kernel/linux.git/drivers/scsi/aacraid, branch v5.10.257

scsi: aacraid: Stop using PCI_IRQ_AFFINITY

2025-08-28T14:22:46+00:00

[ Upstream commit dafeaf2c03e71255438ffe5a341d94d180e6c88e ] When PCI_IRQ_AFFINITY is set for calling pci_alloc_irq_vectors(), it means interrupts are spread around the available CPUs. It also means that the interrupts become managed, which means that an interrupt is shutdown when all the CPUs in the interrupt affinity mask go offline. Using managed interrupts in this way means that we should ensure that completions should not occur on HW queues where the associated interrupt is shutdown. This is typically achieved by ensuring only CPUs which are online can generate IO completion traffic to the HW queue which they are mapped to (so that they can also serve completion interrupts for that HW queue). The problem in the driver is that a CPU can generate completions to a HW queue whose interrupt may be shutdown, as the CPUs in the HW queue interrupt affinity mask may be offline. This can cause IOs to never complete and hang the system. The driver maintains its own CPU <-> HW queue mapping for submissions, see aac_fib_vector_assign(), but this does not reflect the CPU <-> HW queue interrupt affinity mapping. Commit 9dc704dcc09e ("scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity") tried to remedy this issue may mapping CPUs properly to HW queue interrupts. However this was later reverted in commit c5becf57dd56 ("Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity") - it seems that there were other reports of hangs. I guess that this was due to some implementation issue in the original commit or maybe a HW issue. Fix the very original hang by just not using managed interrupts by not setting PCI_IRQ_AFFINITY. In this way, all CPUs will be in each HW queue affinity mask, so should not create completion problems if any CPUs go offline. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20250715111535.499853-1-john.g.garry@oracle.com Closes: https://lore.kernel.org/linux-scsi/20250618192427.3845724-1-jmeneghi@redhat.com/ Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: aacraid: Rearrange order of struct aac_srb_unit

2024-10-17T13:08:16+00:00

[ Upstream commit 6e5860b0ad4934baee8c7a202c02033b2631bb44 ] struct aac_srb_unit contains struct aac_srb, which contains struct sgmap, which ends in a (currently) "fake" (1-element) flexible array. Converting this to a flexible array is needed so that runtime bounds checking won't think the array is fixed size (i.e. under CONFIG_FORTIFY_SOURCE=y and/or CONFIG_UBSAN_BOUNDS=y), as other parts of aacraid use struct sgmap as a flexible array. It is not legal to have a flexible array in the middle of a structure, so it either needs to be split up or rearranged so that it is at the end of the structure. Luckily, struct aac_srb_unit, which is exclusively consumed/updated by aac_send_safw_bmic_cmd(), does not depend on member ordering. The values set in the on-stack struct aac_srb_unit instance "srbu" by the only two callers, aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), do not contain anything in srbu.srb.sgmap.sg, and they both implicitly initialize srbu.srb.sgmap.count to 0 during memset(). For example: memset(&srbu, 0, sizeof(struct aac_srb_unit)); srbcmd = &srbu.srb; srbcmd->flags = cpu_to_le32(SRB_DataIn); srbcmd->cdb[0] = CISS_REPORT_PHYSICAL_LUNS; srbcmd->cdb[1] = 2; /* extended reporting */ srbcmd->cdb[8] = (u8)(datasize >> 8); srbcmd->cdb[9] = (u8)(datasize); rcode = aac_send_safw_bmic_cmd(dev, &srbu, phys_luns, datasize); During aac_send_safw_bmic_cmd(), a separate srb is mapped into DMA, and has srbu.srb copied into it: srb = fib_data(fibptr); memcpy(srb, &srbu->srb, sizeof(struct aac_srb)); Only then is srb.sgmap.count written and srb->sg populated: srb->count = cpu_to_le32(xfer_len); sg64 = (struct sgmap64 *)&srb->sg; sg64->count = cpu_to_le32(1); sg64->sg[0].addr[1] = cpu_to_le32(upper_32_bits(addr)); sg64->sg[0].addr[0] = cpu_to_le32(lower_32_bits(addr)); sg64->sg[0].count = cpu_to_le32(xfer_len); But this is happening in the DMA memory, not in srbu.srb. An attempt to copy the changes back to srbu does happen: /* * Copy the updated data for other dumping or other usage if * needed */ memcpy(&srbu->srb, srb, sizeof(struct aac_srb)); But this was never correct: the sg64 (3 u32s) overlap of srb.sg (2 u32s) always meant that srbu.srb would have held truncated information and any attempt to walk srbu.srb.sg.sg based on the value of srbu.srb.sg.count would result in attempting to parse past the end of srbu.srb.sg.sg[0] into srbu.srb_reply. After getting a reply from hardware, the reply is copied into srbu.srb_reply: srb_reply = (struct aac_srb_reply *)fib_data(fibptr); memcpy(&srbu->srb_reply, srb_reply, sizeof(struct aac_srb_reply)); This has always been fixed-size, so there's no issue here. It is worth noting that the two callers _never check_ srbu contents -- neither srbu.srb nor srbu.srb_reply is examined. (They depend on the mapped xfer_buf instead.) Therefore, the ordering of members in struct aac_srb_unit does not matter, and the flexible array member can moved to the end. (Additionally, the two memcpy()s that update srbu could be entirely removed as they are never consumed, but I left that as-is.) Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20240711215739.208776-1-kees@kernel.org Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: aacraid: Fix double-free on probe failure

