- Kernel - mailweb.openeuler.org

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/2] netfilter: nft_ct: Fix CVE-2026-43060
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43060 in the OLK-5.10 branch. * Patch 1: Add seqadj extension for natted connections (stable-dep) * Patch 2: Drop pending enqueued packets on removal (CVE fix) Andrii Melnychenko (1): netfilter: nft_ct: add seqadj extension for natted connections Pablo Neira Ayuso (1): netfilter: nft_ct: drop pending enqueued packets on removal net/netfilter/nft_ct.c | 9 +++++++++ 1 file changed, 9 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] netfilter: nft_ct: drop pending enqueued packets on removal
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.130 commit e68a8db3a0546482b34e9ca5ca886bcf73eb37bb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14592 CVE: CVE-2026-43060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 36eae0956f659e48d5366d9b083d9417f3263ddc ] Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference. Since these objects can just go away, drop enqueued packets to avoid stale reference to them. If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies. Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/netfilter/nft_ct.c [context mismatch in nft_ct_timeout_obj_destroy due to kfree_rcu() instead of kfree() in target tree for f8dca15a1b19 has been merged; manual resolution applied] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_ct.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index eff5921bdea6..7ed103de9b76 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -23,6 +23,7 @@ #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_expect.h> #include <net/netfilter/nf_conntrack_seqadj.h> +#include "nf_internals.h" struct nft_ct_helper_obj { struct nf_conntrack_helper *helper4; @@ -527,6 +528,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) #endif #ifdef CONFIG_NF_CONNTRACK_ZONES case NFT_CT_ZONE: + nf_queue_nf_hook_drop(ctx->net); mutex_lock(&nft_ct_pcpu_mutex); if (--nft_ct_pcpu_template_refcnt == 0) nft_ct_tmpl_put_pcpu(); @@ -997,6 +999,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, struct nft_ct_timeout_obj *priv = nft_obj_data(obj); struct nf_ct_timeout *timeout = priv->timeout; + nf_queue_nf_hook_drop(ctx->net); nf_ct_untimeout(ctx->net, timeout); nf_ct_netns_put(ctx->net, ctx->family); kfree_rcu(priv->timeout, rcu); @@ -1129,6 +1132,7 @@ static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, { struct nft_ct_helper_obj *priv = nft_obj_data(obj); + nf_queue_nf_hook_drop(ctx->net); if (priv->helper4) nf_conntrack_helper_put(priv->helper4); if (priv->helper6) -- 2.43.0

2 1

[PATCH OLK-6.6] APEI/GHES: ARM processor Error: don't go past allocated memory
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 87880af2d24e62a84ed19943dbdd524f097172f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14747 CVE: CVE-2026-43201 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/apei/ghes.c drivers/ras/ras.c [conflicts due to not merged 96b010536ee0 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs")] Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..d67618bc7017 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -607,27 +607,51 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; + int length = gdata->error_data_length; bool queued = false; int sec_sev, i; bool critical; char *p; sec_sev = ghes_severity(gdata->error_severity); + if (length >= sizeof(*err)) { #ifdef CONFIG_RAS_ARM_EVENT_INFO - log_arm_hw_error(err, sec_sev); + log_arm_hw_error(err, sec_sev); #else - log_arm_hw_error(err); + log_arm_hw_error(err); #endif + } else { + pr_warn(FW_BUG "arm error length: %d\n", length); + pr_warn(FW_BUG "length is too small\n"); + pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); + return false; + } + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) return false; p = (char *)(err + 1); critical = ghes_armp_vendor_critical_error(err, sync); + length -= sizeof(err); + for (i = 0; i < err->err_info_num; i++) { - struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); - bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); const char *error_type = "unknown error"; + struct cper_arm_err_info *err_info; + bool is_cache, has_pa; + + /* Ensure we have enough data for the error info header */ + if (length < sizeof(*err_info)) + break; + + err_info = (struct cper_arm_err_info *)p; + + /* Validate the claimed length before using it */ + length -= err_info->length; + if (length < 0) + break; + + is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); /* * The field (err_info->error_info & BIT(26)) is fixed to set to diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 547e058e2d56..ecfaff12816c 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -77,7 +77,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err) ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); ctx_err = (u8 *)ctx_info; for (n = 0; n < err->context_info_num; n++) { - sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; + sz = sizeof(struct cper_arm_ctx_info); + + if (sz + (long)ctx_info - (long)err >= err->section_length) + sz += ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len += sz; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-43240
by Liu Mingrui 30 May '26

30 May '26

CVE-2026-43240 Harshit Mogalapalli (2): ima: verify the previous kernel's IMA buffer lies in addressable RAM x86/kexec: add a sanity check on previous kernel's ima kexec buffer arch/x86/kernel/setup.c | 6 +++++ include/linux/ima.h | 1 + security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 0/6] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- include/linux/cleanup.h | 19 +++++ 6 files changed, 173 insertions(+), 25 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.140 commit 83ce43a21bb7df8dd52228afdd918d2d058eefde category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 ] Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> [ kept existing dout() debug call instead of upstream's doutc() form when adding the d_unhashed() guard around d_add() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index beedb07ee4af..949c2a450cfb 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -745,7 +745,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -813,7 +814,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, __ceph_touch_fmode(ci, mdsc, CEPH_FILE_MODE_RD); spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.1-rc1 commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 1fddb9cd3e88..504693f6b72d 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -719,7 +719,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -775,7 +776,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, __ceph_touch_fmode(ci, mdsc, CEPH_FILE_MODE_RD); spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] APEI/GHES: ARM processor Error: don't go past allocated memory
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 87880af2d24e62a84ed19943dbdd524f097172f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14747 CVE: CVE-2026-43201 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/apei/ghes.c drivers/ras/ras.c [conflicts due to not merged 96b010536ee0 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs")] Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..2091aa4b3a00 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -607,27 +607,51 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; + int length = gdata->error_data_length; bool queued = false; int sec_sev, i; bool critical; char *p; sec_sev = ghes_severity(gdata->error_severity); ++ if (length >= sizeof(*err)) { #ifdef CONFIG_RAS_ARM_EVENT_INFO - log_arm_hw_error(err, sec_sev); + log_arm_hw_error(err, sec_sev); #else - log_arm_hw_error(err); + log_arm_hw_error(err); #endif + } else { + pr_warn(FW_BUG "arm error length: %d\n", length); + pr_warn(FW_BUG "length is too small\n"); + pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); + return false; + } + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) return false; p = (char *)(err + 1); critical = ghes_armp_vendor_critical_error(err, sync); + length -= sizeof(err); + for (i = 0; i < err->err_info_num; i++) { - struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); - bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); const char *error_type = "unknown error"; + struct cper_arm_err_info *err_info; + bool is_cache, has_pa; + + /* Ensure we have enough data for the error info header */ + if (length < sizeof(*err_info)) + break; + + err_info = (struct cper_arm_err_info *)p; + + /* Validate the claimed length before using it */ + length -= err_info->length; + if (length < 0) + break; + + is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); /* * The field (err_info->error_info & BIT(26)) is fixed to set to diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 547e058e2d56..ecfaff12816c 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -77,7 +77,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err) ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); ctx_err = (u8 *)ctx_info; for (n = 0; n < err->context_info_num; n++) { - sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; + sz = sizeof(struct cper_arm_ctx_info); + + if (sz + (long)ctx_info - (long)err >= err->section_length) + sz += ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len += sz; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.1-rc1 commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 7f3f64ba464f..0a12e668133c 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -703,7 +703,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -758,7 +759,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, (__ceph_caps_issued_mask(ci, CEPH_CAP_FILE_SHARED, 1))) { spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- include/linux/cleanup.h | 19 +++++ 6 files changed, 173 insertions(+), 25 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Andreas Gruenbacher (1): gfs2: Add metapath_dibh helper Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
by Chen Jinghuang 30 May '26

30 May '26

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v6.6.140 commit c5dc30da990045105c9762248d23076223e7878a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15428 CVE: CVE-2026-46178 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c54c7e4cb679c0aaa1cb489b9c3f2cd98e63a44c upstream. Sashiko points out that mlx4_srq_alloc() was not undone during error unwind, add the missing call to mlx4_srq_free(). Cc: stable(a)vger.kernel.org Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg… Link: https://patch.msgid.link/r/11-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia… Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx4/srq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c index c4cf91235eee..68e8b04c5388 100644 --- a/drivers/infiniband/hw/mlx4/srq.c +++ b/drivers/infiniband/hw/mlx4/srq.c @@ -193,13 +193,15 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq, if (udata) if (ib_copy_to_udata(udata, &srq->msrq.srqn, sizeof (__u32))) { err = -EFAULT; - goto err_wrid; + goto err_srq; } init_attr->attr.max_wr = srq->msrq.max - 1; return 0; +err_srq: + mlx4_srq_free(dev->dev, &srq->msrq); err_wrid: if (udata) mlx4_ib_db_unmap_user(ucontext, &srq->db); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/7] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Andreas Gruenbacher (6): gfs2: Add new gfs2_iomap_get helper gfs2: Turn gfs2_extent_map into gfs2_{get,alloc}_extent gfs2: Replace gfs2_lblk_to_dblk with gfs2_get_extent gfs2: Add wrapper for iomap_file_buffered_write gfs2: Move the inode glock locking to gfs2_file_buffered_write gfs2: Add metapath_dibh helper Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 227 +++++++++++++++++++-------------------------- fs/gfs2/bmap.h | 13 ++- fs/gfs2/dir.c | 13 ++- fs/gfs2/file.c | 59 +++++++++--- fs/gfs2/log.c | 6 +- fs/gfs2/quota.c | 4 +- fs/gfs2/recovery.c | 4 +- 7 files changed, 162 insertions(+), 164 deletions(-) -- 2.34.1

2 8

[PATCH openeuler-1.0-LTS] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 30 +++++++++++++++-------- 4 files changed, 36 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 4e3fff9f929b..7e12d5b27249 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -81,4 +81,9 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index c11822a7d2bf..c8b4c0c15767 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -238,6 +238,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 27b84231db10..a8dcb4e44d5f 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -105,6 +106,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -162,6 +165,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; @@ -414,6 +419,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -467,8 +474,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 331839218a1c..203a5d059b20 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3056,31 +3056,37 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + err = -ENOMEM; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - err = -ENOMEM; - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (skb2 == NULL) { - nf_ct_expect_put(exp); - goto out; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) goto free; @@ -3135,22 +3141,26 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] CVE-2026-46044
by Cai Xinchen 30 May '26

30 May '26

CVE-2026-46044 Corey Minyard (2): ipmi:ssif: Clean up kthread on errors ipmi:ssif: NULL thread on error drivers/char/ipmi/ipmi_ssif.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] eventfs: Hold eventfs_mutex and SRCU when remount walks events
by Tengda Wu 30 May '26

30 May '26

From: David Carlier <devnexen(a)gmail.com> stable inclusion from stable-v6.6.140 commit ae9cd0b46b1890040006a2fc5e905c5d6053fd02 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 07004a8c4b572171934390148ee48c4175c77eed upstream. Commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") had eventfs_set_attrs() recurse through ei->children on remount. The walk only holds the rcu_read_lock() taken by tracefs_apply_options() over tracefs_inodes, which is wrong: - list_for_each_entry over ei->children races with the list_del_rcu() in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as d2603279c7d6. - eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...). rcu_read_lock() does not extend an SRCU grace period, so ti->private can be reclaimed under the walk. - The writes to ei->attr race with eventfs_set_attr(), which holds eventfs_mutex. Reproducer: while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done & while :; do echo "p:kp submit_bio" > /sys/kernel/tracing/kprobe_events echo > /sys/kernel/tracing/kprobe_events done Wrap the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() that take eventfs_mutex and srcu_read_lock(&eventfs_srcu). eventfs_set_attrs() doesn't sleep so the nested rcu_read_lock() is fine; lockdep_assert_held() pins the contract. Comment in tracefs_drop_inode() said "RCU cycle" -- it is SRCU. Fixes: 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260418191737.10289-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/tracefs/event_inode.c | 14 ++++++++++++++ fs/tracefs/inode.c | 5 ++++- fs/tracefs/internal.h | 3 +++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 4190e6155044..f98315e91e99 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -310,6 +310,8 @@ static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t { struct eventfs_inode *ei_child; + lockdep_assert_held(&eventfs_mutex); + /* Update events/<system>/<event> */ if (WARN_ON_ONCE(level > 3)) return; @@ -985,3 +987,15 @@ void eventfs_remove_events_dir(struct eventfs_inode *ei) d_invalidate(dentry); dput(dentry); } + +int eventfs_remount_lock(void) +{ + mutex_lock(&eventfs_mutex); + return srcu_read_lock(&eventfs_srcu); +} + +void eventfs_remount_unlock(int srcu_idx) +{ + srcu_read_unlock(&eventfs_srcu, srcu_idx); + mutex_unlock(&eventfs_mutex); +} diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 6b70965063d7..6c7b48770948 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -362,6 +362,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) struct tracefs_mount_opts *opts = &fsi->mount_opts; struct tracefs_inode *ti; bool update_uid, update_gid; + int srcu_idx; umode_t tmp_mode; /* @@ -386,6 +387,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) update_uid = opts->opts & BIT(Opt_uid); update_gid = opts->opts & BIT(Opt_gid); + srcu_idx = eventfs_remount_lock(); rcu_read_lock(); list_for_each_entry_rcu(ti, &tracefs_inodes, list) { if (update_uid) @@ -398,6 +400,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) eventfs_remount(ti, update_uid, update_gid); } rcu_read_unlock(); + eventfs_remount_unlock(srcu_idx); } return 0; @@ -444,7 +447,7 @@ static int tracefs_drop_inode(struct inode *inode) * This inode is being freed and cannot be used for * eventfs. Clear the flag so that it doesn't call into * eventfs during the remount flag updates. The eventfs_inode - * gets freed after an RCU cycle, so the content will still + * gets freed after an SRCU cycle, so the content will still * be safe if the iteration is going on now. */ ti->flags &= ~TRACEFS_EVENT_INODE; diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index d83c2a25f288..a4a7f8431aff 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -76,4 +76,7 @@ struct inode *tracefs_get_inode(struct super_block *sb); void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid); void eventfs_d_release(struct dentry *dentry); +int eventfs_remount_lock(void); +void eventfs_remount_unlock(int srcu_idx); + #endif /* _TRACEFS_INTERNAL_H */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 30 +++++++++++++++-------- 4 files changed, 36 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 4e3fff9f929b..7e12d5b27249 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -81,4 +81,9 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index c11822a7d2bf..c8b4c0c15767 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -238,6 +238,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 27b84231db10..a8dcb4e44d5f 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -105,6 +106,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -162,6 +165,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; @@ -414,6 +419,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -467,8 +474,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 331839218a1c..203a5d059b20 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3056,31 +3056,37 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + err = -ENOMEM; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (skb2 == NULL) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - err = -ENOMEM; - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (skb2 == NULL) { - nf_ct_expect_put(exp); - goto out; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) goto free; @@ -3135,22 +3141,26 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); -- 2.43.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] APEI/GHES: ensure that won't go past CPER allocated record
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v6.6.128 commit e0ec99115e135dbb58e11a0df007c7d4771d4a17 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). Yet, the allocation is done with the actual number of pages from the CPER bios table location, which can be smaller. Yet, a bad firmware could send data with a different size, which might be bigger than the allocated memory, causing an OOPS: Unable to handle kernel paging request at virtual address fff00000f9b40000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 Workqueue: kacpi_notify acpi_os_execute_deferred pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : hex_dump_to_buffer+0x30c/0x4a0 lr : hex_dump_to_buffer+0x328/0x4a0 sp : ffff800080e13880 x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 Call trace: hex_dump_to_buffer+0x30c/0x4a0 (P) print_hex_dump+0xac/0x170 cper_estatus_print_section+0x90c/0x968 cper_estatus_print+0xf0/0x158 __ghes_print_estatus+0xa0/0x148 ghes_proc+0x1bc/0x220 ghes_notify_hed+0x5c/0xb8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x80 acpi_hed_notify+0x28/0x40 acpi_ev_notify_dispatch+0x50/0x80 acpi_os_execute_deferred+0x24/0x48 process_one_work+0x15c/0x3b0 worker_thread+0x2d0/0x400 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) ---[ end trace 0000000000000000 ]--- Prevent that by taking the actual allocated are into account when checking for CPER length. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 6 +++++- include/acpi/ghes.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..bdaf28b5ebcc 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -27,6 +27,7 @@ #include <linux/timer.h> #include <linux/cper.h> #include <linux/platform_device.h> +#include <linux/minmax.h> #include <linux/mutex.h> #include <linux/ratelimit.h> #include <linux/vmalloc.h> @@ -290,6 +291,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) error_block_length = GHES_ESTATUS_MAX_SIZE; } ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); + ghes->estatus_length = error_block_length; if (!ghes->estatus) { rc = -ENOMEM; goto err_unmap_status_addr; @@ -361,13 +363,15 @@ static int __ghes_check_estatus(struct ghes *ghes, struct acpi_hest_generic_status *estatus) { u32 len = cper_estatus_len(estatus); + u32 max_len = min(ghes->generic->error_block_length, + ghes->estatus_length); if (len < sizeof(*estatus)) { pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); return -EIO; } - if (len > ghes->generic->error_block_length) { + if (!len || len > max_len) { pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); return -EIO; } diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index 73a4e64c8900..b4bf8e7e94f7 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -21,6 +21,7 @@ struct ghes { struct acpi_hest_generic_v2 *generic_v2; }; struct acpi_hest_generic_status *estatus; + unsigned int estatus_length; unsigned long flags; union { struct list_head list; -- 2.34.1

2 3

[PATCH OLK-6.6] x86/kexec: add a sanity check on previous kernel's ima kexec buffer
by Liu Mingrui 30 May '26

30 May '26

From: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> stable inclusion from stable-v6.6.128 commit 22e460b6333a5f818b042ac89201f8e735556f4a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5489d04337b47e93c0623e8145fcba3f5739efd ] When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that contains the carried over IMA measurement list may fall outside the truncated RAM leading to a kernel panic. BUG: unable to handle page fault for address: ffff97793ff47000 RIP: ima_restore_measurement_list+0xdc/0x45a #PF: error_code(0x0000) – not-present page Other architectures already validate the range with page_is_ram(), as done in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") do a similar check on x86. Without carrying the measurement list across kexec, the attestation would fail. Link: https://lkml.kernel.org/r/20251231061609.907170-4-harshit.m.mogalapalli@ora… Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec") Reported-by: Paul Webb <paul.x.webb(a)oracle.com> Reviewed-by: Mimi Zohar <zohar(a)linux.ibm.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Ard Biesheuvel <ardb(a)kernel.org> Cc: Baoquan He <bhe(a)redhat.com> Cc: Borislav Betkov <bp(a)alien8.de> Cc: guoweikang <guoweikang.kernel(a)gmail.com> Cc: Henry Willard <henry.willard(a)oracle.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jiri Bohac <jbohac(a)suse.cz> Cc: Joel Granados <joel.granados(a)kernel.org> Cc: Jonathan McDowell <noodles(a)fb.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Sohil Mehta <sohil.mehta(a)intel.com> Cc: Sourabh Jain <sourabhjain(a)linux.ibm.com> Cc: Thomas Gleinxer <tglx(a)linutronix.de> Cc: Yifei Liu <yifei.l.liu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/x86/kernel/setup.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index 3adc91b1b376..42e8a5d4770c 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -371,9 +371,15 @@ int __init ima_free_kexec_buffer(void) int __init ima_get_kexec_buffer(void **addr, size_t *size) { + int ret; + if (!ima_kexec_buffer_size) return -ENOENT; + ret = ima_validate_range(ima_kexec_buffer_phys, ima_kexec_buffer_size); + if (ret) + return ret; + *addr = __va(ima_kexec_buffer_phys); *size = ima_kexec_buffer_size; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-46044
by Cai Xinchen 30 May '26

30 May '26

ipmi:ssif: Clean up kthread on errors is original patch ipmi:ssif: NULL thread on error is new bugfix. Corey Minyard (2): ipmi:ssif: Clean up kthread on errors ipmi:ssif: NULL thread on error drivers/char/ipmi/ipmi_ssif.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
by Chen Jinghuang 30 May '26

30 May '26

From: Siwei Zhang <oss(a)fourdim.xyz> stable inclusion from stable-v6.6.140 commit 5105f3e6b2df619c635b5f6a49fac131a36c7952 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15079 CVE: CVE-2026-45834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2ff1a41a912de8517b4482e946dd951b7d80edbf upstream. Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 89bc500e41fc ("Bluetooth: Add state tracking to struct l2cap_chan") Cc: stable(a)kernel.org Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 7c87741a3d9e..2fcac3e28c7a 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1617,6 +1617,9 @@ static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, { struct sock *sk = chan->data; + if (!sk) + return; + sk->sk_state = state; if (err) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 154 insertions(+), 25 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43456 in the OLK-5.10 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() Introduces bond_header_ops wrapper functions to prevent type confusion when non-Ethernet devices are enslaved to a bond. * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() Adds dev parameter to header_ops->parse() to prevent infinite recursion when bonding devices are stacked. Also updates two wireless drivers (hostap and airo) that were missed in the original mainline patch. Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 +- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++- drivers/net/wireless/cisco/airo.c | 4 +- .../wireless/intersil/hostap/hostap_main.c | 1 + include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++- net/ethernet/eth.c | 9 ++-- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 +- net/phonet/af_phonet.c | 5 +- 11 files changed, 75 insertions(+), 17 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43456 in the OLK-6.6 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() (Main CVE fix - prevents kernel crash when non-Ethernet device is enslaved to a bond) * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() (Newbugfix - adds dev parameter to header_ops->parse to prevent infinite loop when bonding devices are stacked) Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 ++-- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++++++++++++++++- include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++-- net/ethernet/eth.c | 9 ++---- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 ++- net/phonet/af_phonet.c | 5 +++- 9 files changed, 71 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (1): usb: gadget: f_ncm: Fix net_device lifecycle with device_move Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 22 ++++++ drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 150 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 93cdceddc94c..2de1176f0952 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -987,6 +987,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1448,8 +1449,10 @@ thermal_zone_device_register(const char *type, int trips, int mask, /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1578,8 +1581,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_simple_remove(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH OLK-6.6] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 2476774af738..677db876a229 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -805,6 +805,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); mutex_destroy(&tz->lock); complete(&tz->removal); } else if (!strncmp(dev_name(dev), "cooling_device", @@ -1326,8 +1327,10 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1478,8 +1481,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_free(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

1 0

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 30 May '26

30 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

1 0

[PATCH OLK-5.10] xfrm: always flush state and policy upon NETDEV_UNREGISTER event
by superdcc97＠163.com 29 May '26

29 May '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v7.0-rc2 commit 4efa91a28576054aae0e6dad9cba8fed8293aef8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14713 CVE: CVE-2026-43167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 ref_tracker: netdev@ffff888052f24618 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_tracker_alloc include/linux/netdevice.h:4412 [inline] xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316 xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline] xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022 xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550 xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646 __sys_sendmsg+0x16d/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrm_dev_unregister() as no-op despite xfrm_dev_state_add() from xfrm_state_construct() acquires a reference to "struct net_device". I guess that that commit expected that NETDEV_DOWN event is fired before NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add() is called only if (dev->features & NETIF_F_HW_ESP) != 0. Sabrina Dubroca identified steps to reproduce the same symptoms as below. echo 0 > /sys/bus/netdevsim/new_device dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/del_device Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after xfrm_dev_state_add() acquired a reference to "struct net_device". Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit when acquiring a reference to "struct net_device". Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device") re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that commit for unknown reason chose to share xfrm_dev_down() between the NETDEV_DOWN event and the NETDEV_UNREGISTER event. I guess that that commit missed the behavior in the previous paragraph. Therefore, we need to re-introduce xfrm_dev_unregister() in order to release the reference to "struct net_device" by unconditionally flushing state and policy. Reported-by: syzbot+881d65229ca4f9ae8c84(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Cc: Sabrina Dubroca <sd(a)queasysnail.net> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_device.c [OLK-5.10: xfrm_dev_policy_flush() does not exist because xfrm policy offload was added in later kernels. Only call xfrm_dev_state_flush() in xfrm_dev_unregister().] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_device.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c index 8b8e957a69c3..0e7424b8a5fa 100644 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -414,6 +414,13 @@ static int xfrm_dev_down(struct net_device *dev) return NOTIFY_DONE; } +static int xfrm_dev_unregister(struct net_device *dev) +{ + xfrm_dev_state_flush(dev_net(dev), dev, true); + + return NOTIFY_DONE; +} + static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); @@ -426,8 +433,10 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void return xfrm_dev_feat_change(dev); case NETDEV_DOWN: - case NETDEV_UNREGISTER: return xfrm_dev_down(dev); + + case NETDEV_UNREGISTER: + return xfrm_dev_unregister(dev); } return NOTIFY_DONE; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9294 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45943
by Hongbo Li 29 May '26

29 May '26

Fix CVE-2026-45943. Gao Xiang (1): erofs: fix inline data read failure for ztailpacking pclusters fs/erofs/zdata.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 29 May '26

29 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 0886b19d2e1c..c9f52cd1cfb2 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

1 0

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 29 May '26

29 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affinity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 2

[PATCH OLK-6.6 0/6] mainline for bpf
by Pu Lehui 29 May '26

29 May '26

Alexei Starovoitov (1): bpf: Fix variable length stack write over spilled pointers Amery Hung (5): bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage bpf: Convert bpf_selem_unlink_map to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink to failable bpf: Do not allow deleting local storage in NMI include/linux/bpf_local_storage.h | 7 +- kernel/bpf/bpf_cgrp_storage.c | 3 +- kernel/bpf/bpf_inode_storage.c | 4 +- kernel/bpf/bpf_local_storage.c | 149 +++++++++++++++++------------- kernel/bpf/bpf_task_storage.c | 4 +- kernel/bpf/verifier.c | 28 ++++-- net/core/bpf_sk_storage.c | 13 ++- 7 files changed, 122 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index 3e137d8c9d2f..215f2a7d8458 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -744,10 +744,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -796,11 +797,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-5.10] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit a7db57ccca21f5801609065473c89a38229ecb92 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index b1fcd2ad5ecf..cae497418dc9 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -743,10 +743,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -795,11 +796,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH] xfrm: Fix dev use-after-free in xfrm async resumption
by Dong Chenchen 28 May '26

28 May '26

xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev. Stash original skb->dev to fix it. Fixes: 1c428b038400 ("xfrm: hold dev ref until after transport_finish NF_HOOK") Reported-by: Xu Chunxiao <xuchunxiao3(a)huawei.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_input.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index f65291eba1f6..810600d4614a 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -467,6 +467,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) { const struct xfrm_state_afinfo *afinfo; struct net *net = dev_net(skb->dev); + struct net_device *dev = skb->dev; int err; __be32 seq; __be32 seq_hi; @@ -493,7 +494,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) LINUX_MIB_XFRMINSTATEINVALID); if (encap_type == -1) - dev_put(skb->dev); + dev_put(dev); goto drop; } @@ -655,16 +656,16 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (!crypto_done) { spin_unlock(&x->lock); - dev_hold(skb->dev); + dev_hold(dev); nexthdr = x->type->input(x, skb); if (nexthdr == -EINPROGRESS) { if (async) - dev_put(skb->dev); + dev_put(dev); return 0; } - dev_put(skb->dev); + dev_put(dev); spin_lock(&x->lock); } resume: @@ -699,7 +700,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) err = xfrm_inner_mode_input(x, skb); if (err == -EINPROGRESS) { if (async) - dev_put(skb->dev); + dev_put(dev); return 0; } else if (err) { XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR); @@ -739,7 +740,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (skb_valid_dst(skb)) skb_dst_drop(skb); if (async) - dev_put(skb->dev); + dev_put(dev); gro_cells_receive(&gro_cells, skb); return 0; } else { @@ -760,7 +761,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (skb_valid_dst(skb)) skb_dst_drop(skb); if (async) - dev_put(skb->dev); + dev_put(dev); gro_cells_receive(&gro_cells, skb); return err; } @@ -772,7 +773,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) spin_unlock(&x->lock); drop: if (async) - dev_put(skb->dev); + dev_put(dev); xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1); kfree_skb(skb); return 0; -- 2.25.1

1 0

[PATCH OLK-5.10] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v5.10.252 commit 2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index cf2c3c4c590f..e5e20ea850aa 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -241,7 +241,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, return sch; err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-5.10] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v5.10.252 commit 2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index cf2c3c4c590f..e5e20ea850aa 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -241,7 +241,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, return sch; err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix CVE-2026-45961
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45961. Deepanshu Kartikey (1): gfs2: fix memory leaks in gfs2_fill_super error path fs/gfs2/ops_fstype.c | 2 +- fs/gfs2/super.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14886 CVE: CVE-2026-43328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45999
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45999. Junrui Luo (1): erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() fs/erofs/decompressor.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] backport soc cache patches from linux mainline
by Yushan Wang 28 May '26

28 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9262 ---------------------------------------------------------------------- Yushan Wang (1): soc cache: Fix unsafe shift left .../soc/hisilicon/hisi_soc_cache_framework.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] Bluetooth: SCO: fix race conditions in sco_sock_connect()
by Liu Kai 28 May '26

28 May '26

From: Cen Zhang <zzzccc427(a)gmail.com> stable inclusion from stable-v6.6.134 commit adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14555 CVE: CVE-2026-43023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b ] sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket can both pass the check and enter sco_connect(), leading to use-after-free. The buggy scenario involves three participants and was confirmed with additional logging instrumentation: Thread A (connect): HCI disconnect: Thread B (connect): sco_sock_connect(sk) sco_sock_connect(sk) sk_state==BT_OPEN sk_state==BT_OPEN (pass, no lock) (pass, no lock) sco_connect(sk): sco_connect(sk): hci_dev_lock hci_dev_lock hci_connect_sco <- blocked -> hcon1 sco_conn_add->conn1 lock_sock(sk) sco_chan_add: conn1->sk = sk sk->conn = conn1 sk_state=BT_CONNECT release_sock hci_dev_unlock hci_dev_lock sco_conn_del: lock_sock(sk) sco_chan_del: sk->conn=NULL conn1->sk=NULL sk_state= BT_CLOSED SOCK_ZAPPED release_sock hci_dev_unlock (unblocked) hci_connect_sco -> hcon2 sco_conn_add -> conn2 lock_sock(sk) sco_chan_add: sk->conn=conn2 sk_state= BT_CONNECT // zombie sk! release_sock hci_dev_unlock Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to BT_CONNECT. Subsequent cleanup triggers double sock_put() and use-after-free. Meanwhile conn1 is leaked as it was orphaned when sco_conn_del() cleared the association. Fix this by: - Moving lock_sock() before the sk_state/sk_type checks in sco_sock_connect() to serialize concurrent connect attempts - Fixing the sk_type != SOCK_SEQPACKET check to actually return the error instead of just assigning it - Adding a state re-check in sco_connect() after lock_sock() to catch state changes during the window between the locks - Adding sco_pi(sk)->conn check in sco_chan_add() to prevent double-attach of a socket to multiple connections - Adding hci_conn_drop() on sco_chan_add failure to prevent HCI connection leaks Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") Signed-off-by: Cen Zhang <zzzccc427(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/sco.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 56d8a2a26a7a..0ec5686489a1 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -298,7 +298,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, int err = 0; sco_conn_lock(conn); - if (conn->sk) + if (conn->sk || sco_pi(sk)->conn) err = -EBUSY; else __sco_chan_add(conn, sk, parent); @@ -352,9 +352,20 @@ static int sco_connect(struct sock *sk) lock_sock(sk); + /* Recheck state after reacquiring the socket lock, as another + * thread may have changed it (e.g., closed the socket). + */ + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { + release_sock(sk); + hci_conn_drop(hcon); + err = -EBADFD; + goto unlock; + } + err = sco_chan_add(conn, sk, NULL); if (err) { release_sock(sk); + hci_conn_drop(hcon); goto unlock; } @@ -652,13 +663,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH) return -EINVAL; - if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) + lock_sock(sk); + + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { + release_sock(sk); return -EBADFD; + } - if (sk->sk_type != SOCK_SEQPACKET) - err = -EINVAL; + if (sk->sk_type != SOCK_SEQPACKET) { + release_sock(sk); + return -EINVAL; + } - lock_sock(sk); /* Set destination address and psm */ bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); release_sock(sk); -- 2.34.1

2 1

[PATCH OLK-6.6 V3 0/6] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() Zizhi Wo (1): fs/mount: wrap overmount field with KABI_EXTEND fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 280 +++++++++++++++++++++++++++---------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 247 insertions(+), 71 deletions(-) -- 2.52.0

2 7

[PATCH OLK-6.6 0/1] Fix CVE-2026-46078
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-46078. Gao Xiang (1): erofs: fix the out-of-bounds nameoff handling for trailing dirents fs/erofs/dir.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43427
by Xinyu Zheng 28 May '26

28 May '26

Oliver Neukum (1): usb: class: cdc-wdm: fix reordering issue in read code path Robert Hodaszi (1): usb: cdc-wdm: avoid setting WDM_READ for ZLP-s drivers/usb/class/cdc-wdm.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 28 May '26

28 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 98d9bba6f4ac..37cb45b133ed 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -840,6 +840,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1230,8 +1231,10 @@ thermal_zone_device_register(const char *type, int trips, int mask, /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1353,8 +1356,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_simple_remove(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14332 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-43328
by Xinyu Zheng 28 May '26

28 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/14886 CVE: CVE-2026-43328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit 425a22c5373d4e1b46492ab869074ebeeade61f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index d9a378d12be6..4655534b6cc1 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1828,7 +1828,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1836,6 +1836,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14332 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-31759
by Liu Mingrui 28 May '26

28 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Sean Anderson (1): usb: ulpi: Call of_node_put correctly drivers/usb/common/ulpi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43427
by Xinyu Zheng 28 May '26

28 May '26

Oliver Neukum (1): usb: class: cdc-wdm: fix reordering issue in read code path Robert Hodaszi (1): usb: cdc-wdm: avoid setting WDM_READ for ZLP-s drivers/usb/class/cdc-wdm.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V2 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6

[openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-6.6] efi: Fix reservation of unaccepted memory table
by Jinjie Ruan 28 May '26

28 May '26

From: "Kiryl Shutsemau (Meta)" <kas(a)kernel.org> stable inclusion from stable-v6.6.128 commit b7bc182ec1846be437351e44164089d988f9d0dd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15103 CVE: CVE-2026-45851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0862438c90487e79822d5647f854977d50381505 ] The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned. If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in accept_memory(). This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB). Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation. Fixes: 8dbe33956d96 ("efi/unaccepted: Make sure unaccepted table is mapped") Reported-by: Moritz Sanft <ms(a)edgeless.systems> Signed-off-by: Kiryl Shutsemau (Meta) <kas(a)kernel.org> Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Acked-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/firmware/efi/efi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 30f6c4397b40..7e1f96c06d18 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -649,13 +649,13 @@ static __init int match_config_table(const efi_guid_t *guid, static __init void reserve_unaccepted(struct efi_unaccepted_memory *unaccepted) { - phys_addr_t start, size; + phys_addr_t start, end; start = PAGE_ALIGN_DOWN(efi.unaccepted); - size = PAGE_ALIGN(sizeof(*unaccepted) + unaccepted->size); + end = PAGE_ALIGN(efi.unaccepted + sizeof(*unaccepted) + unaccepted->size); - memblock_add(start, size); - memblock_reserve(start, size); + memblock_add(start, end - start); + memblock_reserve(start, end - start); } int __init efi_config_parse_tables(const efi_config_table_t *config_tables, -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Support open_tree OPEN_TREE_NAMESPACE Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit 425a22c5373d4e1b46492ab869074ebeeade61f3 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index d9a378d12be6..4655534b6cc1 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1828,7 +1828,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1836,6 +1836,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 28 May '26

28 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

2 35

[PATCH OLK-5.10] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 27 May '26

27 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_conntrack_core.h net/netfilter/nf_conntrack_ecache.c net/netfilter/nf_conntrack_expect.c net/netfilter/nf_conntrack_netlink.c [mainline commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 is not a 5.10 backport, which leads to conflicts due to code differences between mainline and 5.10. Adapted by adding lockdep_nfct_expect_lock_held() and adjusting spinlock sections to match 5.10 codebase.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 5805fe4947f3..ef9c0cac225b 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -83,6 +83,11 @@ void print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple, extern spinlock_t nf_conntrack_locks[CONNTRACK_LOCKS]; void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index 7956c9f19899..aa866d3e519a 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -247,10 +247,12 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, { struct net *net = nf_ct_exp_net(exp); struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) goto out_unlock; diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 45f29e28aba3..64b6f0657cce 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -48,10 +48,11 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, u32 portid, int report) { struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); hlist_del_rcu(&exp->hnode); net->ct.expect_count--; @@ -102,10 +103,12 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, nf_ct_zone_equal_any(i->master, zone); } bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); return true; } @@ -159,10 +162,12 @@ nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple, bool unlink) { struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; h = nf_ct_expect_dst_hash(net, tuple); hlist_for_each_entry(i, &nf_ct_expect_hash[h], hnode) { @@ -421,10 +426,12 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, struct net *net = nf_ct_exp_net(expect); struct hlist_node *next; unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; } h = nf_ct_expect_dst_hash(net, &expect->tuple); @@ -476,12 +483,13 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, if (ret < 0) goto out; nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); return ret; } diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 78329f4e171b..fd84f48715c7 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3308,34 +3308,40 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, return -EINVAL; if (err < 0) return err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!skb2) { - nf_ct_expect_put(exp); - return -ENOMEM; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) { kfree_skb(skb2); return -ENOMEM; } @@ -3378,26 +3384,30 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3, NULL); if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); nf_ct_expect_put(exp); } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2026-43158
by Long Li 27 May '26

27 May '26

Fix CVE-2026-43158. Darrick J. Wong (2): xfs: delete attr leaf freemap entries when empty xfs: fix freemap adjustments when adding xattrs to leaf blocks fs/xfs/libxfs/xfs_attr_leaf.c | 49 +++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 27 May '26

27 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_expect.c net/netfilter/nf_conntrack_netlink.c [commit bffcaad9afdfe is not backport, which lead to conflicts due to timer_delete() vs del_timer() API differences and lock placement changes in ctnetlink_del_expect()] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 3384859a8921..8883575adcc1 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + /* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout) diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index 69948e1d6974..6526bdcca580 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -237,6 +237,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_ct_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_conntrack_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index e0eb844c2cdc..c47f7eacf78a 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct net *net = nf_ct_exp_net(exp); struct nf_conntrack_net *cnet; + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!cnet->expect_count) return NULL; @@ -454,6 +459,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -510,8 +517,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 4522e9110352..67a0762915e3 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3337,31 +3337,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, if (err < 0) return err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!skb2) { - nf_ct_expect_put(exp); - return -ENOMEM; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) { kfree_skb(skb2); return -ENOMEM; @@ -3408,22 +3414,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(info->nlh)); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 27 May '26

27 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 2

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v6.6.128 commit bbfaa5761f589a81031b493cb01275a990d6fb25 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 4d1d04736222e..1c8508aa77e2e 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-5.10] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v5.10.252 commit b6117210ed349356f8e6027ff020b4d620bca42b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index dc867439f359f..02268f7d62e7a 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] netfilter: Fix CVE-2026-43025 - slab-out-of-bounds in nf_ct_expect_related_report
by superdcc97＠163.com 26 May '26

26 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43025 in the OLK-6.6 branch. The vulnerability allows reading kernel memory bytes off the expectation boundary when validating CTA_EXPECT_CLASS via a different helper than the existing master conntrack helper. * Patch 1: Store netns and zone in expectation (Stable-dep-of prerequisite) * Patch 2: Ignore explicit helper on new expectations (main CVE fix) * Patch 3: Restore helper propagation via expectation (newbugfix) Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation include/net/netfilter/nf_conntrack_expect.h | 23 +++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 74 insertions(+), 53 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/3] Fix hist_field_name issue
by Tengda Wu 26 May '26

26 May '26

This series is going to backport three patch from upstream to fix hist field name issue. David Carlier (1): tracing: Avoid NULL return from hist_field_name() on truncation Pengpeng Hou (1): tracing: Rebuild full_name on each hist_field_name() call Tom Zanussi (1): tracing: Fix fully-qualified variable reference printing in histograms kernel/trace/trace_events_hist.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] arm64/ACPI: fix build error when CONFIG_ACPI_APEI_GHES is disabled
by Wupeng Ma 26 May '26

26 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9116 ------------------------------------------ When CONFIG_ACPI_APEI_GHES=n, apei_claim_sei() is not defined. Commit cd342fd16526 ("ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS") placed its declaration and inline stub inside the CONFIG_ACPI block in arch/arm64/include/asm/acpi.h, but the function is implemented in ghes.c which depends on CONFIG_ACPI_APEI_GHES, not CONFIG_ACPI. This leads to a link failure: aarch64-linux-gnu-ld: arch/arm64/kernel/traps.o: in function `arm64_is_fatal_ras_serror': traps.c:(.text+0x1490): undefined reference to `apei_claim_sei' Fix it by moving the declaration and stub to include/acpi/ghes.h, where they are correctly guarded by CONFIG_ACPI_APEI_GHES, and add the necessary #include in traps.c. Fixes: cd342fd16526 ("ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/include/asm/acpi.h | 2 -- arch/arm64/kernel/traps.c | 1 + include/acpi/ghes.h | 3 +++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index 693dc4c7b8173..c07a58b96329d 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -134,11 +134,9 @@ static inline int get_cpu_for_acpi_id(u32 uid) static inline void arch_fix_phys_package_id(int num, u32 slot) { } void __init acpi_init_cpus(void); int apei_claim_sea(struct pt_regs *regs); -int apei_claim_sei(struct pt_regs *regs); #else static inline void acpi_init_cpus(void) { } static inline int apei_claim_sea(struct pt_regs *regs) { return -ENOENT; } -static inline int apei_claim_sei(struct pt_regs *regs) { return -ENOENT; } #endif /* CONFIG_ACPI */ #ifdef CONFIG_ARM64_ACPI_PARKING_PROTOCOL diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c index e8ef661715f00..6d5c4039b9219 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -31,6 +31,7 @@ #include <linux/ubsan.h> #include <linux/cfi.h> #include <linux/acpi.h> +#include <acpi/ghes.h> #include <asm/atomic.h> #include <asm/bug.h> diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index ebd21b05fe6ed..73a4e64c89002 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -72,10 +72,13 @@ void ghes_unregister_vendor_record_notifier(struct notifier_block *nb); struct list_head *ghes_get_devices(void); void ghes_estatus_pool_region_free(unsigned long addr, u32 size); +int apei_claim_sei(struct pt_regs *regs); #else static inline struct list_head *ghes_get_devices(void) { return NULL; } static inline void ghes_estatus_pool_region_free(unsigned long addr, u32 size) { return; } + +static inline int apei_claim_sei(struct pt_regs *regs) { return -ENOENT; } #endif int ghes_estatus_pool_init(unsigned int num_ghes); -- 2.43.0

2 1

[PATCH OLK-5.10] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
by Zhang Qilong 26 May '26

26 May '26

From: Jan Kiszka <jan.kiszka(a)siemens.com> stable inclusion from stable-v5.10.253 commit cf00cb15f2515e38d3b7571bf6800b7c6ce70a84 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15032 CVE: CVE-2026-43475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ] This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002 [ 415.140822] INFO: lockdep is turned off. [ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common [ 415.140846] Preemption disabled at: [ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)} [ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024 [ 415.140857] Call Trace: [ 415.140861] <TASK> [ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140863] dump_stack_lvl+0x91/0xb0 [ 415.140870] __schedule_bug+0x9c/0xc0 [ 415.140875] __schedule+0xdf6/0x1300 [ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980 [ 415.140879] ? rcu_is_watching+0x12/0x60 [ 415.140883] schedule_rtlock+0x21/0x40 [ 415.140885] rtlock_slowlock_locked+0x502/0x1980 [ 415.140891] rt_spin_lock+0x89/0x1e0 [ 415.140893] hv_ringbuffer_write+0x87/0x2a0 [ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0 [ 415.140900] ? rcu_is_watching+0x12/0x60 [ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc] [ 415.140904] ? HARDIRQ_verbose+0x10/0x10 [ 415.140908] ? __rq_qos_issue+0x28/0x40 [ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod] [ 415.140926] __blk_mq_issue_directly+0x4a/0xc0 [ 415.140928] blk_mq_issue_direct+0x87/0x2b0 [ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440 [ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0 [ 415.140935] __blk_flush_plug+0xf4/0x150 [ 415.140940] __submit_bio+0x2b2/0x5c0 [ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360 [ 415.140946] submit_bio_noacct_nocheck+0x272/0x360 [ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4] [ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4] [ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4] [ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4] [ 415.141060] generic_perform_write+0x14e/0x2c0 [ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4] [ 415.141083] vfs_write+0x2ca/0x570 [ 415.141087] ksys_write+0x76/0xf0 [ 415.141089] do_syscall_64+0x99/0x1490 [ 415.141093] ? rcu_is_watching+0x12/0x60 [ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0 [ 415.141097] ? rcu_is_watching+0x12/0x60 [ 415.141098] ? lock_release+0x1f0/0x2a0 [ 415.141100] ? rcu_is_watching+0x12/0x60 [ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0 [ 415.141103] ? rcu_is_watching+0x12/0x60 [ 415.141104] ? __schedule+0xb34/0x1300 [ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170 [ 415.141109] ? do_nanosleep+0x8b/0x160 [ 415.141111] ? hrtimer_nanosleep+0x89/0x100 [ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 415.141116] ? xfd_validate_state+0x26/0x90 [ 415.141118] ? rcu_is_watching+0x12/0x60 [ 415.141120] ? do_syscall_64+0x1e0/0x1490 [ 415.141121] ? do_syscall_64+0x1e0/0x1490 [ 415.141123] ? rcu_is_watching+0x12/0x60 [ 415.141124] ? do_syscall_64+0x1e0/0x1490 [ 415.141125] ? do_syscall_64+0x1e0/0x1490 [ 415.141127] ? irqentry_exit+0x140/0x7e0 [ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e get_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT. Signed-off-by: Jan Kiszka <jan.kiszka(a)siemens.com> Tested-by: Florian Bezdeka <florian.bezdeka(a)siemens.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Tested-by: Michael Kelley <mhklinux(a)outlook.com> Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 37ad5f525647..c8111d26feff 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1821,12 +1821,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload = payload; cmd_request->payload_sz = payload_sz; /* Invokes the vsc to start an IO */ - ret = storvsc_do_io(dev, cmd_request, get_cpu()); - put_cpu(); + migrate_disable(); + ret = storvsc_do_io(dev, cmd_request, smp_processor_id()); + migrate_enable(); if (ret == -EAGAIN) { if (payload_sz > sizeof(cmd_request->mpb)) kfree(payload); /* no more space */ -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
by Zhang Qilong 26 May '26

26 May '26

From: Jan Kiszka <jan.kiszka(a)siemens.com> stable inclusion from stable-v6.6.130 commit e7919a293f9b6101e38bde0d8613daea6c9955df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15032 CVE: CVE-2026-43475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ] This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002 [ 415.140822] INFO: lockdep is turned off. [ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common [ 415.140846] Preemption disabled at: [ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)} [ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024 [ 415.140857] Call Trace: [ 415.140861] <TASK> [ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140863] dump_stack_lvl+0x91/0xb0 [ 415.140870] __schedule_bug+0x9c/0xc0 [ 415.140875] __schedule+0xdf6/0x1300 [ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980 [ 415.140879] ? rcu_is_watching+0x12/0x60 [ 415.140883] schedule_rtlock+0x21/0x40 [ 415.140885] rtlock_slowlock_locked+0x502/0x1980 [ 415.140891] rt_spin_lock+0x89/0x1e0 [ 415.140893] hv_ringbuffer_write+0x87/0x2a0 [ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0 [ 415.140900] ? rcu_is_watching+0x12/0x60 [ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc] [ 415.140904] ? HARDIRQ_verbose+0x10/0x10 [ 415.140908] ? __rq_qos_issue+0x28/0x40 [ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod] [ 415.140926] __blk_mq_issue_directly+0x4a/0xc0 [ 415.140928] blk_mq_issue_direct+0x87/0x2b0 [ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440 [ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0 [ 415.140935] __blk_flush_plug+0xf4/0x150 [ 415.140940] __submit_bio+0x2b2/0x5c0 [ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360 [ 415.140946] submit_bio_noacct_nocheck+0x272/0x360 [ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4] [ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4] [ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4] [ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4] [ 415.141060] generic_perform_write+0x14e/0x2c0 [ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4] [ 415.141083] vfs_write+0x2ca/0x570 [ 415.141087] ksys_write+0x76/0xf0 [ 415.141089] do_syscall_64+0x99/0x1490 [ 415.141093] ? rcu_is_watching+0x12/0x60 [ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0 [ 415.141097] ? rcu_is_watching+0x12/0x60 [ 415.141098] ? lock_release+0x1f0/0x2a0 [ 415.141100] ? rcu_is_watching+0x12/0x60 [ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0 [ 415.141103] ? rcu_is_watching+0x12/0x60 [ 415.141104] ? __schedule+0xb34/0x1300 [ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170 [ 415.141109] ? do_nanosleep+0x8b/0x160 [ 415.141111] ? hrtimer_nanosleep+0x89/0x100 [ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 415.141116] ? xfd_validate_state+0x26/0x90 [ 415.141118] ? rcu_is_watching+0x12/0x60 [ 415.141120] ? do_syscall_64+0x1e0/0x1490 [ 415.141121] ? do_syscall_64+0x1e0/0x1490 [ 415.141123] ? rcu_is_watching+0x12/0x60 [ 415.141124] ? do_syscall_64+0x1e0/0x1490 [ 415.141125] ? do_syscall_64+0x1e0/0x1490 [ 415.141127] ? irqentry_exit+0x140/0x7e0 [ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e get_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT. Signed-off-by: Jan Kiszka <jan.kiszka(a)siemens.com> Tested-by: Florian Bezdeka <florian.bezdeka(a)siemens.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Tested-by: Michael Kelley <mhklinux(a)outlook.com> Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 9dcad02ce489..106bccaac427 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1859,12 +1859,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload = payload; cmd_request->payload_sz = payload_sz; /* Invokes the vsc to start an IO */ - ret = storvsc_do_io(dev, cmd_request, get_cpu()); - put_cpu(); + migrate_disable(); + ret = storvsc_do_io(dev, cmd_request, smp_processor_id()); + migrate_enable(); if (ret) scsi_dma_unmap(scmnd); if (ret == -EAGAIN) { -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: define and enforce CEPH_MAX_KEY_LEN
by Zhang Qilong 26 May '26

26 May '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.128 commit e1dc45d97975f9db65694d234fbddf1915176e16 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14861 CVE: CVE-2026-43304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway. Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/crypto.c | 8 +++++--- net/ceph/crypto.h | 2 +- net/ceph/messenger_v2.c | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c index 051d22c0e4ad..3397d105f74f 100644 --- a/net/ceph/crypto.c +++ b/net/ceph/crypto.c @@ -35,13 +35,10 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) break; default: return -ENOTSUPP; } - if (!key->len) - return -EINVAL; - key->key = kmemdup(buf, key->len, GFP_NOIO); if (!key->key) { ret = -ENOMEM; goto fail; } @@ -93,10 +90,15 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) ceph_decode_need(p, end, 2*sizeof(u16) + sizeof(key->created), bad); key->type = ceph_decode_16(p); ceph_decode_copy(p, &key->created, sizeof(key->created)); key->len = ceph_decode_16(p); ceph_decode_need(p, end, key->len, bad); + if (key->len > CEPH_MAX_KEY_LEN) { + pr_err("secret too big %d\n", key->len); + return -EINVAL; + } + ret = set_secret(key, *p); memzero_explicit(*p, key->len); *p += key->len; return ret; diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h index 13bd526349fa..0d32f1649f3d 100644 --- a/net/ceph/crypto.h +++ b/net/ceph/crypto.h @@ -3,11 +3,11 @@ #define _FS_CEPH_CRYPTO_H #include <linux/ceph/types.h> #include <linux/ceph/buffer.h> -#define CEPH_KEY_LEN 16 +#define CEPH_MAX_KEY_LEN 16 #define CEPH_MAX_CON_SECRET_LEN 64 /* * cryptographic secret */ diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c index 858198724439..f82029bd33db 100644 --- a/net/ceph/messenger_v2.c +++ b/net/ceph/messenger_v2.c @@ -2391,11 +2391,11 @@ static int process_auth_reply_more(struct ceph_connection *con, * setup_crypto(). __aligned(16) isn't guaranteed to work for stack * objects, so do it by hand. */ static int process_auth_done(struct ceph_connection *con, void *p, void *end) { - u8 session_key_buf[CEPH_KEY_LEN + 16]; + u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); int session_key_len, con_secret_len; int payload_len; -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: leapraid: update driver to v2.0.1.2
by haodongdong 26 May '26

