 GB/5.00 GiB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA Unable to handle kernel NULL pointer dereference at virtual address (ptrval) Oops: 00000000 Modules linked in: PC: [<001cd874>] blk_mq_free_request+0x66/0xe2 SR: 2004 SP: (ptrval) a2: 00874520 d0: 00000000 d1: 00000000 d2: 009ba800 d3: 00000000 d4: 00000000 d5: 08000002 a0: 0087be68 a1: 009a81e0 Process kworker/u2:2 (pid: 15, task=(ptrval)) Frame format=7 eff addr=0000007a ssw=0505 faddr=0000007a wb 1 stat/addr/data: 0000 00000000 00000000 wb 2 stat/addr/data: 0000 00000000 00000000 wb 3 stat/addr/data: 0000 0000007a 00000000 push data: 00000000 00000000 00000000 00000000 Stack from 0087bd98: 00000002 00000000 0087be72 009a7820 0087bdb4 001c4f6c 009a7820 0087bdd4 0024d200 009a7820 0024d0dc 0087be72 009baa00 0087be68 009a5000 0087be7c 00265d10 009a5000 0087be72 00000003 00000000 00000000 00000000 0087be68 00000bb8 00000005 00000000 00000000 00000000 00000000 00265c56 00000000 009ba60c 0036ddf4 00000002 ffffffff 009baa00 009ba600 009a50d6 0087be74 00227ba0 009baa08 00000001 009baa08 009ba60c 0036ddf4 00000000 00000000 Call Trace: [<001c4f6c>] blk_put_request+0xe/0x14 [<0024d200>] __scsi_execute+0x124/0x174 [<0024d0dc>] __scsi_execute+0x0/0x174 [<00265d10>] sd_revalidate_disk+0xba/0x1f02 [<00265c56>] sd_revalidate_disk+0x0/0x1f02 [<0036ddf4>] strlen+0x0/0x22 [<00227ba0>] device_add+0x3da/0x604 [<0036ddf4>] strlen+0x0/0x22 [<00267e64>] sd_probe+0x30c/0x4b4 [<0002da44>] process_one_work+0x0/0x402 [<0022b978>] really_probe+0x226/0x354 [<0022bc34>] driver_probe_device+0xa4/0xf0 [<0002da44>] process_one_work+0x0/0x402 [<0022bcd0>] __driver_attach_async_helper+0x50/0x70 [<00035dae>] async_run_entry_fn+0x36/0x130 [<0002db88>] process_one_work+0x144/0x402 [<0002e1aa>] worker_thread+0x0/0x570 [<0002e29a>] worker_thread+0xf0/0x570 [<0002e1aa>] worker_thread+0x0/0x570 [<003768d8>] schedule+0x0/0xb8 [<0003f58c>] __init_waitqueue_head+0x0/0x12 [<00033e92>] kthread+0xc2/0xf6 [<000331e8>] kthread_parkme+0x0/0x4e [<003768d8>] schedule+0x0/0xb8 [<00033dd0>] kthread+0x0/0xf6 [<00002c10>] ret_from_kernel_thread+0xc/0x14 Code: 0280 0006 0800 56c0 4400 0280 0000 00ff <52b4> 0c3a 082b 0006 0013 6706 2042 53a8 00c4 4ab9 0047 3374 6640 202d 000c 670c Disabling lock debugging due to kernel taint Avoid this by setting sg_tablesize = 1. Link: https://lore.kernel.org/r/4567bcae94523b47d6f3b77450ba305823bca479.1572656814.git.fthain@telegraphics.com.au Reported-and-tested-by:Michael Schmitz <schmitzmic@gmail.com> Reviewed-by:
-
Johan Hovold authored
For some reason this driver depends on !64BIT, but it can still be useful to allow compile-testing on 64-bit machines. Link: https://lore.kernel.org/r/20191105085609.2338-3-johan@kernel.org Signed-off-by:
Johan Hovold <johan@kernel.org> Signed-off-by:
-
Johan Hovold authored
The MODULE_LICENSE macro is unconditionally defined in module.h, no need to ifdef its use. Link: https://lore.kernel.org/r/20191105085609.2338-2-johan@kernel.org Signed-off-by:
-
YueHaibing authored
platform_get_irq() will call dev_err() itself on failure, so there is no need for the driver to also do this. This is detected by coccinelle. Link: https://lore.kernel.org/r/20191101140058.23212-1-yuehaibing@huawei.com Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Kars de Jong authored
When using this driver on a Blizzard 1260, there were failures whenever DMA transfers from the SCSI bus to memory of 65535 bytes were followed by a DMA transfer of 1 byte. This caused the byte at offset 65535 to be overwritten with 0xff. The Blizzard hardware can't handle single byte DMA transfers. Besides this issue, limiting the DMA length to something that is not a multiple of the page size is very inefficient on most file systems. It seems this limit was chosen because the DMA transfer counter of the ESP by default is 16 bits wide, thus limiting the length to 65535 bytes. However, the value 0 means 65536 bytes, which is handled by the ESP and the Blizzard just fine. It is also the default maximum used by esp_scsi when drivers don't provide their own dma_length_limit() function. The limit of 65536 bytes can be used by all boards except the Fastlane. The old driver used a limit of 65532 bytes (0xfffc), which is reintroduced in this patch. Fixes: b7ded0e8 ("scsi: zorro_esp: Limit DMA transfers to 65535 bytes") Link: https://lore.kernel.org/r/20191112175523.23145-1-jongk@linux-m68k.org Signed-off-by:
Kars de Jong <jongk@linux-m68k.org> Reviewed-by:
-
YueHaibing authored
Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/csiostor/csio_lnode.c: In function 'csio_ln_init': drivers/scsi/csiostor/csio_lnode.c:1995:21: warning: variable 'rln' set but not used [-Wunused-but-set-variable] It is never used since introduction, so remove it. Link: https://lore.kernel.org/r/20191029061530.98197-1-yuehaibing@huawei.com Signed-off-by:
-
Bean Huo authored
In function __ufshcd_query_descriptor(), in the event of an error happening, we directly goto out_unlock and forget to invaliate hba->dev_cmd.query.descriptor pointer. This results in this pointer still valid in ufshcd_copy_query_response() for other query requests which go through ufshcd_exec_raw_upiu_cmd(). This will cause __memcpy() crash and system hangs. Log as shown below: Unable to handle kernel paging request at virtual address ffff000012233c40 Mem abort info: ESR = 0x96000047 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000047 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000028cc735c [ffff000012233c40] pgd=00000000bffff003, pud=00000000bfffe003, pmd=00000000ba8b8003, pte=0000000000000000 Internal error: Oops: 96000047 [#2] PREEMPT SMP ... Call trace: __memcpy+0x74/0x180 ufshcd_issue_devman_upiu_cmd+0x250/0x3c0 ufshcd_exec_raw_upiu_cmd+0xfc/0x1a8 ufs_bsg_request+0x178/0x3b0 bsg_queue_rq+0xc0/0x118 blk_mq_dispatch_rq_list+0xb0/0x538 blk_mq_sched_dispatch_requests+0x18c/0x1d8 __blk_mq_run_hw_queue+0xb4/0x118 blk_mq_run_work_fn+0x28/0x38 process_one_work+0x1ec/0x470 worker_thread+0x48/0x458 kthread+0x130/0x138 ret_from_fork+0x10/0x1c Code: 540000ab a8c12027 a88120c7 a8c12027 (a88120c7) ---[ end trace 793e1eb5dff69f2d ]--- note: kworker/0:2H[2054] exited with preempt_count 1 This patch is to move "descriptor = NULL" down to below the label "out_unlock". Fixes: d44a5f98(ufs: query descriptor API) Link: https://lore.kernel.org/r/20191112223436.27449-3-huobean@gmail.com Reviewed-by:
Alim Akhtar <alim.akhtar@samsung.com> Reviewed-by:
Bart Van Assche <bvanassche@acm.org> Signed-off-by:
-
Bean Huo authored
Print out returned response size and buffer size, while the front one is bigger than the back one. Link: https://lore.kernel.org/r/20191112223436.27449-2-huobean@gmail.com Reviewed-by:
-
John Garry authored
The !! operator on a bool is pointless, so remove an example in hisi_sas_rescan_topology(). Link: https://lore.kernel.org/r/1573551059-107873-5-git-send-email-john.garry@huawei.com Signed-off-by:
John Garry <john.garry@huawei.com> Signed-off-by:
-
Xiang Chen authored
Currently we call function hisi_sas_debugfs_exit() to remove debugfs_dir before freeing interrupt irqs and destroying workqueue in the driver remove path. If a dump is triggered before function hisi_sas_debugfs_exit() but debugfs_work may be called after it, so it may refer to already removed debugfs_dir which will cause NULL pointer dereference. To avoid it, put function hisi_sas_debugfs_exit() after free_irqs and destroy workqueue when removing hisi_sas driver. Link: https://lore.kernel.org/r/1573551059-107873-4-git-send-email-john.garry@huawei.com Signed-off-by:
Xiang Chen <chenxiang66@hisilicon.com> Signed-off-by:
-
Xiang Chen authored
Need to return directly if init hardware failed. Fixes: 73a4925d ("scsi: hisi_sas: Update all the registers after suspend and resume") Link: https://lore.kernel.org/r/1573551059-107873-3-git-send-email-john.garry@huawei.com Signed-off-by:
-
Xiang Chen authored
Need to check the structure sas_port before using it. Link: https://lore.kernel.org/r/1573551059-107873-2-git-send-email-john.garry@huawei.com Signed-off-by:
-
James Smart authored
Update lpfc version to 12.6.0.2 Link: https://lore.kernel.org/r/20191111230401.12958-7-jsmart2021@gmail.com Reviewed-by:
Ewan D. Milne <emilne@redhat.com> Signed-off-by:
Dick Kennedy <dick.kennedy@broadcom.com> Signed-off-by:
James Smart <jsmart2021@gmail.com> Signed-off-by:
-
James Smart authored
Driver is setting the initiator nvme template with a max hw queues value of the present cpu count which is odd. It should be registering the number of hdwq queues (queues created on the adapter). Change to set nvme tempate, in all cases, to the number of hardware queues. Link: https://lore.kernel.org/r/20191111230401.12958-6-jsmart2021@gmail.com Signed-off-by:
-
James Smart authored
Currently, cpu_map[cpu#]->hdwq is left to equal LPFC_VECTOR_MAP_EMPTY for not present CPUs. If a CPU is dynamically hot-added, it is possible we may crash due to not assigning an allocated hdwq. Correct by assigning a hdwq at initialization for all not-present CPUs. Fixes: dcaa2136 ("scsi: lpfc: Change default IRQ model on AMD architectures") Link: https://lore.kernel.org/r/20191111230401.12958-5-jsmart2021@gmail.com Reviewed-by:
-
James Smart authored
Compilation can fail due to having an inline function reference where the function body is not present. Fix by removing the inline tag. Fixes: 93a4d6f4 ("scsi: lpfc: Add registration for CPU Offline/Online events") Link: https://lore.kernel.org/r/20191111230401.12958-4-jsmart2021@gmail.com Reviewed-by:
-
James Smart authored
Coverity reported the following: *** CID 101747: Null pointer dereferences (FORWARD_NULL) /drivers/scsi/lpfc/lpfc_els.c: 4439 in lpfc_cmpl_els_rsp() 4433 kfree(mp); 4434 } 4435 mempool_free(mbox, phba->mbox_mem_pool); 4436 } 4437 out: 4438 if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { vvv CID 101747: Null pointer dereferences (FORWARD_NULL) vvv Dereferencing null pointer "shost". 4439 spin_lock_irq(shost->host_lock); 4440 ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); 4441 spin_unlock_irq(shost->host_lock); 4442 4443 /* If the node is not being used by another discovery thread, 4444 * and we are sending a reject, we are done with it. Fix by adding a check for non-null shost in line 4438. The scenario when shost is set to null is when ndlp is null. As such, the ndlp check present was sufficient. But better safe than sorry so add the shost check. Reported-by:coverity-bot <keescook+coverity-bot@chromium.org> Addresses-Coverity-ID: 101747 ("Null pointer dereferences") Fixes: 2e0fef85 ("[SCSI] lpfc: NPIV: split ports") CC: James Bottomley <James.Bottomley@SteelEye.com> CC: "Gustavo A. R. Silva" <gustavo@embeddedor.com> CC: linux-next@vger.kernel.org Link: https://lore.kernel.org/r/20191111230401.12958-3-jsmart2021@gmail.com Reviewed-by:
-
