- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ip6_gre: Use cached t->net in ip6erspan_changelink().
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Maoyi Xie <maoyixie.tju(a)gmail.com> mainline inclusion from mainline-v7.1-rc3 commit 1d324c2f43f70c965f25c58cc3611c779adbe47e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15387 CVE: CVE-2026-46120 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration. This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape. Fixes: 2d665034f239 ("net: ip6_gre: Fix ip6erspan hlen calculation") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie <maoyi.xie(a)ntu.edu.sg> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260430103318.3206018-1-maoyi.xie@ntu.edu.sg Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ip6_gre.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c index ea880805ddf5..7d870eb5061d 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -2295,10 +2295,11 @@ static int ip6erspan_changelink(struct net_device *dev, struct nlattr *tb[], struct nlattr *data[], struct netlink_ext_ack *extack) { - struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id); + struct ip6_tnl *t = netdev_priv(dev); struct __ip6_tnl_parm p; - struct ip6_tnl *t; + struct ip6gre_net *ign; + ign = net_generic(t->net, ip6gre_net_id); t = ip6gre_changelink_common(dev, tb, data, &p, extack); if (IS_ERR(t)) return PTR_ERR(t); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
by Hongtao Zhang 03 Jun '26

03 Jun '26

From: Ashutosh Desai <ashutoshdesai993(a)gmail.com> stable inclusion from stable-v6.6.140 commit 6b992591e04f2cce813bcf239b354f375bbf84d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15462 CVE: CVE-2026-46209 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3d4c2268bd7243c3780fe32bf24ff876da272acf upstream. drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which round up dimensions via DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations. For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX as an unsigned int, causing min_size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds. Fix by replacing the open-coded divisions with drm_format_info_plane_width() and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the calculation already used in framebuffer_check(). Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library") Cc: stable(a)vger.kernel.org # v4.14+ Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Ashutosh Desai <ashutoshdesai993(a)gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/drm_gem_framebuffer_helper.c [Not merge bf39607c1614 and f2b816d78a94] Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c index 2810d4131411..42c396d47d51 100644 --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c @@ -158,8 +158,10 @@ drm_gem_fb_create_with_funcs(struct drm_device *dev, struct drm_file *file, return ERR_PTR(-EINVAL); for (i = 0; i < info->num_planes; i++) { - unsigned int width = mode_cmd->width / (i ? info->hsub : 1); - unsigned int height = mode_cmd->height / (i ? info->vsub : 1); + unsigned int width = i ? DIV_ROUND_UP(mode_cmd->width, info->hsub) : + mode_cmd->width; + unsigned int height = i ? DIV_ROUND_UP(mode_cmd->height, info->vsub) : + mode_cmd->height; unsigned int min_size; objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]); -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] fix CVE-2026-45893
by Gu Bowen 03 Jun '26

03 Jun '26

fix CVE-2026-45893 Helge Deller (2): AppArmor: Allow apparmor to handle unaligned dfa tables apparmor: Fix & Optimize table creation from possibly unaligned memory security/apparmor/include/match.h | 12 +++++++----- security/apparmor/match.c | 22 +++++++++++----------- 2 files changed, 18 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] ipmi: Add limits to event and receive message requests
by Zhao Yipeng 03 Jun '26

03 Jun '26

From: Corey Minyard <corey(a)minyard.net> mainline inclusion from mainline-v7.1-rc3 commit c4cca236968683eb0d59abfb12d5c7e4d8514227 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15454 CVE: CVE-2026-46177 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition, an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck, it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck. This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver. It's not a bug per-se, but it is accounting for bugs in BMCs. Reported-by: Matt Fleming <mfleming(a)cloudflare.com> Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/ Fixes: <1da177e4c3f4> ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Corey Minyard <corey(a)minyard.net> Conflicts: drivers/char/ipmi/ipmi_si_intf.c [Context conflicts.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/char/ipmi/ipmi_si_intf.c | 54 +++++++++++++++++++++++++------- drivers/char/ipmi/ipmi_ssif.c | 23 ++++++++++++-- 2 files changed, 64 insertions(+), 13 deletions(-) diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c index 955bb53def90..56684f0ed4fa 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -160,6 +160,10 @@ struct smi_info { OEM2_DATA_AVAIL) unsigned char msg_flags; + /* When requesting events and messages, don't do it forever. */ + unsigned int num_requests_in_a_row; + bool last_was_flag_fetch; + /* Does the BMC have an event buffer? */ bool has_event_buffer; @@ -397,7 +401,10 @@ static void start_getting_msg_queue(struct smi_info *smi_info) start_new_msg(smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); - smi_info->si_state = SI_GETTING_MESSAGES; + if (smi_info->si_state != SI_GETTING_MESSAGES) { + smi_info->num_requests_in_a_row = 0; + smi_info->si_state = SI_GETTING_MESSAGES; + } } static void start_getting_events(struct smi_info *smi_info) @@ -408,7 +415,10 @@ static void start_getting_events(struct smi_info *smi_info) start_new_msg(smi_info, smi_info->curr_msg->data, smi_info->curr_msg->data_size); - smi_info->si_state = SI_GETTING_EVENTS; + if (smi_info->si_state != SI_GETTING_EVENTS) { + smi_info->num_requests_in_a_row = 0; + smi_info->si_state = SI_GETTING_EVENTS; + } } /* @@ -582,6 +592,7 @@ static void handle_transaction_done(struct smi_info *smi_info) smi_info->si_state = SI_NORMAL; } else { smi_info->msg_flags = msg[3]; + smi_info->last_was_flag_fetch = true; handle_flags(smi_info); } break; @@ -627,6 +638,11 @@ static void handle_transaction_done(struct smi_info *smi_info) } else { smi_inc_stat(smi_info, events); + smi_info->num_requests_in_a_row++; + if (smi_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; + /* * Do this before we deliver the message * because delivering the message releases the @@ -665,6 +681,11 @@ static void handle_transaction_done(struct smi_info *smi_info) } else { smi_inc_stat(smi_info, incoming_messages); + smi_info->num_requests_in_a_row++; + if (smi_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL; + /* * Do this before we deliver the message * because delivering the message releases the @@ -792,6 +813,26 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info, goto restart; } + /* + * If we are currently idle, or if the last thing that was + * done was a flag fetch and there is a message pending, try + * to start the next message. + * + * We do the waiting message check to avoid a stuck flag + * completely wedging the driver. Let a message through + * in between flag operations if that happens. + */ + if (si_sm_result == SI_SM_IDLE || + (si_sm_result == SI_SM_ATTN && smi_info->waiting_msg && + smi_info->last_was_flag_fetch)) { + smi_info->last_was_flag_fetch = false; + smi_inc_stat(smi_info, idles); + + si_sm_result = start_next_msg(smi_info); + if (si_sm_result != SI_SM_IDLE) + goto restart; + } + /* * We prefer handling attn over new messages. But don't do * this if there is not yet an upper layer to handle anything. @@ -825,15 +866,6 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info, } } - /* If we are currently idle, try to start the next message. */ - if (si_sm_result == SI_SM_IDLE) { - smi_inc_stat(smi_info, idles); - - si_sm_result = start_next_msg(smi_info); - if (si_sm_result != SI_SM_IDLE) - goto restart; - } - if ((si_sm_result == SI_SM_IDLE) && (atomic_read(&smi_info->req_events))) { /* diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c index 3160f6565f33..f15db2d2134f 100644 --- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -227,6 +227,9 @@ struct ssif_info { bool has_event_buffer; bool supports_alert; + /* When requesting events and messages, don't do it forever. */ + unsigned int num_requests_in_a_row; + /* * Used to tell what we should do with alerts. If we are * waiting on a response, read the data immediately. @@ -415,7 +418,10 @@ static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags) } ssif_info->curr_msg = msg; - ssif_info->ssif_state = SSIF_GETTING_EVENTS; + if (ssif_info->ssif_state != SSIF_GETTING_EVENTS) { + ssif_info->num_requests_in_a_row = 0; + ssif_info->ssif_state = SSIF_GETTING_EVENTS; + } ipmi_ssif_unlock_cond(ssif_info, flags); msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); @@ -438,7 +444,10 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info, } ssif_info->curr_msg = msg; - ssif_info->ssif_state = SSIF_GETTING_MESSAGES; + if (ssif_info->ssif_state != SSIF_GETTING_MESSAGES) { + ssif_info->num_requests_in_a_row = 0; + ssif_info->ssif_state = SSIF_GETTING_MESSAGES; + } ipmi_ssif_unlock_cond(ssif_info, flags); msg->data[0] = (IPMI_NETFN_APP_REQUEST << 2); @@ -847,6 +856,11 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; handle_flags(ssif_info, flags); } else { + ssif_info->num_requests_in_a_row++; + if (ssif_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + ssif_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL; + handle_flags(ssif_info, flags); ssif_inc_stat(ssif_info, events); deliver_recv_msg(ssif_info, msg); @@ -871,6 +885,11 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL; handle_flags(ssif_info, flags); } else { + ssif_info->num_requests_in_a_row++; + if (ssif_info->num_requests_in_a_row > 10) + /* Stop if we do this too many times. */ + ssif_info->msg_flags &= ~RECEIVE_MSG_AVAIL; + ssif_inc_stat(ssif_info, incoming_messages); handle_flags(ssif_info, flags); deliver_recv_msg(ssif_info, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bonding: alb: fix UAF in rlb_arp_recv during bond up/down
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Hangbin Liu <liuhangbin(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit e6834a4c474697df23ab9948fd3577b26bf48656 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15209 CVE: CVE-2026-45970 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN. However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag. [ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] <IRQ> [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] </IRQ> The issue is reproducible by repeatedly running ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry. Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize(). Reported-by: Liang Li <liali(a)redhat.com> Fixes: 3aba891dde38 ("bonding: move processing of recv handlers into handle_frame()") Reviewed-by: Nikolay Aleksandrov <nikolay(a)nvidia.com> Acked-by: Jay Vosburgh <jv(a)jvosburgh.net> Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Link: https://patch.msgid.link/20260218060919.101574-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/bonding/bond_main.c [commit ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad") is not backported, so the target kernel has a simplified bond_close() without the BOND_MODE_8023AD block, causing patch context mismatch. Applied the core fix (WRITE_ONCE + synchronize_net + removing the old bond->recv_probe = NULL) while keeping the target's existing code structure.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 56c16b171e35..30a9bf8804ac 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -3475,9 +3475,13 @@ static int bond_close(struct net_device *bond_dev) bond_work_cancel_all(bond); bond->send_peer_notif = 0; + WRITE_ONCE(bond->recv_probe, NULL); + + /* Wait for any in-flight RX handlers */ + synchronize_net(); + if (bond_is_lb(bond)) bond_alb_deinitialize(bond); - bond->recv_probe = NULL; return 0; } -- 2.43.0

2 1

[PATCH] bonding: alb: fix UAF in rlb_arp_recv during bond up/down
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Hangbin Liu <liuhangbin(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit e6834a4c474697df23ab9948fd3577b26bf48656 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15209 CVE: CVE-2026-45970 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN. However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag. [ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] <IRQ> [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] </IRQ> The issue is reproducible by repeatedly running ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry. Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize(). Reported-by: Liang Li <liali(a)redhat.com> Fixes: 3aba891dde38 ("bonding: move processing of recv handlers into handle_frame()") Reviewed-by: Nikolay Aleksandrov <nikolay(a)nvidia.com> Acked-by: Jay Vosburgh <jv(a)jvosburgh.net> Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Link: https://patch.msgid.link/20260218060919.101574-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/bonding/bond_main.c [commit ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad") is not backported, so the target kernel has a simplified bond_close() without the BOND_MODE_8023AD block, causing patch context mismatch. Applied the core fix (WRITE_ONCE + synchronize_net + removing the old bond->recv_probe = NULL) while keeping the target's existing code structure.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 56c16b171e35..30a9bf8804ac 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -3475,9 +3475,13 @@ static int bond_close(struct net_device *bond_dev) bond_work_cancel_all(bond); bond->send_peer_notif = 0; + WRITE_ONCE(bond->recv_probe, NULL); + + /* Wait for any in-flight RX handlers */ + synchronize_net(); + if (bond_is_lb(bond)) bond_alb_deinitialize(bond); - bond->recv_probe = NULL; return 0; } -- 2.43.0

1 0

[PATCH OLK-5.10] KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
by Zhang Kunbo 03 Jun '26

03 Jun '26

From: Yosry Ahmed <yosry(a)kernel.org> stable inclusion from stable-v6.6.140 commit 1709418535a8df95532999d61b03d59975280258 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15238 CVE: CVE-2026-45987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 03bee264f8ebfd39e0254c98e112d033a7aa9055 upstream. After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is used as the authoritative copy of some of the controls, and is the payload when saving/restoring nested state. int_state is also written by the CPU, specifically bit 0 (i.e. SVM_INTERRUPT_SHADOW_MASK) for nested VMs, but it is not sync'd to cached vmcb12. This does not cause a problem if KVM_SET_NESTED_STATE preceeds KVM_SET_VCPU_EVENTS in the restore path, as an interrupt shadow would be correctly restored to vmcb02 (KVM_SET_VCPU_EVENTS overwrites what KVM_SET_NESTED_STATE restored in int_state). However, if KVM_SET_VCPU_EVENTS preceeds KVM_SET_NESTED_STATE, an interrupt shadow would be restored into vmcb01 instead of vmcb02. This would mostly be benign for L1 (delays an interrupt), but not for L2. For L2, the vCPU could hang (e.g. if a wakeup interrupt is delivered before a HLT that should have been in an interrupt shadow). Sync int_state to the cached vmcb12 in nested_sync_control_from_vmcb02() to avoid this problem. With that, KVM_SET_NESTED_STATE restores the correct interrupt shadow state, and if KVM_SET_VCPU_EVENTS follows it would overwrite it with the same value. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable(a)vger.kernel.org Signed-off-by: Yosry Ahmed <yosry(a)kernel.org> Link: https://patch.msgid.link/20260225005950.3739782-3-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/nested.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 382ff1b18161..6dcd9b4cae29 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -307,6 +307,7 @@ void sync_nested_vmcb_control(struct vcpu_svm *svm) u32 mask; svm->nested.ctl.event_inj = svm->vmcb->control.event_inj; svm->nested.ctl.event_inj_err = svm->vmcb->control.event_inj_err; + svm->nested.ctl.int_state = svm->vmcb->control.int_state; /* Only a few fields of int_ctl are written by the processor. */ mask = V_IRQ_MASK | V_TPR_MASK; -- 2.34.1

2 1

[PATCH OLK-6.6 1/2] AppArmor: Allow apparmor to handle unaligned dfa tables
by Gu Bowen 03 Jun '26

03 Jun '26

From: Helge Deller <deller(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 64802f731214a51dfe3c6c27636b3ddafd003eb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following [ 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720 [ 74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common [ 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE [ 74.536543] Call Trace: [ 74.568561] [<0000000000434c24>] dump_stack+0x8/0x18 [ 74.633757] [<0000000000476438>] __warn+0xd8/0x100 [ 74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74 [ 74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720 [ 74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0 [ 74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300 [ 74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0 [ 75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160 [ 75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280 [ 75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100 [ 75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420 [ 75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0 [ 75.406932] [<0000000000767174>] sys_write+0x14/0x40 [ 75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44 [ 75.548802] ---[ end trace 0000000000000000 ]--- [ 75.609503] dfa blob stream 0xfff0000008926b96 not aligned. [ 75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720 Work around it by using the get_unaligned_xx() helpers. Fixes: e6e8bf418850d ("apparmor: fix restricted endian type warnings for dfa unpack") Reported-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Closes: https://github.com/sparclinux/issues/issues/30 Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Conflicts: security/apparmor/match.c [Due to commit 5f60d5f6bbc1 ("move asm/unaligned.h to linux/unaligned.h") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/match.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/security/apparmor/match.c b/security/apparmor/match.c index ed2ed6e40849..063f0b053320 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -15,6 +15,7 @@ #include <linux/vmalloc.h> #include <linux/err.h> #include <linux/kref.h> +#include <asm/unaligned.h> #include "include/lib.h" #include "include/match.h" @@ -86,11 +87,11 @@ static struct table_header *unpack_table(char *blob, size_t bsize) /* loaded td_id's start at 1, subtract 1 now to avoid doing * it every time we use td_id as an index */ - th.td_id = be16_to_cpu(*(__be16 *) (blob)) - 1; + th.td_id = get_unaligned_be16(blob) - 1; if (th.td_id > YYTD_ID_MAX) goto out; - th.td_flags = be16_to_cpu(*(__be16 *) (blob + 2)); - th.td_lolen = be32_to_cpu(*(__be32 *) (blob + 8)); + th.td_flags = get_unaligned_be16(blob + 2); + th.td_lolen = get_unaligned_be32(blob + 8); blob += sizeof(struct table_header); if (!(th.td_flags == YYTD_DATA16 || th.td_flags == YYTD_DATA32 || @@ -337,14 +338,14 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags) if (size < sizeof(struct table_set_header)) goto fail; - if (ntohl(*(__be32 *) data) != YYTH_MAGIC) + if (get_unaligned_be32(data) != YYTH_MAGIC) goto fail; - hsize = ntohl(*(__be32 *) (data + 4)); + hsize = get_unaligned_be32(data + 4); if (size < hsize) goto fail; - dfa->flags = ntohs(*(__be16 *) (data + 12)); + dfa->flags = get_unaligned_be16(data + 12); if (dfa->flags & ~(YYTH_FLAGS)) goto fail; @@ -353,7 +354,7 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags) * if (dfa->flags & YYTH_FLAGS_OOB_TRANS) { * if (hsize < 16 + 4) * goto fail; - * dfa->max_oob = ntol(*(__be32 *) (data + 16)); + * dfa->max_oob = get_unaligned_be32(data + 16); * if (dfa->max <= MAX_OOB_SUPPORTED) { * pr_err("AppArmor DFA OOB greater than supported\n"); * goto fail; -- 2.43.0

2 2

[PATCH OLK-6.6 0/4] hungtask fix patch and mainline backport
by Chen Jinghuang 03 Jun '26

03 Jun '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi broken of struct sched_entity Peter Zijlstra (2): sched/fair: Fix lag clamp sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") Zhan Xusheng (1): sched/fair: Fix math notation errors in avg_vruntime comment include/linux/sched.h | 2 +- kernel/sched/fair.c | 188 +++++++++++++++++++++++++++++++++++------- 2 files changed, 161 insertions(+), 29 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/3] CVEs
by Liu Kai 03 Jun '26

03 Jun '26

CVEs Michael Bommarito (1): RDMA/rxe: Reject unknown opcodes before ICRC processing Shuvam Pandey (1): Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hkbinbin (1): RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv drivers/infiniband/sw/rxe/rxe_recv.c | 14 +++++++++++++- net/bluetooth/hci_event.c | 18 ++++++++++++++---- 2 files changed, 27 insertions(+), 5 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/3] *** revert CVE-2026-31527 ***
by Lin Ruifeng 03 Jun '26

03 Jun '26

*** revert CVE-2026-31527 *** Lin Ruifeng (3): Revert "driver/core: Fix kabi broken of platform_device/device/bus_type" Revert "driver core: platform: use generic driver_override infrastructure" Revert "driver core: generalize driver_override in struct device" drivers/base/bus.c | 49 +-------------------- drivers/base/core.c | 3 -- drivers/base/dd.c | 61 --------------------------- drivers/base/platform.c | 57 ++++++++++++++++++++++--- drivers/slimbus/qcom-ngd-ctrl.c | 12 +----- include/linux/device.h | 75 --------------------------------- include/linux/platform_device.h | 7 +-- 7 files changed, 55 insertions(+), 209 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb()
by Long Li 03 Jun '26

03 Jun '26

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9228 CVE: NA -------------------------------- Recently, I encountered a problem where a BUG was triggered in the write-back process. The detailed problem information is as follows: xfs_bmap_extents_to_btree: ip=0xffff888148ecad00 wasdel=0 sde: writeback error on inode 68, offset 61440, sector 1400 XFS (sde): Corruption of in-memory data (0x8) detected at xfs_trans_mod_sb+0xaa6/0xc60 (fs/xfs/xfs_trans.c:351). Shutting. XFS (sde): Please unmount the filesystem and rectify the problem(s) XFS: Assertion failed: tp->t_blk_res || tp->t_fdblocks_delta >= 0, file: fs/xfs/xfs_trans.c, line: 610 ------------[ cut here ]------------ kernel BUG at fs/xfs/xfs_message.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 7.0.0-rc6-next-20260402-00028-g56f243e5f8ea-dirty #360 P Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: writeback wb_workfn (flush-8:64) RIP: 0010:assfail+0x9f/0xb0 Code: fe 84 db 75 20 e8 41 2e 33 fe 0f 0b 5b 5d 41 5c 41 5d e9 94 34 a5 06 48 c7 c7 58 ae 2b 8d e8 f8 72 a0 RSP: 0018:ffffc900000dedd0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff838c91b6 RDX: ffff88810425d880 RSI: ffffffff838c91df RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10e3b14901 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8a956520 R13: 0000000000000262 R14: 0000000000000000 R15: ffffffffffffffff FS: 0000000000000000(0000) GS:ffff88878bdc5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fccb3c788f0 CR3: 000000000c98a000 CR4: 00000000000006f0 Call Trace: <TASK> xfs_trans_unreserve_and_mod_sb+0xb86/0xd00 __xfs_trans_commit+0x38b/0xe00 xfs_trans_commit+0xeb/0x1a0 xfs_bmapi_convert_one_delalloc+0xba9/0x12d0 xfs_bmapi_convert_delalloc+0x101/0x350 xfs_writeback_range+0x76c/0x12d0 iomap_writeback_folio+0x9ed/0x2100 iomap_writepages+0x13c/0x2a0 xfs_vm_writepages+0x278/0x330 do_writepages+0x247/0x5c0 __writeback_single_inode+0x123/0x1370 writeback_sb_inodes+0x71e/0x1b90 __writeback_inodes_wb+0xc3/0x280 wb_writeback+0x730/0xb80 wb_workfn+0x8b0/0xbc0 process_one_work+0xa08/0x1d00 worker_thread+0x698/0xeb0 kthread+0x408/0x540 ret_from_fork+0xa4d/0xdd0 ret_from_fork_asm+0x1a/0x30 </TASK> After analyzing the above issues, the possible triggering process is as follows: xfs_bmapi_convert_delalloc xfs_bmapi_convert_one_delalloc xfs_bmapi_allocate xfs_bmap_add_extent_delay_real da_old = startblockval(PREV.br_startblock); // da_old = 5 case BMAP_LEFT_FILLING: ifp->if_nextents++; // 21 + 1 = 22 if (xfs_bmap_needs_btree(bma->ip, whichfork)) // 22 > 21 xfs_bmap_extents_to_btree // convert to btree cur->bc_ino.allocated++; // da_new = 5 - 1 = 4 da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), startblockval(PREV.br_startblock) - (bma->cur ? bma->cur->bc_ino.allocated : 0)) //xfs_bmapi_convert_one_delalloc() return PREV.br_startblock = nullstartblock(da_new); xfs_bmap_del_extent_real case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING: ifp->if_nextents--; // 22 - 1 = 21 if (xfs_bmap_needs_btree(ip, whichfork)) xfs_bmap_extents_to_btree(); else // convert to extents xfs_bmap_btree_to_extents(); ... // Alternate a few times in the middle. da_old = 4 da_old = 3 da_old = 2 da_old = 1 ... xfs_bmapi_convert_delalloc xfs_bmapi_convert_one_delalloc // Both blocks and rtextents are 0 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, XFS_TRANS_RESERVE, &tp); tp = kmem_cache_zalloc(xfs_trans_cache, GFP_KERNEL | __GFP_NOFAIL); error = xfs_trans_reserve(tp, resp, blocks, rtextents); if (blocks > 0) error = xfs_mod_fdblocks(mp, -((int64_t)blocks), rsvd); // The value of blocks is 0, so the value of tp->t_blk_res is 0 tp->t_blk_res += blocks; xfs_bmapi_allocate xfs_bmap_add_extent_delay_real da_old = startblockval(PREV.br_startblock); // da_old = 0 // The current delay extent is just exhausted. case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING ifp->if_nextents++; // 21 + 1 + 22 if (xfs_bmap_needs_btree(bma->ip, whichfork)) // 22 > 21 // Converted to btree. da_old > 0 is false. error = xfs_bmap_extents_to_btree(bma->tp, bma->ip, &bma->cur, da_old > 0, &tmp_logflags, whichfork); args.wasdel = wasdel; // wasdel is false error = xfs_alloc_vextent_start_ag(&args, XFS_INO_TO_FSB(mp, ip->i_ino)); xfs_alloc_vextent_finish(args, minimum_agno, error, true); xfs_ag_resv_alloc_extent(args->pag, args->resv, args); case XFS_AG_RESV_NONE: field = args->wasdel ? XFS_TRANS_SB_RES_FDBLOCKS : XFS_TRANS_SB_FDBLOCKS; //args->wasdel == false xfs_trans_mod_sb(args->tp, field, -(int64_t)args->len); case XFS_TRANS_SB_FDBLOCKS: if (delta < 0) tp->t_blk_res_used += (uint)-delta; if (tp->t_blk_res_used > tp->t_blk_res) // ***tp->t_blk_res is 0, thus triggering xfs_force_shutdown()*** xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE); The logic that triggers the issue above was designed by me to facilitate the construction of the problem. Besides the scenario where BTREE and EXTENTS are converted back and forth, there is also the scenario of btree splitting. The core reason for the issue is that in xfs_bmapi_convert_delalloc(), the call to xfs_bmap_worst_indlen() calculates the worst-case number of reserved blocks, which is the number of additional blocks required after a complete conversion of the entire delayed extent. It assumes that the entire conversion process is atomic. However, the current process cannot guarantee such atomicity. In the case of a fragmented filesystem, the most extreme scenario is that every block conversion triggers a full btree split, in which case the reserved blocks are far from sufficient. When this issue is triggered, the filesystem fragmentation in the environment is indeed quite severe. Further analysis of this abnormal model shows that because the reserved blocks are continuously consumed, they may eventually exceed the reserved amount. When the space is nearly exhausted, xfs_bmap_extents_to_btree() may fail to allocate blocks, triggering a warning. This failure to allocate additional blocks can lead to issues with normal block allocation. Since a single delay extent cannot guarantee a one-time completion of the conversion, the 'inlen' of the delay extent should be maintained at the value calculated by xfs_bmap_worst_indlen(). Commit d69bee6a35d3 ("xfs: fix xfs_bmap_add_extent_delay_real for partial conversions") addressed the issue of potentially not reserving enough space in emergency situations. Based on this modification, we can recalculate the worst-case 'inlen' required for the remaining delay extents after the conversion in xfs_bmap_add_extent_delay_real(), instead of using the remaining value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_bmap.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c index 9ed22d82c000..3d655c1bef7d 100644 --- a/fs/xfs/libxfs/xfs_bmap.c +++ b/fs/xfs/libxfs/xfs_bmap.c @@ -1656,8 +1656,7 @@ xfs_bmap_add_extent_delay_real( */ old = LEFT; temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); LEFT.br_blockcount += new->br_blockcount; @@ -1724,9 +1723,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock) - - (bma->cur ? bma->cur->bc_ino.allocated : 0)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_startoff = new_endoff; PREV.br_blockcount = temp; @@ -1763,8 +1760,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_blockcount = temp; PREV.br_startblock = nullstartblock(da_new); @@ -1812,9 +1808,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock) - - (bma->cur ? bma->cur->bc_ino.allocated : 0)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_startblock = nullstartblock(da_new); PREV.br_blockcount = temp; -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] xfs: fix delay extent reserve issue
by Long Li 03 Jun '26

03 Jun '26

This patch set fix delay extent reserve issue. Christoph Hellwig (1): xfs: fix xfs_bmap_add_extent_delay_real for partial conversions Ye Bin (1): xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() fs/xfs/libxfs/xfs_bmap.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects()
by Qi Xi 03 Jun '26

03 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/15059 CVE: NA --------------------------- Fixes the incorrect callback invocation that would cause shrinker behavior mismatch when adapting v2 shrinkers to v1 interface. Fixes: 0dabf4e3ac0f ("mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()") Signed-off-by: Qi Xi <xiqi5703(a)163.com> --- mm/vmscan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index cf6b9e6dc8cd..5c81e3e1e2d7 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7623,9 +7623,9 @@ static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, struct shrink_control *sc) { if (shk_v2->v1) - return shk_v2->v1->count_objects(shk_v2->v1, sc); + return shk_v2->v1->scan_objects(shk_v2->v1, sc); - return SHRINK_EMPTY; + return SHRINK_STOP; } int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) -- 2.53.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_helper: pass helper to expect cleanup
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Qi Tang <tpluszz77(a)gmail.com> mainline inclusion from mainline-v7.0-rc7 commit a242a9ae58aa46ff7dae51ce64150a93957abe65 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14559 CVE: CVE-2026-43027 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup. After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free. Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed. BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0) Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers") Signed-off-by: Qi Tang <tpluszz77(a)gmail.com> Reviewed-by: Phil Sutter <phil(a)nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_helper.c [commit 9c42bc9db90a1 ("netfilter: nf_conntrack_expect: honor expectation helper field") is not backported, which lead to conflicts. The target kernel still contains the old comment and an extra synchronize_rcu() call after nf_ct_iterate_destroy(), while the patch context expects the new comment from mainline.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 06c70d4584cf..31cc05a437c2 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -464,7 +464,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) */ synchronize_rcu(); - nf_ct_expect_iterate_destroy(expect_iter_me, NULL); + nf_ct_expect_iterate_destroy(expect_iter_me, me); nf_ct_iterate_destroy(unhelp, me); /* Maybe someone has gotten the helper already when unhelp above. -- 2.43.0

2 1

[PATCH OLK-6.6] xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb()
by Long Li 03 Jun '26

03 Jun '26

From: Ye Bin <yebin10(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9228 -------------------------------- Recently, I encountered a problem where a BUG was triggered in the write-back process. The detailed problem information is as follows: xfs_bmap_extents_to_btree: ip=0xffff888148ecad00 wasdel=0 sde: writeback error on inode 68, offset 61440, sector 1400 XFS (sde): Corruption of in-memory data (0x8) detected at xfs_trans_mod_sb+0xaa6/0xc60 (fs/xfs/xfs_trans.c:351). Shutting. XFS (sde): Please unmount the filesystem and rectify the problem(s) XFS: Assertion failed: tp->t_blk_res || tp->t_fdblocks_delta >= 0, file: fs/xfs/xfs_trans.c, line: 610 ------------[ cut here ]------------ kernel BUG at fs/xfs/xfs_message.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 7.0.0-rc6-next-20260402-00028-g56f243e5f8ea-dirty #360 P Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: writeback wb_workfn (flush-8:64) RIP: 0010:assfail+0x9f/0xb0 Code: fe 84 db 75 20 e8 41 2e 33 fe 0f 0b 5b 5d 41 5c 41 5d e9 94 34 a5 06 48 c7 c7 58 ae 2b 8d e8 f8 72 a0 RSP: 0018:ffffc900000dedd0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff838c91b6 RDX: ffff88810425d880 RSI: ffffffff838c91df RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10e3b14901 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8a956520 R13: 0000000000000262 R14: 0000000000000000 R15: ffffffffffffffff FS: 0000000000000000(0000) GS:ffff88878bdc5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fccb3c788f0 CR3: 000000000c98a000 CR4: 00000000000006f0 Call Trace: <TASK> xfs_trans_unreserve_and_mod_sb+0xb86/0xd00 __xfs_trans_commit+0x38b/0xe00 xfs_trans_commit+0xeb/0x1a0 xfs_bmapi_convert_one_delalloc+0xba9/0x12d0 xfs_bmapi_convert_delalloc+0x101/0x350 xfs_writeback_range+0x76c/0x12d0 iomap_writeback_folio+0x9ed/0x2100 iomap_writepages+0x13c/0x2a0 xfs_vm_writepages+0x278/0x330 do_writepages+0x247/0x5c0 __writeback_single_inode+0x123/0x1370 writeback_sb_inodes+0x71e/0x1b90 __writeback_inodes_wb+0xc3/0x280 wb_writeback+0x730/0xb80 wb_workfn+0x8b0/0xbc0 process_one_work+0xa08/0x1d00 worker_thread+0x698/0xeb0 kthread+0x408/0x540 ret_from_fork+0xa4d/0xdd0 ret_from_fork_asm+0x1a/0x30 </TASK> After analyzing the above issues, the possible triggering process is as follows: xfs_bmapi_convert_delalloc xfs_bmapi_convert_one_delalloc xfs_bmapi_allocate xfs_bmap_add_extent_delay_real da_old = startblockval(PREV.br_startblock); // da_old = 5 case BMAP_LEFT_FILLING: ifp->if_nextents++; // 21 + 1 = 22 if (xfs_bmap_needs_btree(bma->ip, whichfork)) // 22 > 21 xfs_bmap_extents_to_btree // convert to btree cur->bc_ino.allocated++; // da_new = 5 - 1 = 4 da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), startblockval(PREV.br_startblock) - (bma->cur ? bma->cur->bc_ino.allocated : 0)) //xfs_bmapi_convert_one_delalloc() return PREV.br_startblock = nullstartblock(da_new); xfs_bmap_del_extent_real case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING: ifp->if_nextents--; // 22 - 1 = 21 if (xfs_bmap_needs_btree(ip, whichfork)) xfs_bmap_extents_to_btree(); else // convert to extents xfs_bmap_btree_to_extents(); ... // Alternate a few times in the middle. da_old = 4 da_old = 3 da_old = 2 da_old = 1 ... xfs_bmapi_convert_delalloc xfs_bmapi_convert_one_delalloc // Both blocks and rtextents are 0 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, XFS_TRANS_RESERVE, &tp); tp = kmem_cache_zalloc(xfs_trans_cache, GFP_KERNEL | __GFP_NOFAIL); error = xfs_trans_reserve(tp, resp, blocks, rtextents); if (blocks > 0) error = xfs_mod_fdblocks(mp, -((int64_t)blocks), rsvd); // The value of blocks is 0, so the value of tp->t_blk_res is 0 tp->t_blk_res += blocks; xfs_bmapi_allocate xfs_bmap_add_extent_delay_real da_old = startblockval(PREV.br_startblock); // da_old = 0 // The current delay extent is just exhausted. case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING ifp->if_nextents++; // 21 + 1 + 22 if (xfs_bmap_needs_btree(bma->ip, whichfork)) // 22 > 21 // Converted to btree. da_old > 0 is false. error = xfs_bmap_extents_to_btree(bma->tp, bma->ip, &bma->cur, da_old > 0, &tmp_logflags, whichfork); args.wasdel = wasdel; // wasdel is false error = xfs_alloc_vextent_start_ag(&args, XFS_INO_TO_FSB(mp, ip->i_ino)); xfs_alloc_vextent_finish(args, minimum_agno, error, true); xfs_ag_resv_alloc_extent(args->pag, args->resv, args); case XFS_AG_RESV_NONE: field = args->wasdel ? XFS_TRANS_SB_RES_FDBLOCKS : XFS_TRANS_SB_FDBLOCKS; //args->wasdel == false xfs_trans_mod_sb(args->tp, field, -(int64_t)args->len); case XFS_TRANS_SB_FDBLOCKS: if (delta < 0) tp->t_blk_res_used += (uint)-delta; if (tp->t_blk_res_used > tp->t_blk_res) // ***tp->t_blk_res is 0, thus triggering xfs_force_shutdown()*** xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE); The logic that triggers the issue above was designed by me to facilitate the construction of the problem. Besides the scenario where BTREE and EXTENTS are converted back and forth, there is also the scenario of btree splitting. The core reason for the issue is that in xfs_bmapi_convert_delalloc(), the call to xfs_bmap_worst_indlen() calculates the worst-case number of reserved blocks, which is the number of additional blocks required after a complete conversion of the entire delayed extent. It assumes that the entire conversion process is atomic. However, the current process cannot guarantee such atomicity. In the case of a fragmented filesystem, the most extreme scenario is that every block conversion triggers a full btree split, in which case the reserved blocks are far from sufficient. When this issue is triggered, the filesystem fragmentation in the environment is indeed quite severe. Further analysis of this abnormal model shows that because the reserved blocks are continuously consumed, they may eventually exceed the reserved amount. When the space is nearly exhausted, xfs_bmap_extents_to_btree() may fail to allocate blocks, triggering a warning. This failure to allocate additional blocks can lead to issues with normal block allocation. Since a single delay extent cannot guarantee a one-time completion of the conversion, the 'inlen' of the delay extent should be maintained at the value calculated by xfs_bmap_worst_indlen(). Commit d69bee6a35d3 ("xfs: fix xfs_bmap_add_extent_delay_real for partial conversions") addressed the issue of potentially not reserving enough space in emergency situations. Based on this modification, we can recalculate the worst-case 'inlen' required for the remaining delay extents after the conversion in xfs_bmap_add_extent_delay_real(), instead of using the remaining value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_bmap.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c index 9ed22d82c000..3d655c1bef7d 100644 --- a/fs/xfs/libxfs/xfs_bmap.c +++ b/fs/xfs/libxfs/xfs_bmap.c @@ -1656,8 +1656,7 @@ xfs_bmap_add_extent_delay_real( */ old = LEFT; temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); LEFT.br_blockcount += new->br_blockcount; @@ -1724,9 +1723,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock) - - (bma->cur ? bma->cur->bc_ino.allocated : 0)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_startoff = new_endoff; PREV.br_blockcount = temp; @@ -1763,8 +1760,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_blockcount = temp; PREV.br_startblock = nullstartblock(da_new); @@ -1812,9 +1808,7 @@ xfs_bmap_add_extent_delay_real( } temp = PREV.br_blockcount - new->br_blockcount; - da_new = XFS_FILBLKS_MIN(xfs_bmap_worst_indlen(bma->ip, temp), - startblockval(PREV.br_startblock) - - (bma->cur ? bma->cur->bc_ino.allocated : 0)); + da_new = xfs_bmap_worst_indlen(bma->ip, temp); PREV.br_startblock = nullstartblock(da_new); PREV.br_blockcount = temp; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS V1] RDMA/rxe: Fix double free in rxe_srq_from_init
by Cheng Yu 03 Jun '26

03 Jun '26

From: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 0beefd0e15d962f497aad750b2d5e9c3570b66d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15105 CVE: CVE-2026-45852 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user. Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com Reviewed-by: Zhu Yanjun <yanjun.Zhu(a)linux.dev> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe_srq.c [The conflict is caused by not having applied the patch cc28f351155d("RDMA/rxe: Fix rxe_modify_srq"). ] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_srq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c index c41a5fee81f7..3630d00ca71d 100644 --- a/drivers/infiniband/sw/rxe/rxe_srq.c +++ b/drivers/infiniband/sw/rxe/rxe_srq.c @@ -144,6 +144,9 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, } } + srq->rq.queue = q; + init->attr.max_wr = srq->rq.max_wr; + return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: x_tables: ensure names are nul-terminated
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.0-rc7 commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14560 CVE: CVE-2026-43028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most recent commit that needs this change. Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_cgroup.c | 6 ++++++ net/netfilter/xt_rateest.c | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c index 5cb1ecb29ea4..e54fbda5e435 100644 --- a/net/netfilter/xt_cgroup.c +++ b/net/netfilter/xt_cgroup.c @@ -56,6 +56,9 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) info->priv = NULL; if (info->has_path) { + if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path)) + return -ENAMETOOLONG; + cgrp = cgroup_get_from_path(info->path); if (IS_ERR(cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n", @@ -88,6 +91,9 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par) info->priv = NULL; if (info->has_path) { + if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path)) + return -ENAMETOOLONG; + cgrp = cgroup_get_from_path(info->path); if (IS_ERR(cgrp)) { pr_info_ratelimited("invalid path, errno=%ld\n", diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c index bf77326861af..a9a60a8fc758 100644 --- a/net/netfilter/xt_rateest.c +++ b/net/netfilter/xt_rateest.c @@ -94,6 +94,11 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par) goto err1; } + if (strnlen(info->name1, sizeof(info->name1)) >= sizeof(info->name1)) + return -ENAMETOOLONG; + if (strnlen(info->name2, sizeof(info->name2)) >= sizeof(info->name2)) + return -ENAMETOOLONG; + ret = -ENOENT; est1 = xt_rateest_lookup(par->net, info->name1); if (!est1) -- 2.43.0

2 1

[PATCH OLK-6.6 v2 0/2] bpf mainline
by Pu Lehui 03 Jun '26

03 Jun '26

Daniel Borkmann (2): bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken selftests/bpf: Add test for stale pkt range after scalar arithmetic kernel/bpf/verifier.c | 33 +++++++++- .../bpf/progs/verifier_direct_packet_access.c | 61 +++++++++++++++++++ 2 files changed, 91 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] netfilter: nft_ct: fix use-after-free in timeout object destroy
by superdcc97＠163.com 03 Jun '26

03 Jun '26

From: Tuan Do <tuan(a)calif.io> mainline inclusion from mainline-v7.1-rc1 commit f8dca15a1b190787bbd03285304b569631160eda category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14407 CVE: CVE-2026-31665 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c. KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0 Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Cc: stable(a)vger.kernel.org Signed-off-by: Tuan Do <tuan(a)calif.io> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: include/net/netfilter/nf_conntrack_timeout.h net/netfilter/nft_ct.c [commit 6daf14140129 ("netfilter: Replace zero-length array with flexible-array member") is not backport, target uses 'char data[0]' instead of 'char data[]', need to insert struct rcu_head before data[0]. commit b184356d0a00 ("netfilter: conntrack: remove module owner field") is not backport, target still has nf_ct_l4proto_put(timeout->l4proto) in nft_ct_timeout_obj_destroy(), need to preserve it while replacing kfree with kfree_rcu.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_timeout.h | 1 + net/netfilter/nft_ct.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h index 3394d75e1c80..d6f74145f945 100644 --- a/include/net/netfilter/nf_conntrack_timeout.h +++ b/include/net/netfilter/nf_conntrack_timeout.h @@ -14,6 +14,7 @@ struct nf_ct_timeout { __u16 l3num; const struct nf_conntrack_l4proto *l4proto; + struct rcu_head rcu; char data[0]; }; diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index b17604b5b48b..2fc92f42cea6 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -906,7 +906,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, nf_ct_untimeout(ctx->net, timeout); nf_ct_l4proto_put(timeout->l4proto); nf_ct_netns_put(ctx->net, ctx->family); - kfree(priv->timeout); + kfree_rcu(priv->timeout, rcu); } static int nft_ct_timeout_obj_dump(struct sk_buff *skb, -- 2.43.0

2 1

[PATCH 0/2] xfs: fix delay extent reserve issue
by Long Li 03 Jun '26

03 Jun '26

This patch set fix delay extent reserve issue. Christoph Hellwig (1): xfs: fix xfs_bmap_add_extent_delay_real for partial conversions Ye Bin (1): xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() fs/xfs/libxfs/xfs_bmap.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) -- 2.52.0

1 2

[PATCH OLK-6.6] apparmor: Fix & Optimize table creation from possibly unaligned memory
by Gu Bowen 03 Jun '26

03 Jun '26

From: Helge Deller <deller(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Source blob may come from userspace and might be unaligned. Try to optize the copying process by avoiding unaligned memory accesses. - Added Fixes tag - Added "Fix &" to description as this doesn't just optimize but fixes a potential unaligned memory access Fixes: e6e8bf418850d ("apparmor: fix restricted endian type warnings for dfa unpack") Signed-off-by: Helge Deller <deller(a)gmx.de> [jj: remove duplicate word "convert" in comment trigger checkpatch warning] Signed-off-by: John Johansen <john.johansen(a)canonical.com> Conflicts: security/apparmor/include/match.h [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/apparmor/include/match.h | 12 +++++++----- security/apparmor/match.c | 7 +++---- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h index 82b13c103454..47b55a1971de 100644 --- a/security/apparmor/include/match.h +++ b/security/apparmor/include/match.h @@ -105,16 +105,18 @@ struct aa_dfa { extern struct aa_dfa *nulldfa; extern struct aa_dfa *stacksplitdfa; -#define byte_to_byte(X) (X) - #define UNPACK_ARRAY(TABLE, BLOB, LEN, TTYPE, BTYPE, NTOHX) \ do { \ typeof(LEN) __i; \ TTYPE *__t = (TTYPE *) TABLE; \ BTYPE *__b = (BTYPE *) BLOB; \ - for (__i = 0; __i < LEN; __i++) { \ - __t[__i] = NTOHX(__b[__i]); \ - } \ + BUILD_BUG_ON(sizeof(TTYPE) != sizeof(BTYPE)); \ + if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) \ + memcpy(__t, __b, (LEN) * sizeof(BTYPE)); \ + else /* copy & convert from big-endian */ \ + for (__i = 0; __i < LEN; __i++) { \ + __t[__i] = NTOHX(&__b[__i]); \ + } \ } while (0) static inline size_t table_size(size_t len, size_t el_size) diff --git a/security/apparmor/match.c b/security/apparmor/match.c index ed2ed6e40849..130addfa6bb9 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -110,14 +110,13 @@ static struct table_header *unpack_table(char *blob, size_t bsize) table->td_flags = th.td_flags; table->td_lolen = th.td_lolen; if (th.td_flags == YYTD_DATA8) - UNPACK_ARRAY(table->td_data, blob, th.td_lolen, - u8, u8, byte_to_byte); + memcpy(table->td_data, blob, th.td_lolen); else if (th.td_flags == YYTD_DATA16) UNPACK_ARRAY(table->td_data, blob, th.td_lolen, - u16, __be16, be16_to_cpu); + u16, __be16, get_unaligned_be16); else if (th.td_flags == YYTD_DATA32) UNPACK_ARRAY(table->td_data, blob, th.td_lolen, - u32, __be32, be32_to_cpu); + u32, __be32, get_unaligned_be32); else goto fail; /* if table was vmalloced make sure the page tables are synced -- 2.43.0

2 1

[PATCH OLK-5.10] fbcon: Fix the issue of uninitialized charcount in the remaining consoles
by Luo Gengkun 03 Jun '26

03 Jun '26

HULK inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9126 CVE: NA ---------------------------------------------------------------------- After commit 054a54161b88 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") was merged, using alt+ctrl+f1 to switch the tty from tty0 to tty1 results in garbled display. The reason is the vc->vc_font.charcount is 0, it is clearly an uninitialized value. The mainline is fine because commit a1ac250a82a5 ("fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount") assigns the fvc->vc_font.charcount to vc->vc_font.charcount. Fixes: 06a0aaef1910 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index d0a11b7543b6..d49dc3ef4f53 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1071,6 +1071,7 @@ static void fbcon_init(struct vc_data *vc, int init) fvc->vc_font.data); vc->vc_font.width = fvc->vc_font.width; vc->vc_font.height = fvc->vc_font.height; + vc->vc_font.charcount = fvc->vc_font.charcount; p->userfont = t->userfont; if (p->userfont) -- 2.34.1

2 1

[PATCH OLK-5.10] dlm: validate length in dlm_search_rsb_tree
by Gu Bowen 03 Jun '26

03 Jun '26

From: Ezrak1e <ezrakiez(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 080e5563f878c64e697b89e7439d730d0daad882 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14672 CVE: CVE-2026-43125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow. Signed-off-by: Ezrak1e <ezrakiez(a)gmail.com> Signed-off-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: David Teigland <teigland(a)redhat.com> Conflicts: fs/dlm/lock.c [Context conflicts due to commit 6c648035cbe7 ("dlm: switch to use rhashtable for rsbs") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/dlm/lock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 51ab06308bc7..339f7d4c793f 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -449,6 +449,9 @@ int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, struct dlm_rsb *r; int rc; + if (len > DLM_RESNAME_MAXLEN) + return -EINVAL; + while (node) { r = rb_entry(node, struct dlm_rsb, res_hashnode); rc = rsb_cmp(r, name, len); -- 2.43.0

2 1

[PATCH OLK-6.6] dlm: validate length in dlm_search_rsb_tree
by Gu Bowen 03 Jun '26

03 Jun '26

From: Ezrak1e <ezrakiez(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 080e5563f878c64e697b89e7439d730d0daad882 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14672 CVE: CVE-2026-43125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow. Signed-off-by: Ezrak1e <ezrakiez(a)gmail.com> Signed-off-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: David Teigland <teigland(a)redhat.com> Conflicts: fs/dlm/lock.c [Context conflicts due to commit 6c648035cbe7 ("dlm: switch to use rhashtable for rsbs") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/dlm/lock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 6712d733fc90..6c708ccbdf3c 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -444,6 +444,9 @@ int dlm_search_rsb_tree(struct rb_root *tree, const void *name, int len, struct dlm_rsb *r; int rc; + if (len > DLM_RESNAME_MAXLEN) + return -EINVAL; + while (node) { r = rb_entry(node, struct dlm_rsb, res_hashnode); rc = rsb_cmp(r, name, len); -- 2.43.0

2 2

[PATCH OLK-6.6] vsock: fix buffer size clamping order
by Wupeng Ma 03 Jun '26

03 Jun '26

From: Norbert Szetei <norbert(a)doyensec.com> stable inclusion from stable-v6.6.140 commit a998a7e250bf976539e05a00ec64a81292afecaa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15478 CVE: CVE-2026-46234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d114bfdc9b76bf93b881e195b7ec957c14227bab upstream. In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this by checking the minimum first, and then the maximum. This ensures the buffer size never exceeds the buffer_max_size. Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") Suggested-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Cc: Luigi Leonardi <leonardi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index ca1289e64bcc8..187cc259f820b 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1728,12 +1728,12 @@ static void vsock_update_buffer_size(struct vsock_sock *vsk, const struct vsock_transport *transport, u64 val) { - if (val > vsk->buffer_max_size) - val = vsk->buffer_max_size; - if (val < vsk->buffer_min_size) val = vsk->buffer_min_size; + if (val > vsk->buffer_max_size) + val = vsk->buffer_max_size; + if (val != vsk->buffer_size && transport && transport->notify_buffer_size) transport->notify_buffer_size(vsk, &val); -- 2.43.0

2 2

[PATCH OLK-5.10] fbcon: Fix the issue of uninitialized charcount in the remaining consoles
by Luo Gengkun 03 Jun '26

03 Jun '26

From: Luo Gengkun <luogengkun(a)huaweicloud.com> HULK inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9126 CVE: NA ---------------------------------------------------------------------- After commit 054a54161b88 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") was merged, using alt+ctrl+f1 to switch the tty from tty0 to tty1 results in garbled display. The reason is the vc->vc_font.charcount is 0, it is clearly an uninitialized value. The mainline is fine because commit a1ac250a82a5 ("fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount") assigns the fvc->vc_font.charcount to vc->vc_font.charcount. Fixes: 06a0aaef1910 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index d0a11b7543b6..d49dc3ef4f53 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1071,6 +1071,7 @@ static void fbcon_init(struct vc_data *vc, int init) fvc->vc_font.data); vc->vc_font.width = fvc->vc_font.width; vc->vc_font.height = fvc->vc_font.height; + vc->vc_font.charcount = fvc->vc_font.charcount; p->userfont = t->userfont; if (p->userfont) -- 2.34.1

2 2

[PATCH OLK-6.6] fbcon: Fix the issue of uninitialized charcount in the remaining consoles
by Luo Gengkun 03 Jun '26

03 Jun '26

From: Luo Gengkun <luogengkun(a)huaweicloud.com> HULK inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9126 CVE: NA ---------------------------------------------------------------------- After commit 054a54161b88 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") was merged, using alt+ctrl+f1 to switch the tty from tty0 to tty1 results in garbled display. The reason is the vc->vc_font.charcount is 0, it is clearly an uninitialized value. The mainline is fine because commit a1ac250a82a5 ("fbcon: Avoid using FNTCHARCNT() and hard-coded built-in font charcount") assigns the fvc->vc_font.charcount to vc->vc_font.charcount. Fixes: 06a0aaef1910 ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index d0a11b7543b6..d49dc3ef4f53 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1071,6 +1071,7 @@ static void fbcon_init(struct vc_data *vc, int init) fvc->vc_font.data); vc->vc_font.width = fvc->vc_font.width; vc->vc_font.height = fvc->vc_font.height; + vc->vc_font.charcount = fvc->vc_font.charcount; p->userfont = t->userfont; if (p->userfont) -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Avoid soft lockup in bpf_uprobe_unregister
by Pu Lehui 03 Jun '26

03 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9318 -------------------------------- Syzkaller report a following issue: watchdog: BUG: soft lockup - CPU#0 stuck for 109s! [syz.0.555:3563] Modules linked in: CPU: 0 PID: 3563 Comm: syz.0.555 Not tainted 6.6.0+ #80 RIP: 0010:consumer_del kernel/events/uprobes.c:789 [inline] RIP: 0010:__uprobe_unregister+0x9e/0x260 kernel/events/uprobes.c:1107 RSP: 0018:ffff888143a47a58 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc900156aaf78 RCX: ffffffffa7128384 RDX: 1ffff92002ad55ef RSI: 0000000000000008 RDI: ffff888120c1e050 RBP: ffffc90015504a20 R08: 0000000000000001 R09: ffffed1024183c0a R10: ffff888120c1e057 R11: ffff888100e3a058 R12: dffffc0000000000 R13: ffff888120c1e000 R14: ffffc900156aaf20 R15: ffff888120c1e080 FS: 0000000000000000(0000) GS:ffff8881e1400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd57aa2048 CR3: 000000021a742006 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <TASK> uprobe_unregister+0x62/0x90 kernel/events/uprobes.c:1131 bpf_uprobe_unregister kernel/trace/bpf_trace.c:3082 [inline] bpf_uprobe_multi_link_release+0xd5/0x1f0 kernel/trace/bpf_trace.c:3092 bpf_link_free+0x16b/0x2c0 kernel/bpf/syscall.c:2929 bpf_link_put_direct kernel/bpf/syscall.c:2969 [inline] bpf_link_release+0x68/0x80 kernel/bpf/syscall.c:2976 __fput+0x408/0xab0 fs/file_table.c:384 task_work_run+0x154/0x240 kernel/task_work.c:245 exit_task_work include/linux/task_work.h:45 [inline] do_exit+0x813/0x1140 kernel/exit.c:882 do_group_exit+0xcd/0x280 kernel/exit.c:1023 get_signal+0x185b/0x1910 kernel/signal.c:2908 arch_do_signal_or_restart+0x83/0x3b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x20b/0x220 kernel/entry/common.c:218 do_syscall_64+0x66/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The reason is that syzkaller attempts to unregister 287088 uprobes when CONFIG_PREEMPT_NONE. Let's add cond_resched to avoid soft lockup in bpf_uprobe_unregister. Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/bpf_trace.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 768159fad93c..435f078782e2 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -3077,6 +3077,7 @@ static void bpf_uprobe_unregister(struct path *path, struct bpf_uprobe *uprobes, for (i = 0; i < cnt; i++) { uprobe_unregister(d_real_inode(path->dentry), uprobes[i].offset, &uprobes[i].consumer); + cond_resched(); } } -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_ct: fix use-after-free in timeout object destroy
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Tuan Do <tuan(a)calif.io> stable inclusion from stable-v5.10.253 commit c458fc1c278a65ad5381083121d39a479973ebed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14407 CVE: CVE-2026-31665 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f8dca15a1b190787bbd03285304b569631160eda upstream. nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c. KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0 Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Cc: stable(a)vger.kernel.org Signed-off-by: Tuan Do <tuan(a)calif.io> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_timeout.h | 1 + net/netfilter/nft_ct.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h index 659b0ea25b4d..16e024ca1587 100644 --- a/include/net/netfilter/nf_conntrack_timeout.h +++ b/include/net/netfilter/nf_conntrack_timeout.h @@ -14,6 +14,7 @@ struct nf_ct_timeout { __u16 l3num; const struct nf_conntrack_l4proto *l4proto; + struct rcu_head rcu; char data[]; }; diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index e0fa3e73fed4..2ac4c6b16459 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -934,7 +934,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, nf_queue_nf_hook_drop(ctx->net); nf_ct_untimeout(ctx->net, timeout); nf_ct_netns_put(ctx->net, ctx->family); - kfree(priv->timeout); + kfree_rcu(priv->timeout, rcu); } static int nft_ct_timeout_obj_dump(struct sk_buff *skb, -- 2.43.0

2 1

[PATCH OLK-6.6] vsock: fix buffer size clamping order
by Wupeng Ma 02 Jun '26

02 Jun '26

From: Norbert Szetei <norbert(a)doyensec.com> stable inclusion from stable-v6.6.140 commit a998a7e250bf976539e05a00ec64a81292afecaa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d114bfdc9b76bf93b881e195b7ec957c14227bab upstream. In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this by checking the minimum first, and then the maximum. This ensures the buffer size never exceeds the buffer_max_size. Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") Suggested-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Cc: Luigi Leonardi <leonardi(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index ca1289e64bcc8..187cc259f820b 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1728,12 +1728,12 @@ static void vsock_update_buffer_size(struct vsock_sock *vsk, const struct vsock_transport *transport, u64 val) { - if (val > vsk->buffer_max_size) - val = vsk->buffer_max_size; - if (val < vsk->buffer_min_size) val = vsk->buffer_min_size; + if (val > vsk->buffer_max_size) + val = vsk->buffer_max_size; + if (val != vsk->buffer_size && transport && transport->notify_buffer_size) transport->notify_buffer_size(vsk, &val); -- 2.43.0

2 1

[PATCH OLK-5.10] xfrm: prevent policy_hthresh.work from racing with netns teardown
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Minwoo Ra <raminwo0202(a)gmail.com> mainline inclusion from mainline-v7.0-rc6 commit 29fe3a61bcdce398ee3955101c39f89c01a8a77e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14251 CVE: CVE-2026-31516 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct net via container_of(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrm_hash_rebuild() may then dereference stale memory. xfrm_policy_fini() already flushes policy_hash_work during teardown, but it does not synchronize policy_hthresh.work. Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net. Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink") Signed-off-by: Minwoo Ra <raminwo0202(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index c7a827d4265c..98a8f2623ec7 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -4113,6 +4113,8 @@ static void xfrm_policy_fini(struct net *net) unsigned int sz; int dir; + cancel_work_sync(&net->xfrm.policy_hthresh.work); + flush_work(&net->xfrm.policy_hash_work); #ifdef CONFIG_XFRM_SUB_POLICY xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] xfrm: prevent policy_hthresh.work from racing with netns teardown
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Minwoo Ra <raminwo0202(a)gmail.com> mainline inclusion from mainline-v7.0-rc6 commit 29fe3a61bcdce398ee3955101c39f89c01a8a77e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14251 CVE: CVE-2026-31516 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct net via container_of(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrm_hash_rebuild() may then dereference stale memory. xfrm_policy_fini() already flushes policy_hash_work during teardown, but it does not synchronize policy_hthresh.work. Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net. Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink") Signed-off-by: Minwoo Ra <raminwo0202(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_policy.c [openEuler-1.0-LTS does not have disable_work_sync() API, use cancel_work_sync() instead. The target kernel's xfrm_policy_fini() function lacks struct xfrm_pol_inexact_bin related code which exists in mainline.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 5d635f005ab7..9057e806c890 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2878,6 +2878,8 @@ static void xfrm_policy_fini(struct net *net) unsigned int sz; int dir; + cancel_work_sync(&net->xfrm.policy_hthresh.work); + flush_work(&net->xfrm.policy_hash_work); #ifdef CONFIG_XFRM_SUB_POLICY xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Koichiro Den <den(a)valinux.co.jp> mainline inclusion from mainline-v7.0-rc3 commit 7f083faf59d14c04e01ec05a7507f036c965acf8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13941 CVE: CVE-2026-23340 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling. Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking") Signed-off-by: Koichiro Den <den(a)valinux.co.jp> Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/sch_generic.h [Omitted clear_bit(__QDISC_STATE_MISSED) and clear_bit(__QDISC_STATE_DRAINING) as these states do not exist in openEuler-1.0-LTS.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/sch_generic.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index cb9c6f1a9569..19abc08b305e 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -629,13 +629,20 @@ static inline bool skb_skip_tc_classify(struct sk_buff *skb) static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i) { struct Qdisc *qdisc; + bool nolock; for (; i < dev->num_tx_queues; i++) { qdisc = rtnl_dereference(netdev_get_tx_queue(dev, i)->qdisc); if (qdisc) { + nolock = qdisc->flags & TCQ_F_NOLOCK; + + if (nolock) + spin_lock_bh(&qdisc->seqlock); spin_lock_bh(qdisc_lock(qdisc)); qdisc_reset(qdisc); spin_unlock_bh(qdisc_lock(qdisc)); + if (nolock) + spin_unlock_bh(&qdisc->seqlock); } } } -- 2.43.0

2 1

[PATCH OLK-5.10] net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Koichiro Den <den(a)valinux.co.jp> mainline inclusion from mainline-v7.0-rc1 commit 7f083faf59d14c04e01ec05a7507f036c965acf8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13941 CVE: CVE-2026-23340 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling. Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking") Signed-off-by: Koichiro Den <den(a)valinux.co.jp> Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/sch_generic.h [commit c4fef01ba479 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/sch_generic.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 46afe852c455..d010017d69f1 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -751,13 +751,22 @@ static inline bool skb_skip_tc_classify(struct sk_buff *skb) static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i) { struct Qdisc *qdisc; + bool nolock; for (; i < dev->num_tx_queues; i++) { qdisc = rtnl_dereference(netdev_get_tx_queue(dev, i)->qdisc); if (qdisc) { + nolock = qdisc->flags & TCQ_F_NOLOCK; + + if (nolock) + spin_lock_bh(&qdisc->seqlock); spin_lock_bh(qdisc_lock(qdisc)); qdisc_reset(qdisc); spin_unlock_bh(qdisc_lock(qdisc)); + if (nolock) { + clear_bit(__QDISC_STATE_MISSED, &qdisc->state); + spin_unlock_bh(&qdisc->seqlock); + } } } } -- 2.43.0

2 1

[PATCH OLK-6.6] net: usb: catc: enable basic endpoint checking
by Zhang Qilong 02 Jun '26

02 Jun '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v6.6.128 commit 163d04897e57633c5d2e69734e4e4b22bb63f50d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15162 CVE: CVE-2026-45923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9e7021d2aeae57c323a6f722ed7915686cdcc123 ] catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/catc.c | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c index ff439ef535ac..98346cb4ece0 100644 --- a/drivers/net/usb/catc.c +++ b/drivers/net/usb/catc.c @@ -62,10 +62,20 @@ static const char driver_name[] = "catc"; #define RX_MAX_BURST 15 /* Max packets per rx buffer (> 0, < 16) */ #define TX_MAX_BURST 15 /* Max full sized packets per tx buffer (> 0) */ #define CTRL_QUEUE 16 /* Max control requests in flight (power of two) */ #define RX_PKT_SZ 1600 /* Max size of receive packet for F5U011 */ +/* + * USB endpoints. + */ + +enum catc_usb_ep { + CATC_USB_EP_CONTROL = 0, + CATC_USB_EP_BULK = 1, + CATC_USB_EP_INT_IN = 2, +}; + /* * Control requests. */ enum control_requests { @@ -770,10 +780,17 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id struct net_device *netdev; struct catc *catc; u8 broadcast[ETH_ALEN]; u8 *macbuf; int pktsz, ret = -ENOMEM; + static const u8 bulk_ep_addr[] = { + CATC_USB_EP_BULK | USB_DIR_OUT, + CATC_USB_EP_BULK | USB_DIR_IN, + 0}; + static const u8 int_ep_addr[] = { + CATC_USB_EP_INT_IN | USB_DIR_IN, + 0}; macbuf = kmalloc(ETH_ALEN, GFP_KERNEL); if (!macbuf) goto error; @@ -782,10 +799,18 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id dev_err(dev, "Can't set altsetting 1.\n"); ret = -EIO; goto fail_mem; } + /* Verify that all required endpoints are present */ + if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || + !usb_check_int_endpoints(intf, int_ep_addr)) { + dev_err(dev, "Missing or invalid endpoints\n"); + ret = -ENODEV; + goto fail_mem; + } + netdev = alloc_etherdev(sizeof(struct catc)); if (!netdev) goto fail_mem; catc = netdev_priv(netdev); @@ -826,18 +851,18 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id } usb_fill_control_urb(catc->ctrl_urb, usbdev, usb_sndctrlpipe(usbdev, 0), NULL, NULL, 0, catc_ctrl_done, catc); - usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, 1), - NULL, 0, catc_tx_done, catc); + usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, CATC_USB_EP_BULK), + NULL, 0, catc_tx_done, catc); - usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, 1), - catc->rx_buf, pktsz, catc_rx_done, catc); + usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, CATC_USB_EP_BULK), + catc->rx_buf, pktsz, catc_rx_done, catc); - usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, 2), - catc->irq_buf, 2, catc_irq_done, catc, 1); + usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, CATC_USB_EP_INT_IN), + catc->irq_buf, 2, catc_irq_done, catc, 1); if (!catc->is_f5u011) { u32 *buf; int i; -- 2.43.0

2 1

[PATCH OLK-6.6] net: ks8851: Reinstate disabling of BHs around IRQ handler
by Zhang Qilong 02 Jun '26

02 Jun '26

From: Marek Vasut <marex(a)nabladev.com> stable inclusion from stable-v6.6.140 commit 640a7631d31db87d5fa1b34cea44a99b6e78854b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15276 CVE: CVE-2026-46031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5c9fcac3c872224316714d0d8914d9af16c76a6d upstream. If the driver executes ks8851_irq() AND a TX packet has been sent, then the driver enables TX queue via netif_wake_queue() which schedules TX softirq to queue packets for this device. If CONFIG_PREEMPT_RT=y is set AND a packet has also been received by the MAC, then ks8851_rx_pkts() calls netdev_alloc_skb_ip_align() to allocate SKBs for the received packets. If netdev_alloc_skb_ip_align() is called with BH enabled, then local_bh_enable() at the end of netdev_alloc_skb_ip_align() will trigger the pending softirq processing, which may ultimately call the .xmit callback ks8851_start_xmit_par(). The ks8851_start_xmit_par() will try to lock struct ks8851_net_par .lock spinlock, which is already locked by ks8851_irq() from which ks8851_start_xmit_par() was called. This leads to a deadlock, which is reported by the kernel, including a trace listed below. If CONFIG_PREEMPT_RT is not set, then since commit 0913ec336a6c0 ("net: ks8851: Fix deadlock with the SPI chip variant") the deadlock can also be triggered without received packet in the RX FIFO. The pending softirqs will be processed on return from spin_unlock_bh(&ks->statelock) in ks8851_irq(), which triggers the deadlock as well. Fix the problem by disabling BH around critical sections, including the IRQ handler, thus preventing the net_tx_action() softirq from triggering during these critical sections. The net_tx_action() softirq is triggered once BH are re-enabled and at the end of the IRQ handler, once all the other IRQ handler actions have been completed. __schedule from schedule_rtlock+0x1c/0x34 schedule_rtlock from rtlock_slowlock_locked+0x548/0x904 rtlock_slowlock_locked from rt_spin_lock+0x60/0x9c rt_spin_lock from ks8851_start_xmit_par+0x74/0x1a8 ks8851_start_xmit_par from netdev_start_xmit+0x20/0x44 netdev_start_xmit from dev_hard_start_xmit+0xd0/0x188 dev_hard_start_xmit from sch_direct_xmit+0xb8/0x25c sch_direct_xmit from __qdisc_run+0x1f8/0x4ec __qdisc_run from qdisc_run+0x1c/0x28 qdisc_run from net_tx_action+0x1f0/0x268 net_tx_action from handle_softirqs+0x1a4/0x270 handle_softirqs from __local_bh_enable_ip+0xcc/0xe0 __local_bh_enable_ip from __alloc_skb+0xd8/0x128 __alloc_skb from __netdev_alloc_skb+0x3c/0x19c __netdev_alloc_skb from ks8851_irq+0x388/0x4d4 ks8851_irq from irq_thread_fn+0x24/0x64 irq_thread_fn from irq_thread+0x178/0x28c irq_thread from kthread+0x12c/0x138 kthread from ret_from_fork+0x14/0x28 Reviewed-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Fixes: e0863634bf9f ("net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs") Cc: stable(a)vger.kernel.org Signed-off-by: Marek Vasut <marex(a)nabladev.com> Link: https://patch.msgid.link/20260415231020.455298-1-marex@nabladev.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 64 +++++++++------------ drivers/net/ethernet/micrel/ks8851_par.c | 15 ++--- drivers/net/ethernet/micrel/ks8851_spi.c | 11 ++-- 4 files changed, 38 insertions(+), 58 deletions(-) diff --git a/drivers/net/ethernet/micrel/ks8851.h b/drivers/net/ethernet/micrel/ks8851.h index 31f75b4a67fd..b795a3a60571 100644 --- a/drivers/net/ethernet/micrel/ks8851.h +++ b/drivers/net/ethernet/micrel/ks8851.h @@ -406,14 +406,12 @@ struct ks8851_net { struct regulator *vdd_reg; struct regulator *vdd_io; struct gpio_desc *gpio; struct mii_bus *mii_bus; - void (*lock)(struct ks8851_net *ks, - unsigned long *flags); - void (*unlock)(struct ks8851_net *ks, - unsigned long *flags); + void (*lock)(struct ks8851_net *ks); + void (*unlock)(struct ks8851_net *ks); unsigned int (*rdreg16)(struct ks8851_net *ks, unsigned int reg); void (*wrreg16)(struct ks8851_net *ks, unsigned int reg, unsigned int val); void (*rdfifo)(struct ks8851_net *ks, u8 *buff, diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c index 7fa1820db9cc..8e06656a06c1 100644 --- a/drivers/net/ethernet/micrel/ks8851_common.c +++ b/drivers/net/ethernet/micrel/ks8851_common.c @@ -26,29 +26,27 @@ #include "ks8851.h" /** * ks8851_lock - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock(struct ks8851_net *ks) { - ks->lock(ks, flags); + ks->lock(ks); } /** * ks8851_unlock - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock(struct ks8851_net *ks) { - ks->unlock(ks, flags); + ks->unlock(ks); } /** * ks8851_wrreg16 - write 16bit register value to chip * @ks: The chip state @@ -127,15 +125,14 @@ static void ks8851_set_powermode(struct ks8851_net *ks, unsigned pwrmode) * shutdown the RXQ process whilst setting this. */ static int ks8851_write_mac_addr(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; u16 val; int i; - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* * Wake up chip in case it was powered off when stopped; otherwise, * the first write to the MAC address does not take effect. */ @@ -147,11 +144,11 @@ static int ks8851_write_mac_addr(struct net_device *dev) } if (!netif_running(dev)) ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } /** @@ -161,25 +158,24 @@ static int ks8851_write_mac_addr(struct net_device *dev) * Update our copy of the KS8851 MAC address from the registers of @dev. */ static void ks8851_read_mac_addr(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; u8 addr[ETH_ALEN]; u16 reg; int i; - ks8851_lock(ks, &flags); + ks8851_lock(ks); for (i = 0; i < ETH_ALEN; i += 2) { reg = ks8851_rdreg16(ks, KS_MAR(i)); addr[i] = reg >> 8; addr[i + 1] = reg & 0xff; } eth_hw_addr_set(dev, addr); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } /** * ks8851_init_mac - initialise the mac address * @ks: The device structure @@ -326,15 +322,14 @@ static void ks8851_rx_pkts(struct ks8851_net *ks, struct sk_buff_head *rxq) */ static irqreturn_t ks8851_irq(int irq, void *_ks) { struct ks8851_net *ks = _ks; struct sk_buff_head rxq; - unsigned long flags; unsigned int status; struct sk_buff *skb; - ks8851_lock(ks, &flags); + ks8851_lock(ks); status = ks8851_rdreg16(ks, KS_ISR); ks8851_wrreg16(ks, KS_ISR, status); netif_dbg(ks, intr, ks->netdev, @@ -387,11 +382,11 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) ks8851_wrreg16(ks, KS_RXCR2, rxc->rxcr2); ks8851_wrreg16(ks, KS_RXCR1, rxc->rxcr1); } - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); if (status & IRQ_LCI) mii_check_link(&ks->mii); if (status & IRQ_RXI) @@ -419,11 +414,10 @@ static void ks8851_flush_tx_work(struct ks8851_net *ks) * 'ifconfig up' on the device. */ static int ks8851_net_open(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int ret; ret = request_threaded_irq(dev->irq, NULL, ks8851_irq, IRQF_TRIGGER_LOW | IRQF_ONESHOT, dev->name, ks); @@ -432,11 +426,11 @@ static int ks8851_net_open(struct net_device *dev) return ret; } /* lock the card, even if we may not actually be doing anything * else at the moment */ - ks8851_lock(ks, &flags); + ks8851_lock(ks); netif_dbg(ks, ifup, ks->netdev, "opening\n"); /* bring chip out of any power saving mode it was in */ ks8851_set_powermode(ks, PMECR_PM_NORMAL); @@ -485,11 +479,11 @@ static int ks8851_net_open(struct net_device *dev) ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); netif_start_queue(ks->netdev); netif_dbg(ks, ifup, ks->netdev, "network device up\n"); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); mii_check_link(&ks->mii); return 0; } /** @@ -501,36 +495,35 @@ static int ks8851_net_open(struct net_device *dev) * power state whilst it is not being used. */ static int ks8851_net_stop(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; netif_info(ks, ifdown, dev, "shutting down\n"); netif_stop_queue(dev); - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* turn off the IRQs and ack any outstanding */ ks8851_wrreg16(ks, KS_IER, 0x0000); ks8851_wrreg16(ks, KS_ISR, 0xffff); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); /* stop any outstanding work */ ks8851_flush_tx_work(ks); flush_work(&ks->rxctrl_work); - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* shutdown RX process */ ks8851_wrreg16(ks, KS_RXCR1, 0x0000); /* shutdown TX process */ ks8851_wrreg16(ks, KS_TXCR, 0x0000); /* set powermode to soft power down to save power */ ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); /* ensure any queued tx buffers are dumped */ while (!skb_queue_empty(&ks->txq)) { struct sk_buff *txb = skb_dequeue(&ks->txq); @@ -580,18 +573,17 @@ static netdev_tx_t ks8851_start_xmit(struct sk_buff *skb, * complete. The interrupt handler then writes the new values into the chip. */ static void ks8851_rxctrl_work(struct work_struct *work) { struct ks8851_net *ks = container_of(work, struct ks8851_net, rxctrl_work); - unsigned long flags; - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* need to shutdown RXQ before modifying filter parameters */ ks8851_wrreg16(ks, KS_RXCR1, 0x00); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } static void ks8851_set_rx_mode(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); @@ -794,11 +786,10 @@ static void ks8851_eeprom_release(struct ks8851_net *ks) static int ks8851_set_eeprom(struct net_device *dev, struct ethtool_eeprom *ee, u8 *data) { struct ks8851_net *ks = netdev_priv(dev); int offset = ee->offset; - unsigned long flags; int len = ee->len; u16 tmp; /* currently only support byte writing */ if (len != 1) @@ -808,11 +799,11 @@ static int ks8851_set_eeprom(struct net_device *dev, return -EINVAL; if (!(ks->rc_ccr & CCR_EEPROM)) return -ENOENT; - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_eeprom_claim(ks); eeprom_93cx6_wren(&ks->eeprom, true); @@ -831,39 +822,38 @@ static int ks8851_set_eeprom(struct net_device *dev, eeprom_93cx6_write(&ks->eeprom, offset/2, tmp); eeprom_93cx6_wren(&ks->eeprom, false); ks8851_eeprom_release(ks); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } static int ks8851_get_eeprom(struct net_device *dev, struct ethtool_eeprom *ee, u8 *data) { struct ks8851_net *ks = netdev_priv(dev); int offset = ee->offset; - unsigned long flags; int len = ee->len; /* must be 2 byte aligned */ if (len & 1 || offset & 1) return -EINVAL; if (!(ks->rc_ccr & CCR_EEPROM)) return -ENOENT; - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_eeprom_claim(ks); ee->magic = KS_EEPROM_MAGIC; eeprom_93cx6_multiread(&ks->eeprom, offset/2, (__le16 *)data, len/2); ks8851_eeprom_release(ks); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } static int ks8851_get_eeprom_len(struct net_device *dev) @@ -918,21 +908,20 @@ static int ks8851_phy_reg(int reg) } static int ks8851_phy_read_common(struct net_device *dev, int phy_addr, int reg) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int result; int ksreg; ksreg = ks8851_phy_reg(reg); if (ksreg < 0) return ksreg; - ks8851_lock(ks, &flags); + ks8851_lock(ks); result = ks8851_rdreg16(ks, ksreg); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return result; } /** @@ -963,18 +952,17 @@ static int ks8851_phy_read(struct net_device *dev, int phy_addr, int reg) static void ks8851_phy_write(struct net_device *dev, int phy, int reg, int value) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int ksreg; ksreg = ks8851_phy_reg(reg); if (ksreg >= 0) { - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_wrreg16(ks, ksreg, value); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } } static int ks8851_mdio_read(struct mii_bus *bus, int phy_id, int reg) { diff --git a/drivers/net/ethernet/micrel/ks8851_par.c b/drivers/net/ethernet/micrel/ks8851_par.c index 96fb0ffcedb9..7f16ee5a91e2 100644 --- a/drivers/net/ethernet/micrel/ks8851_par.c +++ b/drivers/net/ethernet/micrel/ks8851_par.c @@ -53,33 +53,31 @@ struct ks8851_net_par { #define to_ks8851_par(ks) container_of((ks), struct ks8851_net_par, ks8851) /** * ks8851_lock_par - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock_par(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock_par(struct ks8851_net *ks) { struct ks8851_net_par *ksp = to_ks8851_par(ks); - spin_lock_irqsave(&ksp->lock, *flags); + spin_lock_bh(&ksp->lock); } /** * ks8851_unlock_par - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock_par(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock_par(struct ks8851_net *ks) { struct ks8851_net_par *ksp = to_ks8851_par(ks); - spin_unlock_irqrestore(&ksp->lock, *flags); + spin_unlock_bh(&ksp->lock); } /** * ks_check_endian - Check whether endianness of the bus is correct * @ks : The chip information @@ -231,19 +229,18 @@ static unsigned int ks8851_rdreg16_par_txqcr(struct ks8851_net *ks) static netdev_tx_t ks8851_start_xmit_par(struct sk_buff *skb, struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); netdev_tx_t ret = NETDEV_TX_OK; - unsigned long flags; unsigned int txqcr; u16 txmir; int err; netif_dbg(ks, tx_queued, ks->netdev, "%s: skb %p, %d@%p\n", __func__, skb, skb->len, skb->data); - ks8851_lock_par(ks, &flags); + ks8851_lock_par(ks); txmir = ks8851_rdreg16_par(ks, KS_TXMIR) & 0x1fff; if (likely(txmir >= skb->len + 12)) { ks8851_wrreg16_par(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); @@ -260,11 +257,11 @@ static netdev_tx_t ks8851_start_xmit_par(struct sk_buff *skb, ks8851_done_tx(ks, skb); } else { ret = NETDEV_TX_BUSY; } - ks8851_unlock_par(ks, &flags); + ks8851_unlock_par(ks); return ret; } static int ks8851_probe_par(struct platform_device *pdev) diff --git a/drivers/net/ethernet/micrel/ks8851_spi.c b/drivers/net/ethernet/micrel/ks8851_spi.c index e33a5e7beb39..50afe8c11178 100644 --- a/drivers/net/ethernet/micrel/ks8851_spi.c +++ b/drivers/net/ethernet/micrel/ks8851_spi.c @@ -71,29 +71,27 @@ struct ks8851_net_spi { (BYTE_EN(_byteen) | (_reg) << (8 + 2) | (_reg) >> 6) /** * ks8851_lock_spi - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock_spi(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock_spi(struct ks8851_net *ks) { struct ks8851_net_spi *kss = to_ks8851_spi(ks); mutex_lock(&kss->lock); } /** * ks8851_unlock_spi - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock_spi(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock_spi(struct ks8851_net *ks) { struct ks8851_net_spi *kss = to_ks8851_spi(ks); mutex_unlock(&kss->lock); } @@ -309,19 +307,18 @@ static void ks8851_tx_work(struct work_struct *work) { unsigned int dequeued_len = 0; struct ks8851_net_spi *kss; unsigned short tx_space; struct ks8851_net *ks; - unsigned long flags; struct sk_buff *txb; bool last; kss = container_of(work, struct ks8851_net_spi, tx_work); ks = &kss->ks8851; last = skb_queue_empty(&ks->txq); - ks8851_lock_spi(ks, &flags); + ks8851_lock_spi(ks); while (!last) { txb = skb_dequeue(&ks->txq); last = skb_queue_empty(&ks->txq); @@ -343,11 +340,11 @@ static void ks8851_tx_work(struct work_struct *work) spin_lock_bh(&ks->statelock); ks->queued_len -= dequeued_len; ks->tx_space = tx_space; spin_unlock_bh(&ks->statelock); - ks8851_unlock_spi(ks, &flags); + ks8851_unlock_spi(ks); } /** * ks8851_flush_tx_work_spi - flush outstanding TX work * @ks: The device state -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] net/sched: Enforce that teql can only be used as root qdisc
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Jamal Hadi Salim <jhs(a)mojatatu.com> mainline inclusion from mainline-v6.19-rc7 commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13607 CVE: CVE-2026-23074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will describe the scenario that unearthed this issue for the curious. GangMin Kim <km.kim1503(a)gmail.com> managed to concot a scenario as follows: ROOT qdisc 1:0 (QFQ) ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql GangMin sends a packet which is enqueued to 1:1 (netem). Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: GangMin Kim <km.kim1503(a)gmail.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20260114160243.913069-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_teql.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index 163364124691..18d219546cc2 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -183,6 +183,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt, if (m->dev == dev) return -ELOOP; + if (sch->parent != TC_H_ROOT) { + NL_SET_ERR_MSG_MOD(extack, "teql can only be used as root"); + return -EOPNOTSUPP; + } + q->m = m; skb_queue_head_init(&q->q); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
by Yi Yang 02 Jun '26

02 Jun '26

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v7.0-rc7 commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14894 CVE: CVE-2026-43336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Conflicts: lib/chacha20.c lib/crypto/chacha-block-generic.c [Commit 1ca1b917940c ("crypto: chacha20-generic - refactor to allow varying number of rounds") was not merged. File name change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- lib/chacha20.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/chacha20.c b/lib/chacha20.c index d907fec6a9ed..d78cf2e6c360 100644 --- a/lib/chacha20.c +++ b/lib/chacha20.c @@ -70,5 +70,7 @@ void chacha20_block(u32 *state, u8 *stream) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); state[12]++; + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(chacha20_block); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipvs: fix ipv4 null-ptr-deref in route error path
by superdcc97＠163.com 02 Jun '26

02 Jun '26

From: Slavin Liu <slavin452(a)gmail.com> mainline inclusion from mainline-v6.19-rc2 commit ad891bb3d079a46a821bf2b8867854645191bab0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13366 CVE: CVE-2025-68813 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure(). The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev from skb_dst(skb)->dev before calling dst_link_failure(). KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f] CPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2 RIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233 RIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285 Call Trace: <TASK> spec_dst_fill net/ipv4/ip_options.c:232 spec_dst_fill net/ipv4/ip_options.c:229 __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330 ipv4_send_dest_unreach net/ipv4/route.c:1252 ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265 dst_link_failure include/net/dst.h:437 __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412 ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764 Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") Signed-off-by: Slavin Liu <slavin452(a)gmail.com> Acked-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipvs/ip_vs_xmit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c index 11f7c546e57b..755644734145 100644 --- a/net/netfilter/ipvs/ip_vs_xmit.c +++ b/net/netfilter/ipvs/ip_vs_xmit.c @@ -409,6 +409,9 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, return -1; err_unreach: + if (!skb->dev) + skb->dev = skb_dst(skb)->dev; + dst_link_failure(skb); return -1; } -- 2.43.0

2 1

[PATCH OLK-6.6] mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects()
by Qi Xi 02 Jun '26

02 Jun '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/15059 CVE: NA --------------------------- Fixes the incorrect callback invocation that would cause shrinker behavior mismatch when adapting v2 shrinkers to v1 interface. Fixes: 0dabf4e3ac0f ("mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()") Signed-off-by: Qi Xi <xiqi5703(a)163.com> --- mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index cf6b9e6dc8cd..305aa6b3cd84 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7623,7 +7623,7 @@ static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, struct shrink_control *sc) { if (shk_v2->v1) - return shk_v2->v1->count_objects(shk_v2->v1, sc); + return shk_v2->v1->scan_objects(shk_v2->v1, sc); return SHRINK_EMPTY; } -- 2.53.0

2 1

[PATCH OLK-6.6] net: ks8851: Reinstate disabling of BHs around IRQ handler
by Zhang Qilong 02 Jun '26

02 Jun '26

From: Marek Vasut <marex(a)nabladev.com> stable inclusion from stable-v6.6.140 commit 640a7631d31db87d5fa1b34cea44a99b6e78854b category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/15276 CVE: CVE-2026-46031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5c9fcac3c872224316714d0d8914d9af16c76a6d upstream. If the driver executes ks8851_irq() AND a TX packet has been sent, then the driver enables TX queue via netif_wake_queue() which schedules TX softirq to queue packets for this device. If CONFIG_PREEMPT_RT=y is set AND a packet has also been received by the MAC, then ks8851_rx_pkts() calls netdev_alloc_skb_ip_align() to allocate SKBs for the received packets. If netdev_alloc_skb_ip_align() is called with BH enabled, then local_bh_enable() at the end of netdev_alloc_skb_ip_align() will trigger the pending softirq processing, which may ultimately call the .xmit callback ks8851_start_xmit_par(). The ks8851_start_xmit_par() will try to lock struct ks8851_net_par .lock spinlock, which is already locked by ks8851_irq() from which ks8851_start_xmit_par() was called. This leads to a deadlock, which is reported by the kernel, including a trace listed below. If CONFIG_PREEMPT_RT is not set, then since commit 0913ec336a6c0 ("net: ks8851: Fix deadlock with the SPI chip variant") the deadlock can also be triggered without received packet in the RX FIFO. The pending softirqs will be processed on return from spin_unlock_bh(&ks->statelock) in ks8851_irq(), which triggers the deadlock as well. Fix the problem by disabling BH around critical sections, including the IRQ handler, thus preventing the net_tx_action() softirq from triggering during these critical sections. The net_tx_action() softirq is triggered once BH are re-enabled and at the end of the IRQ handler, once all the other IRQ handler actions have been completed. __schedule from schedule_rtlock+0x1c/0x34 schedule_rtlock from rtlock_slowlock_locked+0x548/0x904 rtlock_slowlock_locked from rt_spin_lock+0x60/0x9c rt_spin_lock from ks8851_start_xmit_par+0x74/0x1a8 ks8851_start_xmit_par from netdev_start_xmit+0x20/0x44 netdev_start_xmit from dev_hard_start_xmit+0xd0/0x188 dev_hard_start_xmit from sch_direct_xmit+0xb8/0x25c sch_direct_xmit from __qdisc_run+0x1f8/0x4ec __qdisc_run from qdisc_run+0x1c/0x28 qdisc_run from net_tx_action+0x1f0/0x268 net_tx_action from handle_softirqs+0x1a4/0x270 handle_softirqs from __local_bh_enable_ip+0xcc/0xe0 __local_bh_enable_ip from __alloc_skb+0xd8/0x128 __alloc_skb from __netdev_alloc_skb+0x3c/0x19c __netdev_alloc_skb from ks8851_irq+0x388/0x4d4 ks8851_irq from irq_thread_fn+0x24/0x64 irq_thread_fn from irq_thread+0x178/0x28c irq_thread from kthread+0x12c/0x138 kthread from ret_from_fork+0x14/0x28 Reviewed-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Fixes: e0863634bf9f ("net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs") Cc: stable(a)vger.kernel.org Signed-off-by: Marek Vasut <marex(a)nabladev.com> Link: https://patch.msgid.link/20260415231020.455298-1-marex@nabladev.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 64 +++++++++------------ drivers/net/ethernet/micrel/ks8851_par.c | 15 ++--- drivers/net/ethernet/micrel/ks8851_spi.c | 11 ++-- 4 files changed, 38 insertions(+), 58 deletions(-) diff --git a/drivers/net/ethernet/micrel/ks8851.h b/drivers/net/ethernet/micrel/ks8851.h index 31f75b4a67fd..b795a3a60571 100644 --- a/drivers/net/ethernet/micrel/ks8851.h +++ b/drivers/net/ethernet/micrel/ks8851.h @@ -406,14 +406,12 @@ struct ks8851_net { struct regulator *vdd_reg; struct regulator *vdd_io; struct gpio_desc *gpio; struct mii_bus *mii_bus; - void (*lock)(struct ks8851_net *ks, - unsigned long *flags); - void (*unlock)(struct ks8851_net *ks, - unsigned long *flags); + void (*lock)(struct ks8851_net *ks); + void (*unlock)(struct ks8851_net *ks); unsigned int (*rdreg16)(struct ks8851_net *ks, unsigned int reg); void (*wrreg16)(struct ks8851_net *ks, unsigned int reg, unsigned int val); void (*rdfifo)(struct ks8851_net *ks, u8 *buff, diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c index 7fa1820db9cc..8e06656a06c1 100644 --- a/drivers/net/ethernet/micrel/ks8851_common.c +++ b/drivers/net/ethernet/micrel/ks8851_common.c @@ -26,29 +26,27 @@ #include "ks8851.h" /** * ks8851_lock - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock(struct ks8851_net *ks) { - ks->lock(ks, flags); + ks->lock(ks); } /** * ks8851_unlock - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock(struct ks8851_net *ks) { - ks->unlock(ks, flags); + ks->unlock(ks); } /** * ks8851_wrreg16 - write 16bit register value to chip * @ks: The chip state @@ -127,15 +125,14 @@ static void ks8851_set_powermode(struct ks8851_net *ks, unsigned pwrmode) * shutdown the RXQ process whilst setting this. */ static int ks8851_write_mac_addr(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; u16 val; int i; - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* * Wake up chip in case it was powered off when stopped; otherwise, * the first write to the MAC address does not take effect. */ @@ -147,11 +144,11 @@ static int ks8851_write_mac_addr(struct net_device *dev) } if (!netif_running(dev)) ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } /** @@ -161,25 +158,24 @@ static int ks8851_write_mac_addr(struct net_device *dev) * Update our copy of the KS8851 MAC address from the registers of @dev. */ static void ks8851_read_mac_addr(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; u8 addr[ETH_ALEN]; u16 reg; int i; - ks8851_lock(ks, &flags); + ks8851_lock(ks); for (i = 0; i < ETH_ALEN; i += 2) { reg = ks8851_rdreg16(ks, KS_MAR(i)); addr[i] = reg >> 8; addr[i + 1] = reg & 0xff; } eth_hw_addr_set(dev, addr); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } /** * ks8851_init_mac - initialise the mac address * @ks: The device structure @@ -326,15 +322,14 @@ static void ks8851_rx_pkts(struct ks8851_net *ks, struct sk_buff_head *rxq) */ static irqreturn_t ks8851_irq(int irq, void *_ks) { struct ks8851_net *ks = _ks; struct sk_buff_head rxq; - unsigned long flags; unsigned int status; struct sk_buff *skb; - ks8851_lock(ks, &flags); + ks8851_lock(ks); status = ks8851_rdreg16(ks, KS_ISR); ks8851_wrreg16(ks, KS_ISR, status); netif_dbg(ks, intr, ks->netdev, @@ -387,11 +382,11 @@ static irqreturn_t ks8851_irq(int irq, void *_ks) ks8851_wrreg16(ks, KS_RXCR2, rxc->rxcr2); ks8851_wrreg16(ks, KS_RXCR1, rxc->rxcr1); } - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); if (status & IRQ_LCI) mii_check_link(&ks->mii); if (status & IRQ_RXI) @@ -419,11 +414,10 @@ static void ks8851_flush_tx_work(struct ks8851_net *ks) * 'ifconfig up' on the device. */ static int ks8851_net_open(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int ret; ret = request_threaded_irq(dev->irq, NULL, ks8851_irq, IRQF_TRIGGER_LOW | IRQF_ONESHOT, dev->name, ks); @@ -432,11 +426,11 @@ static int ks8851_net_open(struct net_device *dev) return ret; } /* lock the card, even if we may not actually be doing anything * else at the moment */ - ks8851_lock(ks, &flags); + ks8851_lock(ks); netif_dbg(ks, ifup, ks->netdev, "opening\n"); /* bring chip out of any power saving mode it was in */ ks8851_set_powermode(ks, PMECR_PM_NORMAL); @@ -485,11 +479,11 @@ static int ks8851_net_open(struct net_device *dev) ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); netif_start_queue(ks->netdev); netif_dbg(ks, ifup, ks->netdev, "network device up\n"); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); mii_check_link(&ks->mii); return 0; } /** @@ -501,36 +495,35 @@ static int ks8851_net_open(struct net_device *dev) * power state whilst it is not being used. */ static int ks8851_net_stop(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; netif_info(ks, ifdown, dev, "shutting down\n"); netif_stop_queue(dev); - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* turn off the IRQs and ack any outstanding */ ks8851_wrreg16(ks, KS_IER, 0x0000); ks8851_wrreg16(ks, KS_ISR, 0xffff); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); /* stop any outstanding work */ ks8851_flush_tx_work(ks); flush_work(&ks->rxctrl_work); - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* shutdown RX process */ ks8851_wrreg16(ks, KS_RXCR1, 0x0000); /* shutdown TX process */ ks8851_wrreg16(ks, KS_TXCR, 0x0000); /* set powermode to soft power down to save power */ ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); /* ensure any queued tx buffers are dumped */ while (!skb_queue_empty(&ks->txq)) { struct sk_buff *txb = skb_dequeue(&ks->txq); @@ -580,18 +573,17 @@ static netdev_tx_t ks8851_start_xmit(struct sk_buff *skb, * complete. The interrupt handler then writes the new values into the chip. */ static void ks8851_rxctrl_work(struct work_struct *work) { struct ks8851_net *ks = container_of(work, struct ks8851_net, rxctrl_work); - unsigned long flags; - ks8851_lock(ks, &flags); + ks8851_lock(ks); /* need to shutdown RXQ before modifying filter parameters */ ks8851_wrreg16(ks, KS_RXCR1, 0x00); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } static void ks8851_set_rx_mode(struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); @@ -794,11 +786,10 @@ static void ks8851_eeprom_release(struct ks8851_net *ks) static int ks8851_set_eeprom(struct net_device *dev, struct ethtool_eeprom *ee, u8 *data) { struct ks8851_net *ks = netdev_priv(dev); int offset = ee->offset; - unsigned long flags; int len = ee->len; u16 tmp; /* currently only support byte writing */ if (len != 1) @@ -808,11 +799,11 @@ static int ks8851_set_eeprom(struct net_device *dev, return -EINVAL; if (!(ks->rc_ccr & CCR_EEPROM)) return -ENOENT; - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_eeprom_claim(ks); eeprom_93cx6_wren(&ks->eeprom, true); @@ -831,39 +822,38 @@ static int ks8851_set_eeprom(struct net_device *dev, eeprom_93cx6_write(&ks->eeprom, offset/2, tmp); eeprom_93cx6_wren(&ks->eeprom, false); ks8851_eeprom_release(ks); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } static int ks8851_get_eeprom(struct net_device *dev, struct ethtool_eeprom *ee, u8 *data) { struct ks8851_net *ks = netdev_priv(dev); int offset = ee->offset; - unsigned long flags; int len = ee->len; /* must be 2 byte aligned */ if (len & 1 || offset & 1) return -EINVAL; if (!(ks->rc_ccr & CCR_EEPROM)) return -ENOENT; - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_eeprom_claim(ks); ee->magic = KS_EEPROM_MAGIC; eeprom_93cx6_multiread(&ks->eeprom, offset/2, (__le16 *)data, len/2); ks8851_eeprom_release(ks); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return 0; } static int ks8851_get_eeprom_len(struct net_device *dev) @@ -918,21 +908,20 @@ static int ks8851_phy_reg(int reg) } static int ks8851_phy_read_common(struct net_device *dev, int phy_addr, int reg) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int result; int ksreg; ksreg = ks8851_phy_reg(reg); if (ksreg < 0) return ksreg; - ks8851_lock(ks, &flags); + ks8851_lock(ks); result = ks8851_rdreg16(ks, ksreg); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); return result; } /** @@ -963,18 +952,17 @@ static int ks8851_phy_read(struct net_device *dev, int phy_addr, int reg) static void ks8851_phy_write(struct net_device *dev, int phy, int reg, int value) { struct ks8851_net *ks = netdev_priv(dev); - unsigned long flags; int ksreg; ksreg = ks8851_phy_reg(reg); if (ksreg >= 0) { - ks8851_lock(ks, &flags); + ks8851_lock(ks); ks8851_wrreg16(ks, ksreg, value); - ks8851_unlock(ks, &flags); + ks8851_unlock(ks); } } static int ks8851_mdio_read(struct mii_bus *bus, int phy_id, int reg) { diff --git a/drivers/net/ethernet/micrel/ks8851_par.c b/drivers/net/ethernet/micrel/ks8851_par.c index 96fb0ffcedb9..7f16ee5a91e2 100644 --- a/drivers/net/ethernet/micrel/ks8851_par.c +++ b/drivers/net/ethernet/micrel/ks8851_par.c @@ -53,33 +53,31 @@ struct ks8851_net_par { #define to_ks8851_par(ks) container_of((ks), struct ks8851_net_par, ks8851) /** * ks8851_lock_par - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock_par(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock_par(struct ks8851_net *ks) { struct ks8851_net_par *ksp = to_ks8851_par(ks); - spin_lock_irqsave(&ksp->lock, *flags); + spin_lock_bh(&ksp->lock); } /** * ks8851_unlock_par - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock_par(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock_par(struct ks8851_net *ks) { struct ks8851_net_par *ksp = to_ks8851_par(ks); - spin_unlock_irqrestore(&ksp->lock, *flags); + spin_unlock_bh(&ksp->lock); } /** * ks_check_endian - Check whether endianness of the bus is correct * @ks : The chip information @@ -231,19 +229,18 @@ static unsigned int ks8851_rdreg16_par_txqcr(struct ks8851_net *ks) static netdev_tx_t ks8851_start_xmit_par(struct sk_buff *skb, struct net_device *dev) { struct ks8851_net *ks = netdev_priv(dev); netdev_tx_t ret = NETDEV_TX_OK; - unsigned long flags; unsigned int txqcr; u16 txmir; int err; netif_dbg(ks, tx_queued, ks->netdev, "%s: skb %p, %d@%p\n", __func__, skb, skb->len, skb->data); - ks8851_lock_par(ks, &flags); + ks8851_lock_par(ks); txmir = ks8851_rdreg16_par(ks, KS_TXMIR) & 0x1fff; if (likely(txmir >= skb->len + 12)) { ks8851_wrreg16_par(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); @@ -260,11 +257,11 @@ static netdev_tx_t ks8851_start_xmit_par(struct sk_buff *skb, ks8851_done_tx(ks, skb); } else { ret = NETDEV_TX_BUSY; } - ks8851_unlock_par(ks, &flags); + ks8851_unlock_par(ks); return ret; } static int ks8851_probe_par(struct platform_device *pdev) diff --git a/drivers/net/ethernet/micrel/ks8851_spi.c b/drivers/net/ethernet/micrel/ks8851_spi.c index e33a5e7beb39..50afe8c11178 100644 --- a/drivers/net/ethernet/micrel/ks8851_spi.c +++ b/drivers/net/ethernet/micrel/ks8851_spi.c @@ -71,29 +71,27 @@ struct ks8851_net_spi { (BYTE_EN(_byteen) | (_reg) << (8 + 2) | (_reg) >> 6) /** * ks8851_lock_spi - register access lock * @ks: The chip state - * @flags: Spinlock flags * * Claim chip register access lock */ -static void ks8851_lock_spi(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_lock_spi(struct ks8851_net *ks) { struct ks8851_net_spi *kss = to_ks8851_spi(ks); mutex_lock(&kss->lock); } /** * ks8851_unlock_spi - register access unlock * @ks: The chip state - * @flags: Spinlock flags * * Release chip register access lock */ -static void ks8851_unlock_spi(struct ks8851_net *ks, unsigned long *flags) +static void ks8851_unlock_spi(struct ks8851_net *ks) { struct ks8851_net_spi *kss = to_ks8851_spi(ks); mutex_unlock(&kss->lock); } @@ -309,19 +307,18 @@ static void ks8851_tx_work(struct work_struct *work) { unsigned int dequeued_len = 0; struct ks8851_net_spi *kss; unsigned short tx_space; struct ks8851_net *ks; - unsigned long flags; struct sk_buff *txb; bool last; kss = container_of(work, struct ks8851_net_spi, tx_work); ks = &kss->ks8851; last = skb_queue_empty(&ks->txq); - ks8851_lock_spi(ks, &flags); + ks8851_lock_spi(ks); while (!last) { txb = skb_dequeue(&ks->txq); last = skb_queue_empty(&ks->txq); @@ -343,11 +340,11 @@ static void ks8851_tx_work(struct work_struct *work) spin_lock_bh(&ks->statelock); ks->queued_len -= dequeued_len; ks->tx_space = tx_space; spin_unlock_bh(&ks->statelock); - ks8851_unlock_spi(ks, &flags); + ks8851_unlock_spi(ks); } /** * ks8851_flush_tx_work_spi - flush outstanding TX work * @ks: The device state -- 2.43.0

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-46043
by Xia Fukun 02 Jun '26

02 Jun '26

Fix 2 CVE patches CVE-2026-46043 CVE-2026-46133 Michael Bommarito (1): RDMA/rxe: Reject unknown opcodes before ICRC processing hkbinbin (1): RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv drivers/infiniband/sw/rxe/rxe_recv.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-46181
by Cai Xinchen 02 Jun '26

02 Jun '26

CVE-2026-46181 Jason Gunthorpe (1): RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Suren Baghdasaryan (1): refcount: provide ops for cases when object's memory can be reused Documentation/core-api/refcount-vs-atomic.rst | 37 +++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 ++- include/linux/refcount.h | 106 ++++++++++++++++++ include/linux/slab.h | 9 ++ 4 files changed, 153 insertions(+), 12 deletions(-) -- 2.18.0.huawei.25

2 3

[PATCH OLK-5.10 0/3] CVEs
by Liu Kai 02 Jun '26

02 Jun '26

CVEs Michael Bommarito (1): RDMA/rxe: Reject unknown opcodes before ICRC processing Shuvam Pandey (1): Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hkbinbin (1): RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv drivers/infiniband/sw/rxe/rxe_recv.c | 14 +++++++++++++- net/bluetooth/hci_event.c | 18 ++++++++++++++---- 2 files changed, 27 insertions(+), 5 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] net: usb: catc: enable basic endpoint checking
by Zhang Qilong 02 Jun '26

02 Jun '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v6.6.128 commit 163d04897e57633c5d2e69734e4e4b22bb63f50d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/15162 CVE: CVE-2026-45923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9e7021d2aeae57c323a6f722ed7915686cdcc123 ] catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/catc.c | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c index ff439ef535ac..98346cb4ece0 100644 --- a/drivers/net/usb/catc.c +++ b/drivers/net/usb/catc.c @@ -62,10 +62,20 @@ static const char driver_name[] = "catc"; #define RX_MAX_BURST 15 /* Max packets per rx buffer (> 0, < 16) */ #define TX_MAX_BURST 15 /* Max full sized packets per tx buffer (> 0) */ #define CTRL_QUEUE 16 /* Max control requests in flight (power of two) */ #define RX_PKT_SZ 1600 /* Max size of receive packet for F5U011 */ +/* + * USB endpoints. + */ + +enum catc_usb_ep { + CATC_USB_EP_CONTROL = 0, + CATC_USB_EP_BULK = 1, + CATC_USB_EP_INT_IN = 2, +}; + /* * Control requests. */ enum control_requests { @@ -770,10 +780,17 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id struct net_device *netdev; struct catc *catc; u8 broadcast[ETH_ALEN]; u8 *macbuf; int pktsz, ret = -ENOMEM; + static const u8 bulk_ep_addr[] = { + CATC_USB_EP_BULK | USB_DIR_OUT, + CATC_USB_EP_BULK | USB_DIR_IN, + 0}; + static const u8 int_ep_addr[] = { + CATC_USB_EP_INT_IN | USB_DIR_IN, + 0}; macbuf = kmalloc(ETH_ALEN, GFP_KERNEL); if (!macbuf) goto error; @@ -782,10 +799,18 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id dev_err(dev, "Can't set altsetting 1.\n"); ret = -EIO; goto fail_mem; } + /* Verify that all required endpoints are present */ + if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || + !usb_check_int_endpoints(intf, int_ep_addr)) { + dev_err(dev, "Missing or invalid endpoints\n"); + ret = -ENODEV; + goto fail_mem; + } + netdev = alloc_etherdev(sizeof(struct catc)); if (!netdev) goto fail_mem; catc = netdev_priv(netdev); @@ -826,18 +851,18 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id } usb_fill_control_urb(catc->ctrl_urb, usbdev, usb_sndctrlpipe(usbdev, 0), NULL, NULL, 0, catc_ctrl_done, catc); - usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, 1), - NULL, 0, catc_tx_done, catc); + usb_fill_bulk_urb(catc->tx_urb, usbdev, usb_sndbulkpipe(usbdev, CATC_USB_EP_BULK), + NULL, 0, catc_tx_done, catc); - usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, 1), - catc->rx_buf, pktsz, catc_rx_done, catc); + usb_fill_bulk_urb(catc->rx_urb, usbdev, usb_rcvbulkpipe(usbdev, CATC_USB_EP_BULK), + catc->rx_buf, pktsz, catc_rx_done, catc); - usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, 2), - catc->irq_buf, 2, catc_irq_done, catc, 1); + usb_fill_int_urb(catc->irq_urb, usbdev, usb_rcvintpipe(usbdev, CATC_USB_EP_INT_IN), + catc->irq_buf, 2, catc_irq_done, catc, 1); if (!catc->is_f5u011) { u32 *buf; int i; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] bpf mainline
by Pu Lehui 02 Jun '26

02 Jun '26

Daniel Borkmann (2): bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken selftests/bpf: Add test for stale pkt range after scalar arithmetic kernel/bpf/verifier.c | 22 +++++++ .../bpf/progs/verifier_direct_packet_access.c | 61 +++++++++++++++++++ 2 files changed, 83 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
by Ze Zuo 02 Jun '26

02 Jun '26

From: Ben Morris <bmorris(a)anthropic.com> stable inclusion from stable-v6.6.140 commit 1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15482 CVE: CVE-2026-46227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb5f36771cc4c05899b34000829a787572a8817 upstream. The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 ("sctp: walk the list of asoc safely") was added for. Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Cc: stable(a)vger.kernel.org Signed-off-by: Ben Morris <bmorris(a)anthropic.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/socket.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 279d5e9421d3..b9e8056c23fd 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1988,6 +1988,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) goto out_unlock; iov_iter_revert(&msg->msg_iter, err); + + /* sctp_sendmsg_to_asoc() may have released the socket + * lock (sctp_wait_for_sndbuf), during which other + * associations on ep->asocs could have been peeled + * off or freed. @asoc itself is revalidated by the + * base.dead and base.sk checks in sctp_wait_for_sndbuf, + * so re-derive the cached cursor from it. + */ + tmp = list_next_entry(asoc, asocs); } goto out_unlock; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
by Ze Zuo 02 Jun '26

02 Jun '26

From: Ben Morris <bmorris(a)anthropic.com> stable inclusion from stable-v6.6.140 commit 1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15482 CVE: CVE-2026-46227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb5f36771cc4c05899b34000829a787572a8817 upstream. The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 ("sctp: walk the list of asoc safely") was added for. Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Cc: stable(a)vger.kernel.org Signed-off-by: Ben Morris <bmorris(a)anthropic.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/socket.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index e6ac0bc410a7..3ee77f7cf3f7 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -2111,6 +2111,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) goto out_unlock; iov_iter_revert(&msg->msg_iter, err); + + /* sctp_sendmsg_to_asoc() may have released the socket + * lock (sctp_wait_for_sndbuf), during which other + * associations on ep->asocs could have been peeled + * off or freed. @asoc itself is revalidated by the + * base.dead and base.sk checks in sctp_wait_for_sndbuf, + * so re-derive the cached cursor from it. + */ + tmp = list_next_entry(asoc, asocs); } goto out_unlock; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/page_alloc: clear page->private in free_pages_prepare()
by Ze Zuo 02 Jun '26

02 Jun '26

From: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit ac1ea219590c09572ed5992dc233bbf7bb70fef9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14860 CVE: CVE-2026-43303 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use. Link: https://lkml.kernel.org/r/20260207173615.146159-1-mikhail.v.gavrilov@gmail.… Fixes: 3b8000ae185c ("mm/vmalloc: huge vmalloc backing pages should be split rather than compound") Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Suggested-by: Zi Yan <ziy(a)nvidia.com> Acked-by: Zi Yan <ziy(a)nvidia.com> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: Brendan Jackman <jackmanb(a)google.com> Cc: Chris Li <chrisl(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kairui Song <ryncsn(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Nicholas Piggin <npiggin(a)gmail.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/page_alloc.c [Context conflicts due not merge commit 53fbef56e07d ("mm: introduce memdesc_flags_t").] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index f576e0d7ee39..645bcf7213b7 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1152,6 +1152,7 @@ __always_inline bool free_pages_prepare(struct page *page, page_cpupid_reset_last(page); page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP; + page->private = 0; reset_page_owner(page, order); page_table_check_free(page, order); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - reject short ahash digests during instance creation
by Cui GaoSheng 02 Jun '26

02 Jun '26

From: Yucheng Lu <kanolyc(a)gmail.com> stable inclusion from stable-v5.10.258 commit 77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15279 CVE: CVE-2026-46033 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 upstream. authencesn requires either a zero authsize or an authsize of at least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data at the end of the authenticated data. While crypto_authenc_esn_setauthsize() already rejects explicit non-zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth->digestsize into inst->alg.maxauthsize without validating it. The AEAD core then initialized the tfm's default authsize from that value. As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null), exposed authencesn instances whose default authsize was invalid even though setauthsize() would have rejected the same value. AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an out-of-bounds access. Reject authencesn instances whose ahash digest size is in the invalid non-zero range 1..3 so that no tfm can inherit an unsupported default authsize. Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver") Cc: stable(a)kernel.org Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Co-developed-by: Yuan Tan <yuantan098(a)gmail.com> Signed-off-by: Yuan Tan <yuantan098(a)gmail.com> Suggested-by: Xin Liu <bird(a)lzu.edu.cn> Tested-by: Yuhang Zheng <z1652074432(a)gmail.com> Reviewed-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Yucheng Lu <kanolyc(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: crypto/authencesn.c [ Context conflicts. ] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index f6ffa16a74ef..318fc75d326b 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -427,6 +427,11 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, goto err_free_inst; crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); + if (auth->digestsize > 0 && auth->digestsize < 4) { + err = -EINVAL; + goto err_free_inst; + } + err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, crypto_requires_sync(algt->type, algt->mask)); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
by Cui GaoSheng 02 Jun '26

02 Jun '26

From: Gal Pressman <gal(a)nvidia.com> stable inclusion from stable-v5.10.253 commit 821f85d619f7f22cda7b9d7de89cf5eeb1d11544 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15024 CVE: CVE-2026-43466 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1633111d69053512d099658d4a05fc736fab36b0 ] In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer. After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery. The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dma_fifo_cc is already equal to dma_fifo_pc. There is no need to reset either counter, similar to how skb_fifo pc/cc are untouched. Remove the 'dma_fifo_cc = 0' reset. This fixes the following WARNING: WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90 Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00 Call Trace: <IRQ> ? __warn+0x7d/0x110 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0x16d/0x180 ? handle_bug+0x4f/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 ? iommu_dma_unmap_page+0x2e/0x90 dma_unmap_page_attrs+0x10d/0x1b0 mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core] mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core] mlx5e_napi_poll+0x8b/0xac0 [mlx5_core] __napi_poll+0x24/0x190 net_rx_action+0x32a/0x3b0 ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core] ? notifier_call_chain+0x35/0xa0 handle_softirqs+0xc9/0x270 irq_exit_rcu+0x71/0xd0 common_interrupt+0x7f/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 Fixes: db75373c91b0 ("net/mlx5e: Recover Send Queue (SQ) from error state") Signed-off-by: Gal Pressman <gal(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20260305142634.1813208-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c drivers/net/ethernet/mellanox/mlx5/core/en_main.c [ Context conflict. ] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c index 51edc507b7b5..2e27f41a97b5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -1346,7 +1346,6 @@ static void mlx5e_reset_txqsq_cc_pc(struct mlx5e_txqsq *sq) "SQ 0x%x: cc (0x%x) != pc (0x%x)\n", sq->sqn, sq->cc, sq->pc); sq->cc = 0; - sq->dma_fifo_cc = 0; sq->pc = 0; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2026-46181
by Cai Xinchen 02 Jun '26

02 Jun '26

CVE-2026-46181 Jason Gunthorpe (1): RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Suren Baghdasaryan (1): refcount: provide ops for cases when object's memory can be reused Documentation/core-api/refcount-vs-atomic.rst | 37 +++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 ++- include/linux/refcount.h | 106 ++++++++++++++++++ include/linux/slab.h | 9 ++ 4 files changed, 153 insertions(+), 12 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH OLK-5.10 0/2] CVE-2026-46181
by Cai Xinchen 02 Jun '26

02 Jun '26

CVE-2026-46181 Jason Gunthorpe (1): RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Suren Baghdasaryan (1): refcount: provide ops for cases when object's memory can be reused Documentation/core-api/refcount-vs-atomic.rst | 37 +++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 ++- include/linux/refcount.h | 106 ++++++++++++++++++ include/linux/slab.h | 9 ++ 4 files changed, 153 insertions(+), 12 deletions(-) -- 2.18.0.huawei.25

2 3

[PATCH OLK-6.6 0/1] CVE-2026-43201
by Liu Mingrui 02 Jun '26

02 Jun '26

CVE-2026-43201 Mauro Carvalho Chehab (1): APEI/GHES: ARM processor Error: don't go past allocated memory drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-46181
by Cai Xinchen 02 Jun '26

02 Jun '26

CVE-2026-46181 Jason Gunthorpe (1): RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Suren Baghdasaryan (1): refcount: provide ops for cases when object's memory can be reused Documentation/RCU/whatisRCU.rst | 10 ++ Documentation/core-api/refcount-vs-atomic.rst | 37 +++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 ++- include/linux/refcount.h | 106 ++++++++++++++++++ include/linux/slab.h | 9 ++ 5 files changed, 163 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects()
by Qi Xi 02 Jun '26

02 Jun '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/15059 CVE: NA --------------------------- Fixes the incorrect callback invocation that would cause shrinker behavior mismatch when adapting v2 shrinkers to v1 interface. Signed-off-by: Qi Xi <xiqi5703(a)163.com> --- mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index cf6b9e6dc8cd..305aa6b3cd84 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7623,7 +7623,7 @@ static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, struct shrink_control *sc) { if (shk_v2->v1) - return shk_v2->v1->count_objects(shk_v2->v1, sc); + return shk_v2->v1->scan_objects(shk_v2->v1, sc); return SHRINK_EMPTY; } -- 2.53.0

2 1

[PATCH openEuler-1.0-LTS] ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
by Zizhi Wo 02 Jun '26

02 Jun '26

From: Zhang Yi <yi.zhang(a)huawei.com> stable inclusion from stable-v5.10.253 commit 77e407967cd872cd75d7e4a691908e49c8e6b4d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15236 CVE: CVE-2026-45985 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit feaf2a80e78f89ee8a3464126077ba8683b62791 ] When allocating blocks during within-EOF DIO and writeback with dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was set when calling ext4_split_convert_extents(), which may potentially result in stale data issues. Assume we have an unwritten extent, and then DIO writes the second half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, ext4_iomap_alloc() call ext4_map_blocks() with EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the above flags set. Then, ext4_split_convert_extents() calls ext4_split_extent() with EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2 flags set, and it calls ext4_split_extent_at() to split the second half with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at() failed to insert extent since a temporary lack -ENOSPC. It zeroes out the first half but convert the entire on-disk extent to written since the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten in the extent status tree. [0000000000SSSSSS] data S: stale data, 0: zeroed [WWWWWWWWWWWWWWWW] on-disk extent W: written extent [WWWWWWWWWWUUUUUU] extent status tree Finally, if the DIO failed to write data to the disk, the stale data in the second half will be exposed once the cached extent entry is gone. Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting an unwritten extent before submitting I/O, and make ext4_split_convert_extents() to zero out the entire extent range to zero for this case, and also mark the extent in the extent status tree for consistency. Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Message-ID: <20251129103247.686136-4-yi.zhang(a)huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> [ different function signatures ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/ext4/extents.c [Because of commit 779e26517b36 ("ext4: clean up GET_BLOCKS_PRE_IO error handling") not merged, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/extents.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 5f2654bfe2f1..bddc00996306 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3872,15 +3872,19 @@ static int ext4_split_convert_extents(handle_t *handle, ee_len = ext4_ext_get_actual_len(ex); /* Convert to unwritten */ if (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN) { split_flag |= EXT4_EXT_DATA_VALID1; - /* Convert to initialized */ - } else if (flags & EXT4_GET_BLOCKS_CONVERT) { + /* Split the existing unwritten extent */ + } else if (flags & (EXT4_GET_BLOCKS_UNWRIT_EXT | + EXT4_GET_BLOCKS_CONVERT)) { split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0; - split_flag |= (EXT4_EXT_MARK_UNWRIT2 | EXT4_EXT_DATA_VALID2); + split_flag |= EXT4_EXT_MARK_UNWRIT2; + /* Convert to initialized */ + if (flags & EXT4_GET_BLOCKS_CONVERT) + split_flag |= EXT4_EXT_DATA_VALID2; } flags |= EXT4_GET_BLOCKS_PRE_IO; return ext4_split_extent(handle, inode, ppath, map, split_flag, flags); } @@ -4207,11 +4211,11 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, allocated, newblock); /* get_block() before submit the IO, split the extent */ if (flags & EXT4_GET_BLOCKS_PRE_IO) { ret = ext4_split_convert_extents(handle, inode, map, ppath, - flags | EXT4_GET_BLOCKS_CONVERT); + flags); if (ret <= 0) goto out; map->m_flags |= EXT4_MAP_UNWRITTEN; goto out; } -- 2.52.0