2024-09-04T11:17:47+00:00

[ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: aacraid: Improve compat_ioctl handlers

2020-12-30T10:53:02+00:00

[ Upstream commit 077054215a7f787e389a807ece8a39247abbbc1e ] The use of compat_alloc_user_space() can be easily replaced by handling compat arguments in the regular handler, and this will make it work for big-endian kernels as well, which at the moment get an invalid indirect pointer argument. Calling aac_ioctl() instead of aac_compat_do_ioctl() means the compat and native code paths behave the same way again, which they stopped when the adapter health check was added only in the native function. Link: https://lore.kernel.org/r/20201030164450.1253641-1-arnd@kernel.org Fixes: 572ee53a9bad ("scsi: aacraid: check adapter health") Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2020-10-14T22:15:35+00:00

Pull SCSI updates from James Bottomley: "The usual driver updates (ufs, qla2xxx, tcmu, ibmvfc, lpfc, smartpqi, hisi_sas, qedi, qedf, mpt3sas) and minor bug fixes. There are only three core changes: adding sense codes, cleaning up noretry and adding an option for limitless retries" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (226 commits) scsi: hisi_sas: Recover PHY state according to the status before reset scsi: hisi_sas: Filter out new PHY up events during suspend scsi: hisi_sas: Add device link between SCSI devices and hisi_hba scsi: hisi_sas: Add check for methods _PS0 and _PR0 scsi: hisi_sas: Add controller runtime PM support for v3 hw scsi: hisi_sas: Switch to new framework to support suspend and resume scsi: hisi_sas: Use hisi_hba->cq_nvecs for calling calling synchronize_irq() scsi: qedf: Remove redundant assignment to variable 'rc' scsi: lpfc: Remove unneeded variable 'status' in lpfc_fcp_cpu_map_store() scsi: snic: Convert to use DEFINE_SEQ_ATTRIBUTE macro scsi: qla4xxx: Delete unneeded variable 'status' in qla4xxx_process_ddb_changed scsi: sun_esp: Use module_platform_driver to simplify the code scsi: sun3x_esp: Use module_platform_driver to simplify the code scsi: sni_53c710: Use module_platform_driver to simplify the code scsi: qlogicpti: Use module_platform_driver to simplify the code scsi: mac_esp: Use module_platform_driver to simplify the code scsi: jazz_esp: Use module_platform_driver to simplify the code scsi: mvumi: Fix error return in mvumi_io_attach() scsi: lpfc: Drop nodelist reference on error in lpfc_gen_req() scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() ...