26 May '26

From: Dongdong Hao <doubled(a)leap-io-kernel.com> LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9235 ------------------------------------------ leapraid driver changes from v2.0.0.6 to v2.0.1.2. This update includes: - overheat handling rework - reset flow stabilization - improved timeout diagnostics - sysfs enhancement - topology and transport error-path fixes - memory leak/UAF/reference leak fixes - mmap/ioctl validation fixes - improved queue depth handling - improved interrupt and resource cleanup logic The update also fixes several race conditions and improves overall driver robustness under reset, topology change, and controller abnormal scenarios. Signed-off-by: Dongdong Hao <doubled(a)leap-io-kernel.com> --- drivers/scsi/leapraid/Kconfig | 2 +- drivers/scsi/leapraid/leapraid.h | 1335 +++--- drivers/scsi/leapraid/leapraid_app.c | 529 +-- drivers/scsi/leapraid/leapraid_func.c | 4229 ++++++++++++-------- drivers/scsi/leapraid/leapraid_func.h | 1086 ++--- drivers/scsi/leapraid/leapraid_os.c | 910 +++-- drivers/scsi/leapraid/leapraid_transport.c | 485 ++- 7 files changed, 4863 insertions(+), 3713 deletions(-) diff --git a/drivers/scsi/leapraid/Kconfig b/drivers/scsi/leapraid/Kconfig index b539183b24a7..f4ece78f80d3 100644 --- a/drivers/scsi/leapraid/Kconfig +++ b/drivers/scsi/leapraid/Kconfig @@ -5,7 +5,7 @@ config SCSI_LEAPRAID depends on PCI && SCSI select SCSI_SAS_ATTRS help - This driver supports LeapIO PCIe-based Storage + This driver supports LeapIO PCIe-based storage and RAID controllers. <http://www.leap-io.com> diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 77bb93b79254..2a99417143ad 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -1,13 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ #ifndef LEAPRAID_H #define LEAPRAID_H -/* doorbell register definitions */ +/* Doorbell register definitions. */ #define LEAPRAID_DB_RESET 0x00000000 #define LEAPRAID_DB_READY 0x10000000 #define LEAPRAID_DB_OPERATIONAL 0x20000000 @@ -22,55 +22,60 @@ #define LEAPRAID_DB_FUNC_SHIFT 24 #define LEAPRAID_DB_ADD_DWORDS_SHIFT 16 -/* maximum number of retries waiting for doorbell to become ready */ +/* Maximum number of retries waiting for doorbell to become ready. */ #define LEAPRAID_DB_RETRY_COUNT_MAX 10 -/* maximum number of retries waiting for doorbell to become operational */ -#define LEAPRAID_DB_WAIT_OPERATIONAL 10 -/* sleep interval (in seconds) between doorbell polls */ +/* Maximum number of retries waiting for doorbell to become operational. */ +#define LEAPRAID_DB_WAIT_OP_SHORT 10 +#define LEAPRAID_DB_WAIT_OP_LONG 200 +/* Sleep interval (in seconds) between doorbell polls. */ #define LEAPRAID_DB_POLL_INTERVAL_S 1 -/* maximum number of retries waiting for host to end recovery */ -#define LEAPRAID_WAIT_SHOST_RECOVERY 30 +/* Maximum number of retries waiting for host to end recovery. */ +#define LEAPRAID_WAIT_SHOST_RECOVERY 400 -/* diagnostic register definitions */ +/* Diagnostic register definitions. */ #define LEAPRAID_DIAG_WRITE_ENABLE 0x00000080 #define LEAPRAID_DIAG_RESET 0x00000004 -#define LEAPRAID_DIAG_HOLD_ADAPTER_RESET 0x00000002 -/* interrupt status register definitions */ +/* Interrupt status register definitions. */ #define LEAPRAID_HOST2ADAPTER_DB_STATUS 0x80000000 #define LEAPRAID_ADAPTER2HOST_DB_STATUS 0x00000001 -/* the number of debug register */ +/* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 +#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 -/* reply post host register defines */ +/* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 #define LEAPRAID_RPHI_MSIX_IDX_SHIFT 24 -/* vphy flags */ +/* Virtual PHY flags. */ #define LEAPRAID_SAS_PHYINFO_VPHY 0x00001000 -/* linux driver init fw */ +/* Linux driver init firmware. */ #define LEAPRAID_WHOINIT_LINUX_DRIVER 0x04 -/* rdpq array mode */ +/* Reply descriptor post queue array mode. */ #define LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE 0x01 -/* request description flags */ +/* Request description flags. */ #define LEAPRAID_REQ_DESC_FLG_SCSI_IO 0x00 #define LEAPRAID_REQ_DESC_FLG_HPR 0x06 #define LEAPRAID_REQ_DESC_FLG_DFLT_TYPE 0x08 -/* reply description flags */ +/* Reply description flags. */ #define LEAPRAID_RPY_DESC_FLG_TYPE_MASK 0x0F #define LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS 0x00 #define LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY 0x01 #define LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS 0x06 #define LEAPRAID_RPY_DESC_FLG_UNUSED 0x0F -/* MPI functions */ -#define LEAPRAID_FUNC_SCSIIO_REQ 0x00 +/* Request and reply messages share the same set of function codes. + * + * Note: SCSIIO (SCSI I/O) represents SCSI I/O operations and is used + * consistently throughout the driver for all SCSI command handling. + */ +#define LEAPRAID_FUNC_SCSIIO 0x00 #define LEAPRAID_FUNC_SCSI_TMF 0x01 #define LEAPRAID_FUNC_ADAPTER_INIT 0x02 #define LEAPRAID_FUNC_GET_ADAPTER_FEATURES 0x03 @@ -79,17 +84,16 @@ #define LEAPRAID_FUNC_EVENT_NOTIFY 0x07 #define LEAPRAID_FUNC_FW_DOWNLOAD 0x09 #define LEAPRAID_FUNC_FW_UPLOAD 0x12 -#define LEAPRAID_FUNC_RAID_ACTION 0x15 -#define LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH 0x16 +#define LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH 0x16 #define LEAPRAID_FUNC_SCSI_ENC_PROCESSOR 0x18 #define LEAPRAID_FUNC_SMP_PASSTHROUGH 0x1A #define LEAPRAID_FUNC_SAS_IO_UNIT_CTRL 0x1B -#define LEAPRAID_FUNC_SATA_PASSTHROUGH 0x1C +#define LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH 0x1C #define LEAPRAID_FUNC_ADAPTER_UNIT_RESET 0x40 #define LEAPRAID_FUNC_HANDSHAKE 0x42 #define LEAPRAID_FUNC_LOGBUF_INIT 0x57 -/* adapter status values */ +/* Adapter status values. */ #define LEAPRAID_ADAPTER_STATUS_MASK 0x7FFF #define LEAPRAID_ADAPTER_STATUS_SUCCESS 0x0000 #define LEAPRAID_ADAPTER_STATUS_BUSY 0x0002 @@ -113,7 +117,7 @@ #define LEAPRAID_ADAPTER_STATUS_SCSI_ADAPTER_TERMINATED 0x004B #define LEAPRAID_ADAPTER_STATUS_SCSI_EXT_TERMINATED 0x004C -/* sge flags */ +/* SGE flags. */ #define LEAPRAID_SGE_FLG_LAST_ONE 0x80 #define LEAPRAID_SGE_FLG_EOB 0x40 #define LEAPRAID_SGE_FLG_EOL 0x01 @@ -129,15 +133,19 @@ #define LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE 0x80 #define LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR 0x00 -#define LEAPRAID_SGE_OFFSET_SIZE 4 +#define LEAPRAID_SGE_NO_DATA_ADDR -1 +#define LEAPRAID_SGE_OFFSET_SIZE 4 -/* page and ext page type */ +/* The type of page. */ #define LEAPRAID_CFG_PT_IO_UNIT 0x00 #define LEAPRAID_CFG_PT_ADAPTER 0x01 #define LEAPRAID_CFG_PT_BIOS 0x02 #define LEAPRAID_CFG_PT_RAID_VOLUME 0x08 +#define LEAPRAID_CFG_PT_MANUFACTURING 0x09 #define LEAPRAID_CFG_PT_RAID_PHYSDISK 0x0A #define LEAPRAID_CFG_PT_EXTENDED 0x0F + +/* The type of extended page. */ #define LEAPRAID_CFG_EXTPT_SAS_IO_UNIT 0x10 #define LEAPRAID_CFG_EXTPT_SAS_EXP 0x11 #define LEAPRAID_CFG_EXTPT_SAS_DEV 0x12 @@ -145,7 +153,7 @@ #define LEAPRAID_CFG_EXTPT_ENC 0x15 #define LEAPRAID_CFG_EXTPT_RAID_CONFIG 0x16 -/* config page address */ +/* Config page address. */ #define LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP 0x00000000 #define LEAPRAID_SAS_ENC_CFG_PGAD_HDL 0x10000000 #define LEAPRAID_SAS_DEV_CFG_PGAD_HDL 0x20000000 @@ -156,51 +164,55 @@ #define LEAPRAID_SAS_PHY_CFG_PGAD_PHY_NUMBER 0x00000000 #define LEAPRAID_PHYSDISK_CFG_PGAD_PHYSDISKNUM 0x10000000 -/* config page operations */ +/* Config page operations. */ #define LEAPRAID_CFG_ACT_PAGE_HEADER 0x00 #define LEAPRAID_CFG_ACT_PAGE_READ_CUR 0x01 #define LEAPRAID_CFG_ACT_PAGE_WRITE_CUR 0x02 -/* bios pages */ +/* BIOS page number. */ #define LEAPRAID_CFG_PAGE_NUM_BIOS2 0x2 #define LEAPRAID_CFG_PAGE_NUM_BIOS3 0x3 -/* sas device pages */ +/* Manufacturing page number. */ +#define LEAPRAID_CFG_PAGE_NUM_MANU0 0x0 + +/* SAS device page number. */ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 -/* sas device page 0 flags */ +/* SAS device page 0 flags. */ #define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 +#define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 -/* sas IO unit pages */ +/* SAS I/O unit page number. */ #define LEAPRAID_CFG_PAGE_NUM_IOUNIT0 0x0 #define LEAPRAID_CFG_PAGE_NUM_IOUNIT1 0x1 -/* sas expander pages */ +/* SAS expander page number. */ #define LEAPRAID_CFG_PAGE_NUM_EXP0 0x0 #define LEAPRAID_CFG_PAGE_NUM_EXP1 0x1 -/* sas enclosure page */ +/* SAS enclosure page number. */ #define LEAPRAID_CFG_PAGE_NUM_ENC0 0x0 -/* sas phy page */ +/* SAS PHY page number. */ #define LEAPRAID_CFG_PAGE_NUM_PHY0 0x0 -/* raid volume pages */ +/* RAID volume page number. */ #define LEAPRAID_CFG_PAGE_NUM_VOL0 0x0 #define LEAPRAID_CFG_PAGE_NUM_VOL1 0x1 -/* physical disk page */ +/* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* adapter page */ +/* Adapter page number. */ #define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 #define LEAPRAID_CFG_UNIT_SIZE 4 -/* raid volume type and state */ +/* Raid volume type and state. */ #define LEAPRAID_VOL_STATE_MISSING 0x00 #define LEAPRAID_VOL_STATE_FAILED 0x01 #define LEAPRAID_VOL_STATE_INITIALIZING 0x02 @@ -213,17 +225,17 @@ #define LEAPRAID_VOL_TYPE_RAID10 0x05 #define LEAPRAID_VOL_TYPE_UNKNOWN 0xFF -/* raid volume element flags */ +/* Raid volume element flags. */ #define LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE 0x000F #define LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT 0x0001 #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* raid action */ +/* Raid action. */ #define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 #define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 -/* sas negotiated link rates */ +/* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 #define LEAPRAID_SAS_NEG_LINK_RATE_PHY_DISABLED 0x01 @@ -231,6 +243,7 @@ #define LEAPRAID_SAS_NEG_LINK_RATE_SATA_OOB_COMPLETE 0x03 #define LEAPRAID_SAS_NEG_LINK_RATE_PORT_SELECTOR 0x04 #define LEAPRAID_SAS_NEG_LINK_RATE_SMP_RESETTING 0x05 +#define LEAPRAID_SAS_NEG_LINK_RATE_SHIFT 4 #define LEAPRAID_SAS_NEG_LINK_RATE_1_5 0x08 #define LEAPRAID_SAS_NEG_LINK_RATE_3_0 0x09 @@ -240,8 +253,11 @@ #define LEAPRAID_SAS_PRATE_MIN_RATE_MASK 0x0F #define LEAPRAID_SAS_HWRATE_MIN_RATE_MASK 0x0F -/* scsi IO control bits */ -#define LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT 26 +/* + * Control flags for a SCSI I/O Request. + */ +#define LEAPRAID_SCSIIO_CTRL_CDB_32BYTE 4 +#define LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT 26 #define LEAPRAID_SCSIIO_CTRL_NODATATRANSFER 0x00000000 #define LEAPRAID_SCSIIO_CTRL_WRITE 0x01000000 #define LEAPRAID_SCSIIO_CTRL_READ 0x02000000 @@ -250,7 +266,7 @@ #define LEAPRAID_SCSIIO_CTRL_ORDEREDQ 0x00000200 #define LEAPRAID_SCSIIO_CTRL_CMDPRI 0x00000800 -/* scsi state and status */ +/* SCSI state and status. */ #define LEAPRAID_SCSI_STATUS_BUSY 0x08 #define LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT 0x18 #define LEAPRAID_SCSI_STATUS_TASK_SET_FULL 0x28 @@ -261,7 +277,7 @@ #define LEAPRAID_SCSI_STATE_AUTOSENSE_FAILED 0x02 #define LEAPRAID_SCSI_STATE_AUTOSENSE_VALID 0x01 -/* scsi task management defines */ +/* SCSI task management defines. */ #define LEAPRAID_TM_TASKTYPE_ABORT_TASK 0x01 #define LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET 0x02 #define LEAPRAID_TM_TASKTYPE_TARGET_RESET 0x03 @@ -277,21 +293,20 @@ #define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 #define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 -/* scsi sep request defines */ +/* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 #define LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS 0x00 #define LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS 0x01 #define LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT 0x00000040 -/* the capabilities of the adapter */ +/* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 #define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 #define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 -/* event code definitions for the firmware */ +/* Event code definitions for the firmware. */ #define LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE 0x000F -#define LEAPRAID_EVT_SAS_DISCOVERY 0x0016 #define LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST 0x001C #define LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE 0x001D #define LEAPRAID_EVT_IR_CHANGE 0x0020 @@ -303,7 +318,7 @@ #define LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET 0x08 #define LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET 0x0E -/* raid configuration change event */ +/* RAID configuration change event. */ #define LEAPRAID_EVT_IR_RC_VOLUME_ADD 0x01 #define LEAPRAID_EVT_IR_RC_VOLUME_DELETE 0x02 #define LEAPRAID_EVT_IR_RC_PD_HIDDEN_TO_ADD 0x03 @@ -313,27 +328,25 @@ #define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A #define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B -/* sas topology change event */ +/* SAS topology change event. */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 #define LEAPRAID_EVT_SAS_TOPO_ES_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING 0x02 #define LEAPRAID_EVT_SAS_TOPO_ES_RESPONDING 0x03 #define LEAPRAID_EVT_SAS_TOPO_RC_MASK 0x0F -#define LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK 0xF0 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -#define LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED 0x03 -/* sas discovery event defines */ +/* SAS discovery event defines. */ #define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 #define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 -/* enclosure device status change event */ +/* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 -/* device type and identifiers */ +/* Device type and identifiers. */ #define LEAPRAID_DEVTYP_SEP 0x00004000 #define LEAPRAID_DEVTYP_SSP_TGT 0x00000400 #define LEAPRAID_DEVTYP_STP_TGT 0x00000200 @@ -350,12 +363,12 @@ #define LEAPRAID_DEVTYP_EDGE_EXPANDER 0x00000002 #define LEAPRAID_DEVTYP_FANOUT_EXPANDER 0x00000003 -/* sas control operation */ +/* SAS control operation. */ #define LEAPRAID_SAS_OP_PHY_LINK_RESET 0x06 #define LEAPRAID_SAS_OP_PHY_HARD_RESET 0x07 #define LEAPRAID_SAS_OP_SET_PARAMETER 0x0F -/* boot device defines */ +/* Boot device defines */ #define LEAPRAID_BOOTDEV_FORM_MASK 0x0F #define LEAPRAID_BOOTDEV_FORM_NONE 0x00 #define LEAPRAID_BOOTDEV_FORM_SAS_WWID 0x05 @@ -365,21 +378,21 @@ /** * struct leapraid_reg_base - Register layout of the LeapRAID controller * - * @db: Doorbell register used to signal commands or status to firmware - * @ws: Write sequence register for synchronizing doorbell operations - * @host_diag: Diagnostic register used for status or debug reporting - * @r1: Reserved - * @host_int_status: Interrupt status register reporting active interrupts - * @host_int_mask: Interrupt mask register enabling or disabling sources - * @r2: Reserved - * @rep_msg_host_idx: Reply message index for the next available reply slot - * @r3: Reserved - * @debug_log: DebugLog registers for firmware debug and diagnostic output - * @r4: Reserved - * @atomic_req_desc_post: Atomic register for single descriptor posting - * @adapter_log_buf_pos: Adapter log buffer write position - * @host_log_buf_pos: Host log buffer write position - * @r5: Reserved + * @db: Doorbell register used to signal commands or status to firmware. + * @ws: Write sequence register for synchronizing doorbell operations. + * @host_diag: Diagnostic register used for status or debug reporting. + * @r1: Reserved. + * @host_int_status: Interrupt status register reporting active interrupts. + * @host_int_mask: Interrupt mask register enabling or disabling sources. + * @r2: Reserved. + * @rep_msg_host_idx: Reply message index for the next available reply slot. + * @r3: Reserved. + * @debug_log: DebugLog registers for firmware debug and diagnostic output. + * @r4: Reserved. + * @atomic_req_desc_post: Atomic register for single descriptor posting. + * @adapter_log_buf_pos: Adapter log buffer write position. + * @host_log_buf_pos: Host log buffer write position. + * @r5: Reserved. * @rep_post_reg_idx: Array of reply post index registers, one per queue. * The number of entries is defined by * REP_POST_HOST_IDX_REG_CNT. @@ -411,9 +424,9 @@ struct leapraid_reg_base { /** * struct leapraid_atomic_req_desc - Atomic request descriptor * - * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O) - * @msix_idx: MSI-X vector index used for interrupt routing - * @taskid: Unique task identifier associated with this request + * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O). + * @msix_idx: MSI-X vector index used for interrupt routing. + * @taskid: Unique task identifier associated with this request. */ struct leapraid_atomic_req_desc { u8 flg; @@ -424,23 +437,23 @@ struct leapraid_atomic_req_desc { /** * union leapraid_rep_desc_union - Unified reply descriptor format * - * @dflt_rep: Default reply descriptor containing basic completion info - * @dflt_rep.rep_flg: Reply flag indicating reply type or status - * @dflt_rep.msix_idx: MSI-X index for interrupt routing - * @dflt_rep.taskid: Task identifier matching the submitted request - * @r1: Reserved + * @dflt_rep: Default reply descriptor containing basic completion info. + * @dflt_rep.rep_flg: Reply flag indicating reply type or status. + * @dflt_rep.msix_idx: MSI-X index for interrupt routing. + * @dflt_rep.taskid: Task identifier matching the submitted request. + * @r1: Reserved. * * @addr_rep: Address reply descriptor used when firmware returns a - * memory address associated with the reply - * @addr_rep.rep_flg: Reply flag indicating reply type or status - * @addr_rep.msix_idx: MSI-X index for interrupt routing - * @addr_rep.taskid: Task identifier matching the submitted request - * @addr_rep.rep_frame_addr: Physical address of the reply frame + * memory address associated with the reply. + * @addr_rep.rep_flg: Reply flag indicating reply type or status. + * @addr_rep.msix_idx: MSI-X index for interrupt routing. + * @addr_rep.taskid: Task identifier matching the submitted request. + * @addr_rep.rep_frame_addr: Physical address of the reply frame. * - * @words: Raw 64-bit representation of the reply descriptor - * @u: Alternative access using 32-bit low/high words - * @u.low: Lower 32 bits of the descriptor - * @u.high: Upper 32 bits of the descriptor + * @words: Raw 64-bit representation of the reply descriptor. + * @u: Alternative access using 32-bit low/high words. + * @u.low: Lower 32 bits of the descriptor. + * @u.high: Upper 32 bits of the descriptor. */ union leapraid_rep_desc_union { struct leapraid_rep_desc { @@ -465,10 +478,10 @@ union leapraid_rep_desc_union { /** * struct leapraid_req - Generic request header * - * @func_dep1: Function-dependent parameter (low 16 bits) - * @r1: Reserved - * @func: Function code identifying the command type - * @r2: Reserved + * @func_dep1: Function-dependent parameter (low 16 bits). + * @r1: Reserved. + * @func: Function code identifying the command type. + * @r2: Reserved. */ struct leapraid_req { __le16 func_dep1; @@ -480,12 +493,12 @@ struct leapraid_req { /** * struct leapraid_rep - Generic reply header * - * @r1: Reserved - * @msg_len: Length of the reply message in bytes - * @function: Function code corresponding to the request - * @r2: Reserved - * @adapter_status: Status code reported by the adapter - * @r3: Reserved + * @r1: Reserved. + * @msg_len: Length of the reply message in bytes. + * @function: Function code corresponding to the request. + * @r2: Reserved. + * @adapter_status: Status code reported by the adapter. + * @r3: Reserved. */ struct leapraid_rep { u8 r1[2]; @@ -499,8 +512,8 @@ struct leapraid_rep { /** * struct leapraid_sge_simple32 - 32-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 32-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 32-bit physical address of the data buffer. */ struct leapraid_sge_simple32 { __le32 flg_and_len; @@ -510,8 +523,8 @@ struct leapraid_sge_simple32 { /** * struct leapraid_sge_simple64 - 64-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 64-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 64-bit physical address of the data buffer. */ struct leapraid_sge_simple64 { __le32 flg_and_len; @@ -521,9 +534,9 @@ struct leapraid_sge_simple64 { /** * struct leapraid_sge_simple_union - Unified 32/64-bit SGE representation * - * @flg_and_len: Combined field for flags and segment length - * @u.addr32: 32-bit address field - * @u.addr64: 64-bit address field + * @flg_and_len: Combined field for flags and segment length. + * @u.addr32: 32-bit address field. + * @u.addr64: 64-bit address field. */ struct leapraid_sge_simple_union { __le32 flg_and_len; @@ -536,11 +549,11 @@ struct leapraid_sge_simple_union { /** * struct leapraid_sge_chain_union - Chained scatter-gather entry * - * @len: Length of the chain descriptor - * @next_chain_offset: Offset to the next SGE chain - * @flg: Flags indicating chain or termination properties - * @u.addr32: 32-bit physical address - * @u.addr64: 64-bit physical address + * @len: Length of the chain descriptor. + * @next_chain_offset: Offset to the next SGE chain. + * @flg: Flags indicating chain or termination properties. + * @u.addr32: 32-bit physical address. + * @u.addr64: 64-bit physical address. */ struct leapraid_sge_chain_union { __le16 len; @@ -555,8 +568,8 @@ struct leapraid_sge_chain_union { /** * struct leapraid_ieee_sge_simple32 - IEEE 32-bit simple SGE format * - * @addr: 32-bit physical address of the data buffer - * @flg_and_len: Combined field for flags and data length + * @addr: 32-bit physical address of the data buffer. + * @flg_and_len: Combined field for flags and data length. */ struct leapraid_ieee_sge_simple32 { __le32 addr; @@ -566,10 +579,10 @@ struct leapraid_ieee_sge_simple32 { /** * struct leapraid_ieee_sge_simple64 - IEEE 64-bit simple SGE format * - * @addr: 64-bit physical address of the data buffer - * @len: Length of the data segment - * @r1: Reserved - * @flg: Flags indicating transfer properties + * @addr: 64-bit physical address of the data buffer. + * @len: Length of the data segment. + * @r1: Reserved. + * @flg: Flags indicating transfer properties. */ struct leapraid_ieee_sge_simple64 { __le64 addr; @@ -581,8 +594,8 @@ struct leapraid_ieee_sge_simple64 { /** * union leapraid_ieee_sge_simple_union - Unified IEEE SGE format * - * @simple32: IEEE 32-bit simple SGE entry - * @simple64: IEEE 64-bit simple SGE entry + * @simple32: IEEE 32-bit simple SGE entry. + * @simple64: IEEE 64-bit simple SGE entry. */ union leapraid_ieee_sge_simple_union { struct leapraid_ieee_sge_simple32 simple32; @@ -592,8 +605,8 @@ union leapraid_ieee_sge_simple_union { /** * union leapraid_ieee_sge_chain_union - Unified IEEE SGE chain format * - * @chain32: IEEE 32-bit chain SGE entry - * @chain64: IEEE 64-bit chain SGE entry + * @chain32: IEEE 32-bit chain SGE entry. + * @chain64: IEEE 64-bit chain SGE entry. */ union leapraid_ieee_sge_chain_union { struct leapraid_ieee_sge_simple32 chain32; @@ -603,11 +616,11 @@ union leapraid_ieee_sge_chain_union { /** * struct leapraid_chain64_ieee_sg - 64-bit IEEE chain SGE descriptor * - * @addr: Physical address of the next chain segment - * @len: Length of the current SGE - * @r1: Reserved - * @next_chain_offset: Offset to the next chain element - * @flg: Flags that describe SGE attributes + * @addr: Physical address of the next chain segment. + * @len: Length of the current SGE. + * @r1: Reserved. + * @next_chain_offset: Offset to the next chain element. + * @flg: Flags that describe SGE attributes. */ struct leapraid_chain64_ieee_sg { __le64 addr; @@ -620,8 +633,8 @@ struct leapraid_chain64_ieee_sg { /** * union leapraid_ieee_sge_io_union - IEEE-style SGE union for I/O * - * @ieee_simple: Simple IEEE SGE descriptor - * @ieee_chain: IEEE chain SGE descriptor + * @ieee_simple: Simple IEEE SGE descriptor. + * @ieee_chain: IEEE chain SGE descriptor. */ union leapraid_ieee_sge_io_union { struct leapraid_ieee_sge_simple64 ieee_simple; @@ -631,25 +644,25 @@ union leapraid_ieee_sge_io_union { /** * union leapraid_simple_sge_union - Union of simple SGE descriptors * - * @leapio_simple: LeapIO-style simple SGE - * @ieee_simple: IEEE-style simple SGE + * @leapraid_simple: LeapRAID simple SGE. + * @ieee_simple: IEEE-style simple SGE. */ union leapraid_simple_sge_union { - struct leapraid_sge_simple_union leapio_simple; + struct leapraid_sge_simple_union leapraid_simple; union leapraid_ieee_sge_simple_union ieee_simple; }; /** * union leapraid_sge_io_union - Combined SGE union for all I/O types * - * @leapio_simple: LeapIO simple SGE format - * @leapio_chain: LeapIO chain SGE format - * @ieee_simple: IEEE simple SGE format - * @ieee_chain: IEEE chain SGE format + * @leapraid_simple: LeapRAID simple SGE format. + * @leapraid_chain: LeapRAID chain SGE format. + * @ieee_simple: IEEE simple SGE format. + * @ieee_chain: IEEE chain SGE format. */ union leapraid_sge_io_union { - struct leapraid_sge_simple_union leapio_simple; - struct leapraid_sge_chain_union leapio_chain; + struct leapraid_sge_simple_union leapraid_simple; + struct leapraid_sge_chain_union leapraid_chain; union leapraid_ieee_sge_simple_union ieee_simple; union leapraid_ieee_sge_chain_union ieee_chain; }; @@ -657,10 +670,10 @@ union leapraid_sge_io_union { /** * struct leapraid_cfg_pg_header - Standard configuration page header * - * @r1: Reserved - * @page_len: Length of the page in 4-byte units - * @page_num: Page number - * @page_type: Page type + * @r1: Reserved. + * @page_len: Length of the page in 4-byte units. + * @page_num: Page number. + * @page_type: Page type. */ struct leapraid_cfg_pg_header { u8 r1; @@ -672,13 +685,13 @@ struct leapraid_cfg_pg_header { /** * struct leapraid_cfg_ext_pg_header - Extended configuration page header * - * @r1: Reserved - * @r2: Reserved - * @page_num: Page number - * @page_type: Page type - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @r3: Reserved + * @r1: Reserved. + * @r2: Reserved. + * @page_num: Page number. + * @page_type: Page type. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @r3: Reserved. */ struct leapraid_cfg_ext_pg_header { u8 r1; @@ -693,17 +706,17 @@ struct leapraid_cfg_ext_pg_header { /** * struct leapraid_cfg_req - Configuration request message * - * @action: Requested action type - * @sgl_flag: SGL flag field - * @chain_offset: Offset to next chain SGE - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r1: Reserved - * @header: Configuration page header - * @page_addr: Address of the page buffer - * @page_buf_sge: SGE describing the page buffer + * @action: Requested action type. + * @sgl_flag: SGL flag field. + * @chain_offset: Offset to next chain SGE. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r1: Reserved. + * @header: Configuration page header. + * @page_addr: Address of the page buffer. + * @page_buf_sge: SGE describing the page buffer. */ struct leapraid_cfg_req { u8 action; @@ -722,17 +735,17 @@ struct leapraid_cfg_req { /** * struct leapraid_cfg_rep - Configuration reply message * - * @action: Action type from the request - * @r1: Reserved - * @msg_len: Message length in bytes - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status code - * @r3: Reserved - * @header: Configuration page header + * @action: Action type from the request. + * @r1: Reserved. + * @msg_len: Message length in bytes. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status code. + * @r3: Reserved. + * @header: Configuration page header. */ struct leapraid_cfg_rep { u8 action; @@ -751,9 +764,9 @@ struct leapraid_cfg_rep { /** * struct leapraid_boot_dev_format_sas_wwid - Boot device identified by wwid * - * @sas_addr: SAS address of the device - * @lun: Logical unit number - * @r1: Reserved + * @sas_addr: SAS address of the device. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_sas_wwid { __le64 sas_addr; @@ -764,10 +777,10 @@ struct leapraid_boot_dev_format_sas_wwid { /** * struct leapraid_boot_dev_format_enc_slot - identified by enclosure * - * @enc_lid: Enclosure logical ID - * @r1: Reserved - * @slot_num: Slot number in the enclosure - * @r2: Reserved + * @enc_lid: Enclosure logical ID. + * @r1: Reserved. + * @slot_num: Slot number in the enclosure. + * @r2: Reserved. */ struct leapraid_boot_dev_format_enc_slot { __le64 enc_lid; @@ -779,9 +792,9 @@ struct leapraid_boot_dev_format_enc_slot { /** * struct leapraid_boot_dev_format_dev_name - Boot device by device name * - * @dev_name: Device name identifier - * @lun: Logical unit number - * @r1: Reserved + * @dev_name: Device name identifier. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_dev_name { __le64 dev_name; @@ -792,9 +805,9 @@ struct leapraid_boot_dev_format_dev_name { /** * union leapraid_boot_dev_format - Boot device format union * - * @sas_wwid: Format using SAS WWID and LUN - * @enc_slot: Format using enclosure slot and ID - * @dev_name: Format using device name and LUN + * @sas_wwid: Format using SAS WWID and LUN. + * @enc_slot: Format using enclosure slot and ID. + * @dev_name: Format using device name and LUN. */ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_sas_wwid sas_wwid; @@ -802,20 +815,39 @@ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_dev_name dev_name; }; +/** + * struct leapraid_manufacturing_p0 - Manufacturing configuration page 0 + * + * @header: Configuration page header. + * @chip_name: Chip name as a 16-byte ASCII string. + * @chip_revision: Chip revision as an 8-byte ASCII string. + * @board_name: Board name as a 16-byte ASCII string. + * @board_assembly: Board assembly as a 16-byte ASCII string. + * @board_tracer_number: Board tracer number as a 16-byte ASCII string. + */ +struct leapraid_manufacturing_p0 { + struct leapraid_cfg_pg_header header; + u8 chip_name[16]; + u8 chip_revision[8]; + u8 board_name[16]; + u8 board_assembly[16]; + u8 board_tracer_number[16]; +}; + /** * struct leapraid_bios_page2 - BIOS configuration page 2 * - * @header: Configuration page header - * @r1: Reserved - * @requested_boot_dev_form: Format type of the requested boot device - * @r2: Reserved - * @requested_boot_dev: Boot device requested by BIOS or user - * @requested_alt_boot_dev_form: Format of the alternate boot device - * @r3: Reserved - * @requested_alt_boot_dev: Alternate boot device requested - * @current_boot_dev_form: Format type of the active boot device - * @r4: Reserved - * @current_boot_dev: Currently active boot device in use + * @header: Configuration page header. + * @r1: Reserved. + * @requested_boot_dev_form: Format type of the requested boot device. + * @r2: Reserved. + * @requested_boot_dev: Boot device requested by BIOS or user. + * @requested_alt_boot_dev_form: Format of the alternate boot device. + * @r3: Reserved. + * @requested_alt_boot_dev: Alternate boot device requested. + * @current_boot_dev_form: Format type of the active boot device. + * @r4: Reserved. + * @current_boot_dev: Currently active boot device in use. */ struct leapraid_bios_page2 { struct leapraid_cfg_pg_header header; @@ -834,10 +866,10 @@ struct leapraid_bios_page2 { /** * struct leapraid_bios_page3 - BIOS configuration page 3 * - * @header: Configuration page header - * @r1: Reserved - * @bios_version: BIOS firmware version number - * @r2: Reserved + * @header: Configuration page header. + * @r1: Reserved. + * @bios_version: BIOS firmware version number. + * @r2: Reserved. */ struct leapraid_bios_page3 { struct leapraid_cfg_pg_header header; @@ -849,9 +881,9 @@ struct leapraid_bios_page3 { /** * struct leapraid_raidvol0_phys_disk - Physical disk in RAID volume * - * @r1: Reserved - * @phys_disk_num: Physical disk number within the RAID volume - * @r2: Reserved + * @r1: Reserved. + * @phys_disk_num: Physical disk number within the RAID volume. + * @r2: Reserved. */ struct leapraid_raidvol0_phys_disk { u8 r1[2]; @@ -862,14 +894,14 @@ struct leapraid_raidvol0_phys_disk { /** * struct leapraid_raidvol_p0 - RAID volume configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle for the RAID volume - * @volume_state: State of the RAID volume - * @volume_type: RAID type - * @r1: Reserved - * @num_phys_disks: Number of physical disks in the volume - * @r2: Reserved - * @phys_disk: Array of physical disks in this volume + * @header: Configuration page header. + * @dev_hdl: Device handle for the RAID volume. + * @volume_state: State of the RAID volume. + * @volume_type: RAID type. + * @r1: Reserved. + * @num_phys_disks: Number of physical disks in the volume. + * @r2: Reserved. + * @phys_disk: Array of physical disks in this volume. */ struct leapraid_raidvol_p0 { struct leapraid_cfg_pg_header header; @@ -885,11 +917,11 @@ struct leapraid_raidvol_p0 { /** * struct leapraid_raidvol_p1 - RAID volume configuration page 1 * - * @header: Configuration page header - * @dev_hdl: Device handle of the RAID volume - * @r1: Reserved - * @wwid: World-wide identifier for the volume - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the RAID volume. + * @r1: Reserved. + * @wwid: World-wide identifier for the volume. + * @r2: Reserved. */ struct leapraid_raidvol_p1 { struct leapraid_cfg_pg_header header; @@ -902,11 +934,11 @@ struct leapraid_raidvol_p1 { /** * struct leapraid_raidpd_p0 - Physical disk configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle of the physical disk - * @r1: Reserved - * @phys_disk_num: Physical disk number - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the physical disk. + * @r1: Reserved. + * @phys_disk_num: Physical disk number. + * @r2: Reserved. */ struct leapraid_raidpd_p0 { struct leapraid_cfg_pg_header header; @@ -919,14 +951,14 @@ struct leapraid_raidpd_p0 { /** * struct leapraid_sas_io_unit0_phy_info - PHY info for SAS I/O unit * - * @port: Port number the PHY belongs to - * @port_flg: Flags describing port status - * @phy_flg: Flags describing PHY status - * @neg_link_rate: Negotiated link rate of the PHY - * @controller_phy_dev_info: Controller PHY device info - * @attached_dev_hdl: Handle of attached device - * @controller_dev_hdl: Handle of the controller device - * @r1: Reserved + * @port: Port number the PHY belongs to. + * @port_flg: Flags describing port status. + * @phy_flg: Flags describing PHY status. + * @neg_link_rate: Negotiated link rate of the PHY. + * @controller_phy_dev_info: Controller PHY device info. + * @attached_dev_hdl: Handle of attached device. + * @controller_dev_hdl: Handle of the controller device. + * @r1: Reserved. */ struct leapraid_sas_io_unit0_phy_info { u8 port; @@ -942,11 +974,11 @@ struct leapraid_sas_io_unit0_phy_info { /** * struct leapraid_sas_io_unit_p0 - SAS I/O unit configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @phy_num: Number of PHYs in this unit - * @r2: Reserved - * @phy_info: Array of PHY information + * @header: Extended configuration page header. + * @r1: Reserved. + * @phy_num: Number of PHYs in this unit. + * @r2: Reserved. + * @phy_info: Array of PHY information. */ struct leapraid_sas_io_unit_p0 { struct leapraid_cfg_ext_pg_header header; @@ -956,54 +988,20 @@ struct leapraid_sas_io_unit_p0 { struct leapraid_sas_io_unit0_phy_info phy_info[]; }; -/** - * struct leapraid_sas_io_unit1_phy_info - Placeholder for SAS unit page 1 PHY - * - * @r1: Reserved - */ -struct leapraid_sas_io_unit1_phy_info { - u8 r1[12]; -}; - -/** - * struct leapraid_sas_io_unit_page1 - SAS I/O unit configuration page 1 - * - * @header: Extended configuration page header - * @r1: Reserved - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @r2: Reserved - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @r3: Reserved - * @sata_max_queue_depth: Maximum SATA queue depth - * @r4: Reserved - * @phy_info: Array of PHY info structures - */ -struct leapraid_sas_io_unit_page1 { - struct leapraid_cfg_ext_pg_header header; - u8 r1[2]; - __le16 narrowport_max_queue_depth; - u8 r2[2]; - __le16 wideport_max_queue_depth; - u8 r3; - u8 sata_max_queue_depth; - u8 r4[2]; - struct leapraid_sas_io_unit1_phy_info phy_info[]; -}; - /** * struct leapraid_exp_p0 - SAS expander page 0 * - * @header: Extended page header - * @physical_port: Physical port number - * @r1: Reserved - * @enc_hdl: Enclosure handle - * @sas_address: SAS address of the expander - * @r2: Reserved - * @dev_hdl: Device handle of this expander - * @parent_dev_hdl: Device handle of parent expander - * @r3: Reserved - * @phy_num: Number of PHYs - * @r4: Reserved + * @header: Extended page header. + * @physical_port: Physical port number. + * @r1: Reserved. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address of the expander. + * @r2: Reserved. + * @dev_hdl: Device handle of this expander. + * @parent_dev_hdl: Device handle of parent expander. + * @r3: Reserved. + * @phy_num: Number of PHYs. + * @r4: Reserved. */ struct leapraid_exp_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1022,14 +1020,14 @@ struct leapraid_exp_p0 { /** * struct leapraid_exp_p1 - SAS expander page 1 * - * @header: Extended page header - * @r1: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @attached_dev_hdl: Attached device handle - * @r2: Reserved - * @neg_link_rate: Negotiated link rate - * @r3: Reserved + * @header: Extended page header. + * @r1: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @attached_dev_hdl: Attached device handle. + * @r2: Reserved. + * @neg_link_rate: Negotiated link rate. + * @r3: Reserved. */ struct leapraid_exp_p1 { struct leapraid_cfg_ext_pg_header header; @@ -1045,25 +1043,25 @@ struct leapraid_exp_p1 { /** * struct leapraid_sas_dev_p0 - SAS device page 0 * - * @header: Extended configuration page header - * @slot: Slot number - * @enc_hdl: Enclosure handle - * @sas_address: SAS address - * @parent_dev_hdl: Parent device handle - * @phy_num: Number of PHYs - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @dev_info: Device information - * @flg: Flags - * @physical_port: Physical port number - * @max_port_connections: Maximum port connections - * @dev_name: Device name - * @port_groups: Number of port groups - * @r3: Reserved - * @enc_level: Enclosure level - * @connector_name: Connector identifier - * @r4: Reserved + * @header: Extended configuration page header. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address. + * @parent_dev_hdl: Parent device handle. + * @phy_num: Number of PHYs. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @dev_info: Device information. + * @flg: Flags. + * @physical_port: Physical port number. + * @max_port_connections: Maximum port connections. + * @dev_name: Device name. + * @port_groups: Number of port groups. + * @r3: Reserved. + * @enc_level: Enclosure level. + * @connector_name: Connector identifier. + * @r4: Reserved. */ struct leapraid_sas_dev_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1083,23 +1081,23 @@ struct leapraid_sas_dev_p0 { u8 port_groups; u8 r3[2]; u8 enc_level; - u8 connector_name[4]; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN]; u8 r4[4]; } __packed __aligned(4); /** * struct leapraid_sas_phy_p0 - SAS PHY configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @attached_dev_hdl: Handle of attached device - * @r2: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @r3: Reserved - * @phy_info: PHY information - * @neg_link_rate: Negotiated link rate - * @r4: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @attached_dev_hdl: Handle of attached device. + * @r2: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @r3: Reserved. + * @phy_info: PHY information. + * @neg_link_rate: Negotiated link rate. + * @r4: Reserved. */ struct leapraid_sas_phy_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1117,12 +1115,12 @@ struct leapraid_sas_phy_p0 { /** * struct leapraid_enc_p0 - SAS enclosure page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @enc_lid: Enclosure logical ID - * @r2: Reserved - * @enc_hdl: Enclosure handle - * @r3: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @enc_lid: Enclosure logical ID. + * @r2: Reserved. + * @enc_hdl: Enclosure handle. + * @r3: Reserved. */ struct leapraid_enc_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1136,10 +1134,10 @@ struct leapraid_enc_p0 { /** * struct leapraid_raid_cfg_p0_element - RAID configuration element * - * @element_flg: Element flags - * @vol_dev_hdl: Volume device handle - * @r1: Reserved - * @phys_disk_dev_hdl: Physical disk device handle + * @element_flg: Element flags. + * @vol_dev_hdl: Volume device handle. + * @r1: Reserved. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_raid_cfg_p0_element { __le16 element_flg; @@ -1151,13 +1149,13 @@ struct leapraid_raid_cfg_p0_element { /** * struct leapraid_raid_cfg_p0 - RAID configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @cfg_num: Configuration number - * @r2: Reserved - * @elements_num: Number of RAID elements - * @r3: Reserved - * @cfg_element: Array of RAID elements + * @header: Extended configuration page header. + * @r1: Reserved. + * @cfg_num: Configuration number. + * @r2: Reserved. + * @elements_num: Number of RAID elements. + * @r3: Reserved. + * @cfg_element: Array of RAID elements. */ struct leapraid_raid_cfg_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1172,8 +1170,8 @@ struct leapraid_raid_cfg_p0 { /** * union leapraid_mpi_scsi_io_cdb_union - SCSI I/O CDB or simple SGE * - * @cdb32: 32-byte SCSI command descriptor block - * @sge: Simple SGE format + * @cdb32: 32-byte SCSI command descriptor block. + * @sge: Simple SGE format. */ union leapraid_mpi_scsi_io_cdb_union { u8 cdb32[32]; @@ -1183,32 +1181,32 @@ union leapraid_mpi_scsi_io_cdb_union { /** * struct leapraid_mpi_scsiio_req - MPI SCSI I/O request * - * @dev_hdl: Device handle for the target - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flags - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0..3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle for the target. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flags. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0..3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_mpi_scsiio_req { __le16 dev_hdl; @@ -1245,8 +1243,8 @@ struct leapraid_mpi_scsiio_req { /** * union leapraid_scsi_io_cdb_union - SCSI I/O CDB or IEEE simple SGE * - * @cdb32: 32-byte SCSI CDB - * @sge: IEEE simple 64-bit SGE + * @cdb32: 32-byte SCSI CDB. + * @sge: IEEE simple 64-bit SGE. */ union leapraid_scsi_io_cdb_union { u8 cdb32[32]; @@ -1256,32 +1254,32 @@ union leapraid_scsi_io_cdb_union { /** * struct leapraid_scsiio_req - SCSI I/O request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flag - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0-3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flag. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0-3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_scsiio_req { __le16 dev_hdl; @@ -1318,23 +1316,23 @@ struct leapraid_scsiio_req { /** * struct leapraid_scsiio_rep - SCSI I/O response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @scsi_status: SCSI status - * @scsi_state: SCSI state - * @adapter_status: Adapter status - * @r3: Reserved - * @transfer_count: Number of bytes transferred - * @sense_count: Number of sense bytes - * @resp_info: Additional response info - * @task_tag: Task identifier - * @scsi_status_qualifier: SCSI status qualifier - * @bi_dir_trans_count: Bi-directional transfer count - * @r4: Reserved + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @scsi_status: SCSI status. + * @scsi_state: SCSI state. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @transfer_count: Number of bytes transferred. + * @sense_count: Number of sense bytes. + * @resp_info: Additional response info. + * @task_tag: Task identifier. + * @scsi_status_qualifier: SCSI status qualifier. + * @bi_dir_trans_count: Bi-directional transfer count. + * @r4: Reserved. */ struct leapraid_scsiio_rep { __le16 dev_hdl; @@ -1359,18 +1357,18 @@ struct leapraid_scsiio_rep { /** * struct leapraid_scsi_tm_req - SCSI Task Management request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @task_type: Task management function type - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @lun: Logical Unit Number - * @r4: Reserved - * @task_mid: Task identifier - * @r5: Reserved + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @task_type: Task management function type. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @lun: Logical Unit Number. + * @r4: Reserved. + * @task_mid: Task identifier. + * @r5: Reserved. */ struct leapraid_scsi_tm_req { __le16 dev_hdl; @@ -1390,18 +1388,18 @@ struct leapraid_scsi_tm_req { /** * struct leapraid_scsi_tm_rep - SCSI Task Management response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @resp_code: Response code - * @task_type: Task management type - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @termination_count: Count of terminated tasks - * @response_info: Additional response info + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @resp_code: Response code. + * @task_type: Task management type. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @termination_count: Count of terminated tasks. + * @response_info: Additional response info. */ struct leapraid_scsi_tm_rep { __le16 dev_hdl; @@ -1421,18 +1419,18 @@ struct leapraid_scsi_tm_rep { /** * struct leapraid_sep_req - SEP (SCSI Enclosure Processor) request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @act: Action to perform - * @flg: Flags - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @act: Action to perform. + * @flg: Flags. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_req { __le16 dev_hdl; @@ -1452,19 +1450,19 @@ struct leapraid_sep_req { /** * struct leapraid_sep_rep - SEP response * - * @dev_hdl: Device handle - * @msg_len: Message length - * @func: Function code - * @act: Action performed - * @flg: Flags - * @msg_flag: Message flags - * @r1: Reserved - * @adapter_status: Adapter status - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @msg_len: Message length. + * @func: Function code. + * @act: Action performed. + * @flg: Flags. + * @msg_flag: Message flags. + * @r1: Reserved. + * @adapter_status: Adapter status. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_rep { __le16 dev_hdl; @@ -1486,29 +1484,29 @@ struct leapraid_sep_rep { /** * struct leapraid_adapter_init_req - Adapter initialization request * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @chain_offset: Chain offset - * @func: Function code - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @msg_ver: Message version - * @header_ver: Header version - * @host_buf_addr: Host buffer address (non adapter-ref) - * @r4: Reserved - * @host_buf_size: Host buffer size (non adapter-ref) - * @host_msix_vectors: Number of host MSI-X vectors - * @r6: Reserved - * @req_frame_size: Request frame size - * @rep_desc_qd: Reply descriptor queue depth - * @rep_msg_qd: Reply message queue depth - * @sense_buffer_add_high: High 32-bit of sense buffer address - * @rep_msg_dma_high: High 32-bit of reply message DMA address - * @task_desc_base_addr: Base address of task descriptors - * @rep_desc_q_arr_addr: Address of reply descriptor queue array - * @rep_msg_addr_dma: Reply message DMA address - * @time_stamp: Timestamp + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @chain_offset: Chain offset. + * @func: Function code. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @msg_ver: Message version. + * @header_ver: Header version. + * @host_buf_addr: Host buffer address (non adapter-ref). + * @r4: Reserved. + * @host_buf_size: Host buffer size (non adapter-ref). + * @host_msix_vectors: Number of host MSI-X vectors. + * @r6: Reserved. + * @req_frame_size: Request frame size. + * @rep_desc_qd: Reply descriptor queue depth. + * @rep_msg_qd: Reply message queue depth. + * @sense_buffer_add_high: High 32-bit of sense buffer address. + * @rep_msg_dma_high: High 32-bit of reply message DMA address. + * @task_desc_base_addr: Base address of task descriptors. + * @rep_desc_q_arr_addr: Address of reply descriptor queue array. + * @rep_msg_addr_dma: Reply message DMA address. + * @time_stamp: Timestamp. */ struct leapraid_adapter_init_req { u8 who_init; @@ -1539,8 +1537,8 @@ struct leapraid_adapter_init_req { /** * struct leapraid_rep_desc_q_arr - Reply descriptor queue array * - * @rep_desc_base_addr: Base address of the reply descriptors - * @r1: Reserved + * @rep_desc_base_addr: Base address of the reply descriptors. + * @r1: Reserved. */ struct leapraid_rep_desc_q_arr { __le64 rep_desc_base_addr; @@ -1550,15 +1548,15 @@ struct leapraid_rep_desc_q_arr { /** * struct leapraid_adapter_init_rep - Adapter initialization reply * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @msg_len: Length of reply message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @msg_len: Length of reply message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_adapter_init_rep { u8 who_init; @@ -1575,15 +1573,15 @@ struct leapraid_adapter_init_rep { /** * struct leapraid_adapter_log_req - Adapter log request * - * @action: Action code - * @type: Log type - * @chain_offset: Offset for chained SGE - * @func: Function code - * r1: Reserved - * @msg_flag: Message flags - * r2: Reserved - * @mbox: Mailbox for command-specific parameters - * @sge: Scatter-gather entry for data buffer + * @action: Action code. + * @type: Log type. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * r1: Reserved. + * @msg_flag: Message flags. + * r2: Reserved. + * @mbox: Mailbox for command-specific parameters. + * @sge: Scatter-gather entry for data buffer. */ struct leapraid_adapter_log_req { u8 action; @@ -1604,14 +1602,14 @@ struct leapraid_adapter_log_req { /** * struct leapraid_adapter_log_rep - Adapter log reply * - * @action: Action code echoed - * @type: Log type echoed - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Status returned by adapter + * @action: Action code echoed. + * @type: Log type echoed. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Status returned by adapter. */ struct leapraid_adapter_log_rep { u8 action; @@ -1627,12 +1625,12 @@ struct leapraid_adapter_log_rep { /** * struct leapraid_adapter_features_req - Request adapter features * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_adapter_features_req { u8 r1[2]; @@ -1646,32 +1644,32 @@ struct leapraid_adapter_features_req { /** * struct leapraid_adapter_features_rep - Adapter features reply * - * @msg_ver: Message version - * @msg_len: Length of reply message - * @func: Function code - * @header_ver: Header version - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @who_init: Who initialized the adapter - * @r4: Reserved - * @max_msix_vectors: Max MSI-X vectors supported - * @req_slot: Number of request slots - * @r5: Reserved - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version - * @sas_wide_max_qdepth: Max wide SAS queue depth - * @sas_narrow_max_qdepth: Max narrow SAS queue depth - * @r6: Reserved - * @hp_slot: Number of high-priority slots - * @r7: Reserved - * @max_volumes: Maximum supported volumes - * @max_dev_hdl: Maximum device handle - * @r8: Reserved - * @min_dev_hdl: Minimum device handle - * @r9: Reserved + * @msg_ver: Message version. + * @msg_len: Length of reply message. + * @func: Function code. + * @header_ver: Header version. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @who_init: Who initialized the adapter. + * @r4: Reserved. + * @max_msix_vectors: Max MSI-X vectors supported. + * @req_slot: Number of request slots. + * @r5: Reserved. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version. + * @sas_wide_max_qdepth: Max wide SAS queue depth. + * @sas_narrow_max_qdepth: Max narrow SAS queue depth. + * @r6: Reserved. + * @hp_slot: Number of high-priority slots. + * @r7: Reserved. + * @max_volumes: Maximum supported volumes. + * @max_dev_hdl: Maximum device handle. + * @r8: Reserved. + * @min_dev_hdl: Minimum device handle. + * @r9: Reserved. */ struct leapraid_adapter_features_rep { u16 msg_ver; @@ -1706,12 +1704,12 @@ struct leapraid_adapter_features_rep { /** * struct leapraid_scan_dev_req - Request to scan devices * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_scan_dev_req { u8 r1[2]; @@ -1725,14 +1723,14 @@ struct leapraid_scan_dev_req { /** * struct leapraid_scan_dev_rep - Scan devices reply * - * @r1: Reserved - * @msg_len: Length of message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @r1: Reserved. + * @msg_len: Length of message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_scan_dev_rep { u8 r1[2]; @@ -1748,14 +1746,14 @@ struct leapraid_scan_dev_rep { /** * struct leapraid_evt_notify_req - Event notification request * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @evt_masks: Event masks to enable notifications - * @r4: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @evt_masks: Event masks to enable notifications. + * @r4: Reserved. */ struct leapraid_evt_notify_req { u8 r1[2]; @@ -1771,18 +1769,18 @@ struct leapraid_evt_notify_req { /** * struct leapraid_evt_notify_rep - Event notification reply * - * @evt_data_len: Length of event data - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved - * @evt: Event code - * @r5: Reserved - * @evt_data: Event data array + * @evt_data_len: Length of event data. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. + * @evt: Event code. + * @r5: Reserved. + * @evt_data: Event data array. */ struct leapraid_evt_notify_rep { __le16 evt_data_len; @@ -1802,14 +1800,14 @@ struct leapraid_evt_notify_rep { /** * struct leapraid_evt_data_sas_dev_status_change - SAS device status change * - * @task_tag: Task identifier - * @reason_code: Reason for status change - * @physical_port: Physical port number - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @sas_address: SAS address of device - * @lun: Logical Unit Number + * @task_tag: Task identifier. + * @reason_code: Reason for status change. + * @physical_port: Physical port number. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @sas_address: SAS address of device. + * @lun: Logical unit Number. */ struct leapraid_evt_data_sas_dev_status_change { __le16 task_tag; @@ -1824,11 +1822,11 @@ struct leapraid_evt_data_sas_dev_status_change { /** * struct leapraid_evt_data_ir_change - IR (Integrated RAID) change event data * - * @r1: Reserved - * @reason_code: Reason for IR change - * @r2: Reserved - * @vol_dev_hdl: Volume device handle - * @phys_disk_dev_hdl: Physical disk device handle + * @r1: Reserved. + * @reason_code: Reason for IR change. + * @r2: Reserved. + * @vol_dev_hdl: Volume device handle. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_evt_data_ir_change { u8 r1; @@ -1841,10 +1839,10 @@ struct leapraid_evt_data_ir_change { /** * struct leapraid_evt_data_sas_disc - SAS discovery event data * - * @r1: Reserved - * @reason_code: Reason for discovery event - * @physical_port: Physical port number where event occurred - * @r2: Reserved + * @r1: Reserved. + * @reason_code: Reason for discovery event. + * @physical_port: Physical port number where event occurred. + * @r2: Reserved. */ struct leapraid_evt_data_sas_disc { u8 r1; @@ -1856,9 +1854,9 @@ struct leapraid_evt_data_sas_disc { /** * struct leapraid_evt_sas_topo_phy_entry - SAS topology PHY entry * - * @attached_dev_hdl: Device handle attached to PHY - * @link_rate: Current link rate - * @phy_status: PHY status flags + * @attached_dev_hdl: Device handle attached to PHY. + * @link_rate: Current link rate. + * @phy_status: PHY status flags. */ struct leapraid_evt_sas_topo_phy_entry { __le16 attached_dev_hdl; @@ -1869,15 +1867,15 @@ struct leapraid_evt_sas_topo_phy_entry { /** * struct leapraid_evt_data_sas_topo_change_list - SAS topology change list * - * @encl_hdl: Enclosure handle - * @exp_dev_hdl: Expander device handle - * @num_phys: Number of PHYs in this entry - * @r1: Reserved - * @entry_num: Entry index - * @start_phy_num: Start PHY number - * @exp_status: Expander status - * @physical_port: Physical port number - * @phy: Array of SAS PHY entries + * @encl_hdl: Enclosure handle. + * @exp_dev_hdl: Expander device handle. + * @num_phys: Number of PHYs in this entry. + * @r1: Reserved. + * @entry_num: Entry index. + * @start_phy_num: Start PHY number. + * @exp_status: Expander status. + * @physical_port: Physical port number. + * @phy: Array of SAS PHY entries. */ struct leapraid_evt_data_sas_topo_change_list { __le16 encl_hdl; @@ -1892,15 +1890,16 @@ struct leapraid_evt_data_sas_topo_change_list { }; /** - * struct leapraid_evt_data_sas_enc_dev_status_change - SAS enclosure device status + * struct leapraid_evt_data_sas_enc_dev_status_change - + * SAS enclosure device status * - * @enc_hdl: Enclosure handle - * @reason_code: Reason code for status change - * @physical_port: Physical port number - * @encl_logical_id: Enclosure logical ID - * @num_slots: Number of slots in enclosure - * @start_slot: First affected slot - * @phy_bits: Bitmap of affected PHYs + * @enc_hdl: Enclosure handle. + * @reason_code: Reason code for status change. + * @physical_port: Physical port number. + * @encl_logical_id: Enclosure logical ID. + * @num_slots: Number of slots in enclosure. + * @start_slot: First affected slot. + * @phy_bits: Bitmap of affected PHYs. */ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 enc_hdl; @@ -1913,21 +1912,21 @@ struct leapraid_evt_data_sas_enc_dev_status_change { }; /** - * struct leapraid_io_unit_ctrl_req - IO unit control request + * struct leapraid_io_unit_ctrl_req - I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @chain_offset: SGE chain offset - * @func: Function code - * @dev_hdl: Device handle - * @adapter_para: Adapter parameter selector - * @msg_flag: Message flags - * @r2: Reserved - * @phy_num: PHY number - * @r3: Reserved - * @adapter_para_value: Value for adapter parameter - * @adapter_para_value2: Optional second parameter value - * @r4: Reserved + * @op: Operation code. + * @r1: Reserved. + * @chain_offset: SGE chain offset. + * @func: Function code. + * @dev_hdl: Device handle. + * @adapter_para: Adapter parameter selector. + * @msg_flag: Message flags. + * @r2: Reserved. + * @phy_num: PHY number. + * @r3: Reserved. + * @adapter_para_value: Value for adapter parameter. + * @adapter_para_value2: Optional second parameter value. + * @r4: Reserved. */ struct leapraid_io_unit_ctrl_req { u8 op; @@ -1946,13 +1945,13 @@ struct leapraid_io_unit_ctrl_req { }; /** - * struct leapraid_io_unit_ctrl_rep - IO unit control reply + * struct leapraid_io_unit_ctrl_rep - I/O unit control reply * - * @op: Operation code echoed - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code echoed. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_io_unit_ctrl_rep { u8 op; @@ -1965,13 +1964,13 @@ struct leapraid_io_unit_ctrl_rep { /** * struct leapraid_raid_act_req - RAID action request * - * @act: RAID action code - * @r1: Reserved - * @func: Function code - * @r2: Reserved - * @phys_disk_num: Number of physical disks involved - * @r3: Reserved - * @action_data_sge: SGE describing action-specific data + * @act: RAID action code. + * @r1: Reserved. + * @func: Function code. + * @r2: Reserved. + * @phys_disk_num: Number of physical disks involved. + * @r3: Reserved. + * @action_data_sge: SGE describing action-specific data. */ struct leapraid_raid_act_req { u8 act; @@ -1986,13 +1985,13 @@ struct leapraid_raid_act_req { /** * struct leapraid_raid_act_rep - RAID action reply * - * @act: RAID action code echoed - * @r1: Reserved - * @func: Function code - * @vol_dev_hdl: Volume device handle + * @act: RAID action code echoed. + * @r1: Reserved. + * @func: Function code. + * @vol_dev_hdl: Volume device handle. * @r2: Reserved - * @adapter_status: Status returned by adapter - * @r3: Reserved + * @adapter_status: Status returned by adapter. + * @r3: Reserved. */ struct leapraid_raid_act_rep { u8 act; @@ -2007,15 +2006,15 @@ struct leapraid_raid_act_rep { /** * struct leapraid_smp_passthrough_req - SMP passthrough request * - * @passthrough_flg: Passthrough flags - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @req_data_len: Request data length - * @r2: Reserved - * @sas_address: SAS address of target device - * @r3: Reserved - * @sgl: Scatter-gather list describing request buffer + * @passthrough_flg: Passthrough flags. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @req_data_len: Request data length. + * @r2: Reserved. + * @sas_address: SAS address of target device. + * @r3: Reserved. + * @sgl: Scatter-gather list describing request buffer. */ struct leapraid_smp_passthrough_req { u8 passthrough_flg; @@ -2032,14 +2031,14 @@ struct leapraid_smp_passthrough_req { /** * struct leapraid_smp_passthrough_rep - SMP passthrough reply * - * @passthrough_flg: Passthrough flags echoed - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @resp_data_len: Length of response data - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved + * @passthrough_flg: Passthrough flags echoed. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @resp_data_len: Length of response data. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. */ struct leapraid_smp_passthrough_rep { u8 passthrough_flg; @@ -2053,13 +2052,13 @@ struct leapraid_smp_passthrough_rep { }; /** - * struct leapraid_sas_io_unit_ctrl_req - SAS IO unit control request + * struct leapraid_sas_io_unit_ctrl_req - SAS I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_sas_io_unit_ctrl_req { u8 op; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index f838bd5aa20e..25ec57c2ce4b 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -1,23 +1,22 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/compat.h> #include <linux/module.h> #include <linux/miscdevice.h> #include "leapraid_func.h" -/* ioctl device file */ +/* IOCTL device file name. */ #define LEAPRAID_DEV_NAME "leapraid_ctl" -/* ioctl version */ +/* IOCTL version. */ #define LEAPRAID_IOCTL_VERSION 0x07 -/* ioctl command */ +/* IOCTL commands. */ #define LEAPRAID_ADAPTER_INFO 17 #define LEAPRAID_COMMAND 20 #define LEAPRAID_EVENTQUERY 21 @@ -25,9 +24,10 @@ /** * struct leapraid_ioctl_header - IOCTL command header - * @adapter_id : Adapter identifier - * @port_number: Port identifier - * @max_data_size: Maximum data size for transfer + * + * @adapter_id : Adapter identifier. + * @port_number: Port identifier. + * @max_data_size: Maximum data size for transfer. */ struct leapraid_ioctl_header { u32 adapter_id; @@ -37,7 +37,8 @@ struct leapraid_ioctl_header { /** * struct leapraid_ioctl_diag_reset - Diagnostic reset request - * @hdr: Common IOCTL header + * + * @hdr: Common IOCTL header. */ struct leapraid_ioctl_diag_reset { struct leapraid_ioctl_header hdr; @@ -45,12 +46,13 @@ struct leapraid_ioctl_diag_reset { /** * struct leapraid_ioctl_pci_info - PCI device information - * @u: Union holding PCI bus/device/function information - * @u.bits.dev: PCI device number - * @u.bits.func: PCI function number - * @u.bits.bus: PCI bus number - * @u.word: Combined representation of PCI BDF - * @seg_id: PCI segment identifier + * + * @u: Union holding PCI bus/device/function information. + * @u.bits.dev: PCI device number. + * @u.bits.func: PCI function number. + * @u.bits.bus: PCI bus number. + * @u.word: Combined representation of PCI BDF. + * @seg_id: PCI segment identifier. */ struct leapraid_ioctl_pci_info { union { @@ -66,21 +68,22 @@ struct leapraid_ioctl_pci_info { /** * struct leapraid_ioctl_adapter_info - Adapter information for IOCTL - * @hdr: IOCTL header - * @adapter_type: Adapter type identifier - * @port_number: Port number - * @pci_id: PCI device ID - * @revision: Revision number - * @sub_dev: Subsystem device ID - * @sub_vendor: Subsystem vendor ID - * @r0: Reserved - * @fw_ver: Firmware version - * @bios_ver: BIOS version - * @driver_ver: Driver version - * @r1: Reserved - * @scsi_id: SCSI ID - * @r2: Reserved - * @pci_info: PCI information structure + * + * @hdr: IOCTL header. + * @adapter_type: Adapter type identifier. + * @port_number: Port number. + * @pci_id: PCI device ID. + * @revision: Revision number. + * @sub_dev: Subsystem device ID. + * @sub_vendor: Subsystem vendor ID. + * @r0: Reserved. + * @fw_ver: Firmware version. + * @bios_ver: BIOS version. + * @driver_ver: Driver version. + * @r1: Reserved. + * @scsi_id: SCSI ID. + * @r2: Reserved. + * @pci_info: PCI information structure. */ struct leapraid_ioctl_adapter_info { struct leapraid_ioctl_header hdr; @@ -102,18 +105,19 @@ struct leapraid_ioctl_adapter_info { /** * struct leapraid_ioctl_command - IOCTL command structure - * @hdr: IOCTL header - * @timeout: Command timeout - * @rep_msg_buf_ptr: User pointer to reply message buffer - * @c2h_buf_ptr: User pointer to card-to-host data buffer - * @h2c_buf_ptr: User pointer to host-to-card data buffer - * @sense_data_ptr: User pointer to sense data buffer - * @max_rep_bytes: Maximum reply bytes - * @c2h_size: Card-to-host data size - * @h2c_size: Host-to-card data size - * @max_sense_bytes: Maximum sense data bytes - * @data_sge_offset: Data SGE offset - * @mf: Message frame data (flexible array) + * + * @hdr: IOCTL header. + * @timeout: Command timeout. + * @rep_msg_buf_ptr: User pointer to reply message buffer. + * @c2h_buf_ptr: User pointer to card-to-host data buffer. + * @h2c_buf_ptr: User pointer to host-to-card data buffer. + * @sense_data_ptr: User pointer to sense data buffer. + * @max_rep_bytes: Maximum reply bytes. + * @c2h_size: Card-to-host data size. + * @h2c_size: Host-to-card data size. + * @max_sense_bytes: Maximum sense data bytes. + * @data_sge_offset: Data SGE offset. + * @mf: Message frame data (flexible array). */ struct leapraid_ioctl_command { struct leapraid_ioctl_header hdr; @@ -146,39 +150,38 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } -static void leapraid_cli_scsiio_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, u16 taskid, +static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_mpi_req, + u16 taskid, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, u16 dev_hdl, void *psge) { - struct leapraid_mpi_scsiio_req *scsiio_request = - (struct leapraid_mpi_scsiio_req *)ctl_sp_mpi_req; + struct leapraid_mpi_scsiio_req *scsiio_request = ctl_sp_mpi_req; scsiio_request->sense_buffer_len = SCSI_SENSE_BUFFERSIZE; scsiio_request->sense_buffer_low_add = - leapraid_get_sense_buffer_dma(adapter, taskid); - memset((void *)(&adapter->driver_cmds.ctl_cmd.sense), + leapraid_get_sense_buffer_dma(adapter, taskid); + memset(&adapter->driver_cmds.ctl_cmd.sense, 0, SCSI_SENSE_BUFFERSIZE); leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); - if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO_REQ) + if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO) leapraid_fire_scsi_io(adapter, taskid, dev_hdl); else leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - u16 taskid, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, void *h2c) +static int leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, + u16 taskid, + dma_addr_t h2c_dma_addr, + size_t h2c_size, + dma_addr_t c2h_dma_addr, + size_t c2h_size, + void *psge, void *h2c) { - struct leapraid_smp_passthrough_req *smp_pt_req = - (struct leapraid_smp_passthrough_req *)ctl_sp_mpi_req; + struct leapraid_smp_passthrough_req *smp_pt_req = ctl_sp_req; u8 *data; if (!adapter->adapter_attr.enable_mp) @@ -188,83 +191,49 @@ static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, else data = h2c; - if (data[1] == LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG && - (data[10] == 1 || data[10] == 2)) - adapter->reset_desc.adapter_link_resetting = true; + if (!(smp_pt_req->passthrough_flg & LEAPRAID_SMP_PT_FLAG_SGL_PTR) && + h2c_size <= 10) { + dev_err(&adapter->pdev->dev, + "%s: Invalid request size=%zu\n", + __func__, h2c_size); + return -EINVAL; + } + + if (data[1] == SMP_PHY_CONTROL && + (data[10] == SMP_PHY_CONTROL_LINK_RESET || + data[10] == SMP_PHY_CONTROL_HARD_RESET)) + adapter->reset_desc.adapter_link_resetting = 1; + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); + return 0; } -static void leapraid_ctl_fire_ieee_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size); - leapraid_fire_task(adapter, taskid); -} - -static void leapraid_ctl_sata_passthrough_cmd(struct leapraid_adapter *adapter, +static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, void *psge, u16 taskid) { - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static void leapraid_ctl_load_fw_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} + struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctl_req = ctl_sp_req; -static void leapraid_ctl_fire_mpi_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ + if (sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || + sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) + adapter->reset_desc.adapter_link_resetting = 1; leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) +static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, + struct leapraid_ioctl_command *karg, + void __user *mf) { - struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctrl_req = - (struct leapraid_sas_io_unit_ctrl_req *)ctl_sp_mpi_req; - - if (sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || - sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) - adapter->reset_desc.adapter_link_resetting = true; - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, - struct leapraid_ioctl_command *karg, - void __user *mf) -{ - struct leapraid_req *leap_mpi_req = NULL; - struct leapraid_req *ctl_sp_mpi_req = NULL; + struct leapraid_req *leap_mpi_req; + struct leapraid_req *ctl_sp_mpi_req; u16 taskid; void *h2c = NULL; size_t h2c_size = 0; @@ -277,74 +246,88 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; u32 sz; - long rc = 0; + int rc; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + return rc; leap_mpi_req = kzalloc(LEAPRAID_REQUEST_SIZE, GFP_KERNEL); - if (!leap_mpi_req) { - rc = -ENOMEM; - goto out; - } + if (!leap_mpi_req) + return -ENOMEM; - if (karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > LEAPRAID_REQUEST_SIZE || - karg->data_sge_offset > ((UINT_MAX) / LEAPRAID_SGE_OFFSET_SIZE)) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || + karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > + LEAPRAID_REQUEST_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); rc = -EINVAL; - goto out; + goto out_cleanup; } if (copy_from_user(leap_mpi_req, mf, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy request message from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset((void *)(&adapter->driver_cmds.ctl_cmd.reply), 0, - LEAPRAID_REPLY_SIEZ); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, + LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); memcpy(ctl_sp_mpi_req, leap_mpi_req, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); - if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_hdl = le16_to_cpu(ctl_sp_mpi_req->func_dep1); - if (!dev_hdl || dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + if (!dev_hdl || + dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_err(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } } - if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) - return -EINVAL; + if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) { + rc = -EINVAL; + goto out_cleanup; + } h2c_size = karg->h2c_size; c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, - &h2c_dma_addr, GFP_ATOMIC); + &h2c_dma_addr, GFP_KERNEL); if (!h2c) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (copy_from_user(h2c, karg->h2c_buf_ptr, h2c_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy h2c from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } } if (c2h_size) { - c2h = dma_alloc_coherent(&adapter->pdev->dev, - c2h_size, &c2h_dma_addr, GFP_ATOMIC); + c2h = dma_alloc_coherent(&adapter->pdev->dev, c2h_size, + &c2h_dma_addr, GFP_KERNEL); if (!c2h) { rc = -ENOMEM; - goto out; + goto out_cleanup; } } @@ -353,13 +336,9 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { - case LEAPRAID_FUNC_SCSIIO_REQ: - case LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_cli_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + leapraid_ctl_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size, dev_hdl, psge); @@ -367,28 +346,26 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, case LEAPRAID_FUNC_SMP_PASSTHROUGH: if (!h2c) { rc = -EINVAL; - goto out; + goto out_cleanup; } - leapraid_ctl_smp_passthrough_cmd(adapter, - ctl_sp_mpi_req, taskid, - h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size, - psge, h2c); + rc = leapraid_ctl_smp_passthrough_cmd(adapter, + ctl_sp_mpi_req, taskid, + h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size, + psge, h2c); + if (rc) + goto out_cleanup; break; - case LEAPRAID_FUNC_SATA_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_ctl_sata_passthrough_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_FW_DOWNLOAD: case LEAPRAID_FUNC_FW_UPLOAD: - leapraid_ctl_load_fw_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: leapraid_ctl_sas_io_unit_ctrl_cmd(adapter, ctl_sp_mpi_req, @@ -397,23 +374,27 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, psge, taskid); break; default: - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, + h2c_size, c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; } timeout = karg->timeout; if (timeout < LEAPRAID_CTL_CMD_TIMEOUT) timeout = LEAPRAID_CTL_CMD_TIMEOUT; - wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, - timeout * HZ); + if (!wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, + timeout * HZ)) { + dev_err(&adapter->pdev->dev, + "%s: ctl_cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.ctl_cmd.status); + } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || leap_mpi_req->func == LEAPRAID_FUNC_SAS_IO_UNIT_CTRL) && - adapter->reset_desc.adapter_link_resetting) { - adapter->reset_desc.adapter_link_resetting = false; - } + adapter->reset_desc.adapter_link_resetting) + adapter->reset_desc.adapter_link_resetting = 0; + if (!(adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE)) { issue_reset = leapraid_check_reset( @@ -421,57 +402,66 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto reset; } - if (c2h_size) { - if (copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { - rc = -ENODATA; - goto out; - } + if (c2h_size && copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy c2h to user\n", __func__); + rc = -ENODATA; + goto out_cleanup; } if (karg->max_rep_bytes) { - sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIEZ); + sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIZE); if (copy_to_user(karg->rep_msg_buf_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.reply, + &adapter->driver_cmds.ctl_cmd.reply, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy reply to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } if (karg->max_sense_bytes && - (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH)) { + (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH)) { if (!karg->sense_data_ptr) - goto out; + goto out_cleanup; sz = min_t(u32, karg->max_sense_bytes, SCSI_SENSE_BUFFERSIZE); if (copy_to_user(karg->sense_data_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.sense, + &adapter->driver_cmds.ctl_cmd.sense, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy sense data to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } reset: if (issue_reset) { rc = -ENODATA; - if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - leap_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_err(&adapter->pdev->dev, - "fire tgt reset: hdl=0x%04x\n", + "Fire tgt reset, hdl=0x%04x\n", le16_to_cpu(leap_mpi_req->func_dep1)); - leapraid_issue_locked_tm(adapter, + leapraid_issue_locked_tm( + adapter, le16_to_cpu(leap_mpi_req->func_dep1), 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } else { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } } -out: +out_cleanup: if (c2h) dma_free_coherent(&adapter->pdev->dev, c2h_size, c2h, c2h_dma_addr); @@ -483,12 +473,12 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, return rc; } -static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, - void __user *arg) +static int leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, + void __user *arg) { struct leapraid_ioctl_adapter_info *karg; - ssize_t __maybe_unused ret; u8 revision; + int rc = 0; karg = kzalloc(sizeof(*karg), GFP_KERNEL); if (!karg) @@ -504,80 +494,98 @@ static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, karg->pci_info.u.bits.func = PCI_FUNC(adapter->pdev->devfn); karg->pci_info.seg_id = pci_domain_nr(adapter->pdev->bus); karg->fw_ver = adapter->adapter_attr.features.fw_version; - ret = strscpy(karg->driver_ver, LEAPRAID_DRIVER_NAME, - sizeof(karg->driver_ver)); - strcat(karg->driver_ver, "-"); - strcat(karg->driver_ver, LEAPRAID_DRIVER_VERSION); + + snprintf(karg->driver_ver, sizeof(karg->driver_ver), "%s-%s", + LEAPRAID_DRIVER_NAME, LEAPRAID_DRIVER_VERSION); + karg->adapter_type = LEAPRAID_IOCTL_VERSION; karg->bios_ver = adapter->adapter_attr.bios_version; if (copy_to_user(arg, karg, sizeof(struct leapraid_ioctl_adapter_info))) { - kfree(karg); - return -EFAULT; + dev_err(&adapter->pdev->dev, + "%s: Failed to copy info to user\n", __func__); + rc = -EFAULT; + goto free_buf; } +free_buf: kfree(karg); - return 0; + return rc; } -static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, - void __user *arg, u8 compat) +static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, + void __user *arg) { struct leapraid_ioctl_header ioctl_header; struct leapraid_adapter *adapter; - long rc = -ENOIOCTLCMD; - int count; - - if (copy_from_user(&ioctl_header, (char __user *)arg, - sizeof(struct leapraid_ioctl_header))) + struct leapraid_ioctl_command __user *uarg; + struct leapraid_ioctl_command karg; + int rc = -ENOIOCTLCMD; + + if (copy_from_user(&ioctl_header, arg, + sizeof(struct leapraid_ioctl_header))) { + pr_err("%s:%s: Failed to copy header from user\n", + LEAPRAID_DRIVER_NAME, __func__); return -EFAULT; + } adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); if (!adapter) return -EFAULT; + if (atomic_read(&adapter->overheat_desc.thermal_alert)) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, thermal_alert=%d\n", + __func__, + atomic_read(&adapter->overheat_desc.thermal_alert)); + return -EFAULT; + } + mutex_lock(&adapter->access_ctrl.pci_access_lock); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_LONG, + __func__); if (rc) - goto out; + goto unlock; - count = LEAPRAID_WAIT_SHOST_RECOVERY; - while (count--) { - if (!adapter->access_ctrl.shost_recovering) - break; - ssleep(1); + if (!wait_event_timeout(adapter->access_ctrl.shost_recover_wq, + !adapter->access_ctrl.shost_recover_async, + LEAPRAID_WAIT_SHOST_RECOVERY * HZ)) { + dev_warn(&adapter->pdev->dev, + "Timeout waiting for shost recovery async\n"); + rc = -EAGAIN; + goto unlock; } - if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || + if (adapter->access_ctrl.pcie_recovering || adapter->scan_dev_desc.driver_loading || adapter->access_ctrl.host_removing) { rc = -EAGAIN; - goto out; + goto unlock; } if (file->f_flags & O_NONBLOCK) { if (!mutex_trylock(&adapter->driver_cmds.ctl_cmd.mutex)) { rc = -EAGAIN; - goto out; + goto unlock; } - } else if (mutex_lock_interruptible(&adapter->driver_cmds.ctl_cmd.mutex)) { + } else if (mutex_lock_interruptible(&adapter->driver_cmds + .ctl_cmd.mutex)) { rc = -ERESTARTSYS; - goto out; + goto unlock; } switch (_IOC_NR(cmd)) { case LEAPRAID_ADAPTER_INFO: - if (_IOC_SIZE(cmd) == sizeof(struct leapraid_ioctl_adapter_info)) + if (_IOC_SIZE(cmd) == + sizeof(struct leapraid_ioctl_adapter_info)) rc = leapraid_ctl_get_adapter_info(adapter, arg); break; case LEAPRAID_COMMAND: - { - struct leapraid_ioctl_command __user *uarg; - struct leapraid_ioctl_command karg; - if (copy_from_user(&karg, arg, sizeof(karg))) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy data from user\n", + __func__); rc = -EFAULT; break; } @@ -591,61 +599,77 @@ static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, uarg = arg; rc = leapraid_ctl_do_command(adapter, &karg, &uarg->mf); + if (rc) + dev_warn(&adapter->pdev->dev, + "%s: IOCTL cmd failed rc=%d\n", + __func__, rc); } break; - } case LEAPRAID_EVENTQUERY: case LEAPRAID_EVENTREPORT: rc = 0; break; default: - pr_err("unknown ioctl opcode=0x%08x\n", cmd); + dev_err(&adapter->pdev->dev, + "Unknown IOCTL opcode=0x%08x\n", cmd); break; } mutex_unlock(&adapter->driver_cmds.ctl_cmd.mutex); -out: +unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); return rc; } +static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + return -ENOTTY; +} + static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - return leapraid_ctl_ioctl_main(file, cmd, - (void __user *)arg, 0); + return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { struct leapraid_adapter *adapter; + /* Userspace passes the adapter ID via vma->vm_pgoff. */ + u32 adapter_id = vma->vm_pgoff; unsigned long length; - unsigned long pfn; + int rc; length = vma->vm_end - vma->vm_start; - adapter = list_first_entry(&leapraid_adapter_list, - struct leapraid_adapter, list); + adapter = leapraid_ctl_lookup_adapter(adapter_id); + if (!adapter) { + pr_err("%s: No adapter found!\n", __func__); + return -EINVAL; + } if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, - "requested mapping size is too large!\n"); + "Requested mapping size is too large!\n"); return -EINVAL; } if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, "no log buffer!\n"); + dev_err(&adapter->pdev->dev, "No log buffer!\n"); return -EINVAL; } - pfn = virt_to_phys(adapter->fw_log_desc.fw_log_buffer) >> PAGE_SHIFT; + vma->vm_pgoff = 0; - if (remap_pfn_range(vma, vma->vm_start, pfn, length, - vma->vm_page_prot)) { + rc = dma_mmap_coherent(&adapter->pdev->dev, vma, + adapter->fw_log_desc.fw_log_buffer, + adapter->fw_log_desc.fw_log_buffer_dma, + length); + if (rc) { dev_err(&adapter->pdev->dev, - "failed to map memory to user space!\n"); - return -EAGAIN; + "Failed to map memory to user space!\n"); + return rc; } return 0; @@ -655,6 +679,7 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, + .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { @@ -663,10 +688,14 @@ static struct miscdevice leapraid_ctl_dev = { .fops = &leapraid_ctl_fops, }; -void leapraid_ctl_init(void) +int leapraid_ctl_init(void) { - if (misc_register(&leapraid_ctl_dev) < 0) - pr_err("%s can't register misc device\n", LEAPRAID_DRIVER_NAME); + if (misc_register(&leapraid_ctl_dev) < 0) { + pr_err("%s Can't register misc device\n", + LEAPRAID_DRIVER_NAME); + return -ENODEV; + } + return 0; } void leapraid_ctl_exit(void) diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index ad8aee40e2c1..f2574feb2514 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -22,15 +21,16 @@ MODULE_PARM_DESC(smart_poll, static int interrupt_mode; module_param(interrupt_mode, int, 0444); MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 for MSI-X, 1 for MSI, 2 for legacy. (default=0)"); + "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); static int poll_queues; module_param(poll_queues, int, 0444); MODULE_PARM_DESC(poll_queues, "specifies the number of queues for io_uring poll mode."); -static int max_msix_vectors = -1; + +static int max_msix_vectors = LEAPRAID_INVALID_MSIX_VECTORS; module_param(max_msix_vectors, int, 0444); -MODULE_PARM_DESC(max_msix_vectors, " max msix vectors"); +MODULE_PARM_DESC(max_msix_vectors, "max msix vectors"); static void leapraid_remove_device(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev); @@ -39,11 +39,48 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_address, struct leapraid_card_port *port); +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +{ + struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; + u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + bool changed = false; + int i; + + if (leapraid_should_skip_poll_work(adapter)) + return; + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { + debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); + if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) + changed = true; + } + + if (!changed) + return; + + memcpy(adapter->fw_log_desc.pre_debug_log, + debug_log, + sizeof(debug_log)); + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; + i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) + dev_warn(&adapter->pdev->dev, + "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", + i, + i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, + debug_log[i], + debug_log[i + 1], + debug_log[i + 2], + debug_log[i + 3]); +} static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -57,12 +94,14 @@ bool leapraid_pci_removed(struct leapraid_adapter *adapter) struct pci_dev *pdev = adapter->pdev; u32 vendor_id; - if (pci_bus_read_config_dword(pdev->bus, pdev->devfn, PCI_VENDOR_ID, + if (pci_bus_read_config_dword(pdev->bus, + pdev->devfn, + PCI_VENDOR_ID, &vendor_id)) return true; - return ((vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != - LEAPRAID_VENDOR_ID); + return (vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != + LEAPRAID_VENDOR_ID; } static bool leapraid_pci_active(struct leapraid_adapter *adapter) @@ -82,14 +121,14 @@ void *leapraid_get_reply_vaddr(struct leapraid_adapter *adapter, u32 rep_paddr) void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.task_desc + - (taskid * LEAPRAID_REQUEST_SIZE)); + return adapter->mem_desc.task_desc + + taskid * LEAPRAID_REQUEST_SIZE; } void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.sense_data + - ((taskid - 1) * SCSI_SENSE_BUFFERSIZE)); + return adapter->mem_desc.sense_data + + (taskid - 1) * SCSI_SENSE_BUFFERSIZE; } __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -103,7 +142,7 @@ void leapraid_mask_int(struct leapraid_adapter *adapter) { u32 reg; - adapter->mask_int = true; + adapter->mask_int = 1; reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg |= LEAPRAID_TO_SYS_DB_MASK + LEAPRAID_REPLY_INT_MASK + LEAPRAID_RESET_IRQ_MASK; @@ -118,35 +157,59 @@ void leapraid_unmask_int(struct leapraid_adapter *adapter) reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg &= ~LEAPRAID_REPLY_INT_MASK; writel(reg, &adapter->iomem_base->host_int_mask); - adapter->mask_int = false; + adapter->mask_int = 0; } -static void leapraid_flush_io_and_panic(struct leapraid_adapter *adapter) +static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) { - adapter->access_ctrl.adapter_thermal_alert = true; - leapraid_smart_polling_stop(adapter); - leapraid_fw_log_stop(adapter); - leapraid_mq_polling_pause(adapter); - leapraid_clean_active_scsi_cmds(adapter); + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + + if (!adapter) + return; + + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_warn(&pdev->dev, + "Overheat suspend failed, invalid host or adapter\n"); + return; + } + + wq = adapter->overheat_desc.fault_overheat_wq; + if (!wq) + return; + + if (atomic_cmpxchg(&adapter->overheat_desc.thermal_alert, 0, 1)) + return; + + queue_work(wq, &adapter->overheat_desc.fault_overheat_work); } -static void leapraid_check_panic_needed(struct leapraid_adapter *adapter, - u32 db, u32 adapter_state) +static void leapraid_stop_adapter_on_fault(struct leapraid_adapter *adapter, + u32 db) { - bool fault_1 = adapter_state == LEAPRAID_DB_MASK; - bool fault_2 = (adapter_state == LEAPRAID_DB_FAULT) && - ((db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE); + u32 adapter_state = db & LEAPRAID_DB_MASK; + bool fault_1 = false; + bool fault_2 = false; + + fault_1 = adapter_state == LEAPRAID_DB_MASK; + fault_2 = adapter_state == LEAPRAID_DB_FAULT && + (db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE; if (!fault_1 && !fault_2) return; if (fault_1) - pr_err("%s, doorbell status 0xFFFF!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Doorbell status 0xFFFF!\n", __func__); else - pr_err("%s, adapter overheating detected!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Adapter overheating detected!\n", __func__); - leapraid_flush_io_and_panic(adapter); - panic("%s overheating detected, panic now!!!\n", __func__); + leapraid_overheat_suspend(adapter); } u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) @@ -156,38 +219,40 @@ u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) db = leapraid_readl(&adapter->iomem_base->db); adapter_state = db & LEAPRAID_DB_MASK; - leapraid_check_panic_needed(adapter, db, adapter_state); + leapraid_stop_adapter_on_fault(adapter, db); return adapter_state; } static bool leapraid_wait_adapter_ready(struct leapraid_adapter *adapter) { u32 cur_state; - u32 cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { cur_state = leapraid_get_adapter_state(adapter); + if (cur_state == LEAPRAID_DB_READY) return true; if (cur_state == LEAPRAID_DB_FAULT) break; usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } return false; } static int leapraid_db_wait_int_host(struct leapraid_adapter *adapter) { - u32 cnt = LEAPRAID_DB_WAIT_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_DB_WAIT_MAX_RETRY; cnt > 0; cnt--) { if (leapraid_readl(&adapter->iomem_base->host_int_status) & LEAPRAID_ADAPTER2HOST_DB_STATUS) return 0; + udelay(LEAPRAID_DB_WAIT_DELAY_US); - } while (--cnt); + } return -EFAULT; } @@ -198,25 +263,26 @@ static int leapraid_db_wait_ack_and_clear_int(struct leapraid_adapter *adapter) u32 int_status; u32 cnt; - cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { int_status = leapraid_readl(&adapter->iomem_base->host_int_status); - if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) { + + if (int_status == 0xFFFFFFFF) + return -EFAULT; + + if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) return 0; - } else if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { + + if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state == LEAPRAID_DB_FAULT) return -EFAULT; - } else if (int_status == 0xFFFFFFFF) { - goto out; } usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } -out: return -EFAULT; } @@ -226,8 +292,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, { int failed, i; - if ((leapraid_readl(&adapter->iomem_base->db) & - LEAPRAID_DB_USED)) { + if (leapraid_readl(&adapter->iomem_base->db) & LEAPRAID_DB_USED) { dev_err(&adapter->pdev->dev, "doorbell used\n"); return -EFAULT; } @@ -242,7 +307,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, &adapter->iomem_base->db); if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -250,7 +315,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, writel(0, &adapter->iomem_base->host_int_status); if (leapraid_db_wait_ack_and_clear_int(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -258,12 +323,12 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0, failed = 0; i < req_bytes / LEAPRAID_DWORDS_BYTE_SIZE && !failed; i++) { - writel((u32)(req[i]), &adapter->iomem_base->db); + writel((u32)req[i], &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) failed = 1; } if (failed) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -271,7 +336,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0; i < rep_bytes / LEAPRAID_WORD_BYTE_SIZE; i++) { if (leapraid_db_wait_int_host(adapter)) { dev_err(&adapter->pdev->dev, - "%d:wait db interrupt timeout\n", __LINE__); + "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } rep[i] = (u16)(leapraid_readl(&adapter->iomem_base->db) @@ -280,7 +345,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, } if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -290,28 +355,32 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, return 0; } -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter) +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller) { - int wait_count = LEAPRAID_DB_WAIT_OPERATIONAL; + int wait_count; - do { - if (leapraid_pci_removed(adapter)) + for (wait_count = wait; wait_count > 0; wait_count--) { + if (leapraid_pci_removed(adapter)) { + dev_warn(&adapter->pdev->dev, + "%s: PCI device removed\n", __func__); return -EFAULT; + } if (leapraid_get_adapter_state(adapter) == LEAPRAID_DB_OPERATIONAL) return 0; - dev_info(&adapter->pdev->dev, - "waiting for adapter to become op status(cnt=%d)\n", - LEAPRAID_DB_WAIT_OPERATIONAL - wait_count); + dev_dbg(&adapter->pdev->dev, + "%s: Wait for adapter to become op status(cnt=%d)\n", + caller, wait - wait_count); ssleep(1); - } while (--wait_count); + } dev_err(&adapter->pdev->dev, - "adapter failed to become op state, last state=%d\n", - leapraid_get_adapter_state(adapter)); + "%s: Adapter failed to become op state, last state=%d\n", + caller, leapraid_get_adapter_state(adapter)); return -EFAULT; } @@ -329,7 +398,7 @@ struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (scmd) - return leapraid_get_scmd_priv(scmd); + return scsi_cmd_priv(scmd); return NULL; } @@ -354,7 +423,8 @@ static u8 leapraid_get_cb_idx(struct leapraid_adapter *adapter, u16 taskid) } struct scsi_cmnd *leapraid_get_scmd_from_taskid( - struct leapraid_adapter *adapter, u16 taskid) + struct leapraid_adapter *adapter, + u16 taskid) { struct leapraid_scsiio_req *leap_mpi_req; struct leapraid_io_req_tracker *st; @@ -372,7 +442,7 @@ struct scsi_cmnd *leapraid_get_scmd_from_taskid( scmd = scsi_host_find_tag(adapter->shost, uniq_tag); if (scmd) { - st = leapraid_get_scmd_priv(scmd); + st = scsi_cmd_priv(scmd); if (st && st->taskid == taskid) return scmd; } @@ -393,7 +463,7 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, adapter->mem_desc.taskid_to_uniq_tag[tag] = blk_mq_unique_tag_to_hwq(unique_tag); - request = leapraid_get_scmd_priv(scmd); + request = scsi_cmd_priv(scmd); taskid = tag + 1; request->taskid = taskid; request->scmd = scmd; @@ -410,8 +480,9 @@ static void leapraid_check_pending_io(struct leapraid_adapter *adapter) } } -static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +static void leapraid_clear_io_tracker( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (!io_tracker) return; @@ -425,17 +496,18 @@ static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, u16 taskid) { - return (taskid == adapter->driver_cmds.ctl_cmd.taskid || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid || - taskid == adapter->driver_cmds.tm_cmd.hp_taskid || - taskid == adapter->driver_cmds.ctl_cmd.hp_taskid || - taskid == adapter->driver_cmds.scan_dev_cmd.inter_taskid || - taskid == adapter->driver_cmds.timestamp_sync_cmd.inter_taskid || - taskid == adapter->driver_cmds.raid_action_cmd.inter_taskid || - taskid == adapter->driver_cmds.transport_cmd.inter_taskid || - taskid == adapter->driver_cmds.cfg_op_cmd.inter_taskid || - taskid == adapter->driver_cmds.enc_cmd.inter_taskid || - taskid == adapter->driver_cmds.notify_event_cmd.inter_taskid); + struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; + + return (taskid == driver_cmds->ctl_cmd.taskid || + taskid == driver_cmds->driver_scsiio_cmd.taskid || + taskid == driver_cmds->tm_cmd.hp_taskid || + taskid == driver_cmds->ctl_cmd.hp_taskid || + taskid == driver_cmds->scan_dev_cmd.inter_taskid || + taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || + taskid == driver_cmds->transport_cmd.inter_taskid || + taskid == driver_cmds->cfg_op_cmd.inter_taskid || + taskid == driver_cmds->enc_cmd.inter_taskid || + taskid == driver_cmds->notify_event_cmd.inter_taskid); } void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid) @@ -531,6 +603,7 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) { struct leapraid_io_req_tracker *io_tracker; struct scsi_cmnd *scmd; + void *task_desc; u16 taskid; for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { @@ -538,15 +611,17 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) if (!scmd) continue; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); if (io_tracker && io_tracker->taskid == 0) continue; scsi_dma_unmap(scmd); + task_desc = leapraid_get_task_desc(adapter, taskid); + memset(task_desc, 0, LEAPRAID_REQUEST_SIZE); leapraid_clear_io_tracker(adapter, io_tracker); if (!leapraid_pci_active(adapter) || adapter->reset_desc.adapter_reset_results != 0 || - adapter->access_ctrl.adapter_thermal_alert || + atomic_read(&adapter->overheat_desc.thermal_alert) || adapter->access_ctrl.host_removing) scmd->result = DID_NO_CONNECT << 16; else @@ -555,36 +630,37 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) } } -static void leapraid_clean_active_driver_cmd( - struct leapraid_driver_cmd *driver_cmd) +static void leapraid_clean_active_driver_cmd(struct leapraid_driver_cmd *cmd) { - if (driver_cmd->status & LEAPRAID_CMD_PENDING) { - driver_cmd->status |= LEAPRAID_CMD_RESET; - complete(&driver_cmd->done); + if (cmd->status & LEAPRAID_CMD_PENDING) { + cmd->status |= LEAPRAID_CMD_RESET; + complete(&cmd->done); } } static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) { - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.raid_action_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.driver_scsiio_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.tm_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.transport_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.enc_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.notify_event_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.cfg_op_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.ctl_cmd); - - if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { - adapter->scan_dev_desc.scan_dev_failed = true; - adapter->driver_cmds.scan_dev_cmd.status |= LEAPRAID_CMD_RESET; + struct leapraid_driver_cmds *driver_cmds; + + driver_cmds = &adapter->driver_cmds; + leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->notify_event_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->cfg_op_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->ctl_cmd); + + if (driver_cmds->scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { + adapter->scan_dev_desc.scan_dev_failed = 1; + driver_cmds->scan_dev_cmd.status |= LEAPRAID_CMD_RESET; if (adapter->scan_dev_desc.driver_loading) { adapter->scan_dev_desc.scan_start_failed = LEAPRAID_ADAPTER_STATUS_INTERNAL_ERROR; - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; } else { - complete(&adapter->driver_cmds.scan_dev_cmd.done); + complete(&driver_cmds->scan_dev_cmd.done); } } } @@ -592,10 +668,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) static void leapraid_clean_active_cmds(struct leapraid_adapter *adapter) { leapraid_clean_active_driver_cmds(adapter); - memset(adapter->dev_topo.pending_dev_add, 0, - adapter->dev_topo.pending_dev_add_sz); - memset(adapter->dev_topo.dev_removing, 0, - adapter->dev_topo.dev_removing_sz); leapraid_clean_active_fw_evt(adapter); leapraid_clean_active_scsi_cmds(adapter); } @@ -604,9 +676,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; unsigned long flags = 0; - u32 adapter_state = 0; + u32 adapter_state; if (adapter->access_ctrl.pcie_recovering) return; @@ -615,15 +687,15 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -637,9 +709,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_card_port *port = NULL; - u64 sas_address = 0; + struct leapraid_sas_dev *sas_dev; + struct leapraid_card_port *port; + u64 sas_address; unsigned long flags; u32 adapter_state; @@ -650,15 +722,15 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; sas_address = sas_dev->sas_addr; port = sas_dev->card_port; } @@ -672,26 +744,30 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) leapraid_sdev_put(sas_dev); } -static inline void leapraid_single_mpi_sg_append(struct leapraid_adapter *adapter, - void *sge, u32 flag_and_len, - dma_addr_t dma_addr) +static inline void leapraid_single_mpi_sg_append( + struct leapraid_adapter *adapter, + void *sge, + u32 flag_and_len, + dma_addr_t dma_addr) { if (adapter->adapter_attr.use_32_dma_mask) { - ((struct leapraid_sge_simple32 *)sge)->flg_and_len = + struct leapraid_sge_simple32 *sge32 = sge; + + sge32->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_32 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple32 *)sge)->addr = - cpu_to_le32(dma_addr); + sge32->addr = cpu_to_le32(dma_addr); } else { - ((struct leapraid_sge_simple64 *)sge)->flg_and_len = + struct leapraid_sge_simple64 *sge64 = sge; + + sge64->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_64 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple64 *)sge)->addr = - cpu_to_le64(dma_addr); + sge64->addr = cpu_to_le64(dma_addr); } } @@ -700,11 +776,12 @@ static inline void leapraid_single_ieee_sg_append(void *sge, u8 flag, u32 len, dma_addr_t dma_addr) { - ((struct leapraid_chain64_ieee_sg *)sge)->flg = flag; - ((struct leapraid_chain64_ieee_sg *)sge)->next_chain_offset = - next_chain_offset; - ((struct leapraid_chain64_ieee_sg *)sge)->len = cpu_to_le32(len); - ((struct leapraid_chain64_ieee_sg *)sge)->addr = cpu_to_le64(dma_addr); + struct leapraid_chain64_ieee_sg *ieee_sg = sge; + + ieee_sg->flg = flag; + ieee_sg->next_chain_offset = next_chain_offset; + ieee_sg->len = cpu_to_le32(len); + ieee_sg->addr = cpu_to_le64(dma_addr); } static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, @@ -712,12 +789,12 @@ static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, { leapraid_single_mpi_sg_append(adapter, sge, - (u32)((LEAPRAID_SGE_FLG_LAST_ONE | - LEAPRAID_SGE_FLG_EOB | - LEAPRAID_SGE_FLG_EOL | - LEAPRAID_SGE_FLG_SIMPLE_ONE) << - LEAPRAID_SGE_FLG_SHIFT), - -1); + (LEAPRAID_SGE_FLG_LAST_ONE | + LEAPRAID_SGE_FLG_EOB | + LEAPRAID_SGE_FLG_EOL | + LEAPRAID_SGE_FLG_SIMPLE_ONE) << + LEAPRAID_SGE_FLG_SHIFT, + LEAPRAID_SGE_NO_DATA_ADDR); } void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, @@ -768,7 +845,7 @@ void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, c2h_size, c2h_dma_addr); } else { - return leapraid_build_nodata_mpi_sg(adapter, sge); + leapraid_build_nodata_mpi_sg(adapter, sge); } } @@ -778,7 +855,9 @@ void leapraid_build_ieee_nodata_sg(struct leapraid_adapter *adapter, void *sge) (LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | LEAPRAID_IEEE_SGE_FLG_EOL), - 0, 0, -1); + 0, + 0, + LEAPRAID_SGE_NO_DATA_ADDR); } int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, @@ -796,7 +875,7 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, u32 chain_offset_in_cur_seg; u32 chain_len_in_cur_seg; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); scmd_sg_cur = scsi_sglist(scmd); sg_entries_left = scsi_dma_map(scmd); @@ -834,7 +913,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, if (chain_offset_in_cur_seg) chain_len_in_cur_seg += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, chain_offset_in_cur_seg, chain_len_in_cur_seg, @@ -844,7 +924,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, goto fill_last_seg; while (sg_entries_in_cur_seg) { - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, 0, sg_dma_len(scmd_sg_cur), @@ -881,39 +962,44 @@ void leapraid_build_ieee_sg(struct leapraid_adapter *adapter, void *sge, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size) { + u32 base_flag; + u32 flag; + + base_flag = LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | + LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR; + if (h2c_size && !c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, h2c_size, h2c_dma_addr); } else if (!h2c_size && c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, c2h_size, c2h_dma_addr); } else if (h2c_size && c2h_size) { leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + base_flag, 0, h2c_size, h2c_dma_addr); sge += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | - LEAPRAID_IEEE_SGE_FLG_EOL, + flag, 0, c2h_size, c2h_dma_addr); } else { - return leapraid_build_ieee_nodata_sg(adapter, sge); + leapraid_build_ieee_nodata_sg(adapter, sge); } } @@ -967,8 +1053,11 @@ static struct leapraid_card_port *leapraid_get_port_by_id( if (unlikely(!adapter->adapter_attr.enable_mp)) { port = kzalloc(sizeof(*port), GFP_ATOMIC); - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed to alloc port\n", __func__); return NULL; + } port->port_id = LEAPRAID_DISABLE_MP_PORT_ID; list_add_tail(&port->list, &adapter->dev_topo.card_port_list); @@ -995,7 +1084,8 @@ struct leapraid_vphy *leapraid_get_vphy_by_phy(struct leapraid_card_port *port, } struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( - struct leapraid_adapter *adapter, u64 sas_address, + struct leapraid_adapter *adapter, + u64 sas_address, struct sas_rphy *rphy) { struct leapraid_sas_dev *sas_dev; @@ -1025,8 +1115,10 @@ struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr( { struct leapraid_sas_dev *sas_dev; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } assert_spin_locked(&adapter->dev_topo.sas_dev_lock); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) @@ -1054,8 +1146,10 @@ struct leapraid_sas_dev *leapraid_get_sas_dev_by_addr( struct leapraid_sas_dev *sas_dev; unsigned long flags; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, @@ -1104,8 +1198,11 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, unsigned long flags; bool del_from_list; - if (!sas_dev) + if (!sas_dev) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid SAS device\n", __func__); return; + } del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); @@ -1115,8 +1212,10 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - if (del_from_list) + if (del_from_list) { + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); + } } static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, @@ -1132,12 +1231,10 @@ static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1162,12 +1259,10 @@ void leapraid_sas_dev_remove_by_sas_address(struct leapraid_adapter *adapter, spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, port); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1181,14 +1276,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_id( struct leapraid_adapter *adapter, uint id, uint channel) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->id == id && - raid_volume->channel == channel) { + if (raid_volume->id == id && raid_volume->channel == channel) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1197,12 +1297,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_hdl( struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->hdl == hdl) + if (raid_volume->hdl == hdl) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1211,12 +1318,19 @@ static struct leapraid_raid_volume *leapraid_raid_volume_find_by_wwid( struct leapraid_adapter *adapter, u64 wwid) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid) + if (raid_volume->wwid == wwid) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1227,6 +1341,7 @@ static void leapraid_raid_volume_add(struct leapraid_adapter *adapter, unsigned long flags; spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_get(raid_volume); list_add_tail(&raid_volume->list, &adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } @@ -1235,11 +1350,24 @@ void leapraid_raid_volume_remove(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume) { unsigned long flags; + bool del_from_list = false; + + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid RAID volume\n", __func__); + return; + } spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_del(&raid_volume->list); - kfree(raid_volume); + if (!list_empty(&raid_volume->list)) { + list_del_init(&raid_volume->list); + del_from_list = true; + } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + leapraid_clear_cached_boot_dev(adapter, raid_volume, RAID_CHANNEL); + if (del_from_list) + leapraid_raid_volume_put(raid_volume); } static struct leapraid_enc_node *leapraid_enc_find_by_hdl( @@ -1247,10 +1375,9 @@ static struct leapraid_enc_node *leapraid_enc_find_by_hdl( { struct leapraid_enc_node *enc_dev; - list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) { + list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) if (le16_to_cpu(enc_dev->pg0.enc_hdl) == hdl) return enc_dev; - } return NULL; } @@ -1261,15 +1388,19 @@ struct leapraid_topo_node *leapraid_exp_find_by_sas_address( { struct leapraid_topo_node *sas_exp; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->sas_address == sas_address && sas_exp->card_port == port) return sas_exp; - } + dev_warn(&adapter->pdev->dev, + "%s: No expander found for SAS addr=0x%016llx port=%p\n", + __func__, (unsigned long long)sas_address, port); return NULL; } @@ -1316,10 +1447,9 @@ static struct leapraid_topo_node *leapraid_exp_find_by_hdl( { struct leapraid_topo_node *sas_exp; - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->hdl == hdl) return sas_exp; - } return NULL; } @@ -1347,7 +1477,7 @@ static enum leapraid_card_port_checking_flg leapraid_get_card_port_feature( return CARD_PORT_FURTHER_CHECKING_NEEDED; } -static int leapraid_process_card_port_feature( +static bool leapraid_process_card_port_feature( struct leapraid_card_port_feature *feature) { struct leapraid_card_port *old_card_port; @@ -1356,8 +1486,10 @@ static int leapraid_process_card_port_feature( if (feature->exact_phy) { feature->checking_state = SAME_PORT_WITH_NOTHING_CHANGED; feature->expected_old_port = old_card_port; - return 1; - } else if (feature->phy_overlap) { + return true; + } + + if (feature->phy_overlap) { if (feature->same_port) { feature->checking_state = SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS; @@ -1368,21 +1500,20 @@ static int leapraid_process_card_port_feature( SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS; feature->expected_old_port = old_card_port; } - } else { - if (feature->checking_state != - SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && - feature->checking_state != - SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { - feature->checking_state = SAME_ADDR_ONLY; - feature->expected_old_port = old_card_port; - feature->same_addr_port_count++; - } + } else if (feature->checking_state != + SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && + feature->checking_state != + SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { + feature->checking_state = SAME_ADDR_ONLY; + feature->expected_old_port = old_card_port; + feature->same_addr_port_count++; } - return 0; + return false; } -static int leapraid_check_card_port(struct leapraid_adapter *adapter, +static int leapraid_check_card_port( + struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_card_port **expected_card_port, int *count) @@ -1428,7 +1559,8 @@ static void leapraid_del_phy_part_of_anther_port( continue; if (card_port_table[i].phy_mask & BIT(offset)) { - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); found = true; @@ -1448,7 +1580,7 @@ static void leapraid_add_or_del_phys_from_existing_port( { struct leapraid_topo_node *card_topo_node; u32 phy_mask_diff; - u32 offset = 0; + u32 offset; card_topo_node = &adapter->dev_topo.card; phy_mask_diff = card_port->phy_mask ^ @@ -1466,12 +1598,15 @@ static void leapraid_add_or_del_phys_from_existing_port( } if (card_topo_node->card_phy[offset].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); - leapraid_transport_attach_phy_to_port(adapter, - card_topo_node, &card_topo_node->card_phy[offset], + leapraid_transport_attach_phy_to_port( + adapter, + card_topo_node, + &card_topo_node->card_phy[offset], card_port->sas_address, card_port); } @@ -1486,7 +1621,8 @@ struct leapraid_sas_dev *leapraid_get_next_sas_dev_from_init_list( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); if (!list_empty(&adapter->dev_topo.sas_dev_init_list)) { sas_dev = list_first_entry(&adapter->dev_topo.sas_dev_init_list, - struct leapraid_sas_dev, list); + struct leapraid_sas_dev, + list); leapraid_sdev_get(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1498,37 +1634,66 @@ static bool leapraid_check_boot_dev_internal(u64 sas_address, u64 dev_name, struct leapraid_boot_dev *boot_dev, u8 form) { + struct leapraid_boot_dev_format_sas_wwid *wwid; + struct leapraid_boot_dev_format_enc_slot *es; + struct leapraid_boot_dev_format_dev_name *dn; + void *pg_dev; + if (!boot_dev) return false; + pg_dev = boot_dev->pg_dev; switch (form & LEAPRAID_BOOTDEV_FORM_MASK) { case LEAPRAID_BOOTDEV_FORM_SAS_WWID: + wwid = pg_dev; + if (!sas_address) return false; - return sas_address == - le64_to_cpu(((struct leapraid_boot_dev_format_sas_wwid *)( - boot_dev->pg_dev))->sas_addr); + return sas_address == le64_to_cpu(wwid->sas_addr); case LEAPRAID_BOOTDEV_FORM_ENC_SLOT: + es = pg_dev; + if (!enc_lid) return false; - return (enc_lid == le64_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->enc_lid) && - slot == le16_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->slot_num)); + return (enc_lid == le64_to_cpu(es->enc_lid) && + slot == le16_to_cpu(es->slot_num)); case LEAPRAID_BOOTDEV_FORM_DEV_NAME: + dn = pg_dev; + if (!dev_name) return false; - return dev_name == le64_to_cpu(((struct leapraid_boot_dev_format_dev_name *)( - boot_dev->pg_dev))->dev_name); + return dev_name == le64_to_cpu(dn->dev_name); case LEAPRAID_BOOTDEV_FORM_NONE: default: return false; } } +void leapraid_boot_dev_get(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_get((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_get((struct leapraid_sas_dev *)dev); +} + +void leapraid_boot_dev_put(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_put((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_put((struct leapraid_sas_dev *)dev); +} + static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, u64 sas_addr, u64 dev_name, u64 enc_lid, u16 slot, @@ -1543,15 +1708,56 @@ static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, slot, boot_dev, boot_dev->form); if (matched) { + leapraid_boot_dev_get(dev, chnl); boot_dev->dev = dev; boot_dev->chnl = chnl; } } +static void leapraid_clear_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, + void *dev, u32 chnl) +{ + void *cached_dev; + u32 cached_chnl; + unsigned long flags; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (boot_dev->dev != dev || boot_dev->chnl != chnl) + goto out_unlock; + + cached_dev = boot_dev->dev; + cached_chnl = boot_dev->chnl; + boot_dev->dev = NULL; + boot_dev->chnl = 0; + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + leapraid_boot_dev_put(cached_dev, cached_chnl); + return; + +out_unlock: + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); +} + +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl) +{ + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + dev, chnl); +} + static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl) { - u64 sas_addr = 0; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + u64 sas_addr; u64 dev_name = 0; u64 enc_lid = 0; u16 slot = 0; @@ -1561,24 +1767,17 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; - + raid_volume = dev; sas_addr = raid_volume->wwid; break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; + sas_dev = dev; sas_addr = sas_dev->sas_addr; dev_name = sas_dev->dev_name; enc_lid = sas_dev->enc_lid; slot = sas_dev->slot; break; } - } leapraid_try_set_boot_dev(&adapter->boot_devs.requested_boot_dev, sas_addr, dev_name, enc_lid, @@ -1591,17 +1790,272 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, slot, dev, chnl); } -static void leapraid_build_and_fire_cfg_req(struct leapraid_adapter *adapter, +static const char *leapraid_func_name(u8 func) +{ + switch (func) { + case LEAPRAID_FUNC_SCSIIO: + return "SCSIIO"; + case LEAPRAID_FUNC_SCSI_TMF: + return "SCSI_TMF"; + case LEAPRAID_FUNC_ADAPTER_INIT: + return "ADAPTER_INIT"; + case LEAPRAID_FUNC_GET_ADAPTER_FEATURES: + return "GET_ADAPTER_FEATURES"; + case LEAPRAID_FUNC_CONFIG_OP: + return "CONFIG_OP"; + case LEAPRAID_FUNC_SCAN_DEV: + return "SCAN_DEV"; + case LEAPRAID_FUNC_EVENT_NOTIFY: + return "EVENT_NOTIFY"; + case LEAPRAID_FUNC_FW_DOWNLOAD: + return "FW_DOWNLOAD"; + case LEAPRAID_FUNC_FW_UPLOAD: + return "FW_UPLOAD"; + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + return "SCSIIO_RAID_PASSTHROUGH"; + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: + return "SCSI_ENC_PROCESSOR"; + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + return "SMP_PASSTHROUGH"; + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: + return "SAS_IO_UNIT_CTRL"; + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + return "SCSIIO_SATA_PASSTHROUGH"; + case LEAPRAID_FUNC_ADAPTER_UNIT_RESET: + return "ADAPTER_UNIT_RESET"; + case LEAPRAID_FUNC_HANDSHAKE: + return "HANDSHAKE"; + case LEAPRAID_FUNC_LOGBUF_INIT: + return "LOGBUF_INIT"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_CFG_ACT_PAGE_HEADER: + return "PAGE_HEADER"; + case LEAPRAID_CFG_ACT_PAGE_READ_CUR: + return "PAGE_READ_CUR"; + case LEAPRAID_CFG_ACT_PAGE_WRITE_CUR: + return "PAGE_WRITE_CUR"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_page_type_name(u8 page_type) +{ + switch (page_type) { + case LEAPRAID_CFG_PT_IO_UNIT: + return "IO_UNIT"; + case LEAPRAID_CFG_PT_ADAPTER: + return "ADAPTER"; + case LEAPRAID_CFG_PT_BIOS: + return "BIOS"; + case LEAPRAID_CFG_PT_RAID_VOLUME: + return "RAID_VOLUME"; + case LEAPRAID_CFG_PT_MANUFACTURING: + return "MANUFACTURING"; + case LEAPRAID_CFG_PT_RAID_PHYSDISK: + return "RAID_PHYSDISK"; + case LEAPRAID_CFG_PT_EXTENDED: + return "EXTENDED"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_ext_page_type_name(u8 ext_page_type) +{ + switch (ext_page_type) { + case LEAPRAID_CFG_EXTPT_SAS_IO_UNIT: + return "SAS_IO_UNIT"; + case LEAPRAID_CFG_EXTPT_SAS_EXP: + return "SAS_EXPANDER"; + case LEAPRAID_CFG_EXTPT_SAS_DEV: + return "SAS_DEVICE"; + case LEAPRAID_CFG_EXTPT_SAS_PHY: + return "SAS_PHY"; + case LEAPRAID_CFG_EXTPT_ENC: + return "ENCLOSURE"; + case LEAPRAID_CFG_EXTPT_RAID_CONFIG: + return "RAID_CONFIG"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sep_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_SEP_REQ_ACT_WRITE_STATUS: + return "WRITE_STATUS"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sas_op_name(u8 op) +{ + switch (op) { + case LEAPRAID_SAS_OP_PHY_LINK_RESET: + return "PHY_LINK_RESET"; + case LEAPRAID_SAS_OP_PHY_HARD_RESET: + return "PHY_HARD_RESET"; + case LEAPRAID_SAS_OP_SET_PARAMETER: + return "SET_PARAMETER"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_io_param_name(u8 adapter_param) +{ + switch (adapter_param) { + case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: + return "SYNC_TIMESTAMP"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_tm_type_name(u8 task_type) +{ + switch (task_type) { + case LEAPRAID_TM_TASKTYPE_ABORT_TASK: + return "ABORT_TASK"; + case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: + return "ABORT_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_TARGET_RESET: + return "TARGET_RESET"; + case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: + return "LOGICAL_UNIT_RESET"; + case LEAPRAID_TM_TASKTYPE_CLEAR_TASK_SET: + return "CLEAR_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK: + return "QUERY_TASK"; + case LEAPRAID_TM_TASKTYPE_CLEAR_ACA: + return "CLEAR_ACA"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK_SET: + return "QUERY_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_ASYNC_EVENT: + return "QUERY_ASYNC_EVENT"; + default: + return "UNKNOWN"; + } +} + +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data) +{ + const struct leapraid_req *req = req_data; + + if (!adapter || !adapter->pdev || !req_data) + return; + + switch (req->func) { + case LEAPRAID_FUNC_CONFIG_OP: { + const struct leapraid_cfg_req *cfg_req = req_data; + + dev_err(&adapter->pdev->dev, + "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + cfg_req->action, + leapraid_cfg_action_name(cfg_req->action)); + dev_err(&adapter->pdev->dev, + "cfg-req: page_type=0x%02x(%s) page_num=%u\n", + cfg_req->header.page_type, + leapraid_cfg_page_type_name(cfg_req->header.page_type), + cfg_req->header.page_num); + if (cfg_req->header.page_type == LEAPRAID_CFG_PT_EXTENDED) + dev_err(&adapter->pdev->dev, + "cfg-req: ext_page_type=0x%02x(%s)\n", + cfg_req->ext_page_type, + leapraid_cfg_ext_page_type_name( + cfg_req->ext_page_type)); + dev_err(&adapter->pdev->dev, "cfg-req: page_addr=0x%08x\n", + le32_to_cpu(cfg_req->page_addr)); + break; + } + case LEAPRAID_FUNC_SCSI_TMF: { + const struct leapraid_scsi_tm_req *tm_req = req_data; + + dev_err(&adapter->pdev->dev, + "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + tm_req->task_type, + leapraid_tm_type_name(tm_req->task_type)); + dev_err(&adapter->pdev->dev, + "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + le16_to_cpu(tm_req->dev_hdl), + le16_to_cpu(tm_req->task_mid)); + break; + } + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: { + const struct leapraid_sep_req *sep_req = req_data; + + dev_err(&adapter->pdev->dev, + "sep: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + sep_req->act, + leapraid_sep_action_name(sep_req->act)); + dev_err(&adapter->pdev->dev, + "sep: dev_hdl=0x%04x slot=%u enc_hdl=0x%04x\n", + le16_to_cpu(sep_req->dev_hdl), + le16_to_cpu(sep_req->slot), + le16_to_cpu(sep_req->enc_hdl)); + break; + } + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: { + const struct leapraid_io_unit_ctrl_req *io_req = req_data; + + dev_err(&adapter->pdev->dev, + "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + io_req->op, leapraid_sas_op_name(io_req->op)); + dev_err(&adapter->pdev->dev, + "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + le16_to_cpu(io_req->dev_hdl), + io_req->adapter_para, + leapraid_io_param_name(io_req->adapter_para)); + break; + } + case LEAPRAID_FUNC_SMP_PASSTHROUGH: { + const struct leapraid_smp_passthrough_req *smp_req = req_data; + + dev_err(&adapter->pdev->dev, + "transport: func=0x%02x(%s) port=%u req_len=%u\n", + req->func, leapraid_func_name(req->func), + smp_req->physical_port, + le16_to_cpu(smp_req->req_data_len)); + dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + (unsigned long long)le64_to_cpu(smp_req->sas_address)); + break; + } + default: + dev_err(&adapter->pdev->dev, + "%s: func=0x%02x(%s)\n", + __func__, req->func, leapraid_func_name(req->func)); + break; + } +} + +static void leapraid_build_and_fire_cfg_req( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); - memset((void *)(&adapter->driver_cmds.cfg_op_cmd.reply), 0, + memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc(adapter, + local_leap_cfg_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.cfg_op_cmd.inter_taskid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); @@ -1629,17 +2083,18 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { rc = -EFAULT; - goto out; + goto out_cleanup; } dev_warn(&adapter->pdev->dev, - "cfg-req: retry request, cnt=%u\n", retry_cnt); + "cfg-req: Retry request, cnt=%u\n", retry_cnt); } - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: adapter not operational\n"); - goto out; + "cfg-req: Adapter not operational\n"); + goto out_cleanup; } leapraid_build_and_fire_cfg_req(adapter, leap_mpi_cfgp_req, @@ -1649,44 +2104,47 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_RESET) { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg due to hard reset\n"); + "cfg-req: CMD fail due to hard reset\n"); goto retry; } if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { dev_err(&adapter->pdev->dev, - "cfg-req: cmd not done during %s, skip reset\n", + "cfg-req: pending in %s, status=0x%x\n", adapter->access_ctrl.shost_recovering ? - "shost recovery" : "pcie recovery"); + "shost recovery" : "pcie recovery", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, - "cfg-req: cmd timeout, issuing hard reset\n"); + "cfg-req: timeout, status=0x%x, reset\n", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = true; } - goto out; + goto out_cleanup; } if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_REPLY_VALID) { memcpy(leap_mpi_cfgp_rep, - (void *)(&adapter->driver_cmds.cfg_op_cmd.reply), + &adapter->driver_cmds.cfg_op_cmd.reply, sizeof(struct leapraid_cfg_rep)); adapter_status = le16_to_cpu( leap_mpi_cfgp_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS) { - if (target_cfg_pg && real_cfg_pg_addr && - target_real_cfg_pg_sz) - if (leap_mpi_cfgp_req->action == - LEAPRAID_CFG_ACT_PAGE_READ_CUR) - memcpy(target_cfg_pg, - real_cfg_pg_addr, - target_real_cfg_pg_sz); - } else { + if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS && + target_cfg_pg && real_cfg_pg_addr && + target_real_cfg_pg_sz && + leap_mpi_cfgp_req->action == + LEAPRAID_CFG_ACT_PAGE_READ_CUR) + memcpy(target_cfg_pg, real_cfg_pg_addr, + target_real_cfg_pg_sz); + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { if (adapter_status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, @@ -1695,30 +2153,30 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, rc = -EFAULT; } } else { - dev_err(&adapter->pdev->dev, "cfg-rep: reply invalid\n"); + dev_err(&adapter->pdev->dev, "cfg-rep: Reply invalid\n"); rc = -EFAULT; } -out: +out_cleanup: adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { dev_info(&adapter->pdev->dev, - "%s:%d cfg-req: failure, issuing reset\n", + "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = -EFAULT; } else { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg during init, skip reset\n"); - rc = -EFAULT; + "cfg-req: CMD fail in init, skip reset\n"); } + rc = -EFAULT; } return rc; } -static int leapraid_request_cfg_pg_header(struct leapraid_adapter *adapter, +static int leapraid_request_cfg_pg_header( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { @@ -1744,8 +2202,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, { struct leapraid_cfg_req leap_mpi_cfgp_req; struct leapraid_cfg_rep leap_mpi_cfgp_rep; - u16 real_cfg_pg_sz = 0; - void *real_cfg_pg_addr = NULL; + u16 real_cfg_pg_sz; + void *real_cfg_pg_addr; dma_addr_t real_cfg_pg_dma = 0; u32 __page_size; int rc; @@ -1767,6 +2225,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, LEAPRAID_CFG_PAGE_NUM_BIOS2; __page_size = sizeof(struct leapraid_bios_page2); break; + case GET_MANUFACTURING_PG0: + leap_mpi_cfgp_req.header.page_type = + LEAPRAID_CFG_PT_MANUFACTURING; + leap_mpi_cfgp_req.header.page_num = + LEAPRAID_CFG_PAGE_NUM_MANU0; + __page_size = sizeof(struct leapraid_manufacturing_p0); + break; case GET_SAS_DEVICE_PG0: leap_mpi_cfgp_req.header.page_type = LEAPRAID_CFG_PT_EXTENDED; leap_mpi_cfgp_req.ext_page_type = LEAPRAID_CFG_EXTPT_SAS_DEV; @@ -1833,9 +2298,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, break; default: dev_err(&adapter->pdev->dev, - "unsupported config page action=%d!\n", cfg_op); - rc = -EINVAL; - goto out; + "Unsupported config page action=%d!\n", cfg_op); + return -EINVAL; } leapraid_build_nodata_mpi_sg(adapter, @@ -1845,8 +2309,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, &leap_mpi_cfgp_rep); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: header failed rc=%dn", rc); - goto out; + "cfg-req: Header failed rc=%dn", rc); + return rc; } if (cfg_op == GET_SAS_DEVICE_PG0 || @@ -1882,17 +2346,14 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, leap_mpi_cfgp_req.ext_page_type = leap_mpi_cfgp_rep.ext_page_type; real_cfg_pg_sz = (leap_mpi_cfgp_req.header.page_len) ? - leap_mpi_cfgp_req.header.page_len * 4 : - le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * 4; + leap_mpi_cfgp_req.header.page_len * sizeof(u32) : + le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * sizeof(u32); real_cfg_pg_addr = dma_alloc_coherent(&adapter->pdev->dev, real_cfg_pg_sz, &real_cfg_pg_dma, GFP_KERNEL); - if (!real_cfg_pg_addr) { - dev_err(&adapter->pdev->dev, "cfg-req: dma alloc failed\n"); - rc = -ENOMEM; - goto out; - } + if (!real_cfg_pg_addr) + return -ENOMEM; if (leap_mpi_cfgp_req.action == LEAPRAID_CFG_ACT_PAGE_WRITE_CUR) { leapraid_single_mpi_sg_append(adapter, @@ -1929,12 +2390,11 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_addr, min_t(u16, real_cfg_pg_sz, __page_size)); if (rc) { - u32 adapter_status; + u32 status; - adapter_status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != - LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) + status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, "cfg-req: rc=%d, pg_info: 0x%x, 0x%x, %d\n", rc, leap_mpi_cfgp_req.header.page_type, @@ -1947,10 +2407,52 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_sz, real_cfg_pg_addr, real_cfg_pg_dma); -out: + return rc; } +static int leapraid_cfg_find_vol_in_page( + struct leapraid_raid_cfg_p0 *raid_cfg_p0, + u16 pd_hdl, u16 *vol_hdl) +{ + u16 elements = raid_cfg_p0->elements_num; + int i; + + for (i = 0; i < elements; i++) { + struct leapraid_raid_cfg_p0_element *elem; + u16 type; + + elem = &raid_cfg_p0->cfg_element[i]; + + type = le16_to_cpu(elem->element_flg) & + LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; + + switch (type) { + case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: + case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: { + u16 phys_hdl; + + phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); + + if (phys_hdl == pd_hdl) { + *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); + return 0; + } + break; + } + + case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: + *vol_hdl = 0; + return 0; + + default: + break; + } + } + + return -ENOENT; +} + static int leapraid_cfg_get_volume_hdl_dispatch( struct leapraid_adapter *adapter, struct leapraid_cfg_req *cfg_req, @@ -1961,13 +2463,11 @@ static int leapraid_cfg_get_volume_hdl_dispatch( u16 raid_cfg_p0_sz, u16 pd_hdl, u16 *vol_hdl) { - u16 phys_disk_dev_hdl; u16 adapter_status; - u16 element_type; int config_num; - int rc, i; + int rc; - config_num = 0xff; + config_num = 0xFF; while (true) { cfg_req->page_addr = cpu_to_le32(config_num + @@ -1988,35 +2488,14 @@ static int leapraid_cfg_get_volume_hdl_dispatch( } if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - return -1; - - for (i = 0; i < raid_cfg_p0->elements_num; i++) { - element_type = - le16_to_cpu(raid_cfg_p0->cfg_element[i].element_flg) & - LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; - - switch (element_type) { - case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: - case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: - phys_disk_dev_hdl = - le16_to_cpu(raid_cfg_p0->cfg_element[i] - .phys_disk_dev_hdl); - if (phys_disk_dev_hdl == pd_hdl) { - *vol_hdl = - le16_to_cpu - (raid_cfg_p0->cfg_element[i] - .vol_dev_hdl); - return 0; - } - break; + return LEAPRAID_OPERATION_FAILED; + + rc = leapraid_cfg_find_vol_in_page(raid_cfg_p0, + pd_hdl, + vol_hdl); + if (rc != -ENOENT) + return rc; - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: - *vol_hdl = 0; - return 0; - default: - break; - } - } config_num = raid_cfg_p0->cfg_num; } return 0; @@ -2025,12 +2504,12 @@ static int leapraid_cfg_get_volume_hdl_dispatch( int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, u16 pd_hdl, u16 *vol_hdl) { - struct leapraid_raid_cfg_p0 *raid_cfg_p0 = NULL; + struct leapraid_raid_cfg_p0 *raid_cfg_p0; struct leapraid_cfg_req cfg_req; struct leapraid_cfg_rep cfg_rep; dma_addr_t real_cfg_pg_dma = 0; - void *real_cfg_pg_addr = NULL; - u16 real_cfg_pg_sz = 0; + void *real_cfg_pg_addr; + u16 real_cfg_pg_sz; int rc, raid_cfg_p0_sz; *vol_hdl = 0; @@ -2044,16 +2523,14 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, leapraid_build_nodata_mpi_sg(adapter, &cfg_req.page_buf_sge); rc = leapraid_request_cfg_pg_header(adapter, &cfg_req, &cfg_rep); if (rc) - goto out; + return rc; cfg_req.action = LEAPRAID_CFG_ACT_PAGE_READ_CUR; raid_cfg_p0_sz = le16_to_cpu(cfg_rep.ext_page_len) * LEAPRAID_CFG_UNIT_SIZE; raid_cfg_p0 = kmalloc(raid_cfg_p0_sz, GFP_KERNEL); - if (!raid_cfg_p0) { - rc = -1; - goto out; - } + if (!raid_cfg_p0) + return -ENOMEM; real_cfg_pg_sz = (cfg_req.header.page_len) ? cfg_req.header.page_len * LEAPRAID_CFG_UNIT_SIZE : @@ -2064,7 +2541,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, GFP_KERNEL); if (!real_cfg_pg_addr) { rc = -ENOMEM; - goto out; + goto out_free; } memset(raid_cfg_p0, 0, raid_cfg_p0_sz); @@ -2088,7 +2565,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, raid_cfg_p0_sz, pd_hdl, vol_hdl); -out: +out_free: if (real_cfg_pg_addr) dma_free_coherent(&adapter->pdev->dev, real_cfg_pg_sz, real_cfg_pg_addr, @@ -2103,7 +2580,7 @@ static int leapraid_get_adapter_phys(struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 sas_io_unit_page0; union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - int rc = 0; + int rc; *nr_phys = 0; cfgp1.size = sizeof(struct leapraid_sas_io_unit_p0); @@ -2156,7 +2633,8 @@ int leapraid_cfg_get_volume_wwid(struct leapraid_adapter *adapter, return rc; } -static int leapraid_get_sas_io_unit_page0(struct leapraid_adapter *adapter, +static int leapraid_get_sas_io_unit_page0( + struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 *sas_io_unit_p0, u16 sas_iou_pg0_sz) { @@ -2178,8 +2656,8 @@ static int leapraid_get_sas_address(struct leapraid_adapter *adapter, *sas_address = 0; cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; if (hdl <= adapter->dev_topo.card.phys_num && @@ -2201,9 +2679,10 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raidpd_p0 raidpd_p0; u8 num_pds; u16 sz; + int rc = 0; - if ((leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, - &num_pds)) || !num_pds) + if (leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, + &num_pds) || !num_pds) return -EFAULT; raid_volume->pd_num = num_pds; @@ -2211,14 +2690,14 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, (num_pds * sizeof(struct leapraid_raidvol0_phys_disk)); raidvol_p0 = kzalloc(sz, GFP_KERNEL); if (!raidvol_p0) - return -EFAULT; + return -ENOMEM; cfgp1.size = sz; cfgp2.handle = raid_volume->hdl; - if ((leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, - GET_RAID_VOLUME_PG0))) { - kfree(raidvol_p0); - return -EFAULT; + if (leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, + GET_RAID_VOLUME_PG0)) { + rc = -EFAULT; + goto out_cleanup; } raid_volume->vol_type = raidvol_p0->volume_type; @@ -2229,14 +2708,28 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = le16_to_cpu(raidpd_p0.dev_hdl); if (!(leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) { + cfgp2, GET_SAS_DEVICE_PG0))) raid_volume->dev_info = le32_to_cpu(sas_dev_p0.dev_info); - } } +out_cleanup: kfree(raidvol_p0); - return 0; + return rc; +} + +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter) +{ + unsigned long flags; + bool skip; + + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + skip = adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.pcie_recovering || + adapter->access_ctrl.host_removing; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + + return skip; } static void leapraid_fw_log_work(struct work_struct *work) @@ -2244,26 +2737,34 @@ static void leapraid_fw_log_work(struct work_struct *work) struct leapraid_adapter *adapter = container_of(work, struct leapraid_adapter, fw_log_desc.fw_log_work.work); struct leapraid_fw_log_info *infom; + struct leapraid_reg_base __iomem *iomem_base; unsigned long flags; - infom = (struct leapraid_fw_log_info *)(adapter->fw_log_desc.fw_log_buffer + - LEAPRAID_SYS_LOG_BUF_SIZE); + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + infom = (struct leapraid_fw_log_info *) + (adapter->fw_log_desc.fw_log_buffer + + LEAPRAID_SYS_LOG_BUF_SIZE); + iomem_base = adapter->iomem_base; if (adapter->fw_log_desc.fw_log_init_flag == 0) { infom->user_position = - leapraid_readl(&adapter->iomem_base->host_log_buf_pos); + leapraid_readl(&iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); adapter->fw_log_desc.fw_log_init_flag++; } - writel(infom->user_position, &adapter->iomem_base->host_log_buf_pos); + writel(infom->user_position, &iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); +scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2282,7 +2783,8 @@ void leapraid_fw_log_stop(struct leapraid_adapter *adapter) adapter->fw_log_desc.fw_log_wq = NULL; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); if (wq) { - if (!cancel_delayed_work_sync(&adapter->fw_log_desc.fw_log_work)) + if (!cancel_delayed_work_sync(&adapter->fw_log_desc + .fw_log_work)) flush_workqueue(wq); destroy_workqueue(wq); } @@ -2312,7 +2814,8 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2323,12 +2826,13 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; ktime_t current_time; bool issue_reset = false; - u64 time_stamp = 0; + u64 time_stamp; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; io_unit_ctrl_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; @@ -2343,18 +2847,27 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - wait_for_completion_timeout(&adapter->driver_cmds.timestamp_sync_cmd.done, + leapraid_fire_task( + adapter, + adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_debug_log_info(adapter); + wait_for_completion_timeout(&adapter->driver_cmds + .timestamp_sync_cmd.done, LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) + LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: timestamp sync timeout, status=0x%x\n", + __func__, + adapter->driver_cmds.timestamp_sync_cmd.status); + leapraid_log_req_context(adapter, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); + } if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } @@ -2363,20 +2876,6 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); } -static bool leapraid_should_skip_fault_check(struct leapraid_adapter *adapter) -{ - unsigned long flags; - bool skip; - - spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - skip = adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.host_removing; - spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); - - return skip; -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2387,16 +2886,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter = container_of(work, struct leapraid_adapter, reset_desc.fault_reset_work.work); - if (leapraid_should_skip_fault_check(adapter)) + if (leapraid_should_skip_poll_work(adapter)) goto scheduled_timer; adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: hard reset: %s\n", - __func__, (rc == 0) ? "success" : "failed"); + dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", + __func__, rc == 0 ? "success" : "failed"); adapter_state = leapraid_get_adapter_state(adapter); if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) @@ -2412,7 +2911,8 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2437,14 +2937,15 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) adapter->reset_desc.fault_reset_wq_name); if (!adapter->reset_desc.fault_reset_wq) { dev_err(&adapter->pdev->dev, - "create single thread workqueue failed!\n"); + "Create single thread workqueue failed!\n"); return; } spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, - &adapter->reset_desc.fault_reset_work, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, + &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } @@ -2471,17 +2972,24 @@ static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, u16 hdl) { if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) - return false; - - if (leapraid_check_adapter_is_op(adapter)) + adapter->access_ctrl.shost_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", + __func__, + adapter->access_ctrl.pcie_recovering, + adapter->access_ctrl.shost_recovering); return false; + } - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) return false; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.dev_removing)) + if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { + dev_err(&adapter->pdev->dev, + "%s: Device handle is invalid\n", __func__); return false; + } return true; } @@ -2490,13 +2998,13 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, struct leapraid_scsi_cmd_desc *cmd_desc) { struct scsi_device *sdev; + struct scsi_device *target_sdev = NULL; struct leapraid_sdev_priv *sdev_priv; struct scsi_cmnd *scmd; void *dma_buffer = NULL; - dma_addr_t dma_addr = 0; - u8 sdev_flg = 0; + dma_addr_t dma_addr; bool issue_reset = false; - int rc = 0; + int rc; if (WARN_ON(!adapter->driver_cmds.internal_scmd)) return -EINVAL; @@ -2507,23 +3015,28 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); if (adapter->driver_cmds.driver_scsiio_cmd.status != LEAPRAID_CMD_NOT_USED) { + dev_err(&adapter->pdev->dev, + "%s: scsiio cmd busy\n", __func__); rc = -EAGAIN; - goto out; + goto out_cleanup; } adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; + if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && sdev_priv->lun == cmd_desc->lun) { - sdev_flg = 1; + target_sdev = sdev; break; } } - if (!sdev_flg) { + if (!target_sdev) { + dev_warn(&adapter->pdev->dev, + "%s: Device not found\n", __func__); rc = -ENXIO; - goto out; + goto out_cleanup; } if (cmd_desc->data_length) { @@ -2532,7 +3045,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, &dma_addr, GFP_ATOMIC); if (!dma_buffer) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (cmd_desc->dir == DMA_TO_DEVICE) memcpy(dma_buffer, cmd_desc->data_buffer, @@ -2540,7 +3053,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, } scmd = adapter->driver_cmds.internal_scmd; - scmd->device = sdev; + scmd->device = target_sdev; scmd->cmd_len = cmd_desc->cdb_length; memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); scmd->sc_data_direction = cmd_desc->dir; @@ -2553,11 +3066,14 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, adapter->driver_cmds.driver_scsiio_cmd.status &= ~LEAPRAID_CMD_PENDING; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); + dev_err(&adapter->pdev->dev, + "%s: queuecommand failed\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } - wait_for_completion_timeout(&adapter->driver_cmds.driver_scsiio_cmd.done, + wait_for_completion_timeout(&adapter->driver_cmds + .driver_scsiio_cmd.done, cmd_desc->time_out * HZ); if (!(adapter->driver_cmds.driver_scsiio_cmd.status & @@ -2579,15 +3095,22 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, rc = -ENODATA; dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", cmd_desc->hdl); - leapraid_issue_locked_tm(adapter, cmd_desc->hdl, 0, 0, 0, + leapraid_issue_locked_tm( + adapter, cmd_desc->hdl, 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, adapter->driver_cmds.driver_scsiio_cmd.taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } -out: +out_cleanup: + if (target_sdev) + scsi_device_put(target_sdev); + if (dma_buffer) dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, dma_buffer, dma_addr); + cmd_desc->data_length, + dma_buffer, + dma_addr); + adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); return rc; @@ -2597,7 +3120,8 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, u16 hdl, u32 lun) { struct leapraid_scsi_cmd_desc *desc; - int rc = 0; + char *buf; + int rc; desc = kzalloc(sizeof(*desc), GFP_KERNEL); if (!desc) @@ -2611,7 +3135,7 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, desc->cdb[0] = LOG_SENSE; desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; desc->cdb[8] = desc->data_length; - desc->raid_member = false; + desc->raid_member = 0; desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); @@ -2621,11 +3145,10 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, } rc = leapraid_dispatch_scsi_io(adapter, desc); - if (!rc) { - if (((char *)desc->data_buffer)[8] == - LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - } + buf = desc->data_buffer; + + if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) + leapraid_smart_fault_detect(adapter, hdl); kfree(desc->data_buffer); kfree(desc); @@ -2637,31 +3160,32 @@ static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, struct leapraid_sdev_priv *sdev_priv, u32 reset_flg) { - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; if (!sdev_priv || !sdev_priv->starget_priv->card_port) - goto out; + return false; - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev || !sas_dev->support_smart) - goto out; + goto out_fail; if (reset_flg) - sas_dev->led_on = false; + sas_dev->led_on = 0; else if (sas_dev->led_on) - goto out; + goto out_fail; - if ((sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) || + if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || sdev_priv->block) - goto out; + goto out_fail; leapraid_sdev_put(sas_dev); return true; -out: +out_fail: if (sas_dev) leapraid_sdev_put(sas_dev); return false; @@ -2674,16 +3198,21 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) smart_poll_desc.smart_poll_work.work); struct scsi_device *sdev; struct leapraid_sdev_priv *sdev_priv; - static u32 reset_cnt; bool reset_flg = false; - if (leapraid_check_adapter_is_op(adapter)) - goto out; + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) + goto scheduled_timer; + + if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) + reset_flg = true; - reset_flg = (reset_cnt < adapter->reset_desc.reset_cnt); - reset_cnt = adapter->reset_desc.reset_cnt; + adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) leapraid_dispatch_logsense(adapter, @@ -2691,11 +3220,12 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) sdev_priv->lun); } -out: +scheduled_timer: if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); + queue_delayed_work( + adapter->smart_poll_desc.smart_poll_wq, + &adapter->smart_poll_desc.smart_poll_work, + msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); } void leapraid_smart_polling_start(struct leapraid_adapter *adapter) @@ -2724,20 +3254,118 @@ void leapraid_smart_polling_start(struct leapraid_adapter *adapter) void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) { struct workqueue_struct *wq; + struct leapraid_smart_poll_desc *desc; - if (!adapter->smart_poll_desc.smart_poll_wq) + desc = &adapter->smart_poll_desc; + if (!desc->smart_poll_wq) return; - wq = adapter->smart_poll_desc.smart_poll_wq; - adapter->smart_poll_desc.smart_poll_wq = NULL; + wq = desc->smart_poll_wq; + desc->smart_poll_wq = NULL; if (wq) { - if (!cancel_delayed_work_sync(&adapter->smart_poll_desc.smart_poll_work)) + if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); destroy_workqueue(wq); } } +static void leapraid_overheat_work(struct work_struct *work) +{ + struct leapraid_overheat_desc *desc; + struct leapraid_adapter *adapter; + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + unsigned long flags; + + desc = container_of(work, struct leapraid_overheat_desc, + fault_overheat_work); + adapter = container_of(desc, struct leapraid_adapter, overheat_desc); + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_err(&pdev->dev, + "Overheat processing failed: invalid host/adapter\n"); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + if (adapter->access_ctrl.host_removing) { + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + adapter->access_ctrl.host_removing = 1; + adapter->access_ctrl.shost_recover_async = 0; + adapter->scan_dev_desc.scan_start = 0; + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + wake_up(&adapter->access_ctrl.shost_recover_wq); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + + leapraid_mask_int(adapter); + + leapraid_smart_polling_stop(adapter); + leapraid_check_scheduled_fault_stop(adapter); + leapraid_fw_log_stop(adapter); + leapraid_mq_polling_pause(adapter); + + leapraid_clean_active_cmds(adapter); + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + wq = adapter->fw_evt_s.fw_evt_thread; + adapter->fw_evt_s.fw_evt_thread = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (wq) + destroy_workqueue(wq); + + sas_remove_host(shost); + leapraid_cleanup_lists(adapter); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + dev_err(&pdev->dev, "%s: Suspend adapter due to overheat\n", __func__); +} + +static void leapraid_overheat_init(struct leapraid_adapter *adapter) +{ + if (adapter->overheat_desc.fault_overheat_wq) + return; + + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + snprintf(adapter->overheat_desc.fault_overheat_wq_name, + sizeof(adapter->overheat_desc.fault_overheat_wq_name), + "driver_%s%u_overheat", + LEAPRAID_DRIVER_NAME, + adapter->adapter_attr.id); + adapter->overheat_desc.fault_overheat_wq = + create_singlethread_workqueue( + adapter->overheat_desc.fault_overheat_wq_name); + if (!adapter->overheat_desc.fault_overheat_wq) { + dev_err(&adapter->pdev->dev, + "Failed to create overheat workqueue\n"); + return; + } + + INIT_WORK(&adapter->overheat_desc.fault_overheat_work, + leapraid_overheat_work); +} + +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter) +{ + struct workqueue_struct *wq; + + wq = xchg(&adapter->overheat_desc.fault_overheat_wq, NULL); + if (!wq) + return; + + cancel_work_sync(&adapter->overheat_desc.fault_overheat_work); + destroy_workqueue(wq); +} + static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt); @@ -2822,7 +3450,6 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( fw_evt = list_first_entry(&adapter->fw_evt_s.fw_evt_list, struct leapraid_fw_evt_work, list); list_del_init(&fw_evt->list); - leapraid_fw_evt_put(fw_evt); } spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return fw_evt; @@ -2831,56 +3458,65 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) { struct leapraid_fw_evt_work *fw_evt; - bool rc = false; + unsigned long flags; + bool in_fw_evt_context; + bool rc; if ((list_empty(&adapter->fw_evt_s.fw_evt_list) && !adapter->fw_evt_s.cur_evt) || !adapter->fw_evt_s.fw_evt_thread) return; adapter->fw_evt_s.fw_evt_cleanup = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; - while ((fw_evt = leapraid_next_fw_evt(adapter)) || - (fw_evt = adapter->fw_evt_s.cur_evt)) { - if (fw_evt == adapter->fw_evt_s.cur_evt && - adapter->fw_evt_s.cur_evt->evt_type != - LEAPRAID_EVT_REMOVE_DEAD_DEV) { - adapter->fw_evt_s.cur_evt = NULL; - continue; - } - + while ((fw_evt = leapraid_next_fw_evt(adapter))) { rc = cancel_work_sync(&fw_evt->work); - if (rc) leapraid_fw_evt_put(fw_evt); + leapraid_fw_evt_put(fw_evt); } + + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + fw_evt = adapter->fw_evt_s.cur_evt; + if (fw_evt) { + in_fw_evt_context = adapter->fw_evt_s.cur_evt_task == current; + leapraid_fw_evt_get(fw_evt); + } + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (fw_evt) { + if (!in_fw_evt_context) + cancel_work_sync(&fw_evt->work); + leapraid_fw_evt_put(fw_evt); + } + adapter->fw_evt_s.fw_evt_cleanup = 0; } static void leapraid_internal_dev_ublk(struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: now internal unblkg dev\n", + "hdl 0x%04x: Now internal unblkg dev\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc == -EINVAL) { sdev_printk(KERN_WARNING, sdev, "hdl 0x%04x: unblkg failed, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc) sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: blkg failed: earlier unblkg err, rc=%d\n", + "hdl 0x%04x: Earlier ublkg err, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc) sdev_printk(KERN_WARNING, sdev, @@ -2889,38 +3525,6 @@ static void leapraid_internal_dev_ublk(struct scsi_device *sdev, } } -static void leapraid_internal_ublk_io_dev_to_running(struct scsi_device *sdev) -{ - struct leapraid_sdev_priv *sdev_priv; - - sdev_priv = sdev->hostdata; - sdev_priv->block = false; - scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); - sdev_printk(KERN_WARNING, sdev, "%s: ublk hdl 0x%04x\n", - __func__, sdev_priv->starget_priv->hdl); -} - -static void leapraid_ublk_io_dev_to_running( - struct leapraid_adapter *adapter, u64 sas_addr, - struct leapraid_card_port *card_port) -{ - struct leapraid_sdev_priv *sdev_priv; - struct scsi_device *sdev; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->sas_address != sas_addr || - sdev_priv->starget_priv->card_port != card_port) - continue; - - if (sdev_priv->block) - leapraid_internal_ublk_io_dev_to_running(sdev); - } -} - static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_addr, struct leapraid_card_port *card_port) @@ -2972,15 +3576,15 @@ static void leapraid_ublk_io_all_dev(struct leapraid_adapter *adapter) } } -static void __maybe_unused leapraid_internal_dev_blk( +static void leapraid_internal_dev_blk( struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; - sdev_printk(KERN_INFO, sdev, "internal blkg hdl 0x%04x\n", + sdev_printk(KERN_INFO, sdev, "Internal blkg hdl 0x%04x\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc == -EINVAL) sdev_printk(KERN_WARNING, sdev, @@ -2988,42 +3592,6 @@ static void __maybe_unused leapraid_internal_dev_blk( rc, sdev_priv->starget_priv->hdl); } -static void __maybe_unused leapraid_blkio_dev(struct leapraid_adapter *adapter, - u16 hdl) -{ - struct leapraid_sdev_priv *sdev_priv; - struct leapraid_sas_dev *sas_dev; - struct scsi_device *sdev; - - sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->hdl != hdl) - continue; - - if (sdev_priv->block) - continue; - - if (sas_dev && sas_dev->pend_sas_rphy_add) - continue; - - if (sdev_priv->sep) { - sdev_printk(KERN_INFO, sdev, - "sep hdl 0x%04x skip blkg\n", - sdev_priv->starget_priv->hdl); - continue; - } - - leapraid_internal_dev_blk(sdev, sdev_priv); - } - - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { @@ -3055,8 +3623,7 @@ static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, if (sdev_priv->sep) { sdev_printk(KERN_INFO, sdev, - "%s skip dev blk for sep hdl 0x%04x\n", - __func__, + "skip dev blk: sep hdl 0x%04x\n", sdev_priv->starget_priv->hdl); continue; } @@ -3077,10 +3644,8 @@ static void leapraid_imm_blkio_set_end_dev_blk_hdls( list_for_each_entry(sas_port, &topo_node_exp->sas_port_list, port_list) { - if (sas_port->remote_identify.device_type == - SAS_END_DEVICE) { + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) leapraid_imm_blkio_to_end_dev(adapter, sas_port); - } } } @@ -3102,7 +3667,7 @@ static void leapraid_imm_blkio_to_sib_exp( sas_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) { topo_node_exp_sib = - leapraid_exp_find_by_sas_address( + leapraid_exp_find_by_sas_address( adapter, sas_port->remote_identify.sas_address, sas_port->card_port); @@ -3141,17 +3706,15 @@ static void leapraid_report_sdev_directly(struct leapraid_adapter *adapter, if (!sas_dev->starget) { if (!adapter->scan_dev_desc.driver_loading) { - leapraid_transport_port_remove(adapter, - sas_dev->sas_addr, - sas_dev->parent_sas_addr, - sas_dev->card_port); + leapraid_transport_port_remove( + adapter, + sas_dev->sas_addr, + sas_dev->parent_sas_addr, + sas_dev->card_port); leapraid_sas_dev_remove(adapter, sas_dev); } return; } - - clear_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); } static struct leapraid_sas_dev *leapraid_init_sas_dev( @@ -3162,6 +3725,7 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( { struct leapraid_sas_dev *sas_dev; struct leapraid_enc_node *enc_dev; + unsigned long flags; sas_dev = kzalloc(sizeof(*sas_dev), GFP_KERNEL); if (!sas_dev) @@ -3176,28 +3740,32 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->phy = sas_dev_pg0->phy_num; sas_dev->enc_hdl = le16_to_cpu(sas_dev_pg0->enc_hdl); sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); - sas_dev->port_type = sas_dev_pg0->max_port_connections; + sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; - memcpy(sas_dev->connector_name, sas_dev_pg0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; + memcpy(sas_dev->connector_name, + sas_dev_pg0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = + '\0'; } else { sas_dev->enc_level = 0; sas_dev->connector_name[0] = '\0'; } - if (le16_to_cpu(sas_dev_pg0->enc_hdl)) { - enc_dev = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu(sas_dev_pg0->enc_hdl)); - sas_dev->enc_lid = enc_dev ? - le64_to_cpu(enc_dev->pg0.enc_lid) : 0; + if (sas_dev->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_dev = leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); + if (enc_dev) + sas_dev->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } dev_info(&adapter->pdev->dev, - "add dev: hdl=0x%0x, sas addr=0x%016llx, port_type=0x%0x\n", - hdl, sas_dev->sas_addr, sas_dev->port_type); + "add dev: hdl=0x%x, SAS addr=0x%016llx, port connect=0x%x\n", + hdl, sas_dev->sas_addr, sas_dev->port_connection); return sas_dev; } @@ -3217,15 +3785,14 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, - cfgp1, cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, + cfgp1, cfgp2, GET_SAS_DEVICE_PG0)) return; dev_info = le32_to_cpu(sas_dev_pg0.dev_info); if (!(leapraid_is_end_dev(dev_info))) return; - set_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); sas_addr = le64_to_cpu(sas_dev_pg0.sas_address); if (!(le16_to_cpu(sas_dev_pg0.flg) & LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) @@ -3238,8 +3805,6 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_get_sas_dev_by_addr(adapter, sas_addr, card_port); if (sas_dev) { - clear_bit(hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); leapraid_sdev_put(sas_dev); return; } @@ -3254,6 +3819,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) dev_info); if (!sas_dev) return; + if (adapter->scan_dev_desc.wait_scan_dev_done) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); leapraid_sdev_get(sas_dev); @@ -3268,6 +3834,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_report_sdev_directly(adapter, sas_dev); } + leapraid_sdev_put(sas_dev); } static void leapraid_remove_device(struct leapraid_adapter *adapter, @@ -3275,14 +3842,15 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, { struct leapraid_starget_priv *starget_priv; + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); if (sas_dev->led_on) { leapraid_set_led(adapter, sas_dev, false); - sas_dev->led_on = false; + sas_dev->led_on = 0; } if (sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; leapraid_ublk_io_dev(adapter, sas_dev->sas_addr, sas_dev->card_port); starget_priv->hdl = LEAPRAID_INVALID_DEV_HANDLE; @@ -3294,12 +3862,13 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, sas_dev->card_port); dev_info(&adapter->pdev->dev, - "remove dev: hdl=0x%04x, sas addr=0x%016llx\n", + "remove dev: hdl=0x%04x, SAS addr=0x%016llx\n", sas_dev->hdl, (unsigned long long)sas_dev->sas_addr); } -static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapter, - u8 port_id, u8 phy_num) +static struct leapraid_vphy *leapraid_alloc_vphy( + struct leapraid_adapter *adapter, + u8 port_id, u8 phy_num) { struct leapraid_card_port *port; struct leapraid_vphy *vphy; @@ -3311,7 +3880,6 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte vphy = leapraid_get_vphy_by_phy(port, phy_num); if (vphy) return vphy; - vphy = kzalloc(sizeof(*vphy), GFP_KERNEL); if (!vphy) return NULL; @@ -3325,46 +3893,157 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte return vphy; } -static int leapraid_add_port_to_card_port_list(struct leapraid_adapter *adapter, - u8 port_id, bool refresh) +static int leapraid_add_port_to_card_port_list( + struct leapraid_adapter *adapter, + u8 port_id, bool refresh) { struct leapraid_card_port *card_port; card_port = leapraid_get_port_by_id(adapter, port_id, false); if (card_port) return 0; - card_port = kzalloc(sizeof(*card_port), GFP_KERNEL); if (!card_port) return -ENOMEM; card_port->port_id = port_id; - dev_info(&adapter->pdev->dev, - "port: %d is added to card_port list\n", - card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "port: %d is added to card_port list\n", + card_port->port_id); - if (refresh) - if (adapter->access_ctrl.shost_recovering) - card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; + if (refresh && adapter->access_ctrl.shost_recovering) + card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; list_add_tail(&card_port->list, &adapter->dev_topo.card_port_list); return 0; } +static int leapraid_add_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + struct leapraid_topo_node *card = &adapter->dev_topo.card; + u8 port_id; + + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return -EINVAL; + + port_id = iou->phy_info[i].port; + + if (leapraid_add_port_to_card_port_list(adapter, port_id, false)) + return -EINVAL; + + if ((le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY) && + ((phy_pg0.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) >= + LEAPRAID_SAS_NEG_LINK_RATE_1_5)) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + card->card_phy[i].phy_id = i; + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + + return 0; +} + +static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_topo_node *card = &adapter->dev_topo.card; + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + u16 attached_hdl; + u32 dev_info; + u8 link_rate; + u8 port_id; + + link_rate = iou->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; + port_id = iou->phy_info[i].port; + if (leapraid_add_port_to_card_port_list(adapter, port_id, true)) + return -EINVAL; + + dev_info = le32_to_cpu(iou->phy_info[i].controller_phy_dev_info); + if (dev_info & LEAPRAID_DEVTYP_SEP && + link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + if (le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY && + !leapraid_alloc_vphy(adapter, port_id, i)) + return -EINVAL; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + + attached_hdl = le16_to_cpu(iou->phy_info[i].attached_dev_hdl); + if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; + + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + if (!card->card_phy[i].phy) { + cfgp1.phy_number = i; + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + card->card_phy[i].phy_id = i; + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + return 0; + } + + leapraid_transport_update_links(adapter, + card->sas_address, + attached_hdl, + i, + link_rate, + card->card_phy[i].card_port); + + return 0; +} + static void leapraid_sas_host_add(struct leapraid_adapter *adapter, bool refresh) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_phy_p0 phy_pg0; struct leapraid_sas_dev_p0 sas_dev_pg0; struct leapraid_enc_p0 enc_pg0; struct leapraid_sas_io_unit_p0 *sas_iou_pg0; u16 sas_iou_pg0_sz; - u16 attached_hdl; u8 phys_num; - u8 port_id; - u8 link_rate; int i; + int rc; if (!refresh) { if (leapraid_get_adapter_phys(adapter, &phys_num) || !phys_num) @@ -3379,128 +4058,46 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, adapter->dev_topo.card.phys_num = phys_num; } - sas_iou_pg0_sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + - (adapter->dev_topo.card.phys_num * - sizeof(struct leapraid_sas_io_unit0_phy_info)); + sas_iou_pg0_sz = + offsetof(struct leapraid_sas_io_unit_p0, phy_info) + + (adapter->dev_topo.card.phys_num * + sizeof(struct leapraid_sas_io_unit0_phy_info)); sas_iou_pg0 = kzalloc(sas_iou_pg0_sz, GFP_KERNEL); if (!sas_iou_pg0) - goto out; + return; if (leapraid_get_sas_io_unit_page0(adapter, sas_iou_pg0, sas_iou_pg0_sz)) - goto out; + goto out_free; adapter->dev_topo.card.parent_dev = &adapter->shost->shost_gendev; adapter->dev_topo.card.hdl = le16_to_cpu(sas_iou_pg0->phy_info[0].controller_dev_hdl); for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if (!refresh) { /* add */ - cfgp1.phy_number = i; - if (leapraid_op_config_page(adapter, &phy_pg0, cfgp1, - cfgp2, GET_PHY_PG0)) - goto out; - - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - false)) - goto out; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY) && - (phy_pg0.neg_link_rate >> 4) >= - LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - if (!leapraid_alloc_vphy(adapter, port_id, i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - adapter->dev_topo.card.card_phy[i].phy_id = i; - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - leapraid_transport_add_card_phy( - adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, adapter->dev_topo.card.parent_dev); - } else { /* refresh */ - link_rate = sas_iou_pg0->phy_info[i].neg_link_rate >> 4; - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - true)) - goto out; - - if (le32_to_cpu(sas_iou_pg0->phy_info[i] - .controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP && - link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY)) { - if (!leapraid_alloc_vphy(adapter, - port_id, - i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - attached_hdl = - le16_to_cpu(sas_iou_pg0->phy_info[i].attached_dev_hdl); - if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; - - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - if (!adapter->dev_topo.card.card_phy[i].phy) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - adapter->dev_topo.card.card_phy[i].phy_id = i; - leapraid_transport_add_card_phy(adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, - adapter->dev_topo.card.parent_dev); - continue; - } - - leapraid_transport_update_links(adapter, - adapter->dev_topo.card.sas_address, - attached_hdl, i, link_rate, - adapter->dev_topo.card.card_phy[i].card_port); - } + if (!refresh) /* add */ + rc = leapraid_add_card_phy(adapter, sas_iou_pg0, i); + else /* refresh */ + rc = leapraid_refresh_card_phy(adapter, + sas_iou_pg0, + i); + if (rc) + goto out_free; } if (!refresh) { cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = adapter->dev_topo.card.hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) - goto out; + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) + goto out_free; adapter->dev_topo.card.enc_hdl = le16_to_cpu(sas_dev_pg0.enc_hdl); adapter->dev_topo.card.sas_address = le64_to_cpu(sas_dev_pg0.sas_address); dev_info(&adapter->pdev->dev, - "add host: devhdl=0x%04x, sas addr=0x%016llx, phynums=%d\n", + "add host: hdl=0x%04x, SAS addr=0x%016llx, phy=%d\n", adapter->dev_topo.card.hdl, (unsigned long long)adapter->dev_topo.card.sas_address, adapter->dev_topo.card.phys_num); @@ -3515,7 +4112,7 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, le64_to_cpu(enc_pg0.enc_lid); } } -out: +out_free: kfree(sas_iou_pg0); } @@ -3529,22 +4126,24 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port = NULL; struct leapraid_enc_node *enc_dev; struct leapraid_exp_p1 exp_pg1; - int rc = 0; + int ret; + int rc; unsigned long flags; u8 port_id; u16 parent_handle; - u64 sas_addr_parent = 0; + u64 sas_addr_parent; int i; port_id = exp_pg0->physical_port; parent_handle = le16_to_cpu(exp_pg0->parent_dev_hdl); - if (leapraid_get_sas_address(adapter, parent_handle, &sas_addr_parent)) - return -1; - + rc = leapraid_get_sas_address(adapter, + parent_handle, &sas_addr_parent); + if (rc) + return rc; topo_node_exp = kzalloc(sizeof(*topo_node_exp), GFP_KERNEL); if (!topo_node_exp) - return -1; + return -ENOMEM; topo_node_exp->hdl = hdl; topo_node_exp->phys_num = exp_pg0->phy_num; @@ -3553,17 +4152,19 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->card_port = leapraid_get_port_by_id(adapter, port_id, false); if (!topo_node_exp->card_port) { - rc = -1; + rc = -EPERM; goto out_fail; } dev_info(&adapter->pdev->dev, - "add exp: sas addr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phys=%d\n", + "add exp: saddr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phy=%d\n", (unsigned long long)topo_node_exp->sas_address, hdl, parent_handle, topo_node_exp->phys_num); if (!topo_node_exp->phys_num) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Invalid PHY num from exp_pg0\n", __func__); + rc = -EPERM; goto out_fail; } @@ -3571,7 +4172,10 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, kcalloc(topo_node_exp->phys_num, sizeof(struct leapraid_card_phy), GFP_KERNEL); if (!topo_node_exp->card_phy) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Failed to alloc expander phy array, count=%u\n", + __func__, topo_node_exp->phys_num); + rc = -EPERM; goto out_fail; } @@ -3579,7 +4183,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, sas_port = leapraid_transport_port_add(adapter, hdl, sas_addr_parent, topo_node_exp->card_port); if (!sas_port) { - rc = -1; + rc = -EPERM; goto out_fail; } @@ -3588,31 +4192,38 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1->phy_number = i; cfgp2->handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, - GET_SAS_EXPANDER_PG1))) { - rc = -1; + if (leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, + GET_SAS_EXPANDER_PG1)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to get exp_pg1, phy=%d\n", + __func__, i); + rc = -EPERM; goto out_fail; } topo_node_exp->card_phy[i].hdl = hdl; topo_node_exp->card_phy[i].phy_id = i; topo_node_exp->card_phy[i].card_port = - leapraid_get_port_by_id(adapter, port_id, false); - if ((leapraid_transport_add_exp_phy(adapter, - &topo_node_exp->card_phy[i], - &exp_pg1, - topo_node_exp->parent_dev))) { - rc = -1; + leapraid_get_port_by_id(adapter, port_id, false); + ret = leapraid_transport_add_exp_phy( + adapter, + &topo_node_exp->card_phy[i], + &exp_pg1, + topo_node_exp->parent_dev); + if (ret) { + rc = -EPERM; goto out_fail; } } if (topo_node_exp->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); enc_dev = leapraid_enc_find_by_hdl(adapter, topo_node_exp->enc_hdl); if (enc_dev) topo_node_exp->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3626,6 +4237,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->sas_address, sas_addr_parent, topo_node_exp->card_port); + kfree(topo_node_exp->card_phy); kfree(topo_node_exp); return rc; } @@ -3637,22 +4249,29 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) struct leapraid_topo_node *topo_node_exp; struct leapraid_exp_p0 exp_pg0; u16 parent_handle; - u64 sas_addr, sas_addr_parent = 0; + u64 sas_addr, sas_addr_parent; unsigned long flags; u8 port_id; - int rc = 0; + int rc; - if (!hdl) + if (!hdl) { + dev_warn(&adapter->pdev->dev, "%s: Invalid hdl\n", __func__); return -EPERM; + } if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EPERM; + } cfgp1.form = LEAPRAID_SAS_EXP_CFD_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG0))) + if (leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG0)) return -EPERM; parent_handle = le16_to_cpu(exp_pg0.parent_dev_hdl); @@ -3663,10 +4282,14 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) if (sas_addr_parent != adapter->dev_topo.card.sas_address) { spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, sas_addr_parent, - leapraid_get_port_by_id(adapter, port_id, false)); - spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); + leapraid_get_port_by_id(adapter, + port_id, + false)); + spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, + flags); if (!topo_node_exp) { rc = leapraid_exp_add(adapter, parent_handle); if (rc != 0) @@ -3677,7 +4300,9 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); sas_addr = le64_to_cpu(exp_pg0.sas_address); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, sas_addr, + leapraid_exp_find_by_sas_address( + adapter, + sas_addr, leapraid_get_port_by_id(adapter, port_id, false)); spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -3725,7 +4350,7 @@ static void leapraid_exp_node_rm(struct leapraid_adapter *adapter, topo_node_exp->sas_address_parent, topo_node_exp->card_port); dev_info(&adapter->pdev->dev, - "removing exp: port=%d, sas addr=0x%016llx, hdl=0x%04x\n", + "removing exp: port=%d, SAS addr=0x%016llx, hdl=0x%04x\n", port_id, (unsigned long long)topo_node_exp->sas_address, topo_node_exp->hdl); spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3757,92 +4382,6 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static void leapraid_check_device(struct leapraid_adapter *adapter, - u64 parent_sas_address, u16 handle, - u8 phy_number, u8 link_rate) -{ - struct leapraid_sas_dev_p0 sas_device_pg0; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_enc_node *enclosure_dev = NULL; - union cfg_param_1 cfgp1 = {0}; - union cfg_param_2 cfgp2 = {0}; - unsigned long flags; - u64 sas_address; - struct scsi_target *starget; - struct leapraid_starget_priv *sas_target_priv_data; - u32 device_info; - struct leapraid_card_port *port; - - cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; - cfgp2.handle = handle; - if ((leapraid_op_config_page(adapter, &sas_device_pg0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) - return; - - if (phy_number != sas_device_pg0.phy_num) - return; - - device_info = le32_to_cpu(sas_device_pg0.dev_info); - if (!(leapraid_is_end_dev(device_info))) - return; - - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_address = le64_to_cpu(sas_device_pg0.sas_address); - port = leapraid_get_port_by_id(adapter, sas_device_pg0.physical_port, - false); - if (!port) - goto out_unlock; - - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, - port); - if (!sas_dev) - goto out_unlock; - - if (unlikely(sas_dev->hdl != handle)) { - starget = sas_dev->starget; - sas_target_priv_data = starget->hostdata; - starget_printk(KERN_INFO, starget, - "hdl changed from 0x%04x to 0x%04x!\n", - sas_dev->hdl, handle); - sas_target_priv_data->hdl = handle; - sas_dev->hdl = handle; - if (le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = - sas_device_pg0.enc_level; - memcpy(sas_dev->connector_name, - sas_device_pg0.connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } - sas_dev->enc_hdl = - le16_to_cpu(sas_device_pg0.enc_hdl); - enclosure_dev = - leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); - if (enclosure_dev) { - sas_dev->enc_lid = - le64_to_cpu(enclosure_dev->pg0.enc_lid); - } - } - - if (!(le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) - goto out_unlock; - - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - - leapraid_ublk_io_dev_to_running(adapter, sas_address, port); - goto out; - -out_unlock: - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); -out: - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static int leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, @@ -3851,10 +4390,8 @@ static int leapraid_internal_sas_topo_chg_evt( u64 sas_addr, u8 max_phys) { struct leapraid_evt_data_sas_topo_change_list *evt_data; - struct leapraid_sas_dev *sas_dev; - unsigned long flags; u8 phy_number; - u8 link_rate, prev_link_rate; + u8 link_rate; u16 reason_code; u16 hdl; int i; @@ -3876,47 +4413,15 @@ static int leapraid_internal_sas_topo_chg_evt( LEAPRAID_EVT_SAS_TOPO_RC_MASK; hdl = le16_to_cpu(evt_data->phy[i].attached_dev_hdl); - if (!hdl) + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); continue; - - link_rate = evt_data->phy[i].link_rate >> 4; - prev_link_rate = evt_data->phy[i].link_rate & 0xF; + } + link_rate = evt_data->phy[i].link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; switch (reason_code) { - case LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED: - if (adapter->access_ctrl.shost_recovering) - break; - - if (link_rate == prev_link_rate) - break; - - leapraid_transport_update_links(adapter, sas_addr, - hdl, phy_number, - link_rate, card_port); - if (link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - break; - - leapraid_check_device(adapter, sas_addr, hdl, - phy_number, link_rate); - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, - flags); - sas_dev = - leapraid_hold_lock_get_sas_dev_by_hdl( - adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, - flags); - if (sas_dev) { - leapraid_sdev_put(sas_dev); - break; - } - if (!test_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add)) - break; - - evt_data->phy[i].phy_status &= - LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK; - evt_data->phy[i].phy_status |= - LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED; - fallthrough; - case LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED: if (adapter->access_ctrl.shost_recovering) break; @@ -3957,7 +4462,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, return 0; evt_data = fw_evt->evt_data; - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) return 0; @@ -3966,9 +4471,9 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, card_port = leapraid_get_port_by_id(adapter, evt_data->physical_port, false); - if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED) - if (leapraid_exp_add(adapter, phdl) != 0) - return 0; + if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && + leapraid_exp_add(adapter, phdl) != 0) + return 0; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -3995,12 +4500,13 @@ static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) { sdev->no_uld_attach = no_uld_attach ? 1 : 0; sdev_printk(KERN_INFO, sdev, - "%s raid component to upper layer\n", + "%s RAID component to upper layer\n", sdev->no_uld_attach ? "hide" : "expose"); WARN_ON(scsi_device_reprobe(sdev)); } -static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { union cfg_param_1 cfgp1 = {0}; @@ -4012,20 +4518,26 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + + set_bit(hdl, adapter->dev_topo.pd_hdls); sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev) { leapraid_sdev_put(sas_dev); dev_warn(&adapter->pdev->dev, - "dev handle 0x%x already exists\n", hdl); + "Dev handle 0x%x already exists\n", hdl); return; } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) { - dev_warn(&adapter->pdev->dev, "failed to read dev page0\n"); + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, + GET_SAS_DEVICE_PG0)) { + dev_warn(&adapter->pdev->dev, "Failed to read dev page0\n"); return; } @@ -4040,7 +4552,8 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, leapraid_add_dev(adapter, hdl); } -static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_delete( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 hdl; @@ -4049,7 +4562,8 @@ static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, leapraid_sas_dev_remove_by_hdl(adapter, hdl); } -static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_hide( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_starget_priv *starget_priv; @@ -4057,10 +4571,15 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev; unsigned long flags; u64 volume_wwid = 0; - u16 volume_hdl = 0; + u16 volume_hdl; u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } leapraid_cfg_get_volume_hdl(adapter, hdl, &volume_hdl); if (volume_hdl) leapraid_cfg_get_volume_wwid(adapter, @@ -4074,21 +4593,23 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, return; } - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + set_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; sas_dev->volume_hdl = volume_hdl; sas_dev->volume_wwid = volume_wwid; - leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - (void *)1, leapraid_reprobe_lun); + (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } static void leapraid_sas_pd_expose( @@ -4103,11 +4624,17 @@ static void leapraid_sas_pd_expose( hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { dev_warn(&adapter->pdev->dev, - "%s:%d: sas_dev not found， hdl=0x%x\n", + "%s:%d: sas_dev not found, hdl=0x%x\n", __func__, __LINE__, hdl); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); return; @@ -4115,84 +4642,100 @@ static void leapraid_sas_pd_expose( sas_dev->volume_hdl = 0; sas_dev->volume_wwid = 0; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + clear_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg &= ~LEAPRAID_TGT_FLG_RAID_MEMBER; - sas_dev->led_on = false; - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "expose sas_dev, hdl=0x%x\n", hdl); - starget_for_each_device(starget, NULL, leapraid_reprobe_lun); + starget_for_each_device(starget, + LEAPRAID_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } -static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, +static void leapraid_sas_vol_visibility( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { - struct leapraid_raid_volume *raid_volume = NULL; - struct scsi_device *sdev = NULL; - u16 hdl = 0; + struct leapraid_raid_volume *raid_volume; + struct scsi_device *sdev; + bool reprobe_flg = false; + bool sdev_held = false; unsigned long flags; - u8 rc = 0; - u8 reprobe_flg = 0; + u16 hdl; + u8 rc; hdl = le16_to_cpu(evt_data->vol_dev_hdl); rc = evt_data->reason_code; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + sdev = raid_volume->sdev; + if (!sdev) { spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x has no sdev\n", __func__, __LINE__, hdl); return; } - reprobe_flg = 0; - sdev = raid_volume->sdev; - if (sdev) { - if (sdev->no_uld_attach) { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { - sdev->no_uld_attach = 0; - reprobe_flg = 1; - } - } else { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { - sdev->no_uld_attach = 1; - reprobe_flg = 1; - } - } + if (sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = true; + } else if (!sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = true; + } - if (reprobe_flg) { - if (sdev->no_uld_attach) - sdev_printk(KERN_INFO, sdev, "hide vol\n"); - else - sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + if (reprobe_flg && !scsi_device_get(sdev)) + sdev_held = true; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); - WARN_ON(scsi_device_reprobe(sdev)); - } else { - dev_warn(&adapter->pdev->dev, - "%s:rc(0x%x):request matches, skipping.\n", - __func__, rc); - } + if (!reprobe_flg) { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x): Request matches, skipping\n", + __func__, rc); + return; + } - } else { + if (!sdev_held) { dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x has no sdev\n", - __func__, __LINE__, hdl); + "%s: Failed to hold sdev for reprobe, hdl=0x%x\n", + __func__, hdl); + return; } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + scsi_device_put(sdev); } -static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, +static void leapraid_sas_volume_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_raid_volume *raid_volume; @@ -4203,23 +4746,21 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, hdl = le16_to_cpu(evt_data->vol_dev_hdl); if (leapraid_cfg_get_volume_wwid(adapter, hdl, &wwid)) { - dev_warn(&adapter->pdev->dev, "failed to read volume page1\n"); + dev_warn(&adapter->pdev->dev, "Failed to read volume page1\n"); return; } if (!wwid) { - dev_warn(&adapter->pdev->dev, "invalid WWID(handle=0x%x)\n", + dev_warn(&adapter->pdev->dev, "Invalid WWID(handle=0x%x)\n", hdl); return; } - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - if (raid_volume) { dev_warn(&adapter->pdev->dev, - "volume handle 0x%x already exists\n", hdl); + "Volume handle 0x%x already exists\n", hdl); + leapraid_raid_volume_put(raid_volume); return; } @@ -4227,6 +4768,8 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, if (!raid_volume) return; + INIT_LIST_HEAD(&raid_volume->list); + kref_init(&raid_volume->refcnt); raid_volume->id = adapter->dev_topo.sas_id++; raid_volume->channel = RAID_CHANNEL; raid_volume->hdl = hdl; @@ -4237,52 +4780,67 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); dev_info(&adapter->pdev->dev, - "add raid volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); + "add RAID volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); } else { spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); leapraid_check_boot_dev(adapter, raid_volume, RAID_CHANNEL); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } + leapraid_raid_volume_put(raid_volume); } - -static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, - u16 hdl) + +static void leapraid_sas_volume_delete_by_ptr( + struct leapraid_adapter *adapter, + struct leapraid_raid_volume *raid_volume) { struct leapraid_starget_priv *starget_priv; - struct leapraid_raid_volume *raid_volume; struct scsi_target *starget = NULL; unsigned long flags; + bool in_list; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - if (!raid_volume) { - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", - __func__, __LINE__, hdl); + if (!raid_volume) return; - } - if (raid_volume->starget) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + in_list = !list_empty(&raid_volume->list); + if (in_list && raid_volume->starget) { starget = raid_volume->starget; starget_priv = starget->hostdata; - starget_priv->deleted = true; + if (starget_priv) + starget_priv->deleted = 1; } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + if (!in_list) + return; dev_info(&adapter->pdev->dev, - "delete raid volume: hdl=0x%x, wwid=0x%llx\n", + "delete RAID volume: hdl=0x%x, wwid=0x%llx\n", raid_volume->hdl, raid_volume->wwid); - list_del(&raid_volume->list); - kfree(raid_volume); - - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_remove(adapter, raid_volume); if (starget) scsi_remove_target(&starget->dev); } +static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, + u16 hdl) +{ + struct leapraid_raid_volume *raid_volume; + + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); + leapraid_raid_volume_put(raid_volume); +} + static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { @@ -4324,7 +4882,9 @@ static void leapraid_sas_enc_dev_stat_add_node( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_enc_node *enc_node = NULL; + struct leapraid_enc_node *enc_node; + struct leapraid_enc_node *enc_exist; + unsigned long flags; int rc; enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); @@ -4339,16 +4899,33 @@ static void leapraid_sas_enc_dev_stat_add_node( kfree(enc_node); return; } + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_exist = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_exist) { + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); + return; + } list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } static void leapraid_sas_enc_dev_stat_del_node( - struct leapraid_enc_node *enc_node) + struct leapraid_adapter *adapter, u16 hdl) { - if (!enc_node) + struct leapraid_enc_node *enc_node; + unsigned long flags; + + if (!hdl) return; - list_del(&enc_node->list); + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_node = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_node) + list_del(&enc_node->list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); } @@ -4356,7 +4933,6 @@ static void leapraid_sas_enc_dev_stat_chg_evt( struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { - struct leapraid_enc_node *enc_node = NULL; struct leapraid_evt_data_sas_enc_dev_status_change *evt_data; u16 enc_hdl; @@ -4365,15 +4941,13 @@ static void leapraid_sas_enc_dev_stat_chg_evt( evt_data = fw_evt->evt_data; enc_hdl = le16_to_cpu(evt_data->enc_hdl); - if (enc_hdl) - enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); switch (evt_data->reason_code) { case LEAPRAID_EVT_SAS_ENCL_RC_ADDED: - if (!enc_node) + if (enc_hdl) leapraid_sas_enc_dev_stat_add_node(adapter, enc_hdl); break; case LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING: - leapraid_sas_enc_dev_stat_del_node(enc_node); + leapraid_sas_enc_dev_stat_del_node(adapter, enc_hdl); break; default: break; @@ -4390,7 +4964,11 @@ static void leapraid_remove_unresp_sas_end_dev( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry_safe(sas_dev, sas_dev_next, &adapter->dev_topo.sas_dev_init_list, list) { + if (sas_dev->rphy || sas_dev->pend_sas_rphy_add) + continue; + list_del_init(&sas_dev->list); + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); } list_for_each_entry_safe(sas_dev, sas_dev_next, @@ -4398,7 +4976,7 @@ static void leapraid_remove_unresp_sas_end_dev( if (!sas_dev->resp) list_move_tail(&sas_dev->list, &head); else - sas_dev->resp = false; + sas_dev->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -4409,23 +4987,32 @@ static void leapraid_remove_unresp_sas_end_dev( } dev_info(&adapter->pdev->dev, - "unresponding sas end devices removed\n"); + "Unresponsive SAS end devices removed\n"); } static void leapraid_remove_unresp_raid_volumes( struct leapraid_adapter *adapter) { + unsigned long flags; struct leapraid_raid_volume *raid_volume, *raid_volume_next; + LIST_HEAD(head); + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry_safe(raid_volume, raid_volume_next, &adapter->dev_topo.raid_volume_list, list) { if (!raid_volume->resp) - leapraid_sas_volume_delete(adapter, raid_volume->hdl); + list_move_tail(&raid_volume->list, &head); else - raid_volume->resp = false; + raid_volume->resp = 0; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, raid_volume_next, &head, list) { + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } + dev_info(&adapter->pdev->dev, - "unresponding raid volumes removed\n"); + "Unresponsive RAID volumes removed\n"); } static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) @@ -4440,7 +5027,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) if (!topo_node_exp->resp) list_move_tail(&topo_node_exp->list, &head); else - topo_node_exp->resp = false; + topo_node_exp->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -4449,7 +5036,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) leapraid_exp_node_rm(adapter, topo_node_exp); dev_info(&adapter->pdev->dev, - "unresponding sas expanders removed\n"); + "Unresponsive SAS expanders removed\n"); } static void leapraid_remove_unresp_dev(struct leapraid_adapter *adapter) @@ -4505,25 +5092,27 @@ static void leapraid_update_dev_qdepth(struct leapraid_adapter *adapter) { struct leapraid_sdev_priv *sdev_priv; struct leapraid_sas_dev *sas_dev; + struct leapraid_adapter_attr *attr; struct scsi_device *sdev; u16 qdepth; + attr = &adapter->adapter_attr; shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) continue; sas_dev = sdev_priv->starget_priv->sas_dev; if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) - qdepth = (sas_dev->port_type > 1) ? - adapter->adapter_attr.wideport_max_queue_depth : - adapter->adapter_attr.narrowport_max_queue_depth; + qdepth = (sas_dev->port_connection > 1) ? + attr->wideport_max_queue_depth : + attr->narrowport_max_queue_depth; else if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) - qdepth = adapter->adapter_attr.sata_max_queue_depth; + qdepth = attr->sata_max_queue_depth; else continue; - leapraid_adjust_sdev_queue_depth(sdev, qdepth); + leapraid_change_queue_depth(sdev, qdepth); } } @@ -4539,15 +5128,17 @@ static void leapraid_update_exp_links(struct leapraid_adapter *adapter, cfgp2.handle = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG1))) + if (leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG1)) return; - leapraid_transport_update_links(adapter, + leapraid_transport_update_links( + adapter, topo_node_exp->sas_address, le16_to_cpu(exp_p1.attached_dev_hdl), i, - exp_p1.neg_link_rate >> 4, + exp_p1.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT, topo_node_exp->card_port); } } @@ -4562,7 +5153,7 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "begin scanning expanders\n"); + dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4573,7 +5164,8 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) port_id = exp_p0.physical_port; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, le64_to_cpu(exp_p0.sas_address), leapraid_get_port_by_id(adapter, port_id, @@ -4587,14 +5179,14 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) leapraid_exp_add(adapter, hdl); dev_info(&adapter->pdev->dev, - "add exp: hdl=0x%04x, sas addr=0x%016llx\n", + "add exp: hdl=0x%04x, SAS addr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( exp_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "expanders scan complete\n"); + dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -4611,7 +5203,7 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "begin scanning phys disk\n"); + dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; @@ -4644,20 +5236,25 @@ static void leapraid_scan_phy_disks_after_reset( LEAPRAID_SAS_NEG_LINK_RATE_1_5, leapraid_get_port_by_id( adapter, port_id, false)); - set_bit(hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - - leapraid_add_dev(adapter, hdl); - - dev_info(&adapter->pdev->dev, - "add phys disk: hdl=0x%04x, sas addr=0x%016llx\n", - hdl, - (unsigned long long)le64_to_cpu( - sas_dev_p0.sas_address)); + if (!hdl || hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", + __func__); + } else { + set_bit(hdl, adapter->dev_topo.pd_hdls); + leapraid_add_dev(adapter, hdl); + + dev_info(&adapter->pdev->dev, + "add pd hdl=0x%04x saddr=0x%016llx\n", + hdl, + (unsigned long long)le64_to_cpu( + sas_dev_p0.sas_address)); + } } } - dev_info(&adapter->pdev->dev, "phys disk scan complete\n"); + dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -4667,10 +5264,9 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) union cfg_param_1 cfgp1_extra = {0}; union cfg_param_2 cfgp2_extra = {0}; struct leapraid_evt_data_ir_change evt_data; - static struct leapraid_raid_volume *raid_volume; + struct leapraid_raid_volume *raid_volume; struct leapraid_raidvol_p1 *vol_p1; struct leapraid_raidvol_p0 *vol_p0; - unsigned long flags; u16 hdl; vol_p0 = kzalloc(sizeof(*vol_p0), GFP_KERNEL); @@ -4683,21 +5279,20 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "begin scanning volumes\n"); + dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, cfgp2, GET_RAID_VOLUME_PG1); cfgp2.handle = hdl) { hdl = le16_to_cpu(vol_p1->dev_hdl); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid( adapter, le64_to_cpu(vol_p1->wwid)); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume) + if (raid_volume) { + leapraid_raid_volume_put(raid_volume); continue; + } cfgp1_extra.size = sizeof(struct leapraid_raidvol_p0); cfgp2_extra.handle = hdl; @@ -4722,7 +5317,7 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - dev_info(&adapter->pdev->dev, "volumes scan complete\n"); + dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -4736,7 +5331,7 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u8 port_id; dev_info(&adapter->pdev->dev, - "begin scanning sas end devices\n"); + "Begin scanning SAS end devices\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4744,6 +5339,13 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) GET_SAS_DEVICE_PG0); cfgp2.handle = hdl) { hdl = le16_to_cpu(sas_dev_p0.dev_hdl); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + continue; + } + if (!(leapraid_is_end_dev(le32_to_cpu(sas_dev_p0.dev_info)))) continue; @@ -4774,21 +5376,21 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) false)); leapraid_add_dev(adapter, hdl); dev_info(&adapter->pdev->dev, - "add sas dev: hdl=0x%04x, sas addr=0x%016llx\n", + "Add SAS dev: hdl=0x%04x, saddr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( sas_dev_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "sas end devices scan complete\n"); + dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "begin scanning devices\n"); + dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { leapraid_scan_phy_disks_after_reset(adapter); @@ -4796,11 +5398,13 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) } leapraid_scan_sas_dev_after_reset(adapter); - dev_info(&adapter->pdev->dev, "devices scan complete\n"); + dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) { + unsigned long flags; + leapraid_remove_unresp_dev(adapter); leapraid_del_dirty_vphy(adapter); leapraid_del_dirty_card_port(adapter); @@ -4809,6 +5413,10 @@ static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) if (adapter->scan_dev_desc.driver_loading) leapraid_scan_dev_done(adapter); + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + wake_up(&adapter->access_ctrl.shost_recover_wq); } static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, @@ -4817,15 +5425,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, { void *req; bool reset_flg = false; - int rc = 0; + int rc; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc(adapter, + req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.enc_cmd.inter_taskid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); @@ -4835,6 +5445,10 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: SEP command timeout, status=0x%x\n", + __func__, adapter->driver_cmds.enc_cmd.status); + leapraid_log_req_context(adapter, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -4843,17 +5457,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, } if (adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_REPLY_VALID) - memcpy(sep_rep, (void *)(&adapter->driver_cmds.enc_cmd.reply), + memcpy(sep_rep, &adapter->driver_cmds.enc_cmd.reply, sizeof(struct leapraid_sep_rep)); do_hard_reset: if (reset_flg) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; -out: +unlock: mutex_unlock(&adapter->driver_cmds.enc_cmd.mutex); return rc; } @@ -4872,8 +5486,9 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, sep_req.func = LEAPRAID_FUNC_SCSI_ENC_PROCESSOR; sep_req.act = LEAPRAID_SEP_REQ_ACT_WRITE_STATUS; if (on) { - sep_req.slot_status = - cpu_to_le32(LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); + u32 status = LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT; + + sep_req.slot_status = cpu_to_le32(status); sep_req.dev_hdl = cpu_to_le16(sas_dev->hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS; if (leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req)) { @@ -4881,52 +5496,75 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, return; } - sas_dev->led_on = true; - if (sep_rep.adapter_status) - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 1; + leapraid_sdev_put(sas_dev); } else { sep_req.slot_status = 0; sep_req.slot = cpu_to_le16(sas_dev->slot); sep_req.dev_hdl = 0; sep_req.enc_hdl = cpu_to_le16(sas_dev->enc_hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS; - if ((leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req))) { - leapraid_sdev_put(sas_dev); - return; - } + leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req); + } +} - if (sep_rep.adapter_status) { - leapraid_sdev_put(sas_dev); - return; +static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) +{ + unsigned long flags; + + while (scsi_host_in_recovery(adapter->shost) || + adapter->access_ctrl.shost_recovering) { + if (adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup) { + spin_lock_irqsave( + &adapter->reset_desc.adapter_reset_lock, + flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore( + &adapter->reset_desc.adapter_reset_lock, + flags); + + wake_up(&adapter->access_ctrl.shost_recover_wq); + + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost %d, host %d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.host_removing); + + return -EFAULT; } + + wait_event_timeout(adapter->access_ctrl.recovery_waitq, + !adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup, + msecs_to_jiffies(1000)); } + return 0; } static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { struct leapraid_sas_dev *sas_dev; + unsigned long flags; + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); adapter->fw_evt_s.cur_evt = fw_evt; + adapter->fw_evt_s.cur_evt_task = current; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_del_fw_evt_from_list(adapter, fw_evt); if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; } switch (fw_evt->evt_type) { - case LEAPRAID_EVT_SAS_DISCOVERY: - { - struct leapraid_evt_data_sas_disc *evt_data; - - evt_data = fw_evt->evt_data; - if (evt_data->reason_code == - LEAPRAID_EVT_SAS_DISC_RC_STARTED && - !adapter->dev_topo.card.phys_num) - leapraid_sas_host_add(adapter, 0); - break; - } case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: leapraid_sas_topo_chg_evt(adapter, fw_evt); break; @@ -4937,14 +5575,9 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_sas_enc_dev_stat_chg_evt(adapter, fw_evt); break; case LEAPRAID_EVT_REMOVE_DEAD_DEV: - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) - goto out; + if (leapraid_wait_adapter_recovery(adapter)) + goto out_cleanup; - ssleep(1); - } leapraid_hardreset_async_logic(adapter); break; case LEAPRAID_EVT_TURN_ON_PFA_LED: @@ -4953,14 +5586,17 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_set_led(adapter, sas_dev, true); break; case LEAPRAID_EVT_SCAN_DEV_DONE: - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; break; default: break; } -out: +out_cleanup: + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); } static void leapraid_sas_dev_stat_chg_evt( @@ -4968,7 +5604,7 @@ static void leapraid_sas_dev_stat_chg_evt( struct leapraid_evt_data_sas_dev_status_change *event_data) { struct leapraid_starget_priv *starget_priv; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; u64 sas_address; unsigned long flags; @@ -4983,26 +5619,29 @@ static void leapraid_sas_dev_stat_chg_evt( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_address = le64_to_cpu(event_data->sas_address); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, sas_address, leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (sas_dev && sas_dev->starget) { - starget_priv = sas_dev->starget->hostdata; - if (starget_priv) { - switch (event_data->reason_code) { - case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: - starget_priv->tm_busy = true; - break; - case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: - starget_priv->tm_busy = false; - break; - } + if (!sas_dev || !sas_dev->starget) + goto out_unlock; + + starget_priv = sas_dev->starget->hostdata; + if (starget_priv) { + switch (event_data->reason_code) { + case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 1; + break; + case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 0; + break; } } +out_unlock: if (sas_dev) leapraid_sdev_put(sas_dev); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -5015,32 +5654,45 @@ static void leapraid_set_volume_delete_flag(struct leapraid_adapter *adapter, struct leapraid_starget_priv *sas_target_priv_data; unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, handle); - if (raid_volume && raid_volume->starget && - raid_volume->starget->hostdata) { - sas_target_priv_data = raid_volume->starget->hostdata; - sas_target_priv_data->deleted = true; + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (raid_volume->starget && + raid_volume->starget->hostdata) { + sas_target_priv_data = raid_volume->starget->hostdata; + sas_target_priv_data->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } -static void leapraid_check_ir_change_evt(struct leapraid_adapter *adapter, +static void leapraid_check_ir_change_evt( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 phys_disk_dev_hdl; switch (evt_data->reason_code) { case LEAPRAID_EVT_IR_RC_VOLUME_DELETE: - leapraid_set_volume_delete_flag(adapter, - le16_to_cpu(evt_data->vol_dev_hdl)); + leapraid_set_volume_delete_flag( + adapter, + le16_to_cpu(evt_data->vol_dev_hdl)); break; case LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE: phys_disk_dev_hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - clear_bit(phys_disk_dev_hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + if (!phys_disk_dev_hdl || + phys_disk_dev_hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + } else { + clear_bit(phys_disk_dev_hdl, + adapter->dev_topo.pd_hdls); + leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + } break; } } @@ -5050,7 +5702,7 @@ static void leapraid_topo_del_evts_process_exp_status( struct leapraid_evt_data_sas_topo_change_list *evt_data) { struct leapraid_fw_evt_work *fw_evt = NULL; - struct leapraid_evt_data_sas_topo_change_list *loc_evt_data = NULL; + struct leapraid_evt_data_sas_topo_change_list *loc_evt_data; unsigned long flags; u16 exp_hdl; @@ -5081,7 +5733,8 @@ static void leapraid_topo_del_evts_process_exp_status( } } -static void leapraid_check_topo_del_evts(struct leapraid_adapter *adapter, +static void leapraid_check_topo_del_evts( + struct leapraid_adapter *adapter, struct leapraid_evt_data_sas_topo_change_list *evt_data) { int reason_code; @@ -5111,17 +5764,20 @@ static bool leapraid_async_process_evt( switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: - leapraid_sas_dev_stat_chg_evt(adapter, + leapraid_sas_dev_stat_chg_evt( + adapter, (struct leapraid_evt_data_sas_dev_status_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_IR_CHANGE: - leapraid_check_ir_change_evt(adapter, + leapraid_check_ir_change_evt( + adapter, (struct leapraid_evt_data_ir_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: - leapraid_check_topo_del_evts(adapter, + leapraid_check_topo_del_evts( + adapter, (struct leapraid_evt_data_sas_topo_change_list *)event_notify_rep->evt_data); if (adapter->access_ctrl.shost_recovering) { @@ -5129,7 +5785,6 @@ static bool leapraid_async_process_evt( return exit_flag; } break; - case LEAPRAID_EVT_SAS_DISCOVERY: case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: break; default: @@ -5151,7 +5806,7 @@ static void leapraid_async_evt_cb_enqueue( if (!fw_evt) return; - evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * 4; + evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * sizeof(u32); fw_evt->evt_data = kmemdup(evt_notify_rep->evt_data, evt_sz, GFP_ATOMIC); if (!fw_evt->evt_data) { @@ -5240,13 +5895,63 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, - u16 taskid, u8 msix_index, - u32 rep_paddr, u8 cb_idx) +static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) +{ + u16 status; + + cmd->status &= ~LEAPRAID_CMD_PENDING; + + status = le16_to_cpu(rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + + if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + adapter->scan_dev_desc.scan_dev_failed = 1; + + if (!cmd->async_scan_dev) { + complete(&cmd->done); + return 1; + } + + if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) + leapraid_scan_dev_complete(adapter); + else + adapter->scan_dev_desc.scan_start_failed = status; + + return 1; +} + +static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, + struct leapraid_rep *rep, + u16 taskid) +{ + struct leapraid_scsiio_rep *scsiio_reply; + + if (rep->function != LEAPRAID_FUNC_SCSIIO && + rep->function != LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH) + return; + + scsiio_reply = (struct leapraid_scsiio_rep *)rep; + + if (!(scsiio_reply->scsi_state & + LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) + return; + + memcpy(&adapter->driver_cmds.ctl_cmd.sense, + leapraid_get_sense_buffer(adapter, taskid), + min_t(u32, SCSI_SENSE_BUFFERSIZE, + le32_to_cpu(scsiio_reply->sense_count))); +} + +static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_index, + u32 rep_paddr, u8 cb_idx) { struct leapraid_rep *leap_mpi_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); struct leapraid_driver_cmd *sp_cmd, *_sp_cmd = NULL; + u8 reply_len; list_for_each_entry(sp_cmd, &adapter->driver_cmds.special_cmd_list, list) @@ -5256,74 +5961,55 @@ static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, } if (WARN_ON(!_sp_cmd)) - return 1; + return true; if (WARN_ON(_sp_cmd->status == LEAPRAID_CMD_NOT_USED)) - return 1; + return true; if (WARN_ON(taskid != _sp_cmd->hp_taskid && taskid != _sp_cmd->taskid && taskid != _sp_cmd->inter_taskid)) - return 1; - + return true; _sp_cmd->status |= LEAPRAID_CMD_DONE; if (leap_mpi_rep) { - memcpy((void *)(&_sp_cmd->reply), leap_mpi_rep, - leap_mpi_rep->msg_len * 4); + reply_len = leap_mpi_rep->msg_len * sizeof(u32); + if (reply_len > LEAPRAID_REPLY_SIZE) + reply_len = LEAPRAID_REPLY_SIZE; + memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { - u16 adapter_status; - - _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; - adapter_status = - le16_to_cpu(leap_mpi_rep->adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - adapter->scan_dev_desc.scan_dev_failed = true; - - if (_sp_cmd->async_scan_dev) { - if (adapter_status == - LEAPRAID_ADAPTER_STATUS_SUCCESS) { - leapraid_scan_dev_complete(adapter); - } else { - adapter->scan_dev_desc.scan_start_failed = - adapter_status; - } - return 1; - } - - complete(&_sp_cmd->done); - return 1; - } + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) + return leapraid_handle_scan_cb(adapter, + _sp_cmd, + leap_mpi_rep); - if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) { - struct leapraid_scsiio_rep *scsiio_reply; - - if (leap_mpi_rep->function == - LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_rep->function == - LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH) { - scsiio_reply = - (struct leapraid_scsiio_rep *)leap_mpi_rep; - if (scsiio_reply->scsi_state & - LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) - memcpy((void *)(&adapter->driver_cmds.ctl_cmd.sense), - leapraid_get_sense_buffer(adapter, taskid), - min_t(u32, - SCSI_SENSE_BUFFERSIZE, - le32_to_cpu(scsiio_reply->sense_count))); - } - } + if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) + leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); } _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; complete(&_sp_cmd->done); - return 1; + return true; +} + +static void leapraid_complete_task(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_idx, u32 rep) +{ + if (taskid <= adapter->shost->can_queue || + taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) + leapraid_free_taskid(adapter, taskid); + return; + } + + if (leapraid_driver_cmds_done(adapter, taskid, msix_idx, rep, + leapraid_get_cb_idx(adapter, taskid))) + leapraid_free_taskid(adapter, taskid); } -static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, - union leapraid_rep_desc_union *rpf, - u8 req_desc_type, u8 msix_idx) +static void leapraid_request_descript_handler( + struct leapraid_adapter *adapter, + union leapraid_rep_desc_union *rpf, + u8 req_desc_type, u8 msix_idx) { u32 rep; u16 taskid; @@ -5333,50 +6019,34 @@ static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, switch (req_desc_type) { case LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS: case LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS: - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, msix_idx, 0); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, 0, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } + leapraid_complete_task(adapter, taskid, msix_idx, 0); break; case LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY: rep = le32_to_cpu(rpf->addr_rep.rep_frame_addr); - if (rep > ((u32)adapter->mem_desc.rep_msg_dma + - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ) || - rep < ((u32)adapter->mem_desc.rep_msg_dma)) + if (rep > (u32)adapter->mem_desc.rep_msg_dma + + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE || + rep < (u32)adapter->mem_desc.rep_msg_dma) rep = 0; - if (taskid) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, - msix_idx, rep); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, rep, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } - } else { + + if (taskid) + leapraid_complete_task(adapter, taskid, msix_idx, rep); + else leapraid_handle_async_event(adapter, msix_idx, rep); - } - if (rep) { - adapter->rep_msg_host_idx = - (adapter->rep_msg_host_idx == - (adapter->adapter_attr.rep_msg_qd - 1)) ? - 0 : adapter->rep_msg_host_idx + 1; - adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = - cpu_to_le32(rep); - wmb(); /* Make sure that all write ops are in order */ - writel(adapter->rep_msg_host_idx, - &adapter->iomem_base->rep_msg_host_idx); - } + if (!rep) + return; + + adapter->rep_msg_host_idx = + (adapter->rep_msg_host_idx == + (adapter->adapter_attr.rep_msg_qd - 1)) ? + 0 : adapter->rep_msg_host_idx + 1; + adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = + cpu_to_le32(rep); + wmb(); /* Make sure that all write ops are in order */ + writel(adapter->rep_msg_host_idx, + &adapter->iomem_base->rep_msg_host_idx); + break; default: break; @@ -5438,8 +6108,8 @@ int leapraid_rep_queue_handler(struct leapraid_rq *rq) wmb(); /* Make sure that all write ops are in order */ writel(rq->rep_post_host_idx | ((msix_idx & LEAPRAID_MSIX_GROUP_MASK) << LEAPRAID_RPHI_MSIX_IDX_SHIFT), - &adapter->iomem_base->rep_post_reg_idx[msix_idx / - LEAPRAID_MSIX_GROUP_SIZE].idx); + &adapter->iomem_base->rep_post_reg_idx[ + msix_idx / LEAPRAID_MSIX_GROUP_SIZE].idx); atomic_dec(&rq->busy); return finish_cmds; } @@ -5456,7 +6126,7 @@ static irqreturn_t leapraid_irq_handler(int irq, void *bus_id) if (adapter->mask_int) return IRQ_NONE; - return ((leapraid_rep_queue_handler(rq) > 0) ? + return (leapraid_rep_queue_handler(rq) > 0 ? IRQ_HANDLED : IRQ_NONE); } @@ -5484,7 +6154,8 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) if (int_rq->rq.msix_idx == 0) continue; - synchronize_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx)); + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); if (poll) leapraid_rep_queue_handler(&int_rq->rq); } @@ -5506,16 +6177,18 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 1); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 1); for (qid = 0; qid < iopoll_q_count; qid++) { - while (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy)) { + while (atomic_read(&desc->blk_mq_poll_rqs[qid].busy)) { cpu_relax(); udelay(LEAPRAID_IO_POLL_DELAY_US); } @@ -5524,19 +6197,30 @@ void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) void leapraid_mq_polling_resume(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 0); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 0); } static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, u32 *host_diag) { - const u32 unlock_seq[] = { 0x0, 0xF, 0x4, 0xB, 0x2, 0x7, 0xD }; + const u32 unlock_seq[] = { + LEAPRAID_WRSEQ_FLUSH_KEY_VALUE, + LEAPRAID_WRSEQ_1ST_KEY_VALUE, + LEAPRAID_WRSEQ_2ND_KEY_VALUE, + LEAPRAID_WRSEQ_3RD_KEY_VALUE, + LEAPRAID_WRSEQ_4TH_KEY_VALUE, + LEAPRAID_WRSEQ_5TH_KEY_VALUE, + LEAPRAID_WRSEQ_6TH_KEY_VALUE + }; + const int max_retries = LEAPRAID_UNLOCK_RETRY_LIMIT; int retry = 0; unsigned int i; @@ -5553,51 +6237,46 @@ static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, return 0; } - dev_err(&adapter->pdev->dev, "try host reset timeout!\n"); + dev_err(&adapter->pdev->dev, "Try host reset timeout!\n"); return -EFAULT; } static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - u32 cnt; - dev_info(&adapter->pdev->dev, "entering host diag reset!\n"); + dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); if (leapraid_unlock_host_diag(adapter, &host_diag)) - goto out; + goto out_cleanup; writel(host_diag | LEAPRAID_DIAG_RESET, &adapter->iomem_base->host_diag); + msleep(LEAPRAID_MSLEEP_EXTRA_LONG_MS); msleep(LEAPRAID_MSLEEP_NORMAL_MS); - for (cnt = 0; cnt < LEAPRAID_RESET_LOOP_COUNT_DEFAULT; cnt++) { - host_diag = leapraid_readl(&adapter->iomem_base->host_diag); - if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL) - goto out; - if (!(host_diag & LEAPRAID_DIAG_RESET)) - break; - - msleep(LEAPRAID_RESET_POLL_INTERVAL_MS); - } + host_diag = leapraid_readl(&adapter->iomem_base->host_diag); + if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL || + host_diag & LEAPRAID_DIAG_RESET) + goto out_cleanup; - writel(host_diag & ~LEAPRAID_DIAG_HOLD_ADAPTER_RESET, - &adapter->iomem_base->host_diag); writel(0x0, &adapter->iomem_base->ws); mutex_unlock(&adapter->reset_desc.host_diag_mutex); if (!leapraid_wait_adapter_ready(adapter)) - goto out; + goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag success!\n"); + dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; -out: - pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag failed!\n"); + +out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); +out_failed: + pci_cfg_access_unlock(adapter->pdev); + dev_info(&adapter->pdev->dev, "Host diag failed!\n"); return -EFAULT; } @@ -5607,12 +6286,12 @@ static int leapraid_find_matching_port( { int i; - for (i = 0; i < count; i++) { + for (i = 0; i < count; i++) if (card_port_table[i].port_id == port_id && card_port_table[i].sas_address == sas_addr) return i; - } - return -1; + + return LEAPRAID_INVALID_INDEX; } static u8 leapraid_fill_card_port_table( @@ -5626,12 +6305,13 @@ static u8 leapraid_fill_card_port_table( int i, idx; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if ((sas_iounit_p0->phy_info[i].neg_link_rate >> 4) - < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + if (sas_iounit_p0->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < + LEAPRAID_SAS_NEG_LINK_RATE_1_5) continue; - attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + attached_hdl = le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) @@ -5663,7 +6343,7 @@ static u8 leapraid_set_new_card_port_table_after_reset( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; u8 port_entry_num = 0; u16 sz; @@ -5675,14 +6355,14 @@ static u8 leapraid_set_new_card_port_table_after_reset( return port_entry_num; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; port_entry_num = leapraid_fill_card_port_table(adapter, sas_iounit_p0, new_card_port_table); -out: +out_free: kfree(sas_iounit_p0); return port_entry_num; } @@ -5691,9 +6371,9 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, struct leapraid_card_port *new_table, int entry_idx, int port_entry_num) { - struct leapraid_card_port *matched_card_port = NULL; + struct leapraid_card_port *matched_card_port; int matched_code; - int count = 0, lcount = 0; + int count, lcount = 0; u64 sas_addr; int i; @@ -5714,10 +6394,10 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, port_entry_num); } else if (matched_code == SAME_ADDR_ONLY) { sas_addr = new_table[entry_idx].sas_address; - for (i = 0; i < port_entry_num; i++) { + for (i = 0; i < port_entry_num; i++) if (new_table[i].sas_address == sas_addr) lcount++; - } + if (count > 1 || lcount > 1) return; @@ -5739,15 +6419,24 @@ static void leapraid_update_card_port_after_reset( struct leapraid_adapter *adapter) { struct leapraid_card_port *new_card_port_table; - struct leapraid_card_port *matched_card_port = NULL; - u8 port_entry_num = 0; + struct leapraid_card_port *matched_card_port; + u8 port_entry_num; u8 nr_phys; int i; if (leapraid_get_adapter_phys(adapter, &nr_phys) || !nr_phys) return; + if (!adapter->dev_topo.card.card_phy) { + adapter->dev_topo.card.card_phy = + kcalloc(nr_phys, sizeof(struct leapraid_card_phy), + GFP_KERNEL); + if (!adapter->dev_topo.card.card_phy) + return; + } + adapter->dev_topo.card.phys_num = nr_phys; + new_card_port_table = kcalloc(adapter->dev_topo.card.phys_num, sizeof(struct leapraid_card_port), GFP_KERNEL); @@ -5755,21 +6444,23 @@ static void leapraid_update_card_port_after_reset( return; port_entry_num = - leapraid_set_new_card_port_table_after_reset(adapter, - new_card_port_table); + leapraid_set_new_card_port_table_after_reset( + adapter, + new_card_port_table); if (!port_entry_num) - return; + goto out_free_port_table; list_for_each_entry(matched_card_port, - &adapter->dev_topo.card_port_list, list) { + &adapter->dev_topo.card_port_list, list) matched_card_port->flg |= LEAPRAID_CARD_PORT_FLG_DIRTY; - } matched_card_port = NULL; for (i = 0; i < port_entry_num; i++) leapraid_update_existing_port(adapter, new_card_port_table, i, port_entry_num); +out_free_port_table: + kfree(new_card_port_table); } static bool leapraid_is_valid_vphy( @@ -5780,13 +6471,16 @@ static bool leapraid_is_valid_vphy( union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; struct leapraid_sas_phy_p0 phy_p0; + u32 dev_info; - if ((sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> 4) < + if (sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < LEAPRAID_SAS_NEG_LINK_RATE_1_5) return false; - if (!(le32_to_cpu(sas_io_unit_p0->phy_info[phy_index].controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP)) + dev_info = le32_to_cpu(sas_io_unit_p0->phy_info[phy_index] + .controller_phy_dev_info); + if (!(dev_info & LEAPRAID_DEVTYP_SEP)) return false; cfgp1.phy_number = phy_index; @@ -5819,7 +6513,7 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, return; may_new_card_port->port_id = may_new_port_id; dev_err(&adapter->pdev->dev, - "%s: new card port %p added, port=%d\n", + "%s: New card port %p added, port=%d\n", __func__, may_new_card_port, may_new_port_id); list_add_tail(&may_new_card_port->list, &adapter->dev_topo.card_port_list); @@ -5835,8 +6529,10 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, sas_dev = leapraid_get_sas_dev_by_addr(adapter, attached_sas_addr, card_port); - if (sas_dev) + if (sas_dev) { sas_dev->card_port = may_new_card_port; + leapraid_sdev_put(sas_dev); + } } if (may_new_card_port->flg & LEAPRAID_CARD_PORT_FLG_DIRTY) { @@ -5851,7 +6547,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; struct leapraid_card_port *card_port, *card_port_next; struct leapraid_vphy *vphy, *vphy_next; u64 attached_sas_addr; @@ -5867,9 +6563,8 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) continue; list_for_each_entry_safe(vphy, vphy_next, - &card_port->vphys_list, list) { + &card_port->vphys_list, list) vphy->flg |= LEAPRAID_VPHY_FLG_DIRTY; - } } sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + @@ -5880,16 +6575,17 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) return; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { if (!leapraid_is_valid_vphy(adapter, sas_iounit_p0, i)) continue; attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) continue; @@ -5931,7 +6627,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) break; } } -out: +out_free: kfree(sas_iounit_p0); } @@ -5943,17 +6639,21 @@ static void leapraid_mark_all_dev_deleted(struct leapraid_adapter *adapter) shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (sdev_priv && sdev_priv->starget_priv) - sdev_priv->starget_priv->deleted = true; + sdev_priv->starget_priv->deleted = 1; } } static void leapraid_free_enc_list(struct leapraid_adapter *adapter) { struct leapraid_enc_node *enc_dev, *enc_dev_next; + LIST_HEAD(free_list); + unsigned long flags; + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + list_splice_init(&adapter->dev_topo.enc_list, &free_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); - list_for_each_entry_safe(enc_dev, enc_dev_next, - &adapter->dev_topo.enc_list, - list) { + list_for_each_entry_safe(enc_dev, enc_dev_next, &free_list, list) { list_del(&enc_dev->list); kfree(enc_dev); } @@ -5966,14 +6666,14 @@ static void leapraid_rebuild_enc_list_after_reset( union cfg_param_2 cfgp2 = {0}; struct leapraid_enc_node *enc_node; u16 enc_hdl; + unsigned long flags; int rc; leapraid_free_enc_list(adapter); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (enc_hdl = 0xFFFF; ; enc_hdl = le16_to_cpu(enc_node->pg0.enc_hdl)) { - enc_node = kzalloc(sizeof(*enc_node), - GFP_KERNEL); + enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); if (!enc_node) return; @@ -5985,91 +6685,102 @@ static void leapraid_rebuild_enc_list_after_reset( return; } + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } } static void leapraid_mark_resp_sas_dev(struct leapraid_adapter *adapter, struct leapraid_sas_dev_p0 *sas_dev_p0) { - struct leapraid_starget_priv *starget_priv = NULL; + struct leapraid_starget_priv *starget_priv; struct leapraid_enc_node *enc_node = NULL; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; struct scsi_target *starget; unsigned long flags; + unsigned long enc_flags = 0; + u16 enc_hdl; + u64 enc_lid = 0; card_port = leapraid_get_port_by_id(adapter, sas_dev_p0->physical_port, false); - if (sas_dev_p0->enc_hdl) { - enc_node = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu( - sas_dev_p0->enc_hdl)); + enc_hdl = le16_to_cpu(sas_dev_p0->enc_hdl); + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); + enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); if (!enc_node) dev_info(&adapter->pdev->dev, "enc hdl 0x%04x has no matched enc dev\n", - le16_to_cpu(sas_dev_p0->enc_hdl)); + enc_hdl); } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) { - if (sas_dev->sas_addr == le64_to_cpu(sas_dev_p0->sas_address) && - sas_dev->slot == le16_to_cpu(sas_dev_p0->slot) && - sas_dev->card_port == card_port) { - sas_dev->resp = true; - starget = sas_dev->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->tm_busy = false; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } + if (sas_dev->sas_addr != le64_to_cpu(sas_dev_p0->sas_address) || + sas_dev->slot != le16_to_cpu(sas_dev_p0->slot) || + sas_dev->card_port != card_port) + continue; + + sas_dev->resp = 1; + starget = sas_dev->starget; + if (starget && starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->tm_busy = 0; + starget_priv->deleted = 0; + } else { + starget_priv = NULL; + } + + if (starget) { + starget_printk( + KERN_INFO, starget, + "dev: hdl=0x%04x saddr=0x%016llx port_id=%d\n", + sas_dev->hdl, + (unsigned long long)sas_dev->sas_addr, + sas_dev->card_port->port_id); + if (sas_dev->enc_hdl != 0) + starget_printk( + KERN_INFO, + starget, + "enc info: enc_lid=0x%016llx slot=%d\n", + (unsigned long long)sas_dev->enc_lid, + sas_dev->slot); + } + + if (le16_to_cpu(sas_dev_p0->flg) & + LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { + sas_dev->enc_level = sas_dev_p0->enc_level; + memcpy(sas_dev->connector_name, + sas_dev_p0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[ + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = '\0'; + } else { + sas_dev->enc_level = 0; + sas_dev->connector_name[0] = '\0'; + } - if (starget) { - starget_printk(KERN_INFO, starget, - "dev: hdl=0x%04x, sas addr=0x%016llx, port_id=%d\n", - sas_dev->hdl, - (unsigned long long)sas_dev->sas_addr, - sas_dev->card_port->port_id); - if (sas_dev->enc_hdl != 0) - starget_printk(KERN_INFO, starget, - "enc info: enc_lid=0x%016llx, slot=%d\n", - (unsigned long long)sas_dev->enc_lid, - sas_dev->slot); - } + sas_dev->enc_hdl = enc_hdl; + sas_dev->enc_lid = enc_lid; - if (le16_to_cpu(sas_dev_p0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = sas_dev_p0->enc_level; - memcpy(sas_dev->connector_name, - sas_dev_p0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } + if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) + goto unlock; - sas_dev->enc_hdl = - le16_to_cpu(sas_dev_p0->enc_hdl); - if (enc_node) { - sas_dev->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - } - if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) - goto out; + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + sas_dev->hdl, sas_dev_p0->dev_hdl); + sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + if (starget_priv) + starget_priv->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - sas_dev->hdl, sas_dev_p0->dev_hdl); - sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - if (starget_priv) - starget_priv->hdl = - le16_to_cpu(sas_dev_p0->dev_hdl); - goto out; - } + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); } @@ -6081,10 +6792,10 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) u32 device_info; dev_info(&adapter->pdev->dev, - "begin searching for sas end devices\n"); + "Begin searching for SAS end devices\n"); if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6097,63 +6808,58 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "sas end devices searching complete\n"); + "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, u64 wwid, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; + struct leapraid_starget_priv *starget_priv = NULL; struct scsi_target *starget; unsigned long flags; + u64 volume_wwid; + u16 old_hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_for_each_entry(raid_volume, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid && raid_volume->starget) { - starget = raid_volume->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } - - raid_volume->resp = true; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); + raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); + if (!raid_volume) + return; - starget_printk( - KERN_INFO, raid_volume->starget, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", - hdl, (unsigned long long)raid_volume->wwid); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume->hdl == hdl) { - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (!raid_volume->starget) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); + return; + } - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - raid_volume->hdl, hdl); + starget = raid_volume->starget; + if (starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->deleted = 0; + } - raid_volume->hdl = hdl; - if (starget_priv) - starget_priv->hdl = hdl; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + raid_volume->resp = 1; + volume_wwid = raid_volume->wwid; + old_hdl = raid_volume->hdl; + if (old_hdl != hdl) { + raid_volume->hdl = hdl; + if (starget_priv) + starget_priv->hdl = hdl; } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + starget_printk(KERN_INFO, starget, + "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + hdl, (unsigned long long)volume_wwid); + if (old_hdl != hdl) + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + old_hdl, hdl); + + leapraid_raid_volume_put(raid_volume); } static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) @@ -6165,17 +6871,22 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) struct leapraid_raidvol_p1 raidvol_p1; struct leapraid_raidvol_p0 raidvol_p0; struct leapraid_raidpd_p0 raidpd_p0; + unsigned long flags; u16 hdl; u8 phys_disk_num; + bool is_empty; if (!adapter->adapter_attr.raid_support) return; dev_info(&adapter->pdev->dev, - "begin searching for raid volumes\n"); + "Begin searching for RAID volumes\n"); - if (list_empty(&adapter->dev_topo.raid_volume_list)) - goto out; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + is_empty = list_empty(&adapter->dev_topo.raid_volume_list); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (is_empty) + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6206,11 +6917,16 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) cfgp2.form_specific = phys_disk_num) { phys_disk_num = raidpd_p0.phys_disk_num; hdl = le16_to_cpu(raidpd_p0.dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + else + set_bit(hdl, adapter->dev_topo.pd_hdls); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "raid volumes searching complete\n"); + "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6226,10 +6942,17 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, port_id, false); unsigned long flags; + unsigned long enc_flags = 0; + u64 enc_lid = 0; int i; - if (enc_hdl) + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); + } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); list_for_each_entry(topo_node_exp, &adapter->dev_topo.exp_list, list) { @@ -6237,14 +6960,11 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->card_port != card_port) continue; - topo_node_exp->resp = true; - if (enc_node) { - topo_node_exp->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - topo_node_exp->enc_hdl = le16_to_cpu(exp_pg0->enc_hdl); - } + topo_node_exp->resp = 1; + topo_node_exp->enc_hdl = enc_hdl; + topo_node_exp->enc_lid = enc_lid; if (topo_node_exp->hdl == hdl) - goto out; + goto unlock; dev_info(&adapter->pdev->dev, "hdl changed: 0x%04x -> 0x%04x\n", @@ -6252,9 +6972,9 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->hdl = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) topo_node_exp->card_phy[i].hdl = hdl; - goto out; + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); } @@ -6267,10 +6987,10 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_info(&adapter->pdev->dev, - "begin searching for expanders\n"); + dev_dbg(&adapter->pdev->dev, + "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6281,16 +7001,16 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) sas_address = le64_to_cpu(exp_p0.sas_address); port = exp_p0.physical_port; - dev_info(&adapter->pdev->dev, - "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", - hdl, (unsigned long long)sas_address, - ((adapter->adapter_attr.enable_mp) ? (port) : - (LEAPRAID_DISABLE_MP_PORT_ID))); + dev_dbg(&adapter->pdev->dev, + "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", + hdl, (unsigned long long)sas_address, + adapter->adapter_attr.enable_mp ? port : + LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -out: - dev_info(&adapter->pdev->dev, - "expander searching complete\n"); +exit_search: + dev_dbg(&adapter->pdev->dev, + "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -6302,7 +7022,7 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) adapter->reset_desc.pending_io_cnt = 0; if (!leapraid_pci_active(adapter)) { dev_err(&adapter->pdev->dev, - "%s %s: pci error, device reset or unplugged!\n", + "%s %s: PCI error, device reset or unplugged!\n", adapter->adapter_attr.name, __func__); return; } @@ -6314,9 +7034,9 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) for (i = 1; i <= adapter->shost->can_queue; i++) { io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, i); - if (io_req_tracker && io_req_tracker->taskid != 0) - if (io_req_tracker->scmd) - adapter->reset_desc.pending_io_cnt++; + if (io_req_tracker && io_req_tracker->taskid != 0 && + io_req_tracker->scmd) + adapter->reset_desc.pending_io_cnt++; } spin_unlock_irqrestore(&adapter->dynamic_task_desc.task_lock, flags); @@ -6324,38 +7044,37 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) return; wait_event_timeout(adapter->reset_desc.reset_wait_queue, - adapter->reset_desc.pending_io_cnt == 0, 10 * HZ); + adapter->reset_desc.pending_io_cnt == 0, + LEAPRAID_IO_CMD_TIMEOUT * HZ); } int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, enum reset_type type) { unsigned long flags; + bool wake = false; int rc; - if (!mutex_trylock(&adapter->reset_desc.adapter_reset_mutex)) { - do { - ssleep(1); - } while (adapter->access_ctrl.shost_recovering); - return adapter->reset_desc.adapter_reset_results; - } + mutex_lock(&adapter->reset_desc.adapter_reset_mutex); if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, - "pci_dev removed, pausing polling and cleaning cmds\n"); + "pci_dev removed, pause poll, clean cmds\n"); leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); } - rc = 0; - goto exit_pci_unavailable; + dev_err(&adapter->pdev->dev, "PCIe unavailable!\n"); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return -ENXIO; } - dev_info(&adapter->pdev->dev, "starting hard reset\n"); + dev_info(&adapter->pdev->dev, "Starting hard reset\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; + adapter->access_ctrl.shost_recover_async = 1; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); leapraid_wait_cmds_done(adapter); @@ -6364,14 +7083,14 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, rc = leapraid_make_adapter_ready(adapter, type); if (rc) { dev_err(&adapter->pdev->dev, - "failed to make adapter ready, rc=%d\n", rc); - goto out; + "Failed to make adapter ready, rc=%d\n", rc); + goto out_cleanup; } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "firmware log init failed\n"); - goto out; + dev_err(&adapter->pdev->dev, "Firmware log init failed\n"); + goto out_cleanup; } leapraid_clean_active_cmds(adapter); @@ -6379,15 +7098,16 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, adapter->scan_dev_desc.scan_dev_failed) { dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; - goto out; + goto out_cleanup; } rc = leapraid_make_adapter_available(adapter); if (!rc) { dev_info(&adapter->pdev->dev, - "adapter is now available, rebuilding topology\n"); + "Adapter is now available, rebuilding topology\n"); if (adapter->adapter_attr.enable_mp) { leapraid_update_card_port_after_reset(adapter); leapraid_update_vphys_after_reset(adapter); @@ -6399,14 +7119,22 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_search_resp_exp(adapter); leapraid_hardreset_barrier(adapter); } -out: - dev_info(&adapter->pdev->dev, "hard reset %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); +out_cleanup: + dev_info(&adapter->pdev->dev, "Hard reset %s\n", + rc == 0 ? "SUCCESS" : "FAILED"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + if (rc) { + adapter->access_ctrl.shost_recover_async = 0; + wake = true; + } spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + if (wake) + wake_up(&adapter->access_ctrl.shost_recover_wq); + adapter->reset_desc.reset_cnt++; mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); @@ -6414,8 +7142,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); -exit_pci_unavailable: - dev_info(&adapter->pdev->dev, "pcie unavailable!\n"); return rc; } @@ -6424,31 +7150,40 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) struct leapraid_adapter_features_req leap_mpi_req; struct leapraid_adapter_features_rep leap_mpi_rep; u8 fw_major, fw_minor, fw_build, fw_release; + u32 req_sz; + u32 rep_sz; u32 db; int r; db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED || - (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) + (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { + dev_err(&adapter->pdev->dev, + "%s: Doorbell used or fault\n", __func__); return -EFAULT; + } - if (((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) && - ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL)) { - if (!leapraid_wait_adapter_ready(adapter)) - return -EFAULT; + if ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY && + (db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL && + !leapraid_wait_adapter_ready(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: adapter not ready\n", __func__); + return -EFAULT; } - memset(&leap_mpi_req, 0, sizeof(struct leapraid_adapter_features_req)); - memset(&leap_mpi_rep, 0, sizeof(struct leapraid_adapter_features_rep)); + req_sz = sizeof(struct leapraid_adapter_features_req); + rep_sz = sizeof(struct leapraid_adapter_features_rep); + memset(&leap_mpi_req, 0, req_sz); + memset(&leap_mpi_rep, 0, rep_sz); leap_mpi_req.func = LEAPRAID_FUNC_GET_ADAPTER_FEATURES; r = leapraid_handshake_func(adapter, - sizeof(struct leapraid_adapter_features_req), + req_sz, (u32 *)&leap_mpi_req, - sizeof(struct leapraid_adapter_features_rep), + rep_sz, (u16 *)&leap_mpi_rep); if (r) { dev_err(&adapter->pdev->dev, - "%s %s: handshake failed, r=%d\n", + "%s %s: Handshake failed, r=%d\n", adapter->adapter_attr.name, __func__, r); return r; } @@ -6475,19 +7210,43 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) LEAPRAID_MAX_DEV_HANDLE_DEFAULT; adapter->adapter_attr.features.min_dev_handle = le16_to_cpu(leap_mpi_rep.min_dev_hdl); - if ((adapter->adapter_attr.features.adapter_caps & - LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID)) - adapter->adapter_attr.raid_support = true; + if (adapter->adapter_attr.features.adapter_caps & + LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID) + adapter->adapter_attr.raid_support = 1; + adapter->adapter_attr.wideport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.sata_max_queue_depth = + leap_mpi_rep.sata_max_qdepth ? + leap_mpi_rep.sata_max_qdepth : + LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.raid_volume_max_queue_depth = + LEAPRAID_RAID_QUEUE_DEPTH; + dev_info(&adapter->pdev->dev, + "max: wp qd=%d, np qd=%d, SATA qd=%d, raid qd=%d\n", + adapter->adapter_attr.wideport_max_queue_depth, + adapter->adapter_attr.narrowport_max_queue_depth, + adapter->adapter_attr.sata_max_queue_depth, + adapter->adapter_attr.raid_volume_max_queue_depth); if (WARN_ON(!(adapter->adapter_attr.features.adapter_caps & LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ))) return -EFAULT; adapter->adapter_attr.features.fw_version = le32_to_cpu(leap_mpi_rep.fw_version); - fw_major = (adapter->adapter_attr.features.fw_version >> 24) & 0xFF; - fw_minor = (adapter->adapter_attr.features.fw_version >> 16) & 0xFF; - fw_build = (adapter->adapter_attr.features.fw_version >> 8) & 0xFF; - fw_release = adapter->adapter_attr.features.fw_version & 0xFF; + fw_major = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MAJOR_SHIFT) & LEAPRAID_VER_MASK; + fw_minor = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MINOR_SHIFT) & LEAPRAID_VER_MASK; + fw_build = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_BUILD_SHIFT) & LEAPRAID_VER_MASK; + fw_release = + adapter->adapter_attr.features.fw_version & LEAPRAID_VER_MASK; dev_info(&adapter->pdev->dev, "Firmware version: %u.%u.%u.%u (0x%08x)\n", @@ -6499,7 +7258,7 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) "Unsupported firmware major version, requires >= 2\n"); return -EFAULT; } - adapter->shost->max_id = -1; + adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; return 0; } @@ -6525,53 +7284,49 @@ static int leapraid_enable_pcie(struct leapraid_adapter *adapter) rc = pci_enable_device(adapter->pdev); if (rc) { - dev_err(&adapter->pdev->dev, "failed to enable PCI device\n"); + dev_err(&adapter->pdev->dev, "Failed to enable PCI device\n"); return rc; } rc = pci_request_regions(adapter->pdev, LEAPRAID_DRIVER_NAME); if (rc) { dev_err(&adapter->pdev->dev, - "failed to obtain PCI resources\n"); - goto disable_pcie; + "Failed to obtain PCI resources\n"); + return rc; } if (sizeof(dma_addr_t) > 4) { - dma_mask = DMA_BIT_MASK(64); - adapter->adapter_attr.use_32_dma_mask = false; + dma_mask = DMA_BIT_MASK(DMA_64_BITS); + adapter->adapter_attr.use_32_dma_mask = 0; } else { - dma_mask = DMA_BIT_MASK(32); - adapter->adapter_attr.use_32_dma_mask = true; + dma_mask = DMA_BIT_MASK(DMA_32_BITS); + adapter->adapter_attr.use_32_dma_mask = 1; } rc = dma_set_mask_and_coherent(&adapter->pdev->dev, dma_mask); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set %lld DMA mask\n", dma_mask); - goto disable_pcie; + "Failed to set %lld DMA mask\n", dma_mask); + return rc; } adapter->iomem_base = ioremap(pci_resource_start(adapter->pdev, 0), sizeof(struct leapraid_reg_base)); if (!adapter->iomem_base) { dev_err(&adapter->pdev->dev, - "failed to map memory for controller registers\n"); - rc = -ENOMEM; - goto disable_pcie; + "Failed to map memory for controller registers\n"); + return -ENOMEM; } pci_set_master(adapter->pdev); return 0; - -disable_pcie: - return rc; } static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i, base_group, this_group; - unsigned int cpu, nr_cpus, total_msix, index = 0; + unsigned int cpu, nr_cpus, total_msix, index; total_msix = adapter->notification_desc.iopoll_qdex; nr_cpus = num_online_cpus(); @@ -6613,8 +7368,12 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq = &adapter->notification_desc.int_rqs[i]; affinity_mask = pci_irq_get_affinity(adapter->pdev, int_rq->rq.msix_idx); - if (!affinity_mask) - goto out; + if (!affinity_mask) { + dev_warn(&adapter->pdev->dev, + "%s: IRQ affinity NULL, msix_idx=%d\n", + __func__, int_rq->rq.msix_idx); + goto out_apply_irq_affinity; + } for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) @@ -6624,7 +7383,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } -out: +out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -6641,27 +7400,26 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i; + int irq; - if (!adapter->notification_desc.int_rqs) - return; - - for (i = 0; i < adapter->notification_desc.int_rqs_allocated; i++) { + for (i = 0; adapter->notification_desc.int_rqs && + i < adapter->notification_desc.int_rqs_allocated; i++) { int_rq = &adapter->notification_desc.int_rqs[i]; if (!int_rq) continue; - irq_set_affinity_hint(pci_irq_vector(adapter->pdev, - int_rq->rq.msix_idx), NULL); - free_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx), - &int_rq->rq); + irq = pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx); + irq_set_affinity_hint(irq, NULL); + free_irq(irq, &int_rq->rq); } adapter->notification_desc.int_rqs_allocated = 0; - if (!adapter->notification_desc.msix_enable) - return; + if (adapter->notification_desc.irq_vectors_allocated) { + pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; + } - pci_free_irq_vectors(adapter->pdev); - adapter->notification_desc.msix_enable = false; + adapter->notification_desc.msix_enable = 0; kfree(adapter->notification_desc.blk_mq_poll_rqs); adapter->notification_desc.blk_mq_poll_rqs = NULL; @@ -6671,16 +7429,9 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) kfree(adapter->notification_desc.msix_cpu_map); adapter->notification_desc.msix_cpu_map = NULL; -} - -static inline int leapraid_msix_cnt(struct pci_dev *pdev) -{ - return pci_msix_vec_count(pdev); -} - -static inline int leapraid_msi_cnt(struct pci_dev *pdev) -{ - return pci_msi_vec_count(pdev); + adapter->notification_desc.msix_cpu_map_sz = 0; + adapter->notification_desc.iopoll_qdex = 0; + adapter->notification_desc.iopoll_qcnt = 0; } static int leapraid_setup_irqs(struct leapraid_adapter *adapter) @@ -6688,7 +7439,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) unsigned int i; int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, @@ -6697,22 +7448,26 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi/msix vectors alloacted failed!\n", + "%d MSI/MSIX vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); return rc; } + + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = + LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == 0) + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == 1) + else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -6723,6 +7478,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); + if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -6754,10 +7510,12 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "legacy irq alloacted failed!\n"); + "Legacy irq allocated failed!\n"); return rc; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_LEGACY; rc = request_irq(pci_irq_vector(adapter->pdev, 0), leapraid_irq_handler, IRQF_SHARED, @@ -6766,8 +7524,9 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) if (rc) { irq_set_affinity_hint(pci_irq_vector(adapter->pdev, 0), NULL); pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; dev_err(&adapter->pdev->dev, - "Legact Int: request_irq %s failed!\n", + "Legacy Int: request_irq %s failed!\n", adapter->notification_desc.int_rqs[0].rq.name); return -EBUSY; } @@ -6781,8 +7540,8 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; @@ -6791,19 +7550,15 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->adapter_attr.rq_cnt; adapter->notification_desc.iopoll_qcnt = 0; dev_info(&adapter->pdev->dev, - "Legacy Intr: req queue cnt=%d, intr=%d/poll=%d rep queues!\n", + "Legacy Intr: req queue cnt=%d intr=%d/poll=%d rep queues!\n", adapter->adapter_attr.rq_cnt, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qcnt); adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "Legacy Intr: allocate %d intr rep queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } rc = leapraid_setup_legacy_int(adapter); @@ -6817,13 +7572,13 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) int rc, msix_cnt; if (msix_disable == 1) - goto legacy_int; + goto apply_legacy_int; - msix_cnt = leapraid_msix_cnt(adapter->pdev); + msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); - goto legacy_int; + dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); + goto apply_legacy_int; } msix_cnt = min_t(int, msix_cnt, @@ -6872,25 +7627,25 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSIx: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = adapter; adapter->notification_desc.blk_mq_poll_rqs[i].rq.msix_idx = i + adapter->notification_desc.iopoll_qdex; - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, 0); + atomic_set( + &adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, + 0); snprintf(adapter->notification_desc.blk_mq_poll_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MQ-Poll%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, 0); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, + 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, + 0); } adapter->notification_desc.msix_cpu_map_sz = @@ -6900,20 +7655,21 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; + memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -6926,13 +7682,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) int rc, msi_cnt; if (msix_disable == 1) - goto legacy_int1; + goto apply_legacy_int; - msi_cnt = leapraid_msi_cnt(adapter->pdev); + msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msi unsupported!\n"); - goto legacy_int1; + dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); + goto apply_legacy_int; } msi_cnt = min_t(int, msi_cnt, @@ -6979,10 +7735,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) PCI_IRQ_MSI | PCI_IRQ_AFFINITY, NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi vectors alloacted failed!\n", + "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); - goto legacy_int1; + leapraid_free_irq(adapter); + goto apply_legacy_int; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -6999,12 +7758,8 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSI: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = @@ -7028,24 +7783,24 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int1; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int1: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -7055,30 +7810,26 @@ static int leapraid_set_notification(struct leapraid_adapter *adapter) { int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = leapraid_set_msix(adapter); if (rc) - pr_err("%s enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == 1) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI-X irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { rc = leapraid_set_msi(adapter); if (rc) - pr_err("%s enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == 2) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { rc = leapraid_set_legacy_int(adapter); if (rc) - pr_err("%s enable legacy irq failed!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); } return rc; } -static void leapraid_disable_pcie_and_notification( - struct leapraid_adapter *adapter) -{ - leapraid_free_irq(adapter); - leapraid_disable_pcie(adapter); -} - int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) { int rc; @@ -7091,13 +7842,13 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_ready(adapter, PART_RESET); if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + dev_err(&adapter->pdev->dev, "Make adapter ready failure\n"); goto out_fail; } rc = leapraid_get_adapter_features(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + dev_err(&adapter->pdev->dev, "Get adapter feature failure\n"); goto out_fail; } @@ -7110,7 +7861,8 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) return 0; out_fail: - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); return rc; } @@ -7121,11 +7873,13 @@ void leapraid_disable_controller(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; leapraid_make_adapter_ready(adapter, PART_RESET); - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); } static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) @@ -7139,12 +7893,11 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - rc = -EFAULT; - goto out; + dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + return -EFAULT; } -out: - dev_info(&adapter->pdev->dev, "unit reset: %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); + + dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7164,13 +7917,13 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, while ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) { if (count++ == LEAPRAID_DB_RETRY_COUNT_MAX) { dev_err(&adapter->pdev->dev, - "wait adapter ready timeout\n"); + "Wait adapter ready timeout\n"); return -EFAULT; } ssleep(1); db = leapraid_readl(&adapter->iomem_base->db); dev_info(&adapter->pdev->dev, - "wait adapter ready, count=%d, db=0x%x\n", + "Wait adapter ready, count=%d, db=0x%x\n", count, db); } } @@ -7186,9 +7939,9 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, if (type == FULL_RESET) goto full_reset; - if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL) - if (!(leapraid_adapter_unit_reset(adapter))) - return 0; + if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL && + !leapraid_adapter_unit_reset(adapter)) + return 0; full_reset: rc = leapraid_host_diag_reset(adapter); @@ -7229,12 +7982,8 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) LEAPRAID_SYS_LOG_BUF_RESERVE), &adapter->fw_log_desc.fw_log_buffer_dma, GFP_KERNEL); - if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, - "%s: log buf alloc failed.\n", - __func__); + if (!adapter->fw_log_desc.fw_log_buffer) return -ENOMEM; - } } memset(&adapter_log_req, 0, sizeof(struct leapraid_adapter_log_req)); @@ -7253,7 +8002,7 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_log_rep), (u16 *)&adapter_log_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7292,7 +8041,7 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_msg) { dma_free_coherent( &adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ, + adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE, adapter->mem_desc.rep_msg, adapter->mem_desc.rep_msg_dma); adapter->mem_desc.rep_msg = NULL; @@ -7310,15 +8059,19 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_desc_seg_maint) { for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { - if (adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { + if (adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg) { dma_free_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma); - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = NULL; + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg, + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma); + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg = NULL; } } @@ -7333,7 +8086,8 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) } for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) - kfree(adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint); + kfree(adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_maint); kfree(adapter->mem_desc.rep_desc_seg_maint); } @@ -7345,16 +8099,16 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) { - return (upper_32_bits(start) == upper_32_bits(start + size - 1)); + return upper_32_bits(start) == upper_32_bits(start + size - 1); } int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker) { io_tracker->chain = - dma_pool_alloc(adapter->mem_desc.sg_chain_pool, - GFP_KERNEL, - &io_tracker->chain_dma); + dma_pool_alloc(adapter->mem_desc.sg_chain_pool, + GFP_KERNEL, + &io_tracker->chain_dma); if (!io_tracker->chain) return -ENOMEM; @@ -7381,17 +8135,16 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) unsigned int i, j; int rc; - /* sg table size */ + /* Scatter-gather table size. */ adapter->shost->sg_tablesize = LEAPRAID_SG_DEPTH; if (reset_devices) adapter->shost->sg_tablesize = LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS; - /* high priority cmds queue depth */ - adapter->dynamic_task_desc.hp_cmd_qd = facts->hp_slot; + /* High-priority commands queue depth. */ adapter->dynamic_task_desc.hp_cmd_qd = LEAPRAID_FIXED_HP_CMDS; - /* internal cmds queue depth */ + /* Internal commands queue depth. */ adapter->dynamic_task_desc.inter_cmd_qd = LEAPRAID_FIXED_INTER_CMDS; - /* adapter cmds total queue depth */ + /* Adapter commands total queue depth. */ if (reset_devices) adapter->adapter_attr.adapter_total_qd = LEAPRAID_DEFAULT_CMD_QD_OFFSET + @@ -7400,22 +8153,22 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) else adapter->adapter_attr.adapter_total_qd = facts->req_slot + adapter->dynamic_task_desc.hp_cmd_qd; - /* reply message queue depth */ + /* Reply message queue depth. */ adapter->adapter_attr.rep_msg_qd = adapter->adapter_attr.adapter_total_qd + LEAPRAID_DEFAULT_CMD_QD_OFFSET; - /* reply descriptor queue depth */ + /* Reply descriptor queue depth. */ adapter->adapter_attr.rep_desc_qd = round_up(adapter->adapter_attr.adapter_total_qd + adapter->adapter_attr.rep_msg_qd + LEAPRAID_TASKID_OFFSET_CTRL_CMD, LEAPRAID_REPLY_QD_ALIGNMENT); - /* scsi cmd io depth */ + /* SCSI command I/O depth. */ adapter->adapter_attr.io_qd = adapter->adapter_attr.adapter_total_qd - adapter->dynamic_task_desc.hp_cmd_qd - adapter->dynamic_task_desc.inter_cmd_qd; - /* scsi host can queue */ + /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + @@ -7424,7 +8177,7 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; - /* allocate task descriptor */ + /* Allocate task descriptor. */ try_again: adapter->adapter_attr.task_desc_dma_size = (adapter->adapter_attr.adapter_total_qd + @@ -7435,39 +8188,31 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->adapter_attr.task_desc_dma_size, &adapter->mem_desc.task_desc_dma, GFP_KERNEL); - if (!adapter->mem_desc.task_desc) { - dev_err(&adapter->pdev->dev, - "failed to allocate task descriptor DMA!\n"); - rc = -ENOMEM; - goto out; - } - /* allocate chain message pool */ + if (!adapter->mem_desc.task_desc) + return -ENOMEM; + + /* Allocate chain message pool. */ adapter->mem_desc.sg_chain_pool_size = LEAPRAID_DEFAULT_CHAINS_PER_IO * LEAPRAID_CHAIN_SEG_SIZE; adapter->mem_desc.sg_chain_pool = dma_pool_create("leapraid chain pool", &adapter->pdev->dev, - adapter->mem_desc.sg_chain_pool_size, 16, 0); - if (!adapter->mem_desc.sg_chain_pool) { - dev_err(&adapter->pdev->dev, - "failed to allocate chain message DMA!\n"); - rc = -ENOMEM; - goto out; - } + adapter->mem_desc.sg_chain_pool_size, + LEAPRAID_DMA_ALIGN, 0); + if (!adapter->mem_desc.sg_chain_pool) + return -ENOMEM; - /* allocate io tracker to ref scsi io */ + /* Allocate I/O tracker to SCSI I/O. */ adapter->mem_desc.taskid_to_uniq_tag = - kcalloc(adapter->shost->can_queue, sizeof(u16), GFP_KERNEL); - if (!adapter->mem_desc.taskid_to_uniq_tag) { - rc = -ENOMEM; - goto out; - } + kcalloc(adapter->shost->can_queue, sizeof(u16), GFP_KERNEL); + if (!adapter->mem_desc.taskid_to_uniq_tag) + return -ENOMEM; adapter->dynamic_task_desc.hp_taskid = adapter->adapter_attr.io_qd + LEAPRAID_HP_TASKID_OFFSET_CTL_CMD; - /* allocate static hp taskid */ + /* Allocate static high-priority task ID. */ adapter->driver_cmds.ctl_cmd.hp_taskid = adapter->dynamic_task_desc.hp_taskid; adapter->driver_cmds.tm_cmd.hp_taskid = @@ -7488,9 +8233,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; - adapter->driver_cmds.raid_action_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -7518,64 +8260,58 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_taskid); /* - * allocate sense dma, driver maintain - * need in same 4GB segment + * Allocate sense data DMA buffer. + * Constraint: Must reside within the same 4GB segment + * (driver-maintained). */ adapter->mem_desc.sense_data = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE, - &adapter->mem_desc.sense_data_dma, GFP_KERNEL); - if (!adapter->mem_desc.sense_data) { - dev_err(&adapter->pdev->dev, - "failed to allocate sense data DMA!\n"); - rc = -ENOMEM; - goto out; - } + &adapter->mem_desc.sense_data_dma, + GFP_KERNEL); + if (!adapter->mem_desc.sense_data) + return -ENOMEM; + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.sense_data_dma, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE)) { dev_warn(&adapter->pdev->dev, - "try 32 bit dma due to sense data is not in same 4g!\n"); + "Try 32bit DMA: Sense not in same 4G\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* reply frame, need in same 4GB segment */ + /* + * Allocate reply frame buffer. + * Constraint: Must reside in the same 4GB segment as the sense DMA. + */ adapter->mem_desc.rep_msg = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ, - &adapter->mem_desc.rep_msg_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE, + &adapter->mem_desc.rep_msg_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg) + return -ENOMEM; if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ)) { + LEAPRAID_REPLY_SIZE)) { dev_warn(&adapter->pdev->dev, - "use 32 bit dma due to rep msg is not in same 4g!\n"); + "Use 32 bit DMA due to rep msg is not in same 4g!\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* address of reply frame */ + /* Address of reply frame. */ adapter->mem_desc.rep_msg_addr = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REP_MSG_ADDR_SIZE, - &adapter->mem_desc.rep_msg_addr_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg_addr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message address DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REP_MSG_ADDR_SIZE, + &adapter->mem_desc.rep_msg_addr_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg_addr) + return -ENOMEM; adapter->adapter_attr.rep_desc_q_seg_cnt = DIV_ROUND_UP(adapter->adapter_attr.rq_cnt, LEAPRAID_REP_DESC_CHUNK_SIZE); @@ -7583,10 +8319,8 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(adapter->adapter_attr.rep_desc_q_seg_cnt, sizeof(struct leapraid_rep_desc_seg_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint) + return -ENOMEM; rep_desc_q_cnt_allocated = 0; for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { @@ -7594,25 +8328,20 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(LEAPRAID_REP_DESC_CHUNK_SIZE, sizeof(struct leapraid_rep_desc_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) + return -ENOMEM; adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * - LEAPRAID_REP_DESC_ENTRY_SIZE) * + LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - &adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma, + &adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor segment DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) + return -ENOMEM; for (j = 0; j < LEAPRAID_REP_DESC_CHUNK_SIZE; j++) { if (rep_desc_q_cnt_allocated >= @@ -7645,30 +8374,26 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) if (!reset_devices) { adapter->mem_desc.rep_desc_q_arr = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.rq_cnt * LEAPRAID_REP_RQ_CNT_SIZE, &adapter->mem_desc.rep_desc_q_arr_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_q_arr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor queue array DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_q_arr) + return -ENOMEM; } return 0; -out: +out_fail: if (rc == -EAGAIN) { leapraid_free_host_memory(adapter); - adapter->adapter_attr.use_32_dma_mask = true; + adapter->adapter_attr.use_32_dma_mask = 1; rc = dma_set_mask_and_coherent(&adapter->pdev->dev, - DMA_BIT_MASK(32)); + DMA_BIT_MASK(DMA_32_BITS)); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set 32 DMA mask\n"); + "Failed to set 32 DMA mask\n"); return rc; } goto try_again; @@ -7678,12 +8403,13 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { - adapter->dev_topo.pd_hdls_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pd_hdls_sz++; + u16 pd_hdls_sz; + + pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / + LEAPRAID_BITS_PER_BYTE; + pd_hdls_sz++; + + adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = kzalloc(adapter->dev_topo.pd_hdls_sz, GFP_KERNEL); if (!adapter->dev_topo.pd_hdls) @@ -7694,24 +8420,6 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) if (!adapter->dev_topo.blocking_hdls) return -ENOMEM; - adapter->dev_topo.pending_dev_add_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pending_dev_add_sz++; - adapter->dev_topo.pending_dev_add = - kzalloc(adapter->dev_topo.pending_dev_add_sz, GFP_KERNEL); - if (!adapter->dev_topo.pending_dev_add) - return -ENOMEM; - - adapter->dev_topo.dev_removing_sz = - adapter->dev_topo.pending_dev_add_sz; - adapter->dev_topo.dev_removing = - kzalloc(adapter->dev_topo.dev_removing_sz, GFP_KERNEL); - if (!adapter->dev_topo.dev_removing) - return -ENOMEM; - return 0; } @@ -7719,13 +8427,11 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) { kfree(adapter->dev_topo.pd_hdls); kfree(adapter->dev_topo.blocking_hdls); - kfree(adapter->dev_topo.pending_dev_add); - kfree(adapter->dev_topo.dev_removing); } static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size = 0; + u32 buffer_size; void *buffer; INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); @@ -7777,15 +8483,14 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) return -ENOMEM; adapter->driver_cmds.internal_scmd = buffer; - buffer = (void *)((u8 *)buffer + - sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker)); + buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + + sizeof(struct leapraid_io_req_tracker); adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (void *)((u8 *)buffer + SCSI_SENSE_BUFFERSIZE); + (unsigned char *)buffer; + buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (void *)((u8 *)buffer + sizeof(struct scatterlist)); + (struct scatterlist *)buffer; + buffer = (u8 *)buffer + sizeof(struct scatterlist); adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; adapter->driver_cmds.enc_cmd.cb_idx = LEAPRAID_ENC_CB_IDX; @@ -7828,32 +8533,34 @@ static void leapraid_init_event_mask(struct leapraid_adapter *adapter) int i; for (i = 0; i < LEAPRAID_EVT_MASK_COUNT; i++) - adapter->fw_evt_s.leapraid_evt_masks[i] = -1; - leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DISCOVERY); + adapter->fw_evt_s.leapraid_evt_masks[i] = + LEAPRAID_INVALID_INITIAL_VALUE; + leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_IR_CHANGE); } -static void leapraid_prepare_adp_init_req( +static void leapraid_prepare_adapter_init_req( struct leapraid_adapter *adapter, struct leapraid_adapter_init_req *init_req) { ktime_t cur_time; - int i; + int i, chunk; u32 reply_post_free_ary_sz; memset(init_req, 0, sizeof(struct leapraid_adapter_init_req)); init_req->func = LEAPRAID_FUNC_ADAPTER_INIT; init_req->who_init = LEAPRAID_WHOINIT_LINUX_DRIVER; - init_req->msg_ver = cpu_to_le16(0x0100); - init_req->header_ver = cpu_to_le16(0x0000); - - init_req->driver_ver = cpu_to_le32((LEAPRAID_MAJOR_VERSION << 24) | - (LEAPRAID_MINOR_VERSION << 16) | - (LEAPRAID_BUILD_VERSION << 8) | - LEAPRAID_RELEASE_VERSION); + init_req->msg_ver = cpu_to_le16(LEAPRAID_MSG_VERSION); + init_req->header_ver = cpu_to_le16(LEAPRAID_HEADER_VERSION); + init_req->driver_ver = + cpu_to_le32((LEAPRAID_MAJOR_VERSION << + LEAPRAID_VER_MAJOR_SHIFT) | + (LEAPRAID_MINOR_VERSION << LEAPRAID_VER_MINOR_SHIFT) | + (LEAPRAID_BUILD_VERSION << LEAPRAID_VER_BUILD_SHIFT) | + LEAPRAID_RELEASE_VERSION); if (adapter->notification_desc.msix_enable) init_req->host_msix_vectors = adapter->adapter_attr.rq_cnt; @@ -7877,18 +8584,13 @@ static void leapraid_prepare_adp_init_req( memset(adapter->mem_desc.rep_desc_q_arr, 0, reply_post_free_ary_sz); - for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) { - adapter->mem_desc - .rep_desc_q_arr[i] - .rep_desc_base_addr = - cpu_to_le64 ( - (u64)adapter->mem_desc - .rep_desc_seg_maint[i / - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_maint[i % - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_dma); - } + chunk = LEAPRAID_REP_DESC_CHUNK_SIZE; + for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) + adapter->mem_desc.rep_desc_q_arr[i].rep_desc_base_addr = + cpu_to_le64 ((u64)adapter->mem_desc + .rep_desc_seg_maint[i / chunk] + .rep_desc_maint[i % chunk] + .rep_desc_dma); init_req->msg_flg = LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE; @@ -7910,9 +8612,9 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) struct leapraid_adapter_init_req init_req; struct leapraid_adapter_init_rep init_rep; u16 adapter_status; - int rc = 0; + int rc; - leapraid_prepare_adp_init_req(adapter, &init_req); + leapraid_prepare_adapter_init_req(adapter, &init_req); rc = leapraid_handshake_func(adapter, sizeof(struct leapraid_adapter_init_req), @@ -7920,7 +8622,7 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_init_rep), (u16 *)&init_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7941,11 +8643,10 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_page1 *sas_io_unit_page1 = NULL; + struct leapraid_manufacturing_p0 manufacturing_page0; struct leapraid_bios_page3 bios_page3; struct leapraid_bios_page2 bios_page2; - int rc = 0; - int sz; + int rc; rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); @@ -7957,79 +8658,49 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) if (rc) return rc; + rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, + cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + adapter->adapter_attr.bios_version = le32_to_cpu(bios_page3.bios_version); - adapter->adapter_attr.wideport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.narrowport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.sata_max_queue_depth = - LEAPRAID_SATA_QUEUE_DEPTH; - + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(manufacturing_page0.board_name), + manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = bios_page2.requested_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_boot_dev.pg_dev, - (void *)&bios_page2.requested_boot_dev, + memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, + &bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = bios_page2.requested_alt_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_alt_boot_dev.pg_dev, - (void *)&bios_page2.requested_alt_boot_dev, + memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, + &bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = bios_page2.current_boot_dev_form; - memcpy((void *)adapter->boot_devs.current_boot_dev.pg_dev, - (void *)&bios_page2.current_boot_dev, + memcpy(adapter->boot_devs.current_boot_dev.pg_dev, + &bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); - - sz = offsetof(struct leapraid_sas_io_unit_page1, phy_info); - sas_io_unit_page1 = kzalloc(sz, GFP_KERNEL); - if (!sas_io_unit_page1) { - rc = -ENOMEM; - return rc; - } - - cfgp1.size = sz; - - rc = leapraid_op_config_page(adapter, sas_io_unit_page1, cfgp1, - cfgp2, GET_SAS_IOUNIT_PG1); - if (rc) - goto out; - - if (le16_to_cpu(sas_io_unit_page1->wideport_max_queue_depth)) - adapter->adapter_attr.wideport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->wideport_max_queue_depth); - - if (le16_to_cpu(sas_io_unit_page1->narrowport_max_queue_depth)) - adapter->adapter_attr.narrowport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->narrowport_max_queue_depth); - - if (sas_io_unit_page1->sata_max_queue_depth) - adapter->adapter_attr.sata_max_queue_depth = - sas_io_unit_page1->sata_max_queue_depth; - -out: - kfree(sas_io_unit_page1); - dev_info(&adapter->pdev->dev, - "max wp qd=%d, max np qd=%d, max sata qd=%d\n", - adapter->adapter_attr.wideport_max_queue_depth, - adapter->adapter_attr.narrowport_max_queue_depth, - adapter->adapter_attr.sata_max_queue_depth); return rc; } static int leapraid_evt_notify(struct leapraid_adapter *adapter) { struct leapraid_evt_notify_req *evt_notify_req; + struct leapraid_evt_notify_rep *evt_notify_rep; + u16 adapter_status; int rc = 0; int i; mutex_lock(&adapter->driver_cmds.notify_event_cmd.mutex); adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_PENDING; evt_notify_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.notify_event_cmd.inter_taskid); memset(evt_notify_req, 0, sizeof(struct leapraid_evt_notify_req)); evt_notify_req->func = LEAPRAID_FUNC_EVENT_NOTIFY; @@ -8038,15 +8709,30 @@ static int leapraid_evt_notify(struct leapraid_adapter *adapter) cpu_to_le32(adapter->fw_evt_s.leapraid_evt_masks[i]); init_completion(&adapter->driver_cmds.notify_event_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.notify_event_cmd.inter_taskid); + adapter->driver_cmds.notify_event_cmd.inter_taskid); wait_for_completion_timeout( &adapter->driver_cmds.notify_event_cmd.done, LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT * HZ); + if (!(adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_DONE)) - if (adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_RESET) - rc = -EFAULT; + LEAPRAID_CMD_DONE)) { + rc = -EFAULT; + goto out_cleanup; + } + + if (!(adapter->driver_cmds.notify_event_cmd.status & + LEAPRAID_CMD_REPLY_VALID)) { + rc = -EFAULT; + goto out_cleanup; + } + + evt_notify_rep = (void *)&adapter->driver_cmds.notify_event_cmd.reply; + adapter_status = le16_to_cpu(evt_notify_rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + rc = -EFAULT; + +out_cleanup: adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.notify_event_cmd.mutex); @@ -8061,51 +8747,54 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) int rc = 0; dev_info(&adapter->pdev->dev, - "send device scan, async_scan_dev=%d!\n", async_scan_dev); + "Send device scan, async_scan_dev=%d!\n", async_scan_dev); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_PENDING; adapter->driver_cmds.scan_dev_cmd.async_scan_dev = async_scan_dev; - scan_dev_req = leapraid_get_task_desc(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + scan_dev_req = + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.scan_dev_cmd.inter_taskid); memset(scan_dev_req, 0, sizeof(struct leapraid_scan_dev_req)); scan_dev_req->func = LEAPRAID_FUNC_SCAN_DEV; if (async_scan_dev) { - adapter->scan_dev_desc.first_scan_dev_fired = true; - leapraid_fire_task(adapter, + adapter->scan_dev_desc.first_scan_dev_fired = 1; + leapraid_fire_task( + adapter, adapter->driver_cmds.scan_dev_cmd.inter_taskid); return 0; } init_completion(&adapter->driver_cmds.scan_dev_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + adapter->driver_cmds.scan_dev_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.scan_dev_cmd.done, LEAPRAID_SCAN_DEV_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "device scan timeout!\n"); + dev_err(&adapter->pdev->dev, "Device scan timeout!\n"); if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) rc = -EFAULT; else rc = -ETIME; - goto out; + goto out_cleanup; } - scan_dev_rep = (void *)(&adapter->driver_cmds.scan_dev_cmd.reply); + scan_dev_rep = (void *)&adapter->driver_cmds.scan_dev_cmd.reply; adapter_status = le16_to_cpu(scan_dev_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { - dev_err(&adapter->pdev->dev, "device scan failure!\n"); + dev_err(&adapter->pdev->dev, "Device scan failure!\n"); rc = -EFAULT; - goto out; + goto out_cleanup; } -out: +out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_info(&adapter->pdev->dev, - "device scan %s\n", ((rc == 0) ? "SUCCESS" : "FAILED")); + "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8125,13 +8814,14 @@ static void leapraid_init_rep_msg_addr(struct leapraid_adapter *adapter) for (i = 0, reply_address = (u32)adapter->mem_desc.rep_msg_dma; i < adapter->adapter_attr.rep_msg_qd; - i++, reply_address += LEAPRAID_REPLY_SIEZ) { + i++, reply_address += LEAPRAID_REPLY_SIZE) adapter->mem_desc.rep_msg_addr[i] = cpu_to_le32(reply_address); - } } -static void init_rep_desc(struct leapraid_rq *rq, int index, - union leapraid_rep_desc_union *reply_post_free_contig) +static void init_rep_desc( + struct leapraid_rq *rq, + int index, + union leapraid_rep_desc_union *reply_post_free_contig) { struct leapraid_adapter *adapter = rq->adapter; unsigned int i; @@ -8218,7 +8908,7 @@ static void leapraid_init_bar_idx_regs(struct leapraid_adapter *adapter) static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; leapraid_init_task_tracker(adapter); leapraid_init_rep_msg_addr(adapter); @@ -8242,7 +8932,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return rc; if (!adapter->access_ctrl.shost_recovering) { - adapter->scan_dev_desc.wait_scan_dev_done = true; + adapter->scan_dev_desc.wait_scan_dev_done = 1; return 0; } @@ -8256,45 +8946,45 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) int leapraid_ctrl_init(struct leapraid_adapter *adapter) { u32 cap; - int rc = 0; + int rc; rc = leapraid_set_pcie_and_notification(adapter); if (rc) - goto out_free_resources; + goto out_free; pci_set_drvdata(adapter->pdev, adapter->shost); pcie_capability_read_dword(adapter->pdev, PCI_EXP_DEVCAP, &cap); - if (cap & PCI_EXP_DEVCAP_EXT_TAG) { + if (cap & PCI_EXP_DEVCAP_EXT_TAG) pcie_capability_set_word(adapter->pdev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_EXT_TAG); - } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "fw log init failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "FW log init failure\n"); + goto out_free; } rc = leapraid_request_host_memory(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "request host memory failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Request host memory failure\n"); + goto out_free; } init_waitqueue_head(&adapter->reset_desc.reset_wait_queue); + init_waitqueue_head(&adapter->access_ctrl.shost_recover_wq); rc = leapraid_alloc_dev_topo_bitmaps(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "alloc topo bitmaps failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Alloc topo bitmaps failure\n"); + goto out_free; } rc = leapraid_init_driver_cmds(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "init driver cmds failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; } leapraid_init_event_mask(adapter); @@ -8302,14 +8992,23 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_available(adapter); if (rc) { dev_err(&adapter->pdev->dev, - "make adapter available failure\n"); - goto out_free_resources; + "Make adapter available failure\n"); + goto out_free; } + + leapraid_overheat_init(adapter); + if (!adapter->overheat_desc.fault_overheat_wq) { + rc = -ENOMEM; + goto out_free; + } + return 0; -out_free_resources: - adapter->access_ctrl.host_removing = true; +out_free: + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -8319,9 +9018,11 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) void leapraid_remove_ctrl(struct leapraid_adapter *adapter) { + leapraid_overheat_cleanup(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index f7072d078315..df61bc2e994a 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -1,16 +1,16 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #ifndef LEAPRAID_FUNC_H_INCLUDED #define LEAPRAID_FUNC_H_INCLUDED #include <linux/pci.h> #include <linux/aer.h> #include <linux/poll.h> +#include <linux/atomic.h> #include <linux/errno.h> #include <linux/ktime.h> #include <linux/delay.h> @@ -28,9 +28,9 @@ #include "leapraid.h" #include <linux/blk-mq-pci.h> -/* some requset and reply buffer size */ +/* Request and reply buffer size. */ #define LEAPRAID_REQUEST_SIZE 128 -#define LEAPRAID_REPLY_SIEZ 128 +#define LEAPRAID_REPLY_SIZE 128 #define LEAPRAID_CHAIN_SEG_SIZE 128 #define LEAPRAID_MAX_SGES_IN_CHAIN 7 #define LEAPRAID_DEFAULT_CHAINS_PER_IO 19 @@ -45,61 +45,68 @@ #define LEAPRAID_SYS_LOG_BUF_SIZE 0x200000 #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 -/* Driver version and name */ +/* Driver version and name. */ #define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 +#define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.06" +#define LEAPRAID_DRIVER_VERSION "2.00.01.02" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 06 +#define LEAPRAID_BUILD_VERSION 01 +#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MSG_VERSION 0x1021 +#define LEAPRAID_HEADER_VERSION 0x0000 -/* Device ID */ +/* Device ID. */ #define LEAPRAID_VENDOR_ID 0xD405 #define LEAPRAID_DEVID_HBA 0x8200 -#define LEAPRAID_DEVID_RAID 0x8201 +#define LEAPRAID_SUBVENDOR_ID 0xD405 +#define LEAPRAID_SUBDEVID_HBA 0x8200 #define LEAPRAID_PCI_VENDOR_ID_MASK 0xFFFF - /* RAID virtual channel ID */ + /* RAID virtual channel ID. */ #define RAID_CHANNEL 1 -/* Scatter/Gather (SG) segment limits */ +/* Scatter-gather (SG) segment limits. */ #define LEAPRAID_MAX_PHYS_SEGMENTS SG_CHUNK_SIZE #define LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS 32 #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS -/* firmware / config page operations */ +/* Firmware and config page operations. */ #define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 -/* Hardware access helpers*/ +/* Hardware access helpers. */ #define leapraid_readl(addr) readl(addr) #define leapraid_check_reset(status) \ (!((status) & LEAPRAID_CMD_RESET)) -/* Polling intervals */ +/* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 #define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 #define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) -/* init mask */ +/* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 #define LEAPRAID_REPLY_INT_MASK 0x00000008 #define LEAPRAID_TO_SYS_DB_MASK 0x00000001 -/* queue depth */ +/* Queue depth. */ #define LEAPRAID_SATA_QUEUE_DEPTH 32 -#define LEAPRAID_SAS_QUEUE_DEPTH 254 -#define LEAPRAID_RAID_QUEUE_DEPTH 128 +#define LEAPRAID_SAS_QUEUE_DEPTH 64 +#define LEAPRAID_RAID_QUEUE_DEPTH 64 + +/* Target probe flag. */ +#define LEAPRAID_NO_ULD_ATTACH_FLAG 1 +#define LEAPRAID_ULD_ATTACH_FLAG 0 -/* SCSI device and queue limits */ -#define LEAPRAID_MAX_SECTORS 8192 -#define LEAPRAID_DEF_MAX_SECTORS 32767 +/* SCSI device and queue limits. */ +#define LEAPRAID_MAX_SECTORS 2048 #define LEAPRAID_MAX_CDB_LEN 32 #define LEAPRAID_MAX_LUNS 16384 #define LEAPRAID_CAN_QUEUE_MIN 1 @@ -107,136 +114,166 @@ #define LEAPRAID_CMD_PER_LUN 128 #define LEAPRAID_MAX_SEGMENT_SIZE 0xffffffff -/* SCSI sense and ASC/ASCQ and disk geometry configuration */ +/* SCSI sense and ASC/ASCQ and disk geometry configuration. */ #define DESC_FORMAT_THRESHOLD 0x72 #define SENSE_KEY_MASK 0x0F #define SCSI_SENSE_RESPONSE_CODE_MASK 0x7F #define ASC_FAILURE_PREDICTION_THRESHOLD_EXCEEDED 0x5D -#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL /* in sectors, 1GB */ +#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL #define LEAPRAID_LARGE_DISK_HEADS 255 #define LEAPRAID_LARGE_DISK_SECTORS 63 #define LEAPRAID_SMALL_DISK_HEADS 64 #define LEAPRAID_SMALL_DISK_SECTORS 32 -/* SMP (Serial Management Protocol) */ +/* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 #define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 -/* SCSI ASC/ASCQ definitions */ +/* SCSI ASC/ASCQ definitions. */ #define LEAPRAID_SCSI_ASCQ_DEFAULT 0x00 #define LEAPRAID_SCSI_ASC_POWER_ON_RESET 0x29 #define LEAPRAID_SCSI_ASC_INVALID_CMD_CODE 0x20 #define LEAPRAID_SCSI_ASCQ_POWER_ON_RESET 0x07 -/* ---- VPD Page 0x89 (ATA Information) ---- */ +/* VPD Page 0x89 (ATA Information). */ #define LEAPRAID_VPD_PAGE_ATA_INFO 0x89 #define LEAPRAID_VPD_PG89_MAX_LEN 255 #define LEAPRAID_VPD_PG89_MIN_LEN 214 -/* Byte index for NCQ support flag in VPD Page 0x89 */ +/* Byte index for NCQ support flag in VPD page 0x89. */ #define LEAPRAID_VPD_PG89_NCQ_BYTE_IDX 213 #define LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT 4 #define LEAPRAID_VPD_PG89_NCQ_BIT_MASK 0x1 -/* readiness polling: max retries, sleep µs between */ +/* Readiness polling: max retries, sleep µs between. */ #define LEAPRAID_ADAPTER_READY_MAX_RETRY 15000 #define LEAPRAID_ADAPTER_READY_SLEEP_MIN_US 1000 #define LEAPRAID_ADAPTER_READY_SLEEP_MAX_US 1100 -/* Doorbell wait parameters */ +/* Doorbell wait parameters. */ #define LEAPRAID_DB_WAIT_MAX_RETRY 20000 #define LEAPRAID_DB_WAIT_DELAY_US 500 -/* Basic data size definitions */ +/* Basic data size definitions. */ #define LEAPRAID_DWORDS_BYTE_SIZE 4 #define LEAPRAID_WORD_BYTE_SIZE 2 -/* SGL threshold and chain offset*/ +/* SGL threshold and chain offset. */ #define LEAPRAID_SGL_INLINE_THRESHOLD 2 #define LEAPRAID_CHAIN_OFFSET_DWORDS 7 -/* MSI-X group size and mask */ +/* MSI-X group size and mask. */ #define LEAPRAID_MSIX_GROUP_SIZE 8 #define LEAPRAID_MSIX_GROUP_MASK 7 -/* basic constants and limits */ +/* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 #define LEAPRAID_INDEX_FIRST 0 #define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF -/* retry / sleep configuration */ +/* Retry/Sleep configuration. */ +#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 +#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF +#define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 +#define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF +#define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 +#define LEAPRAID_WRSEQ_3RD_KEY_VALUE 0xB +#define LEAPRAID_WRSEQ_4TH_KEY_VALUE 0x2 +#define LEAPRAID_WRSEQ_5TH_KEY_VALUE 0x7 +#define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 #define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 -#define LEAPRAID_MSLEEP_LONG_MS 256 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 -/* controller reset loop parameters */ -#define LEAPRAID_RESET_LOOP_COUNT_REF (300000 / 256) -#define LEAPRAID_RESET_LOOP_COUNT_DEFAULT 10000 -#define LEAPRAID_RESET_POLL_INTERVAL_MS 500 - -/* Device / Volume configuration */ +/* Device/Volume configuration. */ #define LEAPRAID_MAX_VOLUMES_DEFAULT 32 #define LEAPRAID_MAX_DEV_HANDLE_DEFAULT 2048 #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF -/* cmd queue depth */ +/* Commands queue depth. */ #define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 -/* task id offset */ +/* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 #define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 -#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 +#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 #define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD 4 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 5 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 6 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 -/* task id offset for high-priority */ +/* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 #define LEAPRAID_HP_TASKID_OFFSET_TM_CMD 1 -/* Event / Boot configuration */ +/* Event/Boot configuration. */ #define LEAPRAID_EVT_MASK_COUNT 4 #define LEAPRAID_BOOT_DEV_SIZE 24 -/* logsense command definitions */ +/* Commands timeout. */ +#define LEAPRAID_UNIFIED_TIMEOUT 30 +#define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 +#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT + +/* Logsense command definitions. */ #define LEAPRAID_LOGSENSE_DATA_LENGTH 16 #define LEAPRAID_LOGSENSE_CDB_LENGTH 10 #define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT 5 +#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_LOGSENSE_SMART_CODE 0x5D -/* cmd timeout */ -#define LEAPRAID_DRIVER_SCSIIO_CMD_TIMEOUT LEAPRAID_LOGSENSE_TIMEOUT -#define LEAPRAID_CFG_OP_TIMEOUT 15 -#define LEAPRAID_CTL_CMD_TIMEOUT 10 -#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT 10 -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT 10 -#define LEAPRAID_ENC_CMD_TIMEOUT 10 -#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT 30 -#define LEAPRAID_TM_CMD_TIMEOUT 30 -#define LEAPRAID_TRANSPORT_CMD_TIMEOUT 10 +/* Host DMA cap. */ +#define DMA_32_BITS 32 +#define DMA_64_BITS 64 +#define LEAPRAID_DMA_ALIGN 16 + +/* Values used to represent an invalid. */ +#define LEAPRAID_INVALID_INDEX -1 +#define LEAPRAID_INVALID_MSIX_VECTORS -1 +#define LEAPRAID_INVALID_INITIAL_VALUE -1 +#define LEAPRAID_OPERATION_FAILED -1 + +/* Version shift and mask. */ +#define LEAPRAID_VER_MAJOR_SHIFT 24 +#define LEAPRAID_VER_MINOR_SHIFT 16 +#define LEAPRAID_VER_BUILD_SHIFT 8 +#define LEAPRAID_VER_MASK 0xFF + +/* Interrupt type. */ +#define LEAPRAID_INTERRUPT_MODE_MSIX 0 +#define LEAPRAID_INTERRUPT_MODE_MSI 1 +#define LEAPRAID_INTERRUPT_MODE_LEGACY 2 + +/* SMP link reset. */ +#define SMP_PHY_CONTROL_LINK_RESET 0x01 +#define SMP_PHY_CONTROL_HARD_RESET 0x02 +#define SMP_PHY_CONTROL_DISABLE 0x03 /** - * struct leapraid_adapter_features - Features and - * capabilities of a LeapRAID adapter + * struct leapraid_adapter_features - Adapter features/capabilities. * - * @req_slot: Number of request slots supported by the adapter - * @hp_slot: Number of high-priority slots supported by the adapter - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version of the adapter - * @max_dev_handle: Maximum device supported by the adapter + * @req_slot: Number of request slots supported by the adapter. + * @hp_slot: Number of high-priority slots supported by the adapter. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version of the adapter. + * @max_dev_handle: Maximum device handle supported by the adapter. + * @min_dev_handle: Minimum device handle supported by the adapter. */ struct leapraid_adapter_features { u16 req_slot; @@ -252,32 +289,35 @@ struct leapraid_adapter_features { /** * struct leapraid_adapter_attr - Adapter attributes and capabilities * - * @id: Adapter identifier - * @raid_support: Indicates if RAID is supported - * @bios_version: Version of the adapter BIOS - * @enable_mp: Indicates if multipath (MP) support is enabled - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @sata_max_queue_depth: Maximum queue depth for SATA - * @features: Detailed features of the adapter - * @adapter_total_qd: Total queue depth available on the adapter - * @io_qd: Queue depth allocated for I/O operations - * @rep_msg_qd: Queue depth for reply messages - * @rep_desc_qd: Queue depth for reply descriptors - * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue - * @rq_cnt: Number of request queues - * @task_desc_dma_size: Size of task descriptor DMA memory - * @use_32_dma_mask: Indicates if 32-bit DMA mask is used - * @name: Adapter name string + * @id: Adapter identifier. + * @raid_support: Indicates if RAID is supported. + * @bios_version: Version of the adapter BIOS. + * @enable_mp: Indicates if multipath (MP) support is enabled. + * @wideport_max_queue_depth: Maximum queue depth for wide ports. + * @narrowport_max_queue_depth: Maximum queue depth for narrow ports. + * @sata_max_queue_depth: Maximum queue depth for SATA. + * @raid_volume_max_queue_depth: Maximum queue depth for RAID volumes. + * @features: Detailed features of the adapter. + * @adapter_total_qd: Total queue depth available on the adapter. + * @io_qd: Queue depth allocated for I/O operations. + * @rep_msg_qd: Queue depth for reply messages. + * @rep_desc_qd: Queue depth for reply descriptors. + * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue. + * @rq_cnt: Number of request queues. + * @task_desc_dma_size: Size of task descriptor DMA memory. + * @use_32_dma_mask: Indicates if 32-bit DMA mask is used. + * @name: Adapter name string. + * @board_name: Board name retrieved from manufacturing page 0. */ struct leapraid_adapter_attr { u8 id; - bool raid_support; + u8 raid_support; u32 bios_version; - bool enable_mp; + u8 enable_mp; u32 wideport_max_queue_depth; u32 narrowport_max_queue_depth; u32 sata_max_queue_depth; + u32 raid_volume_max_queue_depth; struct leapraid_adapter_features features; u32 adapter_total_qd; u32 io_qd; @@ -286,20 +326,20 @@ struct leapraid_adapter_attr { u32 rep_desc_q_seg_cnt; u16 rq_cnt; u32 task_desc_dma_size; - bool use_32_dma_mask; + u8 use_32_dma_mask; char name[LEAPRAID_NAME_LENGTH]; + char board_name[LEAPRAID_BOARD_NAME_LENGTH]; }; /** - * struct leapraid_io_req_tracker - Track a SCSI I/O request - * for the adapter + * struct leapraid_io_req_tracker - Track a SCSI I/O request for the adapter * - * @taskid: Unique task ID for this I/O request - * @scmd: Pointer to the associated SCSI command - * @chain_list: List of chain frames associated with this request - * @msix_io: MSI-X vector assigned to this I/O request - * @chain: Pointer to the chain memory for this request - * @chain_dma: DMA address of the chain memory + * @taskid: Unique task ID for this I/O request. + * @scmd: Pointer to the associated SCSI command. + * @chain_list: List of chain frames associated with this request. + * @msix_io: MSI-X vector assigned to this I/O request. + * @chain: Pointer to the chain memory for this request. + * @chain_dma: DMA address of the chain memory. */ struct leapraid_io_req_tracker { u16 taskid; @@ -313,9 +353,9 @@ struct leapraid_io_req_tracker { /** * struct leapraid_task_tracker - Tracks a task in the adapter * - * @taskid: Unique task ID for this tracker - * @cb_idx: Callback index associated with this task - * @tracker_list: Linked list node to chain this tracker in lists + * @taskid: Unique task ID for this tracker. + * @cb_idx: Callback index associated with this task. + * @tracker_list: Linked list node to chain this tracker in lists. */ struct leapraid_task_tracker { u16 taskid; @@ -324,11 +364,10 @@ struct leapraid_task_tracker { }; /** - * struct leapraid_rep_desc_maint - Maintains reply descriptor - * memory + * struct leapraid_rep_desc_maint - Maintains reply descriptor memory * - * @rep_desc: Pointer to the reply descriptor - * @rep_desc_dma: DMA address of the reply descriptor + * @rep_desc: Pointer to the reply descriptor. + * @rep_desc_dma: DMA address of the reply descriptor. */ struct leapraid_rep_desc_maint { union leapraid_rep_desc_union *rep_desc; @@ -336,12 +375,12 @@ struct leapraid_rep_desc_maint { }; /** - * struct leapraid_rep_desc_seg_maint - Maintains reply descriptor - * segment memory + * struct leapraid_rep_desc_seg_maint - + * Maintains reply descriptor segment memory * - * @rep_desc_seg: Pointer to the reply descriptor segment - * @rep_desc_seg_dma: DMA address of the reply descriptor segment - * @rep_desc_maint: Pointer to the main reply descriptor structure + * @rep_desc_seg: Pointer to the reply descriptor segment. + * @rep_desc_seg_dma: DMA address of the reply descriptor segment. + * @rep_desc_maint: Pointer to the main reply descriptor structure. */ struct leapraid_rep_desc_seg_maint { void *rep_desc_seg; @@ -352,20 +391,20 @@ struct leapraid_rep_desc_seg_maint { /** * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * - * @task_desc: Pointer to task descriptor - * @task_desc_dma: DMA address of task descriptor - * @sg_chain_pool: DMA pool for SGL chain allocations - * @sg_chain_pool_size: Size of the sg_chain_pool - * @taskid_to_uniq_tag: Mapping from task ID to unique tag - * @sense_data: Buffer for SCSI sense data - * @sense_data_dma: DMA address of sense_data buffer - * @rep_msg: Buffer for reply message - * @rep_msg_dma: DMA address of reply message buffer - * @rep_msg_addr: Pointer to reply message address - * @rep_msg_addr_dma: DMA address of reply message address - * @rep_desc_seg_maint: Pointer to reply descriptor segment - * @rep_desc_q_arr: Pointer to reply descriptor queue array - * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array + * @task_desc: Pointer to task descriptor. + * @task_desc_dma: DMA address of task descriptor. + * @sg_chain_pool: DMA pool for SGL chain allocations. + * @sg_chain_pool_size: Size of the sg_chain_pool. + * @taskid_to_uniq_tag: Mapping from task ID to unique tag. + * @sense_data: Buffer for SCSI sense data. + * @sense_data_dma: DMA address of sense_data buffer. + * @rep_msg: Buffer for reply message. + * @rep_msg_dma: DMA address of reply message buffer. + * @rep_msg_addr: Pointer to reply message address. + * @rep_msg_addr_dma: DMA address of reply message address. + * @rep_desc_seg_maint: Pointer to reply descriptor segment. + * @rep_desc_q_arr: Pointer to reply descriptor queue array. + * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array. */ struct leapraid_mem_desc { void *task_desc; @@ -384,31 +423,30 @@ struct leapraid_mem_desc { dma_addr_t rep_desc_q_arr_dma; }; -#define LEAPRAID_FIXED_INTER_CMDS 7 -#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_INTER_HP_CMDS_DIF \ - (LEAPRAID_FIXED_INTER_CMDS - LEAPRAID_FIXED_HP_CMDS) +/* internal cmd description */ +#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_CMD_NOT_USED 0x8000 -#define LEAPRAID_CMD_DONE 0x0001 -#define LEAPRAID_CMD_PENDING 0x0002 -#define LEAPRAID_CMD_REPLY_VALID 0x0004 -#define LEAPRAID_CMD_RESET 0x0008 +#define LEAPRAID_CMD_NOT_USED 0x8000 +#define LEAPRAID_CMD_DONE 0x0001 +#define LEAPRAID_CMD_PENDING 0x0002 +#define LEAPRAID_CMD_REPLY_VALID 0x0004 +#define LEAPRAID_CMD_RESET 0x0008 /** * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * - * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index - * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index - * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index - * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index - * @LEAPRAID_ENC_CB_IDX: Encryption callback index - * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index - * @LEAPRAID_CTL_CB_IDX: Control callback index - * @LEAPRAID_TM_CB_IDX: Task management callback index + * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. + * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. + * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. + * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. + * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. + * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. + * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. + * @LEAPRAID_ENC_CB_IDX: Encryption callback index. + * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. + * @LEAPRAID_CTL_CB_IDX: Control callback index. + * @LEAPRAID_TM_CB_IDX: Task management callback index. */ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, @@ -425,10 +463,25 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_NUM_CB_IDXS }; +/** + * struct leapraid_default_reply - Default reply frame buffer + * @pad: Raw reply data buffer returned by firmware. + * + * This structure represents a generic reply frame used by the firmware + * when no specific reply format is required. The buffer size is defined + * by LEAPRAID_REPLY_SIZE and stores the raw reply data. + */ struct leapraid_default_reply { - u8 pad[LEAPRAID_REPLY_SIEZ]; + u8 pad[LEAPRAID_REPLY_SIZE]; }; +/** + * struct leapraid_sense_buffer - SCSI sense data buffer + * @pad: Buffer used to store sense data returned by a SCSI command. + * + * This buffer holds the sense data provided by a device.The size is + * defined by SCSI_SENSE_BUFFERSIZE. + */ struct leapraid_sense_buffer { u8 pad[SCSI_SENSE_BUFFERSIZE]; }; @@ -436,17 +489,17 @@ struct leapraid_sense_buffer { /** * struct leapraid_driver_cmd - Driver command tracking structure * - * @reply: Default reply structure returned by the adapter - * @done: Completion object used to signal command completion - * @status: Status code returned by the firmware - * @taskid: Unique task identifier for this command - * @hp_taskid: Task identifier for high-priority commands - * @inter_taskid: Task identifier for internal commands - * @cb_idx: Callback index used to identify completion context - * @async_scan_dev: True if this command is for asynchronous device scan - * @sense: Sense buffer holding error information from device - * @mutex: Mutex to protect access to this command structure - * @list: List node for linking driver commands into lists + * @reply: Default reply structure returned by the adapter. + * @done: Completion object used to signal command completion. + * @status: Status code returned by the firmware. + * @taskid: Unique task identifier for this command. + * @hp_taskid: Task identifier for high-priority commands. + * @inter_taskid: Task identifier for internal commands. + * @cb_idx: Callback index used to identify completion context. + * @async_scan_dev: True if this command is for asynchronous device scan. + * @sense: Sense buffer holding error information from device. + * @mutex: Mutex to protect access to this command structure. + * @list: List node for linking driver commands into lists. */ struct leapraid_driver_cmd { struct leapraid_default_reply reply; @@ -456,27 +509,27 @@ struct leapraid_driver_cmd { u16 hp_taskid; u16 inter_taskid; u8 cb_idx; - bool async_scan_dev; + u8 async_scan_dev; struct leapraid_sense_buffer sense; - struct mutex mutex; + struct mutex mutex; /* Mutex for driver cmd */ struct list_head list; }; /** * struct leapraid_driver_cmds - Collection of driver command objects * - * @special_cmd_list: List head for tracking special driver commands - * @scan_dev_cmd: Command used for asynchronous device scan operations - * @cfg_op_cmd: Command for configuration operations - * @transport_cmd: Command for transport-level operations - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware - * @raid_action_cmd: Command for RAID-related management or action requests - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing - * @enc_cmd: Command for enclosure management operations - * @notify_event_cmd: Command for asynchronous event notification handling - * @ctl_cmd: Command for generic control or maintenance operations - * @tm_cmd: Task management command - * @internal_scmd: Pointer to internal SCSI command used by the driver + * @special_cmd_list: List head for tracking special driver commands. + * @scan_dev_cmd: Command used for asynchronous device scan operations. + * @cfg_op_cmd: Command for configuration operations. + * @transport_cmd: Command for transport-level operations. + * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. + * @raid_action_cmd: Command for RAID-related management or action requests. + * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. + * @enc_cmd: Command for enclosure management operations. + * @notify_event_cmd: Command for asynchronous event notification handling. + * @ctl_cmd: Command for generic control or maintenance operations. + * @tm_cmd: Task management command. + * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; @@ -496,14 +549,14 @@ struct leapraid_driver_cmds { /** * struct leapraid_dynamic_task_desc - Dynamic task descriptor * - * @task_lock: Spinlock to protect concurrent access - * @hp_taskid: Current high-priority task ID - * @hp_cmd_qd: Fixed command queue depth for high-priority tasks - * @inter_taskid: Current internal task ID - * @inter_cmd_qd: Fixed command queue depth for internal tasks + * @task_lock: Spinlock to protect concurrent access. + * @hp_taskid: Current high-priority task ID. + * @hp_cmd_qd: Fixed command queue depth for high-priority tasks. + * @inter_taskid: Current internal task ID. + * @inter_cmd_qd: Fixed command queue depth for internal tasks. */ struct leapraid_dynamic_task_desc { - spinlock_t task_lock; + spinlock_t task_lock; /* protects dynamic task */ u16 hp_taskid; u16 hp_cmd_qd; u16 inter_taskid; @@ -513,14 +566,14 @@ struct leapraid_dynamic_task_desc { /** * struct leapraid_fw_evt_work - Firmware event work structure * - * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRAID adapter - * @work: Work structure used by the kernel workqueue - * @refcnt: Reference counter for managing the lifetime of this work - * @evt_data: Pointer to firmware event data - * @dev_handle: Device handle associated with the event - * @evt_type: Type of firmware event - * @ignore: Flag indicating whether the event should be ignored + * @list: Linked list node for queuing the work. + * @adapter: Pointer to the associated LeapRAID adapter. + * @work: Work structure used by the kernel workqueue. + * @refcnt: Reference counter for managing the lifetime of this work. + * @evt_data: Pointer to firmware event data. + * @dev_handle: Device handle associated with the event. + * @evt_type: Type of firmware event. + * @ignore: Flag indicating whether the event should be ignored. */ struct leapraid_fw_evt_work { struct list_head list; @@ -536,33 +589,35 @@ struct leapraid_fw_evt_work { /** * struct leapraid_fw_evt_struct - Firmware event handling structure * - * @fw_evt_name: Name of the firmware event - * @fw_evt_thread: Workqueue used for processing firmware events - * @fw_evt_lock: Spinlock protecting access to the firmware event list - * @fw_evt_list: Linked list of pending firmware events - * @cur_evt: Pointer to the currently processing firmware event - * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress - * @leapraid_evt_masks: Array of event masks for filtering firmware events + * @fw_evt_name: Name of the firmware event. + * @fw_evt_thread: Workqueue used for processing firmware events. + * @fw_evt_lock: Spinlock protecting access to the firmware event list. + * @fw_evt_list: Linked list of pending firmware events. + * @cur_evt: Pointer to the currently processing firmware event. + * @cur_evt_task: Task currently executing @cur_evt work. + * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress. + * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; - spinlock_t fw_evt_lock; + spinlock_t fw_evt_lock; /* protects firmware event */ struct list_head fw_evt_list; struct leapraid_fw_evt_work *cur_evt; - int fw_evt_cleanup; + struct task_struct *cur_evt_task; + u8 fw_evt_cleanup; u32 leapraid_evt_masks[4]; }; /** * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRAID adapter - * @msix_idx: MSI-X vector index used by this queue - * @rep_post_host_idx: Index of the last processed reply descriptor - * @rep_desc: Pointer to the reply descriptor associated with this queue - * @name: Name of the request queue - * @busy: Atomic counter indicating if the queue is busy + * @adapter: Pointer to the associated LeapRAID adapter. + * @msix_idx: MSI-X vector index used by this queue. + * @rep_post_host_idx: Index of the last processed reply descriptor. + * @rep_desc: Pointer to the reply descriptor associated with this queue. + * @name: Name of the request queue. + * @busy: Atomic counter indicating if the queue is busy. */ struct leapraid_rq { struct leapraid_adapter *adapter; @@ -576,8 +631,8 @@ struct leapraid_rq { /** * struct leapraid_int_rq - Internal request queue for a CPU * - * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRAID request queue structure + * @affinity_hint: CPU affinity mask for the queue. + * @rq: Underlying LeapRAID request queue structure. */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -587,9 +642,9 @@ struct leapraid_int_rq { /** * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * - * @busy: Atomic flag indicating request is being processed - * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRAID request structure + * @busy: Atomic flag indicating request is being processed. + * @pause: Atomic flag to temporarily suspend polling. + * @rq: The underlying LeapRAID request structure. */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,22 +653,25 @@ struct leapraid_blk_mq_poll_rq { }; /** - * struct leapraid_notification_desc - Notification - * descriptor for LeapRAID + * struct leapraid_notification_desc - Notification descriptor for LeapRAID * - * @iopoll_qdex: Index of the I/O polling queue - * @iopoll_qcnt: Count of I/O polling queues - * @msix_enable: Flag indicating MSI-X is enabled - * @msix_cpu_map: CPU map for MSI-X interrupts - * @msix_cpu_map_sz: Size of the MSI-X CPU map - * @int_rqs: Array of interrupt request queues - * @int_rqs_allocated: Count of allocated interrupt request queues - * @blk_mq_poll_rqs: Array of blk-mq polling requests + * @iopoll_qdex: Index of the I/O polling queue. + * @iopoll_qcnt: Count of I/O polling queues. + * @msix_enable: Flag indicating MSI-X is enabled. + * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. + * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. + * @msix_cpu_map: CPU map for MSI-X interrupts. + * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @int_rqs: Array of interrupt request queues. + * @int_rqs_allocated: Count of allocated interrupt request queues. + * @blk_mq_poll_rqs: Array of blk-mq polling requests. */ struct leapraid_notification_desc { u32 iopoll_qdex; u32 iopoll_qcnt; - bool msix_enable; + u8 msix_enable; + u8 irq_vectors_allocated; + u8 irq_mode; u8 *msix_cpu_map; u32 msix_cpu_map_sz; struct leapraid_int_rq *int_rqs; @@ -621,82 +679,104 @@ struct leapraid_notification_desc { struct leapraid_blk_mq_poll_rq *blk_mq_poll_rqs; }; +/** + * struct leapraid_overheat_desc - Overheat descriptor for LeapRAID + * + * @fault_overheat_wq: Workqueue for adapter thermal overheat operations. + * @fault_overheat_work: Work structure for thermal overheat. + * @thermal_alert: Flag indicating if adapter thermal alert is active. + * @fault_overheat_wq_name: Name of the fault overheat workqueue. + */ +struct leapraid_overheat_desc { + struct workqueue_struct *fault_overheat_wq; + struct work_struct fault_overheat_work; + atomic_t thermal_alert; + char fault_overheat_wq_name[48]; +}; + /** * struct leapraid_reset_desc - Reset descriptor for LeapRAID * - * @fault_reset_wq: Workqueue for fault reset operations - * @fault_reset_work: Delayed work structure for fault reset - * @fault_reset_wq_name: Name of the fault reset workqueue - * @host_diag_mutex: Mutex for host diagnostic operations - * @adapter_reset_lock: Spinlock for adapter reset operations - * @adapter_reset_mutex: Mutex for adapter reset operations - * @adapter_link_resetting: Flag indicating if adapter link is resetting - * @adapter_reset_results: Results of the adapter reset operation - * @pending_io_cnt: Count of pending I/O operations - * @reset_wait_queue: Wait queue for reset operations - * @reset_cnt: Counter for reset operations + * @fault_reset_wq: Workqueue for fault reset operations. + * @fault_reset_work: Delayed work structure for fault reset. + * @fault_reset_wq_name: Name of the fault reset workqueue. + * @host_diag_mutex: Mutex for host diagnostic operations. + * @adapter_reset_lock: Spinlock for adapter reset operations. + * @adapter_reset_mutex: Mutex for adapter reset operations. + * @adapter_link_resetting: Flag indicating if adapter link is resetting. + * @adapter_reset_results: Results of the adapter reset operation. + * @pending_io_cnt: Count of pending I/O operations. + * @reset_wait_queue: Wait queue for reset operations. + * @reset_cnt: Counter for reset operations. + * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; struct delayed_work fault_reset_work; char fault_reset_wq_name[48]; - struct mutex host_diag_mutex; - spinlock_t adapter_reset_lock; - struct mutex adapter_reset_mutex; - bool adapter_link_resetting; + struct mutex host_diag_mutex; /* Mutex for operations. */ + spinlock_t adapter_reset_lock; /* Protects adapter reset state. */ + struct mutex adapter_reset_mutex; /* Serializes adapter reset. */ + u8 adapter_link_resetting; int adapter_reset_results; int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; + u32 last_reset_cnt; }; /** - * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRAID + * struct leapraid_scan_dev_desc - Scan device descriptor for LeapRAID * - * @wait_scan_dev_done: Flag indicating if scan device operation is done - * @driver_loading: Flag indicating if driver is loading - * @first_scan_dev_fired: Flag indicating if first scan device operation fired - * @scan_dev_failed: Flag indicating if scan device operation failed - * @scan_start: Flag indicating if scan operation started - * @scan_start_failed: Count of failed scan start operations + * @wait_scan_dev_done: Flag indicating if scan device operation is done. + * @driver_loading: Flag indicating if driver is loading. + * @first_scan_dev_fired: Flag indicating if first scan device operation fired. + * @scan_dev_failed: Flag indicating if scan device operation failed. + * @scan_start: Flag indicating if scan operation started. + * @scan_start_failed: Count of failed scan start operations. */ struct leapraid_scan_dev_desc { - bool wait_scan_dev_done; - bool driver_loading; - bool first_scan_dev_fired; - bool scan_dev_failed; - bool scan_start; + u8 wait_scan_dev_done; + u8 driver_loading; + wait_queue_head_t wait_driver_loading; + u8 first_scan_dev_fired; + u8 scan_dev_failed; + u8 scan_start; u16 scan_start_failed; }; /** * struct leapraid_access_ctrl - Access control structure for LeapRAID * - * @pci_access_lock: Mutex for PCI access control - * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active - * @shost_recovering: Flag indicating if host is recovering - * @host_removing: Flag indicating if host is being removed - * @pcie_recovering: Flag indicating if PCIe is recovering + * @pci_access_lock: Mutex for PCI access control. + * @shost_recovering: Flag indicating if host is recovering. + * @shost_recover_async: Flag indicating if host is recovering + * and the 0xFFFF event. + * @shost_recover_wq: Wait queue for threads waiting on shost_recover_async. + * @host_removing: Flag indicating if host is being removed. + * @pcie_recovering: Flag indicating if PCIe is recovering. */ struct leapraid_access_ctrl { - struct mutex pci_access_lock; - bool adapter_thermal_alert; - bool shost_recovering; - bool host_removing; - bool pcie_recovering; + struct mutex pci_access_lock; /* serializes PCI register access. */ + u8 shost_recovering; + wait_queue_head_t recovery_waitq; + u8 shost_recover_async; + wait_queue_head_t shost_recover_wq; + u8 host_removing; + u8 pcie_recovering; }; /** * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * - * @fw_log_buffer: Buffer for firmware log data - * @fw_log_buffer_dma: DMA address of the firmware log buffer - * @fw_log_wq_name: Name of the firmware log workqueue - * @fw_log_wq: Workqueue for firmware log operations - * @fw_log_work: Delayed work structure for firmware log - * @open_pcie_trace: Flag indicating if PCIe tracing is open - * @fw_log_init_flag: Flag indicating if firmware log is initialized + * @fw_log_buffer: Buffer for firmware log data. + * @fw_log_buffer_dma: DMA address of the firmware log buffer. + * @fw_log_wq_name: Name of the firmware log workqueue. + * @fw_log_wq: Workqueue for firmware log operations. + * @fw_log_work: Delayed work structure for firmware log. + * @open_pcie_trace: Flag indicating if PCIe tracing is open. + * @fw_log_init_flag: Flag indicating if firmware log is initialized. + * @pre_debug_log: Last DebugLog register snapshot for change detection. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -706,6 +786,7 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; + u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -714,13 +795,13 @@ struct leapraid_fw_log_desc { /** * struct leapraid_card_port - Card port structure for LeapRAID * - * @list: List head for card port - * @vphys_list: List head for virtual phy list - * @port_id: Port ID - * @sas_address: SAS address - * @phy_mask: Mask of phy - * @vphys_mask: Mask of virtual phy - * @flg: Flags for the port + * @list: List head for card port. + * @vphys_list: List head for virtual PHY list. + * @port_id: Port ID. + * @sas_address: SAS address. + * @phy_mask: Mask of PHY. + * @vphys_mask: Mask of virtual PHY. + * @flg: Flags for the port. */ struct leapraid_card_port { struct list_head list; @@ -733,18 +814,18 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRAID + * struct leapraid_card_phy - Card PHY structure for LeapRAID * - * @port_siblings: List head for port siblings - * @card_port: Pointer to the card port - * @identify: SAS identify structure - * @remote_identify: Remote SAS identify structure - * @phy: SAS phy structure - * @phy_id: Phy ID - * @hdl: Handle for the port - * @attached_hdl: Handle for the attached port - * @phy_is_assigned: Flag indicating if phy is assigned - * @vphy: Flag indicating if virtual phy + * @port_siblings: List head for port siblings. + * @card_port: Pointer to the card port. + * @identify: SAS identify structure. + * @remote_identify: Remote SAS identify structure. + * @phy: SAS PHY structure. + * @phy_id: PHY ID. + * @hdl: Handle for the port. + * @attached_hdl: Handle for the attached port. + * @phy_is_assigned: Flag indicating if PHY is assigned. + * @vphy: Flag indicating if virtual PHY. */ struct leapraid_card_phy { struct list_head port_siblings; @@ -755,26 +836,26 @@ struct leapraid_card_phy { u8 phy_id; u16 hdl; u16 attached_hdl; - bool phy_is_assigned; - bool vphy; + u8 phy_is_assigned; + u8 vphy; }; /** * struct leapraid_topo_node - SAS topology node for LeapRAID * - * @list: List head for linking nodes - * @sas_port_list: List of SAS ports - * @card_port: Associated card port - * @card_phy: Associated card PHY - * @rphy: SAS remote PHY device - * @parent_dev: Parent device pointer - * @sas_address: SAS address of this node - * @sas_address_parent: Parent node's SAS address - * @phys_num: Number of physical links - * @hdl: Handle identifier - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical identifier - * @resp: Response status flag + * @list: List head for linking nodes. + * @sas_port_list: List of SAS ports. + * @card_port: Associated card port. + * @card_phy: Associated card PHY. + * @rphy: SAS remote PHY device. + * @parent_dev: Parent device pointer. + * @sas_address: SAS address of this node. + * @sas_address_parent: Parent node's SAS address. + * @phys_num: Number of physical links. + * @hdl: Handle identifier. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical identifier. + * @resp: Response status flag. */ struct leapraid_topo_node { struct list_head list; @@ -789,32 +870,32 @@ struct leapraid_topo_node { u16 hdl; u16 enc_hdl; u64 enc_lid; - bool resp; + u8 resp; }; /** * struct leapraid_dev_topo - LeapRAID device topology management structure * - * @topo_node_lock: Spinlock for protecting topology node operations - * @sas_dev_lock: Spinlock for SAS device list access - * @raid_volume_lock: Spinlock for RAID volume list access - * @sas_id: SAS domain identifier - * @card: Main card topology node - * @exp_list: List of expander devices - * @enc_list: List of enclosure devices - * @sas_dev_list: List of SAS devices - * @sas_dev_init_list: List of SAS devices being initialized - * @raid_volume_list: List of RAID volumes - * @card_port_list: List of card ports - * @pd_hdls: Array of physical disk handles - * @dev_removing: Array tracking devices being removed - * @pending_dev_add: Array tracking devices pending addition - * @blocking_hdls: Array of blocking handles + * @topo_node_lock: Spinlock for protecting topology node operations. + * @sas_dev_lock: Spinlock for SAS device list access. + * @raid_volume_lock: Spinlock for RAID volume list access. + * @enc_lock: Spinlock for enclosure device list access. + * @sas_id: SAS domain identifier. + * @card: Main card topology node. + * @exp_list: List of expander devices. + * @enc_list: List of enclosure devices. + * @sas_dev_list: List of SAS devices. + * @sas_dev_init_list: List of SAS devices being initialized. + * @raid_volume_list: List of RAID volumes. + * @card_port_list: List of card ports. + * @pd_hdls: Array of physical disk handles. + * @blocking_hdls: Array of blocking handles. */ struct leapraid_dev_topo { - spinlock_t topo_node_lock; - spinlock_t sas_dev_lock; - spinlock_t raid_volume_lock; + spinlock_t topo_node_lock; /* Protects topology node. */ + spinlock_t sas_dev_lock; /* Protects SAS device list access. */ + spinlock_t raid_volume_lock; /* Protects RAID volume list access. */ + spinlock_t enc_lock; /* Protects enclosure device list access. */ int sas_id; struct leapraid_topo_node card; struct list_head exp_list; @@ -824,21 +905,17 @@ struct leapraid_dev_topo { struct list_head raid_volume_list; struct list_head card_port_list; u16 pd_hdls_sz; - void *pd_hdls; - void *blocking_hdls; - u16 pending_dev_add_sz; - void *pending_dev_add; - u16 dev_removing_sz; - void *dev_removing; + unsigned long *pd_hdls; + unsigned long *blocking_hdls; }; /** * struct leapraid_boot_dev - Boot device structure for LeapRAID * - * @dev: Device pointer - * @chnl: Channel number - * @form: Form factor - * @pg_dev: Config page device content + * @dev: Device pointer. + * @chnl: Channel number. + * @form: Form factor. + * @pg_dev: Config page device content. */ struct leapraid_boot_dev { void *dev; @@ -849,11 +926,14 @@ struct leapraid_boot_dev { /** * struct leapraid_boot_devs - Boot device management structure - * @requested_boot_dev: Requested primary boot device - * @requested_alt_boot_dev: Requested alternate boot device - * @current_boot_dev: Currently active boot device + * + * @lock: Spinlock protecting boot device cache access. + * @requested_boot_dev: Requested primary boot device. + * @requested_alt_boot_dev: Requested alternate boot device. + * @current_boot_dev: Currently active boot device. */ struct leapraid_boot_devs { + spinlock_t lock; /* protects boot dev */ struct leapraid_boot_dev requested_boot_dev; struct leapraid_boot_dev requested_alt_boot_dev; struct leapraid_boot_dev current_boot_dev; @@ -861,9 +941,10 @@ struct leapraid_boot_devs { /** * struct leapraid_smart_poll_desc - SMART polling descriptor - * @smart_poll_wq: Workqueue for SMART polling tasks - * @smart_poll_work: Delayed work for SMART polling operations - * @smart_poll_wq_name: Workqueue name string + * + * @smart_poll_wq: Workqueue for SMART polling tasks. + * @smart_poll_work: Delayed work for SMART polling operations. + * @smart_poll_wq_name: Workqueue name string. */ struct leapraid_smart_poll_desc { struct workqueue_struct *smart_poll_wq; @@ -873,26 +954,28 @@ struct leapraid_smart_poll_desc { /** * struct leapraid_adapter - Main LeapRAID adapter structure - * @list: List head for adapter management - * @shost: SCSI host structure - * @pdev: PCI device structure - * @iomem_base: I/O memory mapped base address - * @rep_msg_host_idx: Host index for reply messages - * @mask_int: Interrupt masking flag - * @timestamp_sync_cnt: Timestamp synchronization counter - * @adapter_attr: Adapter attributes - * @mem_desc: Memory descriptor - * @driver_cmds: Driver commands - * @dynamic_task_desc: Dynamic task descriptor - * @fw_evt_s: Firmware event structure - * @notification_desc: Notification descriptor - * @reset_desc: Reset descriptor - * @scan_dev_desc: Device scan descriptor - * @access_ctrl: Access control - * @fw_log_desc: Firmware log descriptor - * @dev_topo: Device topology - * @boot_devs: Boot devices - * @smart_poll_desc: SMART polling descriptor + * + * @list: List head for adapter management. + * @shost: SCSI host structure. + * @pdev: PCI device structure. + * @iomem_base: I/O memory mapped base address. + * @rep_msg_host_idx: Host index for reply messages. + * @mask_int: Interrupt masking flag. + * @timestamp_sync_cnt: Timestamp synchronization counter. + * @adapter_attr: Adapter attributes. + * @mem_desc: Memory descriptor. + * @driver_cmds: Driver commands. + * @dynamic_task_desc: Dynamic task descriptor. + * @fw_evt_s: Firmware event structure. + * @notification_desc: Notification descriptor. + * @reset_desc: Reset descriptor. + * @scan_dev_desc: Device scan descriptor. + * @access_ctrl: Access control. + * @fw_log_desc: Firmware log descriptor. + * @dev_topo: Device topology. + * @boot_devs: Boot devices. + * @smart_poll_desc: SMART polling descriptor. + * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { struct list_head list; @@ -900,7 +983,7 @@ struct leapraid_adapter { struct pci_dev *pdev; struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; - bool mask_int; + u8 mask_int; u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; @@ -916,6 +999,7 @@ struct leapraid_adapter { struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; struct leapraid_smart_poll_desc smart_poll_desc; + struct leapraid_overheat_desc overheat_desc; }; union cfg_param_1 { @@ -932,6 +1016,7 @@ union cfg_param_2 { enum config_page_action { GET_BIOS_PG2, GET_BIOS_PG3, + GET_MANUFACTURING_PG0, GET_SAS_DEVICE_PG0, GET_SAS_IOUNIT_PG0, GET_SAS_IOUNIT_PG1, @@ -946,8 +1031,9 @@ enum config_page_action { /** * struct leapraid_enc_node - Enclosure node structure - * @list: List head for enclosure management - * @pg0: Enclosure page 0 data + * + * @list: List head for enclosure management. + * @pg0: Enclosure page 0 data. */ struct leapraid_enc_node { struct list_head list; @@ -956,20 +1042,23 @@ struct leapraid_enc_node { /** * struct leapraid_raid_volume - RAID volume structure - * @list: List head for volume management - * @starget: SCSI target structure - * @sdev: SCSI device structure - * @id: Volume ID - * @channel: SCSI channel - * @wwid: World Wide Identifier - * @hdl: Volume handle - * @vol_type: Volume type - * @pd_num: Number of physical disks - * @resp: Response status - * @dev_info: Device information + * + * @list: List head for volume management. + * @refcnt: Reference count. + * @starget: SCSI target structure. + * @sdev: SCSI device structure. + * @id: Volume ID. + * @channel: SCSI channel. + * @wwid: World wide Identifier. + * @hdl: Volume handle. + * @vol_type: Volume type. + * @pd_num: Number of physical disks. + * @resp: Response status. + * @dev_info: Device information. */ struct leapraid_raid_volume { struct list_head list; + struct kref refcnt; struct scsi_target *starget; struct scsi_device *sdev; unsigned int id; @@ -982,20 +1071,31 @@ struct leapraid_raid_volume { u32 dev_info; }; +static inline void leapraid_raid_volume_free(struct kref *ref) +{ + kfree(container_of(ref, struct leapraid_raid_volume, refcnt)); +} + +#define leapraid_raid_volume_get(volume) \ + kref_get(&(volume)->refcnt) +#define leapraid_raid_volume_put(volume) \ + kref_put(&(volume)->refcnt, leapraid_raid_volume_free) + #define LEAPRAID_TGT_FLG_RAID_MEMBER 0x01 #define LEAPRAID_TGT_FLG_VOLUME 0x02 #define LEAPRAID_NO_ULD_ATTACH 1 /** * struct leapraid_starget_priv - SCSI target private data - * @starget: SCSI target structure - * @sas_address: SAS address - * @hdl: Device handle - * @num_luns: Number of LUNs - * @flg: Flags - * @deleted: Deletion flag - * @tm_busy: Task management busy flag - * @card_port: Associated card port - * @sas_dev: SAS device structure + * + * @starget: SCSI target structure. + * @sas_address: SAS address. + * @hdl: Device handle. + * @num_luns: Number of LUNs. + * @flg: Flags. + * @deleted: Deletion flag. + * @tm_busy: Task management busy flag. + * @card_port: Associated card port. + * @sas_dev: SAS device structure. */ struct leapraid_starget_priv { struct scsi_target *starget; @@ -1003,8 +1103,8 @@ struct leapraid_starget_priv { u16 hdl; int num_luns; u32 flg; - bool deleted; - bool tm_busy; + u8 deleted; + u8 tm_busy; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; }; @@ -1012,50 +1112,52 @@ struct leapraid_starget_priv { #define LEAPRAID_DEVICE_FLG_INIT 0x01 /** * struct leapraid_sdev_priv - SCSI device private data - * @starget_priv: Associated target private data - * @lun: Logical Unit Number - * @flg: Flags - * @block: Block flag - * @deleted: Deletion flag - * @sep: SEP flag + * + * @starget_priv: Associated target private data. + * @lun: Logical Unit Number. + * @flg: Flags. + * @block: Block flag. + * @deleted: Deletion flag. + * @sep: SEP flag. */ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - bool ncq; - bool block; - bool deleted; - bool sep; + u8 ncq; + u8 block; + u8 deleted; + u8 sep; }; /** * struct leapraid_sas_dev - SAS device structure - * @list: List head for device management - * @starget: SCSI target structure - * @card_port: Associated card port - * @rphy: SAS remote PHY - * @refcnt: Reference count - * @id: Device ID - * @channel: SCSI channel - * @slot: Slot number - * @phy: PHY identifier - * @resp: Response status - * @led_on: LED state - * @sas_addr: SAS address - * @dev_name: Device name - * @hdl: Device handle - * @parent_sas_addr: Parent SAS address - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical ID - * @volume_hdl: Volume handle - * @volume_wwid: Volume WWID - * @dev_info: Device information - * @pend_sas_rphy_add: Pending SAS rphy addition flag - * @enc_level: Enclosure level - * @port_type: Port type - * @connector_name: Connector name - * @support_smart: SMART support flag + * + * @list: List head for device management. + * @starget: SCSI target structure. + * @card_port: Associated card port. + * @rphy: SAS remote PHY. + * @refcnt: Reference count. + * @id: Device ID. + * @channel: SCSI channel. + * @slot: Slot number. + * @phy: PHY identifier. + * @resp: Response status. + * @led_on: LED state. + * @sas_addr: SAS address. + * @dev_name: Device name. + * @hdl: Device handle. + * @parent_sas_addr: Parent SAS address. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical ID. + * @volume_hdl: Volume handle. + * @volume_wwid: Volume WWID. + * @dev_info: Device information. + * @pend_sas_rphy_add: Pending SAS remote PHY addition flag. + * @enc_level: Enclosure level. + * @port_connection: Port connection. + * @connector_name: Connector name. + * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1067,8 +1169,8 @@ struct leapraid_sas_dev { unsigned int channel; u16 slot; u8 phy; - bool resp; - bool led_on; + u8 resp; + u8 led_on; u64 sas_addr; u64 dev_name; u16 hdl; @@ -1080,9 +1182,9 @@ struct leapraid_sas_dev { u32 dev_info; u8 pend_sas_rphy_add; u8 enc_level; - u8 port_type; - u8 connector_name[5]; - bool support_smart; + u8 port_connection; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; + u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1093,15 +1195,19 @@ static inline void leapraid_sdev_free(struct kref *ref) #define leapraid_sdev_get(sdev) kref_get(&(sdev)->refcnt) #define leapraid_sdev_put(sdev) kref_put(&(sdev)->refcnt, leapraid_sdev_free) +void leapraid_boot_dev_get(void *dev, u32 chnl); +void leapraid_boot_dev_put(void *dev, u32 chnl); + /** * struct leapraid_sas_port - SAS port structure - * @port_list: List head for port management - * @phy_list: List of PHYs in this port - * @port: SAS port structure - * @card_port: Associated card port - * @remote_identify: Remote device identification - * @rphy: SAS remote PHY - * @phys_num: Number of PHYs in this port + * + * @port_list: List head for port management. + * @phy_list: List of PHYs in this port. + * @port: SAS port structure. + * @card_port: Associated card port. + * @remote_identify: Remote device identification. + * @rphy: SAS remote PHY. + * @phys_num: Number of PHYs in this port. */ struct leapraid_sas_port { struct list_head port_list; @@ -1116,10 +1222,11 @@ struct leapraid_sas_port { #define LEAPRAID_VPHY_FLG_DIRTY 0x01 /** * struct leapraid_vphy - Virtual PHY structure - * @list: List head for PHY management - * @sas_address: SAS address - * @phy_mask: PHY mask - * @flg: Flags + * + * @list: List head for PHY management. + * @sas_address: SAS address. + * @phy_mask: PHY mask. + * @flg: Flags. */ struct leapraid_vphy { struct list_head list; @@ -1128,23 +1235,44 @@ struct leapraid_vphy { u8 flg; }; +/** + * struct leapraid_tgt_rst_list - Target reset tracking entry + * @list: List node used to link reset entries. + * @handle: Device handle of the target being reset. + * @state: Current state of the target reset operation. + * + * Each entry represents a target device that is undergoing or has + * undergone a target reset operation. + */ struct leapraid_tgt_rst_list { struct list_head list; u16 handle; u16 state; }; -struct leapraid_sc_list { - struct list_head list; - u16 handle; -}; - +/** + * struct sense_info - Parsed SCSI sense information + * @sense_key: Sense key extracted from sense data. + * @asc: Additional Sense Code (ASC). + * @ascq: Additional Sense Code Qualifier (ASCQ). + * + * This structure stores key fields parsed from SCSI sense data to + * simplify error handling and reporting. + */ struct sense_info { u8 sense_key; u8 asc; u8 ascq; }; +/** + * struct leapraid_fw_log_info - Firmware log position information + * @user_position: Current log read position used by the driver. + * @adapter_position: Current log write position maintained by firmware. + * + * This structure tracks firmware log buffer positions used for retrieving + * log entries from the adapter. + */ struct leapraid_fw_log_info { u32 user_position; u32 adapter_position; @@ -1152,8 +1280,9 @@ struct leapraid_fw_log_info { /** * enum reset_type - Reset type enumeration - * @FULL_RESET: Full hardware reset - * @PART_RESET: Partial reset + * + * @FULL_RESET: Full hardware reset. + * @PART_RESET: Partial reset. */ enum reset_type { FULL_RESET, @@ -1175,22 +1304,23 @@ enum leapraid_port_checking_state { /** * struct leapraid_card_port_feature - Card port feature - * @dirty_flg: Dirty flag indicator - * @same_addr: Same address flag - * @exact_phy: Exact PHY match flag - * @phy_overlap: PHY overlap bitmap - * @same_port: Same port flag - * @cur_chking_old_port: Current checking old port - * @expected_old_port: Expected old port - * @same_addr_port_count: Same address port count - * @checking_state: Port checking state + * + * @dirty_flg: Dirty flag indicator. + * @same_addr: Same address flag. + * @exact_phy: Exact PHY match flag. + * @phy_overlap: PHY overlap bitmap. + * @same_port: Same port flag. + * @cur_chking_old_port: Current checking old port. + * @expected_old_port: Expected old port. + * @same_addr_port_count: Same address port count. + * @checking_state: Port checking state. */ struct leapraid_card_port_feature { u8 dirty_flg; - bool same_addr; - bool exact_phy; + u8 same_addr; + u8 exact_phy; u32 phy_overlap; - bool same_port; + u8 same_port; struct leapraid_card_port *cur_chking_old_port; struct leapraid_card_port *expected_old_port; int same_addr_port_count; @@ -1225,7 +1355,7 @@ struct leapraid_rep_manu_reply { u8 vendor_identification[SAS_EXPANDER_VENDOR_ID_LEN]; u8 product_identification[SAS_EXPANDER_PRODUCT_ID_LEN]; u8 product_revision_level[SAS_EXPANDER_PRODUCT_REV_LEN]; - u8 component_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; + u8 comp_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; u16 component_id; u8 component_revision_level; u8 r3; @@ -1234,20 +1364,21 @@ struct leapraid_rep_manu_reply { /** * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * @hdl: Device handle - * @lun: Logical Unit Number - * @raid_member: RAID member flag - * @dir: DMA data direction - * @data_length: Data transfer length - * @data_buffer: Data buffer pointer - * @cdb_length: CDB length - * @cdb: Command Descriptor Block - * @time_out: Timeout + * + * @hdl: Device handle. + * @lun: Logical Unit Number. + * @raid_member: RAID member flag. + * @dir: DMA data direction. + * @data_length: Data transfer length. + * @data_buffer: Data buffer pointer. + * @cdb_length: CDB length. + * @cdb: Command Descriptor Block. + * @time_out: Timeout. */ struct leapraid_scsi_cmd_desc { u16 hdl; u32 lun; - bool raid_member; + u8 raid_member; enum dma_data_direction dir; u32 data_length; void *data_buffer; @@ -1274,7 +1405,8 @@ void leapraid_mask_int(struct leapraid_adapter *adapter); void leapraid_unmask_int(struct leapraid_adapter *adapter); u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter); bool leapraid_pci_removed(struct leapraid_adapter *adapter); -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter); +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller); void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid); void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid); __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -1286,11 +1418,11 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid); struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( struct leapraid_adapter *adapter, u16 taskid); -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd); struct scsi_cmnd *leapraid_get_scmd_from_taskid( struct leapraid_adapter *adapter, u16 taskid); int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev); void leapraid_scan_dev_done(struct leapraid_adapter *adapter); +void leapraid_cleanup_lists(struct leapraid_adapter *adapter); void leapraid_wait_cmds_done(struct leapraid_adapter *adapter); void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter); void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll); @@ -1307,14 +1439,16 @@ int leapraid_issue_locked_tm(struct leapraid_adapter *adapter, u16 handle, int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 handle, uint channel, uint id, uint lun, u8 type, u16 taskid_task, u8 tr_method); -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep); +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep); int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume); -int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_init_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_exit_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); bool leapraid_scmd_find_by_lun(struct leapraid_adapter *adapter, uint id, unsigned int lun, uint channel); @@ -1383,10 +1517,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth); +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data); + +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); int leapraid_ctl_release(struct inode *inode, struct file *filep); -void leapraid_ctl_init(void); +int leapraid_ctl_init(void); void leapraid_ctl_exit(void); extern struct sas_function_template leapraid_transport_functions; @@ -1409,17 +1546,20 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, u64 sas_address, u16 handle, u8 phy_number, u8 link_rate, struct leapraid_card_port *card_port); -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *topo_node, - struct leapraid_card_phy *card_phy); -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *sas_node, - struct leapraid_card_phy *card_phy, - u64 sas_address, - struct leapraid_card_port *card_port); +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *topo_node, + struct leapraid_card_phy *card_phy); +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *sas_node, + struct leapraid_card_phy *card_phy, + u64 sas_address, + struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); void leapraid_smart_polling_start(struct leapraid_adapter *adapter); void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index f8354c68ab71..c60c5d80c7b3 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -18,16 +17,16 @@ MODULE_DESCRIPTION(LEAPRAID_DESCRIPTION); MODULE_LICENSE("GPL"); MODULE_VERSION(LEAPRAID_DRIVER_VERSION); -static int leapraid_ids; +static atomic_t leapraid_ids = ATOMIC_INIT(0); static int open_pcie_trace = 1; module_param(open_pcie_trace, int, 0644); -MODULE_PARM_DESC(open_pcie_trace, "open_pcie_trace: default=1(open)/0(close)"); +MODULE_PARM_DESC(open_pcie_trace, "Default=1(open)/0(close)"); static int enable_mp = 1; module_param(enable_mp, int, 0444); MODULE_PARM_DESC(enable_mp, - "enable multipath on target device. default=1(enable)"); + "Enable multipath on target device. default=1(enable)"); static inline void leapraid_get_sense_data(char *sense, struct sense_info *data) @@ -46,14 +45,9 @@ static inline void leapraid_get_sense_data(char *sense, } } -static struct Scsi_Host *pdev_to_shost(struct pci_dev *pdev) -{ - return pci_get_drvdata(pdev); -} - static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost) return NULL; @@ -61,18 +55,13 @@ static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) return shost_priv(shost); } -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd) -{ - return scsi_cmd_priv(scmd); -} - void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_sdev_priv *sdev_priv; struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -82,7 +71,7 @@ void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = true; + sdev_priv->starget_priv->tm_busy = 1; skip = true; } } @@ -94,7 +83,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -104,7 +93,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = false; + sdev_priv->starget_priv->tm_busy = 0; skip = true; } } @@ -136,21 +125,19 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - if ((adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && + (adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid) { - if ((adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && + (adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; return rc; } @@ -197,7 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsi_tm_req *scsi_tm_req; struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; - u16 msix_task = 0; + u16 msix_task; bool issue_reset = false; u32 db; int rc; @@ -208,7 +195,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { dev_info(&adapter->pdev->dev, - "%s %s: host is recovering, skip tm command!\n", + "%s %s: Host is recovering, skip tm command!\n", __func__, adapter->adapter_attr.name); return FAILED; } @@ -216,24 +203,25 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED) { dev_info(&adapter->pdev->dev, - "%s unexpected db status, issuing hard reset!\n", + "%s Unexpected db status, issuing hard reset!\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, - target_taskid); + io_req_tracker = + leapraid_get_io_tracker_from_taskid(adapter, + target_taskid); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_PENDING; scsi_tm_req = @@ -241,7 +229,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->driver_cmds.tm_cmd.hp_taskid); leapraid_build_tm_req(scsi_tm_req, hdl, lun, type, tr_method, target_taskid); - memset((void *)(&adapter->driver_cmds.tm_cmd.reply), 0, + memset(&adapter->driver_cmds.tm_cmd.reply, 0, sizeof(struct leapraid_scsi_tm_rep)); leapraid_set_tm_flg(adapter, hdl); init_completion(&adapter->driver_cmds.tm_cmd.done); @@ -257,16 +245,20 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: TM cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.tm_cmd.status); + leapraid_log_req_context(adapter, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); if (issue_reset) { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = (!rc) ? SUCCESS : FAILED; - goto out; + rc = !rc ? SUCCESS : FAILED; + goto out_cleanup; } } @@ -276,15 +268,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, case LEAPRAID_TM_TASKTYPE_TARGET_RESET: case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: - rc = leapraid_tm_post_processing(adapter, hdl, channel, id, lun, - type, target_taskid); + rc = leapraid_tm_post_processing(adapter, hdl, channel, id, + lun, type, target_taskid); break; case LEAPRAID_TM_TASKTYPE_ABORT_TASK: rc = SUCCESS; scsiio_req = leapraid_get_task_desc(adapter, target_taskid); if (le16_to_cpu(scsiio_req->dev_hdl) != hdl) break; - dev_err(&adapter->pdev->dev, "%s abort failed, hdl=0x%04x\n", + dev_err(&adapter->pdev->dev, "%s: Abort failed, hdl=0x%04x\n", adapter->adapter_attr.name, hdl); rc = FAILED; break; @@ -296,7 +288,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, break; } -out: +out_cleanup: leapraid_clear_tm_flg(adapter, hdl); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_NOT_USED; return rc; @@ -327,20 +319,25 @@ void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + return; } starget = sas_dev->starget; - starget_priv = starget->hostdata; - if ((starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { + starget_priv = starget ? starget->hostdata : NULL; + if (!starget_priv) { + spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); + goto release_sdev; + } + + if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + goto release_sdev; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_async_turn_on_led(adapter, hdl); -out: +release_sdev: if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -417,7 +414,8 @@ static void leapraid_handle_success_status( scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; } -static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, +static void leapraid_scsiio_done_dispatch( + struct leapraid_adapter *adapter, struct leapraid_scsiio_rep *scsiio_rep, struct leapraid_sdev_priv *sdev_priv, struct scsi_cmnd *scmd, @@ -439,9 +437,8 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, xfer_cnt == 0 && (scsi_status == LEAPRAID_SCSI_STATUS_BUSY || scsi_status == LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT || - scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) { + scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) adapter_status = LEAPRAID_ADAPTER_STATUS_SUCCESS; - } switch (adapter_status) { case LEAPRAID_ADAPTER_STATUS_SCSI_DEVICE_NOT_THERE: @@ -513,7 +510,7 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, scsi_print_command(scmd); dev_warn(&adapter->pdev->dev, - "scsiio warn: hdl=0x%x, status are: 0x%x, 0x%x, 0x%x\n", + "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, scsi_status, scsi_state); @@ -523,24 +520,23 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, sz = min_t(u32, SCSI_SENSE_BUFFERSIZE, le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, - &sshdr)) { + &sshdr)) dev_warn(&adapter->pdev->dev, - "sense: key=0x%x asc=0x%x ascq=0x%x\n", + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", sshdr.sense_key, sshdr.asc, sshdr.ascq); - } else { + else dev_warn(&adapter->pdev->dev, - "sense: invalid sense data\n"); - } + "Sense: Invalid sense data\n"); } } -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep) +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep) { - struct leapraid_scsiio_rep *scsiio_rep = NULL; - struct leapraid_sdev_priv *sdev_priv = NULL; - struct scsi_cmnd *scmd = NULL; + struct leapraid_scsiio_rep *scsiio_rep; + struct leapraid_sdev_priv *sdev_priv; + struct scsi_cmnd *scmd; u32 response_code = 0; if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) @@ -548,12 +544,12 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, else scmd = adapter->driver_cmds.internal_scmd; if (!scmd) - return 1; + return true; scsiio_rep = leapraid_get_reply_vaddr(adapter, rep); if (!scsiio_rep) { scmd->result = DID_OK << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } sdev_priv = scmd->device->hostdata; @@ -561,7 +557,7 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, !sdev_priv->starget_priv || sdev_priv->starget_priv->deleted) { scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } if (scsiio_rep->scsi_state & LEAPRAID_SCSI_STATE_RESPONSE_INFO_VALID) @@ -571,33 +567,51 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, leapraid_scsiio_done_dispatch(adapter, scsiio_rep, sdev_priv, scmd, taskid, response_code); -out: +out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid)) { + if (unlikely(taskid == + adapter->driver_cmds.driver_scsiio_cmd.taskid)) { adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_DONE; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return 0; + return false; } leapraid_free_taskid(adapter, taskid); scsi_done(scmd); - return 0; + return false; } static void leapraid_probe_raid(struct leapraid_adapter *adapter) { - struct leapraid_raid_volume *raid_volume, *raid_volume_next; + struct leapraid_raid_volume *raid_volume, *next_raid_volume; + unsigned long flags; + LIST_HEAD(head); int rc; - list_for_each_entry_safe(raid_volume, raid_volume_next, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->starget) + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_splice_init(&adapter->dev_topo.raid_volume_list, &head); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, next_raid_volume, &head, list) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_move_tail(&raid_volume->list, + &adapter->dev_topo.raid_volume_list); + if (raid_volume->starget) { + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); continue; + } + + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); rc = scsi_add_device(adapter->shost, RAID_CHANNEL, raid_volume->id, 0); if (rc) leapraid_raid_volume_remove(adapter, raid_volume); + + leapraid_raid_volume_put(raid_volume); } } @@ -626,7 +640,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev = leapraid_get_next_sas_dev_from_init_list(adapter); if (!sas_dev) break; - added = leapraid_transport_port_add(adapter, sas_dev->hdl, sas_dev->parent_sas_addr, @@ -654,32 +667,52 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) } } -static bool leapraid_get_boot_dev(struct leapraid_boot_dev *boot_dev, +static bool leapraid_get_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, void **pdev, u32 *pchnl) { - if (boot_dev->dev) { - *pdev = boot_dev->dev; - *pchnl = boot_dev->chnl; - return true; + unsigned long flags; + void *dev; + u32 chnl; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (!boot_dev->dev) { + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + return false; } - return false; + + dev = boot_dev->dev; + chnl = boot_dev->chnl; + leapraid_boot_dev_get(dev, chnl); + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + + *pdev = dev; + *pchnl = chnl; + return true; } static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) { + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + struct leapraid_sas_port *sport; + unsigned long flags; void *dev = NULL; u32 chnl; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_alt_boot_dev, + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.current_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + &dev, &chnl)) goto boot_dev_found; return; @@ -687,12 +720,10 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) boot_dev_found: switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; + raid_volume = dev; if (raid_volume->starget) - return; + break; /* TODO eedp */ @@ -700,16 +731,11 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; - struct leapraid_sas_port *sas_port; - unsigned long flags; + sas_dev = dev; if (sas_dev->starget) - return; + break; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_move_tail(&sas_dev->list, @@ -717,16 +743,17 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (!sas_dev->card_port) - return; + break; - sas_port = leapraid_transport_port_add(adapter, sas_dev->hdl, - sas_dev->parent_sas_addr, - sas_dev->card_port); - if (!sas_port) + sport = leapraid_transport_port_add(adapter, sas_dev->hdl, + sas_dev->parent_sas_addr, + sas_dev->card_port); + if (!sport) leapraid_sas_dev_remove(adapter, sas_dev); break; } - } + + leapraid_boot_dev_put(dev, chnl); } static void leapraid_probe_devices(struct leapraid_adapter *adapter) @@ -744,69 +771,23 @@ static void leapraid_probe_devices(struct leapraid_adapter *adapter) void leapraid_scan_dev_done(struct leapraid_adapter *adapter) { if (adapter->scan_dev_desc.wait_scan_dev_done) { - adapter->scan_dev_desc.wait_scan_dev_done = false; + adapter->scan_dev_desc.wait_scan_dev_done = 0; leapraid_probe_devices(adapter); } + adapter->scan_dev_desc.scan_start = 0; + leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_smart_polling_start(adapter); } -static void leapraid_ir_shutdown(struct leapraid_adapter *adapter) -{ - struct leapraid_raid_act_req *raid_act_req; - struct leapraid_raid_act_rep *raid_act_rep; - struct leapraid_driver_cmd *raid_action_cmd; - - if (!adapter || !adapter->adapter_attr.raid_support) - return; - - if (list_empty(&adapter->dev_topo.raid_volume_list)) - return; - - if (leapraid_pci_removed(adapter)) - return; - - raid_action_cmd = &adapter->driver_cmds.raid_action_cmd; - - mutex_lock(&raid_action_cmd->mutex); - raid_action_cmd->status = LEAPRAID_CMD_PENDING; - - raid_act_req = leapraid_get_task_desc(adapter, - raid_action_cmd->inter_taskid); - memset(raid_act_req, 0, sizeof(struct leapraid_raid_act_req)); - raid_act_req->func = LEAPRAID_FUNC_RAID_ACTION; - raid_act_req->act = LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED; - - dev_info(&adapter->pdev->dev, "ir shutdown start\n"); - init_completion(&raid_action_cmd->done); - leapraid_fire_task(adapter, raid_action_cmd->inter_taskid); - wait_for_completion_timeout(&raid_action_cmd->done, - LEAPRAID_RAID_ACTION_CMD_TIMEOUT * HZ); - - if (!(raid_action_cmd->status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timeout waiting for ir shutdown\n", __func__); - goto out; - } - - if (raid_action_cmd->status & LEAPRAID_CMD_REPLY_VALID) { - raid_act_rep = (void *)(&raid_action_cmd->reply); - dev_info(&adapter->pdev->dev, - "ir shutdown done, adapter status=0x%04x\n", - le16_to_cpu(raid_act_rep->adapter_status)); - } - -out: - raid_action_cmd->status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&raid_action_cmd->mutex); -} - static const struct pci_device_id leapraid_pci_table[] = { - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA) }, - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_RAID) }, + { PCI_DEVICE_SUB(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA, + LEAPRAID_SUBVENDOR_ID, + LEAPRAID_SUBDEVID_HBA) }, { 0, } }; @@ -816,7 +797,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, u8 opcode; if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.adapter_thermal_alert) + atomic_read(&adapter->overheat_desc.thermal_alert)) return false; if (adapter->access_ctrl.host_removing) { @@ -826,8 +807,8 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, opcode = scmd->cmnd[0]; if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) return true; - else - return false; + + return false; } return true; } @@ -854,28 +835,33 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, scsi_build_sense(scmd, 0, UNIT_ATTENTION, LEAPRAID_SCSI_ASC_POWER_ON_RESET, LEAPRAID_SCSI_ASCQ_POWER_ON_RESET); - goto done_out; + goto scsiio_done; } if (adapter->access_ctrl.shost_recovering || adapter->reset_desc.adapter_link_resetting) { *rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; - } else if (starget_priv->deleted || sdev_priv->deleted) { + return false; + } + + if (starget_priv->deleted || sdev_priv->deleted) goto no_connect; - } else if (starget_priv->tm_busy || sdev_priv->block) { + + if (starget_priv->tm_busy || sdev_priv->block) { *rc = SCSI_MLQUEUE_DEVICE_BUSY; - goto out; + return false; } return true; no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; -done_out: +scsiio_done: if (likely(scmd != adapter->driver_cmds.internal_scmd)) scsi_done(scmd); -out: + else + *rc = LEAPRAID_OPERATION_FAILED; + return false; } @@ -903,12 +889,14 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; if (scmd->cmd_len == 32) - control |= 4 << LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT; + control |= LEAPRAID_SCSIIO_CTRL_CDB_32BYTE << + LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT; return control; } -int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) +int leapraid_queuecommand(struct Scsi_Host *shost, + struct scsi_cmnd *scmd) { struct leapraid_adapter *adapter = shost_priv(scmd->device->host); struct leapraid_sdev_priv *sdev_priv = scmd->device->hostdata; @@ -920,7 +908,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) int rc = 0; if (!leapraid_should_queuecommand(adapter, sdev_priv, scmd, &rc)) - goto out; + return rc; starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; @@ -932,11 +920,11 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) - scsiio_req->func = LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH; else - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; scsiio_req->dev_hdl = cpu_to_le16(hdl); scsiio_req->data_len = cpu_to_le32(scsi_bufflen(scmd)); @@ -954,23 +942,21 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) if (scsiio_req->data_len) { if (leapraid_build_scmd_ieee_sg(adapter, scmd, taskid)) { leapraid_free_taskid(adapter, taskid); - rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; + return SCSI_MLQUEUE_HOST_BUSY; } } else { leapraid_build_ieee_nodata_sg(adapter, &scsiio_req->sgl); } - if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO_REQ)) { + if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO)) leapraid_fire_scsi_io(adapter, taskid, - le16_to_cpu(scsiio_req->dev_hdl)); - } else { + le16_to_cpu(scsiio_req->dev_hdl)); + else leapraid_fire_task(adapter, taskid); - } + dev_dbg(&adapter->pdev->dev, "LEAPRAID_SCSIIO: Send Descriptor taskid %d, req type 0x%x\n", taskid, scsiio_req->func); -out: return rc; } @@ -980,7 +966,7 @@ static int leapraid_init_cmd_priv(struct Scsi_Host *shost, struct leapraid_adapter *adapter = shost_priv(shost); struct leapraid_io_req_tracker *io_tracker; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); leapraid_internal_init_cmd_priv(adapter, io_tracker); return 0; @@ -992,7 +978,7 @@ static int leapraid_exit_cmd_priv(struct Scsi_Host *shost, struct leapraid_adapter *adapter = shost_priv(shost); struct leapraid_io_req_tracker *io_tracker; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); leapraid_internal_exit_cmd_priv(adapter, io_tracker); return 0; @@ -1016,9 +1002,9 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, scsi_print_command(scmd); if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - io_req_tracker = leapraid_get_scmd_priv(scmd); + io_req_tracker = scsi_cmd_priv(scmd); dev_info(&adapter->pdev->dev, - "EH ABORT: scmd=0x%p, pending=%u ms, tout=%u ms, req tag=%d\n", + "EH ABORT: scmd=0x%p, pend=%ums, tout=%ums, tag=%d\n", scmd, jiffies_to_msecs(jiffies - scmd->jiffies_at_alloc), (scsi_cmd_to_rq(scmd)->timeout / HZ) * 1000, @@ -1031,48 +1017,47 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH %s failed: %s scmd=0x%p\n", str, (adapter->access_ctrl.host_removing ? "shost removing!" : "pci_dev removed!"), scmd); - if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - if (io_req_tracker && io_req_tracker->taskid) - leapraid_free_taskid(adapter, - io_req_tracker->taskid); + if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK && + io_req_tracker && io_req_tracker->taskid) + leapraid_free_taskid(adapter, io_req_tracker->taskid); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; #ifdef FAST_IO_FAIL rc = FAST_IO_FAIL; #else rc = FAILED; #endif - goto out; + goto out_eh_done; } sdev_priv = scmd->device->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) { dev_warn(&adapter->pdev->dev, - "EH %s: sdev or starget gone, scmd=0x%p\n", + "EH %s: SAS dev or starget gone, scmd=0x%p\n", str, scmd); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scsi_done(scmd); rc = SUCCESS; - goto out; + goto out_eh_done; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { if (!io_req_tracker) { dev_warn(&adapter->pdev->dev, - "EH ABORT: no io tracker, scmd 0x%p\n", scmd); + "EH ABORT: No I/O tracker, scmd 0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = SUCCESS; - goto out; + goto out_eh_done; } if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { dev_err(&adapter->pdev->dev, - "EH ABORT: skip RAID/VOLUME target, scmd=0x%p\n", + "EH ABORT: Skip RAID/VOLUME, scmd=0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } hdl = sdev_priv->starget_priv->hdl; @@ -1090,11 +1075,11 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, if (!hdl) { dev_err(&adapter->pdev->dev, - "EH %s failed: target handle is 0, scmd=0x%p\n", + "EH %s failed: Target handle 0, scmd=0x%p\n", str, scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } } @@ -1102,24 +1087,27 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH issue TM: type=%s, scmd=0x%p, hdl=0x%x\n", str, scmd, hdl); - rc = leapraid_issue_locked_tm(adapter, hdl, scmd->device->channel, - scmd->device->id, - (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? - 0 : scmd->device->lun), - type, - (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? - io_req_tracker->taskid : 0), - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - -out: + rc = leapraid_issue_locked_tm( + adapter, + hdl, + scmd->device->channel, + scmd->device->id, + (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? + 0 : scmd->device->lun), + type, + (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? + io_req_tracker->taskid : 0), + LEAPRAID_TM_MSGFLAGS_LINK_RESET); + +out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { dev_info(&adapter->pdev->dev, "EH ABORT result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); } else { dev_info(&adapter->pdev->dev, "EH %s result: %s, scmd=0x%p\n", - str, ((rc == SUCCESS) ? "success" : "failed"), scmd); + str, rc == SUCCESS ? "success" : "failed", scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1162,19 +1150,19 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) (adapter->access_ctrl.host_removing ? "shost removing!" : "driver loading!"), scmd); rc = FAILED; - goto out; + goto out_host_reset_done; } - dev_info(&adapter->pdev->dev, "%s:%d issuing hard reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: Issuing hard reset\n", __func__, __LINE__); if (leapraid_hard_reset_handler(adapter, FULL_RESET) < 0) rc = FAILED; else rc = SUCCESS; -out: +out_host_reset_done: dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); return rc; } @@ -1200,30 +1188,35 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) stgt_priv->num_luns++; sdev_priv->starget_priv = stgt_priv; sdev->hostdata = sdev_priv; - if ((stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER)) + if (stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) sdev->no_uld_attach = LEAPRAID_NO_ULD_ATTACH; shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); if (tgt->channel == RAID_CHANNEL) { - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); - if (raid_volume) + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, + flags); raid_volume->sdev = sdev; - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); + } } if (!(stgt_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - stgt_priv->sas_address, - stgt_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + stgt_priv->sas_address, + stgt_priv->card_port); if (sas_dev && !sas_dev->starget) { sdev_printk(KERN_INFO, sdev, - "%s: assign starget to sas_dev\n", __func__); + "%s: Assign starget to sas_dev\n", + __func__); sas_dev->starget = tgt; } @@ -1241,7 +1234,6 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) struct leapraid_raid_volume *raid_volume; struct leapraid_starget_priv *starget_priv; struct leapraid_sdev_priv *sdev_priv; - unsigned long flags; int qd; u16 hdl; @@ -1249,37 +1241,38 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (!raid_volume) { sdev_printk(KERN_WARNING, sdev, - "%s: raid_volume not found, hdl=0x%x\n", + "%s: RAID volume not found, hdl=0x%x\n", __func__, hdl); return 1; } if (leapraid_get_volume_cap(adapter, raid_volume)) { sdev_printk(KERN_ERR, sdev, - "%s: failed to get volume cap, hdl=0x%x\n", + "%s: Failed to get volume cap, hdl=0x%x\n", __func__, hdl); + leapraid_raid_volume_put(raid_volume); return 1; } qd = (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) ? - LEAPRAID_SAS_QUEUE_DEPTH : LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth : + adapter->adapter_attr.sata_max_queue_depth; if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) - qd = LEAPRAID_RAID_QUEUE_DEPTH; + qd = adapter->adapter_attr.raid_volume_max_queue_depth; sdev_printk(KERN_INFO, sdev, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + "RAID volume: hdl=0x%04x, wwid=0x%016llx\n", raid_volume->hdl, (unsigned long long)raid_volume->wwid); if (shost->max_sectors > LEAPRAID_MAX_SECTORS) blk_queue_max_hw_sectors(sdev->request_queue, LEAPRAID_MAX_SECTORS); - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); + leapraid_raid_volume_put(raid_volume); return 0; } @@ -1297,13 +1290,14 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sdev_priv = sdev->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); *is_target_ssp = false; - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); sdev_printk(KERN_WARNING, sdev, - "%s: sas_dev not found, sas=0x%llx\n", + "%s: SAS dev not found, sas=0x%llx\n", __func__, sdev_priv->starget_priv->sas_address); return 1; } @@ -1312,18 +1306,18 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sas_dev->volume_hdl = vol_hdl; sas_dev->volume_wwid = volume_wwid; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { - *qd = (sas_dev->port_type > 1) ? + *qd = (sas_dev->port_connection > 1) ? adapter->adapter_attr.wideport_max_queue_depth : adapter->adapter_attr.narrowport_max_queue_depth; *is_target_ssp = true; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SEP) - sdev_priv->sep = true; + sdev_priv->sep = 1; } else { *qd = adapter->adapter_attr.sata_max_queue_depth; } sdev_printk(KERN_INFO, sdev, - "sdev: dev name=0x%016llx, sas addr=0x%016llx\n", + "device name=0x%016llx, SAS addr=0x%016llx\n", (unsigned long long)sas_dev->dev_name, (unsigned long long)sas_dev->sas_addr); leapraid_sdev_put(sas_dev); @@ -1354,7 +1348,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) { if (leapraid_cfg_get_volume_hdl(adapter, hdl, &vol_hdl)) { sdev_printk(KERN_WARNING, sdev, - "%s: get volume hdl failed, hdl=0x%x\n", + "%s: Get volume hdl failed, hdl=0x%x\n", __func__, hdl); return 1; } @@ -1362,7 +1356,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (vol_hdl && leapraid_cfg_get_volume_wwid(adapter, vol_hdl, &volume_wwid)) { sdev_printk(KERN_WARNING, sdev, - "%s: get wwid failed, volume_hdl=0x%x\n", + "%s: Get wwid failed, volume_hdl=0x%x\n", __func__, vol_hdl); return 1; } @@ -1375,7 +1369,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) return 1; } - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); if (is_target_ssp) sas_read_port_mode_page(sdev); @@ -1422,17 +1416,19 @@ static int leapraid_target_alloc_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + starget_priv = tgt->hostdata; raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); starget_priv->hdl = raid_volume->hdl; starget_priv->sas_address = raid_volume->wwid; starget_priv->flg |= LEAPRAID_TGT_FLG_VOLUME; raid_volume->starget = tgt; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return 0; } @@ -1447,12 +1443,13 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; + starget_priv = tgt->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); rphy = dev_to_rphy(tgt->dev.parent); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, - rphy->identify.sas_address, - rphy); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, + rphy->identify.sas_address, + rphy); if (sas_dev) { starget_priv->sas_dev = sas_dev; starget_priv->card_port = sas_dev->card_port; @@ -1461,8 +1458,10 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) sas_dev->channel = tgt->channel; sas_dev->id = tgt->id; sas_dev->starget = tgt; - if (test_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pd_hdls)) + if (sas_dev->hdl && + sas_dev->hdl <= + adapter->adapter_attr.features.max_dev_handle && + test_bit(sas_dev->hdl, adapter->dev_topo.pd_hdls)) starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1494,14 +1493,16 @@ static void leapraid_target_destroy_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume->starget = NULL; raid_volume->sdev = NULL; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } static void leapraid_target_destroy_sas(struct scsi_target *tgt) @@ -1543,12 +1544,12 @@ static void leapraid_target_destroy(struct scsi_target *tgt) if (tgt->channel == RAID_CHANNEL) { leapraid_target_destroy_raid(tgt); - goto out; + goto out_free; } leapraid_target_destroy_sas(tgt); -out: +out_free: kfree(starget_priv); tgt->hostdata = NULL; } @@ -1569,24 +1570,27 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) { dev_err(&adapter->pdev->dev, - "device scan: aborted due to reset\n"); + "Device scan: Aborted due to reset\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return true; } if (adapter->scan_dev_desc.scan_start_failed) { dev_err(&adapter->pdev->dev, - "device scan: failed with adapter_status=0x%08x\n", + "Device scan: Failed with adapter_status=0x%08x\n", adapter->scan_dev_desc.scan_start_failed); - adapter->scan_dev_desc.driver_loading = false; - adapter->scan_dev_desc.wait_scan_dev_done = false; - adapter->access_ctrl.host_removing = true; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "device scan: SUCCESS\n"); + dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1601,8 +1605,9 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_err(&adapter->pdev->dev, - "device scan: failed with timeout 300s\n"); - adapter->scan_dev_desc.driver_loading = false; + "Device scan: Failed with timeout 300s\n"); + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return 1; } @@ -1612,10 +1617,12 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) if (need_hard_reset) { adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - if (leapraid_hard_reset_handler(adapter, PART_RESET)) - adapter->scan_dev_desc.driver_loading = false; + if (leapraid_hard_reset_handler(adapter, PART_RESET)) { + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + } } return 1; @@ -1625,18 +1632,88 @@ static void leapraid_scan_start(struct Scsi_Host *shost) { struct leapraid_adapter *adapter = shost_priv(shost); - adapter->scan_dev_desc.scan_start = true; + adapter->scan_dev_desc.scan_start = 1; leapraid_scan_dev(adapter, true); } +static u32 leapraid_get_raid_qd(struct leapraid_adapter *adapter, + const struct leapraid_raid_volume *raid_volume, + bool default_qd) +{ + const struct leapraid_adapter_attr *attr = &adapter->adapter_attr; + + if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) + return default_qd ? LEAPRAID_RAID_QUEUE_DEPTH : + attr->raid_volume_max_queue_depth; + + if (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) + return default_qd ? LEAPRAID_SAS_QUEUE_DEPTH : + attr->narrowport_max_queue_depth; + + return default_qd ? LEAPRAID_SATA_QUEUE_DEPTH : + attr->sata_max_queue_depth; +} + static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) { struct Scsi_Host *shost; + struct leapraid_adapter *adapter; + struct leapraid_starget_priv *starget_priv; + struct leapraid_sdev_priv *sdev_priv; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; int max_depth; + u32 default_qdepth = 0; + u32 fw_qdepth = 0; shost = sdev->host; + adapter = shost_priv(shost); max_depth = shost->can_queue; + sdev_priv = sdev->hostdata; + if (!sdev_priv) + goto out_tag_check; + + starget_priv = sdev_priv->starget_priv; + if (!starget_priv) + goto out_tag_check; + + if (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + raid_volume = leapraid_raid_volume_find_by_hdl( + adapter, starget_priv->hdl); + if (raid_volume) { + default_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, true); + fw_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, false); + leapraid_raid_volume_put(raid_volume); + } + goto out_limit_check; + } + + sas_dev = leapraid_get_sas_dev_from_tgt(adapter, starget_priv); + if (sas_dev) { + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { + default_qdepth = LEAPRAID_SAS_QUEUE_DEPTH; + fw_qdepth = (sas_dev->port_connection > 1) ? + adapter->adapter_attr.wideport_max_queue_depth : + adapter->adapter_attr.narrowport_max_queue_depth; + } + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) { + default_qdepth = LEAPRAID_SATA_QUEUE_DEPTH; + fw_qdepth = adapter->adapter_attr.sata_max_queue_depth; + } + leapraid_sdev_put(sas_dev); + } + +out_limit_check: + if (fw_qdepth > shost->can_queue && default_qdepth) + fw_qdepth = default_qdepth; + + if (fw_qdepth) + max_depth = min_t(int, max_depth, fw_qdepth); + +out_tag_check: if (!sdev->tagged_supported) max_depth = 1; @@ -1646,18 +1723,13 @@ static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) return qdepth; } -static int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) { qdepth = leapraid_calc_max_queue_depth(sdev, qdepth); scsi_change_queue_depth(sdev, qdepth); return sdev->queue_depth; } -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth) -{ - leapraid_change_queue_depth(sdev, qdepth); -} - static void leapraid_map_queues(struct Scsi_Host *shost) { struct leapraid_adapter *adapter; @@ -1669,7 +1741,7 @@ static void leapraid_map_queues(struct Scsi_Host *shost) adapter = (struct leapraid_adapter *)shost->hostdata; if (shost->nr_hw_queues == 1) - goto out; + return; msix_queue_count = adapter->notification_desc.iopoll_qdex; poll_queue_count = adapter->adapter_attr.rq_cnt - msix_queue_count; @@ -1683,7 +1755,7 @@ static void leapraid_map_queues(struct Scsi_Host *shost) case HCTX_TYPE_DEFAULT: queue_map->nr_queues = msix_queue_count; queue_map->queue_offset = queue_offset; - BUG_ON(!queue_map->nr_queues); + WARN_ON_ONCE(!queue_map->nr_queues); blk_mq_pci_map_queues(queue_map, adapter->pdev, 0); break; case HCTX_TYPE_POLL: @@ -1698,9 +1770,6 @@ static void leapraid_map_queues(struct Scsi_Host *shost) } queue_offset += queue_map->nr_queues; } - -out: - return; } int leapraid_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num) @@ -1711,13 +1780,13 @@ int leapraid_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num) int num_entries; int qid = queue_num - adapter->notification_desc.iopoll_qdex; - if (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause) || - !atomic_add_unless(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy, 1, 1)) + blk_mq_poll_rq = &adapter->notification_desc.blk_mq_poll_rqs[qid]; + if (atomic_read(&blk_mq_poll_rq->pause) || + !atomic_add_unless(&blk_mq_poll_rq->busy, 1, 1)) return 0; - blk_mq_poll_rq = &adapter->notification_desc.blk_mq_poll_rqs[qid]; num_entries = leapraid_rep_queue_handler(&blk_mq_poll_rq->rq); - atomic_dec(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy); + atomic_dec(&blk_mq_poll_rq->busy); return num_entries; } @@ -1725,8 +1794,8 @@ static int leapraid_bios_param(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[]) { - int heads = 0; - int sectors = 0; + int heads; + int sectors; sector_t cylinders; if (scsi_partsize(bdev, capacity, geom)) @@ -1770,12 +1839,23 @@ static ssize_t host_sas_address_show(struct device *cdev, (unsigned long long)adapter->dev_topo.card.sas_address); } +static ssize_t board_name_show(struct device *cdev, + struct device_attribute *attr, char *buf) +{ + struct Scsi_Host *shost = class_to_shost(cdev); + struct leapraid_adapter *adapter = shost_priv(shost); + + return sysfs_emit(buf, "%s\n", adapter->adapter_attr.board_name); +} + static DEVICE_ATTR_RO(fw_queue_depth); static DEVICE_ATTR_RO(host_sas_address); +static DEVICE_ATTR_RO(board_name); static struct attribute *leapraid_shost_attrs[] = { &dev_attr_fw_queue_depth.attr, &dev_attr_host_sas_address.attr, + &dev_attr_board_name.attr, NULL, }; @@ -1786,9 +1866,17 @@ static ssize_t sas_address_show(struct device *dev, { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + u64 sas_address; - return sysfs_emit(buf, "0x%016llx\n", - (unsigned long long)sas_device_priv_data->starget_priv->sas_address); + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + + sas_address = sas_device_priv_data->starget_priv->sas_address; + + return sysfs_emit(buf, "0x%016llx\n", (unsigned long long)sas_address); } static ssize_t sas_device_handle_show(struct device *dev, @@ -1797,6 +1885,12 @@ static ssize_t sas_device_handle_show(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + return sysfs_emit(buf, "0x%04x\n", sas_device_priv_data->starget_priv->hdl); } @@ -1807,6 +1901,12 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } + return sysfs_emit(buf, "%d\n", sas_device_priv_data->ncq); } @@ -1817,17 +1917,30 @@ static ssize_t sas_ncq_store(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; struct scsi_vpd *vpd_pg89; - int ncq_op = 0; - bool ncq_supported = false; + int ncq_op; + bool ncq_supported; + + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } if (kstrtoint(buf, 0, &ncq_op)) - goto out; + return -EINVAL; + + if (ncq_op != 0 && ncq_op != 1) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid NCQ value %d (only 0/1 allowed)\n", + __func__, ncq_op); + return -EINVAL; + } rcu_read_lock(); vpd_pg89 = rcu_dereference(sdev->vpd_pg89); if (!vpd_pg89 || vpd_pg89->len < LEAPRAID_VPD_PG89_MIN_LEN) { rcu_read_unlock(); - goto out; + return -EINVAL; } ncq_supported = (vpd_pg89->data[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> @@ -1836,9 +1949,7 @@ static ssize_t sas_ncq_store(struct device *dev, rcu_read_unlock(); if (ncq_supported) sas_device_priv_data->ncq = ncq_op; - return strlen(buf); -out: - return -EINVAL; + return count; } static DEVICE_ATTR_RO(sas_address); @@ -1881,7 +1992,7 @@ static struct scsi_host_template leapraid_driver_template = { .can_queue = LEAPRAID_CAN_QUEUE_MIN, .this_id = LEAPRAID_THIS_ID_NONE, .sg_tablesize = LEAPRAID_SG_DEPTH, - .max_sectors = LEAPRAID_DEF_MAX_SECTORS, + .max_sectors = LEAPRAID_MAX_SECTORS, .max_segment_size = LEAPRAID_MAX_SEGMENT_SIZE, .cmd_per_lun = LEAPRAID_CMD_PER_LUN, .shost_groups = leapraid_shost_groups, @@ -1901,6 +2012,8 @@ static void leapraid_lock_init(struct leapraid_adapter *adapter) spin_lock_init(&adapter->dev_topo.topo_node_lock); spin_lock_init(&adapter->fw_evt_s.fw_evt_lock); spin_lock_init(&adapter->dev_topo.raid_volume_lock); + spin_lock_init(&adapter->dev_topo.enc_lock); + spin_lock_init(&adapter->boot_devs.lock); } static void leapraid_list_init(struct leapraid_adapter *adapter) @@ -1917,19 +2030,24 @@ static void leapraid_list_init(struct leapraid_adapter *adapter) static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) { - struct leapraid_adapter *adapter = NULL; - struct Scsi_Host *shost = NULL; - int iopoll_q_count = 0; + struct leapraid_adapter *adapter; + struct Scsi_Host *shost; + int iopoll_q_count; int rc; shost = scsi_host_alloc(&leapraid_driver_template, sizeof(struct leapraid_adapter)); - if (!shost) + if (!shost) { + dev_err(&pdev->dev, + "%s: SCSI host alloc failed\n", __func__); return -ENODEV; + } adapter = shost_priv(shost); memset(adapter, 0, sizeof(struct leapraid_adapter)); - adapter->adapter_attr.id = leapraid_ids++; + + init_waitqueue_head(&adapter->access_ctrl.recovery_waitq); + adapter->adapter_attr.id = atomic_inc_return(&leapraid_ids) - 1; adapter->adapter_attr.enable_mp = enable_mp; @@ -1944,8 +2062,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; leapraid_lock_init(adapter); leapraid_list_init(adapter); - sprintf(adapter->adapter_attr.name, "%s%d", - LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); + snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", + LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); shost->max_cmd_len = LEAPRAID_MAX_CDB_LEN; shost->max_lun = LEAPRAID_MAX_LUNS; @@ -1959,13 +2077,18 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_evt_s.fw_evt_thread = alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); if (!adapter->fw_evt_s.fw_evt_thread) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create fw event workqueue\n", __func__); rc = -ENODEV; goto evt_wq_fail; } shost->host_tagset = 1; - adapter->scan_dev_desc.driver_loading = true; - if ((leapraid_ctrl_init(adapter))) { + init_waitqueue_head(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.driver_loading = 1; + if (leapraid_ctrl_init(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: Adapter init failed\n", __func__); rc = -ENODEV; goto ctrl_init_fail; } @@ -1977,15 +2100,14 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->notification_desc.iopoll_qdex; shost->nr_maps = iopoll_q_count ? 3 : 1; dev_info(&adapter->pdev->dev, - "max scsi io cmds %d shared with nr_hw_queues=%d\n", + "Max scsi I/O cmds %d shared with nr_hw_queues=%d\n", shost->can_queue, shost->nr_hw_queues); } rc = scsi_add_host(shost, &pdev->dev); if (rc) { - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); + dev_err(&pdev->dev, + "%s: SCSI host add failed\n", __func__); goto scsi_add_shost_fail; } @@ -1995,6 +2117,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) scsi_add_shost_fail: leapraid_remove_ctrl(adapter); ctrl_init_fail: + leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: spin_lock(&leapraid_adapter_lock); @@ -2004,7 +2127,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) return rc; } -static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) +void leapraid_cleanup_lists(struct leapraid_adapter *adapter) { struct leapraid_raid_volume *raid_volume, *next_raid_volume; struct leapraid_starget_priv *starget_priv_data; @@ -2016,12 +2139,14 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) &adapter->dev_topo.raid_volume_list, list) { if (raid_volume->starget) { starget_priv_data = raid_volume->starget->hostdata; - starget_priv_data->deleted = true; + if (starget_priv_data) + starget_priv_data->deleted = 1; scsi_remove_target(&raid_volume->starget->dev); } - pr_info("removing hdl=0x%04x, wwid=0x%016llx\n", - raid_volume->hdl, - (unsigned long long)raid_volume->wwid); + dev_info(&adapter->pdev->dev, + "removing hdl=0x%04x, wwid=0x%016llx\n", + raid_volume->hdl, + (unsigned long long)raid_volume->wwid); leapraid_raid_volume_remove(adapter, raid_volume); } @@ -2030,16 +2155,18 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) port_list) { if (leapraid_port->remote_identify.device_type == SAS_END_DEVICE) - leapraid_sas_dev_remove_by_sas_address(adapter, + leapraid_sas_dev_remove_by_sas_address( + adapter, leapraid_port->remote_identify.sas_address, leapraid_port->card_port); else if (leapraid_port->remote_identify.device_type == SAS_EDGE_EXPANDER_DEVICE || leapraid_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) - leapraid_exp_rm(adapter, - leapraid_port->remote_identify.sas_address, - leapraid_port->card_port); + leapraid_exp_rm( + adapter, + leapraid_port->remote_identify.sas_address, + leapraid_port->card_port); } list_for_each_entry_safe(port, port_next, @@ -2064,27 +2191,26 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) static void leapraid_remove(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to remove!\n"); + dev_err(&pdev->dev, "Unable to remove!\n"); return; } - while (adapter->scan_dev_desc.driver_loading) - ssleep(1); - - while (adapter->access_ctrl.shost_recovering) - ssleep(1); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !adapter->scan_dev_desc.driver_loading); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !atomic_read(&adapter->overheat_desc.thermal_alert)); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_smart_polling_stop(adapter); - leapraid_free_internal_scsi_cmd(adapter); if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); @@ -2099,7 +2225,6 @@ static void leapraid_remove(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); @@ -2112,18 +2237,20 @@ static void leapraid_remove(struct pci_dev *pdev) static void leapraid_shutdown(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to shutdown!\n"); + dev_err(&pdev->dev, "Unable to shutdown!\n"); return; } - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); + leapraid_overheat_cleanup(adapter); leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; @@ -2132,7 +2259,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); leapraid_disable_controller(adapter); } @@ -2140,29 +2266,31 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to error detected for device\n"); + dev_err(&pdev->dev, "Failed to error detected for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - pr_err("%s: pci error detected, state=%d\n", - adapter->adapter_attr.name, state); + dev_err(&pdev->dev, "%s: PCI error detected, state=%d\n", + adapter->adapter_attr.name, state); switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; case pci_channel_io_frozen: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); @@ -2177,15 +2305,15 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to enable mmio for device\n"); + "Failed to enable mmio for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_info(&pdev->dev, "%s: pci error mmio enabled\n", + dev_info(&pdev->dev, "%s: PCI error mmio enabled\n", adapter->adapter_attr.name); return PCI_ERS_RESULT_RECOVERED; @@ -2194,43 +2322,47 @@ static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to slot reset for device\n"); + "Failed to slot reset for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_err(&pdev->dev, "%s pci error slot reset\n", + dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = false; + adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); - if (leapraid_set_pcie_and_notification(adapter)) + if (leapraid_set_pcie_and_notification(adapter)) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return PCI_ERS_RESULT_DISCONNECT; + } - dev_info(&pdev->dev, "%s: hard reset triggered by pci slot reset\n", + dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, (rc == 0) ? "success" : "failed"); + adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); - return (rc == 0) ? PCI_ERS_RESULT_RECOVERED : + return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; } static void leapraid_pci_resume(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct leapraid_adapter *adapter = pdev_to_adapter(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to resume\n"); + dev_err(&pdev->dev, "Failed to resume\n"); return; } @@ -2254,23 +2386,23 @@ static struct pci_error_handlers leapraid_err_handler = { static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state; if (!shost || !adapter) { dev_err(&pdev->dev, - "suspend failed, invalid host or adapter\n"); + "Suspend failed, invalid host or adapter\n"); return -ENXIO; } + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); scsi_block_requests(shost); device_state = pci_choose_state(pdev, state); - leapraid_ir_shutdown(adapter); - dev_info(&pdev->dev, "entering PCI power state D%d, (slot=%s)\n", + dev_info(&pdev->dev, "Entering PCI power state D%d, (slot=%s)\n", device_state, pci_name(pdev)); pci_save_state(pdev); @@ -2282,18 +2414,18 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) static int leapraid_resume(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state = pdev->current_state; int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "resume failed, invalid host or adapter\n"); + "Resume failed, invalid host or adapter\n"); return -ENXIO; } dev_info(&pdev->dev, - "resuming device %s, previous state D%d\n", + "Resuming device %s, previous state D%d\n", pci_name(pdev), device_state); pci_set_power_state(pdev, PCI_D0); @@ -2301,12 +2433,22 @@ static int leapraid_resume(struct pci_dev *pdev) pci_restore_state(pdev); adapter->pdev = pdev; rc = leapraid_set_pcie_and_notification(adapter); - if (rc) + if (rc) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return rc; + } - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, PART_RESET); + rc = leapraid_hard_reset_handler(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed during resume, rc=%d\n", + __func__, rc); + return rc; + } scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); @@ -2332,29 +2474,37 @@ static int __init leapraid_init(void) { int error; - pr_info("%s version %s loaded\n", LEAPRAID_DRIVER_NAME, - LEAPRAID_DRIVER_VERSION); + pr_info("%s initializing\n", LEAPRAID_DRIVER_NAME); leapraid_transport_template = sas_attach_transport(&leapraid_transport_functions); - if (!leapraid_transport_template) + if (!leapraid_transport_template) { + pr_err("%s: Failed to attach SAS transport\n", + LEAPRAID_DRIVER_NAME); return -ENODEV; - - leapraid_ids = 0; - - leapraid_ctl_init(); + } error = pci_register_driver(&leapraid_driver); - if (error) + if (error) { + pr_err("%s: PCI driver registration failed: %d\n", + LEAPRAID_DRIVER_NAME, error); + sas_release_transport(leapraid_transport_template); + return error; + } + + error = leapraid_ctl_init(); + if (error) { + pci_unregister_driver(&leapraid_driver); sas_release_transport(leapraid_transport_template); + return error; + } - return error; + return 0; } static void __exit leapraid_exit(void) { - pr_info("leapraid version %s unloading\n", - LEAPRAID_DRIVER_VERSION); + pr_info("%s exiting\n", LEAPRAID_DRIVER_NAME); leapraid_ctl_exit(); pci_unregister_driver(&leapraid_driver); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index d224449732a3..738bc55df416 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <scsi/scsi_host.h> #include "leapraid_func.h" @@ -16,10 +15,8 @@ static struct leapraid_topo_node *leapraid_transport_topo_node_by_sas_addr( { if (adapter->dev_topo.card.sas_address == sas_addr) return &adapter->dev_topo.card; - else - return leapraid_exp_find_by_sas_address(adapter, - sas_addr, - card_port); + + return leapraid_exp_find_by_sas_address(adapter, sas_addr, card_port); } static u8 leapraid_get_port_id_by_expander(struct leapraid_adapter *adapter, @@ -49,7 +46,8 @@ static u8 leapraid_get_port_id_by_end_dev(struct leapraid_adapter *adapter, u8 port_id = 0xFF; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, rphy->identify.sas_address, rphy); if (sas_dev) { @@ -131,10 +129,9 @@ static enum sas_linkrate leapraid_transport_convert_phy_link_rate(u8 link_rate) }, }; - for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) { + for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) if (linkrate_table[i].in == link_rate) return linkrate_table[i].out; - } return SAS_LINK_RATE_UNKNOWN; } @@ -192,7 +189,7 @@ static void leapraid_set_identify_protocol_flags(u32 dev_info, }; for (i = 0; i < ARRAY_SIZE(mappings); i++) - if ((dev_info & mappings[i].mask) && mappings[i].target) + if (dev_info & mappings[i].mask && mappings[i].target) *mappings[i].target |= mappings[i].protocol; } @@ -207,13 +204,19 @@ static int leapraid_transport_set_identify(struct leapraid_adapter *adapter, if ((adapter->access_ctrl.shost_recovering && !adapter->scan_dev_desc.driver_loading) || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; + } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; memset(identify, 0, sizeof(struct sas_identify)); @@ -248,27 +251,34 @@ static void leapraid_transport_exp_set_edev(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; struct leapraid_rep_manu_reply *rep_manu_reply; u8 *component_id; - ssize_t __maybe_unused ret; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; if (le16_to_cpu(smp_passthrough_rep->resp_data_len) != sizeof(struct leapraid_rep_manu_reply)) return; rep_manu_reply = data_out + sizeof(struct leapraid_rep_manu_request); - ret = strscpy(edev->vendor_id, rep_manu_reply->vendor_identification, - SAS_EXPANDER_VENDOR_ID_LEN); - ret = strscpy(edev->product_id, rep_manu_reply->product_identification, - SAS_EXPANDER_PRODUCT_ID_LEN); - ret = strscpy(edev->product_rev, - rep_manu_reply->product_revision_level, - SAS_EXPANDER_PRODUCT_REV_LEN); + + memcpy(edev->vendor_id, rep_manu_reply->vendor_identification, + SAS_EXPANDER_VENDOR_ID_LEN); + edev->vendor_id[SAS_EXPANDER_VENDOR_ID_LEN] = '\0'; + + memcpy(edev->product_id, rep_manu_reply->product_identification, + SAS_EXPANDER_PRODUCT_ID_LEN); + edev->product_id[SAS_EXPANDER_PRODUCT_ID_LEN] = '\0'; + + memcpy(edev->product_rev, rep_manu_reply->product_revision_level, + SAS_EXPANDER_PRODUCT_REV_LEN); + edev->product_rev[SAS_EXPANDER_PRODUCT_REV_LEN] = '\0'; + edev->level = rep_manu_reply->sas_format & 1; if (edev->level) { - ret = strscpy(edev->component_vendor_id, - rep_manu_reply->component_vendor_identification, - SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + memcpy(edev->component_vendor_id, + rep_manu_reply->comp_vendor_identification, + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + edev->component_vendor_id[ + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN] = '\0'; component_id = (u8 *)&rep_manu_reply->component_id; edev->component_id = component_id[0] << 8 | component_id[1]; @@ -291,18 +301,24 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, size_t c2h_size; size_t h2c_size; void *psge; - int rc = 0; + int rc; if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; } mutex_lock(&adapter->driver_cmds.transport_cmd.mutex); adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto out_cleanup; h2c_size = sizeof(struct leapraid_rep_manu_request); c2h_size = sizeof(struct leapraid_rep_manu_reply); @@ -312,7 +328,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, GFP_ATOMIC); if (!data_out) { rc = -ENOMEM; - goto out; + goto out_cleanup; } rep_manu_request = data_out; @@ -323,8 +339,9 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->request_length = 0; smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.transport_cmd.inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -342,11 +359,13 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { + rc = -ETIMEDOUT; dev_err(&adapter->pdev->dev, - "%s: smp passthrough to exp timeout\n", - __func__); + "%s: SMP passthrough timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & - LEAPRAID_CMD_RESET)) + LEAPRAID_CMD_RESET)) issue_reset = true; goto hard_reset; @@ -358,11 +377,11 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, hard_reset: if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); + rc = leapraid_hard_reset_handler(adapter, FULL_RESET); } -out: +out_cleanup: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; if (data_out) dma_free_coherent(&adapter->pdev->dev, h2c_size + c2h_size, @@ -376,13 +395,14 @@ static void leapraid_transport_del_port(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { dev_info(&sas_port->port->dev, - "remove port: sas addr=0x%016llx\n", + "Remove port: SAS addr=0x%016llx\n", (unsigned long long)sas_port->remote_identify.sas_address); switch (sas_port->remote_identify.device_type) { case SAS_END_DEVICE: - leapraid_sas_dev_remove_by_sas_address(adapter, - sas_port->remote_identify.sas_address, - sas_port->card_port); + leapraid_sas_dev_remove_by_sas_address( + adapter, + sas_port->remote_identify.sas_address, + sas_port->card_port); break; case SAS_EDGE_EXPANDER_DEVICE: case SAS_FANOUT_EXPANDER_DEVICE: @@ -399,13 +419,13 @@ static void leapraid_transport_del_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "remove phy: sas addr=0x%016llx, phy=%d\n", + "Remove PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_del(&card_phy->port_siblings); sas_port->phys_num--; sas_port_delete_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; } static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, @@ -413,16 +433,17 @@ static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "add phy: sas addr=0x%016llx, phy=%d\n", + "Add PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_add_tail(&card_phy->port_siblings, &sas_port->phy_list); sas_port->phys_num++; sas_port_add_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; } -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *card_phy, u64 sas_address, @@ -454,7 +475,8 @@ void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, } } -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *target_card_phy) { @@ -482,7 +504,8 @@ void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, } } -static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, +static void leapraid_detach_phy_from_old_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, u64 sas_address, struct leapraid_card_port *card_port) @@ -495,9 +518,10 @@ static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, topo_node->card_phy[i].card_port != card_port) continue; if (topo_node->card_phy[i].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, - topo_node, - &topo_node->card_phy[i]); + leapraid_transport_detach_phy_to_port( + adapter, + topo_node, + &topo_node->card_phy[i]); } } @@ -512,8 +536,11 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( unsigned long flags; sas_port = kzalloc(sizeof(*sas_port), GFP_KERNEL); - if (!sas_port) + if (!sas_port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed alloc sas_port\n", __func__); return NULL; + } INIT_LIST_HEAD(&sas_port->port_list); INIT_LIST_HEAD(&sas_port->phy_list); @@ -526,27 +553,30 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( if (!topo_node) { dev_err(&adapter->pdev->dev, - "%s: failed to find parent node for sas addr 0x%016llx!\n", + "%s: Failed to locate parent for SAS 0x%016llx!\n", __func__, sas_address); - kfree(sas_port); - return NULL; + goto out_cleanup; } if (leapraid_transport_set_identify(adapter, handle, - &sas_port->remote_identify)) { - kfree(sas_port); - return NULL; - } + &sas_port->remote_identify)) + goto out_cleanup; if (sas_port->remote_identify.device_type == SAS_PHY_UNUSED) { - kfree(sas_port); - return NULL; + dev_warn(&adapter->pdev->dev, + "%s: Failed, device type is SAS_PHY_UNUSED\n", + __func__); + goto out_cleanup; } sas_port->card_port = card_port; *out_topo_node = topo_node; return sas_port; + +out_cleanup: + kfree(sas_port); + return NULL; } static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, @@ -576,12 +606,12 @@ static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, vphy = leapraid_get_vphy_by_phy(card_port, i); if (!vphy) - return -1; + return LEAPRAID_OPERATION_FAILED; } } *out_vphy = vphy; - return sas_port->phys_num ? 0 : -1; + return sas_port->phys_num ? 0 : LEAPRAID_OPERATION_FAILED; } static struct sas_rphy *leapraid_create_and_register_rphy( @@ -596,26 +626,42 @@ static struct sas_rphy *leapraid_create_and_register_rphy( struct sas_port *port; struct sas_rphy *rphy; - if (!topo_node->parent_dev) - return NULL; + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sas_port->remote_identify.sas_address, + card_port); + if (!sas_dev) + return NULL; + sas_dev->pend_sas_rphy_add = 1; + } + + if (!topo_node->parent_dev) { + dev_warn(&adapter->pdev->dev, + "%s: topo_node parent device is NULL\n", __func__); + goto cleanup_sas_dev; + } port = sas_port_alloc_num(topo_node->parent_dev); - if (sas_port_add(port)) - return NULL; + if (!port) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate SAS port\n", __func__); + goto cleanup_sas_dev; + } + + if (sas_port_add(port)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to add SAS port\n", __func__); + goto out_delete_port; + } list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { sas_port_add_phy(port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; card_phy->card_port = card_port; } - if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sas_port->remote_identify.sas_address, - card_port); - if (!sas_dev) - return NULL; - sas_dev->pend_sas_rphy_add = 1; + if (sas_dev) { rphy = sas_end_device_alloc(port); sas_dev->rphy = rphy; @@ -625,28 +671,63 @@ static struct sas_rphy *leapraid_create_and_register_rphy( else vphy->sas_address = sas_dev->sas_addr; } - } else { - rphy = sas_expander_alloc(port, - sas_port->remote_identify.device_type); + rphy = sas_expander_alloc( + port, + sas_port->remote_identify.device_type); if (topo_node->hdl <= adapter->dev_topo.card.phys_num) card_port->sas_address = sas_port->remote_identify.sas_address; } + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate RPHY\n", __func__); + goto cleanup_card_phy; + } + rphy->identify = sas_port->remote_identify; - if (sas_rphy_add(rphy)) + if (sas_rphy_add(rphy)) { dev_err(&adapter->pdev->dev, - "%s: failed to add rphy\n", __func__); + "%s: Failed to add RPHY\n", __func__); + if (sas_dev) + sas_dev->rphy = NULL; + + sas_rphy_free(rphy); + goto cleanup_card_phy; + } + sas_port->port = port; if (sas_dev) { sas_dev->pend_sas_rphy_add = 0; leapraid_sdev_put(sas_dev); } - sas_port->port = port; return rphy; + +cleanup_card_phy: + if (topo_node->hdl <= adapter->dev_topo.card.phys_num) { + if (!vphy) + card_port->sas_address = 0; + else + vphy->sas_address = 0; + } + + list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { + card_phy->phy_is_assigned = 0; + card_phy->card_port = NULL; + } + +out_delete_port: + sas_port_delete(port); + +cleanup_sas_dev: + if (sas_dev) { + sas_dev->pend_sas_rphy_add = 0; + leapraid_sdev_put(sas_dev); + } + return NULL; } struct leapraid_sas_port *leapraid_transport_port_add( @@ -656,35 +737,45 @@ struct leapraid_sas_port *leapraid_transport_port_add( { struct leapraid_card_phy *card_phy, *card_phy_next; struct leapraid_topo_node *topo_node = NULL; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_vphy *vphy = NULL; - struct sas_rphy *rphy = NULL; + struct sas_rphy *rphy; unsigned long flags; - if (!card_port) + if (!card_port) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid card_port\n", __func__); return NULL; + } sas_port = leapraid_prepare_sas_port(adapter, hdl, sas_address, card_port, &topo_node); if (!sas_port) return NULL; - leapraid_detach_phy_from_old_port(adapter, - topo_node, - sas_port->remote_identify.sas_address, - card_port); + leapraid_detach_phy_from_old_port( + adapter, + topo_node, + sas_port->remote_identify.sas_address, + card_port); if (leapraid_bind_phys_and_vphy(adapter, sas_port, topo_node, - card_port, &vphy)) + card_port, &vphy)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to bind phy to vphy\n", __func__); goto out_fail; + } rphy = leapraid_create_and_register_rphy(adapter, sas_port, topo_node, card_port, vphy); - if (!rphy) + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create rphy\n", __func__); goto out_fail; + } dev_info(&rphy->dev, - "%s: added dev: hdl=0x%04x, sas addr=0x%016llx\n", + "%s: Added dev: hdl=0x%04x, SAS addr=0x%016llx\n", __func__, hdl, (unsigned long long)sas_port->remote_identify.sas_address); @@ -695,20 +786,27 @@ struct leapraid_sas_port *leapraid_transport_port_add( spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); if (sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_EDGE_EXPANDER || + SAS_EDGE_EXPANDER_DEVICE || sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_FANOUT_EXPANDER) - leapraid_transport_exp_report_manu(adapter, - sas_port->remote_identify.sas_address, - rphy_to_expander_device(rphy), - card_port->port_id); + SAS_FANOUT_EXPANDER_DEVICE) + leapraid_transport_exp_report_manu( + adapter, + sas_port->remote_identify.sas_address, + rphy_to_expander_device(rphy), + card_port->port_id); return sas_port; out_fail: list_for_each_entry_safe(card_phy, card_phy_next, - &sas_port->phy_list, port_siblings) - list_del(&card_phy->port_siblings); + &sas_port->phy_list, port_siblings) { + if (topo_node->hdl <= adapter->dev_topo.card.phys_num && + !card_phy->vphy) + card_port->phy_mask &= ~BIT(card_phy->phy_id); + + list_del_init(&card_phy->port_siblings); + } + kfree(sas_port); return NULL; } @@ -750,10 +848,10 @@ static void leapraid_cleanup_card_port_and_vphys( if (vphy->sas_address != sas_address) continue; - dev_info(&adapter->pdev->dev, - "%s: remove vphy: %p from port: %p, port_id=%d\n", - __func__, vphy, remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove vphy=%p from port=%p port_id=%d\n", + __func__, vphy, remove_card_port, + remove_card_port->port_id); remove_card_port->vphys_mask &= ~vphy->phy_mask; list_del(&vphy->list); @@ -762,11 +860,11 @@ static void leapraid_cleanup_card_port_and_vphys( if (!remove_card_port->vphys_mask && !remove_card_port->sas_address) { - dev_info(&adapter->pdev->dev, - "%s: remove empty hba_port: %p, port_id=%d\n", - __func__, - remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove empty hba_port: %p, port_id=%d\n", + __func__, + remove_card_port, + remove_card_port->port_id); list_del(&remove_card_port->list); kfree(remove_card_port); remove_card_port = NULL; @@ -782,15 +880,15 @@ static void leapraid_cleanup_card_port_and_vphys( continue; if (!remove_card_port->vphys_mask) { - dev_info(&adapter->pdev->dev, - "%s: remove hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove hba_port: %p, port_id=%d\n", + __func__, card_port, card_port->port_id); list_del(&card_port->list); kfree(card_port); } else { - dev_info(&adapter->pdev->dev, - "%s: clear sas_address of hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "Clear sas_address of port=%p, port_id=%d\n", + card_port, card_port->port_id); remove_card_port->sas_address = 0; } break; @@ -802,22 +900,23 @@ static void leapraid_clear_topo_node_phys(struct leapraid_topo_node *topo_node, { int i; - for (i = 0; i < topo_node->phys_num; i++) { + for (i = 0; i < topo_node->phys_num; i++) if (topo_node->card_phy[i].remote_identify.sas_address == sas_address) { memset(&topo_node->card_phy[i].remote_identify, 0, sizeof(struct sas_identify)); - topo_node->card_phy[i].vphy = false; + topo_node->card_phy[i].vphy = 0; } - } } -void leapraid_transport_port_remove(struct leapraid_adapter *adapter, - u64 sas_address, u64 sas_address_parent, +void leapraid_transport_port_remove( + struct leapraid_adapter *adapter, + u64 sas_address, + u64 sas_address_parent, struct leapraid_card_port *remove_card_port) { struct leapraid_card_phy *card_phy, *card_phy_next; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_topo_node *topo_node; unsigned long flags; bool found = false; @@ -855,7 +954,7 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, list_for_each_entry_safe(card_phy, card_phy_next, &sas_port->phy_list, port_siblings) { - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; if (!adapter->access_ctrl.host_removing) sas_port_delete_phy(sas_port->port, card_phy->phy); @@ -865,9 +964,9 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, if (!adapter->access_ctrl.host_removing) sas_port_delete(sas_port->port); - dev_info(&adapter->pdev->dev, - "%s: removed sas_port for sas addr=0x%016llx\n", - __func__, (unsigned long long)sas_address); + dev_dbg(&adapter->pdev->dev, + "%s: Removed sas_port for SAS addr=0x%016llx\n", + __func__, (unsigned long long)sas_address); kfree(sas_port); } @@ -902,9 +1001,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_HWRATE_MIN_RATE_MASK); phy->maximum_linkrate_hw = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->hw_link_rate >> 4) : + phy_pg0->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->hw_link_rate >> 4); + exp_pg1->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->minimum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( phy_pg0->p_link_rate & @@ -914,9 +1015,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_PRATE_MIN_RATE_MASK); phy->maximum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->p_link_rate >> 4) : + phy_pg0->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->p_link_rate >> 4); + exp_pg1->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->hostdata = card_phy->card_port; } @@ -926,30 +1029,33 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy handle identify failed!\n", __func__); + "%s: Set PHY handle identify failed!\n", __func__); sas_phy_free(phy); return; } card_phy->attached_hdl = le16_to_cpu(phy_pg0->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) { dev_err(&adapter->pdev->dev, - "%s set phy attached handle identify failed!\n", + "%s: Set PHY attached hdl identify failed!\n", __func__); sas_phy_free(phy); return; @@ -958,7 +1064,9 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, phy_pg0, NULL); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return; } @@ -972,38 +1080,41 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return -EFAULT; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy hdl identify failed!\n", __func__); + "%s: Set PHY hdl identify failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } card_phy->attached_hdl = le16_to_cpu(exp_pg1->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { - dev_err(&adapter->pdev->dev, - "%s set phy attached hdl identify failed!\n", - __func__); - sas_phy_free(phy); - } + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) + dev_warn(&adapter->pdev->dev, + "%s: Set PHY attached hdl identify failed!\n", + __func__); } leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, NULL, exp_pg1); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } @@ -1012,13 +1123,14 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, return 0; } -void leapraid_transport_update_links(struct leapraid_adapter *adapter, +void leapraid_transport_update_links( + struct leapraid_adapter *adapter, u64 sas_address, u16 hdl, u8 phy_index, u8 link_rate, struct leapraid_card_port *target_card_port) { struct leapraid_topo_node *topo_node; struct leapraid_card_phy *card_phy; - struct leapraid_card_port *card_port = NULL; + struct leapraid_card_port *card_port; unsigned long flags; if (adapter->access_ctrl.shost_recovering || @@ -1053,10 +1165,12 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, BIT(card_phy->phy_id); } } - leapraid_transport_attach_phy_to_port(adapter, topo_node, - card_phy, - card_phy->remote_identify.sas_address, - target_card_port); + leapraid_transport_attach_phy_to_port( + adapter, + topo_node, + card_phy, + card_phy->remote_identify.sas_address, + target_card_port); } else { memset(&card_phy->remote_identify, 0, sizeof(struct sas_identify)); @@ -1079,8 +1193,12 @@ static int leapraid_dma_map_buffer(struct device *dev, struct bsg_buffer *buf, *dma_len = buf->payload_len; } else { - if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) + if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) { + dev_err(dev, + "%s: Failed to map sg buffer for dma\n", + __func__); return -ENOMEM; + } *dma_addr = sg_dma_address(buf->sg_list); *dma_len = sg_dma_len(buf->sg_list); @@ -1106,11 +1224,11 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr, size_t c2h_size) { struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; void *psge; - smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(*smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -1130,30 +1248,36 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, - "%s: sending smp request\n", __func__); + const struct leapraid_smp_passthrough_req *smp_passthrough_req; + + dev_dbg(&adapter->pdev->dev, + "%s: Sending smp request\n", __func__); + smp_passthrough_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.transport_cmd.inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); leapraid_fire_task(adapter, adapter->driver_cmds.transport_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "%s: timeout\n", __func__); + dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { - dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", - __func__, __LINE__); + dev_dbg(&adapter->pdev->dev, + "%s:%d: call hard_reset\n", + __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); return -ETIMEDOUT; } } - dev_info(&adapter->pdev->dev, "%s: smp request complete\n", __func__); + dev_dbg(&adapter->pdev->dev, "%s: SMP request complete\n", __func__); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_REPLY_VALID)) { dev_err(&adapter->pdev->dev, - "%s: smp request no reply\n", __func__); + "%s: SMP request no reply\n", __func__); return -ENXIO; } @@ -1167,10 +1291,10 @@ static void leapraid_handle_smp_rep(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; - dev_info(&adapter->pdev->dev, "%s: response data len=%d\n", - __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); + dev_dbg(&adapter->pdev->dev, "%s: Response data len=%d\n", + __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); memcpy(job->reply, smp_passthrough_rep, sizeof(*smp_passthrough_rep)); job->reply_len = sizeof(*smp_passthrough_rep); @@ -1198,13 +1322,19 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); rc = -EFAULT; - goto done; + goto exit_bsg_job; } - rc = mutex_lock_interruptible(&adapter->driver_cmds.transport_cmd.mutex); + rc = mutex_lock_interruptible(&adapter->driver_cmds + .transport_cmd.mutex); if (rc) - goto done; + goto exit_bsg_job; adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; rc = leapraid_dma_map_buffer(&adapter->pdev->dev, @@ -1223,7 +1353,8 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) goto free_rep_buf; @@ -1245,7 +1376,7 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, release_lock: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.transport_cmd.mutex); -done: +exit_bsg_job: bsg_job_done(job, rc, reslen); } -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: leapraid: update driver to v2.0.1.2
by haodongdong 26 May '26

26 May '26

From: Dongdong Hao <doubled(a)leap-io-kernel.com> LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9234 ------------------------------------------ leapraid driver changes from v2.0.0.6 to v2.0.1.2. This update includes: - overheat handling rework - reset flow stabilization - improved timeout diagnostics - sysfs enhancement - topology and transport error-path fixes - memory leak/UAF/reference leak fixes - mmap/ioctl validation fixes - improved queue depth handling - improved interrupt and resource cleanup logic The update also fixes several race conditions and improves overall driver robustness under reset, topology change, and controller abnormal scenarios. Signed-off-by: Dongdong Hao <doubled(a)leap-io-kernel.com> --- drivers/scsi/leapraid/Kconfig | 2 +- drivers/scsi/leapraid/leapraid.h | 1335 +++--- drivers/scsi/leapraid/leapraid_app.c | 529 +-- drivers/scsi/leapraid/leapraid_func.c | 4237 ++++++++++++-------- drivers/scsi/leapraid/leapraid_func.h | 1086 ++--- drivers/scsi/leapraid/leapraid_os.c | 889 ++-- drivers/scsi/leapraid/leapraid_transport.c | 485 ++- 7 files changed, 4859 insertions(+), 3704 deletions(-) diff --git a/drivers/scsi/leapraid/Kconfig b/drivers/scsi/leapraid/Kconfig index b539183b24a7..f4ece78f80d3 100644 --- a/drivers/scsi/leapraid/Kconfig +++ b/drivers/scsi/leapraid/Kconfig @@ -5,7 +5,7 @@ config SCSI_LEAPRAID depends on PCI && SCSI select SCSI_SAS_ATTRS help - This driver supports LeapIO PCIe-based Storage + This driver supports LeapIO PCIe-based storage and RAID controllers. <http://www.leap-io.com> diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 77bb93b79254..2a99417143ad 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -1,13 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ #ifndef LEAPRAID_H #define LEAPRAID_H -/* doorbell register definitions */ +/* Doorbell register definitions. */ #define LEAPRAID_DB_RESET 0x00000000 #define LEAPRAID_DB_READY 0x10000000 #define LEAPRAID_DB_OPERATIONAL 0x20000000 @@ -22,55 +22,60 @@ #define LEAPRAID_DB_FUNC_SHIFT 24 #define LEAPRAID_DB_ADD_DWORDS_SHIFT 16 -/* maximum number of retries waiting for doorbell to become ready */ +/* Maximum number of retries waiting for doorbell to become ready. */ #define LEAPRAID_DB_RETRY_COUNT_MAX 10 -/* maximum number of retries waiting for doorbell to become operational */ -#define LEAPRAID_DB_WAIT_OPERATIONAL 10 -/* sleep interval (in seconds) between doorbell polls */ +/* Maximum number of retries waiting for doorbell to become operational. */ +#define LEAPRAID_DB_WAIT_OP_SHORT 10 +#define LEAPRAID_DB_WAIT_OP_LONG 200 +/* Sleep interval (in seconds) between doorbell polls. */ #define LEAPRAID_DB_POLL_INTERVAL_S 1 -/* maximum number of retries waiting for host to end recovery */ -#define LEAPRAID_WAIT_SHOST_RECOVERY 30 +/* Maximum number of retries waiting for host to end recovery. */ +#define LEAPRAID_WAIT_SHOST_RECOVERY 400 -/* diagnostic register definitions */ +/* Diagnostic register definitions. */ #define LEAPRAID_DIAG_WRITE_ENABLE 0x00000080 #define LEAPRAID_DIAG_RESET 0x00000004 -#define LEAPRAID_DIAG_HOLD_ADAPTER_RESET 0x00000002 -/* interrupt status register definitions */ +/* Interrupt status register definitions. */ #define LEAPRAID_HOST2ADAPTER_DB_STATUS 0x80000000 #define LEAPRAID_ADAPTER2HOST_DB_STATUS 0x00000001 -/* the number of debug register */ +/* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 +#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 -/* reply post host register defines */ +/* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 #define LEAPRAID_RPHI_MSIX_IDX_SHIFT 24 -/* vphy flags */ +/* Virtual PHY flags. */ #define LEAPRAID_SAS_PHYINFO_VPHY 0x00001000 -/* linux driver init fw */ +/* Linux driver init firmware. */ #define LEAPRAID_WHOINIT_LINUX_DRIVER 0x04 -/* rdpq array mode */ +/* Reply descriptor post queue array mode. */ #define LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE 0x01 -/* request description flags */ +/* Request description flags. */ #define LEAPRAID_REQ_DESC_FLG_SCSI_IO 0x00 #define LEAPRAID_REQ_DESC_FLG_HPR 0x06 #define LEAPRAID_REQ_DESC_FLG_DFLT_TYPE 0x08 -/* reply description flags */ +/* Reply description flags. */ #define LEAPRAID_RPY_DESC_FLG_TYPE_MASK 0x0F #define LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS 0x00 #define LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY 0x01 #define LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS 0x06 #define LEAPRAID_RPY_DESC_FLG_UNUSED 0x0F -/* MPI functions */ -#define LEAPRAID_FUNC_SCSIIO_REQ 0x00 +/* Request and reply messages share the same set of function codes. + * + * Note: SCSIIO (SCSI I/O) represents SCSI I/O operations and is used + * consistently throughout the driver for all SCSI command handling. + */ +#define LEAPRAID_FUNC_SCSIIO 0x00 #define LEAPRAID_FUNC_SCSI_TMF 0x01 #define LEAPRAID_FUNC_ADAPTER_INIT 0x02 #define LEAPRAID_FUNC_GET_ADAPTER_FEATURES 0x03 @@ -79,17 +84,16 @@ #define LEAPRAID_FUNC_EVENT_NOTIFY 0x07 #define LEAPRAID_FUNC_FW_DOWNLOAD 0x09 #define LEAPRAID_FUNC_FW_UPLOAD 0x12 -#define LEAPRAID_FUNC_RAID_ACTION 0x15 -#define LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH 0x16 +#define LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH 0x16 #define LEAPRAID_FUNC_SCSI_ENC_PROCESSOR 0x18 #define LEAPRAID_FUNC_SMP_PASSTHROUGH 0x1A #define LEAPRAID_FUNC_SAS_IO_UNIT_CTRL 0x1B -#define LEAPRAID_FUNC_SATA_PASSTHROUGH 0x1C +#define LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH 0x1C #define LEAPRAID_FUNC_ADAPTER_UNIT_RESET 0x40 #define LEAPRAID_FUNC_HANDSHAKE 0x42 #define LEAPRAID_FUNC_LOGBUF_INIT 0x57 -/* adapter status values */ +/* Adapter status values. */ #define LEAPRAID_ADAPTER_STATUS_MASK 0x7FFF #define LEAPRAID_ADAPTER_STATUS_SUCCESS 0x0000 #define LEAPRAID_ADAPTER_STATUS_BUSY 0x0002 @@ -113,7 +117,7 @@ #define LEAPRAID_ADAPTER_STATUS_SCSI_ADAPTER_TERMINATED 0x004B #define LEAPRAID_ADAPTER_STATUS_SCSI_EXT_TERMINATED 0x004C -/* sge flags */ +/* SGE flags. */ #define LEAPRAID_SGE_FLG_LAST_ONE 0x80 #define LEAPRAID_SGE_FLG_EOB 0x40 #define LEAPRAID_SGE_FLG_EOL 0x01 @@ -129,15 +133,19 @@ #define LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE 0x80 #define LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR 0x00 -#define LEAPRAID_SGE_OFFSET_SIZE 4 +#define LEAPRAID_SGE_NO_DATA_ADDR -1 +#define LEAPRAID_SGE_OFFSET_SIZE 4 -/* page and ext page type */ +/* The type of page. */ #define LEAPRAID_CFG_PT_IO_UNIT 0x00 #define LEAPRAID_CFG_PT_ADAPTER 0x01 #define LEAPRAID_CFG_PT_BIOS 0x02 #define LEAPRAID_CFG_PT_RAID_VOLUME 0x08 +#define LEAPRAID_CFG_PT_MANUFACTURING 0x09 #define LEAPRAID_CFG_PT_RAID_PHYSDISK 0x0A #define LEAPRAID_CFG_PT_EXTENDED 0x0F + +/* The type of extended page. */ #define LEAPRAID_CFG_EXTPT_SAS_IO_UNIT 0x10 #define LEAPRAID_CFG_EXTPT_SAS_EXP 0x11 #define LEAPRAID_CFG_EXTPT_SAS_DEV 0x12 @@ -145,7 +153,7 @@ #define LEAPRAID_CFG_EXTPT_ENC 0x15 #define LEAPRAID_CFG_EXTPT_RAID_CONFIG 0x16 -/* config page address */ +/* Config page address. */ #define LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP 0x00000000 #define LEAPRAID_SAS_ENC_CFG_PGAD_HDL 0x10000000 #define LEAPRAID_SAS_DEV_CFG_PGAD_HDL 0x20000000 @@ -156,51 +164,55 @@ #define LEAPRAID_SAS_PHY_CFG_PGAD_PHY_NUMBER 0x00000000 #define LEAPRAID_PHYSDISK_CFG_PGAD_PHYSDISKNUM 0x10000000 -/* config page operations */ +/* Config page operations. */ #define LEAPRAID_CFG_ACT_PAGE_HEADER 0x00 #define LEAPRAID_CFG_ACT_PAGE_READ_CUR 0x01 #define LEAPRAID_CFG_ACT_PAGE_WRITE_CUR 0x02 -/* bios pages */ +/* BIOS page number. */ #define LEAPRAID_CFG_PAGE_NUM_BIOS2 0x2 #define LEAPRAID_CFG_PAGE_NUM_BIOS3 0x3 -/* sas device pages */ +/* Manufacturing page number. */ +#define LEAPRAID_CFG_PAGE_NUM_MANU0 0x0 + +/* SAS device page number. */ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 -/* sas device page 0 flags */ +/* SAS device page 0 flags. */ #define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 +#define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 -/* sas IO unit pages */ +/* SAS I/O unit page number. */ #define LEAPRAID_CFG_PAGE_NUM_IOUNIT0 0x0 #define LEAPRAID_CFG_PAGE_NUM_IOUNIT1 0x1 -/* sas expander pages */ +/* SAS expander page number. */ #define LEAPRAID_CFG_PAGE_NUM_EXP0 0x0 #define LEAPRAID_CFG_PAGE_NUM_EXP1 0x1 -/* sas enclosure page */ +/* SAS enclosure page number. */ #define LEAPRAID_CFG_PAGE_NUM_ENC0 0x0 -/* sas phy page */ +/* SAS PHY page number. */ #define LEAPRAID_CFG_PAGE_NUM_PHY0 0x0 -/* raid volume pages */ +/* RAID volume page number. */ #define LEAPRAID_CFG_PAGE_NUM_VOL0 0x0 #define LEAPRAID_CFG_PAGE_NUM_VOL1 0x1 -/* physical disk page */ +/* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* adapter page */ +/* Adapter page number. */ #define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 #define LEAPRAID_CFG_UNIT_SIZE 4 -/* raid volume type and state */ +/* Raid volume type and state. */ #define LEAPRAID_VOL_STATE_MISSING 0x00 #define LEAPRAID_VOL_STATE_FAILED 0x01 #define LEAPRAID_VOL_STATE_INITIALIZING 0x02 @@ -213,17 +225,17 @@ #define LEAPRAID_VOL_TYPE_RAID10 0x05 #define LEAPRAID_VOL_TYPE_UNKNOWN 0xFF -/* raid volume element flags */ +/* Raid volume element flags. */ #define LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE 0x000F #define LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT 0x0001 #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* raid action */ +/* Raid action. */ #define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 #define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 -/* sas negotiated link rates */ +/* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 #define LEAPRAID_SAS_NEG_LINK_RATE_PHY_DISABLED 0x01 @@ -231,6 +243,7 @@ #define LEAPRAID_SAS_NEG_LINK_RATE_SATA_OOB_COMPLETE 0x03 #define LEAPRAID_SAS_NEG_LINK_RATE_PORT_SELECTOR 0x04 #define LEAPRAID_SAS_NEG_LINK_RATE_SMP_RESETTING 0x05 +#define LEAPRAID_SAS_NEG_LINK_RATE_SHIFT 4 #define LEAPRAID_SAS_NEG_LINK_RATE_1_5 0x08 #define LEAPRAID_SAS_NEG_LINK_RATE_3_0 0x09 @@ -240,8 +253,11 @@ #define LEAPRAID_SAS_PRATE_MIN_RATE_MASK 0x0F #define LEAPRAID_SAS_HWRATE_MIN_RATE_MASK 0x0F -/* scsi IO control bits */ -#define LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT 26 +/* + * Control flags for a SCSI I/O Request. + */ +#define LEAPRAID_SCSIIO_CTRL_CDB_32BYTE 4 +#define LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT 26 #define LEAPRAID_SCSIIO_CTRL_NODATATRANSFER 0x00000000 #define LEAPRAID_SCSIIO_CTRL_WRITE 0x01000000 #define LEAPRAID_SCSIIO_CTRL_READ 0x02000000 @@ -250,7 +266,7 @@ #define LEAPRAID_SCSIIO_CTRL_ORDEREDQ 0x00000200 #define LEAPRAID_SCSIIO_CTRL_CMDPRI 0x00000800 -/* scsi state and status */ +/* SCSI state and status. */ #define LEAPRAID_SCSI_STATUS_BUSY 0x08 #define LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT 0x18 #define LEAPRAID_SCSI_STATUS_TASK_SET_FULL 0x28 @@ -261,7 +277,7 @@ #define LEAPRAID_SCSI_STATE_AUTOSENSE_FAILED 0x02 #define LEAPRAID_SCSI_STATE_AUTOSENSE_VALID 0x01 -/* scsi task management defines */ +/* SCSI task management defines. */ #define LEAPRAID_TM_TASKTYPE_ABORT_TASK 0x01 #define LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET 0x02 #define LEAPRAID_TM_TASKTYPE_TARGET_RESET 0x03 @@ -277,21 +293,20 @@ #define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 #define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 -/* scsi sep request defines */ +/* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 #define LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS 0x00 #define LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS 0x01 #define LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT 0x00000040 -/* the capabilities of the adapter */ +/* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 #define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 #define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 -/* event code definitions for the firmware */ +/* Event code definitions for the firmware. */ #define LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE 0x000F -#define LEAPRAID_EVT_SAS_DISCOVERY 0x0016 #define LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST 0x001C #define LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE 0x001D #define LEAPRAID_EVT_IR_CHANGE 0x0020 @@ -303,7 +318,7 @@ #define LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET 0x08 #define LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET 0x0E -/* raid configuration change event */ +/* RAID configuration change event. */ #define LEAPRAID_EVT_IR_RC_VOLUME_ADD 0x01 #define LEAPRAID_EVT_IR_RC_VOLUME_DELETE 0x02 #define LEAPRAID_EVT_IR_RC_PD_HIDDEN_TO_ADD 0x03 @@ -313,27 +328,25 @@ #define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A #define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B -/* sas topology change event */ +/* SAS topology change event. */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 #define LEAPRAID_EVT_SAS_TOPO_ES_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING 0x02 #define LEAPRAID_EVT_SAS_TOPO_ES_RESPONDING 0x03 #define LEAPRAID_EVT_SAS_TOPO_RC_MASK 0x0F -#define LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK 0xF0 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -#define LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED 0x03 -/* sas discovery event defines */ +/* SAS discovery event defines. */ #define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 #define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 -/* enclosure device status change event */ +/* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 -/* device type and identifiers */ +/* Device type and identifiers. */ #define LEAPRAID_DEVTYP_SEP 0x00004000 #define LEAPRAID_DEVTYP_SSP_TGT 0x00000400 #define LEAPRAID_DEVTYP_STP_TGT 0x00000200 @@ -350,12 +363,12 @@ #define LEAPRAID_DEVTYP_EDGE_EXPANDER 0x00000002 #define LEAPRAID_DEVTYP_FANOUT_EXPANDER 0x00000003 -/* sas control operation */ +/* SAS control operation. */ #define LEAPRAID_SAS_OP_PHY_LINK_RESET 0x06 #define LEAPRAID_SAS_OP_PHY_HARD_RESET 0x07 #define LEAPRAID_SAS_OP_SET_PARAMETER 0x0F -/* boot device defines */ +/* Boot device defines */ #define LEAPRAID_BOOTDEV_FORM_MASK 0x0F #define LEAPRAID_BOOTDEV_FORM_NONE 0x00 #define LEAPRAID_BOOTDEV_FORM_SAS_WWID 0x05 @@ -365,21 +378,21 @@ /** * struct leapraid_reg_base - Register layout of the LeapRAID controller * - * @db: Doorbell register used to signal commands or status to firmware - * @ws: Write sequence register for synchronizing doorbell operations - * @host_diag: Diagnostic register used for status or debug reporting - * @r1: Reserved - * @host_int_status: Interrupt status register reporting active interrupts - * @host_int_mask: Interrupt mask register enabling or disabling sources - * @r2: Reserved - * @rep_msg_host_idx: Reply message index for the next available reply slot - * @r3: Reserved - * @debug_log: DebugLog registers for firmware debug and diagnostic output - * @r4: Reserved - * @atomic_req_desc_post: Atomic register for single descriptor posting - * @adapter_log_buf_pos: Adapter log buffer write position - * @host_log_buf_pos: Host log buffer write position - * @r5: Reserved + * @db: Doorbell register used to signal commands or status to firmware. + * @ws: Write sequence register for synchronizing doorbell operations. + * @host_diag: Diagnostic register used for status or debug reporting. + * @r1: Reserved. + * @host_int_status: Interrupt status register reporting active interrupts. + * @host_int_mask: Interrupt mask register enabling or disabling sources. + * @r2: Reserved. + * @rep_msg_host_idx: Reply message index for the next available reply slot. + * @r3: Reserved. + * @debug_log: DebugLog registers for firmware debug and diagnostic output. + * @r4: Reserved. + * @atomic_req_desc_post: Atomic register for single descriptor posting. + * @adapter_log_buf_pos: Adapter log buffer write position. + * @host_log_buf_pos: Host log buffer write position. + * @r5: Reserved. * @rep_post_reg_idx: Array of reply post index registers, one per queue. * The number of entries is defined by * REP_POST_HOST_IDX_REG_CNT. @@ -411,9 +424,9 @@ struct leapraid_reg_base { /** * struct leapraid_atomic_req_desc - Atomic request descriptor * - * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O) - * @msix_idx: MSI-X vector index used for interrupt routing - * @taskid: Unique task identifier associated with this request + * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O). + * @msix_idx: MSI-X vector index used for interrupt routing. + * @taskid: Unique task identifier associated with this request. */ struct leapraid_atomic_req_desc { u8 flg; @@ -424,23 +437,23 @@ struct leapraid_atomic_req_desc { /** * union leapraid_rep_desc_union - Unified reply descriptor format * - * @dflt_rep: Default reply descriptor containing basic completion info - * @dflt_rep.rep_flg: Reply flag indicating reply type or status - * @dflt_rep.msix_idx: MSI-X index for interrupt routing - * @dflt_rep.taskid: Task identifier matching the submitted request - * @r1: Reserved + * @dflt_rep: Default reply descriptor containing basic completion info. + * @dflt_rep.rep_flg: Reply flag indicating reply type or status. + * @dflt_rep.msix_idx: MSI-X index for interrupt routing. + * @dflt_rep.taskid: Task identifier matching the submitted request. + * @r1: Reserved. * * @addr_rep: Address reply descriptor used when firmware returns a - * memory address associated with the reply - * @addr_rep.rep_flg: Reply flag indicating reply type or status - * @addr_rep.msix_idx: MSI-X index for interrupt routing - * @addr_rep.taskid: Task identifier matching the submitted request - * @addr_rep.rep_frame_addr: Physical address of the reply frame + * memory address associated with the reply. + * @addr_rep.rep_flg: Reply flag indicating reply type or status. + * @addr_rep.msix_idx: MSI-X index for interrupt routing. + * @addr_rep.taskid: Task identifier matching the submitted request. + * @addr_rep.rep_frame_addr: Physical address of the reply frame. * - * @words: Raw 64-bit representation of the reply descriptor - * @u: Alternative access using 32-bit low/high words - * @u.low: Lower 32 bits of the descriptor - * @u.high: Upper 32 bits of the descriptor + * @words: Raw 64-bit representation of the reply descriptor. + * @u: Alternative access using 32-bit low/high words. + * @u.low: Lower 32 bits of the descriptor. + * @u.high: Upper 32 bits of the descriptor. */ union leapraid_rep_desc_union { struct leapraid_rep_desc { @@ -465,10 +478,10 @@ union leapraid_rep_desc_union { /** * struct leapraid_req - Generic request header * - * @func_dep1: Function-dependent parameter (low 16 bits) - * @r1: Reserved - * @func: Function code identifying the command type - * @r2: Reserved + * @func_dep1: Function-dependent parameter (low 16 bits). + * @r1: Reserved. + * @func: Function code identifying the command type. + * @r2: Reserved. */ struct leapraid_req { __le16 func_dep1; @@ -480,12 +493,12 @@ struct leapraid_req { /** * struct leapraid_rep - Generic reply header * - * @r1: Reserved - * @msg_len: Length of the reply message in bytes - * @function: Function code corresponding to the request - * @r2: Reserved - * @adapter_status: Status code reported by the adapter - * @r3: Reserved + * @r1: Reserved. + * @msg_len: Length of the reply message in bytes. + * @function: Function code corresponding to the request. + * @r2: Reserved. + * @adapter_status: Status code reported by the adapter. + * @r3: Reserved. */ struct leapraid_rep { u8 r1[2]; @@ -499,8 +512,8 @@ struct leapraid_rep { /** * struct leapraid_sge_simple32 - 32-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 32-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 32-bit physical address of the data buffer. */ struct leapraid_sge_simple32 { __le32 flg_and_len; @@ -510,8 +523,8 @@ struct leapraid_sge_simple32 { /** * struct leapraid_sge_simple64 - 64-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 64-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 64-bit physical address of the data buffer. */ struct leapraid_sge_simple64 { __le32 flg_and_len; @@ -521,9 +534,9 @@ struct leapraid_sge_simple64 { /** * struct leapraid_sge_simple_union - Unified 32/64-bit SGE representation * - * @flg_and_len: Combined field for flags and segment length - * @u.addr32: 32-bit address field - * @u.addr64: 64-bit address field + * @flg_and_len: Combined field for flags and segment length. + * @u.addr32: 32-bit address field. + * @u.addr64: 64-bit address field. */ struct leapraid_sge_simple_union { __le32 flg_and_len; @@ -536,11 +549,11 @@ struct leapraid_sge_simple_union { /** * struct leapraid_sge_chain_union - Chained scatter-gather entry * - * @len: Length of the chain descriptor - * @next_chain_offset: Offset to the next SGE chain - * @flg: Flags indicating chain or termination properties - * @u.addr32: 32-bit physical address - * @u.addr64: 64-bit physical address + * @len: Length of the chain descriptor. + * @next_chain_offset: Offset to the next SGE chain. + * @flg: Flags indicating chain or termination properties. + * @u.addr32: 32-bit physical address. + * @u.addr64: 64-bit physical address. */ struct leapraid_sge_chain_union { __le16 len; @@ -555,8 +568,8 @@ struct leapraid_sge_chain_union { /** * struct leapraid_ieee_sge_simple32 - IEEE 32-bit simple SGE format * - * @addr: 32-bit physical address of the data buffer - * @flg_and_len: Combined field for flags and data length + * @addr: 32-bit physical address of the data buffer. + * @flg_and_len: Combined field for flags and data length. */ struct leapraid_ieee_sge_simple32 { __le32 addr; @@ -566,10 +579,10 @@ struct leapraid_ieee_sge_simple32 { /** * struct leapraid_ieee_sge_simple64 - IEEE 64-bit simple SGE format * - * @addr: 64-bit physical address of the data buffer - * @len: Length of the data segment - * @r1: Reserved - * @flg: Flags indicating transfer properties + * @addr: 64-bit physical address of the data buffer. + * @len: Length of the data segment. + * @r1: Reserved. + * @flg: Flags indicating transfer properties. */ struct leapraid_ieee_sge_simple64 { __le64 addr; @@ -581,8 +594,8 @@ struct leapraid_ieee_sge_simple64 { /** * union leapraid_ieee_sge_simple_union - Unified IEEE SGE format * - * @simple32: IEEE 32-bit simple SGE entry - * @simple64: IEEE 64-bit simple SGE entry + * @simple32: IEEE 32-bit simple SGE entry. + * @simple64: IEEE 64-bit simple SGE entry. */ union leapraid_ieee_sge_simple_union { struct leapraid_ieee_sge_simple32 simple32; @@ -592,8 +605,8 @@ union leapraid_ieee_sge_simple_union { /** * union leapraid_ieee_sge_chain_union - Unified IEEE SGE chain format * - * @chain32: IEEE 32-bit chain SGE entry - * @chain64: IEEE 64-bit chain SGE entry + * @chain32: IEEE 32-bit chain SGE entry. + * @chain64: IEEE 64-bit chain SGE entry. */ union leapraid_ieee_sge_chain_union { struct leapraid_ieee_sge_simple32 chain32; @@ -603,11 +616,11 @@ union leapraid_ieee_sge_chain_union { /** * struct leapraid_chain64_ieee_sg - 64-bit IEEE chain SGE descriptor * - * @addr: Physical address of the next chain segment - * @len: Length of the current SGE - * @r1: Reserved - * @next_chain_offset: Offset to the next chain element - * @flg: Flags that describe SGE attributes + * @addr: Physical address of the next chain segment. + * @len: Length of the current SGE. + * @r1: Reserved. + * @next_chain_offset: Offset to the next chain element. + * @flg: Flags that describe SGE attributes. */ struct leapraid_chain64_ieee_sg { __le64 addr; @@ -620,8 +633,8 @@ struct leapraid_chain64_ieee_sg { /** * union leapraid_ieee_sge_io_union - IEEE-style SGE union for I/O * - * @ieee_simple: Simple IEEE SGE descriptor - * @ieee_chain: IEEE chain SGE descriptor + * @ieee_simple: Simple IEEE SGE descriptor. + * @ieee_chain: IEEE chain SGE descriptor. */ union leapraid_ieee_sge_io_union { struct leapraid_ieee_sge_simple64 ieee_simple; @@ -631,25 +644,25 @@ union leapraid_ieee_sge_io_union { /** * union leapraid_simple_sge_union - Union of simple SGE descriptors * - * @leapio_simple: LeapIO-style simple SGE - * @ieee_simple: IEEE-style simple SGE + * @leapraid_simple: LeapRAID simple SGE. + * @ieee_simple: IEEE-style simple SGE. */ union leapraid_simple_sge_union { - struct leapraid_sge_simple_union leapio_simple; + struct leapraid_sge_simple_union leapraid_simple; union leapraid_ieee_sge_simple_union ieee_simple; }; /** * union leapraid_sge_io_union - Combined SGE union for all I/O types * - * @leapio_simple: LeapIO simple SGE format - * @leapio_chain: LeapIO chain SGE format - * @ieee_simple: IEEE simple SGE format - * @ieee_chain: IEEE chain SGE format + * @leapraid_simple: LeapRAID simple SGE format. + * @leapraid_chain: LeapRAID chain SGE format. + * @ieee_simple: IEEE simple SGE format. + * @ieee_chain: IEEE chain SGE format. */ union leapraid_sge_io_union { - struct leapraid_sge_simple_union leapio_simple; - struct leapraid_sge_chain_union leapio_chain; + struct leapraid_sge_simple_union leapraid_simple; + struct leapraid_sge_chain_union leapraid_chain; union leapraid_ieee_sge_simple_union ieee_simple; union leapraid_ieee_sge_chain_union ieee_chain; }; @@ -657,10 +670,10 @@ union leapraid_sge_io_union { /** * struct leapraid_cfg_pg_header - Standard configuration page header * - * @r1: Reserved - * @page_len: Length of the page in 4-byte units - * @page_num: Page number - * @page_type: Page type + * @r1: Reserved. + * @page_len: Length of the page in 4-byte units. + * @page_num: Page number. + * @page_type: Page type. */ struct leapraid_cfg_pg_header { u8 r1; @@ -672,13 +685,13 @@ struct leapraid_cfg_pg_header { /** * struct leapraid_cfg_ext_pg_header - Extended configuration page header * - * @r1: Reserved - * @r2: Reserved - * @page_num: Page number - * @page_type: Page type - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @r3: Reserved + * @r1: Reserved. + * @r2: Reserved. + * @page_num: Page number. + * @page_type: Page type. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @r3: Reserved. */ struct leapraid_cfg_ext_pg_header { u8 r1; @@ -693,17 +706,17 @@ struct leapraid_cfg_ext_pg_header { /** * struct leapraid_cfg_req - Configuration request message * - * @action: Requested action type - * @sgl_flag: SGL flag field - * @chain_offset: Offset to next chain SGE - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r1: Reserved - * @header: Configuration page header - * @page_addr: Address of the page buffer - * @page_buf_sge: SGE describing the page buffer + * @action: Requested action type. + * @sgl_flag: SGL flag field. + * @chain_offset: Offset to next chain SGE. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r1: Reserved. + * @header: Configuration page header. + * @page_addr: Address of the page buffer. + * @page_buf_sge: SGE describing the page buffer. */ struct leapraid_cfg_req { u8 action; @@ -722,17 +735,17 @@ struct leapraid_cfg_req { /** * struct leapraid_cfg_rep - Configuration reply message * - * @action: Action type from the request - * @r1: Reserved - * @msg_len: Message length in bytes - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status code - * @r3: Reserved - * @header: Configuration page header + * @action: Action type from the request. + * @r1: Reserved. + * @msg_len: Message length in bytes. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status code. + * @r3: Reserved. + * @header: Configuration page header. */ struct leapraid_cfg_rep { u8 action; @@ -751,9 +764,9 @@ struct leapraid_cfg_rep { /** * struct leapraid_boot_dev_format_sas_wwid - Boot device identified by wwid * - * @sas_addr: SAS address of the device - * @lun: Logical unit number - * @r1: Reserved + * @sas_addr: SAS address of the device. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_sas_wwid { __le64 sas_addr; @@ -764,10 +777,10 @@ struct leapraid_boot_dev_format_sas_wwid { /** * struct leapraid_boot_dev_format_enc_slot - identified by enclosure * - * @enc_lid: Enclosure logical ID - * @r1: Reserved - * @slot_num: Slot number in the enclosure - * @r2: Reserved + * @enc_lid: Enclosure logical ID. + * @r1: Reserved. + * @slot_num: Slot number in the enclosure. + * @r2: Reserved. */ struct leapraid_boot_dev_format_enc_slot { __le64 enc_lid; @@ -779,9 +792,9 @@ struct leapraid_boot_dev_format_enc_slot { /** * struct leapraid_boot_dev_format_dev_name - Boot device by device name * - * @dev_name: Device name identifier - * @lun: Logical unit number - * @r1: Reserved + * @dev_name: Device name identifier. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_dev_name { __le64 dev_name; @@ -792,9 +805,9 @@ struct leapraid_boot_dev_format_dev_name { /** * union leapraid_boot_dev_format - Boot device format union * - * @sas_wwid: Format using SAS WWID and LUN - * @enc_slot: Format using enclosure slot and ID - * @dev_name: Format using device name and LUN + * @sas_wwid: Format using SAS WWID and LUN. + * @enc_slot: Format using enclosure slot and ID. + * @dev_name: Format using device name and LUN. */ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_sas_wwid sas_wwid; @@ -802,20 +815,39 @@ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_dev_name dev_name; }; +/** + * struct leapraid_manufacturing_p0 - Manufacturing configuration page 0 + * + * @header: Configuration page header. + * @chip_name: Chip name as a 16-byte ASCII string. + * @chip_revision: Chip revision as an 8-byte ASCII string. + * @board_name: Board name as a 16-byte ASCII string. + * @board_assembly: Board assembly as a 16-byte ASCII string. + * @board_tracer_number: Board tracer number as a 16-byte ASCII string. + */ +struct leapraid_manufacturing_p0 { + struct leapraid_cfg_pg_header header; + u8 chip_name[16]; + u8 chip_revision[8]; + u8 board_name[16]; + u8 board_assembly[16]; + u8 board_tracer_number[16]; +}; + /** * struct leapraid_bios_page2 - BIOS configuration page 2 * - * @header: Configuration page header - * @r1: Reserved - * @requested_boot_dev_form: Format type of the requested boot device - * @r2: Reserved - * @requested_boot_dev: Boot device requested by BIOS or user - * @requested_alt_boot_dev_form: Format of the alternate boot device - * @r3: Reserved - * @requested_alt_boot_dev: Alternate boot device requested - * @current_boot_dev_form: Format type of the active boot device - * @r4: Reserved - * @current_boot_dev: Currently active boot device in use + * @header: Configuration page header. + * @r1: Reserved. + * @requested_boot_dev_form: Format type of the requested boot device. + * @r2: Reserved. + * @requested_boot_dev: Boot device requested by BIOS or user. + * @requested_alt_boot_dev_form: Format of the alternate boot device. + * @r3: Reserved. + * @requested_alt_boot_dev: Alternate boot device requested. + * @current_boot_dev_form: Format type of the active boot device. + * @r4: Reserved. + * @current_boot_dev: Currently active boot device in use. */ struct leapraid_bios_page2 { struct leapraid_cfg_pg_header header; @@ -834,10 +866,10 @@ struct leapraid_bios_page2 { /** * struct leapraid_bios_page3 - BIOS configuration page 3 * - * @header: Configuration page header - * @r1: Reserved - * @bios_version: BIOS firmware version number - * @r2: Reserved + * @header: Configuration page header. + * @r1: Reserved. + * @bios_version: BIOS firmware version number. + * @r2: Reserved. */ struct leapraid_bios_page3 { struct leapraid_cfg_pg_header header; @@ -849,9 +881,9 @@ struct leapraid_bios_page3 { /** * struct leapraid_raidvol0_phys_disk - Physical disk in RAID volume * - * @r1: Reserved - * @phys_disk_num: Physical disk number within the RAID volume - * @r2: Reserved + * @r1: Reserved. + * @phys_disk_num: Physical disk number within the RAID volume. + * @r2: Reserved. */ struct leapraid_raidvol0_phys_disk { u8 r1[2]; @@ -862,14 +894,14 @@ struct leapraid_raidvol0_phys_disk { /** * struct leapraid_raidvol_p0 - RAID volume configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle for the RAID volume - * @volume_state: State of the RAID volume - * @volume_type: RAID type - * @r1: Reserved - * @num_phys_disks: Number of physical disks in the volume - * @r2: Reserved - * @phys_disk: Array of physical disks in this volume + * @header: Configuration page header. + * @dev_hdl: Device handle for the RAID volume. + * @volume_state: State of the RAID volume. + * @volume_type: RAID type. + * @r1: Reserved. + * @num_phys_disks: Number of physical disks in the volume. + * @r2: Reserved. + * @phys_disk: Array of physical disks in this volume. */ struct leapraid_raidvol_p0 { struct leapraid_cfg_pg_header header; @@ -885,11 +917,11 @@ struct leapraid_raidvol_p0 { /** * struct leapraid_raidvol_p1 - RAID volume configuration page 1 * - * @header: Configuration page header - * @dev_hdl: Device handle of the RAID volume - * @r1: Reserved - * @wwid: World-wide identifier for the volume - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the RAID volume. + * @r1: Reserved. + * @wwid: World-wide identifier for the volume. + * @r2: Reserved. */ struct leapraid_raidvol_p1 { struct leapraid_cfg_pg_header header; @@ -902,11 +934,11 @@ struct leapraid_raidvol_p1 { /** * struct leapraid_raidpd_p0 - Physical disk configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle of the physical disk - * @r1: Reserved - * @phys_disk_num: Physical disk number - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the physical disk. + * @r1: Reserved. + * @phys_disk_num: Physical disk number. + * @r2: Reserved. */ struct leapraid_raidpd_p0 { struct leapraid_cfg_pg_header header; @@ -919,14 +951,14 @@ struct leapraid_raidpd_p0 { /** * struct leapraid_sas_io_unit0_phy_info - PHY info for SAS I/O unit * - * @port: Port number the PHY belongs to - * @port_flg: Flags describing port status - * @phy_flg: Flags describing PHY status - * @neg_link_rate: Negotiated link rate of the PHY - * @controller_phy_dev_info: Controller PHY device info - * @attached_dev_hdl: Handle of attached device - * @controller_dev_hdl: Handle of the controller device - * @r1: Reserved + * @port: Port number the PHY belongs to. + * @port_flg: Flags describing port status. + * @phy_flg: Flags describing PHY status. + * @neg_link_rate: Negotiated link rate of the PHY. + * @controller_phy_dev_info: Controller PHY device info. + * @attached_dev_hdl: Handle of attached device. + * @controller_dev_hdl: Handle of the controller device. + * @r1: Reserved. */ struct leapraid_sas_io_unit0_phy_info { u8 port; @@ -942,11 +974,11 @@ struct leapraid_sas_io_unit0_phy_info { /** * struct leapraid_sas_io_unit_p0 - SAS I/O unit configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @phy_num: Number of PHYs in this unit - * @r2: Reserved - * @phy_info: Array of PHY information + * @header: Extended configuration page header. + * @r1: Reserved. + * @phy_num: Number of PHYs in this unit. + * @r2: Reserved. + * @phy_info: Array of PHY information. */ struct leapraid_sas_io_unit_p0 { struct leapraid_cfg_ext_pg_header header; @@ -956,54 +988,20 @@ struct leapraid_sas_io_unit_p0 { struct leapraid_sas_io_unit0_phy_info phy_info[]; }; -/** - * struct leapraid_sas_io_unit1_phy_info - Placeholder for SAS unit page 1 PHY - * - * @r1: Reserved - */ -struct leapraid_sas_io_unit1_phy_info { - u8 r1[12]; -}; - -/** - * struct leapraid_sas_io_unit_page1 - SAS I/O unit configuration page 1 - * - * @header: Extended configuration page header - * @r1: Reserved - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @r2: Reserved - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @r3: Reserved - * @sata_max_queue_depth: Maximum SATA queue depth - * @r4: Reserved - * @phy_info: Array of PHY info structures - */ -struct leapraid_sas_io_unit_page1 { - struct leapraid_cfg_ext_pg_header header; - u8 r1[2]; - __le16 narrowport_max_queue_depth; - u8 r2[2]; - __le16 wideport_max_queue_depth; - u8 r3; - u8 sata_max_queue_depth; - u8 r4[2]; - struct leapraid_sas_io_unit1_phy_info phy_info[]; -}; - /** * struct leapraid_exp_p0 - SAS expander page 0 * - * @header: Extended page header - * @physical_port: Physical port number - * @r1: Reserved - * @enc_hdl: Enclosure handle - * @sas_address: SAS address of the expander - * @r2: Reserved - * @dev_hdl: Device handle of this expander - * @parent_dev_hdl: Device handle of parent expander - * @r3: Reserved - * @phy_num: Number of PHYs - * @r4: Reserved + * @header: Extended page header. + * @physical_port: Physical port number. + * @r1: Reserved. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address of the expander. + * @r2: Reserved. + * @dev_hdl: Device handle of this expander. + * @parent_dev_hdl: Device handle of parent expander. + * @r3: Reserved. + * @phy_num: Number of PHYs. + * @r4: Reserved. */ struct leapraid_exp_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1022,14 +1020,14 @@ struct leapraid_exp_p0 { /** * struct leapraid_exp_p1 - SAS expander page 1 * - * @header: Extended page header - * @r1: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @attached_dev_hdl: Attached device handle - * @r2: Reserved - * @neg_link_rate: Negotiated link rate - * @r3: Reserved + * @header: Extended page header. + * @r1: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @attached_dev_hdl: Attached device handle. + * @r2: Reserved. + * @neg_link_rate: Negotiated link rate. + * @r3: Reserved. */ struct leapraid_exp_p1 { struct leapraid_cfg_ext_pg_header header; @@ -1045,25 +1043,25 @@ struct leapraid_exp_p1 { /** * struct leapraid_sas_dev_p0 - SAS device page 0 * - * @header: Extended configuration page header - * @slot: Slot number - * @enc_hdl: Enclosure handle - * @sas_address: SAS address - * @parent_dev_hdl: Parent device handle - * @phy_num: Number of PHYs - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @dev_info: Device information - * @flg: Flags - * @physical_port: Physical port number - * @max_port_connections: Maximum port connections - * @dev_name: Device name - * @port_groups: Number of port groups - * @r3: Reserved - * @enc_level: Enclosure level - * @connector_name: Connector identifier - * @r4: Reserved + * @header: Extended configuration page header. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address. + * @parent_dev_hdl: Parent device handle. + * @phy_num: Number of PHYs. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @dev_info: Device information. + * @flg: Flags. + * @physical_port: Physical port number. + * @max_port_connections: Maximum port connections. + * @dev_name: Device name. + * @port_groups: Number of port groups. + * @r3: Reserved. + * @enc_level: Enclosure level. + * @connector_name: Connector identifier. + * @r4: Reserved. */ struct leapraid_sas_dev_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1083,23 +1081,23 @@ struct leapraid_sas_dev_p0 { u8 port_groups; u8 r3[2]; u8 enc_level; - u8 connector_name[4]; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN]; u8 r4[4]; } __packed __aligned(4); /** * struct leapraid_sas_phy_p0 - SAS PHY configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @attached_dev_hdl: Handle of attached device - * @r2: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @r3: Reserved - * @phy_info: PHY information - * @neg_link_rate: Negotiated link rate - * @r4: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @attached_dev_hdl: Handle of attached device. + * @r2: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @r3: Reserved. + * @phy_info: PHY information. + * @neg_link_rate: Negotiated link rate. + * @r4: Reserved. */ struct leapraid_sas_phy_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1117,12 +1115,12 @@ struct leapraid_sas_phy_p0 { /** * struct leapraid_enc_p0 - SAS enclosure page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @enc_lid: Enclosure logical ID - * @r2: Reserved - * @enc_hdl: Enclosure handle - * @r3: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @enc_lid: Enclosure logical ID. + * @r2: Reserved. + * @enc_hdl: Enclosure handle. + * @r3: Reserved. */ struct leapraid_enc_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1136,10 +1134,10 @@ struct leapraid_enc_p0 { /** * struct leapraid_raid_cfg_p0_element - RAID configuration element * - * @element_flg: Element flags - * @vol_dev_hdl: Volume device handle - * @r1: Reserved - * @phys_disk_dev_hdl: Physical disk device handle + * @element_flg: Element flags. + * @vol_dev_hdl: Volume device handle. + * @r1: Reserved. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_raid_cfg_p0_element { __le16 element_flg; @@ -1151,13 +1149,13 @@ struct leapraid_raid_cfg_p0_element { /** * struct leapraid_raid_cfg_p0 - RAID configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @cfg_num: Configuration number - * @r2: Reserved - * @elements_num: Number of RAID elements - * @r3: Reserved - * @cfg_element: Array of RAID elements + * @header: Extended configuration page header. + * @r1: Reserved. + * @cfg_num: Configuration number. + * @r2: Reserved. + * @elements_num: Number of RAID elements. + * @r3: Reserved. + * @cfg_element: Array of RAID elements. */ struct leapraid_raid_cfg_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1172,8 +1170,8 @@ struct leapraid_raid_cfg_p0 { /** * union leapraid_mpi_scsi_io_cdb_union - SCSI I/O CDB or simple SGE * - * @cdb32: 32-byte SCSI command descriptor block - * @sge: Simple SGE format + * @cdb32: 32-byte SCSI command descriptor block. + * @sge: Simple SGE format. */ union leapraid_mpi_scsi_io_cdb_union { u8 cdb32[32]; @@ -1183,32 +1181,32 @@ union leapraid_mpi_scsi_io_cdb_union { /** * struct leapraid_mpi_scsiio_req - MPI SCSI I/O request * - * @dev_hdl: Device handle for the target - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flags - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0..3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle for the target. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flags. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0..3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_mpi_scsiio_req { __le16 dev_hdl; @@ -1245,8 +1243,8 @@ struct leapraid_mpi_scsiio_req { /** * union leapraid_scsi_io_cdb_union - SCSI I/O CDB or IEEE simple SGE * - * @cdb32: 32-byte SCSI CDB - * @sge: IEEE simple 64-bit SGE + * @cdb32: 32-byte SCSI CDB. + * @sge: IEEE simple 64-bit SGE. */ union leapraid_scsi_io_cdb_union { u8 cdb32[32]; @@ -1256,32 +1254,32 @@ union leapraid_scsi_io_cdb_union { /** * struct leapraid_scsiio_req - SCSI I/O request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flag - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0-3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flag. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0-3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_scsiio_req { __le16 dev_hdl; @@ -1318,23 +1316,23 @@ struct leapraid_scsiio_req { /** * struct leapraid_scsiio_rep - SCSI I/O response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @scsi_status: SCSI status - * @scsi_state: SCSI state - * @adapter_status: Adapter status - * @r3: Reserved - * @transfer_count: Number of bytes transferred - * @sense_count: Number of sense bytes - * @resp_info: Additional response info - * @task_tag: Task identifier - * @scsi_status_qualifier: SCSI status qualifier - * @bi_dir_trans_count: Bi-directional transfer count - * @r4: Reserved + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @scsi_status: SCSI status. + * @scsi_state: SCSI state. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @transfer_count: Number of bytes transferred. + * @sense_count: Number of sense bytes. + * @resp_info: Additional response info. + * @task_tag: Task identifier. + * @scsi_status_qualifier: SCSI status qualifier. + * @bi_dir_trans_count: Bi-directional transfer count. + * @r4: Reserved. */ struct leapraid_scsiio_rep { __le16 dev_hdl; @@ -1359,18 +1357,18 @@ struct leapraid_scsiio_rep { /** * struct leapraid_scsi_tm_req - SCSI Task Management request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @task_type: Task management function type - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @lun: Logical Unit Number - * @r4: Reserved - * @task_mid: Task identifier - * @r5: Reserved + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @task_type: Task management function type. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @lun: Logical Unit Number. + * @r4: Reserved. + * @task_mid: Task identifier. + * @r5: Reserved. */ struct leapraid_scsi_tm_req { __le16 dev_hdl; @@ -1390,18 +1388,18 @@ struct leapraid_scsi_tm_req { /** * struct leapraid_scsi_tm_rep - SCSI Task Management response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @resp_code: Response code - * @task_type: Task management type - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @termination_count: Count of terminated tasks - * @response_info: Additional response info + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @resp_code: Response code. + * @task_type: Task management type. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @termination_count: Count of terminated tasks. + * @response_info: Additional response info. */ struct leapraid_scsi_tm_rep { __le16 dev_hdl; @@ -1421,18 +1419,18 @@ struct leapraid_scsi_tm_rep { /** * struct leapraid_sep_req - SEP (SCSI Enclosure Processor) request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @act: Action to perform - * @flg: Flags - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @act: Action to perform. + * @flg: Flags. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_req { __le16 dev_hdl; @@ -1452,19 +1450,19 @@ struct leapraid_sep_req { /** * struct leapraid_sep_rep - SEP response * - * @dev_hdl: Device handle - * @msg_len: Message length - * @func: Function code - * @act: Action performed - * @flg: Flags - * @msg_flag: Message flags - * @r1: Reserved - * @adapter_status: Adapter status - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @msg_len: Message length. + * @func: Function code. + * @act: Action performed. + * @flg: Flags. + * @msg_flag: Message flags. + * @r1: Reserved. + * @adapter_status: Adapter status. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_rep { __le16 dev_hdl; @@ -1486,29 +1484,29 @@ struct leapraid_sep_rep { /** * struct leapraid_adapter_init_req - Adapter initialization request * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @chain_offset: Chain offset - * @func: Function code - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @msg_ver: Message version - * @header_ver: Header version - * @host_buf_addr: Host buffer address (non adapter-ref) - * @r4: Reserved - * @host_buf_size: Host buffer size (non adapter-ref) - * @host_msix_vectors: Number of host MSI-X vectors - * @r6: Reserved - * @req_frame_size: Request frame size - * @rep_desc_qd: Reply descriptor queue depth - * @rep_msg_qd: Reply message queue depth - * @sense_buffer_add_high: High 32-bit of sense buffer address - * @rep_msg_dma_high: High 32-bit of reply message DMA address - * @task_desc_base_addr: Base address of task descriptors - * @rep_desc_q_arr_addr: Address of reply descriptor queue array - * @rep_msg_addr_dma: Reply message DMA address - * @time_stamp: Timestamp + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @chain_offset: Chain offset. + * @func: Function code. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @msg_ver: Message version. + * @header_ver: Header version. + * @host_buf_addr: Host buffer address (non adapter-ref). + * @r4: Reserved. + * @host_buf_size: Host buffer size (non adapter-ref). + * @host_msix_vectors: Number of host MSI-X vectors. + * @r6: Reserved. + * @req_frame_size: Request frame size. + * @rep_desc_qd: Reply descriptor queue depth. + * @rep_msg_qd: Reply message queue depth. + * @sense_buffer_add_high: High 32-bit of sense buffer address. + * @rep_msg_dma_high: High 32-bit of reply message DMA address. + * @task_desc_base_addr: Base address of task descriptors. + * @rep_desc_q_arr_addr: Address of reply descriptor queue array. + * @rep_msg_addr_dma: Reply message DMA address. + * @time_stamp: Timestamp. */ struct leapraid_adapter_init_req { u8 who_init; @@ -1539,8 +1537,8 @@ struct leapraid_adapter_init_req { /** * struct leapraid_rep_desc_q_arr - Reply descriptor queue array * - * @rep_desc_base_addr: Base address of the reply descriptors - * @r1: Reserved + * @rep_desc_base_addr: Base address of the reply descriptors. + * @r1: Reserved. */ struct leapraid_rep_desc_q_arr { __le64 rep_desc_base_addr; @@ -1550,15 +1548,15 @@ struct leapraid_rep_desc_q_arr { /** * struct leapraid_adapter_init_rep - Adapter initialization reply * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @msg_len: Length of reply message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @msg_len: Length of reply message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_adapter_init_rep { u8 who_init; @@ -1575,15 +1573,15 @@ struct leapraid_adapter_init_rep { /** * struct leapraid_adapter_log_req - Adapter log request * - * @action: Action code - * @type: Log type - * @chain_offset: Offset for chained SGE - * @func: Function code - * r1: Reserved - * @msg_flag: Message flags - * r2: Reserved - * @mbox: Mailbox for command-specific parameters - * @sge: Scatter-gather entry for data buffer + * @action: Action code. + * @type: Log type. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * r1: Reserved. + * @msg_flag: Message flags. + * r2: Reserved. + * @mbox: Mailbox for command-specific parameters. + * @sge: Scatter-gather entry for data buffer. */ struct leapraid_adapter_log_req { u8 action; @@ -1604,14 +1602,14 @@ struct leapraid_adapter_log_req { /** * struct leapraid_adapter_log_rep - Adapter log reply * - * @action: Action code echoed - * @type: Log type echoed - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Status returned by adapter + * @action: Action code echoed. + * @type: Log type echoed. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Status returned by adapter. */ struct leapraid_adapter_log_rep { u8 action; @@ -1627,12 +1625,12 @@ struct leapraid_adapter_log_rep { /** * struct leapraid_adapter_features_req - Request adapter features * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_adapter_features_req { u8 r1[2]; @@ -1646,32 +1644,32 @@ struct leapraid_adapter_features_req { /** * struct leapraid_adapter_features_rep - Adapter features reply * - * @msg_ver: Message version - * @msg_len: Length of reply message - * @func: Function code - * @header_ver: Header version - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @who_init: Who initialized the adapter - * @r4: Reserved - * @max_msix_vectors: Max MSI-X vectors supported - * @req_slot: Number of request slots - * @r5: Reserved - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version - * @sas_wide_max_qdepth: Max wide SAS queue depth - * @sas_narrow_max_qdepth: Max narrow SAS queue depth - * @r6: Reserved - * @hp_slot: Number of high-priority slots - * @r7: Reserved - * @max_volumes: Maximum supported volumes - * @max_dev_hdl: Maximum device handle - * @r8: Reserved - * @min_dev_hdl: Minimum device handle - * @r9: Reserved + * @msg_ver: Message version. + * @msg_len: Length of reply message. + * @func: Function code. + * @header_ver: Header version. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @who_init: Who initialized the adapter. + * @r4: Reserved. + * @max_msix_vectors: Max MSI-X vectors supported. + * @req_slot: Number of request slots. + * @r5: Reserved. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version. + * @sas_wide_max_qdepth: Max wide SAS queue depth. + * @sas_narrow_max_qdepth: Max narrow SAS queue depth. + * @r6: Reserved. + * @hp_slot: Number of high-priority slots. + * @r7: Reserved. + * @max_volumes: Maximum supported volumes. + * @max_dev_hdl: Maximum device handle. + * @r8: Reserved. + * @min_dev_hdl: Minimum device handle. + * @r9: Reserved. */ struct leapraid_adapter_features_rep { u16 msg_ver; @@ -1706,12 +1704,12 @@ struct leapraid_adapter_features_rep { /** * struct leapraid_scan_dev_req - Request to scan devices * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_scan_dev_req { u8 r1[2]; @@ -1725,14 +1723,14 @@ struct leapraid_scan_dev_req { /** * struct leapraid_scan_dev_rep - Scan devices reply * - * @r1: Reserved - * @msg_len: Length of message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @r1: Reserved. + * @msg_len: Length of message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_scan_dev_rep { u8 r1[2]; @@ -1748,14 +1746,14 @@ struct leapraid_scan_dev_rep { /** * struct leapraid_evt_notify_req - Event notification request * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @evt_masks: Event masks to enable notifications - * @r4: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @evt_masks: Event masks to enable notifications. + * @r4: Reserved. */ struct leapraid_evt_notify_req { u8 r1[2]; @@ -1771,18 +1769,18 @@ struct leapraid_evt_notify_req { /** * struct leapraid_evt_notify_rep - Event notification reply * - * @evt_data_len: Length of event data - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved - * @evt: Event code - * @r5: Reserved - * @evt_data: Event data array + * @evt_data_len: Length of event data. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. + * @evt: Event code. + * @r5: Reserved. + * @evt_data: Event data array. */ struct leapraid_evt_notify_rep { __le16 evt_data_len; @@ -1802,14 +1800,14 @@ struct leapraid_evt_notify_rep { /** * struct leapraid_evt_data_sas_dev_status_change - SAS device status change * - * @task_tag: Task identifier - * @reason_code: Reason for status change - * @physical_port: Physical port number - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @sas_address: SAS address of device - * @lun: Logical Unit Number + * @task_tag: Task identifier. + * @reason_code: Reason for status change. + * @physical_port: Physical port number. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @sas_address: SAS address of device. + * @lun: Logical unit Number. */ struct leapraid_evt_data_sas_dev_status_change { __le16 task_tag; @@ -1824,11 +1822,11 @@ struct leapraid_evt_data_sas_dev_status_change { /** * struct leapraid_evt_data_ir_change - IR (Integrated RAID) change event data * - * @r1: Reserved - * @reason_code: Reason for IR change - * @r2: Reserved - * @vol_dev_hdl: Volume device handle - * @phys_disk_dev_hdl: Physical disk device handle + * @r1: Reserved. + * @reason_code: Reason for IR change. + * @r2: Reserved. + * @vol_dev_hdl: Volume device handle. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_evt_data_ir_change { u8 r1; @@ -1841,10 +1839,10 @@ struct leapraid_evt_data_ir_change { /** * struct leapraid_evt_data_sas_disc - SAS discovery event data * - * @r1: Reserved - * @reason_code: Reason for discovery event - * @physical_port: Physical port number where event occurred - * @r2: Reserved + * @r1: Reserved. + * @reason_code: Reason for discovery event. + * @physical_port: Physical port number where event occurred. + * @r2: Reserved. */ struct leapraid_evt_data_sas_disc { u8 r1; @@ -1856,9 +1854,9 @@ struct leapraid_evt_data_sas_disc { /** * struct leapraid_evt_sas_topo_phy_entry - SAS topology PHY entry * - * @attached_dev_hdl: Device handle attached to PHY - * @link_rate: Current link rate - * @phy_status: PHY status flags + * @attached_dev_hdl: Device handle attached to PHY. + * @link_rate: Current link rate. + * @phy_status: PHY status flags. */ struct leapraid_evt_sas_topo_phy_entry { __le16 attached_dev_hdl; @@ -1869,15 +1867,15 @@ struct leapraid_evt_sas_topo_phy_entry { /** * struct leapraid_evt_data_sas_topo_change_list - SAS topology change list * - * @encl_hdl: Enclosure handle - * @exp_dev_hdl: Expander device handle - * @num_phys: Number of PHYs in this entry - * @r1: Reserved - * @entry_num: Entry index - * @start_phy_num: Start PHY number - * @exp_status: Expander status - * @physical_port: Physical port number - * @phy: Array of SAS PHY entries + * @encl_hdl: Enclosure handle. + * @exp_dev_hdl: Expander device handle. + * @num_phys: Number of PHYs in this entry. + * @r1: Reserved. + * @entry_num: Entry index. + * @start_phy_num: Start PHY number. + * @exp_status: Expander status. + * @physical_port: Physical port number. + * @phy: Array of SAS PHY entries. */ struct leapraid_evt_data_sas_topo_change_list { __le16 encl_hdl; @@ -1892,15 +1890,16 @@ struct leapraid_evt_data_sas_topo_change_list { }; /** - * struct leapraid_evt_data_sas_enc_dev_status_change - SAS enclosure device status + * struct leapraid_evt_data_sas_enc_dev_status_change - + * SAS enclosure device status * - * @enc_hdl: Enclosure handle - * @reason_code: Reason code for status change - * @physical_port: Physical port number - * @encl_logical_id: Enclosure logical ID - * @num_slots: Number of slots in enclosure - * @start_slot: First affected slot - * @phy_bits: Bitmap of affected PHYs + * @enc_hdl: Enclosure handle. + * @reason_code: Reason code for status change. + * @physical_port: Physical port number. + * @encl_logical_id: Enclosure logical ID. + * @num_slots: Number of slots in enclosure. + * @start_slot: First affected slot. + * @phy_bits: Bitmap of affected PHYs. */ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 enc_hdl; @@ -1913,21 +1912,21 @@ struct leapraid_evt_data_sas_enc_dev_status_change { }; /** - * struct leapraid_io_unit_ctrl_req - IO unit control request + * struct leapraid_io_unit_ctrl_req - I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @chain_offset: SGE chain offset - * @func: Function code - * @dev_hdl: Device handle - * @adapter_para: Adapter parameter selector - * @msg_flag: Message flags - * @r2: Reserved - * @phy_num: PHY number - * @r3: Reserved - * @adapter_para_value: Value for adapter parameter - * @adapter_para_value2: Optional second parameter value - * @r4: Reserved + * @op: Operation code. + * @r1: Reserved. + * @chain_offset: SGE chain offset. + * @func: Function code. + * @dev_hdl: Device handle. + * @adapter_para: Adapter parameter selector. + * @msg_flag: Message flags. + * @r2: Reserved. + * @phy_num: PHY number. + * @r3: Reserved. + * @adapter_para_value: Value for adapter parameter. + * @adapter_para_value2: Optional second parameter value. + * @r4: Reserved. */ struct leapraid_io_unit_ctrl_req { u8 op; @@ -1946,13 +1945,13 @@ struct leapraid_io_unit_ctrl_req { }; /** - * struct leapraid_io_unit_ctrl_rep - IO unit control reply + * struct leapraid_io_unit_ctrl_rep - I/O unit control reply * - * @op: Operation code echoed - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code echoed. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_io_unit_ctrl_rep { u8 op; @@ -1965,13 +1964,13 @@ struct leapraid_io_unit_ctrl_rep { /** * struct leapraid_raid_act_req - RAID action request * - * @act: RAID action code - * @r1: Reserved - * @func: Function code - * @r2: Reserved - * @phys_disk_num: Number of physical disks involved - * @r3: Reserved - * @action_data_sge: SGE describing action-specific data + * @act: RAID action code. + * @r1: Reserved. + * @func: Function code. + * @r2: Reserved. + * @phys_disk_num: Number of physical disks involved. + * @r3: Reserved. + * @action_data_sge: SGE describing action-specific data. */ struct leapraid_raid_act_req { u8 act; @@ -1986,13 +1985,13 @@ struct leapraid_raid_act_req { /** * struct leapraid_raid_act_rep - RAID action reply * - * @act: RAID action code echoed - * @r1: Reserved - * @func: Function code - * @vol_dev_hdl: Volume device handle + * @act: RAID action code echoed. + * @r1: Reserved. + * @func: Function code. + * @vol_dev_hdl: Volume device handle. * @r2: Reserved - * @adapter_status: Status returned by adapter - * @r3: Reserved + * @adapter_status: Status returned by adapter. + * @r3: Reserved. */ struct leapraid_raid_act_rep { u8 act; @@ -2007,15 +2006,15 @@ struct leapraid_raid_act_rep { /** * struct leapraid_smp_passthrough_req - SMP passthrough request * - * @passthrough_flg: Passthrough flags - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @req_data_len: Request data length - * @r2: Reserved - * @sas_address: SAS address of target device - * @r3: Reserved - * @sgl: Scatter-gather list describing request buffer + * @passthrough_flg: Passthrough flags. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @req_data_len: Request data length. + * @r2: Reserved. + * @sas_address: SAS address of target device. + * @r3: Reserved. + * @sgl: Scatter-gather list describing request buffer. */ struct leapraid_smp_passthrough_req { u8 passthrough_flg; @@ -2032,14 +2031,14 @@ struct leapraid_smp_passthrough_req { /** * struct leapraid_smp_passthrough_rep - SMP passthrough reply * - * @passthrough_flg: Passthrough flags echoed - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @resp_data_len: Length of response data - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved + * @passthrough_flg: Passthrough flags echoed. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @resp_data_len: Length of response data. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. */ struct leapraid_smp_passthrough_rep { u8 passthrough_flg; @@ -2053,13 +2052,13 @@ struct leapraid_smp_passthrough_rep { }; /** - * struct leapraid_sas_io_unit_ctrl_req - SAS IO unit control request + * struct leapraid_sas_io_unit_ctrl_req - SAS I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_sas_io_unit_ctrl_req { u8 op; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index f838bd5aa20e..25ec57c2ce4b 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -1,23 +1,22 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/compat.h> #include <linux/module.h> #include <linux/miscdevice.h> #include "leapraid_func.h" -/* ioctl device file */ +/* IOCTL device file name. */ #define LEAPRAID_DEV_NAME "leapraid_ctl" -/* ioctl version */ +/* IOCTL version. */ #define LEAPRAID_IOCTL_VERSION 0x07 -/* ioctl command */ +/* IOCTL commands. */ #define LEAPRAID_ADAPTER_INFO 17 #define LEAPRAID_COMMAND 20 #define LEAPRAID_EVENTQUERY 21 @@ -25,9 +24,10 @@ /** * struct leapraid_ioctl_header - IOCTL command header - * @adapter_id : Adapter identifier - * @port_number: Port identifier - * @max_data_size: Maximum data size for transfer + * + * @adapter_id : Adapter identifier. + * @port_number: Port identifier. + * @max_data_size: Maximum data size for transfer. */ struct leapraid_ioctl_header { u32 adapter_id; @@ -37,7 +37,8 @@ struct leapraid_ioctl_header { /** * struct leapraid_ioctl_diag_reset - Diagnostic reset request - * @hdr: Common IOCTL header + * + * @hdr: Common IOCTL header. */ struct leapraid_ioctl_diag_reset { struct leapraid_ioctl_header hdr; @@ -45,12 +46,13 @@ struct leapraid_ioctl_diag_reset { /** * struct leapraid_ioctl_pci_info - PCI device information - * @u: Union holding PCI bus/device/function information - * @u.bits.dev: PCI device number - * @u.bits.func: PCI function number - * @u.bits.bus: PCI bus number - * @u.word: Combined representation of PCI BDF - * @seg_id: PCI segment identifier + * + * @u: Union holding PCI bus/device/function information. + * @u.bits.dev: PCI device number. + * @u.bits.func: PCI function number. + * @u.bits.bus: PCI bus number. + * @u.word: Combined representation of PCI BDF. + * @seg_id: PCI segment identifier. */ struct leapraid_ioctl_pci_info { union { @@ -66,21 +68,22 @@ struct leapraid_ioctl_pci_info { /** * struct leapraid_ioctl_adapter_info - Adapter information for IOCTL - * @hdr: IOCTL header - * @adapter_type: Adapter type identifier - * @port_number: Port number - * @pci_id: PCI device ID - * @revision: Revision number - * @sub_dev: Subsystem device ID - * @sub_vendor: Subsystem vendor ID - * @r0: Reserved - * @fw_ver: Firmware version - * @bios_ver: BIOS version - * @driver_ver: Driver version - * @r1: Reserved - * @scsi_id: SCSI ID - * @r2: Reserved - * @pci_info: PCI information structure + * + * @hdr: IOCTL header. + * @adapter_type: Adapter type identifier. + * @port_number: Port number. + * @pci_id: PCI device ID. + * @revision: Revision number. + * @sub_dev: Subsystem device ID. + * @sub_vendor: Subsystem vendor ID. + * @r0: Reserved. + * @fw_ver: Firmware version. + * @bios_ver: BIOS version. + * @driver_ver: Driver version. + * @r1: Reserved. + * @scsi_id: SCSI ID. + * @r2: Reserved. + * @pci_info: PCI information structure. */ struct leapraid_ioctl_adapter_info { struct leapraid_ioctl_header hdr; @@ -102,18 +105,19 @@ struct leapraid_ioctl_adapter_info { /** * struct leapraid_ioctl_command - IOCTL command structure - * @hdr: IOCTL header - * @timeout: Command timeout - * @rep_msg_buf_ptr: User pointer to reply message buffer - * @c2h_buf_ptr: User pointer to card-to-host data buffer - * @h2c_buf_ptr: User pointer to host-to-card data buffer - * @sense_data_ptr: User pointer to sense data buffer - * @max_rep_bytes: Maximum reply bytes - * @c2h_size: Card-to-host data size - * @h2c_size: Host-to-card data size - * @max_sense_bytes: Maximum sense data bytes - * @data_sge_offset: Data SGE offset - * @mf: Message frame data (flexible array) + * + * @hdr: IOCTL header. + * @timeout: Command timeout. + * @rep_msg_buf_ptr: User pointer to reply message buffer. + * @c2h_buf_ptr: User pointer to card-to-host data buffer. + * @h2c_buf_ptr: User pointer to host-to-card data buffer. + * @sense_data_ptr: User pointer to sense data buffer. + * @max_rep_bytes: Maximum reply bytes. + * @c2h_size: Card-to-host data size. + * @h2c_size: Host-to-card data size. + * @max_sense_bytes: Maximum sense data bytes. + * @data_sge_offset: Data SGE offset. + * @mf: Message frame data (flexible array). */ struct leapraid_ioctl_command { struct leapraid_ioctl_header hdr; @@ -146,39 +150,38 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } -static void leapraid_cli_scsiio_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, u16 taskid, +static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_mpi_req, + u16 taskid, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, u16 dev_hdl, void *psge) { - struct leapraid_mpi_scsiio_req *scsiio_request = - (struct leapraid_mpi_scsiio_req *)ctl_sp_mpi_req; + struct leapraid_mpi_scsiio_req *scsiio_request = ctl_sp_mpi_req; scsiio_request->sense_buffer_len = SCSI_SENSE_BUFFERSIZE; scsiio_request->sense_buffer_low_add = - leapraid_get_sense_buffer_dma(adapter, taskid); - memset((void *)(&adapter->driver_cmds.ctl_cmd.sense), + leapraid_get_sense_buffer_dma(adapter, taskid); + memset(&adapter->driver_cmds.ctl_cmd.sense, 0, SCSI_SENSE_BUFFERSIZE); leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); - if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO_REQ) + if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO) leapraid_fire_scsi_io(adapter, taskid, dev_hdl); else leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - u16 taskid, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, void *h2c) +static int leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, + u16 taskid, + dma_addr_t h2c_dma_addr, + size_t h2c_size, + dma_addr_t c2h_dma_addr, + size_t c2h_size, + void *psge, void *h2c) { - struct leapraid_smp_passthrough_req *smp_pt_req = - (struct leapraid_smp_passthrough_req *)ctl_sp_mpi_req; + struct leapraid_smp_passthrough_req *smp_pt_req = ctl_sp_req; u8 *data; if (!adapter->adapter_attr.enable_mp) @@ -188,83 +191,49 @@ static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, else data = h2c; - if (data[1] == LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG && - (data[10] == 1 || data[10] == 2)) - adapter->reset_desc.adapter_link_resetting = true; + if (!(smp_pt_req->passthrough_flg & LEAPRAID_SMP_PT_FLAG_SGL_PTR) && + h2c_size <= 10) { + dev_err(&adapter->pdev->dev, + "%s: Invalid request size=%zu\n", + __func__, h2c_size); + return -EINVAL; + } + + if (data[1] == SMP_PHY_CONTROL && + (data[10] == SMP_PHY_CONTROL_LINK_RESET || + data[10] == SMP_PHY_CONTROL_HARD_RESET)) + adapter->reset_desc.adapter_link_resetting = 1; + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); + return 0; } -static void leapraid_ctl_fire_ieee_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size); - leapraid_fire_task(adapter, taskid); -} - -static void leapraid_ctl_sata_passthrough_cmd(struct leapraid_adapter *adapter, +static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, void *psge, u16 taskid) { - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static void leapraid_ctl_load_fw_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} + struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctl_req = ctl_sp_req; -static void leapraid_ctl_fire_mpi_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ + if (sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || + sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) + adapter->reset_desc.adapter_link_resetting = 1; leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) +static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, + struct leapraid_ioctl_command *karg, + void __user *mf) { - struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctrl_req = - (struct leapraid_sas_io_unit_ctrl_req *)ctl_sp_mpi_req; - - if (sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || - sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) - adapter->reset_desc.adapter_link_resetting = true; - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, - struct leapraid_ioctl_command *karg, - void __user *mf) -{ - struct leapraid_req *leap_mpi_req = NULL; - struct leapraid_req *ctl_sp_mpi_req = NULL; + struct leapraid_req *leap_mpi_req; + struct leapraid_req *ctl_sp_mpi_req; u16 taskid; void *h2c = NULL; size_t h2c_size = 0; @@ -277,74 +246,88 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; u32 sz; - long rc = 0; + int rc; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + return rc; leap_mpi_req = kzalloc(LEAPRAID_REQUEST_SIZE, GFP_KERNEL); - if (!leap_mpi_req) { - rc = -ENOMEM; - goto out; - } + if (!leap_mpi_req) + return -ENOMEM; - if (karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > LEAPRAID_REQUEST_SIZE || - karg->data_sge_offset > ((UINT_MAX) / LEAPRAID_SGE_OFFSET_SIZE)) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || + karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > + LEAPRAID_REQUEST_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); rc = -EINVAL; - goto out; + goto out_cleanup; } if (copy_from_user(leap_mpi_req, mf, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy request message from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset((void *)(&adapter->driver_cmds.ctl_cmd.reply), 0, - LEAPRAID_REPLY_SIEZ); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, + LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); memcpy(ctl_sp_mpi_req, leap_mpi_req, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); - if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_hdl = le16_to_cpu(ctl_sp_mpi_req->func_dep1); - if (!dev_hdl || dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + if (!dev_hdl || + dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_err(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } } - if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) - return -EINVAL; + if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) { + rc = -EINVAL; + goto out_cleanup; + } h2c_size = karg->h2c_size; c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, - &h2c_dma_addr, GFP_ATOMIC); + &h2c_dma_addr, GFP_KERNEL); if (!h2c) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (copy_from_user(h2c, karg->h2c_buf_ptr, h2c_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy h2c from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } } if (c2h_size) { - c2h = dma_alloc_coherent(&adapter->pdev->dev, - c2h_size, &c2h_dma_addr, GFP_ATOMIC); + c2h = dma_alloc_coherent(&adapter->pdev->dev, c2h_size, + &c2h_dma_addr, GFP_KERNEL); if (!c2h) { rc = -ENOMEM; - goto out; + goto out_cleanup; } } @@ -353,13 +336,9 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { - case LEAPRAID_FUNC_SCSIIO_REQ: - case LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_cli_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + leapraid_ctl_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size, dev_hdl, psge); @@ -367,28 +346,26 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, case LEAPRAID_FUNC_SMP_PASSTHROUGH: if (!h2c) { rc = -EINVAL; - goto out; + goto out_cleanup; } - leapraid_ctl_smp_passthrough_cmd(adapter, - ctl_sp_mpi_req, taskid, - h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size, - psge, h2c); + rc = leapraid_ctl_smp_passthrough_cmd(adapter, + ctl_sp_mpi_req, taskid, + h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size, + psge, h2c); + if (rc) + goto out_cleanup; break; - case LEAPRAID_FUNC_SATA_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_ctl_sata_passthrough_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_FW_DOWNLOAD: case LEAPRAID_FUNC_FW_UPLOAD: - leapraid_ctl_load_fw_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: leapraid_ctl_sas_io_unit_ctrl_cmd(adapter, ctl_sp_mpi_req, @@ -397,23 +374,27 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, psge, taskid); break; default: - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, + h2c_size, c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; } timeout = karg->timeout; if (timeout < LEAPRAID_CTL_CMD_TIMEOUT) timeout = LEAPRAID_CTL_CMD_TIMEOUT; - wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, - timeout * HZ); + if (!wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, + timeout * HZ)) { + dev_err(&adapter->pdev->dev, + "%s: ctl_cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.ctl_cmd.status); + } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || leap_mpi_req->func == LEAPRAID_FUNC_SAS_IO_UNIT_CTRL) && - adapter->reset_desc.adapter_link_resetting) { - adapter->reset_desc.adapter_link_resetting = false; - } + adapter->reset_desc.adapter_link_resetting) + adapter->reset_desc.adapter_link_resetting = 0; + if (!(adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE)) { issue_reset = leapraid_check_reset( @@ -421,57 +402,66 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto reset; } - if (c2h_size) { - if (copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { - rc = -ENODATA; - goto out; - } + if (c2h_size && copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy c2h to user\n", __func__); + rc = -ENODATA; + goto out_cleanup; } if (karg->max_rep_bytes) { - sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIEZ); + sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIZE); if (copy_to_user(karg->rep_msg_buf_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.reply, + &adapter->driver_cmds.ctl_cmd.reply, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy reply to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } if (karg->max_sense_bytes && - (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH)) { + (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH)) { if (!karg->sense_data_ptr) - goto out; + goto out_cleanup; sz = min_t(u32, karg->max_sense_bytes, SCSI_SENSE_BUFFERSIZE); if (copy_to_user(karg->sense_data_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.sense, + &adapter->driver_cmds.ctl_cmd.sense, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy sense data to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } reset: if (issue_reset) { rc = -ENODATA; - if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - leap_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_err(&adapter->pdev->dev, - "fire tgt reset: hdl=0x%04x\n", + "Fire tgt reset, hdl=0x%04x\n", le16_to_cpu(leap_mpi_req->func_dep1)); - leapraid_issue_locked_tm(adapter, + leapraid_issue_locked_tm( + adapter, le16_to_cpu(leap_mpi_req->func_dep1), 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } else { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } } -out: +out_cleanup: if (c2h) dma_free_coherent(&adapter->pdev->dev, c2h_size, c2h, c2h_dma_addr); @@ -483,12 +473,12 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, return rc; } -static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, - void __user *arg) +static int leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, + void __user *arg) { struct leapraid_ioctl_adapter_info *karg; - ssize_t __maybe_unused ret; u8 revision; + int rc = 0; karg = kzalloc(sizeof(*karg), GFP_KERNEL); if (!karg) @@ -504,80 +494,98 @@ static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, karg->pci_info.u.bits.func = PCI_FUNC(adapter->pdev->devfn); karg->pci_info.seg_id = pci_domain_nr(adapter->pdev->bus); karg->fw_ver = adapter->adapter_attr.features.fw_version; - ret = strscpy(karg->driver_ver, LEAPRAID_DRIVER_NAME, - sizeof(karg->driver_ver)); - strcat(karg->driver_ver, "-"); - strcat(karg->driver_ver, LEAPRAID_DRIVER_VERSION); + + snprintf(karg->driver_ver, sizeof(karg->driver_ver), "%s-%s", + LEAPRAID_DRIVER_NAME, LEAPRAID_DRIVER_VERSION); + karg->adapter_type = LEAPRAID_IOCTL_VERSION; karg->bios_ver = adapter->adapter_attr.bios_version; if (copy_to_user(arg, karg, sizeof(struct leapraid_ioctl_adapter_info))) { - kfree(karg); - return -EFAULT; + dev_err(&adapter->pdev->dev, + "%s: Failed to copy info to user\n", __func__); + rc = -EFAULT; + goto free_buf; } +free_buf: kfree(karg); - return 0; + return rc; } -static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, - void __user *arg, u8 compat) +static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, + void __user *arg) { struct leapraid_ioctl_header ioctl_header; struct leapraid_adapter *adapter; - long rc = -ENOIOCTLCMD; - int count; - - if (copy_from_user(&ioctl_header, (char __user *)arg, - sizeof(struct leapraid_ioctl_header))) + struct leapraid_ioctl_command __user *uarg; + struct leapraid_ioctl_command karg; + int rc = -ENOIOCTLCMD; + + if (copy_from_user(&ioctl_header, arg, + sizeof(struct leapraid_ioctl_header))) { + pr_err("%s:%s: Failed to copy header from user\n", + LEAPRAID_DRIVER_NAME, __func__); return -EFAULT; + } adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); if (!adapter) return -EFAULT; + if (atomic_read(&adapter->overheat_desc.thermal_alert)) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, thermal_alert=%d\n", + __func__, + atomic_read(&adapter->overheat_desc.thermal_alert)); + return -EFAULT; + } + mutex_lock(&adapter->access_ctrl.pci_access_lock); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_LONG, + __func__); if (rc) - goto out; + goto unlock; - count = LEAPRAID_WAIT_SHOST_RECOVERY; - while (count--) { - if (!adapter->access_ctrl.shost_recovering) - break; - ssleep(1); + if (!wait_event_timeout(adapter->access_ctrl.shost_recover_wq, + !adapter->access_ctrl.shost_recover_async, + LEAPRAID_WAIT_SHOST_RECOVERY * HZ)) { + dev_warn(&adapter->pdev->dev, + "Timeout waiting for shost recovery async\n"); + rc = -EAGAIN; + goto unlock; } - if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || + if (adapter->access_ctrl.pcie_recovering || adapter->scan_dev_desc.driver_loading || adapter->access_ctrl.host_removing) { rc = -EAGAIN; - goto out; + goto unlock; } if (file->f_flags & O_NONBLOCK) { if (!mutex_trylock(&adapter->driver_cmds.ctl_cmd.mutex)) { rc = -EAGAIN; - goto out; + goto unlock; } - } else if (mutex_lock_interruptible(&adapter->driver_cmds.ctl_cmd.mutex)) { + } else if (mutex_lock_interruptible(&adapter->driver_cmds + .ctl_cmd.mutex)) { rc = -ERESTARTSYS; - goto out; + goto unlock; } switch (_IOC_NR(cmd)) { case LEAPRAID_ADAPTER_INFO: - if (_IOC_SIZE(cmd) == sizeof(struct leapraid_ioctl_adapter_info)) + if (_IOC_SIZE(cmd) == + sizeof(struct leapraid_ioctl_adapter_info)) rc = leapraid_ctl_get_adapter_info(adapter, arg); break; case LEAPRAID_COMMAND: - { - struct leapraid_ioctl_command __user *uarg; - struct leapraid_ioctl_command karg; - if (copy_from_user(&karg, arg, sizeof(karg))) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy data from user\n", + __func__); rc = -EFAULT; break; } @@ -591,61 +599,77 @@ static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, uarg = arg; rc = leapraid_ctl_do_command(adapter, &karg, &uarg->mf); + if (rc) + dev_warn(&adapter->pdev->dev, + "%s: IOCTL cmd failed rc=%d\n", + __func__, rc); } break; - } case LEAPRAID_EVENTQUERY: case LEAPRAID_EVENTREPORT: rc = 0; break; default: - pr_err("unknown ioctl opcode=0x%08x\n", cmd); + dev_err(&adapter->pdev->dev, + "Unknown IOCTL opcode=0x%08x\n", cmd); break; } mutex_unlock(&adapter->driver_cmds.ctl_cmd.mutex); -out: +unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); return rc; } +static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + return -ENOTTY; +} + static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - return leapraid_ctl_ioctl_main(file, cmd, - (void __user *)arg, 0); + return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { struct leapraid_adapter *adapter; + /* Userspace passes the adapter ID via vma->vm_pgoff. */ + u32 adapter_id = vma->vm_pgoff; unsigned long length; - unsigned long pfn; + int rc; length = vma->vm_end - vma->vm_start; - adapter = list_first_entry(&leapraid_adapter_list, - struct leapraid_adapter, list); + adapter = leapraid_ctl_lookup_adapter(adapter_id); + if (!adapter) { + pr_err("%s: No adapter found!\n", __func__); + return -EINVAL; + } if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, - "requested mapping size is too large!\n"); + "Requested mapping size is too large!\n"); return -EINVAL; } if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, "no log buffer!\n"); + dev_err(&adapter->pdev->dev, "No log buffer!\n"); return -EINVAL; } - pfn = virt_to_phys(adapter->fw_log_desc.fw_log_buffer) >> PAGE_SHIFT; + vma->vm_pgoff = 0; - if (remap_pfn_range(vma, vma->vm_start, pfn, length, - vma->vm_page_prot)) { + rc = dma_mmap_coherent(&adapter->pdev->dev, vma, + adapter->fw_log_desc.fw_log_buffer, + adapter->fw_log_desc.fw_log_buffer_dma, + length); + if (rc) { dev_err(&adapter->pdev->dev, - "failed to map memory to user space!\n"); - return -EAGAIN; + "Failed to map memory to user space!\n"); + return rc; } return 0; @@ -655,6 +679,7 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, + .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { @@ -663,10 +688,14 @@ static struct miscdevice leapraid_ctl_dev = { .fops = &leapraid_ctl_fops, }; -void leapraid_ctl_init(void) +int leapraid_ctl_init(void) { - if (misc_register(&leapraid_ctl_dev) < 0) - pr_err("%s can't register misc device\n", LEAPRAID_DRIVER_NAME); + if (misc_register(&leapraid_ctl_dev) < 0) { + pr_err("%s Can't register misc device\n", + LEAPRAID_DRIVER_NAME); + return -ENODEV; + } + return 0; } void leapraid_ctl_exit(void) diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 5dfe95a8dd84..01096664d122 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -22,11 +21,12 @@ MODULE_PARM_DESC(smart_poll, static int interrupt_mode; module_param(interrupt_mode, int, 0444); MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 for MSI-X, 1 for MSI, 2 for legacy. (default=0)"); + "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); + -static int max_msix_vectors = -1; +static int max_msix_vectors = LEAPRAID_INVALID_MSIX_VECTORS; module_param(max_msix_vectors, int, 0444); -MODULE_PARM_DESC(max_msix_vectors, " max msix vectors"); +MODULE_PARM_DESC(max_msix_vectors, "max msix vectors"); static void leapraid_remove_device(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev); @@ -35,11 +35,48 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_address, struct leapraid_card_port *port); +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +{ + struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; + u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + bool changed = false; + int i; + + if (leapraid_should_skip_poll_work(adapter)) + return; + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { + debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); + if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) + changed = true; + } + + if (!changed) + return; + + memcpy(adapter->fw_log_desc.pre_debug_log, + debug_log, + sizeof(debug_log)); + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; + i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) + dev_warn(&adapter->pdev->dev, + "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", + i, + i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, + debug_log[i], + debug_log[i + 1], + debug_log[i + 2], + debug_log[i + 3]); +} static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -53,12 +90,14 @@ bool leapraid_pci_removed(struct leapraid_adapter *adapter) struct pci_dev *pdev = adapter->pdev; u32 vendor_id; - if (pci_bus_read_config_dword(pdev->bus, pdev->devfn, PCI_VENDOR_ID, + if (pci_bus_read_config_dword(pdev->bus, + pdev->devfn, + PCI_VENDOR_ID, &vendor_id)) return true; - return ((vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != - LEAPRAID_VENDOR_ID); + return (vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != + LEAPRAID_VENDOR_ID; } static bool leapraid_pci_active(struct leapraid_adapter *adapter) @@ -78,14 +117,14 @@ void *leapraid_get_reply_vaddr(struct leapraid_adapter *adapter, u32 rep_paddr) void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.task_desc + - (taskid * LEAPRAID_REQUEST_SIZE)); + return adapter->mem_desc.task_desc + + taskid * LEAPRAID_REQUEST_SIZE; } void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.sense_data + - ((taskid - 1) * SCSI_SENSE_BUFFERSIZE)); + return adapter->mem_desc.sense_data + + (taskid - 1) * SCSI_SENSE_BUFFERSIZE; } __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -99,7 +138,7 @@ void leapraid_mask_int(struct leapraid_adapter *adapter) { u32 reg; - adapter->mask_int = true; + adapter->mask_int = 1; reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg |= LEAPRAID_TO_SYS_DB_MASK + LEAPRAID_REPLY_INT_MASK + LEAPRAID_RESET_IRQ_MASK; @@ -114,35 +153,59 @@ void leapraid_unmask_int(struct leapraid_adapter *adapter) reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg &= ~LEAPRAID_REPLY_INT_MASK; writel(reg, &adapter->iomem_base->host_int_mask); - adapter->mask_int = false; + adapter->mask_int = 0; } -static void leapraid_flush_io_and_panic(struct leapraid_adapter *adapter) +static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) { - adapter->access_ctrl.adapter_thermal_alert = true; - leapraid_smart_polling_stop(adapter); - leapraid_fw_log_stop(adapter); - leapraid_mq_polling_pause(adapter); - leapraid_clean_active_scsi_cmds(adapter); + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + + if (!adapter) + return; + + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_warn(&pdev->dev, + "Overheat suspend failed, invalid host or adapter\n"); + return; + } + + wq = adapter->overheat_desc.fault_overheat_wq; + if (!wq) + return; + + if (atomic_cmpxchg(&adapter->overheat_desc.thermal_alert, 0, 1)) + return; + + queue_work(wq, &adapter->overheat_desc.fault_overheat_work); } -static void leapraid_check_panic_needed(struct leapraid_adapter *adapter, - u32 db, u32 adapter_state) +static void leapraid_stop_adapter_on_fault(struct leapraid_adapter *adapter, + u32 db) { - bool fault_1 = adapter_state == LEAPRAID_DB_MASK; - bool fault_2 = (adapter_state == LEAPRAID_DB_FAULT) && - ((db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE); + u32 adapter_state = db & LEAPRAID_DB_MASK; + bool fault_1 = false; + bool fault_2 = false; + + fault_1 = adapter_state == LEAPRAID_DB_MASK; + fault_2 = adapter_state == LEAPRAID_DB_FAULT && + (db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE; if (!fault_1 && !fault_2) return; if (fault_1) - pr_err("%s, doorbell status 0xFFFF!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Doorbell status 0xFFFF!\n", __func__); else - pr_err("%s, adapter overheating detected!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Adapter overheating detected!\n", __func__); - leapraid_flush_io_and_panic(adapter); - panic("%s overheating detected, panic now!!!\n", __func__); + leapraid_overheat_suspend(adapter); } u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) @@ -152,38 +215,40 @@ u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) db = leapraid_readl(&adapter->iomem_base->db); adapter_state = db & LEAPRAID_DB_MASK; - leapraid_check_panic_needed(adapter, db, adapter_state); + leapraid_stop_adapter_on_fault(adapter, db); return adapter_state; } static bool leapraid_wait_adapter_ready(struct leapraid_adapter *adapter) { u32 cur_state; - u32 cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { cur_state = leapraid_get_adapter_state(adapter); + if (cur_state == LEAPRAID_DB_READY) return true; if (cur_state == LEAPRAID_DB_FAULT) break; usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } return false; } static int leapraid_db_wait_int_host(struct leapraid_adapter *adapter) { - u32 cnt = LEAPRAID_DB_WAIT_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_DB_WAIT_MAX_RETRY; cnt > 0; cnt--) { if (leapraid_readl(&adapter->iomem_base->host_int_status) & LEAPRAID_ADAPTER2HOST_DB_STATUS) return 0; + udelay(LEAPRAID_DB_WAIT_DELAY_US); - } while (--cnt); + } return -EFAULT; } @@ -194,25 +259,26 @@ static int leapraid_db_wait_ack_and_clear_int(struct leapraid_adapter *adapter) u32 int_status; u32 cnt; - cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { int_status = leapraid_readl(&adapter->iomem_base->host_int_status); - if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) { + + if (int_status == 0xFFFFFFFF) + return -EFAULT; + + if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) return 0; - } else if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { + + if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state == LEAPRAID_DB_FAULT) return -EFAULT; - } else if (int_status == 0xFFFFFFFF) { - goto out; } usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } -out: return -EFAULT; } @@ -222,8 +288,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, { int failed, i; - if ((leapraid_readl(&adapter->iomem_base->db) & - LEAPRAID_DB_USED)) { + if (leapraid_readl(&adapter->iomem_base->db) & LEAPRAID_DB_USED) { dev_err(&adapter->pdev->dev, "doorbell used\n"); return -EFAULT; } @@ -238,7 +303,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, &adapter->iomem_base->db); if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -246,7 +311,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, writel(0, &adapter->iomem_base->host_int_status); if (leapraid_db_wait_ack_and_clear_int(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -254,12 +319,12 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0, failed = 0; i < req_bytes / LEAPRAID_DWORDS_BYTE_SIZE && !failed; i++) { - writel((u32)(req[i]), &adapter->iomem_base->db); + writel((u32)req[i], &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) failed = 1; } if (failed) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -267,7 +332,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0; i < rep_bytes / LEAPRAID_WORD_BYTE_SIZE; i++) { if (leapraid_db_wait_int_host(adapter)) { dev_err(&adapter->pdev->dev, - "%d:wait db interrupt timeout\n", __LINE__); + "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } rep[i] = (u16)(leapraid_readl(&adapter->iomem_base->db) @@ -276,7 +341,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, } if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -286,28 +351,32 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, return 0; } -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter) +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller) { - int wait_count = LEAPRAID_DB_WAIT_OPERATIONAL; + int wait_count; - do { - if (leapraid_pci_removed(adapter)) + for (wait_count = wait; wait_count > 0; wait_count--) { + if (leapraid_pci_removed(adapter)) { + dev_warn(&adapter->pdev->dev, + "%s: PCI device removed\n", __func__); return -EFAULT; + } if (leapraid_get_adapter_state(adapter) == LEAPRAID_DB_OPERATIONAL) return 0; - dev_info(&adapter->pdev->dev, - "waiting for adapter to become op status(cnt=%d)\n", - LEAPRAID_DB_WAIT_OPERATIONAL - wait_count); + dev_dbg(&adapter->pdev->dev, + "%s: Wait for adapter to become op status(cnt=%d)\n", + caller, wait - wait_count); ssleep(1); - } while (--wait_count); + } dev_err(&adapter->pdev->dev, - "adapter failed to become op state, last state=%d\n", - leapraid_get_adapter_state(adapter)); + "%s: Adapter failed to become op state, last state=%d\n", + caller, leapraid_get_adapter_state(adapter)); return -EFAULT; } @@ -325,7 +394,7 @@ struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (scmd) - return leapraid_get_scmd_priv(scmd); + return (struct leapraid_io_req_tracker *)scmd->host_scribble; return NULL; } @@ -350,7 +419,8 @@ static u8 leapraid_get_cb_idx(struct leapraid_adapter *adapter, u16 taskid) } struct scsi_cmnd *leapraid_get_scmd_from_taskid( - struct leapraid_adapter *adapter, u16 taskid) + struct leapraid_adapter *adapter, + u16 taskid) { struct leapraid_scsiio_req *leap_mpi_req; struct leapraid_io_req_tracker *st; @@ -367,7 +437,7 @@ struct scsi_cmnd *leapraid_get_scmd_from_taskid( scmd = scsi_host_find_tag(adapter->shost, uniq_tag); if (scmd) { - st = leapraid_get_scmd_priv(scmd); + st = (struct leapraid_io_req_tracker *)scmd->host_scribble; if (st && st->taskid == taskid) return scmd; } @@ -383,8 +453,8 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, u32 tag = scmd->request->tag; scmd->host_scribble = - (unsigned char *)(&adapter->mem_desc.io_tracker[tag]); - request = leapraid_get_scmd_priv(scmd); + (unsigned char *)&adapter->mem_desc.io_tracker[tag]; + request = (struct leapraid_io_req_tracker *)scmd->host_scribble; taskid = tag + 1; request->taskid = taskid; request->scmd = scmd; @@ -401,8 +471,9 @@ static void leapraid_check_pending_io(struct leapraid_adapter *adapter) } } -static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +static void leapraid_clear_io_tracker( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (!io_tracker) return; @@ -416,17 +487,18 @@ static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, u16 taskid) { - return (taskid == adapter->driver_cmds.ctl_cmd.taskid || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid || - taskid == adapter->driver_cmds.tm_cmd.hp_taskid || - taskid == adapter->driver_cmds.ctl_cmd.hp_taskid || - taskid == adapter->driver_cmds.scan_dev_cmd.inter_taskid || - taskid == adapter->driver_cmds.timestamp_sync_cmd.inter_taskid || - taskid == adapter->driver_cmds.raid_action_cmd.inter_taskid || - taskid == adapter->driver_cmds.transport_cmd.inter_taskid || - taskid == adapter->driver_cmds.cfg_op_cmd.inter_taskid || - taskid == adapter->driver_cmds.enc_cmd.inter_taskid || - taskid == adapter->driver_cmds.notify_event_cmd.inter_taskid); + struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; + + return (taskid == driver_cmds->ctl_cmd.taskid || + taskid == driver_cmds->driver_scsiio_cmd.taskid || + taskid == driver_cmds->tm_cmd.hp_taskid || + taskid == driver_cmds->ctl_cmd.hp_taskid || + taskid == driver_cmds->scan_dev_cmd.inter_taskid || + taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || + taskid == driver_cmds->transport_cmd.inter_taskid || + taskid == driver_cmds->cfg_op_cmd.inter_taskid || + taskid == driver_cmds->enc_cmd.inter_taskid || + taskid == driver_cmds->notify_event_cmd.inter_taskid); } void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid) @@ -516,6 +588,7 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) { struct leapraid_io_req_tracker *io_tracker; struct scsi_cmnd *scmd; + void *task_desc; u16 taskid; for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { @@ -523,15 +596,17 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) if (!scmd) continue; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; if (io_tracker && io_tracker->taskid == 0) continue; scsi_dma_unmap(scmd); + task_desc = leapraid_get_task_desc(adapter, taskid); + memset(task_desc, 0, LEAPRAID_REQUEST_SIZE); leapraid_clear_io_tracker(adapter, io_tracker); if (!leapraid_pci_active(adapter) || adapter->reset_desc.adapter_reset_results != 0 || - adapter->access_ctrl.adapter_thermal_alert || + atomic_read(&adapter->overheat_desc.thermal_alert) || adapter->access_ctrl.host_removing) scmd->result = DID_NO_CONNECT << 16; else @@ -540,36 +615,37 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) } } -static void leapraid_clean_active_driver_cmd( - struct leapraid_driver_cmd *driver_cmd) +static void leapraid_clean_active_driver_cmd(struct leapraid_driver_cmd *cmd) { - if (driver_cmd->status & LEAPRAID_CMD_PENDING) { - driver_cmd->status |= LEAPRAID_CMD_RESET; - complete(&driver_cmd->done); + if (cmd->status & LEAPRAID_CMD_PENDING) { + cmd->status |= LEAPRAID_CMD_RESET; + complete(&cmd->done); } } static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) { - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.raid_action_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.driver_scsiio_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.tm_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.transport_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.enc_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.notify_event_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.cfg_op_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.ctl_cmd); - - if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { - adapter->scan_dev_desc.scan_dev_failed = true; - adapter->driver_cmds.scan_dev_cmd.status |= LEAPRAID_CMD_RESET; + struct leapraid_driver_cmds *driver_cmds; + + driver_cmds = &adapter->driver_cmds; + leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->notify_event_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->cfg_op_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->ctl_cmd); + + if (driver_cmds->scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { + adapter->scan_dev_desc.scan_dev_failed = 1; + driver_cmds->scan_dev_cmd.status |= LEAPRAID_CMD_RESET; if (adapter->scan_dev_desc.driver_loading) { adapter->scan_dev_desc.scan_start_failed = LEAPRAID_ADAPTER_STATUS_INTERNAL_ERROR; - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; } else { - complete(&adapter->driver_cmds.scan_dev_cmd.done); + complete(&driver_cmds->scan_dev_cmd.done); } } } @@ -577,10 +653,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) static void leapraid_clean_active_cmds(struct leapraid_adapter *adapter) { leapraid_clean_active_driver_cmds(adapter); - memset(adapter->dev_topo.pending_dev_add, 0, - adapter->dev_topo.pending_dev_add_sz); - memset(adapter->dev_topo.dev_removing, 0, - adapter->dev_topo.dev_removing_sz); leapraid_clean_active_fw_evt(adapter); leapraid_clean_active_scsi_cmds(adapter); } @@ -589,9 +661,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; unsigned long flags = 0; - u32 adapter_state = 0; + u32 adapter_state; if (adapter->access_ctrl.pcie_recovering) return; @@ -600,15 +672,15 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -622,9 +694,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_card_port *port = NULL; - u64 sas_address = 0; + struct leapraid_sas_dev *sas_dev; + struct leapraid_card_port *port; + u64 sas_address; unsigned long flags; u32 adapter_state; @@ -635,15 +707,15 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; sas_address = sas_dev->sas_addr; port = sas_dev->card_port; } @@ -657,26 +729,30 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) leapraid_sdev_put(sas_dev); } -static inline void leapraid_single_mpi_sg_append(struct leapraid_adapter *adapter, - void *sge, u32 flag_and_len, - dma_addr_t dma_addr) +static inline void leapraid_single_mpi_sg_append( + struct leapraid_adapter *adapter, + void *sge, + u32 flag_and_len, + dma_addr_t dma_addr) { if (adapter->adapter_attr.use_32_dma_mask) { - ((struct leapraid_sge_simple32 *)sge)->flg_and_len = + struct leapraid_sge_simple32 *sge32 = sge; + + sge32->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_32 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple32 *)sge)->addr = - cpu_to_le32(dma_addr); + sge32->addr = cpu_to_le32(dma_addr); } else { - ((struct leapraid_sge_simple64 *)sge)->flg_and_len = + struct leapraid_sge_simple64 *sge64 = sge; + + sge64->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_64 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple64 *)sge)->addr = - cpu_to_le64(dma_addr); + sge64->addr = cpu_to_le64(dma_addr); } } @@ -685,11 +761,12 @@ static inline void leapraid_single_ieee_sg_append(void *sge, u8 flag, u32 len, dma_addr_t dma_addr) { - ((struct leapraid_chain64_ieee_sg *)sge)->flg = flag; - ((struct leapraid_chain64_ieee_sg *)sge)->next_chain_offset = - next_chain_offset; - ((struct leapraid_chain64_ieee_sg *)sge)->len = cpu_to_le32(len); - ((struct leapraid_chain64_ieee_sg *)sge)->addr = cpu_to_le64(dma_addr); + struct leapraid_chain64_ieee_sg *ieee_sg = sge; + + ieee_sg->flg = flag; + ieee_sg->next_chain_offset = next_chain_offset; + ieee_sg->len = cpu_to_le32(len); + ieee_sg->addr = cpu_to_le64(dma_addr); } static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, @@ -697,12 +774,12 @@ static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, { leapraid_single_mpi_sg_append(adapter, sge, - (u32)((LEAPRAID_SGE_FLG_LAST_ONE | - LEAPRAID_SGE_FLG_EOB | - LEAPRAID_SGE_FLG_EOL | - LEAPRAID_SGE_FLG_SIMPLE_ONE) << - LEAPRAID_SGE_FLG_SHIFT), - -1); + (LEAPRAID_SGE_FLG_LAST_ONE | + LEAPRAID_SGE_FLG_EOB | + LEAPRAID_SGE_FLG_EOL | + LEAPRAID_SGE_FLG_SIMPLE_ONE) << + LEAPRAID_SGE_FLG_SHIFT, + LEAPRAID_SGE_NO_DATA_ADDR); } void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, @@ -753,7 +830,7 @@ void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, c2h_size, c2h_dma_addr); } else { - return leapraid_build_nodata_mpi_sg(adapter, sge); + leapraid_build_nodata_mpi_sg(adapter, sge); } } @@ -763,7 +840,9 @@ void leapraid_build_ieee_nodata_sg(struct leapraid_adapter *adapter, void *sge) (LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | LEAPRAID_IEEE_SGE_FLG_EOL), - 0, 0, -1); + 0, + 0, + LEAPRAID_SGE_NO_DATA_ADDR); } int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, @@ -781,7 +860,7 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, u32 chain_offset_in_cur_seg; u32 chain_len_in_cur_seg; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; scsiio_req = leapraid_get_task_desc(adapter, taskid); scmd_sg_cur = scsi_sglist(scmd); sg_entries_left = scsi_dma_map(scmd); @@ -819,7 +898,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, if (chain_offset_in_cur_seg) chain_len_in_cur_seg += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, chain_offset_in_cur_seg, chain_len_in_cur_seg, @@ -829,7 +909,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, goto fill_last_seg; while (sg_entries_in_cur_seg) { - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, 0, sg_dma_len(scmd_sg_cur), @@ -866,39 +947,44 @@ void leapraid_build_ieee_sg(struct leapraid_adapter *adapter, void *sge, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size) { + u32 base_flag; + u32 flag; + + base_flag = LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | + LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR; + if (h2c_size && !c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, h2c_size, h2c_dma_addr); } else if (!h2c_size && c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, c2h_size, c2h_dma_addr); } else if (h2c_size && c2h_size) { leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + base_flag, 0, h2c_size, h2c_dma_addr); sge += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | - LEAPRAID_IEEE_SGE_FLG_EOL, + flag, 0, c2h_size, c2h_dma_addr); } else { - return leapraid_build_ieee_nodata_sg(adapter, sge); + leapraid_build_ieee_nodata_sg(adapter, sge); } } @@ -952,8 +1038,11 @@ static struct leapraid_card_port *leapraid_get_port_by_id( if (unlikely(!adapter->adapter_attr.enable_mp)) { port = kzalloc(sizeof(*port), GFP_ATOMIC); - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed to alloc port\n", __func__); return NULL; + } port->port_id = LEAPRAID_DISABLE_MP_PORT_ID; list_add_tail(&port->list, &adapter->dev_topo.card_port_list); @@ -980,7 +1069,8 @@ struct leapraid_vphy *leapraid_get_vphy_by_phy(struct leapraid_card_port *port, } struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( - struct leapraid_adapter *adapter, u64 sas_address, + struct leapraid_adapter *adapter, + u64 sas_address, struct sas_rphy *rphy) { struct leapraid_sas_dev *sas_dev; @@ -1010,8 +1100,10 @@ struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr( { struct leapraid_sas_dev *sas_dev; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } assert_spin_locked(&adapter->dev_topo.sas_dev_lock); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) @@ -1039,8 +1131,10 @@ struct leapraid_sas_dev *leapraid_get_sas_dev_by_addr( struct leapraid_sas_dev *sas_dev; unsigned long flags; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, @@ -1089,8 +1183,11 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, unsigned long flags; bool del_from_list; - if (!sas_dev) + if (!sas_dev) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid SAS device\n", __func__); return; + } del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); @@ -1100,8 +1197,10 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - if (del_from_list) + if (del_from_list) { + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); + } } static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, @@ -1117,12 +1216,10 @@ static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1147,12 +1244,10 @@ void leapraid_sas_dev_remove_by_sas_address(struct leapraid_adapter *adapter, spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, port); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1166,14 +1261,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_id( struct leapraid_adapter *adapter, uint id, uint channel) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->id == id && - raid_volume->channel == channel) { + if (raid_volume->id == id && raid_volume->channel == channel) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1182,12 +1282,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_hdl( struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->hdl == hdl) + if (raid_volume->hdl == hdl) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1196,12 +1303,19 @@ static struct leapraid_raid_volume *leapraid_raid_volume_find_by_wwid( struct leapraid_adapter *adapter, u64 wwid) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid) + if (raid_volume->wwid == wwid) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1212,6 +1326,7 @@ static void leapraid_raid_volume_add(struct leapraid_adapter *adapter, unsigned long flags; spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_get(raid_volume); list_add_tail(&raid_volume->list, &adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } @@ -1220,11 +1335,24 @@ void leapraid_raid_volume_remove(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume) { unsigned long flags; + bool del_from_list = false; + + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid RAID volume\n", __func__); + return; + } spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_del(&raid_volume->list); - kfree(raid_volume); + if (!list_empty(&raid_volume->list)) { + list_del_init(&raid_volume->list); + del_from_list = true; + } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + leapraid_clear_cached_boot_dev(adapter, raid_volume, RAID_CHANNEL); + if (del_from_list) + leapraid_raid_volume_put(raid_volume); } static struct leapraid_enc_node *leapraid_enc_find_by_hdl( @@ -1232,10 +1360,9 @@ static struct leapraid_enc_node *leapraid_enc_find_by_hdl( { struct leapraid_enc_node *enc_dev; - list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) { + list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) if (le16_to_cpu(enc_dev->pg0.enc_hdl) == hdl) return enc_dev; - } return NULL; } @@ -1246,15 +1373,19 @@ struct leapraid_topo_node *leapraid_exp_find_by_sas_address( { struct leapraid_topo_node *sas_exp; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->sas_address == sas_address && sas_exp->card_port == port) return sas_exp; - } + dev_warn(&adapter->pdev->dev, + "%s: No expander found for SAS addr=0x%016llx port=%p\n", + __func__, (unsigned long long)sas_address, port); return NULL; } @@ -1301,10 +1432,9 @@ static struct leapraid_topo_node *leapraid_exp_find_by_hdl( { struct leapraid_topo_node *sas_exp; - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->hdl == hdl) return sas_exp; - } return NULL; } @@ -1332,7 +1462,7 @@ static enum leapraid_card_port_checking_flg leapraid_get_card_port_feature( return CARD_PORT_FURTHER_CHECKING_NEEDED; } -static int leapraid_process_card_port_feature( +static bool leapraid_process_card_port_feature( struct leapraid_card_port_feature *feature) { struct leapraid_card_port *old_card_port; @@ -1341,8 +1471,10 @@ static int leapraid_process_card_port_feature( if (feature->exact_phy) { feature->checking_state = SAME_PORT_WITH_NOTHING_CHANGED; feature->expected_old_port = old_card_port; - return 1; - } else if (feature->phy_overlap) { + return true; + } + + if (feature->phy_overlap) { if (feature->same_port) { feature->checking_state = SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS; @@ -1353,21 +1485,20 @@ static int leapraid_process_card_port_feature( SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS; feature->expected_old_port = old_card_port; } - } else { - if (feature->checking_state != - SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && - feature->checking_state != - SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { - feature->checking_state = SAME_ADDR_ONLY; - feature->expected_old_port = old_card_port; - feature->same_addr_port_count++; - } + } else if (feature->checking_state != + SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && + feature->checking_state != + SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { + feature->checking_state = SAME_ADDR_ONLY; + feature->expected_old_port = old_card_port; + feature->same_addr_port_count++; } - return 0; + return false; } -static int leapraid_check_card_port(struct leapraid_adapter *adapter, +static int leapraid_check_card_port( + struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_card_port **expected_card_port, int *count) @@ -1413,7 +1544,8 @@ static void leapraid_del_phy_part_of_anther_port( continue; if (card_port_table[i].phy_mask & BIT(offset)) { - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); found = true; @@ -1433,7 +1565,7 @@ static void leapraid_add_or_del_phys_from_existing_port( { struct leapraid_topo_node *card_topo_node; u32 phy_mask_diff; - u32 offset = 0; + u32 offset; card_topo_node = &adapter->dev_topo.card; phy_mask_diff = card_port->phy_mask ^ @@ -1451,12 +1583,15 @@ static void leapraid_add_or_del_phys_from_existing_port( } if (card_topo_node->card_phy[offset].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); - leapraid_transport_attach_phy_to_port(adapter, - card_topo_node, &card_topo_node->card_phy[offset], + leapraid_transport_attach_phy_to_port( + adapter, + card_topo_node, + &card_topo_node->card_phy[offset], card_port->sas_address, card_port); } @@ -1471,7 +1606,8 @@ struct leapraid_sas_dev *leapraid_get_next_sas_dev_from_init_list( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); if (!list_empty(&adapter->dev_topo.sas_dev_init_list)) { sas_dev = list_first_entry(&adapter->dev_topo.sas_dev_init_list, - struct leapraid_sas_dev, list); + struct leapraid_sas_dev, + list); leapraid_sdev_get(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1483,37 +1619,66 @@ static bool leapraid_check_boot_dev_internal(u64 sas_address, u64 dev_name, struct leapraid_boot_dev *boot_dev, u8 form) { + struct leapraid_boot_dev_format_sas_wwid *wwid; + struct leapraid_boot_dev_format_enc_slot *es; + struct leapraid_boot_dev_format_dev_name *dn; + void *pg_dev; + if (!boot_dev) return false; + pg_dev = boot_dev->pg_dev; switch (form & LEAPRAID_BOOTDEV_FORM_MASK) { case LEAPRAID_BOOTDEV_FORM_SAS_WWID: + wwid = pg_dev; + if (!sas_address) return false; - return sas_address == - le64_to_cpu(((struct leapraid_boot_dev_format_sas_wwid *)( - boot_dev->pg_dev))->sas_addr); + return sas_address == le64_to_cpu(wwid->sas_addr); case LEAPRAID_BOOTDEV_FORM_ENC_SLOT: + es = pg_dev; + if (!enc_lid) return false; - return (enc_lid == le64_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->enc_lid) && - slot == le16_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->slot_num)); + return (enc_lid == le64_to_cpu(es->enc_lid) && + slot == le16_to_cpu(es->slot_num)); case LEAPRAID_BOOTDEV_FORM_DEV_NAME: + dn = pg_dev; + if (!dev_name) return false; - return dev_name == le64_to_cpu(((struct leapraid_boot_dev_format_dev_name *)( - boot_dev->pg_dev))->dev_name); + return dev_name == le64_to_cpu(dn->dev_name); case LEAPRAID_BOOTDEV_FORM_NONE: default: return false; } } +void leapraid_boot_dev_get(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_get((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_get((struct leapraid_sas_dev *)dev); +} + +void leapraid_boot_dev_put(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_put((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_put((struct leapraid_sas_dev *)dev); +} + static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, u64 sas_addr, u64 dev_name, u64 enc_lid, u16 slot, @@ -1528,15 +1693,56 @@ static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, slot, boot_dev, boot_dev->form); if (matched) { + leapraid_boot_dev_get(dev, chnl); boot_dev->dev = dev; boot_dev->chnl = chnl; } } +static void leapraid_clear_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, + void *dev, u32 chnl) +{ + void *cached_dev; + u32 cached_chnl; + unsigned long flags; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (boot_dev->dev != dev || boot_dev->chnl != chnl) + goto out_unlock; + + cached_dev = boot_dev->dev; + cached_chnl = boot_dev->chnl; + boot_dev->dev = NULL; + boot_dev->chnl = 0; + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + leapraid_boot_dev_put(cached_dev, cached_chnl); + return; + +out_unlock: + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); +} + +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl) +{ + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + dev, chnl); +} + static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl) { - u64 sas_addr = 0; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + u64 sas_addr; u64 dev_name = 0; u64 enc_lid = 0; u16 slot = 0; @@ -1546,24 +1752,17 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; - + raid_volume = dev; sas_addr = raid_volume->wwid; break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; + sas_dev = dev; sas_addr = sas_dev->sas_addr; dev_name = sas_dev->dev_name; enc_lid = sas_dev->enc_lid; slot = sas_dev->slot; break; } - } leapraid_try_set_boot_dev(&adapter->boot_devs.requested_boot_dev, sas_addr, dev_name, enc_lid, @@ -1576,17 +1775,272 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, slot, dev, chnl); } -static void leapraid_build_and_fire_cfg_req(struct leapraid_adapter *adapter, +static const char *leapraid_func_name(u8 func) +{ + switch (func) { + case LEAPRAID_FUNC_SCSIIO: + return "SCSIIO"; + case LEAPRAID_FUNC_SCSI_TMF: + return "SCSI_TMF"; + case LEAPRAID_FUNC_ADAPTER_INIT: + return "ADAPTER_INIT"; + case LEAPRAID_FUNC_GET_ADAPTER_FEATURES: + return "GET_ADAPTER_FEATURES"; + case LEAPRAID_FUNC_CONFIG_OP: + return "CONFIG_OP"; + case LEAPRAID_FUNC_SCAN_DEV: + return "SCAN_DEV"; + case LEAPRAID_FUNC_EVENT_NOTIFY: + return "EVENT_NOTIFY"; + case LEAPRAID_FUNC_FW_DOWNLOAD: + return "FW_DOWNLOAD"; + case LEAPRAID_FUNC_FW_UPLOAD: + return "FW_UPLOAD"; + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + return "SCSIIO_RAID_PASSTHROUGH"; + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: + return "SCSI_ENC_PROCESSOR"; + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + return "SMP_PASSTHROUGH"; + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: + return "SAS_IO_UNIT_CTRL"; + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + return "SCSIIO_SATA_PASSTHROUGH"; + case LEAPRAID_FUNC_ADAPTER_UNIT_RESET: + return "ADAPTER_UNIT_RESET"; + case LEAPRAID_FUNC_HANDSHAKE: + return "HANDSHAKE"; + case LEAPRAID_FUNC_LOGBUF_INIT: + return "LOGBUF_INIT"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_CFG_ACT_PAGE_HEADER: + return "PAGE_HEADER"; + case LEAPRAID_CFG_ACT_PAGE_READ_CUR: + return "PAGE_READ_CUR"; + case LEAPRAID_CFG_ACT_PAGE_WRITE_CUR: + return "PAGE_WRITE_CUR"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_page_type_name(u8 page_type) +{ + switch (page_type) { + case LEAPRAID_CFG_PT_IO_UNIT: + return "IO_UNIT"; + case LEAPRAID_CFG_PT_ADAPTER: + return "ADAPTER"; + case LEAPRAID_CFG_PT_BIOS: + return "BIOS"; + case LEAPRAID_CFG_PT_RAID_VOLUME: + return "RAID_VOLUME"; + case LEAPRAID_CFG_PT_MANUFACTURING: + return "MANUFACTURING"; + case LEAPRAID_CFG_PT_RAID_PHYSDISK: + return "RAID_PHYSDISK"; + case LEAPRAID_CFG_PT_EXTENDED: + return "EXTENDED"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_ext_page_type_name(u8 ext_page_type) +{ + switch (ext_page_type) { + case LEAPRAID_CFG_EXTPT_SAS_IO_UNIT: + return "SAS_IO_UNIT"; + case LEAPRAID_CFG_EXTPT_SAS_EXP: + return "SAS_EXPANDER"; + case LEAPRAID_CFG_EXTPT_SAS_DEV: + return "SAS_DEVICE"; + case LEAPRAID_CFG_EXTPT_SAS_PHY: + return "SAS_PHY"; + case LEAPRAID_CFG_EXTPT_ENC: + return "ENCLOSURE"; + case LEAPRAID_CFG_EXTPT_RAID_CONFIG: + return "RAID_CONFIG"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sep_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_SEP_REQ_ACT_WRITE_STATUS: + return "WRITE_STATUS"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sas_op_name(u8 op) +{ + switch (op) { + case LEAPRAID_SAS_OP_PHY_LINK_RESET: + return "PHY_LINK_RESET"; + case LEAPRAID_SAS_OP_PHY_HARD_RESET: + return "PHY_HARD_RESET"; + case LEAPRAID_SAS_OP_SET_PARAMETER: + return "SET_PARAMETER"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_io_param_name(u8 adapter_param) +{ + switch (adapter_param) { + case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: + return "SYNC_TIMESTAMP"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_tm_type_name(u8 task_type) +{ + switch (task_type) { + case LEAPRAID_TM_TASKTYPE_ABORT_TASK: + return "ABORT_TASK"; + case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: + return "ABORT_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_TARGET_RESET: + return "TARGET_RESET"; + case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: + return "LOGICAL_UNIT_RESET"; + case LEAPRAID_TM_TASKTYPE_CLEAR_TASK_SET: + return "CLEAR_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK: + return "QUERY_TASK"; + case LEAPRAID_TM_TASKTYPE_CLEAR_ACA: + return "CLEAR_ACA"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK_SET: + return "QUERY_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_ASYNC_EVENT: + return "QUERY_ASYNC_EVENT"; + default: + return "UNKNOWN"; + } +} + +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data) +{ + const struct leapraid_req *req = req_data; + + if (!adapter || !adapter->pdev || !req_data) + return; + + switch (req->func) { + case LEAPRAID_FUNC_CONFIG_OP: { + const struct leapraid_cfg_req *cfg_req = req_data; + + dev_err(&adapter->pdev->dev, + "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + cfg_req->action, + leapraid_cfg_action_name(cfg_req->action)); + dev_err(&adapter->pdev->dev, + "cfg-req: page_type=0x%02x(%s) page_num=%u\n", + cfg_req->header.page_type, + leapraid_cfg_page_type_name(cfg_req->header.page_type), + cfg_req->header.page_num); + if (cfg_req->header.page_type == LEAPRAID_CFG_PT_EXTENDED) + dev_err(&adapter->pdev->dev, + "cfg-req: ext_page_type=0x%02x(%s)\n", + cfg_req->ext_page_type, + leapraid_cfg_ext_page_type_name( + cfg_req->ext_page_type)); + dev_err(&adapter->pdev->dev, "cfg-req: page_addr=0x%08x\n", + le32_to_cpu(cfg_req->page_addr)); + break; + } + case LEAPRAID_FUNC_SCSI_TMF: { + const struct leapraid_scsi_tm_req *tm_req = req_data; + + dev_err(&adapter->pdev->dev, + "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + tm_req->task_type, + leapraid_tm_type_name(tm_req->task_type)); + dev_err(&adapter->pdev->dev, + "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + le16_to_cpu(tm_req->dev_hdl), + le16_to_cpu(tm_req->task_mid)); + break; + } + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: { + const struct leapraid_sep_req *sep_req = req_data; + + dev_err(&adapter->pdev->dev, + "sep: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + sep_req->act, + leapraid_sep_action_name(sep_req->act)); + dev_err(&adapter->pdev->dev, + "sep: dev_hdl=0x%04x slot=%u enc_hdl=0x%04x\n", + le16_to_cpu(sep_req->dev_hdl), + le16_to_cpu(sep_req->slot), + le16_to_cpu(sep_req->enc_hdl)); + break; + } + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: { + const struct leapraid_io_unit_ctrl_req *io_req = req_data; + + dev_err(&adapter->pdev->dev, + "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + io_req->op, leapraid_sas_op_name(io_req->op)); + dev_err(&adapter->pdev->dev, + "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + le16_to_cpu(io_req->dev_hdl), + io_req->adapter_para, + leapraid_io_param_name(io_req->adapter_para)); + break; + } + case LEAPRAID_FUNC_SMP_PASSTHROUGH: { + const struct leapraid_smp_passthrough_req *smp_req = req_data; + + dev_err(&adapter->pdev->dev, + "transport: func=0x%02x(%s) port=%u req_len=%u\n", + req->func, leapraid_func_name(req->func), + smp_req->physical_port, + le16_to_cpu(smp_req->req_data_len)); + dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + (unsigned long long)le64_to_cpu(smp_req->sas_address)); + break; + } + default: + dev_err(&adapter->pdev->dev, + "%s: func=0x%02x(%s)\n", + __func__, req->func, leapraid_func_name(req->func)); + break; + } +} + +static void leapraid_build_and_fire_cfg_req( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); - memset((void *)(&adapter->driver_cmds.cfg_op_cmd.reply), 0, + memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc(adapter, + local_leap_cfg_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.cfg_op_cmd.inter_taskid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); @@ -1614,17 +2068,18 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { rc = -EFAULT; - goto out; + goto out_cleanup; } dev_warn(&adapter->pdev->dev, - "cfg-req: retry request, cnt=%u\n", retry_cnt); + "cfg-req: Retry request, cnt=%u\n", retry_cnt); } - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: adapter not operational\n"); - goto out; + "cfg-req: Adapter not operational\n"); + goto out_cleanup; } leapraid_build_and_fire_cfg_req(adapter, leap_mpi_cfgp_req, @@ -1634,44 +2089,47 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_RESET) { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg due to hard reset\n"); + "cfg-req: CMD fail due to hard reset\n"); goto retry; } if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { dev_err(&adapter->pdev->dev, - "cfg-req: cmd not done during %s, skip reset\n", + "cfg-req: pending in %s, status=0x%x\n", adapter->access_ctrl.shost_recovering ? - "shost recovery" : "pcie recovery"); + "shost recovery" : "pcie recovery", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, - "cfg-req: cmd timeout, issuing hard reset\n"); + "cfg-req: timeout, status=0x%x, reset\n", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = true; } - goto out; + goto out_cleanup; } if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_REPLY_VALID) { memcpy(leap_mpi_cfgp_rep, - (void *)(&adapter->driver_cmds.cfg_op_cmd.reply), + &adapter->driver_cmds.cfg_op_cmd.reply, sizeof(struct leapraid_cfg_rep)); adapter_status = le16_to_cpu( leap_mpi_cfgp_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS) { - if (target_cfg_pg && real_cfg_pg_addr && - target_real_cfg_pg_sz) - if (leap_mpi_cfgp_req->action == - LEAPRAID_CFG_ACT_PAGE_READ_CUR) - memcpy(target_cfg_pg, - real_cfg_pg_addr, - target_real_cfg_pg_sz); - } else { + if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS && + target_cfg_pg && real_cfg_pg_addr && + target_real_cfg_pg_sz && + leap_mpi_cfgp_req->action == + LEAPRAID_CFG_ACT_PAGE_READ_CUR) + memcpy(target_cfg_pg, real_cfg_pg_addr, + target_real_cfg_pg_sz); + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { if (adapter_status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, @@ -1680,30 +2138,30 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, rc = -EFAULT; } } else { - dev_err(&adapter->pdev->dev, "cfg-rep: reply invalid\n"); + dev_err(&adapter->pdev->dev, "cfg-rep: Reply invalid\n"); rc = -EFAULT; } -out: +out_cleanup: adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { dev_info(&adapter->pdev->dev, - "%s:%d cfg-req: failure, issuing reset\n", + "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = -EFAULT; } else { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg during init, skip reset\n"); - rc = -EFAULT; + "cfg-req: CMD fail in init, skip reset\n"); } + rc = -EFAULT; } return rc; } -static int leapraid_request_cfg_pg_header(struct leapraid_adapter *adapter, +static int leapraid_request_cfg_pg_header( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { @@ -1729,8 +2187,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, { struct leapraid_cfg_req leap_mpi_cfgp_req; struct leapraid_cfg_rep leap_mpi_cfgp_rep; - u16 real_cfg_pg_sz = 0; - void *real_cfg_pg_addr = NULL; + u16 real_cfg_pg_sz; + void *real_cfg_pg_addr; dma_addr_t real_cfg_pg_dma = 0; u32 __page_size; int rc; @@ -1752,6 +2210,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, LEAPRAID_CFG_PAGE_NUM_BIOS2; __page_size = sizeof(struct leapraid_bios_page2); break; + case GET_MANUFACTURING_PG0: + leap_mpi_cfgp_req.header.page_type = + LEAPRAID_CFG_PT_MANUFACTURING; + leap_mpi_cfgp_req.header.page_num = + LEAPRAID_CFG_PAGE_NUM_MANU0; + __page_size = sizeof(struct leapraid_manufacturing_p0); + break; case GET_SAS_DEVICE_PG0: leap_mpi_cfgp_req.header.page_type = LEAPRAID_CFG_PT_EXTENDED; leap_mpi_cfgp_req.ext_page_type = LEAPRAID_CFG_EXTPT_SAS_DEV; @@ -1818,9 +2283,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, break; default: dev_err(&adapter->pdev->dev, - "unsupported config page action=%d!\n", cfg_op); - rc = -EINVAL; - goto out; + "Unsupported config page action=%d!\n", cfg_op); + return -EINVAL; } leapraid_build_nodata_mpi_sg(adapter, @@ -1830,8 +2294,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, &leap_mpi_cfgp_rep); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: header failed rc=%dn", rc); - goto out; + "cfg-req: Header failed rc=%dn", rc); + return rc; } if (cfg_op == GET_SAS_DEVICE_PG0 || @@ -1867,17 +2331,14 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, leap_mpi_cfgp_req.ext_page_type = leap_mpi_cfgp_rep.ext_page_type; real_cfg_pg_sz = (leap_mpi_cfgp_req.header.page_len) ? - leap_mpi_cfgp_req.header.page_len * 4 : - le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * 4; + leap_mpi_cfgp_req.header.page_len * sizeof(u32) : + le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * sizeof(u32); real_cfg_pg_addr = dma_alloc_coherent(&adapter->pdev->dev, real_cfg_pg_sz, &real_cfg_pg_dma, GFP_KERNEL); - if (!real_cfg_pg_addr) { - dev_err(&adapter->pdev->dev, "cfg-req: dma alloc failed\n"); - rc = -ENOMEM; - goto out; - } + if (!real_cfg_pg_addr) + return -ENOMEM; if (leap_mpi_cfgp_req.action == LEAPRAID_CFG_ACT_PAGE_WRITE_CUR) { leapraid_single_mpi_sg_append(adapter, @@ -1914,12 +2375,11 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_addr, min_t(u16, real_cfg_pg_sz, __page_size)); if (rc) { - u32 adapter_status; + u32 status; - adapter_status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != - LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) + status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, "cfg-req: rc=%d, pg_info: 0x%x, 0x%x, %d\n", rc, leap_mpi_cfgp_req.header.page_type, @@ -1932,10 +2392,52 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_sz, real_cfg_pg_addr, real_cfg_pg_dma); -out: + return rc; } +static int leapraid_cfg_find_vol_in_page( + struct leapraid_raid_cfg_p0 *raid_cfg_p0, + u16 pd_hdl, u16 *vol_hdl) +{ + u16 elements = raid_cfg_p0->elements_num; + int i; + + for (i = 0; i < elements; i++) { + struct leapraid_raid_cfg_p0_element *elem; + u16 type; + + elem = &raid_cfg_p0->cfg_element[i]; + + type = le16_to_cpu(elem->element_flg) & + LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; + + switch (type) { + case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: + case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: { + u16 phys_hdl; + + phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); + + if (phys_hdl == pd_hdl) { + *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); + return 0; + } + break; + } + + case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: + *vol_hdl = 0; + return 0; + + default: + break; + } + } + + return -ENOENT; +} + static int leapraid_cfg_get_volume_hdl_dispatch( struct leapraid_adapter *adapter, struct leapraid_cfg_req *cfg_req, @@ -1946,13 +2448,11 @@ static int leapraid_cfg_get_volume_hdl_dispatch( u16 raid_cfg_p0_sz, u16 pd_hdl, u16 *vol_hdl) { - u16 phys_disk_dev_hdl; u16 adapter_status; - u16 element_type; int config_num; - int rc, i; + int rc; - config_num = 0xff; + config_num = 0xFF; while (true) { cfg_req->page_addr = cpu_to_le32(config_num + @@ -1973,35 +2473,14 @@ static int leapraid_cfg_get_volume_hdl_dispatch( } if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - return -1; - - for (i = 0; i < raid_cfg_p0->elements_num; i++) { - element_type = - le16_to_cpu(raid_cfg_p0->cfg_element[i].element_flg) & - LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; - - switch (element_type) { - case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: - case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: - phys_disk_dev_hdl = - le16_to_cpu(raid_cfg_p0->cfg_element[i] - .phys_disk_dev_hdl); - if (phys_disk_dev_hdl == pd_hdl) { - *vol_hdl = - le16_to_cpu - (raid_cfg_p0->cfg_element[i] - .vol_dev_hdl); - return 0; - } - break; + return LEAPRAID_OPERATION_FAILED; + + rc = leapraid_cfg_find_vol_in_page(raid_cfg_p0, + pd_hdl, + vol_hdl); + if (rc != -ENOENT) + return rc; - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: - *vol_hdl = 0; - return 0; - default: - break; - } - } config_num = raid_cfg_p0->cfg_num; } return 0; @@ -2010,12 +2489,12 @@ static int leapraid_cfg_get_volume_hdl_dispatch( int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, u16 pd_hdl, u16 *vol_hdl) { - struct leapraid_raid_cfg_p0 *raid_cfg_p0 = NULL; + struct leapraid_raid_cfg_p0 *raid_cfg_p0; struct leapraid_cfg_req cfg_req; struct leapraid_cfg_rep cfg_rep; dma_addr_t real_cfg_pg_dma = 0; - void *real_cfg_pg_addr = NULL; - u16 real_cfg_pg_sz = 0; + void *real_cfg_pg_addr; + u16 real_cfg_pg_sz; int rc, raid_cfg_p0_sz; *vol_hdl = 0; @@ -2029,16 +2508,14 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, leapraid_build_nodata_mpi_sg(adapter, &cfg_req.page_buf_sge); rc = leapraid_request_cfg_pg_header(adapter, &cfg_req, &cfg_rep); if (rc) - goto out; + return rc; cfg_req.action = LEAPRAID_CFG_ACT_PAGE_READ_CUR; raid_cfg_p0_sz = le16_to_cpu(cfg_rep.ext_page_len) * LEAPRAID_CFG_UNIT_SIZE; raid_cfg_p0 = kmalloc(raid_cfg_p0_sz, GFP_KERNEL); - if (!raid_cfg_p0) { - rc = -1; - goto out; - } + if (!raid_cfg_p0) + return -ENOMEM; real_cfg_pg_sz = (cfg_req.header.page_len) ? cfg_req.header.page_len * LEAPRAID_CFG_UNIT_SIZE : @@ -2049,7 +2526,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, GFP_KERNEL); if (!real_cfg_pg_addr) { rc = -ENOMEM; - goto out; + goto out_free; } memset(raid_cfg_p0, 0, raid_cfg_p0_sz); @@ -2073,7 +2550,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, raid_cfg_p0_sz, pd_hdl, vol_hdl); -out: +out_free: if (real_cfg_pg_addr) dma_free_coherent(&adapter->pdev->dev, real_cfg_pg_sz, real_cfg_pg_addr, @@ -2088,7 +2565,7 @@ static int leapraid_get_adapter_phys(struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 sas_io_unit_page0; union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - int rc = 0; + int rc; *nr_phys = 0; cfgp1.size = sizeof(struct leapraid_sas_io_unit_p0); @@ -2141,7 +2618,8 @@ int leapraid_cfg_get_volume_wwid(struct leapraid_adapter *adapter, return rc; } -static int leapraid_get_sas_io_unit_page0(struct leapraid_adapter *adapter, +static int leapraid_get_sas_io_unit_page0( + struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 *sas_io_unit_p0, u16 sas_iou_pg0_sz) { @@ -2163,8 +2641,8 @@ static int leapraid_get_sas_address(struct leapraid_adapter *adapter, *sas_address = 0; cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; if (hdl <= adapter->dev_topo.card.phys_num && @@ -2186,9 +2664,10 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raidpd_p0 raidpd_p0; u8 num_pds; u16 sz; + int rc = 0; - if ((leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, - &num_pds)) || !num_pds) + if (leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, + &num_pds) || !num_pds) return -EFAULT; raid_volume->pd_num = num_pds; @@ -2196,14 +2675,14 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, (num_pds * sizeof(struct leapraid_raidvol0_phys_disk)); raidvol_p0 = kzalloc(sz, GFP_KERNEL); if (!raidvol_p0) - return -EFAULT; + return -ENOMEM; cfgp1.size = sz; cfgp2.handle = raid_volume->hdl; - if ((leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, - GET_RAID_VOLUME_PG0))) { - kfree(raidvol_p0); - return -EFAULT; + if (leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, + GET_RAID_VOLUME_PG0)) { + rc = -EFAULT; + goto out_cleanup; } raid_volume->vol_type = raidvol_p0->volume_type; @@ -2214,14 +2693,28 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = le16_to_cpu(raidpd_p0.dev_hdl); if (!(leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) { + cfgp2, GET_SAS_DEVICE_PG0))) raid_volume->dev_info = le32_to_cpu(sas_dev_p0.dev_info); - } } +out_cleanup: kfree(raidvol_p0); - return 0; + return rc; +} + +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter) +{ + unsigned long flags; + bool skip; + + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + skip = adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.pcie_recovering || + adapter->access_ctrl.host_removing; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + + return skip; } static void leapraid_fw_log_work(struct work_struct *work) @@ -2229,26 +2722,34 @@ static void leapraid_fw_log_work(struct work_struct *work) struct leapraid_adapter *adapter = container_of(work, struct leapraid_adapter, fw_log_desc.fw_log_work.work); struct leapraid_fw_log_info *infom; + struct leapraid_reg_base __iomem *iomem_base; unsigned long flags; - infom = (struct leapraid_fw_log_info *)(adapter->fw_log_desc.fw_log_buffer + - LEAPRAID_SYS_LOG_BUF_SIZE); + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + infom = (struct leapraid_fw_log_info *) + (adapter->fw_log_desc.fw_log_buffer + + LEAPRAID_SYS_LOG_BUF_SIZE); + iomem_base = adapter->iomem_base; if (adapter->fw_log_desc.fw_log_init_flag == 0) { infom->user_position = - leapraid_readl(&adapter->iomem_base->host_log_buf_pos); + leapraid_readl(&iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); adapter->fw_log_desc.fw_log_init_flag++; } - writel(infom->user_position, &adapter->iomem_base->host_log_buf_pos); + writel(infom->user_position, &iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); +scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2267,7 +2768,8 @@ void leapraid_fw_log_stop(struct leapraid_adapter *adapter) adapter->fw_log_desc.fw_log_wq = NULL; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); if (wq) { - if (!cancel_delayed_work_sync(&adapter->fw_log_desc.fw_log_work)) + if (!cancel_delayed_work_sync(&adapter->fw_log_desc + .fw_log_work)) flush_workqueue(wq); destroy_workqueue(wq); } @@ -2297,7 +2799,8 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2308,12 +2811,13 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; ktime_t current_time; bool issue_reset = false; - u64 time_stamp = 0; + u64 time_stamp; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; io_unit_ctrl_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; @@ -2328,18 +2832,27 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - wait_for_completion_timeout(&adapter->driver_cmds.timestamp_sync_cmd.done, + leapraid_fire_task( + adapter, + adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_debug_log_info(adapter); + wait_for_completion_timeout(&adapter->driver_cmds + .timestamp_sync_cmd.done, LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) + LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: timestamp sync timeout, status=0x%x\n", + __func__, + adapter->driver_cmds.timestamp_sync_cmd.status); + leapraid_log_req_context(adapter, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); + } if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } @@ -2348,20 +2861,6 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); } -static bool leapraid_should_skip_fault_check(struct leapraid_adapter *adapter) -{ - unsigned long flags; - bool skip; - - spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - skip = adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.host_removing; - spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); - - return skip; -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2372,16 +2871,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter = container_of(work, struct leapraid_adapter, reset_desc.fault_reset_work.work); - if (leapraid_should_skip_fault_check(adapter)) + if (leapraid_should_skip_poll_work(adapter)) goto scheduled_timer; adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: hard reset: %s\n", - __func__, (rc == 0) ? "success" : "failed"); + dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", + __func__, rc == 0 ? "success" : "failed"); adapter_state = leapraid_get_adapter_state(adapter); if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) @@ -2397,7 +2896,8 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2422,14 +2922,15 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) adapter->reset_desc.fault_reset_wq_name); if (!adapter->reset_desc.fault_reset_wq) { dev_err(&adapter->pdev->dev, - "create single thread workqueue failed!\n"); + "Create single thread workqueue failed!\n"); return; } spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, - &adapter->reset_desc.fault_reset_work, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, + &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } @@ -2456,17 +2957,24 @@ static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, u16 hdl) { if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) - return false; - - if (leapraid_check_adapter_is_op(adapter)) + adapter->access_ctrl.shost_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", + __func__, + adapter->access_ctrl.pcie_recovering, + adapter->access_ctrl.shost_recovering); return false; + } - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) return false; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.dev_removing)) + if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { + dev_err(&adapter->pdev->dev, + "%s: Device handle is invalid\n", __func__); return false; + } return true; } @@ -2475,13 +2983,13 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, struct leapraid_scsi_cmd_desc *cmd_desc) { struct scsi_device *sdev; + struct scsi_device *target_sdev = NULL; struct leapraid_sdev_priv *sdev_priv; struct scsi_cmnd *scmd; void *dma_buffer = NULL; - dma_addr_t dma_addr = 0; - u8 sdev_flg = 0; + dma_addr_t dma_addr; bool issue_reset = false; - int rc = 0; + int rc; if (WARN_ON(!adapter->driver_cmds.internal_scmd)) return -EINVAL; @@ -2492,23 +3000,28 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); if (adapter->driver_cmds.driver_scsiio_cmd.status != LEAPRAID_CMD_NOT_USED) { + dev_err(&adapter->pdev->dev, + "%s: scsiio cmd busy\n", __func__); rc = -EAGAIN; - goto out; + goto out_cleanup; } adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; + if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && sdev_priv->lun == cmd_desc->lun) { - sdev_flg = 1; + target_sdev = sdev; break; } } - if (!sdev_flg) { + if (!target_sdev) { + dev_warn(&adapter->pdev->dev, + "%s: Device not found\n", __func__); rc = -ENXIO; - goto out; + goto out_cleanup; } if (cmd_desc->data_length) { @@ -2517,7 +3030,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, &dma_addr, GFP_ATOMIC); if (!dma_buffer) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (cmd_desc->dir == DMA_TO_DEVICE) memcpy(dma_buffer, cmd_desc->data_buffer, @@ -2525,7 +3038,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, } scmd = adapter->driver_cmds.internal_scmd; - scmd->device = sdev; + scmd->device = target_sdev; scmd->cmd_len = cmd_desc->cdb_length; memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); scmd->sc_data_direction = cmd_desc->dir; @@ -2538,11 +3051,14 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, adapter->driver_cmds.driver_scsiio_cmd.status &= ~LEAPRAID_CMD_PENDING; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); + dev_err(&adapter->pdev->dev, + "%s: queuecommand failed\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } - wait_for_completion_timeout(&adapter->driver_cmds.driver_scsiio_cmd.done, + wait_for_completion_timeout(&adapter->driver_cmds + .driver_scsiio_cmd.done, cmd_desc->time_out * HZ); if (!(adapter->driver_cmds.driver_scsiio_cmd.status & @@ -2564,15 +3080,22 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, rc = -ENODATA; dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", cmd_desc->hdl); - leapraid_issue_locked_tm(adapter, cmd_desc->hdl, 0, 0, 0, + leapraid_issue_locked_tm( + adapter, cmd_desc->hdl, 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, adapter->driver_cmds.driver_scsiio_cmd.taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } -out: +out_cleanup: + if (target_sdev) + scsi_device_put(target_sdev); + if (dma_buffer) dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, dma_buffer, dma_addr); + cmd_desc->data_length, + dma_buffer, + dma_addr); + adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); return rc; @@ -2582,7 +3105,8 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, u16 hdl, u32 lun) { struct leapraid_scsi_cmd_desc *desc; - int rc = 0; + char *buf; + int rc; desc = kzalloc(sizeof(*desc), GFP_KERNEL); if (!desc) @@ -2596,7 +3120,7 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, desc->cdb[0] = LOG_SENSE; desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; desc->cdb[8] = desc->data_length; - desc->raid_member = false; + desc->raid_member = 0; desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); @@ -2606,11 +3130,10 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, } rc = leapraid_dispatch_scsi_io(adapter, desc); - if (!rc) { - if (((char *)desc->data_buffer)[8] == - LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - } + buf = desc->data_buffer; + + if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) + leapraid_smart_fault_detect(adapter, hdl); kfree(desc->data_buffer); kfree(desc); @@ -2622,31 +3145,32 @@ static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, struct leapraid_sdev_priv *sdev_priv, u32 reset_flg) { - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; if (!sdev_priv || !sdev_priv->starget_priv->card_port) - goto out; + return false; - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev || !sas_dev->support_smart) - goto out; + goto out_fail; if (reset_flg) - sas_dev->led_on = false; + sas_dev->led_on = 0; else if (sas_dev->led_on) - goto out; + goto out_fail; - if ((sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) || + if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || sdev_priv->block) - goto out; + goto out_fail; leapraid_sdev_put(sas_dev); return true; -out: +out_fail: if (sas_dev) leapraid_sdev_put(sas_dev); return false; @@ -2659,16 +3183,21 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) smart_poll_desc.smart_poll_work.work); struct scsi_device *sdev; struct leapraid_sdev_priv *sdev_priv; - static u32 reset_cnt; bool reset_flg = false; - if (leapraid_check_adapter_is_op(adapter)) - goto out; + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) + goto scheduled_timer; + + if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) + reset_flg = true; - reset_flg = (reset_cnt < adapter->reset_desc.reset_cnt); - reset_cnt = adapter->reset_desc.reset_cnt; + adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) leapraid_dispatch_logsense(adapter, @@ -2676,11 +3205,12 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) sdev_priv->lun); } -out: +scheduled_timer: if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); + queue_delayed_work( + adapter->smart_poll_desc.smart_poll_wq, + &adapter->smart_poll_desc.smart_poll_work, + msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); } void leapraid_smart_polling_start(struct leapraid_adapter *adapter) @@ -2709,20 +3239,118 @@ void leapraid_smart_polling_start(struct leapraid_adapter *adapter) void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) { struct workqueue_struct *wq; + struct leapraid_smart_poll_desc *desc; - if (!adapter->smart_poll_desc.smart_poll_wq) + desc = &adapter->smart_poll_desc; + if (!desc->smart_poll_wq) return; - wq = adapter->smart_poll_desc.smart_poll_wq; - adapter->smart_poll_desc.smart_poll_wq = NULL; + wq = desc->smart_poll_wq; + desc->smart_poll_wq = NULL; if (wq) { - if (!cancel_delayed_work_sync(&adapter->smart_poll_desc.smart_poll_work)) + if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); destroy_workqueue(wq); } } +static void leapraid_overheat_work(struct work_struct *work) +{ + struct leapraid_overheat_desc *desc; + struct leapraid_adapter *adapter; + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + unsigned long flags; + + desc = container_of(work, struct leapraid_overheat_desc, + fault_overheat_work); + adapter = container_of(desc, struct leapraid_adapter, overheat_desc); + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_err(&pdev->dev, + "Overheat processing failed: invalid host/adapter\n"); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + if (adapter->access_ctrl.host_removing) { + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + adapter->access_ctrl.host_removing = 1; + adapter->access_ctrl.shost_recover_async = 0; + adapter->scan_dev_desc.scan_start = 0; + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + wake_up(&adapter->access_ctrl.shost_recover_wq); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + + leapraid_mask_int(adapter); + + leapraid_smart_polling_stop(adapter); + leapraid_check_scheduled_fault_stop(adapter); + leapraid_fw_log_stop(adapter); + leapraid_mq_polling_pause(adapter); + + leapraid_clean_active_cmds(adapter); + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + wq = adapter->fw_evt_s.fw_evt_thread; + adapter->fw_evt_s.fw_evt_thread = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (wq) + destroy_workqueue(wq); + + sas_remove_host(shost); + leapraid_cleanup_lists(adapter); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + dev_err(&pdev->dev, "%s: Suspend adapter due to overheat\n", __func__); +} + +static void leapraid_overheat_init(struct leapraid_adapter *adapter) +{ + if (adapter->overheat_desc.fault_overheat_wq) + return; + + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + snprintf(adapter->overheat_desc.fault_overheat_wq_name, + sizeof(adapter->overheat_desc.fault_overheat_wq_name), + "driver_%s%u_overheat", + LEAPRAID_DRIVER_NAME, + adapter->adapter_attr.id); + adapter->overheat_desc.fault_overheat_wq = + create_singlethread_workqueue( + adapter->overheat_desc.fault_overheat_wq_name); + if (!adapter->overheat_desc.fault_overheat_wq) { + dev_err(&adapter->pdev->dev, + "Failed to create overheat workqueue\n"); + return; + } + + INIT_WORK(&adapter->overheat_desc.fault_overheat_work, + leapraid_overheat_work); +} + +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter) +{ + struct workqueue_struct *wq; + + wq = xchg(&adapter->overheat_desc.fault_overheat_wq, NULL); + if (!wq) + return; + + cancel_work_sync(&adapter->overheat_desc.fault_overheat_work); + destroy_workqueue(wq); +} + static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt); @@ -2807,7 +3435,6 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( fw_evt = list_first_entry(&adapter->fw_evt_s.fw_evt_list, struct leapraid_fw_evt_work, list); list_del_init(&fw_evt->list); - leapraid_fw_evt_put(fw_evt); } spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return fw_evt; @@ -2816,56 +3443,65 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) { struct leapraid_fw_evt_work *fw_evt; - bool rc = false; + unsigned long flags; + bool in_fw_evt_context; + bool rc; if ((list_empty(&adapter->fw_evt_s.fw_evt_list) && !adapter->fw_evt_s.cur_evt) || !adapter->fw_evt_s.fw_evt_thread) return; adapter->fw_evt_s.fw_evt_cleanup = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; - while ((fw_evt = leapraid_next_fw_evt(adapter)) || - (fw_evt = adapter->fw_evt_s.cur_evt)) { - if (fw_evt == adapter->fw_evt_s.cur_evt && - adapter->fw_evt_s.cur_evt->evt_type != - LEAPRAID_EVT_REMOVE_DEAD_DEV) { - adapter->fw_evt_s.cur_evt = NULL; - continue; - } - + while ((fw_evt = leapraid_next_fw_evt(adapter))) { rc = cancel_work_sync(&fw_evt->work); - if (rc) leapraid_fw_evt_put(fw_evt); + leapraid_fw_evt_put(fw_evt); } + + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + fw_evt = adapter->fw_evt_s.cur_evt; + if (fw_evt) { + in_fw_evt_context = adapter->fw_evt_s.cur_evt_task == current; + leapraid_fw_evt_get(fw_evt); + } + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (fw_evt) { + if (!in_fw_evt_context) + cancel_work_sync(&fw_evt->work); + leapraid_fw_evt_put(fw_evt); + } + adapter->fw_evt_s.fw_evt_cleanup = 0; } static void leapraid_internal_dev_ublk(struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: now internal unblkg dev\n", + "hdl 0x%04x: Now internal unblkg dev\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc == -EINVAL) { sdev_printk(KERN_WARNING, sdev, "hdl 0x%04x: unblkg failed, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc) sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: blkg failed: earlier unblkg err, rc=%d\n", + "hdl 0x%04x: Earlier ublkg err, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc) sdev_printk(KERN_WARNING, sdev, @@ -2874,38 +3510,6 @@ static void leapraid_internal_dev_ublk(struct scsi_device *sdev, } } -static void leapraid_internal_ublk_io_dev_to_running(struct scsi_device *sdev) -{ - struct leapraid_sdev_priv *sdev_priv; - - sdev_priv = sdev->hostdata; - sdev_priv->block = false; - scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); - sdev_printk(KERN_WARNING, sdev, "%s: ublk hdl 0x%04x\n", - __func__, sdev_priv->starget_priv->hdl); -} - -static void leapraid_ublk_io_dev_to_running( - struct leapraid_adapter *adapter, u64 sas_addr, - struct leapraid_card_port *card_port) -{ - struct leapraid_sdev_priv *sdev_priv; - struct scsi_device *sdev; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->sas_address != sas_addr || - sdev_priv->starget_priv->card_port != card_port) - continue; - - if (sdev_priv->block) - leapraid_internal_ublk_io_dev_to_running(sdev); - } -} - static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_addr, struct leapraid_card_port *card_port) @@ -2957,15 +3561,15 @@ static void leapraid_ublk_io_all_dev(struct leapraid_adapter *adapter) } } -static void __maybe_unused leapraid_internal_dev_blk( +static void leapraid_internal_dev_blk( struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; - sdev_printk(KERN_INFO, sdev, "internal blkg hdl 0x%04x\n", + sdev_printk(KERN_INFO, sdev, "Internal blkg hdl 0x%04x\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc == -EINVAL) sdev_printk(KERN_WARNING, sdev, @@ -2973,42 +3577,6 @@ static void __maybe_unused leapraid_internal_dev_blk( rc, sdev_priv->starget_priv->hdl); } -static void __maybe_unused leapraid_blkio_dev(struct leapraid_adapter *adapter, - u16 hdl) -{ - struct leapraid_sdev_priv *sdev_priv; - struct leapraid_sas_dev *sas_dev; - struct scsi_device *sdev; - - sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->hdl != hdl) - continue; - - if (sdev_priv->block) - continue; - - if (sas_dev && sas_dev->pend_sas_rphy_add) - continue; - - if (sdev_priv->sep) { - sdev_printk(KERN_INFO, sdev, - "sep hdl 0x%04x skip blkg\n", - sdev_priv->starget_priv->hdl); - continue; - } - - leapraid_internal_dev_blk(sdev, sdev_priv); - } - - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { @@ -3040,8 +3608,7 @@ static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, if (sdev_priv->sep) { sdev_printk(KERN_INFO, sdev, - "%s skip dev blk for sep hdl 0x%04x\n", - __func__, + "skip dev blk: sep hdl 0x%04x\n", sdev_priv->starget_priv->hdl); continue; } @@ -3062,10 +3629,8 @@ static void leapraid_imm_blkio_set_end_dev_blk_hdls( list_for_each_entry(sas_port, &topo_node_exp->sas_port_list, port_list) { - if (sas_port->remote_identify.device_type == - SAS_END_DEVICE) { + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) leapraid_imm_blkio_to_end_dev(adapter, sas_port); - } } } @@ -3087,7 +3652,7 @@ static void leapraid_imm_blkio_to_sib_exp( sas_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) { topo_node_exp_sib = - leapraid_exp_find_by_sas_address( + leapraid_exp_find_by_sas_address( adapter, sas_port->remote_identify.sas_address, sas_port->card_port); @@ -3126,17 +3691,15 @@ static void leapraid_report_sdev_directly(struct leapraid_adapter *adapter, if (!sas_dev->starget) { if (!adapter->scan_dev_desc.driver_loading) { - leapraid_transport_port_remove(adapter, - sas_dev->sas_addr, - sas_dev->parent_sas_addr, - sas_dev->card_port); + leapraid_transport_port_remove( + adapter, + sas_dev->sas_addr, + sas_dev->parent_sas_addr, + sas_dev->card_port); leapraid_sas_dev_remove(adapter, sas_dev); } return; } - - clear_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); } static struct leapraid_sas_dev *leapraid_init_sas_dev( @@ -3147,6 +3710,7 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( { struct leapraid_sas_dev *sas_dev; struct leapraid_enc_node *enc_dev; + unsigned long flags; sas_dev = kzalloc(sizeof(*sas_dev), GFP_KERNEL); if (!sas_dev) @@ -3161,28 +3725,32 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->phy = sas_dev_pg0->phy_num; sas_dev->enc_hdl = le16_to_cpu(sas_dev_pg0->enc_hdl); sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); - sas_dev->port_type = sas_dev_pg0->max_port_connections; + sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; - memcpy(sas_dev->connector_name, sas_dev_pg0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; + memcpy(sas_dev->connector_name, + sas_dev_pg0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = + '\0'; } else { sas_dev->enc_level = 0; sas_dev->connector_name[0] = '\0'; } - if (le16_to_cpu(sas_dev_pg0->enc_hdl)) { - enc_dev = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu(sas_dev_pg0->enc_hdl)); - sas_dev->enc_lid = enc_dev ? - le64_to_cpu(enc_dev->pg0.enc_lid) : 0; + if (sas_dev->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_dev = leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); + if (enc_dev) + sas_dev->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } dev_info(&adapter->pdev->dev, - "add dev: hdl=0x%0x, sas addr=0x%016llx, port_type=0x%0x\n", - hdl, sas_dev->sas_addr, sas_dev->port_type); + "add dev: hdl=0x%x, SAS addr=0x%016llx, port connect=0x%x\n", + hdl, sas_dev->sas_addr, sas_dev->port_connection); return sas_dev; } @@ -3202,15 +3770,14 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, - cfgp1, cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, + cfgp1, cfgp2, GET_SAS_DEVICE_PG0)) return; dev_info = le32_to_cpu(sas_dev_pg0.dev_info); if (!(leapraid_is_end_dev(dev_info))) return; - set_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); sas_addr = le64_to_cpu(sas_dev_pg0.sas_address); if (!(le16_to_cpu(sas_dev_pg0.flg) & LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) @@ -3223,8 +3790,6 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_get_sas_dev_by_addr(adapter, sas_addr, card_port); if (sas_dev) { - clear_bit(hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); leapraid_sdev_put(sas_dev); return; } @@ -3239,6 +3804,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) dev_info); if (!sas_dev) return; + if (adapter->scan_dev_desc.wait_scan_dev_done) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); leapraid_sdev_get(sas_dev); @@ -3253,6 +3819,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_report_sdev_directly(adapter, sas_dev); } + leapraid_sdev_put(sas_dev); } static void leapraid_remove_device(struct leapraid_adapter *adapter, @@ -3260,14 +3827,15 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, { struct leapraid_starget_priv *starget_priv; + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); if (sas_dev->led_on) { leapraid_set_led(adapter, sas_dev, false); - sas_dev->led_on = false; + sas_dev->led_on = 0; } if (sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; leapraid_ublk_io_dev(adapter, sas_dev->sas_addr, sas_dev->card_port); starget_priv->hdl = LEAPRAID_INVALID_DEV_HANDLE; @@ -3279,12 +3847,13 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, sas_dev->card_port); dev_info(&adapter->pdev->dev, - "remove dev: hdl=0x%04x, sas addr=0x%016llx\n", + "remove dev: hdl=0x%04x, SAS addr=0x%016llx\n", sas_dev->hdl, (unsigned long long)sas_dev->sas_addr); } -static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapter, - u8 port_id, u8 phy_num) +static struct leapraid_vphy *leapraid_alloc_vphy( + struct leapraid_adapter *adapter, + u8 port_id, u8 phy_num) { struct leapraid_card_port *port; struct leapraid_vphy *vphy; @@ -3296,7 +3865,6 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte vphy = leapraid_get_vphy_by_phy(port, phy_num); if (vphy) return vphy; - vphy = kzalloc(sizeof(*vphy), GFP_KERNEL); if (!vphy) return NULL; @@ -3310,46 +3878,157 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte return vphy; } -static int leapraid_add_port_to_card_port_list(struct leapraid_adapter *adapter, - u8 port_id, bool refresh) +static int leapraid_add_port_to_card_port_list( + struct leapraid_adapter *adapter, + u8 port_id, bool refresh) { struct leapraid_card_port *card_port; card_port = leapraid_get_port_by_id(adapter, port_id, false); if (card_port) return 0; - card_port = kzalloc(sizeof(*card_port), GFP_KERNEL); if (!card_port) return -ENOMEM; card_port->port_id = port_id; - dev_info(&adapter->pdev->dev, - "port: %d is added to card_port list\n", - card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "port: %d is added to card_port list\n", + card_port->port_id); - if (refresh) - if (adapter->access_ctrl.shost_recovering) - card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; + if (refresh && adapter->access_ctrl.shost_recovering) + card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; list_add_tail(&card_port->list, &adapter->dev_topo.card_port_list); return 0; } +static int leapraid_add_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + struct leapraid_topo_node *card = &adapter->dev_topo.card; + u8 port_id; + + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return -EINVAL; + + port_id = iou->phy_info[i].port; + + if (leapraid_add_port_to_card_port_list(adapter, port_id, false)) + return -EINVAL; + + if ((le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY) && + ((phy_pg0.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) >= + LEAPRAID_SAS_NEG_LINK_RATE_1_5)) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + card->card_phy[i].phy_id = i; + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + + return 0; +} + +static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_topo_node *card = &adapter->dev_topo.card; + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + u16 attached_hdl; + u32 dev_info; + u8 link_rate; + u8 port_id; + + link_rate = iou->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; + port_id = iou->phy_info[i].port; + if (leapraid_add_port_to_card_port_list(adapter, port_id, true)) + return -EINVAL; + + dev_info = le32_to_cpu(iou->phy_info[i].controller_phy_dev_info); + if (dev_info & LEAPRAID_DEVTYP_SEP && + link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + if (le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY && + !leapraid_alloc_vphy(adapter, port_id, i)) + return -EINVAL; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + + attached_hdl = le16_to_cpu(iou->phy_info[i].attached_dev_hdl); + if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; + + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + if (!card->card_phy[i].phy) { + cfgp1.phy_number = i; + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + card->card_phy[i].phy_id = i; + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + return 0; + } + + leapraid_transport_update_links(adapter, + card->sas_address, + attached_hdl, + i, + link_rate, + card->card_phy[i].card_port); + + return 0; +} + static void leapraid_sas_host_add(struct leapraid_adapter *adapter, bool refresh) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_phy_p0 phy_pg0; struct leapraid_sas_dev_p0 sas_dev_pg0; struct leapraid_enc_p0 enc_pg0; struct leapraid_sas_io_unit_p0 *sas_iou_pg0; u16 sas_iou_pg0_sz; - u16 attached_hdl; u8 phys_num; - u8 port_id; - u8 link_rate; int i; + int rc; if (!refresh) { if (leapraid_get_adapter_phys(adapter, &phys_num) || !phys_num) @@ -3364,128 +4043,46 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, adapter->dev_topo.card.phys_num = phys_num; } - sas_iou_pg0_sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + - (adapter->dev_topo.card.phys_num * - sizeof(struct leapraid_sas_io_unit0_phy_info)); + sas_iou_pg0_sz = + offsetof(struct leapraid_sas_io_unit_p0, phy_info) + + (adapter->dev_topo.card.phys_num * + sizeof(struct leapraid_sas_io_unit0_phy_info)); sas_iou_pg0 = kzalloc(sas_iou_pg0_sz, GFP_KERNEL); if (!sas_iou_pg0) - goto out; + return; if (leapraid_get_sas_io_unit_page0(adapter, sas_iou_pg0, sas_iou_pg0_sz)) - goto out; + goto out_free; adapter->dev_topo.card.parent_dev = &adapter->shost->shost_gendev; adapter->dev_topo.card.hdl = le16_to_cpu(sas_iou_pg0->phy_info[0].controller_dev_hdl); for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if (!refresh) { /* add */ - cfgp1.phy_number = i; - if (leapraid_op_config_page(adapter, &phy_pg0, cfgp1, - cfgp2, GET_PHY_PG0)) - goto out; - - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - false)) - goto out; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY) && - (phy_pg0.neg_link_rate >> 4) >= - LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - if (!leapraid_alloc_vphy(adapter, port_id, i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - adapter->dev_topo.card.card_phy[i].phy_id = i; - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - leapraid_transport_add_card_phy( - adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, adapter->dev_topo.card.parent_dev); - } else { /* refresh */ - link_rate = sas_iou_pg0->phy_info[i].neg_link_rate >> 4; - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - true)) - goto out; - - if (le32_to_cpu(sas_iou_pg0->phy_info[i] - .controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP && - link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY)) { - if (!leapraid_alloc_vphy(adapter, - port_id, - i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - attached_hdl = - le16_to_cpu(sas_iou_pg0->phy_info[i].attached_dev_hdl); - if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; - - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - if (!adapter->dev_topo.card.card_phy[i].phy) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - adapter->dev_topo.card.card_phy[i].phy_id = i; - leapraid_transport_add_card_phy(adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, - adapter->dev_topo.card.parent_dev); - continue; - } - - leapraid_transport_update_links(adapter, - adapter->dev_topo.card.sas_address, - attached_hdl, i, link_rate, - adapter->dev_topo.card.card_phy[i].card_port); - } + if (!refresh) /* add */ + rc = leapraid_add_card_phy(adapter, sas_iou_pg0, i); + else /* refresh */ + rc = leapraid_refresh_card_phy(adapter, + sas_iou_pg0, + i); + if (rc) + goto out_free; } if (!refresh) { cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = adapter->dev_topo.card.hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) - goto out; + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) + goto out_free; adapter->dev_topo.card.enc_hdl = le16_to_cpu(sas_dev_pg0.enc_hdl); adapter->dev_topo.card.sas_address = le64_to_cpu(sas_dev_pg0.sas_address); dev_info(&adapter->pdev->dev, - "add host: devhdl=0x%04x, sas addr=0x%016llx, phynums=%d\n", + "add host: hdl=0x%04x, SAS addr=0x%016llx, phy=%d\n", adapter->dev_topo.card.hdl, (unsigned long long)adapter->dev_topo.card.sas_address, adapter->dev_topo.card.phys_num); @@ -3500,7 +4097,7 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, le64_to_cpu(enc_pg0.enc_lid); } } -out: +out_free: kfree(sas_iou_pg0); } @@ -3514,22 +4111,24 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port = NULL; struct leapraid_enc_node *enc_dev; struct leapraid_exp_p1 exp_pg1; - int rc = 0; + int ret; + int rc; unsigned long flags; u8 port_id; u16 parent_handle; - u64 sas_addr_parent = 0; + u64 sas_addr_parent; int i; port_id = exp_pg0->physical_port; parent_handle = le16_to_cpu(exp_pg0->parent_dev_hdl); - if (leapraid_get_sas_address(adapter, parent_handle, &sas_addr_parent)) - return -1; - + rc = leapraid_get_sas_address(adapter, + parent_handle, &sas_addr_parent); + if (rc) + return rc; topo_node_exp = kzalloc(sizeof(*topo_node_exp), GFP_KERNEL); if (!topo_node_exp) - return -1; + return -ENOMEM; topo_node_exp->hdl = hdl; topo_node_exp->phys_num = exp_pg0->phy_num; @@ -3538,17 +4137,19 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->card_port = leapraid_get_port_by_id(adapter, port_id, false); if (!topo_node_exp->card_port) { - rc = -1; + rc = -EPERM; goto out_fail; } dev_info(&adapter->pdev->dev, - "add exp: sas addr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phys=%d\n", + "add exp: saddr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phy=%d\n", (unsigned long long)topo_node_exp->sas_address, hdl, parent_handle, topo_node_exp->phys_num); if (!topo_node_exp->phys_num) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Invalid PHY num from exp_pg0\n", __func__); + rc = -EPERM; goto out_fail; } @@ -3556,7 +4157,10 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, kcalloc(topo_node_exp->phys_num, sizeof(struct leapraid_card_phy), GFP_KERNEL); if (!topo_node_exp->card_phy) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Failed to alloc expander phy array, count=%u\n", + __func__, topo_node_exp->phys_num); + rc = -EPERM; goto out_fail; } @@ -3564,7 +4168,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, sas_port = leapraid_transport_port_add(adapter, hdl, sas_addr_parent, topo_node_exp->card_port); if (!sas_port) { - rc = -1; + rc = -EPERM; goto out_fail; } @@ -3573,31 +4177,38 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1->phy_number = i; cfgp2->handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, - GET_SAS_EXPANDER_PG1))) { - rc = -1; + if (leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, + GET_SAS_EXPANDER_PG1)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to get exp_pg1, phy=%d\n", + __func__, i); + rc = -EPERM; goto out_fail; } topo_node_exp->card_phy[i].hdl = hdl; topo_node_exp->card_phy[i].phy_id = i; topo_node_exp->card_phy[i].card_port = - leapraid_get_port_by_id(adapter, port_id, false); - if ((leapraid_transport_add_exp_phy(adapter, - &topo_node_exp->card_phy[i], - &exp_pg1, - topo_node_exp->parent_dev))) { - rc = -1; + leapraid_get_port_by_id(adapter, port_id, false); + ret = leapraid_transport_add_exp_phy( + adapter, + &topo_node_exp->card_phy[i], + &exp_pg1, + topo_node_exp->parent_dev); + if (ret) { + rc = -EPERM; goto out_fail; } } if (topo_node_exp->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); enc_dev = leapraid_enc_find_by_hdl(adapter, topo_node_exp->enc_hdl); if (enc_dev) topo_node_exp->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3611,6 +4222,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->sas_address, sas_addr_parent, topo_node_exp->card_port); + kfree(topo_node_exp->card_phy); kfree(topo_node_exp); return rc; } @@ -3622,22 +4234,29 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) struct leapraid_topo_node *topo_node_exp; struct leapraid_exp_p0 exp_pg0; u16 parent_handle; - u64 sas_addr, sas_addr_parent = 0; + u64 sas_addr, sas_addr_parent; unsigned long flags; u8 port_id; - int rc = 0; + int rc; - if (!hdl) + if (!hdl) { + dev_warn(&adapter->pdev->dev, "%s: Invalid hdl\n", __func__); return -EPERM; + } if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EPERM; + } cfgp1.form = LEAPRAID_SAS_EXP_CFD_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG0))) + if (leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG0)) return -EPERM; parent_handle = le16_to_cpu(exp_pg0.parent_dev_hdl); @@ -3648,10 +4267,14 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) if (sas_addr_parent != adapter->dev_topo.card.sas_address) { spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, sas_addr_parent, - leapraid_get_port_by_id(adapter, port_id, false)); - spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); + leapraid_get_port_by_id(adapter, + port_id, + false)); + spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, + flags); if (!topo_node_exp) { rc = leapraid_exp_add(adapter, parent_handle); if (rc != 0) @@ -3662,7 +4285,9 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); sas_addr = le64_to_cpu(exp_pg0.sas_address); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, sas_addr, + leapraid_exp_find_by_sas_address( + adapter, + sas_addr, leapraid_get_port_by_id(adapter, port_id, false)); spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -3710,7 +4335,7 @@ static void leapraid_exp_node_rm(struct leapraid_adapter *adapter, topo_node_exp->sas_address_parent, topo_node_exp->card_port); dev_info(&adapter->pdev->dev, - "removing exp: port=%d, sas addr=0x%016llx, hdl=0x%04x\n", + "removing exp: port=%d, SAS addr=0x%016llx, hdl=0x%04x\n", port_id, (unsigned long long)topo_node_exp->sas_address, topo_node_exp->hdl); spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3742,92 +4367,6 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static void leapraid_check_device(struct leapraid_adapter *adapter, - u64 parent_sas_address, u16 handle, - u8 phy_number, u8 link_rate) -{ - struct leapraid_sas_dev_p0 sas_device_pg0; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_enc_node *enclosure_dev = NULL; - union cfg_param_1 cfgp1 = {0}; - union cfg_param_2 cfgp2 = {0}; - unsigned long flags; - u64 sas_address; - struct scsi_target *starget; - struct leapraid_starget_priv *sas_target_priv_data; - u32 device_info; - struct leapraid_card_port *port; - - cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; - cfgp2.handle = handle; - if ((leapraid_op_config_page(adapter, &sas_device_pg0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) - return; - - if (phy_number != sas_device_pg0.phy_num) - return; - - device_info = le32_to_cpu(sas_device_pg0.dev_info); - if (!(leapraid_is_end_dev(device_info))) - return; - - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_address = le64_to_cpu(sas_device_pg0.sas_address); - port = leapraid_get_port_by_id(adapter, sas_device_pg0.physical_port, - false); - if (!port) - goto out_unlock; - - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, - port); - if (!sas_dev) - goto out_unlock; - - if (unlikely(sas_dev->hdl != handle)) { - starget = sas_dev->starget; - sas_target_priv_data = starget->hostdata; - starget_printk(KERN_INFO, starget, - "hdl changed from 0x%04x to 0x%04x!\n", - sas_dev->hdl, handle); - sas_target_priv_data->hdl = handle; - sas_dev->hdl = handle; - if (le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = - sas_device_pg0.enc_level; - memcpy(sas_dev->connector_name, - sas_device_pg0.connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } - sas_dev->enc_hdl = - le16_to_cpu(sas_device_pg0.enc_hdl); - enclosure_dev = - leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); - if (enclosure_dev) { - sas_dev->enc_lid = - le64_to_cpu(enclosure_dev->pg0.enc_lid); - } - } - - if (!(le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) - goto out_unlock; - - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - - leapraid_ublk_io_dev_to_running(adapter, sas_address, port); - goto out; - -out_unlock: - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); -out: - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static int leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, @@ -3836,10 +4375,8 @@ static int leapraid_internal_sas_topo_chg_evt( u64 sas_addr, u8 max_phys) { struct leapraid_evt_data_sas_topo_change_list *evt_data; - struct leapraid_sas_dev *sas_dev; - unsigned long flags; u8 phy_number; - u8 link_rate, prev_link_rate; + u8 link_rate; u16 reason_code; u16 hdl; int i; @@ -3861,47 +4398,15 @@ static int leapraid_internal_sas_topo_chg_evt( LEAPRAID_EVT_SAS_TOPO_RC_MASK; hdl = le16_to_cpu(evt_data->phy[i].attached_dev_hdl); - if (!hdl) + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); continue; - - link_rate = evt_data->phy[i].link_rate >> 4; - prev_link_rate = evt_data->phy[i].link_rate & 0xF; + } + link_rate = evt_data->phy[i].link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; switch (reason_code) { - case LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED: - if (adapter->access_ctrl.shost_recovering) - break; - - if (link_rate == prev_link_rate) - break; - - leapraid_transport_update_links(adapter, sas_addr, - hdl, phy_number, - link_rate, card_port); - if (link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - break; - - leapraid_check_device(adapter, sas_addr, hdl, - phy_number, link_rate); - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, - flags); - sas_dev = - leapraid_hold_lock_get_sas_dev_by_hdl( - adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, - flags); - if (sas_dev) { - leapraid_sdev_put(sas_dev); - break; - } - if (!test_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add)) - break; - - evt_data->phy[i].phy_status &= - LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK; - evt_data->phy[i].phy_status |= - LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED; - fallthrough; - case LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED: if (adapter->access_ctrl.shost_recovering) break; @@ -3942,7 +4447,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, return 0; evt_data = fw_evt->evt_data; - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) return 0; @@ -3951,9 +4456,9 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, card_port = leapraid_get_port_by_id(adapter, evt_data->physical_port, false); - if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED) - if (leapraid_exp_add(adapter, phdl) != 0) - return 0; + if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && + leapraid_exp_add(adapter, phdl) != 0) + return 0; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -3980,12 +4485,13 @@ static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) { sdev->no_uld_attach = no_uld_attach ? 1 : 0; sdev_printk(KERN_INFO, sdev, - "%s raid component to upper layer\n", + "%s RAID component to upper layer\n", sdev->no_uld_attach ? "hide" : "expose"); WARN_ON(scsi_device_reprobe(sdev)); } -static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { union cfg_param_1 cfgp1 = {0}; @@ -3997,20 +4503,26 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + + set_bit(hdl, adapter->dev_topo.pd_hdls); sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev) { leapraid_sdev_put(sas_dev); dev_warn(&adapter->pdev->dev, - "dev handle 0x%x already exists\n", hdl); + "Dev handle 0x%x already exists\n", hdl); return; } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) { - dev_warn(&adapter->pdev->dev, "failed to read dev page0\n"); + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, + GET_SAS_DEVICE_PG0)) { + dev_warn(&adapter->pdev->dev, "Failed to read dev page0\n"); return; } @@ -4025,7 +4537,8 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, leapraid_add_dev(adapter, hdl); } -static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_delete( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 hdl; @@ -4034,7 +4547,8 @@ static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, leapraid_sas_dev_remove_by_hdl(adapter, hdl); } -static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_hide( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_starget_priv *starget_priv; @@ -4042,10 +4556,15 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev; unsigned long flags; u64 volume_wwid = 0; - u16 volume_hdl = 0; + u16 volume_hdl; u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } leapraid_cfg_get_volume_hdl(adapter, hdl, &volume_hdl); if (volume_hdl) leapraid_cfg_get_volume_wwid(adapter, @@ -4059,21 +4578,23 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, return; } - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + set_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; sas_dev->volume_hdl = volume_hdl; sas_dev->volume_wwid = volume_wwid; - leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - (void *)1, leapraid_reprobe_lun); + (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } static void leapraid_sas_pd_expose( @@ -4088,11 +4609,17 @@ static void leapraid_sas_pd_expose( hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { dev_warn(&adapter->pdev->dev, - "%s:%d: sas_dev not found， hdl=0x%x\n", + "%s:%d: sas_dev not found, hdl=0x%x\n", __func__, __LINE__, hdl); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); return; @@ -4100,84 +4627,100 @@ static void leapraid_sas_pd_expose( sas_dev->volume_hdl = 0; sas_dev->volume_wwid = 0; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + clear_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg &= ~LEAPRAID_TGT_FLG_RAID_MEMBER; - sas_dev->led_on = false; - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "expose sas_dev, hdl=0x%x\n", hdl); - starget_for_each_device(starget, NULL, leapraid_reprobe_lun); + starget_for_each_device(starget, + LEAPRAID_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } -static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, +static void leapraid_sas_vol_visibility( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { - struct leapraid_raid_volume *raid_volume = NULL; - struct scsi_device *sdev = NULL; - u16 hdl = 0; + struct leapraid_raid_volume *raid_volume; + struct scsi_device *sdev; + bool reprobe_flg = false; + bool sdev_held = false; unsigned long flags; - u8 rc = 0; - u8 reprobe_flg = 0; + u16 hdl; + u8 rc; hdl = le16_to_cpu(evt_data->vol_dev_hdl); rc = evt_data->reason_code; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + sdev = raid_volume->sdev; + if (!sdev) { spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x has no sdev\n", __func__, __LINE__, hdl); return; } - reprobe_flg = 0; - sdev = raid_volume->sdev; - if (sdev) { - if (sdev->no_uld_attach) { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { - sdev->no_uld_attach = 0; - reprobe_flg = 1; - } - } else { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { - sdev->no_uld_attach = 1; - reprobe_flg = 1; - } - } + if (sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = true; + } else if (!sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = true; + } - if (reprobe_flg) { - if (sdev->no_uld_attach) - sdev_printk(KERN_INFO, sdev, "hide vol\n"); - else - sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + if (reprobe_flg && !scsi_device_get(sdev)) + sdev_held = true; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); - WARN_ON(scsi_device_reprobe(sdev)); - } else { - dev_warn(&adapter->pdev->dev, - "%s:rc(0x%x):request matches, skipping.\n", - __func__, rc); - } + if (!reprobe_flg) { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x): Request matches, skipping\n", + __func__, rc); + return; + } - } else { + if (!sdev_held) { dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x has no sdev\n", - __func__, __LINE__, hdl); + "%s: Failed to hold sdev for reprobe, hdl=0x%x\n", + __func__, hdl); + return; } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + scsi_device_put(sdev); } -static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, +static void leapraid_sas_volume_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_raid_volume *raid_volume; @@ -4188,23 +4731,21 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, hdl = le16_to_cpu(evt_data->vol_dev_hdl); if (leapraid_cfg_get_volume_wwid(adapter, hdl, &wwid)) { - dev_warn(&adapter->pdev->dev, "failed to read volume page1\n"); + dev_warn(&adapter->pdev->dev, "Failed to read volume page1\n"); return; } if (!wwid) { - dev_warn(&adapter->pdev->dev, "invalid WWID(handle=0x%x)\n", + dev_warn(&adapter->pdev->dev, "Invalid WWID(handle=0x%x)\n", hdl); return; } - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - if (raid_volume) { dev_warn(&adapter->pdev->dev, - "volume handle 0x%x already exists\n", hdl); + "Volume handle 0x%x already exists\n", hdl); + leapraid_raid_volume_put(raid_volume); return; } @@ -4212,6 +4753,8 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, if (!raid_volume) return; + INIT_LIST_HEAD(&raid_volume->list); + kref_init(&raid_volume->refcnt); raid_volume->id = adapter->dev_topo.sas_id++; raid_volume->channel = RAID_CHANNEL; raid_volume->hdl = hdl; @@ -4222,50 +4765,65 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); dev_info(&adapter->pdev->dev, - "add raid volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); + "add RAID volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); } else { spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); leapraid_check_boot_dev(adapter, raid_volume, RAID_CHANNEL); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } + leapraid_raid_volume_put(raid_volume); +} + +static void leapraid_sas_volume_delete_by_ptr( + struct leapraid_adapter *adapter, + struct leapraid_raid_volume *raid_volume) +{ + struct leapraid_starget_priv *starget_priv; + struct scsi_target *starget = NULL; + unsigned long flags; + bool in_list; + + if (!raid_volume) + return; + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + in_list = !list_empty(&raid_volume->list); + if (in_list && raid_volume->starget) { + starget = raid_volume->starget; + starget_priv = starget->hostdata; + if (starget_priv) + starget_priv->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + if (!in_list) + return; + + dev_info(&adapter->pdev->dev, + "delete RAID volume: hdl=0x%x, wwid=0x%llx\n", + raid_volume->hdl, raid_volume->wwid); + leapraid_raid_volume_remove(adapter, raid_volume); + + if (starget) + scsi_remove_target(&starget->dev); } static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; - struct scsi_target *starget = NULL; - unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x not found\n", __func__, __LINE__, hdl); return; } - if (raid_volume->starget) { - starget = raid_volume->starget; - starget_priv = starget->hostdata; - starget_priv->deleted = true; - } - - dev_info(&adapter->pdev->dev, - "delete raid volume: hdl=0x%x, wwid=0x%llx\n", - raid_volume->hdl, raid_volume->wwid); - list_del(&raid_volume->list); - kfree(raid_volume); - - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - - if (starget) - scsi_remove_target(&starget->dev); + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); + leapraid_raid_volume_put(raid_volume); } static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, @@ -4309,7 +4867,9 @@ static void leapraid_sas_enc_dev_stat_add_node( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_enc_node *enc_node = NULL; + struct leapraid_enc_node *enc_node; + struct leapraid_enc_node *enc_exist; + unsigned long flags; int rc; enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); @@ -4324,16 +4884,33 @@ static void leapraid_sas_enc_dev_stat_add_node( kfree(enc_node); return; } + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_exist = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_exist) { + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); + return; + } list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } static void leapraid_sas_enc_dev_stat_del_node( - struct leapraid_enc_node *enc_node) + struct leapraid_adapter *adapter, u16 hdl) { - if (!enc_node) + struct leapraid_enc_node *enc_node; + unsigned long flags; + + if (!hdl) return; - list_del(&enc_node->list); + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_node = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_node) + list_del(&enc_node->list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); } @@ -4341,7 +4918,6 @@ static void leapraid_sas_enc_dev_stat_chg_evt( struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { - struct leapraid_enc_node *enc_node = NULL; struct leapraid_evt_data_sas_enc_dev_status_change *evt_data; u16 enc_hdl; @@ -4350,15 +4926,13 @@ static void leapraid_sas_enc_dev_stat_chg_evt( evt_data = fw_evt->evt_data; enc_hdl = le16_to_cpu(evt_data->enc_hdl); - if (enc_hdl) - enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); switch (evt_data->reason_code) { case LEAPRAID_EVT_SAS_ENCL_RC_ADDED: - if (!enc_node) + if (enc_hdl) leapraid_sas_enc_dev_stat_add_node(adapter, enc_hdl); break; case LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING: - leapraid_sas_enc_dev_stat_del_node(enc_node); + leapraid_sas_enc_dev_stat_del_node(adapter, enc_hdl); break; default: break; @@ -4375,7 +4949,11 @@ static void leapraid_remove_unresp_sas_end_dev( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry_safe(sas_dev, sas_dev_next, &adapter->dev_topo.sas_dev_init_list, list) { + if (sas_dev->rphy || sas_dev->pend_sas_rphy_add) + continue; + list_del_init(&sas_dev->list); + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); } list_for_each_entry_safe(sas_dev, sas_dev_next, @@ -4383,7 +4961,7 @@ static void leapraid_remove_unresp_sas_end_dev( if (!sas_dev->resp) list_move_tail(&sas_dev->list, &head); else - sas_dev->resp = false; + sas_dev->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -4394,23 +4972,32 @@ static void leapraid_remove_unresp_sas_end_dev( } dev_info(&adapter->pdev->dev, - "unresponding sas end devices removed\n"); + "Unresponsive SAS end devices removed\n"); } static void leapraid_remove_unresp_raid_volumes( struct leapraid_adapter *adapter) { + unsigned long flags; struct leapraid_raid_volume *raid_volume, *raid_volume_next; + LIST_HEAD(head); + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry_safe(raid_volume, raid_volume_next, &adapter->dev_topo.raid_volume_list, list) { if (!raid_volume->resp) - leapraid_sas_volume_delete(adapter, raid_volume->hdl); + list_move_tail(&raid_volume->list, &head); else - raid_volume->resp = false; + raid_volume->resp = 0; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, raid_volume_next, &head, list) { + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } + dev_info(&adapter->pdev->dev, - "unresponding raid volumes removed\n"); + "Unresponsive RAID volumes removed\n"); } static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) @@ -4425,7 +5012,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) if (!topo_node_exp->resp) list_move_tail(&topo_node_exp->list, &head); else - topo_node_exp->resp = false; + topo_node_exp->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -4434,7 +5021,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) leapraid_exp_node_rm(adapter, topo_node_exp); dev_info(&adapter->pdev->dev, - "unresponding sas expanders removed\n"); + "Unresponsive SAS expanders removed\n"); } static void leapraid_remove_unresp_dev(struct leapraid_adapter *adapter) @@ -4490,25 +5077,27 @@ static void leapraid_update_dev_qdepth(struct leapraid_adapter *adapter) { struct leapraid_sdev_priv *sdev_priv; struct leapraid_sas_dev *sas_dev; + struct leapraid_adapter_attr *attr; struct scsi_device *sdev; u16 qdepth; + attr = &adapter->adapter_attr; shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) continue; sas_dev = sdev_priv->starget_priv->sas_dev; if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) - qdepth = (sas_dev->port_type > 1) ? - adapter->adapter_attr.wideport_max_queue_depth : - adapter->adapter_attr.narrowport_max_queue_depth; + qdepth = (sas_dev->port_connection > 1) ? + attr->wideport_max_queue_depth : + attr->narrowport_max_queue_depth; else if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) - qdepth = adapter->adapter_attr.sata_max_queue_depth; + qdepth = attr->sata_max_queue_depth; else continue; - leapraid_adjust_sdev_queue_depth(sdev, qdepth); + leapraid_change_queue_depth(sdev, qdepth); } } @@ -4524,15 +5113,17 @@ static void leapraid_update_exp_links(struct leapraid_adapter *adapter, cfgp2.handle = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG1))) + if (leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG1)) return; - leapraid_transport_update_links(adapter, + leapraid_transport_update_links( + adapter, topo_node_exp->sas_address, le16_to_cpu(exp_p1.attached_dev_hdl), i, - exp_p1.neg_link_rate >> 4, + exp_p1.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT, topo_node_exp->card_port); } } @@ -4547,7 +5138,7 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "begin scanning expanders\n"); + dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4558,7 +5149,8 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) port_id = exp_p0.physical_port; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, le64_to_cpu(exp_p0.sas_address), leapraid_get_port_by_id(adapter, port_id, @@ -4572,14 +5164,14 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) leapraid_exp_add(adapter, hdl); dev_info(&adapter->pdev->dev, - "add exp: hdl=0x%04x, sas addr=0x%016llx\n", + "add exp: hdl=0x%04x, SAS addr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( exp_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "expanders scan complete\n"); + dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -4596,7 +5188,7 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "begin scanning phys disk\n"); + dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; @@ -4629,20 +5221,25 @@ static void leapraid_scan_phy_disks_after_reset( LEAPRAID_SAS_NEG_LINK_RATE_1_5, leapraid_get_port_by_id( adapter, port_id, false)); - set_bit(hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - - leapraid_add_dev(adapter, hdl); - - dev_info(&adapter->pdev->dev, - "add phys disk: hdl=0x%04x, sas addr=0x%016llx\n", - hdl, - (unsigned long long)le64_to_cpu( - sas_dev_p0.sas_address)); + if (!hdl || hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", + __func__); + } else { + set_bit(hdl, adapter->dev_topo.pd_hdls); + leapraid_add_dev(adapter, hdl); + + dev_info(&adapter->pdev->dev, + "add pd hdl=0x%04x saddr=0x%016llx\n", + hdl, + (unsigned long long)le64_to_cpu( + sas_dev_p0.sas_address)); + } } } - dev_info(&adapter->pdev->dev, "phys disk scan complete\n"); + dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -4652,10 +5249,9 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) union cfg_param_1 cfgp1_extra = {0}; union cfg_param_2 cfgp2_extra = {0}; struct leapraid_evt_data_ir_change evt_data; - static struct leapraid_raid_volume *raid_volume; + struct leapraid_raid_volume *raid_volume; struct leapraid_raidvol_p1 *vol_p1; struct leapraid_raidvol_p0 *vol_p0; - unsigned long flags; u16 hdl; vol_p0 = kzalloc(sizeof(*vol_p0), GFP_KERNEL); @@ -4668,21 +5264,20 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "begin scanning volumes\n"); + dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, cfgp2, GET_RAID_VOLUME_PG1); cfgp2.handle = hdl) { hdl = le16_to_cpu(vol_p1->dev_hdl); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid( adapter, le64_to_cpu(vol_p1->wwid)); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume) + if (raid_volume) { + leapraid_raid_volume_put(raid_volume); continue; + } cfgp1_extra.size = sizeof(struct leapraid_raidvol_p0); cfgp2_extra.handle = hdl; @@ -4707,7 +5302,7 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - dev_info(&adapter->pdev->dev, "volumes scan complete\n"); + dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -4721,7 +5316,7 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u8 port_id; dev_info(&adapter->pdev->dev, - "begin scanning sas end devices\n"); + "Begin scanning SAS end devices\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4729,6 +5324,13 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) GET_SAS_DEVICE_PG0); cfgp2.handle = hdl) { hdl = le16_to_cpu(sas_dev_p0.dev_hdl); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + continue; + } + if (!(leapraid_is_end_dev(le32_to_cpu(sas_dev_p0.dev_info)))) continue; @@ -4759,21 +5361,21 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) false)); leapraid_add_dev(adapter, hdl); dev_info(&adapter->pdev->dev, - "add sas dev: hdl=0x%04x, sas addr=0x%016llx\n", + "Add SAS dev: hdl=0x%04x, saddr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( sas_dev_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "sas end devices scan complete\n"); + dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "begin scanning devices\n"); + dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { leapraid_scan_phy_disks_after_reset(adapter); @@ -4781,11 +5383,13 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) } leapraid_scan_sas_dev_after_reset(adapter); - dev_info(&adapter->pdev->dev, "devices scan complete\n"); + dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) { + unsigned long flags; + leapraid_remove_unresp_dev(adapter); leapraid_del_dirty_vphy(adapter); leapraid_del_dirty_card_port(adapter); @@ -4794,6 +5398,10 @@ static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) if (adapter->scan_dev_desc.driver_loading) leapraid_scan_dev_done(adapter); + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + wake_up(&adapter->access_ctrl.shost_recover_wq); } static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, @@ -4802,15 +5410,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, { void *req; bool reset_flg = false; - int rc = 0; + int rc; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc(adapter, + req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.enc_cmd.inter_taskid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); @@ -4820,6 +5430,10 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: SEP command timeout, status=0x%x\n", + __func__, adapter->driver_cmds.enc_cmd.status); + leapraid_log_req_context(adapter, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -4828,17 +5442,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, } if (adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_REPLY_VALID) - memcpy(sep_rep, (void *)(&adapter->driver_cmds.enc_cmd.reply), + memcpy(sep_rep, &adapter->driver_cmds.enc_cmd.reply, sizeof(struct leapraid_sep_rep)); do_hard_reset: if (reset_flg) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; -out: +unlock: mutex_unlock(&adapter->driver_cmds.enc_cmd.mutex); return rc; } @@ -4857,8 +5471,9 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, sep_req.func = LEAPRAID_FUNC_SCSI_ENC_PROCESSOR; sep_req.act = LEAPRAID_SEP_REQ_ACT_WRITE_STATUS; if (on) { - sep_req.slot_status = - cpu_to_le32(LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); + u32 status = LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT; + + sep_req.slot_status = cpu_to_le32(status); sep_req.dev_hdl = cpu_to_le16(sas_dev->hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS; if (leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req)) { @@ -4866,52 +5481,75 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, return; } - sas_dev->led_on = true; - if (sep_rep.adapter_status) - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 1; + leapraid_sdev_put(sas_dev); } else { sep_req.slot_status = 0; sep_req.slot = cpu_to_le16(sas_dev->slot); sep_req.dev_hdl = 0; sep_req.enc_hdl = cpu_to_le16(sas_dev->enc_hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS; - if ((leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req))) { - leapraid_sdev_put(sas_dev); - return; - } + leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req); + } +} - if (sep_rep.adapter_status) { - leapraid_sdev_put(sas_dev); - return; +static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) +{ + unsigned long flags; + + while (scsi_host_in_recovery(adapter->shost) || + adapter->access_ctrl.shost_recovering) { + if (adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup) { + spin_lock_irqsave( + &adapter->reset_desc.adapter_reset_lock, + flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore( + &adapter->reset_desc.adapter_reset_lock, + flags); + + wake_up(&adapter->access_ctrl.shost_recover_wq); + + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost %d, host %d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.host_removing); + + return -EFAULT; } + + wait_event_timeout(adapter->access_ctrl.recovery_waitq, + !adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup, + msecs_to_jiffies(1000)); } + return 0; } static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { struct leapraid_sas_dev *sas_dev; + unsigned long flags; + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); adapter->fw_evt_s.cur_evt = fw_evt; + adapter->fw_evt_s.cur_evt_task = current; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_del_fw_evt_from_list(adapter, fw_evt); if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; } switch (fw_evt->evt_type) { - case LEAPRAID_EVT_SAS_DISCOVERY: - { - struct leapraid_evt_data_sas_disc *evt_data; - - evt_data = fw_evt->evt_data; - if (evt_data->reason_code == - LEAPRAID_EVT_SAS_DISC_RC_STARTED && - !adapter->dev_topo.card.phys_num) - leapraid_sas_host_add(adapter, 0); - break; - } case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: leapraid_sas_topo_chg_evt(adapter, fw_evt); break; @@ -4922,14 +5560,9 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_sas_enc_dev_stat_chg_evt(adapter, fw_evt); break; case LEAPRAID_EVT_REMOVE_DEAD_DEV: - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) - goto out; + if (leapraid_wait_adapter_recovery(adapter)) + goto out_cleanup; - ssleep(1); - } leapraid_hardreset_async_logic(adapter); break; case LEAPRAID_EVT_TURN_ON_PFA_LED: @@ -4938,14 +5571,17 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_set_led(adapter, sas_dev, true); break; case LEAPRAID_EVT_SCAN_DEV_DONE: - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; break; default: break; } -out: +out_cleanup: + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); } static void leapraid_sas_dev_stat_chg_evt( @@ -4953,7 +5589,7 @@ static void leapraid_sas_dev_stat_chg_evt( struct leapraid_evt_data_sas_dev_status_change *event_data) { struct leapraid_starget_priv *starget_priv; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; u64 sas_address; unsigned long flags; @@ -4968,26 +5604,29 @@ static void leapraid_sas_dev_stat_chg_evt( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_address = le64_to_cpu(event_data->sas_address); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, sas_address, leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (sas_dev && sas_dev->starget) { - starget_priv = sas_dev->starget->hostdata; - if (starget_priv) { - switch (event_data->reason_code) { - case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: - starget_priv->tm_busy = true; - break; - case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: - starget_priv->tm_busy = false; - break; - } + if (!sas_dev || !sas_dev->starget) + goto out_unlock; + + starget_priv = sas_dev->starget->hostdata; + if (starget_priv) { + switch (event_data->reason_code) { + case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 1; + break; + case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 0; + break; } } +out_unlock: if (sas_dev) leapraid_sdev_put(sas_dev); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -5000,32 +5639,45 @@ static void leapraid_set_volume_delete_flag(struct leapraid_adapter *adapter, struct leapraid_starget_priv *sas_target_priv_data; unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, handle); - if (raid_volume && raid_volume->starget && - raid_volume->starget->hostdata) { - sas_target_priv_data = raid_volume->starget->hostdata; - sas_target_priv_data->deleted = true; + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (raid_volume->starget && + raid_volume->starget->hostdata) { + sas_target_priv_data = raid_volume->starget->hostdata; + sas_target_priv_data->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } -static void leapraid_check_ir_change_evt(struct leapraid_adapter *adapter, +static void leapraid_check_ir_change_evt( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 phys_disk_dev_hdl; switch (evt_data->reason_code) { case LEAPRAID_EVT_IR_RC_VOLUME_DELETE: - leapraid_set_volume_delete_flag(adapter, - le16_to_cpu(evt_data->vol_dev_hdl)); + leapraid_set_volume_delete_flag( + adapter, + le16_to_cpu(evt_data->vol_dev_hdl)); break; case LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE: phys_disk_dev_hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - clear_bit(phys_disk_dev_hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + if (!phys_disk_dev_hdl || + phys_disk_dev_hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + } else { + clear_bit(phys_disk_dev_hdl, + adapter->dev_topo.pd_hdls); + leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + } break; } } @@ -5035,7 +5687,7 @@ static void leapraid_topo_del_evts_process_exp_status( struct leapraid_evt_data_sas_topo_change_list *evt_data) { struct leapraid_fw_evt_work *fw_evt = NULL; - struct leapraid_evt_data_sas_topo_change_list *loc_evt_data = NULL; + struct leapraid_evt_data_sas_topo_change_list *loc_evt_data; unsigned long flags; u16 exp_hdl; @@ -5066,7 +5718,8 @@ static void leapraid_topo_del_evts_process_exp_status( } } -static void leapraid_check_topo_del_evts(struct leapraid_adapter *adapter, +static void leapraid_check_topo_del_evts( + struct leapraid_adapter *adapter, struct leapraid_evt_data_sas_topo_change_list *evt_data) { int reason_code; @@ -5096,17 +5749,20 @@ static bool leapraid_async_process_evt( switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: - leapraid_sas_dev_stat_chg_evt(adapter, + leapraid_sas_dev_stat_chg_evt( + adapter, (struct leapraid_evt_data_sas_dev_status_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_IR_CHANGE: - leapraid_check_ir_change_evt(adapter, + leapraid_check_ir_change_evt( + adapter, (struct leapraid_evt_data_ir_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: - leapraid_check_topo_del_evts(adapter, + leapraid_check_topo_del_evts( + adapter, (struct leapraid_evt_data_sas_topo_change_list *)event_notify_rep->evt_data); if (adapter->access_ctrl.shost_recovering) { @@ -5114,7 +5770,6 @@ static bool leapraid_async_process_evt( return exit_flag; } break; - case LEAPRAID_EVT_SAS_DISCOVERY: case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: break; default: @@ -5136,7 +5791,7 @@ static void leapraid_async_evt_cb_enqueue( if (!fw_evt) return; - evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * 4; + evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * sizeof(u32); fw_evt->evt_data = kmemdup(evt_notify_rep->evt_data, evt_sz, GFP_ATOMIC); if (!fw_evt->evt_data) { @@ -5225,13 +5880,63 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, - u16 taskid, u8 msix_index, - u32 rep_paddr, u8 cb_idx) +static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) +{ + u16 status; + + cmd->status &= ~LEAPRAID_CMD_PENDING; + + status = le16_to_cpu(rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + + if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + adapter->scan_dev_desc.scan_dev_failed = 1; + + if (!cmd->async_scan_dev) { + complete(&cmd->done); + return 1; + } + + if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) + leapraid_scan_dev_complete(adapter); + else + adapter->scan_dev_desc.scan_start_failed = status; + + return 1; +} + +static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, + struct leapraid_rep *rep, + u16 taskid) +{ + struct leapraid_scsiio_rep *scsiio_reply; + + if (rep->function != LEAPRAID_FUNC_SCSIIO && + rep->function != LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH) + return; + + scsiio_reply = (struct leapraid_scsiio_rep *)rep; + + if (!(scsiio_reply->scsi_state & + LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) + return; + + memcpy(&adapter->driver_cmds.ctl_cmd.sense, + leapraid_get_sense_buffer(adapter, taskid), + min_t(u32, SCSI_SENSE_BUFFERSIZE, + le32_to_cpu(scsiio_reply->sense_count))); +} + +static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_index, + u32 rep_paddr, u8 cb_idx) { struct leapraid_rep *leap_mpi_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); struct leapraid_driver_cmd *sp_cmd, *_sp_cmd = NULL; + u8 reply_len; list_for_each_entry(sp_cmd, &adapter->driver_cmds.special_cmd_list, list) @@ -5241,74 +5946,55 @@ static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, } if (WARN_ON(!_sp_cmd)) - return 1; + return true; if (WARN_ON(_sp_cmd->status == LEAPRAID_CMD_NOT_USED)) - return 1; + return true; if (WARN_ON(taskid != _sp_cmd->hp_taskid && taskid != _sp_cmd->taskid && taskid != _sp_cmd->inter_taskid)) - return 1; - + return true; _sp_cmd->status |= LEAPRAID_CMD_DONE; if (leap_mpi_rep) { - memcpy((void *)(&_sp_cmd->reply), leap_mpi_rep, - leap_mpi_rep->msg_len * 4); + reply_len = leap_mpi_rep->msg_len * sizeof(u32); + if (reply_len > LEAPRAID_REPLY_SIZE) + reply_len = LEAPRAID_REPLY_SIZE; + memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { - u16 adapter_status; - - _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; - adapter_status = - le16_to_cpu(leap_mpi_rep->adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - adapter->scan_dev_desc.scan_dev_failed = true; - - if (_sp_cmd->async_scan_dev) { - if (adapter_status == - LEAPRAID_ADAPTER_STATUS_SUCCESS) { - leapraid_scan_dev_complete(adapter); - } else { - adapter->scan_dev_desc.scan_start_failed = - adapter_status; - } - return 1; - } - - complete(&_sp_cmd->done); - return 1; - } + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) + return leapraid_handle_scan_cb(adapter, + _sp_cmd, + leap_mpi_rep); - if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) { - struct leapraid_scsiio_rep *scsiio_reply; - - if (leap_mpi_rep->function == - LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_rep->function == - LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH) { - scsiio_reply = - (struct leapraid_scsiio_rep *)leap_mpi_rep; - if (scsiio_reply->scsi_state & - LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) - memcpy((void *)(&adapter->driver_cmds.ctl_cmd.sense), - leapraid_get_sense_buffer(adapter, taskid), - min_t(u32, - SCSI_SENSE_BUFFERSIZE, - le32_to_cpu(scsiio_reply->sense_count))); - } - } + if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) + leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); } _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; complete(&_sp_cmd->done); - return 1; + return true; } -static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, - union leapraid_rep_desc_union *rpf, - u8 req_desc_type, u8 msix_idx) +static void leapraid_complete_task(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_idx, u32 rep) +{ + if (taskid <= adapter->shost->can_queue || + taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) + leapraid_free_taskid(adapter, taskid); + return; + } + + if (leapraid_driver_cmds_done(adapter, taskid, msix_idx, rep, + leapraid_get_cb_idx(adapter, taskid))) + leapraid_free_taskid(adapter, taskid); +} + +static void leapraid_request_descript_handler( + struct leapraid_adapter *adapter, + union leapraid_rep_desc_union *rpf, + u8 req_desc_type, u8 msix_idx) { u32 rep; u16 taskid; @@ -5318,50 +6004,34 @@ static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, switch (req_desc_type) { case LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS: case LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS: - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, msix_idx, 0); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, 0, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } + leapraid_complete_task(adapter, taskid, msix_idx, 0); break; case LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY: rep = le32_to_cpu(rpf->addr_rep.rep_frame_addr); - if (rep > ((u32)adapter->mem_desc.rep_msg_dma + - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ) || - rep < ((u32)adapter->mem_desc.rep_msg_dma)) + if (rep > (u32)adapter->mem_desc.rep_msg_dma + + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE || + rep < (u32)adapter->mem_desc.rep_msg_dma) rep = 0; - if (taskid) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, - msix_idx, rep); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, rep, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } - } else { + + if (taskid) + leapraid_complete_task(adapter, taskid, msix_idx, rep); + else leapraid_handle_async_event(adapter, msix_idx, rep); - } - if (rep) { - adapter->rep_msg_host_idx = - (adapter->rep_msg_host_idx == - (adapter->adapter_attr.rep_msg_qd - 1)) ? - 0 : adapter->rep_msg_host_idx + 1; - adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = - cpu_to_le32(rep); - wmb(); /* Make sure that all write ops are in order */ - writel(adapter->rep_msg_host_idx, - &adapter->iomem_base->rep_msg_host_idx); - } + if (!rep) + return; + + adapter->rep_msg_host_idx = + (adapter->rep_msg_host_idx == + (adapter->adapter_attr.rep_msg_qd - 1)) ? + 0 : adapter->rep_msg_host_idx + 1; + adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = + cpu_to_le32(rep); + wmb(); /* Make sure that all write ops are in order */ + writel(adapter->rep_msg_host_idx, + &adapter->iomem_base->rep_msg_host_idx); + break; default: break; @@ -5423,8 +6093,8 @@ int leapraid_rep_queue_handler(struct leapraid_rq *rq) wmb(); /* Make sure that all write ops are in order */ writel(rq->rep_post_host_idx | ((msix_idx & LEAPRAID_MSIX_GROUP_MASK) << LEAPRAID_RPHI_MSIX_IDX_SHIFT), - &adapter->iomem_base->rep_post_reg_idx[msix_idx / - LEAPRAID_MSIX_GROUP_SIZE].idx); + &adapter->iomem_base->rep_post_reg_idx[ + msix_idx / LEAPRAID_MSIX_GROUP_SIZE].idx); atomic_dec(&rq->busy); return finish_cmds; } @@ -5441,7 +6111,7 @@ static irqreturn_t leapraid_irq_handler(int irq, void *bus_id) if (adapter->mask_int) return IRQ_NONE; - return ((leapraid_rep_queue_handler(rq) > 0) ? + return (leapraid_rep_queue_handler(rq) > 0 ? IRQ_HANDLED : IRQ_NONE); } @@ -5469,7 +6139,8 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) if (int_rq->rq.msix_idx == 0) continue; - synchronize_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx)); + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); if (poll) leapraid_rep_queue_handler(&int_rq->rq); } @@ -5491,16 +6162,18 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 1); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 1); for (qid = 0; qid < iopoll_q_count; qid++) { - while (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy)) { + while (atomic_read(&desc->blk_mq_poll_rqs[qid].busy)) { cpu_relax(); udelay(LEAPRAID_IO_POLL_DELAY_US); } @@ -5509,19 +6182,30 @@ void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) void leapraid_mq_polling_resume(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 0); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 0); } static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, u32 *host_diag) { - const u32 unlock_seq[] = { 0x0, 0xF, 0x4, 0xB, 0x2, 0x7, 0xD }; + const u32 unlock_seq[] = { + LEAPRAID_WRSEQ_FLUSH_KEY_VALUE, + LEAPRAID_WRSEQ_1ST_KEY_VALUE, + LEAPRAID_WRSEQ_2ND_KEY_VALUE, + LEAPRAID_WRSEQ_3RD_KEY_VALUE, + LEAPRAID_WRSEQ_4TH_KEY_VALUE, + LEAPRAID_WRSEQ_5TH_KEY_VALUE, + LEAPRAID_WRSEQ_6TH_KEY_VALUE + }; + const int max_retries = LEAPRAID_UNLOCK_RETRY_LIMIT; int retry = 0; unsigned int i; @@ -5538,51 +6222,46 @@ static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, return 0; } - dev_err(&adapter->pdev->dev, "try host reset timeout!\n"); + dev_err(&adapter->pdev->dev, "Try host reset timeout!\n"); return -EFAULT; } static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - u32 cnt; - dev_info(&adapter->pdev->dev, "entering host diag reset!\n"); + dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); if (leapraid_unlock_host_diag(adapter, &host_diag)) - goto out; + goto out_cleanup; writel(host_diag | LEAPRAID_DIAG_RESET, &adapter->iomem_base->host_diag); + msleep(LEAPRAID_MSLEEP_EXTRA_LONG_MS); msleep(LEAPRAID_MSLEEP_NORMAL_MS); - for (cnt = 0; cnt < LEAPRAID_RESET_LOOP_COUNT_DEFAULT; cnt++) { - host_diag = leapraid_readl(&adapter->iomem_base->host_diag); - if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL) - goto out; - - if (!(host_diag & LEAPRAID_DIAG_RESET)) - break; - msleep(LEAPRAID_RESET_POLL_INTERVAL_MS); - } + host_diag = leapraid_readl(&adapter->iomem_base->host_diag); + if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL || + host_diag & LEAPRAID_DIAG_RESET) + goto out_cleanup; - writel(host_diag & ~LEAPRAID_DIAG_HOLD_ADAPTER_RESET, - &adapter->iomem_base->host_diag); writel(0x0, &adapter->iomem_base->ws); mutex_unlock(&adapter->reset_desc.host_diag_mutex); if (!leapraid_wait_adapter_ready(adapter)) - goto out; + goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag success!\n"); + dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; -out: - pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag failed!\n"); + +out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); +out_failed: + pci_cfg_access_unlock(adapter->pdev); + dev_info(&adapter->pdev->dev, "Host diag failed!\n"); return -EFAULT; } @@ -5592,12 +6271,12 @@ static int leapraid_find_matching_port( { int i; - for (i = 0; i < count; i++) { + for (i = 0; i < count; i++) if (card_port_table[i].port_id == port_id && card_port_table[i].sas_address == sas_addr) return i; - } - return -1; + + return LEAPRAID_INVALID_INDEX; } static u8 leapraid_fill_card_port_table( @@ -5611,12 +6290,13 @@ static u8 leapraid_fill_card_port_table( int i, idx; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if ((sas_iounit_p0->phy_info[i].neg_link_rate >> 4) - < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + if (sas_iounit_p0->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < + LEAPRAID_SAS_NEG_LINK_RATE_1_5) continue; - attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + attached_hdl = le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) @@ -5648,7 +6328,7 @@ static u8 leapraid_set_new_card_port_table_after_reset( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; u8 port_entry_num = 0; u16 sz; @@ -5660,14 +6340,14 @@ static u8 leapraid_set_new_card_port_table_after_reset( return port_entry_num; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; port_entry_num = leapraid_fill_card_port_table(adapter, sas_iounit_p0, new_card_port_table); -out: +out_free: kfree(sas_iounit_p0); return port_entry_num; } @@ -5676,9 +6356,9 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, struct leapraid_card_port *new_table, int entry_idx, int port_entry_num) { - struct leapraid_card_port *matched_card_port = NULL; + struct leapraid_card_port *matched_card_port; int matched_code; - int count = 0, lcount = 0; + int count, lcount = 0; u64 sas_addr; int i; @@ -5699,10 +6379,10 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, port_entry_num); } else if (matched_code == SAME_ADDR_ONLY) { sas_addr = new_table[entry_idx].sas_address; - for (i = 0; i < port_entry_num; i++) { + for (i = 0; i < port_entry_num; i++) if (new_table[i].sas_address == sas_addr) lcount++; - } + if (count > 1 || lcount > 1) return; @@ -5724,15 +6404,24 @@ static void leapraid_update_card_port_after_reset( struct leapraid_adapter *adapter) { struct leapraid_card_port *new_card_port_table; - struct leapraid_card_port *matched_card_port = NULL; - u8 port_entry_num = 0; + struct leapraid_card_port *matched_card_port; + u8 port_entry_num; u8 nr_phys; int i; if (leapraid_get_adapter_phys(adapter, &nr_phys) || !nr_phys) return; + if (!adapter->dev_topo.card.card_phy) { + adapter->dev_topo.card.card_phy = + kcalloc(nr_phys, sizeof(struct leapraid_card_phy), + GFP_KERNEL); + if (!adapter->dev_topo.card.card_phy) + return; + } + adapter->dev_topo.card.phys_num = nr_phys; + new_card_port_table = kcalloc(adapter->dev_topo.card.phys_num, sizeof(struct leapraid_card_port), GFP_KERNEL); @@ -5740,21 +6429,23 @@ static void leapraid_update_card_port_after_reset( return; port_entry_num = - leapraid_set_new_card_port_table_after_reset(adapter, - new_card_port_table); + leapraid_set_new_card_port_table_after_reset( + adapter, + new_card_port_table); if (!port_entry_num) - return; + goto out_free_port_table; list_for_each_entry(matched_card_port, - &adapter->dev_topo.card_port_list, list) { + &adapter->dev_topo.card_port_list, list) matched_card_port->flg |= LEAPRAID_CARD_PORT_FLG_DIRTY; - } matched_card_port = NULL; for (i = 0; i < port_entry_num; i++) leapraid_update_existing_port(adapter, new_card_port_table, i, port_entry_num); +out_free_port_table: + kfree(new_card_port_table); } static bool leapraid_is_valid_vphy( @@ -5765,13 +6456,16 @@ static bool leapraid_is_valid_vphy( union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; struct leapraid_sas_phy_p0 phy_p0; + u32 dev_info; - if ((sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> 4) < + if (sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < LEAPRAID_SAS_NEG_LINK_RATE_1_5) return false; - if (!(le32_to_cpu(sas_io_unit_p0->phy_info[phy_index].controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP)) + dev_info = le32_to_cpu(sas_io_unit_p0->phy_info[phy_index] + .controller_phy_dev_info); + if (!(dev_info & LEAPRAID_DEVTYP_SEP)) return false; cfgp1.phy_number = phy_index; @@ -5804,7 +6498,7 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, return; may_new_card_port->port_id = may_new_port_id; dev_err(&adapter->pdev->dev, - "%s: new card port %p added, port=%d\n", + "%s: New card port %p added, port=%d\n", __func__, may_new_card_port, may_new_port_id); list_add_tail(&may_new_card_port->list, &adapter->dev_topo.card_port_list); @@ -5820,8 +6514,10 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, sas_dev = leapraid_get_sas_dev_by_addr(adapter, attached_sas_addr, card_port); - if (sas_dev) + if (sas_dev) { sas_dev->card_port = may_new_card_port; + leapraid_sdev_put(sas_dev); + } } if (may_new_card_port->flg & LEAPRAID_CARD_PORT_FLG_DIRTY) { @@ -5836,7 +6532,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; struct leapraid_card_port *card_port, *card_port_next; struct leapraid_vphy *vphy, *vphy_next; u64 attached_sas_addr; @@ -5852,9 +6548,8 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) continue; list_for_each_entry_safe(vphy, vphy_next, - &card_port->vphys_list, list) { + &card_port->vphys_list, list) vphy->flg |= LEAPRAID_VPHY_FLG_DIRTY; - } } sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + @@ -5865,16 +6560,17 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) return; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { if (!leapraid_is_valid_vphy(adapter, sas_iounit_p0, i)) continue; attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) continue; @@ -5916,7 +6612,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) break; } } -out: +out_free: kfree(sas_iounit_p0); } @@ -5928,17 +6624,21 @@ static void leapraid_mark_all_dev_deleted(struct leapraid_adapter *adapter) shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (sdev_priv && sdev_priv->starget_priv) - sdev_priv->starget_priv->deleted = true; + sdev_priv->starget_priv->deleted = 1; } } static void leapraid_free_enc_list(struct leapraid_adapter *adapter) { struct leapraid_enc_node *enc_dev, *enc_dev_next; + LIST_HEAD(free_list); + unsigned long flags; + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + list_splice_init(&adapter->dev_topo.enc_list, &free_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); - list_for_each_entry_safe(enc_dev, enc_dev_next, - &adapter->dev_topo.enc_list, - list) { + list_for_each_entry_safe(enc_dev, enc_dev_next, &free_list, list) { list_del(&enc_dev->list); kfree(enc_dev); } @@ -5951,14 +6651,14 @@ static void leapraid_rebuild_enc_list_after_reset( union cfg_param_2 cfgp2 = {0}; struct leapraid_enc_node *enc_node; u16 enc_hdl; + unsigned long flags; int rc; leapraid_free_enc_list(adapter); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (enc_hdl = 0xFFFF; ; enc_hdl = le16_to_cpu(enc_node->pg0.enc_hdl)) { - enc_node = kzalloc(sizeof(*enc_node), - GFP_KERNEL); + enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); if (!enc_node) return; @@ -5970,91 +6670,102 @@ static void leapraid_rebuild_enc_list_after_reset( return; } + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } } static void leapraid_mark_resp_sas_dev(struct leapraid_adapter *adapter, struct leapraid_sas_dev_p0 *sas_dev_p0) { - struct leapraid_starget_priv *starget_priv = NULL; + struct leapraid_starget_priv *starget_priv; struct leapraid_enc_node *enc_node = NULL; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; struct scsi_target *starget; unsigned long flags; + unsigned long enc_flags = 0; + u16 enc_hdl; + u64 enc_lid = 0; card_port = leapraid_get_port_by_id(adapter, sas_dev_p0->physical_port, false); - if (sas_dev_p0->enc_hdl) { - enc_node = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu( - sas_dev_p0->enc_hdl)); + enc_hdl = le16_to_cpu(sas_dev_p0->enc_hdl); + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); + enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); if (!enc_node) dev_info(&adapter->pdev->dev, "enc hdl 0x%04x has no matched enc dev\n", - le16_to_cpu(sas_dev_p0->enc_hdl)); + enc_hdl); } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) { - if (sas_dev->sas_addr == le64_to_cpu(sas_dev_p0->sas_address) && - sas_dev->slot == le16_to_cpu(sas_dev_p0->slot) && - sas_dev->card_port == card_port) { - sas_dev->resp = true; - starget = sas_dev->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->tm_busy = false; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } + if (sas_dev->sas_addr != le64_to_cpu(sas_dev_p0->sas_address) || + sas_dev->slot != le16_to_cpu(sas_dev_p0->slot) || + sas_dev->card_port != card_port) + continue; - if (starget) { - starget_printk(KERN_INFO, starget, - "dev: hdl=0x%04x, sas addr=0x%016llx, port_id=%d\n", - sas_dev->hdl, - (unsigned long long)sas_dev->sas_addr, - sas_dev->card_port->port_id); - if (sas_dev->enc_hdl != 0) - starget_printk(KERN_INFO, starget, - "enc info: enc_lid=0x%016llx, slot=%d\n", - (unsigned long long)sas_dev->enc_lid, - sas_dev->slot); - } + sas_dev->resp = 1; + starget = sas_dev->starget; + if (starget && starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->tm_busy = 0; + starget_priv->deleted = 0; + } else { + starget_priv = NULL; + } - if (le16_to_cpu(sas_dev_p0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = sas_dev_p0->enc_level; - memcpy(sas_dev->connector_name, - sas_dev_p0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } + if (starget) { + starget_printk( + KERN_INFO, starget, + "dev: hdl=0x%04x saddr=0x%016llx port_id=%d\n", + sas_dev->hdl, + (unsigned long long)sas_dev->sas_addr, + sas_dev->card_port->port_id); + if (sas_dev->enc_hdl != 0) + starget_printk( + KERN_INFO, + starget, + "enc info: enc_lid=0x%016llx slot=%d\n", + (unsigned long long)sas_dev->enc_lid, + sas_dev->slot); + } + + if (le16_to_cpu(sas_dev_p0->flg) & + LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { + sas_dev->enc_level = sas_dev_p0->enc_level; + memcpy(sas_dev->connector_name, + sas_dev_p0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[ + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = '\0'; + } else { + sas_dev->enc_level = 0; + sas_dev->connector_name[0] = '\0'; + } + + sas_dev->enc_hdl = enc_hdl; + sas_dev->enc_lid = enc_lid; - sas_dev->enc_hdl = - le16_to_cpu(sas_dev_p0->enc_hdl); - if (enc_node) { - sas_dev->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - } - if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) - goto out; + if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) + goto unlock; - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - sas_dev->hdl, sas_dev_p0->dev_hdl); - sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - if (starget_priv) - starget_priv->hdl = - le16_to_cpu(sas_dev_p0->dev_hdl); - goto out; - } + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + sas_dev->hdl, sas_dev_p0->dev_hdl); + sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + if (starget_priv) + starget_priv->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); } @@ -6066,10 +6777,10 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) u32 device_info; dev_info(&adapter->pdev->dev, - "begin searching for sas end devices\n"); + "Begin searching for SAS end devices\n"); if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6082,63 +6793,58 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "sas end devices searching complete\n"); + "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, u64 wwid, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; + struct leapraid_starget_priv *starget_priv = NULL; struct scsi_target *starget; unsigned long flags; + u64 volume_wwid; + u16 old_hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_for_each_entry(raid_volume, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid && raid_volume->starget) { - starget = raid_volume->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } - - raid_volume->resp = true; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); + raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); + if (!raid_volume) + return; - starget_printk( - KERN_INFO, raid_volume->starget, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", - hdl, (unsigned long long)raid_volume->wwid); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume->hdl == hdl) { - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (!raid_volume->starget) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); + return; + } - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - raid_volume->hdl, hdl); + starget = raid_volume->starget; + if (starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->deleted = 0; + } - raid_volume->hdl = hdl; - if (starget_priv) - starget_priv->hdl = hdl; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + raid_volume->resp = 1; + volume_wwid = raid_volume->wwid; + old_hdl = raid_volume->hdl; + if (old_hdl != hdl) { + raid_volume->hdl = hdl; + if (starget_priv) + starget_priv->hdl = hdl; } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + starget_printk(KERN_INFO, starget, + "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + hdl, (unsigned long long)volume_wwid); + if (old_hdl != hdl) + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + old_hdl, hdl); + + leapraid_raid_volume_put(raid_volume); } static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) @@ -6150,17 +6856,22 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) struct leapraid_raidvol_p1 raidvol_p1; struct leapraid_raidvol_p0 raidvol_p0; struct leapraid_raidpd_p0 raidpd_p0; + unsigned long flags; u16 hdl; u8 phys_disk_num; + bool is_empty; if (!adapter->adapter_attr.raid_support) return; dev_info(&adapter->pdev->dev, - "begin searching for raid volumes\n"); + "Begin searching for RAID volumes\n"); - if (list_empty(&adapter->dev_topo.raid_volume_list)) - goto out; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + is_empty = list_empty(&adapter->dev_topo.raid_volume_list); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (is_empty) + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6191,11 +6902,16 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) cfgp2.form_specific = phys_disk_num) { phys_disk_num = raidpd_p0.phys_disk_num; hdl = le16_to_cpu(raidpd_p0.dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + else + set_bit(hdl, adapter->dev_topo.pd_hdls); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "raid volumes searching complete\n"); + "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6211,10 +6927,17 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, port_id, false); unsigned long flags; + unsigned long enc_flags = 0; + u64 enc_lid = 0; int i; - if (enc_hdl) + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); + } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); list_for_each_entry(topo_node_exp, &adapter->dev_topo.exp_list, list) { @@ -6222,14 +6945,11 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->card_port != card_port) continue; - topo_node_exp->resp = true; - if (enc_node) { - topo_node_exp->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - topo_node_exp->enc_hdl = le16_to_cpu(exp_pg0->enc_hdl); - } + topo_node_exp->resp = 1; + topo_node_exp->enc_hdl = enc_hdl; + topo_node_exp->enc_lid = enc_lid; if (topo_node_exp->hdl == hdl) - goto out; + goto unlock; dev_info(&adapter->pdev->dev, "hdl changed: 0x%04x -> 0x%04x\n", @@ -6237,9 +6957,9 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->hdl = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) topo_node_exp->card_phy[i].hdl = hdl; - goto out; + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); } @@ -6252,10 +6972,10 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_info(&adapter->pdev->dev, - "begin searching for expanders\n"); + dev_dbg(&adapter->pdev->dev, + "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6266,16 +6986,16 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) sas_address = le64_to_cpu(exp_p0.sas_address); port = exp_p0.physical_port; - dev_info(&adapter->pdev->dev, - "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", - hdl, (unsigned long long)sas_address, - ((adapter->adapter_attr.enable_mp) ? (port) : - (LEAPRAID_DISABLE_MP_PORT_ID))); + dev_dbg(&adapter->pdev->dev, + "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", + hdl, (unsigned long long)sas_address, + adapter->adapter_attr.enable_mp ? port : + LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -out: - dev_info(&adapter->pdev->dev, - "expander searching complete\n"); +exit_search: + dev_dbg(&adapter->pdev->dev, + "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -6287,7 +7007,7 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) adapter->reset_desc.pending_io_cnt = 0; if (!leapraid_pci_active(adapter)) { dev_err(&adapter->pdev->dev, - "%s %s: pci error, device reset or unplugged!\n", + "%s %s: PCI error, device reset or unplugged!\n", adapter->adapter_attr.name, __func__); return; } @@ -6299,9 +7019,9 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) for (i = 1; i <= adapter->shost->can_queue; i++) { io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, i); - if (io_req_tracker && io_req_tracker->taskid != 0) - if (io_req_tracker->scmd) - adapter->reset_desc.pending_io_cnt++; + if (io_req_tracker && io_req_tracker->taskid != 0 && + io_req_tracker->scmd) + adapter->reset_desc.pending_io_cnt++; } spin_unlock_irqrestore(&adapter->dynamic_task_desc.task_lock, flags); @@ -6309,38 +7029,37 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) return; wait_event_timeout(adapter->reset_desc.reset_wait_queue, - adapter->reset_desc.pending_io_cnt == 0, 10 * HZ); + adapter->reset_desc.pending_io_cnt == 0, + LEAPRAID_IO_CMD_TIMEOUT * HZ); } int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, enum reset_type type) { unsigned long flags; + bool wake = false; int rc; - if (!mutex_trylock(&adapter->reset_desc.adapter_reset_mutex)) { - do { - ssleep(1); - } while (adapter->access_ctrl.shost_recovering); - return adapter->reset_desc.adapter_reset_results; - } + mutex_lock(&adapter->reset_desc.adapter_reset_mutex); if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, - "pci_dev removed, pausing polling and cleaning cmds\n"); + "pci_dev removed, pause poll, clean cmds\n"); leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); } - rc = 0; - goto exit_pci_unavailable; + dev_err(&adapter->pdev->dev, "PCIe unavailable!\n"); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return -ENXIO; } - dev_info(&adapter->pdev->dev, "starting hard reset\n"); + dev_info(&adapter->pdev->dev, "Starting hard reset\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; + adapter->access_ctrl.shost_recover_async = 1; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); leapraid_wait_cmds_done(adapter); @@ -6349,14 +7068,14 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, rc = leapraid_make_adapter_ready(adapter, type); if (rc) { dev_err(&adapter->pdev->dev, - "failed to make adapter ready, rc=%d\n", rc); - goto out; + "Failed to make adapter ready, rc=%d\n", rc); + goto out_cleanup; } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "firmware log init failed\n"); - goto out; + dev_err(&adapter->pdev->dev, "Firmware log init failed\n"); + goto out_cleanup; } leapraid_clean_active_cmds(adapter); @@ -6364,15 +7083,16 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, adapter->scan_dev_desc.scan_dev_failed) { dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; - goto out; + goto out_cleanup; } rc = leapraid_make_adapter_available(adapter); if (!rc) { dev_info(&adapter->pdev->dev, - "adapter is now available, rebuilding topology\n"); + "Adapter is now available, rebuilding topology\n"); if (adapter->adapter_attr.enable_mp) { leapraid_update_card_port_after_reset(adapter); leapraid_update_vphys_after_reset(adapter); @@ -6384,14 +7104,22 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_search_resp_exp(adapter); leapraid_hardreset_barrier(adapter); } -out: - dev_info(&adapter->pdev->dev, "hard reset %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); +out_cleanup: + dev_info(&adapter->pdev->dev, "Hard reset %s\n", + rc == 0 ? "SUCCESS" : "FAILED"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + if (rc) { + adapter->access_ctrl.shost_recover_async = 0; + wake = true; + } spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + if (wake) + wake_up(&adapter->access_ctrl.shost_recover_wq); + adapter->reset_desc.reset_cnt++; mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); @@ -6399,8 +7127,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); -exit_pci_unavailable: - dev_info(&adapter->pdev->dev, "pcie unavailable!\n"); return rc; } @@ -6409,31 +7135,40 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) struct leapraid_adapter_features_req leap_mpi_req; struct leapraid_adapter_features_rep leap_mpi_rep; u8 fw_major, fw_minor, fw_build, fw_release; + u32 req_sz; + u32 rep_sz; u32 db; int r; db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED || - (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) + (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { + dev_err(&adapter->pdev->dev, + "%s: Doorbell used or fault\n", __func__); return -EFAULT; + } - if (((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) && - ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL)) { - if (!leapraid_wait_adapter_ready(adapter)) - return -EFAULT; + if ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY && + (db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL && + !leapraid_wait_adapter_ready(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: adapter not ready\n", __func__); + return -EFAULT; } - memset(&leap_mpi_req, 0, sizeof(struct leapraid_adapter_features_req)); - memset(&leap_mpi_rep, 0, sizeof(struct leapraid_adapter_features_rep)); + req_sz = sizeof(struct leapraid_adapter_features_req); + rep_sz = sizeof(struct leapraid_adapter_features_rep); + memset(&leap_mpi_req, 0, req_sz); + memset(&leap_mpi_rep, 0, rep_sz); leap_mpi_req.func = LEAPRAID_FUNC_GET_ADAPTER_FEATURES; r = leapraid_handshake_func(adapter, - sizeof(struct leapraid_adapter_features_req), + req_sz, (u32 *)&leap_mpi_req, - sizeof(struct leapraid_adapter_features_rep), + rep_sz, (u16 *)&leap_mpi_rep); if (r) { dev_err(&adapter->pdev->dev, - "%s %s: handshake failed, r=%d\n", + "%s %s: Handshake failed, r=%d\n", adapter->adapter_attr.name, __func__, r); return r; } @@ -6460,19 +7195,43 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) LEAPRAID_MAX_DEV_HANDLE_DEFAULT; adapter->adapter_attr.features.min_dev_handle = le16_to_cpu(leap_mpi_rep.min_dev_hdl); - if ((adapter->adapter_attr.features.adapter_caps & - LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID)) - adapter->adapter_attr.raid_support = true; + if (adapter->adapter_attr.features.adapter_caps & + LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID) + adapter->adapter_attr.raid_support = 1; + adapter->adapter_attr.wideport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.sata_max_queue_depth = + leap_mpi_rep.sata_max_qdepth ? + leap_mpi_rep.sata_max_qdepth : + LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.raid_volume_max_queue_depth = + LEAPRAID_RAID_QUEUE_DEPTH; + dev_info(&adapter->pdev->dev, + "max: wp qd=%d, np qd=%d, SATA qd=%d, raid qd=%d\n", + adapter->adapter_attr.wideport_max_queue_depth, + adapter->adapter_attr.narrowport_max_queue_depth, + adapter->adapter_attr.sata_max_queue_depth, + adapter->adapter_attr.raid_volume_max_queue_depth); if (WARN_ON(!(adapter->adapter_attr.features.adapter_caps & LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ))) return -EFAULT; adapter->adapter_attr.features.fw_version = le32_to_cpu(leap_mpi_rep.fw_version); - fw_major = (adapter->adapter_attr.features.fw_version >> 24) & 0xFF; - fw_minor = (adapter->adapter_attr.features.fw_version >> 16) & 0xFF; - fw_build = (adapter->adapter_attr.features.fw_version >> 8) & 0xFF; - fw_release = adapter->adapter_attr.features.fw_version & 0xFF; + fw_major = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MAJOR_SHIFT) & LEAPRAID_VER_MASK; + fw_minor = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MINOR_SHIFT) & LEAPRAID_VER_MASK; + fw_build = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_BUILD_SHIFT) & LEAPRAID_VER_MASK; + fw_release = + adapter->adapter_attr.features.fw_version & LEAPRAID_VER_MASK; dev_info(&adapter->pdev->dev, "Firmware version: %u.%u.%u.%u (0x%08x)\n", @@ -6484,7 +7243,7 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) "Unsupported firmware major version, requires >= 2\n"); return -EFAULT; } - adapter->shost->max_id = -1; + adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; return 0; } @@ -6511,54 +7270,50 @@ static int leapraid_enable_pcie(struct leapraid_adapter *adapter) rc = pci_enable_device(adapter->pdev); if (rc) { - dev_err(&adapter->pdev->dev, "failed to enable PCI device\n"); + dev_err(&adapter->pdev->dev, "Failed to enable PCI device\n"); return rc; } rc = pci_request_regions(adapter->pdev, LEAPRAID_DRIVER_NAME); if (rc) { dev_err(&adapter->pdev->dev, - "failed to obtain PCI resources\n"); - goto disable_pcie; + "Failed to obtain PCI resources\n"); + return rc; } if (sizeof(dma_addr_t) > 4) { - dma_mask = DMA_BIT_MASK(64); - adapter->adapter_attr.use_32_dma_mask = false; + dma_mask = DMA_BIT_MASK(DMA_64_BITS); + adapter->adapter_attr.use_32_dma_mask = 0; } else { - dma_mask = DMA_BIT_MASK(32); - adapter->adapter_attr.use_32_dma_mask = true; + dma_mask = DMA_BIT_MASK(DMA_32_BITS); + adapter->adapter_attr.use_32_dma_mask = 1; } rc = dma_set_mask_and_coherent(&adapter->pdev->dev, dma_mask); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set %lld DMA mask\n", dma_mask); - goto disable_pcie; + "Failed to set %lld DMA mask\n", dma_mask); + return rc; } adapter->iomem_base = ioremap(pci_resource_start(adapter->pdev, 0), sizeof(struct leapraid_reg_base)); if (!adapter->iomem_base) { dev_err(&adapter->pdev->dev, - "failed to map memory for controller registers\n"); - rc = -ENOMEM; - goto disable_pcie; + "Failed to map memory for controller registers\n"); + return -ENOMEM; } pci_enable_pcie_error_reporting(adapter->pdev); pci_set_master(adapter->pdev); return 0; - -disable_pcie: - return rc; } static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i, base_group, this_group; - unsigned int cpu, nr_cpus, total_msix, index = 0; + unsigned int cpu, nr_cpus, total_msix, index; total_msix = adapter->notification_desc.iopoll_qdex; nr_cpus = num_online_cpus(); @@ -6600,8 +7355,12 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq = &adapter->notification_desc.int_rqs[i]; affinity_mask = pci_irq_get_affinity(adapter->pdev, int_rq->rq.msix_idx); - if (!affinity_mask) - goto out; + if (!affinity_mask) { + dev_warn(&adapter->pdev->dev, + "%s: IRQ affinity NULL, msix_idx=%d\n", + __func__, int_rq->rq.msix_idx); + goto out_apply_irq_affinity; + } for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) @@ -6611,7 +7370,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } -out: +out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -6628,27 +7387,26 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i; + int irq; - if (!adapter->notification_desc.int_rqs) - return; - - for (i = 0; i < adapter->notification_desc.int_rqs_allocated; i++) { + for (i = 0; adapter->notification_desc.int_rqs && + i < adapter->notification_desc.int_rqs_allocated; i++) { int_rq = &adapter->notification_desc.int_rqs[i]; if (!int_rq) continue; - irq_set_affinity_hint(pci_irq_vector(adapter->pdev, - int_rq->rq.msix_idx), NULL); - free_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx), - &int_rq->rq); + irq = pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx); + irq_set_affinity_hint(irq, NULL); + free_irq(irq, &int_rq->rq); } adapter->notification_desc.int_rqs_allocated = 0; - if (!adapter->notification_desc.msix_enable) - return; + if (adapter->notification_desc.irq_vectors_allocated) { + pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; + } - pci_free_irq_vectors(adapter->pdev); - adapter->notification_desc.msix_enable = false; + adapter->notification_desc.msix_enable = 0; kfree(adapter->notification_desc.blk_mq_poll_rqs); adapter->notification_desc.blk_mq_poll_rqs = NULL; @@ -6658,16 +7416,9 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) kfree(adapter->notification_desc.msix_cpu_map); adapter->notification_desc.msix_cpu_map = NULL; -} - -static inline int leapraid_msix_cnt(struct pci_dev *pdev) -{ - return pci_msix_vec_count(pdev); -} - -static inline int leapraid_msi_cnt(struct pci_dev *pdev) -{ - return pci_msi_vec_count(pdev); + adapter->notification_desc.msix_cpu_map_sz = 0; + adapter->notification_desc.iopoll_qdex = 0; + adapter->notification_desc.iopoll_qcnt = 0; } static int leapraid_setup_irqs(struct leapraid_adapter *adapter) @@ -6675,7 +7426,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) unsigned int i; int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, @@ -6684,22 +7435,26 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi/msix vectors alloacted failed!\n", + "%d MSI/MSIX vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); return rc; } + + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = + LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == 0) + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == 1) + else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -6710,6 +7465,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); + if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -6741,10 +7497,12 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "legacy irq alloacted failed!\n"); + "Legacy irq allocated failed!\n"); return rc; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_LEGACY; rc = request_irq(pci_irq_vector(adapter->pdev, 0), leapraid_irq_handler, IRQF_SHARED, @@ -6753,8 +7511,9 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) if (rc) { irq_set_affinity_hint(pci_irq_vector(adapter->pdev, 0), NULL); pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; dev_err(&adapter->pdev->dev, - "Legact Int: request_irq %s failed!\n", + "Legacy Int: request_irq %s failed!\n", adapter->notification_desc.int_rqs[0].rq.name); return -EBUSY; } @@ -6768,8 +7527,8 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; @@ -6778,19 +7537,15 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->adapter_attr.rq_cnt; adapter->notification_desc.iopoll_qcnt = 0; dev_info(&adapter->pdev->dev, - "Legacy Intr: req queue cnt=%d, intr=%d/poll=%d rep queues!\n", + "Legacy Intr: req queue cnt=%d intr=%d/poll=%d rep queues!\n", adapter->adapter_attr.rq_cnt, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qcnt); adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "Legacy Intr: allocate %d intr rep queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } rc = leapraid_setup_legacy_int(adapter); @@ -6804,13 +7559,13 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) int rc, msix_cnt; if (msix_disable == 1) - goto legacy_int; + goto apply_legacy_int; - msix_cnt = leapraid_msix_cnt(adapter->pdev); + msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); - goto legacy_int; + dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); + goto apply_legacy_int; } msix_cnt = min_t(int, msix_cnt, @@ -6852,25 +7607,25 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSIx: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = adapter; adapter->notification_desc.blk_mq_poll_rqs[i].rq.msix_idx = i + adapter->notification_desc.iopoll_qdex; - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, 0); + atomic_set( + &adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, + 0); snprintf(adapter->notification_desc.blk_mq_poll_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MQ-Poll%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, 0); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, + 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, + 0); } adapter->notification_desc.msix_cpu_map_sz = @@ -6880,20 +7635,21 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; + memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -6906,13 +7662,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) int rc, msi_cnt; if (msix_disable == 1) - goto legacy_int1; + goto apply_legacy_int; - msi_cnt = leapraid_msi_cnt(adapter->pdev); + msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msi unsupported!\n"); - goto legacy_int1; + dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); + goto apply_legacy_int; } msi_cnt = min_t(int, msi_cnt, @@ -6952,10 +7708,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) PCI_IRQ_MSI | PCI_IRQ_AFFINITY, NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi vectors alloacted failed!\n", + "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); - goto legacy_int1; + leapraid_free_irq(adapter); + goto apply_legacy_int; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -6972,12 +7731,8 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSI: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = @@ -7001,24 +7756,24 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int1; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int1: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -7028,30 +7783,26 @@ static int leapraid_set_notification(struct leapraid_adapter *adapter) { int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = leapraid_set_msix(adapter); if (rc) - pr_err("%s enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == 1) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI-X irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { rc = leapraid_set_msi(adapter); if (rc) - pr_err("%s enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == 2) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { rc = leapraid_set_legacy_int(adapter); if (rc) - pr_err("%s enable legacy irq failed!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); } return rc; } -static void leapraid_disable_pcie_and_notification( - struct leapraid_adapter *adapter) -{ - leapraid_free_irq(adapter); - leapraid_disable_pcie(adapter); -} - int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) { int rc; @@ -7064,13 +7815,13 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_ready(adapter, PART_RESET); if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + dev_err(&adapter->pdev->dev, "Make adapter ready failure\n"); goto out_fail; } rc = leapraid_get_adapter_features(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + dev_err(&adapter->pdev->dev, "Get adapter feature failure\n"); goto out_fail; } @@ -7083,7 +7834,8 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) return 0; out_fail: - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); return rc; } @@ -7094,11 +7846,13 @@ void leapraid_disable_controller(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; leapraid_make_adapter_ready(adapter, PART_RESET); - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); } static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) @@ -7112,12 +7866,11 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - rc = -EFAULT; - goto out; + dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + return -EFAULT; } -out: - dev_info(&adapter->pdev->dev, "unit reset: %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); + + dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7137,13 +7890,13 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, while ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) { if (count++ == LEAPRAID_DB_RETRY_COUNT_MAX) { dev_err(&adapter->pdev->dev, - "wait adapter ready timeout\n"); + "Wait adapter ready timeout\n"); return -EFAULT; } ssleep(1); db = leapraid_readl(&adapter->iomem_base->db); dev_info(&adapter->pdev->dev, - "wait adapter ready, count=%d, db=0x%x\n", + "Wait adapter ready, count=%d, db=0x%x\n", count, db); } } @@ -7159,9 +7912,9 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, if (type == FULL_RESET) goto full_reset; - if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL) - if (!(leapraid_adapter_unit_reset(adapter))) - return 0; + if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL && + !leapraid_adapter_unit_reset(adapter)) + return 0; full_reset: rc = leapraid_host_diag_reset(adapter); @@ -7202,12 +7955,8 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) LEAPRAID_SYS_LOG_BUF_RESERVE), &adapter->fw_log_desc.fw_log_buffer_dma, GFP_KERNEL); - if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, - "%s: log buf alloc failed.\n", - __func__); + if (!adapter->fw_log_desc.fw_log_buffer) return -ENOMEM; - } } memset(&adapter_log_req, 0, sizeof(struct leapraid_adapter_log_req)); @@ -7226,7 +7975,7 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_log_rep), (u16 *)&adapter_log_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7265,7 +8014,7 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_msg) { dma_free_coherent( &adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ, + adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE, adapter->mem_desc.rep_msg, adapter->mem_desc.rep_msg_dma); adapter->mem_desc.rep_msg = NULL; @@ -7283,15 +8032,19 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_desc_seg_maint) { for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { - if (adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { + if (adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg) { dma_free_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma); - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = NULL; + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg, + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma); + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg = NULL; } } @@ -7306,7 +8059,8 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) } for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) - kfree(adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint); + kfree(adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_maint); kfree(adapter->mem_desc.rep_desc_seg_maint); } @@ -7324,16 +8078,16 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) { - return (upper_32_bits(start) == upper_32_bits(start + size - 1)); + return upper_32_bits(start) == upper_32_bits(start + size - 1); } int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker) { io_tracker->chain = - dma_pool_alloc(adapter->mem_desc.sg_chain_pool, - GFP_KERNEL, - &io_tracker->chain_dma); + dma_pool_alloc(adapter->mem_desc.sg_chain_pool, + GFP_KERNEL, + &io_tracker->chain_dma); if (!io_tracker->chain) return -ENOMEM; @@ -7360,17 +8114,16 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) unsigned int i, j; int rc; - /* sg table size */ + /* Scatter-gather table size. */ adapter->shost->sg_tablesize = LEAPRAID_SG_DEPTH; if (reset_devices) adapter->shost->sg_tablesize = LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS; - /* high priority cmds queue depth */ - adapter->dynamic_task_desc.hp_cmd_qd = facts->hp_slot; + /* High-priority commands queue depth. */ adapter->dynamic_task_desc.hp_cmd_qd = LEAPRAID_FIXED_HP_CMDS; - /* internal cmds queue depth */ + /* Internal commands queue depth. */ adapter->dynamic_task_desc.inter_cmd_qd = LEAPRAID_FIXED_INTER_CMDS; - /* adapter cmds total queue depth */ + /* Adapter commands total queue depth. */ if (reset_devices) adapter->adapter_attr.adapter_total_qd = LEAPRAID_DEFAULT_CMD_QD_OFFSET + @@ -7379,22 +8132,22 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) else adapter->adapter_attr.adapter_total_qd = facts->req_slot + adapter->dynamic_task_desc.hp_cmd_qd; - /* reply message queue depth */ + /* Reply message queue depth. */ adapter->adapter_attr.rep_msg_qd = adapter->adapter_attr.adapter_total_qd + LEAPRAID_DEFAULT_CMD_QD_OFFSET; - /* reply descriptor queue depth */ + /* Reply descriptor queue depth. */ adapter->adapter_attr.rep_desc_qd = round_up(adapter->adapter_attr.adapter_total_qd + adapter->adapter_attr.rep_msg_qd + LEAPRAID_TASKID_OFFSET_CTRL_CMD, LEAPRAID_REPLY_QD_ALIGNMENT); - /* scsi cmd io depth */ + /* SCSI command I/O depth. */ adapter->adapter_attr.io_qd = adapter->adapter_attr.adapter_total_qd - adapter->dynamic_task_desc.hp_cmd_qd - adapter->dynamic_task_desc.inter_cmd_qd; - /* scsi host can queue */ + /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + @@ -7403,7 +8156,7 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; - /* allocate task descriptor */ + /* Allocate task descriptor. */ try_again: adapter->adapter_attr.task_desc_dma_size = (adapter->adapter_attr.adapter_total_qd + @@ -7414,49 +8167,41 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->adapter_attr.task_desc_dma_size, &adapter->mem_desc.task_desc_dma, GFP_KERNEL); - if (!adapter->mem_desc.task_desc) { - dev_err(&adapter->pdev->dev, - "failed to allocate task descriptor DMA!\n"); - rc = -ENOMEM; - goto out; - } - /* allocate chain message pool */ + if (!adapter->mem_desc.task_desc) + return -ENOMEM; + + /* Allocate chain message pool. */ adapter->mem_desc.sg_chain_pool_size = LEAPRAID_DEFAULT_CHAINS_PER_IO * LEAPRAID_CHAIN_SEG_SIZE; adapter->mem_desc.sg_chain_pool = dma_pool_create("leapraid chain pool", &adapter->pdev->dev, - adapter->mem_desc.sg_chain_pool_size, 16, 0); - if (!adapter->mem_desc.sg_chain_pool) { - dev_err(&adapter->pdev->dev, - "failed to allocate chain message DMA!\n"); - rc = -ENOMEM; - goto out; - } + adapter->mem_desc.sg_chain_pool_size, + LEAPRAID_DMA_ALIGN, 0); + if (!adapter->mem_desc.sg_chain_pool) + return -ENOMEM; - /* allocate io tracker to ref scsi io */ + /* Allocate I/O tracker to SCSI I/O. */ adapter->mem_desc.io_tracker = kcalloc(adapter->shost->can_queue, sizeof(struct leapraid_io_req_tracker), GFP_KERNEL); - if (!adapter->mem_desc.io_tracker) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.io_tracker) + return -ENOMEM; for (i = 0; (int)i < adapter->shost->can_queue; i++) { rc = leapraid_internal_init_cmd_priv( adapter, adapter->mem_desc.io_tracker + i); if (rc) - goto out; + goto out_fail; } adapter->dynamic_task_desc.hp_taskid = adapter->adapter_attr.io_qd + LEAPRAID_HP_TASKID_OFFSET_CTL_CMD; - /* allocate static hp taskid */ + /* Allocate static high-priority task ID. */ adapter->driver_cmds.ctl_cmd.hp_taskid = adapter->dynamic_task_desc.hp_taskid; adapter->driver_cmds.tm_cmd.hp_taskid = @@ -7477,9 +8222,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; - adapter->driver_cmds.raid_action_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -7507,64 +8249,58 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_taskid); /* - * allocate sense dma, driver maintain - * need in same 4GB segment + * Allocate sense data DMA buffer. + * Constraint: Must reside within the same 4GB segment + * (driver-maintained). */ adapter->mem_desc.sense_data = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE, - &adapter->mem_desc.sense_data_dma, GFP_KERNEL); - if (!adapter->mem_desc.sense_data) { - dev_err(&adapter->pdev->dev, - "failed to allocate sense data DMA!\n"); - rc = -ENOMEM; - goto out; - } + &adapter->mem_desc.sense_data_dma, + GFP_KERNEL); + if (!adapter->mem_desc.sense_data) + return -ENOMEM; + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.sense_data_dma, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE)) { dev_warn(&adapter->pdev->dev, - "try 32 bit dma due to sense data is not in same 4g!\n"); + "Try 32bit DMA: Sense not in same 4G\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* reply frame, need in same 4GB segment */ + /* + * Allocate reply frame buffer. + * Constraint: Must reside in the same 4GB segment as the sense DMA. + */ adapter->mem_desc.rep_msg = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ, - &adapter->mem_desc.rep_msg_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE, + &adapter->mem_desc.rep_msg_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg) + return -ENOMEM; if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ)) { + LEAPRAID_REPLY_SIZE)) { dev_warn(&adapter->pdev->dev, - "use 32 bit dma due to rep msg is not in same 4g!\n"); + "Use 32 bit DMA due to rep msg is not in same 4g!\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* address of reply frame */ + /* Address of reply frame. */ adapter->mem_desc.rep_msg_addr = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REP_MSG_ADDR_SIZE, - &adapter->mem_desc.rep_msg_addr_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg_addr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message address DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REP_MSG_ADDR_SIZE, + &adapter->mem_desc.rep_msg_addr_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg_addr) + return -ENOMEM; adapter->adapter_attr.rep_desc_q_seg_cnt = DIV_ROUND_UP(adapter->adapter_attr.rq_cnt, LEAPRAID_REP_DESC_CHUNK_SIZE); @@ -7572,10 +8308,8 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(adapter->adapter_attr.rep_desc_q_seg_cnt, sizeof(struct leapraid_rep_desc_seg_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint) + return -ENOMEM; rep_desc_q_cnt_allocated = 0; for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { @@ -7583,25 +8317,20 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(LEAPRAID_REP_DESC_CHUNK_SIZE, sizeof(struct leapraid_rep_desc_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) + return -ENOMEM; adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * - LEAPRAID_REP_DESC_ENTRY_SIZE) * + LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - &adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma, + &adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor segment DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) + return -ENOMEM; for (j = 0; j < LEAPRAID_REP_DESC_CHUNK_SIZE; j++) { if (rep_desc_q_cnt_allocated >= @@ -7634,30 +8363,26 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) if (!reset_devices) { adapter->mem_desc.rep_desc_q_arr = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.rq_cnt * LEAPRAID_REP_RQ_CNT_SIZE, &adapter->mem_desc.rep_desc_q_arr_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_q_arr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor queue array DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_q_arr) + return -ENOMEM; } return 0; -out: +out_fail: if (rc == -EAGAIN) { leapraid_free_host_memory(adapter); - adapter->adapter_attr.use_32_dma_mask = true; + adapter->adapter_attr.use_32_dma_mask = 1; rc = dma_set_mask_and_coherent(&adapter->pdev->dev, - DMA_BIT_MASK(32)); + DMA_BIT_MASK(DMA_32_BITS)); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set 32 DMA mask\n"); + "Failed to set 32 DMA mask\n"); return rc; } goto try_again; @@ -7667,12 +8392,13 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { - adapter->dev_topo.pd_hdls_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pd_hdls_sz++; + u16 pd_hdls_sz; + + pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / + LEAPRAID_BITS_PER_BYTE; + pd_hdls_sz++; + + adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = kzalloc(adapter->dev_topo.pd_hdls_sz, GFP_KERNEL); if (!adapter->dev_topo.pd_hdls) @@ -7683,24 +8409,6 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) if (!adapter->dev_topo.blocking_hdls) return -ENOMEM; - adapter->dev_topo.pending_dev_add_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pending_dev_add_sz++; - adapter->dev_topo.pending_dev_add = - kzalloc(adapter->dev_topo.pending_dev_add_sz, GFP_KERNEL); - if (!adapter->dev_topo.pending_dev_add) - return -ENOMEM; - - adapter->dev_topo.dev_removing_sz = - adapter->dev_topo.pending_dev_add_sz; - adapter->dev_topo.dev_removing = - kzalloc(adapter->dev_topo.dev_removing_sz, GFP_KERNEL); - if (!adapter->dev_topo.dev_removing) - return -ENOMEM; - return 0; } @@ -7708,13 +8416,11 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) { kfree(adapter->dev_topo.pd_hdls); kfree(adapter->dev_topo.blocking_hdls); - kfree(adapter->dev_topo.pending_dev_add); - kfree(adapter->dev_topo.dev_removing); } static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size = 0; + u32 buffer_size; void *buffer; INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); @@ -7767,15 +8473,14 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) return -ENOMEM; adapter->driver_cmds.internal_scmd = buffer; - buffer = (void *)((u8 *)buffer + - sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker)); + buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + + sizeof(struct leapraid_io_req_tracker); adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (void *)((u8 *)buffer + SCSI_SENSE_BUFFERSIZE); + (unsigned char *)buffer; + buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (void *)((u8 *)buffer + sizeof(struct scatterlist)); + (struct scatterlist *)buffer; + buffer = (u8 *)buffer + sizeof(struct scatterlist); adapter->driver_cmds.internal_scmd->cmnd = buffer; adapter->driver_cmds.internal_scmd->host_scribble = (unsigned char *)(adapter->driver_cmds.internal_scmd + 1); @@ -7821,32 +8526,34 @@ static void leapraid_init_event_mask(struct leapraid_adapter *adapter) int i; for (i = 0; i < LEAPRAID_EVT_MASK_COUNT; i++) - adapter->fw_evt_s.leapraid_evt_masks[i] = -1; - leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DISCOVERY); + adapter->fw_evt_s.leapraid_evt_masks[i] = + LEAPRAID_INVALID_INITIAL_VALUE; + leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_IR_CHANGE); } -static void leapraid_prepare_adp_init_req( +static void leapraid_prepare_adapter_init_req( struct leapraid_adapter *adapter, struct leapraid_adapter_init_req *init_req) { ktime_t cur_time; - int i; + int i, chunk; u32 reply_post_free_ary_sz; memset(init_req, 0, sizeof(struct leapraid_adapter_init_req)); init_req->func = LEAPRAID_FUNC_ADAPTER_INIT; init_req->who_init = LEAPRAID_WHOINIT_LINUX_DRIVER; - init_req->msg_ver = cpu_to_le16(0x0100); - init_req->header_ver = cpu_to_le16(0x0000); - - init_req->driver_ver = cpu_to_le32((LEAPRAID_MAJOR_VERSION << 24) | - (LEAPRAID_MINOR_VERSION << 16) | - (LEAPRAID_BUILD_VERSION << 8) | - LEAPRAID_RELEASE_VERSION); + init_req->msg_ver = cpu_to_le16(LEAPRAID_MSG_VERSION); + init_req->header_ver = cpu_to_le16(LEAPRAID_HEADER_VERSION); + init_req->driver_ver = + cpu_to_le32((LEAPRAID_MAJOR_VERSION << + LEAPRAID_VER_MAJOR_SHIFT) | + (LEAPRAID_MINOR_VERSION << LEAPRAID_VER_MINOR_SHIFT) | + (LEAPRAID_BUILD_VERSION << LEAPRAID_VER_BUILD_SHIFT) | + LEAPRAID_RELEASE_VERSION); if (adapter->notification_desc.msix_enable) init_req->host_msix_vectors = adapter->adapter_attr.rq_cnt; @@ -7870,18 +8577,13 @@ static void leapraid_prepare_adp_init_req( memset(adapter->mem_desc.rep_desc_q_arr, 0, reply_post_free_ary_sz); - for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) { - adapter->mem_desc - .rep_desc_q_arr[i] - .rep_desc_base_addr = - cpu_to_le64 ( - (u64)adapter->mem_desc - .rep_desc_seg_maint[i / - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_maint[i % - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_dma); - } + chunk = LEAPRAID_REP_DESC_CHUNK_SIZE; + for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) + adapter->mem_desc.rep_desc_q_arr[i].rep_desc_base_addr = + cpu_to_le64 ((u64)adapter->mem_desc + .rep_desc_seg_maint[i / chunk] + .rep_desc_maint[i % chunk] + .rep_desc_dma); init_req->msg_flg = LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE; @@ -7903,9 +8605,9 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) struct leapraid_adapter_init_req init_req; struct leapraid_adapter_init_rep init_rep; u16 adapter_status; - int rc = 0; + int rc; - leapraid_prepare_adp_init_req(adapter, &init_req); + leapraid_prepare_adapter_init_req(adapter, &init_req); rc = leapraid_handshake_func(adapter, sizeof(struct leapraid_adapter_init_req), @@ -7913,7 +8615,7 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_init_rep), (u16 *)&init_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7934,11 +8636,10 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_page1 *sas_io_unit_page1 = NULL; + struct leapraid_manufacturing_p0 manufacturing_page0; struct leapraid_bios_page3 bios_page3; struct leapraid_bios_page2 bios_page2; - int rc = 0; - int sz; + int rc; rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); @@ -7950,79 +8651,49 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) if (rc) return rc; + rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, + cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + adapter->adapter_attr.bios_version = le32_to_cpu(bios_page3.bios_version); - adapter->adapter_attr.wideport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.narrowport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.sata_max_queue_depth = - LEAPRAID_SATA_QUEUE_DEPTH; - + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(manufacturing_page0.board_name), + manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = bios_page2.requested_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_boot_dev.pg_dev, - (void *)&bios_page2.requested_boot_dev, + memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, + &bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = bios_page2.requested_alt_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_alt_boot_dev.pg_dev, - (void *)&bios_page2.requested_alt_boot_dev, + memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, + &bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = bios_page2.current_boot_dev_form; - memcpy((void *)adapter->boot_devs.current_boot_dev.pg_dev, - (void *)&bios_page2.current_boot_dev, + memcpy(adapter->boot_devs.current_boot_dev.pg_dev, + &bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); - - sz = offsetof(struct leapraid_sas_io_unit_page1, phy_info); - sas_io_unit_page1 = kzalloc(sz, GFP_KERNEL); - if (!sas_io_unit_page1) { - rc = -ENOMEM; - return rc; - } - - cfgp1.size = sz; - - rc = leapraid_op_config_page(adapter, sas_io_unit_page1, cfgp1, - cfgp2, GET_SAS_IOUNIT_PG1); - if (rc) - goto out; - - if (le16_to_cpu(sas_io_unit_page1->wideport_max_queue_depth)) - adapter->adapter_attr.wideport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->wideport_max_queue_depth); - - if (le16_to_cpu(sas_io_unit_page1->narrowport_max_queue_depth)) - adapter->adapter_attr.narrowport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->narrowport_max_queue_depth); - - if (sas_io_unit_page1->sata_max_queue_depth) - adapter->adapter_attr.sata_max_queue_depth = - sas_io_unit_page1->sata_max_queue_depth; - -out: - kfree(sas_io_unit_page1); - dev_info(&adapter->pdev->dev, - "max wp qd=%d, max np qd=%d, max sata qd=%d\n", - adapter->adapter_attr.wideport_max_queue_depth, - adapter->adapter_attr.narrowport_max_queue_depth, - adapter->adapter_attr.sata_max_queue_depth); return rc; } static int leapraid_evt_notify(struct leapraid_adapter *adapter) { struct leapraid_evt_notify_req *evt_notify_req; + struct leapraid_evt_notify_rep *evt_notify_rep; + u16 adapter_status; int rc = 0; int i; mutex_lock(&adapter->driver_cmds.notify_event_cmd.mutex); adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_PENDING; evt_notify_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.notify_event_cmd.inter_taskid); memset(evt_notify_req, 0, sizeof(struct leapraid_evt_notify_req)); evt_notify_req->func = LEAPRAID_FUNC_EVENT_NOTIFY; @@ -8031,15 +8702,30 @@ static int leapraid_evt_notify(struct leapraid_adapter *adapter) cpu_to_le32(adapter->fw_evt_s.leapraid_evt_masks[i]); init_completion(&adapter->driver_cmds.notify_event_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.notify_event_cmd.inter_taskid); + adapter->driver_cmds.notify_event_cmd.inter_taskid); wait_for_completion_timeout( &adapter->driver_cmds.notify_event_cmd.done, LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT * HZ); + if (!(adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_DONE)) - if (adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_RESET) - rc = -EFAULT; + LEAPRAID_CMD_DONE)) { + rc = -EFAULT; + goto out_cleanup; + } + + if (!(adapter->driver_cmds.notify_event_cmd.status & + LEAPRAID_CMD_REPLY_VALID)) { + rc = -EFAULT; + goto out_cleanup; + } + + evt_notify_rep = (void *)&adapter->driver_cmds.notify_event_cmd.reply; + adapter_status = le16_to_cpu(evt_notify_rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + rc = -EFAULT; + +out_cleanup: adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.notify_event_cmd.mutex); @@ -8054,51 +8740,54 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) int rc = 0; dev_info(&adapter->pdev->dev, - "send device scan, async_scan_dev=%d!\n", async_scan_dev); + "Send device scan, async_scan_dev=%d!\n", async_scan_dev); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_PENDING; adapter->driver_cmds.scan_dev_cmd.async_scan_dev = async_scan_dev; - scan_dev_req = leapraid_get_task_desc(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + scan_dev_req = + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.scan_dev_cmd.inter_taskid); memset(scan_dev_req, 0, sizeof(struct leapraid_scan_dev_req)); scan_dev_req->func = LEAPRAID_FUNC_SCAN_DEV; if (async_scan_dev) { - adapter->scan_dev_desc.first_scan_dev_fired = true; - leapraid_fire_task(adapter, + adapter->scan_dev_desc.first_scan_dev_fired = 1; + leapraid_fire_task( + adapter, adapter->driver_cmds.scan_dev_cmd.inter_taskid); return 0; } init_completion(&adapter->driver_cmds.scan_dev_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + adapter->driver_cmds.scan_dev_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.scan_dev_cmd.done, LEAPRAID_SCAN_DEV_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "device scan timeout!\n"); + dev_err(&adapter->pdev->dev, "Device scan timeout!\n"); if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) rc = -EFAULT; else rc = -ETIME; - goto out; + goto out_cleanup; } - scan_dev_rep = (void *)(&adapter->driver_cmds.scan_dev_cmd.reply); + scan_dev_rep = (void *)&adapter->driver_cmds.scan_dev_cmd.reply; adapter_status = le16_to_cpu(scan_dev_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { - dev_err(&adapter->pdev->dev, "device scan failure!\n"); + dev_err(&adapter->pdev->dev, "Device scan failure!\n"); rc = -EFAULT; - goto out; + goto out_cleanup; } -out: +out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_info(&adapter->pdev->dev, - "device scan %s\n", ((rc == 0) ? "SUCCESS" : "FAILED")); + "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8125,13 +8814,14 @@ static void leapraid_init_rep_msg_addr(struct leapraid_adapter *adapter) for (i = 0, reply_address = (u32)adapter->mem_desc.rep_msg_dma; i < adapter->adapter_attr.rep_msg_qd; - i++, reply_address += LEAPRAID_REPLY_SIEZ) { + i++, reply_address += LEAPRAID_REPLY_SIZE) adapter->mem_desc.rep_msg_addr[i] = cpu_to_le32(reply_address); - } } -static void init_rep_desc(struct leapraid_rq *rq, int index, - union leapraid_rep_desc_union *reply_post_free_contig) +static void init_rep_desc( + struct leapraid_rq *rq, + int index, + union leapraid_rep_desc_union *reply_post_free_contig) { struct leapraid_adapter *adapter = rq->adapter; unsigned int i; @@ -8218,7 +8908,7 @@ static void leapraid_init_bar_idx_regs(struct leapraid_adapter *adapter) static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; leapraid_init_task_tracker(adapter); leapraid_init_rep_msg_addr(adapter); @@ -8242,7 +8932,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return rc; if (!adapter->access_ctrl.shost_recovering) { - adapter->scan_dev_desc.wait_scan_dev_done = true; + adapter->scan_dev_desc.wait_scan_dev_done = 1; return 0; } @@ -8256,45 +8946,45 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) int leapraid_ctrl_init(struct leapraid_adapter *adapter) { u32 cap; - int rc = 0; + int rc; rc = leapraid_set_pcie_and_notification(adapter); if (rc) - goto out_free_resources; + goto out_free; pci_set_drvdata(adapter->pdev, adapter->shost); pcie_capability_read_dword(adapter->pdev, PCI_EXP_DEVCAP, &cap); - if (cap & PCI_EXP_DEVCAP_EXT_TAG) { + if (cap & PCI_EXP_DEVCAP_EXT_TAG) pcie_capability_set_word(adapter->pdev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_EXT_TAG); - } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "fw log init failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "FW log init failure\n"); + goto out_free; } rc = leapraid_request_host_memory(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "request host memory failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Request host memory failure\n"); + goto out_free; } init_waitqueue_head(&adapter->reset_desc.reset_wait_queue); + init_waitqueue_head(&adapter->access_ctrl.shost_recover_wq); rc = leapraid_alloc_dev_topo_bitmaps(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "alloc topo bitmaps failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Alloc topo bitmaps failure\n"); + goto out_free; } rc = leapraid_init_driver_cmds(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "init driver cmds failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; } leapraid_init_event_mask(adapter); @@ -8302,14 +8992,23 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_available(adapter); if (rc) { dev_err(&adapter->pdev->dev, - "make adapter available failure\n"); - goto out_free_resources; + "Make adapter available failure\n"); + goto out_free; } + + leapraid_overheat_init(adapter); + if (!adapter->overheat_desc.fault_overheat_wq) { + rc = -ENOMEM; + goto out_free; + } + return 0; -out_free_resources: - adapter->access_ctrl.host_removing = true; +out_free: + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -8319,9 +9018,11 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) void leapraid_remove_ctrl(struct leapraid_adapter *adapter) { + leapraid_overheat_cleanup(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 15293922aefa..359802578586 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -1,16 +1,16 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #ifndef LEAPRAID_FUNC_H_INCLUDED #define LEAPRAID_FUNC_H_INCLUDED #include <linux/pci.h> #include <linux/aer.h> #include <linux/poll.h> +#include <linux/atomic.h> #include <linux/errno.h> #include <linux/ktime.h> #include <linux/delay.h> @@ -27,9 +27,9 @@ #include "leapraid.h" -/* some requset and reply buffer size */ +/* Request and reply buffer size. */ #define LEAPRAID_REQUEST_SIZE 128 -#define LEAPRAID_REPLY_SIEZ 128 +#define LEAPRAID_REPLY_SIZE 128 #define LEAPRAID_CHAIN_SEG_SIZE 128 #define LEAPRAID_MAX_SGES_IN_CHAIN 7 #define LEAPRAID_DEFAULT_CHAINS_PER_IO 19 @@ -44,61 +44,68 @@ #define LEAPRAID_SYS_LOG_BUF_SIZE 0x200000 #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 -/* Driver version and name */ +/* Driver version and name. */ #define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 +#define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.06" +#define LEAPRAID_DRIVER_VERSION "2.00.01.02" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 06 +#define LEAPRAID_BUILD_VERSION 01 +#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MSG_VERSION 0x1021 +#define LEAPRAID_HEADER_VERSION 0x0000 -/* Device ID */ +/* Device ID. */ #define LEAPRAID_VENDOR_ID 0xD405 #define LEAPRAID_DEVID_HBA 0x8200 -#define LEAPRAID_DEVID_RAID 0x8201 +#define LEAPRAID_SUBVENDOR_ID 0xD405 +#define LEAPRAID_SUBDEVID_HBA 0x8200 #define LEAPRAID_PCI_VENDOR_ID_MASK 0xFFFF - /* RAID virtual channel ID */ + /* RAID virtual channel ID. */ #define RAID_CHANNEL 1 -/* Scatter/Gather (SG) segment limits */ +/* Scatter-gather (SG) segment limits. */ #define LEAPRAID_MAX_PHYS_SEGMENTS SG_CHUNK_SIZE #define LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS 32 #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS -/* firmware / config page operations */ +/* Firmware and config page operations. */ #define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 -/* Hardware access helpers*/ +/* Hardware access helpers. */ #define leapraid_readl(addr) readl(addr) #define leapraid_check_reset(status) \ (!((status) & LEAPRAID_CMD_RESET)) -/* Polling intervals */ +/* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 #define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 #define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) -/* init mask */ +/* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 #define LEAPRAID_REPLY_INT_MASK 0x00000008 #define LEAPRAID_TO_SYS_DB_MASK 0x00000001 -/* queue depth */ +/* Queue depth. */ #define LEAPRAID_SATA_QUEUE_DEPTH 32 -#define LEAPRAID_SAS_QUEUE_DEPTH 254 -#define LEAPRAID_RAID_QUEUE_DEPTH 128 +#define LEAPRAID_SAS_QUEUE_DEPTH 64 +#define LEAPRAID_RAID_QUEUE_DEPTH 64 + +/* Target probe flag. */ +#define LEAPRAID_NO_ULD_ATTACH_FLAG 1 +#define LEAPRAID_ULD_ATTACH_FLAG 0 -/* SCSI device and queue limits */ -#define LEAPRAID_MAX_SECTORS 8192 -#define LEAPRAID_DEF_MAX_SECTORS 32767 +/* SCSI device and queue limits. */ +#define LEAPRAID_MAX_SECTORS 2048 #define LEAPRAID_MAX_CDB_LEN 32 #define LEAPRAID_MAX_LUNS 16384 #define LEAPRAID_CAN_QUEUE_MIN 1 @@ -106,136 +113,166 @@ #define LEAPRAID_CMD_PER_LUN 128 #define LEAPRAID_MAX_SEGMENT_SIZE 0xffffffff -/* SCSI sense and ASC/ASCQ and disk geometry configuration */ +/* SCSI sense and ASC/ASCQ and disk geometry configuration. */ #define DESC_FORMAT_THRESHOLD 0x72 #define SENSE_KEY_MASK 0x0F #define SCSI_SENSE_RESPONSE_CODE_MASK 0x7F #define ASC_FAILURE_PREDICTION_THRESHOLD_EXCEEDED 0x5D -#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL /* in sectors, 1GB */ +#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL #define LEAPRAID_LARGE_DISK_HEADS 255 #define LEAPRAID_LARGE_DISK_SECTORS 63 #define LEAPRAID_SMALL_DISK_HEADS 64 #define LEAPRAID_SMALL_DISK_SECTORS 32 -/* SMP (Serial Management Protocol) */ +/* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 #define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 -/* SCSI ASC/ASCQ definitions */ +/* SCSI ASC/ASCQ definitions. */ #define LEAPRAID_SCSI_ASCQ_DEFAULT 0x00 #define LEAPRAID_SCSI_ASC_POWER_ON_RESET 0x29 #define LEAPRAID_SCSI_ASC_INVALID_CMD_CODE 0x20 #define LEAPRAID_SCSI_ASCQ_POWER_ON_RESET 0x07 -/* ---- VPD Page 0x89 (ATA Information) ---- */ +/* VPD Page 0x89 (ATA Information). */ #define LEAPRAID_VPD_PAGE_ATA_INFO 0x89 #define LEAPRAID_VPD_PG89_MAX_LEN 255 #define LEAPRAID_VPD_PG89_MIN_LEN 214 -/* Byte index for NCQ support flag in VPD Page 0x89 */ +/* Byte index for NCQ support flag in VPD page 0x89. */ #define LEAPRAID_VPD_PG89_NCQ_BYTE_IDX 213 #define LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT 4 #define LEAPRAID_VPD_PG89_NCQ_BIT_MASK 0x1 -/* readiness polling: max retries, sleep µs between */ +/* Readiness polling: max retries, sleep µs between. */ #define LEAPRAID_ADAPTER_READY_MAX_RETRY 15000 #define LEAPRAID_ADAPTER_READY_SLEEP_MIN_US 1000 #define LEAPRAID_ADAPTER_READY_SLEEP_MAX_US 1100 -/* Doorbell wait parameters */ +/* Doorbell wait parameters. */ #define LEAPRAID_DB_WAIT_MAX_RETRY 20000 #define LEAPRAID_DB_WAIT_DELAY_US 500 -/* Basic data size definitions */ +/* Basic data size definitions. */ #define LEAPRAID_DWORDS_BYTE_SIZE 4 #define LEAPRAID_WORD_BYTE_SIZE 2 -/* SGL threshold and chain offset*/ +/* SGL threshold and chain offset. */ #define LEAPRAID_SGL_INLINE_THRESHOLD 2 #define LEAPRAID_CHAIN_OFFSET_DWORDS 7 -/* MSI-X group size and mask */ +/* MSI-X group size and mask. */ #define LEAPRAID_MSIX_GROUP_SIZE 8 #define LEAPRAID_MSIX_GROUP_MASK 7 -/* basic constants and limits */ +/* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 #define LEAPRAID_INDEX_FIRST 0 #define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF -/* retry / sleep configuration */ +/* Retry/Sleep configuration. */ +#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 +#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF +#define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 +#define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF +#define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 +#define LEAPRAID_WRSEQ_3RD_KEY_VALUE 0xB +#define LEAPRAID_WRSEQ_4TH_KEY_VALUE 0x2 +#define LEAPRAID_WRSEQ_5TH_KEY_VALUE 0x7 +#define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 #define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 -#define LEAPRAID_MSLEEP_LONG_MS 256 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 -/* controller reset loop parameters */ -#define LEAPRAID_RESET_LOOP_COUNT_REF (300000 / 256) -#define LEAPRAID_RESET_LOOP_COUNT_DEFAULT 10000 -#define LEAPRAID_RESET_POLL_INTERVAL_MS 500 - -/* Device / Volume configuration */ +/* Device/Volume configuration. */ #define LEAPRAID_MAX_VOLUMES_DEFAULT 32 #define LEAPRAID_MAX_DEV_HANDLE_DEFAULT 2048 #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF -/* cmd queue depth */ +/* Commands queue depth. */ #define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 -/* task id offset */ +/* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 #define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 -#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 +#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 #define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD 4 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 5 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 6 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 -/* task id offset for high-priority */ +/* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 #define LEAPRAID_HP_TASKID_OFFSET_TM_CMD 1 -/* Event / Boot configuration */ +/* Event/Boot configuration. */ #define LEAPRAID_EVT_MASK_COUNT 4 #define LEAPRAID_BOOT_DEV_SIZE 24 -/* logsense command definitions */ +/* Commands timeout. */ +#define LEAPRAID_UNIFIED_TIMEOUT 30 +#define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 +#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT + +/* Logsense command definitions. */ #define LEAPRAID_LOGSENSE_DATA_LENGTH 16 #define LEAPRAID_LOGSENSE_CDB_LENGTH 10 #define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT 5 +#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_LOGSENSE_SMART_CODE 0x5D -/* cmd timeout */ -#define LEAPRAID_DRIVER_SCSIIO_CMD_TIMEOUT LEAPRAID_LOGSENSE_TIMEOUT -#define LEAPRAID_CFG_OP_TIMEOUT 15 -#define LEAPRAID_CTL_CMD_TIMEOUT 10 -#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT 10 -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT 10 -#define LEAPRAID_ENC_CMD_TIMEOUT 10 -#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT 30 -#define LEAPRAID_TM_CMD_TIMEOUT 30 -#define LEAPRAID_TRANSPORT_CMD_TIMEOUT 10 +/* Host DMA cap. */ +#define DMA_32_BITS 32 +#define DMA_64_BITS 64 +#define LEAPRAID_DMA_ALIGN 16 + +/* Values used to represent an invalid. */ +#define LEAPRAID_INVALID_INDEX -1 +#define LEAPRAID_INVALID_MSIX_VECTORS -1 +#define LEAPRAID_INVALID_INITIAL_VALUE -1 +#define LEAPRAID_OPERATION_FAILED -1 + +/* Version shift and mask. */ +#define LEAPRAID_VER_MAJOR_SHIFT 24 +#define LEAPRAID_VER_MINOR_SHIFT 16 +#define LEAPRAID_VER_BUILD_SHIFT 8 +#define LEAPRAID_VER_MASK 0xFF + +/* Interrupt type. */ +#define LEAPRAID_INTERRUPT_MODE_MSIX 0 +#define LEAPRAID_INTERRUPT_MODE_MSI 1 +#define LEAPRAID_INTERRUPT_MODE_LEGACY 2 + +/* SMP link reset. */ +#define SMP_PHY_CONTROL_LINK_RESET 0x01 +#define SMP_PHY_CONTROL_HARD_RESET 0x02 +#define SMP_PHY_CONTROL_DISABLE 0x03 /** - * struct leapraid_adapter_features - Features and - * capabilities of a LeapRAID adapter + * struct leapraid_adapter_features - Adapter features/capabilities. * - * @req_slot: Number of request slots supported by the adapter - * @hp_slot: Number of high-priority slots supported by the adapter - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version of the adapter - * @max_dev_handle: Maximum device supported by the adapter + * @req_slot: Number of request slots supported by the adapter. + * @hp_slot: Number of high-priority slots supported by the adapter. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version of the adapter. + * @max_dev_handle: Maximum device handle supported by the adapter. + * @min_dev_handle: Minimum device handle supported by the adapter. */ struct leapraid_adapter_features { u16 req_slot; @@ -251,32 +288,35 @@ struct leapraid_adapter_features { /** * struct leapraid_adapter_attr - Adapter attributes and capabilities * - * @id: Adapter identifier - * @raid_support: Indicates if RAID is supported - * @bios_version: Version of the adapter BIOS - * @enable_mp: Indicates if multipath (MP) support is enabled - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @sata_max_queue_depth: Maximum queue depth for SATA - * @features: Detailed features of the adapter - * @adapter_total_qd: Total queue depth available on the adapter - * @io_qd: Queue depth allocated for I/O operations - * @rep_msg_qd: Queue depth for reply messages - * @rep_desc_qd: Queue depth for reply descriptors - * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue - * @rq_cnt: Number of request queues - * @task_desc_dma_size: Size of task descriptor DMA memory - * @use_32_dma_mask: Indicates if 32-bit DMA mask is used - * @name: Adapter name string + * @id: Adapter identifier. + * @raid_support: Indicates if RAID is supported. + * @bios_version: Version of the adapter BIOS. + * @enable_mp: Indicates if multipath (MP) support is enabled. + * @wideport_max_queue_depth: Maximum queue depth for wide ports. + * @narrowport_max_queue_depth: Maximum queue depth for narrow ports. + * @sata_max_queue_depth: Maximum queue depth for SATA. + * @raid_volume_max_queue_depth: Maximum queue depth for RAID volumes. + * @features: Detailed features of the adapter. + * @adapter_total_qd: Total queue depth available on the adapter. + * @io_qd: Queue depth allocated for I/O operations. + * @rep_msg_qd: Queue depth for reply messages. + * @rep_desc_qd: Queue depth for reply descriptors. + * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue. + * @rq_cnt: Number of request queues. + * @task_desc_dma_size: Size of task descriptor DMA memory. + * @use_32_dma_mask: Indicates if 32-bit DMA mask is used. + * @name: Adapter name string. + * @board_name: Board name retrieved from manufacturing page 0. */ struct leapraid_adapter_attr { u8 id; - bool raid_support; + u8 raid_support; u32 bios_version; - bool enable_mp; + u8 enable_mp; u32 wideport_max_queue_depth; u32 narrowport_max_queue_depth; u32 sata_max_queue_depth; + u32 raid_volume_max_queue_depth; struct leapraid_adapter_features features; u32 adapter_total_qd; u32 io_qd; @@ -285,20 +325,20 @@ struct leapraid_adapter_attr { u32 rep_desc_q_seg_cnt; u16 rq_cnt; u32 task_desc_dma_size; - bool use_32_dma_mask; + u8 use_32_dma_mask; char name[LEAPRAID_NAME_LENGTH]; + char board_name[LEAPRAID_BOARD_NAME_LENGTH]; }; /** - * struct leapraid_io_req_tracker - Track a SCSI I/O request - * for the adapter + * struct leapraid_io_req_tracker - Track a SCSI I/O request for the adapter * - * @taskid: Unique task ID for this I/O request - * @scmd: Pointer to the associated SCSI command - * @chain_list: List of chain frames associated with this request - * @msix_io: MSI-X vector assigned to this I/O request - * @chain: Pointer to the chain memory for this request - * @chain_dma: DMA address of the chain memory + * @taskid: Unique task ID for this I/O request. + * @scmd: Pointer to the associated SCSI command. + * @chain_list: List of chain frames associated with this request. + * @msix_io: MSI-X vector assigned to this I/O request. + * @chain: Pointer to the chain memory for this request. + * @chain_dma: DMA address of the chain memory. */ struct leapraid_io_req_tracker { u16 taskid; @@ -312,9 +352,9 @@ struct leapraid_io_req_tracker { /** * struct leapraid_task_tracker - Tracks a task in the adapter * - * @taskid: Unique task ID for this tracker - * @cb_idx: Callback index associated with this task - * @tracker_list: Linked list node to chain this tracker in lists + * @taskid: Unique task ID for this tracker. + * @cb_idx: Callback index associated with this task. + * @tracker_list: Linked list node to chain this tracker in lists. */ struct leapraid_task_tracker { u16 taskid; @@ -323,11 +363,10 @@ struct leapraid_task_tracker { }; /** - * struct leapraid_rep_desc_maint - Maintains reply descriptor - * memory + * struct leapraid_rep_desc_maint - Maintains reply descriptor memory * - * @rep_desc: Pointer to the reply descriptor - * @rep_desc_dma: DMA address of the reply descriptor + * @rep_desc: Pointer to the reply descriptor. + * @rep_desc_dma: DMA address of the reply descriptor. */ struct leapraid_rep_desc_maint { union leapraid_rep_desc_union *rep_desc; @@ -335,12 +374,12 @@ struct leapraid_rep_desc_maint { }; /** - * struct leapraid_rep_desc_seg_maint - Maintains reply descriptor - * segment memory + * struct leapraid_rep_desc_seg_maint - + * Maintains reply descriptor segment memory * - * @rep_desc_seg: Pointer to the reply descriptor segment - * @rep_desc_seg_dma: DMA address of the reply descriptor segment - * @rep_desc_maint: Pointer to the main reply descriptor structure + * @rep_desc_seg: Pointer to the reply descriptor segment. + * @rep_desc_seg_dma: DMA address of the reply descriptor segment. + * @rep_desc_maint: Pointer to the main reply descriptor structure. */ struct leapraid_rep_desc_seg_maint { void *rep_desc_seg; @@ -351,20 +390,20 @@ struct leapraid_rep_desc_seg_maint { /** * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * - * @task_desc: Pointer to task descriptor - * @task_desc_dma: DMA address of task descriptor - * @sg_chain_pool: DMA pool for SGL chain allocations - * @sg_chain_pool_size: Size of the sg_chain_pool - * @io_tracker: IO request tracker array - * @sense_data: Buffer for SCSI sense data - * @sense_data_dma: DMA address of sense_data buffer - * @rep_msg: Buffer for reply message - * @rep_msg_dma: DMA address of reply message buffer - * @rep_msg_addr: Pointer to reply message address - * @rep_msg_addr_dma: DMA address of reply message address - * @rep_desc_seg_maint: Pointer to reply descriptor segment - * @rep_desc_q_arr: Pointer to reply descriptor queue array - * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array + * @task_desc: Pointer to task descriptor. + * @task_desc_dma: DMA address of task descriptor. + * @sg_chain_pool: DMA pool for SGL chain allocations. + * @sg_chain_pool_size: Size of the sg_chain_pool. + * @io_tracker: I/O request tracker array. + * @sense_data: Buffer for SCSI sense data. + * @sense_data_dma: DMA address of sense_data buffer. + * @rep_msg: Buffer for reply message. + * @rep_msg_dma: DMA address of reply message buffer. + * @rep_msg_addr: Pointer to reply message address. + * @rep_msg_addr_dma: DMA address of reply message address. + * @rep_desc_seg_maint: Pointer to reply descriptor segment. + * @rep_desc_q_arr: Pointer to reply descriptor queue array. + * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array. */ struct leapraid_mem_desc { void *task_desc; @@ -383,31 +422,30 @@ struct leapraid_mem_desc { dma_addr_t rep_desc_q_arr_dma; }; -#define LEAPRAID_FIXED_INTER_CMDS 7 -#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_INTER_HP_CMDS_DIF \ - (LEAPRAID_FIXED_INTER_CMDS - LEAPRAID_FIXED_HP_CMDS) +/* internal cmd description */ +#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_CMD_NOT_USED 0x8000 -#define LEAPRAID_CMD_DONE 0x0001 -#define LEAPRAID_CMD_PENDING 0x0002 -#define LEAPRAID_CMD_REPLY_VALID 0x0004 -#define LEAPRAID_CMD_RESET 0x0008 +#define LEAPRAID_CMD_NOT_USED 0x8000 +#define LEAPRAID_CMD_DONE 0x0001 +#define LEAPRAID_CMD_PENDING 0x0002 +#define LEAPRAID_CMD_REPLY_VALID 0x0004 +#define LEAPRAID_CMD_RESET 0x0008 /** * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * - * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index - * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index - * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index - * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index - * @LEAPRAID_ENC_CB_IDX: Encryption callback index - * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index - * @LEAPRAID_CTL_CB_IDX: Control callback index - * @LEAPRAID_TM_CB_IDX: Task management callback index + * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. + * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. + * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. + * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. + * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. + * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. + * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. + * @LEAPRAID_ENC_CB_IDX: Encryption callback index. + * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. + * @LEAPRAID_CTL_CB_IDX: Control callback index. + * @LEAPRAID_TM_CB_IDX: Task management callback index. */ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, @@ -424,10 +462,25 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_NUM_CB_IDXS }; +/** + * struct leapraid_default_reply - Default reply frame buffer + * @pad: Raw reply data buffer returned by firmware. + * + * This structure represents a generic reply frame used by the firmware + * when no specific reply format is required. The buffer size is defined + * by LEAPRAID_REPLY_SIZE and stores the raw reply data. + */ struct leapraid_default_reply { - u8 pad[LEAPRAID_REPLY_SIEZ]; + u8 pad[LEAPRAID_REPLY_SIZE]; }; +/** + * struct leapraid_sense_buffer - SCSI sense data buffer + * @pad: Buffer used to store sense data returned by a SCSI command. + * + * This buffer holds the sense data provided by a device.The size is + * defined by SCSI_SENSE_BUFFERSIZE. + */ struct leapraid_sense_buffer { u8 pad[SCSI_SENSE_BUFFERSIZE]; }; @@ -435,17 +488,17 @@ struct leapraid_sense_buffer { /** * struct leapraid_driver_cmd - Driver command tracking structure * - * @reply: Default reply structure returned by the adapter - * @done: Completion object used to signal command completion - * @status: Status code returned by the firmware - * @taskid: Unique task identifier for this command - * @hp_taskid: Task identifier for high-priority commands - * @inter_taskid: Task identifier for internal commands - * @cb_idx: Callback index used to identify completion context - * @async_scan_dev: True if this command is for asynchronous device scan - * @sense: Sense buffer holding error information from device - * @mutex: Mutex to protect access to this command structure - * @list: List node for linking driver commands into lists + * @reply: Default reply structure returned by the adapter. + * @done: Completion object used to signal command completion. + * @status: Status code returned by the firmware. + * @taskid: Unique task identifier for this command. + * @hp_taskid: Task identifier for high-priority commands. + * @inter_taskid: Task identifier for internal commands. + * @cb_idx: Callback index used to identify completion context. + * @async_scan_dev: True if this command is for asynchronous device scan. + * @sense: Sense buffer holding error information from device. + * @mutex: Mutex to protect access to this command structure. + * @list: List node for linking driver commands into lists. */ struct leapraid_driver_cmd { struct leapraid_default_reply reply; @@ -455,27 +508,27 @@ struct leapraid_driver_cmd { u16 hp_taskid; u16 inter_taskid; u8 cb_idx; - bool async_scan_dev; + u8 async_scan_dev; struct leapraid_sense_buffer sense; - struct mutex mutex; + struct mutex mutex; /* Mutex for driver cmd */ struct list_head list; }; /** * struct leapraid_driver_cmds - Collection of driver command objects * - * @special_cmd_list: List head for tracking special driver commands - * @scan_dev_cmd: Command used for asynchronous device scan operations - * @cfg_op_cmd: Command for configuration operations - * @transport_cmd: Command for transport-level operations - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware - * @raid_action_cmd: Command for RAID-related management or action requests - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing - * @enc_cmd: Command for enclosure management operations - * @notify_event_cmd: Command for asynchronous event notification handling - * @ctl_cmd: Command for generic control or maintenance operations - * @tm_cmd: Task management command - * @internal_scmd: Pointer to internal SCSI command used by the driver + * @special_cmd_list: List head for tracking special driver commands. + * @scan_dev_cmd: Command used for asynchronous device scan operations. + * @cfg_op_cmd: Command for configuration operations. + * @transport_cmd: Command for transport-level operations. + * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. + * @raid_action_cmd: Command for RAID-related management or action requests. + * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. + * @enc_cmd: Command for enclosure management operations. + * @notify_event_cmd: Command for asynchronous event notification handling. + * @ctl_cmd: Command for generic control or maintenance operations. + * @tm_cmd: Task management command. + * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; @@ -495,14 +548,14 @@ struct leapraid_driver_cmds { /** * struct leapraid_dynamic_task_desc - Dynamic task descriptor * - * @task_lock: Spinlock to protect concurrent access - * @hp_taskid: Current high-priority task ID - * @hp_cmd_qd: Fixed command queue depth for high-priority tasks - * @inter_taskid: Current internal task ID - * @inter_cmd_qd: Fixed command queue depth for internal tasks + * @task_lock: Spinlock to protect concurrent access. + * @hp_taskid: Current high-priority task ID. + * @hp_cmd_qd: Fixed command queue depth for high-priority tasks. + * @inter_taskid: Current internal task ID. + * @inter_cmd_qd: Fixed command queue depth for internal tasks. */ struct leapraid_dynamic_task_desc { - spinlock_t task_lock; + spinlock_t task_lock; /* protects dynamic task */ u16 hp_taskid; u16 hp_cmd_qd; u16 inter_taskid; @@ -512,14 +565,14 @@ struct leapraid_dynamic_task_desc { /** * struct leapraid_fw_evt_work - Firmware event work structure * - * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRAID adapter - * @work: Work structure used by the kernel workqueue - * @refcnt: Reference counter for managing the lifetime of this work - * @evt_data: Pointer to firmware event data - * @dev_handle: Device handle associated with the event - * @evt_type: Type of firmware event - * @ignore: Flag indicating whether the event should be ignored + * @list: Linked list node for queuing the work. + * @adapter: Pointer to the associated LeapRAID adapter. + * @work: Work structure used by the kernel workqueue. + * @refcnt: Reference counter for managing the lifetime of this work. + * @evt_data: Pointer to firmware event data. + * @dev_handle: Device handle associated with the event. + * @evt_type: Type of firmware event. + * @ignore: Flag indicating whether the event should be ignored. */ struct leapraid_fw_evt_work { struct list_head list; @@ -535,33 +588,35 @@ struct leapraid_fw_evt_work { /** * struct leapraid_fw_evt_struct - Firmware event handling structure * - * @fw_evt_name: Name of the firmware event - * @fw_evt_thread: Workqueue used for processing firmware events - * @fw_evt_lock: Spinlock protecting access to the firmware event list - * @fw_evt_list: Linked list of pending firmware events - * @cur_evt: Pointer to the currently processing firmware event - * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress - * @leapraid_evt_masks: Array of event masks for filtering firmware events + * @fw_evt_name: Name of the firmware event. + * @fw_evt_thread: Workqueue used for processing firmware events. + * @fw_evt_lock: Spinlock protecting access to the firmware event list. + * @fw_evt_list: Linked list of pending firmware events. + * @cur_evt: Pointer to the currently processing firmware event. + * @cur_evt_task: Task currently executing @cur_evt work. + * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress. + * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; - spinlock_t fw_evt_lock; + spinlock_t fw_evt_lock; /* protects firmware event */ struct list_head fw_evt_list; struct leapraid_fw_evt_work *cur_evt; - int fw_evt_cleanup; + struct task_struct *cur_evt_task; + u8 fw_evt_cleanup; u32 leapraid_evt_masks[4]; }; /** * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRAID adapter - * @msix_idx: MSI-X vector index used by this queue - * @rep_post_host_idx: Index of the last processed reply descriptor - * @rep_desc: Pointer to the reply descriptor associated with this queue - * @name: Name of the request queue - * @busy: Atomic counter indicating if the queue is busy + * @adapter: Pointer to the associated LeapRAID adapter. + * @msix_idx: MSI-X vector index used by this queue. + * @rep_post_host_idx: Index of the last processed reply descriptor. + * @rep_desc: Pointer to the reply descriptor associated with this queue. + * @name: Name of the request queue. + * @busy: Atomic counter indicating if the queue is busy. */ struct leapraid_rq { struct leapraid_adapter *adapter; @@ -575,8 +630,8 @@ struct leapraid_rq { /** * struct leapraid_int_rq - Internal request queue for a CPU * - * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRAID request queue structure + * @affinity_hint: CPU affinity mask for the queue. + * @rq: Underlying LeapRAID request queue structure. */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -586,9 +641,9 @@ struct leapraid_int_rq { /** * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * - * @busy: Atomic flag indicating request is being processed - * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRAID request structure + * @busy: Atomic flag indicating request is being processed. + * @pause: Atomic flag to temporarily suspend polling. + * @rq: The underlying LeapRAID request structure. */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -597,22 +652,25 @@ struct leapraid_blk_mq_poll_rq { }; /** - * struct leapraid_notification_desc - Notification - * descriptor for LeapRAID + * struct leapraid_notification_desc - Notification descriptor for LeapRAID * - * @iopoll_qdex: Index of the I/O polling queue - * @iopoll_qcnt: Count of I/O polling queues - * @msix_enable: Flag indicating MSI-X is enabled - * @msix_cpu_map: CPU map for MSI-X interrupts - * @msix_cpu_map_sz: Size of the MSI-X CPU map - * @int_rqs: Array of interrupt request queues - * @int_rqs_allocated: Count of allocated interrupt request queues - * @blk_mq_poll_rqs: Array of blk-mq polling requests + * @iopoll_qdex: Index of the I/O polling queue. + * @iopoll_qcnt: Count of I/O polling queues. + * @msix_enable: Flag indicating MSI-X is enabled. + * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. + * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. + * @msix_cpu_map: CPU map for MSI-X interrupts. + * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @int_rqs: Array of interrupt request queues. + * @int_rqs_allocated: Count of allocated interrupt request queues. + * @blk_mq_poll_rqs: Array of blk-mq polling requests. */ struct leapraid_notification_desc { u32 iopoll_qdex; u32 iopoll_qcnt; - bool msix_enable; + u8 msix_enable; + u8 irq_vectors_allocated; + u8 irq_mode; u8 *msix_cpu_map; u32 msix_cpu_map_sz; struct leapraid_int_rq *int_rqs; @@ -620,82 +678,104 @@ struct leapraid_notification_desc { struct leapraid_blk_mq_poll_rq *blk_mq_poll_rqs; }; +/** + * struct leapraid_overheat_desc - Overheat descriptor for LeapRAID + * + * @fault_overheat_wq: Workqueue for adapter thermal overheat operations. + * @fault_overheat_work: Work structure for thermal overheat. + * @thermal_alert: Flag indicating if adapter thermal alert is active. + * @fault_overheat_wq_name: Name of the fault overheat workqueue. + */ +struct leapraid_overheat_desc { + struct workqueue_struct *fault_overheat_wq; + struct work_struct fault_overheat_work; + atomic_t thermal_alert; + char fault_overheat_wq_name[48]; +}; + /** * struct leapraid_reset_desc - Reset descriptor for LeapRAID * - * @fault_reset_wq: Workqueue for fault reset operations - * @fault_reset_work: Delayed work structure for fault reset - * @fault_reset_wq_name: Name of the fault reset workqueue - * @host_diag_mutex: Mutex for host diagnostic operations - * @adapter_reset_lock: Spinlock for adapter reset operations - * @adapter_reset_mutex: Mutex for adapter reset operations - * @adapter_link_resetting: Flag indicating if adapter link is resetting - * @adapter_reset_results: Results of the adapter reset operation - * @pending_io_cnt: Count of pending I/O operations - * @reset_wait_queue: Wait queue for reset operations - * @reset_cnt: Counter for reset operations + * @fault_reset_wq: Workqueue for fault reset operations. + * @fault_reset_work: Delayed work structure for fault reset. + * @fault_reset_wq_name: Name of the fault reset workqueue. + * @host_diag_mutex: Mutex for host diagnostic operations. + * @adapter_reset_lock: Spinlock for adapter reset operations. + * @adapter_reset_mutex: Mutex for adapter reset operations. + * @adapter_link_resetting: Flag indicating if adapter link is resetting. + * @adapter_reset_results: Results of the adapter reset operation. + * @pending_io_cnt: Count of pending I/O operations. + * @reset_wait_queue: Wait queue for reset operations. + * @reset_cnt: Counter for reset operations. + * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; struct delayed_work fault_reset_work; char fault_reset_wq_name[48]; - struct mutex host_diag_mutex; - spinlock_t adapter_reset_lock; - struct mutex adapter_reset_mutex; - bool adapter_link_resetting; + struct mutex host_diag_mutex; /* Mutex for operations. */ + spinlock_t adapter_reset_lock; /* Protects adapter reset state. */ + struct mutex adapter_reset_mutex; /* Serializes adapter reset. */ + u8 adapter_link_resetting; int adapter_reset_results; int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; + u32 last_reset_cnt; }; /** - * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRAID + * struct leapraid_scan_dev_desc - Scan device descriptor for LeapRAID * - * @wait_scan_dev_done: Flag indicating if scan device operation is done - * @driver_loading: Flag indicating if driver is loading - * @first_scan_dev_fired: Flag indicating if first scan device operation fired - * @scan_dev_failed: Flag indicating if scan device operation failed - * @scan_start: Flag indicating if scan operation started - * @scan_start_failed: Count of failed scan start operations + * @wait_scan_dev_done: Flag indicating if scan device operation is done. + * @driver_loading: Flag indicating if driver is loading. + * @first_scan_dev_fired: Flag indicating if first scan device operation fired. + * @scan_dev_failed: Flag indicating if scan device operation failed. + * @scan_start: Flag indicating if scan operation started. + * @scan_start_failed: Count of failed scan start operations. */ struct leapraid_scan_dev_desc { - bool wait_scan_dev_done; - bool driver_loading; - bool first_scan_dev_fired; - bool scan_dev_failed; - bool scan_start; + u8 wait_scan_dev_done; + u8 driver_loading; + wait_queue_head_t wait_driver_loading; + u8 first_scan_dev_fired; + u8 scan_dev_failed; + u8 scan_start; u16 scan_start_failed; }; /** * struct leapraid_access_ctrl - Access control structure for LeapRAID * - * @pci_access_lock: Mutex for PCI access control - * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active - * @shost_recovering: Flag indicating if host is recovering - * @host_removing: Flag indicating if host is being removed - * @pcie_recovering: Flag indicating if PCIe is recovering + * @pci_access_lock: Mutex for PCI access control. + * @shost_recovering: Flag indicating if host is recovering. + * @shost_recover_async: Flag indicating if host is recovering + * and the 0xFFFF event. + * @shost_recover_wq: Wait queue for threads waiting on shost_recover_async. + * @host_removing: Flag indicating if host is being removed. + * @pcie_recovering: Flag indicating if PCIe is recovering. */ struct leapraid_access_ctrl { - struct mutex pci_access_lock; - bool adapter_thermal_alert; - bool shost_recovering; - bool host_removing; - bool pcie_recovering; + struct mutex pci_access_lock; /* serializes PCI register access. */ + u8 shost_recovering; + wait_queue_head_t recovery_waitq; + u8 shost_recover_async; + wait_queue_head_t shost_recover_wq; + u8 host_removing; + u8 pcie_recovering; }; /** * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * - * @fw_log_buffer: Buffer for firmware log data - * @fw_log_buffer_dma: DMA address of the firmware log buffer - * @fw_log_wq_name: Name of the firmware log workqueue - * @fw_log_wq: Workqueue for firmware log operations - * @fw_log_work: Delayed work structure for firmware log - * @open_pcie_trace: Flag indicating if PCIe tracing is open - * @fw_log_init_flag: Flag indicating if firmware log is initialized + * @fw_log_buffer: Buffer for firmware log data. + * @fw_log_buffer_dma: DMA address of the firmware log buffer. + * @fw_log_wq_name: Name of the firmware log workqueue. + * @fw_log_wq: Workqueue for firmware log operations. + * @fw_log_work: Delayed work structure for firmware log. + * @open_pcie_trace: Flag indicating if PCIe tracing is open. + * @fw_log_init_flag: Flag indicating if firmware log is initialized. + * @pre_debug_log: Last DebugLog register snapshot for change detection. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -705,6 +785,7 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; + u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -713,13 +794,13 @@ struct leapraid_fw_log_desc { /** * struct leapraid_card_port - Card port structure for LeapRAID * - * @list: List head for card port - * @vphys_list: List head for virtual phy list - * @port_id: Port ID - * @sas_address: SAS address - * @phy_mask: Mask of phy - * @vphys_mask: Mask of virtual phy - * @flg: Flags for the port + * @list: List head for card port. + * @vphys_list: List head for virtual PHY list. + * @port_id: Port ID. + * @sas_address: SAS address. + * @phy_mask: Mask of PHY. + * @vphys_mask: Mask of virtual PHY. + * @flg: Flags for the port. */ struct leapraid_card_port { struct list_head list; @@ -732,18 +813,18 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRAID + * struct leapraid_card_phy - Card PHY structure for LeapRAID * - * @port_siblings: List head for port siblings - * @card_port: Pointer to the card port - * @identify: SAS identify structure - * @remote_identify: Remote SAS identify structure - * @phy: SAS phy structure - * @phy_id: Phy ID - * @hdl: Handle for the port - * @attached_hdl: Handle for the attached port - * @phy_is_assigned: Flag indicating if phy is assigned - * @vphy: Flag indicating if virtual phy + * @port_siblings: List head for port siblings. + * @card_port: Pointer to the card port. + * @identify: SAS identify structure. + * @remote_identify: Remote SAS identify structure. + * @phy: SAS PHY structure. + * @phy_id: PHY ID. + * @hdl: Handle for the port. + * @attached_hdl: Handle for the attached port. + * @phy_is_assigned: Flag indicating if PHY is assigned. + * @vphy: Flag indicating if virtual PHY. */ struct leapraid_card_phy { struct list_head port_siblings; @@ -754,26 +835,26 @@ struct leapraid_card_phy { u8 phy_id; u16 hdl; u16 attached_hdl; - bool phy_is_assigned; - bool vphy; + u8 phy_is_assigned; + u8 vphy; }; /** * struct leapraid_topo_node - SAS topology node for LeapRAID * - * @list: List head for linking nodes - * @sas_port_list: List of SAS ports - * @card_port: Associated card port - * @card_phy: Associated card PHY - * @rphy: SAS remote PHY device - * @parent_dev: Parent device pointer - * @sas_address: SAS address of this node - * @sas_address_parent: Parent node's SAS address - * @phys_num: Number of physical links - * @hdl: Handle identifier - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical identifier - * @resp: Response status flag + * @list: List head for linking nodes. + * @sas_port_list: List of SAS ports. + * @card_port: Associated card port. + * @card_phy: Associated card PHY. + * @rphy: SAS remote PHY device. + * @parent_dev: Parent device pointer. + * @sas_address: SAS address of this node. + * @sas_address_parent: Parent node's SAS address. + * @phys_num: Number of physical links. + * @hdl: Handle identifier. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical identifier. + * @resp: Response status flag. */ struct leapraid_topo_node { struct list_head list; @@ -788,32 +869,32 @@ struct leapraid_topo_node { u16 hdl; u16 enc_hdl; u64 enc_lid; - bool resp; + u8 resp; }; /** * struct leapraid_dev_topo - LeapRAID device topology management structure * - * @topo_node_lock: Spinlock for protecting topology node operations - * @sas_dev_lock: Spinlock for SAS device list access - * @raid_volume_lock: Spinlock for RAID volume list access - * @sas_id: SAS domain identifier - * @card: Main card topology node - * @exp_list: List of expander devices - * @enc_list: List of enclosure devices - * @sas_dev_list: List of SAS devices - * @sas_dev_init_list: List of SAS devices being initialized - * @raid_volume_list: List of RAID volumes - * @card_port_list: List of card ports - * @pd_hdls: Array of physical disk handles - * @dev_removing: Array tracking devices being removed - * @pending_dev_add: Array tracking devices pending addition - * @blocking_hdls: Array of blocking handles + * @topo_node_lock: Spinlock for protecting topology node operations. + * @sas_dev_lock: Spinlock for SAS device list access. + * @raid_volume_lock: Spinlock for RAID volume list access. + * @enc_lock: Spinlock for enclosure device list access. + * @sas_id: SAS domain identifier. + * @card: Main card topology node. + * @exp_list: List of expander devices. + * @enc_list: List of enclosure devices. + * @sas_dev_list: List of SAS devices. + * @sas_dev_init_list: List of SAS devices being initialized. + * @raid_volume_list: List of RAID volumes. + * @card_port_list: List of card ports. + * @pd_hdls: Array of physical disk handles. + * @blocking_hdls: Array of blocking handles. */ struct leapraid_dev_topo { - spinlock_t topo_node_lock; - spinlock_t sas_dev_lock; - spinlock_t raid_volume_lock; + spinlock_t topo_node_lock; /* Protects topology node. */ + spinlock_t sas_dev_lock; /* Protects SAS device list access. */ + spinlock_t raid_volume_lock; /* Protects RAID volume list access. */ + spinlock_t enc_lock; /* Protects enclosure device list access. */ int sas_id; struct leapraid_topo_node card; struct list_head exp_list; @@ -823,21 +904,17 @@ struct leapraid_dev_topo { struct list_head raid_volume_list; struct list_head card_port_list; u16 pd_hdls_sz; - void *pd_hdls; - void *blocking_hdls; - u16 pending_dev_add_sz; - void *pending_dev_add; - u16 dev_removing_sz; - void *dev_removing; + unsigned long *pd_hdls; + unsigned long *blocking_hdls; }; /** * struct leapraid_boot_dev - Boot device structure for LeapRAID * - * @dev: Device pointer - * @chnl: Channel number - * @form: Form factor - * @pg_dev: Config page device content + * @dev: Device pointer. + * @chnl: Channel number. + * @form: Form factor. + * @pg_dev: Config page device content. */ struct leapraid_boot_dev { void *dev; @@ -848,11 +925,14 @@ struct leapraid_boot_dev { /** * struct leapraid_boot_devs - Boot device management structure - * @requested_boot_dev: Requested primary boot device - * @requested_alt_boot_dev: Requested alternate boot device - * @current_boot_dev: Currently active boot device + * + * @lock: Spinlock protecting boot device cache access. + * @requested_boot_dev: Requested primary boot device. + * @requested_alt_boot_dev: Requested alternate boot device. + * @current_boot_dev: Currently active boot device. */ struct leapraid_boot_devs { + spinlock_t lock; /* protects boot dev */ struct leapraid_boot_dev requested_boot_dev; struct leapraid_boot_dev requested_alt_boot_dev; struct leapraid_boot_dev current_boot_dev; @@ -860,9 +940,10 @@ struct leapraid_boot_devs { /** * struct leapraid_smart_poll_desc - SMART polling descriptor - * @smart_poll_wq: Workqueue for SMART polling tasks - * @smart_poll_work: Delayed work for SMART polling operations - * @smart_poll_wq_name: Workqueue name string + * + * @smart_poll_wq: Workqueue for SMART polling tasks. + * @smart_poll_work: Delayed work for SMART polling operations. + * @smart_poll_wq_name: Workqueue name string. */ struct leapraid_smart_poll_desc { struct workqueue_struct *smart_poll_wq; @@ -872,26 +953,28 @@ struct leapraid_smart_poll_desc { /** * struct leapraid_adapter - Main LeapRAID adapter structure - * @list: List head for adapter management - * @shost: SCSI host structure - * @pdev: PCI device structure - * @iomem_base: I/O memory mapped base address - * @rep_msg_host_idx: Host index for reply messages - * @mask_int: Interrupt masking flag - * @timestamp_sync_cnt: Timestamp synchronization counter - * @adapter_attr: Adapter attributes - * @mem_desc: Memory descriptor - * @driver_cmds: Driver commands - * @dynamic_task_desc: Dynamic task descriptor - * @fw_evt_s: Firmware event structure - * @notification_desc: Notification descriptor - * @reset_desc: Reset descriptor - * @scan_dev_desc: Device scan descriptor - * @access_ctrl: Access control - * @fw_log_desc: Firmware log descriptor - * @dev_topo: Device topology - * @boot_devs: Boot devices - * @smart_poll_desc: SMART polling descriptor + * + * @list: List head for adapter management. + * @shost: SCSI host structure. + * @pdev: PCI device structure. + * @iomem_base: I/O memory mapped base address. + * @rep_msg_host_idx: Host index for reply messages. + * @mask_int: Interrupt masking flag. + * @timestamp_sync_cnt: Timestamp synchronization counter. + * @adapter_attr: Adapter attributes. + * @mem_desc: Memory descriptor. + * @driver_cmds: Driver commands. + * @dynamic_task_desc: Dynamic task descriptor. + * @fw_evt_s: Firmware event structure. + * @notification_desc: Notification descriptor. + * @reset_desc: Reset descriptor. + * @scan_dev_desc: Device scan descriptor. + * @access_ctrl: Access control. + * @fw_log_desc: Firmware log descriptor. + * @dev_topo: Device topology. + * @boot_devs: Boot devices. + * @smart_poll_desc: SMART polling descriptor. + * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { struct list_head list; @@ -899,7 +982,7 @@ struct leapraid_adapter { struct pci_dev *pdev; struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; - bool mask_int; + u8 mask_int; u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; @@ -915,6 +998,7 @@ struct leapraid_adapter { struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; struct leapraid_smart_poll_desc smart_poll_desc; + struct leapraid_overheat_desc overheat_desc; }; union cfg_param_1 { @@ -931,6 +1015,7 @@ union cfg_param_2 { enum config_page_action { GET_BIOS_PG2, GET_BIOS_PG3, + GET_MANUFACTURING_PG0, GET_SAS_DEVICE_PG0, GET_SAS_IOUNIT_PG0, GET_SAS_IOUNIT_PG1, @@ -945,8 +1030,9 @@ enum config_page_action { /** * struct leapraid_enc_node - Enclosure node structure - * @list: List head for enclosure management - * @pg0: Enclosure page 0 data + * + * @list: List head for enclosure management. + * @pg0: Enclosure page 0 data. */ struct leapraid_enc_node { struct list_head list; @@ -955,20 +1041,23 @@ struct leapraid_enc_node { /** * struct leapraid_raid_volume - RAID volume structure - * @list: List head for volume management - * @starget: SCSI target structure - * @sdev: SCSI device structure - * @id: Volume ID - * @channel: SCSI channel - * @wwid: World Wide Identifier - * @hdl: Volume handle - * @vol_type: Volume type - * @pd_num: Number of physical disks - * @resp: Response status - * @dev_info: Device information + * + * @list: List head for volume management. + * @refcnt: Reference count. + * @starget: SCSI target structure. + * @sdev: SCSI device structure. + * @id: Volume ID. + * @channel: SCSI channel. + * @wwid: World wide Identifier. + * @hdl: Volume handle. + * @vol_type: Volume type. + * @pd_num: Number of physical disks. + * @resp: Response status. + * @dev_info: Device information. */ struct leapraid_raid_volume { struct list_head list; + struct kref refcnt; struct scsi_target *starget; struct scsi_device *sdev; unsigned int id; @@ -981,20 +1070,31 @@ struct leapraid_raid_volume { u32 dev_info; }; +static inline void leapraid_raid_volume_free(struct kref *ref) +{ + kfree(container_of(ref, struct leapraid_raid_volume, refcnt)); +} + +#define leapraid_raid_volume_get(volume) \ + kref_get(&(volume)->refcnt) +#define leapraid_raid_volume_put(volume) \ + kref_put(&(volume)->refcnt, leapraid_raid_volume_free) + #define LEAPRAID_TGT_FLG_RAID_MEMBER 0x01 #define LEAPRAID_TGT_FLG_VOLUME 0x02 #define LEAPRAID_NO_ULD_ATTACH 1 /** * struct leapraid_starget_priv - SCSI target private data - * @starget: SCSI target structure - * @sas_address: SAS address - * @hdl: Device handle - * @num_luns: Number of LUNs - * @flg: Flags - * @deleted: Deletion flag - * @tm_busy: Task management busy flag - * @card_port: Associated card port - * @sas_dev: SAS device structure + * + * @starget: SCSI target structure. + * @sas_address: SAS address. + * @hdl: Device handle. + * @num_luns: Number of LUNs. + * @flg: Flags. + * @deleted: Deletion flag. + * @tm_busy: Task management busy flag. + * @card_port: Associated card port. + * @sas_dev: SAS device structure. */ struct leapraid_starget_priv { struct scsi_target *starget; @@ -1002,8 +1102,8 @@ struct leapraid_starget_priv { u16 hdl; int num_luns; u32 flg; - bool deleted; - bool tm_busy; + u8 deleted; + u8 tm_busy; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; }; @@ -1011,50 +1111,52 @@ struct leapraid_starget_priv { #define LEAPRAID_DEVICE_FLG_INIT 0x01 /** * struct leapraid_sdev_priv - SCSI device private data - * @starget_priv: Associated target private data - * @lun: Logical Unit Number - * @flg: Flags - * @block: Block flag - * @deleted: Deletion flag - * @sep: SEP flag + * + * @starget_priv: Associated target private data. + * @lun: Logical Unit Number. + * @flg: Flags. + * @block: Block flag. + * @deleted: Deletion flag. + * @sep: SEP flag. */ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - bool ncq; - bool block; - bool deleted; - bool sep; + u8 ncq; + u8 block; + u8 deleted; + u8 sep; }; /** * struct leapraid_sas_dev - SAS device structure - * @list: List head for device management - * @starget: SCSI target structure - * @card_port: Associated card port - * @rphy: SAS remote PHY - * @refcnt: Reference count - * @id: Device ID - * @channel: SCSI channel - * @slot: Slot number - * @phy: PHY identifier - * @resp: Response status - * @led_on: LED state - * @sas_addr: SAS address - * @dev_name: Device name - * @hdl: Device handle - * @parent_sas_addr: Parent SAS address - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical ID - * @volume_hdl: Volume handle - * @volume_wwid: Volume WWID - * @dev_info: Device information - * @pend_sas_rphy_add: Pending SAS rphy addition flag - * @enc_level: Enclosure level - * @port_type: Port type - * @connector_name: Connector name - * @support_smart: SMART support flag + * + * @list: List head for device management. + * @starget: SCSI target structure. + * @card_port: Associated card port. + * @rphy: SAS remote PHY. + * @refcnt: Reference count. + * @id: Device ID. + * @channel: SCSI channel. + * @slot: Slot number. + * @phy: PHY identifier. + * @resp: Response status. + * @led_on: LED state. + * @sas_addr: SAS address. + * @dev_name: Device name. + * @hdl: Device handle. + * @parent_sas_addr: Parent SAS address. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical ID. + * @volume_hdl: Volume handle. + * @volume_wwid: Volume WWID. + * @dev_info: Device information. + * @pend_sas_rphy_add: Pending SAS remote PHY addition flag. + * @enc_level: Enclosure level. + * @port_connection: Port connection. + * @connector_name: Connector name. + * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1066,8 +1168,8 @@ struct leapraid_sas_dev { unsigned int channel; u16 slot; u8 phy; - bool resp; - bool led_on; + u8 resp; + u8 led_on; u64 sas_addr; u64 dev_name; u16 hdl; @@ -1079,9 +1181,9 @@ struct leapraid_sas_dev { u32 dev_info; u8 pend_sas_rphy_add; u8 enc_level; - u8 port_type; - u8 connector_name[5]; - bool support_smart; + u8 port_connection; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; + u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1092,15 +1194,19 @@ static inline void leapraid_sdev_free(struct kref *ref) #define leapraid_sdev_get(sdev) kref_get(&(sdev)->refcnt) #define leapraid_sdev_put(sdev) kref_put(&(sdev)->refcnt, leapraid_sdev_free) +void leapraid_boot_dev_get(void *dev, u32 chnl); +void leapraid_boot_dev_put(void *dev, u32 chnl); + /** * struct leapraid_sas_port - SAS port structure - * @port_list: List head for port management - * @phy_list: List of PHYs in this port - * @port: SAS port structure - * @card_port: Associated card port - * @remote_identify: Remote device identification - * @rphy: SAS remote PHY - * @phys_num: Number of PHYs in this port + * + * @port_list: List head for port management. + * @phy_list: List of PHYs in this port. + * @port: SAS port structure. + * @card_port: Associated card port. + * @remote_identify: Remote device identification. + * @rphy: SAS remote PHY. + * @phys_num: Number of PHYs in this port. */ struct leapraid_sas_port { struct list_head port_list; @@ -1115,10 +1221,11 @@ struct leapraid_sas_port { #define LEAPRAID_VPHY_FLG_DIRTY 0x01 /** * struct leapraid_vphy - Virtual PHY structure - * @list: List head for PHY management - * @sas_address: SAS address - * @phy_mask: PHY mask - * @flg: Flags + * + * @list: List head for PHY management. + * @sas_address: SAS address. + * @phy_mask: PHY mask. + * @flg: Flags. */ struct leapraid_vphy { struct list_head list; @@ -1127,23 +1234,44 @@ struct leapraid_vphy { u8 flg; }; +/** + * struct leapraid_tgt_rst_list - Target reset tracking entry + * @list: List node used to link reset entries. + * @handle: Device handle of the target being reset. + * @state: Current state of the target reset operation. + * + * Each entry represents a target device that is undergoing or has + * undergone a target reset operation. + */ struct leapraid_tgt_rst_list { struct list_head list; u16 handle; u16 state; }; -struct leapraid_sc_list { - struct list_head list; - u16 handle; -}; - +/** + * struct sense_info - Parsed SCSI sense information + * @sense_key: Sense key extracted from sense data. + * @asc: Additional Sense Code (ASC). + * @ascq: Additional Sense Code Qualifier (ASCQ). + * + * This structure stores key fields parsed from SCSI sense data to + * simplify error handling and reporting. + */ struct sense_info { u8 sense_key; u8 asc; u8 ascq; }; +/** + * struct leapraid_fw_log_info - Firmware log position information + * @user_position: Current log read position used by the driver. + * @adapter_position: Current log write position maintained by firmware. + * + * This structure tracks firmware log buffer positions used for retrieving + * log entries from the adapter. + */ struct leapraid_fw_log_info { u32 user_position; u32 adapter_position; @@ -1151,8 +1279,9 @@ struct leapraid_fw_log_info { /** * enum reset_type - Reset type enumeration - * @FULL_RESET: Full hardware reset - * @PART_RESET: Partial reset + * + * @FULL_RESET: Full hardware reset. + * @PART_RESET: Partial reset. */ enum reset_type { FULL_RESET, @@ -1174,22 +1303,23 @@ enum leapraid_port_checking_state { /** * struct leapraid_card_port_feature - Card port feature - * @dirty_flg: Dirty flag indicator - * @same_addr: Same address flag - * @exact_phy: Exact PHY match flag - * @phy_overlap: PHY overlap bitmap - * @same_port: Same port flag - * @cur_chking_old_port: Current checking old port - * @expected_old_port: Expected old port - * @same_addr_port_count: Same address port count - * @checking_state: Port checking state + * + * @dirty_flg: Dirty flag indicator. + * @same_addr: Same address flag. + * @exact_phy: Exact PHY match flag. + * @phy_overlap: PHY overlap bitmap. + * @same_port: Same port flag. + * @cur_chking_old_port: Current checking old port. + * @expected_old_port: Expected old port. + * @same_addr_port_count: Same address port count. + * @checking_state: Port checking state. */ struct leapraid_card_port_feature { u8 dirty_flg; - bool same_addr; - bool exact_phy; + u8 same_addr; + u8 exact_phy; u32 phy_overlap; - bool same_port; + u8 same_port; struct leapraid_card_port *cur_chking_old_port; struct leapraid_card_port *expected_old_port; int same_addr_port_count; @@ -1224,7 +1354,7 @@ struct leapraid_rep_manu_reply { u8 vendor_identification[SAS_EXPANDER_VENDOR_ID_LEN]; u8 product_identification[SAS_EXPANDER_PRODUCT_ID_LEN]; u8 product_revision_level[SAS_EXPANDER_PRODUCT_REV_LEN]; - u8 component_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; + u8 comp_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; u16 component_id; u8 component_revision_level; u8 r3; @@ -1233,20 +1363,21 @@ struct leapraid_rep_manu_reply { /** * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * @hdl: Device handle - * @lun: Logical Unit Number - * @raid_member: RAID member flag - * @dir: DMA data direction - * @data_length: Data transfer length - * @data_buffer: Data buffer pointer - * @cdb_length: CDB length - * @cdb: Command Descriptor Block - * @time_out: Timeout + * + * @hdl: Device handle. + * @lun: Logical Unit Number. + * @raid_member: RAID member flag. + * @dir: DMA data direction. + * @data_length: Data transfer length. + * @data_buffer: Data buffer pointer. + * @cdb_length: CDB length. + * @cdb: Command Descriptor Block. + * @time_out: Timeout. */ struct leapraid_scsi_cmd_desc { u16 hdl; u32 lun; - bool raid_member; + u8 raid_member; enum dma_data_direction dir; u32 data_length; void *data_buffer; @@ -1273,7 +1404,8 @@ void leapraid_mask_int(struct leapraid_adapter *adapter); void leapraid_unmask_int(struct leapraid_adapter *adapter); u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter); bool leapraid_pci_removed(struct leapraid_adapter *adapter); -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter); +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller); void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid); void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid); __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -1285,11 +1417,11 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid); struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( struct leapraid_adapter *adapter, u16 taskid); -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd); struct scsi_cmnd *leapraid_get_scmd_from_taskid( struct leapraid_adapter *adapter, u16 taskid); int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev); void leapraid_scan_dev_done(struct leapraid_adapter *adapter); +void leapraid_cleanup_lists(struct leapraid_adapter *adapter); void leapraid_wait_cmds_done(struct leapraid_adapter *adapter); void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter); void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll); @@ -1305,14 +1437,16 @@ int leapraid_issue_locked_tm(struct leapraid_adapter *adapter, u16 handle, int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 handle, uint channel, uint id, uint lun, u8 type, u16 taskid_task, u8 tr_method); -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep); +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep); int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume); -int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_init_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_exit_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); bool leapraid_scmd_find_by_lun(struct leapraid_adapter *adapter, uint id, unsigned int lun, uint channel); @@ -1381,10 +1515,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth); +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data); + +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); int leapraid_ctl_release(struct inode *inode, struct file *filep); -void leapraid_ctl_init(void); +int leapraid_ctl_init(void); void leapraid_ctl_exit(void); extern struct sas_function_template leapraid_transport_functions; @@ -1407,17 +1544,20 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, u64 sas_address, u16 handle, u8 phy_number, u8 link_rate, struct leapraid_card_port *card_port); -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *topo_node, - struct leapraid_card_phy *card_phy); -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *sas_node, - struct leapraid_card_phy *card_phy, - u64 sas_address, - struct leapraid_card_port *card_port); +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *topo_node, + struct leapraid_card_phy *card_phy); +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *sas_node, + struct leapraid_card_phy *card_phy, + u64 sas_address, + struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); void leapraid_smart_polling_start(struct leapraid_adapter *adapter); void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 6635e74fd8ff..5a6cda0b5ea8 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -18,16 +17,16 @@ MODULE_DESCRIPTION(LEAPRAID_DESCRIPTION); MODULE_LICENSE("GPL"); MODULE_VERSION(LEAPRAID_DRIVER_VERSION); -static int leapraid_ids; +static atomic_t leapraid_ids = ATOMIC_INIT(0); static int open_pcie_trace = 1; module_param(open_pcie_trace, int, 0644); -MODULE_PARM_DESC(open_pcie_trace, "open_pcie_trace: default=1(open)/0(close)"); +MODULE_PARM_DESC(open_pcie_trace, "Default=1(open)/0(close)"); static int enable_mp = 1; module_param(enable_mp, int, 0444); MODULE_PARM_DESC(enable_mp, - "enable multipath on target device. default=1(enable)"); + "Enable multipath on target device. default=1(enable)"); static inline void leapraid_get_sense_data(char *sense, struct sense_info *data) @@ -46,14 +45,9 @@ static inline void leapraid_get_sense_data(char *sense, } } -static struct Scsi_Host *pdev_to_shost(struct pci_dev *pdev) -{ - return pci_get_drvdata(pdev); -} - static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost) return NULL; @@ -61,18 +55,13 @@ static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) return shost_priv(shost); } -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd) -{ - return (struct leapraid_io_req_tracker *)scmd->host_scribble; -} - void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_sdev_priv *sdev_priv; struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -82,7 +71,7 @@ void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = true; + sdev_priv->starget_priv->tm_busy = 1; skip = true; } } @@ -94,7 +83,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -104,7 +93,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = false; + sdev_priv->starget_priv->tm_busy = 0; skip = true; } } @@ -136,21 +125,19 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - if ((adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && + (adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid) { - if ((adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && + (adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; return rc; } @@ -197,7 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsi_tm_req *scsi_tm_req; struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; - u16 msix_task = 0; + u16 msix_task; bool issue_reset = false; u32 db; int rc; @@ -208,7 +195,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { dev_info(&adapter->pdev->dev, - "%s %s: host is recovering, skip tm command!\n", + "%s %s: Host is recovering, skip tm command!\n", __func__, adapter->adapter_attr.name); return FAILED; } @@ -216,24 +203,25 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED) { dev_info(&adapter->pdev->dev, - "%s unexpected db status, issuing hard reset!\n", + "%s Unexpected db status, issuing hard reset!\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, - target_taskid); + io_req_tracker = + leapraid_get_io_tracker_from_taskid(adapter, + target_taskid); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_PENDING; scsi_tm_req = @@ -241,7 +229,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->driver_cmds.tm_cmd.hp_taskid); leapraid_build_tm_req(scsi_tm_req, hdl, lun, type, tr_method, target_taskid); - memset((void *)(&adapter->driver_cmds.tm_cmd.reply), 0, + memset(&adapter->driver_cmds.tm_cmd.reply, 0, sizeof(struct leapraid_scsi_tm_rep)); leapraid_set_tm_flg(adapter, hdl); init_completion(&adapter->driver_cmds.tm_cmd.done); @@ -257,16 +245,20 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: TM cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.tm_cmd.status); + leapraid_log_req_context(adapter, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); if (issue_reset) { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = (!rc) ? SUCCESS : FAILED; - goto out; + rc = !rc ? SUCCESS : FAILED; + goto out_cleanup; } } @@ -276,15 +268,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, case LEAPRAID_TM_TASKTYPE_TARGET_RESET: case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: - rc = leapraid_tm_post_processing(adapter, hdl, channel, id, lun, - type, target_taskid); + rc = leapraid_tm_post_processing(adapter, hdl, channel, id, + lun, type, target_taskid); break; case LEAPRAID_TM_TASKTYPE_ABORT_TASK: rc = SUCCESS; scsiio_req = leapraid_get_task_desc(adapter, target_taskid); if (le16_to_cpu(scsiio_req->dev_hdl) != hdl) break; - dev_err(&adapter->pdev->dev, "%s abort failed, hdl=0x%04x\n", + dev_err(&adapter->pdev->dev, "%s: Abort failed, hdl=0x%04x\n", adapter->adapter_attr.name, hdl); rc = FAILED; break; @@ -296,7 +288,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, break; } -out: +out_cleanup: leapraid_clear_tm_flg(adapter, hdl); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_NOT_USED; return rc; @@ -327,20 +319,25 @@ void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + return; } starget = sas_dev->starget; - starget_priv = starget->hostdata; - if ((starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { + starget_priv = starget ? starget->hostdata : NULL; + if (!starget_priv) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + goto release_sdev; + } + + if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); + goto release_sdev; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_async_turn_on_led(adapter, hdl); -out: +release_sdev: if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -420,7 +417,8 @@ static void leapraid_handle_success_status( scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; } -static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, +static void leapraid_scsiio_done_dispatch( + struct leapraid_adapter *adapter, struct leapraid_scsiio_rep *scsiio_rep, struct leapraid_sdev_priv *sdev_priv, struct scsi_cmnd *scmd, @@ -442,9 +440,8 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, xfer_cnt == 0 && (scsi_status == LEAPRAID_SCSI_STATUS_BUSY || scsi_status == LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT || - scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) { + scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) adapter_status = LEAPRAID_ADAPTER_STATUS_SUCCESS; - } switch (adapter_status) { case LEAPRAID_ADAPTER_STATUS_SCSI_DEVICE_NOT_THERE: @@ -516,7 +513,7 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, scsi_print_command(scmd); dev_warn(&adapter->pdev->dev, - "scsiio warn: hdl=0x%x, status are: 0x%x, 0x%x, 0x%x\n", + "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, scsi_status, scsi_state); @@ -526,24 +523,23 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, sz = min_t(u32, SCSI_SENSE_BUFFERSIZE, le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, - &sshdr)) { + &sshdr)) dev_warn(&adapter->pdev->dev, - "sense: key=0x%x asc=0x%x ascq=0x%x\n", + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", sshdr.sense_key, sshdr.asc, sshdr.ascq); - } else { + else dev_warn(&adapter->pdev->dev, - "sense: invalid sense data\n"); - } + "Sense: Invalid sense data\n"); } } -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep) +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep) { - struct leapraid_scsiio_rep *scsiio_rep = NULL; - struct leapraid_sdev_priv *sdev_priv = NULL; - struct scsi_cmnd *scmd = NULL; + struct leapraid_scsiio_rep *scsiio_rep; + struct leapraid_sdev_priv *sdev_priv; + struct scsi_cmnd *scmd; u32 response_code = 0; if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) @@ -551,12 +547,12 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, else scmd = adapter->driver_cmds.internal_scmd; if (!scmd) - return 1; + return true; scsiio_rep = leapraid_get_reply_vaddr(adapter, rep); if (!scsiio_rep) { scmd->result = DID_OK << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } sdev_priv = scmd->device->hostdata; @@ -564,7 +560,7 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, !sdev_priv->starget_priv || sdev_priv->starget_priv->deleted) { scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } if (scsiio_rep->scsi_state & LEAPRAID_SCSI_STATE_RESPONSE_INFO_VALID) @@ -574,33 +570,51 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, leapraid_scsiio_done_dispatch(adapter, scsiio_rep, sdev_priv, scmd, taskid, response_code); -out: +out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid)) { + if (unlikely(taskid == + adapter->driver_cmds.driver_scsiio_cmd.taskid)) { adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_DONE; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return 0; + return false; } leapraid_free_taskid(adapter, taskid); scmd->scsi_done(scmd); - return 0; + return false; } static void leapraid_probe_raid(struct leapraid_adapter *adapter) { - struct leapraid_raid_volume *raid_volume, *raid_volume_next; + struct leapraid_raid_volume *raid_volume, *next_raid_volume; + unsigned long flags; + LIST_HEAD(head); int rc; - list_for_each_entry_safe(raid_volume, raid_volume_next, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->starget) + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_splice_init(&adapter->dev_topo.raid_volume_list, &head); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, next_raid_volume, &head, list) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_move_tail(&raid_volume->list, + &adapter->dev_topo.raid_volume_list); + if (raid_volume->starget) { + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); continue; + } + + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); rc = scsi_add_device(adapter->shost, RAID_CHANNEL, raid_volume->id, 0); if (rc) leapraid_raid_volume_remove(adapter, raid_volume); + + leapraid_raid_volume_put(raid_volume); } } @@ -629,7 +643,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev = leapraid_get_next_sas_dev_from_init_list(adapter); if (!sas_dev) break; - added = leapraid_transport_port_add(adapter, sas_dev->hdl, sas_dev->parent_sas_addr, @@ -657,32 +670,52 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) } } -static bool leapraid_get_boot_dev(struct leapraid_boot_dev *boot_dev, +static bool leapraid_get_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, void **pdev, u32 *pchnl) { - if (boot_dev->dev) { - *pdev = boot_dev->dev; - *pchnl = boot_dev->chnl; - return true; + unsigned long flags; + void *dev; + u32 chnl; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (!boot_dev->dev) { + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + return false; } - return false; + + dev = boot_dev->dev; + chnl = boot_dev->chnl; + leapraid_boot_dev_get(dev, chnl); + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + + *pdev = dev; + *pchnl = chnl; + return true; } static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) { + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + struct leapraid_sas_port *sport; + unsigned long flags; void *dev = NULL; u32 chnl; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_alt_boot_dev, + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.current_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + &dev, &chnl)) goto boot_dev_found; return; @@ -690,12 +723,10 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) boot_dev_found: switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; + raid_volume = dev; if (raid_volume->starget) - return; + break; /* TODO eedp */ @@ -703,16 +734,11 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; - struct leapraid_sas_port *sas_port; - unsigned long flags; + sas_dev = dev; if (sas_dev->starget) - return; + break; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_move_tail(&sas_dev->list, @@ -720,16 +746,17 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (!sas_dev->card_port) - return; + break; - sas_port = leapraid_transport_port_add(adapter, sas_dev->hdl, - sas_dev->parent_sas_addr, - sas_dev->card_port); - if (!sas_port) + sport = leapraid_transport_port_add(adapter, sas_dev->hdl, + sas_dev->parent_sas_addr, + sas_dev->card_port); + if (!sport) leapraid_sas_dev_remove(adapter, sas_dev); break; } - } + + leapraid_boot_dev_put(dev, chnl); } static void leapraid_probe_devices(struct leapraid_adapter *adapter) @@ -747,69 +774,23 @@ static void leapraid_probe_devices(struct leapraid_adapter *adapter) void leapraid_scan_dev_done(struct leapraid_adapter *adapter) { if (adapter->scan_dev_desc.wait_scan_dev_done) { - adapter->scan_dev_desc.wait_scan_dev_done = false; + adapter->scan_dev_desc.wait_scan_dev_done = 0; leapraid_probe_devices(adapter); } + adapter->scan_dev_desc.scan_start = 0; + leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_smart_polling_start(adapter); } -static void leapraid_ir_shutdown(struct leapraid_adapter *adapter) -{ - struct leapraid_raid_act_req *raid_act_req; - struct leapraid_raid_act_rep *raid_act_rep; - struct leapraid_driver_cmd *raid_action_cmd; - - if (!adapter || !adapter->adapter_attr.raid_support) - return; - - if (list_empty(&adapter->dev_topo.raid_volume_list)) - return; - - if (leapraid_pci_removed(adapter)) - return; - - raid_action_cmd = &adapter->driver_cmds.raid_action_cmd; - - mutex_lock(&raid_action_cmd->mutex); - raid_action_cmd->status = LEAPRAID_CMD_PENDING; - - raid_act_req = leapraid_get_task_desc(adapter, - raid_action_cmd->inter_taskid); - memset(raid_act_req, 0, sizeof(struct leapraid_raid_act_req)); - raid_act_req->func = LEAPRAID_FUNC_RAID_ACTION; - raid_act_req->act = LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED; - - dev_info(&adapter->pdev->dev, "ir shutdown start\n"); - init_completion(&raid_action_cmd->done); - leapraid_fire_task(adapter, raid_action_cmd->inter_taskid); - wait_for_completion_timeout(&raid_action_cmd->done, - LEAPRAID_RAID_ACTION_CMD_TIMEOUT * HZ); - - if (!(raid_action_cmd->status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timeout waiting for ir shutdown\n", __func__); - goto out; - } - - if (raid_action_cmd->status & LEAPRAID_CMD_REPLY_VALID) { - raid_act_rep = (void *)(&raid_action_cmd->reply); - dev_info(&adapter->pdev->dev, - "ir shutdown done, adapter status=0x%04x\n", - le16_to_cpu(raid_act_rep->adapter_status)); - } - -out: - raid_action_cmd->status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&raid_action_cmd->mutex); -} - static const struct pci_device_id leapraid_pci_table[] = { - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA) }, - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_RAID) }, + { PCI_DEVICE_SUB(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA, + LEAPRAID_SUBVENDOR_ID, + LEAPRAID_SUBDEVID_HBA) }, { 0, } }; @@ -819,7 +800,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, u8 opcode; if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.adapter_thermal_alert) + atomic_read(&adapter->overheat_desc.thermal_alert)) return false; if (adapter->access_ctrl.host_removing) { @@ -829,8 +810,8 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, opcode = scmd->cmnd[0]; if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) return true; - else - return false; + + return false; } return true; } @@ -860,28 +841,33 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, scmd->result = (DRIVER_SENSE << LEAPRAID_SCSI_DRIVER_SHIFT) | (DID_OK << LEAPRAID_SCSI_HOST_SHIFT) | SAM_STAT_CHECK_CONDITION; - goto done_out; + goto scsiio_done; } if (adapter->access_ctrl.shost_recovering || adapter->reset_desc.adapter_link_resetting) { *rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; - } else if (starget_priv->deleted || sdev_priv->deleted) { + return false; + } + + if (starget_priv->deleted || sdev_priv->deleted) goto no_connect; - } else if (starget_priv->tm_busy || sdev_priv->block) { + + if (starget_priv->tm_busy || sdev_priv->block) { *rc = SCSI_MLQUEUE_DEVICE_BUSY; - goto out; + return false; } return true; no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; -done_out: +scsiio_done: if (likely(scmd != adapter->driver_cmds.internal_scmd)) scmd->scsi_done(scmd); -out: + else + *rc = LEAPRAID_OPERATION_FAILED; + return false; } @@ -909,12 +895,14 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; if (scmd->cmd_len == 32) - control |= 4 << LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT; + control |= LEAPRAID_SCSIIO_CTRL_CDB_32BYTE << + LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT; return control; } -int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) +int leapraid_queuecommand(struct Scsi_Host *shost, + struct scsi_cmnd *scmd) { struct leapraid_adapter *adapter = shost_priv(scmd->device->host); struct leapraid_sdev_priv *sdev_priv = scmd->device->hostdata; @@ -926,7 +914,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) int rc = 0; if (!leapraid_should_queuecommand(adapter, sdev_priv, scmd, &rc)) - goto out; + return rc; starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; @@ -938,11 +926,11 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) - scsiio_req->func = LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH; else - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; scsiio_req->dev_hdl = cpu_to_le16(hdl); scsiio_req->data_len = cpu_to_le32(scsi_bufflen(scmd)); @@ -960,23 +948,21 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) if (scsiio_req->data_len) { if (leapraid_build_scmd_ieee_sg(adapter, scmd, taskid)) { leapraid_free_taskid(adapter, taskid); - rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; + return SCSI_MLQUEUE_HOST_BUSY; } } else { leapraid_build_ieee_nodata_sg(adapter, &scsiio_req->sgl); } - if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO_REQ)) { + if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO)) leapraid_fire_scsi_io(adapter, taskid, - le16_to_cpu(scsiio_req->dev_hdl)); - } else { + le16_to_cpu(scsiio_req->dev_hdl)); + else leapraid_fire_task(adapter, taskid); - } + dev_dbg(&adapter->pdev->dev, "LEAPRAID_SCSIIO: Send Descriptor taskid %d, req type 0x%x\n", taskid, scsiio_req->func); -out: return rc; } @@ -999,9 +985,9 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, scsi_print_command(scmd); if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - io_req_tracker = leapraid_get_scmd_priv(scmd); + io_req_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; dev_info(&adapter->pdev->dev, - "EH ABORT: scmd=0x%p, pending=%u ms, tout=%u ms, req tag=%d\n", + "EH ABORT: scmd=0x%p, pend=%ums, tout=%ums, tag=%d\n", scmd, jiffies_to_msecs(jiffies - scmd->jiffies_at_alloc), (scmd->request->timeout / HZ) * 1000, @@ -1014,48 +1000,47 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH %s failed: %s scmd=0x%p\n", str, (adapter->access_ctrl.host_removing ? "shost removing!" : "pci_dev removed!"), scmd); - if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - if (io_req_tracker && io_req_tracker->taskid) - leapraid_free_taskid(adapter, - io_req_tracker->taskid); + if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK && + io_req_tracker && io_req_tracker->taskid) + leapraid_free_taskid(adapter, io_req_tracker->taskid); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; #ifdef FAST_IO_FAIL rc = FAST_IO_FAIL; #else rc = FAILED; #endif - goto out; + goto out_eh_done; } sdev_priv = scmd->device->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) { dev_warn(&adapter->pdev->dev, - "EH %s: sdev or starget gone, scmd=0x%p\n", + "EH %s: SAS dev or starget gone, scmd=0x%p\n", str, scmd); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scmd->scsi_done(scmd); rc = SUCCESS; - goto out; + goto out_eh_done; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { if (!io_req_tracker) { dev_warn(&adapter->pdev->dev, - "EH ABORT: no io tracker, scmd 0x%p\n", scmd); + "EH ABORT: No I/O tracker, scmd 0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = SUCCESS; - goto out; + goto out_eh_done; } if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { dev_err(&adapter->pdev->dev, - "EH ABORT: skip RAID/VOLUME target, scmd=0x%p\n", + "EH ABORT: Skip RAID/VOLUME, scmd=0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } hdl = sdev_priv->starget_priv->hdl; @@ -1073,11 +1058,11 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, if (!hdl) { dev_err(&adapter->pdev->dev, - "EH %s failed: target handle is 0, scmd=0x%p\n", + "EH %s failed: Target handle 0, scmd=0x%p\n", str, scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } } @@ -1085,24 +1070,27 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH issue TM: type=%s, scmd=0x%p, hdl=0x%x\n", str, scmd, hdl); - rc = leapraid_issue_locked_tm(adapter, hdl, scmd->device->channel, - scmd->device->id, - (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? - 0 : scmd->device->lun), - type, - (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? - io_req_tracker->taskid : 0), - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - -out: + rc = leapraid_issue_locked_tm( + adapter, + hdl, + scmd->device->channel, + scmd->device->id, + (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? + 0 : scmd->device->lun), + type, + (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? + io_req_tracker->taskid : 0), + LEAPRAID_TM_MSGFLAGS_LINK_RESET); + +out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { dev_info(&adapter->pdev->dev, "EH ABORT result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); } else { dev_info(&adapter->pdev->dev, "EH %s result: %s, scmd=0x%p\n", - str, ((rc == SUCCESS) ? "success" : "failed"), scmd); + str, rc == SUCCESS ? "success" : "failed", scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1145,19 +1133,19 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) (adapter->access_ctrl.host_removing ? "shost removing!" : "driver loading!"), scmd); rc = FAILED; - goto out; + goto out_host_reset_done; } - dev_info(&adapter->pdev->dev, "%s:%d issuing hard reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: Issuing hard reset\n", __func__, __LINE__); if (leapraid_hard_reset_handler(adapter, FULL_RESET) < 0) rc = FAILED; else rc = SUCCESS; -out: +out_host_reset_done: dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); return rc; } @@ -1183,30 +1171,35 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) stgt_priv->num_luns++; sdev_priv->starget_priv = stgt_priv; sdev->hostdata = sdev_priv; - if ((stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER)) + if (stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) sdev->no_uld_attach = LEAPRAID_NO_ULD_ATTACH; shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); if (tgt->channel == RAID_CHANNEL) { - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); - if (raid_volume) + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, + flags); raid_volume->sdev = sdev; - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); + } } if (!(stgt_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - stgt_priv->sas_address, - stgt_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + stgt_priv->sas_address, + stgt_priv->card_port); if (sas_dev && !sas_dev->starget) { sdev_printk(KERN_INFO, sdev, - "%s: assign starget to sas_dev\n", __func__); + "%s: Assign starget to sas_dev\n", + __func__); sas_dev->starget = tgt; } @@ -1224,7 +1217,6 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) struct leapraid_raid_volume *raid_volume; struct leapraid_starget_priv *starget_priv; struct leapraid_sdev_priv *sdev_priv; - unsigned long flags; int qd; u16 hdl; @@ -1232,37 +1224,38 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (!raid_volume) { sdev_printk(KERN_WARNING, sdev, - "%s: raid_volume not found, hdl=0x%x\n", + "%s: RAID volume not found, hdl=0x%x\n", __func__, hdl); return 1; } if (leapraid_get_volume_cap(adapter, raid_volume)) { sdev_printk(KERN_ERR, sdev, - "%s: failed to get volume cap, hdl=0x%x\n", + "%s: Failed to get volume cap, hdl=0x%x\n", __func__, hdl); + leapraid_raid_volume_put(raid_volume); return 1; } qd = (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) ? - LEAPRAID_SAS_QUEUE_DEPTH : LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth : + adapter->adapter_attr.sata_max_queue_depth; if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) - qd = LEAPRAID_RAID_QUEUE_DEPTH; + qd = adapter->adapter_attr.raid_volume_max_queue_depth; sdev_printk(KERN_INFO, sdev, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + "RAID volume: hdl=0x%04x, wwid=0x%016llx\n", raid_volume->hdl, (unsigned long long)raid_volume->wwid); if (shost->max_sectors > LEAPRAID_MAX_SECTORS) blk_queue_max_hw_sectors(sdev->request_queue, LEAPRAID_MAX_SECTORS); - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); + leapraid_raid_volume_put(raid_volume); return 0; } @@ -1280,13 +1273,14 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sdev_priv = sdev->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); *is_target_ssp = false; - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); sdev_printk(KERN_WARNING, sdev, - "%s: sas_dev not found, sas=0x%llx\n", + "%s: SAS dev not found, sas=0x%llx\n", __func__, sdev_priv->starget_priv->sas_address); return 1; } @@ -1295,18 +1289,18 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sas_dev->volume_hdl = vol_hdl; sas_dev->volume_wwid = volume_wwid; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { - *qd = (sas_dev->port_type > 1) ? + *qd = (sas_dev->port_connection > 1) ? adapter->adapter_attr.wideport_max_queue_depth : adapter->adapter_attr.narrowport_max_queue_depth; *is_target_ssp = true; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SEP) - sdev_priv->sep = true; + sdev_priv->sep = 1; } else { *qd = adapter->adapter_attr.sata_max_queue_depth; } sdev_printk(KERN_INFO, sdev, - "sdev: dev name=0x%016llx, sas addr=0x%016llx\n", + "device name=0x%016llx, SAS addr=0x%016llx\n", (unsigned long long)sas_dev->dev_name, (unsigned long long)sas_dev->sas_addr); leapraid_sdev_put(sas_dev); @@ -1337,7 +1331,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) { if (leapraid_cfg_get_volume_hdl(adapter, hdl, &vol_hdl)) { sdev_printk(KERN_WARNING, sdev, - "%s: get volume hdl failed, hdl=0x%x\n", + "%s: Get volume hdl failed, hdl=0x%x\n", __func__, hdl); return 1; } @@ -1345,7 +1339,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (vol_hdl && leapraid_cfg_get_volume_wwid(adapter, vol_hdl, &volume_wwid)) { sdev_printk(KERN_WARNING, sdev, - "%s: get wwid failed, volume_hdl=0x%x\n", + "%s: Get wwid failed, volume_hdl=0x%x\n", __func__, vol_hdl); return 1; } @@ -1358,7 +1352,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) return 1; } - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); if (is_target_ssp) sas_read_port_mode_page(sdev); @@ -1405,17 +1399,19 @@ static int leapraid_target_alloc_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + starget_priv = tgt->hostdata; raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); starget_priv->hdl = raid_volume->hdl; starget_priv->sas_address = raid_volume->wwid; starget_priv->flg |= LEAPRAID_TGT_FLG_VOLUME; raid_volume->starget = tgt; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return 0; } @@ -1430,12 +1426,13 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; + starget_priv = tgt->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); rphy = dev_to_rphy(tgt->dev.parent); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, - rphy->identify.sas_address, - rphy); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, + rphy->identify.sas_address, + rphy); if (sas_dev) { starget_priv->sas_dev = sas_dev; starget_priv->card_port = sas_dev->card_port; @@ -1444,8 +1441,10 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) sas_dev->channel = tgt->channel; sas_dev->id = tgt->id; sas_dev->starget = tgt; - if (test_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pd_hdls)) + if (sas_dev->hdl && + sas_dev->hdl <= + adapter->adapter_attr.features.max_dev_handle && + test_bit(sas_dev->hdl, adapter->dev_topo.pd_hdls)) starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1477,14 +1476,16 @@ static void leapraid_target_destroy_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume->starget = NULL; raid_volume->sdev = NULL; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } static void leapraid_target_destroy_sas(struct scsi_target *tgt) @@ -1526,12 +1527,12 @@ static void leapraid_target_destroy(struct scsi_target *tgt) if (tgt->channel == RAID_CHANNEL) { leapraid_target_destroy_raid(tgt); - goto out; + goto out_free; } leapraid_target_destroy_sas(tgt); -out: +out_free: kfree(starget_priv); tgt->hostdata = NULL; } @@ -1552,24 +1553,27 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) { dev_err(&adapter->pdev->dev, - "device scan: aborted due to reset\n"); + "Device scan: Aborted due to reset\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return true; } if (adapter->scan_dev_desc.scan_start_failed) { dev_err(&adapter->pdev->dev, - "device scan: failed with adapter_status=0x%08x\n", + "Device scan: Failed with adapter_status=0x%08x\n", adapter->scan_dev_desc.scan_start_failed); - adapter->scan_dev_desc.driver_loading = false; - adapter->scan_dev_desc.wait_scan_dev_done = false; - adapter->access_ctrl.host_removing = true; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "device scan: SUCCESS\n"); + dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1584,8 +1588,9 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_err(&adapter->pdev->dev, - "device scan: failed with timeout 300s\n"); - adapter->scan_dev_desc.driver_loading = false; + "Device scan: Failed with timeout 300s\n"); + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return 1; } @@ -1595,10 +1600,12 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) if (need_hard_reset) { adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - if (leapraid_hard_reset_handler(adapter, PART_RESET)) - adapter->scan_dev_desc.driver_loading = false; + if (leapraid_hard_reset_handler(adapter, PART_RESET)) { + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + } } return 1; @@ -1608,18 +1615,88 @@ static void leapraid_scan_start(struct Scsi_Host *shost) { struct leapraid_adapter *adapter = shost_priv(shost); - adapter->scan_dev_desc.scan_start = true; + adapter->scan_dev_desc.scan_start = 1; leapraid_scan_dev(adapter, true); } +static u32 leapraid_get_raid_qd(struct leapraid_adapter *adapter, + const struct leapraid_raid_volume *raid_volume, + bool default_qd) +{ + const struct leapraid_adapter_attr *attr = &adapter->adapter_attr; + + if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) + return default_qd ? LEAPRAID_RAID_QUEUE_DEPTH : + attr->raid_volume_max_queue_depth; + + if (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) + return default_qd ? LEAPRAID_SAS_QUEUE_DEPTH : + attr->narrowport_max_queue_depth; + + return default_qd ? LEAPRAID_SATA_QUEUE_DEPTH : + attr->sata_max_queue_depth; +} + static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) { struct Scsi_Host *shost; + struct leapraid_adapter *adapter; + struct leapraid_starget_priv *starget_priv; + struct leapraid_sdev_priv *sdev_priv; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; int max_depth; + u32 default_qdepth = 0; + u32 fw_qdepth = 0; shost = sdev->host; + adapter = shost_priv(shost); max_depth = shost->can_queue; + sdev_priv = sdev->hostdata; + if (!sdev_priv) + goto out_tag_check; + + starget_priv = sdev_priv->starget_priv; + if (!starget_priv) + goto out_tag_check; + + if (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + raid_volume = leapraid_raid_volume_find_by_hdl( + adapter, starget_priv->hdl); + if (raid_volume) { + default_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, true); + fw_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, false); + leapraid_raid_volume_put(raid_volume); + } + goto out_limit_check; + } + + sas_dev = leapraid_get_sas_dev_from_tgt(adapter, starget_priv); + if (sas_dev) { + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { + default_qdepth = LEAPRAID_SAS_QUEUE_DEPTH; + fw_qdepth = (sas_dev->port_connection > 1) ? + adapter->adapter_attr.wideport_max_queue_depth : + adapter->adapter_attr.narrowport_max_queue_depth; + } + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) { + default_qdepth = LEAPRAID_SATA_QUEUE_DEPTH; + fw_qdepth = adapter->adapter_attr.sata_max_queue_depth; + } + leapraid_sdev_put(sas_dev); + } + +out_limit_check: + if (fw_qdepth > shost->can_queue && default_qdepth) + fw_qdepth = default_qdepth; + + if (fw_qdepth) + max_depth = min_t(int, max_depth, fw_qdepth); + +out_tag_check: if (!sdev->tagged_supported) max_depth = 1; @@ -1629,26 +1706,21 @@ static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) return qdepth; } -static int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) { qdepth = leapraid_calc_max_queue_depth(sdev, qdepth); scsi_change_queue_depth(sdev, qdepth); return sdev->queue_depth; } -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth) -{ - leapraid_change_queue_depth(sdev, qdepth); -} - static int leapraid_bios_param(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[]) { - int heads = 0; - int sectors = 0; + int heads; + int sectors; sector_t cylinders; if (scsi_partsize(bdev, capacity, geom)) @@ -1692,12 +1764,24 @@ static ssize_t host_sas_address_show(struct device *cdev, (unsigned long long)adapter->dev_topo.card.sas_address); } +static ssize_t board_name_show(struct device *cdev, + struct device_attribute *attr, char *buf) +{ + struct Scsi_Host *shost = class_to_shost(cdev); + struct leapraid_adapter *adapter = shost_priv(shost); + + return scnprintf(buf, PAGE_SIZE, "%s\n", + adapter->adapter_attr.board_name); +} + static DEVICE_ATTR_RO(fw_queue_depth); static DEVICE_ATTR_RO(host_sas_address); +static DEVICE_ATTR_RO(board_name); static struct device_attribute *leapraid_shost_attrs[] = { &dev_attr_fw_queue_depth, &dev_attr_host_sas_address, + &dev_attr_board_name, NULL, }; @@ -1706,9 +1790,18 @@ static ssize_t sas_address_show(struct device *dev, { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + u64 sas_address; + + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + + sas_address = sas_device_priv_data->starget_priv->sas_address; return scnprintf(buf, PAGE_SIZE, "0x%016llx\n", - (unsigned long long)sas_device_priv_data->starget_priv->sas_address); + (unsigned long long)sas_address); } static ssize_t sas_device_handle_show(struct device *dev, @@ -1717,6 +1810,12 @@ static ssize_t sas_device_handle_show(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + return scnprintf(buf, PAGE_SIZE, "0x%04x\n", sas_device_priv_data->starget_priv->hdl); } @@ -1727,6 +1826,12 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } + return scnprintf(buf, PAGE_SIZE, "%d\n", sas_device_priv_data->ncq); } @@ -1737,21 +1842,34 @@ static ssize_t sas_ncq_store(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; unsigned char *vpd_pg89; - int ncq_op = 0; - bool ncq_supported = false; + int ncq_op; + bool ncq_supported; + + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } if (kstrtoint(buf, 0, &ncq_op)) - goto out; + return -EINVAL; + + if (ncq_op != 0 && ncq_op != 1) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid NCQ value %d (only 0/1 allowed)\n", + __func__, ncq_op); + return -EINVAL; + } vpd_pg89 = kmalloc(LEAPRAID_VPD_PG89_MAX_LEN, GFP_KERNEL); if (!vpd_pg89) - goto out; + return -ENOMEM; if (!scsi_device_supports_vpd(sdev) || scsi_get_vpd_page(sdev, LEAPRAID_VPD_PAGE_ATA_INFO, vpd_pg89, LEAPRAID_VPD_PG89_MAX_LEN)) { kfree(vpd_pg89); - goto out; + return -EINVAL; } ncq_supported = (vpd_pg89[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> @@ -1760,9 +1878,7 @@ static ssize_t sas_ncq_store(struct device *dev, kfree(vpd_pg89); if (ncq_supported) sas_device_priv_data->ncq = ncq_op; - return strlen(buf); -out: - return -EINVAL; + return count; } static DEVICE_ATTR_RO(sas_address); @@ -1798,7 +1914,7 @@ static struct scsi_host_template leapraid_driver_template = { .can_queue = LEAPRAID_CAN_QUEUE_MIN, .this_id = LEAPRAID_THIS_ID_NONE, .sg_tablesize = LEAPRAID_SG_DEPTH, - .max_sectors = LEAPRAID_DEF_MAX_SECTORS, + .max_sectors = LEAPRAID_MAX_SECTORS, .max_segment_size = LEAPRAID_MAX_SEGMENT_SIZE, .cmd_per_lun = LEAPRAID_CMD_PER_LUN, .shost_attrs = leapraid_shost_attrs, @@ -1818,6 +1934,8 @@ static void leapraid_lock_init(struct leapraid_adapter *adapter) spin_lock_init(&adapter->dev_topo.topo_node_lock); spin_lock_init(&adapter->fw_evt_s.fw_evt_lock); spin_lock_init(&adapter->dev_topo.raid_volume_lock); + spin_lock_init(&adapter->dev_topo.enc_lock); + spin_lock_init(&adapter->boot_devs.lock); } static void leapraid_list_init(struct leapraid_adapter *adapter) @@ -1834,18 +1952,23 @@ static void leapraid_list_init(struct leapraid_adapter *adapter) static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) { - struct leapraid_adapter *adapter = NULL; - struct Scsi_Host *shost = NULL; + struct leapraid_adapter *adapter; + struct Scsi_Host *shost; int rc; shost = scsi_host_alloc(&leapraid_driver_template, sizeof(struct leapraid_adapter)); - if (!shost) + if (!shost) { + dev_err(&pdev->dev, + "%s: SCSI host alloc failed\n", __func__); return -ENODEV; + } adapter = shost_priv(shost); memset(adapter, 0, sizeof(struct leapraid_adapter)); - adapter->adapter_attr.id = leapraid_ids++; + + init_waitqueue_head(&adapter->access_ctrl.recovery_waitq); + adapter->adapter_attr.id = atomic_inc_return(&leapraid_ids) - 1; adapter->adapter_attr.enable_mp = enable_mp; @@ -1860,8 +1983,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; leapraid_lock_init(adapter); leapraid_list_init(adapter); - sprintf(adapter->adapter_attr.name, "%s%d", - LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); + snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", + LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); shost->max_cmd_len = LEAPRAID_MAX_CDB_LEN; shost->max_lun = LEAPRAID_MAX_LUNS; @@ -1875,12 +1998,17 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_evt_s.fw_evt_thread = alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); if (!adapter->fw_evt_s.fw_evt_thread) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create fw event workqueue\n", __func__); rc = -ENODEV; goto evt_wq_fail; } - adapter->scan_dev_desc.driver_loading = true; - if ((leapraid_ctrl_init(adapter))) { + init_waitqueue_head(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.driver_loading = 1; + if (leapraid_ctrl_init(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: Adapter init failed\n", __func__); rc = -ENODEV; goto ctrl_init_fail; } @@ -1888,9 +2016,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) rc = scsi_add_host(shost, &pdev->dev); if (rc) { - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); + dev_err(&pdev->dev, + "%s: SCSI host add failed\n", __func__); goto scsi_add_shost_fail; } @@ -1900,6 +2027,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) scsi_add_shost_fail: leapraid_remove_ctrl(adapter); ctrl_init_fail: + leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: spin_lock(&leapraid_adapter_lock); @@ -1909,7 +2037,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) return rc; } -static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) +void leapraid_cleanup_lists(struct leapraid_adapter *adapter) { struct leapraid_raid_volume *raid_volume, *next_raid_volume; struct leapraid_starget_priv *starget_priv_data; @@ -1921,12 +2049,14 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) &adapter->dev_topo.raid_volume_list, list) { if (raid_volume->starget) { starget_priv_data = raid_volume->starget->hostdata; - starget_priv_data->deleted = true; + if (starget_priv_data) + starget_priv_data->deleted = 1; scsi_remove_target(&raid_volume->starget->dev); } - pr_info("removing hdl=0x%04x, wwid=0x%016llx\n", - raid_volume->hdl, - (unsigned long long)raid_volume->wwid); + dev_info(&adapter->pdev->dev, + "removing hdl=0x%04x, wwid=0x%016llx\n", + raid_volume->hdl, + (unsigned long long)raid_volume->wwid); leapraid_raid_volume_remove(adapter, raid_volume); } @@ -1935,16 +2065,18 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) port_list) { if (leapraid_port->remote_identify.device_type == SAS_END_DEVICE) - leapraid_sas_dev_remove_by_sas_address(adapter, + leapraid_sas_dev_remove_by_sas_address( + adapter, leapraid_port->remote_identify.sas_address, leapraid_port->card_port); else if (leapraid_port->remote_identify.device_type == SAS_EDGE_EXPANDER_DEVICE || leapraid_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) - leapraid_exp_rm(adapter, - leapraid_port->remote_identify.sas_address, - leapraid_port->card_port); + leapraid_exp_rm( + adapter, + leapraid_port->remote_identify.sas_address, + leapraid_port->card_port); } list_for_each_entry_safe(port, port_next, @@ -1969,27 +2101,26 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) static void leapraid_remove(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to remove!\n"); + dev_err(&pdev->dev, "Unable to remove!\n"); return; } - while (adapter->scan_dev_desc.driver_loading) - ssleep(1); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !adapter->scan_dev_desc.driver_loading); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !atomic_read(&adapter->overheat_desc.thermal_alert)); - while (adapter->access_ctrl.shost_recovering) - ssleep(1); - - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_smart_polling_stop(adapter); - leapraid_free_internal_scsi_cmd(adapter); if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); @@ -2004,7 +2135,6 @@ static void leapraid_remove(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); @@ -2017,18 +2147,20 @@ static void leapraid_remove(struct pci_dev *pdev) static void leapraid_shutdown(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to shutdown!\n"); + dev_err(&pdev->dev, "Unable to shutdown!\n"); return; } - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); + leapraid_overheat_cleanup(adapter); leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; @@ -2037,7 +2169,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); leapraid_disable_controller(adapter); } @@ -2045,29 +2176,31 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to error detected for device\n"); + dev_err(&pdev->dev, "Failed to error detected for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - pr_err("%s: pci error detected, state=%d\n", - adapter->adapter_attr.name, state); + dev_err(&pdev->dev, "%s: PCI error detected, state=%d\n", + adapter->adapter_attr.name, state); switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; case pci_channel_io_frozen: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); @@ -2082,15 +2215,15 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to enable mmio for device\n"); + "Failed to enable mmio for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_info(&pdev->dev, "%s: pci error mmio enabled\n", + dev_info(&pdev->dev, "%s: PCI error mmio enabled\n", adapter->adapter_attr.name); return PCI_ERS_RESULT_RECOVERED; @@ -2099,43 +2232,47 @@ static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to slot reset for device\n"); + "Failed to slot reset for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_err(&pdev->dev, "%s pci error slot reset\n", + dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = false; + adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); - if (leapraid_set_pcie_and_notification(adapter)) + if (leapraid_set_pcie_and_notification(adapter)) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return PCI_ERS_RESULT_DISCONNECT; + } - dev_info(&pdev->dev, "%s: hard reset triggered by pci slot reset\n", + dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, (rc == 0) ? "success" : "failed"); + adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); - return (rc == 0) ? PCI_ERS_RESULT_RECOVERED : + return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; } static void leapraid_pci_resume(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct leapraid_adapter *adapter = pdev_to_adapter(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to resume\n"); + dev_err(&pdev->dev, "Failed to resume\n"); return; } @@ -2159,24 +2296,24 @@ static struct pci_error_handlers leapraid_err_handler = { static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state; if (!shost || !adapter) { dev_err(&pdev->dev, - "suspend failed, invalid host or adapter\n"); + "Suspend failed, invalid host or adapter\n"); return -ENXIO; } + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); flush_scheduled_work(); scsi_block_requests(shost); device_state = pci_choose_state(pdev, state); - leapraid_ir_shutdown(adapter); - dev_info(&pdev->dev, "entering PCI power state D%d, (slot=%s)\n", + dev_info(&pdev->dev, "Entering PCI power state D%d, (slot=%s)\n", device_state, pci_name(pdev)); pci_save_state(pdev); @@ -2188,18 +2325,18 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) static int leapraid_resume(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state = pdev->current_state; int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "resume failed, invalid host or adapter\n"); + "Resume failed, invalid host or adapter\n"); return -ENXIO; } dev_info(&pdev->dev, - "resuming device %s, previous state D%d\n", + "Resuming device %s, previous state D%d\n", pci_name(pdev), device_state); pci_set_power_state(pdev, PCI_D0); @@ -2207,12 +2344,22 @@ static int leapraid_resume(struct pci_dev *pdev) pci_restore_state(pdev); adapter->pdev = pdev; rc = leapraid_set_pcie_and_notification(adapter); - if (rc) + if (rc) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return rc; + } - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, PART_RESET); + rc = leapraid_hard_reset_handler(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed during resume, rc=%d\n", + __func__, rc); + return rc; + } scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); @@ -2238,29 +2385,37 @@ static int __init leapraid_init(void) { int error; - pr_info("%s version %s loaded\n", LEAPRAID_DRIVER_NAME, - LEAPRAID_DRIVER_VERSION); + pr_info("%s initializing\n", LEAPRAID_DRIVER_NAME); leapraid_transport_template = sas_attach_transport(&leapraid_transport_functions); - if (!leapraid_transport_template) + if (!leapraid_transport_template) { + pr_err("%s: Failed to attach SAS transport\n", + LEAPRAID_DRIVER_NAME); return -ENODEV; - - leapraid_ids = 0; - - leapraid_ctl_init(); + } error = pci_register_driver(&leapraid_driver); - if (error) + if (error) { + pr_err("%s: PCI driver registration failed: %d\n", + LEAPRAID_DRIVER_NAME, error); + sas_release_transport(leapraid_transport_template); + return error; + } + + error = leapraid_ctl_init(); + if (error) { + pci_unregister_driver(&leapraid_driver); sas_release_transport(leapraid_transport_template); + return error; + } - return error; + return 0; } static void __exit leapraid_exit(void) { - pr_info("leapraid version %s unloading\n", - LEAPRAID_DRIVER_VERSION); + pr_info("%s exiting\n", LEAPRAID_DRIVER_NAME); leapraid_ctl_exit(); pci_unregister_driver(&leapraid_driver); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index d224449732a3..738bc55df416 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <scsi/scsi_host.h> #include "leapraid_func.h" @@ -16,10 +15,8 @@ static struct leapraid_topo_node *leapraid_transport_topo_node_by_sas_addr( { if (adapter->dev_topo.card.sas_address == sas_addr) return &adapter->dev_topo.card; - else - return leapraid_exp_find_by_sas_address(adapter, - sas_addr, - card_port); + + return leapraid_exp_find_by_sas_address(adapter, sas_addr, card_port); } static u8 leapraid_get_port_id_by_expander(struct leapraid_adapter *adapter, @@ -49,7 +46,8 @@ static u8 leapraid_get_port_id_by_end_dev(struct leapraid_adapter *adapter, u8 port_id = 0xFF; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, rphy->identify.sas_address, rphy); if (sas_dev) { @@ -131,10 +129,9 @@ static enum sas_linkrate leapraid_transport_convert_phy_link_rate(u8 link_rate) }, }; - for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) { + for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) if (linkrate_table[i].in == link_rate) return linkrate_table[i].out; - } return SAS_LINK_RATE_UNKNOWN; } @@ -192,7 +189,7 @@ static void leapraid_set_identify_protocol_flags(u32 dev_info, }; for (i = 0; i < ARRAY_SIZE(mappings); i++) - if ((dev_info & mappings[i].mask) && mappings[i].target) + if (dev_info & mappings[i].mask && mappings[i].target) *mappings[i].target |= mappings[i].protocol; } @@ -207,13 +204,19 @@ static int leapraid_transport_set_identify(struct leapraid_adapter *adapter, if ((adapter->access_ctrl.shost_recovering && !adapter->scan_dev_desc.driver_loading) || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; + } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; memset(identify, 0, sizeof(struct sas_identify)); @@ -248,27 +251,34 @@ static void leapraid_transport_exp_set_edev(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; struct leapraid_rep_manu_reply *rep_manu_reply; u8 *component_id; - ssize_t __maybe_unused ret; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; if (le16_to_cpu(smp_passthrough_rep->resp_data_len) != sizeof(struct leapraid_rep_manu_reply)) return; rep_manu_reply = data_out + sizeof(struct leapraid_rep_manu_request); - ret = strscpy(edev->vendor_id, rep_manu_reply->vendor_identification, - SAS_EXPANDER_VENDOR_ID_LEN); - ret = strscpy(edev->product_id, rep_manu_reply->product_identification, - SAS_EXPANDER_PRODUCT_ID_LEN); - ret = strscpy(edev->product_rev, - rep_manu_reply->product_revision_level, - SAS_EXPANDER_PRODUCT_REV_LEN); + + memcpy(edev->vendor_id, rep_manu_reply->vendor_identification, + SAS_EXPANDER_VENDOR_ID_LEN); + edev->vendor_id[SAS_EXPANDER_VENDOR_ID_LEN] = '\0'; + + memcpy(edev->product_id, rep_manu_reply->product_identification, + SAS_EXPANDER_PRODUCT_ID_LEN); + edev->product_id[SAS_EXPANDER_PRODUCT_ID_LEN] = '\0'; + + memcpy(edev->product_rev, rep_manu_reply->product_revision_level, + SAS_EXPANDER_PRODUCT_REV_LEN); + edev->product_rev[SAS_EXPANDER_PRODUCT_REV_LEN] = '\0'; + edev->level = rep_manu_reply->sas_format & 1; if (edev->level) { - ret = strscpy(edev->component_vendor_id, - rep_manu_reply->component_vendor_identification, - SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + memcpy(edev->component_vendor_id, + rep_manu_reply->comp_vendor_identification, + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + edev->component_vendor_id[ + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN] = '\0'; component_id = (u8 *)&rep_manu_reply->component_id; edev->component_id = component_id[0] << 8 | component_id[1]; @@ -291,18 +301,24 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, size_t c2h_size; size_t h2c_size; void *psge; - int rc = 0; + int rc; if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; } mutex_lock(&adapter->driver_cmds.transport_cmd.mutex); adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto out_cleanup; h2c_size = sizeof(struct leapraid_rep_manu_request); c2h_size = sizeof(struct leapraid_rep_manu_reply); @@ -312,7 +328,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, GFP_ATOMIC); if (!data_out) { rc = -ENOMEM; - goto out; + goto out_cleanup; } rep_manu_request = data_out; @@ -323,8 +339,9 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->request_length = 0; smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.transport_cmd.inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -342,11 +359,13 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { + rc = -ETIMEDOUT; dev_err(&adapter->pdev->dev, - "%s: smp passthrough to exp timeout\n", - __func__); + "%s: SMP passthrough timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & - LEAPRAID_CMD_RESET)) + LEAPRAID_CMD_RESET)) issue_reset = true; goto hard_reset; @@ -358,11 +377,11 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, hard_reset: if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); + rc = leapraid_hard_reset_handler(adapter, FULL_RESET); } -out: +out_cleanup: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; if (data_out) dma_free_coherent(&adapter->pdev->dev, h2c_size + c2h_size, @@ -376,13 +395,14 @@ static void leapraid_transport_del_port(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { dev_info(&sas_port->port->dev, - "remove port: sas addr=0x%016llx\n", + "Remove port: SAS addr=0x%016llx\n", (unsigned long long)sas_port->remote_identify.sas_address); switch (sas_port->remote_identify.device_type) { case SAS_END_DEVICE: - leapraid_sas_dev_remove_by_sas_address(adapter, - sas_port->remote_identify.sas_address, - sas_port->card_port); + leapraid_sas_dev_remove_by_sas_address( + adapter, + sas_port->remote_identify.sas_address, + sas_port->card_port); break; case SAS_EDGE_EXPANDER_DEVICE: case SAS_FANOUT_EXPANDER_DEVICE: @@ -399,13 +419,13 @@ static void leapraid_transport_del_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "remove phy: sas addr=0x%016llx, phy=%d\n", + "Remove PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_del(&card_phy->port_siblings); sas_port->phys_num--; sas_port_delete_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; } static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, @@ -413,16 +433,17 @@ static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "add phy: sas addr=0x%016llx, phy=%d\n", + "Add PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_add_tail(&card_phy->port_siblings, &sas_port->phy_list); sas_port->phys_num++; sas_port_add_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; } -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *card_phy, u64 sas_address, @@ -454,7 +475,8 @@ void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, } } -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *target_card_phy) { @@ -482,7 +504,8 @@ void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, } } -static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, +static void leapraid_detach_phy_from_old_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, u64 sas_address, struct leapraid_card_port *card_port) @@ -495,9 +518,10 @@ static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, topo_node->card_phy[i].card_port != card_port) continue; if (topo_node->card_phy[i].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, - topo_node, - &topo_node->card_phy[i]); + leapraid_transport_detach_phy_to_port( + adapter, + topo_node, + &topo_node->card_phy[i]); } } @@ -512,8 +536,11 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( unsigned long flags; sas_port = kzalloc(sizeof(*sas_port), GFP_KERNEL); - if (!sas_port) + if (!sas_port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed alloc sas_port\n", __func__); return NULL; + } INIT_LIST_HEAD(&sas_port->port_list); INIT_LIST_HEAD(&sas_port->phy_list); @@ -526,27 +553,30 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( if (!topo_node) { dev_err(&adapter->pdev->dev, - "%s: failed to find parent node for sas addr 0x%016llx!\n", + "%s: Failed to locate parent for SAS 0x%016llx!\n", __func__, sas_address); - kfree(sas_port); - return NULL; + goto out_cleanup; } if (leapraid_transport_set_identify(adapter, handle, - &sas_port->remote_identify)) { - kfree(sas_port); - return NULL; - } + &sas_port->remote_identify)) + goto out_cleanup; if (sas_port->remote_identify.device_type == SAS_PHY_UNUSED) { - kfree(sas_port); - return NULL; + dev_warn(&adapter->pdev->dev, + "%s: Failed, device type is SAS_PHY_UNUSED\n", + __func__); + goto out_cleanup; } sas_port->card_port = card_port; *out_topo_node = topo_node; return sas_port; + +out_cleanup: + kfree(sas_port); + return NULL; } static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, @@ -576,12 +606,12 @@ static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, vphy = leapraid_get_vphy_by_phy(card_port, i); if (!vphy) - return -1; + return LEAPRAID_OPERATION_FAILED; } } *out_vphy = vphy; - return sas_port->phys_num ? 0 : -1; + return sas_port->phys_num ? 0 : LEAPRAID_OPERATION_FAILED; } static struct sas_rphy *leapraid_create_and_register_rphy( @@ -596,26 +626,42 @@ static struct sas_rphy *leapraid_create_and_register_rphy( struct sas_port *port; struct sas_rphy *rphy; - if (!topo_node->parent_dev) - return NULL; + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sas_port->remote_identify.sas_address, + card_port); + if (!sas_dev) + return NULL; + sas_dev->pend_sas_rphy_add = 1; + } + + if (!topo_node->parent_dev) { + dev_warn(&adapter->pdev->dev, + "%s: topo_node parent device is NULL\n", __func__); + goto cleanup_sas_dev; + } port = sas_port_alloc_num(topo_node->parent_dev); - if (sas_port_add(port)) - return NULL; + if (!port) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate SAS port\n", __func__); + goto cleanup_sas_dev; + } + + if (sas_port_add(port)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to add SAS port\n", __func__); + goto out_delete_port; + } list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { sas_port_add_phy(port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; card_phy->card_port = card_port; } - if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sas_port->remote_identify.sas_address, - card_port); - if (!sas_dev) - return NULL; - sas_dev->pend_sas_rphy_add = 1; + if (sas_dev) { rphy = sas_end_device_alloc(port); sas_dev->rphy = rphy; @@ -625,28 +671,63 @@ static struct sas_rphy *leapraid_create_and_register_rphy( else vphy->sas_address = sas_dev->sas_addr; } - } else { - rphy = sas_expander_alloc(port, - sas_port->remote_identify.device_type); + rphy = sas_expander_alloc( + port, + sas_port->remote_identify.device_type); if (topo_node->hdl <= adapter->dev_topo.card.phys_num) card_port->sas_address = sas_port->remote_identify.sas_address; } + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate RPHY\n", __func__); + goto cleanup_card_phy; + } + rphy->identify = sas_port->remote_identify; - if (sas_rphy_add(rphy)) + if (sas_rphy_add(rphy)) { dev_err(&adapter->pdev->dev, - "%s: failed to add rphy\n", __func__); + "%s: Failed to add RPHY\n", __func__); + if (sas_dev) + sas_dev->rphy = NULL; + + sas_rphy_free(rphy); + goto cleanup_card_phy; + } + sas_port->port = port; if (sas_dev) { sas_dev->pend_sas_rphy_add = 0; leapraid_sdev_put(sas_dev); } - sas_port->port = port; return rphy; + +cleanup_card_phy: + if (topo_node->hdl <= adapter->dev_topo.card.phys_num) { + if (!vphy) + card_port->sas_address = 0; + else + vphy->sas_address = 0; + } + + list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { + card_phy->phy_is_assigned = 0; + card_phy->card_port = NULL; + } + +out_delete_port: + sas_port_delete(port); + +cleanup_sas_dev: + if (sas_dev) { + sas_dev->pend_sas_rphy_add = 0; + leapraid_sdev_put(sas_dev); + } + return NULL; } struct leapraid_sas_port *leapraid_transport_port_add( @@ -656,35 +737,45 @@ struct leapraid_sas_port *leapraid_transport_port_add( { struct leapraid_card_phy *card_phy, *card_phy_next; struct leapraid_topo_node *topo_node = NULL; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_vphy *vphy = NULL; - struct sas_rphy *rphy = NULL; + struct sas_rphy *rphy; unsigned long flags; - if (!card_port) + if (!card_port) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid card_port\n", __func__); return NULL; + } sas_port = leapraid_prepare_sas_port(adapter, hdl, sas_address, card_port, &topo_node); if (!sas_port) return NULL; - leapraid_detach_phy_from_old_port(adapter, - topo_node, - sas_port->remote_identify.sas_address, - card_port); + leapraid_detach_phy_from_old_port( + adapter, + topo_node, + sas_port->remote_identify.sas_address, + card_port); if (leapraid_bind_phys_and_vphy(adapter, sas_port, topo_node, - card_port, &vphy)) + card_port, &vphy)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to bind phy to vphy\n", __func__); goto out_fail; + } rphy = leapraid_create_and_register_rphy(adapter, sas_port, topo_node, card_port, vphy); - if (!rphy) + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create rphy\n", __func__); goto out_fail; + } dev_info(&rphy->dev, - "%s: added dev: hdl=0x%04x, sas addr=0x%016llx\n", + "%s: Added dev: hdl=0x%04x, SAS addr=0x%016llx\n", __func__, hdl, (unsigned long long)sas_port->remote_identify.sas_address); @@ -695,20 +786,27 @@ struct leapraid_sas_port *leapraid_transport_port_add( spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); if (sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_EDGE_EXPANDER || + SAS_EDGE_EXPANDER_DEVICE || sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_FANOUT_EXPANDER) - leapraid_transport_exp_report_manu(adapter, - sas_port->remote_identify.sas_address, - rphy_to_expander_device(rphy), - card_port->port_id); + SAS_FANOUT_EXPANDER_DEVICE) + leapraid_transport_exp_report_manu( + adapter, + sas_port->remote_identify.sas_address, + rphy_to_expander_device(rphy), + card_port->port_id); return sas_port; out_fail: list_for_each_entry_safe(card_phy, card_phy_next, - &sas_port->phy_list, port_siblings) - list_del(&card_phy->port_siblings); + &sas_port->phy_list, port_siblings) { + if (topo_node->hdl <= adapter->dev_topo.card.phys_num && + !card_phy->vphy) + card_port->phy_mask &= ~BIT(card_phy->phy_id); + + list_del_init(&card_phy->port_siblings); + } + kfree(sas_port); return NULL; } @@ -750,10 +848,10 @@ static void leapraid_cleanup_card_port_and_vphys( if (vphy->sas_address != sas_address) continue; - dev_info(&adapter->pdev->dev, - "%s: remove vphy: %p from port: %p, port_id=%d\n", - __func__, vphy, remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove vphy=%p from port=%p port_id=%d\n", + __func__, vphy, remove_card_port, + remove_card_port->port_id); remove_card_port->vphys_mask &= ~vphy->phy_mask; list_del(&vphy->list); @@ -762,11 +860,11 @@ static void leapraid_cleanup_card_port_and_vphys( if (!remove_card_port->vphys_mask && !remove_card_port->sas_address) { - dev_info(&adapter->pdev->dev, - "%s: remove empty hba_port: %p, port_id=%d\n", - __func__, - remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove empty hba_port: %p, port_id=%d\n", + __func__, + remove_card_port, + remove_card_port->port_id); list_del(&remove_card_port->list); kfree(remove_card_port); remove_card_port = NULL; @@ -782,15 +880,15 @@ static void leapraid_cleanup_card_port_and_vphys( continue; if (!remove_card_port->vphys_mask) { - dev_info(&adapter->pdev->dev, - "%s: remove hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove hba_port: %p, port_id=%d\n", + __func__, card_port, card_port->port_id); list_del(&card_port->list); kfree(card_port); } else { - dev_info(&adapter->pdev->dev, - "%s: clear sas_address of hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "Clear sas_address of port=%p, port_id=%d\n", + card_port, card_port->port_id); remove_card_port->sas_address = 0; } break; @@ -802,22 +900,23 @@ static void leapraid_clear_topo_node_phys(struct leapraid_topo_node *topo_node, { int i; - for (i = 0; i < topo_node->phys_num; i++) { + for (i = 0; i < topo_node->phys_num; i++) if (topo_node->card_phy[i].remote_identify.sas_address == sas_address) { memset(&topo_node->card_phy[i].remote_identify, 0, sizeof(struct sas_identify)); - topo_node->card_phy[i].vphy = false; + topo_node->card_phy[i].vphy = 0; } - } } -void leapraid_transport_port_remove(struct leapraid_adapter *adapter, - u64 sas_address, u64 sas_address_parent, +void leapraid_transport_port_remove( + struct leapraid_adapter *adapter, + u64 sas_address, + u64 sas_address_parent, struct leapraid_card_port *remove_card_port) { struct leapraid_card_phy *card_phy, *card_phy_next; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_topo_node *topo_node; unsigned long flags; bool found = false; @@ -855,7 +954,7 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, list_for_each_entry_safe(card_phy, card_phy_next, &sas_port->phy_list, port_siblings) { - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; if (!adapter->access_ctrl.host_removing) sas_port_delete_phy(sas_port->port, card_phy->phy); @@ -865,9 +964,9 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, if (!adapter->access_ctrl.host_removing) sas_port_delete(sas_port->port); - dev_info(&adapter->pdev->dev, - "%s: removed sas_port for sas addr=0x%016llx\n", - __func__, (unsigned long long)sas_address); + dev_dbg(&adapter->pdev->dev, + "%s: Removed sas_port for SAS addr=0x%016llx\n", + __func__, (unsigned long long)sas_address); kfree(sas_port); } @@ -902,9 +1001,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_HWRATE_MIN_RATE_MASK); phy->maximum_linkrate_hw = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->hw_link_rate >> 4) : + phy_pg0->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->hw_link_rate >> 4); + exp_pg1->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->minimum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( phy_pg0->p_link_rate & @@ -914,9 +1015,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_PRATE_MIN_RATE_MASK); phy->maximum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->p_link_rate >> 4) : + phy_pg0->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->p_link_rate >> 4); + exp_pg1->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->hostdata = card_phy->card_port; } @@ -926,30 +1029,33 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy handle identify failed!\n", __func__); + "%s: Set PHY handle identify failed!\n", __func__); sas_phy_free(phy); return; } card_phy->attached_hdl = le16_to_cpu(phy_pg0->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) { dev_err(&adapter->pdev->dev, - "%s set phy attached handle identify failed!\n", + "%s: Set PHY attached hdl identify failed!\n", __func__); sas_phy_free(phy); return; @@ -958,7 +1064,9 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, phy_pg0, NULL); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return; } @@ -972,38 +1080,41 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return -EFAULT; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy hdl identify failed!\n", __func__); + "%s: Set PHY hdl identify failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } card_phy->attached_hdl = le16_to_cpu(exp_pg1->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { - dev_err(&adapter->pdev->dev, - "%s set phy attached hdl identify failed!\n", - __func__); - sas_phy_free(phy); - } + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) + dev_warn(&adapter->pdev->dev, + "%s: Set PHY attached hdl identify failed!\n", + __func__); } leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, NULL, exp_pg1); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } @@ -1012,13 +1123,14 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, return 0; } -void leapraid_transport_update_links(struct leapraid_adapter *adapter, +void leapraid_transport_update_links( + struct leapraid_adapter *adapter, u64 sas_address, u16 hdl, u8 phy_index, u8 link_rate, struct leapraid_card_port *target_card_port) { struct leapraid_topo_node *topo_node; struct leapraid_card_phy *card_phy; - struct leapraid_card_port *card_port = NULL; + struct leapraid_card_port *card_port; unsigned long flags; if (adapter->access_ctrl.shost_recovering || @@ -1053,10 +1165,12 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, BIT(card_phy->phy_id); } } - leapraid_transport_attach_phy_to_port(adapter, topo_node, - card_phy, - card_phy->remote_identify.sas_address, - target_card_port); + leapraid_transport_attach_phy_to_port( + adapter, + topo_node, + card_phy, + card_phy->remote_identify.sas_address, + target_card_port); } else { memset(&card_phy->remote_identify, 0, sizeof(struct sas_identify)); @@ -1079,8 +1193,12 @@ static int leapraid_dma_map_buffer(struct device *dev, struct bsg_buffer *buf, *dma_len = buf->payload_len; } else { - if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) + if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) { + dev_err(dev, + "%s: Failed to map sg buffer for dma\n", + __func__); return -ENOMEM; + } *dma_addr = sg_dma_address(buf->sg_list); *dma_len = sg_dma_len(buf->sg_list); @@ -1106,11 +1224,11 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr, size_t c2h_size) { struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; void *psge; - smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(*smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -1130,30 +1248,36 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, - "%s: sending smp request\n", __func__); + const struct leapraid_smp_passthrough_req *smp_passthrough_req; + + dev_dbg(&adapter->pdev->dev, + "%s: Sending smp request\n", __func__); + smp_passthrough_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.transport_cmd.inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); leapraid_fire_task(adapter, adapter->driver_cmds.transport_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "%s: timeout\n", __func__); + dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { - dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", - __func__, __LINE__); + dev_dbg(&adapter->pdev->dev, + "%s:%d: call hard_reset\n", + __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); return -ETIMEDOUT; } } - dev_info(&adapter->pdev->dev, "%s: smp request complete\n", __func__); + dev_dbg(&adapter->pdev->dev, "%s: SMP request complete\n", __func__); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_REPLY_VALID)) { dev_err(&adapter->pdev->dev, - "%s: smp request no reply\n", __func__); + "%s: SMP request no reply\n", __func__); return -ENXIO; } @@ -1167,10 +1291,10 @@ static void leapraid_handle_smp_rep(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; - dev_info(&adapter->pdev->dev, "%s: response data len=%d\n", - __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); + dev_dbg(&adapter->pdev->dev, "%s: Response data len=%d\n", + __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); memcpy(job->reply, smp_passthrough_rep, sizeof(*smp_passthrough_rep)); job->reply_len = sizeof(*smp_passthrough_rep); @@ -1198,13 +1322,19 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); rc = -EFAULT; - goto done; + goto exit_bsg_job; } - rc = mutex_lock_interruptible(&adapter->driver_cmds.transport_cmd.mutex); + rc = mutex_lock_interruptible(&adapter->driver_cmds + .transport_cmd.mutex); if (rc) - goto done; + goto exit_bsg_job; adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; rc = leapraid_dma_map_buffer(&adapter->pdev->dev, @@ -1223,7 +1353,8 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) goto free_rep_buf; @@ -1245,7 +1376,7 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, release_lock: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.transport_cmd.mutex); -done: +exit_bsg_job: bsg_job_done(job, rc, reslen); } -- 2.25.1

2 1

[PATCH OLK-6.6] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
by Yi Yang 26 May '26

26 May '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v6.6.135 commit 066c760acead1fb743bae294dbd89f479ae43b9b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14894 CVE: CVE-2026-43336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream. Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- lib/crypto/chacha.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/crypto/chacha.c b/lib/crypto/chacha.c index b748fd3d256e..1bff9f283777 100644 --- a/lib/crypto/chacha.c +++ b/lib/crypto/chacha.c @@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8 *stream, int nrounds) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); state[12]++; + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(chacha_block_generic); @@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds) memcpy(&stream[0], &x[0], 16); memcpy(&stream[4], &x[12], 16); + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(hchacha_block_generic); -- 2.25.1

2 1

[PATCH OLK-5.10] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
by Yi Yang 26 May '26

26 May '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v5.10.253 commit e90ee961af515a484f091678ce58a4c3f7b73b02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14894 CVE: CVE-2026-43336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream. Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- lib/crypto/chacha.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/crypto/chacha.c b/lib/crypto/chacha.c index b748fd3d256e..1bff9f283777 100644 --- a/lib/crypto/chacha.c +++ b/lib/crypto/chacha.c @@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8 *stream, int nrounds) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); state[12]++; + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(chacha_block_generic); @@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds) memcpy(&stream[0], &x[0], 16); memcpy(&stream[4], &x[12], 16); + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(hchacha_block_generic); -- 2.25.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 26 May '26

26 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace3c6..4f2f82293125 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1911,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 26 May '26

26 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) mode change 100644 => 100755 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c old mode 100644 new mode 100755 index 01eed3ace3c6..4f2f82293125 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1911,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/tracepoint.c [a9cfb8778c43 ("tracing: Introduce tracepoint extended structure") is not backport yet.] Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 2dff7f1a27ec..7642926517cf 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -358,6 +358,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->unregfunc && !static_key_enabled(&tp->key)) + tp->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Rebuild full_name on each hist_field_name() call
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.141 commit 9399a92989354e34086f9a5c379493217df83c5e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 ] hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Tested-by: Tom Zanussi <zanussi(a)kernel.org> Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index f22aa4afaa6d..b6c4e2f26e3f 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1349,12 +1349,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) { if (field->system) { static char full_name[MAX_FILTER_STR_VAL]; + int len; + + len = snprintf(full_name, sizeof(full_name), "%s.%s.%s", + field->system, field->event_name, + field->name); + if (len >= sizeof(full_name)) + return NULL; - strcat(full_name, field->system); - strcat(full_name, "."); - strcat(full_name, field->event_name); - strcat(full_name, "."); - strcat(full_name, field->name); field_name = full_name; } else field_name = field->name; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Rebuild full_name on each hist_field_name() call
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.1-rc1 commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Tested-by: Tom Zanussi <zanussi(a)kernel.org> Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 557b8c28faf4..f67367e487cb 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1104,12 +1104,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) { if (field->system) { static char full_name[MAX_FILTER_STR_VAL]; + int len; + + len = snprintf(full_name, sizeof(full_name), "%s.%s.%s", + field->system, field->event_name, + field->name); + if (len >= sizeof(full_name)) + return NULL; - strcat(full_name, field->system); - strcat(full_name, "."); - strcat(full_name, field->event_name); - strcat(full_name, "."); - strcat(full_name, field->name); field_name = full_name; } else field_name = field->name; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.0 commit 4346be6577aaa04586167402ae87bbdbe32484a4 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 3e020511885c..f2ced0ac04eb 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -352,7 +352,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2

[PATCH OLK-6.6] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.136 commit feba4907c30284b6d1ec0b350320242d4f288fc9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4346be6577aaa04586167402ae87bbdbe32484a4 ] parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index b168d6dd0773..6a96b03aae62 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -886,7 +886,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2

[PATCH OLK-6.6] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> stable inclusion from stable-v6.6.140 commit 247ed8a969f981bfba3112fd4bb441eaa6cef59c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e ] When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> [ changed `tp->ext->unregfunc` to `tp->unregfunc` to match older struct layout ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 8d1507dd0724..f7a4210d5d5e 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -337,6 +337,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->unregfunc && !static_key_enabled(&tp->key)) + tp->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-5.10] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 2dff7f1a27ec..33017d6806d2 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -358,6 +358,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->ext && tp->ext->unregfunc && !static_key_enabled(&tp->key)) + tp->ext->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 25 May '26

25 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../net/ethernet/motorcomm/yt6801/yt6801_main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) mode change 100644 => 100755 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c old mode 100644 new mode 100755 index 01eed3ace3c6..93b7f41a2cb9 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1898,7 +1910,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) ndev->max_mtu = FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); + ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: branch: Fix inverted check on stat tracer registration
by Tengda Wu 25 May '26

25 May '26

From: Breno Leitao <leitao(a)debian.org> mainline inclusion from mainline-v7.1-rc2 commit 3b75dd76e64a04771861bb5647951c264919e563 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- init_annotated_branch_stats() and all_annotated_branch_stats() check the return value of register_stat_tracer() with "if (!ret)", but register_stat_tracer() returns 0 on success and a negative errno on failure. The inverted check causes the warning to be printed on every successful registration, e.g.: Warning: could not register annotated branches stats while leaving real failures silent. The initcall also returned a hard-coded 1 instead of the actual error. Invert the check and propagate ret so that the warning fires on real errors and the initcall reports the correct status. Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ingo Molnar <mingo(a)elte.hu> Cc: Frederic Weisbecker <fweisbec(a)gmail.com> Link: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org Fixes: 002bb86d8d42 ("tracing/ftrace: separate events tracing and stats tracing engine") Signed-off-by: Breno Leitao <leitao(a)debian.org> Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_branch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c index e47fdb4c92fb..30f72e0ecb5d 100644 --- a/kernel/trace/trace_branch.c +++ b/kernel/trace/trace_branch.c @@ -379,10 +379,10 @@ __init static int init_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&annotated_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "annotated branches stats\n"); - return 1; + return ret; } return 0; } @@ -444,10 +444,10 @@ __init static int all_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&all_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "all branches stats\n"); - return 1; + return ret; } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: branch: Fix inverted check on stat tracer registration
by Tengda Wu 25 May '26

25 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.141 commit cbf460bf94921b1b07160cce6818d785af116bc8 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3b75dd76e64a04771861bb5647951c264919e563 ] init_annotated_branch_stats() and all_annotated_branch_stats() check the return value of register_stat_tracer() with "if (!ret)", but register_stat_tracer() returns 0 on success and a negative errno on failure. The inverted check causes the warning to be printed on every successful registration, e.g.: Warning: could not register annotated branches stats while leaving real failures silent. The initcall also returned a hard-coded 1 instead of the actual error. Invert the check and propagate ret so that the warning fires on real errors and the initcall reports the correct status. Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ingo Molnar <mingo(a)elte.hu> Cc: Frederic Weisbecker <fweisbec(a)gmail.com> Link: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org Fixes: 002bb86d8d42 ("tracing/ftrace: separate events tracing and stats tracing engine") Signed-off-by: Breno Leitao <leitao(a)debian.org> Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_branch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c index e47fdb4c92fb..30f72e0ecb5d 100644 --- a/kernel/trace/trace_branch.c +++ b/kernel/trace/trace_branch.c @@ -379,10 +379,10 @@ __init static int init_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&annotated_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "annotated branches stats\n"); - return 1; + return ret; } return 0; } @@ -444,10 +444,10 @@ __init static int all_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&all_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "all branches stats\n"); - return 1; + return ret; } return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: pcrypt - Fix handling of MAY_BACKLOG requests
by Cai Xinchen 25 May '26

25 May '26

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v7.1-rc1 commit 915b692e6cb723aac658c25eb82c58fd81235110 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15062 CVE: CVE-2026-43493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Fixes: 5a1436beec57 ("crypto: pcrypt - call the complete function on error") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/pcrypt.c [Only context conflicts.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- crypto/pcrypt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 2d7f98709e97..d545549e7a1a 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -69,6 +69,9 @@ static void pcrypt_aead_done(struct crypto_async_request *areq, int err) struct pcrypt_request *preq = aead_request_ctx(req); struct padata_priv *padata = pcrypt_request_padata(preq); + if (err == -EINPROGRESS) + return; + padata->info = err; padata_do_serial(padata); @@ -82,7 +85,7 @@ static void pcrypt_aead_enc(struct padata_priv *padata) ret = crypto_aead_encrypt(req); - if (ret == -EINPROGRESS) + if (ret == -EINPROGRESS || ret == -EBUSY) return; padata->info = ret; @@ -133,7 +136,7 @@ static void pcrypt_aead_dec(struct padata_priv *padata) ret = crypto_aead_decrypt(req); - if (ret == -EINPROGRESS) + if (ret == -EINPROGRESS || ret == -EBUSY) return; padata->info = ret; -- 2.34.1

2 1

内核崩溃协助排查 - openEuler 5.10.0-60.18.0.50.oe2203.x86_64
by 张宝 25 May '26

25 May '26

您好 openEuler 内核sig团队：       我司一台服务器（openEuler 22.03 LTS，内核 5.10.0-60.18.0.50.oe2203.x86_64，运行 342 天）发生内核崩溃，已收集到 vmcore。根据openEuler Witty智能诊断Agent 诊断报告，发现内核可能存在bug，恳请协助排查。当前状况我们已在 openEuler 社区提交 Issue（链接：https://gitcode.com/openeuler/kernel/issues/9047），待明确根因和解决方案。谢谢！附 1. 内核日志片段 [29613041.914241] ------------[ cut here ]------------ [29613041.914241] kernel BUG at kernel/entry/common.c:427! ... [29613041.914259] BUG: stack guard page was hit at 00000000089c7912 [29613041.914260] NMI watchdog: Watchdog detected hard LOCKUP on cpu 8 [29613041.914272] CPU: 8 PID: 1249797 Comm: lurker Kdump: loaded Not tainted 5.10.0-60.18.0.50.oe2203.x86_64 #1 [29613041.914273] RIP: 0010:native_queued_spin_lock_slowpath+0x5c/0x1b0 ... [29613041.914325] traps: PANIC: double fault, error_code: 0x0 2. PID 1249797 (lurker) 的堆栈回溯 PID: 1249797  TASK: ffff9c26fc228000  CPU: 8   COMMAND: "lurker"  #0 [fffffe00001e2ee8] die at ffffffffa5e25b4a  #1 [fffffe00001e2f10] handle_stack_overflow at ffffffffa67dca7b  #2 [fffffe00001e2f28] exc_double_fault at ffffffffa6827a08  #3 [fffffe00001e2f50] asm_exc_double_fault at ffffffffa6a00b7e     [exception RIP: bsearch+2] ...  #160 [ffffa93bcf3b7958] no_context at ffffffffa5e71c37  #161 [ffffa93bcf3b7990] __bad_area_nosemaphore at ffffffffa5e71e62  #162 [ffffa93bcf3b79d8] exc_page_fault at ffffffffa682a565  #163 [ffffa93bcf3b7a30] asm_exc_page_fault at ffffffffa6a00ace     [exception RIP: vma_dump_size+39]     RIP: ffffffffa61d4fa7  RSP: ffffa93bcf3b7ae8  RFLAGS: 00010286     RAX: ffffffffb750aba0  RBX: ffff9c264e92f5c0 ...  #164 [ffffa93bcf3b7af8] dump_vma_snapshot at ffffffffa61d6461  #165 [ffffa93bcf3b7b60] elf_core_dump at ffffffffa61cefc9  #166 [ffffa93bcf3b7d40] do_coredump at ffffffffa61d5e81  #167 [ffffa93bcf3b7e38] get_signal at ffffffffa5eefd6f  #168 [ffffa93bcf3b7e88] arch_do_signal at ffffffffa5e21cda  #169 [ffffa93bcf3b7f10] exit_to_user_mode_loop at ffffffffa5f6f309  #170 [ffffa93bcf3b7f30] exit_to_user_mode_prepare at ffffffffa5f6f3a2  #171 [ffffa93bcf3b7f48] irqentry_exit_to_user_mode at ffffffffa682ac65  #172 [ffffa93bcf3b7f50] asm_exc_page_fault at ffffffffa6a00ace 3. 其他 CPU 的部分堆栈（CPU 1, 2, 7, 10, 14 均出现异常） CPU 1 (postgres):  #3 [fffffe0000045f50] asm_exc_double_fault     [exception RIP: do_error_trap+53] ...  #8 [ffffa93bcd274170] do_error_trap  #9 [ffffa93bcd2741b0] exc_invalid_op  #10 [ffffa93bcd2741d0] asm_exc_invalid_op     [exception RIP: fixup_exception+35] CPU 2 (log_server):  #3 [ffffa93bcef97ce0] native_queued_spin_lock_slowpath ...  #9 [ffffa93bcef97dc0] asm_exc_general_protection     [exception RIP: do_renameat2+50]     RIP: ffffffffa615e252 CPU 10 (df):  #2 [fffffe0000258f50] asm_exc_double_fault     [exception RIP: mmap_base+155]     RIP: ffffffffa5e732eb  RSP: 00000000029de8c0 4. 智能Agent 工具分析结果   ZDNS 张宝

1 0

[PATCH OLK-6.6] pstore/ram: fix resource leak when ioremap() fails
by Luo Gengkun 25 May '26

25 May '26

From: Cole Leavitt <cole(a)unwrap.rs> mainline inclusion from mainline-v7.1-rc1 commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15064 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region(). This leads to a resource leak where the memory region remains reserved but unusable. Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state. This is the ioremap() counterpart to commit 05363abc7625 ("pstore: ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path. Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory") Signed-off-by: Cole Leavitt <cole(a)unwrap.rs> Link: https://patch.msgid.link/20260225235406.11790-1-cole@unwrap.rs Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/pstore/ram_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index 7b6d6378a3b8..95675d4bab14 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -489,6 +489,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, else va = ioremap_wc(start, size); + /* We must release the mem region if ioremap fails. */ + if (!va) + release_mem_region(start, size); + /* * Since request_mem_region() and ioremap() are byte-granularity * there is no need handle anything special like we do when the -- 2.34.1

2 1

Re: [PATCH OLK-6.6 4/4] iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
by Qinxin Xia 25 May '26

25 May '26

On 2026/5/25 13:57:56, Greg KH <greg(a)kroah.com> wrote: > On Mon, May 25, 2026 at 10:35:39AM +0800, Qinxin Xia wrote: >> From: Balbir Singh <balbirs(a)nvidia.com> >> >> mainline inclusion >> from mainline-v6.15-rc5 >> commit 12f78021973ae422564b234136c702a305932d73 >> category: bugfix >> bugzilla: https://atomgit.com/openeuler/kernel/issues/9215 >> CVE: NA >> >> Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… > > What is this for? > > confused, > > greg k-h Sorry for the noise – I forgot to use --suppress-cc=all when sending the patch. Please ignore the previous email. Thanks. -- Thanks, Qinxin

1 0

[PATCH OLK-6.6] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v6.6.128 commit ef9b10a020503888eb6c8ed85a3d901a624ede4c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index a8c3ecf7d810..cb2472b59e10 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -763,21 +763,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH OLK-5.10] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v5.10.252 commit 443a830b1dc4f85c7560da59d4494b629feee215 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index a8c3ecf7d810..cb2472b59e10 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -763,21 +763,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v5.10.252 commit 443a830b1dc4f85c7560da59d4494b629feee215 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index 913e50bab0a2..4e53512c87a0 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -853,21 +853,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] backport dma map and smmu patches from linux mainline
by Qinxin Xia 25 May '26

25 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9215 ---------------------------------------------------------------------- Balbir Singh (1): iommu/arm-smmu-v3: Fix pgsize_bit for sva domains Qinxin Xia (3): dma-mapping: benchmark: modify the framework to adapt to more map modes dma-mapping: benchmark: add support for dma_map_sg tools/dma: Add dma_map_sg support .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 6 + include/linux/map_benchmark.h | 13 +- kernel/dma/map_benchmark.c | 246 ++++++++++++++++-- .../testing/selftests/dma/dma_map_benchmark.c | 23 +- 4 files changed, 260 insertions(+), 28 deletions(-) -- 2.33.0

2 5

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 25 May '26

25 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

1 37

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 22 May '26

22 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

1 37

[PATCH OLK-6.6] usb: gadget: f_ncm: Fix net_device lifecycle with device_move
by Xinyu Zheng 22 May '26

22 May '26

From: Kuen-Han Tsai <khtsai(a)google.com> mainline inclusion from mainline-v7.0-rc4 commit ec35c1969650e7cb6c8a91020e568ed46e3551b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14979 CVE: CVE-2026-43421 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1] was reverted due to power management ordering concerns and a NO-CARRIER regression. A subsequent attempt to defer net_device allocation to bind [2] broke 1:1 mapping between function instance and network device, making it impossible for configfs to report the resolved interface name. This results in a regression where the DHCP server fails on pmOS. Use device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind/unbind cycles. This preserves the network interface across USB reconnection, allowing the DHCP server to retain their binding. Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use __free(detach_gadget) macro to undo attachment on bind failure. The bind_count ensures device_move executes only on the first bind. [1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel… [2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit… Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility") Cc: stable <stable(a)kernel.org> Signed-off-by: Kuen-Han Tsai <khtsai(a)google.com> Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-7-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/function/f_ncm.c [zxy: context conflict] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 36 +++++++++++++++++++-------- drivers/usb/gadget/function/u_ether.c | 22 ++++++++++++++++ drivers/usb/gadget/function/u_ether.h | 26 +++++++++++++++++++ drivers/usb/gadget/function/u_ncm.h | 2 +- 4 files changed, 74 insertions(+), 12 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 1da4e59338c5..56af3e57a07f 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1425,6 +1425,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) struct f_ncm_opts *ncm_opts; struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; + struct net_device *net __free(detach_gadget) = NULL; struct usb_request *request __free(free_usb_request) = NULL; if (!can_support_ecm(cdev->gadget)) @@ -1438,16 +1439,19 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) return -ENOMEM; } - mutex_lock(&ncm_opts->lock); - gether_set_gadget(ncm_opts->net, cdev->gadget); - if (!ncm_opts->bound) - status = gether_register_netdev(ncm_opts->net); - mutex_unlock(&ncm_opts->lock); - - if (status) - return status; - - ncm_opts->bound = true; + scoped_guard(mutex, &ncm_opts->lock) + if (ncm_opts->bind_count == 0) { + if (!device_is_registered(&ncm_opts->net->dev)) { + ncm_opts->net->mtu = (ncm_opts->max_segment_size - ETH_HLEN); + gether_set_gadget(ncm_opts->net, cdev->gadget); + status = gether_register_netdev(ncm_opts->net); + } else + status = gether_attach_gadget(ncm_opts->net, cdev->gadget); + + if (status) + return status; + net = ncm_opts->net; + } ncm_string_defs[1].s = ncm->ethaddr; @@ -1547,6 +1551,9 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) } ncm->notify_req = no_free_ptr(request); + ncm_opts->bind_count++; + retain_and_null_ptr(net); + DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n", ncm->port.in_ep->name, ncm->port.out_ep->name, ncm->notify->name); @@ -1593,7 +1600,7 @@ static void ncm_free_inst(struct usb_function_instance *f) struct f_ncm_opts *opts; opts = container_of(f, struct f_ncm_opts, func_inst); - if (opts->bound) + if (device_is_registered(&opts->net->dev)) gether_cleanup(netdev_priv(opts->net)); else free_netdev(opts->net); @@ -1655,9 +1662,12 @@ static void ncm_free(struct usb_function *f) static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) { struct f_ncm *ncm = func_to_ncm(f); + struct f_ncm_opts *ncm_opts; DBG(c->cdev, "ncm unbind\n"); + ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst); + hrtimer_cancel(&ncm->task_timer); kfree(f->os_desc_table); @@ -1673,6 +1683,10 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) kfree(ncm->notify_req->buf); usb_ep_free_request(ncm->notify, ncm->notify_req); + + ncm_opts->bind_count--; + if (ncm_opts->bind_count == 0) + gether_detach_gadget(ncm_opts->net); } static struct usb_function *ncm_alloc(struct usb_function_instance *fi) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 2da2db5e15a3..fae3cd49e0f8 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -896,6 +896,28 @@ void gether_set_gadget(struct net_device *net, struct usb_gadget *g) } EXPORT_SYMBOL_GPL(gether_set_gadget); +int gether_attach_gadget(struct net_device *net, struct usb_gadget *g) +{ + int ret; + + ret = device_move(&net->dev, &g->dev, DPM_ORDER_DEV_AFTER_PARENT); + if (ret) + return ret; + + gether_set_gadget(net, g); + return 0; +} +EXPORT_SYMBOL_GPL(gether_attach_gadget); + +void gether_detach_gadget(struct net_device *net) +{ + struct eth_dev *dev = netdev_priv(net); + + device_move(&net->dev, NULL, DPM_ORDER_NONE); + dev->gadget = NULL; +} +EXPORT_SYMBOL_GPL(gether_detach_gadget); + int gether_set_dev_addr(struct net_device *net, const char *dev_addr) { struct eth_dev *dev; diff --git a/drivers/usb/gadget/function/u_ether.h b/drivers/usb/gadget/function/u_ether.h index 34be220cef77..c85a1cf3c115 100644 --- a/drivers/usb/gadget/function/u_ether.h +++ b/drivers/usb/gadget/function/u_ether.h @@ -150,6 +150,32 @@ static inline struct net_device *gether_setup_default(void) */ void gether_set_gadget(struct net_device *net, struct usb_gadget *g); +/** + * gether_attach_gadget - Reparent net_device to the gadget device. + * @net: The network device to reparent. + * @g: The target USB gadget device to parent to. + * + * This function moves the network device to be a child of the USB gadget + * device in the device hierarchy. This is typically done when the function + * is bound to a configuration. + * + * Returns 0 on success, or a negative error code on failure. + */ +int gether_attach_gadget(struct net_device *net, struct usb_gadget *g); + +/** + * gether_detach_gadget - Detach net_device from its gadget parent. + * @net: The network device to detach. + * + * This function moves the network device to be a child of the virtual + * devices parent, effectively detaching it from the USB gadget device + * hierarchy. This is typically done when the function is unbound + * from a configuration but the instance is not yet freed. + */ +void gether_detach_gadget(struct net_device *net); + +DEFINE_FREE(detach_gadget, struct net_device *, if (_T) gether_detach_gadget(_T)) + /** * gether_set_dev_addr - initialize an ethernet-over-usb link with eth address * @net: device representing this link diff --git a/drivers/usb/gadget/function/u_ncm.h b/drivers/usb/gadget/function/u_ncm.h index 5408854d8407..297e5087872f 100644 --- a/drivers/usb/gadget/function/u_ncm.h +++ b/drivers/usb/gadget/function/u_ncm.h @@ -18,7 +18,7 @@ struct f_ncm_opts { struct usb_function_instance func_inst; struct net_device *net; - bool bound; + int bind_count; struct config_group *ncm_interf_group; struct usb_os_desc ncm_os_desc; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

Enable batched TLB flush in unmap_hotplug_range(). Anshuman Khandual (1): arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Peter Zijlstra (1): arm64/mm: Implement pXX_leaf_size() support arch/arm64/include/asm/pgtable.h | 4 ++++ arch/arm64/mm/mmu.c | 36 ++++++++++++++++++-------------- 2 files changed, 24 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] sched/fair: Do not send IPI if WFI timeout is 0
by Jinjie Ruan 22 May '26

22 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8929 ---------------------------------------- When the WFI timeout is configured to 0, no WFI suppression will be applied to offline tasks and no IPI is needed, and no IPI will eliminate the background noise. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/include/asm/xint.h | 2 ++ arch/arm64/kernel/smt_qos.c | 2 +- kernel/sched/smt_qos.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/xint.h b/arch/arm64/include/asm/xint.h index 2a63c663988e..7d89280a53f8 100644 --- a/arch/arm64/include/asm/xint.h +++ b/arch/arm64/include/asm/xint.h @@ -5,6 +5,8 @@ #define NR_IPI_USER 7 // SGI #ifndef __ASSEMBLY__ +extern unsigned int sysctl_sched_wfi_timeout; + extern void gic_handle_irq_noack(struct pt_regs *regs); extern void gic_handle_nmi_noack(struct pt_regs *regs); extern void arch_smp_send_ipi_user(int cpu); diff --git a/arch/arm64/kernel/smt_qos.c b/arch/arm64/kernel/smt_qos.c index 7e1a8e1121da..9f113c50d389 100644 --- a/arch/arm64/kernel/smt_qos.c +++ b/arch/arm64/kernel/smt_qos.c @@ -11,7 +11,7 @@ #include <vdso/time64.h> -static unsigned int sysctl_sched_wfi_timeout = 50; +unsigned int sysctl_sched_wfi_timeout = 50; static DEFINE_STATIC_KEY_TRUE(split_mode); static u32 arch_timer_freq; diff --git a/kernel/sched/smt_qos.c b/kernel/sched/smt_qos.c index 8f3eead1b179..c07c279ab0f7 100644 --- a/kernel/sched/smt_qos.c +++ b/kernel/sched/smt_qos.c @@ -123,7 +123,7 @@ static inline void send_ipi_throttle_smt(int this_cpu) { int cpu; - if (!system_uses_xint()) + if (!system_uses_xint() || !sysctl_sched_wfi_timeout) return; for_each_cpu(cpu, cpu_smt_mask(this_cpu)) { -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

From: Anshuman Khandual <anshuman.khandual(a)arm.com> stable inclusion from stable-v6.12.86 commit 7260b0ec7a84023412f8c26a456ee9a23e29bdb6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48478b9f791376b4b89018d7afdfd06865498f65 upstream. During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon <will(a)kernel.org> Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable(a)vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/mm/mmu.c [Conflicts due to commit 5a00bfd6a52c ("arm64/mm: new ptep layer to manage contig bit") update pte_clear to __pte_clear, that is fine.] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index adaca1fd5a277..a1f7080643a86 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -874,10 +874,14 @@ static void unmap_hotplug_pte_range(pmd_t *pmdp, unsigned long addr, WARN_ON(!pte_present(pte)); pte_clear(&init_mm, addr, ptep); - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pte_cont(pte)); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); free_hotplug_page_range(pte_page(pte), PAGE_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ } while (addr += PAGE_SIZE, addr < end); } @@ -898,15 +902,14 @@ static void unmap_hotplug_pmd_range(pud_t *pudp, unsigned long addr, WARN_ON(!pmd_present(pmd)); if (pmd_sect(pmd)) { pmd_clear(pmdp); - - /* - * One TLBI should be sufficient here as the PMD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pmd_cont(pmd)); + flush_tlb_kernel_range(addr, addr + PMD_SIZE); free_hotplug_page_range(pmd_page(pmd), PMD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pmd_table(pmd)); @@ -931,15 +934,12 @@ static void unmap_hotplug_pud_range(p4d_t *p4dp, unsigned long addr, WARN_ON(!pud_present(pud)); if (pud_sect(pud)) { pud_clear(pudp); - - /* - * One TLBI should be sufficient here as the PUD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + flush_tlb_kernel_range(addr, addr + PUD_SIZE); free_hotplug_page_range(pud_page(pud), PUD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pud_table(pud)); @@ -969,6 +969,7 @@ static void unmap_hotplug_p4d_range(pgd_t *pgdp, unsigned long addr, static void unmap_hotplug_range(unsigned long addr, unsigned long end, bool free_mapped, struct vmem_altmap *altmap) { + unsigned long start = addr; unsigned long next; pgd_t *pgdp, pgd; @@ -990,6 +991,9 @@ static void unmap_hotplug_range(unsigned long addr, unsigned long end, WARN_ON(!pgd_present(pgd)); unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap); } while (addr = next, addr < end); + + if (!free_mapped) + flush_tlb_kernel_range(start, end); } static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr, -- 2.43.0

2 2

[PATCH OLK-6.6] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

From: Anshuman Khandual <anshuman.khandual(a)arm.com> stable inclusion from stable-v6.12.86 commit 7260b0ec7a84023412f8c26a456ee9a23e29bdb6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48478b9f791376b4b89018d7afdfd06865498f65 upstream. During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon <will(a)kernel.org> Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable(a)vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index b2ef6c56db749..f65dbd76e2567 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -876,10 +876,14 @@ static void unmap_hotplug_pte_range(pmd_t *pmdp, unsigned long addr, WARN_ON(!pte_present(pte)); __pte_clear(&init_mm, addr, ptep); - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pte_cont(pte)); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); free_hotplug_page_range(pte_page(pte), PAGE_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ } while (addr += PAGE_SIZE, addr < end); } @@ -900,15 +904,14 @@ static void unmap_hotplug_pmd_range(pud_t *pudp, unsigned long addr, WARN_ON(!pmd_present(pmd)); if (pmd_sect(pmd)) { pmd_clear(pmdp); - - /* - * One TLBI should be sufficient here as the PMD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pmd_cont(pmd)); + flush_tlb_kernel_range(addr, addr + PMD_SIZE); free_hotplug_page_range(pmd_page(pmd), PMD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pmd_table(pmd)); @@ -933,15 +936,12 @@ static void unmap_hotplug_pud_range(p4d_t *p4dp, unsigned long addr, WARN_ON(!pud_present(pud)); if (pud_sect(pud)) { pud_clear(pudp); - - /* - * One TLBI should be sufficient here as the PUD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + flush_tlb_kernel_range(addr, addr + PUD_SIZE); free_hotplug_page_range(pud_page(pud), PUD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pud_table(pud)); @@ -971,6 +971,7 @@ static void unmap_hotplug_p4d_range(pgd_t *pgdp, unsigned long addr, static void unmap_hotplug_range(unsigned long addr, unsigned long end, bool free_mapped, struct vmem_altmap *altmap) { + unsigned long start = addr; unsigned long next; pgd_t *pgdp, pgd; @@ -992,6 +993,9 @@ static void unmap_hotplug_range(unsigned long addr, unsigned long end, WARN_ON(!pgd_present(pgd)); unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap); } while (addr = next, addr < end); + + if (!free_mapped) + flush_tlb_kernel_range(start, end); } static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 22 May '26

22 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 22 May '26

22 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 22 May '26

22 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 30 ++++++++++++++++++++++++------ kernel/xsched/cgroup.c | 3 +-- kernel/xsched/core.c | 12 ++++-------- kernel/xsched/vstream.c | 27 +++++++++------------------ 4 files changed, 38 insertions(+), 34 deletions(-) -- 2.34.1

2 6

[PATCH 00/23] KVM: arm64: rVIC/rVID PV interrupt controller
by Kunkun Jiang 21 May '26

21 May '26

https://lore.kernel.org/all/20200903152610.1078827-1-maz@kernel.org/ Marc Zyngier (5): irqchip/rvic: Add support for untrusted interrupt allocation irqchip: Add Reduced Virtual Interrupt Distributor support irqchip/rvid: Add PCI MSI support KVM: arm64: Tighten msis_require_devid reporting KVM: arm64: Add debugfs files for the rVIC/rVID implementation wanghaibin (18): irqchip: Add Reduced Virtual Interrupt Controller driver KVM: arm64: Move GIC model out of the distributor KVM: arm64: vgic-v3: Move early init to kvm_vgic_create() KVM: arm64: Add irqchip callback structure to kvm_arch KVM: arm64: Move kvm_vgic_destroy to kvm_irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_init() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_[un]blocking() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_load/put() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_pending_irq() to irqchip_flow KVM: arm64: Move vgic resource mapping on first run to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_{sync, flush}_hwstate() to irqchip_flow KVM: arm64: nVHE: Only save/restore GICv3 state if modeling a GIC KVM: arm64: Move interrupt injection to irqchip_flow KVM: arm64: Move mapping of HW interrupts into irqchip_flow KVM: arm64: Move set_owner into irqchip_flow KVM: arm64: Turn vgic_initialized into irqchip_finalized KVM: arm64: Move irqfd routing to irqchip_flow KVM: arm64: Add a rVIC/rVID in-kernel implementation arch/arm64/include/asm/kvm_host.h | 12 +- arch/arm64/include/asm/kvm_irq.h | 142 +++ arch/arm64/include/uapi/asm/kvm.h | 10 + arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arch_timer.c | 55 +- arch/arm64/kvm/arm.c | 128 ++- arch/arm64/kvm/hyp/nvhe/switch.c | 10 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 10 +- arch/arm64/kvm/rvic-cpu.c | 1217 +++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic-debug.c | 7 +- arch/arm64/kvm/vgic/vgic-init.c | 122 ++- arch/arm64/kvm/vgic/vgic-irqfd.c | 72 +- arch/arm64/kvm/vgic/vgic-its.c | 2 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 18 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio.c | 14 +- arch/arm64/kvm/vgic/vgic-v3.c | 24 +- arch/arm64/kvm/vgic/vgic.c | 55 +- arch/arm64/kvm/vgic/vgic.h | 41 +- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/irqchip/Kconfig | 12 + drivers/irqchip/Makefile | 2 + drivers/irqchip/irq-rvic.c | 595 ++++++++++++ drivers/irqchip/irq-rvid.c | 440 +++++++++ include/kvm/arm_rvic.h | 41 + include/kvm/arm_vgic.h | 32 - include/linux/cpuhotplug.h | 1 + include/linux/irqchip/irq-rvic.h | 100 ++ include/uapi/linux/kvm.h | 3 +- 30 files changed, 2945 insertions(+), 239 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_irq.h create mode 100644 arch/arm64/kvm/rvic-cpu.c create mode 100644 drivers/irqchip/irq-rvic.c create mode 100644 drivers/irqchip/irq-rvid.c create mode 100644 include/kvm/arm_rvic.h create mode 100644 include/linux/irqchip/irq-rvic.h -- 2.33.0

1 23

[PATCH openEuler-1.0-LTS v7 00/11] support apei_page_offline_policy
by Qi Xi 21 May '26

21 May '26

Patches 1-4 are the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-11 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-11 fix bugs. Changes in v7: Use blocking notifier for page offline policy chain Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (5): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path apei: use blocking notifier for page offline policy chain Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 12

[PATCH OLK-5.10] apei: use blocking notifier for page offline policy chain
by Qi Xi 21 May '26

21 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9170 ------------------------------------------------------- atomic_notifier_call_chain() holds rcu_read_lock() over callbacks, which prevents sleeping. Notifier callbacks such as ipmi_pso_notifier_call() need to sleep for IPMI completion, triggering a BUG: sleeping function called from invalid context. Switch apei_page_offline_notifier_chain to a blocking notifier to allow callbacks to safely sleep when invoked from sysctl write path. Fixes: 543fadb5575a ("apei/ghes: Add sysctl interface to control soft-offline page isolation") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/apei/ghes-policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes-policy.c b/drivers/acpi/apei/ghes-policy.c index 87c611f2cbaa..0bc12b0ba32b 100644 --- a/drivers/acpi/apei/ghes-policy.c +++ b/drivers/acpi/apei/ghes-policy.c @@ -17,18 +17,18 @@ int sysctl_apei_page_offline_policy __read_mostly = APEI_PAGE_OFFLINE_ALLOW_BASE_PAGE; EXPORT_SYMBOL(sysctl_apei_page_offline_policy); -static ATOMIC_NOTIFIER_HEAD(apei_page_offline_notifier_chain); +static BLOCKING_NOTIFIER_HEAD(apei_page_offline_notifier_chain); int register_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_register( + return blocking_notifier_chain_register( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(register_apei_page_offline_notifier); int unregister_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_unregister( + return blocking_notifier_chain_unregister( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(unregister_apei_page_offline_notifier); @@ -48,7 +48,7 @@ static int apei_page_offline_policy_handler(struct ctl_table *table, pr_debug("APEI policy: 0x%x -> 0x%x\n", old_val, new_val); if ((old_val ^ new_val) & APEI_PAGE_OFFLINE_NOTIFY) - atomic_notifier_call_chain( + blocking_notifier_call_chain( &apei_page_offline_notifier_chain, 0, &new_val); } -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 21 May '26

21 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/1] mfs: fix inode resource leak when cache object fd is zero
by Hongbo Li 21 May '26

21 May '26

Fix inode resource leak when cache object fd is zero. Hongbo Li (1): mfs: fix inode resource leak when cache object fd is zero fs/mfs/cache.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/10] bpf mainline for olk-6.6
by Pu Lehui 21 May '26

21 May '26

Daniel Borkmann (1): bpf, arm64: Fix off-by-one in check_imm signed range check David Carlier (1): bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Jiayuan Chen (2): bpf: Fix use-after-free in offloaded map/prog info fill bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Lang Xu (1): bpf: Fix OOB in pcpu_init_value MingTao Huang (1): bpf: Fix stale offload->prog pointer after constant blinding Mykyta Yatsenko (2): bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK Sechang Lim (1): bpf: Fix RCU stall in bpf_fd_array_map_clear() Weiming Shi (1): bpf: fix end-of-list detection in cgroup_storage_get_next_key() arch/arm64/net/bpf_jit_comp.c | 4 ++-- kernel/bpf/arraymap.c | 4 +++- kernel/bpf/bpf_lsm.c | 2 -- kernel/bpf/core.c | 2 ++ kernel/bpf/devmap.c | 5 ++--- kernel/bpf/hashtab.c | 12 ++++++++---- kernel/bpf/local_storage.c | 2 +- kernel/bpf/offload.c | 10 ++++------ kernel/bpf/verifier.c | 5 ++++- 9 files changed, 26 insertions(+), 20 deletions(-) -- 2.34.1

2 12

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 21 May '26

21 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 26 ++++++++++++++++++++------ kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 29 insertions(+), 26 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
by Liu Kai 21 May '26

21 May '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.0-rc7 commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14554 CVE: CVE-2026-43022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that. Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [hci_connect_pa_sync(), hci_connect_big_sync(), hci_past_sync(), hci_le_read_remote_features(), hci_acl_change_pkt_type(), hci_le_set_phy() are not introduced, so some changes are not applied] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/hci_sync.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index f4066b8e95da..0648cebf0865 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -798,7 +798,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, void *data, hci_cmd_sync_work_destroy_t destroy) { if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) - return 0; + return -EEXIST; return hci_cmd_sync_queue(hdev, func, data, destroy); } @@ -3266,6 +3266,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data) int hci_update_passive_scan(struct hci_dev *hdev) { + int err; + /* Only queue if it would have any effect */ if (!test_bit(HCI_UP, &hdev->flags) || test_bit(HCI_INIT, &hdev->flags) || @@ -3275,8 +3277,9 @@ int hci_update_passive_scan(struct hci_dev *hdev) hci_dev_test_flag(hdev, HCI_UNREGISTER)) return 0; - return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, - NULL); + err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, + NULL); + return (err == -EEXIST) ? 0 : err; } int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) @@ -6904,8 +6907,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, - NULL); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, + NULL); + return (err == -EEXIST) ? 0 : err; } static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) @@ -6941,8 +6947,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, - create_le_conn_complete); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, + create_le_conn_complete); + return (err == -EEXIST) ? 0 : err; } int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) -- 2.34.1

2 1

[PATCH openEuler-24.03-LTS_SP3] tracing: test ci
by Tengda Wu 20 May '26

20 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14259 -------------------------------- This is a test. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 39bef9ddc5ae..affd03dd969c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -106,6 +106,8 @@ dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set) return 0; } +/* This is a test */ + /* * To prevent the comm cache from being overwritten when no * tracing is active, only save the comm when a trace event -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 20 May '26

20 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 7 ++++++- kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 15 insertions(+), 21 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 00/10] backport cpuidle patches from linux mainline
by Lifeng Zheng 20 May '26

20 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9163 ---------------------------------------------------------------------- backport cpuidle patches from linux mainline Bowen Yu (3): update to sysfs_emit() for safer buffer handling cpufreq: Update sscanf() to kstrtouint() cpufreq: Replace magic number Hongye Lin (1): Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus" Jie Zhan (4): cpufreq: CPPC: Don't warn if FIE init fails to read counters ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() cpufreq: CPPC: Factor out cppc_fie_kworker_init() cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs Pengjie Zhang (1): PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() Sumit Gupta (1): arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads arch/arm64/kernel/topology.c | 21 +++++-- drivers/acpi/cppc_acpi.c | 48 ++++++++------- drivers/cpufreq/cppc_cpufreq.c | 105 ++++++++++++++++++++++----------- drivers/cpufreq/cpufreq.c | 14 ++--- drivers/devfreq/devfreq.c | 99 ++++++++++++++++++------------- include/acpi/cppc_acpi.h | 5 ++ 6 files changed, 181 insertions(+), 111 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 20 May '26

20 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3]Backport per-vma locks in userfaultfd for OLK 6.6
by Wupeng Ma 20 May '26

20 May '26

Backport per-vma locks in userfaultfd[1] for OLK 6.6 Lokesh Gidra (3): userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK userfaultfd: use per-vma locks in userfaultfd operations fs/userfaultfd.c | 35 ++-- include/linux/mm.h | 5 + include/linux/userfaultfd_k.h | 24 ++- include/linux/userfaultfd_k_ext.h | 7 + mm/userfaultfd.c | 273 ++++++++++++++++++++---------- 5 files changed, 226 insertions(+), 118 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
by Liu Kai 20 May '26

20 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.252 commit 335071c0c3637064ec250481f589075db44fe4e6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14681 CVE: CVE-2026-43134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ] This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE. Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/ Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Christian Eggers <ceggers(a)arri.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_core.c [delete parameter "pchan" of l2cap_check_enc_key_size()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index d97f29f7218a..cbe8dcc2b5f0 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5860,6 +5860,13 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response_unlock; } + /* Check if Key Size is sufficient for the security level */ + if (!l2cap_check_enc_key_size(conn->hcon)) { + result = L2CAP_CR_LE_BAD_KEY_SIZE; + chan = NULL; + goto response_unlock; + } + /* Check for valid dynamic CID range */ if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { result = L2CAP_CR_LE_INVALID_SCID; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
by Liu Kai 20 May '26

20 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.252 commit 335071c0c3637064ec250481f589075db44fe4e6 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ] This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE. Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/ Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Christian Eggers <ceggers(a)arri.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_core.c [delete parameter "pchan" of l2cap_check_enc_key_size()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index d97f29f7218a..cbe8dcc2b5f0 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5860,6 +5860,13 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response_unlock; } + /* Check if Key Size is sufficient for the security level */ + if (!l2cap_check_enc_key_size(conn->hcon)) { + result = L2CAP_CR_LE_BAD_KEY_SIZE; + chan = NULL; + goto response_unlock; + } + /* Check for valid dynamic CID range */ if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { result = L2CAP_CR_LE_INVALID_SCID; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2026-43134
by Liu Kai 20 May '26

20 May '26

CVE-2026-43134 Archie Pusaka (1): Bluetooth: Enforce key size of 16 bytes on FIPS level Frédéric Danis (1): Bluetooth: l2cap: Check encryption key size on incoming connection Luiz Augusto von Dentz (1): Bluetooth: L2CAP: Fix not checking l2cap_chan security level net/bluetooth/l2cap_core.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) -- 2.34.1

2 4

openEuler Kernel SIG双周例会
by openEuler conference 20 May '26

20 May '26

您好！ Kernel 邀请您参加 2026-05-22 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件，或直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/985166233 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-05-22 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件，或直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/985166233 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] config: x86: Fix CI "checkdefconfig" warning by updating defconfig
by Tengda Wu 19 May '26

19 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9203 CVE: NA --------------------------- When building the x86_64 kernel, the CI robot complains: [WARNING] x86_64 checkdefconfig fail - CONFIG_DEBUG_INFO_BTF_MODULES=y - CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for x86_64 is not updated, you can configure and run 'make update_oedefconfig' to update it. After investigation, it was found that one of these two configs has existed since the 6.6 baseline version, so just run 'make update_oedefconfig' to stop the complaint. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 35 ++++++++++++++-------------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 73302f391cd7..08126a9363ef 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7,7 +7,7 @@ CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y -CONFIG_DRM_PHYTIUM=y + # # General setup # @@ -198,6 +198,7 @@ CONFIG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_V1_WRITEBACK=y CONFIG_CGROUP_SCHED=y +CONFIG_QOS_LEVEL=y CONFIG_QOS_SCHED=y CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_QOS_SCHED_PRIO_LB=y @@ -1054,6 +1055,7 @@ CONFIG_MQ_IOSCHED_KYBER=y CONFIG_IOSCHED_BFQ=y CONFIG_BFQ_GROUP_IOSCHED=y # CONFIG_BFQ_CGROUP_DEBUG is not set +CONFIG_BPF_RVI_BLK_BFQ=y # end of IO Schedulers CONFIG_PREEMPT_NOTIFIERS=y @@ -1179,6 +1181,7 @@ CONFIG_READ_ONLY_THP_FOR_FS=y CONFIG_PGTABLE_HAS_HUGE_LEAVES=y CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y +CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_USE_PERCPU_NUMA_NODE_ID=y @@ -1224,7 +1227,6 @@ CONFIG_LRU_GEN=y # CONFIG_LRU_GEN_STATS is not set CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y -CONFIG_GMEM=y CONFIG_LOCK_MM_AND_FIND_VMA=y CONFIG_IOMMU_MM_DATA=y CONFIG_PAGE_CACHE_LIMIT=y @@ -1233,6 +1235,7 @@ CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m CONFIG_ETMEM=y # CONFIG_BPF_READAHEAD is not set +CONFIG_GMEM=y # # Data Access Monitoring @@ -1263,7 +1266,6 @@ CONFIG_SKB_EXTENSIONS=y CONFIG_PACKET=y CONFIG_PACKET_DIAG=m CONFIG_UNIX=y -CONFIG_UNIX_SCM=y CONFIG_AF_UNIX_OOB=y CONFIG_UNIX_DIAG=m CONFIG_TLS=m @@ -1286,11 +1288,11 @@ CONFIG_NET_KEY_MIGRATE=y CONFIG_SMC=m CONFIG_SMC_DIAG=m CONFIG_SMC_LO=y -CONFIG_UB_UMS=m -CONFIG_UB_SOCKET_HANDSHAKE=y CONFIG_XDP_SOCKETS=y CONFIG_XDP_SOCKETS_DIAG=y # CONFIG_OENETCLS is not set +CONFIG_UB_UMS=m +CONFIG_UB_SOCKET_HANDSHAKE=y CONFIG_NET_HANDSHAKE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y @@ -1920,7 +1922,6 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_STREAM_PARSER=y -# CONFIG_HISOCK is not set CONFIG_NET_FLOW_LIMIT=y # @@ -2045,8 +2046,6 @@ CONFIG_NETACC_TERRACE=y # # Device Drivers # -CONFIG_HAVE_EISA=y -# CONFIG_EISA is not set CONFIG_HAVE_PCI=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y @@ -2177,9 +2176,6 @@ CONFIG_FW_CACHE=y CONFIG_FW_UPLOAD=y # end of Firmware loader -# fwctl -CONFIG_FWCTL=m - CONFIG_WANT_DEV_COREDUMP=y CONFIG_ALLOW_DEV_COREDUMP=y CONFIG_DEV_COREDUMP=y @@ -2271,6 +2267,7 @@ CONFIG_UEFI_CPER_X86=y # end of Tegra firmware driver # end of Firmware Drivers +CONFIG_FWCTL=m # CONFIG_GNSS is not set CONFIG_MTD=m # CONFIG_MTD_TESTS is not set @@ -3142,7 +3139,6 @@ CONFIG_NET_VENDOR_VERTEXCOM=y # CONFIG_MSE102X is not set # CONFIG_NET_VENDOR_VIA is not set CONFIG_NET_VENDOR_WANGXUN=y -CONFIG_LIBWX=m CONFIG_NGBE=m CONFIG_TXGBE=m # CONFIG_NET_VENDOR_WIZNET is not set @@ -3292,7 +3288,6 @@ CONFIG_MDIO_THUNDER=m # # PCS device drivers # -CONFIG_PCS_XPCS=m # end of PCS device drivers # CONFIG_PLIP is not set @@ -5780,6 +5775,7 @@ CONFIG_DRM_CIRRUS_QEMU=m # CONFIG_DRM_VBOXVIDEO is not set # CONFIG_DRM_GUD is not set # CONFIG_DRM_SSD130X is not set +CONFIG_DRM_PHYTIUM=m # CONFIG_DRM_HYPERV is not set # CONFIG_DRM_LEGACY is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y @@ -8333,6 +8329,7 @@ CONFIG_OVERLAY_FS=m # CONFIG_OVERLAY_FS_XINO_AUTO is not set # CONFIG_OVERLAY_FS_METACOPY is not set # CONFIG_OVERLAY_FS_DEBUG is not set + # # Caches # @@ -8397,9 +8394,9 @@ CONFIG_TMPFS_XATTR=y # CONFIG_TMPFS_INODE64 is not set # CONFIG_TMPFS_QUOTA is not set CONFIG_HUGETLBFS=y +# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set CONFIG_HUGETLB_PAGE=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set CONFIG_HUGETLB_ALLOC_LIMIT=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y @@ -8486,6 +8483,7 @@ CONFIG_NFS_USE_KERNEL_DNS=y CONFIG_NFS_DEBUG=y # CONFIG_NFS_DISABLE_UDP_SUPPORT is not set # CONFIG_NFS_V4_2_READ_PLUS is not set +CONFIG_ENFS=m CONFIG_NFSD=m # CONFIG_NFSD_V2 is not set CONFIG_NFSD_V3_ACL=y @@ -8502,8 +8500,6 @@ CONFIG_LOCKD_V4=y CONFIG_NFS_ACL_SUPPORT=m CONFIG_NFS_COMMON=y CONFIG_NFS_V4_2_SSC_HELPER=y -CONFIG_ENFS=m -CONFIG_SUNRPC_ENFS=y CONFIG_SUNRPC=m CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y @@ -8513,6 +8509,7 @@ CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1=y # CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 is not set CONFIG_SUNRPC_DEBUG=y CONFIG_SUNRPC_XPRT_RDMA=m +CONFIG_SUNRPC_ENFS=y CONFIG_CEPH_FS=m # CONFIG_CEPH_FSCACHE is not set CONFIG_CEPH_FS_POSIX_ACL=y @@ -8710,8 +8707,6 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y -# CONFIG_INIT_STACK_ALL_PATTERN is not set -# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set # CONFIG_ZERO_CALL_USED_REGS is not set @@ -9231,6 +9226,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVEs
by Liu Kai 19 May '26

19 May '26

CVEs Andrey Vatoropin (1): fbcon: check return value of con2fb_acquire_newinfo() Luiz Augusto von Dentz (1): Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ drivers/video/fbdev/core/fbcon.c | 3 ++- net/bluetooth/l2cap_core.c | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
by Yi Yang 19 May '26

19 May '26

From: Joonwon Kang <joonwonkang(a)google.com> mainline inclusion from mainline-v7.0-rc1 commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14824 CVE: CVE-2026-43281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable(a)vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang(a)google.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Conflicts: drivers/mailbox/mailbox.c [Commit ba879dfc0574 ("mailbox: Allow controller specific mapping using fwnode") was not merged. Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mailbox/mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c index adf36c05fa43..19eefdf99058 100644 --- a/drivers/mailbox/mailbox.c +++ b/drivers/mailbox/mailbox.c @@ -507,12 +507,10 @@ static struct mbox_chan * of_mbox_index_xlate(struct mbox_controller *mbox, const struct of_phandle_args *sp) { - int ind = sp->args[0]; - - if (ind >= mbox->num_chans) + if (sp->args_count < 1 || sp->args[0] >= mbox->num_chans) return ERR_PTR(-EINVAL); - return &mbox->chans[ind]; + return &mbox->chans[sp->args[0]]; } /** -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
by Yi Yang 19 May '26

19 May '26

From: Joonwon Kang <joonwonkang(a)google.com> mainline inclusion from mainline-v7.0-rc1 commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14824 CVE: CVE-2026-43281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable(a)vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang(a)google.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Conflicts: drivers/mailbox/mailbox.c [Commit ba879dfc0574 ("mailbox: Allow controller specific mapping using fwnode") was not merged. Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mailbox/mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c index 055c90b8253c..275119136bde 100644 --- a/drivers/mailbox/mailbox.c +++ b/drivers/mailbox/mailbox.c @@ -432,12 +432,10 @@ static struct mbox_chan * of_mbox_index_xlate(struct mbox_controller *mbox, const struct of_phandle_args *sp) { - int ind = sp->args[0]; - - if (ind >= mbox->num_chans) + if (sp->args_count < 1 || sp->args[0] >= mbox->num_chans) return ERR_PTR(-EINVAL); - return &mbox->chans[ind]; + return &mbox->chans[sp->args[0]]; } /** -- 2.25.1

2 2

[PATCH OLK-5.10 0/2] *** Fix CVE-2026-43428 ***
by Zhang Kunbo 19 May '26

19 May '26

*** Fix CVE-2026-43428 *** Alan Stern (2): USB: usbcore: Introduce usb_bulk_msg_killable() USB: core: Limit the length of unkillable synchronous timeouts drivers/usb/core/message.c | 97 ++++++++++++++++++++++++++++++-------- include/linux/usb.h | 8 +++- 2 files changed, 84 insertions(+), 21 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] USB: core: Limit the length of unkillable synchronous timeouts
by Zhang Kunbo 19 May '26

19 May '26

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v6.6.130 commit 659c0c7d50a4b0f6aa197c4c098cfd91daf63862 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14986 CVE: CVE-2026-43428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream. The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowl… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable(a)vger.kernel.org Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harva… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/usb/core/message.c | 27 +++++++++++++-------------- include/linux/usb.h | 3 +++ 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 858436862cbf..119d07c4c62b 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -45,6 +45,8 @@ static void usb_api_blocking_completion(struct urb *urb) * Starts urb and waits for completion or timeout. * Whether or not the wait is killable depends on the flag passed in. * For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). + * + * For non-killable waits, we enforce a maximum limit on the timeout value. */ static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length, bool killable) @@ -61,7 +63,9 @@ static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length, if (unlikely(retval)) goto out; - expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; + if (!killable && (timeout <= 0 || timeout > USB_MAX_SYNCHRONOUS_TIMEOUT)) + timeout = USB_MAX_SYNCHRONOUS_TIMEOUT; + expire = (timeout > 0) ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (killable) rc = wait_for_completion_killable_timeout(&ctx.done, expire); else @@ -127,8 +131,7 @@ static int usb_internal_control_msg(struct usb_device *usb_dev, * @index: USB message index value * @data: pointer to the data to send * @size: length in bytes of the data to send - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -183,8 +186,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg); * @index: USB message index value * @driver_data: pointer to the data to send * @size: length in bytes of the data to send - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt () @@ -242,8 +244,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_send); * @index: USB message index value * @driver_data: pointer to the data to be filled in by the message * @size: length in bytes of the data to be received - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt () @@ -314,8 +315,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_recv); * @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes - * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -347,8 +347,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg); * @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes - * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -408,12 +407,12 @@ EXPORT_SYMBOL_GPL(usb_bulk_msg); * @actual_length: pointer to a location to put the actual length transferred * in bytes * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * timing out (if <= 0, the wait is as long as possible) * * Context: task context, might sleep. * - * This function is just like usb_blk_msg() except that it waits in a - * killable state. + * This function is just like usb_blk_msg(), except that it waits in a + * killable state and there is no limit on the timeout length. * * Return: * If successful, 0. Otherwise a negative error number. The number of actual diff --git a/include/linux/usb.h b/include/linux/usb.h index a3261427d6e0..6e6e32067148 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -1843,6 +1843,9 @@ void usb_buffer_unmap_sg(const struct usb_device *dev, int is_in, * SYNCHRONOUS CALL SUPPORT * *-------------------------------------------------------------------*/ +/* Maximum value allowed for timeout in synchronous routines below */ +#define USB_MAX_SYNCHRONOUS_TIMEOUT 60000 /* ms */ + extern int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u8 requesttype, __u16 value, __u16 index, void *data, __u16 size, int timeout); -- 2.34.1

2 1

[PATCH OLK-6.6 00/24] backport cpuidle patches from linux mainline
by Huisong Li 19 May '26

19 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9134 ---------------------------------------------------------------------- backport cpuidle patches from linux mainline Andy Shevchenko (1): ACPI: processor: idle: Replace strlcat() with better alternative Breno Leitao (1): ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Huisong Li (18): ACPI: processor: idle: Relocate state flags initialization ACPI: processor: idle: Drop redundant C-state count checks ACPI: processor: idle: Optimize ACPI idle driver registration ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Add debug log for states with invalid entry methods ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init ACPI: processor: idle: Move max_cstate update out of the loop ACPI: processor: idle: Remove redundant static variable and rename cstate check function ACPI: processor: idle: Reset power_setup_done flag on initialization failure ACPI: processor: idle: Fix NULL pointer dereference in hotplug path cpuidle: Simplify cpuidle_register_device() with guard() cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() ACPI: processor: idle: Reset cpuidle on C-state list changes Jingkai Tan (1): ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() Rafael J. Wysocki (3): ACPI: processor: idle: Eliminate static ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() arch/arm64/kernel/cpuidle.c | 10 +- drivers/acpi/processor_driver.c | 12 +- drivers/acpi/processor_idle.c | 297 +++++++++++++++++--------------- drivers/cpuidle/cpuidle.c | 34 ++-- include/acpi/processor.h | 35 +--- include/linux/cpuidle.h | 2 + 6 files changed, 200 insertions(+), 190 deletions(-) -- 2.33.0

2 25

[PATCH OLK-6.6] e1000/e1000e: Fix leak in DMA error cleanup
by Pan Taixi 19 May '26

19 May '26

From: Matt Vollrath <tactii(a)gmail.com> stable inclusion from stable-v6.6.130 commit 0a1fc25deabab4efce64610e3c449485c4fa8f5f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15003 CVE: CVE-2026-43445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ] If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak. In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver") Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error. This issue may still exist in the igbvf driver, but I did not address it in this patch. Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") Assisted-by: Claude:claude-4.6-opus Signed-off-by: Matt Vollrath <tactii(a)gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -- drivers/net/ethernet/intel/e1000e/netdev.c | 2 -- 2 files changed, 4 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index d015a0a85f07..8dcb5d7c5a4b 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -2951,8 +2951,6 @@ static int e1000_tx_map(struct e1000_adapter *adapter, dma_error: dev_err(&pdev->dev, "TX DMA map failed\n"); buffer_info->dma = 0; - if (count) - count--; while (count--) { if (i == 0) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index 7e4fea0e186b..9e9138ccac42 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -5633,8 +5633,6 @@ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb, dma_error: dev_err(&pdev->dev, "Tx DMA map failed\n"); buffer_info->dma = 0; - if (count) - count--; while (count--) { if (i == 0) -- 2.34.1

2 1

[PATCH OLK-6.6 V3] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
by Zizhi Wo 18 May '26

18 May '26

mainline inclusion from mainline-v7.1-rc4 commit f44d38a31f1802b7222adaea9ee69f9d280f698a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU: [root@fedora io_uring_stress]# ps -ef | grep io_uring root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] <defunct> The task loops inside io_cqring_wait() and never returns to userspace, and SIGKILL has no effect. This is caused by the CQ ring exposing rings->cq.head to userspace as writable, while the authoritative tail lives in kernel-private ctx->cached_cq_tail. io_cqe_cache_refill() computes free space as an unsigned subtraction: free = ctx->cq_entries - min(tail - head, ctx->cq_entries); If userspace keeps head within [0, tail], the subtraction is well defined and min() just acts as a defensive clamp. But if userspace advances head past tail, (tail - head) wraps to a huge value, free becomes 0, and io_cqe_cache_refill() fails. The CQE is pushed onto the overflow list and IO_CHECK_CQ_OVERFLOW_BIT is set. The wait loop in io_cqring_wait() relies on an invariant: refill() only fails when the CQ is *physically* full, in which case rings->cq.tail has been advanced to iowq->cq_tail and io_should_wake() returns true. The tampered head breaks this: refill() fails while the ring is not full, no OCQE is copied in, rings->cq.tail never catches up, io_should_wake() stays false, and io_cqring_wait_schedule() keeps returning early because IO_CHECK_CQ_OVERFLOW_BIT is still set. The result is a tight retry loop that never returns to userspace. Introduce io_cqring_queued() as the single point that converts the (tail, head) pair into a trustworthy queued count. Since the real head/tail distance is bounded by cq_entries (far below 2^31), a signed comparison reliably detects userspace moving head past tail; in that case treat the queue as empty so callers see the full cache as free and forward progress is preserved. Suggested-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Link: https://patch.msgid.link/20260514021847.4062782-1-wozizhi@huaweicloud.com [axboe: fixup commit message, kill 'queued' var, and keep it all in io_uring.c] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Not has io_fill_nop_cqe(), not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- io_uring/io_uring.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 20a657c8d625..b5565b76414f 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -835,32 +835,44 @@ void io_req_cqe_overflow(struct io_kiocb *req) req->cqe.res, req->cqe.flags, req->big_cqe.extra1, req->big_cqe.extra2); memset(&req->big_cqe, 0, sizeof(req->big_cqe)); } +/* + * Compute queued CQEs for free-space calculation, clamped to cq_entries. + */ +static unsigned int io_cqring_queued(struct io_ring_ctx *ctx) +{ + struct io_rings *rings = ctx->rings; + int diff; + + diff = (int)(ctx->cached_cq_tail - READ_ONCE(rings->cq.head)); + if (diff >= 0) + return min((unsigned int)diff, ctx->cq_entries); + return 0; +} + /* * writes to the cq entry need to come after reading head; the * control dependency is enough as we're using WRITE_ONCE to * fill the cq entry */ bool io_cqe_cache_refill(struct io_ring_ctx *ctx, bool overflow) { struct io_rings *rings = ctx->rings; unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries - 1); - unsigned int free, queued, len; + unsigned int free, len; /* * Posting into the CQ when there are pending overflowed CQEs may break * ordering guarantees, which will affect links, F_MORE users and more. * Force overflow the completion. */ if (!overflow && (ctx->check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))) return false; - /* userspace may cheat modifying the tail, be safe and do min */ - queued = min(__io_cqring_events(ctx), ctx->cq_entries); - free = ctx->cq_entries - queued; + free = ctx->cq_entries - io_cqring_queued(ctx); /* we need a contiguous range, limit based on the current array offset */ len = min(free, ctx->cq_entries - off); if (!len) return false; -- 2.52.0

2 1

[PATCH OLK-6.6 V2] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
by Zizhi Wo 18 May '26

18 May '26

mainline inclusion from mainline-v7.1-rc4 commit f44d38a31f1802b7222adaea9ee69f9d280f698a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU: [root@fedora io_uring_stress]# ps -ef | grep io_uring root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] <defunct> The task loops inside io_cqring_wait() and never returns to userspace, and SIGKILL has no effect. This is caused by the CQ ring exposing rings->cq.head to userspace as writable, while the authoritative tail lives in kernel-private ctx->cached_cq_tail. io_cqe_cache_refill() computes free space as an unsigned subtraction: free = ctx->cq_entries - min(tail - head, ctx->cq_entries); If userspace keeps head within [0, tail], the subtraction is well defined and min() just acts as a defensive clamp. But if userspace advances head past tail, (tail - head) wraps to a huge value, free becomes 0, and io_cqe_cache_refill() fails. The CQE is pushed onto the overflow list and IO_CHECK_CQ_OVERFLOW_BIT is set. The wait loop in io_cqring_wait() relies on an invariant: refill() only fails when the CQ is *physically* full, in which case rings->cq.tail has been advanced to iowq->cq_tail and io_should_wake() returns true. The tampered head breaks this: refill() fails while the ring is not full, no OCQE is copied in, rings->cq.tail never catches up, io_should_wake() stays false, and io_cqring_wait_schedule() keeps returning early because IO_CHECK_CQ_OVERFLOW_BIT is still set. The result is a tight retry loop that never returns to userspace. Introduce io_cqring_queued() as the single point that converts the (tail, head) pair into a trustworthy queued count. Since the real head/tail distance is bounded by cq_entries (far below 2^31), a signed comparison reliably detects userspace moving head past tail; in that case treat the queue as empty so callers see the full cache as free and forward progress is preserved. Suggested-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Link: https://patch.msgid.link/20260514021847.4062782-1-wozizhi@huaweicloud.com [axboe: fixup commit message, kill 'queued' var, and keep it all in io_uring.c] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Not has io_fill_nop_cqe(), not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- io_uring/io_uring.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 20a657c8d625..898749d522a9 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -835,32 +835,44 @@ void io_req_cqe_overflow(struct io_kiocb *req) req->cqe.res, req->cqe.flags, req->big_cqe.extra1, req->big_cqe.extra2); memset(&req->big_cqe, 0, sizeof(req->big_cqe)); } +/* + Compute queued CQEs for free-space calculation, clamped to cq_entries. + */ +static unsigned int io_cqring_queued(struct io_ring_ctx *ctx) +{ + struct io_rings *rings = ctx->rings; + int diff; + + diff = (int)(ctx->cached_cq_tail - READ_ONCE(rings->cq.head)); + if (diff >= 0) + return min((unsigned int)diff, ctx->cq_entries); + return 0; +} + /* * writes to the cq entry need to come after reading head; the * control dependency is enough as we're using WRITE_ONCE to * fill the cq entry */ bool io_cqe_cache_refill(struct io_ring_ctx *ctx, bool overflow) { struct io_rings *rings = ctx->rings; unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries - 1); - unsigned int free, queued, len; + unsigned int free, len; /* * Posting into the CQ when there are pending overflowed CQEs may break * ordering guarantees, which will affect links, F_MORE users and more. * Force overflow the completion. */ if (!overflow && (ctx->check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))) return false; - /* userspace may cheat modifying the tail, be safe and do min */ - queued = min(__io_cqring_events(ctx), ctx->cq_entries); - free = ctx->cq_entries - queued; + free = ctx->cq_entries - io_cqring_queued(ctx); /* we need a contiguous range, limit based on the current array offset */ len = min(free, ctx->cq_entries - off); if (!len) return false; -- 2.52.0

2 2

[PATCH OLK-6.6] io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
by Zizhi Wo 18 May '26

18 May '26

mainline inclusion from mainline-v7.1-rc4 commit f44d38a31f1802b7222adaea9ee69f9d280f698a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU: [root@fedora io_uring_stress]# ps -ef | grep io_uring root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] <defunct> The task loops inside io_cqring_wait() and never returns to userspace, and SIGKILL has no effect. This is caused by the CQ ring exposing rings->cq.head to userspace as writable, while the authoritative tail lives in kernel-private ctx->cached_cq_tail. io_cqe_cache_refill() computes free space as an unsigned subtraction: free = ctx->cq_entries - min(tail - head, ctx->cq_entries); If userspace keeps head within [0, tail], the subtraction is well defined and min() just acts as a defensive clamp. But if userspace advances head past tail, (tail - head) wraps to a huge value, free becomes 0, and io_cqe_cache_refill() fails. The CQE is pushed onto the overflow list and IO_CHECK_CQ_OVERFLOW_BIT is set. The wait loop in io_cqring_wait() relies on an invariant: refill() only fails when the CQ is *physically* full, in which case rings->cq.tail has been advanced to iowq->cq_tail and io_should_wake() returns true. The tampered head breaks this: refill() fails while the ring is not full, no OCQE is copied in, rings->cq.tail never catches up, io_should_wake() stays false, and io_cqring_wait_schedule() keeps returning early because IO_CHECK_CQ_OVERFLOW_BIT is still set. The result is a tight retry loop that never returns to userspace. Introduce io_cqring_queued() as the single point that converts the (tail, head) pair into a trustworthy queued count. Since the real head/tail distance is bounded by cq_entries (far below 2^31), a signed comparison reliably detects userspace moving head past tail; in that case treat the queue as empty so callers see the full cache as free and forward progress is preserved. Suggested-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Link: https://patch.msgid.link/20260514021847.4062782-1-wozizhi@huaweicloud.com [axboe: fixup commit message, kill 'queued' var, and keep it all in io_uring.c] Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Not has io_fill_nop_cqe(), not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- io_uring/io_uring.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 20a657c8d625..4b7927f92389 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -835,32 +835,44 @@ void io_req_cqe_overflow(struct io_kiocb *req) req->cqe.res, req->cqe.flags, req->big_cqe.extra1, req->big_cqe.extra2); memset(&req->big_cqe, 0, sizeof(req->big_cqe)); } +/* + Compute queued CQEs for free-space calculation, clamped to cq_entries. + */ +static unsigned int io_cqring_queued(struct io_ring_ctx *ctx) +{ + struct io_rings *rings = io_get_rings(ctx); + int diff; + + diff = (int)(ctx->cached_cq_tail - READ_ONCE(rings->cq.head)); + if (diff >= 0) + return min((unsigned int)diff, ctx->cq_entries); + return 0; +} + /* * writes to the cq entry need to come after reading head; the * control dependency is enough as we're using WRITE_ONCE to * fill the cq entry */ bool io_cqe_cache_refill(struct io_ring_ctx *ctx, bool overflow) { struct io_rings *rings = ctx->rings; unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries - 1); - unsigned int free, queued, len; + unsigned int free, len; /* * Posting into the CQ when there are pending overflowed CQEs may break * ordering guarantees, which will affect links, F_MORE users and more. * Force overflow the completion. */ if (!overflow && (ctx->check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))) return false; - /* userspace may cheat modifying the tail, be safe and do min */ - queued = min(__io_cqring_events(ctx), ctx->cq_entries); - free = ctx->cq_entries - queued; + free = ctx->cq_entries - io_cqring_queued(ctx); /* we need a contiguous range, limit based on the current array offset */ len = min(free, ctx->cq_entries - off); if (!len) return false; -- 2.52.0

2 1

[PATCH OLK-6.6 00/36] perf arm-spe: Extend branch operations
by Yushan Wang 18 May '26

18 May '26

From: Ying Jiang<jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (4): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping Yushan Wang (4): Revert "arm64/boot: Enable EL2 requirements for BRBE" perf: Fix hw_metric event idx config perf: Keep event consistency of hw_metric events arm_pmuv3: hw_metric: Remove unnecessary check of event type Documentation/arch/arm64/booting.rst | 75 +++- arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 68 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 28 files changed, 1098 insertions(+), 195 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

2 37

[PATCH openEuler-1.0-LTS 0/2] mm: introduce ZRAM-Reclaim module for optimized swap-based reclaim
by Ze Zuo 18 May '26

18 May '26

In ZRAM + HDD storage environments, the default LRU-based reclaim policy often struggles to effectively balance anonymous and file-backed pages. The existing algorithm tends to over-reclaim file pages under memory pressure, causing excessive disk I/O and poor system responsiveness when ZRAM is used as a compressed swap device. The historical VM assumption treats anonymous pages as "expensive" to reclaim (requires swap I/O) and file pages as "cheap" (just drop clean cache). However, this assumption is inverted for ZRAM + slow disk scenarios: reclaiming anonymous pages from ZRAM (decompress + discard) is significantly cheaper than reclaiming file pages which may require disk reads to fault back in. This series introduces CONFIG_ZRAM_RECLAIM, a new reclaim policy module that addresses this problem through: 1) Per-lruvec refault cost tracking for anonymous and file pages 2) Dynamic scan balancing based on observed refault pressure 3) CPU vendor auto-tuning for Hisilicon ARM64 platforms The key observation is that when anonymous pages are being refaulted frequently while file pages are not, the system should prioritize reclaiming anonymous pages (which are cheap to re-fault from ZRAM) over file pages (which are expensive to read from disk). Implementation overview: Patch 1 adds the core infrastructure: Kconfig option, mem_cgroup extensions, cost tracking counters, and the scan balancing logic. Patch 2 hooks the module into existing VM paths: do_swap_page for anonymous refaults, workingset_refault for file refaults, and get_scan_count for reclaim decisions. The feature depends on MEMCG and is controlled by the per-memcg 'more_zram' flag, allowing fine-grained control per cgroup. Testing on Hisilicon TSV200 platform with ZRAM as swap device shows significant reduction in file page thrashing and improved application launch times under memory pressure. Ze Zuo (2): mm: add ZRAM-Reclaim infrastructure and policy core mm: hook ZRAM-Reclaim into swap and refault paths include/linux/memcontrol.h | 6 + include/linux/zram_reclaim.h | 25 ++++ mm/Kconfig | 9 ++ mm/Makefile | 1 + mm/memory.c | 8 ++ mm/vmscan.c | 6 + mm/workingset.c | 3 + mm/zram_reclaim.c | 244 +++++++++++++++++++++++++++++++++++ 8 files changed, 302 insertions(+) create mode 100644 include/linux/zram_reclaim.h create mode 100644 mm/zram_reclaim.c -- 2.33.0

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2026-31729
by Hongbo Li 18 May '26

18 May '26

Fix CVE-2026-31729. Nathan Rebello (2): usb: typec: ucsi: validate connector number in ucsi_notify_common() usb: typec: ucsi: skip connector validation before init drivers/usb/typec/ucsi/ucsi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Fix dup panic
by Zizhi Wo 18 May '26

18 May '26

bugfix patches. Al Viro (1): alloc_fdtable(): change calling conventions. Mateusz Guzik (1): fs: consistently deref the files table with rcu_dereference_raw() fs/file.c | 107 +++++++++++++++++++++++++----------------------------- 1 file changed, 50 insertions(+), 57 deletions(-) -- 2.52.0

2 4

[openEuler-1.0-LTS 0/2] mm: introduce ZRAM-Reclaim module for optimized swap-based reclaim
by Ze Zuo 18 May '26

18 May '26

In ZRAM + HDD storage environments, the default LRU-based reclaim policy often struggles to effectively balance anonymous and file-backed pages. The existing algorithm tends to over-reclaim file pages under memory pressure, causing excessive disk I/O and poor system responsiveness when ZRAM is used as a compressed swap device. The historical VM assumption treats anonymous pages as "expensive" to reclaim (requires swap I/O) and file pages as "cheap" (just drop clean cache). However, this assumption is inverted for ZRAM + slow disk scenarios: reclaiming anonymous pages from ZRAM (decompress + discard) is significantly cheaper than reclaiming file pages which may require disk reads to fault back in. This series introduces CONFIG_ZRAM_RECLAIM, a new reclaim policy module that addresses this problem through: 1) Per-lruvec refault cost tracking for anonymous and file pages 2) Dynamic scan balancing based on observed refault pressure 3) CPU vendor auto-tuning for Hisilicon ARM64 platforms The key observation is that when anonymous pages are being refaulted frequently while file pages are not, the system should prioritize reclaiming anonymous pages (which are cheap to re-fault from ZRAM) over file pages (which are expensive to read from disk). Implementation overview: Patch 1 adds the core infrastructure: Kconfig option, mem_cgroup extensions, cost tracking counters, and the scan balancing logic. Patch 2 hooks the module into existing VM paths: do_swap_page for anonymous refaults, workingset_refault for file refaults, and get_scan_count for reclaim decisions. The feature depends on MEMCG and is controlled by the per-memcg 'more_zram' flag, allowing fine-grained control per cgroup. Testing on Hisilicon TSV200 platform with ZRAM as swap device shows significant reduction in file page thrashing and improved application launch times under memory pressure. Ze Zuo (2): mm: add ZRAM-Reclaim infrastructure and policy core mm: hook ZRAM-Reclaim into swap and refault paths include/linux/memcontrol.h | 6 + include/linux/zram_reclaim.h | 25 ++++ mm/Kconfig | 9 ++ mm/Makefile | 1 + mm/memory.c | 8 ++ mm/vmscan.c | 6 + mm/workingset.c | 3 + mm/zram_reclaim.c | 244 +++++++++++++++++++++++++++++++++++ 8 files changed, 302 insertions(+) create mode 100644 include/linux/zram_reclaim.h create mode 100644 mm/zram_reclaim.c -- 2.33.0

1 2

[PATCH OLK-6.6] arm64: entry: Fix missing sync_sei in irq_ventry
by Jinjie Ruan 18 May '26

18 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8929 ---------------------------------------- commit 5a39a4730d80 ("arm64/entry: Add support to synchronize SEI at the exception boundary") changed the standard arm64 exception handling and jump to excetion table directly in order to support hisilicon TF firmware which delegates SEI to lower exception software, but we forgot to update the new interrupt entry "irq_ventry", so add the missing sync_sei. Fixes: 0343d644345c ("arm64: Add arch code for SMT QoS") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/xcall/entry.S | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/xcall/entry.S b/arch/arm64/kernel/xcall/entry.S index 8419a0195792..b7fd442977ce 100644 --- a/arch/arm64/kernel/xcall/entry.S +++ b/arch/arm64/kernel/xcall/entry.S @@ -333,6 +333,7 @@ SYM_CODE_END(el0t_64_irq_table) .macro irq_ventry .align 7 .Lventry_start\@: + sync_sei /* * This must be the first instruction of the EL0 vector entries. It is * skipped by the trampoline vectors, to trigger the cleanup. -- 2.34.1

2 1

[PATCH OLK-6.6] e1000/e1000e: Fix leak in DMA error cleanup
by Pan Taixi 18 May '26

18 May '26

From: Matt Vollrath <tactii(a)gmail.com> stable inclusion from stable-v6.6.130 commit 0a1fc25deabab4efce64610e3c449485c4fa8f5f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/15003 CVE: CVE-2026-43445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ] If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak. In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver") Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error. This issue may still exist in the igbvf driver, but I did not address it in this patch. Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") Assisted-by: Claude:claude-4.6-opus Signed-off-by: Matt Vollrath <tactii(a)gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -- drivers/net/ethernet/intel/e1000e/netdev.c | 2 -- 2 files changed, 4 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index d015a0a85f07..8dcb5d7c5a4b 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -2951,8 +2951,6 @@ static int e1000_tx_map(struct e1000_adapter *adapter, dma_error: dev_err(&pdev->dev, "TX DMA map failed\n"); buffer_info->dma = 0; - if (count) - count--; while (count--) { if (i == 0) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index 7e4fea0e186b..9e9138ccac42 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -5633,8 +5633,6 @@ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb, dma_error: dev_err(&pdev->dev, "Tx DMA map failed\n"); buffer_info->dma = 0; - if (count) - count--; while (count--) { if (i == 0) -- 2.34.1

2 1

[PATCH OLK-6.6] btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 18 May '26

18 May '26

From: Goldwyn Rodrigues <rgoldwyn(a)suse.de> stable inclusion from stable-v6.6.136 commit c09a7446aab5773f38d6abb25fce99b8e1dfbc97 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14618 CVE: CVE-2026-43117 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Goldwyn Rodrigues <rgoldwyn(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- include/trace/events/btrfs.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index f759109caeea..4fef4f8c3138 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -789,12 +789,15 @@ TRACE_EVENT(btrfs_sync_file, ), TP_fast_assign( - const struct dentry *dentry = file->f_path.dentry; - const struct inode *inode = d_inode(dentry); + struct dentry *dentry = file_dentry(file); + struct inode *inode = file_inode(file); + struct dentry *parent = dget_parent(dentry); + struct inode *parent_inode = d_inode(parent); - TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb)); + dput(parent); + TP_fast_assign_fsid(btrfs_sb(inode->i_sb)); __entry->ino = btrfs_ino(BTRFS_I(inode)); - __entry->parent = btrfs_ino(BTRFS_I(d_inode(dentry->d_parent))); + __entry->parent = btrfs_ino(BTRFS_I(parent_inode)); __entry->datasync = datasync; __entry->root_objectid = BTRFS_I(inode)->root->root_key.objectid; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2026-31477
by Li Lingfeng 18 May '26

18 May '26

Jeff Layton (1): ksmbd: use F_SETLK when unlocking a file Werner Kasselman (1): ksmbd: fix memory leaks and NULL deref in smb2_lock() fs/ksmbd/smb2pdu.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] blk-cgroup: skip dying blkg in blkcg_activate_policy()
by Zizhi Wo 16 May '26

16 May '26

From: Zheng Qixing <zhengqixing(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8427 Reference: https://lore.kernel.org/all/20260304073809.3438679-5-yukuai@fnnas.com/ -------------------------------- When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed. Link: https://lore.kernel.org/all/20260108014416.3656493-4-zhengqixing@huaweiclou… Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Signed-off-by: Yu Kuai <yukuai(a)fnnas.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-cgroup.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index ed387265f996..ca5485f04dab 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1580,10 +1580,12 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol) list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) { struct blkg_policy_data *pd; if (blkg->pd[pol->plid]) continue; + if (hlist_unhashed(&blkg->blkcg_node)) + continue; /* If prealloc matches, use it; otherwise try GFP_NOWAIT */ if (blkg == pinned_blkg) { pd = pd_prealloc; pd_prealloc = NULL; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 5 +++++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 22 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 2 ++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 2 ++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 24d045889c6e..e804aea23063 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3221,6 +3221,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 747403de8cb2..4aca4b517005 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3163,6 +3163,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
by Jinjie Ruan 15 May '26

15 May '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.130 commit 816fa1dfae4532e851b1fe6b2434c753ecbd86c7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15045 CVE: CVE-2026-43483 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 87d0f901a9bd8ae6be57249c737f20ac0cace93d ] Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Cc: Naveen N Rao (AMD) <naveen(a)kernel.org> Cc: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Reviewed-by: Naveen N Rao (AMD) <naveen(a)kernel.org> Reviewed-by: Jim Mattson <jmattson(a)google.com> Link: https://patch.msgid.link/20260203190711.458413-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [Squash fix to avic_deactivate_vmcb. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflict: arch/x86/kvm/svm/avic.c [Conflict conflicts.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/kvm/svm/avic.c | 6 +++++- arch/x86/kvm/svm/svm.c | 7 ++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index 6970b11a6b4c..5d4d1d2ebba9 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -88,9 +88,10 @@ static void avic_activate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; - vmcb->control.int_ctl |= AVIC_ENABLE_MASK; + svm_clr_intercept(svm, INTERCEPT_CR8_WRITE); + /* * Note: KVM supports hybrid-AVIC mode, where KVM emulates x2APIC MSR * accesses, while interrupt injection to a running vCPU can be @@ -124,6 +125,9 @@ static void avic_deactivate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; + if (!sev_es_guest(svm->vcpu.kvm)) + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + /* * If running nested and the guest uses its own MSR bitmap, there * is no need to update L0's msr bitmap diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e365c50b6d92..ad25a6995ee6 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1279,8 +1279,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu) svm_set_intercept(svm, INTERCEPT_CR0_WRITE); svm_set_intercept(svm, INTERCEPT_CR3_WRITE); svm_set_intercept(svm, INTERCEPT_CR4_WRITE); - if (!kvm_vcpu_apicv_active(vcpu)) - svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); set_dr_intercepts(svm); @@ -2836,9 +2835,11 @@ static int dr_interception(struct kvm_vcpu *vcpu) static int cr8_write_interception(struct kvm_vcpu *vcpu) { + u8 cr8_prev = kvm_get_cr8(vcpu); int r; - u8 cr8_prev = kvm_get_cr8(vcpu); + WARN_ON_ONCE(kvm_vcpu_apicv_active(vcpu)); + /* instruction emulation calls kvm_set_cr8() */ r = cr_interception(vcpu); if (lapic_in_kernel(vcpu)) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-31709
by Li Lingfeng 15 May '26

15 May '26

Michael Bommarito (2): smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl fs/smb/client/cifsacl.c | 115 +++++++++++++++++++++++++++++----------- 1 file changed, 85 insertions(+), 30 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] ksmbd: validate EaNameLength in smb2_get_ea()
by Li Lingfeng 15 May '26

15 May '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 66751841212c2cc196577453c37f7774ff363f02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14355 CVE: CVE-2026-31612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input buffer received. Fix this up by properly checking the size of the name based on the value received and the overall size of the request, to prevent a later strncmp() call to use the length as a "trusted" size of the buffer. Without this check, uninitialized heap values might be slowly leaked to the client. Cc: Namjae Jeon <linkinjeon(a)kernel.org> Cc: Steve French <smfrench(a)gmail.com> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Tom Talpey <tom(a)talpey.com> Cc: linux-cifs(a)vger.kernel.org Cc: <stable(a)kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 176a6a51be6d..d259201edbf6 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -4243,6 +4243,11 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp, ea_req = (struct smb2_ea_info_req *)((char *)req + le16_to_cpu(req->InputBufferOffset)); + + if (le32_to_cpu(req->InputBufferLength) < + offsetof(struct smb2_ea_info_req, name) + + ea_req->EaNameLength) + return -EINVAL; } else { /* need to send all EAs, if no specific EA is requested*/ if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY) -- 2.52.0

2 2

[PATCH OLK-5.10] ksmbd: fix memory leaks and NULL deref in smb2_lock()
by Li Lingfeng 15 May '26

15 May '26

From: Werner Kasselman <werner(a)verivus.com> mainline inclusion from mainline-v7.0-rc6 commit 309b44ed684496ed3f9c5715d10b899338623512 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14218 CVE: CVE-2026-31477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out: handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock. 2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale. 3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown. Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup. Found via call-graph analysis using sqry. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Suggested-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Werner Kasselman <werner(a)verivus.com> Reviewed-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 176a6a51be6d..e27022b9481a 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -7071,14 +7071,15 @@ int smb2_lock(struct ksmbd_work *work) rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); skip: if (flags & SMB2_LOCKFLAG_UNLOCK) { + locks_free_lock(flock); + kfree(smb_lock); if (!rc) { ksmbd_debug(SMB, "File unlocked\n"); } else if (rc == -ENOENT) { rsp->hdr.Status = STATUS_NOT_LOCKED; + err = rc; goto out; } - locks_free_lock(flock); - kfree(smb_lock); } else { if (rc == FILE_LOCK_DEFERRED) { void **argv; @@ -7158,6 +7159,9 @@ int smb2_lock(struct ksmbd_work *work) list_add(&smb_lock->llist, &rollback_list); ksmbd_debug(SMB, "successful in taking lock\n"); } else { + locks_free_lock(flock); + kfree(smb_lock); + err = rc; goto out; } } @@ -7185,13 +7189,17 @@ int smb2_lock(struct ksmbd_work *work) struct file_lock *rlock = NULL; rlock = smb_flock_init(filp); - rlock->fl_type = F_UNLCK; - rlock->fl_start = smb_lock->start; - rlock->fl_end = smb_lock->end; + if (rlock) { + rlock->fl_type = F_UNLCK; + rlock->fl_start = smb_lock->start; + rlock->fl_end = smb_lock->end; - rc = vfs_lock_file(filp, 0, rlock, NULL); - if (rc) - pr_err("rollback unlock fail : %d\n", rc); + rc = vfs_lock_file(filp, F_SETLK, rlock, NULL); + if (rc) + pr_err("rollback unlock fail : %d\n", rc); + } else { + pr_err("rollback unlock alloc failed\n"); + } list_del(&smb_lock->llist); spin_lock(&work->conn->llist_lock); @@ -7201,7 +7209,8 @@ int smb2_lock(struct ksmbd_work *work) spin_unlock(&work->conn->llist_lock); locks_free_lock(smb_lock->fl); - locks_free_lock(rlock); + if (rlock) + locks_free_lock(rlock); kfree(smb_lock); } out2: -- 2.52.0

2 1

[PATCH OLK-5.10] ksmbd: require 3 sub-authorities before reading sub_auth[2]
by Li Lingfeng 15 May '26

15 May '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 53370cf9090777774e07fd9a8ebce67c6cc333ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14354 CVE: CVE-2026-31611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth, 2) sub-authorities so a client SID with num_subauth = 2 and sub_auth = {88, 3} will match. If num_subauth = 2 and the ACE is placed at the very end of the security descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen. Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all. Cc: Namjae Jeon <linkinjeon(a)kernel.org> Cc: Steve French <smfrench(a)gmail.com> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Tom Talpey <tom(a)talpey.com> Cc: linux-cifs(a)vger.kernel.org Cc: <stable(a)kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..859b88f0de88 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -439,7 +439,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, ppace[i]->access_req = smb_map_generic_desired_access(ppace[i]->access_req); - if (!(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) { + if (ppace[i]->sid.num_subauth >= 3 && + !(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) { fattr->cf_mode = le32_to_cpu(ppace[i]->sid.sub_auth[2]); break; -- 2.52.0

2 1

[PATCH OLK-6.6 v12 0/6] SMT QOS
by Jinjie Ruan 15 May '26

15 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v12: - Fix backup_select_cpus not set NULL. - Use separate patch to move dynamic affinity helper functions to sched.h - include smt_qos.c in build_policy.c. - Simplify set_qos_task_select_cpus(). Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (6): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Move dynamic affinity helper functions to sched.h sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 13 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/build_policy.c | 4 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 107 ++++++++----- kernel/sched/features.h | 4 + kernel/sched/sched.h | 86 ++++++++-- kernel/sched/smt_qos.c | 209 +++++++++++++++++++++++++ 19 files changed, 676 insertions(+), 68 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 7

[PATCH OLK-6.6 v12 0/6] SMT QOS
by Jinjie Ruan 15 May '26

15 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v12: - Fix backup_select_cpus not set NULL. - Use separate patch to move dynamic affinity helper functions to sched.h - include smt_qos.c in build_policy.c. - Simplify set_qos_task_select_cpus(). Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (6): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Move dynamic affinity helper functions to sched.h sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 13 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/build_policy.c | 4 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 114 ++++++++------ kernel/sched/features.h | 4 + kernel/sched/sched.h | 93 +++++++++-- kernel/sched/smt_qos.c | 209 +++++++++++++++++++++++++ 19 files changed, 683 insertions(+), 75 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 7

[PATCH OLK-6.6] ceph: add a bunch of missing ceph_path_info initializers
by Pan Taixi 15 May '26

15 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.0-rc4 commit 43323a5934b660afae687e8e4e95ac328615a5c4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14967 CVE: CVE-2026-43408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info() may crash. Example crash (on Linux 6.18.12): virt_to_cache: Object is not a Slab page! WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400 [...] Call Trace: [...] ceph_open+0x13d/0x3e0 do_dentry_open+0x134/0x480 vfs_open+0x2a/0xe0 path_openat+0x9a3/0x1160 [...] cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400 [...] kernel BUG at mm/slub.c:634! Oops: invalid opcode: 0000 [#1] SMP NOPTI RIP: 0010:__slab_free+0x1a4/0x350 Some of the ceph_mdsc_build_path() callers had initializers, but others had not, even though they were all added by commit 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state"). The ones without initializer are suspectible to random crashes. (I can imagine it could even be possible to exploit this bug to elevate privileges.) Unfortunately, these Ceph functions are undocumented and its semantics can only be derived from the code. I see that ceph_mdsc_build_path() initializes the structure only on success, but not on error. Calling ceph_mdsc_free_path_info() after a failed ceph_mdsc_build_path() call does not even make sense, but that's what all callers do, and for it to be safe, the structure must be zero-initialized. The least intrusive approach to fix this is therefore to add initializers everywhere. Cc: stable(a)vger.kernel.org Fixes: 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/debugfs.c fs/ceph/dir.c fs/ceph/file.c fs/ceph/inode.c [Context conflicts in fs/ceph/debugfs.c. For other files, struct ceph_path_info path_info are all properly initialized to {0}] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c index f00b333676d9..b44e44709e0a 100644 --- a/fs/ceph/debugfs.c +++ b/fs/ceph/debugfs.c @@ -79,7 +79,7 @@ static int mdsc_show(struct seq_file *s, void *p) if (req->r_inode) { seq_printf(s, " #%llx", ceph_ino(req->r_inode)); } else if (req->r_dentry) { - struct ceph_path_info path_info; + struct ceph_path_info path_info = {0}; path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); if (IS_ERR(path)) @@ -99,7 +99,7 @@ static int mdsc_show(struct seq_file *s, void *p) } if (req->r_old_dentry) { - struct ceph_path_info path_info; + struct ceph_path_info path_info = {0}; path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0); if (IS_ERR(path)) -- 2.34.1

2 1

[PATCH OLK-6.6] apei: use blocking notifier for page offline policy chain
by Qi Xi 15 May '26

15 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9170 ------------------------------------------------------- atomic_notifier_call_chain() holds rcu_read_lock() over callbacks, which prevents sleeping. Notifier callbacks such as ipmi_pso_notifier_call() need to sleep for IPMI completion, triggering a BUG: sleeping function called from invalid context. Switch apei_page_offline_notifier_chain to a blocking notifier to allow callbacks to safely sleep when invoked from sysctl write path. Fixes: 543fadb5575a ("apei/ghes: Add sysctl interface to control soft-offline page isolation") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/apei/ghes-policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes-policy.c b/drivers/acpi/apei/ghes-policy.c index 87c611f2cbaa..0bc12b0ba32b 100644 --- a/drivers/acpi/apei/ghes-policy.c +++ b/drivers/acpi/apei/ghes-policy.c @@ -17,18 +17,18 @@ int sysctl_apei_page_offline_policy __read_mostly = APEI_PAGE_OFFLINE_ALLOW_BASE_PAGE; EXPORT_SYMBOL(sysctl_apei_page_offline_policy); -static ATOMIC_NOTIFIER_HEAD(apei_page_offline_notifier_chain); +static BLOCKING_NOTIFIER_HEAD(apei_page_offline_notifier_chain); int register_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_register( + return blocking_notifier_chain_register( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(register_apei_page_offline_notifier); int unregister_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_unregister( + return blocking_notifier_chain_unregister( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(unregister_apei_page_offline_notifier); @@ -48,7 +48,7 @@ static int apei_page_offline_policy_handler(struct ctl_table *table, pr_debug("APEI policy: 0x%x -> 0x%x\n", old_val, new_val); if ((old_val ^ new_val) & APEI_PAGE_OFFLINE_NOTIFY) - atomic_notifier_call_chain( + blocking_notifier_call_chain( &apei_page_offline_notifier_chain, 0, &new_val); } -- 2.33.0

2 1

[PATCH OLK-6.6] dm: clear cloned request bio pointer when last clone bio completes
by Li Lingfeng 14 May '26

14 May '26

From: Michael Liang <mliang(a)purestorage.com> stable inclusion from stable-v6.6.128 commit 7daf279c674d515fb22a727a7bbc92aeb35c5442 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14830 CVE: CVE-2026-43278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ] Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-multipath on top of a PCIe NVMe namespace, where cloned request bios are freed during blk_complete_request(), but rq->bio is left intact. Subsequent clone teardown then attempts to free the same bios again via blk_rq_unprep_clone(). The resulting double-free path looks like: nvme_pci_complete_batch() nvme_complete_batch() blk_mq_end_request_batch() blk_complete_request() // called on a DM clone request bio_endio() // first free of all clone bios ... rq->end_io() // end_clone_request() dm_complete_request(tio->orig) dm_softirq_done() dm_done() dm_end_request() blk_rq_unprep_clone() // second free of clone bios Fix this by clearing the clone request's bio pointer when the last cloned bio completes, ensuring that later teardown paths do not attempt to free already-released bios. Signed-off-by: Michael Liang <mliang(a)purestorage.com> Reviewed-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-rq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c index 499f8cc8a39f..5bcf020df856 100644 --- a/drivers/md/dm-rq.c +++ b/drivers/md/dm-rq.c @@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone) */ tio->completed += nr_bytes; + if (!is_last) + return; + /* + * At this moment we know this is the last bio of the cloned request, + * and all cloned bios have been released, so reset the clone request's + * bio pointer to avoid double free. + */ + tio->clone->bio = NULL; + exit: /* * Update the original request. * Do not use blk_mq_end_request() here, because it may complete * the original request before the clone, and break the ordering. */ - if (is_last) - exit: - blk_update_request(tio->orig, BLK_STS_OK, tio->completed); + blk_update_request(tio->orig, BLK_STS_OK, tio->completed); } static struct dm_rq_target_io *tio_from_request(struct request *rq) -- 2.52.0

2 1

[PATCH OLK-6.6] dm: clear cloned request bio pointer when last clone bio completes
by Li Lingfeng 14 May '26

14 May '26

From: Michael Liang <mliang(a)purestorage.com> stable inclusion from stable-v6.6.128 commit 7daf279c674d515fb22a727a7bbc92aeb35c5442 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-43278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ] Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-multipath on top of a PCIe NVMe namespace, where cloned request bios are freed during blk_complete_request(), but rq->bio is left intact. Subsequent clone teardown then attempts to free the same bios again via blk_rq_unprep_clone(). The resulting double-free path looks like: nvme_pci_complete_batch() nvme_complete_batch() blk_mq_end_request_batch() blk_complete_request() // called on a DM clone request bio_endio() // first free of all clone bios ... rq->end_io() // end_clone_request() dm_complete_request(tio->orig) dm_softirq_done() dm_done() dm_end_request() blk_rq_unprep_clone() // second free of clone bios Fix this by clearing the clone request's bio pointer when the last cloned bio completes, ensuring that later teardown paths do not attempt to free already-released bios. Signed-off-by: Michael Liang <mliang(a)purestorage.com> Reviewed-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-rq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c index 499f8cc8a39f..5bcf020df856 100644 --- a/drivers/md/dm-rq.c +++ b/drivers/md/dm-rq.c @@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone) */ tio->completed += nr_bytes; + if (!is_last) + return; + /* + * At this moment we know this is the last bio of the cloned request, + * and all cloned bios have been released, so reset the clone request's + * bio pointer to avoid double free. + */ + tio->clone->bio = NULL; + exit: /* * Update the original request. * Do not use blk_mq_end_request() here, because it may complete * the original request before the clone, and break the ordering. */ - if (is_last) - exit: - blk_update_request(tio->orig, BLK_STS_OK, tio->completed); + blk_update_request(tio->orig, BLK_STS_OK, tio->completed); } static struct dm_rq_target_io *tio_from_request(struct request *rq) -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 14 May '26

14 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14783 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..a051f205589a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH OLK-5.10] ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
by Li Lingfeng 14 May '26

14 May '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.1-rc1 commit 299f962c0b02d048fb45d248b4da493d03f3175d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14454 CVE: CVE-2026-31704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value. Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c. Cc: stable(a)vger.kernel.org Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move smbacl.c to fs/smb/server/.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..44485451a6f0 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -582,6 +582,7 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, struct smb_sid *sid; struct smb_ace *ntace; int i, j; + u16 ace_sz; if (!fattr->cf_acls) goto posix_default_acl; @@ -626,8 +627,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, flags = 0x03; ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -636,8 +639,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, if (S_ISDIR(fattr->cf_mode) && (pace->e_tag == ACL_USER || pace->e_tag == ACL_GROUP)) { ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x03, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -677,8 +682,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, } ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -712,7 +719,8 @@ static void set_ntacl_dacl(struct smb_acl *pndacl, struct smb_acl *nt_dacl, break; memcpy((char *)pndace + size, ntace, nt_ace_size); - size += nt_ace_size; + if (check_add_overflow(size, nt_ace_size, &size)) + break; aces_size -= nt_ace_size; ntace = (struct smb_ace *)((char *)ntace + nt_ace_size); num_aces++; -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 14 May '26

14 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..a051f205589a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 655 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-6.6] bpf-rvi: Fix possible AA deadlock pidns_list_lock
by Gu Bowen 14 May '26

14 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9171 -------------------------------- Spin lock pidns_list_lock is used in both process context and bottom half, which may cause the AA deadlock issue. Replace spin_lock with spin_lock_bh to resolve this problem. Call trace: native_queued_spin_lock_slowpath+0x71/0x428 destroy_pid_namespace+0x100/0x110 put_pid_ns+0x90/0xc8 put_pid+0x8c/0xc8 delayed_put_pid+0x1c/0x30 rcu_do_batch+0x164/0x580 rcu_core+0x130/0x2b8 rcu_core_si+0x18/0x30 handle_softirqs+0x120/0x328 __do_softirq+0x1c/0x28 ____do_softirq+0x18/0x30 call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0x108/0x130 el1_interrupt+0x54/0x130 el1h_64_irq_handler+0x24/0x30 el1h_64_irq+0x78/0x80 create_pid_namespace+0x214/0x3c0 copy_pid_ns+0x90/0xf0 create_new_namespaces+0xc8/0x368 unshare_nsproxy_namespaces+0x6c/0xc0 ksys_unshare+0x130/0x418 __arm64_sys_unshare+0x1c/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3c8/0x3d0 Fixes: d758abf3762c ("bpf-rvi: pidns: Calculate loadavg for each pid namespace") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/pid_namespace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index b321c02f382e..0bfd9ff3a6b8 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -128,9 +128,9 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns ns->loadavg = kmem_cache_zalloc(pidns_loadavg_cachep, GFP_KERNEL); if (ns->loadavg == NULL) goto out_free_idr; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_add_tail(&ns->loadavg->list, &init_pidns_loadavg.list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); #endif return ns; @@ -164,9 +164,9 @@ static void destroy_pid_namespace(struct pid_namespace *ns) * ns->loadavg's lifecycle aligns precisely with ns, * so don't need RCU delayed free. */ - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_del(&ns->loadavg->list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); kmem_cache_free(pidns_loadavg_cachep, ns->loadavg); #endif call_rcu(&ns->rcu, delayed_free_pidns); @@ -537,13 +537,13 @@ static void pidns_list_reset(void) { struct list_head *pos, *tmp; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_for_each_safe(pos, tmp, &init_pidns_loadavg.list) { struct pidns_loadavg *entry = list_entry(pos, struct pidns_loadavg, list); entry->load_tasks = 0; // reset } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_update_load_tasks(void) @@ -574,7 +574,7 @@ static void pidns_calc_avenrun(void) { struct list_head *pos; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); /* * As the loadavg of init_pid_ns is exactly /proc/loadavg, avoid redundant * re-calculation for init_pid_ns, and reuse init_pidns_loadavg.list as the @@ -590,7 +590,7 @@ static void pidns_calc_avenrun(void) entry->avenrun[1] = calc_load(entry->avenrun[1], EXP_5, active); entry->avenrun[2] = calc_load(entry->avenrun[2], EXP_15, active); } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_calc_loadavg_workfn(struct work_struct *work) -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-31709
by Li Lingfeng 14 May '26

14 May '26

Michael Bommarito (2): smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl fs/smb/client/cifsacl.c | 114 +++++++++++++++++++++++++++++----------- 1 file changed, 84 insertions(+), 30 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 655 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on 920G: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 14 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 656 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-5.10] ksmbd: require minimum ACE size in smb_check_perm_dacl()
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit d07b26f39246a82399661936dd0c853983cfade7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14462 CVE: CVE-2026-31712 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first check only requires the 4-byte ACE header to be in bounds; it does not require access_req (4 bytes at offset 4) to be readable. An attacker who has set a crafted DACL on a file they own can declare ace->size == 4 with aces_size == 4, pass both checks, and then granted |= le32_to_cpu(ace->access_req); /* upper loop */ compare_sids(&sid, &ace->sid); /* lower loop */ reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes). Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE which is the smallest valid on-wire ACE layout (4-byte header + 4-byte access_req + 8-byte sid base with zero sub-auths). Also reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before letting compare_sids() dereference sub_auth[] entries. parse_sec_desc() already enforces an equivalent check (lines 441-448); smb_check_perm_dacl() simply grew weaker validation over time. Reachability: authenticated SMB client with permission to set an ACL on a file. On a subsequent CREATE against that file, the kernel walks the stored DACL via smb_check_perm_dacl() and triggers the OOB read. Not pre-auth, and the OOB read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Commit 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d ("smb: common: change the data type of num_aces to le16") change the data type of num_aces to le16.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..b23b725cf8c3 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1258,10 +1258,13 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; granted |= le32_to_cpu(ace->access_req); @@ -1279,13 +1282,19 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; + if (ace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) + break; + if (!compare_sids(&sid, &ace->sid) || !compare_sids(&sid_unix_NFS_mode, &ace->sid)) { found = 1; -- 2.52.0

2 1

[PATCH OLK-6.6] bpf-rvi: Fix possible AA deadlock pidns_list_lock
by Gu Bowen 14 May '26

14 May '26

hulk inclusion category: bugfix bugzilla: -------------------------------- Spin lock pidns_list_lock is used in both process context and bottom half, which may cause the AA deadlock issue. Replace spin_lock with spin_lock_bh to resolve this problem. Call trace: native_queued_spin_lock_slowpath+0x71/0x428 destroy_pid_namespace+0x100/0x110 put_pid_ns+0x90/0xc8 put_pid+0x8c/0xc8 delayed_put_pid+0x1c/0x30 rcu_do_batch+0x164/0x580 rcu_core+0x130/0x2b8 rcu_core_si+0x18/0x30 handle_softirqs+0x120/0x328 __do_softirq+0x1c/0x28 ____do_softirq+0x18/0x30 call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0x108/0x130 el1_interrupt+0x54/0x130 el1h_64_irq_handler+0x24/0x30 el1h_64_irq+0x78/0x80 create_pid_namespace+0x214/0x3c0 copy_pid_ns+0x90/0xf0 create_new_namespaces+0xc8/0x368 unshare_nsproxy_namespaces+0x6c/0xc0 ksys_unshare+0x130/0x418 __arm64_sys_unshare+0x1c/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3c8/0x3d0 Fixes: d758abf3762c ("bpf-rvi: pidns: Calculate loadavg for each pid namespace") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/pid_namespace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index b321c02f382e..0bfd9ff3a6b8 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -128,9 +128,9 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns ns->loadavg = kmem_cache_zalloc(pidns_loadavg_cachep, GFP_KERNEL); if (ns->loadavg == NULL) goto out_free_idr; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_add_tail(&ns->loadavg->list, &init_pidns_loadavg.list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); #endif return ns; @@ -164,9 +164,9 @@ static void destroy_pid_namespace(struct pid_namespace *ns) * ns->loadavg's lifecycle aligns precisely with ns, * so don't need RCU delayed free. */ - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_del(&ns->loadavg->list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); kmem_cache_free(pidns_loadavg_cachep, ns->loadavg); #endif call_rcu(&ns->rcu, delayed_free_pidns); @@ -537,13 +537,13 @@ static void pidns_list_reset(void) { struct list_head *pos, *tmp; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_for_each_safe(pos, tmp, &init_pidns_loadavg.list) { struct pidns_loadavg *entry = list_entry(pos, struct pidns_loadavg, list); entry->load_tasks = 0; // reset } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_update_load_tasks(void) @@ -574,7 +574,7 @@ static void pidns_calc_avenrun(void) { struct list_head *pos; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); /* * As the loadavg of init_pid_ns is exactly /proc/loadavg, avoid redundant * re-calculation for init_pid_ns, and reuse init_pidns_loadavg.list as the @@ -590,7 +590,7 @@ static void pidns_calc_avenrun(void) entry->avenrun[1] = calc_load(entry->avenrun[1], EXP_5, active); entry->avenrun[2] = calc_load(entry->avenrun[2], EXP_15, active); } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_calc_loadavg_workfn(struct work_struct *work) -- 2.43.0

2 1

[PATCH OLK-6.6] cifs: some missing initializations on replay
by Li Lingfeng 14 May '26

14 May '26

From: Shyam Prasad N <sprasad(a)microsoft.com> stable inclusion from stable-v6.6.128 commit c854ab481ece4b3e5f4c2e8b22824f015ff874a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14443 CVE: CVE-2026-31693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ] In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable(a)vger.kernel.org Reported-by: Yuchan Nam <entropy1110(a)gmail.com> Tested-by: Yuchan Nam <entropy1110(a)gmail.com> Signed-off-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 2 ++ fs/smb/client/smb2pdu.c | 1 + 2 files changed, 3 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..324d2382dfef 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1147,6 +1147,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, replay_again: /* reinitialize for possible replay */ + used_len = 0; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); @@ -1545,6 +1546,7 @@ smb2_ioctl_query_info(const unsigned int xid, replay_again: /* reinitialize for possible replay */ + buffer = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 493e4ae3842a..dbee701a478a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2851,6 +2851,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, replay_again: /* reinitialize for possible replay */ + pc_buf = NULL; flags = 0; n_iov = 2; server = cifs_pick_channel(ses); -- 2.52.0

2 1

[PATCH OLK-6.6 v3 0/3] optimize copy_from_user
by Qi Xi 14 May '26

14 May '26

This patchset adds an optimized copy_from_user path for Hisilicon HIP11/HIP12/Linxicore9100, using ldp/stp instructions with PAN temporarily disabled during the copy. Patch 1 adds the HIP11 MIDR definition. Patch 2 implements the optimized path and the raw_copy_from_user routing. Patch 3 adds CONFIG_ARM64_COPY_FROM_USER_OPT compile-time gating. v3 changes: - add CONFIG_ARM64_COPY_FROM_USER_OPT to openeuler_defconfig v2 changes: - add HISI_CPU_PART_HIP11 - merge the asm implementation and the uaccess.h routing into a single patch to avoid bisect breakage - fix compile error when CONFIG_ARM64_COPY_FROM_USER_OPT=n Qi Xi (3): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: uaccess: add optimized copy_from_user for Hisilicon platforms arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig.turbo | 11 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/asm-uaccess.h | 11 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 30 ++- arch/arm64/kernel/cpufeature.c | 36 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 11 files changed, 323 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4