2 1

[PATCH OLK-6.6] bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken
by Pu Lehui 02 Jun '26

02 Jun '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.1-rc1 commit 9f118095dd341885dbc3f1cd6a028414da099aba category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a pkt pointer acquires AT_PKT_END or BEYOND_PKT_END range from a comparison, and then, known-constant arithmetic is performed, adjust_ptr_min_max_vals() copies the stale range via dst_reg->raw = ptr_reg->raw without clearing the negative reg->range sentinel values. This lets is_pkt_ptr_branch_taken() choose one branch direction and skip going through the other. Fix this by clearing negative pkt range values (that is, AT_PKT_END and BEYOND_PKT_END) after arithmetic on pkt pointers. This ensures is_pkt_ptr_branch_taken() returns unknown and both branches are properly verified. Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.") Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20260409155016.536608-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [Not merged commit 022ac0750883] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7ad363512643..9894c45aeb0c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12912,9 +12912,16 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, dst_reg->off = ptr_reg->off; dst_reg->raw = ptr_reg->raw; if (reg_is_pkt_pointer(ptr_reg)) { - dst_reg->id = ++env->id_gen; - /* something was added to pkt_ptr, set range to zero */ - memset(&dst_reg->raw, 0, sizeof(dst_reg->raw)); + if (!known) + dst_reg->id = ++env->id_gen; + /* + * Clear range for unknown addends since we can't know + * where the pkt pointer ended up. Also clear AT_PKT_END / + * BEYOND_PKT_END from prior comparison as any pointer + * arithmetic invalidates them. + */ + if (!known || dst_reg->range < 0) + memset(&dst_reg->raw, 0, sizeof(dst_reg->raw)); } break; case BPF_SUB: @@ -12971,9 +12978,16 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, dst_reg->off = ptr_reg->off; dst_reg->raw = ptr_reg->raw; if (reg_is_pkt_pointer(ptr_reg)) { - dst_reg->id = ++env->id_gen; - /* something was added to pkt_ptr, set range to zero */ - if (smin_val < 0) + if (!known) + dst_reg->id = ++env->id_gen; + /* + * Clear range if the subtrahend may be negative since + * pkt pointer could move past its bounds. A positive + * subtrahend moves it backwards keeping positive range + * intact. Also clear AT_PKT_END / BEYOND_PKT_END from + * prior comparison as arithmetic invalidates them. + */ + if ((!known && smin_val < 0) || dst_reg->range < 0) memset(&dst_reg->raw, 0, sizeof(dst_reg->raw)); } break; -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
by Jiacheng Yu 02 Jun '26

02 Jun '26

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v7.0-rc1 commit 5a19302cab5cec7ae7f1a60c619951e6c17d8742 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15122 CVE: CVE-2026-45878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array. drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely. This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined). 439 return -EINVAL; 440 441 if (!pdd->dev->kfd->shared_resources.enable_mes) { 442 r = debug_lock_and_unmap(pdd->dev->dqm); 443 if (r) 444 return r; 445 } 446 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false); --> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id); v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id(). Fixes: e0f85f4690d0 ("drm/amdkfd: add debug set and clear address watch points operation") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Jonathan Kim <jonathan.kim(a)amd.com> Cc: Felix Kuehling <felix.kuehling(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: Christian König <christian.koenig(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Jonathan Kim <jonathan.kim(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_debug.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c index 9c32c64c407f..cd1d92d5cb30 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_debug.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_debug.c @@ -400,27 +400,25 @@ static int kfd_dbg_get_dev_watch_id(struct kfd_process_device *pdd, int *watch_i return -ENOMEM; } -static void kfd_dbg_clear_dev_watch_id(struct kfd_process_device *pdd, int watch_id) +static void kfd_dbg_clear_dev_watch_id(struct kfd_process_device *pdd, u32 watch_id) { spin_lock(&pdd->dev->kfd->watch_points_lock); /* process owns device watch point so safe to clear */ - if ((pdd->alloc_watch_ids >> watch_id) & 0x1) { - pdd->alloc_watch_ids &= ~(0x1 << watch_id); - pdd->dev->kfd->alloc_watch_ids &= ~(0x1 << watch_id); + if (pdd->alloc_watch_ids & BIT(watch_id)) { + pdd->alloc_watch_ids &= ~BIT(watch_id); + pdd->dev->kfd->alloc_watch_ids &= ~BIT(watch_id); } spin_unlock(&pdd->dev->kfd->watch_points_lock); } -static bool kfd_dbg_owns_dev_watch_id(struct kfd_process_device *pdd, int watch_id) +static bool kfd_dbg_owns_dev_watch_id(struct kfd_process_device *pdd, u32 watch_id) { bool owns_watch_id = false; spin_lock(&pdd->dev->kfd->watch_points_lock); - owns_watch_id = watch_id < MAX_WATCH_ADDRESSES && - ((pdd->alloc_watch_ids >> watch_id) & 0x1); - + owns_watch_id = pdd->alloc_watch_ids & BIT(watch_id); spin_unlock(&pdd->dev->kfd->watch_points_lock); return owns_watch_id; @@ -431,6 +429,9 @@ int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, { int r; + if (watch_id >= MAX_WATCH_ADDRESSES) + return -EINVAL; + if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) return -EINVAL; @@ -468,6 +469,9 @@ int kfd_dbg_trap_set_dev_address_watch(struct kfd_process_device *pdd, if (r) return r; + if (*watch_id >= MAX_WATCH_ADDRESSES) + return -EINVAL; + if (!pdd->dev->kfd->shared_resources.enable_mes) { r = debug_lock_and_unmap(pdd->dev->dqm); if (r) { -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
by Jiacheng Yu 02 Jun '26

02 Jun '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc1 commit c9be63d565789b56ca7b0197e2cb78a3671f95a8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15186 CVE: CVE-2026-45947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without releasing the allocated xcc_info, resulting in a memory leak. Fix this by ensuring that xcc_info is properly freed in the error paths. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 4d5275ab0b18 ("drm/amdgpu: Add parsing of acpi xcc objects") Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c index 8b2f2b921d9d..7730e5644493 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c @@ -1128,8 +1128,10 @@ static int amdgpu_acpi_enumerate_xcc(void) if (!dev_info) ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, bdf); - if (ret == -ENOMEM) + if (ret == -ENOMEM) { + kfree(xcc_info); return ret; + } if (!dev_info) { kfree(xcc_info); -- 2.34.1

2 1

[PATCH OLK-6.6] drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
by Jiacheng Yu 02 Jun '26

02 Jun '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 2fc87d37be1b730a149b035f9375fdb8cc5333a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15257 CVE: CVE-2026-46006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size. Cast to u64 so the addition happens in 64-bit arithmetic. Cc: Lyude Paul <lyude(a)redhat.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: Simona Vetter <simona(a)ffwll.ch> Reported-by: Anthropic Cc: stable <stable(a)kernel.org> Assisted-by: gkh_clanker_t1000 Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16") Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Add Fixes: tag. - Danilo ] Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index cd97df690335..e8ce33c89548 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -679,7 +679,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, } nvbo = (void *)(unsigned long)bo[r->reloc_bo_index].user_priv; - if (unlikely(r->reloc_bo_offset + 4 > + if (unlikely((u64)r->reloc_bo_offset + 4 > nvbo->bo.base.size)) { NV_PRINTK(err, cli, "reloc outside of bo\n"); ret = -EINVAL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
by Jiacheng Yu 02 Jun '26

02 Jun '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 2fc87d37be1b730a149b035f9375fdb8cc5333a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15257 CVE: CVE-2026-46006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size. Cast to u64 so the addition happens in 64-bit arithmetic. Cc: Lyude Paul <lyude(a)redhat.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: Simona Vetter <simona(a)ffwll.ch> Reported-by: Anthropic Cc: stable <stable(a)kernel.org> Assisted-by: gkh_clanker_t1000 Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16") Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Add Fixes: tag. - Danilo ] Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Conflicts: drivers/gpu/drm/nouveau/nouveau_gem.c [Contest conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index b56524d343c3..177d53a44910 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -633,7 +633,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, } nvbo = (void *)(unsigned long)bo[r->reloc_bo_index].user_priv; - if (unlikely(r->reloc_bo_offset + 4 > + if (unlikely((u64)r->reloc_bo_offset + 4 > nvbo->bo.mem.num_pages << PAGE_SHIFT)) { NV_PRINTK(err, cli, "reloc outside of bo\n"); ret = -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 02 Jun '26

02 Jun '26

From: Ying Jiang <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 5 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1099 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

1 34

[PATCH OLK-6.6 0/6] add min_slice and sched_runtime
by Chen Jinghuang 01 Jun '26

01 Jun '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage in struct sched_entity Omar Sandoval (1): sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash Peter Zijlstra (3): sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion sched/fair: Re-organize dequeue_task_fair() sched/eevdf: Propagate min_slice up the cgroup hierarchy Tianchen Ding (1): sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks include/linux/sched.h | 5 +- kernel/sched/core.c | 4 +- kernel/sched/debug.c | 3 +- kernel/sched/fair.c | 131 ++++++++++++++++++++++++++++++++-------- kernel/sched/syscalls.c | 29 +++++++-- 5 files changed, 137 insertions(+), 35 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6] sched/cputime: Fix time overflow in cputime_adjust()
by Xia Fukun 01 Jun '26

01 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8331 ------------------ When a process has hundreds of threads and runs for an extended period, the aggregated stime or utime of its thread group can become extremely large. Accessing /proc/xx/stat then triggers a divide error like the following: divide error: 0000 [#1] SMP NOPTI CPU: 273 PID: 4619 Comm: ... Tainted: 5.10.0 x86_64 RIP: 0010:cputime_adjust+0x55/0xb0 RSP: 0018:ffffae408e07bbc8 EFLAGS: 00010807 ... Call Trace: thread_group_cputime_adjusted+0x4b/0x70 do_task_stat+0x2d8/0xdc0 This is due to overflow in stime + utime, which causes mul_u64_u64_div_u64() to trigger a divide error. Add overflow detection logic and, upon overflow, right-shift the values before computation. This fixes the issue while preserving the original calculation semantics. Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/cputime.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index e560426f23bd..773b9411007c 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -564,6 +564,7 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, u64 *ut, u64 *st) { u64 rtime, stime, utime; + u64 s, u, sum; unsigned long flags; /* Serialize concurrent callers such that we can honour our guarantees */ @@ -599,7 +600,23 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, goto update; } - stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + s = stime; + u = utime; + sum = s + u; + + /* + * Detect unsigned overflow: if sum < either operand, + * overflow occurred. A single right shift is sufficient + * to guarantee that the new sum won't overflow. + */ + if (unlikely(sum < s)) { + s >>= 1; + u >>= 1; + sum = s + u; + stime = mul_u64_u64_div_u64(s, rtime, sum); + } else { + stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + } /* * Because mul_u64_u64_div_u64() can approximate on some * achitectures; enforce the constraint that: a*b/(b+c) <= a. -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: x_tables: guard option walkers against 1-byte tail reads
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: David Dull <monderasdor(a)gmail.com> stable inclusion from stable-v6.6.130 commit 9b94f0e42ed248eb31929da84ed9f5310d7ff540 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15010 CVE: CVE-2026-43452 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ] When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Signed-off-by: David Dull <monderasdor(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_dccp.c | 4 ++-- net/netfilter/xt_tcpudp.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index e5a13ecbe67a..037ab93e25d0 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option, return true; } - if (op[i] < 2) + if (op[i] < 2 || i == optlen - 1) i++; else - i += op[i+1]?:1; + i += op[i + 1] ? : 1; } spin_unlock_bh(&dccp_buflock); diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c index e8991130a3de..f76cf18f1a24 100644 --- a/net/netfilter/xt_tcpudp.c +++ b/net/netfilter/xt_tcpudp.c @@ -59,8 +59,10 @@ tcp_find_option(u_int8_t option, for (i = 0; i < optlen; ) { if (op[i] == option) return !invert; - if (op[i] < 2) i++; - else i += op[i+1]?:1; + if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i + 1] ? : 1; } return invert; -- 2.43.0

2 1

[PATCH OLK-5.10] sched/cputime: Fix time overflow in cputime_adjust()
by Xia Fukun 01 Jun '26

01 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8331 ------------------ When a process has hundreds of threads and runs for an extended period, the aggregated stime or utime of its thread group can become extremely large. Accessing /proc/xx/stat then triggers a divide error like the following: divide error: 0000 [#1] SMP NOPTI CPU: 273 PID: 4619 Comm: ... Tainted: 5.10.0 x86_64 RIP: 0010:cputime_adjust+0x55/0xb0 RSP: 0018:ffffae408e07bbc8 EFLAGS: 00010807 ... Call Trace: thread_group_cputime_adjusted+0x4b/0x70 do_task_stat+0x2d8/0xdc0 This is due to overflow in stime + utime, which causes mul_u64_u64_div_u64() to trigger a divide error. Add overflow detection logic and, upon overflow, right-shift the values before computation. This fixes the issue while preserving the original calculation semantics. Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/cputime.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index f03b3af2fb79..38cb82382730 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -543,6 +543,7 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, u64 *ut, u64 *st) { u64 rtime, stime, utime; + u64 s, u, sum; unsigned long flags; /* Serialize concurrent callers such that we can honour our guarantees */ @@ -578,7 +579,23 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, goto update; } - stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + s = stime; + u = utime; + sum = s + u; + + /* + * Detect unsigned overflow: if sum < either operand, + * overflow occurred. A single right shift is sufficient + * to guarantee that the new sum won't overflow. + */ + if (unlikely(sum < s)) { + s >>= 1; + u >>= 1; + sum = s + u; + stime = mul_u64_u64_div_u64(s, rtime, sum); + } else { + stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + } /* * Because mul_u64_u64_div_u64() can approximate on some * achitectures; enforce the constraint that: a*b/(b+c) <= a. -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: x_tables: guard option walkers against 1-byte tail reads
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: David Dull <monderasdor(a)gmail.com> stable inclusion from stable-v5.10.253 commit c2a445367a496a3c25dbc940c10c8bd1cfd4c14a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15010 CVE: CVE-2026-43452 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ] When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Signed-off-by: David Dull <monderasdor(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_dccp.c | 4 ++-- net/netfilter/xt_tcpudp.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index e5a13ecbe67a..037ab93e25d0 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option, return true; } - if (op[i] < 2) + if (op[i] < 2 || i == optlen - 1) i++; else - i += op[i+1]?:1; + i += op[i + 1] ? : 1; } spin_unlock_bh(&dccp_buflock); diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c index 11ec2abf0c72..73f50dc01b19 100644 --- a/net/netfilter/xt_tcpudp.c +++ b/net/netfilter/xt_tcpudp.c @@ -56,8 +56,10 @@ tcp_find_option(u_int8_t option, for (i = 0; i < optlen; ) { if (op[i] == option) return !invert; - if (op[i] < 2) i++; - else i += op[i+1]?:1; + if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i + 1] ? : 1; } return invert; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: x_tables: guard option walkers against 1-byte tail reads
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: David Dull <monderasdor(a)gmail.com> mainline inclusion from mainline-v7.0-rc4 commit cfe770220ac2dbd3e104c6b45094037455da81d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15010 CVE: CVE-2026-43452 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Signed-off-by: David Dull <monderasdor(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_dccp.c | 4 ++-- net/netfilter/xt_tcpudp.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index b63d2a3d80ba..b74f6b76d3ca 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -65,10 +65,10 @@ dccp_find_option(u_int8_t option, return true; } - if (op[i] < 2) + if (op[i] < 2 || i == optlen - 1) i++; else - i += op[i+1]?:1; + i += op[i + 1] ? : 1; } spin_unlock_bh(&dccp_buflock); diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c index ade024c90f4f..8d620f84795d 100644 --- a/net/netfilter/xt_tcpudp.c +++ b/net/netfilter/xt_tcpudp.c @@ -55,8 +55,10 @@ tcp_find_option(u_int8_t option, for (i = 0; i < optlen; ) { if (op[i] == option) return !invert; - if (op[i] < 2) i++; - else i += op[i+1]?:1; + if (op[i] < 2 || i == optlen - 1) + i++; + else + i += op[i + 1] ? : 1; } return invert; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] xfrm: Wait for RCU readers during policy netns exit
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Steffen Klassert <steffen.klassert(a)secunet.com> mainline inclusion from mainline-v7.1-rc1 commit 069daad4f2ae9c5c108131995529d5f02392c446 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14643 CVE: CVE-2026-43091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory. Fix this by adding synchronize_rcu() before freeing the policy hash tables. Fixes: e1e551bc5630 ("xfrm: policy: prepare policy_bydst hash for rcu lookups") Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Reviewed-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index f0c4571b128a..5d635f005ab7 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2884,6 +2884,8 @@ static void xfrm_policy_fini(struct net *net) #endif xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, false); + synchronize_rcu(); + WARN_ON(!list_empty(&net->xfrm.policy_all)); for (dir = 0; dir < XFRM_POLICY_MAX; dir++) { -- 2.43.0

2 1

[PATCH OLK-5.10] ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
by Zhang Yuwei 01 Jun '26

01 Jun '26

From: Ziqing Chen <chenziqing(a)xiaomi.com> stable inclusion from stable-v6.6.140 commit 1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15330 CVE: CVE-2026-46088 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e0da8a8cac74f4b9f577979d131f0d2b88a84487 upstream. snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone. Fixes: 8d448162bda5 ("ALSA: control: add support for ENUMERATED user space controls") Cc: stable(a)vger.kernel.org Signed-off-by: Ziqing Chen <chenziqing(a)xiaomi.com> Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Conflicts: sound/core/control.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- sound/core/control.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control.c b/sound/core/control.c index 732eb515d2f5..640bafb6605a 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1387,6 +1387,10 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) buf_len = ue->info.value.enumerated.names_length; p = names; for (i = 0; i < ue->info.value.enumerated.items; ++i) { + if (buf_len == 0) { + kvfree(names); + return -EINVAL; + } name_len = strnlen(p, buf_len); if (name_len == 0 || name_len >= 64 || name_len == buf_len) { kvfree(names); -- 2.22.0

2 1

[PATCH OLK-5.10] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Hyunwoo Kim <imv4bel(a)gmail.com> stable inclusion from stable-v5.10.253 commit 0605e1985a95d4334a67869aee45a47e82301abf category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15008 CVE: CVE-2026-43450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ] nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 3134df2423e9..10201a58d15e 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -601,10 +601,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } - if (cb->args[1]) { - cb->args[1] = 0; - goto restart; + if (cb->args[1]) { + cb->args[1] = 0; + goto restart; + } } out: rcu_read_unlock(); -- 2.43.0

2 1

[PATCH openEuler-24.03-LTS_SP3 0/5] add min_slice and sched_attr::sched_runtime
by Chen Jinghuang 01 Jun '26

01 Jun '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage in struct sched_entity and sched_class Peter Zijlstra (4): sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion sched: Allow sched_class::dequeue_task() to fail sched/fair: Re-organize dequeue_task_fair() sched/eevdf: Propagate min_slice up the cgroup hierarchy include/linux/sched.h | 5 +- kernel/sched/core.c | 11 +++- kernel/sched/deadline.c | 4 +- kernel/sched/debug.c | 3 +- kernel/sched/fair.c | 128 +++++++++++++++++++++++++++++++-------- kernel/sched/idle.c | 3 +- kernel/sched/rt.c | 4 +- kernel/sched/sched.h | 3 +- kernel/sched/stop_task.c | 3 +- 9 files changed, 129 insertions(+), 35 deletions(-) -- 2.34.1

1 7

[PATCH OLK-6.6] KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
by Zhang Kunbo 01 Jun '26

01 Jun '26

From: Yosry Ahmed <yosry(a)kernel.org> stable inclusion from stable-v7.0.4 commit 9a738cf170a4a2332ea3a15e23ec65b5757fe4a1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15277 CVE: CVE-2026-46032 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5d291ef0585ed880ed4dd71ea1a5965e0a65fb53 upstream. If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway. Fixes: d82aaef9c88a ("KVM: nSVM: use nested_svm_load_cr3() on guest->host switch") CC: stable(a)vger.kernel.org Signed-off-by: Yosry Ahmed <yosry(a)kernel.org> Link: https://patch.msgid.link/20260303003421.2185681-10-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/kvm/svm/nested.c arch/x86/kvm/svm/svm.h [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/nested.c | 10 +++------- arch/x86/kvm/svm/svm.c | 11 ++--------- arch/x86/kvm/svm/svm.h | 6 +++--- 3 files changed, 8 insertions(+), 19 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f47242a1e602..daea197d8aee 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -968,14 +968,13 @@ void svm_copy_vmloadsave_state(struct vmcb *to_vmcb, struct vmcb *from_vmcb) to_vmcb->save.sysenter_eip = from_vmcb->save.sysenter_eip; } -int nested_svm_vmexit(struct vcpu_svm *svm) +void nested_svm_vmexit(struct vcpu_svm *svm) { struct kvm_vcpu *vcpu = &svm->vcpu; struct vmcb *vmcb01 = svm->vmcb01.ptr; struct vmcb *vmcb02 = svm->nested.vmcb02.ptr; struct vmcb *vmcb12; struct kvm_host_map map; - int rc; rc = kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.vmcb12_gpa), &map); if (rc) { @@ -1136,9 +1135,8 @@ int nested_svm_vmexit(struct vcpu_svm *svm) nested_svm_uninit_mmu_context(vcpu); - rc = nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true); - if (rc) - return 1; + if (nested_svm_load_cr3(vcpu, vmcb01->save.cr3, false, true)) + kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); /* * Drop what we picked up for L2 via svm_complete_interrupts() so it @@ -1163,8 +1161,6 @@ int nested_svm_vmexit(struct vcpu_svm *svm) */ if (kvm_apicv_activated(vcpu->kvm)) __kvm_vcpu_update_apicv(vcpu); - - return 0; } static void nested_svm_triple_fault(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index ad25a6995ee6..30f25ee08df7 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2402,13 +2402,9 @@ static int emulate_svm_instr(struct kvm_vcpu *vcpu, int opcode) [SVM_INSTR_VMSAVE] = vmsave_interception, }; struct vcpu_svm *svm = to_svm(vcpu); - int ret; if (is_guest_mode(vcpu)) { - /* Returns '1' or -errno on failure, '0' on success. */ - ret = nested_svm_simple_vmexit(svm, guest_mode_exit_codes[opcode]); - if (ret) - return ret; + nested_svm_simple_vmexit(svm, guest_mode_exit_codes[opcode]); return 1; } return svm_instr_handlers[opcode](vcpu); @@ -4768,7 +4764,6 @@ static int svm_enter_smm(struct kvm_vcpu *vcpu, union kvm_smram *smram) { struct vcpu_svm *svm = to_svm(vcpu); struct kvm_host_map map_save; - int ret; if (!is_guest_mode(vcpu)) return 0; @@ -4788,9 +4783,7 @@ static int svm_enter_smm(struct kvm_vcpu *vcpu, union kvm_smram *smram) svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP]; svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP]; - ret = nested_svm_simple_vmexit(svm, SVM_EXIT_SW); - if (ret) - return ret; + nested_svm_simple_vmexit(svm, SVM_EXIT_SW); /* * KVM uses VMCB01 to store L1 host state while L2 runs but diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 565d6e1355f6..aa3f87cb1f23 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -604,15 +604,15 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu); void svm_copy_vmrun_state(struct vmcb_save_area *to_save, struct vmcb_save_area *from_save); void svm_copy_vmloadsave_state(struct vmcb *to_vmcb, struct vmcb *from_vmcb); -int nested_svm_vmexit(struct vcpu_svm *svm); +void nested_svm_vmexit(struct vcpu_svm *svm); -static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_code) +static inline void nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_code) { svm->vmcb->control.exit_code = exit_code; svm->vmcb->control.exit_code_hi = 0; svm->vmcb->control.exit_info_1 = 0; svm->vmcb->control.exit_info_2 = 0; - return nested_svm_vmexit(svm); + nested_svm_vmexit(svm); } int nested_svm_exit_handled(struct vcpu_svm *svm); -- 2.34.1

2 1

[PATCH OLK-6.6] net: usb: pegasus: enable basic endpoint checking
by Wupeng Ma 01 Jun '26

01 Jun '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v6.12.75 commit 67ba6b13dbcaf45681fb6758794c5ac5fa589a6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14703 CVE: CVE-2026-43156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3d7e6ce34f4fcc7083510c28b17a7c36462a25d4 ] pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_rcvbulkpipe(dev, 1) for RX data - usb_sndbulkpipe(dev, 2) for TX data - usb_rcvintpipe(dev, 3) for status interrupts A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a pegasus_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls before any resource allocation to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time, and avoid triggering assertion. Similar fix to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") - commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260222050633.410165-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/usb/pegasus.c | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c index 7cc949460edc9..475b066081c7f 100644 --- a/drivers/net/usb/pegasus.c +++ b/drivers/net/usb/pegasus.c @@ -31,6 +31,17 @@ static const char driver_name[] = "pegasus"; BMSR_100FULL | BMSR_ANEGCAPABLE) #define CARRIER_CHECK_DELAY (2 * HZ) +/* + * USB endpoints. + */ + +enum pegasus_usb_ep { + PEGASUS_USB_EP_CONTROL = 0, + PEGASUS_USB_EP_BULK_IN = 1, + PEGASUS_USB_EP_BULK_OUT = 2, + PEGASUS_USB_EP_INT_IN = 3, +}; + static bool loopback; static bool mii_mode; static char *devid; @@ -545,7 +556,7 @@ static void read_bulk_callback(struct urb *urb) goto tl_sched; goon: usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb, - usb_rcvbulkpipe(pegasus->usb, 1), + usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN), pegasus->rx_skb->data, PEGASUS_MTU, read_bulk_callback, pegasus); rx_status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC); @@ -585,7 +596,7 @@ static void rx_fixup(struct tasklet_struct *t) return; } usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb, - usb_rcvbulkpipe(pegasus->usb, 1), + usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN), pegasus->rx_skb->data, PEGASUS_MTU, read_bulk_callback, pegasus); try_again: @@ -713,7 +724,7 @@ static netdev_tx_t pegasus_start_xmit(struct sk_buff *skb, ((__le16 *) pegasus->tx_buff)[0] = cpu_to_le16(l16); skb_copy_from_linear_data(skb, pegasus->tx_buff + 2, skb->len); usb_fill_bulk_urb(pegasus->tx_urb, pegasus->usb, - usb_sndbulkpipe(pegasus->usb, 2), + usb_sndbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_OUT), pegasus->tx_buff, count, write_bulk_callback, pegasus); if ((res = usb_submit_urb(pegasus->tx_urb, GFP_ATOMIC))) { @@ -851,7 +862,7 @@ static int pegasus_open(struct net_device *net) set_registers(pegasus, EthID, 6, net->dev_addr); usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb, - usb_rcvbulkpipe(pegasus->usb, 1), + usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN), pegasus->rx_skb->data, PEGASUS_MTU, read_bulk_callback, pegasus); if ((res = usb_submit_urb(pegasus->rx_urb, GFP_KERNEL))) { @@ -862,7 +873,7 @@ static int pegasus_open(struct net_device *net) } usb_fill_int_urb(pegasus->intr_urb, pegasus->usb, - usb_rcvintpipe(pegasus->usb, 3), + usb_rcvintpipe(pegasus->usb, PEGASUS_USB_EP_INT_IN), pegasus->intr_buff, sizeof(pegasus->intr_buff), intr_callback, pegasus, pegasus->intr_interval); if ((res = usb_submit_urb(pegasus->intr_urb, GFP_KERNEL))) { @@ -1147,10 +1158,24 @@ static int pegasus_probe(struct usb_interface *intf, pegasus_t *pegasus; int dev_index = id - pegasus_ids; int res = -ENOMEM; + static const u8 bulk_ep_addr[] = { + PEGASUS_USB_EP_BULK_IN | USB_DIR_IN, + PEGASUS_USB_EP_BULK_OUT | USB_DIR_OUT, + 0}; + static const u8 int_ep_addr[] = { + PEGASUS_USB_EP_INT_IN | USB_DIR_IN, + 0}; if (pegasus_blacklisted(dev)) return -ENODEV; + /* Verify that all required endpoints are present */ + if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) || + !usb_check_int_endpoints(intf, int_ep_addr)) { + dev_err(&intf->dev, "Missing or invalid endpoints\n"); + return -ENODEV; + } + net = alloc_etherdev(sizeof(struct pegasus)); if (!net) goto out; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
by Wupeng Ma 01 Jun '26

01 Jun '26

From: SeongJae Park <sj(a)kernel.org> stable inclusion from stable-v6.12.88 commit c88802d0e8edd14b6cd2daf3000f99adbc4c85c5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15373 CVE: CVE-2026-46121 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e68eb96e8beb1abefd12dd22c5637795d8a877e upstream. Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path". Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those. This patch (of 2): damon_sysfs_scheme_filter->mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock. Link: https://lore.kernel.org/20260423150253.111520-1-sj@kernel.org Link: https://lore.kernel.org/20260423150253.111520-2-sj@kernel.org Fixes: 4f489fe6afb3 ("mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write") Co-developed-by: Junxi Qian <qjx1298677004(a)gmail.com> Signed-off-by: Junxi Qian <qjx1298677004(a)gmail.com> Signed-off-by: SeongJae Park <sj(a)kernel.org> Cc: <stable(a)vger.kernel.org> # 6.16.x Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/damon/sysfs-schemes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c index 13229cf9c7d1f..1c1662db8f80f 100644 --- a/mm/damon/sysfs-schemes.c +++ b/mm/damon/sysfs-schemes.c @@ -360,9 +360,14 @@ static ssize_t memcg_path_show(struct kobject *kobj, { struct damon_sysfs_scheme_filter *filter = container_of(kobj, struct damon_sysfs_scheme_filter, kobj); + int len; - return sysfs_emit(buf, "%s\n", + if (!mutex_trylock(&damon_sysfs_lock)) + return -EBUSY; + len = sysfs_emit(buf, "%s\n", filter->memcg_path ? filter->memcg_path : ""); + mutex_unlock(&damon_sysfs_lock); + return len; } static ssize_t memcg_path_store(struct kobject *kobj, @@ -376,8 +381,13 @@ static ssize_t memcg_path_store(struct kobject *kobj, return -ENOMEM; strscpy(path, buf, count + 1); + if (!mutex_trylock(&damon_sysfs_lock)) { + kfree(path); + return -EBUSY; + } kfree(filter->memcg_path); filter->memcg_path = path; + mutex_unlock(&damon_sysfs_lock); return count; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v7.0-rc4 commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15008 CVE: CVE-2026-43450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index c8b0f1122c44..3ce818aa37d8 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -608,10 +608,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } - if (cb->args[1]) { - cb->args[1] = 0; - goto restart; + if (cb->args[1]) { + cb->args[1] = 0; + goto restart; + } } out: rcu_read_unlock(); -- 2.43.0

2 1

[PATCH openEuler-24.03-LTS_SP3 0/5] add min_slice and sched_attr::sched_runtime
by Chen Jinghuang 01 Jun '26

01 Jun '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix kabi breakage in struct sched_entity and sched_class Peter Zijlstra (4): sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion sched: Allow sched_class::dequeue_task() to fail sched/fair: Re-organize dequeue_task_fair() sched/eevdf: Propagate min_slice up the cgroup hierarchy include/linux/sched.h | 5 +- kernel/sched/core.c | 11 +++- kernel/sched/deadline.c | 4 +- kernel/sched/debug.c | 3 +- kernel/sched/fair.c | 128 +++++++++++++++++++++++++++++++-------- kernel/sched/idle.c | 3 +- kernel/sched/rt.c | 4 +- kernel/sched/sched.h | 3 +- kernel/sched/stop_task.c | 3 +- 9 files changed, 129 insertions(+), 35 deletions(-) -- 2.34.1

1 5

[PATCH OLK-6.6] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Hyunwoo Kim <imv4bel(a)gmail.com> stable inclusion from stable-v6.6.130 commit 4a1f6ee69267a5f524102c028981410eeacfa3da category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15008 CVE: CVE-2026-43450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ] nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 97248963a7d3..71a248cca746 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -603,10 +603,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } - if (cb->args[1]) { - cb->args[1] = 0; - goto restart; + if (cb->args[1]) { + cb->args[1] = 0; + goto restart; + } } out: rcu_read_unlock(); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/amd: serialize sequence allocation under concurrent TLB invalidations
by Zhang Yuwei 01 Jun '26

01 Jun '26

From: Ankit Soni <Ankit.Soni(a)amd.com> stable inclusion from stable-v6.6.128 commit 9e249c48412828e807afddc21527eb734dc9bd3d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14766 CVE: CVE-2026-43220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return. Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") Tested-by: Srikanth Aithal <sraithal(a)amd.com> Reported-by: Srikanth Aithal <sraithal(a)amd.com> Signed-off-by: Ankit Soni <Ankit.Soni(a)amd.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/amd_iommu_types.h drivers/iommu/amd/iommu.c [commit 7d0f5fd3e4d68 merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 17 ++++++++++++----- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 8f77221b68c4..1d25dba50d8c 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -776,7 +776,7 @@ struct amd_iommu { u32 flags; volatile u64 *cmd_sem; - atomic64_t cmd_sem_val; + u64 cmd_sem_val; #ifdef CONFIG_AMD_IOMMU_DEBUGFS /* DebugFS Info */ diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 62b1676c10c3..67f431da43a6 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -1810,7 +1810,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h, iommu->pci_seg = pci_seg; raw_spin_lock_init(&iommu->lock); - atomic64_set(&iommu->cmd_sem_val, 0); + iommu->cmd_sem_val = 0; /* Add IOMMU to internal data structures */ list_add_tail(&iommu->list, &amd_iommu_list); diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 05cf1d8f2e15..be92a5af96bd 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1261,6 +1261,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) return iommu_queue_command_sync(iommu, cmd, true); } +static u64 get_cmdsem_val(struct amd_iommu *iommu) +{ + lockdep_assert_held(&iommu->lock); + return ++iommu->cmd_sem_val; +} + /* * This function queues a completion wait command into the command * buffer of an IOMMU @@ -1275,11 +1281,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (!iommu->need_sync) return 0; - data = atomic64_add_return(1, &iommu->cmd_sem_val); - build_completion_wait(&cmd, iommu, data); - raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, false); if (ret) goto out_unlock; @@ -3093,10 +3099,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) return; build_inv_irt(&cmd, devid); - data = atomic64_add_return(1, &iommu->cmd_sem_val); - build_completion_wait(&cmd2, iommu, data); raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd2, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, true); if (ret) goto out; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 30 +++++++++++++++-------- 4 files changed, 36 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 4e3fff9f929b..7e12d5b27249 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -81,4 +81,9 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index c11822a7d2bf..c8b4c0c15767 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -238,6 +238,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 27b84231db10..a8dcb4e44d5f 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -105,6 +106,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -162,6 +165,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; @@ -414,6 +419,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -467,8 +474,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 331839218a1c..203a5d059b20 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3056,31 +3056,37 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + err = -ENOMEM; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (skb2 == NULL) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - err = -ENOMEM; - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (skb2 == NULL) { - nf_ct_expect_put(exp); - goto out; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) goto free; @@ -3135,22 +3141,26 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/amd: serialize sequence allocation under concurrent TLB invalidations
by Zhang Yuwei 01 Jun '26

01 Jun '26

From: Ankit Soni <Ankit.Soni(a)amd.com> stable inclusion from stable-v6.6.128 commit 9e249c48412828e807afddc21527eb734dc9bd3d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14766 CVE: CVE-2026-43220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return. Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") Tested-by: Srikanth Aithal <sraithal(a)amd.com> Reported-by: Srikanth Aithal <sraithal(a)amd.com> Signed-off-by: Ankit Soni <Ankit.Soni(a)amd.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/amd_iommu_types.h drivers/iommu/amd/iommu.c [commit 7d0f5fd3e4d68 merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 15 ++++++++++++--- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 8f77221b68c4..1d25dba50d8c 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -776,7 +776,7 @@ struct amd_iommu { u32 flags; volatile u64 *cmd_sem; - atomic64_t cmd_sem_val; + u64 cmd_sem_val; #ifdef CONFIG_AMD_IOMMU_DEBUGFS /* DebugFS Info */ diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 62b1676c10c3..67f431da43a6 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -1810,7 +1810,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h, iommu->pci_seg = pci_seg; raw_spin_lock_init(&iommu->lock); - atomic64_set(&iommu->cmd_sem_val, 0); + iommu->cmd_sem_val = 0; /* Add IOMMU to internal data structures */ list_add_tail(&iommu->list, &amd_iommu_list); diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 05cf1d8f2e15..7f8f28484952 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1261,6 +1261,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) return iommu_queue_command_sync(iommu, cmd, true); } +static u64 get_cmdsem_val(struct amd_iommu *iommu) +{ + lockdep_assert_held(&iommu->lock); + return ++iommu->cmd_sem_val; +} + /* * This function queues a completion wait command into the command * buffer of an IOMMU @@ -1275,11 +1281,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (!iommu->need_sync) return 0; - data = atomic64_add_return(1, &iommu->cmd_sem_val); - build_completion_wait(&cmd, iommu, data); - raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, false); if (ret) goto out_unlock; @@ -3097,6 +3103,9 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) build_completion_wait(&cmd2, iommu, data); raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd2, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, true); if (ret) goto out; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: nft_ct: drop pending enqueued packets on removal
by superdcc97＠163.com 01 Jun '26

01 Jun '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc5 commit 36eae0956f659e48d5366d9b083d9417f3263ddc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14592 CVE: CVE-2026-43060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference. Since these objects can just go away, drop enqueued packets to avoid stale reference to them. If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies. Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: net/netfilter/nft_ct.c [openEuler-1.0-LTS nft_ct.c differs from mainline: - lacks nft_ct_pcpu_mutex (introduced by commit e3245a7b7b34) - NFT_CT_ZONE case missing break statement - nf_ct_l4proto_put() present in nft_ct_timeout_obj_destroy() Adapted manually without introducing unsupported symbols] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_ct.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 5dd87748afa8..b17604b5b48b 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -24,6 +24,7 @@ #include <net/netfilter/nf_conntrack_labels.h> #include <net/netfilter/nf_conntrack_timeout.h> #include <net/netfilter/nf_conntrack_l4proto.h> +#include "nf_internals.h" struct nft_ct { enum nft_ct_keys key:8; @@ -514,6 +515,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) #endif #ifdef CONFIG_NF_CONNTRACK_ZONES case NFT_CT_ZONE: + nf_queue_nf_hook_drop(ctx->net); if (--nft_ct_pcpu_template_refcnt == 0) nft_ct_tmpl_put_pcpu(); #endif @@ -900,6 +902,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, struct nft_ct_timeout_obj *priv = nft_obj_data(obj); struct nf_ct_timeout *timeout = priv->timeout; + nf_queue_nf_hook_drop(ctx->net); nf_ct_untimeout(ctx->net, timeout); nf_ct_l4proto_put(timeout->l4proto); nf_ct_netns_put(ctx->net, ctx->family); @@ -1033,6 +1036,7 @@ static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, { struct nft_ct_helper_obj *priv = nft_obj_data(obj); + nf_queue_nf_hook_drop(ctx->net); if (priv->helper4) nf_conntrack_helper_put(priv->helper4); if (priv->helper6) -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/amd: serialize sequence allocation under concurrent TLB invalidations
by Zhang Yuwei 01 Jun '26

01 Jun '26

From: Ankit Soni <Ankit.Soni(a)amd.com> stable inclusion from stable-v6.6.128 commit 9e249c48412828e807afddc21527eb734dc9bd3d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14766 CVE: CVE-2026-43220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return. Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") Tested-by: Srikanth Aithal <sraithal(a)amd.com> Reported-by: Srikanth Aithal <sraithal(a)amd.com> Signed-off-by: Ankit Soni <Ankit.Soni(a)amd.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/amd_iommu_types.h drivers/iommu/amd/iommu.c [commit 7d0f5fd3e4d68 merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 15 ++++++++++++--- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 8f77221b68c4..1d25dba50d8c 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -776,7 +776,7 @@ struct amd_iommu { u32 flags; volatile u64 *cmd_sem; - atomic64_t cmd_sem_val; + u64 cmd_sem_val; #ifdef CONFIG_AMD_IOMMU_DEBUGFS /* DebugFS Info */ diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 62b1676c10c3..67f431da43a6 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -1810,7 +1810,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h, iommu->pci_seg = pci_seg; raw_spin_lock_init(&iommu->lock); - atomic64_set(&iommu->cmd_sem_val, 0); + iommu->cmd_sem_val = 0; /* Add IOMMU to internal data structures */ list_add_tail(&iommu->list, &amd_iommu_list); diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 05cf1d8f2e15..7f8f28484952 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1261,6 +1261,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) return iommu_queue_command_sync(iommu, cmd, true); } +static u64 get_cmdsem_val(struct amd_iommu *iommu) +{ + lockdep_assert_held(&iommu->lock); + return ++iommu->cmd_sem_val; +} + /* * This function queues a completion wait command into the command * buffer of an IOMMU @@ -1275,11 +1281,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (!iommu->need_sync) return 0; - data = atomic64_add_return(1, &iommu->cmd_sem_val); - build_completion_wait(&cmd, iommu, data); - raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, false); if (ret) goto out_unlock; @@ -3097,6 +3103,9 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid) build_completion_wait(&cmd2, iommu, data); raw_spin_lock_irqsave(&iommu->lock, flags); + data = get_cmdsem_val(iommu); + build_completion_wait(&cmd2, iommu, data); + ret = __iommu_queue_command_sync(iommu, &cmd, true); if (ret) goto out; -- 2.22.0

2 1

[PATCH OLK-6.6] KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
by Zhang Kunbo 01 Jun '26

01 Jun '26

From: Kevin Cheng <chengkev(a)google.com> stable inclusion from stable-v6.12.86 commit 924d721fae95687acedbaf624a094ed0e8b67104 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15318 CVE: CVE-2026-46076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c36991c6f8d2ab56ee67aff04e3c357f45cfc76c upstream. Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1. The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it's not intercepted. Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses. The last remaining "single" stub will soon be dropped as well. Suggested-by: Sean Christopherson <seanjc(a)google.com> Fixes: 3f4a812edf5c ("KVM: nSVM: hyper-v: Enable L2 TLB flush") Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Kevin Cheng <chengkev(a)google.com> Link: https://patch.msgid.link/20260228033328.2285047-5-chengkev@google.com [sean: rewrite changelog and comment, tag for stable, remove defunct stubs] Reviewed-by: Yosry Ahmed <yosry(a)kernel.org> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://patch.msgid.link/20260304002223.1105129-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/hyperv.h | 8 -------- arch/x86/kvm/svm/hyperv.h | 11 +++++++++++ arch/x86/kvm/svm/nested.c | 4 +--- arch/x86/kvm/svm/svm.c | 19 ++++++++++++++++++- 4 files changed, 30 insertions(+), 12 deletions(-) diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h index a643e11c894d..a0c5f6165b2c 100644 --- a/arch/x86/kvm/hyperv.h +++ b/arch/x86/kvm/hyperv.h @@ -277,14 +277,6 @@ static inline bool kvm_hv_has_stimer_pending(struct kvm_vcpu *vcpu) { return false; } -static inline bool kvm_hv_is_tlb_flush_hcall(struct kvm_vcpu *vcpu) -{ - return false; -} -static inline bool guest_hv_cpuid_has_l2_tlb_flush(struct kvm_vcpu *vcpu) -{ - return false; -} static inline int kvm_hv_verify_vp_assist(struct kvm_vcpu *vcpu) { return 0; diff --git a/arch/x86/kvm/svm/hyperv.h b/arch/x86/kvm/svm/hyperv.h index d3f8bfc05832..9af03970d40c 100644 --- a/arch/x86/kvm/svm/hyperv.h +++ b/arch/x86/kvm/svm/hyperv.h @@ -41,6 +41,13 @@ static inline bool nested_svm_l2_tlb_flush_enabled(struct kvm_vcpu *vcpu) return hv_vcpu->vp_assist_page.nested_control.features.directhypercall; } +static inline bool nested_svm_is_l2_tlb_flush_hcall(struct kvm_vcpu *vcpu) +{ + return guest_hv_cpuid_has_l2_tlb_flush(vcpu) && + nested_svm_l2_tlb_flush_enabled(vcpu) && + kvm_hv_is_tlb_flush_hcall(vcpu); +} + void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct kvm_vcpu *vcpu); #else /* CONFIG_KVM_HYPERV */ static inline void nested_svm_hv_update_vm_vp_ids(struct kvm_vcpu *vcpu) {} @@ -48,6 +55,10 @@ static inline bool nested_svm_l2_tlb_flush_enabled(struct kvm_vcpu *vcpu) { return false; } +static inline bool nested_svm_is_l2_tlb_flush_hcall(struct kvm_vcpu *vcpu) +{ + return false; +} static inline void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct kvm_vcpu *vcpu) {} #endif /* CONFIG_KVM_HYPERV */ diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f47242a1e602..319f73df03ba 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1521,9 +1521,7 @@ int nested_svm_exit_special(struct vcpu_svm *svm) } case SVM_EXIT_VMMCALL: /* Hyper-V L2 TLB flush hypercall is handled by L0 */ - if (guest_hv_cpuid_has_l2_tlb_flush(vcpu) && - nested_svm_l2_tlb_flush_enabled(vcpu) && - kvm_hv_is_tlb_flush_hcall(vcpu)) + if (nested_svm_is_l2_tlb_flush_hcall(vcpu)) return NESTED_EXIT_HOST; break; default: diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index ad25a6995ee6..433bbaf6ed66 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -51,6 +51,7 @@ #include "svm.h" #include "svm_ops.h" +#include "hyperv.h" #include "kvm_onhyperv.h" #include "svm_onhyperv.h" @@ -3350,6 +3351,22 @@ static int invpcid_interception(struct kvm_vcpu *vcpu) return kvm_handle_invpcid(vcpu, type, gva); } +static int vmmcall_interception(struct kvm_vcpu *vcpu) +{ + /* + * Inject a #UD if L2 is active and the VMMCALL isn't a Hyper-V TLB + * hypercall, as VMMCALL #UDs if it's not intercepted, and this path is + * reachable if and only if L1 doesn't want to intercept VMMCALL or has + * enabled L0 (KVM) handling of Hyper-V L2 TLB flush hypercalls. + */ + if (is_guest_mode(vcpu) && !nested_svm_is_l2_tlb_flush_hcall(vcpu)) { + kvm_queue_exception(vcpu, UD_VECTOR); + return 1; + } + + return kvm_emulate_hypercall(vcpu); +} + static int (*const svm_exit_handlers[])(struct kvm_vcpu *vcpu) = { [SVM_EXIT_READ_CR0] = cr_interception, [SVM_EXIT_READ_CR3] = cr_interception, @@ -3400,7 +3417,7 @@ static int (*const svm_exit_handlers[])(struct kvm_vcpu *vcpu) = { [SVM_EXIT_TASK_SWITCH] = task_switch_interception, [SVM_EXIT_SHUTDOWN] = shutdown_interception, [SVM_EXIT_VMRUN] = vmrun_interception, - [SVM_EXIT_VMMCALL] = kvm_emulate_hypercall, + [SVM_EXIT_VMMCALL] = vmmcall_interception, [SVM_EXIT_VMLOAD] = vmload_interception, [SVM_EXIT_VMSAVE] = vmsave_interception, [SVM_EXIT_STGI] = stgi_interception, -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Disable userswap by default
by Wupeng Ma 01 Jun '26

01 Jun '26

Disable userswap by default. Wupeng Ma (2): mm/userswap: remove boot param openeuler_defconfig: disable CONFIG_USERSWAP by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- mm/userswap.c | 7 ------- 3 files changed, 2 insertions(+), 9 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/2] CVE-2026-31759
by Liu Mingrui 01 Jun '26

01 Jun '26

CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Guangshuo Li (1): usb: ulpi: fix double free in ulpi_register_interface() error path drivers/usb/common/ulpi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-31759
by Liu Mingrui 01 Jun '26

01 Jun '26

CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Guangshuo Li (1): usb: ulpi: fix double free in ulpi_register_interface() error path drivers/usb/common/ulpi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/2] netfilter: nft_ct: Fix CVE-2026-43060
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43060 in the OLK-5.10 branch. * Patch 1: Add seqadj extension for natted connections (stable-dep) * Patch 2: Drop pending enqueued packets on removal (CVE fix) Andrii Melnychenko (1): netfilter: nft_ct: add seqadj extension for natted connections Pablo Neira Ayuso (1): netfilter: nft_ct: drop pending enqueued packets on removal net/netfilter/nft_ct.c | 9 +++++++++ 1 file changed, 9 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] netfilter: nft_ct: drop pending enqueued packets on removal
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.130 commit e68a8db3a0546482b34e9ca5ca886bcf73eb37bb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14592 CVE: CVE-2026-43060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 36eae0956f659e48d5366d9b083d9417f3263ddc ] Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference. Since these objects can just go away, drop enqueued packets to avoid stale reference to them. If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies. Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/netfilter/nft_ct.c [context mismatch in nft_ct_timeout_obj_destroy due to kfree_rcu() instead of kfree() in target tree for f8dca15a1b19 has been merged; manual resolution applied] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_ct.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index eff5921bdea6..7ed103de9b76 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -23,6 +23,7 @@ #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_expect.h> #include <net/netfilter/nf_conntrack_seqadj.h> +#include "nf_internals.h" struct nft_ct_helper_obj { struct nf_conntrack_helper *helper4; @@ -527,6 +528,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) #endif #ifdef CONFIG_NF_CONNTRACK_ZONES case NFT_CT_ZONE: + nf_queue_nf_hook_drop(ctx->net); mutex_lock(&nft_ct_pcpu_mutex); if (--nft_ct_pcpu_template_refcnt == 0) nft_ct_tmpl_put_pcpu(); @@ -997,6 +999,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, struct nft_ct_timeout_obj *priv = nft_obj_data(obj); struct nf_ct_timeout *timeout = priv->timeout; + nf_queue_nf_hook_drop(ctx->net); nf_ct_untimeout(ctx->net, timeout); nf_ct_netns_put(ctx->net, ctx->family); kfree_rcu(priv->timeout, rcu); @@ -1129,6 +1132,7 @@ static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, { struct nft_ct_helper_obj *priv = nft_obj_data(obj); + nf_queue_nf_hook_drop(ctx->net); if (priv->helper4) nf_conntrack_helper_put(priv->helper4); if (priv->helper6) -- 2.43.0

2 1

[PATCH OLK-6.6] APEI/GHES: ARM processor Error: don't go past allocated memory
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 87880af2d24e62a84ed19943dbdd524f097172f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14747 CVE: CVE-2026-43201 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/apei/ghes.c drivers/ras/ras.c [conflicts due to not merged 96b010536ee0 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs")] Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..d67618bc7017 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -607,27 +607,51 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; + int length = gdata->error_data_length; bool queued = false; int sec_sev, i; bool critical; char *p; sec_sev = ghes_severity(gdata->error_severity); + if (length >= sizeof(*err)) { #ifdef CONFIG_RAS_ARM_EVENT_INFO - log_arm_hw_error(err, sec_sev); + log_arm_hw_error(err, sec_sev); #else - log_arm_hw_error(err); + log_arm_hw_error(err); #endif + } else { + pr_warn(FW_BUG "arm error length: %d\n", length); + pr_warn(FW_BUG "length is too small\n"); + pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); + return false; + } + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) return false; p = (char *)(err + 1); critical = ghes_armp_vendor_critical_error(err, sync); + length -= sizeof(err); + for (i = 0; i < err->err_info_num; i++) { - struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); - bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); const char *error_type = "unknown error"; + struct cper_arm_err_info *err_info; + bool is_cache, has_pa; + + /* Ensure we have enough data for the error info header */ + if (length < sizeof(*err_info)) + break; + + err_info = (struct cper_arm_err_info *)p; + + /* Validate the claimed length before using it */ + length -= err_info->length; + if (length < 0) + break; + + is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); /* * The field (err_info->error_info & BIT(26)) is fixed to set to diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 547e058e2d56..ecfaff12816c 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -77,7 +77,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err) ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); ctx_err = (u8 *)ctx_info; for (n = 0; n < err->context_info_num; n++) { - sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; + sz = sizeof(struct cper_arm_ctx_info); + + if (sz + (long)ctx_info - (long)err >= err->section_length) + sz += ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len += sz; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-43240
by Liu Mingrui 30 May '26

30 May '26

CVE-2026-43240 Harshit Mogalapalli (2): ima: verify the previous kernel's IMA buffer lies in addressable RAM x86/kexec: add a sanity check on previous kernel's ima kexec buffer arch/x86/kernel/setup.c | 6 +++++ include/linux/ima.h | 1 + security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 0/6] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- include/linux/cleanup.h | 19 +++++ 6 files changed, 173 insertions(+), 25 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.140 commit 83ce43a21bb7df8dd52228afdd918d2d058eefde category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 ] Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> [ kept existing dout() debug call instead of upstream's doutc() form when adding the d_unhashed() guard around d_add() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index beedb07ee4af..949c2a450cfb 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -745,7 +745,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -813,7 +814,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, __ceph_touch_fmode(ci, mdsc, CEPH_FILE_MODE_RD); spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.1-rc1 commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 1fddb9cd3e88..504693f6b72d 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -719,7 +719,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -775,7 +776,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, __ceph_touch_fmode(ci, mdsc, CEPH_FILE_MODE_RD); spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] APEI/GHES: ARM processor Error: don't go past allocated memory
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 87880af2d24e62a84ed19943dbdd524f097172f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14747 CVE: CVE-2026-43201 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/apei/ghes.c drivers/ras/ras.c [conflicts due to not merged 96b010536ee0 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs")] Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..2091aa4b3a00 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -607,27 +607,51 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; + int length = gdata->error_data_length; bool queued = false; int sec_sev, i; bool critical; char *p; sec_sev = ghes_severity(gdata->error_severity); ++ if (length >= sizeof(*err)) { #ifdef CONFIG_RAS_ARM_EVENT_INFO - log_arm_hw_error(err, sec_sev); + log_arm_hw_error(err, sec_sev); #else - log_arm_hw_error(err); + log_arm_hw_error(err); #endif + } else { + pr_warn(FW_BUG "arm error length: %d\n", length); + pr_warn(FW_BUG "length is too small\n"); + pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); + return false; + } + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) return false; p = (char *)(err + 1); critical = ghes_armp_vendor_critical_error(err, sync); + length -= sizeof(err); + for (i = 0; i < err->err_info_num; i++) { - struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); - bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); const char *error_type = "unknown error"; + struct cper_arm_err_info *err_info; + bool is_cache, has_pa; + + /* Ensure we have enough data for the error info header */ + if (length < sizeof(*err_info)) + break; + + err_info = (struct cper_arm_err_info *)p; + + /* Validate the claimed length before using it */ + length -= err_info->length; + if (length < 0) + break; + + is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); /* * The field (err_info->error_info & BIT(26)) is fixed to set to diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 547e058e2d56..ecfaff12816c 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -77,7 +77,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err) ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); ctx_err = (u8 *)ctx_info; for (n = 0; n < err->context_info_num; n++) { - sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; + sz = sizeof(struct cper_arm_ctx_info); + + if (sz + (long)ctx_info - (long)err >= err->section_length) + sz += ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len += sz; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: only d_add() negative dentries when they are unhashed
by Tengda Wu 30 May '26

30 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.1-rc1 commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15294 CVE: CVE-2026-46052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: <TASK> lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable(a)vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 7f3f64ba464f..0a12e668133c 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -703,7 +703,8 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req, d_drop(dentry); err = -ENOENT; } else { - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); } } } @@ -758,7 +759,8 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry, (__ceph_caps_issued_mask(ci, CEPH_CAP_FILE_SHARED, 1))) { spin_unlock(&ci->i_ceph_lock); dout(" dir %p complete, -ENOENT\n", dir); - d_add(dentry, NULL); + if (d_unhashed(dentry)) + d_add(dentry, NULL); di->lease_shared_gen = atomic_read(&ci->i_shared_gen); return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- include/linux/cleanup.h | 19 +++++ 6 files changed, 173 insertions(+), 25 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Andreas Gruenbacher (1): gfs2: Add metapath_dibh helper Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
by Chen Jinghuang 30 May '26

30 May '26

From: Jason Gunthorpe <jgg(a)nvidia.com> stable inclusion from stable-v6.6.140 commit c5dc30da990045105c9762248d23076223e7878a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15428 CVE: CVE-2026-46178 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c54c7e4cb679c0aaa1cb489b9c3f2cd98e63a44c upstream. Sashiko points out that mlx4_srq_alloc() was not undone during error unwind, add the missing call to mlx4_srq_free(). Cc: stable(a)vger.kernel.org Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg… Link: https://patch.msgid.link/r/11-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia… Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx4/srq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c index c4cf91235eee..68e8b04c5388 100644 --- a/drivers/infiniband/hw/mlx4/srq.c +++ b/drivers/infiniband/hw/mlx4/srq.c @@ -193,13 +193,15 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq, if (udata) if (ib_copy_to_udata(udata, &srq->msrq.srqn, sizeof (__u32))) { err = -EFAULT; - goto err_wrid; + goto err_srq; } init_attr->attr.max_wr = srq->msrq.max - 1; return 0; +err_srq: + mlx4_srq_free(dev->dev, &srq->msrq); err_wrid: if (udata) mlx4_ib_db_unmap_user(ucontext, &srq->db); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/7] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Andreas Gruenbacher (6): gfs2: Add new gfs2_iomap_get helper gfs2: Turn gfs2_extent_map into gfs2_{get,alloc}_extent gfs2: Replace gfs2_lblk_to_dblk with gfs2_get_extent gfs2: Add wrapper for iomap_file_buffered_write gfs2: Move the inode glock locking to gfs2_file_buffered_write gfs2: Add metapath_dibh helper Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 227 +++++++++++++++++++-------------------------- fs/gfs2/bmap.h | 13 ++- fs/gfs2/dir.c | 13 ++- fs/gfs2/file.c | 59 +++++++++--- fs/gfs2/log.c | 6 +- fs/gfs2/quota.c | 4 +- fs/gfs2/recovery.c | 4 +- 7 files changed, 162 insertions(+), 164 deletions(-) -- 2.34.1

2 8

[PATCH openeuler-1.0-LTS] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 30 +++++++++++++++-------- 4 files changed, 36 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 4e3fff9f929b..7e12d5b27249 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -81,4 +81,9 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index c11822a7d2bf..c8b4c0c15767 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -238,6 +238,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 27b84231db10..a8dcb4e44d5f 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -105,6 +106,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -162,6 +165,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; @@ -414,6 +419,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -467,8 +474,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 331839218a1c..203a5d059b20 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3056,31 +3056,37 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + err = -ENOMEM; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - err = -ENOMEM; - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (skb2 == NULL) { - nf_ct_expect_put(exp); - goto out; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) goto free; @@ -3135,22 +3141,26 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] CVE-2026-46044
by Cai Xinchen 30 May '26

30 May '26

CVE-2026-46044 Corey Minyard (2): ipmi:ssif: Clean up kthread on errors ipmi:ssif: NULL thread on error drivers/char/ipmi/ipmi_ssif.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] eventfs: Hold eventfs_mutex and SRCU when remount walks events
by Tengda Wu 30 May '26

30 May '26

From: David Carlier <devnexen(a)gmail.com> stable inclusion from stable-v6.6.140 commit ae9cd0b46b1890040006a2fc5e905c5d6053fd02 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 07004a8c4b572171934390148ee48c4175c77eed upstream. Commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") had eventfs_set_attrs() recurse through ei->children on remount. The walk only holds the rcu_read_lock() taken by tracefs_apply_options() over tracefs_inodes, which is wrong: - list_for_each_entry over ei->children races with the list_del_rcu() in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as d2603279c7d6. - eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...). rcu_read_lock() does not extend an SRCU grace period, so ti->private can be reclaimed under the walk. - The writes to ei->attr race with eventfs_set_attr(), which holds eventfs_mutex. Reproducer: while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done & while :; do echo "p:kp submit_bio" > /sys/kernel/tracing/kprobe_events echo > /sys/kernel/tracing/kprobe_events done Wrap the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() that take eventfs_mutex and srcu_read_lock(&eventfs_srcu). eventfs_set_attrs() doesn't sleep so the nested rcu_read_lock() is fine; lockdep_assert_held() pins the contract. Comment in tracefs_drop_inode() said "RCU cycle" -- it is SRCU. Fixes: 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260418191737.10289-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/tracefs/event_inode.c | 14 ++++++++++++++ fs/tracefs/inode.c | 5 ++++- fs/tracefs/internal.h | 3 +++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 4190e6155044..f98315e91e99 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -310,6 +310,8 @@ static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t { struct eventfs_inode *ei_child; + lockdep_assert_held(&eventfs_mutex); + /* Update events/<system>/<event> */ if (WARN_ON_ONCE(level > 3)) return; @@ -985,3 +987,15 @@ void eventfs_remove_events_dir(struct eventfs_inode *ei) d_invalidate(dentry); dput(dentry); } + +int eventfs_remount_lock(void) +{ + mutex_lock(&eventfs_mutex); + return srcu_read_lock(&eventfs_srcu); +} + +void eventfs_remount_unlock(int srcu_idx) +{ + srcu_read_unlock(&eventfs_srcu, srcu_idx); + mutex_unlock(&eventfs_mutex); +} diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 6b70965063d7..6c7b48770948 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -362,6 +362,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) struct tracefs_mount_opts *opts = &fsi->mount_opts; struct tracefs_inode *ti; bool update_uid, update_gid; + int srcu_idx; umode_t tmp_mode; /* @@ -386,6 +387,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) update_uid = opts->opts & BIT(Opt_uid); update_gid = opts->opts & BIT(Opt_gid); + srcu_idx = eventfs_remount_lock(); rcu_read_lock(); list_for_each_entry_rcu(ti, &tracefs_inodes, list) { if (update_uid) @@ -398,6 +400,7 @@ static int tracefs_apply_options(struct super_block *sb, bool remount) eventfs_remount(ti, update_uid, update_gid); } rcu_read_unlock(); + eventfs_remount_unlock(srcu_idx); } return 0; @@ -444,7 +447,7 @@ static int tracefs_drop_inode(struct inode *inode) * This inode is being freed and cannot be used for * eventfs. Clear the flag so that it doesn't call into * eventfs during the remount flag updates. The eventfs_inode - * gets freed after an RCU cycle, so the content will still + * gets freed after an SRCU cycle, so the content will still * be safe if the iteration is going on now. */ ti->flags &= ~TRACEFS_EVENT_INODE; diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index d83c2a25f288..a4a7f8431aff 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -76,4 +76,7 @@ struct inode *tracefs_get_inode(struct super_block *sb); void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid); void eventfs_d_release(struct dentry *dentry); +int eventfs_remount_lock(void); +void eventfs_remount_unlock(int srcu_idx); + #endif /* _TRACEFS_INTERNAL_H */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 30 +++++++++++++++-------- 4 files changed, 36 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 4e3fff9f929b..7e12d5b27249 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -81,4 +81,9 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index c11822a7d2bf..c8b4c0c15767 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -238,6 +238,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 27b84231db10..a8dcb4e44d5f 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -105,6 +106,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -162,6 +165,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; @@ -414,6 +419,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -467,8 +474,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 331839218a1c..203a5d059b20 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3056,31 +3056,37 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + err = -ENOMEM; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (skb2 == NULL) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - err = -ENOMEM; - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (skb2 == NULL) { - nf_ct_expect_put(exp); - goto out; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) goto free; @@ -3135,22 +3141,26 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); -- 2.43.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45984
by Hongbo Li 30 May '26

30 May '26

Fix CVE-2026-45984. Deepanshu Kartikey (1): gfs2: Fix use-after-free in iomap inline data write path fs/gfs2/bmap.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] APEI/GHES: ensure that won't go past CPER allocated record
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v6.6.128 commit e0ec99115e135dbb58e11a0df007c7d4771d4a17 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ] The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB). Yet, the allocation is done with the actual number of pages from the CPER bios table location, which can be smaller. Yet, a bad firmware could send data with a different size, which might be bigger than the allocated memory, causing an OOPS: Unable to handle kernel paging request at virtual address fff00000f9b40000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000 [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 Workqueue: kacpi_notify acpi_os_execute_deferred pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : hex_dump_to_buffer+0x30c/0x4a0 lr : hex_dump_to_buffer+0x328/0x4a0 sp : ffff800080e13880 x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083 x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004 x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083 x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010 x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020 x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008 x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020 x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000 x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008 Call trace: hex_dump_to_buffer+0x30c/0x4a0 (P) print_hex_dump+0xac/0x170 cper_estatus_print_section+0x90c/0x968 cper_estatus_print+0xf0/0x158 __ghes_print_estatus+0xa0/0x148 ghes_proc+0x1bc/0x220 ghes_notify_hed+0x5c/0xb8 notifier_call_chain+0x78/0x148 blocking_notifier_call_chain+0x4c/0x80 acpi_hed_notify+0x28/0x40 acpi_ev_notify_dispatch+0x50/0x80 acpi_os_execute_deferred+0x24/0x48 process_one_work+0x15c/0x3b0 worker_thread+0x2d0/0x400 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44) ---[ end trace 0000000000000000 ]--- Prevent that by taking the actual allocated are into account when checking for CPER length. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 6 +++++- include/acpi/ghes.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..bdaf28b5ebcc 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -27,6 +27,7 @@ #include <linux/timer.h> #include <linux/cper.h> #include <linux/platform_device.h> +#include <linux/minmax.h> #include <linux/mutex.h> #include <linux/ratelimit.h> #include <linux/vmalloc.h> @@ -290,6 +291,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic) error_block_length = GHES_ESTATUS_MAX_SIZE; } ghes->estatus = kmalloc(error_block_length, GFP_KERNEL); + ghes->estatus_length = error_block_length; if (!ghes->estatus) { rc = -ENOMEM; goto err_unmap_status_addr; @@ -361,13 +363,15 @@ static int __ghes_check_estatus(struct ghes *ghes, struct acpi_hest_generic_status *estatus) { u32 len = cper_estatus_len(estatus); + u32 max_len = min(ghes->generic->error_block_length, + ghes->estatus_length); if (len < sizeof(*estatus)) { pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n"); return -EIO; } - if (len > ghes->generic->error_block_length) { + if (!len || len > max_len) { pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n"); return -EIO; } diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index 73a4e64c8900..b4bf8e7e94f7 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -21,6 +21,7 @@ struct ghes { struct acpi_hest_generic_v2 *generic_v2; }; struct acpi_hest_generic_status *estatus; + unsigned int estatus_length; unsigned long flags; union { struct list_head list; -- 2.34.1

2 3

[PATCH OLK-6.6] x86/kexec: add a sanity check on previous kernel's ima kexec buffer
by Liu Mingrui 30 May '26

30 May '26

From: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> stable inclusion from stable-v6.6.128 commit 22e460b6333a5f818b042ac89201f8e735556f4a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5489d04337b47e93c0623e8145fcba3f5739efd ] When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that contains the carried over IMA measurement list may fall outside the truncated RAM leading to a kernel panic. BUG: unable to handle page fault for address: ffff97793ff47000 RIP: ima_restore_measurement_list+0xdc/0x45a #PF: error_code(0x0000) – not-present page Other architectures already validate the range with page_is_ram(), as done in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") do a similar check on x86. Without carrying the measurement list across kexec, the attestation would fail. Link: https://lkml.kernel.org/r/20251231061609.907170-4-harshit.m.mogalapalli@ora… Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec") Reported-by: Paul Webb <paul.x.webb(a)oracle.com> Reviewed-by: Mimi Zohar <zohar(a)linux.ibm.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Ard Biesheuvel <ardb(a)kernel.org> Cc: Baoquan He <bhe(a)redhat.com> Cc: Borislav Betkov <bp(a)alien8.de> Cc: guoweikang <guoweikang.kernel(a)gmail.com> Cc: Henry Willard <henry.willard(a)oracle.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jiri Bohac <jbohac(a)suse.cz> Cc: Joel Granados <joel.granados(a)kernel.org> Cc: Jonathan McDowell <noodles(a)fb.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Sohil Mehta <sohil.mehta(a)intel.com> Cc: Sourabh Jain <sourabhjain(a)linux.ibm.com> Cc: Thomas Gleinxer <tglx(a)linutronix.de> Cc: Yifei Liu <yifei.l.liu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/x86/kernel/setup.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index 3adc91b1b376..42e8a5d4770c 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -371,9 +371,15 @@ int __init ima_free_kexec_buffer(void) int __init ima_get_kexec_buffer(void **addr, size_t *size) { + int ret; + if (!ima_kexec_buffer_size) return -ENOENT; + ret = ima_validate_range(ima_kexec_buffer_phys, ima_kexec_buffer_size); + if (ret) + return ret; + *addr = __va(ima_kexec_buffer_phys); *size = ima_kexec_buffer_size; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-46044
by Cai Xinchen 30 May '26

30 May '26

ipmi:ssif: Clean up kthread on errors is original patch ipmi:ssif: NULL thread on error is new bugfix. Corey Minyard (2): ipmi:ssif: Clean up kthread on errors ipmi:ssif: NULL thread on error drivers/char/ipmi/ipmi_ssif.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
by Chen Jinghuang 30 May '26

30 May '26

From: Siwei Zhang <oss(a)fourdim.xyz> stable inclusion from stable-v6.6.140 commit 5105f3e6b2df619c635b5f6a49fac131a36c7952 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15079 CVE: CVE-2026-45834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2ff1a41a912de8517b4482e946dd951b7d80edbf upstream. Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 89bc500e41fc ("Bluetooth: Add state tracking to struct l2cap_chan") Cc: stable(a)kernel.org Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 7c87741a3d9e..2fcac3e28c7a 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1617,6 +1617,9 @@ static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, { struct sock *sk = chan->data; + if (!sk) + return; + sk->sk_state = state; if (err) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 154 insertions(+), 25 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43456 in the OLK-5.10 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() Introduces bond_header_ops wrapper functions to prevent type confusion when non-Ethernet devices are enslaved to a bond. * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() Adds dev parameter to header_ops->parse() to prevent infinite recursion when bonding devices are stacked. Also updates two wireless drivers (hostap and airo) that were missed in the original mainline patch. Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 +- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++- drivers/net/wireless/cisco/airo.c | 4 +- .../wireless/intersil/hostap/hostap_main.c | 1 + include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++- net/ethernet/eth.c | 9 ++-- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 +- net/phonet/af_phonet.c | 5 +- 11 files changed, 75 insertions(+), 17 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/2] bonding: Fix CVE-2026-43456 type confusion in bond_setup_by_slave()
by superdcc97＠163.com 30 May '26

30 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43456 in the OLK-6.6 branch. * Patch 1: bonding: fix type confusion in bond_setup_by_slave() (Main CVE fix - prevents kernel crash when non-Ethernet device is enslaved to a bond) * Patch 2: bonding: prevent potential infinite loop in bond_header_parse() (Newbugfix - adds dev parameter to header_ops->parse to prevent infinite loop when bonding devices are stacked) Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/firewire/net.c | 5 ++-- drivers/net/bonding/bond_main.c | 49 ++++++++++++++++++++++++++++++++- include/linux/etherdevice.h | 3 +- include/linux/if_ether.h | 3 +- include/linux/netdevice.h | 6 ++-- net/ethernet/eth.c | 9 ++---- net/ipv4/ip_gre.c | 3 +- net/mac802154/iface.c | 4 ++- net/phonet/af_phonet.c | 5 +++- 9 files changed, 71 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (1): usb: gadget: f_ncm: Fix net_device lifecycle with device_move Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 22 ++++++ drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- 5 files changed, 150 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 93cdceddc94c..2de1176f0952 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -987,6 +987,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1448,8 +1449,10 @@ thermal_zone_device_register(const char *type, int trips, int mask, /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1578,8 +1581,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_simple_remove(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH OLK-6.6] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 30 May '26

30 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 2476774af738..677db876a229 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -805,6 +805,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); mutex_destroy(&tz->lock); complete(&tz->removal); } else if (!strncmp(dev_name(dev), "cooling_device", @@ -1326,8 +1327,10 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1478,8 +1481,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_free(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH] Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
by Chen Jinghuang 30 May '26

30 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.140 commit 6cb7f67bc28da787499291a562d49a084d9c90cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15492 CVE: CVE-2026-46138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ddb8014261137cadaf83ab5617a588d80a22586 upstream. hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable(a)vger.kernel.org Signed-off-by: ZhiTao Ou <hkbinbinbin(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f4b2cddc5370..b89b42966665 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -6896,9 +6896,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, continue; } + if (ev->num_bis <= i) { + bt_dev_err(hdev, + "Not enough BIS handles for BIG 0x%2.2x", + ev->handle); + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); + continue; + } + if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + __le16_to_cpu(ev->bis_handle[i++]))) { + bt_dev_err(hdev, + "Failed to set BIS handle for BIG 0x%2.2x", + ev->handle); + /* Force error so BIG gets terminated as not all BIS + * could be connected. + */ + ev->status = HCI_ERROR_UNSPECIFIED; + hci_connect_cfm(conn, ev->status); + hci_conn_del(conn); continue; + } conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); @@ -6907,7 +6927,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data, hci_iso_setup_path(conn); } - if (!ev->status && !i) + /* If there is an unexpected error or if no BISes have been connected + * for the BIG, terminate it. + */ + if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i)) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections * have been closed before the BIG creation -- 2.34.1

1 0

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 30 May '26

30 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

1 0

[PATCH OLK-5.10] xfrm: always flush state and policy upon NETDEV_UNREGISTER event
by superdcc97＠163.com 29 May '26

29 May '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v7.0-rc2 commit 4efa91a28576054aae0e6dad9cba8fed8293aef8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14713 CVE: CVE-2026-43167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 ref_tracker: netdev@ffff888052f24618 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_tracker_alloc include/linux/netdevice.h:4412 [inline] xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316 xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline] xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022 xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550 xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646 __sys_sendmsg+0x16d/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrm_dev_unregister() as no-op despite xfrm_dev_state_add() from xfrm_state_construct() acquires a reference to "struct net_device". I guess that that commit expected that NETDEV_DOWN event is fired before NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add() is called only if (dev->features & NETIF_F_HW_ESP) != 0. Sabrina Dubroca identified steps to reproduce the same symptoms as below. echo 0 > /sys/bus/netdevsim/new_device dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/del_device Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after xfrm_dev_state_add() acquired a reference to "struct net_device". Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit when acquiring a reference to "struct net_device". Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device") re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that commit for unknown reason chose to share xfrm_dev_down() between the NETDEV_DOWN event and the NETDEV_UNREGISTER event. I guess that that commit missed the behavior in the previous paragraph. Therefore, we need to re-introduce xfrm_dev_unregister() in order to release the reference to "struct net_device" by unconditionally flushing state and policy. Reported-by: syzbot+881d65229ca4f9ae8c84(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Cc: Sabrina Dubroca <sd(a)queasysnail.net> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_device.c [OLK-5.10: xfrm_dev_policy_flush() does not exist because xfrm policy offload was added in later kernels. Only call xfrm_dev_state_flush() in xfrm_dev_unregister().] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_device.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c index 8b8e957a69c3..0e7424b8a5fa 100644 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -414,6 +414,13 @@ static int xfrm_dev_down(struct net_device *dev) return NOTIFY_DONE; } +static int xfrm_dev_unregister(struct net_device *dev) +{ + xfrm_dev_state_flush(dev_net(dev), dev, true); + + return NOTIFY_DONE; +} + static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); @@ -426,8 +433,10 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void return xfrm_dev_feat_change(dev); case NETDEV_DOWN: - case NETDEV_UNREGISTER: return xfrm_dev_down(dev); + + case NETDEV_UNREGISTER: + return xfrm_dev_unregister(dev); } return NOTIFY_DONE; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9294 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45943
by Hongbo Li 29 May '26

29 May '26

Fix CVE-2026-45943. Gao Xiang (1): erofs: fix inline data read failure for ztailpacking pclusters fs/erofs/zdata.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 29 May '26

29 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 0886b19d2e1c..c9f52cd1cfb2 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

1 0

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 29 May '26

29 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affinity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 2

[PATCH OLK-6.6 0/6] mainline for bpf
by Pu Lehui 29 May '26

29 May '26

Alexei Starovoitov (1): bpf: Fix variable length stack write over spilled pointers Amery Hung (5): bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage bpf: Convert bpf_selem_unlink_map to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink to failable bpf: Do not allow deleting local storage in NMI include/linux/bpf_local_storage.h | 7 +- kernel/bpf/bpf_cgrp_storage.c | 3 +- kernel/bpf/bpf_inode_storage.c | 4 +- kernel/bpf/bpf_local_storage.c | 149 +++++++++++++++++------------- kernel/bpf/bpf_task_storage.c | 4 +- kernel/bpf/verifier.c | 28 ++++-- net/core/bpf_sk_storage.c | 13 ++- 7 files changed, 122 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index 3e137d8c9d2f..215f2a7d8458 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -744,10 +744,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -796,11 +797,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-5.10] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit a7db57ccca21f5801609065473c89a38229ecb92 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index b1fcd2ad5ecf..cae497418dc9 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -743,10 +743,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -795,11 +796,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH] xfrm: Fix dev use-after-free in xfrm async resumption
by Dong Chenchen 28 May '26

28 May '26

xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev. Stash original skb->dev to fix it. Fixes: 1c428b038400 ("xfrm: hold dev ref until after transport_finish NF_HOOK") Reported-by: Xu Chunxiao <xuchunxiao3(a)huawei.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_input.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index f65291eba1f6..810600d4614a 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -467,6 +467,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) { const struct xfrm_state_afinfo *afinfo; struct net *net = dev_net(skb->dev); + struct net_device *dev = skb->dev; int err; __be32 seq; __be32 seq_hi; @@ -493,7 +494,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) LINUX_MIB_XFRMINSTATEINVALID); if (encap_type == -1) - dev_put(skb->dev); + dev_put(dev); goto drop; } @@ -655,16 +656,16 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (!crypto_done) { spin_unlock(&x->lock); - dev_hold(skb->dev); + dev_hold(dev); nexthdr = x->type->input(x, skb); if (nexthdr == -EINPROGRESS) { if (async) - dev_put(skb->dev); + dev_put(dev); return 0; } - dev_put(skb->dev); + dev_put(dev); spin_lock(&x->lock); } resume: @@ -699,7 +700,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) err = xfrm_inner_mode_input(x, skb); if (err == -EINPROGRESS) { if (async) - dev_put(skb->dev); + dev_put(dev); return 0; } else if (err) { XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR); @@ -739,7 +740,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (skb_valid_dst(skb)) skb_dst_drop(skb); if (async) - dev_put(skb->dev); + dev_put(dev); gro_cells_receive(&gro_cells, skb); return 0; } else { @@ -760,7 +761,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) if (skb_valid_dst(skb)) skb_dst_drop(skb); if (async) - dev_put(skb->dev); + dev_put(dev); gro_cells_receive(&gro_cells, skb); return err; } @@ -772,7 +773,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) spin_unlock(&x->lock); drop: if (async) - dev_put(skb->dev); + dev_put(dev); xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1); kfree_skb(skb); return 0; -- 2.25.1

1 0

[PATCH OLK-5.10] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v5.10.252 commit 2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index cf2c3c4c590f..e5e20ea850aa 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -241,7 +241,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, return sch; err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-5.10] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v5.10.252 commit 2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index cf2c3c4c590f..e5e20ea850aa 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -241,7 +241,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, return sch; err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix CVE-2026-45961
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45961. Deepanshu Kartikey (1): gfs2: fix memory leaks in gfs2_fill_super error path fs/gfs2/ops_fstype.c | 2 +- fs/gfs2/super.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14886 CVE: CVE-2026-43328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45999
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45999. Junrui Luo (1): erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() fs/erofs/decompressor.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] backport soc cache patches from linux mainline
by Yushan Wang 28 May '26

28 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9262 ---------------------------------------------------------------------- Yushan Wang (1): soc cache: Fix unsafe shift left .../soc/hisilicon/hisi_soc_cache_framework.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] Bluetooth: SCO: fix race conditions in sco_sock_connect()
by Liu Kai 28 May '26

28 May '26

From: Cen Zhang <zzzccc427(a)gmail.com> stable inclusion from stable-v6.6.134 commit adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14555 CVE: CVE-2026-43023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b ] sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket can both pass the check and enter sco_connect(), leading to use-after-free. The buggy scenario involves three participants and was confirmed with additional logging instrumentation: Thread A (connect): HCI disconnect: Thread B (connect): sco_sock_connect(sk) sco_sock_connect(sk) sk_state==BT_OPEN sk_state==BT_OPEN (pass, no lock) (pass, no lock) sco_connect(sk): sco_connect(sk): hci_dev_lock hci_dev_lock hci_connect_sco <- blocked -> hcon1 sco_conn_add->conn1 lock_sock(sk) sco_chan_add: conn1->sk = sk sk->conn = conn1 sk_state=BT_CONNECT release_sock hci_dev_unlock hci_dev_lock sco_conn_del: lock_sock(sk) sco_chan_del: sk->conn=NULL conn1->sk=NULL sk_state= BT_CLOSED SOCK_ZAPPED release_sock hci_dev_unlock (unblocked) hci_connect_sco -> hcon2 sco_conn_add -> conn2 lock_sock(sk) sco_chan_add: sk->conn=conn2 sk_state= BT_CONNECT // zombie sk! release_sock hci_dev_unlock Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to BT_CONNECT. Subsequent cleanup triggers double sock_put() and use-after-free. Meanwhile conn1 is leaked as it was orphaned when sco_conn_del() cleared the association. Fix this by: - Moving lock_sock() before the sk_state/sk_type checks in sco_sock_connect() to serialize concurrent connect attempts - Fixing the sk_type != SOCK_SEQPACKET check to actually return the error instead of just assigning it - Adding a state re-check in sco_connect() after lock_sock() to catch state changes during the window between the locks - Adding sco_pi(sk)->conn check in sco_chan_add() to prevent double-attach of a socket to multiple connections - Adding hci_conn_drop() on sco_chan_add failure to prevent HCI connection leaks Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") Signed-off-by: Cen Zhang <zzzccc427(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/sco.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 56d8a2a26a7a..0ec5686489a1 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -298,7 +298,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, int err = 0; sco_conn_lock(conn); - if (conn->sk) + if (conn->sk || sco_pi(sk)->conn) err = -EBUSY; else __sco_chan_add(conn, sk, parent); @@ -352,9 +352,20 @@ static int sco_connect(struct sock *sk) lock_sock(sk); + /* Recheck state after reacquiring the socket lock, as another + * thread may have changed it (e.g., closed the socket). + */ + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { + release_sock(sk); + hci_conn_drop(hcon); + err = -EBADFD; + goto unlock; + } + err = sco_chan_add(conn, sk, NULL); if (err) { release_sock(sk); + hci_conn_drop(hcon); goto unlock; } @@ -652,13 +663,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH) return -EINVAL; - if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) + lock_sock(sk); + + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { + release_sock(sk); return -EBADFD; + } - if (sk->sk_type != SOCK_SEQPACKET) - err = -EINVAL; + if (sk->sk_type != SOCK_SEQPACKET) { + release_sock(sk); + return -EINVAL; + } - lock_sock(sk); /* Set destination address and psm */ bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); release_sock(sk); -- 2.34.1

2 1

[PATCH OLK-6.6 V3 0/6] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() Zizhi Wo (1): fs/mount: wrap overmount field with KABI_EXTEND fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 280 +++++++++++++++++++++++++++---------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 247 insertions(+), 71 deletions(-) -- 2.52.0

2 7

[PATCH OLK-6.6 0/1] Fix CVE-2026-46078
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-46078. Gao Xiang (1): erofs: fix the out-of-bounds nameoff handling for trailing dirents fs/erofs/dir.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43427
by Xinyu Zheng 28 May '26

28 May '26

Oliver Neukum (1): usb: class: cdc-wdm: fix reordering issue in read code path Robert Hodaszi (1): usb: cdc-wdm: avoid setting WDM_READ for ZLP-s drivers/usb/class/cdc-wdm.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] thermal: core: Fix thermal zone governor cleanup issues
by Jinjie Ruan 28 May '26

28 May '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v7.1-rc1 commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15286 CVE: CVE-2026-46021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki Conflicts: drivers/thermal/thermal_core.c [context conflict.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/thermal/thermal_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 98d9bba6f4ac..37cb45b133ed 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -840,6 +840,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + thermal_set_governor(tz, NULL); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1230,8 +1231,10 @@ thermal_zone_device_register(const char *type, int trips, int mask, /* sys I/F */ /* Add nodes that are always present via .groups */ result = thermal_zone_create_device_groups(tz, mask); - if (result) + if (result) { + thermal_set_governor(tz, NULL); goto remove_id; + } /* A new thermal zone needs to be updated anyway. */ atomic_set(&tz->need_update, 1); @@ -1353,8 +1356,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) cancel_delayed_work_sync(&tz->poll_queue); - thermal_set_governor(tz, NULL); - thermal_remove_hwmon_sysfs(tz); ida_simple_remove(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14332 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-43328
by Xinyu Zheng 28 May '26

28 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/14886 CVE: CVE-2026-43328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit 425a22c5373d4e1b46492ab869074ebeeade61f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14892 CVE: CVE-2026-43334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index d9a378d12be6..4655534b6cc1 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1828,7 +1828,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1836,6 +1836,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14332 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-31759
by Liu Mingrui 28 May '26

28 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Sean Anderson (1): usb: ulpi: Call of_node_put correctly drivers/usb/common/ulpi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43427
by Xinyu Zheng 28 May '26

28 May '26

Oliver Neukum (1): usb: class: cdc-wdm: fix reordering issue in read code path Robert Hodaszi (1): usb: cdc-wdm: avoid setting WDM_READ for ZLP-s drivers/usb/class/cdc-wdm.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-45968
by Jinjie Ruan 28 May '26

28 May '26

CVE-2026-45968 Aboorva Devarajan (1): cpuidle: Skip governor when only one idle state is available Rafael J. Wysocki (1): sched: idle: Make skipping governor callbacks more consistent kernel/sched/idle.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 V2 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6

[openEuler-1.0-LTS] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
by Jinjiang Tu 28 May '26

28 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.136 commit 115a5266749dcde7fe4127e8623d19c752088f69 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9037 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f5857be99f1ed1fa80991c72449541f634626ee upstream. cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Dennis Zhou <dennis(a)kernel.org> Reviewed-by: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: JP Kobryn <inwardvessel(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> Cc: Martin KaFai Lau <martin.lau(a)linux.dev> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/backing-dev.c [Context conflicts due to commit d866dbf6.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/backing-dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/backing-dev.c b/mm/backing-dev.c index a395eba85670..4c3037c27651 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -499,12 +499,13 @@ static void cgwb_release_workfn(struct work_struct *work) wb_shutdown(wb); css_put(wb->memcg_css); - css_put(wb->blkcg_css); - mutex_unlock(&wb->bdi->cgwb_release_mutex); /* triggers blkg destruction if cgwb_refcnt becomes zero */ blkcg_cgwb_put(blkcg); + css_put(wb->blkcg_css); + mutex_unlock(&wb->bdi->cgwb_release_mutex); + fprop_local_destroy_percpu(&wb->memcg_completions); wb_exit(wb); call_rcu(&wb->rcu, cgwb_free_rcu); -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
by Xinyu Zheng 28 May '26

28 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit da39ee627fd82b52068d4d5f115749a8b7d271f9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e upstream. When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Zhongqiu Han <zhongqiu.han(a)oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Cc: All applicable <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/cpufreq_governor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index 8f5474612b31..00a26fa6292c 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -468,13 +468,13 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) /* Failure, so roll back. */ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret); - kobject_put(&dbs_data->attr_set.kobj); - policy->governor_data = NULL; if (!have_governor_per_policy()) gov->gdbs_data = NULL; - gov->exit(dbs_data); + + kobject_put(&dbs_data->attr_set.kobj); + goto free_policy_dbs_info; free_dbs_data: kfree(dbs_data); -- 2.34.1

2 1

[PATCH OLK-6.6] efi: Fix reservation of unaccepted memory table
by Jinjie Ruan 28 May '26

28 May '26

From: "Kiryl Shutsemau (Meta)" <kas(a)kernel.org> stable inclusion from stable-v6.6.128 commit b7bc182ec1846be437351e44164089d988f9d0dd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15103 CVE: CVE-2026-45851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0862438c90487e79822d5647f854977d50381505 ] The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned. If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in accept_memory(). This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB). Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation. Fixes: 8dbe33956d96 ("efi/unaccepted: Make sure unaccepted table is mapped") Reported-by: Moritz Sanft <ms(a)edgeless.systems> Signed-off-by: Kiryl Shutsemau (Meta) <kas(a)kernel.org> Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Acked-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/firmware/efi/efi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index 30f6c4397b40..7e1f96c06d18 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -649,13 +649,13 @@ static __init int match_config_table(const efi_guid_t *guid, static __init void reserve_unaccepted(struct efi_unaccepted_memory *unaccepted) { - phys_addr_t start, size; + phys_addr_t start, end; start = PAGE_ALIGN_DOWN(efi.unaccepted); - size = PAGE_ALIGN(sizeof(*unaccepted) + unaccepted->size); + end = PAGE_ALIGN(efi.unaccepted + sizeof(*unaccepted) + unaccepted->size); - memblock_add(start, size); - memblock_reserve(start, size); + memblock_add(start, end - start); + memblock_reserve(start, end - start); } int __init efi_config_parse_tables(const efi_config_table_t *config_tables, -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Support open_tree OPEN_TREE_NAMESPACE Al Viro (3): attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument get rid of mnt_set_mountpoint_beneath() prevent mount hash conflicts Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/mount.h | 1 + fs/namespace.c | 281 ++++++++++++++++++++++++++++--------- fs/nsfs.c | 32 +++++ include/uapi/linux/mount.h | 3 +- 5 files changed, 248 insertions(+), 71 deletions(-) -- 2.52.0

2 6

[PATCH OLK-6.6] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 91649c02c1baaa18cedf7fb425fa1f0f852c8183 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 101cc9007cf0..de34bdf1802d 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1824,7 +1824,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1832,6 +1832,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: SMP: force responder MITM requirements before building the pairing response
by Xinyu Zheng 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit 425a22c5373d4e1b46492ab869074ebeeade61f3 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream. smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable(a)vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- net/bluetooth/smp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index d9a378d12be6..4655534b6cc1 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1828,7 +1828,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) if (sec_level > conn->hcon->pending_sec_level) conn->hcon->pending_sec_level = sec_level; - /* If we need MITM check that it can be achieved */ + /* If we need MITM check that it can be achieved. */ if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { u8 method; @@ -1836,6 +1836,10 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb) req->io_capability); if (method == JUST_WORKS || method == JUST_CFM) return SMP_AUTH_REQUIREMENTS; + + /* Force MITM bit if it isn't set by the initiator. */ + auth |= SMP_AUTH_MITM; + rsp.auth_req |= SMP_AUTH_MITM; } key_size = min(req->max_key_size, rsp.max_key_size); -- 2.34.1

2 1

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 28 May '26

28 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

2 35

[PATCH OLK-5.10] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 27 May '26

27 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_conntrack_core.h net/netfilter/nf_conntrack_ecache.c net/netfilter/nf_conntrack_expect.c net/netfilter/nf_conntrack_netlink.c [mainline commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 is not a 5.10 backport, which leads to conflicts due to code differences between mainline and 5.10. Adapted by adding lockdep_nfct_expect_lock_held() and adjusting spinlock sections to match 5.10 codebase.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 5805fe4947f3..ef9c0cac225b 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -83,6 +83,11 @@ void print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple, extern spinlock_t nf_conntrack_locks[CONNTRACK_LOCKS]; void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + #endif /* _NF_CONNTRACK_CORE_H */ diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index 7956c9f19899..aa866d3e519a 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -247,10 +247,12 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, { struct net *net = nf_ct_exp_net(exp); struct nf_exp_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_expect_event_cb); if (!notify) goto out_unlock; diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 45f29e28aba3..64b6f0657cce 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -48,10 +48,11 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, u32 portid, int report) { struct nf_conn_help *master_help = nfct_help(exp->master); struct net *net = nf_ct_exp_net(exp); + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); hlist_del_rcu(&exp->hnode); net->ct.expect_count--; @@ -102,10 +103,12 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, nf_ct_zone_equal_any(i->master, zone); } bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); return true; } @@ -159,10 +162,12 @@ nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple, bool unlink) { struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!net->ct.expect_count) return NULL; h = nf_ct_expect_dst_hash(net, tuple); hlist_for_each_entry(i, &nf_ct_expect_hash[h], hnode) { @@ -421,10 +426,12 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, struct net *net = nf_ct_exp_net(expect); struct hlist_node *next; unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; } h = nf_ct_expect_dst_hash(net, &expect->tuple); @@ -476,12 +483,13 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, if (ret < 0) goto out; nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); return ret; } diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 78329f4e171b..fd84f48715c7 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3308,34 +3308,40 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl, return -EINVAL; if (err < 0) return err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!skb2) { - nf_ct_expect_put(exp); - return -ENOMEM; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) { kfree_skb(skb2); return -ENOMEM; } @@ -3378,26 +3384,30 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl, err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3, NULL); if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(nlh)); nf_ct_expect_put(exp); } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2026-43158
by Long Li 27 May '26

27 May '26

Fix CVE-2026-43158. Darrick J. Wong (2): xfs: delete attr leaf freemap entries when empty xfs: fix freemap adjustments when adding xattrs to leaf blocks fs/xfs/libxfs/xfs_attr_leaf.c | 49 +++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 27 May '26

27 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_expect.c net/netfilter/nf_conntrack_netlink.c [commit bffcaad9afdfe is not backport, which lead to conflicts due to timer_delete() vs del_timer() API differences and lock placement changes in ctnetlink_del_expect()] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 3384859a8921..8883575adcc1 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + /* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout) diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index 69948e1d6974..6526bdcca580 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -237,6 +237,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_ct_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_conntrack_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index e0eb844c2cdc..c47f7eacf78a 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct net *net = nf_ct_exp_net(exp); struct nf_conntrack_net *cnet; + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!cnet->expect_count) return NULL; @@ -454,6 +459,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -510,8 +517,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 4522e9110352..67a0762915e3 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3337,31 +3337,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, if (err < 0) return err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!skb2) { - nf_ct_expect_put(exp); - return -ENOMEM; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) { kfree_skb(skb2); return -ENOMEM; @@ -3408,22 +3414,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(info->nlh)); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 27 May '26

27 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 2

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v6.6.128 commit bbfaa5761f589a81031b493cb01275a990d6fb25 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 4d1d04736222e..1c8508aa77e2e 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-5.10] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v5.10.252 commit b6117210ed349356f8e6027ff020b4d620bca42b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index dc867439f359f..02268f7d62e7a 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] netfilter: Fix CVE-2026-43025 - slab-out-of-bounds in nf_ct_expect_related_report
by superdcc97＠163.com 26 May '26

26 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43025 in the OLK-6.6 branch. The vulnerability allows reading kernel memory bytes off the expectation boundary when validating CTA_EXPECT_CLASS via a different helper than the existing master conntrack helper. * Patch 1: Store netns and zone in expectation (Stable-dep-of prerequisite) * Patch 2: Ignore explicit helper on new expectations (main CVE fix) * Patch 3: Restore helper propagation via expectation (newbugfix) Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation include/net/netfilter/nf_conntrack_expect.h | 23 +++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 74 insertions(+), 53 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/3] Fix hist_field_name issue
by Tengda Wu 26 May '26

26 May '26

This series is going to backport three patch from upstream to fix hist field name issue. David Carlier (1): tracing: Avoid NULL return from hist_field_name() on truncation Pengpeng Hou (1): tracing: Rebuild full_name on each hist_field_name() call Tom Zanussi (1): tracing: Fix fully-qualified variable reference printing in histograms kernel/trace/trace_events_hist.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] arm64/ACPI: fix build error when CONFIG_ACPI_APEI_GHES is disabled
by Wupeng Ma 26 May '26

26 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9116 ------------------------------------------ When CONFIG_ACPI_APEI_GHES=n, apei_claim_sei() is not defined. Commit cd342fd16526 ("ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS") placed its declaration and inline stub inside the CONFIG_ACPI block in arch/arm64/include/asm/acpi.h, but the function is implemented in ghes.c which depends on CONFIG_ACPI_APEI_GHES, not CONFIG_ACPI. This leads to a link failure: aarch64-linux-gnu-ld: arch/arm64/kernel/traps.o: in function `arm64_is_fatal_ras_serror': traps.c:(.text+0x1490): undefined reference to `apei_claim_sei' Fix it by moving the declaration and stub to include/acpi/ghes.h, where they are correctly guarded by CONFIG_ACPI_APEI_GHES, and add the necessary #include in traps.c. Fixes: cd342fd16526 ("ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/include/asm/acpi.h | 2 -- arch/arm64/kernel/traps.c | 1 + include/acpi/ghes.h | 3 +++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index 693dc4c7b8173..c07a58b96329d 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -134,11 +134,9 @@ static inline int get_cpu_for_acpi_id(u32 uid) static inline void arch_fix_phys_package_id(int num, u32 slot) { } void __init acpi_init_cpus(void); int apei_claim_sea(struct pt_regs *regs); -int apei_claim_sei(struct pt_regs *regs); #else static inline void acpi_init_cpus(void) { } static inline int apei_claim_sea(struct pt_regs *regs) { return -ENOENT; } -static inline int apei_claim_sei(struct pt_regs *regs) { return -ENOENT; } #endif /* CONFIG_ACPI */ #ifdef CONFIG_ARM64_ACPI_PARKING_PROTOCOL diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c index e8ef661715f00..6d5c4039b9219 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -31,6 +31,7 @@ #include <linux/ubsan.h> #include <linux/cfi.h> #include <linux/acpi.h> +#include <acpi/ghes.h> #include <asm/atomic.h> #include <asm/bug.h> diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h index ebd21b05fe6ed..73a4e64c89002 100644 --- a/include/acpi/ghes.h +++ b/include/acpi/ghes.h @@ -72,10 +72,13 @@ void ghes_unregister_vendor_record_notifier(struct notifier_block *nb); struct list_head *ghes_get_devices(void); void ghes_estatus_pool_region_free(unsigned long addr, u32 size); +int apei_claim_sei(struct pt_regs *regs); #else static inline struct list_head *ghes_get_devices(void) { return NULL; } static inline void ghes_estatus_pool_region_free(unsigned long addr, u32 size) { return; } + +static inline int apei_claim_sei(struct pt_regs *regs) { return -ENOENT; } #endif int ghes_estatus_pool_init(unsigned int num_ghes); -- 2.43.0

2 1

[PATCH OLK-5.10] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
by Zhang Qilong 26 May '26

26 May '26

From: Jan Kiszka <jan.kiszka(a)siemens.com> stable inclusion from stable-v5.10.253 commit cf00cb15f2515e38d3b7571bf6800b7c6ce70a84 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15032 CVE: CVE-2026-43475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ] This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002 [ 415.140822] INFO: lockdep is turned off. [ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common [ 415.140846] Preemption disabled at: [ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)} [ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024 [ 415.140857] Call Trace: [ 415.140861] <TASK> [ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140863] dump_stack_lvl+0x91/0xb0 [ 415.140870] __schedule_bug+0x9c/0xc0 [ 415.140875] __schedule+0xdf6/0x1300 [ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980 [ 415.140879] ? rcu_is_watching+0x12/0x60 [ 415.140883] schedule_rtlock+0x21/0x40 [ 415.140885] rtlock_slowlock_locked+0x502/0x1980 [ 415.140891] rt_spin_lock+0x89/0x1e0 [ 415.140893] hv_ringbuffer_write+0x87/0x2a0 [ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0 [ 415.140900] ? rcu_is_watching+0x12/0x60 [ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc] [ 415.140904] ? HARDIRQ_verbose+0x10/0x10 [ 415.140908] ? __rq_qos_issue+0x28/0x40 [ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod] [ 415.140926] __blk_mq_issue_directly+0x4a/0xc0 [ 415.140928] blk_mq_issue_direct+0x87/0x2b0 [ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440 [ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0 [ 415.140935] __blk_flush_plug+0xf4/0x150 [ 415.140940] __submit_bio+0x2b2/0x5c0 [ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360 [ 415.140946] submit_bio_noacct_nocheck+0x272/0x360 [ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4] [ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4] [ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4] [ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4] [ 415.141060] generic_perform_write+0x14e/0x2c0 [ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4] [ 415.141083] vfs_write+0x2ca/0x570 [ 415.141087] ksys_write+0x76/0xf0 [ 415.141089] do_syscall_64+0x99/0x1490 [ 415.141093] ? rcu_is_watching+0x12/0x60 [ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0 [ 415.141097] ? rcu_is_watching+0x12/0x60 [ 415.141098] ? lock_release+0x1f0/0x2a0 [ 415.141100] ? rcu_is_watching+0x12/0x60 [ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0 [ 415.141103] ? rcu_is_watching+0x12/0x60 [ 415.141104] ? __schedule+0xb34/0x1300 [ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170 [ 415.141109] ? do_nanosleep+0x8b/0x160 [ 415.141111] ? hrtimer_nanosleep+0x89/0x100 [ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 415.141116] ? xfd_validate_state+0x26/0x90 [ 415.141118] ? rcu_is_watching+0x12/0x60 [ 415.141120] ? do_syscall_64+0x1e0/0x1490 [ 415.141121] ? do_syscall_64+0x1e0/0x1490 [ 415.141123] ? rcu_is_watching+0x12/0x60 [ 415.141124] ? do_syscall_64+0x1e0/0x1490 [ 415.141125] ? do_syscall_64+0x1e0/0x1490 [ 415.141127] ? irqentry_exit+0x140/0x7e0 [ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e get_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT. Signed-off-by: Jan Kiszka <jan.kiszka(a)siemens.com> Tested-by: Florian Bezdeka <florian.bezdeka(a)siemens.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Tested-by: Michael Kelley <mhklinux(a)outlook.com> Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 37ad5f525647..c8111d26feff 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1821,12 +1821,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload = payload; cmd_request->payload_sz = payload_sz; /* Invokes the vsc to start an IO */ - ret = storvsc_do_io(dev, cmd_request, get_cpu()); - put_cpu(); + migrate_disable(); + ret = storvsc_do_io(dev, cmd_request, smp_processor_id()); + migrate_enable(); if (ret == -EAGAIN) { if (payload_sz > sizeof(cmd_request->mpb)) kfree(payload); /* no more space */ -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
by Zhang Qilong 26 May '26

26 May '26

From: Jan Kiszka <jan.kiszka(a)siemens.com> stable inclusion from stable-v6.6.130 commit e7919a293f9b6101e38bde0d8613daea6c9955df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15032 CVE: CVE-2026-43475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ] This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002 [ 415.140822] INFO: lockdep is turned off. [ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common [ 415.140846] Preemption disabled at: [ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)} [ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024 [ 415.140857] Call Trace: [ 415.140861] <TASK> [ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140863] dump_stack_lvl+0x91/0xb0 [ 415.140870] __schedule_bug+0x9c/0xc0 [ 415.140875] __schedule+0xdf6/0x1300 [ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980 [ 415.140879] ? rcu_is_watching+0x12/0x60 [ 415.140883] schedule_rtlock+0x21/0x40 [ 415.140885] rtlock_slowlock_locked+0x502/0x1980 [ 415.140891] rt_spin_lock+0x89/0x1e0 [ 415.140893] hv_ringbuffer_write+0x87/0x2a0 [ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0 [ 415.140900] ? rcu_is_watching+0x12/0x60 [ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc] [ 415.140904] ? HARDIRQ_verbose+0x10/0x10 [ 415.140908] ? __rq_qos_issue+0x28/0x40 [ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod] [ 415.140926] __blk_mq_issue_directly+0x4a/0xc0 [ 415.140928] blk_mq_issue_direct+0x87/0x2b0 [ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440 [ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0 [ 415.140935] __blk_flush_plug+0xf4/0x150 [ 415.140940] __submit_bio+0x2b2/0x5c0 [ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360 [ 415.140946] submit_bio_noacct_nocheck+0x272/0x360 [ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4] [ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4] [ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4] [ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4] [ 415.141060] generic_perform_write+0x14e/0x2c0 [ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4] [ 415.141083] vfs_write+0x2ca/0x570 [ 415.141087] ksys_write+0x76/0xf0 [ 415.141089] do_syscall_64+0x99/0x1490 [ 415.141093] ? rcu_is_watching+0x12/0x60 [ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0 [ 415.141097] ? rcu_is_watching+0x12/0x60 [ 415.141098] ? lock_release+0x1f0/0x2a0 [ 415.141100] ? rcu_is_watching+0x12/0x60 [ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0 [ 415.141103] ? rcu_is_watching+0x12/0x60 [ 415.141104] ? __schedule+0xb34/0x1300 [ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170 [ 415.141109] ? do_nanosleep+0x8b/0x160 [ 415.141111] ? hrtimer_nanosleep+0x89/0x100 [ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 415.141116] ? xfd_validate_state+0x26/0x90 [ 415.141118] ? rcu_is_watching+0x12/0x60 [ 415.141120] ? do_syscall_64+0x1e0/0x1490 [ 415.141121] ? do_syscall_64+0x1e0/0x1490 [ 415.141123] ? rcu_is_watching+0x12/0x60 [ 415.141124] ? do_syscall_64+0x1e0/0x1490 [ 415.141125] ? do_syscall_64+0x1e0/0x1490 [ 415.141127] ? irqentry_exit+0x140/0x7e0 [ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e get_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT. Signed-off-by: Jan Kiszka <jan.kiszka(a)siemens.com> Tested-by: Florian Bezdeka <florian.bezdeka(a)siemens.com> Reviewed-by: Michael Kelley <mhklinux(a)outlook.com> Tested-by: Michael Kelley <mhklinux(a)outlook.com> Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 9dcad02ce489..106bccaac427 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1859,12 +1859,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload = payload; cmd_request->payload_sz = payload_sz; /* Invokes the vsc to start an IO */ - ret = storvsc_do_io(dev, cmd_request, get_cpu()); - put_cpu(); + migrate_disable(); + ret = storvsc_do_io(dev, cmd_request, smp_processor_id()); + migrate_enable(); if (ret) scsi_dma_unmap(scmnd); if (ret == -EAGAIN) { -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: define and enforce CEPH_MAX_KEY_LEN
by Zhang Qilong 26 May '26

26 May '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.128 commit e1dc45d97975f9db65694d234fbddf1915176e16 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14861 CVE: CVE-2026-43304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ] When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway. Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/crypto.c | 8 +++++--- net/ceph/crypto.h | 2 +- net/ceph/messenger_v2.c | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c index 051d22c0e4ad..3397d105f74f 100644 --- a/net/ceph/crypto.c +++ b/net/ceph/crypto.c @@ -35,13 +35,10 @@ static int set_secret(struct ceph_crypto_key *key, void *buf) break; default: return -ENOTSUPP; } - if (!key->len) - return -EINVAL; - key->key = kmemdup(buf, key->len, GFP_NOIO); if (!key->key) { ret = -ENOMEM; goto fail; } @@ -93,10 +90,15 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end) ceph_decode_need(p, end, 2*sizeof(u16) + sizeof(key->created), bad); key->type = ceph_decode_16(p); ceph_decode_copy(p, &key->created, sizeof(key->created)); key->len = ceph_decode_16(p); ceph_decode_need(p, end, key->len, bad); + if (key->len > CEPH_MAX_KEY_LEN) { + pr_err("secret too big %d\n", key->len); + return -EINVAL; + } + ret = set_secret(key, *p); memzero_explicit(*p, key->len); *p += key->len; return ret; diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h index 13bd526349fa..0d32f1649f3d 100644 --- a/net/ceph/crypto.h +++ b/net/ceph/crypto.h @@ -3,11 +3,11 @@ #define _FS_CEPH_CRYPTO_H #include <linux/ceph/types.h> #include <linux/ceph/buffer.h> -#define CEPH_KEY_LEN 16 +#define CEPH_MAX_KEY_LEN 16 #define CEPH_MAX_CON_SECRET_LEN 64 /* * cryptographic secret */ diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c index 858198724439..f82029bd33db 100644 --- a/net/ceph/messenger_v2.c +++ b/net/ceph/messenger_v2.c @@ -2391,11 +2391,11 @@ static int process_auth_reply_more(struct ceph_connection *con, * setup_crypto(). __aligned(16) isn't guaranteed to work for stack * objects, so do it by hand. */ static int process_auth_done(struct ceph_connection *con, void *p, void *end) { - u8 session_key_buf[CEPH_KEY_LEN + 16]; + u8 session_key_buf[CEPH_MAX_KEY_LEN + 16]; u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16]; u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16); u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16); int session_key_len, con_secret_len; int payload_len; -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: leapraid: update driver to v2.0.1.2
by haodongdong 26 May '26