scsi: aacraid: Add a missing iounmap call

2020-10-03T01:28:33+00:00

Add a missing resource cleanup in _aac_reset_adapter. Link: https://lore.kernel.org/r/20200926150015.6187-1-thenzl@redhat.com Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen

scsi: aacraid: Make some symbols static in aachba.c

2020-09-16T01:28:03+00:00

This eliminates the following sparse warning: drivers/scsi/aacraid/aachba.c:245:5: warning: symbol 'aac_convert_sgl' was not declared. Should it be static? drivers/scsi/aacraid/aachba.c:293:5: warning: symbol 'acbsize' was not declared. Should it be static? drivers/scsi/aacraid/aachba.c:324:5: warning: symbol 'aac_wwn' was not declared. Should it be static? Link: https://lore.kernel.org/r/20200912033749.142488-1-yanaijie@huawei.com Reported-by: Hulk Robot Signed-off-by: Jason Yan Signed-off-by: Martin K. Petersen

scsi: aacraid: Remove erroneous fallthrough annotation

2020-09-02T02:03:26+00:00

This fallthrough annotation is unreachable so we can delete it. Link: https://lore.kernel.org/r/20200825112003.GD285523@mwanda Fixes: c4e2fbca374b ("scsi: aacraid: Reworked scsi command submission path") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen

scsi: aacraid: Remove pci-dma-compat wrapper API

2020-08-25T02:30:16+00:00

The legacy API wrappers in include/linux/pci-dma-compat.h should go away as they create unnecessary midlayering for include/linux/dma-mapping.h API. Instead use dma-mapping.h API directly. The patch has been generated with the coccinelle script below. Compile-tested. @@@@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@@@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@@@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@@@ - PCI_DMA_NONE + DMA_NONE @@ expression E1, E2, E3; @@ - pci_alloc_consistent(E1, E2, E3) + dma_alloc_coherent(&E1->dev, E2, E3, GFP_) @@ expression E1, E2, E3; @@ - pci_zalloc_consistent(E1, E2, E3) + dma_alloc_coherent(&E1->dev, E2, E3, GFP_) @@ expression E1, E2, E3, E4; @@ - pci_free_consistent(E1, E2, E3, E4) + dma_free_coherent(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_map_single(E1, E2, E3, E4) + dma_map_single(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_unmap_single(E1, E2, E3, E4) + dma_unmap_single(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4, E5; @@ - pci_map_page(E1, E2, E3, E4, E5) + dma_map_page(&E1->dev, E2, E3, E4, E5) @@ expression E1, E2, E3, E4; @@ - pci_unmap_page(E1, E2, E3, E4) + dma_unmap_page(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_map_sg(E1, E2, E3, E4) + dma_map_sg(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_unmap_sg(E1, E2, E3, E4) + dma_unmap_sg(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_dma_sync_single_for_cpu(E1, E2, E3, E4) + dma_sync_single_for_cpu(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_dma_sync_single_for_device(E1, E2, E3, E4) + dma_sync_single_for_device(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_dma_sync_sg_for_cpu(E1, E2, E3, E4) + dma_sync_sg_for_cpu(&E1->dev, E2, E3, E4) @@ expression E1, E2, E3, E4; @@ - pci_dma_sync_sg_for_device(E1, E2, E3, E4) + dma_sync_sg_for_device(&E1->dev, E2, E3, E4) @@ expression E1, E2; @@ - pci_dma_mapping_error(E1, E2) + dma_mapping_error(&E1->dev, E2) @@ expression E1, E2; @@ - pci_set_consistent_dma_mask(E1, E2) + dma_set_coherent_mask(&E1->dev, E2) @@ expression E1, E2; @@ - pci_set_dma_mask(E1, E2) + dma_set_mask(&E1->dev, E2) Link: https://lore.kernel.org/r/f8d4778440d55ba26c04eef0f7d63fb211a39443.1596045683.git.usuraj35@gmail.com Signed-off-by: Suraj Upadhyay Signed-off-by: Martin K. Petersen

treewide: Use fallthrough pseudo-keyword

2020-08-23T22:36:59+00:00

Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva