- 19 Apr, 2022 16 commits
-
-
James Smart authored
lpfc_cgn_calc_crc32() is returning 32 bits, and lpfc_cgn_update_stat() was using u16 to store the crc32 value. Correct by redeclaring the local variable to u32. Link: https://lore.kernel.org/r/20220412222008.126521-15-jsmart2021@gmail.comCo-developed-by:
Justin Tee <justin.tee@broadcom.com> Signed-off-by:
James Smart <jsmart2021@gmail.com> Signed-off-by:
Martin K. Petersen <martin.petersen@oracle.com>
-
James Smart authored
lpfc_refresh_params() can be called for an async event handler. This could potentially override the value initialized by lpfc_cmf_setup(). Move module parameter check to lpfc_refresh_params(). Link: https://lore.kernel.org/r/20220412222008.126521-14-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
The command IOCB ndlp pointer is overwritten in lpfc_issue_els_rdf(), and the original ndlp pointer is stored ahead of time. This null ptr assignment can be safely removed. Link: https://lore.kernel.org/r/20220412222008.126521-13-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
In P2P topology, a target controller reboot sometimes results in not reestablishing a login because the ndlp is stuck in LOGO state. Fix by transitioning to NPR state if we get link down before LOGO completes. Link: https://lore.kernel.org/r/20220412222008.126521-12-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
If lpfc_sli_issue_iocb() fails, then the fc_prli_sent is never decremented. Move the fc_prli_sent++ to after a guaranteed IOCB submit. Link: https://lore.kernel.org/r/20220412222008.126521-11-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT (lpfc_rcv_plogi()'s login_mbox). Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(), and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for service parameters. For lpfc_els_rsp_reject() failure, free both the ctx_buf for service parameters and the login_mbox. Link: https://lore.kernel.org/r/20220412222008.126521-10-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Previous topologies may no longer be in fabric mode, so clear FC_FABRIC in fc_flag for every new FLOGI. Link: https://lore.kernel.org/r/20220412222008.126521-8-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: native_queued_spin_lock_slowpath+0x192 _raw_spin_lock_irqsave+0x32 lpfc_handle_fcp_err+0x4c6 lpfc_fcp_io_cmd_wqe_cmpl+0x964 lpfc_sli4_fp_handle_cqe+0x266 __lpfc_sli4_process_cq+0x105 __lpfc_sli4_hba_process_cq+0x3c lpfc_cq_poll_hdler+0x16 irq_poll_softirq+0x76 __softirqentry_text_start+0xe4 irq_exit+0xf7 do_IRQ+0x7f CPU B: native_queued_spin_lock_slowpath+0x5b _raw_spin_lock+0x1c lpfc_abort_handler+0x13e scmd_eh_abort_handler+0x85 process_one_work+0x1a7 worker_thread+0x30 kthread+0x112 ret_from_fork+0x1f Diagram of lockup: CPUA CPUB ---- ---- lpfc_cmd->buf_lock phba->hbalock lpfc_cmd->buf_lock phba->hbalock Fix by reordering the taking of the lpfc_cmd->buf_lock and phba->hbalock in lpfc_abort_handler routine so that it tries to take the lpfc_cmd->buf_lock first before phba->hbalock. Link: https://lore.kernel.org/r/20220412222008.126521-7-jsmart2021@gmail.comCo-developed-by: -
James Smart authored
During heavy I/O stress tests with 100+ vports and cable pulls, it may take a while before the vport logs back into the fabric to resume I/O. Currently, the driver immediately fails the I/O with DID_ERROR. Change behavior to return DID_REQUEUE, and rely on SCSI layer's max retry of 5 before erroring out the I/O. Link: https://lore.kernel.org/r/20220412222008.126521-6-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
It's possible that the fcpCntl0 reserved field is allocated non-zero. For certain target storage arrays this could cause problems expecting reserved fields to be all zero. SLI3 path already allocates fcp_cmnd buffer with dma_pool_zalloc() in lpfc_new_scsi_buf_s3. The fcpCntl0 field itself is never proactively set throughout the SCSI I/O path. Thus, we only change the SLI4 fcp_cmnd buffer allocation to dma_pool_zalloc. Link: https://lore.kernel.org/r/20220412222008.126521-5-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
The lpfc_sli4_ras_setup() routine is only called from the lpfc_pci_probe_one_s4() routine, which means diagnostic fw logging initialization only occurs during probing. Thus, any path involving a reset of the HBA that restarts the state of the SLI port does not reinitialize diagnostic fw logging. Move lpfc_sli4_ras_setup() into lpfc_sli4_hba_setup() so that the LOWLEVEL_SET_DIAG_LOG_OPTIONS mailbox command can be sent after a function reset. Link: https://lore.kernel.org/r/20220412222008.126521-4-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
In an attempt to log message 0126 with LOG_TRACE_EVENT, the following hard lockup call trace hangs the system. Call Trace: _raw_spin_lock_irqsave+0x32/0x40 lpfc_dmp_dbg.part.32+0x28/0x220 [lpfc] lpfc_cmpl_els_fdisc+0x145/0x460 [lpfc] lpfc_sli_cancel_jobs+0x92/0xd0 [lpfc] lpfc_els_flush_cmd+0x43c/0x670 [lpfc] lpfc_els_flush_all_cmd+0x37/0x60 [lpfc] lpfc_sli4_async_event_proc+0x956/0x1720 [lpfc] lpfc_do_work+0x1485/0x1d70 [lpfc] kthread+0x112/0x130 ret_from_fork+0x1f/0x40 Kernel panic - not syncing: Hard LOCKUP The same CPU tries to claim the phba->port_list_lock twice. Move the cfg_log_verbose checks as part of the lpfc_printf_vlog() and lpfc_printf_log() macros before calling lpfc_dmp_dbg(). There is no need to take the phba->port_list_lock within lpfc_dmp_dbg(). Link: https://lore.kernel.org/r/20220412222008.126521-3-jsmart2021@gmail.comCo-developed-by:
-
James Smart authored
Several log message categories were updated: - Enable msg 4623 (Xmit of ECD) to display for ELS logging. - Change msg 0220 (FDMI cmd failed) to display for ELS logging. - Change msg 6460 (FDMI RPA failure) to be warning not hard error. - Change msg 6172 (NVME rescan of DID) to be logged under NVMe discovery. Link: https://lore.kernel.org/r/20220412222008.126521-2-jsmart2021@gmail.comCo-developed-by:
-
Martin K. Petersen authored
Pull in 5.18 fixes branch which contains a bunch of fixes required for the lpfc driver update. Signed-off-by: -
Po-Wen Kao authored
Since the HPB mapping is already reset in ufshpb_init() by setting flag QUERY_FLAG_IDN_HPB_RESET, there is no need doing so again in ufshpb_hpb_lu_prepared(). This also resolves the issue where HPB WRITE BUFFER is issued before UAC is cleared. Link: https://lore.kernel.org/r/20220412073131.10644-1-powen.kao@mediatek.comAcked-by:
Bean Huo <beanhuo@micron.com> Signed-off-by:
Po-Wen Kao <powen.kao@mediatek.com> Signed-off-by:
-
- 12 Apr, 2022 14 commits
-
-
Mike Christie authored
I've been doing a lot of iscsi patches because Oracle is paying me to work on iSCSI again. It was supposed to be temp assignment, but my co-worker that was working on iscsi moved to a new group so it looks like I'm back on this code again. After talking to Chris and Lee this patch adds me back as co-maintainer, so I can help them and people remember to cc me on issues. Link: https://lore.kernel.org/r/20220408001314.5014-11-michael.christie@oracle.comTested-by:
Manish Rangankar <mrangankar@marvell.com> Acked-by:
Lee Duncan <lduncan@suse.com> Acked-by:
Chris Leech <cleech@redhat.com> Signed-off-by:
Mike Christie <michael.christie@oracle.com> Signed-off-by:
-
Mike Christie authored
We set the qedi_ep state to EP_STATE_OFLDCONN_START when the ep is created. Then in qedi_set_path we kick off the offload work. If userspace times out the connection and calls ep_disconnect, qedi will only flush the offload work if the qedi_ep state has transitioned away from EP_STATE_OFLDCONN_START. If we can't connect we will not have transitioned state and will leave the offload work running, and we will free the qedi_ep from under it. This patch just has us init the work when we create the ep, then always flush it. Link: https://lore.kernel.org/r/20220408001314.5014-10-michael.christie@oracle.comTested-by:
-
Mike Christie authored
If a offload driver doesn't use the xmit workqueue, then when we are doing ep_disconnect libiscsi can still inject PDUs to the driver. This adds a check for if the connection is bound before trying to inject PDUs. Link: https://lore.kernel.org/r/20220408001314.5014-9-michael.christie@oracle.comTested-by:
-
Mike Christie authored
Move the tx and rx suspend fields into one flags field. Link: https://lore.kernel.org/r/20220408001314.5014-8-michael.christie@oracle.comTested-by:
-
Mike Christie authored
If a driver raises a connection error before the connection is bound, we can leave a cleanup_work queued that can later run and disconnect/stop a connection that is logged in. The problem is that drivers can call iscsi_conn_error_event for endpoints that are connected but not yet bound when something like the network port they are using is brought down. iscsi_cleanup_conn_work_fn will check for this and exit early, but if the cleanup_work is stuck behind other works, it might not get run until after userspace has done ep_disconnect. Because the endpoint is not yet bound there was no way for ep_disconnect to flush the work. The bug of leaving stop_conns queued was added in: Commit 23d6fefb ("scsi: iscsi: Fix in-kernel conn failure handling") and: Commit 0ab71045 ("scsi: iscsi: Perform connection failure entirely in kernel space") was supposed to fix it, but left this case. This patch moves the conn state check to before we even queue the work so we can avoid queueing. Link: https://lore.kernel.org/r/20220408001314.5014-7-michael.christie@oracle.com Fixes: 0ab71045 ("scsi: iscsi: Perform connection failure entirely in kernel space") Tested-by:
-
Mike Christie authored
If iscsid is doing a stop_conn at the same time the kernel is starting error recovery we can hit a race that allows the cleanup work to run on a valid connection. In the race, iscsi_if_stop_conn sees the cleanup bit set, but it calls flush_work on the clean_work before iscsi_conn_error_event has queued it. The flush then returns before the queueing and so the cleanup_work can run later and disconnect/stop a conn while it's in a connected state. The patch: Commit 0ab71045 ("scsi: iscsi: Perform connection failure entirely in kernel space") added the late stop_conn call bug originally, and the patch: Commit 23d6fefb ("scsi: iscsi: Fix in-kernel conn failure handling") attempted to fix it but only fixed the normal EH case and left the above race for the iscsid restart case. For the normal EH case we don't hit the race because we only signal userspace to start recovery after we have done the queueing, so the flush will always catch the queued work or see it completed. For iscsid restart cases like boot, we can hit the race because iscsid will call down to the kernel before the kernel has signaled any error, so both code paths can be running at the same time. This adds a lock around the setting of the cleanup bit and queueing so they happen together. Link: https://lore.kernel.org/r/20220408001314.5014-6-michael.christie@oracle.com Fixes: 0ab71045 ("scsi: iscsi: Perform connection failure entirely in kernel space") Tested-by:
-
Mike Christie authored
This patch fixes a bug where when using iSCSI offload we can free an endpoint while userspace still thinks it's active. That then causes the endpoint ID to be reused for a new connection's endpoint while userspace still thinks the ID is for the original connection. Userspace will then end up disconnecting a running connection's endpoint or trying to bind to another connection's endpoint. This bug is a regression added in: Commit 23d6fefb ("scsi: iscsi: Fix in-kernel conn failure handling") where we added a in kernel ep_disconnect call to fix a bug in: Commit 0ab71045 ("scsi: iscsi: Perform connection failure entirely in kernel space") where we would call stop_conn without having done ep_disconnect. This early ep_disconnect call will then free the endpoint and it's ID while userspace still thinks the ID is valid. Fix the early release of the ID by having the in kernel recovery code keep a reference to the endpoint until userspace has called into the kernel to finish cleaning up the endpoint/connection. It requires the previous commit "scsi: iscsi: Release endpoint ID when its freed" which moved the freeing of the ID until when the endpoint is released. Link: https://lore.kernel.org/r/20220408001314.5014-5-michael.christie@oracle.com Fixes: 23d6fefb ("scsi: iscsi: Fix in-kernel conn failure handling") Tested-by:
-
Mike Christie authored
We can't release the endpoint ID until all references to the endpoint have been dropped or it could be allocated while in use. This has us use an idr instead of looping over all conns to find a free ID and then free the ID when all references have been dropped instead of when the device is only deleted. Link: https://lore.kernel.org/r/20220408001314.5014-4-michael.christie@oracle.comTested-by:
Wu Bo <wubo40@huawei.com> Signed-off-by:
-
Mike Christie authored
When userspace restarts during boot or upgrades it won't know about the offload driver's endpoint and connection mappings. iscsid will start by cleaning up the old session by doing a stop_conn call. Later, if we are able to create a new connection, we clean up the old endpoint during the binding stage. The problem is that if we do stop_conn before doing the ep_disconnect call offload, drivers can still be executing I/O. We then might free tasks from the under the card/driver. This moves the ep_disconnect call to before we do the stop_conn call for this case. It will then work and look like a normal recovery/cleanup procedure from the driver's point of view. Link: https://lore.kernel.org/r/20220408001314.5014-3-michael.christie@oracle.comTested-by:
-
Mike Christie authored
This patch moves iscsi_ep_disconnect() so it can be called earlier in the next patch. Link: https://lore.kernel.org/r/20220408001314.5014-2-michael.christie@oracle.comTested-by:
-
Ajish Koshy authored
Executing driver on servers with more than 32 CPUs were faced with command timeouts. This is because we were not geting completions for commands submitted on IQ32 - IQ63. Set E64Q bit to enable upper inbound and outbound queues 32 to 63 in the MPI main configuration table. Added 500ms delay after successful MPI initialization as mentioned in controller datasheet. Link: https://lore.kernel.org/r/20220411064603.668448-3-Ajish.Koshy@microchip.com Fixes: 05c6c029 ("scsi: pm80xx: Increase number of supported queues") Reviewed-by:
Damien Le Moal <damien.lemoal@opensource.wdc.com> Acked-by:
Jack Wang <jinpu.wang@ionos.com> Signed-off-by:
Ajish Koshy <Ajish.Koshy@microchip.com> Signed-off-by:
Viswas G <Viswas.G@microchip.com> Signed-off-by:
-
Ajish Koshy authored
When upper inbound and outbound queues 32-63 are enabled, we see upper vectors 32-63 in interrupt service routine. We need corresponding registers to handle masking and unmasking of these upper interrupts. To achieve this, we use registers MSGU_ODMR_U(0x34) to mask and MSGU_ODMR_CLR_U(0x3C) to unmask the interrupts. In these registers bit 0-31 represents interrupt vectors 32-63. Link: https://lore.kernel.org/r/20220411064603.668448-2-Ajish.Koshy@microchip.com Fixes: 05c6c029 ("scsi: pm80xx: Increase number of supported queues") Reviewed-by:
John Garry <john.garry@huawei.com> Acked-by:
-
Bart Van Assche authored
Revert the patch mentioned in the subject since it blocks I/O after module unload has started while this is a legitimate use case. For e.g. blktests test case srp/001 that patch causes a command timeout to be triggered for the following call stack: __schedule+0x4c3/0xd20 schedule+0x82/0x110 schedule_timeout+0x122/0x200 io_schedule_timeout+0x7b/0xc0 __wait_for_common+0x2bc/0x380 wait_for_completion_io_timeout+0x1d/0x20 blk_execute_rq+0x1db/0x200 __scsi_execute+0x1fb/0x310 sd_sync_cache+0x155/0x2c0 [sd_mod] sd_shutdown+0xbb/0x190 [sd_mod] sd_remove+0x5b/0x80 [sd_mod] device_remove+0x9a/0xb0 device_release_driver_internal+0x2c5/0x360 device_release_driver+0x12/0x20 bus_remove_device+0x1aa/0x270 device_del+0x2d4/0x640 __scsi_remove_device+0x168/0x1a0 scsi_forget_host+0xa8/0xb0 scsi_remove_host+0x9b/0x150 sdebug_driver_remove+0x3d/0x140 [scsi_debug] device_remove+0x6f/0xb0 device_release_driver_internal+0x2c5/0x360 device_release_driver+0x12/0x20 bus_remove_device+0x1aa/0x270 device_del+0x2d4/0x640 device_unregister+0x18/0x70 sdebug_do_remove_host+0x138/0x180 [scsi_debug] scsi_debug_exit+0x45/0xd5 [scsi_debug] __do_sys_delete_module.constprop.0+0x210/0x320 __x64_sys_delete_module+0x1f/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Link: https://lore.kernel.org/r/20220409043704.28573-1-bvanassche@acm.org Fixes: 2aad3cd8 ("scsi: scsi_debug: Address races following module load") Cc: Douglas Gilbert <dgilbert@interlog.com> Cc: Yi Zhang <yi.zhang@redhat.com> Cc: Bob Pearson <rpearsonhpe@gmail.com> Reported-by:
Yi Zhang <yi.zhang@redhat.com> Tested-by:
Douglas Gilbert <dgilbert@interlog.com> Signed-off-by:
Bart Van Assche <bvanassche@acm.org> Signed-off-by:
-
Wan Jiabing authored
instance->cmd_list is allocated by kcalloc(). The memory is already set to zero. It is unnecessary to call memset again. Link: https://lore.kernel.org/r/20220407072442.4137977-1-wanjiabing@vivo.comAcked-by:
Sumit Saxena <sumit.saxena@broadcom.com> Signed-off-by:
Wan Jiabing <wanjiabing@vivo.com> Signed-off-by:
-
- 07 Apr, 2022 10 commits
-
-
Christophe JAILLET authored
dma_alloc_coherent() already clear the allocated memory, there is no need to explicitly call memset(). Since 'config_page' and 'header' are the same, a memset() call can be avoided. Link: https://lore.kernel.org/r/cd1220c628c89465dcfcbf4aa9bd53110898a529.1648067518.git.christophe.jaillet@wanadoo.frSigned-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Krzysztof Kozlowski authored
The 'struct device' pointer is already cached as a local variable in ufshcd_pltfrm_init(), so use it. Link: https://lore.kernel.org/r/20220401085050.119323-1-krzysztof.kozlowski@linaro.orgReviewed-by:
Chanho Park <chanho61.park@samsung.com> Signed-off-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by:
-
Chandrakanth patil authored
The megaraid_sas driver supports single LUN for RAID devices. That is LUN 0. All other LUNs are unsupported. When a device scan on a logical target with invalid LUN number is invoked through sysfs, that target ends up getting removed. Add LUN ID validation in the slave destroy function to avoid the target deletion. Link: https://lore.kernel.org/r/20220324094711.48833-1-chandrakanth.patil@broadcom.comSigned-off-by:
Chandrakanth patil <chandrakanth.patil@broadcom.com> Signed-off-by:
-
Xiaomeng Tong authored
The list iterator is always non-NULL so the check 'if (!rgn)' is always false and the dev_err() is never called. Move the check outside the loop and determine if 'victim_rgn' is NULL, to fix this bug. Link: https://lore.kernel.org/r/20220320150733.21824-1-xiam0nd.tong@gmail.com Fixes: 4b5f4907 ("scsi: ufs: ufshpb: L2P map management for HPB read") Reviewed-by:
Daejun Park <daejun7.park@samsung.com> Signed-off-by:
Xiaomeng Tong <xiam0nd.tong@gmail.com> Signed-off-by:
-
Wenchao Hao authored
We forgot to call blk_cleanup_disk() when device_add_disk() failed. This would cause a memory leak of gendisk and sched_tags allocated in elevator_init_mq() Reference:https://syzkaller.appspot.com/x/log.txt?x=13b41dcb700000 Reported-and-tested-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220401011018.1026553-1-haowenchao@huawei.comSigned-off-by:
Wenchao Hao <haowenchao@huawei.com> Signed-off-by:
-
Maurizio Lombardi authored
The target driver prevents the users from changing the database root directory if a target module like ib_srpt has been registered. This makes it difficult for users to set their preferred database directory if the module gets loaded during the system boot. Let the users modify dbroot if there are no registered devices Link: https://lore.kernel.org/r/20220328103940.19977-1-mlombard@redhat.comReviewed-by:
Maurizio Lombardi <mlombard@redhat.com> Signed-off-by:
-
Colin Ian King authored
Variable dmp is being assigned a value that is never read, the variable is redundant and can be removed. Cleans up clang scan build warning: drivers/message/fusion/mptbase.c:6667:39: warning: Although the value stored to 'dmp' is used in the enclosing expression, the value is never actually read from 'dmp' [deadcode.DeadStores] Link: https://lore.kernel.org/r/20220318003927.81471-1-colin.i.king@gmail.comReviewed-by:
Nick Desaulniers <ndesaulniers@google.com> Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Signed-off-by:
-
Alexey Galakhov authored
The HighPoint RocketRaid 2640 is a low-cost SAS controller based on Marvell chip. The chip in question was already supported by the kernel, just the PCI ID of this particular board was missing. Link: https://lore.kernel.org/r/20220309212535.402987-1-agalakhov@gmail.comSigned-off-by:
Alexey Galakhov <agalakhov@gmail.com> Signed-off-by:
-
Martin K. Petersen authored
As such it should be called inside the scsi_device_supports_vpd() conditional. Link: https://lore.kernel.org/r/20220302053559.32147-13-martin.petersen@oracle.com Fixes: e815d365 ("scsi: sd: add concurrent positioning ranges support") Cc: Damien Le Moal <damien.lemoal@wdc.com> Reviewed-by:
Christoph Hellwig <hch@lst.de> Reviewed-by:
-
Sreekanth Reddy authored
As part of controller reset operation the driver issues a config request command. If this command gets times out, then fail the controller reset operation instead of retrying it. Link: https://lore.kernel.org/r/20220405120637.20528-1-sreekanth.reddy@broadcom.comSigned-off-by:
Sreekanth Reddy <sreekanth.reddy@broadcom.com> Signed-off-by:
-