26 May '26

From: Dongdong Hao <doubled(a)leap-io-kernel.com> LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9235 ------------------------------------------ leapraid driver changes from v2.0.0.6 to v2.0.1.2. This update includes: - overheat handling rework - reset flow stabilization - improved timeout diagnostics - sysfs enhancement - topology and transport error-path fixes - memory leak/UAF/reference leak fixes - mmap/ioctl validation fixes - improved queue depth handling - improved interrupt and resource cleanup logic The update also fixes several race conditions and improves overall driver robustness under reset, topology change, and controller abnormal scenarios. Signed-off-by: Dongdong Hao <doubled(a)leap-io-kernel.com> --- drivers/scsi/leapraid/Kconfig | 2 +- drivers/scsi/leapraid/leapraid.h | 1335 +++--- drivers/scsi/leapraid/leapraid_app.c | 529 +-- drivers/scsi/leapraid/leapraid_func.c | 4229 ++++++++++++-------- drivers/scsi/leapraid/leapraid_func.h | 1086 ++--- drivers/scsi/leapraid/leapraid_os.c | 910 +++-- drivers/scsi/leapraid/leapraid_transport.c | 485 ++- 7 files changed, 4863 insertions(+), 3713 deletions(-) diff --git a/drivers/scsi/leapraid/Kconfig b/drivers/scsi/leapraid/Kconfig index b539183b24a7..f4ece78f80d3 100644 --- a/drivers/scsi/leapraid/Kconfig +++ b/drivers/scsi/leapraid/Kconfig @@ -5,7 +5,7 @@ config SCSI_LEAPRAID depends on PCI && SCSI select SCSI_SAS_ATTRS help - This driver supports LeapIO PCIe-based Storage + This driver supports LeapIO PCIe-based storage and RAID controllers. <http://www.leap-io.com> diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 77bb93b79254..2a99417143ad 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -1,13 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ #ifndef LEAPRAID_H #define LEAPRAID_H -/* doorbell register definitions */ +/* Doorbell register definitions. */ #define LEAPRAID_DB_RESET 0x00000000 #define LEAPRAID_DB_READY 0x10000000 #define LEAPRAID_DB_OPERATIONAL 0x20000000 @@ -22,55 +22,60 @@ #define LEAPRAID_DB_FUNC_SHIFT 24 #define LEAPRAID_DB_ADD_DWORDS_SHIFT 16 -/* maximum number of retries waiting for doorbell to become ready */ +/* Maximum number of retries waiting for doorbell to become ready. */ #define LEAPRAID_DB_RETRY_COUNT_MAX 10 -/* maximum number of retries waiting for doorbell to become operational */ -#define LEAPRAID_DB_WAIT_OPERATIONAL 10 -/* sleep interval (in seconds) between doorbell polls */ +/* Maximum number of retries waiting for doorbell to become operational. */ +#define LEAPRAID_DB_WAIT_OP_SHORT 10 +#define LEAPRAID_DB_WAIT_OP_LONG 200 +/* Sleep interval (in seconds) between doorbell polls. */ #define LEAPRAID_DB_POLL_INTERVAL_S 1 -/* maximum number of retries waiting for host to end recovery */ -#define LEAPRAID_WAIT_SHOST_RECOVERY 30 +/* Maximum number of retries waiting for host to end recovery. */ +#define LEAPRAID_WAIT_SHOST_RECOVERY 400 -/* diagnostic register definitions */ +/* Diagnostic register definitions. */ #define LEAPRAID_DIAG_WRITE_ENABLE 0x00000080 #define LEAPRAID_DIAG_RESET 0x00000004 -#define LEAPRAID_DIAG_HOLD_ADAPTER_RESET 0x00000002 -/* interrupt status register definitions */ +/* Interrupt status register definitions. */ #define LEAPRAID_HOST2ADAPTER_DB_STATUS 0x80000000 #define LEAPRAID_ADAPTER2HOST_DB_STATUS 0x00000001 -/* the number of debug register */ +/* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 +#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 -/* reply post host register defines */ +/* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 #define LEAPRAID_RPHI_MSIX_IDX_SHIFT 24 -/* vphy flags */ +/* Virtual PHY flags. */ #define LEAPRAID_SAS_PHYINFO_VPHY 0x00001000 -/* linux driver init fw */ +/* Linux driver init firmware. */ #define LEAPRAID_WHOINIT_LINUX_DRIVER 0x04 -/* rdpq array mode */ +/* Reply descriptor post queue array mode. */ #define LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE 0x01 -/* request description flags */ +/* Request description flags. */ #define LEAPRAID_REQ_DESC_FLG_SCSI_IO 0x00 #define LEAPRAID_REQ_DESC_FLG_HPR 0x06 #define LEAPRAID_REQ_DESC_FLG_DFLT_TYPE 0x08 -/* reply description flags */ +/* Reply description flags. */ #define LEAPRAID_RPY_DESC_FLG_TYPE_MASK 0x0F #define LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS 0x00 #define LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY 0x01 #define LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS 0x06 #define LEAPRAID_RPY_DESC_FLG_UNUSED 0x0F -/* MPI functions */ -#define LEAPRAID_FUNC_SCSIIO_REQ 0x00 +/* Request and reply messages share the same set of function codes. + * + * Note: SCSIIO (SCSI I/O) represents SCSI I/O operations and is used + * consistently throughout the driver for all SCSI command handling. + */ +#define LEAPRAID_FUNC_SCSIIO 0x00 #define LEAPRAID_FUNC_SCSI_TMF 0x01 #define LEAPRAID_FUNC_ADAPTER_INIT 0x02 #define LEAPRAID_FUNC_GET_ADAPTER_FEATURES 0x03 @@ -79,17 +84,16 @@ #define LEAPRAID_FUNC_EVENT_NOTIFY 0x07 #define LEAPRAID_FUNC_FW_DOWNLOAD 0x09 #define LEAPRAID_FUNC_FW_UPLOAD 0x12 -#define LEAPRAID_FUNC_RAID_ACTION 0x15 -#define LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH 0x16 +#define LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH 0x16 #define LEAPRAID_FUNC_SCSI_ENC_PROCESSOR 0x18 #define LEAPRAID_FUNC_SMP_PASSTHROUGH 0x1A #define LEAPRAID_FUNC_SAS_IO_UNIT_CTRL 0x1B -#define LEAPRAID_FUNC_SATA_PASSTHROUGH 0x1C +#define LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH 0x1C #define LEAPRAID_FUNC_ADAPTER_UNIT_RESET 0x40 #define LEAPRAID_FUNC_HANDSHAKE 0x42 #define LEAPRAID_FUNC_LOGBUF_INIT 0x57 -/* adapter status values */ +/* Adapter status values. */ #define LEAPRAID_ADAPTER_STATUS_MASK 0x7FFF #define LEAPRAID_ADAPTER_STATUS_SUCCESS 0x0000 #define LEAPRAID_ADAPTER_STATUS_BUSY 0x0002 @@ -113,7 +117,7 @@ #define LEAPRAID_ADAPTER_STATUS_SCSI_ADAPTER_TERMINATED 0x004B #define LEAPRAID_ADAPTER_STATUS_SCSI_EXT_TERMINATED 0x004C -/* sge flags */ +/* SGE flags. */ #define LEAPRAID_SGE_FLG_LAST_ONE 0x80 #define LEAPRAID_SGE_FLG_EOB 0x40 #define LEAPRAID_SGE_FLG_EOL 0x01 @@ -129,15 +133,19 @@ #define LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE 0x80 #define LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR 0x00 -#define LEAPRAID_SGE_OFFSET_SIZE 4 +#define LEAPRAID_SGE_NO_DATA_ADDR -1 +#define LEAPRAID_SGE_OFFSET_SIZE 4 -/* page and ext page type */ +/* The type of page. */ #define LEAPRAID_CFG_PT_IO_UNIT 0x00 #define LEAPRAID_CFG_PT_ADAPTER 0x01 #define LEAPRAID_CFG_PT_BIOS 0x02 #define LEAPRAID_CFG_PT_RAID_VOLUME 0x08 +#define LEAPRAID_CFG_PT_MANUFACTURING 0x09 #define LEAPRAID_CFG_PT_RAID_PHYSDISK 0x0A #define LEAPRAID_CFG_PT_EXTENDED 0x0F + +/* The type of extended page. */ #define LEAPRAID_CFG_EXTPT_SAS_IO_UNIT 0x10 #define LEAPRAID_CFG_EXTPT_SAS_EXP 0x11 #define LEAPRAID_CFG_EXTPT_SAS_DEV 0x12 @@ -145,7 +153,7 @@ #define LEAPRAID_CFG_EXTPT_ENC 0x15 #define LEAPRAID_CFG_EXTPT_RAID_CONFIG 0x16 -/* config page address */ +/* Config page address. */ #define LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP 0x00000000 #define LEAPRAID_SAS_ENC_CFG_PGAD_HDL 0x10000000 #define LEAPRAID_SAS_DEV_CFG_PGAD_HDL 0x20000000 @@ -156,51 +164,55 @@ #define LEAPRAID_SAS_PHY_CFG_PGAD_PHY_NUMBER 0x00000000 #define LEAPRAID_PHYSDISK_CFG_PGAD_PHYSDISKNUM 0x10000000 -/* config page operations */ +/* Config page operations. */ #define LEAPRAID_CFG_ACT_PAGE_HEADER 0x00 #define LEAPRAID_CFG_ACT_PAGE_READ_CUR 0x01 #define LEAPRAID_CFG_ACT_PAGE_WRITE_CUR 0x02 -/* bios pages */ +/* BIOS page number. */ #define LEAPRAID_CFG_PAGE_NUM_BIOS2 0x2 #define LEAPRAID_CFG_PAGE_NUM_BIOS3 0x3 -/* sas device pages */ +/* Manufacturing page number. */ +#define LEAPRAID_CFG_PAGE_NUM_MANU0 0x0 + +/* SAS device page number. */ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 -/* sas device page 0 flags */ +/* SAS device page 0 flags. */ #define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 +#define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 -/* sas IO unit pages */ +/* SAS I/O unit page number. */ #define LEAPRAID_CFG_PAGE_NUM_IOUNIT0 0x0 #define LEAPRAID_CFG_PAGE_NUM_IOUNIT1 0x1 -/* sas expander pages */ +/* SAS expander page number. */ #define LEAPRAID_CFG_PAGE_NUM_EXP0 0x0 #define LEAPRAID_CFG_PAGE_NUM_EXP1 0x1 -/* sas enclosure page */ +/* SAS enclosure page number. */ #define LEAPRAID_CFG_PAGE_NUM_ENC0 0x0 -/* sas phy page */ +/* SAS PHY page number. */ #define LEAPRAID_CFG_PAGE_NUM_PHY0 0x0 -/* raid volume pages */ +/* RAID volume page number. */ #define LEAPRAID_CFG_PAGE_NUM_VOL0 0x0 #define LEAPRAID_CFG_PAGE_NUM_VOL1 0x1 -/* physical disk page */ +/* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* adapter page */ +/* Adapter page number. */ #define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 #define LEAPRAID_CFG_UNIT_SIZE 4 -/* raid volume type and state */ +/* Raid volume type and state. */ #define LEAPRAID_VOL_STATE_MISSING 0x00 #define LEAPRAID_VOL_STATE_FAILED 0x01 #define LEAPRAID_VOL_STATE_INITIALIZING 0x02 @@ -213,17 +225,17 @@ #define LEAPRAID_VOL_TYPE_RAID10 0x05 #define LEAPRAID_VOL_TYPE_UNKNOWN 0xFF -/* raid volume element flags */ +/* Raid volume element flags. */ #define LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE 0x000F #define LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT 0x0001 #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* raid action */ +/* Raid action. */ #define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 #define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 -/* sas negotiated link rates */ +/* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 #define LEAPRAID_SAS_NEG_LINK_RATE_PHY_DISABLED 0x01 @@ -231,6 +243,7 @@ #define LEAPRAID_SAS_NEG_LINK_RATE_SATA_OOB_COMPLETE 0x03 #define LEAPRAID_SAS_NEG_LINK_RATE_PORT_SELECTOR 0x04 #define LEAPRAID_SAS_NEG_LINK_RATE_SMP_RESETTING 0x05 +#define LEAPRAID_SAS_NEG_LINK_RATE_SHIFT 4 #define LEAPRAID_SAS_NEG_LINK_RATE_1_5 0x08 #define LEAPRAID_SAS_NEG_LINK_RATE_3_0 0x09 @@ -240,8 +253,11 @@ #define LEAPRAID_SAS_PRATE_MIN_RATE_MASK 0x0F #define LEAPRAID_SAS_HWRATE_MIN_RATE_MASK 0x0F -/* scsi IO control bits */ -#define LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT 26 +/* + * Control flags for a SCSI I/O Request. + */ +#define LEAPRAID_SCSIIO_CTRL_CDB_32BYTE 4 +#define LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT 26 #define LEAPRAID_SCSIIO_CTRL_NODATATRANSFER 0x00000000 #define LEAPRAID_SCSIIO_CTRL_WRITE 0x01000000 #define LEAPRAID_SCSIIO_CTRL_READ 0x02000000 @@ -250,7 +266,7 @@ #define LEAPRAID_SCSIIO_CTRL_ORDEREDQ 0x00000200 #define LEAPRAID_SCSIIO_CTRL_CMDPRI 0x00000800 -/* scsi state and status */ +/* SCSI state and status. */ #define LEAPRAID_SCSI_STATUS_BUSY 0x08 #define LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT 0x18 #define LEAPRAID_SCSI_STATUS_TASK_SET_FULL 0x28 @@ -261,7 +277,7 @@ #define LEAPRAID_SCSI_STATE_AUTOSENSE_FAILED 0x02 #define LEAPRAID_SCSI_STATE_AUTOSENSE_VALID 0x01 -/* scsi task management defines */ +/* SCSI task management defines. */ #define LEAPRAID_TM_TASKTYPE_ABORT_TASK 0x01 #define LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET 0x02 #define LEAPRAID_TM_TASKTYPE_TARGET_RESET 0x03 @@ -277,21 +293,20 @@ #define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 #define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 -/* scsi sep request defines */ +/* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 #define LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS 0x00 #define LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS 0x01 #define LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT 0x00000040 -/* the capabilities of the adapter */ +/* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 #define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 #define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 -/* event code definitions for the firmware */ +/* Event code definitions for the firmware. */ #define LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE 0x000F -#define LEAPRAID_EVT_SAS_DISCOVERY 0x0016 #define LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST 0x001C #define LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE 0x001D #define LEAPRAID_EVT_IR_CHANGE 0x0020 @@ -303,7 +318,7 @@ #define LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET 0x08 #define LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET 0x0E -/* raid configuration change event */ +/* RAID configuration change event. */ #define LEAPRAID_EVT_IR_RC_VOLUME_ADD 0x01 #define LEAPRAID_EVT_IR_RC_VOLUME_DELETE 0x02 #define LEAPRAID_EVT_IR_RC_PD_HIDDEN_TO_ADD 0x03 @@ -313,27 +328,25 @@ #define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A #define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B -/* sas topology change event */ +/* SAS topology change event. */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 #define LEAPRAID_EVT_SAS_TOPO_ES_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING 0x02 #define LEAPRAID_EVT_SAS_TOPO_ES_RESPONDING 0x03 #define LEAPRAID_EVT_SAS_TOPO_RC_MASK 0x0F -#define LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK 0xF0 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -#define LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED 0x03 -/* sas discovery event defines */ +/* SAS discovery event defines. */ #define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 #define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 -/* enclosure device status change event */ +/* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 -/* device type and identifiers */ +/* Device type and identifiers. */ #define LEAPRAID_DEVTYP_SEP 0x00004000 #define LEAPRAID_DEVTYP_SSP_TGT 0x00000400 #define LEAPRAID_DEVTYP_STP_TGT 0x00000200 @@ -350,12 +363,12 @@ #define LEAPRAID_DEVTYP_EDGE_EXPANDER 0x00000002 #define LEAPRAID_DEVTYP_FANOUT_EXPANDER 0x00000003 -/* sas control operation */ +/* SAS control operation. */ #define LEAPRAID_SAS_OP_PHY_LINK_RESET 0x06 #define LEAPRAID_SAS_OP_PHY_HARD_RESET 0x07 #define LEAPRAID_SAS_OP_SET_PARAMETER 0x0F -/* boot device defines */ +/* Boot device defines */ #define LEAPRAID_BOOTDEV_FORM_MASK 0x0F #define LEAPRAID_BOOTDEV_FORM_NONE 0x00 #define LEAPRAID_BOOTDEV_FORM_SAS_WWID 0x05 @@ -365,21 +378,21 @@ /** * struct leapraid_reg_base - Register layout of the LeapRAID controller * - * @db: Doorbell register used to signal commands or status to firmware - * @ws: Write sequence register for synchronizing doorbell operations - * @host_diag: Diagnostic register used for status or debug reporting - * @r1: Reserved - * @host_int_status: Interrupt status register reporting active interrupts - * @host_int_mask: Interrupt mask register enabling or disabling sources - * @r2: Reserved - * @rep_msg_host_idx: Reply message index for the next available reply slot - * @r3: Reserved - * @debug_log: DebugLog registers for firmware debug and diagnostic output - * @r4: Reserved - * @atomic_req_desc_post: Atomic register for single descriptor posting - * @adapter_log_buf_pos: Adapter log buffer write position - * @host_log_buf_pos: Host log buffer write position - * @r5: Reserved + * @db: Doorbell register used to signal commands or status to firmware. + * @ws: Write sequence register for synchronizing doorbell operations. + * @host_diag: Diagnostic register used for status or debug reporting. + * @r1: Reserved. + * @host_int_status: Interrupt status register reporting active interrupts. + * @host_int_mask: Interrupt mask register enabling or disabling sources. + * @r2: Reserved. + * @rep_msg_host_idx: Reply message index for the next available reply slot. + * @r3: Reserved. + * @debug_log: DebugLog registers for firmware debug and diagnostic output. + * @r4: Reserved. + * @atomic_req_desc_post: Atomic register for single descriptor posting. + * @adapter_log_buf_pos: Adapter log buffer write position. + * @host_log_buf_pos: Host log buffer write position. + * @r5: Reserved. * @rep_post_reg_idx: Array of reply post index registers, one per queue. * The number of entries is defined by * REP_POST_HOST_IDX_REG_CNT. @@ -411,9 +424,9 @@ struct leapraid_reg_base { /** * struct leapraid_atomic_req_desc - Atomic request descriptor * - * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O) - * @msix_idx: MSI-X vector index used for interrupt routing - * @taskid: Unique task identifier associated with this request + * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O). + * @msix_idx: MSI-X vector index used for interrupt routing. + * @taskid: Unique task identifier associated with this request. */ struct leapraid_atomic_req_desc { u8 flg; @@ -424,23 +437,23 @@ struct leapraid_atomic_req_desc { /** * union leapraid_rep_desc_union - Unified reply descriptor format * - * @dflt_rep: Default reply descriptor containing basic completion info - * @dflt_rep.rep_flg: Reply flag indicating reply type or status - * @dflt_rep.msix_idx: MSI-X index for interrupt routing - * @dflt_rep.taskid: Task identifier matching the submitted request - * @r1: Reserved + * @dflt_rep: Default reply descriptor containing basic completion info. + * @dflt_rep.rep_flg: Reply flag indicating reply type or status. + * @dflt_rep.msix_idx: MSI-X index for interrupt routing. + * @dflt_rep.taskid: Task identifier matching the submitted request. + * @r1: Reserved. * * @addr_rep: Address reply descriptor used when firmware returns a - * memory address associated with the reply - * @addr_rep.rep_flg: Reply flag indicating reply type or status - * @addr_rep.msix_idx: MSI-X index for interrupt routing - * @addr_rep.taskid: Task identifier matching the submitted request - * @addr_rep.rep_frame_addr: Physical address of the reply frame + * memory address associated with the reply. + * @addr_rep.rep_flg: Reply flag indicating reply type or status. + * @addr_rep.msix_idx: MSI-X index for interrupt routing. + * @addr_rep.taskid: Task identifier matching the submitted request. + * @addr_rep.rep_frame_addr: Physical address of the reply frame. * - * @words: Raw 64-bit representation of the reply descriptor - * @u: Alternative access using 32-bit low/high words - * @u.low: Lower 32 bits of the descriptor - * @u.high: Upper 32 bits of the descriptor + * @words: Raw 64-bit representation of the reply descriptor. + * @u: Alternative access using 32-bit low/high words. + * @u.low: Lower 32 bits of the descriptor. + * @u.high: Upper 32 bits of the descriptor. */ union leapraid_rep_desc_union { struct leapraid_rep_desc { @@ -465,10 +478,10 @@ union leapraid_rep_desc_union { /** * struct leapraid_req - Generic request header * - * @func_dep1: Function-dependent parameter (low 16 bits) - * @r1: Reserved - * @func: Function code identifying the command type - * @r2: Reserved + * @func_dep1: Function-dependent parameter (low 16 bits). + * @r1: Reserved. + * @func: Function code identifying the command type. + * @r2: Reserved. */ struct leapraid_req { __le16 func_dep1; @@ -480,12 +493,12 @@ struct leapraid_req { /** * struct leapraid_rep - Generic reply header * - * @r1: Reserved - * @msg_len: Length of the reply message in bytes - * @function: Function code corresponding to the request - * @r2: Reserved - * @adapter_status: Status code reported by the adapter - * @r3: Reserved + * @r1: Reserved. + * @msg_len: Length of the reply message in bytes. + * @function: Function code corresponding to the request. + * @r2: Reserved. + * @adapter_status: Status code reported by the adapter. + * @r3: Reserved. */ struct leapraid_rep { u8 r1[2]; @@ -499,8 +512,8 @@ struct leapraid_rep { /** * struct leapraid_sge_simple32 - 32-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 32-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 32-bit physical address of the data buffer. */ struct leapraid_sge_simple32 { __le32 flg_and_len; @@ -510,8 +523,8 @@ struct leapraid_sge_simple32 { /** * struct leapraid_sge_simple64 - 64-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 64-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 64-bit physical address of the data buffer. */ struct leapraid_sge_simple64 { __le32 flg_and_len; @@ -521,9 +534,9 @@ struct leapraid_sge_simple64 { /** * struct leapraid_sge_simple_union - Unified 32/64-bit SGE representation * - * @flg_and_len: Combined field for flags and segment length - * @u.addr32: 32-bit address field - * @u.addr64: 64-bit address field + * @flg_and_len: Combined field for flags and segment length. + * @u.addr32: 32-bit address field. + * @u.addr64: 64-bit address field. */ struct leapraid_sge_simple_union { __le32 flg_and_len; @@ -536,11 +549,11 @@ struct leapraid_sge_simple_union { /** * struct leapraid_sge_chain_union - Chained scatter-gather entry * - * @len: Length of the chain descriptor - * @next_chain_offset: Offset to the next SGE chain - * @flg: Flags indicating chain or termination properties - * @u.addr32: 32-bit physical address - * @u.addr64: 64-bit physical address + * @len: Length of the chain descriptor. + * @next_chain_offset: Offset to the next SGE chain. + * @flg: Flags indicating chain or termination properties. + * @u.addr32: 32-bit physical address. + * @u.addr64: 64-bit physical address. */ struct leapraid_sge_chain_union { __le16 len; @@ -555,8 +568,8 @@ struct leapraid_sge_chain_union { /** * struct leapraid_ieee_sge_simple32 - IEEE 32-bit simple SGE format * - * @addr: 32-bit physical address of the data buffer - * @flg_and_len: Combined field for flags and data length + * @addr: 32-bit physical address of the data buffer. + * @flg_and_len: Combined field for flags and data length. */ struct leapraid_ieee_sge_simple32 { __le32 addr; @@ -566,10 +579,10 @@ struct leapraid_ieee_sge_simple32 { /** * struct leapraid_ieee_sge_simple64 - IEEE 64-bit simple SGE format * - * @addr: 64-bit physical address of the data buffer - * @len: Length of the data segment - * @r1: Reserved - * @flg: Flags indicating transfer properties + * @addr: 64-bit physical address of the data buffer. + * @len: Length of the data segment. + * @r1: Reserved. + * @flg: Flags indicating transfer properties. */ struct leapraid_ieee_sge_simple64 { __le64 addr; @@ -581,8 +594,8 @@ struct leapraid_ieee_sge_simple64 { /** * union leapraid_ieee_sge_simple_union - Unified IEEE SGE format * - * @simple32: IEEE 32-bit simple SGE entry - * @simple64: IEEE 64-bit simple SGE entry + * @simple32: IEEE 32-bit simple SGE entry. + * @simple64: IEEE 64-bit simple SGE entry. */ union leapraid_ieee_sge_simple_union { struct leapraid_ieee_sge_simple32 simple32; @@ -592,8 +605,8 @@ union leapraid_ieee_sge_simple_union { /** * union leapraid_ieee_sge_chain_union - Unified IEEE SGE chain format * - * @chain32: IEEE 32-bit chain SGE entry - * @chain64: IEEE 64-bit chain SGE entry + * @chain32: IEEE 32-bit chain SGE entry. + * @chain64: IEEE 64-bit chain SGE entry. */ union leapraid_ieee_sge_chain_union { struct leapraid_ieee_sge_simple32 chain32; @@ -603,11 +616,11 @@ union leapraid_ieee_sge_chain_union { /** * struct leapraid_chain64_ieee_sg - 64-bit IEEE chain SGE descriptor * - * @addr: Physical address of the next chain segment - * @len: Length of the current SGE - * @r1: Reserved - * @next_chain_offset: Offset to the next chain element - * @flg: Flags that describe SGE attributes + * @addr: Physical address of the next chain segment. + * @len: Length of the current SGE. + * @r1: Reserved. + * @next_chain_offset: Offset to the next chain element. + * @flg: Flags that describe SGE attributes. */ struct leapraid_chain64_ieee_sg { __le64 addr; @@ -620,8 +633,8 @@ struct leapraid_chain64_ieee_sg { /** * union leapraid_ieee_sge_io_union - IEEE-style SGE union for I/O * - * @ieee_simple: Simple IEEE SGE descriptor - * @ieee_chain: IEEE chain SGE descriptor + * @ieee_simple: Simple IEEE SGE descriptor. + * @ieee_chain: IEEE chain SGE descriptor. */ union leapraid_ieee_sge_io_union { struct leapraid_ieee_sge_simple64 ieee_simple; @@ -631,25 +644,25 @@ union leapraid_ieee_sge_io_union { /** * union leapraid_simple_sge_union - Union of simple SGE descriptors * - * @leapio_simple: LeapIO-style simple SGE - * @ieee_simple: IEEE-style simple SGE + * @leapraid_simple: LeapRAID simple SGE. + * @ieee_simple: IEEE-style simple SGE. */ union leapraid_simple_sge_union { - struct leapraid_sge_simple_union leapio_simple; + struct leapraid_sge_simple_union leapraid_simple; union leapraid_ieee_sge_simple_union ieee_simple; }; /** * union leapraid_sge_io_union - Combined SGE union for all I/O types * - * @leapio_simple: LeapIO simple SGE format - * @leapio_chain: LeapIO chain SGE format - * @ieee_simple: IEEE simple SGE format - * @ieee_chain: IEEE chain SGE format + * @leapraid_simple: LeapRAID simple SGE format. + * @leapraid_chain: LeapRAID chain SGE format. + * @ieee_simple: IEEE simple SGE format. + * @ieee_chain: IEEE chain SGE format. */ union leapraid_sge_io_union { - struct leapraid_sge_simple_union leapio_simple; - struct leapraid_sge_chain_union leapio_chain; + struct leapraid_sge_simple_union leapraid_simple; + struct leapraid_sge_chain_union leapraid_chain; union leapraid_ieee_sge_simple_union ieee_simple; union leapraid_ieee_sge_chain_union ieee_chain; }; @@ -657,10 +670,10 @@ union leapraid_sge_io_union { /** * struct leapraid_cfg_pg_header - Standard configuration page header * - * @r1: Reserved - * @page_len: Length of the page in 4-byte units - * @page_num: Page number - * @page_type: Page type + * @r1: Reserved. + * @page_len: Length of the page in 4-byte units. + * @page_num: Page number. + * @page_type: Page type. */ struct leapraid_cfg_pg_header { u8 r1; @@ -672,13 +685,13 @@ struct leapraid_cfg_pg_header { /** * struct leapraid_cfg_ext_pg_header - Extended configuration page header * - * @r1: Reserved - * @r2: Reserved - * @page_num: Page number - * @page_type: Page type - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @r3: Reserved + * @r1: Reserved. + * @r2: Reserved. + * @page_num: Page number. + * @page_type: Page type. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @r3: Reserved. */ struct leapraid_cfg_ext_pg_header { u8 r1; @@ -693,17 +706,17 @@ struct leapraid_cfg_ext_pg_header { /** * struct leapraid_cfg_req - Configuration request message * - * @action: Requested action type - * @sgl_flag: SGL flag field - * @chain_offset: Offset to next chain SGE - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r1: Reserved - * @header: Configuration page header - * @page_addr: Address of the page buffer - * @page_buf_sge: SGE describing the page buffer + * @action: Requested action type. + * @sgl_flag: SGL flag field. + * @chain_offset: Offset to next chain SGE. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r1: Reserved. + * @header: Configuration page header. + * @page_addr: Address of the page buffer. + * @page_buf_sge: SGE describing the page buffer. */ struct leapraid_cfg_req { u8 action; @@ -722,17 +735,17 @@ struct leapraid_cfg_req { /** * struct leapraid_cfg_rep - Configuration reply message * - * @action: Action type from the request - * @r1: Reserved - * @msg_len: Message length in bytes - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status code - * @r3: Reserved - * @header: Configuration page header + * @action: Action type from the request. + * @r1: Reserved. + * @msg_len: Message length in bytes. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status code. + * @r3: Reserved. + * @header: Configuration page header. */ struct leapraid_cfg_rep { u8 action; @@ -751,9 +764,9 @@ struct leapraid_cfg_rep { /** * struct leapraid_boot_dev_format_sas_wwid - Boot device identified by wwid * - * @sas_addr: SAS address of the device - * @lun: Logical unit number - * @r1: Reserved + * @sas_addr: SAS address of the device. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_sas_wwid { __le64 sas_addr; @@ -764,10 +777,10 @@ struct leapraid_boot_dev_format_sas_wwid { /** * struct leapraid_boot_dev_format_enc_slot - identified by enclosure * - * @enc_lid: Enclosure logical ID - * @r1: Reserved - * @slot_num: Slot number in the enclosure - * @r2: Reserved + * @enc_lid: Enclosure logical ID. + * @r1: Reserved. + * @slot_num: Slot number in the enclosure. + * @r2: Reserved. */ struct leapraid_boot_dev_format_enc_slot { __le64 enc_lid; @@ -779,9 +792,9 @@ struct leapraid_boot_dev_format_enc_slot { /** * struct leapraid_boot_dev_format_dev_name - Boot device by device name * - * @dev_name: Device name identifier - * @lun: Logical unit number - * @r1: Reserved + * @dev_name: Device name identifier. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_dev_name { __le64 dev_name; @@ -792,9 +805,9 @@ struct leapraid_boot_dev_format_dev_name { /** * union leapraid_boot_dev_format - Boot device format union * - * @sas_wwid: Format using SAS WWID and LUN - * @enc_slot: Format using enclosure slot and ID - * @dev_name: Format using device name and LUN + * @sas_wwid: Format using SAS WWID and LUN. + * @enc_slot: Format using enclosure slot and ID. + * @dev_name: Format using device name and LUN. */ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_sas_wwid sas_wwid; @@ -802,20 +815,39 @@ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_dev_name dev_name; }; +/** + * struct leapraid_manufacturing_p0 - Manufacturing configuration page 0 + * + * @header: Configuration page header. + * @chip_name: Chip name as a 16-byte ASCII string. + * @chip_revision: Chip revision as an 8-byte ASCII string. + * @board_name: Board name as a 16-byte ASCII string. + * @board_assembly: Board assembly as a 16-byte ASCII string. + * @board_tracer_number: Board tracer number as a 16-byte ASCII string. + */ +struct leapraid_manufacturing_p0 { + struct leapraid_cfg_pg_header header; + u8 chip_name[16]; + u8 chip_revision[8]; + u8 board_name[16]; + u8 board_assembly[16]; + u8 board_tracer_number[16]; +}; + /** * struct leapraid_bios_page2 - BIOS configuration page 2 * - * @header: Configuration page header - * @r1: Reserved - * @requested_boot_dev_form: Format type of the requested boot device - * @r2: Reserved - * @requested_boot_dev: Boot device requested by BIOS or user - * @requested_alt_boot_dev_form: Format of the alternate boot device - * @r3: Reserved - * @requested_alt_boot_dev: Alternate boot device requested - * @current_boot_dev_form: Format type of the active boot device - * @r4: Reserved - * @current_boot_dev: Currently active boot device in use + * @header: Configuration page header. + * @r1: Reserved. + * @requested_boot_dev_form: Format type of the requested boot device. + * @r2: Reserved. + * @requested_boot_dev: Boot device requested by BIOS or user. + * @requested_alt_boot_dev_form: Format of the alternate boot device. + * @r3: Reserved. + * @requested_alt_boot_dev: Alternate boot device requested. + * @current_boot_dev_form: Format type of the active boot device. + * @r4: Reserved. + * @current_boot_dev: Currently active boot device in use. */ struct leapraid_bios_page2 { struct leapraid_cfg_pg_header header; @@ -834,10 +866,10 @@ struct leapraid_bios_page2 { /** * struct leapraid_bios_page3 - BIOS configuration page 3 * - * @header: Configuration page header - * @r1: Reserved - * @bios_version: BIOS firmware version number - * @r2: Reserved + * @header: Configuration page header. + * @r1: Reserved. + * @bios_version: BIOS firmware version number. + * @r2: Reserved. */ struct leapraid_bios_page3 { struct leapraid_cfg_pg_header header; @@ -849,9 +881,9 @@ struct leapraid_bios_page3 { /** * struct leapraid_raidvol0_phys_disk - Physical disk in RAID volume * - * @r1: Reserved - * @phys_disk_num: Physical disk number within the RAID volume - * @r2: Reserved + * @r1: Reserved. + * @phys_disk_num: Physical disk number within the RAID volume. + * @r2: Reserved. */ struct leapraid_raidvol0_phys_disk { u8 r1[2]; @@ -862,14 +894,14 @@ struct leapraid_raidvol0_phys_disk { /** * struct leapraid_raidvol_p0 - RAID volume configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle for the RAID volume - * @volume_state: State of the RAID volume - * @volume_type: RAID type - * @r1: Reserved - * @num_phys_disks: Number of physical disks in the volume - * @r2: Reserved - * @phys_disk: Array of physical disks in this volume + * @header: Configuration page header. + * @dev_hdl: Device handle for the RAID volume. + * @volume_state: State of the RAID volume. + * @volume_type: RAID type. + * @r1: Reserved. + * @num_phys_disks: Number of physical disks in the volume. + * @r2: Reserved. + * @phys_disk: Array of physical disks in this volume. */ struct leapraid_raidvol_p0 { struct leapraid_cfg_pg_header header; @@ -885,11 +917,11 @@ struct leapraid_raidvol_p0 { /** * struct leapraid_raidvol_p1 - RAID volume configuration page 1 * - * @header: Configuration page header - * @dev_hdl: Device handle of the RAID volume - * @r1: Reserved - * @wwid: World-wide identifier for the volume - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the RAID volume. + * @r1: Reserved. + * @wwid: World-wide identifier for the volume. + * @r2: Reserved. */ struct leapraid_raidvol_p1 { struct leapraid_cfg_pg_header header; @@ -902,11 +934,11 @@ struct leapraid_raidvol_p1 { /** * struct leapraid_raidpd_p0 - Physical disk configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle of the physical disk - * @r1: Reserved - * @phys_disk_num: Physical disk number - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the physical disk. + * @r1: Reserved. + * @phys_disk_num: Physical disk number. + * @r2: Reserved. */ struct leapraid_raidpd_p0 { struct leapraid_cfg_pg_header header; @@ -919,14 +951,14 @@ struct leapraid_raidpd_p0 { /** * struct leapraid_sas_io_unit0_phy_info - PHY info for SAS I/O unit * - * @port: Port number the PHY belongs to - * @port_flg: Flags describing port status - * @phy_flg: Flags describing PHY status - * @neg_link_rate: Negotiated link rate of the PHY - * @controller_phy_dev_info: Controller PHY device info - * @attached_dev_hdl: Handle of attached device - * @controller_dev_hdl: Handle of the controller device - * @r1: Reserved + * @port: Port number the PHY belongs to. + * @port_flg: Flags describing port status. + * @phy_flg: Flags describing PHY status. + * @neg_link_rate: Negotiated link rate of the PHY. + * @controller_phy_dev_info: Controller PHY device info. + * @attached_dev_hdl: Handle of attached device. + * @controller_dev_hdl: Handle of the controller device. + * @r1: Reserved. */ struct leapraid_sas_io_unit0_phy_info { u8 port; @@ -942,11 +974,11 @@ struct leapraid_sas_io_unit0_phy_info { /** * struct leapraid_sas_io_unit_p0 - SAS I/O unit configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @phy_num: Number of PHYs in this unit - * @r2: Reserved - * @phy_info: Array of PHY information + * @header: Extended configuration page header. + * @r1: Reserved. + * @phy_num: Number of PHYs in this unit. + * @r2: Reserved. + * @phy_info: Array of PHY information. */ struct leapraid_sas_io_unit_p0 { struct leapraid_cfg_ext_pg_header header; @@ -956,54 +988,20 @@ struct leapraid_sas_io_unit_p0 { struct leapraid_sas_io_unit0_phy_info phy_info[]; }; -/** - * struct leapraid_sas_io_unit1_phy_info - Placeholder for SAS unit page 1 PHY - * - * @r1: Reserved - */ -struct leapraid_sas_io_unit1_phy_info { - u8 r1[12]; -}; - -/** - * struct leapraid_sas_io_unit_page1 - SAS I/O unit configuration page 1 - * - * @header: Extended configuration page header - * @r1: Reserved - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @r2: Reserved - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @r3: Reserved - * @sata_max_queue_depth: Maximum SATA queue depth - * @r4: Reserved - * @phy_info: Array of PHY info structures - */ -struct leapraid_sas_io_unit_page1 { - struct leapraid_cfg_ext_pg_header header; - u8 r1[2]; - __le16 narrowport_max_queue_depth; - u8 r2[2]; - __le16 wideport_max_queue_depth; - u8 r3; - u8 sata_max_queue_depth; - u8 r4[2]; - struct leapraid_sas_io_unit1_phy_info phy_info[]; -}; - /** * struct leapraid_exp_p0 - SAS expander page 0 * - * @header: Extended page header - * @physical_port: Physical port number - * @r1: Reserved - * @enc_hdl: Enclosure handle - * @sas_address: SAS address of the expander - * @r2: Reserved - * @dev_hdl: Device handle of this expander - * @parent_dev_hdl: Device handle of parent expander - * @r3: Reserved - * @phy_num: Number of PHYs - * @r4: Reserved + * @header: Extended page header. + * @physical_port: Physical port number. + * @r1: Reserved. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address of the expander. + * @r2: Reserved. + * @dev_hdl: Device handle of this expander. + * @parent_dev_hdl: Device handle of parent expander. + * @r3: Reserved. + * @phy_num: Number of PHYs. + * @r4: Reserved. */ struct leapraid_exp_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1022,14 +1020,14 @@ struct leapraid_exp_p0 { /** * struct leapraid_exp_p1 - SAS expander page 1 * - * @header: Extended page header - * @r1: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @attached_dev_hdl: Attached device handle - * @r2: Reserved - * @neg_link_rate: Negotiated link rate - * @r3: Reserved + * @header: Extended page header. + * @r1: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @attached_dev_hdl: Attached device handle. + * @r2: Reserved. + * @neg_link_rate: Negotiated link rate. + * @r3: Reserved. */ struct leapraid_exp_p1 { struct leapraid_cfg_ext_pg_header header; @@ -1045,25 +1043,25 @@ struct leapraid_exp_p1 { /** * struct leapraid_sas_dev_p0 - SAS device page 0 * - * @header: Extended configuration page header - * @slot: Slot number - * @enc_hdl: Enclosure handle - * @sas_address: SAS address - * @parent_dev_hdl: Parent device handle - * @phy_num: Number of PHYs - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @dev_info: Device information - * @flg: Flags - * @physical_port: Physical port number - * @max_port_connections: Maximum port connections - * @dev_name: Device name - * @port_groups: Number of port groups - * @r3: Reserved - * @enc_level: Enclosure level - * @connector_name: Connector identifier - * @r4: Reserved + * @header: Extended configuration page header. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address. + * @parent_dev_hdl: Parent device handle. + * @phy_num: Number of PHYs. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @dev_info: Device information. + * @flg: Flags. + * @physical_port: Physical port number. + * @max_port_connections: Maximum port connections. + * @dev_name: Device name. + * @port_groups: Number of port groups. + * @r3: Reserved. + * @enc_level: Enclosure level. + * @connector_name: Connector identifier. + * @r4: Reserved. */ struct leapraid_sas_dev_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1083,23 +1081,23 @@ struct leapraid_sas_dev_p0 { u8 port_groups; u8 r3[2]; u8 enc_level; - u8 connector_name[4]; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN]; u8 r4[4]; } __packed __aligned(4); /** * struct leapraid_sas_phy_p0 - SAS PHY configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @attached_dev_hdl: Handle of attached device - * @r2: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @r3: Reserved - * @phy_info: PHY information - * @neg_link_rate: Negotiated link rate - * @r4: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @attached_dev_hdl: Handle of attached device. + * @r2: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @r3: Reserved. + * @phy_info: PHY information. + * @neg_link_rate: Negotiated link rate. + * @r4: Reserved. */ struct leapraid_sas_phy_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1117,12 +1115,12 @@ struct leapraid_sas_phy_p0 { /** * struct leapraid_enc_p0 - SAS enclosure page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @enc_lid: Enclosure logical ID - * @r2: Reserved - * @enc_hdl: Enclosure handle - * @r3: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @enc_lid: Enclosure logical ID. + * @r2: Reserved. + * @enc_hdl: Enclosure handle. + * @r3: Reserved. */ struct leapraid_enc_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1136,10 +1134,10 @@ struct leapraid_enc_p0 { /** * struct leapraid_raid_cfg_p0_element - RAID configuration element * - * @element_flg: Element flags - * @vol_dev_hdl: Volume device handle - * @r1: Reserved - * @phys_disk_dev_hdl: Physical disk device handle + * @element_flg: Element flags. + * @vol_dev_hdl: Volume device handle. + * @r1: Reserved. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_raid_cfg_p0_element { __le16 element_flg; @@ -1151,13 +1149,13 @@ struct leapraid_raid_cfg_p0_element { /** * struct leapraid_raid_cfg_p0 - RAID configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @cfg_num: Configuration number - * @r2: Reserved - * @elements_num: Number of RAID elements - * @r3: Reserved - * @cfg_element: Array of RAID elements + * @header: Extended configuration page header. + * @r1: Reserved. + * @cfg_num: Configuration number. + * @r2: Reserved. + * @elements_num: Number of RAID elements. + * @r3: Reserved. + * @cfg_element: Array of RAID elements. */ struct leapraid_raid_cfg_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1172,8 +1170,8 @@ struct leapraid_raid_cfg_p0 { /** * union leapraid_mpi_scsi_io_cdb_union - SCSI I/O CDB or simple SGE * - * @cdb32: 32-byte SCSI command descriptor block - * @sge: Simple SGE format + * @cdb32: 32-byte SCSI command descriptor block. + * @sge: Simple SGE format. */ union leapraid_mpi_scsi_io_cdb_union { u8 cdb32[32]; @@ -1183,32 +1181,32 @@ union leapraid_mpi_scsi_io_cdb_union { /** * struct leapraid_mpi_scsiio_req - MPI SCSI I/O request * - * @dev_hdl: Device handle for the target - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flags - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0..3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle for the target. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flags. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0..3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_mpi_scsiio_req { __le16 dev_hdl; @@ -1245,8 +1243,8 @@ struct leapraid_mpi_scsiio_req { /** * union leapraid_scsi_io_cdb_union - SCSI I/O CDB or IEEE simple SGE * - * @cdb32: 32-byte SCSI CDB - * @sge: IEEE simple 64-bit SGE + * @cdb32: 32-byte SCSI CDB. + * @sge: IEEE simple 64-bit SGE. */ union leapraid_scsi_io_cdb_union { u8 cdb32[32]; @@ -1256,32 +1254,32 @@ union leapraid_scsi_io_cdb_union { /** * struct leapraid_scsiio_req - SCSI I/O request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flag - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0-3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flag. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0-3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_scsiio_req { __le16 dev_hdl; @@ -1318,23 +1316,23 @@ struct leapraid_scsiio_req { /** * struct leapraid_scsiio_rep - SCSI I/O response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @scsi_status: SCSI status - * @scsi_state: SCSI state - * @adapter_status: Adapter status - * @r3: Reserved - * @transfer_count: Number of bytes transferred - * @sense_count: Number of sense bytes - * @resp_info: Additional response info - * @task_tag: Task identifier - * @scsi_status_qualifier: SCSI status qualifier - * @bi_dir_trans_count: Bi-directional transfer count - * @r4: Reserved + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @scsi_status: SCSI status. + * @scsi_state: SCSI state. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @transfer_count: Number of bytes transferred. + * @sense_count: Number of sense bytes. + * @resp_info: Additional response info. + * @task_tag: Task identifier. + * @scsi_status_qualifier: SCSI status qualifier. + * @bi_dir_trans_count: Bi-directional transfer count. + * @r4: Reserved. */ struct leapraid_scsiio_rep { __le16 dev_hdl; @@ -1359,18 +1357,18 @@ struct leapraid_scsiio_rep { /** * struct leapraid_scsi_tm_req - SCSI Task Management request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @task_type: Task management function type - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @lun: Logical Unit Number - * @r4: Reserved - * @task_mid: Task identifier - * @r5: Reserved + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @task_type: Task management function type. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @lun: Logical Unit Number. + * @r4: Reserved. + * @task_mid: Task identifier. + * @r5: Reserved. */ struct leapraid_scsi_tm_req { __le16 dev_hdl; @@ -1390,18 +1388,18 @@ struct leapraid_scsi_tm_req { /** * struct leapraid_scsi_tm_rep - SCSI Task Management response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @resp_code: Response code - * @task_type: Task management type - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @termination_count: Count of terminated tasks - * @response_info: Additional response info + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @resp_code: Response code. + * @task_type: Task management type. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @termination_count: Count of terminated tasks. + * @response_info: Additional response info. */ struct leapraid_scsi_tm_rep { __le16 dev_hdl; @@ -1421,18 +1419,18 @@ struct leapraid_scsi_tm_rep { /** * struct leapraid_sep_req - SEP (SCSI Enclosure Processor) request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @act: Action to perform - * @flg: Flags - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @act: Action to perform. + * @flg: Flags. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_req { __le16 dev_hdl; @@ -1452,19 +1450,19 @@ struct leapraid_sep_req { /** * struct leapraid_sep_rep - SEP response * - * @dev_hdl: Device handle - * @msg_len: Message length - * @func: Function code - * @act: Action performed - * @flg: Flags - * @msg_flag: Message flags - * @r1: Reserved - * @adapter_status: Adapter status - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @msg_len: Message length. + * @func: Function code. + * @act: Action performed. + * @flg: Flags. + * @msg_flag: Message flags. + * @r1: Reserved. + * @adapter_status: Adapter status. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_rep { __le16 dev_hdl; @@ -1486,29 +1484,29 @@ struct leapraid_sep_rep { /** * struct leapraid_adapter_init_req - Adapter initialization request * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @chain_offset: Chain offset - * @func: Function code - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @msg_ver: Message version - * @header_ver: Header version - * @host_buf_addr: Host buffer address (non adapter-ref) - * @r4: Reserved - * @host_buf_size: Host buffer size (non adapter-ref) - * @host_msix_vectors: Number of host MSI-X vectors - * @r6: Reserved - * @req_frame_size: Request frame size - * @rep_desc_qd: Reply descriptor queue depth - * @rep_msg_qd: Reply message queue depth - * @sense_buffer_add_high: High 32-bit of sense buffer address - * @rep_msg_dma_high: High 32-bit of reply message DMA address - * @task_desc_base_addr: Base address of task descriptors - * @rep_desc_q_arr_addr: Address of reply descriptor queue array - * @rep_msg_addr_dma: Reply message DMA address - * @time_stamp: Timestamp + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @chain_offset: Chain offset. + * @func: Function code. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @msg_ver: Message version. + * @header_ver: Header version. + * @host_buf_addr: Host buffer address (non adapter-ref). + * @r4: Reserved. + * @host_buf_size: Host buffer size (non adapter-ref). + * @host_msix_vectors: Number of host MSI-X vectors. + * @r6: Reserved. + * @req_frame_size: Request frame size. + * @rep_desc_qd: Reply descriptor queue depth. + * @rep_msg_qd: Reply message queue depth. + * @sense_buffer_add_high: High 32-bit of sense buffer address. + * @rep_msg_dma_high: High 32-bit of reply message DMA address. + * @task_desc_base_addr: Base address of task descriptors. + * @rep_desc_q_arr_addr: Address of reply descriptor queue array. + * @rep_msg_addr_dma: Reply message DMA address. + * @time_stamp: Timestamp. */ struct leapraid_adapter_init_req { u8 who_init; @@ -1539,8 +1537,8 @@ struct leapraid_adapter_init_req { /** * struct leapraid_rep_desc_q_arr - Reply descriptor queue array * - * @rep_desc_base_addr: Base address of the reply descriptors - * @r1: Reserved + * @rep_desc_base_addr: Base address of the reply descriptors. + * @r1: Reserved. */ struct leapraid_rep_desc_q_arr { __le64 rep_desc_base_addr; @@ -1550,15 +1548,15 @@ struct leapraid_rep_desc_q_arr { /** * struct leapraid_adapter_init_rep - Adapter initialization reply * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @msg_len: Length of reply message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @msg_len: Length of reply message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_adapter_init_rep { u8 who_init; @@ -1575,15 +1573,15 @@ struct leapraid_adapter_init_rep { /** * struct leapraid_adapter_log_req - Adapter log request * - * @action: Action code - * @type: Log type - * @chain_offset: Offset for chained SGE - * @func: Function code - * r1: Reserved - * @msg_flag: Message flags - * r2: Reserved - * @mbox: Mailbox for command-specific parameters - * @sge: Scatter-gather entry for data buffer + * @action: Action code. + * @type: Log type. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * r1: Reserved. + * @msg_flag: Message flags. + * r2: Reserved. + * @mbox: Mailbox for command-specific parameters. + * @sge: Scatter-gather entry for data buffer. */ struct leapraid_adapter_log_req { u8 action; @@ -1604,14 +1602,14 @@ struct leapraid_adapter_log_req { /** * struct leapraid_adapter_log_rep - Adapter log reply * - * @action: Action code echoed - * @type: Log type echoed - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Status returned by adapter + * @action: Action code echoed. + * @type: Log type echoed. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Status returned by adapter. */ struct leapraid_adapter_log_rep { u8 action; @@ -1627,12 +1625,12 @@ struct leapraid_adapter_log_rep { /** * struct leapraid_adapter_features_req - Request adapter features * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_adapter_features_req { u8 r1[2]; @@ -1646,32 +1644,32 @@ struct leapraid_adapter_features_req { /** * struct leapraid_adapter_features_rep - Adapter features reply * - * @msg_ver: Message version - * @msg_len: Length of reply message - * @func: Function code - * @header_ver: Header version - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @who_init: Who initialized the adapter - * @r4: Reserved - * @max_msix_vectors: Max MSI-X vectors supported - * @req_slot: Number of request slots - * @r5: Reserved - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version - * @sas_wide_max_qdepth: Max wide SAS queue depth - * @sas_narrow_max_qdepth: Max narrow SAS queue depth - * @r6: Reserved - * @hp_slot: Number of high-priority slots - * @r7: Reserved - * @max_volumes: Maximum supported volumes - * @max_dev_hdl: Maximum device handle - * @r8: Reserved - * @min_dev_hdl: Minimum device handle - * @r9: Reserved + * @msg_ver: Message version. + * @msg_len: Length of reply message. + * @func: Function code. + * @header_ver: Header version. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @who_init: Who initialized the adapter. + * @r4: Reserved. + * @max_msix_vectors: Max MSI-X vectors supported. + * @req_slot: Number of request slots. + * @r5: Reserved. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version. + * @sas_wide_max_qdepth: Max wide SAS queue depth. + * @sas_narrow_max_qdepth: Max narrow SAS queue depth. + * @r6: Reserved. + * @hp_slot: Number of high-priority slots. + * @r7: Reserved. + * @max_volumes: Maximum supported volumes. + * @max_dev_hdl: Maximum device handle. + * @r8: Reserved. + * @min_dev_hdl: Minimum device handle. + * @r9: Reserved. */ struct leapraid_adapter_features_rep { u16 msg_ver; @@ -1706,12 +1704,12 @@ struct leapraid_adapter_features_rep { /** * struct leapraid_scan_dev_req - Request to scan devices * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_scan_dev_req { u8 r1[2]; @@ -1725,14 +1723,14 @@ struct leapraid_scan_dev_req { /** * struct leapraid_scan_dev_rep - Scan devices reply * - * @r1: Reserved - * @msg_len: Length of message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @r1: Reserved. + * @msg_len: Length of message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_scan_dev_rep { u8 r1[2]; @@ -1748,14 +1746,14 @@ struct leapraid_scan_dev_rep { /** * struct leapraid_evt_notify_req - Event notification request * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @evt_masks: Event masks to enable notifications - * @r4: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @evt_masks: Event masks to enable notifications. + * @r4: Reserved. */ struct leapraid_evt_notify_req { u8 r1[2]; @@ -1771,18 +1769,18 @@ struct leapraid_evt_notify_req { /** * struct leapraid_evt_notify_rep - Event notification reply * - * @evt_data_len: Length of event data - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved - * @evt: Event code - * @r5: Reserved - * @evt_data: Event data array + * @evt_data_len: Length of event data. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. + * @evt: Event code. + * @r5: Reserved. + * @evt_data: Event data array. */ struct leapraid_evt_notify_rep { __le16 evt_data_len; @@ -1802,14 +1800,14 @@ struct leapraid_evt_notify_rep { /** * struct leapraid_evt_data_sas_dev_status_change - SAS device status change * - * @task_tag: Task identifier - * @reason_code: Reason for status change - * @physical_port: Physical port number - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @sas_address: SAS address of device - * @lun: Logical Unit Number + * @task_tag: Task identifier. + * @reason_code: Reason for status change. + * @physical_port: Physical port number. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @sas_address: SAS address of device. + * @lun: Logical unit Number. */ struct leapraid_evt_data_sas_dev_status_change { __le16 task_tag; @@ -1824,11 +1822,11 @@ struct leapraid_evt_data_sas_dev_status_change { /** * struct leapraid_evt_data_ir_change - IR (Integrated RAID) change event data * - * @r1: Reserved - * @reason_code: Reason for IR change - * @r2: Reserved - * @vol_dev_hdl: Volume device handle - * @phys_disk_dev_hdl: Physical disk device handle + * @r1: Reserved. + * @reason_code: Reason for IR change. + * @r2: Reserved. + * @vol_dev_hdl: Volume device handle. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_evt_data_ir_change { u8 r1; @@ -1841,10 +1839,10 @@ struct leapraid_evt_data_ir_change { /** * struct leapraid_evt_data_sas_disc - SAS discovery event data * - * @r1: Reserved - * @reason_code: Reason for discovery event - * @physical_port: Physical port number where event occurred - * @r2: Reserved + * @r1: Reserved. + * @reason_code: Reason for discovery event. + * @physical_port: Physical port number where event occurred. + * @r2: Reserved. */ struct leapraid_evt_data_sas_disc { u8 r1; @@ -1856,9 +1854,9 @@ struct leapraid_evt_data_sas_disc { /** * struct leapraid_evt_sas_topo_phy_entry - SAS topology PHY entry * - * @attached_dev_hdl: Device handle attached to PHY - * @link_rate: Current link rate - * @phy_status: PHY status flags + * @attached_dev_hdl: Device handle attached to PHY. + * @link_rate: Current link rate. + * @phy_status: PHY status flags. */ struct leapraid_evt_sas_topo_phy_entry { __le16 attached_dev_hdl; @@ -1869,15 +1867,15 @@ struct leapraid_evt_sas_topo_phy_entry { /** * struct leapraid_evt_data_sas_topo_change_list - SAS topology change list * - * @encl_hdl: Enclosure handle - * @exp_dev_hdl: Expander device handle - * @num_phys: Number of PHYs in this entry - * @r1: Reserved - * @entry_num: Entry index - * @start_phy_num: Start PHY number - * @exp_status: Expander status - * @physical_port: Physical port number - * @phy: Array of SAS PHY entries + * @encl_hdl: Enclosure handle. + * @exp_dev_hdl: Expander device handle. + * @num_phys: Number of PHYs in this entry. + * @r1: Reserved. + * @entry_num: Entry index. + * @start_phy_num: Start PHY number. + * @exp_status: Expander status. + * @physical_port: Physical port number. + * @phy: Array of SAS PHY entries. */ struct leapraid_evt_data_sas_topo_change_list { __le16 encl_hdl; @@ -1892,15 +1890,16 @@ struct leapraid_evt_data_sas_topo_change_list { }; /** - * struct leapraid_evt_data_sas_enc_dev_status_change - SAS enclosure device status + * struct leapraid_evt_data_sas_enc_dev_status_change - + * SAS enclosure device status * - * @enc_hdl: Enclosure handle - * @reason_code: Reason code for status change - * @physical_port: Physical port number - * @encl_logical_id: Enclosure logical ID - * @num_slots: Number of slots in enclosure - * @start_slot: First affected slot - * @phy_bits: Bitmap of affected PHYs + * @enc_hdl: Enclosure handle. + * @reason_code: Reason code for status change. + * @physical_port: Physical port number. + * @encl_logical_id: Enclosure logical ID. + * @num_slots: Number of slots in enclosure. + * @start_slot: First affected slot. + * @phy_bits: Bitmap of affected PHYs. */ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 enc_hdl; @@ -1913,21 +1912,21 @@ struct leapraid_evt_data_sas_enc_dev_status_change { }; /** - * struct leapraid_io_unit_ctrl_req - IO unit control request + * struct leapraid_io_unit_ctrl_req - I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @chain_offset: SGE chain offset - * @func: Function code - * @dev_hdl: Device handle - * @adapter_para: Adapter parameter selector - * @msg_flag: Message flags - * @r2: Reserved - * @phy_num: PHY number - * @r3: Reserved - * @adapter_para_value: Value for adapter parameter - * @adapter_para_value2: Optional second parameter value - * @r4: Reserved + * @op: Operation code. + * @r1: Reserved. + * @chain_offset: SGE chain offset. + * @func: Function code. + * @dev_hdl: Device handle. + * @adapter_para: Adapter parameter selector. + * @msg_flag: Message flags. + * @r2: Reserved. + * @phy_num: PHY number. + * @r3: Reserved. + * @adapter_para_value: Value for adapter parameter. + * @adapter_para_value2: Optional second parameter value. + * @r4: Reserved. */ struct leapraid_io_unit_ctrl_req { u8 op; @@ -1946,13 +1945,13 @@ struct leapraid_io_unit_ctrl_req { }; /** - * struct leapraid_io_unit_ctrl_rep - IO unit control reply + * struct leapraid_io_unit_ctrl_rep - I/O unit control reply * - * @op: Operation code echoed - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code echoed. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_io_unit_ctrl_rep { u8 op; @@ -1965,13 +1964,13 @@ struct leapraid_io_unit_ctrl_rep { /** * struct leapraid_raid_act_req - RAID action request * - * @act: RAID action code - * @r1: Reserved - * @func: Function code - * @r2: Reserved - * @phys_disk_num: Number of physical disks involved - * @r3: Reserved - * @action_data_sge: SGE describing action-specific data + * @act: RAID action code. + * @r1: Reserved. + * @func: Function code. + * @r2: Reserved. + * @phys_disk_num: Number of physical disks involved. + * @r3: Reserved. + * @action_data_sge: SGE describing action-specific data. */ struct leapraid_raid_act_req { u8 act; @@ -1986,13 +1985,13 @@ struct leapraid_raid_act_req { /** * struct leapraid_raid_act_rep - RAID action reply * - * @act: RAID action code echoed - * @r1: Reserved - * @func: Function code - * @vol_dev_hdl: Volume device handle + * @act: RAID action code echoed. + * @r1: Reserved. + * @func: Function code. + * @vol_dev_hdl: Volume device handle. * @r2: Reserved - * @adapter_status: Status returned by adapter - * @r3: Reserved + * @adapter_status: Status returned by adapter. + * @r3: Reserved. */ struct leapraid_raid_act_rep { u8 act; @@ -2007,15 +2006,15 @@ struct leapraid_raid_act_rep { /** * struct leapraid_smp_passthrough_req - SMP passthrough request * - * @passthrough_flg: Passthrough flags - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @req_data_len: Request data length - * @r2: Reserved - * @sas_address: SAS address of target device - * @r3: Reserved - * @sgl: Scatter-gather list describing request buffer + * @passthrough_flg: Passthrough flags. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @req_data_len: Request data length. + * @r2: Reserved. + * @sas_address: SAS address of target device. + * @r3: Reserved. + * @sgl: Scatter-gather list describing request buffer. */ struct leapraid_smp_passthrough_req { u8 passthrough_flg; @@ -2032,14 +2031,14 @@ struct leapraid_smp_passthrough_req { /** * struct leapraid_smp_passthrough_rep - SMP passthrough reply * - * @passthrough_flg: Passthrough flags echoed - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @resp_data_len: Length of response data - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved + * @passthrough_flg: Passthrough flags echoed. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @resp_data_len: Length of response data. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. */ struct leapraid_smp_passthrough_rep { u8 passthrough_flg; @@ -2053,13 +2052,13 @@ struct leapraid_smp_passthrough_rep { }; /** - * struct leapraid_sas_io_unit_ctrl_req - SAS IO unit control request + * struct leapraid_sas_io_unit_ctrl_req - SAS I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_sas_io_unit_ctrl_req { u8 op; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index f838bd5aa20e..25ec57c2ce4b 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -1,23 +1,22 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/compat.h> #include <linux/module.h> #include <linux/miscdevice.h> #include "leapraid_func.h" -/* ioctl device file */ +/* IOCTL device file name. */ #define LEAPRAID_DEV_NAME "leapraid_ctl" -/* ioctl version */ +/* IOCTL version. */ #define LEAPRAID_IOCTL_VERSION 0x07 -/* ioctl command */ +/* IOCTL commands. */ #define LEAPRAID_ADAPTER_INFO 17 #define LEAPRAID_COMMAND 20 #define LEAPRAID_EVENTQUERY 21 @@ -25,9 +24,10 @@ /** * struct leapraid_ioctl_header - IOCTL command header - * @adapter_id : Adapter identifier - * @port_number: Port identifier - * @max_data_size: Maximum data size for transfer + * + * @adapter_id : Adapter identifier. + * @port_number: Port identifier. + * @max_data_size: Maximum data size for transfer. */ struct leapraid_ioctl_header { u32 adapter_id; @@ -37,7 +37,8 @@ struct leapraid_ioctl_header { /** * struct leapraid_ioctl_diag_reset - Diagnostic reset request - * @hdr: Common IOCTL header + * + * @hdr: Common IOCTL header. */ struct leapraid_ioctl_diag_reset { struct leapraid_ioctl_header hdr; @@ -45,12 +46,13 @@ struct leapraid_ioctl_diag_reset { /** * struct leapraid_ioctl_pci_info - PCI device information - * @u: Union holding PCI bus/device/function information - * @u.bits.dev: PCI device number - * @u.bits.func: PCI function number - * @u.bits.bus: PCI bus number - * @u.word: Combined representation of PCI BDF - * @seg_id: PCI segment identifier + * + * @u: Union holding PCI bus/device/function information. + * @u.bits.dev: PCI device number. + * @u.bits.func: PCI function number. + * @u.bits.bus: PCI bus number. + * @u.word: Combined representation of PCI BDF. + * @seg_id: PCI segment identifier. */ struct leapraid_ioctl_pci_info { union { @@ -66,21 +68,22 @@ struct leapraid_ioctl_pci_info { /** * struct leapraid_ioctl_adapter_info - Adapter information for IOCTL - * @hdr: IOCTL header - * @adapter_type: Adapter type identifier - * @port_number: Port number - * @pci_id: PCI device ID - * @revision: Revision number - * @sub_dev: Subsystem device ID - * @sub_vendor: Subsystem vendor ID - * @r0: Reserved - * @fw_ver: Firmware version - * @bios_ver: BIOS version - * @driver_ver: Driver version - * @r1: Reserved - * @scsi_id: SCSI ID - * @r2: Reserved - * @pci_info: PCI information structure + * + * @hdr: IOCTL header. + * @adapter_type: Adapter type identifier. + * @port_number: Port number. + * @pci_id: PCI device ID. + * @revision: Revision number. + * @sub_dev: Subsystem device ID. + * @sub_vendor: Subsystem vendor ID. + * @r0: Reserved. + * @fw_ver: Firmware version. + * @bios_ver: BIOS version. + * @driver_ver: Driver version. + * @r1: Reserved. + * @scsi_id: SCSI ID. + * @r2: Reserved. + * @pci_info: PCI information structure. */ struct leapraid_ioctl_adapter_info { struct leapraid_ioctl_header hdr; @@ -102,18 +105,19 @@ struct leapraid_ioctl_adapter_info { /** * struct leapraid_ioctl_command - IOCTL command structure - * @hdr: IOCTL header - * @timeout: Command timeout - * @rep_msg_buf_ptr: User pointer to reply message buffer - * @c2h_buf_ptr: User pointer to card-to-host data buffer - * @h2c_buf_ptr: User pointer to host-to-card data buffer - * @sense_data_ptr: User pointer to sense data buffer - * @max_rep_bytes: Maximum reply bytes - * @c2h_size: Card-to-host data size - * @h2c_size: Host-to-card data size - * @max_sense_bytes: Maximum sense data bytes - * @data_sge_offset: Data SGE offset - * @mf: Message frame data (flexible array) + * + * @hdr: IOCTL header. + * @timeout: Command timeout. + * @rep_msg_buf_ptr: User pointer to reply message buffer. + * @c2h_buf_ptr: User pointer to card-to-host data buffer. + * @h2c_buf_ptr: User pointer to host-to-card data buffer. + * @sense_data_ptr: User pointer to sense data buffer. + * @max_rep_bytes: Maximum reply bytes. + * @c2h_size: Card-to-host data size. + * @h2c_size: Host-to-card data size. + * @max_sense_bytes: Maximum sense data bytes. + * @data_sge_offset: Data SGE offset. + * @mf: Message frame data (flexible array). */ struct leapraid_ioctl_command { struct leapraid_ioctl_header hdr; @@ -146,39 +150,38 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } -static void leapraid_cli_scsiio_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, u16 taskid, +static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_mpi_req, + u16 taskid, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, u16 dev_hdl, void *psge) { - struct leapraid_mpi_scsiio_req *scsiio_request = - (struct leapraid_mpi_scsiio_req *)ctl_sp_mpi_req; + struct leapraid_mpi_scsiio_req *scsiio_request = ctl_sp_mpi_req; scsiio_request->sense_buffer_len = SCSI_SENSE_BUFFERSIZE; scsiio_request->sense_buffer_low_add = - leapraid_get_sense_buffer_dma(adapter, taskid); - memset((void *)(&adapter->driver_cmds.ctl_cmd.sense), + leapraid_get_sense_buffer_dma(adapter, taskid); + memset(&adapter->driver_cmds.ctl_cmd.sense, 0, SCSI_SENSE_BUFFERSIZE); leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); - if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO_REQ) + if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO) leapraid_fire_scsi_io(adapter, taskid, dev_hdl); else leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - u16 taskid, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, void *h2c) +static int leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, + u16 taskid, + dma_addr_t h2c_dma_addr, + size_t h2c_size, + dma_addr_t c2h_dma_addr, + size_t c2h_size, + void *psge, void *h2c) { - struct leapraid_smp_passthrough_req *smp_pt_req = - (struct leapraid_smp_passthrough_req *)ctl_sp_mpi_req; + struct leapraid_smp_passthrough_req *smp_pt_req = ctl_sp_req; u8 *data; if (!adapter->adapter_attr.enable_mp) @@ -188,83 +191,49 @@ static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, else data = h2c; - if (data[1] == LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG && - (data[10] == 1 || data[10] == 2)) - adapter->reset_desc.adapter_link_resetting = true; + if (!(smp_pt_req->passthrough_flg & LEAPRAID_SMP_PT_FLAG_SGL_PTR) && + h2c_size <= 10) { + dev_err(&adapter->pdev->dev, + "%s: Invalid request size=%zu\n", + __func__, h2c_size); + return -EINVAL; + } + + if (data[1] == SMP_PHY_CONTROL && + (data[10] == SMP_PHY_CONTROL_LINK_RESET || + data[10] == SMP_PHY_CONTROL_HARD_RESET)) + adapter->reset_desc.adapter_link_resetting = 1; + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); + return 0; } -static void leapraid_ctl_fire_ieee_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size); - leapraid_fire_task(adapter, taskid); -} - -static void leapraid_ctl_sata_passthrough_cmd(struct leapraid_adapter *adapter, +static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, void *psge, u16 taskid) { - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static void leapraid_ctl_load_fw_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} + struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctl_req = ctl_sp_req; -static void leapraid_ctl_fire_mpi_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ + if (sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || + sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) + adapter->reset_desc.adapter_link_resetting = 1; leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) +static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, + struct leapraid_ioctl_command *karg, + void __user *mf) { - struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctrl_req = - (struct leapraid_sas_io_unit_ctrl_req *)ctl_sp_mpi_req; - - if (sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || - sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) - adapter->reset_desc.adapter_link_resetting = true; - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, - struct leapraid_ioctl_command *karg, - void __user *mf) -{ - struct leapraid_req *leap_mpi_req = NULL; - struct leapraid_req *ctl_sp_mpi_req = NULL; + struct leapraid_req *leap_mpi_req; + struct leapraid_req *ctl_sp_mpi_req; u16 taskid; void *h2c = NULL; size_t h2c_size = 0; @@ -277,74 +246,88 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; u32 sz; - long rc = 0; + int rc; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + return rc; leap_mpi_req = kzalloc(LEAPRAID_REQUEST_SIZE, GFP_KERNEL); - if (!leap_mpi_req) { - rc = -ENOMEM; - goto out; - } + if (!leap_mpi_req) + return -ENOMEM; - if (karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > LEAPRAID_REQUEST_SIZE || - karg->data_sge_offset > ((UINT_MAX) / LEAPRAID_SGE_OFFSET_SIZE)) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || + karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > + LEAPRAID_REQUEST_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); rc = -EINVAL; - goto out; + goto out_cleanup; } if (copy_from_user(leap_mpi_req, mf, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy request message from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset((void *)(&adapter->driver_cmds.ctl_cmd.reply), 0, - LEAPRAID_REPLY_SIEZ); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, + LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); memcpy(ctl_sp_mpi_req, leap_mpi_req, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); - if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_hdl = le16_to_cpu(ctl_sp_mpi_req->func_dep1); - if (!dev_hdl || dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + if (!dev_hdl || + dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_err(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } } - if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) - return -EINVAL; + if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) { + rc = -EINVAL; + goto out_cleanup; + } h2c_size = karg->h2c_size; c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, - &h2c_dma_addr, GFP_ATOMIC); + &h2c_dma_addr, GFP_KERNEL); if (!h2c) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (copy_from_user(h2c, karg->h2c_buf_ptr, h2c_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy h2c from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } } if (c2h_size) { - c2h = dma_alloc_coherent(&adapter->pdev->dev, - c2h_size, &c2h_dma_addr, GFP_ATOMIC); + c2h = dma_alloc_coherent(&adapter->pdev->dev, c2h_size, + &c2h_dma_addr, GFP_KERNEL); if (!c2h) { rc = -ENOMEM; - goto out; + goto out_cleanup; } } @@ -353,13 +336,9 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { - case LEAPRAID_FUNC_SCSIIO_REQ: - case LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_cli_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + leapraid_ctl_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size, dev_hdl, psge); @@ -367,28 +346,26 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, case LEAPRAID_FUNC_SMP_PASSTHROUGH: if (!h2c) { rc = -EINVAL; - goto out; + goto out_cleanup; } - leapraid_ctl_smp_passthrough_cmd(adapter, - ctl_sp_mpi_req, taskid, - h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size, - psge, h2c); + rc = leapraid_ctl_smp_passthrough_cmd(adapter, + ctl_sp_mpi_req, taskid, + h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size, + psge, h2c); + if (rc) + goto out_cleanup; break; - case LEAPRAID_FUNC_SATA_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_ctl_sata_passthrough_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_FW_DOWNLOAD: case LEAPRAID_FUNC_FW_UPLOAD: - leapraid_ctl_load_fw_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: leapraid_ctl_sas_io_unit_ctrl_cmd(adapter, ctl_sp_mpi_req, @@ -397,23 +374,27 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, psge, taskid); break; default: - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, + h2c_size, c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; } timeout = karg->timeout; if (timeout < LEAPRAID_CTL_CMD_TIMEOUT) timeout = LEAPRAID_CTL_CMD_TIMEOUT; - wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, - timeout * HZ); + if (!wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, + timeout * HZ)) { + dev_err(&adapter->pdev->dev, + "%s: ctl_cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.ctl_cmd.status); + } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || leap_mpi_req->func == LEAPRAID_FUNC_SAS_IO_UNIT_CTRL) && - adapter->reset_desc.adapter_link_resetting) { - adapter->reset_desc.adapter_link_resetting = false; - } + adapter->reset_desc.adapter_link_resetting) + adapter->reset_desc.adapter_link_resetting = 0; + if (!(adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE)) { issue_reset = leapraid_check_reset( @@ -421,57 +402,66 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto reset; } - if (c2h_size) { - if (copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { - rc = -ENODATA; - goto out; - } + if (c2h_size && copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy c2h to user\n", __func__); + rc = -ENODATA; + goto out_cleanup; } if (karg->max_rep_bytes) { - sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIEZ); + sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIZE); if (copy_to_user(karg->rep_msg_buf_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.reply, + &adapter->driver_cmds.ctl_cmd.reply, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy reply to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } if (karg->max_sense_bytes && - (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH)) { + (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH)) { if (!karg->sense_data_ptr) - goto out; + goto out_cleanup; sz = min_t(u32, karg->max_sense_bytes, SCSI_SENSE_BUFFERSIZE); if (copy_to_user(karg->sense_data_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.sense, + &adapter->driver_cmds.ctl_cmd.sense, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy sense data to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } reset: if (issue_reset) { rc = -ENODATA; - if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - leap_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_err(&adapter->pdev->dev, - "fire tgt reset: hdl=0x%04x\n", + "Fire tgt reset, hdl=0x%04x\n", le16_to_cpu(leap_mpi_req->func_dep1)); - leapraid_issue_locked_tm(adapter, + leapraid_issue_locked_tm( + adapter, le16_to_cpu(leap_mpi_req->func_dep1), 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } else { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } } -out: +out_cleanup: if (c2h) dma_free_coherent(&adapter->pdev->dev, c2h_size, c2h, c2h_dma_addr); @@ -483,12 +473,12 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, return rc; } -static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, - void __user *arg) +static int leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, + void __user *arg) { struct leapraid_ioctl_adapter_info *karg; - ssize_t __maybe_unused ret; u8 revision; + int rc = 0; karg = kzalloc(sizeof(*karg), GFP_KERNEL); if (!karg) @@ -504,80 +494,98 @@ static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, karg->pci_info.u.bits.func = PCI_FUNC(adapter->pdev->devfn); karg->pci_info.seg_id = pci_domain_nr(adapter->pdev->bus); karg->fw_ver = adapter->adapter_attr.features.fw_version; - ret = strscpy(karg->driver_ver, LEAPRAID_DRIVER_NAME, - sizeof(karg->driver_ver)); - strcat(karg->driver_ver, "-"); - strcat(karg->driver_ver, LEAPRAID_DRIVER_VERSION); + + snprintf(karg->driver_ver, sizeof(karg->driver_ver), "%s-%s", + LEAPRAID_DRIVER_NAME, LEAPRAID_DRIVER_VERSION); + karg->adapter_type = LEAPRAID_IOCTL_VERSION; karg->bios_ver = adapter->adapter_attr.bios_version; if (copy_to_user(arg, karg, sizeof(struct leapraid_ioctl_adapter_info))) { - kfree(karg); - return -EFAULT; + dev_err(&adapter->pdev->dev, + "%s: Failed to copy info to user\n", __func__); + rc = -EFAULT; + goto free_buf; } +free_buf: kfree(karg); - return 0; + return rc; } -static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, - void __user *arg, u8 compat) +static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, + void __user *arg) { struct leapraid_ioctl_header ioctl_header; struct leapraid_adapter *adapter; - long rc = -ENOIOCTLCMD; - int count; - - if (copy_from_user(&ioctl_header, (char __user *)arg, - sizeof(struct leapraid_ioctl_header))) + struct leapraid_ioctl_command __user *uarg; + struct leapraid_ioctl_command karg; + int rc = -ENOIOCTLCMD; + + if (copy_from_user(&ioctl_header, arg, + sizeof(struct leapraid_ioctl_header))) { + pr_err("%s:%s: Failed to copy header from user\n", + LEAPRAID_DRIVER_NAME, __func__); return -EFAULT; + } adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); if (!adapter) return -EFAULT; + if (atomic_read(&adapter->overheat_desc.thermal_alert)) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, thermal_alert=%d\n", + __func__, + atomic_read(&adapter->overheat_desc.thermal_alert)); + return -EFAULT; + } + mutex_lock(&adapter->access_ctrl.pci_access_lock); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_LONG, + __func__); if (rc) - goto out; + goto unlock; - count = LEAPRAID_WAIT_SHOST_RECOVERY; - while (count--) { - if (!adapter->access_ctrl.shost_recovering) - break; - ssleep(1); + if (!wait_event_timeout(adapter->access_ctrl.shost_recover_wq, + !adapter->access_ctrl.shost_recover_async, + LEAPRAID_WAIT_SHOST_RECOVERY * HZ)) { + dev_warn(&adapter->pdev->dev, + "Timeout waiting for shost recovery async\n"); + rc = -EAGAIN; + goto unlock; } - if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || + if (adapter->access_ctrl.pcie_recovering || adapter->scan_dev_desc.driver_loading || adapter->access_ctrl.host_removing) { rc = -EAGAIN; - goto out; + goto unlock; } if (file->f_flags & O_NONBLOCK) { if (!mutex_trylock(&adapter->driver_cmds.ctl_cmd.mutex)) { rc = -EAGAIN; - goto out; + goto unlock; } - } else if (mutex_lock_interruptible(&adapter->driver_cmds.ctl_cmd.mutex)) { + } else if (mutex_lock_interruptible(&adapter->driver_cmds + .ctl_cmd.mutex)) { rc = -ERESTARTSYS; - goto out; + goto unlock; } switch (_IOC_NR(cmd)) { case LEAPRAID_ADAPTER_INFO: - if (_IOC_SIZE(cmd) == sizeof(struct leapraid_ioctl_adapter_info)) + if (_IOC_SIZE(cmd) == + sizeof(struct leapraid_ioctl_adapter_info)) rc = leapraid_ctl_get_adapter_info(adapter, arg); break; case LEAPRAID_COMMAND: - { - struct leapraid_ioctl_command __user *uarg; - struct leapraid_ioctl_command karg; - if (copy_from_user(&karg, arg, sizeof(karg))) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy data from user\n", + __func__); rc = -EFAULT; break; } @@ -591,61 +599,77 @@ static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, uarg = arg; rc = leapraid_ctl_do_command(adapter, &karg, &uarg->mf); + if (rc) + dev_warn(&adapter->pdev->dev, + "%s: IOCTL cmd failed rc=%d\n", + __func__, rc); } break; - } case LEAPRAID_EVENTQUERY: case LEAPRAID_EVENTREPORT: rc = 0; break; default: - pr_err("unknown ioctl opcode=0x%08x\n", cmd); + dev_err(&adapter->pdev->dev, + "Unknown IOCTL opcode=0x%08x\n", cmd); break; } mutex_unlock(&adapter->driver_cmds.ctl_cmd.mutex); -out: +unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); return rc; } +static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + return -ENOTTY; +} + static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - return leapraid_ctl_ioctl_main(file, cmd, - (void __user *)arg, 0); + return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { struct leapraid_adapter *adapter; + /* Userspace passes the adapter ID via vma->vm_pgoff. */ + u32 adapter_id = vma->vm_pgoff; unsigned long length; - unsigned long pfn; + int rc; length = vma->vm_end - vma->vm_start; - adapter = list_first_entry(&leapraid_adapter_list, - struct leapraid_adapter, list); + adapter = leapraid_ctl_lookup_adapter(adapter_id); + if (!adapter) { + pr_err("%s: No adapter found!\n", __func__); + return -EINVAL; + } if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, - "requested mapping size is too large!\n"); + "Requested mapping size is too large!\n"); return -EINVAL; } if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, "no log buffer!\n"); + dev_err(&adapter->pdev->dev, "No log buffer!\n"); return -EINVAL; } - pfn = virt_to_phys(adapter->fw_log_desc.fw_log_buffer) >> PAGE_SHIFT; + vma->vm_pgoff = 0; - if (remap_pfn_range(vma, vma->vm_start, pfn, length, - vma->vm_page_prot)) { + rc = dma_mmap_coherent(&adapter->pdev->dev, vma, + adapter->fw_log_desc.fw_log_buffer, + adapter->fw_log_desc.fw_log_buffer_dma, + length); + if (rc) { dev_err(&adapter->pdev->dev, - "failed to map memory to user space!\n"); - return -EAGAIN; + "Failed to map memory to user space!\n"); + return rc; } return 0; @@ -655,6 +679,7 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, + .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { @@ -663,10 +688,14 @@ static struct miscdevice leapraid_ctl_dev = { .fops = &leapraid_ctl_fops, }; -void leapraid_ctl_init(void) +int leapraid_ctl_init(void) { - if (misc_register(&leapraid_ctl_dev) < 0) - pr_err("%s can't register misc device\n", LEAPRAID_DRIVER_NAME); + if (misc_register(&leapraid_ctl_dev) < 0) { + pr_err("%s Can't register misc device\n", + LEAPRAID_DRIVER_NAME); + return -ENODEV; + } + return 0; } void leapraid_ctl_exit(void) diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index ad8aee40e2c1..f2574feb2514 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -22,15 +21,16 @@ MODULE_PARM_DESC(smart_poll, static int interrupt_mode; module_param(interrupt_mode, int, 0444); MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 for MSI-X, 1 for MSI, 2 for legacy. (default=0)"); + "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); static int poll_queues; module_param(poll_queues, int, 0444); MODULE_PARM_DESC(poll_queues, "specifies the number of queues for io_uring poll mode."); -static int max_msix_vectors = -1; + +static int max_msix_vectors = LEAPRAID_INVALID_MSIX_VECTORS; module_param(max_msix_vectors, int, 0444); -MODULE_PARM_DESC(max_msix_vectors, " max msix vectors"); +MODULE_PARM_DESC(max_msix_vectors, "max msix vectors"); static void leapraid_remove_device(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev); @@ -39,11 +39,48 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_address, struct leapraid_card_port *port); +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +{ + struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; + u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + bool changed = false; + int i; + + if (leapraid_should_skip_poll_work(adapter)) + return; + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { + debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); + if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) + changed = true; + } + + if (!changed) + return; + + memcpy(adapter->fw_log_desc.pre_debug_log, + debug_log, + sizeof(debug_log)); + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; + i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) + dev_warn(&adapter->pdev->dev, + "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", + i, + i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, + debug_log[i], + debug_log[i + 1], + debug_log[i + 2], + debug_log[i + 3]); +} static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -57,12 +94,14 @@ bool leapraid_pci_removed(struct leapraid_adapter *adapter) struct pci_dev *pdev = adapter->pdev; u32 vendor_id; - if (pci_bus_read_config_dword(pdev->bus, pdev->devfn, PCI_VENDOR_ID, + if (pci_bus_read_config_dword(pdev->bus, + pdev->devfn, + PCI_VENDOR_ID, &vendor_id)) return true; - return ((vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != - LEAPRAID_VENDOR_ID); + return (vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != + LEAPRAID_VENDOR_ID; } static bool leapraid_pci_active(struct leapraid_adapter *adapter) @@ -82,14 +121,14 @@ void *leapraid_get_reply_vaddr(struct leapraid_adapter *adapter, u32 rep_paddr) void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.task_desc + - (taskid * LEAPRAID_REQUEST_SIZE)); + return adapter->mem_desc.task_desc + + taskid * LEAPRAID_REQUEST_SIZE; } void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.sense_data + - ((taskid - 1) * SCSI_SENSE_BUFFERSIZE)); + return adapter->mem_desc.sense_data + + (taskid - 1) * SCSI_SENSE_BUFFERSIZE; } __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -103,7 +142,7 @@ void leapraid_mask_int(struct leapraid_adapter *adapter) { u32 reg; - adapter->mask_int = true; + adapter->mask_int = 1; reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg |= LEAPRAID_TO_SYS_DB_MASK + LEAPRAID_REPLY_INT_MASK + LEAPRAID_RESET_IRQ_MASK; @@ -118,35 +157,59 @@ void leapraid_unmask_int(struct leapraid_adapter *adapter) reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg &= ~LEAPRAID_REPLY_INT_MASK; writel(reg, &adapter->iomem_base->host_int_mask); - adapter->mask_int = false; + adapter->mask_int = 0; } -static void leapraid_flush_io_and_panic(struct leapraid_adapter *adapter) +static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) { - adapter->access_ctrl.adapter_thermal_alert = true; - leapraid_smart_polling_stop(adapter); - leapraid_fw_log_stop(adapter); - leapraid_mq_polling_pause(adapter); - leapraid_clean_active_scsi_cmds(adapter); + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + + if (!adapter) + return; + + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_warn(&pdev->dev, + "Overheat suspend failed, invalid host or adapter\n"); + return; + } + + wq = adapter->overheat_desc.fault_overheat_wq; + if (!wq) + return; + + if (atomic_cmpxchg(&adapter->overheat_desc.thermal_alert, 0, 1)) + return; + + queue_work(wq, &adapter->overheat_desc.fault_overheat_work); } -static void leapraid_check_panic_needed(struct leapraid_adapter *adapter, - u32 db, u32 adapter_state) +static void leapraid_stop_adapter_on_fault(struct leapraid_adapter *adapter, + u32 db) { - bool fault_1 = adapter_state == LEAPRAID_DB_MASK; - bool fault_2 = (adapter_state == LEAPRAID_DB_FAULT) && - ((db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE); + u32 adapter_state = db & LEAPRAID_DB_MASK; + bool fault_1 = false; + bool fault_2 = false; + + fault_1 = adapter_state == LEAPRAID_DB_MASK; + fault_2 = adapter_state == LEAPRAID_DB_FAULT && + (db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE; if (!fault_1 && !fault_2) return; if (fault_1) - pr_err("%s, doorbell status 0xFFFF!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Doorbell status 0xFFFF!\n", __func__); else - pr_err("%s, adapter overheating detected!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Adapter overheating detected!\n", __func__); - leapraid_flush_io_and_panic(adapter); - panic("%s overheating detected, panic now!!!\n", __func__); + leapraid_overheat_suspend(adapter); } u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) @@ -156,38 +219,40 @@ u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) db = leapraid_readl(&adapter->iomem_base->db); adapter_state = db & LEAPRAID_DB_MASK; - leapraid_check_panic_needed(adapter, db, adapter_state); + leapraid_stop_adapter_on_fault(adapter, db); return adapter_state; } static bool leapraid_wait_adapter_ready(struct leapraid_adapter *adapter) { u32 cur_state; - u32 cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { cur_state = leapraid_get_adapter_state(adapter); + if (cur_state == LEAPRAID_DB_READY) return true; if (cur_state == LEAPRAID_DB_FAULT) break; usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } return false; } static int leapraid_db_wait_int_host(struct leapraid_adapter *adapter) { - u32 cnt = LEAPRAID_DB_WAIT_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_DB_WAIT_MAX_RETRY; cnt > 0; cnt--) { if (leapraid_readl(&adapter->iomem_base->host_int_status) & LEAPRAID_ADAPTER2HOST_DB_STATUS) return 0; + udelay(LEAPRAID_DB_WAIT_DELAY_US); - } while (--cnt); + } return -EFAULT; } @@ -198,25 +263,26 @@ static int leapraid_db_wait_ack_and_clear_int(struct leapraid_adapter *adapter) u32 int_status; u32 cnt; - cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { int_status = leapraid_readl(&adapter->iomem_base->host_int_status); - if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) { + + if (int_status == 0xFFFFFFFF) + return -EFAULT; + + if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) return 0; - } else if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { + + if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state == LEAPRAID_DB_FAULT) return -EFAULT; - } else if (int_status == 0xFFFFFFFF) { - goto out; } usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } -out: return -EFAULT; } @@ -226,8 +292,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, { int failed, i; - if ((leapraid_readl(&adapter->iomem_base->db) & - LEAPRAID_DB_USED)) { + if (leapraid_readl(&adapter->iomem_base->db) & LEAPRAID_DB_USED) { dev_err(&adapter->pdev->dev, "doorbell used\n"); return -EFAULT; } @@ -242,7 +307,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, &adapter->iomem_base->db); if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -250,7 +315,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, writel(0, &adapter->iomem_base->host_int_status); if (leapraid_db_wait_ack_and_clear_int(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -258,12 +323,12 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0, failed = 0; i < req_bytes / LEAPRAID_DWORDS_BYTE_SIZE && !failed; i++) { - writel((u32)(req[i]), &adapter->iomem_base->db); + writel((u32)req[i], &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) failed = 1; } if (failed) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -271,7 +336,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0; i < rep_bytes / LEAPRAID_WORD_BYTE_SIZE; i++) { if (leapraid_db_wait_int_host(adapter)) { dev_err(&adapter->pdev->dev, - "%d:wait db interrupt timeout\n", __LINE__); + "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } rep[i] = (u16)(leapraid_readl(&adapter->iomem_base->db) @@ -280,7 +345,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, } if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -290,28 +355,32 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, return 0; } -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter) +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller) { - int wait_count = LEAPRAID_DB_WAIT_OPERATIONAL; + int wait_count; - do { - if (leapraid_pci_removed(adapter)) + for (wait_count = wait; wait_count > 0; wait_count--) { + if (leapraid_pci_removed(adapter)) { + dev_warn(&adapter->pdev->dev, + "%s: PCI device removed\n", __func__); return -EFAULT; + } if (leapraid_get_adapter_state(adapter) == LEAPRAID_DB_OPERATIONAL) return 0; - dev_info(&adapter->pdev->dev, - "waiting for adapter to become op status(cnt=%d)\n", - LEAPRAID_DB_WAIT_OPERATIONAL - wait_count); + dev_dbg(&adapter->pdev->dev, + "%s: Wait for adapter to become op status(cnt=%d)\n", + caller, wait - wait_count); ssleep(1); - } while (--wait_count); + } dev_err(&adapter->pdev->dev, - "adapter failed to become op state, last state=%d\n", - leapraid_get_adapter_state(adapter)); + "%s: Adapter failed to become op state, last state=%d\n", + caller, leapraid_get_adapter_state(adapter)); return -EFAULT; } @@ -329,7 +398,7 @@ struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (scmd) - return leapraid_get_scmd_priv(scmd); + return scsi_cmd_priv(scmd); return NULL; } @@ -354,7 +423,8 @@ static u8 leapraid_get_cb_idx(struct leapraid_adapter *adapter, u16 taskid) } struct scsi_cmnd *leapraid_get_scmd_from_taskid( - struct leapraid_adapter *adapter, u16 taskid) + struct leapraid_adapter *adapter, + u16 taskid) { struct leapraid_scsiio_req *leap_mpi_req; struct leapraid_io_req_tracker *st; @@ -372,7 +442,7 @@ struct scsi_cmnd *leapraid_get_scmd_from_taskid( scmd = scsi_host_find_tag(adapter->shost, uniq_tag); if (scmd) { - st = leapraid_get_scmd_priv(scmd); + st = scsi_cmd_priv(scmd); if (st && st->taskid == taskid) return scmd; } @@ -393,7 +463,7 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, adapter->mem_desc.taskid_to_uniq_tag[tag] = blk_mq_unique_tag_to_hwq(unique_tag); - request = leapraid_get_scmd_priv(scmd); + request = scsi_cmd_priv(scmd); taskid = tag + 1; request->taskid = taskid; request->scmd = scmd; @@ -410,8 +480,9 @@ static void leapraid_check_pending_io(struct leapraid_adapter *adapter) } } -static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +static void leapraid_clear_io_tracker( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (!io_tracker) return; @@ -425,17 +496,18 @@ static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, u16 taskid) { - return (taskid == adapter->driver_cmds.ctl_cmd.taskid || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid || - taskid == adapter->driver_cmds.tm_cmd.hp_taskid || - taskid == adapter->driver_cmds.ctl_cmd.hp_taskid || - taskid == adapter->driver_cmds.scan_dev_cmd.inter_taskid || - taskid == adapter->driver_cmds.timestamp_sync_cmd.inter_taskid || - taskid == adapter->driver_cmds.raid_action_cmd.inter_taskid || - taskid == adapter->driver_cmds.transport_cmd.inter_taskid || - taskid == adapter->driver_cmds.cfg_op_cmd.inter_taskid || - taskid == adapter->driver_cmds.enc_cmd.inter_taskid || - taskid == adapter->driver_cmds.notify_event_cmd.inter_taskid); + struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; + + return (taskid == driver_cmds->ctl_cmd.taskid || + taskid == driver_cmds->driver_scsiio_cmd.taskid || + taskid == driver_cmds->tm_cmd.hp_taskid || + taskid == driver_cmds->ctl_cmd.hp_taskid || + taskid == driver_cmds->scan_dev_cmd.inter_taskid || + taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || + taskid == driver_cmds->transport_cmd.inter_taskid || + taskid == driver_cmds->cfg_op_cmd.inter_taskid || + taskid == driver_cmds->enc_cmd.inter_taskid || + taskid == driver_cmds->notify_event_cmd.inter_taskid); } void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid) @@ -531,6 +603,7 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) { struct leapraid_io_req_tracker *io_tracker; struct scsi_cmnd *scmd; + void *task_desc; u16 taskid; for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { @@ -538,15 +611,17 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) if (!scmd) continue; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); if (io_tracker && io_tracker->taskid == 0) continue; scsi_dma_unmap(scmd); + task_desc = leapraid_get_task_desc(adapter, taskid); + memset(task_desc, 0, LEAPRAID_REQUEST_SIZE); leapraid_clear_io_tracker(adapter, io_tracker); if (!leapraid_pci_active(adapter) || adapter->reset_desc.adapter_reset_results != 0 || - adapter->access_ctrl.adapter_thermal_alert || + atomic_read(&adapter->overheat_desc.thermal_alert) || adapter->access_ctrl.host_removing) scmd->result = DID_NO_CONNECT << 16; else @@ -555,36 +630,37 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) } } -static void leapraid_clean_active_driver_cmd( - struct leapraid_driver_cmd *driver_cmd) +static void leapraid_clean_active_driver_cmd(struct leapraid_driver_cmd *cmd) { - if (driver_cmd->status & LEAPRAID_CMD_PENDING) { - driver_cmd->status |= LEAPRAID_CMD_RESET; - complete(&driver_cmd->done); + if (cmd->status & LEAPRAID_CMD_PENDING) { + cmd->status |= LEAPRAID_CMD_RESET; + complete(&cmd->done); } } static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) { - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.raid_action_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.driver_scsiio_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.tm_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.transport_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.enc_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.notify_event_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.cfg_op_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.ctl_cmd); - - if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { - adapter->scan_dev_desc.scan_dev_failed = true; - adapter->driver_cmds.scan_dev_cmd.status |= LEAPRAID_CMD_RESET; + struct leapraid_driver_cmds *driver_cmds; + + driver_cmds = &adapter->driver_cmds; + leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->notify_event_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->cfg_op_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->ctl_cmd); + + if (driver_cmds->scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { + adapter->scan_dev_desc.scan_dev_failed = 1; + driver_cmds->scan_dev_cmd.status |= LEAPRAID_CMD_RESET; if (adapter->scan_dev_desc.driver_loading) { adapter->scan_dev_desc.scan_start_failed = LEAPRAID_ADAPTER_STATUS_INTERNAL_ERROR; - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; } else { - complete(&adapter->driver_cmds.scan_dev_cmd.done); + complete(&driver_cmds->scan_dev_cmd.done); } } } @@ -592,10 +668,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) static void leapraid_clean_active_cmds(struct leapraid_adapter *adapter) { leapraid_clean_active_driver_cmds(adapter); - memset(adapter->dev_topo.pending_dev_add, 0, - adapter->dev_topo.pending_dev_add_sz); - memset(adapter->dev_topo.dev_removing, 0, - adapter->dev_topo.dev_removing_sz); leapraid_clean_active_fw_evt(adapter); leapraid_clean_active_scsi_cmds(adapter); } @@ -604,9 +676,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; unsigned long flags = 0; - u32 adapter_state = 0; + u32 adapter_state; if (adapter->access_ctrl.pcie_recovering) return; @@ -615,15 +687,15 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -637,9 +709,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_card_port *port = NULL; - u64 sas_address = 0; + struct leapraid_sas_dev *sas_dev; + struct leapraid_card_port *port; + u64 sas_address; unsigned long flags; u32 adapter_state; @@ -650,15 +722,15 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; sas_address = sas_dev->sas_addr; port = sas_dev->card_port; } @@ -672,26 +744,30 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) leapraid_sdev_put(sas_dev); } -static inline void leapraid_single_mpi_sg_append(struct leapraid_adapter *adapter, - void *sge, u32 flag_and_len, - dma_addr_t dma_addr) +static inline void leapraid_single_mpi_sg_append( + struct leapraid_adapter *adapter, + void *sge, + u32 flag_and_len, + dma_addr_t dma_addr) { if (adapter->adapter_attr.use_32_dma_mask) { - ((struct leapraid_sge_simple32 *)sge)->flg_and_len = + struct leapraid_sge_simple32 *sge32 = sge; + + sge32->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_32 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple32 *)sge)->addr = - cpu_to_le32(dma_addr); + sge32->addr = cpu_to_le32(dma_addr); } else { - ((struct leapraid_sge_simple64 *)sge)->flg_and_len = + struct leapraid_sge_simple64 *sge64 = sge; + + sge64->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_64 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple64 *)sge)->addr = - cpu_to_le64(dma_addr); + sge64->addr = cpu_to_le64(dma_addr); } } @@ -700,11 +776,12 @@ static inline void leapraid_single_ieee_sg_append(void *sge, u8 flag, u32 len, dma_addr_t dma_addr) { - ((struct leapraid_chain64_ieee_sg *)sge)->flg = flag; - ((struct leapraid_chain64_ieee_sg *)sge)->next_chain_offset = - next_chain_offset; - ((struct leapraid_chain64_ieee_sg *)sge)->len = cpu_to_le32(len); - ((struct leapraid_chain64_ieee_sg *)sge)->addr = cpu_to_le64(dma_addr); + struct leapraid_chain64_ieee_sg *ieee_sg = sge; + + ieee_sg->flg = flag; + ieee_sg->next_chain_offset = next_chain_offset; + ieee_sg->len = cpu_to_le32(len); + ieee_sg->addr = cpu_to_le64(dma_addr); } static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, @@ -712,12 +789,12 @@ static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, { leapraid_single_mpi_sg_append(adapter, sge, - (u32)((LEAPRAID_SGE_FLG_LAST_ONE | - LEAPRAID_SGE_FLG_EOB | - LEAPRAID_SGE_FLG_EOL | - LEAPRAID_SGE_FLG_SIMPLE_ONE) << - LEAPRAID_SGE_FLG_SHIFT), - -1); + (LEAPRAID_SGE_FLG_LAST_ONE | + LEAPRAID_SGE_FLG_EOB | + LEAPRAID_SGE_FLG_EOL | + LEAPRAID_SGE_FLG_SIMPLE_ONE) << + LEAPRAID_SGE_FLG_SHIFT, + LEAPRAID_SGE_NO_DATA_ADDR); } void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, @@ -768,7 +845,7 @@ void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, c2h_size, c2h_dma_addr); } else { - return leapraid_build_nodata_mpi_sg(adapter, sge); + leapraid_build_nodata_mpi_sg(adapter, sge); } } @@ -778,7 +855,9 @@ void leapraid_build_ieee_nodata_sg(struct leapraid_adapter *adapter, void *sge) (LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | LEAPRAID_IEEE_SGE_FLG_EOL), - 0, 0, -1); + 0, + 0, + LEAPRAID_SGE_NO_DATA_ADDR); } int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, @@ -796,7 +875,7 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, u32 chain_offset_in_cur_seg; u32 chain_len_in_cur_seg; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); scmd_sg_cur = scsi_sglist(scmd); sg_entries_left = scsi_dma_map(scmd); @@ -834,7 +913,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, if (chain_offset_in_cur_seg) chain_len_in_cur_seg += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, chain_offset_in_cur_seg, chain_len_in_cur_seg, @@ -844,7 +924,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, goto fill_last_seg; while (sg_entries_in_cur_seg) { - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, 0, sg_dma_len(scmd_sg_cur), @@ -881,39 +962,44 @@ void leapraid_build_ieee_sg(struct leapraid_adapter *adapter, void *sge, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size) { + u32 base_flag; + u32 flag; + + base_flag = LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | + LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR; + if (h2c_size && !c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, h2c_size, h2c_dma_addr); } else if (!h2c_size && c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, c2h_size, c2h_dma_addr); } else if (h2c_size && c2h_size) { leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + base_flag, 0, h2c_size, h2c_dma_addr); sge += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | - LEAPRAID_IEEE_SGE_FLG_EOL, + flag, 0, c2h_size, c2h_dma_addr); } else { - return leapraid_build_ieee_nodata_sg(adapter, sge); + leapraid_build_ieee_nodata_sg(adapter, sge); } } @@ -967,8 +1053,11 @@ static struct leapraid_card_port *leapraid_get_port_by_id( if (unlikely(!adapter->adapter_attr.enable_mp)) { port = kzalloc(sizeof(*port), GFP_ATOMIC); - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed to alloc port\n", __func__); return NULL; + } port->port_id = LEAPRAID_DISABLE_MP_PORT_ID; list_add_tail(&port->list, &adapter->dev_topo.card_port_list); @@ -995,7 +1084,8 @@ struct leapraid_vphy *leapraid_get_vphy_by_phy(struct leapraid_card_port *port, } struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( - struct leapraid_adapter *adapter, u64 sas_address, + struct leapraid_adapter *adapter, + u64 sas_address, struct sas_rphy *rphy) { struct leapraid_sas_dev *sas_dev; @@ -1025,8 +1115,10 @@ struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr( { struct leapraid_sas_dev *sas_dev; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } assert_spin_locked(&adapter->dev_topo.sas_dev_lock); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) @@ -1054,8 +1146,10 @@ struct leapraid_sas_dev *leapraid_get_sas_dev_by_addr( struct leapraid_sas_dev *sas_dev; unsigned long flags; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, @@ -1104,8 +1198,11 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, unsigned long flags; bool del_from_list; - if (!sas_dev) + if (!sas_dev) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid SAS device\n", __func__); return; + } del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); @@ -1115,8 +1212,10 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - if (del_from_list) + if (del_from_list) { + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); + } } static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, @@ -1132,12 +1231,10 @@ static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1162,12 +1259,10 @@ void leapraid_sas_dev_remove_by_sas_address(struct leapraid_adapter *adapter, spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, port); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1181,14 +1276,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_id( struct leapraid_adapter *adapter, uint id, uint channel) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->id == id && - raid_volume->channel == channel) { + if (raid_volume->id == id && raid_volume->channel == channel) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1197,12 +1297,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_hdl( struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->hdl == hdl) + if (raid_volume->hdl == hdl) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1211,12 +1318,19 @@ static struct leapraid_raid_volume *leapraid_raid_volume_find_by_wwid( struct leapraid_adapter *adapter, u64 wwid) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid) + if (raid_volume->wwid == wwid) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1227,6 +1341,7 @@ static void leapraid_raid_volume_add(struct leapraid_adapter *adapter, unsigned long flags; spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_get(raid_volume); list_add_tail(&raid_volume->list, &adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } @@ -1235,11 +1350,24 @@ void leapraid_raid_volume_remove(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume) { unsigned long flags; + bool del_from_list = false; + + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid RAID volume\n", __func__); + return; + } spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_del(&raid_volume->list); - kfree(raid_volume); + if (!list_empty(&raid_volume->list)) { + list_del_init(&raid_volume->list); + del_from_list = true; + } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + leapraid_clear_cached_boot_dev(adapter, raid_volume, RAID_CHANNEL); + if (del_from_list) + leapraid_raid_volume_put(raid_volume); } static struct leapraid_enc_node *leapraid_enc_find_by_hdl( @@ -1247,10 +1375,9 @@ static struct leapraid_enc_node *leapraid_enc_find_by_hdl( { struct leapraid_enc_node *enc_dev; - list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) { + list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) if (le16_to_cpu(enc_dev->pg0.enc_hdl) == hdl) return enc_dev; - } return NULL; } @@ -1261,15 +1388,19 @@ struct leapraid_topo_node *leapraid_exp_find_by_sas_address( { struct leapraid_topo_node *sas_exp; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->sas_address == sas_address && sas_exp->card_port == port) return sas_exp; - } + dev_warn(&adapter->pdev->dev, + "%s: No expander found for SAS addr=0x%016llx port=%p\n", + __func__, (unsigned long long)sas_address, port); return NULL; } @@ -1316,10 +1447,9 @@ static struct leapraid_topo_node *leapraid_exp_find_by_hdl( { struct leapraid_topo_node *sas_exp; - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->hdl == hdl) return sas_exp; - } return NULL; } @@ -1347,7 +1477,7 @@ static enum leapraid_card_port_checking_flg leapraid_get_card_port_feature( return CARD_PORT_FURTHER_CHECKING_NEEDED; } -static int leapraid_process_card_port_feature( +static bool leapraid_process_card_port_feature( struct leapraid_card_port_feature *feature) { struct leapraid_card_port *old_card_port; @@ -1356,8 +1486,10 @@ static int leapraid_process_card_port_feature( if (feature->exact_phy) { feature->checking_state = SAME_PORT_WITH_NOTHING_CHANGED; feature->expected_old_port = old_card_port; - return 1; - } else if (feature->phy_overlap) { + return true; + } + + if (feature->phy_overlap) { if (feature->same_port) { feature->checking_state = SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS; @@ -1368,21 +1500,20 @@ static int leapraid_process_card_port_feature( SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS; feature->expected_old_port = old_card_port; } - } else { - if (feature->checking_state != - SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && - feature->checking_state != - SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { - feature->checking_state = SAME_ADDR_ONLY; - feature->expected_old_port = old_card_port; - feature->same_addr_port_count++; - } + } else if (feature->checking_state != + SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && + feature->checking_state != + SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { + feature->checking_state = SAME_ADDR_ONLY; + feature->expected_old_port = old_card_port; + feature->same_addr_port_count++; } - return 0; + return false; } -static int leapraid_check_card_port(struct leapraid_adapter *adapter, +static int leapraid_check_card_port( + struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_card_port **expected_card_port, int *count) @@ -1428,7 +1559,8 @@ static void leapraid_del_phy_part_of_anther_port( continue; if (card_port_table[i].phy_mask & BIT(offset)) { - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); found = true; @@ -1448,7 +1580,7 @@ static void leapraid_add_or_del_phys_from_existing_port( { struct leapraid_topo_node *card_topo_node; u32 phy_mask_diff; - u32 offset = 0; + u32 offset; card_topo_node = &adapter->dev_topo.card; phy_mask_diff = card_port->phy_mask ^ @@ -1466,12 +1598,15 @@ static void leapraid_add_or_del_phys_from_existing_port( } if (card_topo_node->card_phy[offset].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); - leapraid_transport_attach_phy_to_port(adapter, - card_topo_node, &card_topo_node->card_phy[offset], + leapraid_transport_attach_phy_to_port( + adapter, + card_topo_node, + &card_topo_node->card_phy[offset], card_port->sas_address, card_port); } @@ -1486,7 +1621,8 @@ struct leapraid_sas_dev *leapraid_get_next_sas_dev_from_init_list( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); if (!list_empty(&adapter->dev_topo.sas_dev_init_list)) { sas_dev = list_first_entry(&adapter->dev_topo.sas_dev_init_list, - struct leapraid_sas_dev, list); + struct leapraid_sas_dev, + list); leapraid_sdev_get(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1498,37 +1634,66 @@ static bool leapraid_check_boot_dev_internal(u64 sas_address, u64 dev_name, struct leapraid_boot_dev *boot_dev, u8 form) { + struct leapraid_boot_dev_format_sas_wwid *wwid; + struct leapraid_boot_dev_format_enc_slot *es; + struct leapraid_boot_dev_format_dev_name *dn; + void *pg_dev; + if (!boot_dev) return false; + pg_dev = boot_dev->pg_dev; switch (form & LEAPRAID_BOOTDEV_FORM_MASK) { case LEAPRAID_BOOTDEV_FORM_SAS_WWID: + wwid = pg_dev; + if (!sas_address) return false; - return sas_address == - le64_to_cpu(((struct leapraid_boot_dev_format_sas_wwid *)( - boot_dev->pg_dev))->sas_addr); + return sas_address == le64_to_cpu(wwid->sas_addr); case LEAPRAID_BOOTDEV_FORM_ENC_SLOT: + es = pg_dev; + if (!enc_lid) return false; - return (enc_lid == le64_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->enc_lid) && - slot == le16_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->slot_num)); + return (enc_lid == le64_to_cpu(es->enc_lid) && + slot == le16_to_cpu(es->slot_num)); case LEAPRAID_BOOTDEV_FORM_DEV_NAME: + dn = pg_dev; + if (!dev_name) return false; - return dev_name == le64_to_cpu(((struct leapraid_boot_dev_format_dev_name *)( - boot_dev->pg_dev))->dev_name); + return dev_name == le64_to_cpu(dn->dev_name); case LEAPRAID_BOOTDEV_FORM_NONE: default: return false; } } +void leapraid_boot_dev_get(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_get((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_get((struct leapraid_sas_dev *)dev); +} + +void leapraid_boot_dev_put(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_put((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_put((struct leapraid_sas_dev *)dev); +} + static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, u64 sas_addr, u64 dev_name, u64 enc_lid, u16 slot, @@ -1543,15 +1708,56 @@ static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, slot, boot_dev, boot_dev->form); if (matched) { + leapraid_boot_dev_get(dev, chnl); boot_dev->dev = dev; boot_dev->chnl = chnl; } } +static void leapraid_clear_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, + void *dev, u32 chnl) +{ + void *cached_dev; + u32 cached_chnl; + unsigned long flags; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (boot_dev->dev != dev || boot_dev->chnl != chnl) + goto out_unlock; + + cached_dev = boot_dev->dev; + cached_chnl = boot_dev->chnl; + boot_dev->dev = NULL; + boot_dev->chnl = 0; + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + leapraid_boot_dev_put(cached_dev, cached_chnl); + return; + +out_unlock: + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); +} + +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl) +{ + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + dev, chnl); +} + static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl) { - u64 sas_addr = 0; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + u64 sas_addr; u64 dev_name = 0; u64 enc_lid = 0; u16 slot = 0; @@ -1561,24 +1767,17 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; - + raid_volume = dev; sas_addr = raid_volume->wwid; break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; + sas_dev = dev; sas_addr = sas_dev->sas_addr; dev_name = sas_dev->dev_name; enc_lid = sas_dev->enc_lid; slot = sas_dev->slot; break; } - } leapraid_try_set_boot_dev(&adapter->boot_devs.requested_boot_dev, sas_addr, dev_name, enc_lid, @@ -1591,17 +1790,272 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, slot, dev, chnl); } -static void leapraid_build_and_fire_cfg_req(struct leapraid_adapter *adapter, +static const char *leapraid_func_name(u8 func) +{ + switch (func) { + case LEAPRAID_FUNC_SCSIIO: + return "SCSIIO"; + case LEAPRAID_FUNC_SCSI_TMF: + return "SCSI_TMF"; + case LEAPRAID_FUNC_ADAPTER_INIT: + return "ADAPTER_INIT"; + case LEAPRAID_FUNC_GET_ADAPTER_FEATURES: + return "GET_ADAPTER_FEATURES"; + case LEAPRAID_FUNC_CONFIG_OP: + return "CONFIG_OP"; + case LEAPRAID_FUNC_SCAN_DEV: + return "SCAN_DEV"; + case LEAPRAID_FUNC_EVENT_NOTIFY: + return "EVENT_NOTIFY"; + case LEAPRAID_FUNC_FW_DOWNLOAD: + return "FW_DOWNLOAD"; + case LEAPRAID_FUNC_FW_UPLOAD: + return "FW_UPLOAD"; + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + return "SCSIIO_RAID_PASSTHROUGH"; + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: + return "SCSI_ENC_PROCESSOR"; + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + return "SMP_PASSTHROUGH"; + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: + return "SAS_IO_UNIT_CTRL"; + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + return "SCSIIO_SATA_PASSTHROUGH"; + case LEAPRAID_FUNC_ADAPTER_UNIT_RESET: + return "ADAPTER_UNIT_RESET"; + case LEAPRAID_FUNC_HANDSHAKE: + return "HANDSHAKE"; + case LEAPRAID_FUNC_LOGBUF_INIT: + return "LOGBUF_INIT"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_CFG_ACT_PAGE_HEADER: + return "PAGE_HEADER"; + case LEAPRAID_CFG_ACT_PAGE_READ_CUR: + return "PAGE_READ_CUR"; + case LEAPRAID_CFG_ACT_PAGE_WRITE_CUR: + return "PAGE_WRITE_CUR"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_page_type_name(u8 page_type) +{ + switch (page_type) { + case LEAPRAID_CFG_PT_IO_UNIT: + return "IO_UNIT"; + case LEAPRAID_CFG_PT_ADAPTER: + return "ADAPTER"; + case LEAPRAID_CFG_PT_BIOS: + return "BIOS"; + case LEAPRAID_CFG_PT_RAID_VOLUME: + return "RAID_VOLUME"; + case LEAPRAID_CFG_PT_MANUFACTURING: + return "MANUFACTURING"; + case LEAPRAID_CFG_PT_RAID_PHYSDISK: + return "RAID_PHYSDISK"; + case LEAPRAID_CFG_PT_EXTENDED: + return "EXTENDED"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_ext_page_type_name(u8 ext_page_type) +{ + switch (ext_page_type) { + case LEAPRAID_CFG_EXTPT_SAS_IO_UNIT: + return "SAS_IO_UNIT"; + case LEAPRAID_CFG_EXTPT_SAS_EXP: + return "SAS_EXPANDER"; + case LEAPRAID_CFG_EXTPT_SAS_DEV: + return "SAS_DEVICE"; + case LEAPRAID_CFG_EXTPT_SAS_PHY: + return "SAS_PHY"; + case LEAPRAID_CFG_EXTPT_ENC: + return "ENCLOSURE"; + case LEAPRAID_CFG_EXTPT_RAID_CONFIG: + return "RAID_CONFIG"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sep_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_SEP_REQ_ACT_WRITE_STATUS: + return "WRITE_STATUS"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sas_op_name(u8 op) +{ + switch (op) { + case LEAPRAID_SAS_OP_PHY_LINK_RESET: + return "PHY_LINK_RESET"; + case LEAPRAID_SAS_OP_PHY_HARD_RESET: + return "PHY_HARD_RESET"; + case LEAPRAID_SAS_OP_SET_PARAMETER: + return "SET_PARAMETER"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_io_param_name(u8 adapter_param) +{ + switch (adapter_param) { + case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: + return "SYNC_TIMESTAMP"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_tm_type_name(u8 task_type) +{ + switch (task_type) { + case LEAPRAID_TM_TASKTYPE_ABORT_TASK: + return "ABORT_TASK"; + case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: + return "ABORT_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_TARGET_RESET: + return "TARGET_RESET"; + case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: + return "LOGICAL_UNIT_RESET"; + case LEAPRAID_TM_TASKTYPE_CLEAR_TASK_SET: + return "CLEAR_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK: + return "QUERY_TASK"; + case LEAPRAID_TM_TASKTYPE_CLEAR_ACA: + return "CLEAR_ACA"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK_SET: + return "QUERY_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_ASYNC_EVENT: + return "QUERY_ASYNC_EVENT"; + default: + return "UNKNOWN"; + } +} + +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data) +{ + const struct leapraid_req *req = req_data; + + if (!adapter || !adapter->pdev || !req_data) + return; + + switch (req->func) { + case LEAPRAID_FUNC_CONFIG_OP: { + const struct leapraid_cfg_req *cfg_req = req_data; + + dev_err(&adapter->pdev->dev, + "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + cfg_req->action, + leapraid_cfg_action_name(cfg_req->action)); + dev_err(&adapter->pdev->dev, + "cfg-req: page_type=0x%02x(%s) page_num=%u\n", + cfg_req->header.page_type, + leapraid_cfg_page_type_name(cfg_req->header.page_type), + cfg_req->header.page_num); + if (cfg_req->header.page_type == LEAPRAID_CFG_PT_EXTENDED) + dev_err(&adapter->pdev->dev, + "cfg-req: ext_page_type=0x%02x(%s)\n", + cfg_req->ext_page_type, + leapraid_cfg_ext_page_type_name( + cfg_req->ext_page_type)); + dev_err(&adapter->pdev->dev, "cfg-req: page_addr=0x%08x\n", + le32_to_cpu(cfg_req->page_addr)); + break; + } + case LEAPRAID_FUNC_SCSI_TMF: { + const struct leapraid_scsi_tm_req *tm_req = req_data; + + dev_err(&adapter->pdev->dev, + "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + tm_req->task_type, + leapraid_tm_type_name(tm_req->task_type)); + dev_err(&adapter->pdev->dev, + "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + le16_to_cpu(tm_req->dev_hdl), + le16_to_cpu(tm_req->task_mid)); + break; + } + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: { + const struct leapraid_sep_req *sep_req = req_data; + + dev_err(&adapter->pdev->dev, + "sep: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + sep_req->act, + leapraid_sep_action_name(sep_req->act)); + dev_err(&adapter->pdev->dev, + "sep: dev_hdl=0x%04x slot=%u enc_hdl=0x%04x\n", + le16_to_cpu(sep_req->dev_hdl), + le16_to_cpu(sep_req->slot), + le16_to_cpu(sep_req->enc_hdl)); + break; + } + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: { + const struct leapraid_io_unit_ctrl_req *io_req = req_data; + + dev_err(&adapter->pdev->dev, + "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + io_req->op, leapraid_sas_op_name(io_req->op)); + dev_err(&adapter->pdev->dev, + "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + le16_to_cpu(io_req->dev_hdl), + io_req->adapter_para, + leapraid_io_param_name(io_req->adapter_para)); + break; + } + case LEAPRAID_FUNC_SMP_PASSTHROUGH: { + const struct leapraid_smp_passthrough_req *smp_req = req_data; + + dev_err(&adapter->pdev->dev, + "transport: func=0x%02x(%s) port=%u req_len=%u\n", + req->func, leapraid_func_name(req->func), + smp_req->physical_port, + le16_to_cpu(smp_req->req_data_len)); + dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + (unsigned long long)le64_to_cpu(smp_req->sas_address)); + break; + } + default: + dev_err(&adapter->pdev->dev, + "%s: func=0x%02x(%s)\n", + __func__, req->func, leapraid_func_name(req->func)); + break; + } +} + +static void leapraid_build_and_fire_cfg_req( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); - memset((void *)(&adapter->driver_cmds.cfg_op_cmd.reply), 0, + memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc(adapter, + local_leap_cfg_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.cfg_op_cmd.inter_taskid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); @@ -1629,17 +2083,18 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { rc = -EFAULT; - goto out; + goto out_cleanup; } dev_warn(&adapter->pdev->dev, - "cfg-req: retry request, cnt=%u\n", retry_cnt); + "cfg-req: Retry request, cnt=%u\n", retry_cnt); } - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: adapter not operational\n"); - goto out; + "cfg-req: Adapter not operational\n"); + goto out_cleanup; } leapraid_build_and_fire_cfg_req(adapter, leap_mpi_cfgp_req, @@ -1649,44 +2104,47 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_RESET) { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg due to hard reset\n"); + "cfg-req: CMD fail due to hard reset\n"); goto retry; } if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { dev_err(&adapter->pdev->dev, - "cfg-req: cmd not done during %s, skip reset\n", + "cfg-req: pending in %s, status=0x%x\n", adapter->access_ctrl.shost_recovering ? - "shost recovery" : "pcie recovery"); + "shost recovery" : "pcie recovery", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, - "cfg-req: cmd timeout, issuing hard reset\n"); + "cfg-req: timeout, status=0x%x, reset\n", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = true; } - goto out; + goto out_cleanup; } if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_REPLY_VALID) { memcpy(leap_mpi_cfgp_rep, - (void *)(&adapter->driver_cmds.cfg_op_cmd.reply), + &adapter->driver_cmds.cfg_op_cmd.reply, sizeof(struct leapraid_cfg_rep)); adapter_status = le16_to_cpu( leap_mpi_cfgp_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS) { - if (target_cfg_pg && real_cfg_pg_addr && - target_real_cfg_pg_sz) - if (leap_mpi_cfgp_req->action == - LEAPRAID_CFG_ACT_PAGE_READ_CUR) - memcpy(target_cfg_pg, - real_cfg_pg_addr, - target_real_cfg_pg_sz); - } else { + if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS && + target_cfg_pg && real_cfg_pg_addr && + target_real_cfg_pg_sz && + leap_mpi_cfgp_req->action == + LEAPRAID_CFG_ACT_PAGE_READ_CUR) + memcpy(target_cfg_pg, real_cfg_pg_addr, + target_real_cfg_pg_sz); + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { if (adapter_status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, @@ -1695,30 +2153,30 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, rc = -EFAULT; } } else { - dev_err(&adapter->pdev->dev, "cfg-rep: reply invalid\n"); + dev_err(&adapter->pdev->dev, "cfg-rep: Reply invalid\n"); rc = -EFAULT; } -out: +out_cleanup: adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { dev_info(&adapter->pdev->dev, - "%s:%d cfg-req: failure, issuing reset\n", + "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = -EFAULT; } else { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg during init, skip reset\n"); - rc = -EFAULT; + "cfg-req: CMD fail in init, skip reset\n"); } + rc = -EFAULT; } return rc; } -static int leapraid_request_cfg_pg_header(struct leapraid_adapter *adapter, +static int leapraid_request_cfg_pg_header( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { @@ -1744,8 +2202,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, { struct leapraid_cfg_req leap_mpi_cfgp_req; struct leapraid_cfg_rep leap_mpi_cfgp_rep; - u16 real_cfg_pg_sz = 0; - void *real_cfg_pg_addr = NULL; + u16 real_cfg_pg_sz; + void *real_cfg_pg_addr; dma_addr_t real_cfg_pg_dma = 0; u32 __page_size; int rc; @@ -1767,6 +2225,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, LEAPRAID_CFG_PAGE_NUM_BIOS2; __page_size = sizeof(struct leapraid_bios_page2); break; + case GET_MANUFACTURING_PG0: + leap_mpi_cfgp_req.header.page_type = + LEAPRAID_CFG_PT_MANUFACTURING; + leap_mpi_cfgp_req.header.page_num = + LEAPRAID_CFG_PAGE_NUM_MANU0; + __page_size = sizeof(struct leapraid_manufacturing_p0); + break; case GET_SAS_DEVICE_PG0: leap_mpi_cfgp_req.header.page_type = LEAPRAID_CFG_PT_EXTENDED; leap_mpi_cfgp_req.ext_page_type = LEAPRAID_CFG_EXTPT_SAS_DEV; @@ -1833,9 +2298,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, break; default: dev_err(&adapter->pdev->dev, - "unsupported config page action=%d!\n", cfg_op); - rc = -EINVAL; - goto out; + "Unsupported config page action=%d!\n", cfg_op); + return -EINVAL; } leapraid_build_nodata_mpi_sg(adapter, @@ -1845,8 +2309,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, &leap_mpi_cfgp_rep); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: header failed rc=%dn", rc); - goto out; + "cfg-req: Header failed rc=%dn", rc); + return rc; } if (cfg_op == GET_SAS_DEVICE_PG0 || @@ -1882,17 +2346,14 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, leap_mpi_cfgp_req.ext_page_type = leap_mpi_cfgp_rep.ext_page_type; real_cfg_pg_sz = (leap_mpi_cfgp_req.header.page_len) ? - leap_mpi_cfgp_req.header.page_len * 4 : - le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * 4; + leap_mpi_cfgp_req.header.page_len * sizeof(u32) : + le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * sizeof(u32); real_cfg_pg_addr = dma_alloc_coherent(&adapter->pdev->dev, real_cfg_pg_sz, &real_cfg_pg_dma, GFP_KERNEL); - if (!real_cfg_pg_addr) { - dev_err(&adapter->pdev->dev, "cfg-req: dma alloc failed\n"); - rc = -ENOMEM; - goto out; - } + if (!real_cfg_pg_addr) + return -ENOMEM; if (leap_mpi_cfgp_req.action == LEAPRAID_CFG_ACT_PAGE_WRITE_CUR) { leapraid_single_mpi_sg_append(adapter, @@ -1929,12 +2390,11 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_addr, min_t(u16, real_cfg_pg_sz, __page_size)); if (rc) { - u32 adapter_status; + u32 status; - adapter_status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != - LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) + status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, "cfg-req: rc=%d, pg_info: 0x%x, 0x%x, %d\n", rc, leap_mpi_cfgp_req.header.page_type, @@ -1947,10 +2407,52 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_sz, real_cfg_pg_addr, real_cfg_pg_dma); -out: + return rc; } +static int leapraid_cfg_find_vol_in_page( + struct leapraid_raid_cfg_p0 *raid_cfg_p0, + u16 pd_hdl, u16 *vol_hdl) +{ + u16 elements = raid_cfg_p0->elements_num; + int i; + + for (i = 0; i < elements; i++) { + struct leapraid_raid_cfg_p0_element *elem; + u16 type; + + elem = &raid_cfg_p0->cfg_element[i]; + + type = le16_to_cpu(elem->element_flg) & + LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; + + switch (type) { + case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: + case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: { + u16 phys_hdl; + + phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); + + if (phys_hdl == pd_hdl) { + *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); + return 0; + } + break; + } + + case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: + *vol_hdl = 0; + return 0; + + default: + break; + } + } + + return -ENOENT; +} + static int leapraid_cfg_get_volume_hdl_dispatch( struct leapraid_adapter *adapter, struct leapraid_cfg_req *cfg_req, @@ -1961,13 +2463,11 @@ static int leapraid_cfg_get_volume_hdl_dispatch( u16 raid_cfg_p0_sz, u16 pd_hdl, u16 *vol_hdl) { - u16 phys_disk_dev_hdl; u16 adapter_status; - u16 element_type; int config_num; - int rc, i; + int rc; - config_num = 0xff; + config_num = 0xFF; while (true) { cfg_req->page_addr = cpu_to_le32(config_num + @@ -1988,35 +2488,14 @@ static int leapraid_cfg_get_volume_hdl_dispatch( } if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - return -1; - - for (i = 0; i < raid_cfg_p0->elements_num; i++) { - element_type = - le16_to_cpu(raid_cfg_p0->cfg_element[i].element_flg) & - LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; - - switch (element_type) { - case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: - case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: - phys_disk_dev_hdl = - le16_to_cpu(raid_cfg_p0->cfg_element[i] - .phys_disk_dev_hdl); - if (phys_disk_dev_hdl == pd_hdl) { - *vol_hdl = - le16_to_cpu - (raid_cfg_p0->cfg_element[i] - .vol_dev_hdl); - return 0; - } - break; + return LEAPRAID_OPERATION_FAILED; + + rc = leapraid_cfg_find_vol_in_page(raid_cfg_p0, + pd_hdl, + vol_hdl); + if (rc != -ENOENT) + return rc; - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: - *vol_hdl = 0; - return 0; - default: - break; - } - } config_num = raid_cfg_p0->cfg_num; } return 0; @@ -2025,12 +2504,12 @@ static int leapraid_cfg_get_volume_hdl_dispatch( int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, u16 pd_hdl, u16 *vol_hdl) { - struct leapraid_raid_cfg_p0 *raid_cfg_p0 = NULL; + struct leapraid_raid_cfg_p0 *raid_cfg_p0; struct leapraid_cfg_req cfg_req; struct leapraid_cfg_rep cfg_rep; dma_addr_t real_cfg_pg_dma = 0; - void *real_cfg_pg_addr = NULL; - u16 real_cfg_pg_sz = 0; + void *real_cfg_pg_addr; + u16 real_cfg_pg_sz; int rc, raid_cfg_p0_sz; *vol_hdl = 0; @@ -2044,16 +2523,14 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, leapraid_build_nodata_mpi_sg(adapter, &cfg_req.page_buf_sge); rc = leapraid_request_cfg_pg_header(adapter, &cfg_req, &cfg_rep); if (rc) - goto out; + return rc; cfg_req.action = LEAPRAID_CFG_ACT_PAGE_READ_CUR; raid_cfg_p0_sz = le16_to_cpu(cfg_rep.ext_page_len) * LEAPRAID_CFG_UNIT_SIZE; raid_cfg_p0 = kmalloc(raid_cfg_p0_sz, GFP_KERNEL); - if (!raid_cfg_p0) { - rc = -1; - goto out; - } + if (!raid_cfg_p0) + return -ENOMEM; real_cfg_pg_sz = (cfg_req.header.page_len) ? cfg_req.header.page_len * LEAPRAID_CFG_UNIT_SIZE : @@ -2064,7 +2541,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, GFP_KERNEL); if (!real_cfg_pg_addr) { rc = -ENOMEM; - goto out; + goto out_free; } memset(raid_cfg_p0, 0, raid_cfg_p0_sz); @@ -2088,7 +2565,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, raid_cfg_p0_sz, pd_hdl, vol_hdl); -out: +out_free: if (real_cfg_pg_addr) dma_free_coherent(&adapter->pdev->dev, real_cfg_pg_sz, real_cfg_pg_addr, @@ -2103,7 +2580,7 @@ static int leapraid_get_adapter_phys(struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 sas_io_unit_page0; union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - int rc = 0; + int rc; *nr_phys = 0; cfgp1.size = sizeof(struct leapraid_sas_io_unit_p0); @@ -2156,7 +2633,8 @@ int leapraid_cfg_get_volume_wwid(struct leapraid_adapter *adapter, return rc; } -static int leapraid_get_sas_io_unit_page0(struct leapraid_adapter *adapter, +static int leapraid_get_sas_io_unit_page0( + struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 *sas_io_unit_p0, u16 sas_iou_pg0_sz) { @@ -2178,8 +2656,8 @@ static int leapraid_get_sas_address(struct leapraid_adapter *adapter, *sas_address = 0; cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; if (hdl <= adapter->dev_topo.card.phys_num && @@ -2201,9 +2679,10 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raidpd_p0 raidpd_p0; u8 num_pds; u16 sz; + int rc = 0; - if ((leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, - &num_pds)) || !num_pds) + if (leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, + &num_pds) || !num_pds) return -EFAULT; raid_volume->pd_num = num_pds; @@ -2211,14 +2690,14 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, (num_pds * sizeof(struct leapraid_raidvol0_phys_disk)); raidvol_p0 = kzalloc(sz, GFP_KERNEL); if (!raidvol_p0) - return -EFAULT; + return -ENOMEM; cfgp1.size = sz; cfgp2.handle = raid_volume->hdl; - if ((leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, - GET_RAID_VOLUME_PG0))) { - kfree(raidvol_p0); - return -EFAULT; + if (leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, + GET_RAID_VOLUME_PG0)) { + rc = -EFAULT; + goto out_cleanup; } raid_volume->vol_type = raidvol_p0->volume_type; @@ -2229,14 +2708,28 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = le16_to_cpu(raidpd_p0.dev_hdl); if (!(leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) { + cfgp2, GET_SAS_DEVICE_PG0))) raid_volume->dev_info = le32_to_cpu(sas_dev_p0.dev_info); - } } +out_cleanup: kfree(raidvol_p0); - return 0; + return rc; +} + +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter) +{ + unsigned long flags; + bool skip; + + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + skip = adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.pcie_recovering || + adapter->access_ctrl.host_removing; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + + return skip; } static void leapraid_fw_log_work(struct work_struct *work) @@ -2244,26 +2737,34 @@ static void leapraid_fw_log_work(struct work_struct *work) struct leapraid_adapter *adapter = container_of(work, struct leapraid_adapter, fw_log_desc.fw_log_work.work); struct leapraid_fw_log_info *infom; + struct leapraid_reg_base __iomem *iomem_base; unsigned long flags; - infom = (struct leapraid_fw_log_info *)(adapter->fw_log_desc.fw_log_buffer + - LEAPRAID_SYS_LOG_BUF_SIZE); + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + infom = (struct leapraid_fw_log_info *) + (adapter->fw_log_desc.fw_log_buffer + + LEAPRAID_SYS_LOG_BUF_SIZE); + iomem_base = adapter->iomem_base; if (adapter->fw_log_desc.fw_log_init_flag == 0) { infom->user_position = - leapraid_readl(&adapter->iomem_base->host_log_buf_pos); + leapraid_readl(&iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); adapter->fw_log_desc.fw_log_init_flag++; } - writel(infom->user_position, &adapter->iomem_base->host_log_buf_pos); + writel(infom->user_position, &iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); +scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2282,7 +2783,8 @@ void leapraid_fw_log_stop(struct leapraid_adapter *adapter) adapter->fw_log_desc.fw_log_wq = NULL; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); if (wq) { - if (!cancel_delayed_work_sync(&adapter->fw_log_desc.fw_log_work)) + if (!cancel_delayed_work_sync(&adapter->fw_log_desc + .fw_log_work)) flush_workqueue(wq); destroy_workqueue(wq); } @@ -2312,7 +2814,8 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2323,12 +2826,13 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; ktime_t current_time; bool issue_reset = false; - u64 time_stamp = 0; + u64 time_stamp; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; io_unit_ctrl_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; @@ -2343,18 +2847,27 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - wait_for_completion_timeout(&adapter->driver_cmds.timestamp_sync_cmd.done, + leapraid_fire_task( + adapter, + adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_debug_log_info(adapter); + wait_for_completion_timeout(&adapter->driver_cmds + .timestamp_sync_cmd.done, LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) + LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: timestamp sync timeout, status=0x%x\n", + __func__, + adapter->driver_cmds.timestamp_sync_cmd.status); + leapraid_log_req_context(adapter, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); + } if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } @@ -2363,20 +2876,6 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); } -static bool leapraid_should_skip_fault_check(struct leapraid_adapter *adapter) -{ - unsigned long flags; - bool skip; - - spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - skip = adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.host_removing; - spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); - - return skip; -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2387,16 +2886,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter = container_of(work, struct leapraid_adapter, reset_desc.fault_reset_work.work); - if (leapraid_should_skip_fault_check(adapter)) + if (leapraid_should_skip_poll_work(adapter)) goto scheduled_timer; adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: hard reset: %s\n", - __func__, (rc == 0) ? "success" : "failed"); + dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", + __func__, rc == 0 ? "success" : "failed"); adapter_state = leapraid_get_adapter_state(adapter); if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) @@ -2412,7 +2911,8 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2437,14 +2937,15 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) adapter->reset_desc.fault_reset_wq_name); if (!adapter->reset_desc.fault_reset_wq) { dev_err(&adapter->pdev->dev, - "create single thread workqueue failed!\n"); + "Create single thread workqueue failed!\n"); return; } spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, - &adapter->reset_desc.fault_reset_work, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, + &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } @@ -2471,17 +2972,24 @@ static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, u16 hdl) { if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) - return false; - - if (leapraid_check_adapter_is_op(adapter)) + adapter->access_ctrl.shost_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", + __func__, + adapter->access_ctrl.pcie_recovering, + adapter->access_ctrl.shost_recovering); return false; + } - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) return false; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.dev_removing)) + if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { + dev_err(&adapter->pdev->dev, + "%s: Device handle is invalid\n", __func__); return false; + } return true; } @@ -2490,13 +2998,13 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, struct leapraid_scsi_cmd_desc *cmd_desc) { struct scsi_device *sdev; + struct scsi_device *target_sdev = NULL; struct leapraid_sdev_priv *sdev_priv; struct scsi_cmnd *scmd; void *dma_buffer = NULL; - dma_addr_t dma_addr = 0; - u8 sdev_flg = 0; + dma_addr_t dma_addr; bool issue_reset = false; - int rc = 0; + int rc; if (WARN_ON(!adapter->driver_cmds.internal_scmd)) return -EINVAL; @@ -2507,23 +3015,28 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); if (adapter->driver_cmds.driver_scsiio_cmd.status != LEAPRAID_CMD_NOT_USED) { + dev_err(&adapter->pdev->dev, + "%s: scsiio cmd busy\n", __func__); rc = -EAGAIN; - goto out; + goto out_cleanup; } adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; + if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && sdev_priv->lun == cmd_desc->lun) { - sdev_flg = 1; + target_sdev = sdev; break; } } - if (!sdev_flg) { + if (!target_sdev) { + dev_warn(&adapter->pdev->dev, + "%s: Device not found\n", __func__); rc = -ENXIO; - goto out; + goto out_cleanup; } if (cmd_desc->data_length) { @@ -2532,7 +3045,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, &dma_addr, GFP_ATOMIC); if (!dma_buffer) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (cmd_desc->dir == DMA_TO_DEVICE) memcpy(dma_buffer, cmd_desc->data_buffer, @@ -2540,7 +3053,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, } scmd = adapter->driver_cmds.internal_scmd; - scmd->device = sdev; + scmd->device = target_sdev; scmd->cmd_len = cmd_desc->cdb_length; memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); scmd->sc_data_direction = cmd_desc->dir; @@ -2553,11 +3066,14 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, adapter->driver_cmds.driver_scsiio_cmd.status &= ~LEAPRAID_CMD_PENDING; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); + dev_err(&adapter->pdev->dev, + "%s: queuecommand failed\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } - wait_for_completion_timeout(&adapter->driver_cmds.driver_scsiio_cmd.done, + wait_for_completion_timeout(&adapter->driver_cmds + .driver_scsiio_cmd.done, cmd_desc->time_out * HZ); if (!(adapter->driver_cmds.driver_scsiio_cmd.status & @@ -2579,15 +3095,22 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, rc = -ENODATA; dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", cmd_desc->hdl); - leapraid_issue_locked_tm(adapter, cmd_desc->hdl, 0, 0, 0, + leapraid_issue_locked_tm( + adapter, cmd_desc->hdl, 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, adapter->driver_cmds.driver_scsiio_cmd.taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } -out: +out_cleanup: + if (target_sdev) + scsi_device_put(target_sdev); + if (dma_buffer) dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, dma_buffer, dma_addr); + cmd_desc->data_length, + dma_buffer, + dma_addr); + adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); return rc; @@ -2597,7 +3120,8 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, u16 hdl, u32 lun) { struct leapraid_scsi_cmd_desc *desc; - int rc = 0; + char *buf; + int rc; desc = kzalloc(sizeof(*desc), GFP_KERNEL); if (!desc) @@ -2611,7 +3135,7 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, desc->cdb[0] = LOG_SENSE; desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; desc->cdb[8] = desc->data_length; - desc->raid_member = false; + desc->raid_member = 0; desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); @@ -2621,11 +3145,10 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, } rc = leapraid_dispatch_scsi_io(adapter, desc); - if (!rc) { - if (((char *)desc->data_buffer)[8] == - LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - } + buf = desc->data_buffer; + + if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) + leapraid_smart_fault_detect(adapter, hdl); kfree(desc->data_buffer); kfree(desc); @@ -2637,31 +3160,32 @@ static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, struct leapraid_sdev_priv *sdev_priv, u32 reset_flg) { - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; if (!sdev_priv || !sdev_priv->starget_priv->card_port) - goto out; + return false; - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev || !sas_dev->support_smart) - goto out; + goto out_fail; if (reset_flg) - sas_dev->led_on = false; + sas_dev->led_on = 0; else if (sas_dev->led_on) - goto out; + goto out_fail; - if ((sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) || + if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || sdev_priv->block) - goto out; + goto out_fail; leapraid_sdev_put(sas_dev); return true; -out: +out_fail: if (sas_dev) leapraid_sdev_put(sas_dev); return false; @@ -2674,16 +3198,21 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) smart_poll_desc.smart_poll_work.work); struct scsi_device *sdev; struct leapraid_sdev_priv *sdev_priv; - static u32 reset_cnt; bool reset_flg = false; - if (leapraid_check_adapter_is_op(adapter)) - goto out; + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) + goto scheduled_timer; + + if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) + reset_flg = true; - reset_flg = (reset_cnt < adapter->reset_desc.reset_cnt); - reset_cnt = adapter->reset_desc.reset_cnt; + adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) leapraid_dispatch_logsense(adapter, @@ -2691,11 +3220,12 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) sdev_priv->lun); } -out: +scheduled_timer: if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); + queue_delayed_work( + adapter->smart_poll_desc.smart_poll_wq, + &adapter->smart_poll_desc.smart_poll_work, + msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); } void leapraid_smart_polling_start(struct leapraid_adapter *adapter) @@ -2724,20 +3254,118 @@ void leapraid_smart_polling_start(struct leapraid_adapter *adapter) void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) { struct workqueue_struct *wq; + struct leapraid_smart_poll_desc *desc; - if (!adapter->smart_poll_desc.smart_poll_wq) + desc = &adapter->smart_poll_desc; + if (!desc->smart_poll_wq) return; - wq = adapter->smart_poll_desc.smart_poll_wq; - adapter->smart_poll_desc.smart_poll_wq = NULL; + wq = desc->smart_poll_wq; + desc->smart_poll_wq = NULL; if (wq) { - if (!cancel_delayed_work_sync(&adapter->smart_poll_desc.smart_poll_work)) + if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); destroy_workqueue(wq); } } +static void leapraid_overheat_work(struct work_struct *work) +{ + struct leapraid_overheat_desc *desc; + struct leapraid_adapter *adapter; + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + unsigned long flags; + + desc = container_of(work, struct leapraid_overheat_desc, + fault_overheat_work); + adapter = container_of(desc, struct leapraid_adapter, overheat_desc); + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_err(&pdev->dev, + "Overheat processing failed: invalid host/adapter\n"); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + if (adapter->access_ctrl.host_removing) { + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + adapter->access_ctrl.host_removing = 1; + adapter->access_ctrl.shost_recover_async = 0; + adapter->scan_dev_desc.scan_start = 0; + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + wake_up(&adapter->access_ctrl.shost_recover_wq); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + + leapraid_mask_int(adapter); + + leapraid_smart_polling_stop(adapter); + leapraid_check_scheduled_fault_stop(adapter); + leapraid_fw_log_stop(adapter); + leapraid_mq_polling_pause(adapter); + + leapraid_clean_active_cmds(adapter); + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + wq = adapter->fw_evt_s.fw_evt_thread; + adapter->fw_evt_s.fw_evt_thread = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (wq) + destroy_workqueue(wq); + + sas_remove_host(shost); + leapraid_cleanup_lists(adapter); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + dev_err(&pdev->dev, "%s: Suspend adapter due to overheat\n", __func__); +} + +static void leapraid_overheat_init(struct leapraid_adapter *adapter) +{ + if (adapter->overheat_desc.fault_overheat_wq) + return; + + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + snprintf(adapter->overheat_desc.fault_overheat_wq_name, + sizeof(adapter->overheat_desc.fault_overheat_wq_name), + "driver_%s%u_overheat", + LEAPRAID_DRIVER_NAME, + adapter->adapter_attr.id); + adapter->overheat_desc.fault_overheat_wq = + create_singlethread_workqueue( + adapter->overheat_desc.fault_overheat_wq_name); + if (!adapter->overheat_desc.fault_overheat_wq) { + dev_err(&adapter->pdev->dev, + "Failed to create overheat workqueue\n"); + return; + } + + INIT_WORK(&adapter->overheat_desc.fault_overheat_work, + leapraid_overheat_work); +} + +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter) +{ + struct workqueue_struct *wq; + + wq = xchg(&adapter->overheat_desc.fault_overheat_wq, NULL); + if (!wq) + return; + + cancel_work_sync(&adapter->overheat_desc.fault_overheat_work); + destroy_workqueue(wq); +} + static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt); @@ -2822,7 +3450,6 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( fw_evt = list_first_entry(&adapter->fw_evt_s.fw_evt_list, struct leapraid_fw_evt_work, list); list_del_init(&fw_evt->list); - leapraid_fw_evt_put(fw_evt); } spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return fw_evt; @@ -2831,56 +3458,65 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) { struct leapraid_fw_evt_work *fw_evt; - bool rc = false; + unsigned long flags; + bool in_fw_evt_context; + bool rc; if ((list_empty(&adapter->fw_evt_s.fw_evt_list) && !adapter->fw_evt_s.cur_evt) || !adapter->fw_evt_s.fw_evt_thread) return; adapter->fw_evt_s.fw_evt_cleanup = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; - while ((fw_evt = leapraid_next_fw_evt(adapter)) || - (fw_evt = adapter->fw_evt_s.cur_evt)) { - if (fw_evt == adapter->fw_evt_s.cur_evt && - adapter->fw_evt_s.cur_evt->evt_type != - LEAPRAID_EVT_REMOVE_DEAD_DEV) { - adapter->fw_evt_s.cur_evt = NULL; - continue; - } - + while ((fw_evt = leapraid_next_fw_evt(adapter))) { rc = cancel_work_sync(&fw_evt->work); - if (rc) leapraid_fw_evt_put(fw_evt); + leapraid_fw_evt_put(fw_evt); } + + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + fw_evt = adapter->fw_evt_s.cur_evt; + if (fw_evt) { + in_fw_evt_context = adapter->fw_evt_s.cur_evt_task == current; + leapraid_fw_evt_get(fw_evt); + } + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (fw_evt) { + if (!in_fw_evt_context) + cancel_work_sync(&fw_evt->work); + leapraid_fw_evt_put(fw_evt); + } + adapter->fw_evt_s.fw_evt_cleanup = 0; } static void leapraid_internal_dev_ublk(struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: now internal unblkg dev\n", + "hdl 0x%04x: Now internal unblkg dev\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc == -EINVAL) { sdev_printk(KERN_WARNING, sdev, "hdl 0x%04x: unblkg failed, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc) sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: blkg failed: earlier unblkg err, rc=%d\n", + "hdl 0x%04x: Earlier ublkg err, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc) sdev_printk(KERN_WARNING, sdev, @@ -2889,38 +3525,6 @@ static void leapraid_internal_dev_ublk(struct scsi_device *sdev, } } -static void leapraid_internal_ublk_io_dev_to_running(struct scsi_device *sdev) -{ - struct leapraid_sdev_priv *sdev_priv; - - sdev_priv = sdev->hostdata; - sdev_priv->block = false; - scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); - sdev_printk(KERN_WARNING, sdev, "%s: ublk hdl 0x%04x\n", - __func__, sdev_priv->starget_priv->hdl); -} - -static void leapraid_ublk_io_dev_to_running( - struct leapraid_adapter *adapter, u64 sas_addr, - struct leapraid_card_port *card_port) -{ - struct leapraid_sdev_priv *sdev_priv; - struct scsi_device *sdev; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->sas_address != sas_addr || - sdev_priv->starget_priv->card_port != card_port) - continue; - - if (sdev_priv->block) - leapraid_internal_ublk_io_dev_to_running(sdev); - } -} - static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_addr, struct leapraid_card_port *card_port) @@ -2972,15 +3576,15 @@ static void leapraid_ublk_io_all_dev(struct leapraid_adapter *adapter) } } -static void __maybe_unused leapraid_internal_dev_blk( +static void leapraid_internal_dev_blk( struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; - sdev_printk(KERN_INFO, sdev, "internal blkg hdl 0x%04x\n", + sdev_printk(KERN_INFO, sdev, "Internal blkg hdl 0x%04x\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc == -EINVAL) sdev_printk(KERN_WARNING, sdev, @@ -2988,42 +3592,6 @@ static void __maybe_unused leapraid_internal_dev_blk( rc, sdev_priv->starget_priv->hdl); } -static void __maybe_unused leapraid_blkio_dev(struct leapraid_adapter *adapter, - u16 hdl) -{ - struct leapraid_sdev_priv *sdev_priv; - struct leapraid_sas_dev *sas_dev; - struct scsi_device *sdev; - - sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->hdl != hdl) - continue; - - if (sdev_priv->block) - continue; - - if (sas_dev && sas_dev->pend_sas_rphy_add) - continue; - - if (sdev_priv->sep) { - sdev_printk(KERN_INFO, sdev, - "sep hdl 0x%04x skip blkg\n", - sdev_priv->starget_priv->hdl); - continue; - } - - leapraid_internal_dev_blk(sdev, sdev_priv); - } - - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { @@ -3055,8 +3623,7 @@ static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, if (sdev_priv->sep) { sdev_printk(KERN_INFO, sdev, - "%s skip dev blk for sep hdl 0x%04x\n", - __func__, + "skip dev blk: sep hdl 0x%04x\n", sdev_priv->starget_priv->hdl); continue; } @@ -3077,10 +3644,8 @@ static void leapraid_imm_blkio_set_end_dev_blk_hdls( list_for_each_entry(sas_port, &topo_node_exp->sas_port_list, port_list) { - if (sas_port->remote_identify.device_type == - SAS_END_DEVICE) { + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) leapraid_imm_blkio_to_end_dev(adapter, sas_port); - } } } @@ -3102,7 +3667,7 @@ static void leapraid_imm_blkio_to_sib_exp( sas_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) { topo_node_exp_sib = - leapraid_exp_find_by_sas_address( + leapraid_exp_find_by_sas_address( adapter, sas_port->remote_identify.sas_address, sas_port->card_port); @@ -3141,17 +3706,15 @@ static void leapraid_report_sdev_directly(struct leapraid_adapter *adapter, if (!sas_dev->starget) { if (!adapter->scan_dev_desc.driver_loading) { - leapraid_transport_port_remove(adapter, - sas_dev->sas_addr, - sas_dev->parent_sas_addr, - sas_dev->card_port); + leapraid_transport_port_remove( + adapter, + sas_dev->sas_addr, + sas_dev->parent_sas_addr, + sas_dev->card_port); leapraid_sas_dev_remove(adapter, sas_dev); } return; } - - clear_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); } static struct leapraid_sas_dev *leapraid_init_sas_dev( @@ -3162,6 +3725,7 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( { struct leapraid_sas_dev *sas_dev; struct leapraid_enc_node *enc_dev; + unsigned long flags; sas_dev = kzalloc(sizeof(*sas_dev), GFP_KERNEL); if (!sas_dev) @@ -3176,28 +3740,32 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->phy = sas_dev_pg0->phy_num; sas_dev->enc_hdl = le16_to_cpu(sas_dev_pg0->enc_hdl); sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); - sas_dev->port_type = sas_dev_pg0->max_port_connections; + sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; - memcpy(sas_dev->connector_name, sas_dev_pg0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; + memcpy(sas_dev->connector_name, + sas_dev_pg0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = + '\0'; } else { sas_dev->enc_level = 0; sas_dev->connector_name[0] = '\0'; } - if (le16_to_cpu(sas_dev_pg0->enc_hdl)) { - enc_dev = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu(sas_dev_pg0->enc_hdl)); - sas_dev->enc_lid = enc_dev ? - le64_to_cpu(enc_dev->pg0.enc_lid) : 0; + if (sas_dev->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_dev = leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); + if (enc_dev) + sas_dev->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } dev_info(&adapter->pdev->dev, - "add dev: hdl=0x%0x, sas addr=0x%016llx, port_type=0x%0x\n", - hdl, sas_dev->sas_addr, sas_dev->port_type); + "add dev: hdl=0x%x, SAS addr=0x%016llx, port connect=0x%x\n", + hdl, sas_dev->sas_addr, sas_dev->port_connection); return sas_dev; } @@ -3217,15 +3785,14 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, - cfgp1, cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, + cfgp1, cfgp2, GET_SAS_DEVICE_PG0)) return; dev_info = le32_to_cpu(sas_dev_pg0.dev_info); if (!(leapraid_is_end_dev(dev_info))) return; - set_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); sas_addr = le64_to_cpu(sas_dev_pg0.sas_address); if (!(le16_to_cpu(sas_dev_pg0.flg) & LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) @@ -3238,8 +3805,6 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_get_sas_dev_by_addr(adapter, sas_addr, card_port); if (sas_dev) { - clear_bit(hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); leapraid_sdev_put(sas_dev); return; } @@ -3254,6 +3819,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) dev_info); if (!sas_dev) return; + if (adapter->scan_dev_desc.wait_scan_dev_done) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); leapraid_sdev_get(sas_dev); @@ -3268,6 +3834,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_report_sdev_directly(adapter, sas_dev); } + leapraid_sdev_put(sas_dev); } static void leapraid_remove_device(struct leapraid_adapter *adapter, @@ -3275,14 +3842,15 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, { struct leapraid_starget_priv *starget_priv; + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); if (sas_dev->led_on) { leapraid_set_led(adapter, sas_dev, false); - sas_dev->led_on = false; + sas_dev->led_on = 0; } if (sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; leapraid_ublk_io_dev(adapter, sas_dev->sas_addr, sas_dev->card_port); starget_priv->hdl = LEAPRAID_INVALID_DEV_HANDLE; @@ -3294,12 +3862,13 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, sas_dev->card_port); dev_info(&adapter->pdev->dev, - "remove dev: hdl=0x%04x, sas addr=0x%016llx\n", + "remove dev: hdl=0x%04x, SAS addr=0x%016llx\n", sas_dev->hdl, (unsigned long long)sas_dev->sas_addr); } -static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapter, - u8 port_id, u8 phy_num) +static struct leapraid_vphy *leapraid_alloc_vphy( + struct leapraid_adapter *adapter, + u8 port_id, u8 phy_num) { struct leapraid_card_port *port; struct leapraid_vphy *vphy; @@ -3311,7 +3880,6 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte vphy = leapraid_get_vphy_by_phy(port, phy_num); if (vphy) return vphy; - vphy = kzalloc(sizeof(*vphy), GFP_KERNEL); if (!vphy) return NULL; @@ -3325,46 +3893,157 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte return vphy; } -static int leapraid_add_port_to_card_port_list(struct leapraid_adapter *adapter, - u8 port_id, bool refresh) +static int leapraid_add_port_to_card_port_list( + struct leapraid_adapter *adapter, + u8 port_id, bool refresh) { struct leapraid_card_port *card_port; card_port = leapraid_get_port_by_id(adapter, port_id, false); if (card_port) return 0; - card_port = kzalloc(sizeof(*card_port), GFP_KERNEL); if (!card_port) return -ENOMEM; card_port->port_id = port_id; - dev_info(&adapter->pdev->dev, - "port: %d is added to card_port list\n", - card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "port: %d is added to card_port list\n", + card_port->port_id); - if (refresh) - if (adapter->access_ctrl.shost_recovering) - card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; + if (refresh && adapter->access_ctrl.shost_recovering) + card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; list_add_tail(&card_port->list, &adapter->dev_topo.card_port_list); return 0; } +static int leapraid_add_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + struct leapraid_topo_node *card = &adapter->dev_topo.card; + u8 port_id; + + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return -EINVAL; + + port_id = iou->phy_info[i].port; + + if (leapraid_add_port_to_card_port_list(adapter, port_id, false)) + return -EINVAL; + + if ((le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY) && + ((phy_pg0.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) >= + LEAPRAID_SAS_NEG_LINK_RATE_1_5)) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + card->card_phy[i].phy_id = i; + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + + return 0; +} + +static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_topo_node *card = &adapter->dev_topo.card; + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + u16 attached_hdl; + u32 dev_info; + u8 link_rate; + u8 port_id; + + link_rate = iou->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; + port_id = iou->phy_info[i].port; + if (leapraid_add_port_to_card_port_list(adapter, port_id, true)) + return -EINVAL; + + dev_info = le32_to_cpu(iou->phy_info[i].controller_phy_dev_info); + if (dev_info & LEAPRAID_DEVTYP_SEP && + link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + if (le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY && + !leapraid_alloc_vphy(adapter, port_id, i)) + return -EINVAL; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + + attached_hdl = le16_to_cpu(iou->phy_info[i].attached_dev_hdl); + if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; + + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + if (!card->card_phy[i].phy) { + cfgp1.phy_number = i; + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + card->card_phy[i].phy_id = i; + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + return 0; + } + + leapraid_transport_update_links(adapter, + card->sas_address, + attached_hdl, + i, + link_rate, + card->card_phy[i].card_port); + + return 0; +} + static void leapraid_sas_host_add(struct leapraid_adapter *adapter, bool refresh) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_phy_p0 phy_pg0; struct leapraid_sas_dev_p0 sas_dev_pg0; struct leapraid_enc_p0 enc_pg0; struct leapraid_sas_io_unit_p0 *sas_iou_pg0; u16 sas_iou_pg0_sz; - u16 attached_hdl; u8 phys_num; - u8 port_id; - u8 link_rate; int i; + int rc; if (!refresh) { if (leapraid_get_adapter_phys(adapter, &phys_num) || !phys_num) @@ -3379,128 +4058,46 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, adapter->dev_topo.card.phys_num = phys_num; } - sas_iou_pg0_sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + - (adapter->dev_topo.card.phys_num * - sizeof(struct leapraid_sas_io_unit0_phy_info)); + sas_iou_pg0_sz = + offsetof(struct leapraid_sas_io_unit_p0, phy_info) + + (adapter->dev_topo.card.phys_num * + sizeof(struct leapraid_sas_io_unit0_phy_info)); sas_iou_pg0 = kzalloc(sas_iou_pg0_sz, GFP_KERNEL); if (!sas_iou_pg0) - goto out; + return; if (leapraid_get_sas_io_unit_page0(adapter, sas_iou_pg0, sas_iou_pg0_sz)) - goto out; + goto out_free; adapter->dev_topo.card.parent_dev = &adapter->shost->shost_gendev; adapter->dev_topo.card.hdl = le16_to_cpu(sas_iou_pg0->phy_info[0].controller_dev_hdl); for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if (!refresh) { /* add */ - cfgp1.phy_number = i; - if (leapraid_op_config_page(adapter, &phy_pg0, cfgp1, - cfgp2, GET_PHY_PG0)) - goto out; - - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - false)) - goto out; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY) && - (phy_pg0.neg_link_rate >> 4) >= - LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - if (!leapraid_alloc_vphy(adapter, port_id, i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - adapter->dev_topo.card.card_phy[i].phy_id = i; - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - leapraid_transport_add_card_phy( - adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, adapter->dev_topo.card.parent_dev); - } else { /* refresh */ - link_rate = sas_iou_pg0->phy_info[i].neg_link_rate >> 4; - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - true)) - goto out; - - if (le32_to_cpu(sas_iou_pg0->phy_info[i] - .controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP && - link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY)) { - if (!leapraid_alloc_vphy(adapter, - port_id, - i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - attached_hdl = - le16_to_cpu(sas_iou_pg0->phy_info[i].attached_dev_hdl); - if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; - - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - if (!adapter->dev_topo.card.card_phy[i].phy) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - adapter->dev_topo.card.card_phy[i].phy_id = i; - leapraid_transport_add_card_phy(adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, - adapter->dev_topo.card.parent_dev); - continue; - } - - leapraid_transport_update_links(adapter, - adapter->dev_topo.card.sas_address, - attached_hdl, i, link_rate, - adapter->dev_topo.card.card_phy[i].card_port); - } + if (!refresh) /* add */ + rc = leapraid_add_card_phy(adapter, sas_iou_pg0, i); + else /* refresh */ + rc = leapraid_refresh_card_phy(adapter, + sas_iou_pg0, + i); + if (rc) + goto out_free; } if (!refresh) { cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = adapter->dev_topo.card.hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) - goto out; + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) + goto out_free; adapter->dev_topo.card.enc_hdl = le16_to_cpu(sas_dev_pg0.enc_hdl); adapter->dev_topo.card.sas_address = le64_to_cpu(sas_dev_pg0.sas_address); dev_info(&adapter->pdev->dev, - "add host: devhdl=0x%04x, sas addr=0x%016llx, phynums=%d\n", + "add host: hdl=0x%04x, SAS addr=0x%016llx, phy=%d\n", adapter->dev_topo.card.hdl, (unsigned long long)adapter->dev_topo.card.sas_address, adapter->dev_topo.card.phys_num); @@ -3515,7 +4112,7 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, le64_to_cpu(enc_pg0.enc_lid); } } -out: +out_free: kfree(sas_iou_pg0); } @@ -3529,22 +4126,24 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port = NULL; struct leapraid_enc_node *enc_dev; struct leapraid_exp_p1 exp_pg1; - int rc = 0; + int ret; + int rc; unsigned long flags; u8 port_id; u16 parent_handle; - u64 sas_addr_parent = 0; + u64 sas_addr_parent; int i; port_id = exp_pg0->physical_port; parent_handle = le16_to_cpu(exp_pg0->parent_dev_hdl); - if (leapraid_get_sas_address(adapter, parent_handle, &sas_addr_parent)) - return -1; - + rc = leapraid_get_sas_address(adapter, + parent_handle, &sas_addr_parent); + if (rc) + return rc; topo_node_exp = kzalloc(sizeof(*topo_node_exp), GFP_KERNEL); if (!topo_node_exp) - return -1; + return -ENOMEM; topo_node_exp->hdl = hdl; topo_node_exp->phys_num = exp_pg0->phy_num; @@ -3553,17 +4152,19 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->card_port = leapraid_get_port_by_id(adapter, port_id, false); if (!topo_node_exp->card_port) { - rc = -1; + rc = -EPERM; goto out_fail; } dev_info(&adapter->pdev->dev, - "add exp: sas addr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phys=%d\n", + "add exp: saddr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phy=%d\n", (unsigned long long)topo_node_exp->sas_address, hdl, parent_handle, topo_node_exp->phys_num); if (!topo_node_exp->phys_num) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Invalid PHY num from exp_pg0\n", __func__); + rc = -EPERM; goto out_fail; } @@ -3571,7 +4172,10 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, kcalloc(topo_node_exp->phys_num, sizeof(struct leapraid_card_phy), GFP_KERNEL); if (!topo_node_exp->card_phy) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Failed to alloc expander phy array, count=%u\n", + __func__, topo_node_exp->phys_num); + rc = -EPERM; goto out_fail; } @@ -3579,7 +4183,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, sas_port = leapraid_transport_port_add(adapter, hdl, sas_addr_parent, topo_node_exp->card_port); if (!sas_port) { - rc = -1; + rc = -EPERM; goto out_fail; } @@ -3588,31 +4192,38 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1->phy_number = i; cfgp2->handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, - GET_SAS_EXPANDER_PG1))) { - rc = -1; + if (leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, + GET_SAS_EXPANDER_PG1)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to get exp_pg1, phy=%d\n", + __func__, i); + rc = -EPERM; goto out_fail; } topo_node_exp->card_phy[i].hdl = hdl; topo_node_exp->card_phy[i].phy_id = i; topo_node_exp->card_phy[i].card_port = - leapraid_get_port_by_id(adapter, port_id, false); - if ((leapraid_transport_add_exp_phy(adapter, - &topo_node_exp->card_phy[i], - &exp_pg1, - topo_node_exp->parent_dev))) { - rc = -1; + leapraid_get_port_by_id(adapter, port_id, false); + ret = leapraid_transport_add_exp_phy( + adapter, + &topo_node_exp->card_phy[i], + &exp_pg1, + topo_node_exp->parent_dev); + if (ret) { + rc = -EPERM; goto out_fail; } } if (topo_node_exp->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); enc_dev = leapraid_enc_find_by_hdl(adapter, topo_node_exp->enc_hdl); if (enc_dev) topo_node_exp->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3626,6 +4237,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->sas_address, sas_addr_parent, topo_node_exp->card_port); + kfree(topo_node_exp->card_phy); kfree(topo_node_exp); return rc; } @@ -3637,22 +4249,29 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) struct leapraid_topo_node *topo_node_exp; struct leapraid_exp_p0 exp_pg0; u16 parent_handle; - u64 sas_addr, sas_addr_parent = 0; + u64 sas_addr, sas_addr_parent; unsigned long flags; u8 port_id; - int rc = 0; + int rc; - if (!hdl) + if (!hdl) { + dev_warn(&adapter->pdev->dev, "%s: Invalid hdl\n", __func__); return -EPERM; + } if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EPERM; + } cfgp1.form = LEAPRAID_SAS_EXP_CFD_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG0))) + if (leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG0)) return -EPERM; parent_handle = le16_to_cpu(exp_pg0.parent_dev_hdl); @@ -3663,10 +4282,14 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) if (sas_addr_parent != adapter->dev_topo.card.sas_address) { spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, sas_addr_parent, - leapraid_get_port_by_id(adapter, port_id, false)); - spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); + leapraid_get_port_by_id(adapter, + port_id, + false)); + spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, + flags); if (!topo_node_exp) { rc = leapraid_exp_add(adapter, parent_handle); if (rc != 0) @@ -3677,7 +4300,9 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); sas_addr = le64_to_cpu(exp_pg0.sas_address); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, sas_addr, + leapraid_exp_find_by_sas_address( + adapter, + sas_addr, leapraid_get_port_by_id(adapter, port_id, false)); spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -3725,7 +4350,7 @@ static void leapraid_exp_node_rm(struct leapraid_adapter *adapter, topo_node_exp->sas_address_parent, topo_node_exp->card_port); dev_info(&adapter->pdev->dev, - "removing exp: port=%d, sas addr=0x%016llx, hdl=0x%04x\n", + "removing exp: port=%d, SAS addr=0x%016llx, hdl=0x%04x\n", port_id, (unsigned long long)topo_node_exp->sas_address, topo_node_exp->hdl); spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3757,92 +4382,6 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static void leapraid_check_device(struct leapraid_adapter *adapter, - u64 parent_sas_address, u16 handle, - u8 phy_number, u8 link_rate) -{ - struct leapraid_sas_dev_p0 sas_device_pg0; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_enc_node *enclosure_dev = NULL; - union cfg_param_1 cfgp1 = {0}; - union cfg_param_2 cfgp2 = {0}; - unsigned long flags; - u64 sas_address; - struct scsi_target *starget; - struct leapraid_starget_priv *sas_target_priv_data; - u32 device_info; - struct leapraid_card_port *port; - - cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; - cfgp2.handle = handle; - if ((leapraid_op_config_page(adapter, &sas_device_pg0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) - return; - - if (phy_number != sas_device_pg0.phy_num) - return; - - device_info = le32_to_cpu(sas_device_pg0.dev_info); - if (!(leapraid_is_end_dev(device_info))) - return; - - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_address = le64_to_cpu(sas_device_pg0.sas_address); - port = leapraid_get_port_by_id(adapter, sas_device_pg0.physical_port, - false); - if (!port) - goto out_unlock; - - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, - port); - if (!sas_dev) - goto out_unlock; - - if (unlikely(sas_dev->hdl != handle)) { - starget = sas_dev->starget; - sas_target_priv_data = starget->hostdata; - starget_printk(KERN_INFO, starget, - "hdl changed from 0x%04x to 0x%04x!\n", - sas_dev->hdl, handle); - sas_target_priv_data->hdl = handle; - sas_dev->hdl = handle; - if (le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = - sas_device_pg0.enc_level; - memcpy(sas_dev->connector_name, - sas_device_pg0.connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } - sas_dev->enc_hdl = - le16_to_cpu(sas_device_pg0.enc_hdl); - enclosure_dev = - leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); - if (enclosure_dev) { - sas_dev->enc_lid = - le64_to_cpu(enclosure_dev->pg0.enc_lid); - } - } - - if (!(le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) - goto out_unlock; - - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - - leapraid_ublk_io_dev_to_running(adapter, sas_address, port); - goto out; - -out_unlock: - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); -out: - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static int leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, @@ -3851,10 +4390,8 @@ static int leapraid_internal_sas_topo_chg_evt( u64 sas_addr, u8 max_phys) { struct leapraid_evt_data_sas_topo_change_list *evt_data; - struct leapraid_sas_dev *sas_dev; - unsigned long flags; u8 phy_number; - u8 link_rate, prev_link_rate; + u8 link_rate; u16 reason_code; u16 hdl; int i; @@ -3876,47 +4413,15 @@ static int leapraid_internal_sas_topo_chg_evt( LEAPRAID_EVT_SAS_TOPO_RC_MASK; hdl = le16_to_cpu(evt_data->phy[i].attached_dev_hdl); - if (!hdl) + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); continue; - - link_rate = evt_data->phy[i].link_rate >> 4; - prev_link_rate = evt_data->phy[i].link_rate & 0xF; + } + link_rate = evt_data->phy[i].link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; switch (reason_code) { - case LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED: - if (adapter->access_ctrl.shost_recovering) - break; - - if (link_rate == prev_link_rate) - break; - - leapraid_transport_update_links(adapter, sas_addr, - hdl, phy_number, - link_rate, card_port); - if (link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - break; - - leapraid_check_device(adapter, sas_addr, hdl, - phy_number, link_rate); - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, - flags); - sas_dev = - leapraid_hold_lock_get_sas_dev_by_hdl( - adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, - flags); - if (sas_dev) { - leapraid_sdev_put(sas_dev); - break; - } - if (!test_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add)) - break; - - evt_data->phy[i].phy_status &= - LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK; - evt_data->phy[i].phy_status |= - LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED; - fallthrough; - case LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED: if (adapter->access_ctrl.shost_recovering) break; @@ -3957,7 +4462,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, return 0; evt_data = fw_evt->evt_data; - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) return 0; @@ -3966,9 +4471,9 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, card_port = leapraid_get_port_by_id(adapter, evt_data->physical_port, false); - if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED) - if (leapraid_exp_add(adapter, phdl) != 0) - return 0; + if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && + leapraid_exp_add(adapter, phdl) != 0) + return 0; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -3995,12 +4500,13 @@ static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) { sdev->no_uld_attach = no_uld_attach ? 1 : 0; sdev_printk(KERN_INFO, sdev, - "%s raid component to upper layer\n", + "%s RAID component to upper layer\n", sdev->no_uld_attach ? "hide" : "expose"); WARN_ON(scsi_device_reprobe(sdev)); } -static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { union cfg_param_1 cfgp1 = {0}; @@ -4012,20 +4518,26 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + + set_bit(hdl, adapter->dev_topo.pd_hdls); sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev) { leapraid_sdev_put(sas_dev); dev_warn(&adapter->pdev->dev, - "dev handle 0x%x already exists\n", hdl); + "Dev handle 0x%x already exists\n", hdl); return; } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) { - dev_warn(&adapter->pdev->dev, "failed to read dev page0\n"); + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, + GET_SAS_DEVICE_PG0)) { + dev_warn(&adapter->pdev->dev, "Failed to read dev page0\n"); return; } @@ -4040,7 +4552,8 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, leapraid_add_dev(adapter, hdl); } -static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_delete( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 hdl; @@ -4049,7 +4562,8 @@ static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, leapraid_sas_dev_remove_by_hdl(adapter, hdl); } -static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_hide( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_starget_priv *starget_priv; @@ -4057,10 +4571,15 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev; unsigned long flags; u64 volume_wwid = 0; - u16 volume_hdl = 0; + u16 volume_hdl; u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } leapraid_cfg_get_volume_hdl(adapter, hdl, &volume_hdl); if (volume_hdl) leapraid_cfg_get_volume_wwid(adapter, @@ -4074,21 +4593,23 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, return; } - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + set_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; sas_dev->volume_hdl = volume_hdl; sas_dev->volume_wwid = volume_wwid; - leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - (void *)1, leapraid_reprobe_lun); + (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } static void leapraid_sas_pd_expose( @@ -4103,11 +4624,17 @@ static void leapraid_sas_pd_expose( hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { dev_warn(&adapter->pdev->dev, - "%s:%d: sas_dev not found， hdl=0x%x\n", + "%s:%d: sas_dev not found, hdl=0x%x\n", __func__, __LINE__, hdl); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); return; @@ -4115,84 +4642,100 @@ static void leapraid_sas_pd_expose( sas_dev->volume_hdl = 0; sas_dev->volume_wwid = 0; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + clear_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg &= ~LEAPRAID_TGT_FLG_RAID_MEMBER; - sas_dev->led_on = false; - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "expose sas_dev, hdl=0x%x\n", hdl); - starget_for_each_device(starget, NULL, leapraid_reprobe_lun); + starget_for_each_device(starget, + LEAPRAID_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } -static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, +static void leapraid_sas_vol_visibility( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { - struct leapraid_raid_volume *raid_volume = NULL; - struct scsi_device *sdev = NULL; - u16 hdl = 0; + struct leapraid_raid_volume *raid_volume; + struct scsi_device *sdev; + bool reprobe_flg = false; + bool sdev_held = false; unsigned long flags; - u8 rc = 0; - u8 reprobe_flg = 0; + u16 hdl; + u8 rc; hdl = le16_to_cpu(evt_data->vol_dev_hdl); rc = evt_data->reason_code; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + sdev = raid_volume->sdev; + if (!sdev) { spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x has no sdev\n", __func__, __LINE__, hdl); return; } - reprobe_flg = 0; - sdev = raid_volume->sdev; - if (sdev) { - if (sdev->no_uld_attach) { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { - sdev->no_uld_attach = 0; - reprobe_flg = 1; - } - } else { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { - sdev->no_uld_attach = 1; - reprobe_flg = 1; - } - } + if (sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = true; + } else if (!sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = true; + } - if (reprobe_flg) { - if (sdev->no_uld_attach) - sdev_printk(KERN_INFO, sdev, "hide vol\n"); - else - sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + if (reprobe_flg && !scsi_device_get(sdev)) + sdev_held = true; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); - WARN_ON(scsi_device_reprobe(sdev)); - } else { - dev_warn(&adapter->pdev->dev, - "%s:rc(0x%x):request matches, skipping.\n", - __func__, rc); - } + if (!reprobe_flg) { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x): Request matches, skipping\n", + __func__, rc); + return; + } - } else { + if (!sdev_held) { dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x has no sdev\n", - __func__, __LINE__, hdl); + "%s: Failed to hold sdev for reprobe, hdl=0x%x\n", + __func__, hdl); + return; } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + scsi_device_put(sdev); } -static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, +static void leapraid_sas_volume_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_raid_volume *raid_volume; @@ -4203,23 +4746,21 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, hdl = le16_to_cpu(evt_data->vol_dev_hdl); if (leapraid_cfg_get_volume_wwid(adapter, hdl, &wwid)) { - dev_warn(&adapter->pdev->dev, "failed to read volume page1\n"); + dev_warn(&adapter->pdev->dev, "Failed to read volume page1\n"); return; } if (!wwid) { - dev_warn(&adapter->pdev->dev, "invalid WWID(handle=0x%x)\n", + dev_warn(&adapter->pdev->dev, "Invalid WWID(handle=0x%x)\n", hdl); return; } - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - if (raid_volume) { dev_warn(&adapter->pdev->dev, - "volume handle 0x%x already exists\n", hdl); + "Volume handle 0x%x already exists\n", hdl); + leapraid_raid_volume_put(raid_volume); return; } @@ -4227,6 +4768,8 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, if (!raid_volume) return; + INIT_LIST_HEAD(&raid_volume->list); + kref_init(&raid_volume->refcnt); raid_volume->id = adapter->dev_topo.sas_id++; raid_volume->channel = RAID_CHANNEL; raid_volume->hdl = hdl; @@ -4237,52 +4780,67 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); dev_info(&adapter->pdev->dev, - "add raid volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); + "add RAID volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); } else { spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); leapraid_check_boot_dev(adapter, raid_volume, RAID_CHANNEL); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } + leapraid_raid_volume_put(raid_volume); } - -static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, - u16 hdl) + +static void leapraid_sas_volume_delete_by_ptr( + struct leapraid_adapter *adapter, + struct leapraid_raid_volume *raid_volume) { struct leapraid_starget_priv *starget_priv; - struct leapraid_raid_volume *raid_volume; struct scsi_target *starget = NULL; unsigned long flags; + bool in_list; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - if (!raid_volume) { - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", - __func__, __LINE__, hdl); + if (!raid_volume) return; - } - if (raid_volume->starget) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + in_list = !list_empty(&raid_volume->list); + if (in_list && raid_volume->starget) { starget = raid_volume->starget; starget_priv = starget->hostdata; - starget_priv->deleted = true; + if (starget_priv) + starget_priv->deleted = 1; } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + if (!in_list) + return; dev_info(&adapter->pdev->dev, - "delete raid volume: hdl=0x%x, wwid=0x%llx\n", + "delete RAID volume: hdl=0x%x, wwid=0x%llx\n", raid_volume->hdl, raid_volume->wwid); - list_del(&raid_volume->list); - kfree(raid_volume); - - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_remove(adapter, raid_volume); if (starget) scsi_remove_target(&starget->dev); } +static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, + u16 hdl) +{ + struct leapraid_raid_volume *raid_volume; + + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); + leapraid_raid_volume_put(raid_volume); +} + static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { @@ -4324,7 +4882,9 @@ static void leapraid_sas_enc_dev_stat_add_node( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_enc_node *enc_node = NULL; + struct leapraid_enc_node *enc_node; + struct leapraid_enc_node *enc_exist; + unsigned long flags; int rc; enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); @@ -4339,16 +4899,33 @@ static void leapraid_sas_enc_dev_stat_add_node( kfree(enc_node); return; } + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_exist = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_exist) { + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); + return; + } list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } static void leapraid_sas_enc_dev_stat_del_node( - struct leapraid_enc_node *enc_node) + struct leapraid_adapter *adapter, u16 hdl) { - if (!enc_node) + struct leapraid_enc_node *enc_node; + unsigned long flags; + + if (!hdl) return; - list_del(&enc_node->list); + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_node = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_node) + list_del(&enc_node->list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); } @@ -4356,7 +4933,6 @@ static void leapraid_sas_enc_dev_stat_chg_evt( struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { - struct leapraid_enc_node *enc_node = NULL; struct leapraid_evt_data_sas_enc_dev_status_change *evt_data; u16 enc_hdl; @@ -4365,15 +4941,13 @@ static void leapraid_sas_enc_dev_stat_chg_evt( evt_data = fw_evt->evt_data; enc_hdl = le16_to_cpu(evt_data->enc_hdl); - if (enc_hdl) - enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); switch (evt_data->reason_code) { case LEAPRAID_EVT_SAS_ENCL_RC_ADDED: - if (!enc_node) + if (enc_hdl) leapraid_sas_enc_dev_stat_add_node(adapter, enc_hdl); break; case LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING: - leapraid_sas_enc_dev_stat_del_node(enc_node); + leapraid_sas_enc_dev_stat_del_node(adapter, enc_hdl); break; default: break; @@ -4390,7 +4964,11 @@ static void leapraid_remove_unresp_sas_end_dev( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry_safe(sas_dev, sas_dev_next, &adapter->dev_topo.sas_dev_init_list, list) { + if (sas_dev->rphy || sas_dev->pend_sas_rphy_add) + continue; + list_del_init(&sas_dev->list); + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); } list_for_each_entry_safe(sas_dev, sas_dev_next, @@ -4398,7 +4976,7 @@ static void leapraid_remove_unresp_sas_end_dev( if (!sas_dev->resp) list_move_tail(&sas_dev->list, &head); else - sas_dev->resp = false; + sas_dev->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -4409,23 +4987,32 @@ static void leapraid_remove_unresp_sas_end_dev( } dev_info(&adapter->pdev->dev, - "unresponding sas end devices removed\n"); + "Unresponsive SAS end devices removed\n"); } static void leapraid_remove_unresp_raid_volumes( struct leapraid_adapter *adapter) { + unsigned long flags; struct leapraid_raid_volume *raid_volume, *raid_volume_next; + LIST_HEAD(head); + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry_safe(raid_volume, raid_volume_next, &adapter->dev_topo.raid_volume_list, list) { if (!raid_volume->resp) - leapraid_sas_volume_delete(adapter, raid_volume->hdl); + list_move_tail(&raid_volume->list, &head); else - raid_volume->resp = false; + raid_volume->resp = 0; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, raid_volume_next, &head, list) { + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } + dev_info(&adapter->pdev->dev, - "unresponding raid volumes removed\n"); + "Unresponsive RAID volumes removed\n"); } static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) @@ -4440,7 +5027,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) if (!topo_node_exp->resp) list_move_tail(&topo_node_exp->list, &head); else - topo_node_exp->resp = false; + topo_node_exp->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -4449,7 +5036,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) leapraid_exp_node_rm(adapter, topo_node_exp); dev_info(&adapter->pdev->dev, - "unresponding sas expanders removed\n"); + "Unresponsive SAS expanders removed\n"); } static void leapraid_remove_unresp_dev(struct leapraid_adapter *adapter) @@ -4505,25 +5092,27 @@ static void leapraid_update_dev_qdepth(struct leapraid_adapter *adapter) { struct leapraid_sdev_priv *sdev_priv; struct leapraid_sas_dev *sas_dev; + struct leapraid_adapter_attr *attr; struct scsi_device *sdev; u16 qdepth; + attr = &adapter->adapter_attr; shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) continue; sas_dev = sdev_priv->starget_priv->sas_dev; if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) - qdepth = (sas_dev->port_type > 1) ? - adapter->adapter_attr.wideport_max_queue_depth : - adapter->adapter_attr.narrowport_max_queue_depth; + qdepth = (sas_dev->port_connection > 1) ? + attr->wideport_max_queue_depth : + attr->narrowport_max_queue_depth; else if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) - qdepth = adapter->adapter_attr.sata_max_queue_depth; + qdepth = attr->sata_max_queue_depth; else continue; - leapraid_adjust_sdev_queue_depth(sdev, qdepth); + leapraid_change_queue_depth(sdev, qdepth); } } @@ -4539,15 +5128,17 @@ static void leapraid_update_exp_links(struct leapraid_adapter *adapter, cfgp2.handle = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG1))) + if (leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG1)) return; - leapraid_transport_update_links(adapter, + leapraid_transport_update_links( + adapter, topo_node_exp->sas_address, le16_to_cpu(exp_p1.attached_dev_hdl), i, - exp_p1.neg_link_rate >> 4, + exp_p1.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT, topo_node_exp->card_port); } } @@ -4562,7 +5153,7 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "begin scanning expanders\n"); + dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4573,7 +5164,8 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) port_id = exp_p0.physical_port; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, le64_to_cpu(exp_p0.sas_address), leapraid_get_port_by_id(adapter, port_id, @@ -4587,14 +5179,14 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) leapraid_exp_add(adapter, hdl); dev_info(&adapter->pdev->dev, - "add exp: hdl=0x%04x, sas addr=0x%016llx\n", + "add exp: hdl=0x%04x, SAS addr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( exp_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "expanders scan complete\n"); + dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -4611,7 +5203,7 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "begin scanning phys disk\n"); + dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; @@ -4644,20 +5236,25 @@ static void leapraid_scan_phy_disks_after_reset( LEAPRAID_SAS_NEG_LINK_RATE_1_5, leapraid_get_port_by_id( adapter, port_id, false)); - set_bit(hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - - leapraid_add_dev(adapter, hdl); - - dev_info(&adapter->pdev->dev, - "add phys disk: hdl=0x%04x, sas addr=0x%016llx\n", - hdl, - (unsigned long long)le64_to_cpu( - sas_dev_p0.sas_address)); + if (!hdl || hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", + __func__); + } else { + set_bit(hdl, adapter->dev_topo.pd_hdls); + leapraid_add_dev(adapter, hdl); + + dev_info(&adapter->pdev->dev, + "add pd hdl=0x%04x saddr=0x%016llx\n", + hdl, + (unsigned long long)le64_to_cpu( + sas_dev_p0.sas_address)); + } } } - dev_info(&adapter->pdev->dev, "phys disk scan complete\n"); + dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -4667,10 +5264,9 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) union cfg_param_1 cfgp1_extra = {0}; union cfg_param_2 cfgp2_extra = {0}; struct leapraid_evt_data_ir_change evt_data; - static struct leapraid_raid_volume *raid_volume; + struct leapraid_raid_volume *raid_volume; struct leapraid_raidvol_p1 *vol_p1; struct leapraid_raidvol_p0 *vol_p0; - unsigned long flags; u16 hdl; vol_p0 = kzalloc(sizeof(*vol_p0), GFP_KERNEL); @@ -4683,21 +5279,20 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "begin scanning volumes\n"); + dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, cfgp2, GET_RAID_VOLUME_PG1); cfgp2.handle = hdl) { hdl = le16_to_cpu(vol_p1->dev_hdl); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid( adapter, le64_to_cpu(vol_p1->wwid)); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume) + if (raid_volume) { + leapraid_raid_volume_put(raid_volume); continue; + } cfgp1_extra.size = sizeof(struct leapraid_raidvol_p0); cfgp2_extra.handle = hdl; @@ -4722,7 +5317,7 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - dev_info(&adapter->pdev->dev, "volumes scan complete\n"); + dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -4736,7 +5331,7 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u8 port_id; dev_info(&adapter->pdev->dev, - "begin scanning sas end devices\n"); + "Begin scanning SAS end devices\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4744,6 +5339,13 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) GET_SAS_DEVICE_PG0); cfgp2.handle = hdl) { hdl = le16_to_cpu(sas_dev_p0.dev_hdl); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + continue; + } + if (!(leapraid_is_end_dev(le32_to_cpu(sas_dev_p0.dev_info)))) continue; @@ -4774,21 +5376,21 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) false)); leapraid_add_dev(adapter, hdl); dev_info(&adapter->pdev->dev, - "add sas dev: hdl=0x%04x, sas addr=0x%016llx\n", + "Add SAS dev: hdl=0x%04x, saddr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( sas_dev_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "sas end devices scan complete\n"); + dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "begin scanning devices\n"); + dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { leapraid_scan_phy_disks_after_reset(adapter); @@ -4796,11 +5398,13 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) } leapraid_scan_sas_dev_after_reset(adapter); - dev_info(&adapter->pdev->dev, "devices scan complete\n"); + dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) { + unsigned long flags; + leapraid_remove_unresp_dev(adapter); leapraid_del_dirty_vphy(adapter); leapraid_del_dirty_card_port(adapter); @@ -4809,6 +5413,10 @@ static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) if (adapter->scan_dev_desc.driver_loading) leapraid_scan_dev_done(adapter); + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + wake_up(&adapter->access_ctrl.shost_recover_wq); } static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, @@ -4817,15 +5425,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, { void *req; bool reset_flg = false; - int rc = 0; + int rc; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc(adapter, + req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.enc_cmd.inter_taskid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); @@ -4835,6 +5445,10 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: SEP command timeout, status=0x%x\n", + __func__, adapter->driver_cmds.enc_cmd.status); + leapraid_log_req_context(adapter, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -4843,17 +5457,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, } if (adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_REPLY_VALID) - memcpy(sep_rep, (void *)(&adapter->driver_cmds.enc_cmd.reply), + memcpy(sep_rep, &adapter->driver_cmds.enc_cmd.reply, sizeof(struct leapraid_sep_rep)); do_hard_reset: if (reset_flg) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; -out: +unlock: mutex_unlock(&adapter->driver_cmds.enc_cmd.mutex); return rc; } @@ -4872,8 +5486,9 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, sep_req.func = LEAPRAID_FUNC_SCSI_ENC_PROCESSOR; sep_req.act = LEAPRAID_SEP_REQ_ACT_WRITE_STATUS; if (on) { - sep_req.slot_status = - cpu_to_le32(LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); + u32 status = LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT; + + sep_req.slot_status = cpu_to_le32(status); sep_req.dev_hdl = cpu_to_le16(sas_dev->hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS; if (leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req)) { @@ -4881,52 +5496,75 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, return; } - sas_dev->led_on = true; - if (sep_rep.adapter_status) - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 1; + leapraid_sdev_put(sas_dev); } else { sep_req.slot_status = 0; sep_req.slot = cpu_to_le16(sas_dev->slot); sep_req.dev_hdl = 0; sep_req.enc_hdl = cpu_to_le16(sas_dev->enc_hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS; - if ((leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req))) { - leapraid_sdev_put(sas_dev); - return; - } + leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req); + } +} - if (sep_rep.adapter_status) { - leapraid_sdev_put(sas_dev); - return; +static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) +{ + unsigned long flags; + + while (scsi_host_in_recovery(adapter->shost) || + adapter->access_ctrl.shost_recovering) { + if (adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup) { + spin_lock_irqsave( + &adapter->reset_desc.adapter_reset_lock, + flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore( + &adapter->reset_desc.adapter_reset_lock, + flags); + + wake_up(&adapter->access_ctrl.shost_recover_wq); + + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost %d, host %d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.host_removing); + + return -EFAULT; } + + wait_event_timeout(adapter->access_ctrl.recovery_waitq, + !adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup, + msecs_to_jiffies(1000)); } + return 0; } static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { struct leapraid_sas_dev *sas_dev; + unsigned long flags; + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); adapter->fw_evt_s.cur_evt = fw_evt; + adapter->fw_evt_s.cur_evt_task = current; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_del_fw_evt_from_list(adapter, fw_evt); if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; } switch (fw_evt->evt_type) { - case LEAPRAID_EVT_SAS_DISCOVERY: - { - struct leapraid_evt_data_sas_disc *evt_data; - - evt_data = fw_evt->evt_data; - if (evt_data->reason_code == - LEAPRAID_EVT_SAS_DISC_RC_STARTED && - !adapter->dev_topo.card.phys_num) - leapraid_sas_host_add(adapter, 0); - break; - } case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: leapraid_sas_topo_chg_evt(adapter, fw_evt); break; @@ -4937,14 +5575,9 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_sas_enc_dev_stat_chg_evt(adapter, fw_evt); break; case LEAPRAID_EVT_REMOVE_DEAD_DEV: - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) - goto out; + if (leapraid_wait_adapter_recovery(adapter)) + goto out_cleanup; - ssleep(1); - } leapraid_hardreset_async_logic(adapter); break; case LEAPRAID_EVT_TURN_ON_PFA_LED: @@ -4953,14 +5586,17 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_set_led(adapter, sas_dev, true); break; case LEAPRAID_EVT_SCAN_DEV_DONE: - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; break; default: break; } -out: +out_cleanup: + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); } static void leapraid_sas_dev_stat_chg_evt( @@ -4968,7 +5604,7 @@ static void leapraid_sas_dev_stat_chg_evt( struct leapraid_evt_data_sas_dev_status_change *event_data) { struct leapraid_starget_priv *starget_priv; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; u64 sas_address; unsigned long flags; @@ -4983,26 +5619,29 @@ static void leapraid_sas_dev_stat_chg_evt( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_address = le64_to_cpu(event_data->sas_address); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, sas_address, leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (sas_dev && sas_dev->starget) { - starget_priv = sas_dev->starget->hostdata; - if (starget_priv) { - switch (event_data->reason_code) { - case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: - starget_priv->tm_busy = true; - break; - case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: - starget_priv->tm_busy = false; - break; - } + if (!sas_dev || !sas_dev->starget) + goto out_unlock; + + starget_priv = sas_dev->starget->hostdata; + if (starget_priv) { + switch (event_data->reason_code) { + case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 1; + break; + case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 0; + break; } } +out_unlock: if (sas_dev) leapraid_sdev_put(sas_dev); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -5015,32 +5654,45 @@ static void leapraid_set_volume_delete_flag(struct leapraid_adapter *adapter, struct leapraid_starget_priv *sas_target_priv_data; unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, handle); - if (raid_volume && raid_volume->starget && - raid_volume->starget->hostdata) { - sas_target_priv_data = raid_volume->starget->hostdata; - sas_target_priv_data->deleted = true; + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (raid_volume->starget && + raid_volume->starget->hostdata) { + sas_target_priv_data = raid_volume->starget->hostdata; + sas_target_priv_data->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } -static void leapraid_check_ir_change_evt(struct leapraid_adapter *adapter, +static void leapraid_check_ir_change_evt( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 phys_disk_dev_hdl; switch (evt_data->reason_code) { case LEAPRAID_EVT_IR_RC_VOLUME_DELETE: - leapraid_set_volume_delete_flag(adapter, - le16_to_cpu(evt_data->vol_dev_hdl)); + leapraid_set_volume_delete_flag( + adapter, + le16_to_cpu(evt_data->vol_dev_hdl)); break; case LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE: phys_disk_dev_hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - clear_bit(phys_disk_dev_hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + if (!phys_disk_dev_hdl || + phys_disk_dev_hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + } else { + clear_bit(phys_disk_dev_hdl, + adapter->dev_topo.pd_hdls); + leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + } break; } } @@ -5050,7 +5702,7 @@ static void leapraid_topo_del_evts_process_exp_status( struct leapraid_evt_data_sas_topo_change_list *evt_data) { struct leapraid_fw_evt_work *fw_evt = NULL; - struct leapraid_evt_data_sas_topo_change_list *loc_evt_data = NULL; + struct leapraid_evt_data_sas_topo_change_list *loc_evt_data; unsigned long flags; u16 exp_hdl; @@ -5081,7 +5733,8 @@ static void leapraid_topo_del_evts_process_exp_status( } } -static void leapraid_check_topo_del_evts(struct leapraid_adapter *adapter, +static void leapraid_check_topo_del_evts( + struct leapraid_adapter *adapter, struct leapraid_evt_data_sas_topo_change_list *evt_data) { int reason_code; @@ -5111,17 +5764,20 @@ static bool leapraid_async_process_evt( switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: - leapraid_sas_dev_stat_chg_evt(adapter, + leapraid_sas_dev_stat_chg_evt( + adapter, (struct leapraid_evt_data_sas_dev_status_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_IR_CHANGE: - leapraid_check_ir_change_evt(adapter, + leapraid_check_ir_change_evt( + adapter, (struct leapraid_evt_data_ir_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: - leapraid_check_topo_del_evts(adapter, + leapraid_check_topo_del_evts( + adapter, (struct leapraid_evt_data_sas_topo_change_list *)event_notify_rep->evt_data); if (adapter->access_ctrl.shost_recovering) { @@ -5129,7 +5785,6 @@ static bool leapraid_async_process_evt( return exit_flag; } break; - case LEAPRAID_EVT_SAS_DISCOVERY: case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: break; default: @@ -5151,7 +5806,7 @@ static void leapraid_async_evt_cb_enqueue( if (!fw_evt) return; - evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * 4; + evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * sizeof(u32); fw_evt->evt_data = kmemdup(evt_notify_rep->evt_data, evt_sz, GFP_ATOMIC); if (!fw_evt->evt_data) { @@ -5240,13 +5895,63 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, - u16 taskid, u8 msix_index, - u32 rep_paddr, u8 cb_idx) +static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) +{ + u16 status; + + cmd->status &= ~LEAPRAID_CMD_PENDING; + + status = le16_to_cpu(rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + + if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + adapter->scan_dev_desc.scan_dev_failed = 1; + + if (!cmd->async_scan_dev) { + complete(&cmd->done); + return 1; + } + + if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) + leapraid_scan_dev_complete(adapter); + else + adapter->scan_dev_desc.scan_start_failed = status; + + return 1; +} + +static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, + struct leapraid_rep *rep, + u16 taskid) +{ + struct leapraid_scsiio_rep *scsiio_reply; + + if (rep->function != LEAPRAID_FUNC_SCSIIO && + rep->function != LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH) + return; + + scsiio_reply = (struct leapraid_scsiio_rep *)rep; + + if (!(scsiio_reply->scsi_state & + LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) + return; + + memcpy(&adapter->driver_cmds.ctl_cmd.sense, + leapraid_get_sense_buffer(adapter, taskid), + min_t(u32, SCSI_SENSE_BUFFERSIZE, + le32_to_cpu(scsiio_reply->sense_count))); +} + +static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_index, + u32 rep_paddr, u8 cb_idx) { struct leapraid_rep *leap_mpi_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); struct leapraid_driver_cmd *sp_cmd, *_sp_cmd = NULL; + u8 reply_len; list_for_each_entry(sp_cmd, &adapter->driver_cmds.special_cmd_list, list) @@ -5256,74 +5961,55 @@ static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, } if (WARN_ON(!_sp_cmd)) - return 1; + return true; if (WARN_ON(_sp_cmd->status == LEAPRAID_CMD_NOT_USED)) - return 1; + return true; if (WARN_ON(taskid != _sp_cmd->hp_taskid && taskid != _sp_cmd->taskid && taskid != _sp_cmd->inter_taskid)) - return 1; - + return true; _sp_cmd->status |= LEAPRAID_CMD_DONE; if (leap_mpi_rep) { - memcpy((void *)(&_sp_cmd->reply), leap_mpi_rep, - leap_mpi_rep->msg_len * 4); + reply_len = leap_mpi_rep->msg_len * sizeof(u32); + if (reply_len > LEAPRAID_REPLY_SIZE) + reply_len = LEAPRAID_REPLY_SIZE; + memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { - u16 adapter_status; - - _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; - adapter_status = - le16_to_cpu(leap_mpi_rep->adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - adapter->scan_dev_desc.scan_dev_failed = true; - - if (_sp_cmd->async_scan_dev) { - if (adapter_status == - LEAPRAID_ADAPTER_STATUS_SUCCESS) { - leapraid_scan_dev_complete(adapter); - } else { - adapter->scan_dev_desc.scan_start_failed = - adapter_status; - } - return 1; - } - - complete(&_sp_cmd->done); - return 1; - } + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) + return leapraid_handle_scan_cb(adapter, + _sp_cmd, + leap_mpi_rep); - if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) { - struct leapraid_scsiio_rep *scsiio_reply; - - if (leap_mpi_rep->function == - LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_rep->function == - LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH) { - scsiio_reply = - (struct leapraid_scsiio_rep *)leap_mpi_rep; - if (scsiio_reply->scsi_state & - LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) - memcpy((void *)(&adapter->driver_cmds.ctl_cmd.sense), - leapraid_get_sense_buffer(adapter, taskid), - min_t(u32, - SCSI_SENSE_BUFFERSIZE, - le32_to_cpu(scsiio_reply->sense_count))); - } - } + if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) + leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); } _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; complete(&_sp_cmd->done); - return 1; + return true; +} + +static void leapraid_complete_task(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_idx, u32 rep) +{ + if (taskid <= adapter->shost->can_queue || + taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) + leapraid_free_taskid(adapter, taskid); + return; + } + + if (leapraid_driver_cmds_done(adapter, taskid, msix_idx, rep, + leapraid_get_cb_idx(adapter, taskid))) + leapraid_free_taskid(adapter, taskid); } -static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, - union leapraid_rep_desc_union *rpf, - u8 req_desc_type, u8 msix_idx) +static void leapraid_request_descript_handler( + struct leapraid_adapter *adapter, + union leapraid_rep_desc_union *rpf, + u8 req_desc_type, u8 msix_idx) { u32 rep; u16 taskid; @@ -5333,50 +6019,34 @@ static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, switch (req_desc_type) { case LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS: case LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS: - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, msix_idx, 0); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, 0, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } + leapraid_complete_task(adapter, taskid, msix_idx, 0); break; case LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY: rep = le32_to_cpu(rpf->addr_rep.rep_frame_addr); - if (rep > ((u32)adapter->mem_desc.rep_msg_dma + - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ) || - rep < ((u32)adapter->mem_desc.rep_msg_dma)) + if (rep > (u32)adapter->mem_desc.rep_msg_dma + + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE || + rep < (u32)adapter->mem_desc.rep_msg_dma) rep = 0; - if (taskid) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, - msix_idx, rep); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, rep, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } - } else { + + if (taskid) + leapraid_complete_task(adapter, taskid, msix_idx, rep); + else leapraid_handle_async_event(adapter, msix_idx, rep); - } - if (rep) { - adapter->rep_msg_host_idx = - (adapter->rep_msg_host_idx == - (adapter->adapter_attr.rep_msg_qd - 1)) ? - 0 : adapter->rep_msg_host_idx + 1; - adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = - cpu_to_le32(rep); - wmb(); /* Make sure that all write ops are in order */ - writel(adapter->rep_msg_host_idx, - &adapter->iomem_base->rep_msg_host_idx); - } + if (!rep) + return; + + adapter->rep_msg_host_idx = + (adapter->rep_msg_host_idx == + (adapter->adapter_attr.rep_msg_qd - 1)) ? + 0 : adapter->rep_msg_host_idx + 1; + adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = + cpu_to_le32(rep); + wmb(); /* Make sure that all write ops are in order */ + writel(adapter->rep_msg_host_idx, + &adapter->iomem_base->rep_msg_host_idx); + break; default: break; @@ -5438,8 +6108,8 @@ int leapraid_rep_queue_handler(struct leapraid_rq *rq) wmb(); /* Make sure that all write ops are in order */ writel(rq->rep_post_host_idx | ((msix_idx & LEAPRAID_MSIX_GROUP_MASK) << LEAPRAID_RPHI_MSIX_IDX_SHIFT), - &adapter->iomem_base->rep_post_reg_idx[msix_idx / - LEAPRAID_MSIX_GROUP_SIZE].idx); + &adapter->iomem_base->rep_post_reg_idx[ + msix_idx / LEAPRAID_MSIX_GROUP_SIZE].idx); atomic_dec(&rq->busy); return finish_cmds; } @@ -5456,7 +6126,7 @@ static irqreturn_t leapraid_irq_handler(int irq, void *bus_id) if (adapter->mask_int) return IRQ_NONE; - return ((leapraid_rep_queue_handler(rq) > 0) ? + return (leapraid_rep_queue_handler(rq) > 0 ? IRQ_HANDLED : IRQ_NONE); } @@ -5484,7 +6154,8 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) if (int_rq->rq.msix_idx == 0) continue; - synchronize_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx)); + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); if (poll) leapraid_rep_queue_handler(&int_rq->rq); } @@ -5506,16 +6177,18 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 1); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 1); for (qid = 0; qid < iopoll_q_count; qid++) { - while (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy)) { + while (atomic_read(&desc->blk_mq_poll_rqs[qid].busy)) { cpu_relax(); udelay(LEAPRAID_IO_POLL_DELAY_US); } @@ -5524,19 +6197,30 @@ void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) void leapraid_mq_polling_resume(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 0); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 0); } static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, u32 *host_diag) { - const u32 unlock_seq[] = { 0x0, 0xF, 0x4, 0xB, 0x2, 0x7, 0xD }; + const u32 unlock_seq[] = { + LEAPRAID_WRSEQ_FLUSH_KEY_VALUE, + LEAPRAID_WRSEQ_1ST_KEY_VALUE, + LEAPRAID_WRSEQ_2ND_KEY_VALUE, + LEAPRAID_WRSEQ_3RD_KEY_VALUE, + LEAPRAID_WRSEQ_4TH_KEY_VALUE, + LEAPRAID_WRSEQ_5TH_KEY_VALUE, + LEAPRAID_WRSEQ_6TH_KEY_VALUE + }; + const int max_retries = LEAPRAID_UNLOCK_RETRY_LIMIT; int retry = 0; unsigned int i; @@ -5553,51 +6237,46 @@ static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, return 0; } - dev_err(&adapter->pdev->dev, "try host reset timeout!\n"); + dev_err(&adapter->pdev->dev, "Try host reset timeout!\n"); return -EFAULT; } static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - u32 cnt; - dev_info(&adapter->pdev->dev, "entering host diag reset!\n"); + dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); if (leapraid_unlock_host_diag(adapter, &host_diag)) - goto out; + goto out_cleanup; writel(host_diag | LEAPRAID_DIAG_RESET, &adapter->iomem_base->host_diag); + msleep(LEAPRAID_MSLEEP_EXTRA_LONG_MS); msleep(LEAPRAID_MSLEEP_NORMAL_MS); - for (cnt = 0; cnt < LEAPRAID_RESET_LOOP_COUNT_DEFAULT; cnt++) { - host_diag = leapraid_readl(&adapter->iomem_base->host_diag); - if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL) - goto out; - if (!(host_diag & LEAPRAID_DIAG_RESET)) - break; - - msleep(LEAPRAID_RESET_POLL_INTERVAL_MS); - } + host_diag = leapraid_readl(&adapter->iomem_base->host_diag); + if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL || + host_diag & LEAPRAID_DIAG_RESET) + goto out_cleanup; - writel(host_diag & ~LEAPRAID_DIAG_HOLD_ADAPTER_RESET, - &adapter->iomem_base->host_diag); writel(0x0, &adapter->iomem_base->ws); mutex_unlock(&adapter->reset_desc.host_diag_mutex); if (!leapraid_wait_adapter_ready(adapter)) - goto out; + goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag success!\n"); + dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; -out: - pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag failed!\n"); + +out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); +out_failed: + pci_cfg_access_unlock(adapter->pdev); + dev_info(&adapter->pdev->dev, "Host diag failed!\n"); return -EFAULT; } @@ -5607,12 +6286,12 @@ static int leapraid_find_matching_port( { int i; - for (i = 0; i < count; i++) { + for (i = 0; i < count; i++) if (card_port_table[i].port_id == port_id && card_port_table[i].sas_address == sas_addr) return i; - } - return -1; + + return LEAPRAID_INVALID_INDEX; } static u8 leapraid_fill_card_port_table( @@ -5626,12 +6305,13 @@ static u8 leapraid_fill_card_port_table( int i, idx; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if ((sas_iounit_p0->phy_info[i].neg_link_rate >> 4) - < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + if (sas_iounit_p0->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < + LEAPRAID_SAS_NEG_LINK_RATE_1_5) continue; - attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + attached_hdl = le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) @@ -5663,7 +6343,7 @@ static u8 leapraid_set_new_card_port_table_after_reset( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; u8 port_entry_num = 0; u16 sz; @@ -5675,14 +6355,14 @@ static u8 leapraid_set_new_card_port_table_after_reset( return port_entry_num; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; port_entry_num = leapraid_fill_card_port_table(adapter, sas_iounit_p0, new_card_port_table); -out: +out_free: kfree(sas_iounit_p0); return port_entry_num; } @@ -5691,9 +6371,9 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, struct leapraid_card_port *new_table, int entry_idx, int port_entry_num) { - struct leapraid_card_port *matched_card_port = NULL; + struct leapraid_card_port *matched_card_port; int matched_code; - int count = 0, lcount = 0; + int count, lcount = 0; u64 sas_addr; int i; @@ -5714,10 +6394,10 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, port_entry_num); } else if (matched_code == SAME_ADDR_ONLY) { sas_addr = new_table[entry_idx].sas_address; - for (i = 0; i < port_entry_num; i++) { + for (i = 0; i < port_entry_num; i++) if (new_table[i].sas_address == sas_addr) lcount++; - } + if (count > 1 || lcount > 1) return; @@ -5739,15 +6419,24 @@ static void leapraid_update_card_port_after_reset( struct leapraid_adapter *adapter) { struct leapraid_card_port *new_card_port_table; - struct leapraid_card_port *matched_card_port = NULL; - u8 port_entry_num = 0; + struct leapraid_card_port *matched_card_port; + u8 port_entry_num; u8 nr_phys; int i; if (leapraid_get_adapter_phys(adapter, &nr_phys) || !nr_phys) return; + if (!adapter->dev_topo.card.card_phy) { + adapter->dev_topo.card.card_phy = + kcalloc(nr_phys, sizeof(struct leapraid_card_phy), + GFP_KERNEL); + if (!adapter->dev_topo.card.card_phy) + return; + } + adapter->dev_topo.card.phys_num = nr_phys; + new_card_port_table = kcalloc(adapter->dev_topo.card.phys_num, sizeof(struct leapraid_card_port), GFP_KERNEL); @@ -5755,21 +6444,23 @@ static void leapraid_update_card_port_after_reset( return; port_entry_num = - leapraid_set_new_card_port_table_after_reset(adapter, - new_card_port_table); + leapraid_set_new_card_port_table_after_reset( + adapter, + new_card_port_table); if (!port_entry_num) - return; + goto out_free_port_table; list_for_each_entry(matched_card_port, - &adapter->dev_topo.card_port_list, list) { + &adapter->dev_topo.card_port_list, list) matched_card_port->flg |= LEAPRAID_CARD_PORT_FLG_DIRTY; - } matched_card_port = NULL; for (i = 0; i < port_entry_num; i++) leapraid_update_existing_port(adapter, new_card_port_table, i, port_entry_num); +out_free_port_table: + kfree(new_card_port_table); } static bool leapraid_is_valid_vphy( @@ -5780,13 +6471,16 @@ static bool leapraid_is_valid_vphy( union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; struct leapraid_sas_phy_p0 phy_p0; + u32 dev_info; - if ((sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> 4) < + if (sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < LEAPRAID_SAS_NEG_LINK_RATE_1_5) return false; - if (!(le32_to_cpu(sas_io_unit_p0->phy_info[phy_index].controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP)) + dev_info = le32_to_cpu(sas_io_unit_p0->phy_info[phy_index] + .controller_phy_dev_info); + if (!(dev_info & LEAPRAID_DEVTYP_SEP)) return false; cfgp1.phy_number = phy_index; @@ -5819,7 +6513,7 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, return; may_new_card_port->port_id = may_new_port_id; dev_err(&adapter->pdev->dev, - "%s: new card port %p added, port=%d\n", + "%s: New card port %p added, port=%d\n", __func__, may_new_card_port, may_new_port_id); list_add_tail(&may_new_card_port->list, &adapter->dev_topo.card_port_list); @@ -5835,8 +6529,10 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, sas_dev = leapraid_get_sas_dev_by_addr(adapter, attached_sas_addr, card_port); - if (sas_dev) + if (sas_dev) { sas_dev->card_port = may_new_card_port; + leapraid_sdev_put(sas_dev); + } } if (may_new_card_port->flg & LEAPRAID_CARD_PORT_FLG_DIRTY) { @@ -5851,7 +6547,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; struct leapraid_card_port *card_port, *card_port_next; struct leapraid_vphy *vphy, *vphy_next; u64 attached_sas_addr; @@ -5867,9 +6563,8 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) continue; list_for_each_entry_safe(vphy, vphy_next, - &card_port->vphys_list, list) { + &card_port->vphys_list, list) vphy->flg |= LEAPRAID_VPHY_FLG_DIRTY; - } } sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + @@ -5880,16 +6575,17 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) return; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { if (!leapraid_is_valid_vphy(adapter, sas_iounit_p0, i)) continue; attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) continue; @@ -5931,7 +6627,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) break; } } -out: +out_free: kfree(sas_iounit_p0); } @@ -5943,17 +6639,21 @@ static void leapraid_mark_all_dev_deleted(struct leapraid_adapter *adapter) shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (sdev_priv && sdev_priv->starget_priv) - sdev_priv->starget_priv->deleted = true; + sdev_priv->starget_priv->deleted = 1; } } static void leapraid_free_enc_list(struct leapraid_adapter *adapter) { struct leapraid_enc_node *enc_dev, *enc_dev_next; + LIST_HEAD(free_list); + unsigned long flags; + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + list_splice_init(&adapter->dev_topo.enc_list, &free_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); - list_for_each_entry_safe(enc_dev, enc_dev_next, - &adapter->dev_topo.enc_list, - list) { + list_for_each_entry_safe(enc_dev, enc_dev_next, &free_list, list) { list_del(&enc_dev->list); kfree(enc_dev); } @@ -5966,14 +6666,14 @@ static void leapraid_rebuild_enc_list_after_reset( union cfg_param_2 cfgp2 = {0}; struct leapraid_enc_node *enc_node; u16 enc_hdl; + unsigned long flags; int rc; leapraid_free_enc_list(adapter); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (enc_hdl = 0xFFFF; ; enc_hdl = le16_to_cpu(enc_node->pg0.enc_hdl)) { - enc_node = kzalloc(sizeof(*enc_node), - GFP_KERNEL); + enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); if (!enc_node) return; @@ -5985,91 +6685,102 @@ static void leapraid_rebuild_enc_list_after_reset( return; } + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } } static void leapraid_mark_resp_sas_dev(struct leapraid_adapter *adapter, struct leapraid_sas_dev_p0 *sas_dev_p0) { - struct leapraid_starget_priv *starget_priv = NULL; + struct leapraid_starget_priv *starget_priv; struct leapraid_enc_node *enc_node = NULL; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; struct scsi_target *starget; unsigned long flags; + unsigned long enc_flags = 0; + u16 enc_hdl; + u64 enc_lid = 0; card_port = leapraid_get_port_by_id(adapter, sas_dev_p0->physical_port, false); - if (sas_dev_p0->enc_hdl) { - enc_node = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu( - sas_dev_p0->enc_hdl)); + enc_hdl = le16_to_cpu(sas_dev_p0->enc_hdl); + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); + enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); if (!enc_node) dev_info(&adapter->pdev->dev, "enc hdl 0x%04x has no matched enc dev\n", - le16_to_cpu(sas_dev_p0->enc_hdl)); + enc_hdl); } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) { - if (sas_dev->sas_addr == le64_to_cpu(sas_dev_p0->sas_address) && - sas_dev->slot == le16_to_cpu(sas_dev_p0->slot) && - sas_dev->card_port == card_port) { - sas_dev->resp = true; - starget = sas_dev->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->tm_busy = false; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } + if (sas_dev->sas_addr != le64_to_cpu(sas_dev_p0->sas_address) || + sas_dev->slot != le16_to_cpu(sas_dev_p0->slot) || + sas_dev->card_port != card_port) + continue; + + sas_dev->resp = 1; + starget = sas_dev->starget; + if (starget && starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->tm_busy = 0; + starget_priv->deleted = 0; + } else { + starget_priv = NULL; + } + + if (starget) { + starget_printk( + KERN_INFO, starget, + "dev: hdl=0x%04x saddr=0x%016llx port_id=%d\n", + sas_dev->hdl, + (unsigned long long)sas_dev->sas_addr, + sas_dev->card_port->port_id); + if (sas_dev->enc_hdl != 0) + starget_printk( + KERN_INFO, + starget, + "enc info: enc_lid=0x%016llx slot=%d\n", + (unsigned long long)sas_dev->enc_lid, + sas_dev->slot); + } + + if (le16_to_cpu(sas_dev_p0->flg) & + LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { + sas_dev->enc_level = sas_dev_p0->enc_level; + memcpy(sas_dev->connector_name, + sas_dev_p0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[ + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = '\0'; + } else { + sas_dev->enc_level = 0; + sas_dev->connector_name[0] = '\0'; + } - if (starget) { - starget_printk(KERN_INFO, starget, - "dev: hdl=0x%04x, sas addr=0x%016llx, port_id=%d\n", - sas_dev->hdl, - (unsigned long long)sas_dev->sas_addr, - sas_dev->card_port->port_id); - if (sas_dev->enc_hdl != 0) - starget_printk(KERN_INFO, starget, - "enc info: enc_lid=0x%016llx, slot=%d\n", - (unsigned long long)sas_dev->enc_lid, - sas_dev->slot); - } + sas_dev->enc_hdl = enc_hdl; + sas_dev->enc_lid = enc_lid; - if (le16_to_cpu(sas_dev_p0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = sas_dev_p0->enc_level; - memcpy(sas_dev->connector_name, - sas_dev_p0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } + if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) + goto unlock; - sas_dev->enc_hdl = - le16_to_cpu(sas_dev_p0->enc_hdl); - if (enc_node) { - sas_dev->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - } - if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) - goto out; + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + sas_dev->hdl, sas_dev_p0->dev_hdl); + sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + if (starget_priv) + starget_priv->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - sas_dev->hdl, sas_dev_p0->dev_hdl); - sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - if (starget_priv) - starget_priv->hdl = - le16_to_cpu(sas_dev_p0->dev_hdl); - goto out; - } + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); } @@ -6081,10 +6792,10 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) u32 device_info; dev_info(&adapter->pdev->dev, - "begin searching for sas end devices\n"); + "Begin searching for SAS end devices\n"); if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6097,63 +6808,58 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "sas end devices searching complete\n"); + "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, u64 wwid, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; + struct leapraid_starget_priv *starget_priv = NULL; struct scsi_target *starget; unsigned long flags; + u64 volume_wwid; + u16 old_hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_for_each_entry(raid_volume, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid && raid_volume->starget) { - starget = raid_volume->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } - - raid_volume->resp = true; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); + raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); + if (!raid_volume) + return; - starget_printk( - KERN_INFO, raid_volume->starget, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", - hdl, (unsigned long long)raid_volume->wwid); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume->hdl == hdl) { - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (!raid_volume->starget) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); + return; + } - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - raid_volume->hdl, hdl); + starget = raid_volume->starget; + if (starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->deleted = 0; + } - raid_volume->hdl = hdl; - if (starget_priv) - starget_priv->hdl = hdl; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + raid_volume->resp = 1; + volume_wwid = raid_volume->wwid; + old_hdl = raid_volume->hdl; + if (old_hdl != hdl) { + raid_volume->hdl = hdl; + if (starget_priv) + starget_priv->hdl = hdl; } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + starget_printk(KERN_INFO, starget, + "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + hdl, (unsigned long long)volume_wwid); + if (old_hdl != hdl) + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + old_hdl, hdl); + + leapraid_raid_volume_put(raid_volume); } static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) @@ -6165,17 +6871,22 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) struct leapraid_raidvol_p1 raidvol_p1; struct leapraid_raidvol_p0 raidvol_p0; struct leapraid_raidpd_p0 raidpd_p0; + unsigned long flags; u16 hdl; u8 phys_disk_num; + bool is_empty; if (!adapter->adapter_attr.raid_support) return; dev_info(&adapter->pdev->dev, - "begin searching for raid volumes\n"); + "Begin searching for RAID volumes\n"); - if (list_empty(&adapter->dev_topo.raid_volume_list)) - goto out; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + is_empty = list_empty(&adapter->dev_topo.raid_volume_list); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (is_empty) + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6206,11 +6917,16 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) cfgp2.form_specific = phys_disk_num) { phys_disk_num = raidpd_p0.phys_disk_num; hdl = le16_to_cpu(raidpd_p0.dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + else + set_bit(hdl, adapter->dev_topo.pd_hdls); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "raid volumes searching complete\n"); + "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6226,10 +6942,17 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, port_id, false); unsigned long flags; + unsigned long enc_flags = 0; + u64 enc_lid = 0; int i; - if (enc_hdl) + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); + } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); list_for_each_entry(topo_node_exp, &adapter->dev_topo.exp_list, list) { @@ -6237,14 +6960,11 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->card_port != card_port) continue; - topo_node_exp->resp = true; - if (enc_node) { - topo_node_exp->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - topo_node_exp->enc_hdl = le16_to_cpu(exp_pg0->enc_hdl); - } + topo_node_exp->resp = 1; + topo_node_exp->enc_hdl = enc_hdl; + topo_node_exp->enc_lid = enc_lid; if (topo_node_exp->hdl == hdl) - goto out; + goto unlock; dev_info(&adapter->pdev->dev, "hdl changed: 0x%04x -> 0x%04x\n", @@ -6252,9 +6972,9 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->hdl = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) topo_node_exp->card_phy[i].hdl = hdl; - goto out; + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); } @@ -6267,10 +6987,10 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_info(&adapter->pdev->dev, - "begin searching for expanders\n"); + dev_dbg(&adapter->pdev->dev, + "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6281,16 +7001,16 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) sas_address = le64_to_cpu(exp_p0.sas_address); port = exp_p0.physical_port; - dev_info(&adapter->pdev->dev, - "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", - hdl, (unsigned long long)sas_address, - ((adapter->adapter_attr.enable_mp) ? (port) : - (LEAPRAID_DISABLE_MP_PORT_ID))); + dev_dbg(&adapter->pdev->dev, + "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", + hdl, (unsigned long long)sas_address, + adapter->adapter_attr.enable_mp ? port : + LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -out: - dev_info(&adapter->pdev->dev, - "expander searching complete\n"); +exit_search: + dev_dbg(&adapter->pdev->dev, + "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -6302,7 +7022,7 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) adapter->reset_desc.pending_io_cnt = 0; if (!leapraid_pci_active(adapter)) { dev_err(&adapter->pdev->dev, - "%s %s: pci error, device reset or unplugged!\n", + "%s %s: PCI error, device reset or unplugged!\n", adapter->adapter_attr.name, __func__); return; } @@ -6314,9 +7034,9 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) for (i = 1; i <= adapter->shost->can_queue; i++) { io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, i); - if (io_req_tracker && io_req_tracker->taskid != 0) - if (io_req_tracker->scmd) - adapter->reset_desc.pending_io_cnt++; + if (io_req_tracker && io_req_tracker->taskid != 0 && + io_req_tracker->scmd) + adapter->reset_desc.pending_io_cnt++; } spin_unlock_irqrestore(&adapter->dynamic_task_desc.task_lock, flags); @@ -6324,38 +7044,37 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) return; wait_event_timeout(adapter->reset_desc.reset_wait_queue, - adapter->reset_desc.pending_io_cnt == 0, 10 * HZ); + adapter->reset_desc.pending_io_cnt == 0, + LEAPRAID_IO_CMD_TIMEOUT * HZ); } int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, enum reset_type type) { unsigned long flags; + bool wake = false; int rc; - if (!mutex_trylock(&adapter->reset_desc.adapter_reset_mutex)) { - do { - ssleep(1); - } while (adapter->access_ctrl.shost_recovering); - return adapter->reset_desc.adapter_reset_results; - } + mutex_lock(&adapter->reset_desc.adapter_reset_mutex); if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, - "pci_dev removed, pausing polling and cleaning cmds\n"); + "pci_dev removed, pause poll, clean cmds\n"); leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); } - rc = 0; - goto exit_pci_unavailable; + dev_err(&adapter->pdev->dev, "PCIe unavailable!\n"); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return -ENXIO; } - dev_info(&adapter->pdev->dev, "starting hard reset\n"); + dev_info(&adapter->pdev->dev, "Starting hard reset\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; + adapter->access_ctrl.shost_recover_async = 1; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); leapraid_wait_cmds_done(adapter); @@ -6364,14 +7083,14 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, rc = leapraid_make_adapter_ready(adapter, type); if (rc) { dev_err(&adapter->pdev->dev, - "failed to make adapter ready, rc=%d\n", rc); - goto out; + "Failed to make adapter ready, rc=%d\n", rc); + goto out_cleanup; } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "firmware log init failed\n"); - goto out; + dev_err(&adapter->pdev->dev, "Firmware log init failed\n"); + goto out_cleanup; } leapraid_clean_active_cmds(adapter); @@ -6379,15 +7098,16 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, adapter->scan_dev_desc.scan_dev_failed) { dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; - goto out; + goto out_cleanup; } rc = leapraid_make_adapter_available(adapter); if (!rc) { dev_info(&adapter->pdev->dev, - "adapter is now available, rebuilding topology\n"); + "Adapter is now available, rebuilding topology\n"); if (adapter->adapter_attr.enable_mp) { leapraid_update_card_port_after_reset(adapter); leapraid_update_vphys_after_reset(adapter); @@ -6399,14 +7119,22 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_search_resp_exp(adapter); leapraid_hardreset_barrier(adapter); } -out: - dev_info(&adapter->pdev->dev, "hard reset %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); +out_cleanup: + dev_info(&adapter->pdev->dev, "Hard reset %s\n", + rc == 0 ? "SUCCESS" : "FAILED"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + if (rc) { + adapter->access_ctrl.shost_recover_async = 0; + wake = true; + } spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + if (wake) + wake_up(&adapter->access_ctrl.shost_recover_wq); + adapter->reset_desc.reset_cnt++; mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); @@ -6414,8 +7142,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); -exit_pci_unavailable: - dev_info(&adapter->pdev->dev, "pcie unavailable!\n"); return rc; } @@ -6424,31 +7150,40 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) struct leapraid_adapter_features_req leap_mpi_req; struct leapraid_adapter_features_rep leap_mpi_rep; u8 fw_major, fw_minor, fw_build, fw_release; + u32 req_sz; + u32 rep_sz; u32 db; int r; db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED || - (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) + (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { + dev_err(&adapter->pdev->dev, + "%s: Doorbell used or fault\n", __func__); return -EFAULT; + } - if (((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) && - ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL)) { - if (!leapraid_wait_adapter_ready(adapter)) - return -EFAULT; + if ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY && + (db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL && + !leapraid_wait_adapter_ready(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: adapter not ready\n", __func__); + return -EFAULT; } - memset(&leap_mpi_req, 0, sizeof(struct leapraid_adapter_features_req)); - memset(&leap_mpi_rep, 0, sizeof(struct leapraid_adapter_features_rep)); + req_sz = sizeof(struct leapraid_adapter_features_req); + rep_sz = sizeof(struct leapraid_adapter_features_rep); + memset(&leap_mpi_req, 0, req_sz); + memset(&leap_mpi_rep, 0, rep_sz); leap_mpi_req.func = LEAPRAID_FUNC_GET_ADAPTER_FEATURES; r = leapraid_handshake_func(adapter, - sizeof(struct leapraid_adapter_features_req), + req_sz, (u32 *)&leap_mpi_req, - sizeof(struct leapraid_adapter_features_rep), + rep_sz, (u16 *)&leap_mpi_rep); if (r) { dev_err(&adapter->pdev->dev, - "%s %s: handshake failed, r=%d\n", + "%s %s: Handshake failed, r=%d\n", adapter->adapter_attr.name, __func__, r); return r; } @@ -6475,19 +7210,43 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) LEAPRAID_MAX_DEV_HANDLE_DEFAULT; adapter->adapter_attr.features.min_dev_handle = le16_to_cpu(leap_mpi_rep.min_dev_hdl); - if ((adapter->adapter_attr.features.adapter_caps & - LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID)) - adapter->adapter_attr.raid_support = true; + if (adapter->adapter_attr.features.adapter_caps & + LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID) + adapter->adapter_attr.raid_support = 1; + adapter->adapter_attr.wideport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.sata_max_queue_depth = + leap_mpi_rep.sata_max_qdepth ? + leap_mpi_rep.sata_max_qdepth : + LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.raid_volume_max_queue_depth = + LEAPRAID_RAID_QUEUE_DEPTH; + dev_info(&adapter->pdev->dev, + "max: wp qd=%d, np qd=%d, SATA qd=%d, raid qd=%d\n", + adapter->adapter_attr.wideport_max_queue_depth, + adapter->adapter_attr.narrowport_max_queue_depth, + adapter->adapter_attr.sata_max_queue_depth, + adapter->adapter_attr.raid_volume_max_queue_depth); if (WARN_ON(!(adapter->adapter_attr.features.adapter_caps & LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ))) return -EFAULT; adapter->adapter_attr.features.fw_version = le32_to_cpu(leap_mpi_rep.fw_version); - fw_major = (adapter->adapter_attr.features.fw_version >> 24) & 0xFF; - fw_minor = (adapter->adapter_attr.features.fw_version >> 16) & 0xFF; - fw_build = (adapter->adapter_attr.features.fw_version >> 8) & 0xFF; - fw_release = adapter->adapter_attr.features.fw_version & 0xFF; + fw_major = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MAJOR_SHIFT) & LEAPRAID_VER_MASK; + fw_minor = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MINOR_SHIFT) & LEAPRAID_VER_MASK; + fw_build = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_BUILD_SHIFT) & LEAPRAID_VER_MASK; + fw_release = + adapter->adapter_attr.features.fw_version & LEAPRAID_VER_MASK; dev_info(&adapter->pdev->dev, "Firmware version: %u.%u.%u.%u (0x%08x)\n", @@ -6499,7 +7258,7 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) "Unsupported firmware major version, requires >= 2\n"); return -EFAULT; } - adapter->shost->max_id = -1; + adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; return 0; } @@ -6525,53 +7284,49 @@ static int leapraid_enable_pcie(struct leapraid_adapter *adapter) rc = pci_enable_device(adapter->pdev); if (rc) { - dev_err(&adapter->pdev->dev, "failed to enable PCI device\n"); + dev_err(&adapter->pdev->dev, "Failed to enable PCI device\n"); return rc; } rc = pci_request_regions(adapter->pdev, LEAPRAID_DRIVER_NAME); if (rc) { dev_err(&adapter->pdev->dev, - "failed to obtain PCI resources\n"); - goto disable_pcie; + "Failed to obtain PCI resources\n"); + return rc; } if (sizeof(dma_addr_t) > 4) { - dma_mask = DMA_BIT_MASK(64); - adapter->adapter_attr.use_32_dma_mask = false; + dma_mask = DMA_BIT_MASK(DMA_64_BITS); + adapter->adapter_attr.use_32_dma_mask = 0; } else { - dma_mask = DMA_BIT_MASK(32); - adapter->adapter_attr.use_32_dma_mask = true; + dma_mask = DMA_BIT_MASK(DMA_32_BITS); + adapter->adapter_attr.use_32_dma_mask = 1; } rc = dma_set_mask_and_coherent(&adapter->pdev->dev, dma_mask); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set %lld DMA mask\n", dma_mask); - goto disable_pcie; + "Failed to set %lld DMA mask\n", dma_mask); + return rc; } adapter->iomem_base = ioremap(pci_resource_start(adapter->pdev, 0), sizeof(struct leapraid_reg_base)); if (!adapter->iomem_base) { dev_err(&adapter->pdev->dev, - "failed to map memory for controller registers\n"); - rc = -ENOMEM; - goto disable_pcie; + "Failed to map memory for controller registers\n"); + return -ENOMEM; } pci_set_master(adapter->pdev); return 0; - -disable_pcie: - return rc; } static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i, base_group, this_group; - unsigned int cpu, nr_cpus, total_msix, index = 0; + unsigned int cpu, nr_cpus, total_msix, index; total_msix = adapter->notification_desc.iopoll_qdex; nr_cpus = num_online_cpus(); @@ -6613,8 +7368,12 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq = &adapter->notification_desc.int_rqs[i]; affinity_mask = pci_irq_get_affinity(adapter->pdev, int_rq->rq.msix_idx); - if (!affinity_mask) - goto out; + if (!affinity_mask) { + dev_warn(&adapter->pdev->dev, + "%s: IRQ affinity NULL, msix_idx=%d\n", + __func__, int_rq->rq.msix_idx); + goto out_apply_irq_affinity; + } for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) @@ -6624,7 +7383,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } -out: +out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -6641,27 +7400,26 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i; + int irq; - if (!adapter->notification_desc.int_rqs) - return; - - for (i = 0; i < adapter->notification_desc.int_rqs_allocated; i++) { + for (i = 0; adapter->notification_desc.int_rqs && + i < adapter->notification_desc.int_rqs_allocated; i++) { int_rq = &adapter->notification_desc.int_rqs[i]; if (!int_rq) continue; - irq_set_affinity_hint(pci_irq_vector(adapter->pdev, - int_rq->rq.msix_idx), NULL); - free_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx), - &int_rq->rq); + irq = pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx); + irq_set_affinity_hint(irq, NULL); + free_irq(irq, &int_rq->rq); } adapter->notification_desc.int_rqs_allocated = 0; - if (!adapter->notification_desc.msix_enable) - return; + if (adapter->notification_desc.irq_vectors_allocated) { + pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; + } - pci_free_irq_vectors(adapter->pdev); - adapter->notification_desc.msix_enable = false; + adapter->notification_desc.msix_enable = 0; kfree(adapter->notification_desc.blk_mq_poll_rqs); adapter->notification_desc.blk_mq_poll_rqs = NULL; @@ -6671,16 +7429,9 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) kfree(adapter->notification_desc.msix_cpu_map); adapter->notification_desc.msix_cpu_map = NULL; -} - -static inline int leapraid_msix_cnt(struct pci_dev *pdev) -{ - return pci_msix_vec_count(pdev); -} - -static inline int leapraid_msi_cnt(struct pci_dev *pdev) -{ - return pci_msi_vec_count(pdev); + adapter->notification_desc.msix_cpu_map_sz = 0; + adapter->notification_desc.iopoll_qdex = 0; + adapter->notification_desc.iopoll_qcnt = 0; } static int leapraid_setup_irqs(struct leapraid_adapter *adapter) @@ -6688,7 +7439,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) unsigned int i; int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, @@ -6697,22 +7448,26 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi/msix vectors alloacted failed!\n", + "%d MSI/MSIX vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); return rc; } + + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = + LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == 0) + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == 1) + else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -6723,6 +7478,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); + if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -6754,10 +7510,12 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "legacy irq alloacted failed!\n"); + "Legacy irq allocated failed!\n"); return rc; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_LEGACY; rc = request_irq(pci_irq_vector(adapter->pdev, 0), leapraid_irq_handler, IRQF_SHARED, @@ -6766,8 +7524,9 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) if (rc) { irq_set_affinity_hint(pci_irq_vector(adapter->pdev, 0), NULL); pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; dev_err(&adapter->pdev->dev, - "Legact Int: request_irq %s failed!\n", + "Legacy Int: request_irq %s failed!\n", adapter->notification_desc.int_rqs[0].rq.name); return -EBUSY; } @@ -6781,8 +7540,8 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; @@ -6791,19 +7550,15 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->adapter_attr.rq_cnt; adapter->notification_desc.iopoll_qcnt = 0; dev_info(&adapter->pdev->dev, - "Legacy Intr: req queue cnt=%d, intr=%d/poll=%d rep queues!\n", + "Legacy Intr: req queue cnt=%d intr=%d/poll=%d rep queues!\n", adapter->adapter_attr.rq_cnt, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qcnt); adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "Legacy Intr: allocate %d intr rep queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } rc = leapraid_setup_legacy_int(adapter); @@ -6817,13 +7572,13 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) int rc, msix_cnt; if (msix_disable == 1) - goto legacy_int; + goto apply_legacy_int; - msix_cnt = leapraid_msix_cnt(adapter->pdev); + msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); - goto legacy_int; + dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); + goto apply_legacy_int; } msix_cnt = min_t(int, msix_cnt, @@ -6872,25 +7627,25 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSIx: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = adapter; adapter->notification_desc.blk_mq_poll_rqs[i].rq.msix_idx = i + adapter->notification_desc.iopoll_qdex; - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, 0); + atomic_set( + &adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, + 0); snprintf(adapter->notification_desc.blk_mq_poll_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MQ-Poll%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, 0); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, + 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, + 0); } adapter->notification_desc.msix_cpu_map_sz = @@ -6900,20 +7655,21 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; + memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -6926,13 +7682,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) int rc, msi_cnt; if (msix_disable == 1) - goto legacy_int1; + goto apply_legacy_int; - msi_cnt = leapraid_msi_cnt(adapter->pdev); + msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msi unsupported!\n"); - goto legacy_int1; + dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); + goto apply_legacy_int; } msi_cnt = min_t(int, msi_cnt, @@ -6979,10 +7735,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) PCI_IRQ_MSI | PCI_IRQ_AFFINITY, NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi vectors alloacted failed!\n", + "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); - goto legacy_int1; + leapraid_free_irq(adapter); + goto apply_legacy_int; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -6999,12 +7758,8 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSI: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = @@ -7028,24 +7783,24 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int1; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int1: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -7055,30 +7810,26 @@ static int leapraid_set_notification(struct leapraid_adapter *adapter) { int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = leapraid_set_msix(adapter); if (rc) - pr_err("%s enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == 1) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI-X irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { rc = leapraid_set_msi(adapter); if (rc) - pr_err("%s enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == 2) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { rc = leapraid_set_legacy_int(adapter); if (rc) - pr_err("%s enable legacy irq failed!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); } return rc; } -static void leapraid_disable_pcie_and_notification( - struct leapraid_adapter *adapter) -{ - leapraid_free_irq(adapter); - leapraid_disable_pcie(adapter); -} - int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) { int rc; @@ -7091,13 +7842,13 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_ready(adapter, PART_RESET); if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + dev_err(&adapter->pdev->dev, "Make adapter ready failure\n"); goto out_fail; } rc = leapraid_get_adapter_features(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + dev_err(&adapter->pdev->dev, "Get adapter feature failure\n"); goto out_fail; } @@ -7110,7 +7861,8 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) return 0; out_fail: - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); return rc; } @@ -7121,11 +7873,13 @@ void leapraid_disable_controller(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; leapraid_make_adapter_ready(adapter, PART_RESET); - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); } static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) @@ -7139,12 +7893,11 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - rc = -EFAULT; - goto out; + dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + return -EFAULT; } -out: - dev_info(&adapter->pdev->dev, "unit reset: %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); + + dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7164,13 +7917,13 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, while ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) { if (count++ == LEAPRAID_DB_RETRY_COUNT_MAX) { dev_err(&adapter->pdev->dev, - "wait adapter ready timeout\n"); + "Wait adapter ready timeout\n"); return -EFAULT; } ssleep(1); db = leapraid_readl(&adapter->iomem_base->db); dev_info(&adapter->pdev->dev, - "wait adapter ready, count=%d, db=0x%x\n", + "Wait adapter ready, count=%d, db=0x%x\n", count, db); } } @@ -7186,9 +7939,9 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, if (type == FULL_RESET) goto full_reset; - if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL) - if (!(leapraid_adapter_unit_reset(adapter))) - return 0; + if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL && + !leapraid_adapter_unit_reset(adapter)) + return 0; full_reset: rc = leapraid_host_diag_reset(adapter); @@ -7229,12 +7982,8 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) LEAPRAID_SYS_LOG_BUF_RESERVE), &adapter->fw_log_desc.fw_log_buffer_dma, GFP_KERNEL); - if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, - "%s: log buf alloc failed.\n", - __func__); + if (!adapter->fw_log_desc.fw_log_buffer) return -ENOMEM; - } } memset(&adapter_log_req, 0, sizeof(struct leapraid_adapter_log_req)); @@ -7253,7 +8002,7 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_log_rep), (u16 *)&adapter_log_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7292,7 +8041,7 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_msg) { dma_free_coherent( &adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ, + adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE, adapter->mem_desc.rep_msg, adapter->mem_desc.rep_msg_dma); adapter->mem_desc.rep_msg = NULL; @@ -7310,15 +8059,19 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_desc_seg_maint) { for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { - if (adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { + if (adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg) { dma_free_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma); - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = NULL; + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg, + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma); + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg = NULL; } } @@ -7333,7 +8086,8 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) } for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) - kfree(adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint); + kfree(adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_maint); kfree(adapter->mem_desc.rep_desc_seg_maint); } @@ -7345,16 +8099,16 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) { - return (upper_32_bits(start) == upper_32_bits(start + size - 1)); + return upper_32_bits(start) == upper_32_bits(start + size - 1); } int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker) { io_tracker->chain = - dma_pool_alloc(adapter->mem_desc.sg_chain_pool, - GFP_KERNEL, - &io_tracker->chain_dma); + dma_pool_alloc(adapter->mem_desc.sg_chain_pool, + GFP_KERNEL, + &io_tracker->chain_dma); if (!io_tracker->chain) return -ENOMEM; @@ -7381,17 +8135,16 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) unsigned int i, j; int rc; - /* sg table size */ + /* Scatter-gather table size. */ adapter->shost->sg_tablesize = LEAPRAID_SG_DEPTH; if (reset_devices) adapter->shost->sg_tablesize = LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS; - /* high priority cmds queue depth */ - adapter->dynamic_task_desc.hp_cmd_qd = facts->hp_slot; + /* High-priority commands queue depth. */ adapter->dynamic_task_desc.hp_cmd_qd = LEAPRAID_FIXED_HP_CMDS; - /* internal cmds queue depth */ + /* Internal commands queue depth. */ adapter->dynamic_task_desc.inter_cmd_qd = LEAPRAID_FIXED_INTER_CMDS; - /* adapter cmds total queue depth */ + /* Adapter commands total queue depth. */ if (reset_devices) adapter->adapter_attr.adapter_total_qd = LEAPRAID_DEFAULT_CMD_QD_OFFSET + @@ -7400,22 +8153,22 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) else adapter->adapter_attr.adapter_total_qd = facts->req_slot + adapter->dynamic_task_desc.hp_cmd_qd; - /* reply message queue depth */ + /* Reply message queue depth. */ adapter->adapter_attr.rep_msg_qd = adapter->adapter_attr.adapter_total_qd + LEAPRAID_DEFAULT_CMD_QD_OFFSET; - /* reply descriptor queue depth */ + /* Reply descriptor queue depth. */ adapter->adapter_attr.rep_desc_qd = round_up(adapter->adapter_attr.adapter_total_qd + adapter->adapter_attr.rep_msg_qd + LEAPRAID_TASKID_OFFSET_CTRL_CMD, LEAPRAID_REPLY_QD_ALIGNMENT); - /* scsi cmd io depth */ + /* SCSI command I/O depth. */ adapter->adapter_attr.io_qd = adapter->adapter_attr.adapter_total_qd - adapter->dynamic_task_desc.hp_cmd_qd - adapter->dynamic_task_desc.inter_cmd_qd; - /* scsi host can queue */ + /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + @@ -7424,7 +8177,7 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; - /* allocate task descriptor */ + /* Allocate task descriptor. */ try_again: adapter->adapter_attr.task_desc_dma_size = (adapter->adapter_attr.adapter_total_qd + @@ -7435,39 +8188,31 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->adapter_attr.task_desc_dma_size, &adapter->mem_desc.task_desc_dma, GFP_KERNEL); - if (!adapter->mem_desc.task_desc) { - dev_err(&adapter->pdev->dev, - "failed to allocate task descriptor DMA!\n"); - rc = -ENOMEM; - goto out; - } - /* allocate chain message pool */ + if (!adapter->mem_desc.task_desc) + return -ENOMEM; + + /* Allocate chain message pool. */ adapter->mem_desc.sg_chain_pool_size = LEAPRAID_DEFAULT_CHAINS_PER_IO * LEAPRAID_CHAIN_SEG_SIZE; adapter->mem_desc.sg_chain_pool = dma_pool_create("leapraid chain pool", &adapter->pdev->dev, - adapter->mem_desc.sg_chain_pool_size, 16, 0); - if (!adapter->mem_desc.sg_chain_pool) { - dev_err(&adapter->pdev->dev, - "failed to allocate chain message DMA!\n"); - rc = -ENOMEM; - goto out; - } + adapter->mem_desc.sg_chain_pool_size, + LEAPRAID_DMA_ALIGN, 0); + if (!adapter->mem_desc.sg_chain_pool) + return -ENOMEM; - /* allocate io tracker to ref scsi io */ + /* Allocate I/O tracker to SCSI I/O. */ adapter->mem_desc.taskid_to_uniq_tag = - kcalloc(adapter->shost->can_queue, sizeof(u16), GFP_KERNEL); - if (!adapter->mem_desc.taskid_to_uniq_tag) { - rc = -ENOMEM; - goto out; - } + kcalloc(adapter->shost->can_queue, sizeof(u16), GFP_KERNEL); + if (!adapter->mem_desc.taskid_to_uniq_tag) + return -ENOMEM; adapter->dynamic_task_desc.hp_taskid = adapter->adapter_attr.io_qd + LEAPRAID_HP_TASKID_OFFSET_CTL_CMD; - /* allocate static hp taskid */ + /* Allocate static high-priority task ID. */ adapter->driver_cmds.ctl_cmd.hp_taskid = adapter->dynamic_task_desc.hp_taskid; adapter->driver_cmds.tm_cmd.hp_taskid = @@ -7488,9 +8233,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; - adapter->driver_cmds.raid_action_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -7518,64 +8260,58 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_taskid); /* - * allocate sense dma, driver maintain - * need in same 4GB segment + * Allocate sense data DMA buffer. + * Constraint: Must reside within the same 4GB segment + * (driver-maintained). */ adapter->mem_desc.sense_data = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE, - &adapter->mem_desc.sense_data_dma, GFP_KERNEL); - if (!adapter->mem_desc.sense_data) { - dev_err(&adapter->pdev->dev, - "failed to allocate sense data DMA!\n"); - rc = -ENOMEM; - goto out; - } + &adapter->mem_desc.sense_data_dma, + GFP_KERNEL); + if (!adapter->mem_desc.sense_data) + return -ENOMEM; + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.sense_data_dma, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE)) { dev_warn(&adapter->pdev->dev, - "try 32 bit dma due to sense data is not in same 4g!\n"); + "Try 32bit DMA: Sense not in same 4G\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* reply frame, need in same 4GB segment */ + /* + * Allocate reply frame buffer. + * Constraint: Must reside in the same 4GB segment as the sense DMA. + */ adapter->mem_desc.rep_msg = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ, - &adapter->mem_desc.rep_msg_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE, + &adapter->mem_desc.rep_msg_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg) + return -ENOMEM; if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ)) { + LEAPRAID_REPLY_SIZE)) { dev_warn(&adapter->pdev->dev, - "use 32 bit dma due to rep msg is not in same 4g!\n"); + "Use 32 bit DMA due to rep msg is not in same 4g!\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* address of reply frame */ + /* Address of reply frame. */ adapter->mem_desc.rep_msg_addr = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REP_MSG_ADDR_SIZE, - &adapter->mem_desc.rep_msg_addr_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg_addr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message address DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REP_MSG_ADDR_SIZE, + &adapter->mem_desc.rep_msg_addr_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg_addr) + return -ENOMEM; adapter->adapter_attr.rep_desc_q_seg_cnt = DIV_ROUND_UP(adapter->adapter_attr.rq_cnt, LEAPRAID_REP_DESC_CHUNK_SIZE); @@ -7583,10 +8319,8 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(adapter->adapter_attr.rep_desc_q_seg_cnt, sizeof(struct leapraid_rep_desc_seg_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint) + return -ENOMEM; rep_desc_q_cnt_allocated = 0; for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { @@ -7594,25 +8328,20 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(LEAPRAID_REP_DESC_CHUNK_SIZE, sizeof(struct leapraid_rep_desc_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) + return -ENOMEM; adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * - LEAPRAID_REP_DESC_ENTRY_SIZE) * + LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - &adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma, + &adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor segment DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) + return -ENOMEM; for (j = 0; j < LEAPRAID_REP_DESC_CHUNK_SIZE; j++) { if (rep_desc_q_cnt_allocated >= @@ -7645,30 +8374,26 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) if (!reset_devices) { adapter->mem_desc.rep_desc_q_arr = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.rq_cnt * LEAPRAID_REP_RQ_CNT_SIZE, &adapter->mem_desc.rep_desc_q_arr_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_q_arr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor queue array DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_q_arr) + return -ENOMEM; } return 0; -out: +out_fail: if (rc == -EAGAIN) { leapraid_free_host_memory(adapter); - adapter->adapter_attr.use_32_dma_mask = true; + adapter->adapter_attr.use_32_dma_mask = 1; rc = dma_set_mask_and_coherent(&adapter->pdev->dev, - DMA_BIT_MASK(32)); + DMA_BIT_MASK(DMA_32_BITS)); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set 32 DMA mask\n"); + "Failed to set 32 DMA mask\n"); return rc; } goto try_again; @@ -7678,12 +8403,13 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { - adapter->dev_topo.pd_hdls_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pd_hdls_sz++; + u16 pd_hdls_sz; + + pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / + LEAPRAID_BITS_PER_BYTE; + pd_hdls_sz++; + + adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = kzalloc(adapter->dev_topo.pd_hdls_sz, GFP_KERNEL); if (!adapter->dev_topo.pd_hdls) @@ -7694,24 +8420,6 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) if (!adapter->dev_topo.blocking_hdls) return -ENOMEM; - adapter->dev_topo.pending_dev_add_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pending_dev_add_sz++; - adapter->dev_topo.pending_dev_add = - kzalloc(adapter->dev_topo.pending_dev_add_sz, GFP_KERNEL); - if (!adapter->dev_topo.pending_dev_add) - return -ENOMEM; - - adapter->dev_topo.dev_removing_sz = - adapter->dev_topo.pending_dev_add_sz; - adapter->dev_topo.dev_removing = - kzalloc(adapter->dev_topo.dev_removing_sz, GFP_KERNEL); - if (!adapter->dev_topo.dev_removing) - return -ENOMEM; - return 0; } @@ -7719,13 +8427,11 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) { kfree(adapter->dev_topo.pd_hdls); kfree(adapter->dev_topo.blocking_hdls); - kfree(adapter->dev_topo.pending_dev_add); - kfree(adapter->dev_topo.dev_removing); } static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size = 0; + u32 buffer_size; void *buffer; INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); @@ -7777,15 +8483,14 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) return -ENOMEM; adapter->driver_cmds.internal_scmd = buffer; - buffer = (void *)((u8 *)buffer + - sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker)); + buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + + sizeof(struct leapraid_io_req_tracker); adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (void *)((u8 *)buffer + SCSI_SENSE_BUFFERSIZE); + (unsigned char *)buffer; + buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (void *)((u8 *)buffer + sizeof(struct scatterlist)); + (struct scatterlist *)buffer; + buffer = (u8 *)buffer + sizeof(struct scatterlist); adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; adapter->driver_cmds.enc_cmd.cb_idx = LEAPRAID_ENC_CB_IDX; @@ -7828,32 +8533,34 @@ static void leapraid_init_event_mask(struct leapraid_adapter *adapter) int i; for (i = 0; i < LEAPRAID_EVT_MASK_COUNT; i++) - adapter->fw_evt_s.leapraid_evt_masks[i] = -1; - leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DISCOVERY); + adapter->fw_evt_s.leapraid_evt_masks[i] = + LEAPRAID_INVALID_INITIAL_VALUE; + leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_IR_CHANGE); } -static void leapraid_prepare_adp_init_req( +static void leapraid_prepare_adapter_init_req( struct leapraid_adapter *adapter, struct leapraid_adapter_init_req *init_req) { ktime_t cur_time; - int i; + int i, chunk; u32 reply_post_free_ary_sz; memset(init_req, 0, sizeof(struct leapraid_adapter_init_req)); init_req->func = LEAPRAID_FUNC_ADAPTER_INIT; init_req->who_init = LEAPRAID_WHOINIT_LINUX_DRIVER; - init_req->msg_ver = cpu_to_le16(0x0100); - init_req->header_ver = cpu_to_le16(0x0000); - - init_req->driver_ver = cpu_to_le32((LEAPRAID_MAJOR_VERSION << 24) | - (LEAPRAID_MINOR_VERSION << 16) | - (LEAPRAID_BUILD_VERSION << 8) | - LEAPRAID_RELEASE_VERSION); + init_req->msg_ver = cpu_to_le16(LEAPRAID_MSG_VERSION); + init_req->header_ver = cpu_to_le16(LEAPRAID_HEADER_VERSION); + init_req->driver_ver = + cpu_to_le32((LEAPRAID_MAJOR_VERSION << + LEAPRAID_VER_MAJOR_SHIFT) | + (LEAPRAID_MINOR_VERSION << LEAPRAID_VER_MINOR_SHIFT) | + (LEAPRAID_BUILD_VERSION << LEAPRAID_VER_BUILD_SHIFT) | + LEAPRAID_RELEASE_VERSION); if (adapter->notification_desc.msix_enable) init_req->host_msix_vectors = adapter->adapter_attr.rq_cnt; @@ -7877,18 +8584,13 @@ static void leapraid_prepare_adp_init_req( memset(adapter->mem_desc.rep_desc_q_arr, 0, reply_post_free_ary_sz); - for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) { - adapter->mem_desc - .rep_desc_q_arr[i] - .rep_desc_base_addr = - cpu_to_le64 ( - (u64)adapter->mem_desc - .rep_desc_seg_maint[i / - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_maint[i % - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_dma); - } + chunk = LEAPRAID_REP_DESC_CHUNK_SIZE; + for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) + adapter->mem_desc.rep_desc_q_arr[i].rep_desc_base_addr = + cpu_to_le64 ((u64)adapter->mem_desc + .rep_desc_seg_maint[i / chunk] + .rep_desc_maint[i % chunk] + .rep_desc_dma); init_req->msg_flg = LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE; @@ -7910,9 +8612,9 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) struct leapraid_adapter_init_req init_req; struct leapraid_adapter_init_rep init_rep; u16 adapter_status; - int rc = 0; + int rc; - leapraid_prepare_adp_init_req(adapter, &init_req); + leapraid_prepare_adapter_init_req(adapter, &init_req); rc = leapraid_handshake_func(adapter, sizeof(struct leapraid_adapter_init_req), @@ -7920,7 +8622,7 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_init_rep), (u16 *)&init_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7941,11 +8643,10 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_page1 *sas_io_unit_page1 = NULL; + struct leapraid_manufacturing_p0 manufacturing_page0; struct leapraid_bios_page3 bios_page3; struct leapraid_bios_page2 bios_page2; - int rc = 0; - int sz; + int rc; rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); @@ -7957,79 +8658,49 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) if (rc) return rc; + rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, + cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + adapter->adapter_attr.bios_version = le32_to_cpu(bios_page3.bios_version); - adapter->adapter_attr.wideport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.narrowport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.sata_max_queue_depth = - LEAPRAID_SATA_QUEUE_DEPTH; - + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(manufacturing_page0.board_name), + manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = bios_page2.requested_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_boot_dev.pg_dev, - (void *)&bios_page2.requested_boot_dev, + memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, + &bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = bios_page2.requested_alt_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_alt_boot_dev.pg_dev, - (void *)&bios_page2.requested_alt_boot_dev, + memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, + &bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = bios_page2.current_boot_dev_form; - memcpy((void *)adapter->boot_devs.current_boot_dev.pg_dev, - (void *)&bios_page2.current_boot_dev, + memcpy(adapter->boot_devs.current_boot_dev.pg_dev, + &bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); - - sz = offsetof(struct leapraid_sas_io_unit_page1, phy_info); - sas_io_unit_page1 = kzalloc(sz, GFP_KERNEL); - if (!sas_io_unit_page1) { - rc = -ENOMEM; - return rc; - } - - cfgp1.size = sz; - - rc = leapraid_op_config_page(adapter, sas_io_unit_page1, cfgp1, - cfgp2, GET_SAS_IOUNIT_PG1); - if (rc) - goto out; - - if (le16_to_cpu(sas_io_unit_page1->wideport_max_queue_depth)) - adapter->adapter_attr.wideport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->wideport_max_queue_depth); - - if (le16_to_cpu(sas_io_unit_page1->narrowport_max_queue_depth)) - adapter->adapter_attr.narrowport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->narrowport_max_queue_depth); - - if (sas_io_unit_page1->sata_max_queue_depth) - adapter->adapter_attr.sata_max_queue_depth = - sas_io_unit_page1->sata_max_queue_depth; - -out: - kfree(sas_io_unit_page1); - dev_info(&adapter->pdev->dev, - "max wp qd=%d, max np qd=%d, max sata qd=%d\n", - adapter->adapter_attr.wideport_max_queue_depth, - adapter->adapter_attr.narrowport_max_queue_depth, - adapter->adapter_attr.sata_max_queue_depth); return rc; } static int leapraid_evt_notify(struct leapraid_adapter *adapter) { struct leapraid_evt_notify_req *evt_notify_req; + struct leapraid_evt_notify_rep *evt_notify_rep; + u16 adapter_status; int rc = 0; int i; mutex_lock(&adapter->driver_cmds.notify_event_cmd.mutex); adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_PENDING; evt_notify_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.notify_event_cmd.inter_taskid); memset(evt_notify_req, 0, sizeof(struct leapraid_evt_notify_req)); evt_notify_req->func = LEAPRAID_FUNC_EVENT_NOTIFY; @@ -8038,15 +8709,30 @@ static int leapraid_evt_notify(struct leapraid_adapter *adapter) cpu_to_le32(adapter->fw_evt_s.leapraid_evt_masks[i]); init_completion(&adapter->driver_cmds.notify_event_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.notify_event_cmd.inter_taskid); + adapter->driver_cmds.notify_event_cmd.inter_taskid); wait_for_completion_timeout( &adapter->driver_cmds.notify_event_cmd.done, LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT * HZ); + if (!(adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_DONE)) - if (adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_RESET) - rc = -EFAULT; + LEAPRAID_CMD_DONE)) { + rc = -EFAULT; + goto out_cleanup; + } + + if (!(adapter->driver_cmds.notify_event_cmd.status & + LEAPRAID_CMD_REPLY_VALID)) { + rc = -EFAULT; + goto out_cleanup; + } + + evt_notify_rep = (void *)&adapter->driver_cmds.notify_event_cmd.reply; + adapter_status = le16_to_cpu(evt_notify_rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + rc = -EFAULT; + +out_cleanup: adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.notify_event_cmd.mutex); @@ -8061,51 +8747,54 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) int rc = 0; dev_info(&adapter->pdev->dev, - "send device scan, async_scan_dev=%d!\n", async_scan_dev); + "Send device scan, async_scan_dev=%d!\n", async_scan_dev); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_PENDING; adapter->driver_cmds.scan_dev_cmd.async_scan_dev = async_scan_dev; - scan_dev_req = leapraid_get_task_desc(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + scan_dev_req = + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.scan_dev_cmd.inter_taskid); memset(scan_dev_req, 0, sizeof(struct leapraid_scan_dev_req)); scan_dev_req->func = LEAPRAID_FUNC_SCAN_DEV; if (async_scan_dev) { - adapter->scan_dev_desc.first_scan_dev_fired = true; - leapraid_fire_task(adapter, + adapter->scan_dev_desc.first_scan_dev_fired = 1; + leapraid_fire_task( + adapter, adapter->driver_cmds.scan_dev_cmd.inter_taskid); return 0; } init_completion(&adapter->driver_cmds.scan_dev_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + adapter->driver_cmds.scan_dev_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.scan_dev_cmd.done, LEAPRAID_SCAN_DEV_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "device scan timeout!\n"); + dev_err(&adapter->pdev->dev, "Device scan timeout!\n"); if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) rc = -EFAULT; else rc = -ETIME; - goto out; + goto out_cleanup; } - scan_dev_rep = (void *)(&adapter->driver_cmds.scan_dev_cmd.reply); + scan_dev_rep = (void *)&adapter->driver_cmds.scan_dev_cmd.reply; adapter_status = le16_to_cpu(scan_dev_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { - dev_err(&adapter->pdev->dev, "device scan failure!\n"); + dev_err(&adapter->pdev->dev, "Device scan failure!\n"); rc = -EFAULT; - goto out; + goto out_cleanup; } -out: +out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_info(&adapter->pdev->dev, - "device scan %s\n", ((rc == 0) ? "SUCCESS" : "FAILED")); + "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8125,13 +8814,14 @@ static void leapraid_init_rep_msg_addr(struct leapraid_adapter *adapter) for (i = 0, reply_address = (u32)adapter->mem_desc.rep_msg_dma; i < adapter->adapter_attr.rep_msg_qd; - i++, reply_address += LEAPRAID_REPLY_SIEZ) { + i++, reply_address += LEAPRAID_REPLY_SIZE) adapter->mem_desc.rep_msg_addr[i] = cpu_to_le32(reply_address); - } } -static void init_rep_desc(struct leapraid_rq *rq, int index, - union leapraid_rep_desc_union *reply_post_free_contig) +static void init_rep_desc( + struct leapraid_rq *rq, + int index, + union leapraid_rep_desc_union *reply_post_free_contig) { struct leapraid_adapter *adapter = rq->adapter; unsigned int i; @@ -8218,7 +8908,7 @@ static void leapraid_init_bar_idx_regs(struct leapraid_adapter *adapter) static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; leapraid_init_task_tracker(adapter); leapraid_init_rep_msg_addr(adapter); @@ -8242,7 +8932,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return rc; if (!adapter->access_ctrl.shost_recovering) { - adapter->scan_dev_desc.wait_scan_dev_done = true; + adapter->scan_dev_desc.wait_scan_dev_done = 1; return 0; } @@ -8256,45 +8946,45 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) int leapraid_ctrl_init(struct leapraid_adapter *adapter) { u32 cap; - int rc = 0; + int rc; rc = leapraid_set_pcie_and_notification(adapter); if (rc) - goto out_free_resources; + goto out_free; pci_set_drvdata(adapter->pdev, adapter->shost); pcie_capability_read_dword(adapter->pdev, PCI_EXP_DEVCAP, &cap); - if (cap & PCI_EXP_DEVCAP_EXT_TAG) { + if (cap & PCI_EXP_DEVCAP_EXT_TAG) pcie_capability_set_word(adapter->pdev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_EXT_TAG); - } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "fw log init failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "FW log init failure\n"); + goto out_free; } rc = leapraid_request_host_memory(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "request host memory failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Request host memory failure\n"); + goto out_free; } init_waitqueue_head(&adapter->reset_desc.reset_wait_queue); + init_waitqueue_head(&adapter->access_ctrl.shost_recover_wq); rc = leapraid_alloc_dev_topo_bitmaps(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "alloc topo bitmaps failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Alloc topo bitmaps failure\n"); + goto out_free; } rc = leapraid_init_driver_cmds(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "init driver cmds failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; } leapraid_init_event_mask(adapter); @@ -8302,14 +8992,23 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_available(adapter); if (rc) { dev_err(&adapter->pdev->dev, - "make adapter available failure\n"); - goto out_free_resources; + "Make adapter available failure\n"); + goto out_free; } + + leapraid_overheat_init(adapter); + if (!adapter->overheat_desc.fault_overheat_wq) { + rc = -ENOMEM; + goto out_free; + } + return 0; -out_free_resources: - adapter->access_ctrl.host_removing = true; +out_free: + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -8319,9 +9018,11 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) void leapraid_remove_ctrl(struct leapraid_adapter *adapter) { + leapraid_overheat_cleanup(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index f7072d078315..df61bc2e994a 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -1,16 +1,16 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #ifndef LEAPRAID_FUNC_H_INCLUDED #define LEAPRAID_FUNC_H_INCLUDED #include <linux/pci.h> #include <linux/aer.h> #include <linux/poll.h> +#include <linux/atomic.h> #include <linux/errno.h> #include <linux/ktime.h> #include <linux/delay.h> @@ -28,9 +28,9 @@ #include "leapraid.h" #include <linux/blk-mq-pci.h> -/* some requset and reply buffer size */ +/* Request and reply buffer size. */ #define LEAPRAID_REQUEST_SIZE 128 -#define LEAPRAID_REPLY_SIEZ 128 +#define LEAPRAID_REPLY_SIZE 128 #define LEAPRAID_CHAIN_SEG_SIZE 128 #define LEAPRAID_MAX_SGES_IN_CHAIN 7 #define LEAPRAID_DEFAULT_CHAINS_PER_IO 19 @@ -45,61 +45,68 @@ #define LEAPRAID_SYS_LOG_BUF_SIZE 0x200000 #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 -/* Driver version and name */ +/* Driver version and name. */ #define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 +#define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.06" +#define LEAPRAID_DRIVER_VERSION "2.00.01.02" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 06 +#define LEAPRAID_BUILD_VERSION 01 +#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MSG_VERSION 0x1021 +#define LEAPRAID_HEADER_VERSION 0x0000 -/* Device ID */ +/* Device ID. */ #define LEAPRAID_VENDOR_ID 0xD405 #define LEAPRAID_DEVID_HBA 0x8200 -#define LEAPRAID_DEVID_RAID 0x8201 +#define LEAPRAID_SUBVENDOR_ID 0xD405 +#define LEAPRAID_SUBDEVID_HBA 0x8200 #define LEAPRAID_PCI_VENDOR_ID_MASK 0xFFFF - /* RAID virtual channel ID */ + /* RAID virtual channel ID. */ #define RAID_CHANNEL 1 -/* Scatter/Gather (SG) segment limits */ +/* Scatter-gather (SG) segment limits. */ #define LEAPRAID_MAX_PHYS_SEGMENTS SG_CHUNK_SIZE #define LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS 32 #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS -/* firmware / config page operations */ +/* Firmware and config page operations. */ #define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 -/* Hardware access helpers*/ +/* Hardware access helpers. */ #define leapraid_readl(addr) readl(addr) #define leapraid_check_reset(status) \ (!((status) & LEAPRAID_CMD_RESET)) -/* Polling intervals */ +/* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 #define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 #define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) -/* init mask */ +/* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 #define LEAPRAID_REPLY_INT_MASK 0x00000008 #define LEAPRAID_TO_SYS_DB_MASK 0x00000001 -/* queue depth */ +/* Queue depth. */ #define LEAPRAID_SATA_QUEUE_DEPTH 32 -#define LEAPRAID_SAS_QUEUE_DEPTH 254 -#define LEAPRAID_RAID_QUEUE_DEPTH 128 +#define LEAPRAID_SAS_QUEUE_DEPTH 64 +#define LEAPRAID_RAID_QUEUE_DEPTH 64 + +/* Target probe flag. */ +#define LEAPRAID_NO_ULD_ATTACH_FLAG 1 +#define LEAPRAID_ULD_ATTACH_FLAG 0 -/* SCSI device and queue limits */ -#define LEAPRAID_MAX_SECTORS 8192 -#define LEAPRAID_DEF_MAX_SECTORS 32767 +/* SCSI device and queue limits. */ +#define LEAPRAID_MAX_SECTORS 2048 #define LEAPRAID_MAX_CDB_LEN 32 #define LEAPRAID_MAX_LUNS 16384 #define LEAPRAID_CAN_QUEUE_MIN 1 @@ -107,136 +114,166 @@ #define LEAPRAID_CMD_PER_LUN 128 #define LEAPRAID_MAX_SEGMENT_SIZE 0xffffffff -/* SCSI sense and ASC/ASCQ and disk geometry configuration */ +/* SCSI sense and ASC/ASCQ and disk geometry configuration. */ #define DESC_FORMAT_THRESHOLD 0x72 #define SENSE_KEY_MASK 0x0F #define SCSI_SENSE_RESPONSE_CODE_MASK 0x7F #define ASC_FAILURE_PREDICTION_THRESHOLD_EXCEEDED 0x5D -#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL /* in sectors, 1GB */ +#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL #define LEAPRAID_LARGE_DISK_HEADS 255 #define LEAPRAID_LARGE_DISK_SECTORS 63 #define LEAPRAID_SMALL_DISK_HEADS 64 #define LEAPRAID_SMALL_DISK_SECTORS 32 -/* SMP (Serial Management Protocol) */ +/* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 #define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 -/* SCSI ASC/ASCQ definitions */ +/* SCSI ASC/ASCQ definitions. */ #define LEAPRAID_SCSI_ASCQ_DEFAULT 0x00 #define LEAPRAID_SCSI_ASC_POWER_ON_RESET 0x29 #define LEAPRAID_SCSI_ASC_INVALID_CMD_CODE 0x20 #define LEAPRAID_SCSI_ASCQ_POWER_ON_RESET 0x07 -/* ---- VPD Page 0x89 (ATA Information) ---- */ +/* VPD Page 0x89 (ATA Information). */ #define LEAPRAID_VPD_PAGE_ATA_INFO 0x89 #define LEAPRAID_VPD_PG89_MAX_LEN 255 #define LEAPRAID_VPD_PG89_MIN_LEN 214 -/* Byte index for NCQ support flag in VPD Page 0x89 */ +/* Byte index for NCQ support flag in VPD page 0x89. */ #define LEAPRAID_VPD_PG89_NCQ_BYTE_IDX 213 #define LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT 4 #define LEAPRAID_VPD_PG89_NCQ_BIT_MASK 0x1 -/* readiness polling: max retries, sleep µs between */ +/* Readiness polling: max retries, sleep µs between. */ #define LEAPRAID_ADAPTER_READY_MAX_RETRY 15000 #define LEAPRAID_ADAPTER_READY_SLEEP_MIN_US 1000 #define LEAPRAID_ADAPTER_READY_SLEEP_MAX_US 1100 -/* Doorbell wait parameters */ +/* Doorbell wait parameters. */ #define LEAPRAID_DB_WAIT_MAX_RETRY 20000 #define LEAPRAID_DB_WAIT_DELAY_US 500 -/* Basic data size definitions */ +/* Basic data size definitions. */ #define LEAPRAID_DWORDS_BYTE_SIZE 4 #define LEAPRAID_WORD_BYTE_SIZE 2 -/* SGL threshold and chain offset*/ +/* SGL threshold and chain offset. */ #define LEAPRAID_SGL_INLINE_THRESHOLD 2 #define LEAPRAID_CHAIN_OFFSET_DWORDS 7 -/* MSI-X group size and mask */ +/* MSI-X group size and mask. */ #define LEAPRAID_MSIX_GROUP_SIZE 8 #define LEAPRAID_MSIX_GROUP_MASK 7 -/* basic constants and limits */ +/* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 #define LEAPRAID_INDEX_FIRST 0 #define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF -/* retry / sleep configuration */ +/* Retry/Sleep configuration. */ +#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 +#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF +#define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 +#define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF +#define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 +#define LEAPRAID_WRSEQ_3RD_KEY_VALUE 0xB +#define LEAPRAID_WRSEQ_4TH_KEY_VALUE 0x2 +#define LEAPRAID_WRSEQ_5TH_KEY_VALUE 0x7 +#define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 #define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 -#define LEAPRAID_MSLEEP_LONG_MS 256 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 -/* controller reset loop parameters */ -#define LEAPRAID_RESET_LOOP_COUNT_REF (300000 / 256) -#define LEAPRAID_RESET_LOOP_COUNT_DEFAULT 10000 -#define LEAPRAID_RESET_POLL_INTERVAL_MS 500 - -/* Device / Volume configuration */ +/* Device/Volume configuration. */ #define LEAPRAID_MAX_VOLUMES_DEFAULT 32 #define LEAPRAID_MAX_DEV_HANDLE_DEFAULT 2048 #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF -/* cmd queue depth */ +/* Commands queue depth. */ #define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 -/* task id offset */ +/* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 #define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 -#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 +#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 #define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD 4 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 5 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 6 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 -/* task id offset for high-priority */ +/* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 #define LEAPRAID_HP_TASKID_OFFSET_TM_CMD 1 -/* Event / Boot configuration */ +/* Event/Boot configuration. */ #define LEAPRAID_EVT_MASK_COUNT 4 #define LEAPRAID_BOOT_DEV_SIZE 24 -/* logsense command definitions */ +/* Commands timeout. */ +#define LEAPRAID_UNIFIED_TIMEOUT 30 +#define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 +#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT + +/* Logsense command definitions. */ #define LEAPRAID_LOGSENSE_DATA_LENGTH 16 #define LEAPRAID_LOGSENSE_CDB_LENGTH 10 #define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT 5 +#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_LOGSENSE_SMART_CODE 0x5D -/* cmd timeout */ -#define LEAPRAID_DRIVER_SCSIIO_CMD_TIMEOUT LEAPRAID_LOGSENSE_TIMEOUT -#define LEAPRAID_CFG_OP_TIMEOUT 15 -#define LEAPRAID_CTL_CMD_TIMEOUT 10 -#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT 10 -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT 10 -#define LEAPRAID_ENC_CMD_TIMEOUT 10 -#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT 30 -#define LEAPRAID_TM_CMD_TIMEOUT 30 -#define LEAPRAID_TRANSPORT_CMD_TIMEOUT 10 +/* Host DMA cap. */ +#define DMA_32_BITS 32 +#define DMA_64_BITS 64 +#define LEAPRAID_DMA_ALIGN 16 + +/* Values used to represent an invalid. */ +#define LEAPRAID_INVALID_INDEX -1 +#define LEAPRAID_INVALID_MSIX_VECTORS -1 +#define LEAPRAID_INVALID_INITIAL_VALUE -1 +#define LEAPRAID_OPERATION_FAILED -1 + +/* Version shift and mask. */ +#define LEAPRAID_VER_MAJOR_SHIFT 24 +#define LEAPRAID_VER_MINOR_SHIFT 16 +#define LEAPRAID_VER_BUILD_SHIFT 8 +#define LEAPRAID_VER_MASK 0xFF + +/* Interrupt type. */ +#define LEAPRAID_INTERRUPT_MODE_MSIX 0 +#define LEAPRAID_INTERRUPT_MODE_MSI 1 +#define LEAPRAID_INTERRUPT_MODE_LEGACY 2 + +/* SMP link reset. */ +#define SMP_PHY_CONTROL_LINK_RESET 0x01 +#define SMP_PHY_CONTROL_HARD_RESET 0x02 +#define SMP_PHY_CONTROL_DISABLE 0x03 /** - * struct leapraid_adapter_features - Features and - * capabilities of a LeapRAID adapter + * struct leapraid_adapter_features - Adapter features/capabilities. * - * @req_slot: Number of request slots supported by the adapter - * @hp_slot: Number of high-priority slots supported by the adapter - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version of the adapter - * @max_dev_handle: Maximum device supported by the adapter + * @req_slot: Number of request slots supported by the adapter. + * @hp_slot: Number of high-priority slots supported by the adapter. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version of the adapter. + * @max_dev_handle: Maximum device handle supported by the adapter. + * @min_dev_handle: Minimum device handle supported by the adapter. */ struct leapraid_adapter_features { u16 req_slot; @@ -252,32 +289,35 @@ struct leapraid_adapter_features { /** * struct leapraid_adapter_attr - Adapter attributes and capabilities * - * @id: Adapter identifier - * @raid_support: Indicates if RAID is supported - * @bios_version: Version of the adapter BIOS - * @enable_mp: Indicates if multipath (MP) support is enabled - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @sata_max_queue_depth: Maximum queue depth for SATA - * @features: Detailed features of the adapter - * @adapter_total_qd: Total queue depth available on the adapter - * @io_qd: Queue depth allocated for I/O operations - * @rep_msg_qd: Queue depth for reply messages - * @rep_desc_qd: Queue depth for reply descriptors - * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue - * @rq_cnt: Number of request queues - * @task_desc_dma_size: Size of task descriptor DMA memory - * @use_32_dma_mask: Indicates if 32-bit DMA mask is used - * @name: Adapter name string + * @id: Adapter identifier. + * @raid_support: Indicates if RAID is supported. + * @bios_version: Version of the adapter BIOS. + * @enable_mp: Indicates if multipath (MP) support is enabled. + * @wideport_max_queue_depth: Maximum queue depth for wide ports. + * @narrowport_max_queue_depth: Maximum queue depth for narrow ports. + * @sata_max_queue_depth: Maximum queue depth for SATA. + * @raid_volume_max_queue_depth: Maximum queue depth for RAID volumes. + * @features: Detailed features of the adapter. + * @adapter_total_qd: Total queue depth available on the adapter. + * @io_qd: Queue depth allocated for I/O operations. + * @rep_msg_qd: Queue depth for reply messages. + * @rep_desc_qd: Queue depth for reply descriptors. + * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue. + * @rq_cnt: Number of request queues. + * @task_desc_dma_size: Size of task descriptor DMA memory. + * @use_32_dma_mask: Indicates if 32-bit DMA mask is used. + * @name: Adapter name string. + * @board_name: Board name retrieved from manufacturing page 0. */ struct leapraid_adapter_attr { u8 id; - bool raid_support; + u8 raid_support; u32 bios_version; - bool enable_mp; + u8 enable_mp; u32 wideport_max_queue_depth; u32 narrowport_max_queue_depth; u32 sata_max_queue_depth; + u32 raid_volume_max_queue_depth; struct leapraid_adapter_features features; u32 adapter_total_qd; u32 io_qd; @@ -286,20 +326,20 @@ struct leapraid_adapter_attr { u32 rep_desc_q_seg_cnt; u16 rq_cnt; u32 task_desc_dma_size; - bool use_32_dma_mask; + u8 use_32_dma_mask; char name[LEAPRAID_NAME_LENGTH]; + char board_name[LEAPRAID_BOARD_NAME_LENGTH]; }; /** - * struct leapraid_io_req_tracker - Track a SCSI I/O request - * for the adapter + * struct leapraid_io_req_tracker - Track a SCSI I/O request for the adapter * - * @taskid: Unique task ID for this I/O request - * @scmd: Pointer to the associated SCSI command - * @chain_list: List of chain frames associated with this request - * @msix_io: MSI-X vector assigned to this I/O request - * @chain: Pointer to the chain memory for this request - * @chain_dma: DMA address of the chain memory + * @taskid: Unique task ID for this I/O request. + * @scmd: Pointer to the associated SCSI command. + * @chain_list: List of chain frames associated with this request. + * @msix_io: MSI-X vector assigned to this I/O request. + * @chain: Pointer to the chain memory for this request. + * @chain_dma: DMA address of the chain memory. */ struct leapraid_io_req_tracker { u16 taskid; @@ -313,9 +353,9 @@ struct leapraid_io_req_tracker { /** * struct leapraid_task_tracker - Tracks a task in the adapter * - * @taskid: Unique task ID for this tracker - * @cb_idx: Callback index associated with this task - * @tracker_list: Linked list node to chain this tracker in lists + * @taskid: Unique task ID for this tracker. + * @cb_idx: Callback index associated with this task. + * @tracker_list: Linked list node to chain this tracker in lists. */ struct leapraid_task_tracker { u16 taskid; @@ -324,11 +364,10 @@ struct leapraid_task_tracker { }; /** - * struct leapraid_rep_desc_maint - Maintains reply descriptor - * memory + * struct leapraid_rep_desc_maint - Maintains reply descriptor memory * - * @rep_desc: Pointer to the reply descriptor - * @rep_desc_dma: DMA address of the reply descriptor + * @rep_desc: Pointer to the reply descriptor. + * @rep_desc_dma: DMA address of the reply descriptor. */ struct leapraid_rep_desc_maint { union leapraid_rep_desc_union *rep_desc; @@ -336,12 +375,12 @@ struct leapraid_rep_desc_maint { }; /** - * struct leapraid_rep_desc_seg_maint - Maintains reply descriptor - * segment memory + * struct leapraid_rep_desc_seg_maint - + * Maintains reply descriptor segment memory * - * @rep_desc_seg: Pointer to the reply descriptor segment - * @rep_desc_seg_dma: DMA address of the reply descriptor segment - * @rep_desc_maint: Pointer to the main reply descriptor structure + * @rep_desc_seg: Pointer to the reply descriptor segment. + * @rep_desc_seg_dma: DMA address of the reply descriptor segment. + * @rep_desc_maint: Pointer to the main reply descriptor structure. */ struct leapraid_rep_desc_seg_maint { void *rep_desc_seg; @@ -352,20 +391,20 @@ struct leapraid_rep_desc_seg_maint { /** * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * - * @task_desc: Pointer to task descriptor - * @task_desc_dma: DMA address of task descriptor - * @sg_chain_pool: DMA pool for SGL chain allocations - * @sg_chain_pool_size: Size of the sg_chain_pool - * @taskid_to_uniq_tag: Mapping from task ID to unique tag - * @sense_data: Buffer for SCSI sense data - * @sense_data_dma: DMA address of sense_data buffer - * @rep_msg: Buffer for reply message - * @rep_msg_dma: DMA address of reply message buffer - * @rep_msg_addr: Pointer to reply message address - * @rep_msg_addr_dma: DMA address of reply message address - * @rep_desc_seg_maint: Pointer to reply descriptor segment - * @rep_desc_q_arr: Pointer to reply descriptor queue array - * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array + * @task_desc: Pointer to task descriptor. + * @task_desc_dma: DMA address of task descriptor. + * @sg_chain_pool: DMA pool for SGL chain allocations. + * @sg_chain_pool_size: Size of the sg_chain_pool. + * @taskid_to_uniq_tag: Mapping from task ID to unique tag. + * @sense_data: Buffer for SCSI sense data. + * @sense_data_dma: DMA address of sense_data buffer. + * @rep_msg: Buffer for reply message. + * @rep_msg_dma: DMA address of reply message buffer. + * @rep_msg_addr: Pointer to reply message address. + * @rep_msg_addr_dma: DMA address of reply message address. + * @rep_desc_seg_maint: Pointer to reply descriptor segment. + * @rep_desc_q_arr: Pointer to reply descriptor queue array. + * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array. */ struct leapraid_mem_desc { void *task_desc; @@ -384,31 +423,30 @@ struct leapraid_mem_desc { dma_addr_t rep_desc_q_arr_dma; }; -#define LEAPRAID_FIXED_INTER_CMDS 7 -#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_INTER_HP_CMDS_DIF \ - (LEAPRAID_FIXED_INTER_CMDS - LEAPRAID_FIXED_HP_CMDS) +/* internal cmd description */ +#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_CMD_NOT_USED 0x8000 -#define LEAPRAID_CMD_DONE 0x0001 -#define LEAPRAID_CMD_PENDING 0x0002 -#define LEAPRAID_CMD_REPLY_VALID 0x0004 -#define LEAPRAID_CMD_RESET 0x0008 +#define LEAPRAID_CMD_NOT_USED 0x8000 +#define LEAPRAID_CMD_DONE 0x0001 +#define LEAPRAID_CMD_PENDING 0x0002 +#define LEAPRAID_CMD_REPLY_VALID 0x0004 +#define LEAPRAID_CMD_RESET 0x0008 /** * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * - * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index - * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index - * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index - * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index - * @LEAPRAID_ENC_CB_IDX: Encryption callback index - * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index - * @LEAPRAID_CTL_CB_IDX: Control callback index - * @LEAPRAID_TM_CB_IDX: Task management callback index + * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. + * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. + * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. + * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. + * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. + * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. + * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. + * @LEAPRAID_ENC_CB_IDX: Encryption callback index. + * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. + * @LEAPRAID_CTL_CB_IDX: Control callback index. + * @LEAPRAID_TM_CB_IDX: Task management callback index. */ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, @@ -425,10 +463,25 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_NUM_CB_IDXS }; +/** + * struct leapraid_default_reply - Default reply frame buffer + * @pad: Raw reply data buffer returned by firmware. + * + * This structure represents a generic reply frame used by the firmware + * when no specific reply format is required. The buffer size is defined + * by LEAPRAID_REPLY_SIZE and stores the raw reply data. + */ struct leapraid_default_reply { - u8 pad[LEAPRAID_REPLY_SIEZ]; + u8 pad[LEAPRAID_REPLY_SIZE]; }; +/** + * struct leapraid_sense_buffer - SCSI sense data buffer + * @pad: Buffer used to store sense data returned by a SCSI command. + * + * This buffer holds the sense data provided by a device.The size is + * defined by SCSI_SENSE_BUFFERSIZE. + */ struct leapraid_sense_buffer { u8 pad[SCSI_SENSE_BUFFERSIZE]; }; @@ -436,17 +489,17 @@ struct leapraid_sense_buffer { /** * struct leapraid_driver_cmd - Driver command tracking structure * - * @reply: Default reply structure returned by the adapter - * @done: Completion object used to signal command completion - * @status: Status code returned by the firmware - * @taskid: Unique task identifier for this command - * @hp_taskid: Task identifier for high-priority commands - * @inter_taskid: Task identifier for internal commands - * @cb_idx: Callback index used to identify completion context - * @async_scan_dev: True if this command is for asynchronous device scan - * @sense: Sense buffer holding error information from device - * @mutex: Mutex to protect access to this command structure - * @list: List node for linking driver commands into lists + * @reply: Default reply structure returned by the adapter. + * @done: Completion object used to signal command completion. + * @status: Status code returned by the firmware. + * @taskid: Unique task identifier for this command. + * @hp_taskid: Task identifier for high-priority commands. + * @inter_taskid: Task identifier for internal commands. + * @cb_idx: Callback index used to identify completion context. + * @async_scan_dev: True if this command is for asynchronous device scan. + * @sense: Sense buffer holding error information from device. + * @mutex: Mutex to protect access to this command structure. + * @list: List node for linking driver commands into lists. */ struct leapraid_driver_cmd { struct leapraid_default_reply reply; @@ -456,27 +509,27 @@ struct leapraid_driver_cmd { u16 hp_taskid; u16 inter_taskid; u8 cb_idx; - bool async_scan_dev; + u8 async_scan_dev; struct leapraid_sense_buffer sense; - struct mutex mutex; + struct mutex mutex; /* Mutex for driver cmd */ struct list_head list; }; /** * struct leapraid_driver_cmds - Collection of driver command objects * - * @special_cmd_list: List head for tracking special driver commands - * @scan_dev_cmd: Command used for asynchronous device scan operations - * @cfg_op_cmd: Command for configuration operations - * @transport_cmd: Command for transport-level operations - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware - * @raid_action_cmd: Command for RAID-related management or action requests - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing - * @enc_cmd: Command for enclosure management operations - * @notify_event_cmd: Command for asynchronous event notification handling - * @ctl_cmd: Command for generic control or maintenance operations - * @tm_cmd: Task management command - * @internal_scmd: Pointer to internal SCSI command used by the driver + * @special_cmd_list: List head for tracking special driver commands. + * @scan_dev_cmd: Command used for asynchronous device scan operations. + * @cfg_op_cmd: Command for configuration operations. + * @transport_cmd: Command for transport-level operations. + * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. + * @raid_action_cmd: Command for RAID-related management or action requests. + * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. + * @enc_cmd: Command for enclosure management operations. + * @notify_event_cmd: Command for asynchronous event notification handling. + * @ctl_cmd: Command for generic control or maintenance operations. + * @tm_cmd: Task management command. + * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; @@ -496,14 +549,14 @@ struct leapraid_driver_cmds { /** * struct leapraid_dynamic_task_desc - Dynamic task descriptor * - * @task_lock: Spinlock to protect concurrent access - * @hp_taskid: Current high-priority task ID - * @hp_cmd_qd: Fixed command queue depth for high-priority tasks - * @inter_taskid: Current internal task ID - * @inter_cmd_qd: Fixed command queue depth for internal tasks + * @task_lock: Spinlock to protect concurrent access. + * @hp_taskid: Current high-priority task ID. + * @hp_cmd_qd: Fixed command queue depth for high-priority tasks. + * @inter_taskid: Current internal task ID. + * @inter_cmd_qd: Fixed command queue depth for internal tasks. */ struct leapraid_dynamic_task_desc { - spinlock_t task_lock; + spinlock_t task_lock; /* protects dynamic task */ u16 hp_taskid; u16 hp_cmd_qd; u16 inter_taskid; @@ -513,14 +566,14 @@ struct leapraid_dynamic_task_desc { /** * struct leapraid_fw_evt_work - Firmware event work structure * - * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRAID adapter - * @work: Work structure used by the kernel workqueue - * @refcnt: Reference counter for managing the lifetime of this work - * @evt_data: Pointer to firmware event data - * @dev_handle: Device handle associated with the event - * @evt_type: Type of firmware event - * @ignore: Flag indicating whether the event should be ignored + * @list: Linked list node for queuing the work. + * @adapter: Pointer to the associated LeapRAID adapter. + * @work: Work structure used by the kernel workqueue. + * @refcnt: Reference counter for managing the lifetime of this work. + * @evt_data: Pointer to firmware event data. + * @dev_handle: Device handle associated with the event. + * @evt_type: Type of firmware event. + * @ignore: Flag indicating whether the event should be ignored. */ struct leapraid_fw_evt_work { struct list_head list; @@ -536,33 +589,35 @@ struct leapraid_fw_evt_work { /** * struct leapraid_fw_evt_struct - Firmware event handling structure * - * @fw_evt_name: Name of the firmware event - * @fw_evt_thread: Workqueue used for processing firmware events - * @fw_evt_lock: Spinlock protecting access to the firmware event list - * @fw_evt_list: Linked list of pending firmware events - * @cur_evt: Pointer to the currently processing firmware event - * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress - * @leapraid_evt_masks: Array of event masks for filtering firmware events + * @fw_evt_name: Name of the firmware event. + * @fw_evt_thread: Workqueue used for processing firmware events. + * @fw_evt_lock: Spinlock protecting access to the firmware event list. + * @fw_evt_list: Linked list of pending firmware events. + * @cur_evt: Pointer to the currently processing firmware event. + * @cur_evt_task: Task currently executing @cur_evt work. + * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress. + * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; - spinlock_t fw_evt_lock; + spinlock_t fw_evt_lock; /* protects firmware event */ struct list_head fw_evt_list; struct leapraid_fw_evt_work *cur_evt; - int fw_evt_cleanup; + struct task_struct *cur_evt_task; + u8 fw_evt_cleanup; u32 leapraid_evt_masks[4]; }; /** * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRAID adapter - * @msix_idx: MSI-X vector index used by this queue - * @rep_post_host_idx: Index of the last processed reply descriptor - * @rep_desc: Pointer to the reply descriptor associated with this queue - * @name: Name of the request queue - * @busy: Atomic counter indicating if the queue is busy + * @adapter: Pointer to the associated LeapRAID adapter. + * @msix_idx: MSI-X vector index used by this queue. + * @rep_post_host_idx: Index of the last processed reply descriptor. + * @rep_desc: Pointer to the reply descriptor associated with this queue. + * @name: Name of the request queue. + * @busy: Atomic counter indicating if the queue is busy. */ struct leapraid_rq { struct leapraid_adapter *adapter; @@ -576,8 +631,8 @@ struct leapraid_rq { /** * struct leapraid_int_rq - Internal request queue for a CPU * - * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRAID request queue structure + * @affinity_hint: CPU affinity mask for the queue. + * @rq: Underlying LeapRAID request queue structure. */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -587,9 +642,9 @@ struct leapraid_int_rq { /** * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * - * @busy: Atomic flag indicating request is being processed - * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRAID request structure + * @busy: Atomic flag indicating request is being processed. + * @pause: Atomic flag to temporarily suspend polling. + * @rq: The underlying LeapRAID request structure. */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,22 +653,25 @@ struct leapraid_blk_mq_poll_rq { }; /** - * struct leapraid_notification_desc - Notification - * descriptor for LeapRAID + * struct leapraid_notification_desc - Notification descriptor for LeapRAID * - * @iopoll_qdex: Index of the I/O polling queue - * @iopoll_qcnt: Count of I/O polling queues - * @msix_enable: Flag indicating MSI-X is enabled - * @msix_cpu_map: CPU map for MSI-X interrupts - * @msix_cpu_map_sz: Size of the MSI-X CPU map - * @int_rqs: Array of interrupt request queues - * @int_rqs_allocated: Count of allocated interrupt request queues - * @blk_mq_poll_rqs: Array of blk-mq polling requests + * @iopoll_qdex: Index of the I/O polling queue. + * @iopoll_qcnt: Count of I/O polling queues. + * @msix_enable: Flag indicating MSI-X is enabled. + * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. + * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. + * @msix_cpu_map: CPU map for MSI-X interrupts. + * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @int_rqs: Array of interrupt request queues. + * @int_rqs_allocated: Count of allocated interrupt request queues. + * @blk_mq_poll_rqs: Array of blk-mq polling requests. */ struct leapraid_notification_desc { u32 iopoll_qdex; u32 iopoll_qcnt; - bool msix_enable; + u8 msix_enable; + u8 irq_vectors_allocated; + u8 irq_mode; u8 *msix_cpu_map; u32 msix_cpu_map_sz; struct leapraid_int_rq *int_rqs; @@ -621,82 +679,104 @@ struct leapraid_notification_desc { struct leapraid_blk_mq_poll_rq *blk_mq_poll_rqs; }; +/** + * struct leapraid_overheat_desc - Overheat descriptor for LeapRAID + * + * @fault_overheat_wq: Workqueue for adapter thermal overheat operations. + * @fault_overheat_work: Work structure for thermal overheat. + * @thermal_alert: Flag indicating if adapter thermal alert is active. + * @fault_overheat_wq_name: Name of the fault overheat workqueue. + */ +struct leapraid_overheat_desc { + struct workqueue_struct *fault_overheat_wq; + struct work_struct fault_overheat_work; + atomic_t thermal_alert; + char fault_overheat_wq_name[48]; +}; + /** * struct leapraid_reset_desc - Reset descriptor for LeapRAID * - * @fault_reset_wq: Workqueue for fault reset operations - * @fault_reset_work: Delayed work structure for fault reset - * @fault_reset_wq_name: Name of the fault reset workqueue - * @host_diag_mutex: Mutex for host diagnostic operations - * @adapter_reset_lock: Spinlock for adapter reset operations - * @adapter_reset_mutex: Mutex for adapter reset operations - * @adapter_link_resetting: Flag indicating if adapter link is resetting - * @adapter_reset_results: Results of the adapter reset operation - * @pending_io_cnt: Count of pending I/O operations - * @reset_wait_queue: Wait queue for reset operations - * @reset_cnt: Counter for reset operations + * @fault_reset_wq: Workqueue for fault reset operations. + * @fault_reset_work: Delayed work structure for fault reset. + * @fault_reset_wq_name: Name of the fault reset workqueue. + * @host_diag_mutex: Mutex for host diagnostic operations. + * @adapter_reset_lock: Spinlock for adapter reset operations. + * @adapter_reset_mutex: Mutex for adapter reset operations. + * @adapter_link_resetting: Flag indicating if adapter link is resetting. + * @adapter_reset_results: Results of the adapter reset operation. + * @pending_io_cnt: Count of pending I/O operations. + * @reset_wait_queue: Wait queue for reset operations. + * @reset_cnt: Counter for reset operations. + * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; struct delayed_work fault_reset_work; char fault_reset_wq_name[48]; - struct mutex host_diag_mutex; - spinlock_t adapter_reset_lock; - struct mutex adapter_reset_mutex; - bool adapter_link_resetting; + struct mutex host_diag_mutex; /* Mutex for operations. */ + spinlock_t adapter_reset_lock; /* Protects adapter reset state. */ + struct mutex adapter_reset_mutex; /* Serializes adapter reset. */ + u8 adapter_link_resetting; int adapter_reset_results; int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; + u32 last_reset_cnt; }; /** - * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRAID + * struct leapraid_scan_dev_desc - Scan device descriptor for LeapRAID * - * @wait_scan_dev_done: Flag indicating if scan device operation is done - * @driver_loading: Flag indicating if driver is loading - * @first_scan_dev_fired: Flag indicating if first scan device operation fired - * @scan_dev_failed: Flag indicating if scan device operation failed - * @scan_start: Flag indicating if scan operation started - * @scan_start_failed: Count of failed scan start operations + * @wait_scan_dev_done: Flag indicating if scan device operation is done. + * @driver_loading: Flag indicating if driver is loading. + * @first_scan_dev_fired: Flag indicating if first scan device operation fired. + * @scan_dev_failed: Flag indicating if scan device operation failed. + * @scan_start: Flag indicating if scan operation started. + * @scan_start_failed: Count of failed scan start operations. */ struct leapraid_scan_dev_desc { - bool wait_scan_dev_done; - bool driver_loading; - bool first_scan_dev_fired; - bool scan_dev_failed; - bool scan_start; + u8 wait_scan_dev_done; + u8 driver_loading; + wait_queue_head_t wait_driver_loading; + u8 first_scan_dev_fired; + u8 scan_dev_failed; + u8 scan_start; u16 scan_start_failed; }; /** * struct leapraid_access_ctrl - Access control structure for LeapRAID * - * @pci_access_lock: Mutex for PCI access control - * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active - * @shost_recovering: Flag indicating if host is recovering - * @host_removing: Flag indicating if host is being removed - * @pcie_recovering: Flag indicating if PCIe is recovering + * @pci_access_lock: Mutex for PCI access control. + * @shost_recovering: Flag indicating if host is recovering. + * @shost_recover_async: Flag indicating if host is recovering + * and the 0xFFFF event. + * @shost_recover_wq: Wait queue for threads waiting on shost_recover_async. + * @host_removing: Flag indicating if host is being removed. + * @pcie_recovering: Flag indicating if PCIe is recovering. */ struct leapraid_access_ctrl { - struct mutex pci_access_lock; - bool adapter_thermal_alert; - bool shost_recovering; - bool host_removing; - bool pcie_recovering; + struct mutex pci_access_lock; /* serializes PCI register access. */ + u8 shost_recovering; + wait_queue_head_t recovery_waitq; + u8 shost_recover_async; + wait_queue_head_t shost_recover_wq; + u8 host_removing; + u8 pcie_recovering; }; /** * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * - * @fw_log_buffer: Buffer for firmware log data - * @fw_log_buffer_dma: DMA address of the firmware log buffer - * @fw_log_wq_name: Name of the firmware log workqueue - * @fw_log_wq: Workqueue for firmware log operations - * @fw_log_work: Delayed work structure for firmware log - * @open_pcie_trace: Flag indicating if PCIe tracing is open - * @fw_log_init_flag: Flag indicating if firmware log is initialized + * @fw_log_buffer: Buffer for firmware log data. + * @fw_log_buffer_dma: DMA address of the firmware log buffer. + * @fw_log_wq_name: Name of the firmware log workqueue. + * @fw_log_wq: Workqueue for firmware log operations. + * @fw_log_work: Delayed work structure for firmware log. + * @open_pcie_trace: Flag indicating if PCIe tracing is open. + * @fw_log_init_flag: Flag indicating if firmware log is initialized. + * @pre_debug_log: Last DebugLog register snapshot for change detection. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -706,6 +786,7 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; + u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -714,13 +795,13 @@ struct leapraid_fw_log_desc { /** * struct leapraid_card_port - Card port structure for LeapRAID * - * @list: List head for card port - * @vphys_list: List head for virtual phy list - * @port_id: Port ID - * @sas_address: SAS address - * @phy_mask: Mask of phy - * @vphys_mask: Mask of virtual phy - * @flg: Flags for the port + * @list: List head for card port. + * @vphys_list: List head for virtual PHY list. + * @port_id: Port ID. + * @sas_address: SAS address. + * @phy_mask: Mask of PHY. + * @vphys_mask: Mask of virtual PHY. + * @flg: Flags for the port. */ struct leapraid_card_port { struct list_head list; @@ -733,18 +814,18 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRAID + * struct leapraid_card_phy - Card PHY structure for LeapRAID * - * @port_siblings: List head for port siblings - * @card_port: Pointer to the card port - * @identify: SAS identify structure - * @remote_identify: Remote SAS identify structure - * @phy: SAS phy structure - * @phy_id: Phy ID - * @hdl: Handle for the port - * @attached_hdl: Handle for the attached port - * @phy_is_assigned: Flag indicating if phy is assigned - * @vphy: Flag indicating if virtual phy + * @port_siblings: List head for port siblings. + * @card_port: Pointer to the card port. + * @identify: SAS identify structure. + * @remote_identify: Remote SAS identify structure. + * @phy: SAS PHY structure. + * @phy_id: PHY ID. + * @hdl: Handle for the port. + * @attached_hdl: Handle for the attached port. + * @phy_is_assigned: Flag indicating if PHY is assigned. + * @vphy: Flag indicating if virtual PHY. */ struct leapraid_card_phy { struct list_head port_siblings; @@ -755,26 +836,26 @@ struct leapraid_card_phy { u8 phy_id; u16 hdl; u16 attached_hdl; - bool phy_is_assigned; - bool vphy; + u8 phy_is_assigned; + u8 vphy; }; /** * struct leapraid_topo_node - SAS topology node for LeapRAID * - * @list: List head for linking nodes - * @sas_port_list: List of SAS ports - * @card_port: Associated card port - * @card_phy: Associated card PHY - * @rphy: SAS remote PHY device - * @parent_dev: Parent device pointer - * @sas_address: SAS address of this node - * @sas_address_parent: Parent node's SAS address - * @phys_num: Number of physical links - * @hdl: Handle identifier - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical identifier - * @resp: Response status flag + * @list: List head for linking nodes. + * @sas_port_list: List of SAS ports. + * @card_port: Associated card port. + * @card_phy: Associated card PHY. + * @rphy: SAS remote PHY device. + * @parent_dev: Parent device pointer. + * @sas_address: SAS address of this node. + * @sas_address_parent: Parent node's SAS address. + * @phys_num: Number of physical links. + * @hdl: Handle identifier. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical identifier. + * @resp: Response status flag. */ struct leapraid_topo_node { struct list_head list; @@ -789,32 +870,32 @@ struct leapraid_topo_node { u16 hdl; u16 enc_hdl; u64 enc_lid; - bool resp; + u8 resp; }; /** * struct leapraid_dev_topo - LeapRAID device topology management structure * - * @topo_node_lock: Spinlock for protecting topology node operations - * @sas_dev_lock: Spinlock for SAS device list access - * @raid_volume_lock: Spinlock for RAID volume list access - * @sas_id: SAS domain identifier - * @card: Main card topology node - * @exp_list: List of expander devices - * @enc_list: List of enclosure devices - * @sas_dev_list: List of SAS devices - * @sas_dev_init_list: List of SAS devices being initialized - * @raid_volume_list: List of RAID volumes - * @card_port_list: List of card ports - * @pd_hdls: Array of physical disk handles - * @dev_removing: Array tracking devices being removed - * @pending_dev_add: Array tracking devices pending addition - * @blocking_hdls: Array of blocking handles + * @topo_node_lock: Spinlock for protecting topology node operations. + * @sas_dev_lock: Spinlock for SAS device list access. + * @raid_volume_lock: Spinlock for RAID volume list access. + * @enc_lock: Spinlock for enclosure device list access. + * @sas_id: SAS domain identifier. + * @card: Main card topology node. + * @exp_list: List of expander devices. + * @enc_list: List of enclosure devices. + * @sas_dev_list: List of SAS devices. + * @sas_dev_init_list: List of SAS devices being initialized. + * @raid_volume_list: List of RAID volumes. + * @card_port_list: List of card ports. + * @pd_hdls: Array of physical disk handles. + * @blocking_hdls: Array of blocking handles. */ struct leapraid_dev_topo { - spinlock_t topo_node_lock; - spinlock_t sas_dev_lock; - spinlock_t raid_volume_lock; + spinlock_t topo_node_lock; /* Protects topology node. */ + spinlock_t sas_dev_lock; /* Protects SAS device list access. */ + spinlock_t raid_volume_lock; /* Protects RAID volume list access. */ + spinlock_t enc_lock; /* Protects enclosure device list access. */ int sas_id; struct leapraid_topo_node card; struct list_head exp_list; @@ -824,21 +905,17 @@ struct leapraid_dev_topo { struct list_head raid_volume_list; struct list_head card_port_list; u16 pd_hdls_sz; - void *pd_hdls; - void *blocking_hdls; - u16 pending_dev_add_sz; - void *pending_dev_add; - u16 dev_removing_sz; - void *dev_removing; + unsigned long *pd_hdls; + unsigned long *blocking_hdls; }; /** * struct leapraid_boot_dev - Boot device structure for LeapRAID * - * @dev: Device pointer - * @chnl: Channel number - * @form: Form factor - * @pg_dev: Config page device content + * @dev: Device pointer. + * @chnl: Channel number. + * @form: Form factor. + * @pg_dev: Config page device content. */ struct leapraid_boot_dev { void *dev; @@ -849,11 +926,14 @@ struct leapraid_boot_dev { /** * struct leapraid_boot_devs - Boot device management structure - * @requested_boot_dev: Requested primary boot device - * @requested_alt_boot_dev: Requested alternate boot device - * @current_boot_dev: Currently active boot device + * + * @lock: Spinlock protecting boot device cache access. + * @requested_boot_dev: Requested primary boot device. + * @requested_alt_boot_dev: Requested alternate boot device. + * @current_boot_dev: Currently active boot device. */ struct leapraid_boot_devs { + spinlock_t lock; /* protects boot dev */ struct leapraid_boot_dev requested_boot_dev; struct leapraid_boot_dev requested_alt_boot_dev; struct leapraid_boot_dev current_boot_dev; @@ -861,9 +941,10 @@ struct leapraid_boot_devs { /** * struct leapraid_smart_poll_desc - SMART polling descriptor - * @smart_poll_wq: Workqueue for SMART polling tasks - * @smart_poll_work: Delayed work for SMART polling operations - * @smart_poll_wq_name: Workqueue name string + * + * @smart_poll_wq: Workqueue for SMART polling tasks. + * @smart_poll_work: Delayed work for SMART polling operations. + * @smart_poll_wq_name: Workqueue name string. */ struct leapraid_smart_poll_desc { struct workqueue_struct *smart_poll_wq; @@ -873,26 +954,28 @@ struct leapraid_smart_poll_desc { /** * struct leapraid_adapter - Main LeapRAID adapter structure - * @list: List head for adapter management - * @shost: SCSI host structure - * @pdev: PCI device structure - * @iomem_base: I/O memory mapped base address - * @rep_msg_host_idx: Host index for reply messages - * @mask_int: Interrupt masking flag - * @timestamp_sync_cnt: Timestamp synchronization counter - * @adapter_attr: Adapter attributes - * @mem_desc: Memory descriptor - * @driver_cmds: Driver commands - * @dynamic_task_desc: Dynamic task descriptor - * @fw_evt_s: Firmware event structure - * @notification_desc: Notification descriptor - * @reset_desc: Reset descriptor - * @scan_dev_desc: Device scan descriptor - * @access_ctrl: Access control - * @fw_log_desc: Firmware log descriptor - * @dev_topo: Device topology - * @boot_devs: Boot devices - * @smart_poll_desc: SMART polling descriptor + * + * @list: List head for adapter management. + * @shost: SCSI host structure. + * @pdev: PCI device structure. + * @iomem_base: I/O memory mapped base address. + * @rep_msg_host_idx: Host index for reply messages. + * @mask_int: Interrupt masking flag. + * @timestamp_sync_cnt: Timestamp synchronization counter. + * @adapter_attr: Adapter attributes. + * @mem_desc: Memory descriptor. + * @driver_cmds: Driver commands. + * @dynamic_task_desc: Dynamic task descriptor. + * @fw_evt_s: Firmware event structure. + * @notification_desc: Notification descriptor. + * @reset_desc: Reset descriptor. + * @scan_dev_desc: Device scan descriptor. + * @access_ctrl: Access control. + * @fw_log_desc: Firmware log descriptor. + * @dev_topo: Device topology. + * @boot_devs: Boot devices. + * @smart_poll_desc: SMART polling descriptor. + * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { struct list_head list; @@ -900,7 +983,7 @@ struct leapraid_adapter { struct pci_dev *pdev; struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; - bool mask_int; + u8 mask_int; u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; @@ -916,6 +999,7 @@ struct leapraid_adapter { struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; struct leapraid_smart_poll_desc smart_poll_desc; + struct leapraid_overheat_desc overheat_desc; }; union cfg_param_1 { @@ -932,6 +1016,7 @@ union cfg_param_2 { enum config_page_action { GET_BIOS_PG2, GET_BIOS_PG3, + GET_MANUFACTURING_PG0, GET_SAS_DEVICE_PG0, GET_SAS_IOUNIT_PG0, GET_SAS_IOUNIT_PG1, @@ -946,8 +1031,9 @@ enum config_page_action { /** * struct leapraid_enc_node - Enclosure node structure - * @list: List head for enclosure management - * @pg0: Enclosure page 0 data + * + * @list: List head for enclosure management. + * @pg0: Enclosure page 0 data. */ struct leapraid_enc_node { struct list_head list; @@ -956,20 +1042,23 @@ struct leapraid_enc_node { /** * struct leapraid_raid_volume - RAID volume structure - * @list: List head for volume management - * @starget: SCSI target structure - * @sdev: SCSI device structure - * @id: Volume ID - * @channel: SCSI channel - * @wwid: World Wide Identifier - * @hdl: Volume handle - * @vol_type: Volume type - * @pd_num: Number of physical disks - * @resp: Response status - * @dev_info: Device information + * + * @list: List head for volume management. + * @refcnt: Reference count. + * @starget: SCSI target structure. + * @sdev: SCSI device structure. + * @id: Volume ID. + * @channel: SCSI channel. + * @wwid: World wide Identifier. + * @hdl: Volume handle. + * @vol_type: Volume type. + * @pd_num: Number of physical disks. + * @resp: Response status. + * @dev_info: Device information. */ struct leapraid_raid_volume { struct list_head list; + struct kref refcnt; struct scsi_target *starget; struct scsi_device *sdev; unsigned int id; @@ -982,20 +1071,31 @@ struct leapraid_raid_volume { u32 dev_info; }; +static inline void leapraid_raid_volume_free(struct kref *ref) +{ + kfree(container_of(ref, struct leapraid_raid_volume, refcnt)); +} + +#define leapraid_raid_volume_get(volume) \ + kref_get(&(volume)->refcnt) +#define leapraid_raid_volume_put(volume) \ + kref_put(&(volume)->refcnt, leapraid_raid_volume_free) + #define LEAPRAID_TGT_FLG_RAID_MEMBER 0x01 #define LEAPRAID_TGT_FLG_VOLUME 0x02 #define LEAPRAID_NO_ULD_ATTACH 1 /** * struct leapraid_starget_priv - SCSI target private data - * @starget: SCSI target structure - * @sas_address: SAS address - * @hdl: Device handle - * @num_luns: Number of LUNs - * @flg: Flags - * @deleted: Deletion flag - * @tm_busy: Task management busy flag - * @card_port: Associated card port - * @sas_dev: SAS device structure + * + * @starget: SCSI target structure. + * @sas_address: SAS address. + * @hdl: Device handle. + * @num_luns: Number of LUNs. + * @flg: Flags. + * @deleted: Deletion flag. + * @tm_busy: Task management busy flag. + * @card_port: Associated card port. + * @sas_dev: SAS device structure. */ struct leapraid_starget_priv { struct scsi_target *starget; @@ -1003,8 +1103,8 @@ struct leapraid_starget_priv { u16 hdl; int num_luns; u32 flg; - bool deleted; - bool tm_busy; + u8 deleted; + u8 tm_busy; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; }; @@ -1012,50 +1112,52 @@ struct leapraid_starget_priv { #define LEAPRAID_DEVICE_FLG_INIT 0x01 /** * struct leapraid_sdev_priv - SCSI device private data - * @starget_priv: Associated target private data - * @lun: Logical Unit Number - * @flg: Flags - * @block: Block flag - * @deleted: Deletion flag - * @sep: SEP flag + * + * @starget_priv: Associated target private data. + * @lun: Logical Unit Number. + * @flg: Flags. + * @block: Block flag. + * @deleted: Deletion flag. + * @sep: SEP flag. */ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - bool ncq; - bool block; - bool deleted; - bool sep; + u8 ncq; + u8 block; + u8 deleted; + u8 sep; }; /** * struct leapraid_sas_dev - SAS device structure - * @list: List head for device management - * @starget: SCSI target structure - * @card_port: Associated card port - * @rphy: SAS remote PHY - * @refcnt: Reference count - * @id: Device ID - * @channel: SCSI channel - * @slot: Slot number - * @phy: PHY identifier - * @resp: Response status - * @led_on: LED state - * @sas_addr: SAS address - * @dev_name: Device name - * @hdl: Device handle - * @parent_sas_addr: Parent SAS address - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical ID - * @volume_hdl: Volume handle - * @volume_wwid: Volume WWID - * @dev_info: Device information - * @pend_sas_rphy_add: Pending SAS rphy addition flag - * @enc_level: Enclosure level - * @port_type: Port type - * @connector_name: Connector name - * @support_smart: SMART support flag + * + * @list: List head for device management. + * @starget: SCSI target structure. + * @card_port: Associated card port. + * @rphy: SAS remote PHY. + * @refcnt: Reference count. + * @id: Device ID. + * @channel: SCSI channel. + * @slot: Slot number. + * @phy: PHY identifier. + * @resp: Response status. + * @led_on: LED state. + * @sas_addr: SAS address. + * @dev_name: Device name. + * @hdl: Device handle. + * @parent_sas_addr: Parent SAS address. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical ID. + * @volume_hdl: Volume handle. + * @volume_wwid: Volume WWID. + * @dev_info: Device information. + * @pend_sas_rphy_add: Pending SAS remote PHY addition flag. + * @enc_level: Enclosure level. + * @port_connection: Port connection. + * @connector_name: Connector name. + * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1067,8 +1169,8 @@ struct leapraid_sas_dev { unsigned int channel; u16 slot; u8 phy; - bool resp; - bool led_on; + u8 resp; + u8 led_on; u64 sas_addr; u64 dev_name; u16 hdl; @@ -1080,9 +1182,9 @@ struct leapraid_sas_dev { u32 dev_info; u8 pend_sas_rphy_add; u8 enc_level; - u8 port_type; - u8 connector_name[5]; - bool support_smart; + u8 port_connection; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; + u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1093,15 +1195,19 @@ static inline void leapraid_sdev_free(struct kref *ref) #define leapraid_sdev_get(sdev) kref_get(&(sdev)->refcnt) #define leapraid_sdev_put(sdev) kref_put(&(sdev)->refcnt, leapraid_sdev_free) +void leapraid_boot_dev_get(void *dev, u32 chnl); +void leapraid_boot_dev_put(void *dev, u32 chnl); + /** * struct leapraid_sas_port - SAS port structure - * @port_list: List head for port management - * @phy_list: List of PHYs in this port - * @port: SAS port structure - * @card_port: Associated card port - * @remote_identify: Remote device identification - * @rphy: SAS remote PHY - * @phys_num: Number of PHYs in this port + * + * @port_list: List head for port management. + * @phy_list: List of PHYs in this port. + * @port: SAS port structure. + * @card_port: Associated card port. + * @remote_identify: Remote device identification. + * @rphy: SAS remote PHY. + * @phys_num: Number of PHYs in this port. */ struct leapraid_sas_port { struct list_head port_list; @@ -1116,10 +1222,11 @@ struct leapraid_sas_port { #define LEAPRAID_VPHY_FLG_DIRTY 0x01 /** * struct leapraid_vphy - Virtual PHY structure - * @list: List head for PHY management - * @sas_address: SAS address - * @phy_mask: PHY mask - * @flg: Flags + * + * @list: List head for PHY management. + * @sas_address: SAS address. + * @phy_mask: PHY mask. + * @flg: Flags. */ struct leapraid_vphy { struct list_head list; @@ -1128,23 +1235,44 @@ struct leapraid_vphy { u8 flg; }; +/** + * struct leapraid_tgt_rst_list - Target reset tracking entry + * @list: List node used to link reset entries. + * @handle: Device handle of the target being reset. + * @state: Current state of the target reset operation. + * + * Each entry represents a target device that is undergoing or has + * undergone a target reset operation. + */ struct leapraid_tgt_rst_list { struct list_head list; u16 handle; u16 state; }; -struct leapraid_sc_list { - struct list_head list; - u16 handle; -}; - +/** + * struct sense_info - Parsed SCSI sense information + * @sense_key: Sense key extracted from sense data. + * @asc: Additional Sense Code (ASC). + * @ascq: Additional Sense Code Qualifier (ASCQ). + * + * This structure stores key fields parsed from SCSI sense data to + * simplify error handling and reporting. + */ struct sense_info { u8 sense_key; u8 asc; u8 ascq; }; +/** + * struct leapraid_fw_log_info - Firmware log position information + * @user_position: Current log read position used by the driver. + * @adapter_position: Current log write position maintained by firmware. + * + * This structure tracks firmware log buffer positions used for retrieving + * log entries from the adapter. + */ struct leapraid_fw_log_info { u32 user_position; u32 adapter_position; @@ -1152,8 +1280,9 @@ struct leapraid_fw_log_info { /** * enum reset_type - Reset type enumeration - * @FULL_RESET: Full hardware reset - * @PART_RESET: Partial reset + * + * @FULL_RESET: Full hardware reset. + * @PART_RESET: Partial reset. */ enum reset_type { FULL_RESET, @@ -1175,22 +1304,23 @@ enum leapraid_port_checking_state { /** * struct leapraid_card_port_feature - Card port feature - * @dirty_flg: Dirty flag indicator - * @same_addr: Same address flag - * @exact_phy: Exact PHY match flag - * @phy_overlap: PHY overlap bitmap - * @same_port: Same port flag - * @cur_chking_old_port: Current checking old port - * @expected_old_port: Expected old port - * @same_addr_port_count: Same address port count - * @checking_state: Port checking state + * + * @dirty_flg: Dirty flag indicator. + * @same_addr: Same address flag. + * @exact_phy: Exact PHY match flag. + * @phy_overlap: PHY overlap bitmap. + * @same_port: Same port flag. + * @cur_chking_old_port: Current checking old port. + * @expected_old_port: Expected old port. + * @same_addr_port_count: Same address port count. + * @checking_state: Port checking state. */ struct leapraid_card_port_feature { u8 dirty_flg; - bool same_addr; - bool exact_phy; + u8 same_addr; + u8 exact_phy; u32 phy_overlap; - bool same_port; + u8 same_port; struct leapraid_card_port *cur_chking_old_port; struct leapraid_card_port *expected_old_port; int same_addr_port_count; @@ -1225,7 +1355,7 @@ struct leapraid_rep_manu_reply { u8 vendor_identification[SAS_EXPANDER_VENDOR_ID_LEN]; u8 product_identification[SAS_EXPANDER_PRODUCT_ID_LEN]; u8 product_revision_level[SAS_EXPANDER_PRODUCT_REV_LEN]; - u8 component_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; + u8 comp_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; u16 component_id; u8 component_revision_level; u8 r3; @@ -1234,20 +1364,21 @@ struct leapraid_rep_manu_reply { /** * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * @hdl: Device handle - * @lun: Logical Unit Number - * @raid_member: RAID member flag - * @dir: DMA data direction - * @data_length: Data transfer length - * @data_buffer: Data buffer pointer - * @cdb_length: CDB length - * @cdb: Command Descriptor Block - * @time_out: Timeout + * + * @hdl: Device handle. + * @lun: Logical Unit Number. + * @raid_member: RAID member flag. + * @dir: DMA data direction. + * @data_length: Data transfer length. + * @data_buffer: Data buffer pointer. + * @cdb_length: CDB length. + * @cdb: Command Descriptor Block. + * @time_out: Timeout. */ struct leapraid_scsi_cmd_desc { u16 hdl; u32 lun; - bool raid_member; + u8 raid_member; enum dma_data_direction dir; u32 data_length; void *data_buffer; @@ -1274,7 +1405,8 @@ void leapraid_mask_int(struct leapraid_adapter *adapter); void leapraid_unmask_int(struct leapraid_adapter *adapter); u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter); bool leapraid_pci_removed(struct leapraid_adapter *adapter); -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter); +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller); void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid); void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid); __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -1286,11 +1418,11 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid); struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( struct leapraid_adapter *adapter, u16 taskid); -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd); struct scsi_cmnd *leapraid_get_scmd_from_taskid( struct leapraid_adapter *adapter, u16 taskid); int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev); void leapraid_scan_dev_done(struct leapraid_adapter *adapter); +void leapraid_cleanup_lists(struct leapraid_adapter *adapter); void leapraid_wait_cmds_done(struct leapraid_adapter *adapter); void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter); void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll); @@ -1307,14 +1439,16 @@ int leapraid_issue_locked_tm(struct leapraid_adapter *adapter, u16 handle, int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 handle, uint channel, uint id, uint lun, u8 type, u16 taskid_task, u8 tr_method); -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep); +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep); int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume); -int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_init_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_exit_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); bool leapraid_scmd_find_by_lun(struct leapraid_adapter *adapter, uint id, unsigned int lun, uint channel); @@ -1383,10 +1517,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth); +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data); + +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); int leapraid_ctl_release(struct inode *inode, struct file *filep); -void leapraid_ctl_init(void); +int leapraid_ctl_init(void); void leapraid_ctl_exit(void); extern struct sas_function_template leapraid_transport_functions; @@ -1409,17 +1546,20 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, u64 sas_address, u16 handle, u8 phy_number, u8 link_rate, struct leapraid_card_port *card_port); -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *topo_node, - struct leapraid_card_phy *card_phy); -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *sas_node, - struct leapraid_card_phy *card_phy, - u64 sas_address, - struct leapraid_card_port *card_port); +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *topo_node, + struct leapraid_card_phy *card_phy); +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *sas_node, + struct leapraid_card_phy *card_phy, + u64 sas_address, + struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); void leapraid_smart_polling_start(struct leapraid_adapter *adapter); void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index f8354c68ab71..c60c5d80c7b3 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -18,16 +17,16 @@ MODULE_DESCRIPTION(LEAPRAID_DESCRIPTION); MODULE_LICENSE("GPL"); MODULE_VERSION(LEAPRAID_DRIVER_VERSION); -static int leapraid_ids; +static atomic_t leapraid_ids = ATOMIC_INIT(0); static int open_pcie_trace = 1; module_param(open_pcie_trace, int, 0644); -MODULE_PARM_DESC(open_pcie_trace, "open_pcie_trace: default=1(open)/0(close)"); +MODULE_PARM_DESC(open_pcie_trace, "Default=1(open)/0(close)"); static int enable_mp = 1; module_param(enable_mp, int, 0444); MODULE_PARM_DESC(enable_mp, - "enable multipath on target device. default=1(enable)"); + "Enable multipath on target device. default=1(enable)"); static inline void leapraid_get_sense_data(char *sense, struct sense_info *data) @@ -46,14 +45,9 @@ static inline void leapraid_get_sense_data(char *sense, } } -static struct Scsi_Host *pdev_to_shost(struct pci_dev *pdev) -{ - return pci_get_drvdata(pdev); -} - static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost) return NULL; @@ -61,18 +55,13 @@ static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) return shost_priv(shost); } -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd) -{ - return scsi_cmd_priv(scmd); -} - void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_sdev_priv *sdev_priv; struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -82,7 +71,7 @@ void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = true; + sdev_priv->starget_priv->tm_busy = 1; skip = true; } } @@ -94,7 +83,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -104,7 +93,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = false; + sdev_priv->starget_priv->tm_busy = 0; skip = true; } } @@ -136,21 +125,19 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - if ((adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && + (adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid) { - if ((adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && + (adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; return rc; } @@ -197,7 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsi_tm_req *scsi_tm_req; struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; - u16 msix_task = 0; + u16 msix_task; bool issue_reset = false; u32 db; int rc; @@ -208,7 +195,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { dev_info(&adapter->pdev->dev, - "%s %s: host is recovering, skip tm command!\n", + "%s %s: Host is recovering, skip tm command!\n", __func__, adapter->adapter_attr.name); return FAILED; } @@ -216,24 +203,25 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED) { dev_info(&adapter->pdev->dev, - "%s unexpected db status, issuing hard reset!\n", + "%s Unexpected db status, issuing hard reset!\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, - target_taskid); + io_req_tracker = + leapraid_get_io_tracker_from_taskid(adapter, + target_taskid); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_PENDING; scsi_tm_req = @@ -241,7 +229,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->driver_cmds.tm_cmd.hp_taskid); leapraid_build_tm_req(scsi_tm_req, hdl, lun, type, tr_method, target_taskid); - memset((void *)(&adapter->driver_cmds.tm_cmd.reply), 0, + memset(&adapter->driver_cmds.tm_cmd.reply, 0, sizeof(struct leapraid_scsi_tm_rep)); leapraid_set_tm_flg(adapter, hdl); init_completion(&adapter->driver_cmds.tm_cmd.done); @@ -257,16 +245,20 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: TM cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.tm_cmd.status); + leapraid_log_req_context(adapter, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); if (issue_reset) { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = (!rc) ? SUCCESS : FAILED; - goto out; + rc = !rc ? SUCCESS : FAILED; + goto out_cleanup; } } @@ -276,15 +268,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, case LEAPRAID_TM_TASKTYPE_TARGET_RESET: case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: - rc = leapraid_tm_post_processing(adapter, hdl, channel, id, lun, - type, target_taskid); + rc = leapraid_tm_post_processing(adapter, hdl, channel, id, + lun, type, target_taskid); break; case LEAPRAID_TM_TASKTYPE_ABORT_TASK: rc = SUCCESS; scsiio_req = leapraid_get_task_desc(adapter, target_taskid); if (le16_to_cpu(scsiio_req->dev_hdl) != hdl) break; - dev_err(&adapter->pdev->dev, "%s abort failed, hdl=0x%04x\n", + dev_err(&adapter->pdev->dev, "%s: Abort failed, hdl=0x%04x\n", adapter->adapter_attr.name, hdl); rc = FAILED; break; @@ -296,7 +288,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, break; } -out: +out_cleanup: leapraid_clear_tm_flg(adapter, hdl); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_NOT_USED; return rc; @@ -327,20 +319,25 @@ void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + return; } starget = sas_dev->starget; - starget_priv = starget->hostdata; - if ((starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { + starget_priv = starget ? starget->hostdata : NULL; + if (!starget_priv) { + spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); + goto release_sdev; + } + + if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + goto release_sdev; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_async_turn_on_led(adapter, hdl); -out: +release_sdev: if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -417,7 +414,8 @@ static void leapraid_handle_success_status( scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; } -static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, +static void leapraid_scsiio_done_dispatch( + struct leapraid_adapter *adapter, struct leapraid_scsiio_rep *scsiio_rep, struct leapraid_sdev_priv *sdev_priv, struct scsi_cmnd *scmd, @@ -439,9 +437,8 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, xfer_cnt == 0 && (scsi_status == LEAPRAID_SCSI_STATUS_BUSY || scsi_status == LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT || - scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) { + scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) adapter_status = LEAPRAID_ADAPTER_STATUS_SUCCESS; - } switch (adapter_status) { case LEAPRAID_ADAPTER_STATUS_SCSI_DEVICE_NOT_THERE: @@ -513,7 +510,7 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, scsi_print_command(scmd); dev_warn(&adapter->pdev->dev, - "scsiio warn: hdl=0x%x, status are: 0x%x, 0x%x, 0x%x\n", + "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, scsi_status, scsi_state); @@ -523,24 +520,23 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, sz = min_t(u32, SCSI_SENSE_BUFFERSIZE, le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, - &sshdr)) { + &sshdr)) dev_warn(&adapter->pdev->dev, - "sense: key=0x%x asc=0x%x ascq=0x%x\n", + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", sshdr.sense_key, sshdr.asc, sshdr.ascq); - } else { + else dev_warn(&adapter->pdev->dev, - "sense: invalid sense data\n"); - } + "Sense: Invalid sense data\n"); } } -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep) +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep) { - struct leapraid_scsiio_rep *scsiio_rep = NULL; - struct leapraid_sdev_priv *sdev_priv = NULL; - struct scsi_cmnd *scmd = NULL; + struct leapraid_scsiio_rep *scsiio_rep; + struct leapraid_sdev_priv *sdev_priv; + struct scsi_cmnd *scmd; u32 response_code = 0; if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) @@ -548,12 +544,12 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, else scmd = adapter->driver_cmds.internal_scmd; if (!scmd) - return 1; + return true; scsiio_rep = leapraid_get_reply_vaddr(adapter, rep); if (!scsiio_rep) { scmd->result = DID_OK << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } sdev_priv = scmd->device->hostdata; @@ -561,7 +557,7 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, !sdev_priv->starget_priv || sdev_priv->starget_priv->deleted) { scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } if (scsiio_rep->scsi_state & LEAPRAID_SCSI_STATE_RESPONSE_INFO_VALID) @@ -571,33 +567,51 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, leapraid_scsiio_done_dispatch(adapter, scsiio_rep, sdev_priv, scmd, taskid, response_code); -out: +out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid)) { + if (unlikely(taskid == + adapter->driver_cmds.driver_scsiio_cmd.taskid)) { adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_DONE; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return 0; + return false; } leapraid_free_taskid(adapter, taskid); scsi_done(scmd); - return 0; + return false; } static void leapraid_probe_raid(struct leapraid_adapter *adapter) { - struct leapraid_raid_volume *raid_volume, *raid_volume_next; + struct leapraid_raid_volume *raid_volume, *next_raid_volume; + unsigned long flags; + LIST_HEAD(head); int rc; - list_for_each_entry_safe(raid_volume, raid_volume_next, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->starget) + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_splice_init(&adapter->dev_topo.raid_volume_list, &head); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, next_raid_volume, &head, list) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_move_tail(&raid_volume->list, + &adapter->dev_topo.raid_volume_list); + if (raid_volume->starget) { + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); continue; + } + + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); rc = scsi_add_device(adapter->shost, RAID_CHANNEL, raid_volume->id, 0); if (rc) leapraid_raid_volume_remove(adapter, raid_volume); + + leapraid_raid_volume_put(raid_volume); } } @@ -626,7 +640,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev = leapraid_get_next_sas_dev_from_init_list(adapter); if (!sas_dev) break; - added = leapraid_transport_port_add(adapter, sas_dev->hdl, sas_dev->parent_sas_addr, @@ -654,32 +667,52 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) } } -static bool leapraid_get_boot_dev(struct leapraid_boot_dev *boot_dev, +static bool leapraid_get_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, void **pdev, u32 *pchnl) { - if (boot_dev->dev) { - *pdev = boot_dev->dev; - *pchnl = boot_dev->chnl; - return true; + unsigned long flags; + void *dev; + u32 chnl; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (!boot_dev->dev) { + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + return false; } - return false; + + dev = boot_dev->dev; + chnl = boot_dev->chnl; + leapraid_boot_dev_get(dev, chnl); + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + + *pdev = dev; + *pchnl = chnl; + return true; } static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) { + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + struct leapraid_sas_port *sport; + unsigned long flags; void *dev = NULL; u32 chnl; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_alt_boot_dev, + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.current_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + &dev, &chnl)) goto boot_dev_found; return; @@ -687,12 +720,10 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) boot_dev_found: switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; + raid_volume = dev; if (raid_volume->starget) - return; + break; /* TODO eedp */ @@ -700,16 +731,11 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; - struct leapraid_sas_port *sas_port; - unsigned long flags; + sas_dev = dev; if (sas_dev->starget) - return; + break; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_move_tail(&sas_dev->list, @@ -717,16 +743,17 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (!sas_dev->card_port) - return; + break; - sas_port = leapraid_transport_port_add(adapter, sas_dev->hdl, - sas_dev->parent_sas_addr, - sas_dev->card_port); - if (!sas_port) + sport = leapraid_transport_port_add(adapter, sas_dev->hdl, + sas_dev->parent_sas_addr, + sas_dev->card_port); + if (!sport) leapraid_sas_dev_remove(adapter, sas_dev); break; } - } + + leapraid_boot_dev_put(dev, chnl); } static void leapraid_probe_devices(struct leapraid_adapter *adapter) @@ -744,69 +771,23 @@ static void leapraid_probe_devices(struct leapraid_adapter *adapter) void leapraid_scan_dev_done(struct leapraid_adapter *adapter) { if (adapter->scan_dev_desc.wait_scan_dev_done) { - adapter->scan_dev_desc.wait_scan_dev_done = false; + adapter->scan_dev_desc.wait_scan_dev_done = 0; leapraid_probe_devices(adapter); } + adapter->scan_dev_desc.scan_start = 0; + leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_smart_polling_start(adapter); } -static void leapraid_ir_shutdown(struct leapraid_adapter *adapter) -{ - struct leapraid_raid_act_req *raid_act_req; - struct leapraid_raid_act_rep *raid_act_rep; - struct leapraid_driver_cmd *raid_action_cmd; - - if (!adapter || !adapter->adapter_attr.raid_support) - return; - - if (list_empty(&adapter->dev_topo.raid_volume_list)) - return; - - if (leapraid_pci_removed(adapter)) - return; - - raid_action_cmd = &adapter->driver_cmds.raid_action_cmd; - - mutex_lock(&raid_action_cmd->mutex); - raid_action_cmd->status = LEAPRAID_CMD_PENDING; - - raid_act_req = leapraid_get_task_desc(adapter, - raid_action_cmd->inter_taskid); - memset(raid_act_req, 0, sizeof(struct leapraid_raid_act_req)); - raid_act_req->func = LEAPRAID_FUNC_RAID_ACTION; - raid_act_req->act = LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED; - - dev_info(&adapter->pdev->dev, "ir shutdown start\n"); - init_completion(&raid_action_cmd->done); - leapraid_fire_task(adapter, raid_action_cmd->inter_taskid); - wait_for_completion_timeout(&raid_action_cmd->done, - LEAPRAID_RAID_ACTION_CMD_TIMEOUT * HZ); - - if (!(raid_action_cmd->status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timeout waiting for ir shutdown\n", __func__); - goto out; - } - - if (raid_action_cmd->status & LEAPRAID_CMD_REPLY_VALID) { - raid_act_rep = (void *)(&raid_action_cmd->reply); - dev_info(&adapter->pdev->dev, - "ir shutdown done, adapter status=0x%04x\n", - le16_to_cpu(raid_act_rep->adapter_status)); - } - -out: - raid_action_cmd->status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&raid_action_cmd->mutex); -} - static const struct pci_device_id leapraid_pci_table[] = { - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA) }, - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_RAID) }, + { PCI_DEVICE_SUB(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA, + LEAPRAID_SUBVENDOR_ID, + LEAPRAID_SUBDEVID_HBA) }, { 0, } }; @@ -816,7 +797,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, u8 opcode; if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.adapter_thermal_alert) + atomic_read(&adapter->overheat_desc.thermal_alert)) return false; if (adapter->access_ctrl.host_removing) { @@ -826,8 +807,8 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, opcode = scmd->cmnd[0]; if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) return true; - else - return false; + + return false; } return true; } @@ -854,28 +835,33 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, scsi_build_sense(scmd, 0, UNIT_ATTENTION, LEAPRAID_SCSI_ASC_POWER_ON_RESET, LEAPRAID_SCSI_ASCQ_POWER_ON_RESET); - goto done_out; + goto scsiio_done; } if (adapter->access_ctrl.shost_recovering || adapter->reset_desc.adapter_link_resetting) { *rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; - } else if (starget_priv->deleted || sdev_priv->deleted) { + return false; + } + + if (starget_priv->deleted || sdev_priv->deleted) goto no_connect; - } else if (starget_priv->tm_busy || sdev_priv->block) { + + if (starget_priv->tm_busy || sdev_priv->block) { *rc = SCSI_MLQUEUE_DEVICE_BUSY; - goto out; + return false; } return true; no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; -done_out: +scsiio_done: if (likely(scmd != adapter->driver_cmds.internal_scmd)) scsi_done(scmd); -out: + else + *rc = LEAPRAID_OPERATION_FAILED; + return false; } @@ -903,12 +889,14 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; if (scmd->cmd_len == 32) - control |= 4 << LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT; + control |= LEAPRAID_SCSIIO_CTRL_CDB_32BYTE << + LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT; return control; } -int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) +int leapraid_queuecommand(struct Scsi_Host *shost, + struct scsi_cmnd *scmd) { struct leapraid_adapter *adapter = shost_priv(scmd->device->host); struct leapraid_sdev_priv *sdev_priv = scmd->device->hostdata; @@ -920,7 +908,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) int rc = 0; if (!leapraid_should_queuecommand(adapter, sdev_priv, scmd, &rc)) - goto out; + return rc; starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; @@ -932,11 +920,11 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) - scsiio_req->func = LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH; else - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; scsiio_req->dev_hdl = cpu_to_le16(hdl); scsiio_req->data_len = cpu_to_le32(scsi_bufflen(scmd)); @@ -954,23 +942,21 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) if (scsiio_req->data_len) { if (leapraid_build_scmd_ieee_sg(adapter, scmd, taskid)) { leapraid_free_taskid(adapter, taskid); - rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; + return SCSI_MLQUEUE_HOST_BUSY; } } else { leapraid_build_ieee_nodata_sg(adapter, &scsiio_req->sgl); } - if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO_REQ)) { + if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO)) leapraid_fire_scsi_io(adapter, taskid, - le16_to_cpu(scsiio_req->dev_hdl)); - } else { + le16_to_cpu(scsiio_req->dev_hdl)); + else leapraid_fire_task(adapter, taskid); - } + dev_dbg(&adapter->pdev->dev, "LEAPRAID_SCSIIO: Send Descriptor taskid %d, req type 0x%x\n", taskid, scsiio_req->func); -out: return rc; } @@ -980,7 +966,7 @@ static int leapraid_init_cmd_priv(struct Scsi_Host *shost, struct leapraid_adapter *adapter = shost_priv(shost); struct leapraid_io_req_tracker *io_tracker; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); leapraid_internal_init_cmd_priv(adapter, io_tracker); return 0; @@ -992,7 +978,7 @@ static int leapraid_exit_cmd_priv(struct Scsi_Host *shost, struct leapraid_adapter *adapter = shost_priv(shost); struct leapraid_io_req_tracker *io_tracker; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = scsi_cmd_priv(scmd); leapraid_internal_exit_cmd_priv(adapter, io_tracker); return 0; @@ -1016,9 +1002,9 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, scsi_print_command(scmd); if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - io_req_tracker = leapraid_get_scmd_priv(scmd); + io_req_tracker = scsi_cmd_priv(scmd); dev_info(&adapter->pdev->dev, - "EH ABORT: scmd=0x%p, pending=%u ms, tout=%u ms, req tag=%d\n", + "EH ABORT: scmd=0x%p, pend=%ums, tout=%ums, tag=%d\n", scmd, jiffies_to_msecs(jiffies - scmd->jiffies_at_alloc), (scsi_cmd_to_rq(scmd)->timeout / HZ) * 1000, @@ -1031,48 +1017,47 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH %s failed: %s scmd=0x%p\n", str, (adapter->access_ctrl.host_removing ? "shost removing!" : "pci_dev removed!"), scmd); - if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - if (io_req_tracker && io_req_tracker->taskid) - leapraid_free_taskid(adapter, - io_req_tracker->taskid); + if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK && + io_req_tracker && io_req_tracker->taskid) + leapraid_free_taskid(adapter, io_req_tracker->taskid); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; #ifdef FAST_IO_FAIL rc = FAST_IO_FAIL; #else rc = FAILED; #endif - goto out; + goto out_eh_done; } sdev_priv = scmd->device->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) { dev_warn(&adapter->pdev->dev, - "EH %s: sdev or starget gone, scmd=0x%p\n", + "EH %s: SAS dev or starget gone, scmd=0x%p\n", str, scmd); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scsi_done(scmd); rc = SUCCESS; - goto out; + goto out_eh_done; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { if (!io_req_tracker) { dev_warn(&adapter->pdev->dev, - "EH ABORT: no io tracker, scmd 0x%p\n", scmd); + "EH ABORT: No I/O tracker, scmd 0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = SUCCESS; - goto out; + goto out_eh_done; } if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { dev_err(&adapter->pdev->dev, - "EH ABORT: skip RAID/VOLUME target, scmd=0x%p\n", + "EH ABORT: Skip RAID/VOLUME, scmd=0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } hdl = sdev_priv->starget_priv->hdl; @@ -1090,11 +1075,11 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, if (!hdl) { dev_err(&adapter->pdev->dev, - "EH %s failed: target handle is 0, scmd=0x%p\n", + "EH %s failed: Target handle 0, scmd=0x%p\n", str, scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } } @@ -1102,24 +1087,27 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH issue TM: type=%s, scmd=0x%p, hdl=0x%x\n", str, scmd, hdl); - rc = leapraid_issue_locked_tm(adapter, hdl, scmd->device->channel, - scmd->device->id, - (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? - 0 : scmd->device->lun), - type, - (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? - io_req_tracker->taskid : 0), - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - -out: + rc = leapraid_issue_locked_tm( + adapter, + hdl, + scmd->device->channel, + scmd->device->id, + (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? + 0 : scmd->device->lun), + type, + (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? + io_req_tracker->taskid : 0), + LEAPRAID_TM_MSGFLAGS_LINK_RESET); + +out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { dev_info(&adapter->pdev->dev, "EH ABORT result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); } else { dev_info(&adapter->pdev->dev, "EH %s result: %s, scmd=0x%p\n", - str, ((rc == SUCCESS) ? "success" : "failed"), scmd); + str, rc == SUCCESS ? "success" : "failed", scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1162,19 +1150,19 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) (adapter->access_ctrl.host_removing ? "shost removing!" : "driver loading!"), scmd); rc = FAILED; - goto out; + goto out_host_reset_done; } - dev_info(&adapter->pdev->dev, "%s:%d issuing hard reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: Issuing hard reset\n", __func__, __LINE__); if (leapraid_hard_reset_handler(adapter, FULL_RESET) < 0) rc = FAILED; else rc = SUCCESS; -out: +out_host_reset_done: dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); return rc; } @@ -1200,30 +1188,35 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) stgt_priv->num_luns++; sdev_priv->starget_priv = stgt_priv; sdev->hostdata = sdev_priv; - if ((stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER)) + if (stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) sdev->no_uld_attach = LEAPRAID_NO_ULD_ATTACH; shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); if (tgt->channel == RAID_CHANNEL) { - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); - if (raid_volume) + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, + flags); raid_volume->sdev = sdev; - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); + } } if (!(stgt_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - stgt_priv->sas_address, - stgt_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + stgt_priv->sas_address, + stgt_priv->card_port); if (sas_dev && !sas_dev->starget) { sdev_printk(KERN_INFO, sdev, - "%s: assign starget to sas_dev\n", __func__); + "%s: Assign starget to sas_dev\n", + __func__); sas_dev->starget = tgt; } @@ -1241,7 +1234,6 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) struct leapraid_raid_volume *raid_volume; struct leapraid_starget_priv *starget_priv; struct leapraid_sdev_priv *sdev_priv; - unsigned long flags; int qd; u16 hdl; @@ -1249,37 +1241,38 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (!raid_volume) { sdev_printk(KERN_WARNING, sdev, - "%s: raid_volume not found, hdl=0x%x\n", + "%s: RAID volume not found, hdl=0x%x\n", __func__, hdl); return 1; } if (leapraid_get_volume_cap(adapter, raid_volume)) { sdev_printk(KERN_ERR, sdev, - "%s: failed to get volume cap, hdl=0x%x\n", + "%s: Failed to get volume cap, hdl=0x%x\n", __func__, hdl); + leapraid_raid_volume_put(raid_volume); return 1; } qd = (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) ? - LEAPRAID_SAS_QUEUE_DEPTH : LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth : + adapter->adapter_attr.sata_max_queue_depth; if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) - qd = LEAPRAID_RAID_QUEUE_DEPTH; + qd = adapter->adapter_attr.raid_volume_max_queue_depth; sdev_printk(KERN_INFO, sdev, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + "RAID volume: hdl=0x%04x, wwid=0x%016llx\n", raid_volume->hdl, (unsigned long long)raid_volume->wwid); if (shost->max_sectors > LEAPRAID_MAX_SECTORS) blk_queue_max_hw_sectors(sdev->request_queue, LEAPRAID_MAX_SECTORS); - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); + leapraid_raid_volume_put(raid_volume); return 0; } @@ -1297,13 +1290,14 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sdev_priv = sdev->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); *is_target_ssp = false; - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); sdev_printk(KERN_WARNING, sdev, - "%s: sas_dev not found, sas=0x%llx\n", + "%s: SAS dev not found, sas=0x%llx\n", __func__, sdev_priv->starget_priv->sas_address); return 1; } @@ -1312,18 +1306,18 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sas_dev->volume_hdl = vol_hdl; sas_dev->volume_wwid = volume_wwid; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { - *qd = (sas_dev->port_type > 1) ? + *qd = (sas_dev->port_connection > 1) ? adapter->adapter_attr.wideport_max_queue_depth : adapter->adapter_attr.narrowport_max_queue_depth; *is_target_ssp = true; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SEP) - sdev_priv->sep = true; + sdev_priv->sep = 1; } else { *qd = adapter->adapter_attr.sata_max_queue_depth; } sdev_printk(KERN_INFO, sdev, - "sdev: dev name=0x%016llx, sas addr=0x%016llx\n", + "device name=0x%016llx, SAS addr=0x%016llx\n", (unsigned long long)sas_dev->dev_name, (unsigned long long)sas_dev->sas_addr); leapraid_sdev_put(sas_dev); @@ -1354,7 +1348,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) { if (leapraid_cfg_get_volume_hdl(adapter, hdl, &vol_hdl)) { sdev_printk(KERN_WARNING, sdev, - "%s: get volume hdl failed, hdl=0x%x\n", + "%s: Get volume hdl failed, hdl=0x%x\n", __func__, hdl); return 1; } @@ -1362,7 +1356,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (vol_hdl && leapraid_cfg_get_volume_wwid(adapter, vol_hdl, &volume_wwid)) { sdev_printk(KERN_WARNING, sdev, - "%s: get wwid failed, volume_hdl=0x%x\n", + "%s: Get wwid failed, volume_hdl=0x%x\n", __func__, vol_hdl); return 1; } @@ -1375,7 +1369,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) return 1; } - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); if (is_target_ssp) sas_read_port_mode_page(sdev); @@ -1422,17 +1416,19 @@ static int leapraid_target_alloc_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + starget_priv = tgt->hostdata; raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); starget_priv->hdl = raid_volume->hdl; starget_priv->sas_address = raid_volume->wwid; starget_priv->flg |= LEAPRAID_TGT_FLG_VOLUME; raid_volume->starget = tgt; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return 0; } @@ -1447,12 +1443,13 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; + starget_priv = tgt->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); rphy = dev_to_rphy(tgt->dev.parent); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, - rphy->identify.sas_address, - rphy); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, + rphy->identify.sas_address, + rphy); if (sas_dev) { starget_priv->sas_dev = sas_dev; starget_priv->card_port = sas_dev->card_port; @@ -1461,8 +1458,10 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) sas_dev->channel = tgt->channel; sas_dev->id = tgt->id; sas_dev->starget = tgt; - if (test_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pd_hdls)) + if (sas_dev->hdl && + sas_dev->hdl <= + adapter->adapter_attr.features.max_dev_handle && + test_bit(sas_dev->hdl, adapter->dev_topo.pd_hdls)) starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1494,14 +1493,16 @@ static void leapraid_target_destroy_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume->starget = NULL; raid_volume->sdev = NULL; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } static void leapraid_target_destroy_sas(struct scsi_target *tgt) @@ -1543,12 +1544,12 @@ static void leapraid_target_destroy(struct scsi_target *tgt) if (tgt->channel == RAID_CHANNEL) { leapraid_target_destroy_raid(tgt); - goto out; + goto out_free; } leapraid_target_destroy_sas(tgt); -out: +out_free: kfree(starget_priv); tgt->hostdata = NULL; } @@ -1569,24 +1570,27 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) { dev_err(&adapter->pdev->dev, - "device scan: aborted due to reset\n"); + "Device scan: Aborted due to reset\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return true; } if (adapter->scan_dev_desc.scan_start_failed) { dev_err(&adapter->pdev->dev, - "device scan: failed with adapter_status=0x%08x\n", + "Device scan: Failed with adapter_status=0x%08x\n", adapter->scan_dev_desc.scan_start_failed); - adapter->scan_dev_desc.driver_loading = false; - adapter->scan_dev_desc.wait_scan_dev_done = false; - adapter->access_ctrl.host_removing = true; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "device scan: SUCCESS\n"); + dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1601,8 +1605,9 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_err(&adapter->pdev->dev, - "device scan: failed with timeout 300s\n"); - adapter->scan_dev_desc.driver_loading = false; + "Device scan: Failed with timeout 300s\n"); + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return 1; } @@ -1612,10 +1617,12 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) if (need_hard_reset) { adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - if (leapraid_hard_reset_handler(adapter, PART_RESET)) - adapter->scan_dev_desc.driver_loading = false; + if (leapraid_hard_reset_handler(adapter, PART_RESET)) { + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + } } return 1; @@ -1625,18 +1632,88 @@ static void leapraid_scan_start(struct Scsi_Host *shost) { struct leapraid_adapter *adapter = shost_priv(shost); - adapter->scan_dev_desc.scan_start = true; + adapter->scan_dev_desc.scan_start = 1; leapraid_scan_dev(adapter, true); } +static u32 leapraid_get_raid_qd(struct leapraid_adapter *adapter, + const struct leapraid_raid_volume *raid_volume, + bool default_qd) +{ + const struct leapraid_adapter_attr *attr = &adapter->adapter_attr; + + if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) + return default_qd ? LEAPRAID_RAID_QUEUE_DEPTH : + attr->raid_volume_max_queue_depth; + + if (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) + return default_qd ? LEAPRAID_SAS_QUEUE_DEPTH : + attr->narrowport_max_queue_depth; + + return default_qd ? LEAPRAID_SATA_QUEUE_DEPTH : + attr->sata_max_queue_depth; +} + static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) { struct Scsi_Host *shost; + struct leapraid_adapter *adapter; + struct leapraid_starget_priv *starget_priv; + struct leapraid_sdev_priv *sdev_priv; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; int max_depth; + u32 default_qdepth = 0; + u32 fw_qdepth = 0; shost = sdev->host; + adapter = shost_priv(shost); max_depth = shost->can_queue; + sdev_priv = sdev->hostdata; + if (!sdev_priv) + goto out_tag_check; + + starget_priv = sdev_priv->starget_priv; + if (!starget_priv) + goto out_tag_check; + + if (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + raid_volume = leapraid_raid_volume_find_by_hdl( + adapter, starget_priv->hdl); + if (raid_volume) { + default_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, true); + fw_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, false); + leapraid_raid_volume_put(raid_volume); + } + goto out_limit_check; + } + + sas_dev = leapraid_get_sas_dev_from_tgt(adapter, starget_priv); + if (sas_dev) { + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { + default_qdepth = LEAPRAID_SAS_QUEUE_DEPTH; + fw_qdepth = (sas_dev->port_connection > 1) ? + adapter->adapter_attr.wideport_max_queue_depth : + adapter->adapter_attr.narrowport_max_queue_depth; + } + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) { + default_qdepth = LEAPRAID_SATA_QUEUE_DEPTH; + fw_qdepth = adapter->adapter_attr.sata_max_queue_depth; + } + leapraid_sdev_put(sas_dev); + } + +out_limit_check: + if (fw_qdepth > shost->can_queue && default_qdepth) + fw_qdepth = default_qdepth; + + if (fw_qdepth) + max_depth = min_t(int, max_depth, fw_qdepth); + +out_tag_check: if (!sdev->tagged_supported) max_depth = 1; @@ -1646,18 +1723,13 @@ static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) return qdepth; } -static int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) { qdepth = leapraid_calc_max_queue_depth(sdev, qdepth); scsi_change_queue_depth(sdev, qdepth); return sdev->queue_depth; } -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth) -{ - leapraid_change_queue_depth(sdev, qdepth); -} - static void leapraid_map_queues(struct Scsi_Host *shost) { struct leapraid_adapter *adapter; @@ -1669,7 +1741,7 @@ static void leapraid_map_queues(struct Scsi_Host *shost) adapter = (struct leapraid_adapter *)shost->hostdata; if (shost->nr_hw_queues == 1) - goto out; + return; msix_queue_count = adapter->notification_desc.iopoll_qdex; poll_queue_count = adapter->adapter_attr.rq_cnt - msix_queue_count; @@ -1683,7 +1755,7 @@ static void leapraid_map_queues(struct Scsi_Host *shost) case HCTX_TYPE_DEFAULT: queue_map->nr_queues = msix_queue_count; queue_map->queue_offset = queue_offset; - BUG_ON(!queue_map->nr_queues); + WARN_ON_ONCE(!queue_map->nr_queues); blk_mq_pci_map_queues(queue_map, adapter->pdev, 0); break; case HCTX_TYPE_POLL: @@ -1698,9 +1770,6 @@ static void leapraid_map_queues(struct Scsi_Host *shost) } queue_offset += queue_map->nr_queues; } - -out: - return; } int leapraid_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num) @@ -1711,13 +1780,13 @@ int leapraid_blk_mq_poll(struct Scsi_Host *shost, unsigned int queue_num) int num_entries; int qid = queue_num - adapter->notification_desc.iopoll_qdex; - if (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause) || - !atomic_add_unless(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy, 1, 1)) + blk_mq_poll_rq = &adapter->notification_desc.blk_mq_poll_rqs[qid]; + if (atomic_read(&blk_mq_poll_rq->pause) || + !atomic_add_unless(&blk_mq_poll_rq->busy, 1, 1)) return 0; - blk_mq_poll_rq = &adapter->notification_desc.blk_mq_poll_rqs[qid]; num_entries = leapraid_rep_queue_handler(&blk_mq_poll_rq->rq); - atomic_dec(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy); + atomic_dec(&blk_mq_poll_rq->busy); return num_entries; } @@ -1725,8 +1794,8 @@ static int leapraid_bios_param(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[]) { - int heads = 0; - int sectors = 0; + int heads; + int sectors; sector_t cylinders; if (scsi_partsize(bdev, capacity, geom)) @@ -1770,12 +1839,23 @@ static ssize_t host_sas_address_show(struct device *cdev, (unsigned long long)adapter->dev_topo.card.sas_address); } +static ssize_t board_name_show(struct device *cdev, + struct device_attribute *attr, char *buf) +{ + struct Scsi_Host *shost = class_to_shost(cdev); + struct leapraid_adapter *adapter = shost_priv(shost); + + return sysfs_emit(buf, "%s\n", adapter->adapter_attr.board_name); +} + static DEVICE_ATTR_RO(fw_queue_depth); static DEVICE_ATTR_RO(host_sas_address); +static DEVICE_ATTR_RO(board_name); static struct attribute *leapraid_shost_attrs[] = { &dev_attr_fw_queue_depth.attr, &dev_attr_host_sas_address.attr, + &dev_attr_board_name.attr, NULL, }; @@ -1786,9 +1866,17 @@ static ssize_t sas_address_show(struct device *dev, { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + u64 sas_address; - return sysfs_emit(buf, "0x%016llx\n", - (unsigned long long)sas_device_priv_data->starget_priv->sas_address); + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + + sas_address = sas_device_priv_data->starget_priv->sas_address; + + return sysfs_emit(buf, "0x%016llx\n", (unsigned long long)sas_address); } static ssize_t sas_device_handle_show(struct device *dev, @@ -1797,6 +1885,12 @@ static ssize_t sas_device_handle_show(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + return sysfs_emit(buf, "0x%04x\n", sas_device_priv_data->starget_priv->hdl); } @@ -1807,6 +1901,12 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } + return sysfs_emit(buf, "%d\n", sas_device_priv_data->ncq); } @@ -1817,17 +1917,30 @@ static ssize_t sas_ncq_store(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; struct scsi_vpd *vpd_pg89; - int ncq_op = 0; - bool ncq_supported = false; + int ncq_op; + bool ncq_supported; + + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } if (kstrtoint(buf, 0, &ncq_op)) - goto out; + return -EINVAL; + + if (ncq_op != 0 && ncq_op != 1) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid NCQ value %d (only 0/1 allowed)\n", + __func__, ncq_op); + return -EINVAL; + } rcu_read_lock(); vpd_pg89 = rcu_dereference(sdev->vpd_pg89); if (!vpd_pg89 || vpd_pg89->len < LEAPRAID_VPD_PG89_MIN_LEN) { rcu_read_unlock(); - goto out; + return -EINVAL; } ncq_supported = (vpd_pg89->data[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> @@ -1836,9 +1949,7 @@ static ssize_t sas_ncq_store(struct device *dev, rcu_read_unlock(); if (ncq_supported) sas_device_priv_data->ncq = ncq_op; - return strlen(buf); -out: - return -EINVAL; + return count; } static DEVICE_ATTR_RO(sas_address); @@ -1881,7 +1992,7 @@ static struct scsi_host_template leapraid_driver_template = { .can_queue = LEAPRAID_CAN_QUEUE_MIN, .this_id = LEAPRAID_THIS_ID_NONE, .sg_tablesize = LEAPRAID_SG_DEPTH, - .max_sectors = LEAPRAID_DEF_MAX_SECTORS, + .max_sectors = LEAPRAID_MAX_SECTORS, .max_segment_size = LEAPRAID_MAX_SEGMENT_SIZE, .cmd_per_lun = LEAPRAID_CMD_PER_LUN, .shost_groups = leapraid_shost_groups, @@ -1901,6 +2012,8 @@ static void leapraid_lock_init(struct leapraid_adapter *adapter) spin_lock_init(&adapter->dev_topo.topo_node_lock); spin_lock_init(&adapter->fw_evt_s.fw_evt_lock); spin_lock_init(&adapter->dev_topo.raid_volume_lock); + spin_lock_init(&adapter->dev_topo.enc_lock); + spin_lock_init(&adapter->boot_devs.lock); } static void leapraid_list_init(struct leapraid_adapter *adapter) @@ -1917,19 +2030,24 @@ static void leapraid_list_init(struct leapraid_adapter *adapter) static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) { - struct leapraid_adapter *adapter = NULL; - struct Scsi_Host *shost = NULL; - int iopoll_q_count = 0; + struct leapraid_adapter *adapter; + struct Scsi_Host *shost; + int iopoll_q_count; int rc; shost = scsi_host_alloc(&leapraid_driver_template, sizeof(struct leapraid_adapter)); - if (!shost) + if (!shost) { + dev_err(&pdev->dev, + "%s: SCSI host alloc failed\n", __func__); return -ENODEV; + } adapter = shost_priv(shost); memset(adapter, 0, sizeof(struct leapraid_adapter)); - adapter->adapter_attr.id = leapraid_ids++; + + init_waitqueue_head(&adapter->access_ctrl.recovery_waitq); + adapter->adapter_attr.id = atomic_inc_return(&leapraid_ids) - 1; adapter->adapter_attr.enable_mp = enable_mp; @@ -1944,8 +2062,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; leapraid_lock_init(adapter); leapraid_list_init(adapter); - sprintf(adapter->adapter_attr.name, "%s%d", - LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); + snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", + LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); shost->max_cmd_len = LEAPRAID_MAX_CDB_LEN; shost->max_lun = LEAPRAID_MAX_LUNS; @@ -1959,13 +2077,18 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_evt_s.fw_evt_thread = alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); if (!adapter->fw_evt_s.fw_evt_thread) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create fw event workqueue\n", __func__); rc = -ENODEV; goto evt_wq_fail; } shost->host_tagset = 1; - adapter->scan_dev_desc.driver_loading = true; - if ((leapraid_ctrl_init(adapter))) { + init_waitqueue_head(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.driver_loading = 1; + if (leapraid_ctrl_init(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: Adapter init failed\n", __func__); rc = -ENODEV; goto ctrl_init_fail; } @@ -1977,15 +2100,14 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->notification_desc.iopoll_qdex; shost->nr_maps = iopoll_q_count ? 3 : 1; dev_info(&adapter->pdev->dev, - "max scsi io cmds %d shared with nr_hw_queues=%d\n", + "Max scsi I/O cmds %d shared with nr_hw_queues=%d\n", shost->can_queue, shost->nr_hw_queues); } rc = scsi_add_host(shost, &pdev->dev); if (rc) { - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); + dev_err(&pdev->dev, + "%s: SCSI host add failed\n", __func__); goto scsi_add_shost_fail; } @@ -1995,6 +2117,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) scsi_add_shost_fail: leapraid_remove_ctrl(adapter); ctrl_init_fail: + leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: spin_lock(&leapraid_adapter_lock); @@ -2004,7 +2127,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) return rc; } -static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) +void leapraid_cleanup_lists(struct leapraid_adapter *adapter) { struct leapraid_raid_volume *raid_volume, *next_raid_volume; struct leapraid_starget_priv *starget_priv_data; @@ -2016,12 +2139,14 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) &adapter->dev_topo.raid_volume_list, list) { if (raid_volume->starget) { starget_priv_data = raid_volume->starget->hostdata; - starget_priv_data->deleted = true; + if (starget_priv_data) + starget_priv_data->deleted = 1; scsi_remove_target(&raid_volume->starget->dev); } - pr_info("removing hdl=0x%04x, wwid=0x%016llx\n", - raid_volume->hdl, - (unsigned long long)raid_volume->wwid); + dev_info(&adapter->pdev->dev, + "removing hdl=0x%04x, wwid=0x%016llx\n", + raid_volume->hdl, + (unsigned long long)raid_volume->wwid); leapraid_raid_volume_remove(adapter, raid_volume); } @@ -2030,16 +2155,18 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) port_list) { if (leapraid_port->remote_identify.device_type == SAS_END_DEVICE) - leapraid_sas_dev_remove_by_sas_address(adapter, + leapraid_sas_dev_remove_by_sas_address( + adapter, leapraid_port->remote_identify.sas_address, leapraid_port->card_port); else if (leapraid_port->remote_identify.device_type == SAS_EDGE_EXPANDER_DEVICE || leapraid_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) - leapraid_exp_rm(adapter, - leapraid_port->remote_identify.sas_address, - leapraid_port->card_port); + leapraid_exp_rm( + adapter, + leapraid_port->remote_identify.sas_address, + leapraid_port->card_port); } list_for_each_entry_safe(port, port_next, @@ -2064,27 +2191,26 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) static void leapraid_remove(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to remove!\n"); + dev_err(&pdev->dev, "Unable to remove!\n"); return; } - while (adapter->scan_dev_desc.driver_loading) - ssleep(1); - - while (adapter->access_ctrl.shost_recovering) - ssleep(1); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !adapter->scan_dev_desc.driver_loading); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !atomic_read(&adapter->overheat_desc.thermal_alert)); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_smart_polling_stop(adapter); - leapraid_free_internal_scsi_cmd(adapter); if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); @@ -2099,7 +2225,6 @@ static void leapraid_remove(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); @@ -2112,18 +2237,20 @@ static void leapraid_remove(struct pci_dev *pdev) static void leapraid_shutdown(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to shutdown!\n"); + dev_err(&pdev->dev, "Unable to shutdown!\n"); return; } - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); + leapraid_overheat_cleanup(adapter); leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; @@ -2132,7 +2259,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); leapraid_disable_controller(adapter); } @@ -2140,29 +2266,31 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to error detected for device\n"); + dev_err(&pdev->dev, "Failed to error detected for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - pr_err("%s: pci error detected, state=%d\n", - adapter->adapter_attr.name, state); + dev_err(&pdev->dev, "%s: PCI error detected, state=%d\n", + adapter->adapter_attr.name, state); switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; case pci_channel_io_frozen: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); @@ -2177,15 +2305,15 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to enable mmio for device\n"); + "Failed to enable mmio for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_info(&pdev->dev, "%s: pci error mmio enabled\n", + dev_info(&pdev->dev, "%s: PCI error mmio enabled\n", adapter->adapter_attr.name); return PCI_ERS_RESULT_RECOVERED; @@ -2194,43 +2322,47 @@ static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to slot reset for device\n"); + "Failed to slot reset for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_err(&pdev->dev, "%s pci error slot reset\n", + dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = false; + adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); - if (leapraid_set_pcie_and_notification(adapter)) + if (leapraid_set_pcie_and_notification(adapter)) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return PCI_ERS_RESULT_DISCONNECT; + } - dev_info(&pdev->dev, "%s: hard reset triggered by pci slot reset\n", + dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, (rc == 0) ? "success" : "failed"); + adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); - return (rc == 0) ? PCI_ERS_RESULT_RECOVERED : + return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; } static void leapraid_pci_resume(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct leapraid_adapter *adapter = pdev_to_adapter(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to resume\n"); + dev_err(&pdev->dev, "Failed to resume\n"); return; } @@ -2254,23 +2386,23 @@ static struct pci_error_handlers leapraid_err_handler = { static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state; if (!shost || !adapter) { dev_err(&pdev->dev, - "suspend failed, invalid host or adapter\n"); + "Suspend failed, invalid host or adapter\n"); return -ENXIO; } + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); scsi_block_requests(shost); device_state = pci_choose_state(pdev, state); - leapraid_ir_shutdown(adapter); - dev_info(&pdev->dev, "entering PCI power state D%d, (slot=%s)\n", + dev_info(&pdev->dev, "Entering PCI power state D%d, (slot=%s)\n", device_state, pci_name(pdev)); pci_save_state(pdev); @@ -2282,18 +2414,18 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) static int leapraid_resume(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state = pdev->current_state; int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "resume failed, invalid host or adapter\n"); + "Resume failed, invalid host or adapter\n"); return -ENXIO; } dev_info(&pdev->dev, - "resuming device %s, previous state D%d\n", + "Resuming device %s, previous state D%d\n", pci_name(pdev), device_state); pci_set_power_state(pdev, PCI_D0); @@ -2301,12 +2433,22 @@ static int leapraid_resume(struct pci_dev *pdev) pci_restore_state(pdev); adapter->pdev = pdev; rc = leapraid_set_pcie_and_notification(adapter); - if (rc) + if (rc) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return rc; + } - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, PART_RESET); + rc = leapraid_hard_reset_handler(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed during resume, rc=%d\n", + __func__, rc); + return rc; + } scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); @@ -2332,29 +2474,37 @@ static int __init leapraid_init(void) { int error; - pr_info("%s version %s loaded\n", LEAPRAID_DRIVER_NAME, - LEAPRAID_DRIVER_VERSION); + pr_info("%s initializing\n", LEAPRAID_DRIVER_NAME); leapraid_transport_template = sas_attach_transport(&leapraid_transport_functions); - if (!leapraid_transport_template) + if (!leapraid_transport_template) { + pr_err("%s: Failed to attach SAS transport\n", + LEAPRAID_DRIVER_NAME); return -ENODEV; - - leapraid_ids = 0; - - leapraid_ctl_init(); + } error = pci_register_driver(&leapraid_driver); - if (error) + if (error) { + pr_err("%s: PCI driver registration failed: %d\n", + LEAPRAID_DRIVER_NAME, error); + sas_release_transport(leapraid_transport_template); + return error; + } + + error = leapraid_ctl_init(); + if (error) { + pci_unregister_driver(&leapraid_driver); sas_release_transport(leapraid_transport_template); + return error; + } - return error; + return 0; } static void __exit leapraid_exit(void) { - pr_info("leapraid version %s unloading\n", - LEAPRAID_DRIVER_VERSION); + pr_info("%s exiting\n", LEAPRAID_DRIVER_NAME); leapraid_ctl_exit(); pci_unregister_driver(&leapraid_driver); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index d224449732a3..738bc55df416 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <scsi/scsi_host.h> #include "leapraid_func.h" @@ -16,10 +15,8 @@ static struct leapraid_topo_node *leapraid_transport_topo_node_by_sas_addr( { if (adapter->dev_topo.card.sas_address == sas_addr) return &adapter->dev_topo.card; - else - return leapraid_exp_find_by_sas_address(adapter, - sas_addr, - card_port); + + return leapraid_exp_find_by_sas_address(adapter, sas_addr, card_port); } static u8 leapraid_get_port_id_by_expander(struct leapraid_adapter *adapter, @@ -49,7 +46,8 @@ static u8 leapraid_get_port_id_by_end_dev(struct leapraid_adapter *adapter, u8 port_id = 0xFF; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, rphy->identify.sas_address, rphy); if (sas_dev) { @@ -131,10 +129,9 @@ static enum sas_linkrate leapraid_transport_convert_phy_link_rate(u8 link_rate) }, }; - for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) { + for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) if (linkrate_table[i].in == link_rate) return linkrate_table[i].out; - } return SAS_LINK_RATE_UNKNOWN; } @@ -192,7 +189,7 @@ static void leapraid_set_identify_protocol_flags(u32 dev_info, }; for (i = 0; i < ARRAY_SIZE(mappings); i++) - if ((dev_info & mappings[i].mask) && mappings[i].target) + if (dev_info & mappings[i].mask && mappings[i].target) *mappings[i].target |= mappings[i].protocol; } @@ -207,13 +204,19 @@ static int leapraid_transport_set_identify(struct leapraid_adapter *adapter, if ((adapter->access_ctrl.shost_recovering && !adapter->scan_dev_desc.driver_loading) || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; + } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; memset(identify, 0, sizeof(struct sas_identify)); @@ -248,27 +251,34 @@ static void leapraid_transport_exp_set_edev(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; struct leapraid_rep_manu_reply *rep_manu_reply; u8 *component_id; - ssize_t __maybe_unused ret; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; if (le16_to_cpu(smp_passthrough_rep->resp_data_len) != sizeof(struct leapraid_rep_manu_reply)) return; rep_manu_reply = data_out + sizeof(struct leapraid_rep_manu_request); - ret = strscpy(edev->vendor_id, rep_manu_reply->vendor_identification, - SAS_EXPANDER_VENDOR_ID_LEN); - ret = strscpy(edev->product_id, rep_manu_reply->product_identification, - SAS_EXPANDER_PRODUCT_ID_LEN); - ret = strscpy(edev->product_rev, - rep_manu_reply->product_revision_level, - SAS_EXPANDER_PRODUCT_REV_LEN); + + memcpy(edev->vendor_id, rep_manu_reply->vendor_identification, + SAS_EXPANDER_VENDOR_ID_LEN); + edev->vendor_id[SAS_EXPANDER_VENDOR_ID_LEN] = '\0'; + + memcpy(edev->product_id, rep_manu_reply->product_identification, + SAS_EXPANDER_PRODUCT_ID_LEN); + edev->product_id[SAS_EXPANDER_PRODUCT_ID_LEN] = '\0'; + + memcpy(edev->product_rev, rep_manu_reply->product_revision_level, + SAS_EXPANDER_PRODUCT_REV_LEN); + edev->product_rev[SAS_EXPANDER_PRODUCT_REV_LEN] = '\0'; + edev->level = rep_manu_reply->sas_format & 1; if (edev->level) { - ret = strscpy(edev->component_vendor_id, - rep_manu_reply->component_vendor_identification, - SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + memcpy(edev->component_vendor_id, + rep_manu_reply->comp_vendor_identification, + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + edev->component_vendor_id[ + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN] = '\0'; component_id = (u8 *)&rep_manu_reply->component_id; edev->component_id = component_id[0] << 8 | component_id[1]; @@ -291,18 +301,24 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, size_t c2h_size; size_t h2c_size; void *psge; - int rc = 0; + int rc; if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; } mutex_lock(&adapter->driver_cmds.transport_cmd.mutex); adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto out_cleanup; h2c_size = sizeof(struct leapraid_rep_manu_request); c2h_size = sizeof(struct leapraid_rep_manu_reply); @@ -312,7 +328,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, GFP_ATOMIC); if (!data_out) { rc = -ENOMEM; - goto out; + goto out_cleanup; } rep_manu_request = data_out; @@ -323,8 +339,9 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->request_length = 0; smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.transport_cmd.inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -342,11 +359,13 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { + rc = -ETIMEDOUT; dev_err(&adapter->pdev->dev, - "%s: smp passthrough to exp timeout\n", - __func__); + "%s: SMP passthrough timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & - LEAPRAID_CMD_RESET)) + LEAPRAID_CMD_RESET)) issue_reset = true; goto hard_reset; @@ -358,11 +377,11 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, hard_reset: if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); + rc = leapraid_hard_reset_handler(adapter, FULL_RESET); } -out: +out_cleanup: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; if (data_out) dma_free_coherent(&adapter->pdev->dev, h2c_size + c2h_size, @@ -376,13 +395,14 @@ static void leapraid_transport_del_port(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { dev_info(&sas_port->port->dev, - "remove port: sas addr=0x%016llx\n", + "Remove port: SAS addr=0x%016llx\n", (unsigned long long)sas_port->remote_identify.sas_address); switch (sas_port->remote_identify.device_type) { case SAS_END_DEVICE: - leapraid_sas_dev_remove_by_sas_address(adapter, - sas_port->remote_identify.sas_address, - sas_port->card_port); + leapraid_sas_dev_remove_by_sas_address( + adapter, + sas_port->remote_identify.sas_address, + sas_port->card_port); break; case SAS_EDGE_EXPANDER_DEVICE: case SAS_FANOUT_EXPANDER_DEVICE: @@ -399,13 +419,13 @@ static void leapraid_transport_del_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "remove phy: sas addr=0x%016llx, phy=%d\n", + "Remove PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_del(&card_phy->port_siblings); sas_port->phys_num--; sas_port_delete_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; } static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, @@ -413,16 +433,17 @@ static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "add phy: sas addr=0x%016llx, phy=%d\n", + "Add PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_add_tail(&card_phy->port_siblings, &sas_port->phy_list); sas_port->phys_num++; sas_port_add_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; } -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *card_phy, u64 sas_address, @@ -454,7 +475,8 @@ void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, } } -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *target_card_phy) { @@ -482,7 +504,8 @@ void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, } } -static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, +static void leapraid_detach_phy_from_old_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, u64 sas_address, struct leapraid_card_port *card_port) @@ -495,9 +518,10 @@ static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, topo_node->card_phy[i].card_port != card_port) continue; if (topo_node->card_phy[i].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, - topo_node, - &topo_node->card_phy[i]); + leapraid_transport_detach_phy_to_port( + adapter, + topo_node, + &topo_node->card_phy[i]); } } @@ -512,8 +536,11 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( unsigned long flags; sas_port = kzalloc(sizeof(*sas_port), GFP_KERNEL); - if (!sas_port) + if (!sas_port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed alloc sas_port\n", __func__); return NULL; + } INIT_LIST_HEAD(&sas_port->port_list); INIT_LIST_HEAD(&sas_port->phy_list); @@ -526,27 +553,30 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( if (!topo_node) { dev_err(&adapter->pdev->dev, - "%s: failed to find parent node for sas addr 0x%016llx!\n", + "%s: Failed to locate parent for SAS 0x%016llx!\n", __func__, sas_address); - kfree(sas_port); - return NULL; + goto out_cleanup; } if (leapraid_transport_set_identify(adapter, handle, - &sas_port->remote_identify)) { - kfree(sas_port); - return NULL; - } + &sas_port->remote_identify)) + goto out_cleanup; if (sas_port->remote_identify.device_type == SAS_PHY_UNUSED) { - kfree(sas_port); - return NULL; + dev_warn(&adapter->pdev->dev, + "%s: Failed, device type is SAS_PHY_UNUSED\n", + __func__); + goto out_cleanup; } sas_port->card_port = card_port; *out_topo_node = topo_node; return sas_port; + +out_cleanup: + kfree(sas_port); + return NULL; } static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, @@ -576,12 +606,12 @@ static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, vphy = leapraid_get_vphy_by_phy(card_port, i); if (!vphy) - return -1; + return LEAPRAID_OPERATION_FAILED; } } *out_vphy = vphy; - return sas_port->phys_num ? 0 : -1; + return sas_port->phys_num ? 0 : LEAPRAID_OPERATION_FAILED; } static struct sas_rphy *leapraid_create_and_register_rphy( @@ -596,26 +626,42 @@ static struct sas_rphy *leapraid_create_and_register_rphy( struct sas_port *port; struct sas_rphy *rphy; - if (!topo_node->parent_dev) - return NULL; + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sas_port->remote_identify.sas_address, + card_port); + if (!sas_dev) + return NULL; + sas_dev->pend_sas_rphy_add = 1; + } + + if (!topo_node->parent_dev) { + dev_warn(&adapter->pdev->dev, + "%s: topo_node parent device is NULL\n", __func__); + goto cleanup_sas_dev; + } port = sas_port_alloc_num(topo_node->parent_dev); - if (sas_port_add(port)) - return NULL; + if (!port) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate SAS port\n", __func__); + goto cleanup_sas_dev; + } + + if (sas_port_add(port)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to add SAS port\n", __func__); + goto out_delete_port; + } list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { sas_port_add_phy(port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; card_phy->card_port = card_port; } - if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sas_port->remote_identify.sas_address, - card_port); - if (!sas_dev) - return NULL; - sas_dev->pend_sas_rphy_add = 1; + if (sas_dev) { rphy = sas_end_device_alloc(port); sas_dev->rphy = rphy; @@ -625,28 +671,63 @@ static struct sas_rphy *leapraid_create_and_register_rphy( else vphy->sas_address = sas_dev->sas_addr; } - } else { - rphy = sas_expander_alloc(port, - sas_port->remote_identify.device_type); + rphy = sas_expander_alloc( + port, + sas_port->remote_identify.device_type); if (topo_node->hdl <= adapter->dev_topo.card.phys_num) card_port->sas_address = sas_port->remote_identify.sas_address; } + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate RPHY\n", __func__); + goto cleanup_card_phy; + } + rphy->identify = sas_port->remote_identify; - if (sas_rphy_add(rphy)) + if (sas_rphy_add(rphy)) { dev_err(&adapter->pdev->dev, - "%s: failed to add rphy\n", __func__); + "%s: Failed to add RPHY\n", __func__); + if (sas_dev) + sas_dev->rphy = NULL; + + sas_rphy_free(rphy); + goto cleanup_card_phy; + } + sas_port->port = port; if (sas_dev) { sas_dev->pend_sas_rphy_add = 0; leapraid_sdev_put(sas_dev); } - sas_port->port = port; return rphy; + +cleanup_card_phy: + if (topo_node->hdl <= adapter->dev_topo.card.phys_num) { + if (!vphy) + card_port->sas_address = 0; + else + vphy->sas_address = 0; + } + + list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { + card_phy->phy_is_assigned = 0; + card_phy->card_port = NULL; + } + +out_delete_port: + sas_port_delete(port); + +cleanup_sas_dev: + if (sas_dev) { + sas_dev->pend_sas_rphy_add = 0; + leapraid_sdev_put(sas_dev); + } + return NULL; } struct leapraid_sas_port *leapraid_transport_port_add( @@ -656,35 +737,45 @@ struct leapraid_sas_port *leapraid_transport_port_add( { struct leapraid_card_phy *card_phy, *card_phy_next; struct leapraid_topo_node *topo_node = NULL; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_vphy *vphy = NULL; - struct sas_rphy *rphy = NULL; + struct sas_rphy *rphy; unsigned long flags; - if (!card_port) + if (!card_port) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid card_port\n", __func__); return NULL; + } sas_port = leapraid_prepare_sas_port(adapter, hdl, sas_address, card_port, &topo_node); if (!sas_port) return NULL; - leapraid_detach_phy_from_old_port(adapter, - topo_node, - sas_port->remote_identify.sas_address, - card_port); + leapraid_detach_phy_from_old_port( + adapter, + topo_node, + sas_port->remote_identify.sas_address, + card_port); if (leapraid_bind_phys_and_vphy(adapter, sas_port, topo_node, - card_port, &vphy)) + card_port, &vphy)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to bind phy to vphy\n", __func__); goto out_fail; + } rphy = leapraid_create_and_register_rphy(adapter, sas_port, topo_node, card_port, vphy); - if (!rphy) + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create rphy\n", __func__); goto out_fail; + } dev_info(&rphy->dev, - "%s: added dev: hdl=0x%04x, sas addr=0x%016llx\n", + "%s: Added dev: hdl=0x%04x, SAS addr=0x%016llx\n", __func__, hdl, (unsigned long long)sas_port->remote_identify.sas_address); @@ -695,20 +786,27 @@ struct leapraid_sas_port *leapraid_transport_port_add( spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); if (sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_EDGE_EXPANDER || + SAS_EDGE_EXPANDER_DEVICE || sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_FANOUT_EXPANDER) - leapraid_transport_exp_report_manu(adapter, - sas_port->remote_identify.sas_address, - rphy_to_expander_device(rphy), - card_port->port_id); + SAS_FANOUT_EXPANDER_DEVICE) + leapraid_transport_exp_report_manu( + adapter, + sas_port->remote_identify.sas_address, + rphy_to_expander_device(rphy), + card_port->port_id); return sas_port; out_fail: list_for_each_entry_safe(card_phy, card_phy_next, - &sas_port->phy_list, port_siblings) - list_del(&card_phy->port_siblings); + &sas_port->phy_list, port_siblings) { + if (topo_node->hdl <= adapter->dev_topo.card.phys_num && + !card_phy->vphy) + card_port->phy_mask &= ~BIT(card_phy->phy_id); + + list_del_init(&card_phy->port_siblings); + } + kfree(sas_port); return NULL; } @@ -750,10 +848,10 @@ static void leapraid_cleanup_card_port_and_vphys( if (vphy->sas_address != sas_address) continue; - dev_info(&adapter->pdev->dev, - "%s: remove vphy: %p from port: %p, port_id=%d\n", - __func__, vphy, remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove vphy=%p from port=%p port_id=%d\n", + __func__, vphy, remove_card_port, + remove_card_port->port_id); remove_card_port->vphys_mask &= ~vphy->phy_mask; list_del(&vphy->list); @@ -762,11 +860,11 @@ static void leapraid_cleanup_card_port_and_vphys( if (!remove_card_port->vphys_mask && !remove_card_port->sas_address) { - dev_info(&adapter->pdev->dev, - "%s: remove empty hba_port: %p, port_id=%d\n", - __func__, - remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove empty hba_port: %p, port_id=%d\n", + __func__, + remove_card_port, + remove_card_port->port_id); list_del(&remove_card_port->list); kfree(remove_card_port); remove_card_port = NULL; @@ -782,15 +880,15 @@ static void leapraid_cleanup_card_port_and_vphys( continue; if (!remove_card_port->vphys_mask) { - dev_info(&adapter->pdev->dev, - "%s: remove hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove hba_port: %p, port_id=%d\n", + __func__, card_port, card_port->port_id); list_del(&card_port->list); kfree(card_port); } else { - dev_info(&adapter->pdev->dev, - "%s: clear sas_address of hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "Clear sas_address of port=%p, port_id=%d\n", + card_port, card_port->port_id); remove_card_port->sas_address = 0; } break; @@ -802,22 +900,23 @@ static void leapraid_clear_topo_node_phys(struct leapraid_topo_node *topo_node, { int i; - for (i = 0; i < topo_node->phys_num; i++) { + for (i = 0; i < topo_node->phys_num; i++) if (topo_node->card_phy[i].remote_identify.sas_address == sas_address) { memset(&topo_node->card_phy[i].remote_identify, 0, sizeof(struct sas_identify)); - topo_node->card_phy[i].vphy = false; + topo_node->card_phy[i].vphy = 0; } - } } -void leapraid_transport_port_remove(struct leapraid_adapter *adapter, - u64 sas_address, u64 sas_address_parent, +void leapraid_transport_port_remove( + struct leapraid_adapter *adapter, + u64 sas_address, + u64 sas_address_parent, struct leapraid_card_port *remove_card_port) { struct leapraid_card_phy *card_phy, *card_phy_next; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_topo_node *topo_node; unsigned long flags; bool found = false; @@ -855,7 +954,7 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, list_for_each_entry_safe(card_phy, card_phy_next, &sas_port->phy_list, port_siblings) { - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; if (!adapter->access_ctrl.host_removing) sas_port_delete_phy(sas_port->port, card_phy->phy); @@ -865,9 +964,9 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, if (!adapter->access_ctrl.host_removing) sas_port_delete(sas_port->port); - dev_info(&adapter->pdev->dev, - "%s: removed sas_port for sas addr=0x%016llx\n", - __func__, (unsigned long long)sas_address); + dev_dbg(&adapter->pdev->dev, + "%s: Removed sas_port for SAS addr=0x%016llx\n", + __func__, (unsigned long long)sas_address); kfree(sas_port); } @@ -902,9 +1001,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_HWRATE_MIN_RATE_MASK); phy->maximum_linkrate_hw = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->hw_link_rate >> 4) : + phy_pg0->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->hw_link_rate >> 4); + exp_pg1->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->minimum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( phy_pg0->p_link_rate & @@ -914,9 +1015,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_PRATE_MIN_RATE_MASK); phy->maximum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->p_link_rate >> 4) : + phy_pg0->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->p_link_rate >> 4); + exp_pg1->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->hostdata = card_phy->card_port; } @@ -926,30 +1029,33 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy handle identify failed!\n", __func__); + "%s: Set PHY handle identify failed!\n", __func__); sas_phy_free(phy); return; } card_phy->attached_hdl = le16_to_cpu(phy_pg0->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) { dev_err(&adapter->pdev->dev, - "%s set phy attached handle identify failed!\n", + "%s: Set PHY attached hdl identify failed!\n", __func__); sas_phy_free(phy); return; @@ -958,7 +1064,9 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, phy_pg0, NULL); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return; } @@ -972,38 +1080,41 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return -EFAULT; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy hdl identify failed!\n", __func__); + "%s: Set PHY hdl identify failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } card_phy->attached_hdl = le16_to_cpu(exp_pg1->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { - dev_err(&adapter->pdev->dev, - "%s set phy attached hdl identify failed!\n", - __func__); - sas_phy_free(phy); - } + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) + dev_warn(&adapter->pdev->dev, + "%s: Set PHY attached hdl identify failed!\n", + __func__); } leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, NULL, exp_pg1); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } @@ -1012,13 +1123,14 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, return 0; } -void leapraid_transport_update_links(struct leapraid_adapter *adapter, +void leapraid_transport_update_links( + struct leapraid_adapter *adapter, u64 sas_address, u16 hdl, u8 phy_index, u8 link_rate, struct leapraid_card_port *target_card_port) { struct leapraid_topo_node *topo_node; struct leapraid_card_phy *card_phy; - struct leapraid_card_port *card_port = NULL; + struct leapraid_card_port *card_port; unsigned long flags; if (adapter->access_ctrl.shost_recovering || @@ -1053,10 +1165,12 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, BIT(card_phy->phy_id); } } - leapraid_transport_attach_phy_to_port(adapter, topo_node, - card_phy, - card_phy->remote_identify.sas_address, - target_card_port); + leapraid_transport_attach_phy_to_port( + adapter, + topo_node, + card_phy, + card_phy->remote_identify.sas_address, + target_card_port); } else { memset(&card_phy->remote_identify, 0, sizeof(struct sas_identify)); @@ -1079,8 +1193,12 @@ static int leapraid_dma_map_buffer(struct device *dev, struct bsg_buffer *buf, *dma_len = buf->payload_len; } else { - if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) + if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) { + dev_err(dev, + "%s: Failed to map sg buffer for dma\n", + __func__); return -ENOMEM; + } *dma_addr = sg_dma_address(buf->sg_list); *dma_len = sg_dma_len(buf->sg_list); @@ -1106,11 +1224,11 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr, size_t c2h_size) { struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; void *psge; - smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(*smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -1130,30 +1248,36 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, - "%s: sending smp request\n", __func__); + const struct leapraid_smp_passthrough_req *smp_passthrough_req; + + dev_dbg(&adapter->pdev->dev, + "%s: Sending smp request\n", __func__); + smp_passthrough_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.transport_cmd.inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); leapraid_fire_task(adapter, adapter->driver_cmds.transport_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "%s: timeout\n", __func__); + dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { - dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", - __func__, __LINE__); + dev_dbg(&adapter->pdev->dev, + "%s:%d: call hard_reset\n", + __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); return -ETIMEDOUT; } } - dev_info(&adapter->pdev->dev, "%s: smp request complete\n", __func__); + dev_dbg(&adapter->pdev->dev, "%s: SMP request complete\n", __func__); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_REPLY_VALID)) { dev_err(&adapter->pdev->dev, - "%s: smp request no reply\n", __func__); + "%s: SMP request no reply\n", __func__); return -ENXIO; } @@ -1167,10 +1291,10 @@ static void leapraid_handle_smp_rep(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; - dev_info(&adapter->pdev->dev, "%s: response data len=%d\n", - __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); + dev_dbg(&adapter->pdev->dev, "%s: Response data len=%d\n", + __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); memcpy(job->reply, smp_passthrough_rep, sizeof(*smp_passthrough_rep)); job->reply_len = sizeof(*smp_passthrough_rep); @@ -1198,13 +1322,19 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); rc = -EFAULT; - goto done; + goto exit_bsg_job; } - rc = mutex_lock_interruptible(&adapter->driver_cmds.transport_cmd.mutex); + rc = mutex_lock_interruptible(&adapter->driver_cmds + .transport_cmd.mutex); if (rc) - goto done; + goto exit_bsg_job; adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; rc = leapraid_dma_map_buffer(&adapter->pdev->dev, @@ -1223,7 +1353,8 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) goto free_rep_buf; @@ -1245,7 +1376,7 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, release_lock: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.transport_cmd.mutex); -done: +exit_bsg_job: bsg_job_done(job, rc, reslen); } -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: leapraid: update driver to v2.0.1.2
by haodongdong 26 May '26

26 May '26

From: Dongdong Hao <doubled(a)leap-io-kernel.com> LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9234 ------------------------------------------ leapraid driver changes from v2.0.0.6 to v2.0.1.2. This update includes: - overheat handling rework - reset flow stabilization - improved timeout diagnostics - sysfs enhancement - topology and transport error-path fixes - memory leak/UAF/reference leak fixes - mmap/ioctl validation fixes - improved queue depth handling - improved interrupt and resource cleanup logic The update also fixes several race conditions and improves overall driver robustness under reset, topology change, and controller abnormal scenarios. Signed-off-by: Dongdong Hao <doubled(a)leap-io-kernel.com> --- drivers/scsi/leapraid/Kconfig | 2 +- drivers/scsi/leapraid/leapraid.h | 1335 +++--- drivers/scsi/leapraid/leapraid_app.c | 529 +-- drivers/scsi/leapraid/leapraid_func.c | 4237 ++++++++++++-------- drivers/scsi/leapraid/leapraid_func.h | 1086 ++--- drivers/scsi/leapraid/leapraid_os.c | 889 ++-- drivers/scsi/leapraid/leapraid_transport.c | 485 ++- 7 files changed, 4859 insertions(+), 3704 deletions(-) diff --git a/drivers/scsi/leapraid/Kconfig b/drivers/scsi/leapraid/Kconfig index b539183b24a7..f4ece78f80d3 100644 --- a/drivers/scsi/leapraid/Kconfig +++ b/drivers/scsi/leapraid/Kconfig @@ -5,7 +5,7 @@ config SCSI_LEAPRAID depends on PCI && SCSI select SCSI_SAS_ATTRS help - This driver supports LeapIO PCIe-based Storage + This driver supports LeapIO PCIe-based storage and RAID controllers. <http://www.leap-io.com> diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 77bb93b79254..2a99417143ad 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -1,13 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ #ifndef LEAPRAID_H #define LEAPRAID_H -/* doorbell register definitions */ +/* Doorbell register definitions. */ #define LEAPRAID_DB_RESET 0x00000000 #define LEAPRAID_DB_READY 0x10000000 #define LEAPRAID_DB_OPERATIONAL 0x20000000 @@ -22,55 +22,60 @@ #define LEAPRAID_DB_FUNC_SHIFT 24 #define LEAPRAID_DB_ADD_DWORDS_SHIFT 16 -/* maximum number of retries waiting for doorbell to become ready */ +/* Maximum number of retries waiting for doorbell to become ready. */ #define LEAPRAID_DB_RETRY_COUNT_MAX 10 -/* maximum number of retries waiting for doorbell to become operational */ -#define LEAPRAID_DB_WAIT_OPERATIONAL 10 -/* sleep interval (in seconds) between doorbell polls */ +/* Maximum number of retries waiting for doorbell to become operational. */ +#define LEAPRAID_DB_WAIT_OP_SHORT 10 +#define LEAPRAID_DB_WAIT_OP_LONG 200 +/* Sleep interval (in seconds) between doorbell polls. */ #define LEAPRAID_DB_POLL_INTERVAL_S 1 -/* maximum number of retries waiting for host to end recovery */ -#define LEAPRAID_WAIT_SHOST_RECOVERY 30 +/* Maximum number of retries waiting for host to end recovery. */ +#define LEAPRAID_WAIT_SHOST_RECOVERY 400 -/* diagnostic register definitions */ +/* Diagnostic register definitions. */ #define LEAPRAID_DIAG_WRITE_ENABLE 0x00000080 #define LEAPRAID_DIAG_RESET 0x00000004 -#define LEAPRAID_DIAG_HOLD_ADAPTER_RESET 0x00000002 -/* interrupt status register definitions */ +/* Interrupt status register definitions. */ #define LEAPRAID_HOST2ADAPTER_DB_STATUS 0x80000000 #define LEAPRAID_ADAPTER2HOST_DB_STATUS 0x00000001 -/* the number of debug register */ +/* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 +#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 -/* reply post host register defines */ +/* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 #define LEAPRAID_RPHI_MSIX_IDX_SHIFT 24 -/* vphy flags */ +/* Virtual PHY flags. */ #define LEAPRAID_SAS_PHYINFO_VPHY 0x00001000 -/* linux driver init fw */ +/* Linux driver init firmware. */ #define LEAPRAID_WHOINIT_LINUX_DRIVER 0x04 -/* rdpq array mode */ +/* Reply descriptor post queue array mode. */ #define LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE 0x01 -/* request description flags */ +/* Request description flags. */ #define LEAPRAID_REQ_DESC_FLG_SCSI_IO 0x00 #define LEAPRAID_REQ_DESC_FLG_HPR 0x06 #define LEAPRAID_REQ_DESC_FLG_DFLT_TYPE 0x08 -/* reply description flags */ +/* Reply description flags. */ #define LEAPRAID_RPY_DESC_FLG_TYPE_MASK 0x0F #define LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS 0x00 #define LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY 0x01 #define LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS 0x06 #define LEAPRAID_RPY_DESC_FLG_UNUSED 0x0F -/* MPI functions */ -#define LEAPRAID_FUNC_SCSIIO_REQ 0x00 +/* Request and reply messages share the same set of function codes. + * + * Note: SCSIIO (SCSI I/O) represents SCSI I/O operations and is used + * consistently throughout the driver for all SCSI command handling. + */ +#define LEAPRAID_FUNC_SCSIIO 0x00 #define LEAPRAID_FUNC_SCSI_TMF 0x01 #define LEAPRAID_FUNC_ADAPTER_INIT 0x02 #define LEAPRAID_FUNC_GET_ADAPTER_FEATURES 0x03 @@ -79,17 +84,16 @@ #define LEAPRAID_FUNC_EVENT_NOTIFY 0x07 #define LEAPRAID_FUNC_FW_DOWNLOAD 0x09 #define LEAPRAID_FUNC_FW_UPLOAD 0x12 -#define LEAPRAID_FUNC_RAID_ACTION 0x15 -#define LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH 0x16 +#define LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH 0x16 #define LEAPRAID_FUNC_SCSI_ENC_PROCESSOR 0x18 #define LEAPRAID_FUNC_SMP_PASSTHROUGH 0x1A #define LEAPRAID_FUNC_SAS_IO_UNIT_CTRL 0x1B -#define LEAPRAID_FUNC_SATA_PASSTHROUGH 0x1C +#define LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH 0x1C #define LEAPRAID_FUNC_ADAPTER_UNIT_RESET 0x40 #define LEAPRAID_FUNC_HANDSHAKE 0x42 #define LEAPRAID_FUNC_LOGBUF_INIT 0x57 -/* adapter status values */ +/* Adapter status values. */ #define LEAPRAID_ADAPTER_STATUS_MASK 0x7FFF #define LEAPRAID_ADAPTER_STATUS_SUCCESS 0x0000 #define LEAPRAID_ADAPTER_STATUS_BUSY 0x0002 @@ -113,7 +117,7 @@ #define LEAPRAID_ADAPTER_STATUS_SCSI_ADAPTER_TERMINATED 0x004B #define LEAPRAID_ADAPTER_STATUS_SCSI_EXT_TERMINATED 0x004C -/* sge flags */ +/* SGE flags. */ #define LEAPRAID_SGE_FLG_LAST_ONE 0x80 #define LEAPRAID_SGE_FLG_EOB 0x40 #define LEAPRAID_SGE_FLG_EOL 0x01 @@ -129,15 +133,19 @@ #define LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE 0x80 #define LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR 0x00 -#define LEAPRAID_SGE_OFFSET_SIZE 4 +#define LEAPRAID_SGE_NO_DATA_ADDR -1 +#define LEAPRAID_SGE_OFFSET_SIZE 4 -/* page and ext page type */ +/* The type of page. */ #define LEAPRAID_CFG_PT_IO_UNIT 0x00 #define LEAPRAID_CFG_PT_ADAPTER 0x01 #define LEAPRAID_CFG_PT_BIOS 0x02 #define LEAPRAID_CFG_PT_RAID_VOLUME 0x08 +#define LEAPRAID_CFG_PT_MANUFACTURING 0x09 #define LEAPRAID_CFG_PT_RAID_PHYSDISK 0x0A #define LEAPRAID_CFG_PT_EXTENDED 0x0F + +/* The type of extended page. */ #define LEAPRAID_CFG_EXTPT_SAS_IO_UNIT 0x10 #define LEAPRAID_CFG_EXTPT_SAS_EXP 0x11 #define LEAPRAID_CFG_EXTPT_SAS_DEV 0x12 @@ -145,7 +153,7 @@ #define LEAPRAID_CFG_EXTPT_ENC 0x15 #define LEAPRAID_CFG_EXTPT_RAID_CONFIG 0x16 -/* config page address */ +/* Config page address. */ #define LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP 0x00000000 #define LEAPRAID_SAS_ENC_CFG_PGAD_HDL 0x10000000 #define LEAPRAID_SAS_DEV_CFG_PGAD_HDL 0x20000000 @@ -156,51 +164,55 @@ #define LEAPRAID_SAS_PHY_CFG_PGAD_PHY_NUMBER 0x00000000 #define LEAPRAID_PHYSDISK_CFG_PGAD_PHYSDISKNUM 0x10000000 -/* config page operations */ +/* Config page operations. */ #define LEAPRAID_CFG_ACT_PAGE_HEADER 0x00 #define LEAPRAID_CFG_ACT_PAGE_READ_CUR 0x01 #define LEAPRAID_CFG_ACT_PAGE_WRITE_CUR 0x02 -/* bios pages */ +/* BIOS page number. */ #define LEAPRAID_CFG_PAGE_NUM_BIOS2 0x2 #define LEAPRAID_CFG_PAGE_NUM_BIOS3 0x3 -/* sas device pages */ +/* Manufacturing page number. */ +#define LEAPRAID_CFG_PAGE_NUM_MANU0 0x0 + +/* SAS device page number. */ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 -/* sas device page 0 flags */ +/* SAS device page 0 flags. */ #define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 +#define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 -/* sas IO unit pages */ +/* SAS I/O unit page number. */ #define LEAPRAID_CFG_PAGE_NUM_IOUNIT0 0x0 #define LEAPRAID_CFG_PAGE_NUM_IOUNIT1 0x1 -/* sas expander pages */ +/* SAS expander page number. */ #define LEAPRAID_CFG_PAGE_NUM_EXP0 0x0 #define LEAPRAID_CFG_PAGE_NUM_EXP1 0x1 -/* sas enclosure page */ +/* SAS enclosure page number. */ #define LEAPRAID_CFG_PAGE_NUM_ENC0 0x0 -/* sas phy page */ +/* SAS PHY page number. */ #define LEAPRAID_CFG_PAGE_NUM_PHY0 0x0 -/* raid volume pages */ +/* RAID volume page number. */ #define LEAPRAID_CFG_PAGE_NUM_VOL0 0x0 #define LEAPRAID_CFG_PAGE_NUM_VOL1 0x1 -/* physical disk page */ +/* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* adapter page */ +/* Adapter page number. */ #define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 #define LEAPRAID_CFG_UNIT_SIZE 4 -/* raid volume type and state */ +/* Raid volume type and state. */ #define LEAPRAID_VOL_STATE_MISSING 0x00 #define LEAPRAID_VOL_STATE_FAILED 0x01 #define LEAPRAID_VOL_STATE_INITIALIZING 0x02 @@ -213,17 +225,17 @@ #define LEAPRAID_VOL_TYPE_RAID10 0x05 #define LEAPRAID_VOL_TYPE_UNKNOWN 0xFF -/* raid volume element flags */ +/* Raid volume element flags. */ #define LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE 0x000F #define LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT 0x0001 #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* raid action */ +/* Raid action. */ #define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 #define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 -/* sas negotiated link rates */ +/* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 #define LEAPRAID_SAS_NEG_LINK_RATE_PHY_DISABLED 0x01 @@ -231,6 +243,7 @@ #define LEAPRAID_SAS_NEG_LINK_RATE_SATA_OOB_COMPLETE 0x03 #define LEAPRAID_SAS_NEG_LINK_RATE_PORT_SELECTOR 0x04 #define LEAPRAID_SAS_NEG_LINK_RATE_SMP_RESETTING 0x05 +#define LEAPRAID_SAS_NEG_LINK_RATE_SHIFT 4 #define LEAPRAID_SAS_NEG_LINK_RATE_1_5 0x08 #define LEAPRAID_SAS_NEG_LINK_RATE_3_0 0x09 @@ -240,8 +253,11 @@ #define LEAPRAID_SAS_PRATE_MIN_RATE_MASK 0x0F #define LEAPRAID_SAS_HWRATE_MIN_RATE_MASK 0x0F -/* scsi IO control bits */ -#define LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT 26 +/* + * Control flags for a SCSI I/O Request. + */ +#define LEAPRAID_SCSIIO_CTRL_CDB_32BYTE 4 +#define LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT 26 #define LEAPRAID_SCSIIO_CTRL_NODATATRANSFER 0x00000000 #define LEAPRAID_SCSIIO_CTRL_WRITE 0x01000000 #define LEAPRAID_SCSIIO_CTRL_READ 0x02000000 @@ -250,7 +266,7 @@ #define LEAPRAID_SCSIIO_CTRL_ORDEREDQ 0x00000200 #define LEAPRAID_SCSIIO_CTRL_CMDPRI 0x00000800 -/* scsi state and status */ +/* SCSI state and status. */ #define LEAPRAID_SCSI_STATUS_BUSY 0x08 #define LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT 0x18 #define LEAPRAID_SCSI_STATUS_TASK_SET_FULL 0x28 @@ -261,7 +277,7 @@ #define LEAPRAID_SCSI_STATE_AUTOSENSE_FAILED 0x02 #define LEAPRAID_SCSI_STATE_AUTOSENSE_VALID 0x01 -/* scsi task management defines */ +/* SCSI task management defines. */ #define LEAPRAID_TM_TASKTYPE_ABORT_TASK 0x01 #define LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET 0x02 #define LEAPRAID_TM_TASKTYPE_TARGET_RESET 0x03 @@ -277,21 +293,20 @@ #define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 #define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 -/* scsi sep request defines */ +/* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 #define LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS 0x00 #define LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS 0x01 #define LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT 0x00000040 -/* the capabilities of the adapter */ +/* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 #define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 #define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 -/* event code definitions for the firmware */ +/* Event code definitions for the firmware. */ #define LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE 0x000F -#define LEAPRAID_EVT_SAS_DISCOVERY 0x0016 #define LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST 0x001C #define LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE 0x001D #define LEAPRAID_EVT_IR_CHANGE 0x0020 @@ -303,7 +318,7 @@ #define LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET 0x08 #define LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET 0x0E -/* raid configuration change event */ +/* RAID configuration change event. */ #define LEAPRAID_EVT_IR_RC_VOLUME_ADD 0x01 #define LEAPRAID_EVT_IR_RC_VOLUME_DELETE 0x02 #define LEAPRAID_EVT_IR_RC_PD_HIDDEN_TO_ADD 0x03 @@ -313,27 +328,25 @@ #define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A #define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B -/* sas topology change event */ +/* SAS topology change event. */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 #define LEAPRAID_EVT_SAS_TOPO_ES_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING 0x02 #define LEAPRAID_EVT_SAS_TOPO_ES_RESPONDING 0x03 #define LEAPRAID_EVT_SAS_TOPO_RC_MASK 0x0F -#define LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK 0xF0 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -#define LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED 0x03 -/* sas discovery event defines */ +/* SAS discovery event defines. */ #define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 #define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 -/* enclosure device status change event */ +/* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 -/* device type and identifiers */ +/* Device type and identifiers. */ #define LEAPRAID_DEVTYP_SEP 0x00004000 #define LEAPRAID_DEVTYP_SSP_TGT 0x00000400 #define LEAPRAID_DEVTYP_STP_TGT 0x00000200 @@ -350,12 +363,12 @@ #define LEAPRAID_DEVTYP_EDGE_EXPANDER 0x00000002 #define LEAPRAID_DEVTYP_FANOUT_EXPANDER 0x00000003 -/* sas control operation */ +/* SAS control operation. */ #define LEAPRAID_SAS_OP_PHY_LINK_RESET 0x06 #define LEAPRAID_SAS_OP_PHY_HARD_RESET 0x07 #define LEAPRAID_SAS_OP_SET_PARAMETER 0x0F -/* boot device defines */ +/* Boot device defines */ #define LEAPRAID_BOOTDEV_FORM_MASK 0x0F #define LEAPRAID_BOOTDEV_FORM_NONE 0x00 #define LEAPRAID_BOOTDEV_FORM_SAS_WWID 0x05 @@ -365,21 +378,21 @@ /** * struct leapraid_reg_base - Register layout of the LeapRAID controller * - * @db: Doorbell register used to signal commands or status to firmware - * @ws: Write sequence register for synchronizing doorbell operations - * @host_diag: Diagnostic register used for status or debug reporting - * @r1: Reserved - * @host_int_status: Interrupt status register reporting active interrupts - * @host_int_mask: Interrupt mask register enabling or disabling sources - * @r2: Reserved - * @rep_msg_host_idx: Reply message index for the next available reply slot - * @r3: Reserved - * @debug_log: DebugLog registers for firmware debug and diagnostic output - * @r4: Reserved - * @atomic_req_desc_post: Atomic register for single descriptor posting - * @adapter_log_buf_pos: Adapter log buffer write position - * @host_log_buf_pos: Host log buffer write position - * @r5: Reserved + * @db: Doorbell register used to signal commands or status to firmware. + * @ws: Write sequence register for synchronizing doorbell operations. + * @host_diag: Diagnostic register used for status or debug reporting. + * @r1: Reserved. + * @host_int_status: Interrupt status register reporting active interrupts. + * @host_int_mask: Interrupt mask register enabling or disabling sources. + * @r2: Reserved. + * @rep_msg_host_idx: Reply message index for the next available reply slot. + * @r3: Reserved. + * @debug_log: DebugLog registers for firmware debug and diagnostic output. + * @r4: Reserved. + * @atomic_req_desc_post: Atomic register for single descriptor posting. + * @adapter_log_buf_pos: Adapter log buffer write position. + * @host_log_buf_pos: Host log buffer write position. + * @r5: Reserved. * @rep_post_reg_idx: Array of reply post index registers, one per queue. * The number of entries is defined by * REP_POST_HOST_IDX_REG_CNT. @@ -411,9 +424,9 @@ struct leapraid_reg_base { /** * struct leapraid_atomic_req_desc - Atomic request descriptor * - * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O) - * @msix_idx: MSI-X vector index used for interrupt routing - * @taskid: Unique task identifier associated with this request + * @flg: Descriptor flag indicating the type of request (e.g. SCSI I/O). + * @msix_idx: MSI-X vector index used for interrupt routing. + * @taskid: Unique task identifier associated with this request. */ struct leapraid_atomic_req_desc { u8 flg; @@ -424,23 +437,23 @@ struct leapraid_atomic_req_desc { /** * union leapraid_rep_desc_union - Unified reply descriptor format * - * @dflt_rep: Default reply descriptor containing basic completion info - * @dflt_rep.rep_flg: Reply flag indicating reply type or status - * @dflt_rep.msix_idx: MSI-X index for interrupt routing - * @dflt_rep.taskid: Task identifier matching the submitted request - * @r1: Reserved + * @dflt_rep: Default reply descriptor containing basic completion info. + * @dflt_rep.rep_flg: Reply flag indicating reply type or status. + * @dflt_rep.msix_idx: MSI-X index for interrupt routing. + * @dflt_rep.taskid: Task identifier matching the submitted request. + * @r1: Reserved. * * @addr_rep: Address reply descriptor used when firmware returns a - * memory address associated with the reply - * @addr_rep.rep_flg: Reply flag indicating reply type or status - * @addr_rep.msix_idx: MSI-X index for interrupt routing - * @addr_rep.taskid: Task identifier matching the submitted request - * @addr_rep.rep_frame_addr: Physical address of the reply frame + * memory address associated with the reply. + * @addr_rep.rep_flg: Reply flag indicating reply type or status. + * @addr_rep.msix_idx: MSI-X index for interrupt routing. + * @addr_rep.taskid: Task identifier matching the submitted request. + * @addr_rep.rep_frame_addr: Physical address of the reply frame. * - * @words: Raw 64-bit representation of the reply descriptor - * @u: Alternative access using 32-bit low/high words - * @u.low: Lower 32 bits of the descriptor - * @u.high: Upper 32 bits of the descriptor + * @words: Raw 64-bit representation of the reply descriptor. + * @u: Alternative access using 32-bit low/high words. + * @u.low: Lower 32 bits of the descriptor. + * @u.high: Upper 32 bits of the descriptor. */ union leapraid_rep_desc_union { struct leapraid_rep_desc { @@ -465,10 +478,10 @@ union leapraid_rep_desc_union { /** * struct leapraid_req - Generic request header * - * @func_dep1: Function-dependent parameter (low 16 bits) - * @r1: Reserved - * @func: Function code identifying the command type - * @r2: Reserved + * @func_dep1: Function-dependent parameter (low 16 bits). + * @r1: Reserved. + * @func: Function code identifying the command type. + * @r2: Reserved. */ struct leapraid_req { __le16 func_dep1; @@ -480,12 +493,12 @@ struct leapraid_req { /** * struct leapraid_rep - Generic reply header * - * @r1: Reserved - * @msg_len: Length of the reply message in bytes - * @function: Function code corresponding to the request - * @r2: Reserved - * @adapter_status: Status code reported by the adapter - * @r3: Reserved + * @r1: Reserved. + * @msg_len: Length of the reply message in bytes. + * @function: Function code corresponding to the request. + * @r2: Reserved. + * @adapter_status: Status code reported by the adapter. + * @r3: Reserved. */ struct leapraid_rep { u8 r1[2]; @@ -499,8 +512,8 @@ struct leapraid_rep { /** * struct leapraid_sge_simple32 - 32-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 32-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 32-bit physical address of the data buffer. */ struct leapraid_sge_simple32 { __le32 flg_and_len; @@ -510,8 +523,8 @@ struct leapraid_sge_simple32 { /** * struct leapraid_sge_simple64 - 64-bit simple scatter-gather entry * - * @flg_and_len: Combined field for flags and segment length - * @addr: 64-bit physical address of the data buffer + * @flg_and_len: Combined field for flags and segment length. + * @addr: 64-bit physical address of the data buffer. */ struct leapraid_sge_simple64 { __le32 flg_and_len; @@ -521,9 +534,9 @@ struct leapraid_sge_simple64 { /** * struct leapraid_sge_simple_union - Unified 32/64-bit SGE representation * - * @flg_and_len: Combined field for flags and segment length - * @u.addr32: 32-bit address field - * @u.addr64: 64-bit address field + * @flg_and_len: Combined field for flags and segment length. + * @u.addr32: 32-bit address field. + * @u.addr64: 64-bit address field. */ struct leapraid_sge_simple_union { __le32 flg_and_len; @@ -536,11 +549,11 @@ struct leapraid_sge_simple_union { /** * struct leapraid_sge_chain_union - Chained scatter-gather entry * - * @len: Length of the chain descriptor - * @next_chain_offset: Offset to the next SGE chain - * @flg: Flags indicating chain or termination properties - * @u.addr32: 32-bit physical address - * @u.addr64: 64-bit physical address + * @len: Length of the chain descriptor. + * @next_chain_offset: Offset to the next SGE chain. + * @flg: Flags indicating chain or termination properties. + * @u.addr32: 32-bit physical address. + * @u.addr64: 64-bit physical address. */ struct leapraid_sge_chain_union { __le16 len; @@ -555,8 +568,8 @@ struct leapraid_sge_chain_union { /** * struct leapraid_ieee_sge_simple32 - IEEE 32-bit simple SGE format * - * @addr: 32-bit physical address of the data buffer - * @flg_and_len: Combined field for flags and data length + * @addr: 32-bit physical address of the data buffer. + * @flg_and_len: Combined field for flags and data length. */ struct leapraid_ieee_sge_simple32 { __le32 addr; @@ -566,10 +579,10 @@ struct leapraid_ieee_sge_simple32 { /** * struct leapraid_ieee_sge_simple64 - IEEE 64-bit simple SGE format * - * @addr: 64-bit physical address of the data buffer - * @len: Length of the data segment - * @r1: Reserved - * @flg: Flags indicating transfer properties + * @addr: 64-bit physical address of the data buffer. + * @len: Length of the data segment. + * @r1: Reserved. + * @flg: Flags indicating transfer properties. */ struct leapraid_ieee_sge_simple64 { __le64 addr; @@ -581,8 +594,8 @@ struct leapraid_ieee_sge_simple64 { /** * union leapraid_ieee_sge_simple_union - Unified IEEE SGE format * - * @simple32: IEEE 32-bit simple SGE entry - * @simple64: IEEE 64-bit simple SGE entry + * @simple32: IEEE 32-bit simple SGE entry. + * @simple64: IEEE 64-bit simple SGE entry. */ union leapraid_ieee_sge_simple_union { struct leapraid_ieee_sge_simple32 simple32; @@ -592,8 +605,8 @@ union leapraid_ieee_sge_simple_union { /** * union leapraid_ieee_sge_chain_union - Unified IEEE SGE chain format * - * @chain32: IEEE 32-bit chain SGE entry - * @chain64: IEEE 64-bit chain SGE entry + * @chain32: IEEE 32-bit chain SGE entry. + * @chain64: IEEE 64-bit chain SGE entry. */ union leapraid_ieee_sge_chain_union { struct leapraid_ieee_sge_simple32 chain32; @@ -603,11 +616,11 @@ union leapraid_ieee_sge_chain_union { /** * struct leapraid_chain64_ieee_sg - 64-bit IEEE chain SGE descriptor * - * @addr: Physical address of the next chain segment - * @len: Length of the current SGE - * @r1: Reserved - * @next_chain_offset: Offset to the next chain element - * @flg: Flags that describe SGE attributes + * @addr: Physical address of the next chain segment. + * @len: Length of the current SGE. + * @r1: Reserved. + * @next_chain_offset: Offset to the next chain element. + * @flg: Flags that describe SGE attributes. */ struct leapraid_chain64_ieee_sg { __le64 addr; @@ -620,8 +633,8 @@ struct leapraid_chain64_ieee_sg { /** * union leapraid_ieee_sge_io_union - IEEE-style SGE union for I/O * - * @ieee_simple: Simple IEEE SGE descriptor - * @ieee_chain: IEEE chain SGE descriptor + * @ieee_simple: Simple IEEE SGE descriptor. + * @ieee_chain: IEEE chain SGE descriptor. */ union leapraid_ieee_sge_io_union { struct leapraid_ieee_sge_simple64 ieee_simple; @@ -631,25 +644,25 @@ union leapraid_ieee_sge_io_union { /** * union leapraid_simple_sge_union - Union of simple SGE descriptors * - * @leapio_simple: LeapIO-style simple SGE - * @ieee_simple: IEEE-style simple SGE + * @leapraid_simple: LeapRAID simple SGE. + * @ieee_simple: IEEE-style simple SGE. */ union leapraid_simple_sge_union { - struct leapraid_sge_simple_union leapio_simple; + struct leapraid_sge_simple_union leapraid_simple; union leapraid_ieee_sge_simple_union ieee_simple; }; /** * union leapraid_sge_io_union - Combined SGE union for all I/O types * - * @leapio_simple: LeapIO simple SGE format - * @leapio_chain: LeapIO chain SGE format - * @ieee_simple: IEEE simple SGE format - * @ieee_chain: IEEE chain SGE format + * @leapraid_simple: LeapRAID simple SGE format. + * @leapraid_chain: LeapRAID chain SGE format. + * @ieee_simple: IEEE simple SGE format. + * @ieee_chain: IEEE chain SGE format. */ union leapraid_sge_io_union { - struct leapraid_sge_simple_union leapio_simple; - struct leapraid_sge_chain_union leapio_chain; + struct leapraid_sge_simple_union leapraid_simple; + struct leapraid_sge_chain_union leapraid_chain; union leapraid_ieee_sge_simple_union ieee_simple; union leapraid_ieee_sge_chain_union ieee_chain; }; @@ -657,10 +670,10 @@ union leapraid_sge_io_union { /** * struct leapraid_cfg_pg_header - Standard configuration page header * - * @r1: Reserved - * @page_len: Length of the page in 4-byte units - * @page_num: Page number - * @page_type: Page type + * @r1: Reserved. + * @page_len: Length of the page in 4-byte units. + * @page_num: Page number. + * @page_type: Page type. */ struct leapraid_cfg_pg_header { u8 r1; @@ -672,13 +685,13 @@ struct leapraid_cfg_pg_header { /** * struct leapraid_cfg_ext_pg_header - Extended configuration page header * - * @r1: Reserved - * @r2: Reserved - * @page_num: Page number - * @page_type: Page type - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @r3: Reserved + * @r1: Reserved. + * @r2: Reserved. + * @page_num: Page number. + * @page_type: Page type. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @r3: Reserved. */ struct leapraid_cfg_ext_pg_header { u8 r1; @@ -693,17 +706,17 @@ struct leapraid_cfg_ext_pg_header { /** * struct leapraid_cfg_req - Configuration request message * - * @action: Requested action type - * @sgl_flag: SGL flag field - * @chain_offset: Offset to next chain SGE - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r1: Reserved - * @header: Configuration page header - * @page_addr: Address of the page buffer - * @page_buf_sge: SGE describing the page buffer + * @action: Requested action type. + * @sgl_flag: SGL flag field. + * @chain_offset: Offset to next chain SGE. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r1: Reserved. + * @header: Configuration page header. + * @page_addr: Address of the page buffer. + * @page_buf_sge: SGE describing the page buffer. */ struct leapraid_cfg_req { u8 action; @@ -722,17 +735,17 @@ struct leapraid_cfg_req { /** * struct leapraid_cfg_rep - Configuration reply message * - * @action: Action type from the request - * @r1: Reserved - * @msg_len: Message length in bytes - * @func: Function code - * @ext_page_len: Extended page length - * @ext_page_type: Extended page type - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status code - * @r3: Reserved - * @header: Configuration page header + * @action: Action type from the request. + * @r1: Reserved. + * @msg_len: Message length in bytes. + * @func: Function code. + * @ext_page_len: Extended page length. + * @ext_page_type: Extended page type. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status code. + * @r3: Reserved. + * @header: Configuration page header. */ struct leapraid_cfg_rep { u8 action; @@ -751,9 +764,9 @@ struct leapraid_cfg_rep { /** * struct leapraid_boot_dev_format_sas_wwid - Boot device identified by wwid * - * @sas_addr: SAS address of the device - * @lun: Logical unit number - * @r1: Reserved + * @sas_addr: SAS address of the device. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_sas_wwid { __le64 sas_addr; @@ -764,10 +777,10 @@ struct leapraid_boot_dev_format_sas_wwid { /** * struct leapraid_boot_dev_format_enc_slot - identified by enclosure * - * @enc_lid: Enclosure logical ID - * @r1: Reserved - * @slot_num: Slot number in the enclosure - * @r2: Reserved + * @enc_lid: Enclosure logical ID. + * @r1: Reserved. + * @slot_num: Slot number in the enclosure. + * @r2: Reserved. */ struct leapraid_boot_dev_format_enc_slot { __le64 enc_lid; @@ -779,9 +792,9 @@ struct leapraid_boot_dev_format_enc_slot { /** * struct leapraid_boot_dev_format_dev_name - Boot device by device name * - * @dev_name: Device name identifier - * @lun: Logical unit number - * @r1: Reserved + * @dev_name: Device name identifier. + * @lun: Logical unit number. + * @r1: Reserved. */ struct leapraid_boot_dev_format_dev_name { __le64 dev_name; @@ -792,9 +805,9 @@ struct leapraid_boot_dev_format_dev_name { /** * union leapraid_boot_dev_format - Boot device format union * - * @sas_wwid: Format using SAS WWID and LUN - * @enc_slot: Format using enclosure slot and ID - * @dev_name: Format using device name and LUN + * @sas_wwid: Format using SAS WWID and LUN. + * @enc_slot: Format using enclosure slot and ID. + * @dev_name: Format using device name and LUN. */ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_sas_wwid sas_wwid; @@ -802,20 +815,39 @@ union leapraid_boot_dev_format { struct leapraid_boot_dev_format_dev_name dev_name; }; +/** + * struct leapraid_manufacturing_p0 - Manufacturing configuration page 0 + * + * @header: Configuration page header. + * @chip_name: Chip name as a 16-byte ASCII string. + * @chip_revision: Chip revision as an 8-byte ASCII string. + * @board_name: Board name as a 16-byte ASCII string. + * @board_assembly: Board assembly as a 16-byte ASCII string. + * @board_tracer_number: Board tracer number as a 16-byte ASCII string. + */ +struct leapraid_manufacturing_p0 { + struct leapraid_cfg_pg_header header; + u8 chip_name[16]; + u8 chip_revision[8]; + u8 board_name[16]; + u8 board_assembly[16]; + u8 board_tracer_number[16]; +}; + /** * struct leapraid_bios_page2 - BIOS configuration page 2 * - * @header: Configuration page header - * @r1: Reserved - * @requested_boot_dev_form: Format type of the requested boot device - * @r2: Reserved - * @requested_boot_dev: Boot device requested by BIOS or user - * @requested_alt_boot_dev_form: Format of the alternate boot device - * @r3: Reserved - * @requested_alt_boot_dev: Alternate boot device requested - * @current_boot_dev_form: Format type of the active boot device - * @r4: Reserved - * @current_boot_dev: Currently active boot device in use + * @header: Configuration page header. + * @r1: Reserved. + * @requested_boot_dev_form: Format type of the requested boot device. + * @r2: Reserved. + * @requested_boot_dev: Boot device requested by BIOS or user. + * @requested_alt_boot_dev_form: Format of the alternate boot device. + * @r3: Reserved. + * @requested_alt_boot_dev: Alternate boot device requested. + * @current_boot_dev_form: Format type of the active boot device. + * @r4: Reserved. + * @current_boot_dev: Currently active boot device in use. */ struct leapraid_bios_page2 { struct leapraid_cfg_pg_header header; @@ -834,10 +866,10 @@ struct leapraid_bios_page2 { /** * struct leapraid_bios_page3 - BIOS configuration page 3 * - * @header: Configuration page header - * @r1: Reserved - * @bios_version: BIOS firmware version number - * @r2: Reserved + * @header: Configuration page header. + * @r1: Reserved. + * @bios_version: BIOS firmware version number. + * @r2: Reserved. */ struct leapraid_bios_page3 { struct leapraid_cfg_pg_header header; @@ -849,9 +881,9 @@ struct leapraid_bios_page3 { /** * struct leapraid_raidvol0_phys_disk - Physical disk in RAID volume * - * @r1: Reserved - * @phys_disk_num: Physical disk number within the RAID volume - * @r2: Reserved + * @r1: Reserved. + * @phys_disk_num: Physical disk number within the RAID volume. + * @r2: Reserved. */ struct leapraid_raidvol0_phys_disk { u8 r1[2]; @@ -862,14 +894,14 @@ struct leapraid_raidvol0_phys_disk { /** * struct leapraid_raidvol_p0 - RAID volume configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle for the RAID volume - * @volume_state: State of the RAID volume - * @volume_type: RAID type - * @r1: Reserved - * @num_phys_disks: Number of physical disks in the volume - * @r2: Reserved - * @phys_disk: Array of physical disks in this volume + * @header: Configuration page header. + * @dev_hdl: Device handle for the RAID volume. + * @volume_state: State of the RAID volume. + * @volume_type: RAID type. + * @r1: Reserved. + * @num_phys_disks: Number of physical disks in the volume. + * @r2: Reserved. + * @phys_disk: Array of physical disks in this volume. */ struct leapraid_raidvol_p0 { struct leapraid_cfg_pg_header header; @@ -885,11 +917,11 @@ struct leapraid_raidvol_p0 { /** * struct leapraid_raidvol_p1 - RAID volume configuration page 1 * - * @header: Configuration page header - * @dev_hdl: Device handle of the RAID volume - * @r1: Reserved - * @wwid: World-wide identifier for the volume - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the RAID volume. + * @r1: Reserved. + * @wwid: World-wide identifier for the volume. + * @r2: Reserved. */ struct leapraid_raidvol_p1 { struct leapraid_cfg_pg_header header; @@ -902,11 +934,11 @@ struct leapraid_raidvol_p1 { /** * struct leapraid_raidpd_p0 - Physical disk configuration page 0 * - * @header: Configuration page header - * @dev_hdl: Device handle of the physical disk - * @r1: Reserved - * @phys_disk_num: Physical disk number - * @r2: Reserved + * @header: Configuration page header. + * @dev_hdl: Device handle of the physical disk. + * @r1: Reserved. + * @phys_disk_num: Physical disk number. + * @r2: Reserved. */ struct leapraid_raidpd_p0 { struct leapraid_cfg_pg_header header; @@ -919,14 +951,14 @@ struct leapraid_raidpd_p0 { /** * struct leapraid_sas_io_unit0_phy_info - PHY info for SAS I/O unit * - * @port: Port number the PHY belongs to - * @port_flg: Flags describing port status - * @phy_flg: Flags describing PHY status - * @neg_link_rate: Negotiated link rate of the PHY - * @controller_phy_dev_info: Controller PHY device info - * @attached_dev_hdl: Handle of attached device - * @controller_dev_hdl: Handle of the controller device - * @r1: Reserved + * @port: Port number the PHY belongs to. + * @port_flg: Flags describing port status. + * @phy_flg: Flags describing PHY status. + * @neg_link_rate: Negotiated link rate of the PHY. + * @controller_phy_dev_info: Controller PHY device info. + * @attached_dev_hdl: Handle of attached device. + * @controller_dev_hdl: Handle of the controller device. + * @r1: Reserved. */ struct leapraid_sas_io_unit0_phy_info { u8 port; @@ -942,11 +974,11 @@ struct leapraid_sas_io_unit0_phy_info { /** * struct leapraid_sas_io_unit_p0 - SAS I/O unit configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @phy_num: Number of PHYs in this unit - * @r2: Reserved - * @phy_info: Array of PHY information + * @header: Extended configuration page header. + * @r1: Reserved. + * @phy_num: Number of PHYs in this unit. + * @r2: Reserved. + * @phy_info: Array of PHY information. */ struct leapraid_sas_io_unit_p0 { struct leapraid_cfg_ext_pg_header header; @@ -956,54 +988,20 @@ struct leapraid_sas_io_unit_p0 { struct leapraid_sas_io_unit0_phy_info phy_info[]; }; -/** - * struct leapraid_sas_io_unit1_phy_info - Placeholder for SAS unit page 1 PHY - * - * @r1: Reserved - */ -struct leapraid_sas_io_unit1_phy_info { - u8 r1[12]; -}; - -/** - * struct leapraid_sas_io_unit_page1 - SAS I/O unit configuration page 1 - * - * @header: Extended configuration page header - * @r1: Reserved - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @r2: Reserved - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @r3: Reserved - * @sata_max_queue_depth: Maximum SATA queue depth - * @r4: Reserved - * @phy_info: Array of PHY info structures - */ -struct leapraid_sas_io_unit_page1 { - struct leapraid_cfg_ext_pg_header header; - u8 r1[2]; - __le16 narrowport_max_queue_depth; - u8 r2[2]; - __le16 wideport_max_queue_depth; - u8 r3; - u8 sata_max_queue_depth; - u8 r4[2]; - struct leapraid_sas_io_unit1_phy_info phy_info[]; -}; - /** * struct leapraid_exp_p0 - SAS expander page 0 * - * @header: Extended page header - * @physical_port: Physical port number - * @r1: Reserved - * @enc_hdl: Enclosure handle - * @sas_address: SAS address of the expander - * @r2: Reserved - * @dev_hdl: Device handle of this expander - * @parent_dev_hdl: Device handle of parent expander - * @r3: Reserved - * @phy_num: Number of PHYs - * @r4: Reserved + * @header: Extended page header. + * @physical_port: Physical port number. + * @r1: Reserved. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address of the expander. + * @r2: Reserved. + * @dev_hdl: Device handle of this expander. + * @parent_dev_hdl: Device handle of parent expander. + * @r3: Reserved. + * @phy_num: Number of PHYs. + * @r4: Reserved. */ struct leapraid_exp_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1022,14 +1020,14 @@ struct leapraid_exp_p0 { /** * struct leapraid_exp_p1 - SAS expander page 1 * - * @header: Extended page header - * @r1: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @attached_dev_hdl: Attached device handle - * @r2: Reserved - * @neg_link_rate: Negotiated link rate - * @r3: Reserved + * @header: Extended page header. + * @r1: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @attached_dev_hdl: Attached device handle. + * @r2: Reserved. + * @neg_link_rate: Negotiated link rate. + * @r3: Reserved. */ struct leapraid_exp_p1 { struct leapraid_cfg_ext_pg_header header; @@ -1045,25 +1043,25 @@ struct leapraid_exp_p1 { /** * struct leapraid_sas_dev_p0 - SAS device page 0 * - * @header: Extended configuration page header - * @slot: Slot number - * @enc_hdl: Enclosure handle - * @sas_address: SAS address - * @parent_dev_hdl: Parent device handle - * @phy_num: Number of PHYs - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @dev_info: Device information - * @flg: Flags - * @physical_port: Physical port number - * @max_port_connections: Maximum port connections - * @dev_name: Device name - * @port_groups: Number of port groups - * @r3: Reserved - * @enc_level: Enclosure level - * @connector_name: Connector identifier - * @r4: Reserved + * @header: Extended configuration page header. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. + * @sas_address: SAS address. + * @parent_dev_hdl: Parent device handle. + * @phy_num: Number of PHYs. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @dev_info: Device information. + * @flg: Flags. + * @physical_port: Physical port number. + * @max_port_connections: Maximum port connections. + * @dev_name: Device name. + * @port_groups: Number of port groups. + * @r3: Reserved. + * @enc_level: Enclosure level. + * @connector_name: Connector identifier. + * @r4: Reserved. */ struct leapraid_sas_dev_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1083,23 +1081,23 @@ struct leapraid_sas_dev_p0 { u8 port_groups; u8 r3[2]; u8 enc_level; - u8 connector_name[4]; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN]; u8 r4[4]; } __packed __aligned(4); /** * struct leapraid_sas_phy_p0 - SAS PHY configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @attached_dev_hdl: Handle of attached device - * @r2: Reserved - * @p_link_rate: PHY link rate - * @hw_link_rate: Hardware supported link rate - * @r3: Reserved - * @phy_info: PHY information - * @neg_link_rate: Negotiated link rate - * @r4: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @attached_dev_hdl: Handle of attached device. + * @r2: Reserved. + * @p_link_rate: PHY link rate. + * @hw_link_rate: Hardware supported link rate. + * @r3: Reserved. + * @phy_info: PHY information. + * @neg_link_rate: Negotiated link rate. + * @r4: Reserved. */ struct leapraid_sas_phy_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1117,12 +1115,12 @@ struct leapraid_sas_phy_p0 { /** * struct leapraid_enc_p0 - SAS enclosure page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @enc_lid: Enclosure logical ID - * @r2: Reserved - * @enc_hdl: Enclosure handle - * @r3: Reserved + * @header: Extended configuration page header. + * @r1: Reserved. + * @enc_lid: Enclosure logical ID. + * @r2: Reserved. + * @enc_hdl: Enclosure handle. + * @r3: Reserved. */ struct leapraid_enc_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1136,10 +1134,10 @@ struct leapraid_enc_p0 { /** * struct leapraid_raid_cfg_p0_element - RAID configuration element * - * @element_flg: Element flags - * @vol_dev_hdl: Volume device handle - * @r1: Reserved - * @phys_disk_dev_hdl: Physical disk device handle + * @element_flg: Element flags. + * @vol_dev_hdl: Volume device handle. + * @r1: Reserved. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_raid_cfg_p0_element { __le16 element_flg; @@ -1151,13 +1149,13 @@ struct leapraid_raid_cfg_p0_element { /** * struct leapraid_raid_cfg_p0 - RAID configuration page 0 * - * @header: Extended configuration page header - * @r1: Reserved - * @cfg_num: Configuration number - * @r2: Reserved - * @elements_num: Number of RAID elements - * @r3: Reserved - * @cfg_element: Array of RAID elements + * @header: Extended configuration page header. + * @r1: Reserved. + * @cfg_num: Configuration number. + * @r2: Reserved. + * @elements_num: Number of RAID elements. + * @r3: Reserved. + * @cfg_element: Array of RAID elements. */ struct leapraid_raid_cfg_p0 { struct leapraid_cfg_ext_pg_header header; @@ -1172,8 +1170,8 @@ struct leapraid_raid_cfg_p0 { /** * union leapraid_mpi_scsi_io_cdb_union - SCSI I/O CDB or simple SGE * - * @cdb32: 32-byte SCSI command descriptor block - * @sge: Simple SGE format + * @cdb32: 32-byte SCSI command descriptor block. + * @sge: Simple SGE format. */ union leapraid_mpi_scsi_io_cdb_union { u8 cdb32[32]; @@ -1183,32 +1181,32 @@ union leapraid_mpi_scsi_io_cdb_union { /** * struct leapraid_mpi_scsiio_req - MPI SCSI I/O request * - * @dev_hdl: Device handle for the target - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flags - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0..3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle for the target. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flags. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0..3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_mpi_scsiio_req { __le16 dev_hdl; @@ -1245,8 +1243,8 @@ struct leapraid_mpi_scsiio_req { /** * union leapraid_scsi_io_cdb_union - SCSI I/O CDB or IEEE simple SGE * - * @cdb32: 32-byte SCSI CDB - * @sge: IEEE simple 64-bit SGE + * @cdb32: 32-byte SCSI CDB. + * @sge: IEEE simple 64-bit SGE. */ union leapraid_scsi_io_cdb_union { u8 cdb32[32]; @@ -1256,32 +1254,32 @@ union leapraid_scsi_io_cdb_union { /** * struct leapraid_scsiio_req - SCSI I/O request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @sense_buffer_low_add: Lower 32-bit address of sense buffer - * @dma_flag: DMA flag - * @r3: Reserved - * @sense_buffer_len: Sense buffer length - * @r4: Reserved - * @sgl_offset0-3: SGL offsets - * @skip_count: Bytes to skip before transfer - * @data_len: Length of data transfer - * @bi_dir_data_len: Bi-directional transfer length - * @io_flg: I/O flags - * @eedp_flag: EEDP flags - * @eedp_block_size: EEDP block size - * @r5: Reserved - * @secondary_ref_tag: Secondary reference tag - * @secondary_app_tag: Secondary application tag - * @app_tag_trans_mask: Application tag mask - * @lun: Logical Unit Number - * @ctrl: Control flags - * @cdb: SCSI Command Descriptor Block or simple SGE - * @sgl: Scatter-gather list + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @sense_buffer_low_add: Lower 32-bit address of sense buffer. + * @dma_flag: DMA flag. + * @r3: Reserved. + * @sense_buffer_len: Sense buffer length. + * @r4: Reserved. + * @sgl_offset0-3: SGL offsets. + * @skip_count: Bytes to skip before transfer. + * @data_len: Length of data transfer. + * @bi_dir_data_len: Bi-directional transfer length. + * @io_flg: I/O flags. + * @eedp_flag: End-to-end data protection flags. + * @eedp_block_size: End-to-end data protection block size. + * @r5: Reserved. + * @secondary_ref_tag: Secondary reference tag. + * @secondary_app_tag: Secondary application tag. + * @app_tag_trans_mask: Application tag mask. + * @lun: Logical Unit Number. + * @ctrl: Control flags. + * @cdb: SCSI Command Descriptor Block or simple SGE. + * @sgl: Scatter-gather list. */ struct leapraid_scsiio_req { __le16 dev_hdl; @@ -1318,23 +1316,23 @@ struct leapraid_scsiio_req { /** * struct leapraid_scsiio_rep - SCSI I/O response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @r1: Reserved - * @msg_flg: Message flags - * @r2: Reserved - * @scsi_status: SCSI status - * @scsi_state: SCSI state - * @adapter_status: Adapter status - * @r3: Reserved - * @transfer_count: Number of bytes transferred - * @sense_count: Number of sense bytes - * @resp_info: Additional response info - * @task_tag: Task identifier - * @scsi_status_qualifier: SCSI status qualifier - * @bi_dir_trans_count: Bi-directional transfer count - * @r4: Reserved + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @r1: Reserved. + * @msg_flg: Message flags. + * @r2: Reserved. + * @scsi_status: SCSI status. + * @scsi_state: SCSI state. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @transfer_count: Number of bytes transferred. + * @sense_count: Number of sense bytes. + * @resp_info: Additional response info. + * @task_tag: Task identifier. + * @scsi_status_qualifier: SCSI status qualifier. + * @bi_dir_trans_count: Bi-directional transfer count. + * @r4: Reserved. */ struct leapraid_scsiio_rep { __le16 dev_hdl; @@ -1359,18 +1357,18 @@ struct leapraid_scsiio_rep { /** * struct leapraid_scsi_tm_req - SCSI Task Management request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r1: Reserved - * @task_type: Task management function type - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @lun: Logical Unit Number - * @r4: Reserved - * @task_mid: Task identifier - * @r5: Reserved + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r1: Reserved. + * @task_type: Task management function type. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @lun: Logical Unit Number. + * @r4: Reserved. + * @task_mid: Task identifier. + * @r5: Reserved. */ struct leapraid_scsi_tm_req { __le16 dev_hdl; @@ -1390,18 +1388,18 @@ struct leapraid_scsi_tm_req { /** * struct leapraid_scsi_tm_rep - SCSI Task Management response * - * @dev_hdl: Device handle - * @msg_len: Length of response message - * @func: Function code - * @resp_code: Response code - * @task_type: Task management type - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @termination_count: Count of terminated tasks - * @response_info: Additional response info + * @dev_hdl: Device handle. + * @msg_len: Length of response message. + * @func: Function code. + * @resp_code: Response code. + * @task_type: Task management type. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @termination_count: Count of terminated tasks. + * @response_info: Additional response info. */ struct leapraid_scsi_tm_rep { __le16 dev_hdl; @@ -1421,18 +1419,18 @@ struct leapraid_scsi_tm_rep { /** * struct leapraid_sep_req - SEP (SCSI Enclosure Processor) request * - * @dev_hdl: Device handle - * @chain_offset: Offset for chained SGE - * @func: Function code - * @act: Action to perform - * @flg: Flags - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @act: Action to perform. + * @flg: Flags. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_req { __le16 dev_hdl; @@ -1452,19 +1450,19 @@ struct leapraid_sep_req { /** * struct leapraid_sep_rep - SEP response * - * @dev_hdl: Device handle - * @msg_len: Message length - * @func: Function code - * @act: Action performed - * @flg: Flags - * @msg_flag: Message flags - * @r1: Reserved - * @adapter_status: Adapter status - * @r2: Reserved - * @slot_status: Slot status - * @r3: Reserved - * @slot: Slot number - * @enc_hdl: Enclosure handle + * @dev_hdl: Device handle. + * @msg_len: Message length. + * @func: Function code. + * @act: Action performed. + * @flg: Flags. + * @msg_flag: Message flags. + * @r1: Reserved. + * @adapter_status: Adapter status. + * @r2: Reserved. + * @slot_status: Slot status. + * @r3: Reserved. + * @slot: Slot number. + * @enc_hdl: Enclosure handle. */ struct leapraid_sep_rep { __le16 dev_hdl; @@ -1486,29 +1484,29 @@ struct leapraid_sep_rep { /** * struct leapraid_adapter_init_req - Adapter initialization request * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @chain_offset: Chain offset - * @func: Function code - * @r2: Reserved - * @msg_flg: Message flags - * @r3: Reserved - * @msg_ver: Message version - * @header_ver: Header version - * @host_buf_addr: Host buffer address (non adapter-ref) - * @r4: Reserved - * @host_buf_size: Host buffer size (non adapter-ref) - * @host_msix_vectors: Number of host MSI-X vectors - * @r6: Reserved - * @req_frame_size: Request frame size - * @rep_desc_qd: Reply descriptor queue depth - * @rep_msg_qd: Reply message queue depth - * @sense_buffer_add_high: High 32-bit of sense buffer address - * @rep_msg_dma_high: High 32-bit of reply message DMA address - * @task_desc_base_addr: Base address of task descriptors - * @rep_desc_q_arr_addr: Address of reply descriptor queue array - * @rep_msg_addr_dma: Reply message DMA address - * @time_stamp: Timestamp + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @chain_offset: Chain offset. + * @func: Function code. + * @r2: Reserved. + * @msg_flg: Message flags. + * @r3: Reserved. + * @msg_ver: Message version. + * @header_ver: Header version. + * @host_buf_addr: Host buffer address (non adapter-ref). + * @r4: Reserved. + * @host_buf_size: Host buffer size (non adapter-ref). + * @host_msix_vectors: Number of host MSI-X vectors. + * @r6: Reserved. + * @req_frame_size: Request frame size. + * @rep_desc_qd: Reply descriptor queue depth. + * @rep_msg_qd: Reply message queue depth. + * @sense_buffer_add_high: High 32-bit of sense buffer address. + * @rep_msg_dma_high: High 32-bit of reply message DMA address. + * @task_desc_base_addr: Base address of task descriptors. + * @rep_desc_q_arr_addr: Address of reply descriptor queue array. + * @rep_msg_addr_dma: Reply message DMA address. + * @time_stamp: Timestamp. */ struct leapraid_adapter_init_req { u8 who_init; @@ -1539,8 +1537,8 @@ struct leapraid_adapter_init_req { /** * struct leapraid_rep_desc_q_arr - Reply descriptor queue array * - * @rep_desc_base_addr: Base address of the reply descriptors - * @r1: Reserved + * @rep_desc_base_addr: Base address of the reply descriptors. + * @r1: Reserved. */ struct leapraid_rep_desc_q_arr { __le64 rep_desc_base_addr; @@ -1550,15 +1548,15 @@ struct leapraid_rep_desc_q_arr { /** * struct leapraid_adapter_init_rep - Adapter initialization reply * - * @who_init: Initiator of the initialization - * @r1: Reserved - * @msg_len: Length of reply message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @who_init: Initiator of the initialization. + * @r1: Reserved. + * @msg_len: Length of reply message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_adapter_init_rep { u8 who_init; @@ -1575,15 +1573,15 @@ struct leapraid_adapter_init_rep { /** * struct leapraid_adapter_log_req - Adapter log request * - * @action: Action code - * @type: Log type - * @chain_offset: Offset for chained SGE - * @func: Function code - * r1: Reserved - * @msg_flag: Message flags - * r2: Reserved - * @mbox: Mailbox for command-specific parameters - * @sge: Scatter-gather entry for data buffer + * @action: Action code. + * @type: Log type. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * r1: Reserved. + * @msg_flag: Message flags. + * r2: Reserved. + * @mbox: Mailbox for command-specific parameters. + * @sge: Scatter-gather entry for data buffer. */ struct leapraid_adapter_log_req { u8 action; @@ -1604,14 +1602,14 @@ struct leapraid_adapter_log_req { /** * struct leapraid_adapter_log_rep - Adapter log reply * - * @action: Action code echoed - * @type: Log type echoed - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Status returned by adapter + * @action: Action code echoed. + * @type: Log type echoed. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Status returned by adapter. */ struct leapraid_adapter_log_rep { u8 action; @@ -1627,12 +1625,12 @@ struct leapraid_adapter_log_rep { /** * struct leapraid_adapter_features_req - Request adapter features * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_adapter_features_req { u8 r1[2]; @@ -1646,32 +1644,32 @@ struct leapraid_adapter_features_req { /** * struct leapraid_adapter_features_rep - Adapter features reply * - * @msg_ver: Message version - * @msg_len: Length of reply message - * @func: Function code - * @header_ver: Header version - * @r1: Reserved - * @msg_flag: Message flags - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved - * @who_init: Who initialized the adapter - * @r4: Reserved - * @max_msix_vectors: Max MSI-X vectors supported - * @req_slot: Number of request slots - * @r5: Reserved - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version - * @sas_wide_max_qdepth: Max wide SAS queue depth - * @sas_narrow_max_qdepth: Max narrow SAS queue depth - * @r6: Reserved - * @hp_slot: Number of high-priority slots - * @r7: Reserved - * @max_volumes: Maximum supported volumes - * @max_dev_hdl: Maximum device handle - * @r8: Reserved - * @min_dev_hdl: Minimum device handle - * @r9: Reserved + * @msg_ver: Message version. + * @msg_len: Length of reply message. + * @func: Function code. + * @header_ver: Header version. + * @r1: Reserved. + * @msg_flag: Message flags. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. + * @who_init: Who initialized the adapter. + * @r4: Reserved. + * @max_msix_vectors: Max MSI-X vectors supported. + * @req_slot: Number of request slots. + * @r5: Reserved. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version. + * @sas_wide_max_qdepth: Max wide SAS queue depth. + * @sas_narrow_max_qdepth: Max narrow SAS queue depth. + * @r6: Reserved. + * @hp_slot: Number of high-priority slots. + * @r7: Reserved. + * @max_volumes: Maximum supported volumes. + * @max_dev_hdl: Maximum device handle. + * @r8: Reserved. + * @min_dev_hdl: Minimum device handle. + * @r9: Reserved. */ struct leapraid_adapter_features_rep { u16 msg_ver; @@ -1706,12 +1704,12 @@ struct leapraid_adapter_features_rep { /** * struct leapraid_scan_dev_req - Request to scan devices * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. */ struct leapraid_scan_dev_req { u8 r1[2]; @@ -1725,14 +1723,14 @@ struct leapraid_scan_dev_req { /** * struct leapraid_scan_dev_rep - Scan devices reply * - * @r1: Reserved - * @msg_len: Length of message - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved + * @r1: Reserved. + * @msg_len: Length of message. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. */ struct leapraid_scan_dev_rep { u8 r1[2]; @@ -1748,14 +1746,14 @@ struct leapraid_scan_dev_rep { /** * struct leapraid_evt_notify_req - Event notification request * - * @r1: Reserved - * @chain_offset: Offset for chained SGE - * @func: Function code - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @evt_masks: Event masks to enable notifications - * @r4: Reserved + * @r1: Reserved. + * @chain_offset: Offset for chained SGE. + * @func: Function code. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @evt_masks: Event masks to enable notifications. + * @r4: Reserved. */ struct leapraid_evt_notify_req { u8 r1[2]; @@ -1771,18 +1769,18 @@ struct leapraid_evt_notify_req { /** * struct leapraid_evt_notify_rep - Event notification reply * - * @evt_data_len: Length of event data - * @msg_len: Length of message - * @func: Function code - * @r1: Reserved - * @r2: Reserved - * @msg_flag: Message flags - * @r3: Reserved - * @adapter_status: Adapter status - * @r4: Reserved - * @evt: Event code - * @r5: Reserved - * @evt_data: Event data array + * @evt_data_len: Length of event data. + * @msg_len: Length of message. + * @func: Function code. + * @r1: Reserved. + * @r2: Reserved. + * @msg_flag: Message flags. + * @r3: Reserved. + * @adapter_status: Adapter status. + * @r4: Reserved. + * @evt: Event code. + * @r5: Reserved. + * @evt_data: Event data array. */ struct leapraid_evt_notify_rep { __le16 evt_data_len; @@ -1802,14 +1800,14 @@ struct leapraid_evt_notify_rep { /** * struct leapraid_evt_data_sas_dev_status_change - SAS device status change * - * @task_tag: Task identifier - * @reason_code: Reason for status change - * @physical_port: Physical port number - * @r1: Reserved - * @dev_hdl: Device handle - * @r2: Reserved - * @sas_address: SAS address of device - * @lun: Logical Unit Number + * @task_tag: Task identifier. + * @reason_code: Reason for status change. + * @physical_port: Physical port number. + * @r1: Reserved. + * @dev_hdl: Device handle. + * @r2: Reserved. + * @sas_address: SAS address of device. + * @lun: Logical unit Number. */ struct leapraid_evt_data_sas_dev_status_change { __le16 task_tag; @@ -1824,11 +1822,11 @@ struct leapraid_evt_data_sas_dev_status_change { /** * struct leapraid_evt_data_ir_change - IR (Integrated RAID) change event data * - * @r1: Reserved - * @reason_code: Reason for IR change - * @r2: Reserved - * @vol_dev_hdl: Volume device handle - * @phys_disk_dev_hdl: Physical disk device handle + * @r1: Reserved. + * @reason_code: Reason for IR change. + * @r2: Reserved. + * @vol_dev_hdl: Volume device handle. + * @phys_disk_dev_hdl: Physical disk device handle. */ struct leapraid_evt_data_ir_change { u8 r1; @@ -1841,10 +1839,10 @@ struct leapraid_evt_data_ir_change { /** * struct leapraid_evt_data_sas_disc - SAS discovery event data * - * @r1: Reserved - * @reason_code: Reason for discovery event - * @physical_port: Physical port number where event occurred - * @r2: Reserved + * @r1: Reserved. + * @reason_code: Reason for discovery event. + * @physical_port: Physical port number where event occurred. + * @r2: Reserved. */ struct leapraid_evt_data_sas_disc { u8 r1; @@ -1856,9 +1854,9 @@ struct leapraid_evt_data_sas_disc { /** * struct leapraid_evt_sas_topo_phy_entry - SAS topology PHY entry * - * @attached_dev_hdl: Device handle attached to PHY - * @link_rate: Current link rate - * @phy_status: PHY status flags + * @attached_dev_hdl: Device handle attached to PHY. + * @link_rate: Current link rate. + * @phy_status: PHY status flags. */ struct leapraid_evt_sas_topo_phy_entry { __le16 attached_dev_hdl; @@ -1869,15 +1867,15 @@ struct leapraid_evt_sas_topo_phy_entry { /** * struct leapraid_evt_data_sas_topo_change_list - SAS topology change list * - * @encl_hdl: Enclosure handle - * @exp_dev_hdl: Expander device handle - * @num_phys: Number of PHYs in this entry - * @r1: Reserved - * @entry_num: Entry index - * @start_phy_num: Start PHY number - * @exp_status: Expander status - * @physical_port: Physical port number - * @phy: Array of SAS PHY entries + * @encl_hdl: Enclosure handle. + * @exp_dev_hdl: Expander device handle. + * @num_phys: Number of PHYs in this entry. + * @r1: Reserved. + * @entry_num: Entry index. + * @start_phy_num: Start PHY number. + * @exp_status: Expander status. + * @physical_port: Physical port number. + * @phy: Array of SAS PHY entries. */ struct leapraid_evt_data_sas_topo_change_list { __le16 encl_hdl; @@ -1892,15 +1890,16 @@ struct leapraid_evt_data_sas_topo_change_list { }; /** - * struct leapraid_evt_data_sas_enc_dev_status_change - SAS enclosure device status + * struct leapraid_evt_data_sas_enc_dev_status_change - + * SAS enclosure device status * - * @enc_hdl: Enclosure handle - * @reason_code: Reason code for status change - * @physical_port: Physical port number - * @encl_logical_id: Enclosure logical ID - * @num_slots: Number of slots in enclosure - * @start_slot: First affected slot - * @phy_bits: Bitmap of affected PHYs + * @enc_hdl: Enclosure handle. + * @reason_code: Reason code for status change. + * @physical_port: Physical port number. + * @encl_logical_id: Enclosure logical ID. + * @num_slots: Number of slots in enclosure. + * @start_slot: First affected slot. + * @phy_bits: Bitmap of affected PHYs. */ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 enc_hdl; @@ -1913,21 +1912,21 @@ struct leapraid_evt_data_sas_enc_dev_status_change { }; /** - * struct leapraid_io_unit_ctrl_req - IO unit control request + * struct leapraid_io_unit_ctrl_req - I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @chain_offset: SGE chain offset - * @func: Function code - * @dev_hdl: Device handle - * @adapter_para: Adapter parameter selector - * @msg_flag: Message flags - * @r2: Reserved - * @phy_num: PHY number - * @r3: Reserved - * @adapter_para_value: Value for adapter parameter - * @adapter_para_value2: Optional second parameter value - * @r4: Reserved + * @op: Operation code. + * @r1: Reserved. + * @chain_offset: SGE chain offset. + * @func: Function code. + * @dev_hdl: Device handle. + * @adapter_para: Adapter parameter selector. + * @msg_flag: Message flags. + * @r2: Reserved. + * @phy_num: PHY number. + * @r3: Reserved. + * @adapter_para_value: Value for adapter parameter. + * @adapter_para_value2: Optional second parameter value. + * @r4: Reserved. */ struct leapraid_io_unit_ctrl_req { u8 op; @@ -1946,13 +1945,13 @@ struct leapraid_io_unit_ctrl_req { }; /** - * struct leapraid_io_unit_ctrl_rep - IO unit control reply + * struct leapraid_io_unit_ctrl_rep - I/O unit control reply * - * @op: Operation code echoed - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code echoed. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_io_unit_ctrl_rep { u8 op; @@ -1965,13 +1964,13 @@ struct leapraid_io_unit_ctrl_rep { /** * struct leapraid_raid_act_req - RAID action request * - * @act: RAID action code - * @r1: Reserved - * @func: Function code - * @r2: Reserved - * @phys_disk_num: Number of physical disks involved - * @r3: Reserved - * @action_data_sge: SGE describing action-specific data + * @act: RAID action code. + * @r1: Reserved. + * @func: Function code. + * @r2: Reserved. + * @phys_disk_num: Number of physical disks involved. + * @r3: Reserved. + * @action_data_sge: SGE describing action-specific data. */ struct leapraid_raid_act_req { u8 act; @@ -1986,13 +1985,13 @@ struct leapraid_raid_act_req { /** * struct leapraid_raid_act_rep - RAID action reply * - * @act: RAID action code echoed - * @r1: Reserved - * @func: Function code - * @vol_dev_hdl: Volume device handle + * @act: RAID action code echoed. + * @r1: Reserved. + * @func: Function code. + * @vol_dev_hdl: Volume device handle. * @r2: Reserved - * @adapter_status: Status returned by adapter - * @r3: Reserved + * @adapter_status: Status returned by adapter. + * @r3: Reserved. */ struct leapraid_raid_act_rep { u8 act; @@ -2007,15 +2006,15 @@ struct leapraid_raid_act_rep { /** * struct leapraid_smp_passthrough_req - SMP passthrough request * - * @passthrough_flg: Passthrough flags - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @req_data_len: Request data length - * @r2: Reserved - * @sas_address: SAS address of target device - * @r3: Reserved - * @sgl: Scatter-gather list describing request buffer + * @passthrough_flg: Passthrough flags. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @req_data_len: Request data length. + * @r2: Reserved. + * @sas_address: SAS address of target device. + * @r3: Reserved. + * @sgl: Scatter-gather list describing request buffer. */ struct leapraid_smp_passthrough_req { u8 passthrough_flg; @@ -2032,14 +2031,14 @@ struct leapraid_smp_passthrough_req { /** * struct leapraid_smp_passthrough_rep - SMP passthrough reply * - * @passthrough_flg: Passthrough flags echoed - * @physical_port: Target PHY port - * @r1: Reserved - * @func: Function code - * @resp_data_len: Length of response data - * @r2: Reserved - * @adapter_status: Adapter status - * @r3: Reserved + * @passthrough_flg: Passthrough flags echoed. + * @physical_port: Target PHY port. + * @r1: Reserved. + * @func: Function code. + * @resp_data_len: Length of response data. + * @r2: Reserved. + * @adapter_status: Adapter status. + * @r3: Reserved. */ struct leapraid_smp_passthrough_rep { u8 passthrough_flg; @@ -2053,13 +2052,13 @@ struct leapraid_smp_passthrough_rep { }; /** - * struct leapraid_sas_io_unit_ctrl_req - SAS IO unit control request + * struct leapraid_sas_io_unit_ctrl_req - SAS I/O unit control request * - * @op: Operation code - * @r1: Reserved - * @func: Function code - * @dev_hdl: Device handle - * @r2: Reserved + * @op: Operation code. + * @r1: Reserved. + * @func: Function code. + * @dev_hdl: Device handle. + * @r2: Reserved. */ struct leapraid_sas_io_unit_ctrl_req { u8 op; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index f838bd5aa20e..25ec57c2ce4b 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -1,23 +1,22 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/compat.h> #include <linux/module.h> #include <linux/miscdevice.h> #include "leapraid_func.h" -/* ioctl device file */ +/* IOCTL device file name. */ #define LEAPRAID_DEV_NAME "leapraid_ctl" -/* ioctl version */ +/* IOCTL version. */ #define LEAPRAID_IOCTL_VERSION 0x07 -/* ioctl command */ +/* IOCTL commands. */ #define LEAPRAID_ADAPTER_INFO 17 #define LEAPRAID_COMMAND 20 #define LEAPRAID_EVENTQUERY 21 @@ -25,9 +24,10 @@ /** * struct leapraid_ioctl_header - IOCTL command header - * @adapter_id : Adapter identifier - * @port_number: Port identifier - * @max_data_size: Maximum data size for transfer + * + * @adapter_id : Adapter identifier. + * @port_number: Port identifier. + * @max_data_size: Maximum data size for transfer. */ struct leapraid_ioctl_header { u32 adapter_id; @@ -37,7 +37,8 @@ struct leapraid_ioctl_header { /** * struct leapraid_ioctl_diag_reset - Diagnostic reset request - * @hdr: Common IOCTL header + * + * @hdr: Common IOCTL header. */ struct leapraid_ioctl_diag_reset { struct leapraid_ioctl_header hdr; @@ -45,12 +46,13 @@ struct leapraid_ioctl_diag_reset { /** * struct leapraid_ioctl_pci_info - PCI device information - * @u: Union holding PCI bus/device/function information - * @u.bits.dev: PCI device number - * @u.bits.func: PCI function number - * @u.bits.bus: PCI bus number - * @u.word: Combined representation of PCI BDF - * @seg_id: PCI segment identifier + * + * @u: Union holding PCI bus/device/function information. + * @u.bits.dev: PCI device number. + * @u.bits.func: PCI function number. + * @u.bits.bus: PCI bus number. + * @u.word: Combined representation of PCI BDF. + * @seg_id: PCI segment identifier. */ struct leapraid_ioctl_pci_info { union { @@ -66,21 +68,22 @@ struct leapraid_ioctl_pci_info { /** * struct leapraid_ioctl_adapter_info - Adapter information for IOCTL - * @hdr: IOCTL header - * @adapter_type: Adapter type identifier - * @port_number: Port number - * @pci_id: PCI device ID - * @revision: Revision number - * @sub_dev: Subsystem device ID - * @sub_vendor: Subsystem vendor ID - * @r0: Reserved - * @fw_ver: Firmware version - * @bios_ver: BIOS version - * @driver_ver: Driver version - * @r1: Reserved - * @scsi_id: SCSI ID - * @r2: Reserved - * @pci_info: PCI information structure + * + * @hdr: IOCTL header. + * @adapter_type: Adapter type identifier. + * @port_number: Port number. + * @pci_id: PCI device ID. + * @revision: Revision number. + * @sub_dev: Subsystem device ID. + * @sub_vendor: Subsystem vendor ID. + * @r0: Reserved. + * @fw_ver: Firmware version. + * @bios_ver: BIOS version. + * @driver_ver: Driver version. + * @r1: Reserved. + * @scsi_id: SCSI ID. + * @r2: Reserved. + * @pci_info: PCI information structure. */ struct leapraid_ioctl_adapter_info { struct leapraid_ioctl_header hdr; @@ -102,18 +105,19 @@ struct leapraid_ioctl_adapter_info { /** * struct leapraid_ioctl_command - IOCTL command structure - * @hdr: IOCTL header - * @timeout: Command timeout - * @rep_msg_buf_ptr: User pointer to reply message buffer - * @c2h_buf_ptr: User pointer to card-to-host data buffer - * @h2c_buf_ptr: User pointer to host-to-card data buffer - * @sense_data_ptr: User pointer to sense data buffer - * @max_rep_bytes: Maximum reply bytes - * @c2h_size: Card-to-host data size - * @h2c_size: Host-to-card data size - * @max_sense_bytes: Maximum sense data bytes - * @data_sge_offset: Data SGE offset - * @mf: Message frame data (flexible array) + * + * @hdr: IOCTL header. + * @timeout: Command timeout. + * @rep_msg_buf_ptr: User pointer to reply message buffer. + * @c2h_buf_ptr: User pointer to card-to-host data buffer. + * @h2c_buf_ptr: User pointer to host-to-card data buffer. + * @sense_data_ptr: User pointer to sense data buffer. + * @max_rep_bytes: Maximum reply bytes. + * @c2h_size: Card-to-host data size. + * @h2c_size: Host-to-card data size. + * @max_sense_bytes: Maximum sense data bytes. + * @data_sge_offset: Data SGE offset. + * @mf: Message frame data (flexible array). */ struct leapraid_ioctl_command { struct leapraid_ioctl_header hdr; @@ -146,39 +150,38 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } -static void leapraid_cli_scsiio_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, u16 taskid, +static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_mpi_req, + u16 taskid, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, u16 dev_hdl, void *psge) { - struct leapraid_mpi_scsiio_req *scsiio_request = - (struct leapraid_mpi_scsiio_req *)ctl_sp_mpi_req; + struct leapraid_mpi_scsiio_req *scsiio_request = ctl_sp_mpi_req; scsiio_request->sense_buffer_len = SCSI_SENSE_BUFFERSIZE; scsiio_request->sense_buffer_low_add = - leapraid_get_sense_buffer_dma(adapter, taskid); - memset((void *)(&adapter->driver_cmds.ctl_cmd.sense), + leapraid_get_sense_buffer_dma(adapter, taskid); + memset(&adapter->driver_cmds.ctl_cmd.sense, 0, SCSI_SENSE_BUFFERSIZE); leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); - if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO_REQ) + if (scsiio_request->func == LEAPRAID_FUNC_SCSIIO) leapraid_fire_scsi_io(adapter, taskid, dev_hdl); else leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - u16 taskid, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, void *h2c) +static int leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, + u16 taskid, + dma_addr_t h2c_dma_addr, + size_t h2c_size, + dma_addr_t c2h_dma_addr, + size_t c2h_size, + void *psge, void *h2c) { - struct leapraid_smp_passthrough_req *smp_pt_req = - (struct leapraid_smp_passthrough_req *)ctl_sp_mpi_req; + struct leapraid_smp_passthrough_req *smp_pt_req = ctl_sp_req; u8 *data; if (!adapter->adapter_attr.enable_mp) @@ -188,83 +191,49 @@ static void leapraid_ctl_smp_passthrough_cmd(struct leapraid_adapter *adapter, else data = h2c; - if (data[1] == LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG && - (data[10] == 1 || data[10] == 2)) - adapter->reset_desc.adapter_link_resetting = true; + if (!(smp_pt_req->passthrough_flg & LEAPRAID_SMP_PT_FLAG_SGL_PTR) && + h2c_size <= 10) { + dev_err(&adapter->pdev->dev, + "%s: Invalid request size=%zu\n", + __func__, h2c_size); + return -EINVAL; + } + + if (data[1] == SMP_PHY_CONTROL && + (data[10] == SMP_PHY_CONTROL_LINK_RESET || + data[10] == SMP_PHY_CONTROL_HARD_RESET)) + adapter->reset_desc.adapter_link_resetting = 1; + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); + return 0; } -static void leapraid_ctl_fire_ieee_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size); - leapraid_fire_task(adapter, taskid); -} - -static void leapraid_ctl_sata_passthrough_cmd(struct leapraid_adapter *adapter, +static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, + void *ctl_sp_req, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size, void *psge, u16 taskid) { - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static void leapraid_ctl_load_fw_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ - leapraid_ctl_fire_ieee_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} + struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctl_req = ctl_sp_req; -static void leapraid_ctl_fire_mpi_cmd(struct leapraid_adapter *adapter, - dma_addr_t h2c_dma_addr, size_t h2c_size, - dma_addr_t c2h_dma_addr, size_t c2h_size, - void *psge, u16 taskid) -{ + if (sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || + sas_io_unit_ctl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) + adapter->reset_desc.adapter_link_resetting = 1; leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size); leapraid_fire_task(adapter, taskid); } -static void leapraid_ctl_sas_io_unit_ctrl_cmd(struct leapraid_adapter *adapter, - struct leapraid_req *ctl_sp_mpi_req, - dma_addr_t h2c_dma_addr, - size_t h2c_size, - dma_addr_t c2h_dma_addr, - size_t c2h_size, - void *psge, u16 taskid) +static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, + struct leapraid_ioctl_command *karg, + void __user *mf) { - struct leapraid_sas_io_unit_ctrl_req *sas_io_unit_ctrl_req = - (struct leapraid_sas_io_unit_ctrl_req *)ctl_sp_mpi_req; - - if (sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_HARD_RESET || - sas_io_unit_ctrl_req->op == LEAPRAID_SAS_OP_PHY_LINK_RESET) - adapter->reset_desc.adapter_link_resetting = true; - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); -} - -static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, - struct leapraid_ioctl_command *karg, - void __user *mf) -{ - struct leapraid_req *leap_mpi_req = NULL; - struct leapraid_req *ctl_sp_mpi_req = NULL; + struct leapraid_req *leap_mpi_req; + struct leapraid_req *ctl_sp_mpi_req; u16 taskid; void *h2c = NULL; size_t h2c_size = 0; @@ -277,74 +246,88 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; u32 sz; - long rc = 0; + int rc; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + return rc; leap_mpi_req = kzalloc(LEAPRAID_REQUEST_SIZE, GFP_KERNEL); - if (!leap_mpi_req) { - rc = -ENOMEM; - goto out; - } + if (!leap_mpi_req) + return -ENOMEM; - if (karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > LEAPRAID_REQUEST_SIZE || - karg->data_sge_offset > ((UINT_MAX) / LEAPRAID_SGE_OFFSET_SIZE)) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || + karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > + LEAPRAID_REQUEST_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); rc = -EINVAL; - goto out; + goto out_cleanup; } if (copy_from_user(leap_mpi_req, mf, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy request message from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset((void *)(&adapter->driver_cmds.ctl_cmd.reply), 0, - LEAPRAID_REPLY_SIEZ); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, + LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); memcpy(ctl_sp_mpi_req, leap_mpi_req, karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); - if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - ctl_sp_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_hdl = le16_to_cpu(ctl_sp_mpi_req->func_dep1); - if (!dev_hdl || dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + if (!dev_hdl || + dev_hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_err(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } } - if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) - return -EINVAL; + if (WARN_ON(ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSI_TMF)) { + rc = -EINVAL; + goto out_cleanup; + } h2c_size = karg->h2c_size; c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, - &h2c_dma_addr, GFP_ATOMIC); + &h2c_dma_addr, GFP_KERNEL); if (!h2c) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (copy_from_user(h2c, karg->h2c_buf_ptr, h2c_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy h2c from user\n", + __func__); rc = -EFAULT; - goto out; + goto out_cleanup; } } if (c2h_size) { - c2h = dma_alloc_coherent(&adapter->pdev->dev, - c2h_size, &c2h_dma_addr, GFP_ATOMIC); + c2h = dma_alloc_coherent(&adapter->pdev->dev, c2h_size, + &c2h_dma_addr, GFP_KERNEL); if (!c2h) { rc = -ENOMEM; - goto out; + goto out_cleanup; } } @@ -353,13 +336,9 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { - case LEAPRAID_FUNC_SCSIIO_REQ: - case LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_cli_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + leapraid_ctl_scsiio_cmd(adapter, ctl_sp_mpi_req, taskid, h2c_dma_addr, h2c_size, c2h_dma_addr, c2h_size, dev_hdl, psge); @@ -367,28 +346,26 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, case LEAPRAID_FUNC_SMP_PASSTHROUGH: if (!h2c) { rc = -EINVAL; - goto out; + goto out_cleanup; } - leapraid_ctl_smp_passthrough_cmd(adapter, - ctl_sp_mpi_req, taskid, - h2c_dma_addr, h2c_size, - c2h_dma_addr, c2h_size, - psge, h2c); + rc = leapraid_ctl_smp_passthrough_cmd(adapter, + ctl_sp_mpi_req, taskid, + h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size, + psge, h2c); + if (rc) + goto out_cleanup; break; - case LEAPRAID_FUNC_SATA_PASSTHROUGH: - if (test_bit(dev_hdl, (unsigned long *)adapter->dev_topo.dev_removing)) { - rc = -EINVAL; - goto out; - } - leapraid_ctl_sata_passthrough_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_FW_DOWNLOAD: case LEAPRAID_FUNC_FW_UPLOAD: - leapraid_ctl_load_fw_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_ieee_sg(adapter, psge, h2c_dma_addr, h2c_size, + c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: leapraid_ctl_sas_io_unit_ctrl_cmd(adapter, ctl_sp_mpi_req, @@ -397,23 +374,27 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, psge, taskid); break; default: - leapraid_ctl_fire_mpi_cmd(adapter, h2c_dma_addr, - h2c_size, c2h_dma_addr, - c2h_size, psge, taskid); + leapraid_build_mpi_sg(adapter, psge, h2c_dma_addr, + h2c_size, c2h_dma_addr, c2h_size); + leapraid_fire_task(adapter, taskid); break; } timeout = karg->timeout; if (timeout < LEAPRAID_CTL_CMD_TIMEOUT) timeout = LEAPRAID_CTL_CMD_TIMEOUT; - wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, - timeout * HZ); + if (!wait_for_completion_timeout(&adapter->driver_cmds.ctl_cmd.done, + timeout * HZ)) { + dev_err(&adapter->pdev->dev, + "%s: ctl_cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.ctl_cmd.status); + } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || leap_mpi_req->func == LEAPRAID_FUNC_SAS_IO_UNIT_CTRL) && - adapter->reset_desc.adapter_link_resetting) { - adapter->reset_desc.adapter_link_resetting = false; - } + adapter->reset_desc.adapter_link_resetting) + adapter->reset_desc.adapter_link_resetting = 0; + if (!(adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE)) { issue_reset = leapraid_check_reset( @@ -421,57 +402,66 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto reset; } - if (c2h_size) { - if (copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { - rc = -ENODATA; - goto out; - } + if (c2h_size && copy_to_user(karg->c2h_buf_ptr, c2h, c2h_size)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy c2h to user\n", __func__); + rc = -ENODATA; + goto out_cleanup; } if (karg->max_rep_bytes) { - sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIEZ); + sz = min_t(u32, karg->max_rep_bytes, LEAPRAID_REPLY_SIZE); if (copy_to_user(karg->rep_msg_buf_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.reply, + &adapter->driver_cmds.ctl_cmd.reply, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy reply to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } if (karg->max_sense_bytes && - (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH)) { + (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH)) { if (!karg->sense_data_ptr) - goto out; + goto out_cleanup; sz = min_t(u32, karg->max_sense_bytes, SCSI_SENSE_BUFFERSIZE); if (copy_to_user(karg->sense_data_ptr, - (void *)&adapter->driver_cmds.ctl_cmd.sense, + &adapter->driver_cmds.ctl_cmd.sense, sz)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy sense data to user\n", + __func__); rc = -ENODATA; - goto out; + goto out_cleanup; } } reset: if (issue_reset) { rc = -ENODATA; - if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_req->func == LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH || - leap_mpi_req->func == LEAPRAID_FUNC_SATA_PASSTHROUGH) { + if (leap_mpi_req->func == LEAPRAID_FUNC_SCSIIO || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || + leap_mpi_req->func == + LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH) { dev_err(&adapter->pdev->dev, - "fire tgt reset: hdl=0x%04x\n", + "Fire tgt reset, hdl=0x%04x\n", le16_to_cpu(leap_mpi_req->func_dep1)); - leapraid_issue_locked_tm(adapter, + leapraid_issue_locked_tm( + adapter, le16_to_cpu(leap_mpi_req->func_dep1), 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } else { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } } -out: +out_cleanup: if (c2h) dma_free_coherent(&adapter->pdev->dev, c2h_size, c2h, c2h_dma_addr); @@ -483,12 +473,12 @@ static long leapraid_ctl_do_command(struct leapraid_adapter *adapter, return rc; } -static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, - void __user *arg) +static int leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, + void __user *arg) { struct leapraid_ioctl_adapter_info *karg; - ssize_t __maybe_unused ret; u8 revision; + int rc = 0; karg = kzalloc(sizeof(*karg), GFP_KERNEL); if (!karg) @@ -504,80 +494,98 @@ static long leapraid_ctl_get_adapter_info(struct leapraid_adapter *adapter, karg->pci_info.u.bits.func = PCI_FUNC(adapter->pdev->devfn); karg->pci_info.seg_id = pci_domain_nr(adapter->pdev->bus); karg->fw_ver = adapter->adapter_attr.features.fw_version; - ret = strscpy(karg->driver_ver, LEAPRAID_DRIVER_NAME, - sizeof(karg->driver_ver)); - strcat(karg->driver_ver, "-"); - strcat(karg->driver_ver, LEAPRAID_DRIVER_VERSION); + + snprintf(karg->driver_ver, sizeof(karg->driver_ver), "%s-%s", + LEAPRAID_DRIVER_NAME, LEAPRAID_DRIVER_VERSION); + karg->adapter_type = LEAPRAID_IOCTL_VERSION; karg->bios_ver = adapter->adapter_attr.bios_version; if (copy_to_user(arg, karg, sizeof(struct leapraid_ioctl_adapter_info))) { - kfree(karg); - return -EFAULT; + dev_err(&adapter->pdev->dev, + "%s: Failed to copy info to user\n", __func__); + rc = -EFAULT; + goto free_buf; } +free_buf: kfree(karg); - return 0; + return rc; } -static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, - void __user *arg, u8 compat) +static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, + void __user *arg) { struct leapraid_ioctl_header ioctl_header; struct leapraid_adapter *adapter; - long rc = -ENOIOCTLCMD; - int count; - - if (copy_from_user(&ioctl_header, (char __user *)arg, - sizeof(struct leapraid_ioctl_header))) + struct leapraid_ioctl_command __user *uarg; + struct leapraid_ioctl_command karg; + int rc = -ENOIOCTLCMD; + + if (copy_from_user(&ioctl_header, arg, + sizeof(struct leapraid_ioctl_header))) { + pr_err("%s:%s: Failed to copy header from user\n", + LEAPRAID_DRIVER_NAME, __func__); return -EFAULT; + } adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); if (!adapter) return -EFAULT; + if (atomic_read(&adapter->overheat_desc.thermal_alert)) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, thermal_alert=%d\n", + __func__, + atomic_read(&adapter->overheat_desc.thermal_alert)); + return -EFAULT; + } + mutex_lock(&adapter->access_ctrl.pci_access_lock); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_LONG, + __func__); if (rc) - goto out; + goto unlock; - count = LEAPRAID_WAIT_SHOST_RECOVERY; - while (count--) { - if (!adapter->access_ctrl.shost_recovering) - break; - ssleep(1); + if (!wait_event_timeout(adapter->access_ctrl.shost_recover_wq, + !adapter->access_ctrl.shost_recover_async, + LEAPRAID_WAIT_SHOST_RECOVERY * HZ)) { + dev_warn(&adapter->pdev->dev, + "Timeout waiting for shost recovery async\n"); + rc = -EAGAIN; + goto unlock; } - if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || + if (adapter->access_ctrl.pcie_recovering || adapter->scan_dev_desc.driver_loading || adapter->access_ctrl.host_removing) { rc = -EAGAIN; - goto out; + goto unlock; } if (file->f_flags & O_NONBLOCK) { if (!mutex_trylock(&adapter->driver_cmds.ctl_cmd.mutex)) { rc = -EAGAIN; - goto out; + goto unlock; } - } else if (mutex_lock_interruptible(&adapter->driver_cmds.ctl_cmd.mutex)) { + } else if (mutex_lock_interruptible(&adapter->driver_cmds + .ctl_cmd.mutex)) { rc = -ERESTARTSYS; - goto out; + goto unlock; } switch (_IOC_NR(cmd)) { case LEAPRAID_ADAPTER_INFO: - if (_IOC_SIZE(cmd) == sizeof(struct leapraid_ioctl_adapter_info)) + if (_IOC_SIZE(cmd) == + sizeof(struct leapraid_ioctl_adapter_info)) rc = leapraid_ctl_get_adapter_info(adapter, arg); break; case LEAPRAID_COMMAND: - { - struct leapraid_ioctl_command __user *uarg; - struct leapraid_ioctl_command karg; - if (copy_from_user(&karg, arg, sizeof(karg))) { + dev_err(&adapter->pdev->dev, + "%s: Failed to copy data from user\n", + __func__); rc = -EFAULT; break; } @@ -591,61 +599,77 @@ static long leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, uarg = arg; rc = leapraid_ctl_do_command(adapter, &karg, &uarg->mf); + if (rc) + dev_warn(&adapter->pdev->dev, + "%s: IOCTL cmd failed rc=%d\n", + __func__, rc); } break; - } case LEAPRAID_EVENTQUERY: case LEAPRAID_EVENTREPORT: rc = 0; break; default: - pr_err("unknown ioctl opcode=0x%08x\n", cmd); + dev_err(&adapter->pdev->dev, + "Unknown IOCTL opcode=0x%08x\n", cmd); break; } mutex_unlock(&adapter->driver_cmds.ctl_cmd.mutex); -out: +unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); return rc; } +static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + return -ENOTTY; +} + static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - return leapraid_ctl_ioctl_main(file, cmd, - (void __user *)arg, 0); + return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { struct leapraid_adapter *adapter; + /* Userspace passes the adapter ID via vma->vm_pgoff. */ + u32 adapter_id = vma->vm_pgoff; unsigned long length; - unsigned long pfn; + int rc; length = vma->vm_end - vma->vm_start; - adapter = list_first_entry(&leapraid_adapter_list, - struct leapraid_adapter, list); + adapter = leapraid_ctl_lookup_adapter(adapter_id); + if (!adapter) { + pr_err("%s: No adapter found!\n", __func__); + return -EINVAL; + } if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, - "requested mapping size is too large!\n"); + "Requested mapping size is too large!\n"); return -EINVAL; } if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, "no log buffer!\n"); + dev_err(&adapter->pdev->dev, "No log buffer!\n"); return -EINVAL; } - pfn = virt_to_phys(adapter->fw_log_desc.fw_log_buffer) >> PAGE_SHIFT; + vma->vm_pgoff = 0; - if (remap_pfn_range(vma, vma->vm_start, pfn, length, - vma->vm_page_prot)) { + rc = dma_mmap_coherent(&adapter->pdev->dev, vma, + adapter->fw_log_desc.fw_log_buffer, + adapter->fw_log_desc.fw_log_buffer_dma, + length); + if (rc) { dev_err(&adapter->pdev->dev, - "failed to map memory to user space!\n"); - return -EAGAIN; + "Failed to map memory to user space!\n"); + return rc; } return 0; @@ -655,6 +679,7 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, + .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { @@ -663,10 +688,14 @@ static struct miscdevice leapraid_ctl_dev = { .fops = &leapraid_ctl_fops, }; -void leapraid_ctl_init(void) +int leapraid_ctl_init(void) { - if (misc_register(&leapraid_ctl_dev) < 0) - pr_err("%s can't register misc device\n", LEAPRAID_DRIVER_NAME); + if (misc_register(&leapraid_ctl_dev) < 0) { + pr_err("%s Can't register misc device\n", + LEAPRAID_DRIVER_NAME); + return -ENODEV; + } + return 0; } void leapraid_ctl_exit(void) diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 5dfe95a8dd84..01096664d122 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -22,11 +21,12 @@ MODULE_PARM_DESC(smart_poll, static int interrupt_mode; module_param(interrupt_mode, int, 0444); MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 for MSI-X, 1 for MSI, 2 for legacy. (default=0)"); + "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); + -static int max_msix_vectors = -1; +static int max_msix_vectors = LEAPRAID_INVALID_MSIX_VECTORS; module_param(max_msix_vectors, int, 0444); -MODULE_PARM_DESC(max_msix_vectors, " max msix vectors"); +MODULE_PARM_DESC(max_msix_vectors, "max msix vectors"); static void leapraid_remove_device(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev); @@ -35,11 +35,48 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_address, struct leapraid_card_port *port); +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +{ + struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; + u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + bool changed = false; + int i; + + if (leapraid_should_skip_poll_work(adapter)) + return; + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { + debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); + if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) + changed = true; + } + + if (!changed) + return; + + memcpy(adapter->fw_log_desc.pre_debug_log, + debug_log, + sizeof(debug_log)); + + for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; + i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) + dev_warn(&adapter->pdev->dev, + "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", + i, + i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, + debug_log[i], + debug_log[i + 1], + debug_log[i + 2], + debug_log[i + 3]); +} static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -53,12 +90,14 @@ bool leapraid_pci_removed(struct leapraid_adapter *adapter) struct pci_dev *pdev = adapter->pdev; u32 vendor_id; - if (pci_bus_read_config_dword(pdev->bus, pdev->devfn, PCI_VENDOR_ID, + if (pci_bus_read_config_dword(pdev->bus, + pdev->devfn, + PCI_VENDOR_ID, &vendor_id)) return true; - return ((vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != - LEAPRAID_VENDOR_ID); + return (vendor_id & LEAPRAID_PCI_VENDOR_ID_MASK) != + LEAPRAID_VENDOR_ID; } static bool leapraid_pci_active(struct leapraid_adapter *adapter) @@ -78,14 +117,14 @@ void *leapraid_get_reply_vaddr(struct leapraid_adapter *adapter, u32 rep_paddr) void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.task_desc + - (taskid * LEAPRAID_REQUEST_SIZE)); + return adapter->mem_desc.task_desc + + taskid * LEAPRAID_REQUEST_SIZE; } void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid) { - return (void *)(adapter->mem_desc.sense_data + - ((taskid - 1) * SCSI_SENSE_BUFFERSIZE)); + return adapter->mem_desc.sense_data + + (taskid - 1) * SCSI_SENSE_BUFFERSIZE; } __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -99,7 +138,7 @@ void leapraid_mask_int(struct leapraid_adapter *adapter) { u32 reg; - adapter->mask_int = true; + adapter->mask_int = 1; reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg |= LEAPRAID_TO_SYS_DB_MASK + LEAPRAID_REPLY_INT_MASK + LEAPRAID_RESET_IRQ_MASK; @@ -114,35 +153,59 @@ void leapraid_unmask_int(struct leapraid_adapter *adapter) reg = leapraid_readl(&adapter->iomem_base->host_int_mask); reg &= ~LEAPRAID_REPLY_INT_MASK; writel(reg, &adapter->iomem_base->host_int_mask); - adapter->mask_int = false; + adapter->mask_int = 0; } -static void leapraid_flush_io_and_panic(struct leapraid_adapter *adapter) +static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) { - adapter->access_ctrl.adapter_thermal_alert = true; - leapraid_smart_polling_stop(adapter); - leapraid_fw_log_stop(adapter); - leapraid_mq_polling_pause(adapter); - leapraid_clean_active_scsi_cmds(adapter); + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + + if (!adapter) + return; + + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_warn(&pdev->dev, + "Overheat suspend failed, invalid host or adapter\n"); + return; + } + + wq = adapter->overheat_desc.fault_overheat_wq; + if (!wq) + return; + + if (atomic_cmpxchg(&adapter->overheat_desc.thermal_alert, 0, 1)) + return; + + queue_work(wq, &adapter->overheat_desc.fault_overheat_work); } -static void leapraid_check_panic_needed(struct leapraid_adapter *adapter, - u32 db, u32 adapter_state) +static void leapraid_stop_adapter_on_fault(struct leapraid_adapter *adapter, + u32 db) { - bool fault_1 = adapter_state == LEAPRAID_DB_MASK; - bool fault_2 = (adapter_state == LEAPRAID_DB_FAULT) && - ((db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE); + u32 adapter_state = db & LEAPRAID_DB_MASK; + bool fault_1 = false; + bool fault_2 = false; + + fault_1 = adapter_state == LEAPRAID_DB_MASK; + fault_2 = adapter_state == LEAPRAID_DB_FAULT && + (db & LEAPRAID_DB_DATA_MASK) == LEAPRAID_DB_OVER_TEMPERATURE; if (!fault_1 && !fault_2) return; if (fault_1) - pr_err("%s, doorbell status 0xFFFF!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Doorbell status 0xFFFF!\n", __func__); else - pr_err("%s, adapter overheating detected!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Adapter overheating detected!\n", __func__); - leapraid_flush_io_and_panic(adapter); - panic("%s overheating detected, panic now!!!\n", __func__); + leapraid_overheat_suspend(adapter); } u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) @@ -152,38 +215,40 @@ u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter) db = leapraid_readl(&adapter->iomem_base->db); adapter_state = db & LEAPRAID_DB_MASK; - leapraid_check_panic_needed(adapter, db, adapter_state); + leapraid_stop_adapter_on_fault(adapter, db); return adapter_state; } static bool leapraid_wait_adapter_ready(struct leapraid_adapter *adapter) { u32 cur_state; - u32 cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { cur_state = leapraid_get_adapter_state(adapter); + if (cur_state == LEAPRAID_DB_READY) return true; if (cur_state == LEAPRAID_DB_FAULT) break; usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } return false; } static int leapraid_db_wait_int_host(struct leapraid_adapter *adapter) { - u32 cnt = LEAPRAID_DB_WAIT_MAX_RETRY; + u32 cnt; - do { + for (cnt = LEAPRAID_DB_WAIT_MAX_RETRY; cnt > 0; cnt--) { if (leapraid_readl(&adapter->iomem_base->host_int_status) & LEAPRAID_ADAPTER2HOST_DB_STATUS) return 0; + udelay(LEAPRAID_DB_WAIT_DELAY_US); - } while (--cnt); + } return -EFAULT; } @@ -194,25 +259,26 @@ static int leapraid_db_wait_ack_and_clear_int(struct leapraid_adapter *adapter) u32 int_status; u32 cnt; - cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; - do { + for (cnt = LEAPRAID_ADAPTER_READY_MAX_RETRY; cnt > 0; cnt--) { int_status = leapraid_readl(&adapter->iomem_base->host_int_status); - if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) { + + if (int_status == 0xFFFFFFFF) + return -EFAULT; + + if (!(int_status & LEAPRAID_HOST2ADAPTER_DB_STATUS)) return 0; - } else if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { + + if (int_status & LEAPRAID_ADAPTER2HOST_DB_STATUS) { adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state == LEAPRAID_DB_FAULT) return -EFAULT; - } else if (int_status == 0xFFFFFFFF) { - goto out; } usleep_range(LEAPRAID_ADAPTER_READY_SLEEP_MIN_US, LEAPRAID_ADAPTER_READY_SLEEP_MAX_US); - } while (--cnt); + } -out: return -EFAULT; } @@ -222,8 +288,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, { int failed, i; - if ((leapraid_readl(&adapter->iomem_base->db) & - LEAPRAID_DB_USED)) { + if (leapraid_readl(&adapter->iomem_base->db) & LEAPRAID_DB_USED) { dev_err(&adapter->pdev->dev, "doorbell used\n"); return -EFAULT; } @@ -238,7 +303,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, &adapter->iomem_base->db); if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -246,7 +311,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, writel(0, &adapter->iomem_base->host_int_status); if (leapraid_db_wait_ack_and_clear_int(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -254,12 +319,12 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0, failed = 0; i < req_bytes / LEAPRAID_DWORDS_BYTE_SIZE && !failed; i++) { - writel((u32)(req[i]), &adapter->iomem_base->db); + writel((u32)req[i], &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) failed = 1; } if (failed) { - dev_err(&adapter->pdev->dev, "%d:wait ack failure\n", + dev_err(&adapter->pdev->dev, "%d: Wait ack failure\n", __LINE__); return -EFAULT; } @@ -267,7 +332,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, for (i = 0; i < rep_bytes / LEAPRAID_WORD_BYTE_SIZE; i++) { if (leapraid_db_wait_int_host(adapter)) { dev_err(&adapter->pdev->dev, - "%d:wait db interrupt timeout\n", __LINE__); + "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } rep[i] = (u16)(leapraid_readl(&adapter->iomem_base->db) @@ -276,7 +341,7 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, } if (leapraid_db_wait_int_host(adapter)) { - dev_err(&adapter->pdev->dev, "%d:wait db interrupt timeout\n", + dev_err(&adapter->pdev->dev, "%d: Wait db interrupt timeout\n", __LINE__); return -EFAULT; } @@ -286,28 +351,32 @@ static int leapraid_handshake_func(struct leapraid_adapter *adapter, return 0; } -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter) +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller) { - int wait_count = LEAPRAID_DB_WAIT_OPERATIONAL; + int wait_count; - do { - if (leapraid_pci_removed(adapter)) + for (wait_count = wait; wait_count > 0; wait_count--) { + if (leapraid_pci_removed(adapter)) { + dev_warn(&adapter->pdev->dev, + "%s: PCI device removed\n", __func__); return -EFAULT; + } if (leapraid_get_adapter_state(adapter) == LEAPRAID_DB_OPERATIONAL) return 0; - dev_info(&adapter->pdev->dev, - "waiting for adapter to become op status(cnt=%d)\n", - LEAPRAID_DB_WAIT_OPERATIONAL - wait_count); + dev_dbg(&adapter->pdev->dev, + "%s: Wait for adapter to become op status(cnt=%d)\n", + caller, wait - wait_count); ssleep(1); - } while (--wait_count); + } dev_err(&adapter->pdev->dev, - "adapter failed to become op state, last state=%d\n", - leapraid_get_adapter_state(adapter)); + "%s: Adapter failed to become op state, last state=%d\n", + caller, leapraid_get_adapter_state(adapter)); return -EFAULT; } @@ -325,7 +394,7 @@ struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (scmd) - return leapraid_get_scmd_priv(scmd); + return (struct leapraid_io_req_tracker *)scmd->host_scribble; return NULL; } @@ -350,7 +419,8 @@ static u8 leapraid_get_cb_idx(struct leapraid_adapter *adapter, u16 taskid) } struct scsi_cmnd *leapraid_get_scmd_from_taskid( - struct leapraid_adapter *adapter, u16 taskid) + struct leapraid_adapter *adapter, + u16 taskid) { struct leapraid_scsiio_req *leap_mpi_req; struct leapraid_io_req_tracker *st; @@ -367,7 +437,7 @@ struct scsi_cmnd *leapraid_get_scmd_from_taskid( scmd = scsi_host_find_tag(adapter->shost, uniq_tag); if (scmd) { - st = leapraid_get_scmd_priv(scmd); + st = (struct leapraid_io_req_tracker *)scmd->host_scribble; if (st && st->taskid == taskid) return scmd; } @@ -383,8 +453,8 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, u32 tag = scmd->request->tag; scmd->host_scribble = - (unsigned char *)(&adapter->mem_desc.io_tracker[tag]); - request = leapraid_get_scmd_priv(scmd); + (unsigned char *)&adapter->mem_desc.io_tracker[tag]; + request = (struct leapraid_io_req_tracker *)scmd->host_scribble; taskid = tag + 1; request->taskid = taskid; request->scmd = scmd; @@ -401,8 +471,9 @@ static void leapraid_check_pending_io(struct leapraid_adapter *adapter) } } -static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +static void leapraid_clear_io_tracker( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (!io_tracker) return; @@ -416,17 +487,18 @@ static void leapraid_clear_io_tracker(struct leapraid_adapter *adapter, static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, u16 taskid) { - return (taskid == adapter->driver_cmds.ctl_cmd.taskid || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid || - taskid == adapter->driver_cmds.tm_cmd.hp_taskid || - taskid == adapter->driver_cmds.ctl_cmd.hp_taskid || - taskid == adapter->driver_cmds.scan_dev_cmd.inter_taskid || - taskid == adapter->driver_cmds.timestamp_sync_cmd.inter_taskid || - taskid == adapter->driver_cmds.raid_action_cmd.inter_taskid || - taskid == adapter->driver_cmds.transport_cmd.inter_taskid || - taskid == adapter->driver_cmds.cfg_op_cmd.inter_taskid || - taskid == adapter->driver_cmds.enc_cmd.inter_taskid || - taskid == adapter->driver_cmds.notify_event_cmd.inter_taskid); + struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; + + return (taskid == driver_cmds->ctl_cmd.taskid || + taskid == driver_cmds->driver_scsiio_cmd.taskid || + taskid == driver_cmds->tm_cmd.hp_taskid || + taskid == driver_cmds->ctl_cmd.hp_taskid || + taskid == driver_cmds->scan_dev_cmd.inter_taskid || + taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || + taskid == driver_cmds->transport_cmd.inter_taskid || + taskid == driver_cmds->cfg_op_cmd.inter_taskid || + taskid == driver_cmds->enc_cmd.inter_taskid || + taskid == driver_cmds->notify_event_cmd.inter_taskid); } void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid) @@ -516,6 +588,7 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) { struct leapraid_io_req_tracker *io_tracker; struct scsi_cmnd *scmd; + void *task_desc; u16 taskid; for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { @@ -523,15 +596,17 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) if (!scmd) continue; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; if (io_tracker && io_tracker->taskid == 0) continue; scsi_dma_unmap(scmd); + task_desc = leapraid_get_task_desc(adapter, taskid); + memset(task_desc, 0, LEAPRAID_REQUEST_SIZE); leapraid_clear_io_tracker(adapter, io_tracker); if (!leapraid_pci_active(adapter) || adapter->reset_desc.adapter_reset_results != 0 || - adapter->access_ctrl.adapter_thermal_alert || + atomic_read(&adapter->overheat_desc.thermal_alert) || adapter->access_ctrl.host_removing) scmd->result = DID_NO_CONNECT << 16; else @@ -540,36 +615,37 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) } } -static void leapraid_clean_active_driver_cmd( - struct leapraid_driver_cmd *driver_cmd) +static void leapraid_clean_active_driver_cmd(struct leapraid_driver_cmd *cmd) { - if (driver_cmd->status & LEAPRAID_CMD_PENDING) { - driver_cmd->status |= LEAPRAID_CMD_RESET; - complete(&driver_cmd->done); + if (cmd->status & LEAPRAID_CMD_PENDING) { + cmd->status |= LEAPRAID_CMD_RESET; + complete(&cmd->done); } } static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) { - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.raid_action_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.driver_scsiio_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.tm_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.transport_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.enc_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.notify_event_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.cfg_op_cmd); - leapraid_clean_active_driver_cmd(&adapter->driver_cmds.ctl_cmd); - - if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { - adapter->scan_dev_desc.scan_dev_failed = true; - adapter->driver_cmds.scan_dev_cmd.status |= LEAPRAID_CMD_RESET; + struct leapraid_driver_cmds *driver_cmds; + + driver_cmds = &adapter->driver_cmds; + leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->notify_event_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->cfg_op_cmd); + leapraid_clean_active_driver_cmd(&driver_cmds->ctl_cmd); + + if (driver_cmds->scan_dev_cmd.status & LEAPRAID_CMD_PENDING) { + adapter->scan_dev_desc.scan_dev_failed = 1; + driver_cmds->scan_dev_cmd.status |= LEAPRAID_CMD_RESET; if (adapter->scan_dev_desc.driver_loading) { adapter->scan_dev_desc.scan_start_failed = LEAPRAID_ADAPTER_STATUS_INTERNAL_ERROR; - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; } else { - complete(&adapter->driver_cmds.scan_dev_cmd.done); + complete(&driver_cmds->scan_dev_cmd.done); } } } @@ -577,10 +653,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) static void leapraid_clean_active_cmds(struct leapraid_adapter *adapter) { leapraid_clean_active_driver_cmds(adapter); - memset(adapter->dev_topo.pending_dev_add, 0, - adapter->dev_topo.pending_dev_add_sz); - memset(adapter->dev_topo.dev_removing, 0, - adapter->dev_topo.dev_removing_sz); leapraid_clean_active_fw_evt(adapter); leapraid_clean_active_scsi_cmds(adapter); } @@ -589,9 +661,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; unsigned long flags = 0; - u32 adapter_state = 0; + u32 adapter_state; if (adapter->access_ctrl.pcie_recovering) return; @@ -600,15 +672,15 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -622,9 +694,9 @@ static void leapraid_tgt_not_responding(struct leapraid_adapter *adapter, static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_starget_priv *starget_priv = NULL; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_card_port *port = NULL; - u64 sas_address = 0; + struct leapraid_sas_dev *sas_dev; + struct leapraid_card_port *port; + u64 sas_address; unsigned long flags; u32 adapter_state; @@ -635,15 +707,15 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) if (adapter_state != LEAPRAID_DB_OPERATIONAL) return; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls)) + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle || + test_bit(hdl, adapter->dev_topo.pd_hdls)) return; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev && sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; sas_address = sas_dev->sas_addr; port = sas_dev->card_port; } @@ -657,26 +729,30 @@ static void leapraid_tgt_rst_send(struct leapraid_adapter *adapter, u16 hdl) leapraid_sdev_put(sas_dev); } -static inline void leapraid_single_mpi_sg_append(struct leapraid_adapter *adapter, - void *sge, u32 flag_and_len, - dma_addr_t dma_addr) +static inline void leapraid_single_mpi_sg_append( + struct leapraid_adapter *adapter, + void *sge, + u32 flag_and_len, + dma_addr_t dma_addr) { if (adapter->adapter_attr.use_32_dma_mask) { - ((struct leapraid_sge_simple32 *)sge)->flg_and_len = + struct leapraid_sge_simple32 *sge32 = sge; + + sge32->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_32 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple32 *)sge)->addr = - cpu_to_le32(dma_addr); + sge32->addr = cpu_to_le32(dma_addr); } else { - ((struct leapraid_sge_simple64 *)sge)->flg_and_len = + struct leapraid_sge_simple64 *sge64 = sge; + + sge64->flg_and_len = cpu_to_le32(flag_and_len | (LEAPRAID_SGE_FLG_64 | LEAPRAID_SGE_FLG_SYSTEM_ADDR) << LEAPRAID_SGE_FLG_SHIFT); - ((struct leapraid_sge_simple64 *)sge)->addr = - cpu_to_le64(dma_addr); + sge64->addr = cpu_to_le64(dma_addr); } } @@ -685,11 +761,12 @@ static inline void leapraid_single_ieee_sg_append(void *sge, u8 flag, u32 len, dma_addr_t dma_addr) { - ((struct leapraid_chain64_ieee_sg *)sge)->flg = flag; - ((struct leapraid_chain64_ieee_sg *)sge)->next_chain_offset = - next_chain_offset; - ((struct leapraid_chain64_ieee_sg *)sge)->len = cpu_to_le32(len); - ((struct leapraid_chain64_ieee_sg *)sge)->addr = cpu_to_le64(dma_addr); + struct leapraid_chain64_ieee_sg *ieee_sg = sge; + + ieee_sg->flg = flag; + ieee_sg->next_chain_offset = next_chain_offset; + ieee_sg->len = cpu_to_le32(len); + ieee_sg->addr = cpu_to_le64(dma_addr); } static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, @@ -697,12 +774,12 @@ static void leapraid_build_nodata_mpi_sg(struct leapraid_adapter *adapter, { leapraid_single_mpi_sg_append(adapter, sge, - (u32)((LEAPRAID_SGE_FLG_LAST_ONE | - LEAPRAID_SGE_FLG_EOB | - LEAPRAID_SGE_FLG_EOL | - LEAPRAID_SGE_FLG_SIMPLE_ONE) << - LEAPRAID_SGE_FLG_SHIFT), - -1); + (LEAPRAID_SGE_FLG_LAST_ONE | + LEAPRAID_SGE_FLG_EOB | + LEAPRAID_SGE_FLG_EOL | + LEAPRAID_SGE_FLG_SIMPLE_ONE) << + LEAPRAID_SGE_FLG_SHIFT, + LEAPRAID_SGE_NO_DATA_ADDR); } void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, @@ -753,7 +830,7 @@ void leapraid_build_mpi_sg(struct leapraid_adapter *adapter, void *sge, c2h_size, c2h_dma_addr); } else { - return leapraid_build_nodata_mpi_sg(adapter, sge); + leapraid_build_nodata_mpi_sg(adapter, sge); } } @@ -763,7 +840,9 @@ void leapraid_build_ieee_nodata_sg(struct leapraid_adapter *adapter, void *sge) (LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | LEAPRAID_IEEE_SGE_FLG_EOL), - 0, 0, -1); + 0, + 0, + LEAPRAID_SGE_NO_DATA_ADDR); } int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, @@ -781,7 +860,7 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, u32 chain_offset_in_cur_seg; u32 chain_len_in_cur_seg; - io_tracker = leapraid_get_scmd_priv(scmd); + io_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; scsiio_req = leapraid_get_task_desc(adapter, taskid); scmd_sg_cur = scsi_sglist(scmd); sg_entries_left = scsi_dma_map(scmd); @@ -819,7 +898,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, if (chain_offset_in_cur_seg) chain_len_in_cur_seg += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_CHAIN_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, chain_offset_in_cur_seg, chain_len_in_cur_seg, @@ -829,7 +909,8 @@ int leapraid_build_scmd_ieee_sg(struct leapraid_adapter *adapter, goto fill_last_seg; while (sg_entries_in_cur_seg) { - leapraid_single_ieee_sg_append(sg_entry_cur, + leapraid_single_ieee_sg_append( + sg_entry_cur, LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, 0, sg_dma_len(scmd_sg_cur), @@ -866,39 +947,44 @@ void leapraid_build_ieee_sg(struct leapraid_adapter *adapter, void *sge, dma_addr_t h2c_dma_addr, size_t h2c_size, dma_addr_t c2h_dma_addr, size_t c2h_size) { + u32 base_flag; + u32 flag; + + base_flag = LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | + LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR; + if (h2c_size && !c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, h2c_size, h2c_dma_addr); } else if (!h2c_size && c2h_size) { + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; + leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_EOL | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + flag, 0, c2h_size, c2h_dma_addr); } else if (h2c_size && c2h_size) { leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR, + base_flag, 0, h2c_size, h2c_dma_addr); sge += LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + + flag = base_flag | LEAPRAID_IEEE_SGE_FLG_EOL; leapraid_single_ieee_sg_append(sge, - LEAPRAID_IEEE_SGE_FLG_SIMPLE_ONE | - LEAPRAID_IEEE_SGE_FLG_SYSTEM_ADDR | - LEAPRAID_IEEE_SGE_FLG_EOL, + flag, 0, c2h_size, c2h_dma_addr); } else { - return leapraid_build_ieee_nodata_sg(adapter, sge); + leapraid_build_ieee_nodata_sg(adapter, sge); } } @@ -952,8 +1038,11 @@ static struct leapraid_card_port *leapraid_get_port_by_id( if (unlikely(!adapter->adapter_attr.enable_mp)) { port = kzalloc(sizeof(*port), GFP_ATOMIC); - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed to alloc port\n", __func__); return NULL; + } port->port_id = LEAPRAID_DISABLE_MP_PORT_ID; list_add_tail(&port->list, &adapter->dev_topo.card_port_list); @@ -980,7 +1069,8 @@ struct leapraid_vphy *leapraid_get_vphy_by_phy(struct leapraid_card_port *port, } struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( - struct leapraid_adapter *adapter, u64 sas_address, + struct leapraid_adapter *adapter, + u64 sas_address, struct sas_rphy *rphy) { struct leapraid_sas_dev *sas_dev; @@ -1010,8 +1100,10 @@ struct leapraid_sas_dev *leapraid_hold_lock_get_sas_dev_by_addr( { struct leapraid_sas_dev *sas_dev; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } assert_spin_locked(&adapter->dev_topo.sas_dev_lock); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) @@ -1039,8 +1131,10 @@ struct leapraid_sas_dev *leapraid_get_sas_dev_by_addr( struct leapraid_sas_dev *sas_dev; unsigned long flags; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, @@ -1089,8 +1183,11 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, unsigned long flags; bool del_from_list; - if (!sas_dev) + if (!sas_dev) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid SAS device\n", __func__); return; + } del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); @@ -1100,8 +1197,10 @@ void leapraid_sas_dev_remove(struct leapraid_adapter *adapter, } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - if (del_from_list) + if (del_from_list) { + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); + } } static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, @@ -1117,12 +1216,10 @@ static void leapraid_sas_dev_remove_by_hdl(struct leapraid_adapter *adapter, del_from_list = false; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1147,12 +1244,10 @@ void leapraid_sas_dev_remove_by_sas_address(struct leapraid_adapter *adapter, spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, port); - if (sas_dev) { - if (!list_empty(&sas_dev->list)) { - list_del_init(&sas_dev->list); - del_from_list = true; - leapraid_sdev_put(sas_dev); - } + if (sas_dev && (!list_empty(&sas_dev->list))) { + list_del_init(&sas_dev->list); + del_from_list = true; + leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1166,14 +1261,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_id( struct leapraid_adapter *adapter, uint id, uint channel) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->id == id && - raid_volume->channel == channel) { + if (raid_volume->id == id && raid_volume->channel == channel) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1182,12 +1282,19 @@ struct leapraid_raid_volume *leapraid_raid_volume_find_by_hdl( struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->hdl == hdl) + if (raid_volume->hdl == hdl) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1196,12 +1303,19 @@ static struct leapraid_raid_volume *leapraid_raid_volume_find_by_wwid( struct leapraid_adapter *adapter, u64 wwid) { struct leapraid_raid_volume *raid_volume; + unsigned long flags; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry(raid_volume, &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid) + if (raid_volume->wwid == wwid) { + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); return raid_volume; + } } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return NULL; } @@ -1212,6 +1326,7 @@ static void leapraid_raid_volume_add(struct leapraid_adapter *adapter, unsigned long flags; spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_get(raid_volume); list_add_tail(&raid_volume->list, &adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } @@ -1220,11 +1335,24 @@ void leapraid_raid_volume_remove(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume) { unsigned long flags; + bool del_from_list = false; + + if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid RAID volume\n", __func__); + return; + } spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_del(&raid_volume->list); - kfree(raid_volume); + if (!list_empty(&raid_volume->list)) { + list_del_init(&raid_volume->list); + del_from_list = true; + } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + leapraid_clear_cached_boot_dev(adapter, raid_volume, RAID_CHANNEL); + if (del_from_list) + leapraid_raid_volume_put(raid_volume); } static struct leapraid_enc_node *leapraid_enc_find_by_hdl( @@ -1232,10 +1360,9 @@ static struct leapraid_enc_node *leapraid_enc_find_by_hdl( { struct leapraid_enc_node *enc_dev; - list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) { + list_for_each_entry(enc_dev, &adapter->dev_topo.enc_list, list) if (le16_to_cpu(enc_dev->pg0.enc_hdl) == hdl) return enc_dev; - } return NULL; } @@ -1246,15 +1373,19 @@ struct leapraid_topo_node *leapraid_exp_find_by_sas_address( { struct leapraid_topo_node *sas_exp; - if (!port) + if (!port) { + dev_warn(&adapter->pdev->dev, "%s: Invalid port\n", __func__); return NULL; + } - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->sas_address == sas_address && sas_exp->card_port == port) return sas_exp; - } + dev_warn(&adapter->pdev->dev, + "%s: No expander found for SAS addr=0x%016llx port=%p\n", + __func__, (unsigned long long)sas_address, port); return NULL; } @@ -1301,10 +1432,9 @@ static struct leapraid_topo_node *leapraid_exp_find_by_hdl( { struct leapraid_topo_node *sas_exp; - list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) { + list_for_each_entry(sas_exp, &adapter->dev_topo.exp_list, list) if (sas_exp->hdl == hdl) return sas_exp; - } return NULL; } @@ -1332,7 +1462,7 @@ static enum leapraid_card_port_checking_flg leapraid_get_card_port_feature( return CARD_PORT_FURTHER_CHECKING_NEEDED; } -static int leapraid_process_card_port_feature( +static bool leapraid_process_card_port_feature( struct leapraid_card_port_feature *feature) { struct leapraid_card_port *old_card_port; @@ -1341,8 +1471,10 @@ static int leapraid_process_card_port_feature( if (feature->exact_phy) { feature->checking_state = SAME_PORT_WITH_NOTHING_CHANGED; feature->expected_old_port = old_card_port; - return 1; - } else if (feature->phy_overlap) { + return true; + } + + if (feature->phy_overlap) { if (feature->same_port) { feature->checking_state = SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS; @@ -1353,21 +1485,20 @@ static int leapraid_process_card_port_feature( SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS; feature->expected_old_port = old_card_port; } - } else { - if (feature->checking_state != - SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && - feature->checking_state != - SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { - feature->checking_state = SAME_ADDR_ONLY; - feature->expected_old_port = old_card_port; - feature->same_addr_port_count++; - } + } else if (feature->checking_state != + SAME_PORT_WITH_PARTIALLY_CHANGED_PHYS && + feature->checking_state != + SAME_ADDR_WITH_PARTIALLY_CHANGED_PHYS) { + feature->checking_state = SAME_ADDR_ONLY; + feature->expected_old_port = old_card_port; + feature->same_addr_port_count++; } - return 0; + return false; } -static int leapraid_check_card_port(struct leapraid_adapter *adapter, +static int leapraid_check_card_port( + struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_card_port **expected_card_port, int *count) @@ -1413,7 +1544,8 @@ static void leapraid_del_phy_part_of_anther_port( continue; if (card_port_table[i].phy_mask & BIT(offset)) { - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); found = true; @@ -1433,7 +1565,7 @@ static void leapraid_add_or_del_phys_from_existing_port( { struct leapraid_topo_node *card_topo_node; u32 phy_mask_diff; - u32 offset = 0; + u32 offset; card_topo_node = &adapter->dev_topo.card; phy_mask_diff = card_port->phy_mask ^ @@ -1451,12 +1583,15 @@ static void leapraid_add_or_del_phys_from_existing_port( } if (card_topo_node->card_phy[offset].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, + leapraid_transport_detach_phy_to_port( + adapter, card_topo_node, &card_topo_node->card_phy[offset]); - leapraid_transport_attach_phy_to_port(adapter, - card_topo_node, &card_topo_node->card_phy[offset], + leapraid_transport_attach_phy_to_port( + adapter, + card_topo_node, + &card_topo_node->card_phy[offset], card_port->sas_address, card_port); } @@ -1471,7 +1606,8 @@ struct leapraid_sas_dev *leapraid_get_next_sas_dev_from_init_list( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); if (!list_empty(&adapter->dev_topo.sas_dev_init_list)) { sas_dev = list_first_entry(&adapter->dev_topo.sas_dev_init_list, - struct leapraid_sas_dev, list); + struct leapraid_sas_dev, + list); leapraid_sdev_get(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1483,37 +1619,66 @@ static bool leapraid_check_boot_dev_internal(u64 sas_address, u64 dev_name, struct leapraid_boot_dev *boot_dev, u8 form) { + struct leapraid_boot_dev_format_sas_wwid *wwid; + struct leapraid_boot_dev_format_enc_slot *es; + struct leapraid_boot_dev_format_dev_name *dn; + void *pg_dev; + if (!boot_dev) return false; + pg_dev = boot_dev->pg_dev; switch (form & LEAPRAID_BOOTDEV_FORM_MASK) { case LEAPRAID_BOOTDEV_FORM_SAS_WWID: + wwid = pg_dev; + if (!sas_address) return false; - return sas_address == - le64_to_cpu(((struct leapraid_boot_dev_format_sas_wwid *)( - boot_dev->pg_dev))->sas_addr); + return sas_address == le64_to_cpu(wwid->sas_addr); case LEAPRAID_BOOTDEV_FORM_ENC_SLOT: + es = pg_dev; + if (!enc_lid) return false; - return (enc_lid == le64_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->enc_lid) && - slot == le16_to_cpu(((struct leapraid_boot_dev_format_enc_slot *)( - boot_dev->pg_dev))->slot_num)); + return (enc_lid == le64_to_cpu(es->enc_lid) && + slot == le16_to_cpu(es->slot_num)); case LEAPRAID_BOOTDEV_FORM_DEV_NAME: + dn = pg_dev; + if (!dev_name) return false; - return dev_name == le64_to_cpu(((struct leapraid_boot_dev_format_dev_name *)( - boot_dev->pg_dev))->dev_name); + return dev_name == le64_to_cpu(dn->dev_name); case LEAPRAID_BOOTDEV_FORM_NONE: default: return false; } } +void leapraid_boot_dev_get(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_get((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_get((struct leapraid_sas_dev *)dev); +} + +void leapraid_boot_dev_put(void *dev, u32 chnl) +{ + if (!dev) + return; + + if (chnl == RAID_CHANNEL) + leapraid_raid_volume_put((struct leapraid_raid_volume *)dev); + else + leapraid_sdev_put((struct leapraid_sas_dev *)dev); +} + static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, u64 sas_addr, u64 dev_name, u64 enc_lid, u16 slot, @@ -1528,15 +1693,56 @@ static void leapraid_try_set_boot_dev(struct leapraid_boot_dev *boot_dev, slot, boot_dev, boot_dev->form); if (matched) { + leapraid_boot_dev_get(dev, chnl); boot_dev->dev = dev; boot_dev->chnl = chnl; } } +static void leapraid_clear_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, + void *dev, u32 chnl) +{ + void *cached_dev; + u32 cached_chnl; + unsigned long flags; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (boot_dev->dev != dev || boot_dev->chnl != chnl) + goto out_unlock; + + cached_dev = boot_dev->dev; + cached_chnl = boot_dev->chnl; + boot_dev->dev = NULL; + boot_dev->chnl = 0; + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + leapraid_boot_dev_put(cached_dev, cached_chnl); + return; + +out_unlock: + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); +} + +static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, + void *dev, u32 chnl) +{ + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, + dev, chnl); + leapraid_clear_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + dev, chnl); +} + static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl) { - u64 sas_addr = 0; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + u64 sas_addr; u64 dev_name = 0; u64 enc_lid = 0; u16 slot = 0; @@ -1546,24 +1752,17 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; - + raid_volume = dev; sas_addr = raid_volume->wwid; break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; + sas_dev = dev; sas_addr = sas_dev->sas_addr; dev_name = sas_dev->dev_name; enc_lid = sas_dev->enc_lid; slot = sas_dev->slot; break; } - } leapraid_try_set_boot_dev(&adapter->boot_devs.requested_boot_dev, sas_addr, dev_name, enc_lid, @@ -1576,17 +1775,272 @@ static void leapraid_check_boot_dev(struct leapraid_adapter *adapter, slot, dev, chnl); } -static void leapraid_build_and_fire_cfg_req(struct leapraid_adapter *adapter, +static const char *leapraid_func_name(u8 func) +{ + switch (func) { + case LEAPRAID_FUNC_SCSIIO: + return "SCSIIO"; + case LEAPRAID_FUNC_SCSI_TMF: + return "SCSI_TMF"; + case LEAPRAID_FUNC_ADAPTER_INIT: + return "ADAPTER_INIT"; + case LEAPRAID_FUNC_GET_ADAPTER_FEATURES: + return "GET_ADAPTER_FEATURES"; + case LEAPRAID_FUNC_CONFIG_OP: + return "CONFIG_OP"; + case LEAPRAID_FUNC_SCAN_DEV: + return "SCAN_DEV"; + case LEAPRAID_FUNC_EVENT_NOTIFY: + return "EVENT_NOTIFY"; + case LEAPRAID_FUNC_FW_DOWNLOAD: + return "FW_DOWNLOAD"; + case LEAPRAID_FUNC_FW_UPLOAD: + return "FW_UPLOAD"; + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + return "SCSIIO_RAID_PASSTHROUGH"; + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: + return "SCSI_ENC_PROCESSOR"; + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + return "SMP_PASSTHROUGH"; + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: + return "SAS_IO_UNIT_CTRL"; + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + return "SCSIIO_SATA_PASSTHROUGH"; + case LEAPRAID_FUNC_ADAPTER_UNIT_RESET: + return "ADAPTER_UNIT_RESET"; + case LEAPRAID_FUNC_HANDSHAKE: + return "HANDSHAKE"; + case LEAPRAID_FUNC_LOGBUF_INIT: + return "LOGBUF_INIT"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_CFG_ACT_PAGE_HEADER: + return "PAGE_HEADER"; + case LEAPRAID_CFG_ACT_PAGE_READ_CUR: + return "PAGE_READ_CUR"; + case LEAPRAID_CFG_ACT_PAGE_WRITE_CUR: + return "PAGE_WRITE_CUR"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_page_type_name(u8 page_type) +{ + switch (page_type) { + case LEAPRAID_CFG_PT_IO_UNIT: + return "IO_UNIT"; + case LEAPRAID_CFG_PT_ADAPTER: + return "ADAPTER"; + case LEAPRAID_CFG_PT_BIOS: + return "BIOS"; + case LEAPRAID_CFG_PT_RAID_VOLUME: + return "RAID_VOLUME"; + case LEAPRAID_CFG_PT_MANUFACTURING: + return "MANUFACTURING"; + case LEAPRAID_CFG_PT_RAID_PHYSDISK: + return "RAID_PHYSDISK"; + case LEAPRAID_CFG_PT_EXTENDED: + return "EXTENDED"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_cfg_ext_page_type_name(u8 ext_page_type) +{ + switch (ext_page_type) { + case LEAPRAID_CFG_EXTPT_SAS_IO_UNIT: + return "SAS_IO_UNIT"; + case LEAPRAID_CFG_EXTPT_SAS_EXP: + return "SAS_EXPANDER"; + case LEAPRAID_CFG_EXTPT_SAS_DEV: + return "SAS_DEVICE"; + case LEAPRAID_CFG_EXTPT_SAS_PHY: + return "SAS_PHY"; + case LEAPRAID_CFG_EXTPT_ENC: + return "ENCLOSURE"; + case LEAPRAID_CFG_EXTPT_RAID_CONFIG: + return "RAID_CONFIG"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sep_action_name(u8 action) +{ + switch (action) { + case LEAPRAID_SEP_REQ_ACT_WRITE_STATUS: + return "WRITE_STATUS"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_sas_op_name(u8 op) +{ + switch (op) { + case LEAPRAID_SAS_OP_PHY_LINK_RESET: + return "PHY_LINK_RESET"; + case LEAPRAID_SAS_OP_PHY_HARD_RESET: + return "PHY_HARD_RESET"; + case LEAPRAID_SAS_OP_SET_PARAMETER: + return "SET_PARAMETER"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_io_param_name(u8 adapter_param) +{ + switch (adapter_param) { + case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: + return "SYNC_TIMESTAMP"; + default: + return "UNKNOWN"; + } +} + +static const char *leapraid_tm_type_name(u8 task_type) +{ + switch (task_type) { + case LEAPRAID_TM_TASKTYPE_ABORT_TASK: + return "ABORT_TASK"; + case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: + return "ABORT_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_TARGET_RESET: + return "TARGET_RESET"; + case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: + return "LOGICAL_UNIT_RESET"; + case LEAPRAID_TM_TASKTYPE_CLEAR_TASK_SET: + return "CLEAR_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK: + return "QUERY_TASK"; + case LEAPRAID_TM_TASKTYPE_CLEAR_ACA: + return "CLEAR_ACA"; + case LEAPRAID_TM_TASKTYPE_QUERY_TASK_SET: + return "QUERY_TASK_SET"; + case LEAPRAID_TM_TASKTYPE_QUERY_ASYNC_EVENT: + return "QUERY_ASYNC_EVENT"; + default: + return "UNKNOWN"; + } +} + +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data) +{ + const struct leapraid_req *req = req_data; + + if (!adapter || !adapter->pdev || !req_data) + return; + + switch (req->func) { + case LEAPRAID_FUNC_CONFIG_OP: { + const struct leapraid_cfg_req *cfg_req = req_data; + + dev_err(&adapter->pdev->dev, + "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + cfg_req->action, + leapraid_cfg_action_name(cfg_req->action)); + dev_err(&adapter->pdev->dev, + "cfg-req: page_type=0x%02x(%s) page_num=%u\n", + cfg_req->header.page_type, + leapraid_cfg_page_type_name(cfg_req->header.page_type), + cfg_req->header.page_num); + if (cfg_req->header.page_type == LEAPRAID_CFG_PT_EXTENDED) + dev_err(&adapter->pdev->dev, + "cfg-req: ext_page_type=0x%02x(%s)\n", + cfg_req->ext_page_type, + leapraid_cfg_ext_page_type_name( + cfg_req->ext_page_type)); + dev_err(&adapter->pdev->dev, "cfg-req: page_addr=0x%08x\n", + le32_to_cpu(cfg_req->page_addr)); + break; + } + case LEAPRAID_FUNC_SCSI_TMF: { + const struct leapraid_scsi_tm_req *tm_req = req_data; + + dev_err(&adapter->pdev->dev, + "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + tm_req->task_type, + leapraid_tm_type_name(tm_req->task_type)); + dev_err(&adapter->pdev->dev, + "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + le16_to_cpu(tm_req->dev_hdl), + le16_to_cpu(tm_req->task_mid)); + break; + } + case LEAPRAID_FUNC_SCSI_ENC_PROCESSOR: { + const struct leapraid_sep_req *sep_req = req_data; + + dev_err(&adapter->pdev->dev, + "sep: func=0x%02x(%s) act=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + sep_req->act, + leapraid_sep_action_name(sep_req->act)); + dev_err(&adapter->pdev->dev, + "sep: dev_hdl=0x%04x slot=%u enc_hdl=0x%04x\n", + le16_to_cpu(sep_req->dev_hdl), + le16_to_cpu(sep_req->slot), + le16_to_cpu(sep_req->enc_hdl)); + break; + } + case LEAPRAID_FUNC_SAS_IO_UNIT_CTRL: { + const struct leapraid_io_unit_ctrl_req *io_req = req_data; + + dev_err(&adapter->pdev->dev, + "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", + req->func, leapraid_func_name(req->func), + io_req->op, leapraid_sas_op_name(io_req->op)); + dev_err(&adapter->pdev->dev, + "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + le16_to_cpu(io_req->dev_hdl), + io_req->adapter_para, + leapraid_io_param_name(io_req->adapter_para)); + break; + } + case LEAPRAID_FUNC_SMP_PASSTHROUGH: { + const struct leapraid_smp_passthrough_req *smp_req = req_data; + + dev_err(&adapter->pdev->dev, + "transport: func=0x%02x(%s) port=%u req_len=%u\n", + req->func, leapraid_func_name(req->func), + smp_req->physical_port, + le16_to_cpu(smp_req->req_data_len)); + dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + (unsigned long long)le64_to_cpu(smp_req->sas_address)); + break; + } + default: + dev_err(&adapter->pdev->dev, + "%s: func=0x%02x(%s)\n", + __func__, req->func, leapraid_func_name(req->func)); + break; + } +} + +static void leapraid_build_and_fire_cfg_req( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); - memset((void *)(&adapter->driver_cmds.cfg_op_cmd.reply), 0, + memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc(adapter, + local_leap_cfg_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.cfg_op_cmd.inter_taskid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); @@ -1614,17 +2068,18 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { rc = -EFAULT; - goto out; + goto out_cleanup; } dev_warn(&adapter->pdev->dev, - "cfg-req: retry request, cnt=%u\n", retry_cnt); + "cfg-req: Retry request, cnt=%u\n", retry_cnt); } - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: adapter not operational\n"); - goto out; + "cfg-req: Adapter not operational\n"); + goto out_cleanup; } leapraid_build_and_fire_cfg_req(adapter, leap_mpi_cfgp_req, @@ -1634,44 +2089,47 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_RESET) { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg due to hard reset\n"); + "cfg-req: CMD fail due to hard reset\n"); goto retry; } if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { dev_err(&adapter->pdev->dev, - "cfg-req: cmd not done during %s, skip reset\n", + "cfg-req: pending in %s, status=0x%x\n", adapter->access_ctrl.shost_recovering ? - "shost recovery" : "pcie recovery"); + "shost recovery" : "pcie recovery", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, - "cfg-req: cmd timeout, issuing hard reset\n"); + "cfg-req: timeout, status=0x%x, reset\n", + adapter->driver_cmds.cfg_op_cmd.status); + leapraid_log_req_context(adapter, leap_mpi_cfgp_req); issue_reset = true; } - goto out; + goto out_cleanup; } if (adapter->driver_cmds.cfg_op_cmd.status & LEAPRAID_CMD_REPLY_VALID) { memcpy(leap_mpi_cfgp_rep, - (void *)(&adapter->driver_cmds.cfg_op_cmd.reply), + &adapter->driver_cmds.cfg_op_cmd.reply, sizeof(struct leapraid_cfg_rep)); adapter_status = le16_to_cpu( leap_mpi_cfgp_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS) { - if (target_cfg_pg && real_cfg_pg_addr && - target_real_cfg_pg_sz) - if (leap_mpi_cfgp_req->action == - LEAPRAID_CFG_ACT_PAGE_READ_CUR) - memcpy(target_cfg_pg, - real_cfg_pg_addr, - target_real_cfg_pg_sz); - } else { + if (adapter_status == LEAPRAID_ADAPTER_STATUS_SUCCESS && + target_cfg_pg && real_cfg_pg_addr && + target_real_cfg_pg_sz && + leap_mpi_cfgp_req->action == + LEAPRAID_CFG_ACT_PAGE_READ_CUR) + memcpy(target_cfg_pg, real_cfg_pg_addr, + target_real_cfg_pg_sz); + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { if (adapter_status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, @@ -1680,30 +2138,30 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, rc = -EFAULT; } } else { - dev_err(&adapter->pdev->dev, "cfg-rep: reply invalid\n"); + dev_err(&adapter->pdev->dev, "cfg-rep: Reply invalid\n"); rc = -EFAULT; } -out: +out_cleanup: adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { dev_info(&adapter->pdev->dev, - "%s:%d cfg-req: failure, issuing reset\n", + "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = -EFAULT; } else { dev_warn(&adapter->pdev->dev, - "cfg-req: cmd gg during init, skip reset\n"); - rc = -EFAULT; + "cfg-req: CMD fail in init, skip reset\n"); } + rc = -EFAULT; } return rc; } -static int leapraid_request_cfg_pg_header(struct leapraid_adapter *adapter, +static int leapraid_request_cfg_pg_header( + struct leapraid_adapter *adapter, struct leapraid_cfg_req *leap_mpi_cfgp_req, struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { @@ -1729,8 +2187,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, { struct leapraid_cfg_req leap_mpi_cfgp_req; struct leapraid_cfg_rep leap_mpi_cfgp_rep; - u16 real_cfg_pg_sz = 0; - void *real_cfg_pg_addr = NULL; + u16 real_cfg_pg_sz; + void *real_cfg_pg_addr; dma_addr_t real_cfg_pg_dma = 0; u32 __page_size; int rc; @@ -1752,6 +2210,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, LEAPRAID_CFG_PAGE_NUM_BIOS2; __page_size = sizeof(struct leapraid_bios_page2); break; + case GET_MANUFACTURING_PG0: + leap_mpi_cfgp_req.header.page_type = + LEAPRAID_CFG_PT_MANUFACTURING; + leap_mpi_cfgp_req.header.page_num = + LEAPRAID_CFG_PAGE_NUM_MANU0; + __page_size = sizeof(struct leapraid_manufacturing_p0); + break; case GET_SAS_DEVICE_PG0: leap_mpi_cfgp_req.header.page_type = LEAPRAID_CFG_PT_EXTENDED; leap_mpi_cfgp_req.ext_page_type = LEAPRAID_CFG_EXTPT_SAS_DEV; @@ -1818,9 +2283,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, break; default: dev_err(&adapter->pdev->dev, - "unsupported config page action=%d!\n", cfg_op); - rc = -EINVAL; - goto out; + "Unsupported config page action=%d!\n", cfg_op); + return -EINVAL; } leapraid_build_nodata_mpi_sg(adapter, @@ -1830,8 +2294,8 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, &leap_mpi_cfgp_rep); if (rc) { dev_err(&adapter->pdev->dev, - "cfg-req: header failed rc=%dn", rc); - goto out; + "cfg-req: Header failed rc=%dn", rc); + return rc; } if (cfg_op == GET_SAS_DEVICE_PG0 || @@ -1867,17 +2331,14 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, leap_mpi_cfgp_req.ext_page_type = leap_mpi_cfgp_rep.ext_page_type; real_cfg_pg_sz = (leap_mpi_cfgp_req.header.page_len) ? - leap_mpi_cfgp_req.header.page_len * 4 : - le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * 4; + leap_mpi_cfgp_req.header.page_len * sizeof(u32) : + le16_to_cpu(leap_mpi_cfgp_rep.ext_page_len) * sizeof(u32); real_cfg_pg_addr = dma_alloc_coherent(&adapter->pdev->dev, real_cfg_pg_sz, &real_cfg_pg_dma, GFP_KERNEL); - if (!real_cfg_pg_addr) { - dev_err(&adapter->pdev->dev, "cfg-req: dma alloc failed\n"); - rc = -ENOMEM; - goto out; - } + if (!real_cfg_pg_addr) + return -ENOMEM; if (leap_mpi_cfgp_req.action == LEAPRAID_CFG_ACT_PAGE_WRITE_CUR) { leapraid_single_mpi_sg_append(adapter, @@ -1914,12 +2375,11 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_addr, min_t(u16, real_cfg_pg_sz, __page_size)); if (rc) { - u32 adapter_status; + u32 status; - adapter_status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != - LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) + status = le16_to_cpu(leap_mpi_cfgp_rep.adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (status != LEAPRAID_ADAPTER_STATUS_CONFIG_INVALID_PAGE) dev_err(&adapter->pdev->dev, "cfg-req: rc=%d, pg_info: 0x%x, 0x%x, %d\n", rc, leap_mpi_cfgp_req.header.page_type, @@ -1932,10 +2392,52 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, real_cfg_pg_sz, real_cfg_pg_addr, real_cfg_pg_dma); -out: + return rc; } +static int leapraid_cfg_find_vol_in_page( + struct leapraid_raid_cfg_p0 *raid_cfg_p0, + u16 pd_hdl, u16 *vol_hdl) +{ + u16 elements = raid_cfg_p0->elements_num; + int i; + + for (i = 0; i < elements; i++) { + struct leapraid_raid_cfg_p0_element *elem; + u16 type; + + elem = &raid_cfg_p0->cfg_element[i]; + + type = le16_to_cpu(elem->element_flg) & + LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; + + switch (type) { + case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: + case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: { + u16 phys_hdl; + + phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); + + if (phys_hdl == pd_hdl) { + *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); + return 0; + } + break; + } + + case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: + *vol_hdl = 0; + return 0; + + default: + break; + } + } + + return -ENOENT; +} + static int leapraid_cfg_get_volume_hdl_dispatch( struct leapraid_adapter *adapter, struct leapraid_cfg_req *cfg_req, @@ -1946,13 +2448,11 @@ static int leapraid_cfg_get_volume_hdl_dispatch( u16 raid_cfg_p0_sz, u16 pd_hdl, u16 *vol_hdl) { - u16 phys_disk_dev_hdl; u16 adapter_status; - u16 element_type; int config_num; - int rc, i; + int rc; - config_num = 0xff; + config_num = 0xFF; while (true) { cfg_req->page_addr = cpu_to_le32(config_num + @@ -1973,35 +2473,14 @@ static int leapraid_cfg_get_volume_hdl_dispatch( } if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - return -1; - - for (i = 0; i < raid_cfg_p0->elements_num; i++) { - element_type = - le16_to_cpu(raid_cfg_p0->cfg_element[i].element_flg) & - LEAPRAID_RAIDCFG_P0_EFLG_MASK_ELEMENT_TYPE; - - switch (element_type) { - case LEAPRAID_RAIDCFG_P0_EFLG_VOL_PHYS_DISK_ELEMENT: - case LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT: - phys_disk_dev_hdl = - le16_to_cpu(raid_cfg_p0->cfg_element[i] - .phys_disk_dev_hdl); - if (phys_disk_dev_hdl == pd_hdl) { - *vol_hdl = - le16_to_cpu - (raid_cfg_p0->cfg_element[i] - .vol_dev_hdl); - return 0; - } - break; + return LEAPRAID_OPERATION_FAILED; + + rc = leapraid_cfg_find_vol_in_page(raid_cfg_p0, + pd_hdl, + vol_hdl); + if (rc != -ENOENT) + return rc; - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: - *vol_hdl = 0; - return 0; - default: - break; - } - } config_num = raid_cfg_p0->cfg_num; } return 0; @@ -2010,12 +2489,12 @@ static int leapraid_cfg_get_volume_hdl_dispatch( int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, u16 pd_hdl, u16 *vol_hdl) { - struct leapraid_raid_cfg_p0 *raid_cfg_p0 = NULL; + struct leapraid_raid_cfg_p0 *raid_cfg_p0; struct leapraid_cfg_req cfg_req; struct leapraid_cfg_rep cfg_rep; dma_addr_t real_cfg_pg_dma = 0; - void *real_cfg_pg_addr = NULL; - u16 real_cfg_pg_sz = 0; + void *real_cfg_pg_addr; + u16 real_cfg_pg_sz; int rc, raid_cfg_p0_sz; *vol_hdl = 0; @@ -2029,16 +2508,14 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, leapraid_build_nodata_mpi_sg(adapter, &cfg_req.page_buf_sge); rc = leapraid_request_cfg_pg_header(adapter, &cfg_req, &cfg_rep); if (rc) - goto out; + return rc; cfg_req.action = LEAPRAID_CFG_ACT_PAGE_READ_CUR; raid_cfg_p0_sz = le16_to_cpu(cfg_rep.ext_page_len) * LEAPRAID_CFG_UNIT_SIZE; raid_cfg_p0 = kmalloc(raid_cfg_p0_sz, GFP_KERNEL); - if (!raid_cfg_p0) { - rc = -1; - goto out; - } + if (!raid_cfg_p0) + return -ENOMEM; real_cfg_pg_sz = (cfg_req.header.page_len) ? cfg_req.header.page_len * LEAPRAID_CFG_UNIT_SIZE : @@ -2049,7 +2526,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, GFP_KERNEL); if (!real_cfg_pg_addr) { rc = -ENOMEM; - goto out; + goto out_free; } memset(raid_cfg_p0, 0, raid_cfg_p0_sz); @@ -2073,7 +2550,7 @@ int leapraid_cfg_get_volume_hdl(struct leapraid_adapter *adapter, raid_cfg_p0_sz, pd_hdl, vol_hdl); -out: +out_free: if (real_cfg_pg_addr) dma_free_coherent(&adapter->pdev->dev, real_cfg_pg_sz, real_cfg_pg_addr, @@ -2088,7 +2565,7 @@ static int leapraid_get_adapter_phys(struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 sas_io_unit_page0; union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - int rc = 0; + int rc; *nr_phys = 0; cfgp1.size = sizeof(struct leapraid_sas_io_unit_p0); @@ -2141,7 +2618,8 @@ int leapraid_cfg_get_volume_wwid(struct leapraid_adapter *adapter, return rc; } -static int leapraid_get_sas_io_unit_page0(struct leapraid_adapter *adapter, +static int leapraid_get_sas_io_unit_page0( + struct leapraid_adapter *adapter, struct leapraid_sas_io_unit_p0 *sas_io_unit_p0, u16 sas_iou_pg0_sz) { @@ -2163,8 +2641,8 @@ static int leapraid_get_sas_address(struct leapraid_adapter *adapter, *sas_address = 0; cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; if (hdl <= adapter->dev_topo.card.phys_num && @@ -2186,9 +2664,10 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raidpd_p0 raidpd_p0; u8 num_pds; u16 sz; + int rc = 0; - if ((leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, - &num_pds)) || !num_pds) + if (leapraid_cfg_get_number_pds(adapter, raid_volume->hdl, + &num_pds) || !num_pds) return -EFAULT; raid_volume->pd_num = num_pds; @@ -2196,14 +2675,14 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, (num_pds * sizeof(struct leapraid_raidvol0_phys_disk)); raidvol_p0 = kzalloc(sz, GFP_KERNEL); if (!raidvol_p0) - return -EFAULT; + return -ENOMEM; cfgp1.size = sz; cfgp2.handle = raid_volume->hdl; - if ((leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, - GET_RAID_VOLUME_PG0))) { - kfree(raidvol_p0); - return -EFAULT; + if (leapraid_op_config_page(adapter, raidvol_p0, cfgp1, cfgp2, + GET_RAID_VOLUME_PG0)) { + rc = -EFAULT; + goto out_cleanup; } raid_volume->vol_type = raidvol_p0->volume_type; @@ -2214,14 +2693,28 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = le16_to_cpu(raidpd_p0.dev_hdl); if (!(leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) { + cfgp2, GET_SAS_DEVICE_PG0))) raid_volume->dev_info = le32_to_cpu(sas_dev_p0.dev_info); - } } +out_cleanup: kfree(raidvol_p0); - return 0; + return rc; +} + +static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter) +{ + unsigned long flags; + bool skip; + + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + skip = adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.pcie_recovering || + adapter->access_ctrl.host_removing; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + + return skip; } static void leapraid_fw_log_work(struct work_struct *work) @@ -2229,26 +2722,34 @@ static void leapraid_fw_log_work(struct work_struct *work) struct leapraid_adapter *adapter = container_of(work, struct leapraid_adapter, fw_log_desc.fw_log_work.work); struct leapraid_fw_log_info *infom; + struct leapraid_reg_base __iomem *iomem_base; unsigned long flags; - infom = (struct leapraid_fw_log_info *)(adapter->fw_log_desc.fw_log_buffer + - LEAPRAID_SYS_LOG_BUF_SIZE); + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + infom = (struct leapraid_fw_log_info *) + (adapter->fw_log_desc.fw_log_buffer + + LEAPRAID_SYS_LOG_BUF_SIZE); + iomem_base = adapter->iomem_base; if (adapter->fw_log_desc.fw_log_init_flag == 0) { infom->user_position = - leapraid_readl(&adapter->iomem_base->host_log_buf_pos); + leapraid_readl(&iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); adapter->fw_log_desc.fw_log_init_flag++; } - writel(infom->user_position, &adapter->iomem_base->host_log_buf_pos); + writel(infom->user_position, &iomem_base->host_log_buf_pos); infom->adapter_position = - leapraid_readl(&adapter->iomem_base->adapter_log_buf_pos); + leapraid_readl(&iomem_base->adapter_log_buf_pos); +scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2267,7 +2768,8 @@ void leapraid_fw_log_stop(struct leapraid_adapter *adapter) adapter->fw_log_desc.fw_log_wq = NULL; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); if (wq) { - if (!cancel_delayed_work_sync(&adapter->fw_log_desc.fw_log_work)) + if (!cancel_delayed_work_sync(&adapter->fw_log_desc + .fw_log_work)) flush_workqueue(wq); destroy_workqueue(wq); } @@ -2297,7 +2799,8 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->fw_log_desc.fw_log_wq) - queue_delayed_work(adapter->fw_log_desc.fw_log_wq, + queue_delayed_work( + adapter->fw_log_desc.fw_log_wq, &adapter->fw_log_desc.fw_log_work, msecs_to_jiffies(LEAPRAID_PCIE_LOG_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2308,12 +2811,13 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; ktime_t current_time; bool issue_reset = false; - u64 time_stamp = 0; + u64 time_stamp; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; io_unit_ctrl_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; @@ -2328,18 +2832,27 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - wait_for_completion_timeout(&adapter->driver_cmds.timestamp_sync_cmd.done, + leapraid_fire_task( + adapter, + adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_debug_log_info(adapter); + wait_for_completion_timeout(&adapter->driver_cmds + .timestamp_sync_cmd.done, LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) + LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: timestamp sync timeout, status=0x%x\n", + __func__, + adapter->driver_cmds.timestamp_sync_cmd.status); + leapraid_log_req_context(adapter, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); + } if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } @@ -2348,20 +2861,6 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); } -static bool leapraid_should_skip_fault_check(struct leapraid_adapter *adapter) -{ - unsigned long flags; - bool skip; - - spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - skip = adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.host_removing; - spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); - - return skip; -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2372,16 +2871,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter = container_of(work, struct leapraid_adapter, reset_desc.fault_reset_work.work); - if (leapraid_should_skip_fault_check(adapter)) + if (leapraid_should_skip_poll_work(adapter)) goto scheduled_timer; adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: hard reset: %s\n", - __func__, (rc == 0) ? "success" : "failed"); + dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", + __func__, rc == 0 ? "success" : "failed"); adapter_state = leapraid_get_adapter_state(adapter); if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) @@ -2397,7 +2896,8 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) scheduled_timer: spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); @@ -2422,14 +2922,15 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) adapter->reset_desc.fault_reset_wq_name); if (!adapter->reset_desc.fault_reset_wq) { dev_err(&adapter->pdev->dev, - "create single thread workqueue failed!\n"); + "Create single thread workqueue failed!\n"); return; } spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); if (adapter->reset_desc.fault_reset_wq) - queue_delayed_work(adapter->reset_desc.fault_reset_wq, - &adapter->reset_desc.fault_reset_work, + queue_delayed_work( + adapter->reset_desc.fault_reset_wq, + &adapter->reset_desc.fault_reset_work, msecs_to_jiffies(LEAPRAID_FAULT_POLLING_INTERVAL)); spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } @@ -2456,17 +2957,24 @@ static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, u16 hdl) { if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) - return false; - - if (leapraid_check_adapter_is_op(adapter)) + adapter->access_ctrl.shost_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", + __func__, + adapter->access_ctrl.pcie_recovering, + adapter->access_ctrl.shost_recovering); return false; + } - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) return false; - if (test_bit(hdl, (unsigned long *)adapter->dev_topo.dev_removing)) + if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { + dev_err(&adapter->pdev->dev, + "%s: Device handle is invalid\n", __func__); return false; + } return true; } @@ -2475,13 +2983,13 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, struct leapraid_scsi_cmd_desc *cmd_desc) { struct scsi_device *sdev; + struct scsi_device *target_sdev = NULL; struct leapraid_sdev_priv *sdev_priv; struct scsi_cmnd *scmd; void *dma_buffer = NULL; - dma_addr_t dma_addr = 0; - u8 sdev_flg = 0; + dma_addr_t dma_addr; bool issue_reset = false; - int rc = 0; + int rc; if (WARN_ON(!adapter->driver_cmds.internal_scmd)) return -EINVAL; @@ -2492,23 +3000,28 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); if (adapter->driver_cmds.driver_scsiio_cmd.status != LEAPRAID_CMD_NOT_USED) { + dev_err(&adapter->pdev->dev, + "%s: scsiio cmd busy\n", __func__); rc = -EAGAIN; - goto out; + goto out_cleanup; } adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; + if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && sdev_priv->lun == cmd_desc->lun) { - sdev_flg = 1; + target_sdev = sdev; break; } } - if (!sdev_flg) { + if (!target_sdev) { + dev_warn(&adapter->pdev->dev, + "%s: Device not found\n", __func__); rc = -ENXIO; - goto out; + goto out_cleanup; } if (cmd_desc->data_length) { @@ -2517,7 +3030,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, &dma_addr, GFP_ATOMIC); if (!dma_buffer) { rc = -ENOMEM; - goto out; + goto out_cleanup; } if (cmd_desc->dir == DMA_TO_DEVICE) memcpy(dma_buffer, cmd_desc->data_buffer, @@ -2525,7 +3038,7 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, } scmd = adapter->driver_cmds.internal_scmd; - scmd->device = sdev; + scmd->device = target_sdev; scmd->cmd_len = cmd_desc->cdb_length; memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); scmd->sc_data_direction = cmd_desc->dir; @@ -2538,11 +3051,14 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, adapter->driver_cmds.driver_scsiio_cmd.status &= ~LEAPRAID_CMD_PENDING; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); + dev_err(&adapter->pdev->dev, + "%s: queuecommand failed\n", __func__); rc = -EINVAL; - goto out; + goto out_cleanup; } - wait_for_completion_timeout(&adapter->driver_cmds.driver_scsiio_cmd.done, + wait_for_completion_timeout(&adapter->driver_cmds + .driver_scsiio_cmd.done, cmd_desc->time_out * HZ); if (!(adapter->driver_cmds.driver_scsiio_cmd.status & @@ -2564,15 +3080,22 @@ static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, rc = -ENODATA; dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", cmd_desc->hdl); - leapraid_issue_locked_tm(adapter, cmd_desc->hdl, 0, 0, 0, + leapraid_issue_locked_tm( + adapter, cmd_desc->hdl, 0, 0, 0, LEAPRAID_TM_TASKTYPE_TARGET_RESET, adapter->driver_cmds.driver_scsiio_cmd.taskid, LEAPRAID_TM_MSGFLAGS_LINK_RESET); } -out: +out_cleanup: + if (target_sdev) + scsi_device_put(target_sdev); + if (dma_buffer) dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, dma_buffer, dma_addr); + cmd_desc->data_length, + dma_buffer, + dma_addr); + adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); return rc; @@ -2582,7 +3105,8 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, u16 hdl, u32 lun) { struct leapraid_scsi_cmd_desc *desc; - int rc = 0; + char *buf; + int rc; desc = kzalloc(sizeof(*desc), GFP_KERNEL); if (!desc) @@ -2596,7 +3120,7 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, desc->cdb[0] = LOG_SENSE; desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; desc->cdb[8] = desc->data_length; - desc->raid_member = false; + desc->raid_member = 0; desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); @@ -2606,11 +3130,10 @@ static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, } rc = leapraid_dispatch_scsi_io(adapter, desc); - if (!rc) { - if (((char *)desc->data_buffer)[8] == - LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - } + buf = desc->data_buffer; + + if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) + leapraid_smart_fault_detect(adapter, hdl); kfree(desc->data_buffer); kfree(desc); @@ -2622,31 +3145,32 @@ static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, struct leapraid_sdev_priv *sdev_priv, u32 reset_flg) { - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; if (!sdev_priv || !sdev_priv->starget_priv->card_port) - goto out; + return false; - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev || !sas_dev->support_smart) - goto out; + goto out_fail; if (reset_flg) - sas_dev->led_on = false; + sas_dev->led_on = 0; else if (sas_dev->led_on) - goto out; + goto out_fail; - if ((sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) || + if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || sdev_priv->block) - goto out; + goto out_fail; leapraid_sdev_put(sas_dev); return true; -out: +out_fail: if (sas_dev) leapraid_sdev_put(sas_dev); return false; @@ -2659,16 +3183,21 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) smart_poll_desc.smart_poll_work.work); struct scsi_device *sdev; struct leapraid_sdev_priv *sdev_priv; - static u32 reset_cnt; bool reset_flg = false; - if (leapraid_check_adapter_is_op(adapter)) - goto out; + if (leapraid_should_skip_poll_work(adapter)) + goto scheduled_timer; + + if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__)) + goto scheduled_timer; + + if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) + reset_flg = true; - reset_flg = (reset_cnt < adapter->reset_desc.reset_cnt); - reset_cnt = adapter->reset_desc.reset_cnt; + adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - __shost_for_each_device(sdev, adapter->shost) { + shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) leapraid_dispatch_logsense(adapter, @@ -2676,11 +3205,12 @@ static void leapraid_sata_smart_poll_work(struct work_struct *work) sdev_priv->lun); } -out: +scheduled_timer: if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); + queue_delayed_work( + adapter->smart_poll_desc.smart_poll_wq, + &adapter->smart_poll_desc.smart_poll_work, + msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); } void leapraid_smart_polling_start(struct leapraid_adapter *adapter) @@ -2709,20 +3239,118 @@ void leapraid_smart_polling_start(struct leapraid_adapter *adapter) void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) { struct workqueue_struct *wq; + struct leapraid_smart_poll_desc *desc; - if (!adapter->smart_poll_desc.smart_poll_wq) + desc = &adapter->smart_poll_desc; + if (!desc->smart_poll_wq) return; - wq = adapter->smart_poll_desc.smart_poll_wq; - adapter->smart_poll_desc.smart_poll_wq = NULL; + wq = desc->smart_poll_wq; + desc->smart_poll_wq = NULL; if (wq) { - if (!cancel_delayed_work_sync(&adapter->smart_poll_desc.smart_poll_work)) + if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); destroy_workqueue(wq); } } +static void leapraid_overheat_work(struct work_struct *work) +{ + struct leapraid_overheat_desc *desc; + struct leapraid_adapter *adapter; + struct workqueue_struct *wq; + struct Scsi_Host *shost; + struct pci_dev *pdev; + unsigned long flags; + + desc = container_of(work, struct leapraid_overheat_desc, + fault_overheat_work); + adapter = container_of(desc, struct leapraid_adapter, overheat_desc); + pdev = adapter->pdev; + shost = pci_get_drvdata(pdev); + + if (!shost) { + dev_err(&pdev->dev, + "Overheat processing failed: invalid host/adapter\n"); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + if (adapter->access_ctrl.host_removing) { + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + return; + } + + adapter->access_ctrl.host_removing = 1; + adapter->access_ctrl.shost_recover_async = 0; + adapter->scan_dev_desc.scan_start = 0; + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + wake_up(&adapter->access_ctrl.shost_recover_wq); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + + leapraid_mask_int(adapter); + + leapraid_smart_polling_stop(adapter); + leapraid_check_scheduled_fault_stop(adapter); + leapraid_fw_log_stop(adapter); + leapraid_mq_polling_pause(adapter); + + leapraid_clean_active_cmds(adapter); + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + wq = adapter->fw_evt_s.fw_evt_thread; + adapter->fw_evt_s.fw_evt_thread = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (wq) + destroy_workqueue(wq); + + sas_remove_host(shost); + leapraid_cleanup_lists(adapter); + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + dev_err(&pdev->dev, "%s: Suspend adapter due to overheat\n", __func__); +} + +static void leapraid_overheat_init(struct leapraid_adapter *adapter) +{ + if (adapter->overheat_desc.fault_overheat_wq) + return; + + atomic_set(&adapter->overheat_desc.thermal_alert, 0); + snprintf(adapter->overheat_desc.fault_overheat_wq_name, + sizeof(adapter->overheat_desc.fault_overheat_wq_name), + "driver_%s%u_overheat", + LEAPRAID_DRIVER_NAME, + adapter->adapter_attr.id); + adapter->overheat_desc.fault_overheat_wq = + create_singlethread_workqueue( + adapter->overheat_desc.fault_overheat_wq_name); + if (!adapter->overheat_desc.fault_overheat_wq) { + dev_err(&adapter->pdev->dev, + "Failed to create overheat workqueue\n"); + return; + } + + INIT_WORK(&adapter->overheat_desc.fault_overheat_work, + leapraid_overheat_work); +} + +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter) +{ + struct workqueue_struct *wq; + + wq = xchg(&adapter->overheat_desc.fault_overheat_wq, NULL); + if (!wq) + return; + + cancel_work_sync(&adapter->overheat_desc.fault_overheat_work); + destroy_workqueue(wq); +} + static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt); @@ -2807,7 +3435,6 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( fw_evt = list_first_entry(&adapter->fw_evt_s.fw_evt_list, struct leapraid_fw_evt_work, list); list_del_init(&fw_evt->list); - leapraid_fw_evt_put(fw_evt); } spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return fw_evt; @@ -2816,56 +3443,65 @@ static struct leapraid_fw_evt_work *leapraid_next_fw_evt( void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) { struct leapraid_fw_evt_work *fw_evt; - bool rc = false; + unsigned long flags; + bool in_fw_evt_context; + bool rc; if ((list_empty(&adapter->fw_evt_s.fw_evt_list) && !adapter->fw_evt_s.cur_evt) || !adapter->fw_evt_s.fw_evt_thread) return; adapter->fw_evt_s.fw_evt_cleanup = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; - while ((fw_evt = leapraid_next_fw_evt(adapter)) || - (fw_evt = adapter->fw_evt_s.cur_evt)) { - if (fw_evt == adapter->fw_evt_s.cur_evt && - adapter->fw_evt_s.cur_evt->evt_type != - LEAPRAID_EVT_REMOVE_DEAD_DEV) { - adapter->fw_evt_s.cur_evt = NULL; - continue; - } - + while ((fw_evt = leapraid_next_fw_evt(adapter))) { rc = cancel_work_sync(&fw_evt->work); - if (rc) leapraid_fw_evt_put(fw_evt); + leapraid_fw_evt_put(fw_evt); } + + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + fw_evt = adapter->fw_evt_s.cur_evt; + if (fw_evt) { + in_fw_evt_context = adapter->fw_evt_s.cur_evt_task == current; + leapraid_fw_evt_get(fw_evt); + } + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); + if (fw_evt) { + if (!in_fw_evt_context) + cancel_work_sync(&fw_evt->work); + leapraid_fw_evt_put(fw_evt); + } + adapter->fw_evt_s.fw_evt_cleanup = 0; } static void leapraid_internal_dev_ublk(struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: now internal unblkg dev\n", + "hdl 0x%04x: Now internal unblkg dev\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc == -EINVAL) { sdev_printk(KERN_WARNING, sdev, "hdl 0x%04x: unblkg failed, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc) sdev_printk(KERN_WARNING, sdev, - "hdl 0x%04x: blkg failed: earlier unblkg err, rc=%d\n", + "hdl 0x%04x: Earlier ublkg err, rc=%d\n", sdev_priv->starget_priv->hdl, rc); - sdev_priv->block = false; + sdev_priv->block = 0; rc = scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); if (rc) sdev_printk(KERN_WARNING, sdev, @@ -2874,38 +3510,6 @@ static void leapraid_internal_dev_ublk(struct scsi_device *sdev, } } -static void leapraid_internal_ublk_io_dev_to_running(struct scsi_device *sdev) -{ - struct leapraid_sdev_priv *sdev_priv; - - sdev_priv = sdev->hostdata; - sdev_priv->block = false; - scsi_internal_device_unblock_nowait(sdev, SDEV_RUNNING); - sdev_printk(KERN_WARNING, sdev, "%s: ublk hdl 0x%04x\n", - __func__, sdev_priv->starget_priv->hdl); -} - -static void leapraid_ublk_io_dev_to_running( - struct leapraid_adapter *adapter, u64 sas_addr, - struct leapraid_card_port *card_port) -{ - struct leapraid_sdev_priv *sdev_priv; - struct scsi_device *sdev; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->sas_address != sas_addr || - sdev_priv->starget_priv->card_port != card_port) - continue; - - if (sdev_priv->block) - leapraid_internal_ublk_io_dev_to_running(sdev); - } -} - static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, u64 sas_addr, struct leapraid_card_port *card_port) @@ -2957,15 +3561,15 @@ static void leapraid_ublk_io_all_dev(struct leapraid_adapter *adapter) } } -static void __maybe_unused leapraid_internal_dev_blk( +static void leapraid_internal_dev_blk( struct scsi_device *sdev, struct leapraid_sdev_priv *sdev_priv) { - int rc = 0; + int rc; - sdev_printk(KERN_INFO, sdev, "internal blkg hdl 0x%04x\n", + sdev_printk(KERN_INFO, sdev, "Internal blkg hdl 0x%04x\n", sdev_priv->starget_priv->hdl); - sdev_priv->block = true; + sdev_priv->block = 1; rc = scsi_internal_device_block_nowait(sdev); if (rc == -EINVAL) sdev_printk(KERN_WARNING, sdev, @@ -2973,42 +3577,6 @@ static void __maybe_unused leapraid_internal_dev_blk( rc, sdev_priv->starget_priv->hdl); } -static void __maybe_unused leapraid_blkio_dev(struct leapraid_adapter *adapter, - u16 hdl) -{ - struct leapraid_sdev_priv *sdev_priv; - struct leapraid_sas_dev *sas_dev; - struct scsi_device *sdev; - - sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (!sdev_priv) - continue; - - if (sdev_priv->starget_priv->hdl != hdl) - continue; - - if (sdev_priv->block) - continue; - - if (sas_dev && sas_dev->pend_sas_rphy_add) - continue; - - if (sdev_priv->sep) { - sdev_printk(KERN_INFO, sdev, - "sep hdl 0x%04x skip blkg\n", - sdev_priv->starget_priv->hdl); - continue; - } - - leapraid_internal_dev_blk(sdev, sdev_priv); - } - - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { @@ -3040,8 +3608,7 @@ static void leapraid_imm_blkio_to_end_dev(struct leapraid_adapter *adapter, if (sdev_priv->sep) { sdev_printk(KERN_INFO, sdev, - "%s skip dev blk for sep hdl 0x%04x\n", - __func__, + "skip dev blk: sep hdl 0x%04x\n", sdev_priv->starget_priv->hdl); continue; } @@ -3062,10 +3629,8 @@ static void leapraid_imm_blkio_set_end_dev_blk_hdls( list_for_each_entry(sas_port, &topo_node_exp->sas_port_list, port_list) { - if (sas_port->remote_identify.device_type == - SAS_END_DEVICE) { + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) leapraid_imm_blkio_to_end_dev(adapter, sas_port); - } } } @@ -3087,7 +3652,7 @@ static void leapraid_imm_blkio_to_sib_exp( sas_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) { topo_node_exp_sib = - leapraid_exp_find_by_sas_address( + leapraid_exp_find_by_sas_address( adapter, sas_port->remote_identify.sas_address, sas_port->card_port); @@ -3126,17 +3691,15 @@ static void leapraid_report_sdev_directly(struct leapraid_adapter *adapter, if (!sas_dev->starget) { if (!adapter->scan_dev_desc.driver_loading) { - leapraid_transport_port_remove(adapter, - sas_dev->sas_addr, - sas_dev->parent_sas_addr, - sas_dev->card_port); + leapraid_transport_port_remove( + adapter, + sas_dev->sas_addr, + sas_dev->parent_sas_addr, + sas_dev->card_port); leapraid_sas_dev_remove(adapter, sas_dev); } return; } - - clear_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); } static struct leapraid_sas_dev *leapraid_init_sas_dev( @@ -3147,6 +3710,7 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( { struct leapraid_sas_dev *sas_dev; struct leapraid_enc_node *enc_dev; + unsigned long flags; sas_dev = kzalloc(sizeof(*sas_dev), GFP_KERNEL); if (!sas_dev) @@ -3161,28 +3725,32 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->phy = sas_dev_pg0->phy_num; sas_dev->enc_hdl = le16_to_cpu(sas_dev_pg0->enc_hdl); sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); - sas_dev->port_type = sas_dev_pg0->max_port_connections; + sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; - memcpy(sas_dev->connector_name, sas_dev_pg0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; + memcpy(sas_dev->connector_name, + sas_dev_pg0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = + '\0'; } else { sas_dev->enc_level = 0; sas_dev->connector_name[0] = '\0'; } - if (le16_to_cpu(sas_dev_pg0->enc_hdl)) { - enc_dev = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu(sas_dev_pg0->enc_hdl)); - sas_dev->enc_lid = enc_dev ? - le64_to_cpu(enc_dev->pg0.enc_lid) : 0; + if (sas_dev->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_dev = leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); + if (enc_dev) + sas_dev->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } dev_info(&adapter->pdev->dev, - "add dev: hdl=0x%0x, sas addr=0x%016llx, port_type=0x%0x\n", - hdl, sas_dev->sas_addr, sas_dev->port_type); + "add dev: hdl=0x%x, SAS addr=0x%016llx, port connect=0x%x\n", + hdl, sas_dev->sas_addr, sas_dev->port_connection); return sas_dev; } @@ -3202,15 +3770,14 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, - cfgp1, cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, + cfgp1, cfgp2, GET_SAS_DEVICE_PG0)) return; dev_info = le32_to_cpu(sas_dev_pg0.dev_info); if (!(leapraid_is_end_dev(dev_info))) return; - set_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add); sas_addr = le64_to_cpu(sas_dev_pg0.sas_address); if (!(le16_to_cpu(sas_dev_pg0.flg) & LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) @@ -3223,8 +3790,6 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_get_sas_dev_by_addr(adapter, sas_addr, card_port); if (sas_dev) { - clear_bit(hdl, - (unsigned long *)adapter->dev_topo.pending_dev_add); leapraid_sdev_put(sas_dev); return; } @@ -3239,6 +3804,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) dev_info); if (!sas_dev) return; + if (adapter->scan_dev_desc.wait_scan_dev_done) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); leapraid_sdev_get(sas_dev); @@ -3253,6 +3819,7 @@ static void leapraid_add_dev(struct leapraid_adapter *adapter, u16 hdl) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_report_sdev_directly(adapter, sas_dev); } + leapraid_sdev_put(sas_dev); } static void leapraid_remove_device(struct leapraid_adapter *adapter, @@ -3260,14 +3827,15 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, { struct leapraid_starget_priv *starget_priv; + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); if (sas_dev->led_on) { leapraid_set_led(adapter, sas_dev, false); - sas_dev->led_on = false; + sas_dev->led_on = 0; } if (sas_dev->starget && sas_dev->starget->hostdata) { starget_priv = sas_dev->starget->hostdata; - starget_priv->deleted = true; + starget_priv->deleted = 1; leapraid_ublk_io_dev(adapter, sas_dev->sas_addr, sas_dev->card_port); starget_priv->hdl = LEAPRAID_INVALID_DEV_HANDLE; @@ -3279,12 +3847,13 @@ static void leapraid_remove_device(struct leapraid_adapter *adapter, sas_dev->card_port); dev_info(&adapter->pdev->dev, - "remove dev: hdl=0x%04x, sas addr=0x%016llx\n", + "remove dev: hdl=0x%04x, SAS addr=0x%016llx\n", sas_dev->hdl, (unsigned long long)sas_dev->sas_addr); } -static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapter, - u8 port_id, u8 phy_num) +static struct leapraid_vphy *leapraid_alloc_vphy( + struct leapraid_adapter *adapter, + u8 port_id, u8 phy_num) { struct leapraid_card_port *port; struct leapraid_vphy *vphy; @@ -3296,7 +3865,6 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte vphy = leapraid_get_vphy_by_phy(port, phy_num); if (vphy) return vphy; - vphy = kzalloc(sizeof(*vphy), GFP_KERNEL); if (!vphy) return NULL; @@ -3310,46 +3878,157 @@ static struct leapraid_vphy *leapraid_alloc_vphy(struct leapraid_adapter *adapte return vphy; } -static int leapraid_add_port_to_card_port_list(struct leapraid_adapter *adapter, - u8 port_id, bool refresh) +static int leapraid_add_port_to_card_port_list( + struct leapraid_adapter *adapter, + u8 port_id, bool refresh) { struct leapraid_card_port *card_port; card_port = leapraid_get_port_by_id(adapter, port_id, false); if (card_port) return 0; - card_port = kzalloc(sizeof(*card_port), GFP_KERNEL); if (!card_port) return -ENOMEM; card_port->port_id = port_id; - dev_info(&adapter->pdev->dev, - "port: %d is added to card_port list\n", - card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "port: %d is added to card_port list\n", + card_port->port_id); - if (refresh) - if (adapter->access_ctrl.shost_recovering) - card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; + if (refresh && adapter->access_ctrl.shost_recovering) + card_port->flg = LEAPRAID_CARD_PORT_FLG_NEW; list_add_tail(&card_port->list, &adapter->dev_topo.card_port_list); return 0; } +static int leapraid_add_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + struct leapraid_topo_node *card = &adapter->dev_topo.card; + u8 port_id; + + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return -EINVAL; + + port_id = iou->phy_info[i].port; + + if (leapraid_add_port_to_card_port_list(adapter, port_id, false)) + return -EINVAL; + + if ((le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY) && + ((phy_pg0.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) >= + LEAPRAID_SAS_NEG_LINK_RATE_1_5)) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + card->card_phy[i].phy_id = i; + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + + return 0; +} + +static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, + struct leapraid_sas_io_unit_p0 *iou, + int i) +{ + struct leapraid_topo_node *card = &adapter->dev_topo.card; + struct leapraid_sas_phy_p0 phy_pg0; + union cfg_param_1 cfgp1 = {0}; + union cfg_param_2 cfgp2 = {0}; + u16 attached_hdl; + u32 dev_info; + u8 link_rate; + u8 port_id; + + link_rate = iou->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; + port_id = iou->phy_info[i].port; + if (leapraid_add_port_to_card_port_list(adapter, port_id, true)) + return -EINVAL; + + dev_info = le32_to_cpu(iou->phy_info[i].controller_phy_dev_info); + if (dev_info & LEAPRAID_DEVTYP_SEP && + link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { + cfgp1.phy_number = i; + + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + if (le32_to_cpu(phy_pg0.phy_info) & + LEAPRAID_SAS_PHYINFO_VPHY && + !leapraid_alloc_vphy(adapter, port_id, i)) + return -EINVAL; + + card->card_phy[i].vphy = 1; + } + + card->card_phy[i].hdl = card->hdl; + + attached_hdl = le16_to_cpu(iou->phy_info[i].attached_dev_hdl); + if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; + + card->card_phy[i].card_port = + leapraid_get_port_by_id(adapter, port_id, false); + + if (!card->card_phy[i].phy) { + cfgp1.phy_number = i; + if (leapraid_op_config_page(adapter, &phy_pg0, + cfgp1, cfgp2, GET_PHY_PG0)) + return 0; + + card->card_phy[i].phy_id = i; + + leapraid_transport_add_card_phy(adapter, + &card->card_phy[i], + &phy_pg0, + card->parent_dev); + return 0; + } + + leapraid_transport_update_links(adapter, + card->sas_address, + attached_hdl, + i, + link_rate, + card->card_phy[i].card_port); + + return 0; +} + static void leapraid_sas_host_add(struct leapraid_adapter *adapter, bool refresh) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_phy_p0 phy_pg0; struct leapraid_sas_dev_p0 sas_dev_pg0; struct leapraid_enc_p0 enc_pg0; struct leapraid_sas_io_unit_p0 *sas_iou_pg0; u16 sas_iou_pg0_sz; - u16 attached_hdl; u8 phys_num; - u8 port_id; - u8 link_rate; int i; + int rc; if (!refresh) { if (leapraid_get_adapter_phys(adapter, &phys_num) || !phys_num) @@ -3364,128 +4043,46 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, adapter->dev_topo.card.phys_num = phys_num; } - sas_iou_pg0_sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + - (adapter->dev_topo.card.phys_num * - sizeof(struct leapraid_sas_io_unit0_phy_info)); + sas_iou_pg0_sz = + offsetof(struct leapraid_sas_io_unit_p0, phy_info) + + (adapter->dev_topo.card.phys_num * + sizeof(struct leapraid_sas_io_unit0_phy_info)); sas_iou_pg0 = kzalloc(sas_iou_pg0_sz, GFP_KERNEL); if (!sas_iou_pg0) - goto out; + return; if (leapraid_get_sas_io_unit_page0(adapter, sas_iou_pg0, sas_iou_pg0_sz)) - goto out; + goto out_free; adapter->dev_topo.card.parent_dev = &adapter->shost->shost_gendev; adapter->dev_topo.card.hdl = le16_to_cpu(sas_iou_pg0->phy_info[0].controller_dev_hdl); for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if (!refresh) { /* add */ - cfgp1.phy_number = i; - if (leapraid_op_config_page(adapter, &phy_pg0, cfgp1, - cfgp2, GET_PHY_PG0)) - goto out; - - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - false)) - goto out; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY) && - (phy_pg0.neg_link_rate >> 4) >= - LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - if (!leapraid_alloc_vphy(adapter, port_id, i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - adapter->dev_topo.card.card_phy[i].phy_id = i; - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - leapraid_transport_add_card_phy( - adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, adapter->dev_topo.card.parent_dev); - } else { /* refresh */ - link_rate = sas_iou_pg0->phy_info[i].neg_link_rate >> 4; - port_id = sas_iou_pg0->phy_info[i].port; - if (leapraid_add_port_to_card_port_list(adapter, - port_id, - true)) - goto out; - - if (le32_to_cpu(sas_iou_pg0->phy_info[i] - .controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP && - link_rate >= LEAPRAID_SAS_NEG_LINK_RATE_1_5) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - if ((le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY)) { - if (!leapraid_alloc_vphy(adapter, - port_id, - i)) - goto out; - adapter->dev_topo.card.card_phy[i].vphy = true; - } - } - - adapter->dev_topo.card.card_phy[i].hdl = - adapter->dev_topo.card.hdl; - attached_hdl = - le16_to_cpu(sas_iou_pg0->phy_info[i].attached_dev_hdl); - if (attached_hdl && link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - link_rate = LEAPRAID_SAS_NEG_LINK_RATE_1_5; - - adapter->dev_topo.card.card_phy[i].card_port = - leapraid_get_port_by_id(adapter, - port_id, - false); - if (!adapter->dev_topo.card.card_phy[i].phy) { - cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &phy_pg0, - cfgp1, cfgp2, - GET_PHY_PG0))) - continue; - - adapter->dev_topo.card.card_phy[i].phy_id = i; - leapraid_transport_add_card_phy(adapter, - &adapter->dev_topo.card.card_phy[i], - &phy_pg0, - adapter->dev_topo.card.parent_dev); - continue; - } - - leapraid_transport_update_links(adapter, - adapter->dev_topo.card.sas_address, - attached_hdl, i, link_rate, - adapter->dev_topo.card.card_phy[i].card_port); - } + if (!refresh) /* add */ + rc = leapraid_add_card_phy(adapter, sas_iou_pg0, i); + else /* refresh */ + rc = leapraid_refresh_card_phy(adapter, + sas_iou_pg0, + i); + if (rc) + goto out_free; } if (!refresh) { cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = adapter->dev_topo.card.hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) - goto out; + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) + goto out_free; adapter->dev_topo.card.enc_hdl = le16_to_cpu(sas_dev_pg0.enc_hdl); adapter->dev_topo.card.sas_address = le64_to_cpu(sas_dev_pg0.sas_address); dev_info(&adapter->pdev->dev, - "add host: devhdl=0x%04x, sas addr=0x%016llx, phynums=%d\n", + "add host: hdl=0x%04x, SAS addr=0x%016llx, phy=%d\n", adapter->dev_topo.card.hdl, (unsigned long long)adapter->dev_topo.card.sas_address, adapter->dev_topo.card.phys_num); @@ -3500,7 +4097,7 @@ static void leapraid_sas_host_add(struct leapraid_adapter *adapter, le64_to_cpu(enc_pg0.enc_lid); } } -out: +out_free: kfree(sas_iou_pg0); } @@ -3514,22 +4111,24 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port = NULL; struct leapraid_enc_node *enc_dev; struct leapraid_exp_p1 exp_pg1; - int rc = 0; + int ret; + int rc; unsigned long flags; u8 port_id; u16 parent_handle; - u64 sas_addr_parent = 0; + u64 sas_addr_parent; int i; port_id = exp_pg0->physical_port; parent_handle = le16_to_cpu(exp_pg0->parent_dev_hdl); - if (leapraid_get_sas_address(adapter, parent_handle, &sas_addr_parent)) - return -1; - + rc = leapraid_get_sas_address(adapter, + parent_handle, &sas_addr_parent); + if (rc) + return rc; topo_node_exp = kzalloc(sizeof(*topo_node_exp), GFP_KERNEL); if (!topo_node_exp) - return -1; + return -ENOMEM; topo_node_exp->hdl = hdl; topo_node_exp->phys_num = exp_pg0->phy_num; @@ -3538,17 +4137,19 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->card_port = leapraid_get_port_by_id(adapter, port_id, false); if (!topo_node_exp->card_port) { - rc = -1; + rc = -EPERM; goto out_fail; } dev_info(&adapter->pdev->dev, - "add exp: sas addr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phys=%d\n", + "add exp: saddr=0x%016llx, hdl=0x%04x, phdl=0x%04x, phy=%d\n", (unsigned long long)topo_node_exp->sas_address, hdl, parent_handle, topo_node_exp->phys_num); if (!topo_node_exp->phys_num) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Invalid PHY num from exp_pg0\n", __func__); + rc = -EPERM; goto out_fail; } @@ -3556,7 +4157,10 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, kcalloc(topo_node_exp->phys_num, sizeof(struct leapraid_card_phy), GFP_KERNEL); if (!topo_node_exp->card_phy) { - rc = -1; + dev_err(&adapter->pdev->dev, + "%s: Failed to alloc expander phy array, count=%u\n", + __func__, topo_node_exp->phys_num); + rc = -EPERM; goto out_fail; } @@ -3564,7 +4168,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, sas_port = leapraid_transport_port_add(adapter, hdl, sas_addr_parent, topo_node_exp->card_port); if (!sas_port) { - rc = -1; + rc = -EPERM; goto out_fail; } @@ -3573,31 +4177,38 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1->phy_number = i; cfgp2->handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, - GET_SAS_EXPANDER_PG1))) { - rc = -1; + if (leapraid_op_config_page(adapter, &exp_pg1, *cfgp1, *cfgp2, + GET_SAS_EXPANDER_PG1)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to get exp_pg1, phy=%d\n", + __func__, i); + rc = -EPERM; goto out_fail; } topo_node_exp->card_phy[i].hdl = hdl; topo_node_exp->card_phy[i].phy_id = i; topo_node_exp->card_phy[i].card_port = - leapraid_get_port_by_id(adapter, port_id, false); - if ((leapraid_transport_add_exp_phy(adapter, - &topo_node_exp->card_phy[i], - &exp_pg1, - topo_node_exp->parent_dev))) { - rc = -1; + leapraid_get_port_by_id(adapter, port_id, false); + ret = leapraid_transport_add_exp_phy( + adapter, + &topo_node_exp->card_phy[i], + &exp_pg1, + topo_node_exp->parent_dev); + if (ret) { + rc = -EPERM; goto out_fail; } } if (topo_node_exp->enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); enc_dev = leapraid_enc_find_by_hdl(adapter, topo_node_exp->enc_hdl); if (enc_dev) topo_node_exp->enc_lid = le64_to_cpu(enc_dev->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3611,6 +4222,7 @@ static int leapraid_internal_exp_add(struct leapraid_adapter *adapter, topo_node_exp->sas_address, sas_addr_parent, topo_node_exp->card_port); + kfree(topo_node_exp->card_phy); kfree(topo_node_exp); return rc; } @@ -3622,22 +4234,29 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) struct leapraid_topo_node *topo_node_exp; struct leapraid_exp_p0 exp_pg0; u16 parent_handle; - u64 sas_addr, sas_addr_parent = 0; + u64 sas_addr, sas_addr_parent; unsigned long flags; u8 port_id; - int rc = 0; + int rc; - if (!hdl) + if (!hdl) { + dev_warn(&adapter->pdev->dev, "%s: Invalid hdl\n", __func__); return -EPERM; + } if (adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EPERM; + } cfgp1.form = LEAPRAID_SAS_EXP_CFD_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG0))) + if (leapraid_op_config_page(adapter, &exp_pg0, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG0)) return -EPERM; parent_handle = le16_to_cpu(exp_pg0.parent_dev_hdl); @@ -3648,10 +4267,14 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) if (sas_addr_parent != adapter->dev_topo.card.sas_address) { spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, sas_addr_parent, - leapraid_get_port_by_id(adapter, port_id, false)); - spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); + leapraid_get_port_by_id(adapter, + port_id, + false)); + spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, + flags); if (!topo_node_exp) { rc = leapraid_exp_add(adapter, parent_handle); if (rc != 0) @@ -3662,7 +4285,9 @@ static int leapraid_exp_add(struct leapraid_adapter *adapter, u16 hdl) spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); sas_addr = le64_to_cpu(exp_pg0.sas_address); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, sas_addr, + leapraid_exp_find_by_sas_address( + adapter, + sas_addr, leapraid_get_port_by_id(adapter, port_id, false)); spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -3710,7 +4335,7 @@ static void leapraid_exp_node_rm(struct leapraid_adapter *adapter, topo_node_exp->sas_address_parent, topo_node_exp->card_port); dev_info(&adapter->pdev->dev, - "removing exp: port=%d, sas addr=0x%016llx, hdl=0x%04x\n", + "removing exp: port=%d, SAS addr=0x%016llx, hdl=0x%04x\n", port_id, (unsigned long long)topo_node_exp->sas_address, topo_node_exp->hdl); spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); @@ -3742,92 +4367,6 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static void leapraid_check_device(struct leapraid_adapter *adapter, - u64 parent_sas_address, u16 handle, - u8 phy_number, u8 link_rate) -{ - struct leapraid_sas_dev_p0 sas_device_pg0; - struct leapraid_sas_dev *sas_dev = NULL; - struct leapraid_enc_node *enclosure_dev = NULL; - union cfg_param_1 cfgp1 = {0}; - union cfg_param_2 cfgp2 = {0}; - unsigned long flags; - u64 sas_address; - struct scsi_target *starget; - struct leapraid_starget_priv *sas_target_priv_data; - u32 device_info; - struct leapraid_card_port *port; - - cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; - cfgp2.handle = handle; - if ((leapraid_op_config_page(adapter, &sas_device_pg0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) - return; - - if (phy_number != sas_device_pg0.phy_num) - return; - - device_info = le32_to_cpu(sas_device_pg0.dev_info); - if (!(leapraid_is_end_dev(device_info))) - return; - - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_address = le64_to_cpu(sas_device_pg0.sas_address); - port = leapraid_get_port_by_id(adapter, sas_device_pg0.physical_port, - false); - if (!port) - goto out_unlock; - - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, sas_address, - port); - if (!sas_dev) - goto out_unlock; - - if (unlikely(sas_dev->hdl != handle)) { - starget = sas_dev->starget; - sas_target_priv_data = starget->hostdata; - starget_printk(KERN_INFO, starget, - "hdl changed from 0x%04x to 0x%04x!\n", - sas_dev->hdl, handle); - sas_target_priv_data->hdl = handle; - sas_dev->hdl = handle; - if (le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = - sas_device_pg0.enc_level; - memcpy(sas_dev->connector_name, - sas_device_pg0.connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } - sas_dev->enc_hdl = - le16_to_cpu(sas_device_pg0.enc_hdl); - enclosure_dev = - leapraid_enc_find_by_hdl(adapter, sas_dev->enc_hdl); - if (enclosure_dev) { - sas_dev->enc_lid = - le64_to_cpu(enclosure_dev->pg0.enc_lid); - } - } - - if (!(le16_to_cpu(sas_device_pg0.flg) & - LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT)) - goto out_unlock; - - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - - leapraid_ublk_io_dev_to_running(adapter, sas_address, port); - goto out; - -out_unlock: - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); -out: - if (sas_dev) - leapraid_sdev_put(sas_dev); -} - static int leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, @@ -3836,10 +4375,8 @@ static int leapraid_internal_sas_topo_chg_evt( u64 sas_addr, u8 max_phys) { struct leapraid_evt_data_sas_topo_change_list *evt_data; - struct leapraid_sas_dev *sas_dev; - unsigned long flags; u8 phy_number; - u8 link_rate, prev_link_rate; + u8 link_rate; u16 reason_code; u16 hdl; int i; @@ -3861,47 +4398,15 @@ static int leapraid_internal_sas_topo_chg_evt( LEAPRAID_EVT_SAS_TOPO_RC_MASK; hdl = le16_to_cpu(evt_data->phy[i].attached_dev_hdl); - if (!hdl) + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); continue; - - link_rate = evt_data->phy[i].link_rate >> 4; - prev_link_rate = evt_data->phy[i].link_rate & 0xF; + } + link_rate = evt_data->phy[i].link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT; switch (reason_code) { - case LEAPRAID_EVT_SAS_TOPO_RC_PHY_CHANGED: - if (adapter->access_ctrl.shost_recovering) - break; - - if (link_rate == prev_link_rate) - break; - - leapraid_transport_update_links(adapter, sas_addr, - hdl, phy_number, - link_rate, card_port); - if (link_rate < LEAPRAID_SAS_NEG_LINK_RATE_1_5) - break; - - leapraid_check_device(adapter, sas_addr, hdl, - phy_number, link_rate); - spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, - flags); - sas_dev = - leapraid_hold_lock_get_sas_dev_by_hdl( - adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, - flags); - if (sas_dev) { - leapraid_sdev_put(sas_dev); - break; - } - if (!test_bit(hdl, (unsigned long *)adapter->dev_topo.pending_dev_add)) - break; - - evt_data->phy[i].phy_status &= - LEAPRAID_EVT_SAS_TOPO_RC_CLEAR_MASK; - evt_data->phy[i].phy_status |= - LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED; - fallthrough; - case LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED: if (adapter->access_ctrl.shost_recovering) break; @@ -3942,7 +4447,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, return 0; evt_data = fw_evt->evt_data; - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) return 0; @@ -3951,9 +4456,9 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, card_port = leapraid_get_port_by_id(adapter, evt_data->physical_port, false); - if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED) - if (leapraid_exp_add(adapter, phdl) != 0) - return 0; + if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && + leapraid_exp_add(adapter, phdl) != 0) + return 0; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -3980,12 +4485,13 @@ static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) { sdev->no_uld_attach = no_uld_attach ? 1 : 0; sdev_printk(KERN_INFO, sdev, - "%s raid component to upper layer\n", + "%s RAID component to upper layer\n", sdev->no_uld_attach ? "hide" : "expose"); WARN_ON(scsi_device_reprobe(sdev)); } -static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { union cfg_param_1 cfgp1 = {0}; @@ -3997,20 +4503,26 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + + set_bit(hdl, adapter->dev_topo.pd_hdls); sas_dev = leapraid_get_sas_dev_by_hdl(adapter, hdl); if (sas_dev) { leapraid_sdev_put(sas_dev); dev_warn(&adapter->pdev->dev, - "dev handle 0x%x already exists\n", hdl); + "Dev handle 0x%x already exists\n", hdl); return; } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, - GET_SAS_DEVICE_PG0))) { - dev_warn(&adapter->pdev->dev, "failed to read dev page0\n"); + if (leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, + GET_SAS_DEVICE_PG0)) { + dev_warn(&adapter->pdev->dev, "Failed to read dev page0\n"); return; } @@ -4025,7 +4537,8 @@ static void leapraid_sas_pd_add(struct leapraid_adapter *adapter, leapraid_add_dev(adapter, hdl); } -static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_delete( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 hdl; @@ -4034,7 +4547,8 @@ static void leapraid_sas_pd_delete(struct leapraid_adapter *adapter, leapraid_sas_dev_remove_by_hdl(adapter, hdl); } -static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, +static void leapraid_sas_pd_hide( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_starget_priv *starget_priv; @@ -4042,10 +4556,15 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, struct leapraid_sas_dev *sas_dev; unsigned long flags; u64 volume_wwid = 0; - u16 volume_hdl = 0; + u16 volume_hdl; u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } leapraid_cfg_get_volume_hdl(adapter, hdl, &volume_hdl); if (volume_hdl) leapraid_cfg_get_volume_wwid(adapter, @@ -4059,21 +4578,23 @@ static void leapraid_sas_pd_hide(struct leapraid_adapter *adapter, return; } - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + set_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; sas_dev->volume_hdl = volume_hdl; sas_dev->volume_wwid = volume_wwid; - leapraid_sdev_put(sas_dev); } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - (void *)1, leapraid_reprobe_lun); + (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } static void leapraid_sas_pd_expose( @@ -4088,11 +4609,17 @@ static void leapraid_sas_pd_expose( hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); + if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + return; + } + spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { dev_warn(&adapter->pdev->dev, - "%s:%d: sas_dev not found， hdl=0x%x\n", + "%s:%d: sas_dev not found, hdl=0x%x\n", __func__, __LINE__, hdl); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); return; @@ -4100,84 +4627,100 @@ static void leapraid_sas_pd_expose( sas_dev->volume_hdl = 0; sas_dev->volume_wwid = 0; - clear_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + clear_bit(hdl, adapter->dev_topo.pd_hdls); if (sas_dev->starget && sas_dev->starget->hostdata) { starget = sas_dev->starget; starget_priv = starget->hostdata; starget_priv->flg &= ~LEAPRAID_TGT_FLG_RAID_MEMBER; - sas_dev->led_on = false; - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { dev_info(&adapter->pdev->dev, "expose sas_dev, hdl=0x%x\n", hdl); - starget_for_each_device(starget, NULL, leapraid_reprobe_lun); + starget_for_each_device(starget, + LEAPRAID_ULD_ATTACH_FLAG, + leapraid_reprobe_lun); } + + leapraid_sdev_put(sas_dev); } -static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, +static void leapraid_sas_vol_visibility( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { - struct leapraid_raid_volume *raid_volume = NULL; - struct scsi_device *sdev = NULL; - u16 hdl = 0; + struct leapraid_raid_volume *raid_volume; + struct scsi_device *sdev; + bool reprobe_flg = false; + bool sdev_held = false; unsigned long flags; - u8 rc = 0; - u8 reprobe_flg = 0; + u16 hdl; + u8 rc; hdl = le16_to_cpu(evt_data->vol_dev_hdl); rc = evt_data->reason_code; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { + dev_warn(&adapter->pdev->dev, + "%s:%d: Volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + sdev = raid_volume->sdev; + if (!sdev) { spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x has no sdev\n", __func__, __LINE__, hdl); return; } - reprobe_flg = 0; - sdev = raid_volume->sdev; - if (sdev) { - if (sdev->no_uld_attach) { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { - sdev->no_uld_attach = 0; - reprobe_flg = 1; - } - } else { - if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { - sdev->no_uld_attach = 1; - reprobe_flg = 1; - } - } + if (sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = true; + } else if (!sdev->no_uld_attach && + rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = true; + } - if (reprobe_flg) { - if (sdev->no_uld_attach) - sdev_printk(KERN_INFO, sdev, "hide vol\n"); - else - sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + if (reprobe_flg && !scsi_device_get(sdev)) + sdev_held = true; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); - WARN_ON(scsi_device_reprobe(sdev)); - } else { - dev_warn(&adapter->pdev->dev, - "%s:rc(0x%x):request matches, skipping.\n", - __func__, rc); - } + if (!reprobe_flg) { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x): Request matches, skipping\n", + __func__, rc); + return; + } - } else { + if (!sdev_held) { dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x has no sdev\n", - __func__, __LINE__, hdl); + "%s: Failed to hold sdev for reprobe, hdl=0x%x\n", + __func__, hdl); + return; } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + scsi_device_put(sdev); } -static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, +static void leapraid_sas_volume_add( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { struct leapraid_raid_volume *raid_volume; @@ -4188,23 +4731,21 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, hdl = le16_to_cpu(evt_data->vol_dev_hdl); if (leapraid_cfg_get_volume_wwid(adapter, hdl, &wwid)) { - dev_warn(&adapter->pdev->dev, "failed to read volume page1\n"); + dev_warn(&adapter->pdev->dev, "Failed to read volume page1\n"); return; } if (!wwid) { - dev_warn(&adapter->pdev->dev, "invalid WWID(handle=0x%x)\n", + dev_warn(&adapter->pdev->dev, "Invalid WWID(handle=0x%x)\n", hdl); return; } - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - if (raid_volume) { dev_warn(&adapter->pdev->dev, - "volume handle 0x%x already exists\n", hdl); + "Volume handle 0x%x already exists\n", hdl); + leapraid_raid_volume_put(raid_volume); return; } @@ -4212,6 +4753,8 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, if (!raid_volume) return; + INIT_LIST_HEAD(&raid_volume->list); + kref_init(&raid_volume->refcnt); raid_volume->id = adapter->dev_topo.sas_id++; raid_volume->channel = RAID_CHANNEL; raid_volume->hdl = hdl; @@ -4222,50 +4765,65 @@ static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); dev_info(&adapter->pdev->dev, - "add raid volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); + "add RAID volume: hdl=0x%x, wwid=0x%llx\n", hdl, wwid); } else { spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); leapraid_check_boot_dev(adapter, raid_volume, RAID_CHANNEL); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } + leapraid_raid_volume_put(raid_volume); +} + +static void leapraid_sas_volume_delete_by_ptr( + struct leapraid_adapter *adapter, + struct leapraid_raid_volume *raid_volume) +{ + struct leapraid_starget_priv *starget_priv; + struct scsi_target *starget = NULL; + unsigned long flags; + bool in_list; + + if (!raid_volume) + return; + + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + in_list = !list_empty(&raid_volume->list); + if (in_list && raid_volume->starget) { + starget = raid_volume->starget; + starget_priv = starget->hostdata; + if (starget_priv) + starget_priv->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + if (!in_list) + return; + + dev_info(&adapter->pdev->dev, + "delete RAID volume: hdl=0x%x, wwid=0x%llx\n", + raid_volume->hdl, raid_volume->wwid); + leapraid_raid_volume_remove(adapter, raid_volume); + + if (starget) + scsi_remove_target(&starget->dev); } static void leapraid_sas_volume_delete(struct leapraid_adapter *adapter, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; - struct scsi_target *starget = NULL; - unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); if (!raid_volume) { - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); dev_warn(&adapter->pdev->dev, - "%s:%d: volume handle 0x%x not found\n", + "%s:%d: Volume handle 0x%x not found\n", __func__, __LINE__, hdl); return; } - if (raid_volume->starget) { - starget = raid_volume->starget; - starget_priv = starget->hostdata; - starget_priv->deleted = true; - } - - dev_info(&adapter->pdev->dev, - "delete raid volume: hdl=0x%x, wwid=0x%llx\n", - raid_volume->hdl, raid_volume->wwid); - list_del(&raid_volume->list); - kfree(raid_volume); - - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); - - if (starget) - scsi_remove_target(&starget->dev); + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); + leapraid_raid_volume_put(raid_volume); } static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, @@ -4309,7 +4867,9 @@ static void leapraid_sas_enc_dev_stat_add_node( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_enc_node *enc_node = NULL; + struct leapraid_enc_node *enc_node; + struct leapraid_enc_node *enc_exist; + unsigned long flags; int rc; enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); @@ -4324,16 +4884,33 @@ static void leapraid_sas_enc_dev_stat_add_node( kfree(enc_node); return; } + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_exist = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_exist) { + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); + return; + } list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } static void leapraid_sas_enc_dev_stat_del_node( - struct leapraid_enc_node *enc_node) + struct leapraid_adapter *adapter, u16 hdl) { - if (!enc_node) + struct leapraid_enc_node *enc_node; + unsigned long flags; + + if (!hdl) return; - list_del(&enc_node->list); + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + enc_node = leapraid_enc_find_by_hdl(adapter, hdl); + if (enc_node) + list_del(&enc_node->list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); + kfree(enc_node); } @@ -4341,7 +4918,6 @@ static void leapraid_sas_enc_dev_stat_chg_evt( struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { - struct leapraid_enc_node *enc_node = NULL; struct leapraid_evt_data_sas_enc_dev_status_change *evt_data; u16 enc_hdl; @@ -4350,15 +4926,13 @@ static void leapraid_sas_enc_dev_stat_chg_evt( evt_data = fw_evt->evt_data; enc_hdl = le16_to_cpu(evt_data->enc_hdl); - if (enc_hdl) - enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); switch (evt_data->reason_code) { case LEAPRAID_EVT_SAS_ENCL_RC_ADDED: - if (!enc_node) + if (enc_hdl) leapraid_sas_enc_dev_stat_add_node(adapter, enc_hdl); break; case LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING: - leapraid_sas_enc_dev_stat_del_node(enc_node); + leapraid_sas_enc_dev_stat_del_node(adapter, enc_hdl); break; default: break; @@ -4375,7 +4949,11 @@ static void leapraid_remove_unresp_sas_end_dev( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry_safe(sas_dev, sas_dev_next, &adapter->dev_topo.sas_dev_init_list, list) { + if (sas_dev->rphy || sas_dev->pend_sas_rphy_add) + continue; + list_del_init(&sas_dev->list); + leapraid_clear_cached_boot_dev(adapter, sas_dev, 0); leapraid_sdev_put(sas_dev); } list_for_each_entry_safe(sas_dev, sas_dev_next, @@ -4383,7 +4961,7 @@ static void leapraid_remove_unresp_sas_end_dev( if (!sas_dev->resp) list_move_tail(&sas_dev->list, &head); else - sas_dev->resp = false; + sas_dev->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -4394,23 +4972,32 @@ static void leapraid_remove_unresp_sas_end_dev( } dev_info(&adapter->pdev->dev, - "unresponding sas end devices removed\n"); + "Unresponsive SAS end devices removed\n"); } static void leapraid_remove_unresp_raid_volumes( struct leapraid_adapter *adapter) { + unsigned long flags; struct leapraid_raid_volume *raid_volume, *raid_volume_next; + LIST_HEAD(head); + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); list_for_each_entry_safe(raid_volume, raid_volume_next, &adapter->dev_topo.raid_volume_list, list) { if (!raid_volume->resp) - leapraid_sas_volume_delete(adapter, raid_volume->hdl); + list_move_tail(&raid_volume->list, &head); else - raid_volume->resp = false; + raid_volume->resp = 0; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, raid_volume_next, &head, list) { + leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } + dev_info(&adapter->pdev->dev, - "unresponding raid volumes removed\n"); + "Unresponsive RAID volumes removed\n"); } static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) @@ -4425,7 +5012,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) if (!topo_node_exp->resp) list_move_tail(&topo_node_exp->list, &head); else - topo_node_exp->resp = false; + topo_node_exp->resp = 0; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); @@ -4434,7 +5021,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) leapraid_exp_node_rm(adapter, topo_node_exp); dev_info(&adapter->pdev->dev, - "unresponding sas expanders removed\n"); + "Unresponsive SAS expanders removed\n"); } static void leapraid_remove_unresp_dev(struct leapraid_adapter *adapter) @@ -4490,25 +5077,27 @@ static void leapraid_update_dev_qdepth(struct leapraid_adapter *adapter) { struct leapraid_sdev_priv *sdev_priv; struct leapraid_sas_dev *sas_dev; + struct leapraid_adapter_attr *attr; struct scsi_device *sdev; u16 qdepth; + attr = &adapter->adapter_attr; shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) continue; sas_dev = sdev_priv->starget_priv->sas_dev; if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) - qdepth = (sas_dev->port_type > 1) ? - adapter->adapter_attr.wideport_max_queue_depth : - adapter->adapter_attr.narrowport_max_queue_depth; + qdepth = (sas_dev->port_connection > 1) ? + attr->wideport_max_queue_depth : + attr->narrowport_max_queue_depth; else if (sas_dev && sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) - qdepth = adapter->adapter_attr.sata_max_queue_depth; + qdepth = attr->sata_max_queue_depth; else continue; - leapraid_adjust_sdev_queue_depth(sdev, qdepth); + leapraid_change_queue_depth(sdev, qdepth); } } @@ -4524,15 +5113,17 @@ static void leapraid_update_exp_links(struct leapraid_adapter *adapter, cfgp2.handle = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) { cfgp1.phy_number = i; - if ((leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, - GET_SAS_EXPANDER_PG1))) + if (leapraid_op_config_page(adapter, &exp_p1, cfgp1, cfgp2, + GET_SAS_EXPANDER_PG1)) return; - leapraid_transport_update_links(adapter, + leapraid_transport_update_links( + adapter, topo_node_exp->sas_address, le16_to_cpu(exp_p1.attached_dev_hdl), i, - exp_p1.neg_link_rate >> 4, + exp_p1.neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT, topo_node_exp->card_port); } } @@ -4547,7 +5138,7 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "begin scanning expanders\n"); + dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4558,7 +5149,8 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) port_id = exp_p0.physical_port; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = - leapraid_exp_find_by_sas_address(adapter, + leapraid_exp_find_by_sas_address( + adapter, le64_to_cpu(exp_p0.sas_address), leapraid_get_port_by_id(adapter, port_id, @@ -4572,14 +5164,14 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) leapraid_exp_add(adapter, hdl); dev_info(&adapter->pdev->dev, - "add exp: hdl=0x%04x, sas addr=0x%016llx\n", + "add exp: hdl=0x%04x, SAS addr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( exp_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "expanders scan complete\n"); + dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -4596,7 +5188,7 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "begin scanning phys disk\n"); + dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; @@ -4629,20 +5221,25 @@ static void leapraid_scan_phy_disks_after_reset( LEAPRAID_SAS_NEG_LINK_RATE_1_5, leapraid_get_port_by_id( adapter, port_id, false)); - set_bit(hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - - leapraid_add_dev(adapter, hdl); - - dev_info(&adapter->pdev->dev, - "add phys disk: hdl=0x%04x, sas addr=0x%016llx\n", - hdl, - (unsigned long long)le64_to_cpu( - sas_dev_p0.sas_address)); + if (!hdl || hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", + __func__); + } else { + set_bit(hdl, adapter->dev_topo.pd_hdls); + leapraid_add_dev(adapter, hdl); + + dev_info(&adapter->pdev->dev, + "add pd hdl=0x%04x saddr=0x%016llx\n", + hdl, + (unsigned long long)le64_to_cpu( + sas_dev_p0.sas_address)); + } } } - dev_info(&adapter->pdev->dev, "phys disk scan complete\n"); + dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -4652,10 +5249,9 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) union cfg_param_1 cfgp1_extra = {0}; union cfg_param_2 cfgp2_extra = {0}; struct leapraid_evt_data_ir_change evt_data; - static struct leapraid_raid_volume *raid_volume; + struct leapraid_raid_volume *raid_volume; struct leapraid_raidvol_p1 *vol_p1; struct leapraid_raidvol_p0 *vol_p0; - unsigned long flags; u16 hdl; vol_p0 = kzalloc(sizeof(*vol_p0), GFP_KERNEL); @@ -4668,21 +5264,20 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "begin scanning volumes\n"); + dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, cfgp2, GET_RAID_VOLUME_PG1); cfgp2.handle = hdl) { hdl = le16_to_cpu(vol_p1->dev_hdl); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_wwid( adapter, le64_to_cpu(vol_p1->wwid)); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume) + if (raid_volume) { + leapraid_raid_volume_put(raid_volume); continue; + } cfgp1_extra.size = sizeof(struct leapraid_raidvol_p0); cfgp2_extra.handle = hdl; @@ -4707,7 +5302,7 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - dev_info(&adapter->pdev->dev, "volumes scan complete\n"); + dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -4721,7 +5316,7 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u8 port_id; dev_info(&adapter->pdev->dev, - "begin scanning sas end devices\n"); + "Begin scanning SAS end devices\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -4729,6 +5324,13 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) GET_SAS_DEVICE_PG0); cfgp2.handle = hdl) { hdl = le16_to_cpu(sas_dev_p0.dev_hdl); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + continue; + } + if (!(leapraid_is_end_dev(le32_to_cpu(sas_dev_p0.dev_info)))) continue; @@ -4759,21 +5361,21 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) false)); leapraid_add_dev(adapter, hdl); dev_info(&adapter->pdev->dev, - "add sas dev: hdl=0x%04x, sas addr=0x%016llx\n", + "Add SAS dev: hdl=0x%04x, saddr=0x%016llx\n", hdl, (unsigned long long)le64_to_cpu( sas_dev_p0.sas_address)); } } - dev_info(&adapter->pdev->dev, "sas end devices scan complete\n"); + dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "begin scanning devices\n"); + dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num); + leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { leapraid_scan_phy_disks_after_reset(adapter); @@ -4781,11 +5383,13 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) } leapraid_scan_sas_dev_after_reset(adapter); - dev_info(&adapter->pdev->dev, "devices scan complete\n"); + dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) { + unsigned long flags; + leapraid_remove_unresp_dev(adapter); leapraid_del_dirty_vphy(adapter); leapraid_del_dirty_card_port(adapter); @@ -4794,6 +5398,10 @@ static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) if (adapter->scan_dev_desc.driver_loading) leapraid_scan_dev_done(adapter); + spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + wake_up(&adapter->access_ctrl.shost_recover_wq); } static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, @@ -4802,15 +5410,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, { void *req; bool reset_flg = false; - int rc = 0; + int rc; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc(adapter, + req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.enc_cmd.inter_taskid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); @@ -4820,6 +5430,10 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: SEP command timeout, status=0x%x\n", + __func__, adapter->driver_cmds.enc_cmd.status); + leapraid_log_req_context(adapter, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -4828,17 +5442,17 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, } if (adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_REPLY_VALID) - memcpy(sep_rep, (void *)(&adapter->driver_cmds.enc_cmd.reply), + memcpy(sep_rep, &adapter->driver_cmds.enc_cmd.reply, sizeof(struct leapraid_sep_rep)); do_hard_reset: if (reset_flg) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); } adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; -out: +unlock: mutex_unlock(&adapter->driver_cmds.enc_cmd.mutex); return rc; } @@ -4857,8 +5471,9 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, sep_req.func = LEAPRAID_FUNC_SCSI_ENC_PROCESSOR; sep_req.act = LEAPRAID_SEP_REQ_ACT_WRITE_STATUS; if (on) { - sep_req.slot_status = - cpu_to_le32(LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT); + u32 status = LEAPRAID_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT; + + sep_req.slot_status = cpu_to_le32(status); sep_req.dev_hdl = cpu_to_le16(sas_dev->hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_DEVHDL_ADDRESS; if (leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req)) { @@ -4866,52 +5481,75 @@ static void leapraid_set_led(struct leapraid_adapter *adapter, return; } - sas_dev->led_on = true; - if (sep_rep.adapter_status) - leapraid_sdev_put(sas_dev); + sas_dev->led_on = 1; + leapraid_sdev_put(sas_dev); } else { sep_req.slot_status = 0; sep_req.slot = cpu_to_le16(sas_dev->slot); sep_req.dev_hdl = 0; sep_req.enc_hdl = cpu_to_le16(sas_dev->enc_hdl); sep_req.flg = LEAPRAID_SEP_REQ_FLG_ENCLOSURE_SLOT_ADDRESS; - if ((leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req))) { - leapraid_sdev_put(sas_dev); - return; - } + leapraid_send_enc_cmd(adapter, &sep_rep, &sep_req); + } +} - if (sep_rep.adapter_status) { - leapraid_sdev_put(sas_dev); - return; +static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) +{ + unsigned long flags; + + while (scsi_host_in_recovery(adapter->shost) || + adapter->access_ctrl.shost_recovering) { + if (adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup) { + spin_lock_irqsave( + &adapter->reset_desc.adapter_reset_lock, + flags); + adapter->access_ctrl.shost_recover_async = 0; + spin_unlock_irqrestore( + &adapter->reset_desc.adapter_reset_lock, + flags); + + wake_up(&adapter->access_ctrl.shost_recover_wq); + + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost %d, host %d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.host_removing); + + return -EFAULT; } + + wait_event_timeout(adapter->access_ctrl.recovery_waitq, + !adapter->access_ctrl.shost_recovering || + adapter->access_ctrl.host_removing || + adapter->fw_evt_s.fw_evt_cleanup, + msecs_to_jiffies(1000)); } + return 0; } static void leapraid_fw_work(struct leapraid_adapter *adapter, struct leapraid_fw_evt_work *fw_evt) { struct leapraid_sas_dev *sas_dev; + unsigned long flags; + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); adapter->fw_evt_s.cur_evt = fw_evt; + adapter->fw_evt_s.cur_evt_task = current; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_del_fw_evt_from_list(adapter, fw_evt); if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; } switch (fw_evt->evt_type) { - case LEAPRAID_EVT_SAS_DISCOVERY: - { - struct leapraid_evt_data_sas_disc *evt_data; - - evt_data = fw_evt->evt_data; - if (evt_data->reason_code == - LEAPRAID_EVT_SAS_DISC_RC_STARTED && - !adapter->dev_topo.card.phys_num) - leapraid_sas_host_add(adapter, 0); - break; - } case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: leapraid_sas_topo_chg_evt(adapter, fw_evt); break; @@ -4922,14 +5560,9 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_sas_enc_dev_stat_chg_evt(adapter, fw_evt); break; case LEAPRAID_EVT_REMOVE_DEAD_DEV: - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) - goto out; + if (leapraid_wait_adapter_recovery(adapter)) + goto out_cleanup; - ssleep(1); - } leapraid_hardreset_async_logic(adapter); break; case LEAPRAID_EVT_TURN_ON_PFA_LED: @@ -4938,14 +5571,17 @@ static void leapraid_fw_work(struct leapraid_adapter *adapter, leapraid_set_led(adapter, sas_dev, true); break; case LEAPRAID_EVT_SCAN_DEV_DONE: - adapter->scan_dev_desc.scan_start = false; + adapter->scan_dev_desc.scan_start = 0; break; default: break; } -out: +out_cleanup: + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_put(fw_evt); adapter->fw_evt_s.cur_evt = NULL; + adapter->fw_evt_s.cur_evt_task = NULL; + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); } static void leapraid_sas_dev_stat_chg_evt( @@ -4953,7 +5589,7 @@ static void leapraid_sas_dev_stat_chg_evt( struct leapraid_evt_data_sas_dev_status_change *event_data) { struct leapraid_starget_priv *starget_priv; - struct leapraid_sas_dev *sas_dev = NULL; + struct leapraid_sas_dev *sas_dev; u64 sas_address; unsigned long flags; @@ -4968,26 +5604,29 @@ static void leapraid_sas_dev_stat_chg_evt( spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); sas_address = le64_to_cpu(event_data->sas_address); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, sas_address, leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (sas_dev && sas_dev->starget) { - starget_priv = sas_dev->starget->hostdata; - if (starget_priv) { - switch (event_data->reason_code) { - case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: - starget_priv->tm_busy = true; - break; - case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: - starget_priv->tm_busy = false; - break; - } + if (!sas_dev || !sas_dev->starget) + goto out_unlock; + + starget_priv = sas_dev->starget->hostdata; + if (starget_priv) { + switch (event_data->reason_code) { + case LEAPRAID_EVT_SAS_DEV_STAT_RC_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 1; + break; + case LEAPRAID_EVT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET: + starget_priv->tm_busy = 0; + break; } } +out_unlock: if (sas_dev) leapraid_sdev_put(sas_dev); spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -5000,32 +5639,45 @@ static void leapraid_set_volume_delete_flag(struct leapraid_adapter *adapter, struct leapraid_starget_priv *sas_target_priv_data; unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, handle); - if (raid_volume && raid_volume->starget && - raid_volume->starget->hostdata) { - sas_target_priv_data = raid_volume->starget->hostdata; - sas_target_priv_data->deleted = true; + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (raid_volume->starget && + raid_volume->starget->hostdata) { + sas_target_priv_data = raid_volume->starget->hostdata; + sas_target_priv_data->deleted = 1; + } + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } -static void leapraid_check_ir_change_evt(struct leapraid_adapter *adapter, +static void leapraid_check_ir_change_evt( + struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { u16 phys_disk_dev_hdl; switch (evt_data->reason_code) { case LEAPRAID_EVT_IR_RC_VOLUME_DELETE: - leapraid_set_volume_delete_flag(adapter, - le16_to_cpu(evt_data->vol_dev_hdl)); + leapraid_set_volume_delete_flag( + adapter, + le16_to_cpu(evt_data->vol_dev_hdl)); break; case LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE: phys_disk_dev_hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - clear_bit(phys_disk_dev_hdl, - (unsigned long *)adapter->dev_topo.pd_hdls); - leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + if (!phys_disk_dev_hdl || + phys_disk_dev_hdl > + adapter->adapter_attr.features.max_dev_handle) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + } else { + clear_bit(phys_disk_dev_hdl, + adapter->dev_topo.pd_hdls); + leapraid_tgt_rst_send(adapter, phys_disk_dev_hdl); + } break; } } @@ -5035,7 +5687,7 @@ static void leapraid_topo_del_evts_process_exp_status( struct leapraid_evt_data_sas_topo_change_list *evt_data) { struct leapraid_fw_evt_work *fw_evt = NULL; - struct leapraid_evt_data_sas_topo_change_list *loc_evt_data = NULL; + struct leapraid_evt_data_sas_topo_change_list *loc_evt_data; unsigned long flags; u16 exp_hdl; @@ -5066,7 +5718,8 @@ static void leapraid_topo_del_evts_process_exp_status( } } -static void leapraid_check_topo_del_evts(struct leapraid_adapter *adapter, +static void leapraid_check_topo_del_evts( + struct leapraid_adapter *adapter, struct leapraid_evt_data_sas_topo_change_list *evt_data) { int reason_code; @@ -5096,17 +5749,20 @@ static bool leapraid_async_process_evt( switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: - leapraid_sas_dev_stat_chg_evt(adapter, + leapraid_sas_dev_stat_chg_evt( + adapter, (struct leapraid_evt_data_sas_dev_status_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_IR_CHANGE: - leapraid_check_ir_change_evt(adapter, + leapraid_check_ir_change_evt( + adapter, (struct leapraid_evt_data_ir_change *)event_notify_rep->evt_data); break; case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: - leapraid_check_topo_del_evts(adapter, + leapraid_check_topo_del_evts( + adapter, (struct leapraid_evt_data_sas_topo_change_list *)event_notify_rep->evt_data); if (adapter->access_ctrl.shost_recovering) { @@ -5114,7 +5770,6 @@ static bool leapraid_async_process_evt( return exit_flag; } break; - case LEAPRAID_EVT_SAS_DISCOVERY: case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: break; default: @@ -5136,7 +5791,7 @@ static void leapraid_async_evt_cb_enqueue( if (!fw_evt) return; - evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * 4; + evt_sz = le16_to_cpu(evt_notify_rep->evt_data_len) * sizeof(u32); fw_evt->evt_data = kmemdup(evt_notify_rep->evt_data, evt_sz, GFP_ATOMIC); if (!fw_evt->evt_data) { @@ -5225,13 +5880,63 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, - u16 taskid, u8 msix_index, - u32 rep_paddr, u8 cb_idx) +static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) +{ + u16 status; + + cmd->status &= ~LEAPRAID_CMD_PENDING; + + status = le16_to_cpu(rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + + if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + adapter->scan_dev_desc.scan_dev_failed = 1; + + if (!cmd->async_scan_dev) { + complete(&cmd->done); + return 1; + } + + if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) + leapraid_scan_dev_complete(adapter); + else + adapter->scan_dev_desc.scan_start_failed = status; + + return 1; +} + +static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, + struct leapraid_rep *rep, + u16 taskid) +{ + struct leapraid_scsiio_rep *scsiio_reply; + + if (rep->function != LEAPRAID_FUNC_SCSIIO && + rep->function != LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH) + return; + + scsiio_reply = (struct leapraid_scsiio_rep *)rep; + + if (!(scsiio_reply->scsi_state & + LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) + return; + + memcpy(&adapter->driver_cmds.ctl_cmd.sense, + leapraid_get_sense_buffer(adapter, taskid), + min_t(u32, SCSI_SENSE_BUFFERSIZE, + le32_to_cpu(scsiio_reply->sense_count))); +} + +static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_index, + u32 rep_paddr, u8 cb_idx) { struct leapraid_rep *leap_mpi_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); struct leapraid_driver_cmd *sp_cmd, *_sp_cmd = NULL; + u8 reply_len; list_for_each_entry(sp_cmd, &adapter->driver_cmds.special_cmd_list, list) @@ -5241,74 +5946,55 @@ static u8 leapraid_driver_cmds_done(struct leapraid_adapter *adapter, } if (WARN_ON(!_sp_cmd)) - return 1; + return true; if (WARN_ON(_sp_cmd->status == LEAPRAID_CMD_NOT_USED)) - return 1; + return true; if (WARN_ON(taskid != _sp_cmd->hp_taskid && taskid != _sp_cmd->taskid && taskid != _sp_cmd->inter_taskid)) - return 1; - + return true; _sp_cmd->status |= LEAPRAID_CMD_DONE; if (leap_mpi_rep) { - memcpy((void *)(&_sp_cmd->reply), leap_mpi_rep, - leap_mpi_rep->msg_len * 4); + reply_len = leap_mpi_rep->msg_len * sizeof(u32); + if (reply_len > LEAPRAID_REPLY_SIZE) + reply_len = LEAPRAID_REPLY_SIZE; + memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { - u16 adapter_status; - - _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; - adapter_status = - le16_to_cpu(leap_mpi_rep->adapter_status) & - LEAPRAID_ADAPTER_STATUS_MASK; - if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) - adapter->scan_dev_desc.scan_dev_failed = true; - - if (_sp_cmd->async_scan_dev) { - if (adapter_status == - LEAPRAID_ADAPTER_STATUS_SUCCESS) { - leapraid_scan_dev_complete(adapter); - } else { - adapter->scan_dev_desc.scan_start_failed = - adapter_status; - } - return 1; - } - - complete(&_sp_cmd->done); - return 1; - } + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) + return leapraid_handle_scan_cb(adapter, + _sp_cmd, + leap_mpi_rep); - if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) { - struct leapraid_scsiio_rep *scsiio_reply; - - if (leap_mpi_rep->function == - LEAPRAID_FUNC_SCSIIO_REQ || - leap_mpi_rep->function == - LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH) { - scsiio_reply = - (struct leapraid_scsiio_rep *)leap_mpi_rep; - if (scsiio_reply->scsi_state & - LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) - memcpy((void *)(&adapter->driver_cmds.ctl_cmd.sense), - leapraid_get_sense_buffer(adapter, taskid), - min_t(u32, - SCSI_SENSE_BUFFERSIZE, - le32_to_cpu(scsiio_reply->sense_count))); - } - } + if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) + leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); } _sp_cmd->status &= ~LEAPRAID_CMD_PENDING; complete(&_sp_cmd->done); - return 1; + return true; } -static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, - union leapraid_rep_desc_union *rpf, - u8 req_desc_type, u8 msix_idx) +static void leapraid_complete_task(struct leapraid_adapter *adapter, + u16 taskid, u8 msix_idx, u32 rep) +{ + if (taskid <= adapter->shost->can_queue || + taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) + leapraid_free_taskid(adapter, taskid); + return; + } + + if (leapraid_driver_cmds_done(adapter, taskid, msix_idx, rep, + leapraid_get_cb_idx(adapter, taskid))) + leapraid_free_taskid(adapter, taskid); +} + +static void leapraid_request_descript_handler( + struct leapraid_adapter *adapter, + union leapraid_rep_desc_union *rpf, + u8 req_desc_type, u8 msix_idx) { u32 rep; u16 taskid; @@ -5318,50 +6004,34 @@ static void leapraid_request_descript_handler(struct leapraid_adapter *adapter, switch (req_desc_type) { case LEAPRAID_RPY_DESC_FLG_FP_SCSI_IO_SUCCESS: case LEAPRAID_RPY_DESC_FLG_SCSI_IO_SUCCESS: - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, msix_idx, 0); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, 0, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } + leapraid_complete_task(adapter, taskid, msix_idx, 0); break; case LEAPRAID_RPY_DESC_FLG_ADDRESS_REPLY: rep = le32_to_cpu(rpf->addr_rep.rep_frame_addr); - if (rep > ((u32)adapter->mem_desc.rep_msg_dma + - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ) || - rep < ((u32)adapter->mem_desc.rep_msg_dma)) + if (rep > (u32)adapter->mem_desc.rep_msg_dma + + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE || + rep < (u32)adapter->mem_desc.rep_msg_dma) rep = 0; - if (taskid) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - leapraid_scsiio_done(adapter, taskid, - msix_idx, rep); - } else { - if (leapraid_driver_cmds_done(adapter, taskid, - msix_idx, rep, - leapraid_get_cb_idx(adapter, - taskid))) - leapraid_free_taskid(adapter, taskid); - } - } else { + + if (taskid) + leapraid_complete_task(adapter, taskid, msix_idx, rep); + else leapraid_handle_async_event(adapter, msix_idx, rep); - } - if (rep) { - adapter->rep_msg_host_idx = - (adapter->rep_msg_host_idx == - (adapter->adapter_attr.rep_msg_qd - 1)) ? - 0 : adapter->rep_msg_host_idx + 1; - adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = - cpu_to_le32(rep); - wmb(); /* Make sure that all write ops are in order */ - writel(adapter->rep_msg_host_idx, - &adapter->iomem_base->rep_msg_host_idx); - } + if (!rep) + return; + + adapter->rep_msg_host_idx = + (adapter->rep_msg_host_idx == + (adapter->adapter_attr.rep_msg_qd - 1)) ? + 0 : adapter->rep_msg_host_idx + 1; + adapter->mem_desc.rep_msg_addr[adapter->rep_msg_host_idx] = + cpu_to_le32(rep); + wmb(); /* Make sure that all write ops are in order */ + writel(adapter->rep_msg_host_idx, + &adapter->iomem_base->rep_msg_host_idx); + break; default: break; @@ -5423,8 +6093,8 @@ int leapraid_rep_queue_handler(struct leapraid_rq *rq) wmb(); /* Make sure that all write ops are in order */ writel(rq->rep_post_host_idx | ((msix_idx & LEAPRAID_MSIX_GROUP_MASK) << LEAPRAID_RPHI_MSIX_IDX_SHIFT), - &adapter->iomem_base->rep_post_reg_idx[msix_idx / - LEAPRAID_MSIX_GROUP_SIZE].idx); + &adapter->iomem_base->rep_post_reg_idx[ + msix_idx / LEAPRAID_MSIX_GROUP_SIZE].idx); atomic_dec(&rq->busy); return finish_cmds; } @@ -5441,7 +6111,7 @@ static irqreturn_t leapraid_irq_handler(int irq, void *bus_id) if (adapter->mask_int) return IRQ_NONE; - return ((leapraid_rep_queue_handler(rq) > 0) ? + return (leapraid_rep_queue_handler(rq) > 0 ? IRQ_HANDLED : IRQ_NONE); } @@ -5469,7 +6139,8 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) if (int_rq->rq.msix_idx == 0) continue; - synchronize_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx)); + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); if (poll) leapraid_rep_queue_handler(&int_rq->rq); } @@ -5491,16 +6162,18 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 1); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 1); for (qid = 0; qid < iopoll_q_count; qid++) { - while (atomic_read(&adapter->notification_desc.blk_mq_poll_rqs[qid].busy)) { + while (atomic_read(&desc->blk_mq_poll_rqs[qid].busy)) { cpu_relax(); udelay(LEAPRAID_IO_POLL_DELAY_US); } @@ -5509,19 +6182,30 @@ void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) void leapraid_mq_polling_resume(struct leapraid_adapter *adapter) { - int iopoll_q_count = - adapter->adapter_attr.rq_cnt - - adapter->notification_desc.iopoll_qdex; + struct leapraid_notification_desc *desc; + int iopoll_q_count; int qid; + desc = &adapter->notification_desc; + iopoll_q_count = adapter->adapter_attr.rq_cnt - desc->iopoll_qdex; + for (qid = 0; qid < iopoll_q_count; qid++) - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[qid].pause, 0); + atomic_set(&desc->blk_mq_poll_rqs[qid].pause, 0); } static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, u32 *host_diag) { - const u32 unlock_seq[] = { 0x0, 0xF, 0x4, 0xB, 0x2, 0x7, 0xD }; + const u32 unlock_seq[] = { + LEAPRAID_WRSEQ_FLUSH_KEY_VALUE, + LEAPRAID_WRSEQ_1ST_KEY_VALUE, + LEAPRAID_WRSEQ_2ND_KEY_VALUE, + LEAPRAID_WRSEQ_3RD_KEY_VALUE, + LEAPRAID_WRSEQ_4TH_KEY_VALUE, + LEAPRAID_WRSEQ_5TH_KEY_VALUE, + LEAPRAID_WRSEQ_6TH_KEY_VALUE + }; + const int max_retries = LEAPRAID_UNLOCK_RETRY_LIMIT; int retry = 0; unsigned int i; @@ -5538,51 +6222,46 @@ static int leapraid_unlock_host_diag(struct leapraid_adapter *adapter, return 0; } - dev_err(&adapter->pdev->dev, "try host reset timeout!\n"); + dev_err(&adapter->pdev->dev, "Try host reset timeout!\n"); return -EFAULT; } static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - u32 cnt; - dev_info(&adapter->pdev->dev, "entering host diag reset!\n"); + dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); if (leapraid_unlock_host_diag(adapter, &host_diag)) - goto out; + goto out_cleanup; writel(host_diag | LEAPRAID_DIAG_RESET, &adapter->iomem_base->host_diag); + msleep(LEAPRAID_MSLEEP_EXTRA_LONG_MS); msleep(LEAPRAID_MSLEEP_NORMAL_MS); - for (cnt = 0; cnt < LEAPRAID_RESET_LOOP_COUNT_DEFAULT; cnt++) { - host_diag = leapraid_readl(&adapter->iomem_base->host_diag); - if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL) - goto out; - - if (!(host_diag & LEAPRAID_DIAG_RESET)) - break; - msleep(LEAPRAID_RESET_POLL_INTERVAL_MS); - } + host_diag = leapraid_readl(&adapter->iomem_base->host_diag); + if (host_diag == LEAPRAID_INVALID_HOST_DIAG_VAL || + host_diag & LEAPRAID_DIAG_RESET) + goto out_cleanup; - writel(host_diag & ~LEAPRAID_DIAG_HOLD_ADAPTER_RESET, - &adapter->iomem_base->host_diag); writel(0x0, &adapter->iomem_base->ws); mutex_unlock(&adapter->reset_desc.host_diag_mutex); if (!leapraid_wait_adapter_ready(adapter)) - goto out; + goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag success!\n"); + dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; -out: - pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "host diag failed!\n"); + +out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); +out_failed: + pci_cfg_access_unlock(adapter->pdev); + dev_info(&adapter->pdev->dev, "Host diag failed!\n"); return -EFAULT; } @@ -5592,12 +6271,12 @@ static int leapraid_find_matching_port( { int i; - for (i = 0; i < count; i++) { + for (i = 0; i < count; i++) if (card_port_table[i].port_id == port_id && card_port_table[i].sas_address == sas_addr) return i; - } - return -1; + + return LEAPRAID_INVALID_INDEX; } static u8 leapraid_fill_card_port_table( @@ -5611,12 +6290,13 @@ static u8 leapraid_fill_card_port_table( int i, idx; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { - if ((sas_iounit_p0->phy_info[i].neg_link_rate >> 4) - < LEAPRAID_SAS_NEG_LINK_RATE_1_5) + if (sas_iounit_p0->phy_info[i].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < + LEAPRAID_SAS_NEG_LINK_RATE_1_5) continue; - attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + attached_hdl = le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) @@ -5648,7 +6328,7 @@ static u8 leapraid_set_new_card_port_table_after_reset( { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; u8 port_entry_num = 0; u16 sz; @@ -5660,14 +6340,14 @@ static u8 leapraid_set_new_card_port_table_after_reset( return port_entry_num; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; port_entry_num = leapraid_fill_card_port_table(adapter, sas_iounit_p0, new_card_port_table); -out: +out_free: kfree(sas_iounit_p0); return port_entry_num; } @@ -5676,9 +6356,9 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, struct leapraid_card_port *new_table, int entry_idx, int port_entry_num) { - struct leapraid_card_port *matched_card_port = NULL; + struct leapraid_card_port *matched_card_port; int matched_code; - int count = 0, lcount = 0; + int count, lcount = 0; u64 sas_addr; int i; @@ -5699,10 +6379,10 @@ static void leapraid_update_existing_port(struct leapraid_adapter *adapter, port_entry_num); } else if (matched_code == SAME_ADDR_ONLY) { sas_addr = new_table[entry_idx].sas_address; - for (i = 0; i < port_entry_num; i++) { + for (i = 0; i < port_entry_num; i++) if (new_table[i].sas_address == sas_addr) lcount++; - } + if (count > 1 || lcount > 1) return; @@ -5724,15 +6404,24 @@ static void leapraid_update_card_port_after_reset( struct leapraid_adapter *adapter) { struct leapraid_card_port *new_card_port_table; - struct leapraid_card_port *matched_card_port = NULL; - u8 port_entry_num = 0; + struct leapraid_card_port *matched_card_port; + u8 port_entry_num; u8 nr_phys; int i; if (leapraid_get_adapter_phys(adapter, &nr_phys) || !nr_phys) return; + if (!adapter->dev_topo.card.card_phy) { + adapter->dev_topo.card.card_phy = + kcalloc(nr_phys, sizeof(struct leapraid_card_phy), + GFP_KERNEL); + if (!adapter->dev_topo.card.card_phy) + return; + } + adapter->dev_topo.card.phys_num = nr_phys; + new_card_port_table = kcalloc(adapter->dev_topo.card.phys_num, sizeof(struct leapraid_card_port), GFP_KERNEL); @@ -5740,21 +6429,23 @@ static void leapraid_update_card_port_after_reset( return; port_entry_num = - leapraid_set_new_card_port_table_after_reset(adapter, - new_card_port_table); + leapraid_set_new_card_port_table_after_reset( + adapter, + new_card_port_table); if (!port_entry_num) - return; + goto out_free_port_table; list_for_each_entry(matched_card_port, - &adapter->dev_topo.card_port_list, list) { + &adapter->dev_topo.card_port_list, list) matched_card_port->flg |= LEAPRAID_CARD_PORT_FLG_DIRTY; - } matched_card_port = NULL; for (i = 0; i < port_entry_num; i++) leapraid_update_existing_port(adapter, new_card_port_table, i, port_entry_num); +out_free_port_table: + kfree(new_card_port_table); } static bool leapraid_is_valid_vphy( @@ -5765,13 +6456,16 @@ static bool leapraid_is_valid_vphy( union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; struct leapraid_sas_phy_p0 phy_p0; + u32 dev_info; - if ((sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> 4) < + if (sas_io_unit_p0->phy_info[phy_index].neg_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT < LEAPRAID_SAS_NEG_LINK_RATE_1_5) return false; - if (!(le32_to_cpu(sas_io_unit_p0->phy_info[phy_index].controller_phy_dev_info) & - LEAPRAID_DEVTYP_SEP)) + dev_info = le32_to_cpu(sas_io_unit_p0->phy_info[phy_index] + .controller_phy_dev_info); + if (!(dev_info & LEAPRAID_DEVTYP_SEP)) return false; cfgp1.phy_number = phy_index; @@ -5804,7 +6498,7 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, return; may_new_card_port->port_id = may_new_port_id; dev_err(&adapter->pdev->dev, - "%s: new card port %p added, port=%d\n", + "%s: New card port %p added, port=%d\n", __func__, may_new_card_port, may_new_port_id); list_add_tail(&may_new_card_port->list, &adapter->dev_topo.card_port_list); @@ -5820,8 +6514,10 @@ static void leapraid_update_vphy_binding(struct leapraid_adapter *adapter, sas_dev = leapraid_get_sas_dev_by_addr(adapter, attached_sas_addr, card_port); - if (sas_dev) + if (sas_dev) { sas_dev->card_port = may_new_card_port; + leapraid_sdev_put(sas_dev); + } } if (may_new_card_port->flg & LEAPRAID_CARD_PORT_FLG_DIRTY) { @@ -5836,7 +6532,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_p0 *sas_iounit_p0 = NULL; + struct leapraid_sas_io_unit_p0 *sas_iounit_p0; struct leapraid_card_port *card_port, *card_port_next; struct leapraid_vphy *vphy, *vphy_next; u64 attached_sas_addr; @@ -5852,9 +6548,8 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) continue; list_for_each_entry_safe(vphy, vphy_next, - &card_port->vphys_list, list) { + &card_port->vphys_list, list) vphy->flg |= LEAPRAID_VPHY_FLG_DIRTY; - } } sz = offsetof(struct leapraid_sas_io_unit_p0, phy_info) + @@ -5865,16 +6560,17 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) return; cfgp1.size = sz; - if ((leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, - GET_SAS_IOUNIT_PG0)) != 0) - goto out; + if (leapraid_op_config_page(adapter, sas_iounit_p0, cfgp1, cfgp2, + GET_SAS_IOUNIT_PG0) != 0) + goto out_free; for (i = 0; i < adapter->dev_topo.card.phys_num; i++) { if (!leapraid_is_valid_vphy(adapter, sas_iounit_p0, i)) continue; attached_hdl = - le16_to_cpu(sas_iounit_p0->phy_info[i].attached_dev_hdl); + le16_to_cpu(sas_iounit_p0->phy_info[i] + .attached_dev_hdl); if (leapraid_get_sas_address(adapter, attached_hdl, &attached_sas_addr) != 0) continue; @@ -5916,7 +6612,7 @@ static void leapraid_update_vphys_after_reset(struct leapraid_adapter *adapter) break; } } -out: +out_free: kfree(sas_iounit_p0); } @@ -5928,17 +6624,21 @@ static void leapraid_mark_all_dev_deleted(struct leapraid_adapter *adapter) shost_for_each_device(sdev, adapter->shost) { sdev_priv = sdev->hostdata; if (sdev_priv && sdev_priv->starget_priv) - sdev_priv->starget_priv->deleted = true; + sdev_priv->starget_priv->deleted = 1; } } static void leapraid_free_enc_list(struct leapraid_adapter *adapter) { struct leapraid_enc_node *enc_dev, *enc_dev_next; + LIST_HEAD(free_list); + unsigned long flags; + + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); + list_splice_init(&adapter->dev_topo.enc_list, &free_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); - list_for_each_entry_safe(enc_dev, enc_dev_next, - &adapter->dev_topo.enc_list, - list) { + list_for_each_entry_safe(enc_dev, enc_dev_next, &free_list, list) { list_del(&enc_dev->list); kfree(enc_dev); } @@ -5951,14 +6651,14 @@ static void leapraid_rebuild_enc_list_after_reset( union cfg_param_2 cfgp2 = {0}; struct leapraid_enc_node *enc_node; u16 enc_hdl; + unsigned long flags; int rc; leapraid_free_enc_list(adapter); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (enc_hdl = 0xFFFF; ; enc_hdl = le16_to_cpu(enc_node->pg0.enc_hdl)) { - enc_node = kzalloc(sizeof(*enc_node), - GFP_KERNEL); + enc_node = kzalloc(sizeof(*enc_node), GFP_KERNEL); if (!enc_node) return; @@ -5970,91 +6670,102 @@ static void leapraid_rebuild_enc_list_after_reset( return; } + spin_lock_irqsave(&adapter->dev_topo.enc_lock, flags); list_add_tail(&enc_node->list, &adapter->dev_topo.enc_list); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, flags); } } static void leapraid_mark_resp_sas_dev(struct leapraid_adapter *adapter, struct leapraid_sas_dev_p0 *sas_dev_p0) { - struct leapraid_starget_priv *starget_priv = NULL; + struct leapraid_starget_priv *starget_priv; struct leapraid_enc_node *enc_node = NULL; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; struct scsi_target *starget; unsigned long flags; + unsigned long enc_flags = 0; + u16 enc_hdl; + u64 enc_lid = 0; card_port = leapraid_get_port_by_id(adapter, sas_dev_p0->physical_port, false); - if (sas_dev_p0->enc_hdl) { - enc_node = leapraid_enc_find_by_hdl(adapter, - le16_to_cpu( - sas_dev_p0->enc_hdl)); + enc_hdl = le16_to_cpu(sas_dev_p0->enc_hdl); + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); + enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); if (!enc_node) dev_info(&adapter->pdev->dev, "enc hdl 0x%04x has no matched enc dev\n", - le16_to_cpu(sas_dev_p0->enc_hdl)); + enc_hdl); } spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_for_each_entry(sas_dev, &adapter->dev_topo.sas_dev_list, list) { - if (sas_dev->sas_addr == le64_to_cpu(sas_dev_p0->sas_address) && - sas_dev->slot == le16_to_cpu(sas_dev_p0->slot) && - sas_dev->card_port == card_port) { - sas_dev->resp = true; - starget = sas_dev->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->tm_busy = false; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } + if (sas_dev->sas_addr != le64_to_cpu(sas_dev_p0->sas_address) || + sas_dev->slot != le16_to_cpu(sas_dev_p0->slot) || + sas_dev->card_port != card_port) + continue; - if (starget) { - starget_printk(KERN_INFO, starget, - "dev: hdl=0x%04x, sas addr=0x%016llx, port_id=%d\n", - sas_dev->hdl, - (unsigned long long)sas_dev->sas_addr, - sas_dev->card_port->port_id); - if (sas_dev->enc_hdl != 0) - starget_printk(KERN_INFO, starget, - "enc info: enc_lid=0x%016llx, slot=%d\n", - (unsigned long long)sas_dev->enc_lid, - sas_dev->slot); - } + sas_dev->resp = 1; + starget = sas_dev->starget; + if (starget && starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->tm_busy = 0; + starget_priv->deleted = 0; + } else { + starget_priv = NULL; + } - if (le16_to_cpu(sas_dev_p0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { - sas_dev->enc_level = sas_dev_p0->enc_level; - memcpy(sas_dev->connector_name, - sas_dev_p0->connector_name, 4); - sas_dev->connector_name[4] = '\0'; - } else { - sas_dev->enc_level = 0; - sas_dev->connector_name[0] = '\0'; - } + if (starget) { + starget_printk( + KERN_INFO, starget, + "dev: hdl=0x%04x saddr=0x%016llx port_id=%d\n", + sas_dev->hdl, + (unsigned long long)sas_dev->sas_addr, + sas_dev->card_port->port_id); + if (sas_dev->enc_hdl != 0) + starget_printk( + KERN_INFO, + starget, + "enc info: enc_lid=0x%016llx slot=%d\n", + (unsigned long long)sas_dev->enc_lid, + sas_dev->slot); + } + + if (le16_to_cpu(sas_dev_p0->flg) & + LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { + sas_dev->enc_level = sas_dev_p0->enc_level; + memcpy(sas_dev->connector_name, + sas_dev_p0->connector_name, + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN); + sas_dev->connector_name[ + LEAPRAID_SAS_DEV_P0_CON_NAME_LEN] = '\0'; + } else { + sas_dev->enc_level = 0; + sas_dev->connector_name[0] = '\0'; + } + + sas_dev->enc_hdl = enc_hdl; + sas_dev->enc_lid = enc_lid; - sas_dev->enc_hdl = - le16_to_cpu(sas_dev_p0->enc_hdl); - if (enc_node) { - sas_dev->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - } - if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) - goto out; + if (sas_dev->hdl == le16_to_cpu(sas_dev_p0->dev_hdl)) + goto unlock; - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - sas_dev->hdl, sas_dev_p0->dev_hdl); - sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); - if (starget_priv) - starget_priv->hdl = - le16_to_cpu(sas_dev_p0->dev_hdl); - goto out; - } + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + sas_dev->hdl, sas_dev_p0->dev_hdl); + sas_dev->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + if (starget_priv) + starget_priv->hdl = le16_to_cpu(sas_dev_p0->dev_hdl); + + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); } @@ -6066,10 +6777,10 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) u32 device_info; dev_info(&adapter->pdev->dev, - "begin searching for sas end devices\n"); + "Begin searching for SAS end devices\n"); if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6082,63 +6793,58 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "sas end devices searching complete\n"); + "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, u64 wwid, u16 hdl) { - struct leapraid_starget_priv *starget_priv; struct leapraid_raid_volume *raid_volume; + struct leapraid_starget_priv *starget_priv = NULL; struct scsi_target *starget; unsigned long flags; + u64 volume_wwid; + u16 old_hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); - list_for_each_entry(raid_volume, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->wwid == wwid && raid_volume->starget) { - starget = raid_volume->starget; - if (starget && starget->hostdata) { - starget_priv = starget->hostdata; - starget_priv->deleted = false; - } else { - starget_priv = NULL; - } - - raid_volume->resp = true; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); + raid_volume = leapraid_raid_volume_find_by_wwid(adapter, wwid); + if (!raid_volume) + return; - starget_printk( - KERN_INFO, raid_volume->starget, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", - hdl, (unsigned long long)raid_volume->wwid); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, - flags); - if (raid_volume->hdl == hdl) { - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + if (!raid_volume->starget) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); + return; + } - dev_info(&adapter->pdev->dev, - "hdl changed: 0x%04x -> 0x%04x\n", - raid_volume->hdl, hdl); + starget = raid_volume->starget; + if (starget->hostdata) { + starget_priv = starget->hostdata; + starget_priv->deleted = 0; + } - raid_volume->hdl = hdl; - if (starget_priv) - starget_priv->hdl = hdl; - spin_unlock_irqrestore( - &adapter->dev_topo.raid_volume_lock, - flags); - return; - } + raid_volume->resp = 1; + volume_wwid = raid_volume->wwid; + old_hdl = raid_volume->hdl; + if (old_hdl != hdl) { + raid_volume->hdl = hdl; + if (starget_priv) + starget_priv->hdl = hdl; } spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + starget_printk(KERN_INFO, starget, + "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + hdl, (unsigned long long)volume_wwid); + if (old_hdl != hdl) + dev_info(&adapter->pdev->dev, + "hdl changed: 0x%04x -> 0x%04x\n", + old_hdl, hdl); + + leapraid_raid_volume_put(raid_volume); } static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) @@ -6150,17 +6856,22 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) struct leapraid_raidvol_p1 raidvol_p1; struct leapraid_raidvol_p0 raidvol_p0; struct leapraid_raidpd_p0 raidpd_p0; + unsigned long flags; u16 hdl; u8 phys_disk_num; + bool is_empty; if (!adapter->adapter_attr.raid_support) return; dev_info(&adapter->pdev->dev, - "begin searching for raid volumes\n"); + "Begin searching for RAID volumes\n"); - if (list_empty(&adapter->dev_topo.raid_volume_list)) - goto out; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + is_empty = list_empty(&adapter->dev_topo.raid_volume_list); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + if (is_empty) + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6191,11 +6902,16 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) cfgp2.form_specific = phys_disk_num) { phys_disk_num = raidpd_p0.phys_disk_num; hdl = le16_to_cpu(raidpd_p0.dev_hdl); - set_bit(hdl, (unsigned long *)adapter->dev_topo.pd_hdls); + if (!hdl || + hdl > adapter->adapter_attr.features.max_dev_handle) + dev_warn(&adapter->pdev->dev, + "%s: Invalid device handle\n", __func__); + else + set_bit(hdl, adapter->dev_topo.pd_hdls); } -out: +exit_search: dev_info(&adapter->pdev->dev, - "raid volumes searching complete\n"); + "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6211,10 +6927,17 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, port_id, false); unsigned long flags; + unsigned long enc_flags = 0; + u64 enc_lid = 0; int i; - if (enc_hdl) + if (enc_hdl) { + spin_lock_irqsave(&adapter->dev_topo.enc_lock, enc_flags); enc_node = leapraid_enc_find_by_hdl(adapter, enc_hdl); + if (enc_node) + enc_lid = le64_to_cpu(enc_node->pg0.enc_lid); + spin_unlock_irqrestore(&adapter->dev_topo.enc_lock, enc_flags); + } spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); list_for_each_entry(topo_node_exp, &adapter->dev_topo.exp_list, list) { @@ -6222,14 +6945,11 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->card_port != card_port) continue; - topo_node_exp->resp = true; - if (enc_node) { - topo_node_exp->enc_lid = - le64_to_cpu(enc_node->pg0.enc_lid); - topo_node_exp->enc_hdl = le16_to_cpu(exp_pg0->enc_hdl); - } + topo_node_exp->resp = 1; + topo_node_exp->enc_hdl = enc_hdl; + topo_node_exp->enc_lid = enc_lid; if (topo_node_exp->hdl == hdl) - goto out; + goto unlock; dev_info(&adapter->pdev->dev, "hdl changed: 0x%04x -> 0x%04x\n", @@ -6237,9 +6957,9 @@ static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, topo_node_exp->hdl = hdl; for (i = 0; i < topo_node_exp->phys_num; i++) topo_node_exp->card_phy[i].hdl = hdl; - goto out; + goto unlock; } -out: +unlock: spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); } @@ -6252,10 +6972,10 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_info(&adapter->pdev->dev, - "begin searching for expanders\n"); + dev_dbg(&adapter->pdev->dev, + "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto out; + goto exit_search; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6266,16 +6986,16 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) sas_address = le64_to_cpu(exp_p0.sas_address); port = exp_p0.physical_port; - dev_info(&adapter->pdev->dev, - "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", - hdl, (unsigned long long)sas_address, - ((adapter->adapter_attr.enable_mp) ? (port) : - (LEAPRAID_DISABLE_MP_PORT_ID))); + dev_dbg(&adapter->pdev->dev, + "exp detected: hdl=0x%04x, sas=0x%016llx, port=%u", + hdl, (unsigned long long)sas_address, + adapter->adapter_attr.enable_mp ? port : + LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -out: - dev_info(&adapter->pdev->dev, - "expander searching complete\n"); +exit_search: + dev_dbg(&adapter->pdev->dev, + "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -6287,7 +7007,7 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) adapter->reset_desc.pending_io_cnt = 0; if (!leapraid_pci_active(adapter)) { dev_err(&adapter->pdev->dev, - "%s %s: pci error, device reset or unplugged!\n", + "%s %s: PCI error, device reset or unplugged!\n", adapter->adapter_attr.name, __func__); return; } @@ -6299,9 +7019,9 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) for (i = 1; i <= adapter->shost->can_queue; i++) { io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, i); - if (io_req_tracker && io_req_tracker->taskid != 0) - if (io_req_tracker->scmd) - adapter->reset_desc.pending_io_cnt++; + if (io_req_tracker && io_req_tracker->taskid != 0 && + io_req_tracker->scmd) + adapter->reset_desc.pending_io_cnt++; } spin_unlock_irqrestore(&adapter->dynamic_task_desc.task_lock, flags); @@ -6309,38 +7029,37 @@ void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) return; wait_event_timeout(adapter->reset_desc.reset_wait_queue, - adapter->reset_desc.pending_io_cnt == 0, 10 * HZ); + adapter->reset_desc.pending_io_cnt == 0, + LEAPRAID_IO_CMD_TIMEOUT * HZ); } int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, enum reset_type type) { unsigned long flags; + bool wake = false; int rc; - if (!mutex_trylock(&adapter->reset_desc.adapter_reset_mutex)) { - do { - ssleep(1); - } while (adapter->access_ctrl.shost_recovering); - return adapter->reset_desc.adapter_reset_results; - } + mutex_lock(&adapter->reset_desc.adapter_reset_mutex); if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, - "pci_dev removed, pausing polling and cleaning cmds\n"); + "pci_dev removed, pause poll, clean cmds\n"); leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); } - rc = 0; - goto exit_pci_unavailable; + dev_err(&adapter->pdev->dev, "PCIe unavailable!\n"); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return -ENXIO; } - dev_info(&adapter->pdev->dev, "starting hard reset\n"); + dev_info(&adapter->pdev->dev, "Starting hard reset\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; + adapter->access_ctrl.shost_recover_async = 1; spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); leapraid_wait_cmds_done(adapter); @@ -6349,14 +7068,14 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, rc = leapraid_make_adapter_ready(adapter, type); if (rc) { dev_err(&adapter->pdev->dev, - "failed to make adapter ready, rc=%d\n", rc); - goto out; + "Failed to make adapter ready, rc=%d\n", rc); + goto out_cleanup; } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "firmware log init failed\n"); - goto out; + dev_err(&adapter->pdev->dev, "Firmware log init failed\n"); + goto out_cleanup; } leapraid_clean_active_cmds(adapter); @@ -6364,15 +7083,16 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, adapter->scan_dev_desc.scan_dev_failed) { dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; - goto out; + goto out_cleanup; } rc = leapraid_make_adapter_available(adapter); if (!rc) { dev_info(&adapter->pdev->dev, - "adapter is now available, rebuilding topology\n"); + "Adapter is now available, rebuilding topology\n"); if (adapter->adapter_attr.enable_mp) { leapraid_update_card_port_after_reset(adapter); leapraid_update_vphys_after_reset(adapter); @@ -6384,14 +7104,22 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_search_resp_exp(adapter); leapraid_hardreset_barrier(adapter); } -out: - dev_info(&adapter->pdev->dev, "hard reset %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); +out_cleanup: + dev_info(&adapter->pdev->dev, "Hard reset %s\n", + rc == 0 ? "SUCCESS" : "FAILED"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); + if (rc) { + adapter->access_ctrl.shost_recover_async = 0; + wake = true; + } spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); + if (wake) + wake_up(&adapter->access_ctrl.shost_recover_wq); + adapter->reset_desc.reset_cnt++; mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); @@ -6399,8 +7127,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_clean_active_scsi_cmds(adapter); leapraid_mq_polling_resume(adapter); -exit_pci_unavailable: - dev_info(&adapter->pdev->dev, "pcie unavailable!\n"); return rc; } @@ -6409,31 +7135,40 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) struct leapraid_adapter_features_req leap_mpi_req; struct leapraid_adapter_features_rep leap_mpi_rep; u8 fw_major, fw_minor, fw_build, fw_release; + u32 req_sz; + u32 rep_sz; u32 db; int r; db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED || - (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) + (db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { + dev_err(&adapter->pdev->dev, + "%s: Doorbell used or fault\n", __func__); return -EFAULT; + } - if (((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) && - ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL)) { - if (!leapraid_wait_adapter_ready(adapter)) - return -EFAULT; + if ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY && + (db & LEAPRAID_DB_MASK) != LEAPRAID_DB_OPERATIONAL && + !leapraid_wait_adapter_ready(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: adapter not ready\n", __func__); + return -EFAULT; } - memset(&leap_mpi_req, 0, sizeof(struct leapraid_adapter_features_req)); - memset(&leap_mpi_rep, 0, sizeof(struct leapraid_adapter_features_rep)); + req_sz = sizeof(struct leapraid_adapter_features_req); + rep_sz = sizeof(struct leapraid_adapter_features_rep); + memset(&leap_mpi_req, 0, req_sz); + memset(&leap_mpi_rep, 0, rep_sz); leap_mpi_req.func = LEAPRAID_FUNC_GET_ADAPTER_FEATURES; r = leapraid_handshake_func(adapter, - sizeof(struct leapraid_adapter_features_req), + req_sz, (u32 *)&leap_mpi_req, - sizeof(struct leapraid_adapter_features_rep), + rep_sz, (u16 *)&leap_mpi_rep); if (r) { dev_err(&adapter->pdev->dev, - "%s %s: handshake failed, r=%d\n", + "%s %s: Handshake failed, r=%d\n", adapter->adapter_attr.name, __func__, r); return r; } @@ -6460,19 +7195,43 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) LEAPRAID_MAX_DEV_HANDLE_DEFAULT; adapter->adapter_attr.features.min_dev_handle = le16_to_cpu(leap_mpi_rep.min_dev_hdl); - if ((adapter->adapter_attr.features.adapter_caps & - LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID)) - adapter->adapter_attr.raid_support = true; + if (adapter->adapter_attr.features.adapter_caps & + LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID) + adapter->adapter_attr.raid_support = 1; + adapter->adapter_attr.wideport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_wide_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth = + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) ? + le16_to_cpu(leap_mpi_rep.sas_narrow_max_qdepth) : + LEAPRAID_SAS_QUEUE_DEPTH; + adapter->adapter_attr.sata_max_queue_depth = + leap_mpi_rep.sata_max_qdepth ? + leap_mpi_rep.sata_max_qdepth : + LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.raid_volume_max_queue_depth = + LEAPRAID_RAID_QUEUE_DEPTH; + dev_info(&adapter->pdev->dev, + "max: wp qd=%d, np qd=%d, SATA qd=%d, raid qd=%d\n", + adapter->adapter_attr.wideport_max_queue_depth, + adapter->adapter_attr.narrowport_max_queue_depth, + adapter->adapter_attr.sata_max_queue_depth, + adapter->adapter_attr.raid_volume_max_queue_depth); if (WARN_ON(!(adapter->adapter_attr.features.adapter_caps & LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ))) return -EFAULT; adapter->adapter_attr.features.fw_version = le32_to_cpu(leap_mpi_rep.fw_version); - fw_major = (adapter->adapter_attr.features.fw_version >> 24) & 0xFF; - fw_minor = (adapter->adapter_attr.features.fw_version >> 16) & 0xFF; - fw_build = (adapter->adapter_attr.features.fw_version >> 8) & 0xFF; - fw_release = adapter->adapter_attr.features.fw_version & 0xFF; + fw_major = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MAJOR_SHIFT) & LEAPRAID_VER_MASK; + fw_minor = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_MINOR_SHIFT) & LEAPRAID_VER_MASK; + fw_build = (adapter->adapter_attr.features.fw_version >> + LEAPRAID_VER_BUILD_SHIFT) & LEAPRAID_VER_MASK; + fw_release = + adapter->adapter_attr.features.fw_version & LEAPRAID_VER_MASK; dev_info(&adapter->pdev->dev, "Firmware version: %u.%u.%u.%u (0x%08x)\n", @@ -6484,7 +7243,7 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) "Unsupported firmware major version, requires >= 2\n"); return -EFAULT; } - adapter->shost->max_id = -1; + adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; return 0; } @@ -6511,54 +7270,50 @@ static int leapraid_enable_pcie(struct leapraid_adapter *adapter) rc = pci_enable_device(adapter->pdev); if (rc) { - dev_err(&adapter->pdev->dev, "failed to enable PCI device\n"); + dev_err(&adapter->pdev->dev, "Failed to enable PCI device\n"); return rc; } rc = pci_request_regions(adapter->pdev, LEAPRAID_DRIVER_NAME); if (rc) { dev_err(&adapter->pdev->dev, - "failed to obtain PCI resources\n"); - goto disable_pcie; + "Failed to obtain PCI resources\n"); + return rc; } if (sizeof(dma_addr_t) > 4) { - dma_mask = DMA_BIT_MASK(64); - adapter->adapter_attr.use_32_dma_mask = false; + dma_mask = DMA_BIT_MASK(DMA_64_BITS); + adapter->adapter_attr.use_32_dma_mask = 0; } else { - dma_mask = DMA_BIT_MASK(32); - adapter->adapter_attr.use_32_dma_mask = true; + dma_mask = DMA_BIT_MASK(DMA_32_BITS); + adapter->adapter_attr.use_32_dma_mask = 1; } rc = dma_set_mask_and_coherent(&adapter->pdev->dev, dma_mask); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set %lld DMA mask\n", dma_mask); - goto disable_pcie; + "Failed to set %lld DMA mask\n", dma_mask); + return rc; } adapter->iomem_base = ioremap(pci_resource_start(adapter->pdev, 0), sizeof(struct leapraid_reg_base)); if (!adapter->iomem_base) { dev_err(&adapter->pdev->dev, - "failed to map memory for controller registers\n"); - rc = -ENOMEM; - goto disable_pcie; + "Failed to map memory for controller registers\n"); + return -ENOMEM; } pci_enable_pcie_error_reporting(adapter->pdev); pci_set_master(adapter->pdev); return 0; - -disable_pcie: - return rc; } static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i, base_group, this_group; - unsigned int cpu, nr_cpus, total_msix, index = 0; + unsigned int cpu, nr_cpus, total_msix, index; total_msix = adapter->notification_desc.iopoll_qdex; nr_cpus = num_online_cpus(); @@ -6600,8 +7355,12 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq = &adapter->notification_desc.int_rqs[i]; affinity_mask = pci_irq_get_affinity(adapter->pdev, int_rq->rq.msix_idx); - if (!affinity_mask) - goto out; + if (!affinity_mask) { + dev_warn(&adapter->pdev->dev, + "%s: IRQ affinity NULL, msix_idx=%d\n", + __func__, int_rq->rq.msix_idx); + goto out_apply_irq_affinity; + } for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) @@ -6611,7 +7370,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } -out: +out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -6628,27 +7387,26 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; unsigned int i; + int irq; - if (!adapter->notification_desc.int_rqs) - return; - - for (i = 0; i < adapter->notification_desc.int_rqs_allocated; i++) { + for (i = 0; adapter->notification_desc.int_rqs && + i < adapter->notification_desc.int_rqs_allocated; i++) { int_rq = &adapter->notification_desc.int_rqs[i]; if (!int_rq) continue; - irq_set_affinity_hint(pci_irq_vector(adapter->pdev, - int_rq->rq.msix_idx), NULL); - free_irq(pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx), - &int_rq->rq); + irq = pci_irq_vector(adapter->pdev, int_rq->rq.msix_idx); + irq_set_affinity_hint(irq, NULL); + free_irq(irq, &int_rq->rq); } adapter->notification_desc.int_rqs_allocated = 0; - if (!adapter->notification_desc.msix_enable) - return; + if (adapter->notification_desc.irq_vectors_allocated) { + pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; + } - pci_free_irq_vectors(adapter->pdev); - adapter->notification_desc.msix_enable = false; + adapter->notification_desc.msix_enable = 0; kfree(adapter->notification_desc.blk_mq_poll_rqs); adapter->notification_desc.blk_mq_poll_rqs = NULL; @@ -6658,16 +7416,9 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) kfree(adapter->notification_desc.msix_cpu_map); adapter->notification_desc.msix_cpu_map = NULL; -} - -static inline int leapraid_msix_cnt(struct pci_dev *pdev) -{ - return pci_msix_vec_count(pdev); -} - -static inline int leapraid_msi_cnt(struct pci_dev *pdev) -{ - return pci_msi_vec_count(pdev); + adapter->notification_desc.msix_cpu_map_sz = 0; + adapter->notification_desc.iopoll_qdex = 0; + adapter->notification_desc.iopoll_qcnt = 0; } static int leapraid_setup_irqs(struct leapraid_adapter *adapter) @@ -6675,7 +7426,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) unsigned int i; int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, @@ -6684,22 +7435,26 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi/msix vectors alloacted failed!\n", + "%d MSI/MSIX vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); return rc; } + + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = + LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == 0) + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == 1) + else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -6710,6 +7465,7 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); + if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -6741,10 +7497,12 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "legacy irq alloacted failed!\n"); + "Legacy irq allocated failed!\n"); return rc; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_LEGACY; rc = request_irq(pci_irq_vector(adapter->pdev, 0), leapraid_irq_handler, IRQF_SHARED, @@ -6753,8 +7511,9 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) if (rc) { irq_set_affinity_hint(pci_irq_vector(adapter->pdev, 0), NULL); pci_free_irq_vectors(adapter->pdev); + adapter->notification_desc.irq_vectors_allocated = 0; dev_err(&adapter->pdev->dev, - "Legact Int: request_irq %s failed!\n", + "Legacy Int: request_irq %s failed!\n", adapter->notification_desc.int_rqs[0].rq.name); return -EBUSY; } @@ -6768,8 +7527,8 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; @@ -6778,19 +7537,15 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) adapter->adapter_attr.rq_cnt; adapter->notification_desc.iopoll_qcnt = 0; dev_info(&adapter->pdev->dev, - "Legacy Intr: req queue cnt=%d, intr=%d/poll=%d rep queues!\n", + "Legacy Intr: req queue cnt=%d intr=%d/poll=%d rep queues!\n", adapter->adapter_attr.rq_cnt, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qcnt); adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "Legacy Intr: allocate %d intr rep queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } rc = leapraid_setup_legacy_int(adapter); @@ -6804,13 +7559,13 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) int rc, msix_cnt; if (msix_disable == 1) - goto legacy_int; + goto apply_legacy_int; - msix_cnt = leapraid_msix_cnt(adapter->pdev); + msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); - goto legacy_int; + dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); + goto apply_legacy_int; } msix_cnt = min_t(int, msix_cnt, @@ -6852,25 +7607,25 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) adapter->notification_desc.int_rqs = kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSIx: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = adapter; adapter->notification_desc.blk_mq_poll_rqs[i].rq.msix_idx = i + adapter->notification_desc.iopoll_qdex; - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, 0); + atomic_set( + &adapter->notification_desc.blk_mq_poll_rqs[i].rq.busy, + 0); snprintf(adapter->notification_desc.blk_mq_poll_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MQ-Poll%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, 0); - atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].busy, + 0); + atomic_set(&adapter->notification_desc.blk_mq_poll_rqs[i].pause, + 0); } adapter->notification_desc.msix_cpu_map_sz = @@ -6880,20 +7635,21 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; + memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -6906,13 +7662,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) int rc, msi_cnt; if (msix_disable == 1) - goto legacy_int1; + goto apply_legacy_int; - msi_cnt = leapraid_msi_cnt(adapter->pdev); + msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { - dev_info(&adapter->pdev->dev, "msi unsupported!\n"); - goto legacy_int1; + dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); + goto apply_legacy_int; } msi_cnt = min_t(int, msi_cnt, @@ -6952,10 +7708,13 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) PCI_IRQ_MSI | PCI_IRQ_AFFINITY, NULL); if (rc < 0) { dev_err(&adapter->pdev->dev, - "%d msi vectors alloacted failed!\n", + "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); - goto legacy_int1; + leapraid_free_irq(adapter); + goto apply_legacy_int; } + adapter->notification_desc.irq_vectors_allocated = 1; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -6972,12 +7731,8 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) kcalloc(adapter->notification_desc.iopoll_qdex, sizeof(struct leapraid_int_rq), GFP_KERNEL); - if (!adapter->notification_desc.int_rqs) { - dev_err(&adapter->pdev->dev, - "MSI: allocate %d interrupt reply queues failed!\n", - adapter->notification_desc.iopoll_qdex); + if (!adapter->notification_desc.int_rqs) return -ENOMEM; - } for (i = 0; i < adapter->notification_desc.iopoll_qcnt; i++) { adapter->notification_desc.blk_mq_poll_rqs[i].rq.adapter = @@ -7001,24 +7756,24 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); if (!adapter->notification_desc.msix_cpu_map) return -ENOMEM; memset(adapter->notification_desc.msix_cpu_map, 0, adapter->notification_desc.msix_cpu_map_sz); - adapter->notification_desc.msix_enable = true; + adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); - adapter->notification_desc.msix_enable = false; - goto legacy_int1; + adapter->notification_desc.msix_enable = 0; + goto apply_legacy_int; } return 0; -legacy_int1: +apply_legacy_int: rc = leapraid_set_legacy_int(adapter); return rc; @@ -7028,30 +7783,26 @@ static int leapraid_set_notification(struct leapraid_adapter *adapter) { int rc = 0; - if (interrupt_mode == 0) { + if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = leapraid_set_msix(adapter); if (rc) - pr_err("%s enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == 1) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI-X irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { rc = leapraid_set_msi(adapter); if (rc) - pr_err("%s enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == 2) { + dev_err(&adapter->pdev->dev, + "%s: Enable MSI irq failed!\n", __func__); + } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { rc = leapraid_set_legacy_int(adapter); if (rc) - pr_err("%s enable legacy irq failed!\n", __func__); + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); } return rc; } -static void leapraid_disable_pcie_and_notification( - struct leapraid_adapter *adapter) -{ - leapraid_free_irq(adapter); - leapraid_disable_pcie(adapter); -} - int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) { int rc; @@ -7064,13 +7815,13 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_ready(adapter, PART_RESET); if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + dev_err(&adapter->pdev->dev, "Make adapter ready failure\n"); goto out_fail; } rc = leapraid_get_adapter_features(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + dev_err(&adapter->pdev->dev, "Get adapter feature failure\n"); goto out_fail; } @@ -7083,7 +7834,8 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) return 0; out_fail: - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); return rc; } @@ -7094,11 +7846,13 @@ void leapraid_disable_controller(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); - adapter->access_ctrl.shost_recovering = true; + adapter->access_ctrl.shost_recovering = 1; leapraid_make_adapter_ready(adapter, PART_RESET); - adapter->access_ctrl.shost_recovering = false; + adapter->access_ctrl.shost_recovering = 0; + wake_up(&adapter->access_ctrl.recovery_waitq); - leapraid_disable_pcie_and_notification(adapter); + leapraid_free_irq(adapter); + leapraid_disable_pcie(adapter); } static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) @@ -7112,12 +7866,11 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - rc = -EFAULT; - goto out; + dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + return -EFAULT; } -out: - dev_info(&adapter->pdev->dev, "unit reset: %s\n", - ((rc == 0) ? "SUCCESS" : "FAILED")); + + dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7137,13 +7890,13 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, while ((db & LEAPRAID_DB_MASK) != LEAPRAID_DB_READY) { if (count++ == LEAPRAID_DB_RETRY_COUNT_MAX) { dev_err(&adapter->pdev->dev, - "wait adapter ready timeout\n"); + "Wait adapter ready timeout\n"); return -EFAULT; } ssleep(1); db = leapraid_readl(&adapter->iomem_base->db); dev_info(&adapter->pdev->dev, - "wait adapter ready, count=%d, db=0x%x\n", + "Wait adapter ready, count=%d, db=0x%x\n", count, db); } } @@ -7159,9 +7912,9 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, if (type == FULL_RESET) goto full_reset; - if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL) - if (!(leapraid_adapter_unit_reset(adapter))) - return 0; + if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_OPERATIONAL && + !leapraid_adapter_unit_reset(adapter)) + return 0; full_reset: rc = leapraid_host_diag_reset(adapter); @@ -7202,12 +7955,8 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) LEAPRAID_SYS_LOG_BUF_RESERVE), &adapter->fw_log_desc.fw_log_buffer_dma, GFP_KERNEL); - if (!adapter->fw_log_desc.fw_log_buffer) { - dev_err(&adapter->pdev->dev, - "%s: log buf alloc failed.\n", - __func__); + if (!adapter->fw_log_desc.fw_log_buffer) return -ENOMEM; - } } memset(&adapter_log_req, 0, sizeof(struct leapraid_adapter_log_req)); @@ -7226,7 +7975,7 @@ static int leapraid_fw_log_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_log_rep), (u16 *)&adapter_log_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7265,7 +8014,7 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_msg) { dma_free_coherent( &adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIEZ, + adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE, adapter->mem_desc.rep_msg, adapter->mem_desc.rep_msg_dma); adapter->mem_desc.rep_msg = NULL; @@ -7283,15 +8032,19 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) if (adapter->mem_desc.rep_desc_seg_maint) { for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { - if (adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { + if (adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg) { dma_free_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg, - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma); - adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = NULL; + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg, + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma); + adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg = NULL; } } @@ -7306,7 +8059,8 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) } for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) - kfree(adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint); + kfree(adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_maint); kfree(adapter->mem_desc.rep_desc_seg_maint); } @@ -7324,16 +8078,16 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) { - return (upper_32_bits(start) == upper_32_bits(start + size - 1)); + return upper_32_bits(start) == upper_32_bits(start + size - 1); } int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker) { io_tracker->chain = - dma_pool_alloc(adapter->mem_desc.sg_chain_pool, - GFP_KERNEL, - &io_tracker->chain_dma); + dma_pool_alloc(adapter->mem_desc.sg_chain_pool, + GFP_KERNEL, + &io_tracker->chain_dma); if (!io_tracker->chain) return -ENOMEM; @@ -7360,17 +8114,16 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) unsigned int i, j; int rc; - /* sg table size */ + /* Scatter-gather table size. */ adapter->shost->sg_tablesize = LEAPRAID_SG_DEPTH; if (reset_devices) adapter->shost->sg_tablesize = LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS; - /* high priority cmds queue depth */ - adapter->dynamic_task_desc.hp_cmd_qd = facts->hp_slot; + /* High-priority commands queue depth. */ adapter->dynamic_task_desc.hp_cmd_qd = LEAPRAID_FIXED_HP_CMDS; - /* internal cmds queue depth */ + /* Internal commands queue depth. */ adapter->dynamic_task_desc.inter_cmd_qd = LEAPRAID_FIXED_INTER_CMDS; - /* adapter cmds total queue depth */ + /* Adapter commands total queue depth. */ if (reset_devices) adapter->adapter_attr.adapter_total_qd = LEAPRAID_DEFAULT_CMD_QD_OFFSET + @@ -7379,22 +8132,22 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) else adapter->adapter_attr.adapter_total_qd = facts->req_slot + adapter->dynamic_task_desc.hp_cmd_qd; - /* reply message queue depth */ + /* Reply message queue depth. */ adapter->adapter_attr.rep_msg_qd = adapter->adapter_attr.adapter_total_qd + LEAPRAID_DEFAULT_CMD_QD_OFFSET; - /* reply descriptor queue depth */ + /* Reply descriptor queue depth. */ adapter->adapter_attr.rep_desc_qd = round_up(adapter->adapter_attr.adapter_total_qd + adapter->adapter_attr.rep_msg_qd + LEAPRAID_TASKID_OFFSET_CTRL_CMD, LEAPRAID_REPLY_QD_ALIGNMENT); - /* scsi cmd io depth */ + /* SCSI command I/O depth. */ adapter->adapter_attr.io_qd = adapter->adapter_attr.adapter_total_qd - adapter->dynamic_task_desc.hp_cmd_qd - adapter->dynamic_task_desc.inter_cmd_qd; - /* scsi host can queue */ + /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + @@ -7403,7 +8156,7 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; - /* allocate task descriptor */ + /* Allocate task descriptor. */ try_again: adapter->adapter_attr.task_desc_dma_size = (adapter->adapter_attr.adapter_total_qd + @@ -7414,49 +8167,41 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->adapter_attr.task_desc_dma_size, &adapter->mem_desc.task_desc_dma, GFP_KERNEL); - if (!adapter->mem_desc.task_desc) { - dev_err(&adapter->pdev->dev, - "failed to allocate task descriptor DMA!\n"); - rc = -ENOMEM; - goto out; - } - /* allocate chain message pool */ + if (!adapter->mem_desc.task_desc) + return -ENOMEM; + + /* Allocate chain message pool. */ adapter->mem_desc.sg_chain_pool_size = LEAPRAID_DEFAULT_CHAINS_PER_IO * LEAPRAID_CHAIN_SEG_SIZE; adapter->mem_desc.sg_chain_pool = dma_pool_create("leapraid chain pool", &adapter->pdev->dev, - adapter->mem_desc.sg_chain_pool_size, 16, 0); - if (!adapter->mem_desc.sg_chain_pool) { - dev_err(&adapter->pdev->dev, - "failed to allocate chain message DMA!\n"); - rc = -ENOMEM; - goto out; - } + adapter->mem_desc.sg_chain_pool_size, + LEAPRAID_DMA_ALIGN, 0); + if (!adapter->mem_desc.sg_chain_pool) + return -ENOMEM; - /* allocate io tracker to ref scsi io */ + /* Allocate I/O tracker to SCSI I/O. */ adapter->mem_desc.io_tracker = kcalloc(adapter->shost->can_queue, sizeof(struct leapraid_io_req_tracker), GFP_KERNEL); - if (!adapter->mem_desc.io_tracker) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.io_tracker) + return -ENOMEM; for (i = 0; (int)i < adapter->shost->can_queue; i++) { rc = leapraid_internal_init_cmd_priv( adapter, adapter->mem_desc.io_tracker + i); if (rc) - goto out; + goto out_fail; } adapter->dynamic_task_desc.hp_taskid = adapter->adapter_attr.io_qd + LEAPRAID_HP_TASKID_OFFSET_CTL_CMD; - /* allocate static hp taskid */ + /* Allocate static high-priority task ID. */ adapter->driver_cmds.ctl_cmd.hp_taskid = adapter->dynamic_task_desc.hp_taskid; adapter->driver_cmds.tm_cmd.hp_taskid = @@ -7477,9 +8222,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; - adapter->driver_cmds.raid_action_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -7507,64 +8249,58 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_taskid); /* - * allocate sense dma, driver maintain - * need in same 4GB segment + * Allocate sense data DMA buffer. + * Constraint: Must reside within the same 4GB segment + * (driver-maintained). */ adapter->mem_desc.sense_data = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE, - &adapter->mem_desc.sense_data_dma, GFP_KERNEL); - if (!adapter->mem_desc.sense_data) { - dev_err(&adapter->pdev->dev, - "failed to allocate sense data DMA!\n"); - rc = -ENOMEM; - goto out; - } + &adapter->mem_desc.sense_data_dma, + GFP_KERNEL); + if (!adapter->mem_desc.sense_data) + return -ENOMEM; + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.sense_data_dma, adapter->adapter_attr.io_qd * SCSI_SENSE_BUFFERSIZE)) { dev_warn(&adapter->pdev->dev, - "try 32 bit dma due to sense data is not in same 4g!\n"); + "Try 32bit DMA: Sense not in same 4G\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* reply frame, need in same 4GB segment */ + /* + * Allocate reply frame buffer. + * Constraint: Must reside in the same 4GB segment as the sense DMA. + */ adapter->mem_desc.rep_msg = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ, - &adapter->mem_desc.rep_msg_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REPLY_SIZE, + &adapter->mem_desc.rep_msg_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg) + return -ENOMEM; if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REPLY_SIEZ)) { + LEAPRAID_REPLY_SIZE)) { dev_warn(&adapter->pdev->dev, - "use 32 bit dma due to rep msg is not in same 4g!\n"); + "Use 32 bit DMA due to rep msg is not in same 4g!\n"); rc = -EAGAIN; - goto out; + goto out_fail; } - /* address of reply frame */ + /* Address of reply frame. */ adapter->mem_desc.rep_msg_addr = - dma_alloc_coherent(&adapter->pdev->dev, - adapter->adapter_attr.rep_msg_qd * - LEAPRAID_REP_MSG_ADDR_SIZE, - &adapter->mem_desc.rep_msg_addr_dma, - GFP_KERNEL); - if (!adapter->mem_desc.rep_msg_addr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply message address DMA!\n"); - rc = -ENOMEM; - goto out; - } + dma_alloc_coherent(&adapter->pdev->dev, + adapter->adapter_attr.rep_msg_qd * + LEAPRAID_REP_MSG_ADDR_SIZE, + &adapter->mem_desc.rep_msg_addr_dma, + GFP_KERNEL); + if (!adapter->mem_desc.rep_msg_addr) + return -ENOMEM; adapter->adapter_attr.rep_desc_q_seg_cnt = DIV_ROUND_UP(adapter->adapter_attr.rq_cnt, LEAPRAID_REP_DESC_CHUNK_SIZE); @@ -7572,10 +8308,8 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(adapter->adapter_attr.rep_desc_q_seg_cnt, sizeof(struct leapraid_rep_desc_seg_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint) + return -ENOMEM; rep_desc_q_cnt_allocated = 0; for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { @@ -7583,25 +8317,20 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) kcalloc(LEAPRAID_REP_DESC_CHUNK_SIZE, sizeof(struct leapraid_rep_desc_maint), GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) { - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_maint) + return -ENOMEM; adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, (adapter->adapter_attr.rep_desc_qd * - LEAPRAID_REP_DESC_ENTRY_SIZE) * + LEAPRAID_REP_DESC_ENTRY_SIZE) * LEAPRAID_REP_DESC_CHUNK_SIZE, - &adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg_dma, + &adapter->mem_desc.rep_desc_seg_maint[i] + .rep_desc_seg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor segment DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_seg_maint[i].rep_desc_seg) + return -ENOMEM; for (j = 0; j < LEAPRAID_REP_DESC_CHUNK_SIZE; j++) { if (rep_desc_q_cnt_allocated >= @@ -7634,30 +8363,26 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) if (!reset_devices) { adapter->mem_desc.rep_desc_q_arr = - dma_alloc_coherent( + dma_alloc_coherent( &adapter->pdev->dev, adapter->adapter_attr.rq_cnt * LEAPRAID_REP_RQ_CNT_SIZE, &adapter->mem_desc.rep_desc_q_arr_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_desc_q_arr) { - dev_err(&adapter->pdev->dev, - "failed to allocate reply descriptor queue array DMA!\n"); - rc = -ENOMEM; - goto out; - } + if (!adapter->mem_desc.rep_desc_q_arr) + return -ENOMEM; } return 0; -out: +out_fail: if (rc == -EAGAIN) { leapraid_free_host_memory(adapter); - adapter->adapter_attr.use_32_dma_mask = true; + adapter->adapter_attr.use_32_dma_mask = 1; rc = dma_set_mask_and_coherent(&adapter->pdev->dev, - DMA_BIT_MASK(32)); + DMA_BIT_MASK(DMA_32_BITS)); if (rc) { dev_err(&adapter->pdev->dev, - "failed to set 32 DMA mask\n"); + "Failed to set 32 DMA mask\n"); return rc; } goto try_again; @@ -7667,12 +8392,13 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { - adapter->dev_topo.pd_hdls_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pd_hdls_sz++; + u16 pd_hdls_sz; + + pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / + LEAPRAID_BITS_PER_BYTE; + pd_hdls_sz++; + + adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = kzalloc(adapter->dev_topo.pd_hdls_sz, GFP_KERNEL); if (!adapter->dev_topo.pd_hdls) @@ -7683,24 +8409,6 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) if (!adapter->dev_topo.blocking_hdls) return -ENOMEM; - adapter->dev_topo.pending_dev_add_sz = - adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - if (adapter->adapter_attr.features.max_dev_handle % - LEAPRAID_BITS_PER_BYTE) - adapter->dev_topo.pending_dev_add_sz++; - adapter->dev_topo.pending_dev_add = - kzalloc(adapter->dev_topo.pending_dev_add_sz, GFP_KERNEL); - if (!adapter->dev_topo.pending_dev_add) - return -ENOMEM; - - adapter->dev_topo.dev_removing_sz = - adapter->dev_topo.pending_dev_add_sz; - adapter->dev_topo.dev_removing = - kzalloc(adapter->dev_topo.dev_removing_sz, GFP_KERNEL); - if (!adapter->dev_topo.dev_removing) - return -ENOMEM; - return 0; } @@ -7708,13 +8416,11 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) { kfree(adapter->dev_topo.pd_hdls); kfree(adapter->dev_topo.blocking_hdls); - kfree(adapter->dev_topo.pending_dev_add); - kfree(adapter->dev_topo.dev_removing); } static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size = 0; + u32 buffer_size; void *buffer; INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); @@ -7767,15 +8473,14 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) return -ENOMEM; adapter->driver_cmds.internal_scmd = buffer; - buffer = (void *)((u8 *)buffer + - sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker)); + buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + + sizeof(struct leapraid_io_req_tracker); adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (void *)((u8 *)buffer + SCSI_SENSE_BUFFERSIZE); + (unsigned char *)buffer; + buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (void *)((u8 *)buffer + sizeof(struct scatterlist)); + (struct scatterlist *)buffer; + buffer = (u8 *)buffer + sizeof(struct scatterlist); adapter->driver_cmds.internal_scmd->cmnd = buffer; adapter->driver_cmds.internal_scmd->host_scribble = (unsigned char *)(adapter->driver_cmds.internal_scmd + 1); @@ -7821,32 +8526,34 @@ static void leapraid_init_event_mask(struct leapraid_adapter *adapter) int i; for (i = 0; i < LEAPRAID_EVT_MASK_COUNT; i++) - adapter->fw_evt_s.leapraid_evt_masks[i] = -1; - leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DISCOVERY); + adapter->fw_evt_s.leapraid_evt_masks[i] = + LEAPRAID_INVALID_INITIAL_VALUE; + leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE); leapraid_unmask_evts(adapter, LEAPRAID_EVT_IR_CHANGE); } -static void leapraid_prepare_adp_init_req( +static void leapraid_prepare_adapter_init_req( struct leapraid_adapter *adapter, struct leapraid_adapter_init_req *init_req) { ktime_t cur_time; - int i; + int i, chunk; u32 reply_post_free_ary_sz; memset(init_req, 0, sizeof(struct leapraid_adapter_init_req)); init_req->func = LEAPRAID_FUNC_ADAPTER_INIT; init_req->who_init = LEAPRAID_WHOINIT_LINUX_DRIVER; - init_req->msg_ver = cpu_to_le16(0x0100); - init_req->header_ver = cpu_to_le16(0x0000); - - init_req->driver_ver = cpu_to_le32((LEAPRAID_MAJOR_VERSION << 24) | - (LEAPRAID_MINOR_VERSION << 16) | - (LEAPRAID_BUILD_VERSION << 8) | - LEAPRAID_RELEASE_VERSION); + init_req->msg_ver = cpu_to_le16(LEAPRAID_MSG_VERSION); + init_req->header_ver = cpu_to_le16(LEAPRAID_HEADER_VERSION); + init_req->driver_ver = + cpu_to_le32((LEAPRAID_MAJOR_VERSION << + LEAPRAID_VER_MAJOR_SHIFT) | + (LEAPRAID_MINOR_VERSION << LEAPRAID_VER_MINOR_SHIFT) | + (LEAPRAID_BUILD_VERSION << LEAPRAID_VER_BUILD_SHIFT) | + LEAPRAID_RELEASE_VERSION); if (adapter->notification_desc.msix_enable) init_req->host_msix_vectors = adapter->adapter_attr.rq_cnt; @@ -7870,18 +8577,13 @@ static void leapraid_prepare_adp_init_req( memset(adapter->mem_desc.rep_desc_q_arr, 0, reply_post_free_ary_sz); - for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) { - adapter->mem_desc - .rep_desc_q_arr[i] - .rep_desc_base_addr = - cpu_to_le64 ( - (u64)adapter->mem_desc - .rep_desc_seg_maint[i / - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_maint[i % - LEAPRAID_REP_DESC_CHUNK_SIZE] - .rep_desc_dma); - } + chunk = LEAPRAID_REP_DESC_CHUNK_SIZE; + for (i = 0; i < adapter->adapter_attr.rq_cnt; i++) + adapter->mem_desc.rep_desc_q_arr[i].rep_desc_base_addr = + cpu_to_le64 ((u64)adapter->mem_desc + .rep_desc_seg_maint[i / chunk] + .rep_desc_maint[i % chunk] + .rep_desc_dma); init_req->msg_flg = LEAPRAID_ADAPTER_INIT_MSGFLG_RDPQ_ARRAY_MODE; @@ -7903,9 +8605,9 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) struct leapraid_adapter_init_req init_req; struct leapraid_adapter_init_rep init_rep; u16 adapter_status; - int rc = 0; + int rc; - leapraid_prepare_adp_init_req(adapter, &init_req); + leapraid_prepare_adapter_init_req(adapter, &init_req); rc = leapraid_handshake_func(adapter, sizeof(struct leapraid_adapter_init_req), @@ -7913,7 +8615,7 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) sizeof(struct leapraid_adapter_init_rep), (u16 *)&init_rep); if (rc != 0) { - dev_err(&adapter->pdev->dev, "%s: handshake failed, rc=%d\n", + dev_err(&adapter->pdev->dev, "%s: Handshake failed, rc=%d\n", __func__, rc); return rc; } @@ -7934,11 +8636,10 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_sas_io_unit_page1 *sas_io_unit_page1 = NULL; + struct leapraid_manufacturing_p0 manufacturing_page0; struct leapraid_bios_page3 bios_page3; struct leapraid_bios_page2 bios_page2; - int rc = 0; - int sz; + int rc; rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); @@ -7950,79 +8651,49 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) if (rc) return rc; + rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, + cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + adapter->adapter_attr.bios_version = le32_to_cpu(bios_page3.bios_version); - adapter->adapter_attr.wideport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.narrowport_max_queue_depth = - LEAPRAID_SAS_QUEUE_DEPTH; - adapter->adapter_attr.sata_max_queue_depth = - LEAPRAID_SATA_QUEUE_DEPTH; - + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(manufacturing_page0.board_name), + manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = bios_page2.requested_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_boot_dev.pg_dev, - (void *)&bios_page2.requested_boot_dev, + memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, + &bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = bios_page2.requested_alt_boot_dev_form; - memcpy((void *)adapter->boot_devs.requested_alt_boot_dev.pg_dev, - (void *)&bios_page2.requested_alt_boot_dev, + memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, + &bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = bios_page2.current_boot_dev_form; - memcpy((void *)adapter->boot_devs.current_boot_dev.pg_dev, - (void *)&bios_page2.current_boot_dev, + memcpy(adapter->boot_devs.current_boot_dev.pg_dev, + &bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); - - sz = offsetof(struct leapraid_sas_io_unit_page1, phy_info); - sas_io_unit_page1 = kzalloc(sz, GFP_KERNEL); - if (!sas_io_unit_page1) { - rc = -ENOMEM; - return rc; - } - - cfgp1.size = sz; - - rc = leapraid_op_config_page(adapter, sas_io_unit_page1, cfgp1, - cfgp2, GET_SAS_IOUNIT_PG1); - if (rc) - goto out; - - if (le16_to_cpu(sas_io_unit_page1->wideport_max_queue_depth)) - adapter->adapter_attr.wideport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->wideport_max_queue_depth); - - if (le16_to_cpu(sas_io_unit_page1->narrowport_max_queue_depth)) - adapter->adapter_attr.narrowport_max_queue_depth = - le16_to_cpu( - sas_io_unit_page1->narrowport_max_queue_depth); - - if (sas_io_unit_page1->sata_max_queue_depth) - adapter->adapter_attr.sata_max_queue_depth = - sas_io_unit_page1->sata_max_queue_depth; - -out: - kfree(sas_io_unit_page1); - dev_info(&adapter->pdev->dev, - "max wp qd=%d, max np qd=%d, max sata qd=%d\n", - adapter->adapter_attr.wideport_max_queue_depth, - adapter->adapter_attr.narrowport_max_queue_depth, - adapter->adapter_attr.sata_max_queue_depth); return rc; } static int leapraid_evt_notify(struct leapraid_adapter *adapter) { struct leapraid_evt_notify_req *evt_notify_req; + struct leapraid_evt_notify_rep *evt_notify_rep; + u16 adapter_status; int rc = 0; int i; mutex_lock(&adapter->driver_cmds.notify_event_cmd.mutex); adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_PENDING; evt_notify_req = - leapraid_get_task_desc(adapter, + leapraid_get_task_desc( + adapter, adapter->driver_cmds.notify_event_cmd.inter_taskid); memset(evt_notify_req, 0, sizeof(struct leapraid_evt_notify_req)); evt_notify_req->func = LEAPRAID_FUNC_EVENT_NOTIFY; @@ -8031,15 +8702,30 @@ static int leapraid_evt_notify(struct leapraid_adapter *adapter) cpu_to_le32(adapter->fw_evt_s.leapraid_evt_masks[i]); init_completion(&adapter->driver_cmds.notify_event_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.notify_event_cmd.inter_taskid); + adapter->driver_cmds.notify_event_cmd.inter_taskid); wait_for_completion_timeout( &adapter->driver_cmds.notify_event_cmd.done, LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT * HZ); + if (!(adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_DONE)) - if (adapter->driver_cmds.notify_event_cmd.status & - LEAPRAID_CMD_RESET) - rc = -EFAULT; + LEAPRAID_CMD_DONE)) { + rc = -EFAULT; + goto out_cleanup; + } + + if (!(adapter->driver_cmds.notify_event_cmd.status & + LEAPRAID_CMD_REPLY_VALID)) { + rc = -EFAULT; + goto out_cleanup; + } + + evt_notify_rep = (void *)&adapter->driver_cmds.notify_event_cmd.reply; + adapter_status = le16_to_cpu(evt_notify_rep->adapter_status) & + LEAPRAID_ADAPTER_STATUS_MASK; + if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) + rc = -EFAULT; + +out_cleanup: adapter->driver_cmds.notify_event_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.notify_event_cmd.mutex); @@ -8054,51 +8740,54 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) int rc = 0; dev_info(&adapter->pdev->dev, - "send device scan, async_scan_dev=%d!\n", async_scan_dev); + "Send device scan, async_scan_dev=%d!\n", async_scan_dev); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_PENDING; adapter->driver_cmds.scan_dev_cmd.async_scan_dev = async_scan_dev; - scan_dev_req = leapraid_get_task_desc(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + scan_dev_req = + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.scan_dev_cmd.inter_taskid); memset(scan_dev_req, 0, sizeof(struct leapraid_scan_dev_req)); scan_dev_req->func = LEAPRAID_FUNC_SCAN_DEV; if (async_scan_dev) { - adapter->scan_dev_desc.first_scan_dev_fired = true; - leapraid_fire_task(adapter, + adapter->scan_dev_desc.first_scan_dev_fired = 1; + leapraid_fire_task( + adapter, adapter->driver_cmds.scan_dev_cmd.inter_taskid); return 0; } init_completion(&adapter->driver_cmds.scan_dev_cmd.done); leapraid_fire_task(adapter, - adapter->driver_cmds.scan_dev_cmd.inter_taskid); + adapter->driver_cmds.scan_dev_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.scan_dev_cmd.done, LEAPRAID_SCAN_DEV_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "device scan timeout!\n"); + dev_err(&adapter->pdev->dev, "Device scan timeout!\n"); if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) rc = -EFAULT; else rc = -ETIME; - goto out; + goto out_cleanup; } - scan_dev_rep = (void *)(&adapter->driver_cmds.scan_dev_cmd.reply); + scan_dev_rep = (void *)&adapter->driver_cmds.scan_dev_cmd.reply; adapter_status = le16_to_cpu(scan_dev_rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; if (adapter_status != LEAPRAID_ADAPTER_STATUS_SUCCESS) { - dev_err(&adapter->pdev->dev, "device scan failure!\n"); + dev_err(&adapter->pdev->dev, "Device scan failure!\n"); rc = -EFAULT; - goto out; + goto out_cleanup; } -out: +out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_info(&adapter->pdev->dev, - "device scan %s\n", ((rc == 0) ? "SUCCESS" : "FAILED")); + "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8125,13 +8814,14 @@ static void leapraid_init_rep_msg_addr(struct leapraid_adapter *adapter) for (i = 0, reply_address = (u32)adapter->mem_desc.rep_msg_dma; i < adapter->adapter_attr.rep_msg_qd; - i++, reply_address += LEAPRAID_REPLY_SIEZ) { + i++, reply_address += LEAPRAID_REPLY_SIZE) adapter->mem_desc.rep_msg_addr[i] = cpu_to_le32(reply_address); - } } -static void init_rep_desc(struct leapraid_rq *rq, int index, - union leapraid_rep_desc_union *reply_post_free_contig) +static void init_rep_desc( + struct leapraid_rq *rq, + int index, + union leapraid_rep_desc_union *reply_post_free_contig) { struct leapraid_adapter *adapter = rq->adapter; unsigned int i; @@ -8218,7 +8908,7 @@ static void leapraid_init_bar_idx_regs(struct leapraid_adapter *adapter) static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; leapraid_init_task_tracker(adapter); leapraid_init_rep_msg_addr(adapter); @@ -8242,7 +8932,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return rc; if (!adapter->access_ctrl.shost_recovering) { - adapter->scan_dev_desc.wait_scan_dev_done = true; + adapter->scan_dev_desc.wait_scan_dev_done = 1; return 0; } @@ -8256,45 +8946,45 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) int leapraid_ctrl_init(struct leapraid_adapter *adapter) { u32 cap; - int rc = 0; + int rc; rc = leapraid_set_pcie_and_notification(adapter); if (rc) - goto out_free_resources; + goto out_free; pci_set_drvdata(adapter->pdev, adapter->shost); pcie_capability_read_dword(adapter->pdev, PCI_EXP_DEVCAP, &cap); - if (cap & PCI_EXP_DEVCAP_EXT_TAG) { + if (cap & PCI_EXP_DEVCAP_EXT_TAG) pcie_capability_set_word(adapter->pdev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_EXT_TAG); - } rc = leapraid_fw_log_init(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "fw log init failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "FW log init failure\n"); + goto out_free; } rc = leapraid_request_host_memory(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "request host memory failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Request host memory failure\n"); + goto out_free; } init_waitqueue_head(&adapter->reset_desc.reset_wait_queue); + init_waitqueue_head(&adapter->access_ctrl.shost_recover_wq); rc = leapraid_alloc_dev_topo_bitmaps(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "alloc topo bitmaps failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Alloc topo bitmaps failure\n"); + goto out_free; } rc = leapraid_init_driver_cmds(adapter); if (rc) { - dev_err(&adapter->pdev->dev, "init driver cmds failure\n"); - goto out_free_resources; + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; } leapraid_init_event_mask(adapter); @@ -8302,14 +8992,23 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) rc = leapraid_make_adapter_available(adapter); if (rc) { dev_err(&adapter->pdev->dev, - "make adapter available failure\n"); - goto out_free_resources; + "Make adapter available failure\n"); + goto out_free; } + + leapraid_overheat_init(adapter); + if (!adapter->overheat_desc.fault_overheat_wq) { + rc = -ENOMEM; + goto out_free; + } + return 0; -out_free_resources: - adapter->access_ctrl.host_removing = true; +out_free: + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -8319,9 +9018,11 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) void leapraid_remove_ctrl(struct leapraid_adapter *adapter) { + leapraid_overheat_cleanup(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); + leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 15293922aefa..359802578586 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -1,16 +1,16 @@ /* SPDX-License-Identifier: GPL-2.0 */ /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #ifndef LEAPRAID_FUNC_H_INCLUDED #define LEAPRAID_FUNC_H_INCLUDED #include <linux/pci.h> #include <linux/aer.h> #include <linux/poll.h> +#include <linux/atomic.h> #include <linux/errno.h> #include <linux/ktime.h> #include <linux/delay.h> @@ -27,9 +27,9 @@ #include "leapraid.h" -/* some requset and reply buffer size */ +/* Request and reply buffer size. */ #define LEAPRAID_REQUEST_SIZE 128 -#define LEAPRAID_REPLY_SIEZ 128 +#define LEAPRAID_REPLY_SIZE 128 #define LEAPRAID_CHAIN_SEG_SIZE 128 #define LEAPRAID_MAX_SGES_IN_CHAIN 7 #define LEAPRAID_DEFAULT_CHAINS_PER_IO 19 @@ -44,61 +44,68 @@ #define LEAPRAID_SYS_LOG_BUF_SIZE 0x200000 #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 -/* Driver version and name */ +/* Driver version and name. */ #define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 +#define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.06" +#define LEAPRAID_DRIVER_VERSION "2.00.01.02" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 06 +#define LEAPRAID_BUILD_VERSION 01 +#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MSG_VERSION 0x1021 +#define LEAPRAID_HEADER_VERSION 0x0000 -/* Device ID */ +/* Device ID. */ #define LEAPRAID_VENDOR_ID 0xD405 #define LEAPRAID_DEVID_HBA 0x8200 -#define LEAPRAID_DEVID_RAID 0x8201 +#define LEAPRAID_SUBVENDOR_ID 0xD405 +#define LEAPRAID_SUBDEVID_HBA 0x8200 #define LEAPRAID_PCI_VENDOR_ID_MASK 0xFFFF - /* RAID virtual channel ID */ + /* RAID virtual channel ID. */ #define RAID_CHANNEL 1 -/* Scatter/Gather (SG) segment limits */ +/* Scatter-gather (SG) segment limits. */ #define LEAPRAID_MAX_PHYS_SEGMENTS SG_CHUNK_SIZE #define LEAPRAID_KDUMP_MIN_PHYS_SEGMENTS 32 #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS -/* firmware / config page operations */ +/* Firmware and config page operations. */ #define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 -/* Hardware access helpers*/ +/* Hardware access helpers. */ #define leapraid_readl(addr) readl(addr) #define leapraid_check_reset(status) \ (!((status) & LEAPRAID_CMD_RESET)) -/* Polling intervals */ +/* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 #define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 #define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) -/* init mask */ +/* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 #define LEAPRAID_REPLY_INT_MASK 0x00000008 #define LEAPRAID_TO_SYS_DB_MASK 0x00000001 -/* queue depth */ +/* Queue depth. */ #define LEAPRAID_SATA_QUEUE_DEPTH 32 -#define LEAPRAID_SAS_QUEUE_DEPTH 254 -#define LEAPRAID_RAID_QUEUE_DEPTH 128 +#define LEAPRAID_SAS_QUEUE_DEPTH 64 +#define LEAPRAID_RAID_QUEUE_DEPTH 64 + +/* Target probe flag. */ +#define LEAPRAID_NO_ULD_ATTACH_FLAG 1 +#define LEAPRAID_ULD_ATTACH_FLAG 0 -/* SCSI device and queue limits */ -#define LEAPRAID_MAX_SECTORS 8192 -#define LEAPRAID_DEF_MAX_SECTORS 32767 +/* SCSI device and queue limits. */ +#define LEAPRAID_MAX_SECTORS 2048 #define LEAPRAID_MAX_CDB_LEN 32 #define LEAPRAID_MAX_LUNS 16384 #define LEAPRAID_CAN_QUEUE_MIN 1 @@ -106,136 +113,166 @@ #define LEAPRAID_CMD_PER_LUN 128 #define LEAPRAID_MAX_SEGMENT_SIZE 0xffffffff -/* SCSI sense and ASC/ASCQ and disk geometry configuration */ +/* SCSI sense and ASC/ASCQ and disk geometry configuration. */ #define DESC_FORMAT_THRESHOLD 0x72 #define SENSE_KEY_MASK 0x0F #define SCSI_SENSE_RESPONSE_CODE_MASK 0x7F #define ASC_FAILURE_PREDICTION_THRESHOLD_EXCEEDED 0x5D -#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL /* in sectors, 1GB */ +#define LEAPRAID_LARGE_DISK_THRESHOLD 0x200000UL #define LEAPRAID_LARGE_DISK_HEADS 255 #define LEAPRAID_LARGE_DISK_SECTORS 63 #define LEAPRAID_SMALL_DISK_HEADS 64 #define LEAPRAID_SMALL_DISK_SECTORS 32 -/* SMP (Serial Management Protocol) */ +/* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 #define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 -/* SCSI ASC/ASCQ definitions */ +/* SCSI ASC/ASCQ definitions. */ #define LEAPRAID_SCSI_ASCQ_DEFAULT 0x00 #define LEAPRAID_SCSI_ASC_POWER_ON_RESET 0x29 #define LEAPRAID_SCSI_ASC_INVALID_CMD_CODE 0x20 #define LEAPRAID_SCSI_ASCQ_POWER_ON_RESET 0x07 -/* ---- VPD Page 0x89 (ATA Information) ---- */ +/* VPD Page 0x89 (ATA Information). */ #define LEAPRAID_VPD_PAGE_ATA_INFO 0x89 #define LEAPRAID_VPD_PG89_MAX_LEN 255 #define LEAPRAID_VPD_PG89_MIN_LEN 214 -/* Byte index for NCQ support flag in VPD Page 0x89 */ +/* Byte index for NCQ support flag in VPD page 0x89. */ #define LEAPRAID_VPD_PG89_NCQ_BYTE_IDX 213 #define LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT 4 #define LEAPRAID_VPD_PG89_NCQ_BIT_MASK 0x1 -/* readiness polling: max retries, sleep µs between */ +/* Readiness polling: max retries, sleep µs between. */ #define LEAPRAID_ADAPTER_READY_MAX_RETRY 15000 #define LEAPRAID_ADAPTER_READY_SLEEP_MIN_US 1000 #define LEAPRAID_ADAPTER_READY_SLEEP_MAX_US 1100 -/* Doorbell wait parameters */ +/* Doorbell wait parameters. */ #define LEAPRAID_DB_WAIT_MAX_RETRY 20000 #define LEAPRAID_DB_WAIT_DELAY_US 500 -/* Basic data size definitions */ +/* Basic data size definitions. */ #define LEAPRAID_DWORDS_BYTE_SIZE 4 #define LEAPRAID_WORD_BYTE_SIZE 2 -/* SGL threshold and chain offset*/ +/* SGL threshold and chain offset. */ #define LEAPRAID_SGL_INLINE_THRESHOLD 2 #define LEAPRAID_CHAIN_OFFSET_DWORDS 7 -/* MSI-X group size and mask */ +/* MSI-X group size and mask. */ #define LEAPRAID_MSIX_GROUP_SIZE 8 #define LEAPRAID_MSIX_GROUP_MASK 7 -/* basic constants and limits */ +/* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 #define LEAPRAID_INDEX_FIRST 0 #define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF -/* retry / sleep configuration */ +/* Retry/Sleep configuration. */ +#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 +#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF +#define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 +#define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF +#define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 +#define LEAPRAID_WRSEQ_3RD_KEY_VALUE 0xB +#define LEAPRAID_WRSEQ_4TH_KEY_VALUE 0x2 +#define LEAPRAID_WRSEQ_5TH_KEY_VALUE 0x7 +#define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 #define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 -#define LEAPRAID_MSLEEP_LONG_MS 256 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 -/* controller reset loop parameters */ -#define LEAPRAID_RESET_LOOP_COUNT_REF (300000 / 256) -#define LEAPRAID_RESET_LOOP_COUNT_DEFAULT 10000 -#define LEAPRAID_RESET_POLL_INTERVAL_MS 500 - -/* Device / Volume configuration */ +/* Device/Volume configuration. */ #define LEAPRAID_MAX_VOLUMES_DEFAULT 32 #define LEAPRAID_MAX_DEV_HANDLE_DEFAULT 2048 #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF -/* cmd queue depth */ +/* Commands queue depth. */ #define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 -/* task id offset */ +/* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 #define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 -#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 +#define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 #define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_RAID_ACTION_CMD 4 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 5 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 6 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 -/* task id offset for high-priority */ +/* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 #define LEAPRAID_HP_TASKID_OFFSET_TM_CMD 1 -/* Event / Boot configuration */ +/* Event/Boot configuration. */ #define LEAPRAID_EVT_MASK_COUNT 4 #define LEAPRAID_BOOT_DEV_SIZE 24 -/* logsense command definitions */ +/* Commands timeout. */ +#define LEAPRAID_UNIFIED_TIMEOUT 30 +#define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 +#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT +#define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT + +/* Logsense command definitions. */ #define LEAPRAID_LOGSENSE_DATA_LENGTH 16 #define LEAPRAID_LOGSENSE_CDB_LENGTH 10 #define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT 5 +#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_LOGSENSE_SMART_CODE 0x5D -/* cmd timeout */ -#define LEAPRAID_DRIVER_SCSIIO_CMD_TIMEOUT LEAPRAID_LOGSENSE_TIMEOUT -#define LEAPRAID_CFG_OP_TIMEOUT 15 -#define LEAPRAID_CTL_CMD_TIMEOUT 10 -#define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT 10 -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT 10 -#define LEAPRAID_ENC_CMD_TIMEOUT 10 -#define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT 30 -#define LEAPRAID_TM_CMD_TIMEOUT 30 -#define LEAPRAID_TRANSPORT_CMD_TIMEOUT 10 +/* Host DMA cap. */ +#define DMA_32_BITS 32 +#define DMA_64_BITS 64 +#define LEAPRAID_DMA_ALIGN 16 + +/* Values used to represent an invalid. */ +#define LEAPRAID_INVALID_INDEX -1 +#define LEAPRAID_INVALID_MSIX_VECTORS -1 +#define LEAPRAID_INVALID_INITIAL_VALUE -1 +#define LEAPRAID_OPERATION_FAILED -1 + +/* Version shift and mask. */ +#define LEAPRAID_VER_MAJOR_SHIFT 24 +#define LEAPRAID_VER_MINOR_SHIFT 16 +#define LEAPRAID_VER_BUILD_SHIFT 8 +#define LEAPRAID_VER_MASK 0xFF + +/* Interrupt type. */ +#define LEAPRAID_INTERRUPT_MODE_MSIX 0 +#define LEAPRAID_INTERRUPT_MODE_MSI 1 +#define LEAPRAID_INTERRUPT_MODE_LEGACY 2 + +/* SMP link reset. */ +#define SMP_PHY_CONTROL_LINK_RESET 0x01 +#define SMP_PHY_CONTROL_HARD_RESET 0x02 +#define SMP_PHY_CONTROL_DISABLE 0x03 /** - * struct leapraid_adapter_features - Features and - * capabilities of a LeapRAID adapter + * struct leapraid_adapter_features - Adapter features/capabilities. * - * @req_slot: Number of request slots supported by the adapter - * @hp_slot: Number of high-priority slots supported by the adapter - * @adapter_caps: Adapter capabilities - * @fw_version: Firmware version of the adapter - * @max_dev_handle: Maximum device supported by the adapter + * @req_slot: Number of request slots supported by the adapter. + * @hp_slot: Number of high-priority slots supported by the adapter. + * @adapter_caps: Adapter capabilities. + * @fw_version: Firmware version of the adapter. + * @max_dev_handle: Maximum device handle supported by the adapter. + * @min_dev_handle: Minimum device handle supported by the adapter. */ struct leapraid_adapter_features { u16 req_slot; @@ -251,32 +288,35 @@ struct leapraid_adapter_features { /** * struct leapraid_adapter_attr - Adapter attributes and capabilities * - * @id: Adapter identifier - * @raid_support: Indicates if RAID is supported - * @bios_version: Version of the adapter BIOS - * @enable_mp: Indicates if multipath (MP) support is enabled - * @wideport_max_queue_depth: Maximum queue depth for wide ports - * @narrowport_max_queue_depth: Maximum queue depth for narrow ports - * @sata_max_queue_depth: Maximum queue depth for SATA - * @features: Detailed features of the adapter - * @adapter_total_qd: Total queue depth available on the adapter - * @io_qd: Queue depth allocated for I/O operations - * @rep_msg_qd: Queue depth for reply messages - * @rep_desc_qd: Queue depth for reply descriptors - * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue - * @rq_cnt: Number of request queues - * @task_desc_dma_size: Size of task descriptor DMA memory - * @use_32_dma_mask: Indicates if 32-bit DMA mask is used - * @name: Adapter name string + * @id: Adapter identifier. + * @raid_support: Indicates if RAID is supported. + * @bios_version: Version of the adapter BIOS. + * @enable_mp: Indicates if multipath (MP) support is enabled. + * @wideport_max_queue_depth: Maximum queue depth for wide ports. + * @narrowport_max_queue_depth: Maximum queue depth for narrow ports. + * @sata_max_queue_depth: Maximum queue depth for SATA. + * @raid_volume_max_queue_depth: Maximum queue depth for RAID volumes. + * @features: Detailed features of the adapter. + * @adapter_total_qd: Total queue depth available on the adapter. + * @io_qd: Queue depth allocated for I/O operations. + * @rep_msg_qd: Queue depth for reply messages. + * @rep_desc_qd: Queue depth for reply descriptors. + * @rep_desc_q_seg_cnt: Number of segments in a reply descriptor queue. + * @rq_cnt: Number of request queues. + * @task_desc_dma_size: Size of task descriptor DMA memory. + * @use_32_dma_mask: Indicates if 32-bit DMA mask is used. + * @name: Adapter name string. + * @board_name: Board name retrieved from manufacturing page 0. */ struct leapraid_adapter_attr { u8 id; - bool raid_support; + u8 raid_support; u32 bios_version; - bool enable_mp; + u8 enable_mp; u32 wideport_max_queue_depth; u32 narrowport_max_queue_depth; u32 sata_max_queue_depth; + u32 raid_volume_max_queue_depth; struct leapraid_adapter_features features; u32 adapter_total_qd; u32 io_qd; @@ -285,20 +325,20 @@ struct leapraid_adapter_attr { u32 rep_desc_q_seg_cnt; u16 rq_cnt; u32 task_desc_dma_size; - bool use_32_dma_mask; + u8 use_32_dma_mask; char name[LEAPRAID_NAME_LENGTH]; + char board_name[LEAPRAID_BOARD_NAME_LENGTH]; }; /** - * struct leapraid_io_req_tracker - Track a SCSI I/O request - * for the adapter + * struct leapraid_io_req_tracker - Track a SCSI I/O request for the adapter * - * @taskid: Unique task ID for this I/O request - * @scmd: Pointer to the associated SCSI command - * @chain_list: List of chain frames associated with this request - * @msix_io: MSI-X vector assigned to this I/O request - * @chain: Pointer to the chain memory for this request - * @chain_dma: DMA address of the chain memory + * @taskid: Unique task ID for this I/O request. + * @scmd: Pointer to the associated SCSI command. + * @chain_list: List of chain frames associated with this request. + * @msix_io: MSI-X vector assigned to this I/O request. + * @chain: Pointer to the chain memory for this request. + * @chain_dma: DMA address of the chain memory. */ struct leapraid_io_req_tracker { u16 taskid; @@ -312,9 +352,9 @@ struct leapraid_io_req_tracker { /** * struct leapraid_task_tracker - Tracks a task in the adapter * - * @taskid: Unique task ID for this tracker - * @cb_idx: Callback index associated with this task - * @tracker_list: Linked list node to chain this tracker in lists + * @taskid: Unique task ID for this tracker. + * @cb_idx: Callback index associated with this task. + * @tracker_list: Linked list node to chain this tracker in lists. */ struct leapraid_task_tracker { u16 taskid; @@ -323,11 +363,10 @@ struct leapraid_task_tracker { }; /** - * struct leapraid_rep_desc_maint - Maintains reply descriptor - * memory + * struct leapraid_rep_desc_maint - Maintains reply descriptor memory * - * @rep_desc: Pointer to the reply descriptor - * @rep_desc_dma: DMA address of the reply descriptor + * @rep_desc: Pointer to the reply descriptor. + * @rep_desc_dma: DMA address of the reply descriptor. */ struct leapraid_rep_desc_maint { union leapraid_rep_desc_union *rep_desc; @@ -335,12 +374,12 @@ struct leapraid_rep_desc_maint { }; /** - * struct leapraid_rep_desc_seg_maint - Maintains reply descriptor - * segment memory + * struct leapraid_rep_desc_seg_maint - + * Maintains reply descriptor segment memory * - * @rep_desc_seg: Pointer to the reply descriptor segment - * @rep_desc_seg_dma: DMA address of the reply descriptor segment - * @rep_desc_maint: Pointer to the main reply descriptor structure + * @rep_desc_seg: Pointer to the reply descriptor segment. + * @rep_desc_seg_dma: DMA address of the reply descriptor segment. + * @rep_desc_maint: Pointer to the main reply descriptor structure. */ struct leapraid_rep_desc_seg_maint { void *rep_desc_seg; @@ -351,20 +390,20 @@ struct leapraid_rep_desc_seg_maint { /** * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * - * @task_desc: Pointer to task descriptor - * @task_desc_dma: DMA address of task descriptor - * @sg_chain_pool: DMA pool for SGL chain allocations - * @sg_chain_pool_size: Size of the sg_chain_pool - * @io_tracker: IO request tracker array - * @sense_data: Buffer for SCSI sense data - * @sense_data_dma: DMA address of sense_data buffer - * @rep_msg: Buffer for reply message - * @rep_msg_dma: DMA address of reply message buffer - * @rep_msg_addr: Pointer to reply message address - * @rep_msg_addr_dma: DMA address of reply message address - * @rep_desc_seg_maint: Pointer to reply descriptor segment - * @rep_desc_q_arr: Pointer to reply descriptor queue array - * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array + * @task_desc: Pointer to task descriptor. + * @task_desc_dma: DMA address of task descriptor. + * @sg_chain_pool: DMA pool for SGL chain allocations. + * @sg_chain_pool_size: Size of the sg_chain_pool. + * @io_tracker: I/O request tracker array. + * @sense_data: Buffer for SCSI sense data. + * @sense_data_dma: DMA address of sense_data buffer. + * @rep_msg: Buffer for reply message. + * @rep_msg_dma: DMA address of reply message buffer. + * @rep_msg_addr: Pointer to reply message address. + * @rep_msg_addr_dma: DMA address of reply message address. + * @rep_desc_seg_maint: Pointer to reply descriptor segment. + * @rep_desc_q_arr: Pointer to reply descriptor queue array. + * @rep_desc_q_arr_dma: DMA address of reply descriptor queue array. */ struct leapraid_mem_desc { void *task_desc; @@ -383,31 +422,30 @@ struct leapraid_mem_desc { dma_addr_t rep_desc_q_arr_dma; }; -#define LEAPRAID_FIXED_INTER_CMDS 7 -#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_INTER_HP_CMDS_DIF \ - (LEAPRAID_FIXED_INTER_CMDS - LEAPRAID_FIXED_HP_CMDS) +/* internal cmd description */ +#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_HP_CMDS 2 -#define LEAPRAID_CMD_NOT_USED 0x8000 -#define LEAPRAID_CMD_DONE 0x0001 -#define LEAPRAID_CMD_PENDING 0x0002 -#define LEAPRAID_CMD_REPLY_VALID 0x0004 -#define LEAPRAID_CMD_RESET 0x0008 +#define LEAPRAID_CMD_NOT_USED 0x8000 +#define LEAPRAID_CMD_DONE 0x0001 +#define LEAPRAID_CMD_PENDING 0x0002 +#define LEAPRAID_CMD_REPLY_VALID 0x0004 +#define LEAPRAID_CMD_RESET 0x0008 /** * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * - * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index - * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index - * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index - * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index - * @LEAPRAID_ENC_CB_IDX: Encryption callback index - * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index - * @LEAPRAID_CTL_CB_IDX: Control callback index - * @LEAPRAID_TM_CB_IDX: Task management callback index + * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. + * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. + * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. + * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. + * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. + * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. + * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. + * @LEAPRAID_ENC_CB_IDX: Encryption callback index. + * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. + * @LEAPRAID_CTL_CB_IDX: Control callback index. + * @LEAPRAID_TM_CB_IDX: Task management callback index. */ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, @@ -424,10 +462,25 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_NUM_CB_IDXS }; +/** + * struct leapraid_default_reply - Default reply frame buffer + * @pad: Raw reply data buffer returned by firmware. + * + * This structure represents a generic reply frame used by the firmware + * when no specific reply format is required. The buffer size is defined + * by LEAPRAID_REPLY_SIZE and stores the raw reply data. + */ struct leapraid_default_reply { - u8 pad[LEAPRAID_REPLY_SIEZ]; + u8 pad[LEAPRAID_REPLY_SIZE]; }; +/** + * struct leapraid_sense_buffer - SCSI sense data buffer + * @pad: Buffer used to store sense data returned by a SCSI command. + * + * This buffer holds the sense data provided by a device.The size is + * defined by SCSI_SENSE_BUFFERSIZE. + */ struct leapraid_sense_buffer { u8 pad[SCSI_SENSE_BUFFERSIZE]; }; @@ -435,17 +488,17 @@ struct leapraid_sense_buffer { /** * struct leapraid_driver_cmd - Driver command tracking structure * - * @reply: Default reply structure returned by the adapter - * @done: Completion object used to signal command completion - * @status: Status code returned by the firmware - * @taskid: Unique task identifier for this command - * @hp_taskid: Task identifier for high-priority commands - * @inter_taskid: Task identifier for internal commands - * @cb_idx: Callback index used to identify completion context - * @async_scan_dev: True if this command is for asynchronous device scan - * @sense: Sense buffer holding error information from device - * @mutex: Mutex to protect access to this command structure - * @list: List node for linking driver commands into lists + * @reply: Default reply structure returned by the adapter. + * @done: Completion object used to signal command completion. + * @status: Status code returned by the firmware. + * @taskid: Unique task identifier for this command. + * @hp_taskid: Task identifier for high-priority commands. + * @inter_taskid: Task identifier for internal commands. + * @cb_idx: Callback index used to identify completion context. + * @async_scan_dev: True if this command is for asynchronous device scan. + * @sense: Sense buffer holding error information from device. + * @mutex: Mutex to protect access to this command structure. + * @list: List node for linking driver commands into lists. */ struct leapraid_driver_cmd { struct leapraid_default_reply reply; @@ -455,27 +508,27 @@ struct leapraid_driver_cmd { u16 hp_taskid; u16 inter_taskid; u8 cb_idx; - bool async_scan_dev; + u8 async_scan_dev; struct leapraid_sense_buffer sense; - struct mutex mutex; + struct mutex mutex; /* Mutex for driver cmd */ struct list_head list; }; /** * struct leapraid_driver_cmds - Collection of driver command objects * - * @special_cmd_list: List head for tracking special driver commands - * @scan_dev_cmd: Command used for asynchronous device scan operations - * @cfg_op_cmd: Command for configuration operations - * @transport_cmd: Command for transport-level operations - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware - * @raid_action_cmd: Command for RAID-related management or action requests - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing - * @enc_cmd: Command for enclosure management operations - * @notify_event_cmd: Command for asynchronous event notification handling - * @ctl_cmd: Command for generic control or maintenance operations - * @tm_cmd: Task management command - * @internal_scmd: Pointer to internal SCSI command used by the driver + * @special_cmd_list: List head for tracking special driver commands. + * @scan_dev_cmd: Command used for asynchronous device scan operations. + * @cfg_op_cmd: Command for configuration operations. + * @transport_cmd: Command for transport-level operations. + * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. + * @raid_action_cmd: Command for RAID-related management or action requests. + * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. + * @enc_cmd: Command for enclosure management operations. + * @notify_event_cmd: Command for asynchronous event notification handling. + * @ctl_cmd: Command for generic control or maintenance operations. + * @tm_cmd: Task management command. + * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; @@ -495,14 +548,14 @@ struct leapraid_driver_cmds { /** * struct leapraid_dynamic_task_desc - Dynamic task descriptor * - * @task_lock: Spinlock to protect concurrent access - * @hp_taskid: Current high-priority task ID - * @hp_cmd_qd: Fixed command queue depth for high-priority tasks - * @inter_taskid: Current internal task ID - * @inter_cmd_qd: Fixed command queue depth for internal tasks + * @task_lock: Spinlock to protect concurrent access. + * @hp_taskid: Current high-priority task ID. + * @hp_cmd_qd: Fixed command queue depth for high-priority tasks. + * @inter_taskid: Current internal task ID. + * @inter_cmd_qd: Fixed command queue depth for internal tasks. */ struct leapraid_dynamic_task_desc { - spinlock_t task_lock; + spinlock_t task_lock; /* protects dynamic task */ u16 hp_taskid; u16 hp_cmd_qd; u16 inter_taskid; @@ -512,14 +565,14 @@ struct leapraid_dynamic_task_desc { /** * struct leapraid_fw_evt_work - Firmware event work structure * - * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRAID adapter - * @work: Work structure used by the kernel workqueue - * @refcnt: Reference counter for managing the lifetime of this work - * @evt_data: Pointer to firmware event data - * @dev_handle: Device handle associated with the event - * @evt_type: Type of firmware event - * @ignore: Flag indicating whether the event should be ignored + * @list: Linked list node for queuing the work. + * @adapter: Pointer to the associated LeapRAID adapter. + * @work: Work structure used by the kernel workqueue. + * @refcnt: Reference counter for managing the lifetime of this work. + * @evt_data: Pointer to firmware event data. + * @dev_handle: Device handle associated with the event. + * @evt_type: Type of firmware event. + * @ignore: Flag indicating whether the event should be ignored. */ struct leapraid_fw_evt_work { struct list_head list; @@ -535,33 +588,35 @@ struct leapraid_fw_evt_work { /** * struct leapraid_fw_evt_struct - Firmware event handling structure * - * @fw_evt_name: Name of the firmware event - * @fw_evt_thread: Workqueue used for processing firmware events - * @fw_evt_lock: Spinlock protecting access to the firmware event list - * @fw_evt_list: Linked list of pending firmware events - * @cur_evt: Pointer to the currently processing firmware event - * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress - * @leapraid_evt_masks: Array of event masks for filtering firmware events + * @fw_evt_name: Name of the firmware event. + * @fw_evt_thread: Workqueue used for processing firmware events. + * @fw_evt_lock: Spinlock protecting access to the firmware event list. + * @fw_evt_list: Linked list of pending firmware events. + * @cur_evt: Pointer to the currently processing firmware event. + * @cur_evt_task: Task currently executing @cur_evt work. + * @fw_evt_cleanup: Flag indicating whether cleanup of events is in progress. + * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; - spinlock_t fw_evt_lock; + spinlock_t fw_evt_lock; /* protects firmware event */ struct list_head fw_evt_list; struct leapraid_fw_evt_work *cur_evt; - int fw_evt_cleanup; + struct task_struct *cur_evt_task; + u8 fw_evt_cleanup; u32 leapraid_evt_masks[4]; }; /** * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRAID adapter - * @msix_idx: MSI-X vector index used by this queue - * @rep_post_host_idx: Index of the last processed reply descriptor - * @rep_desc: Pointer to the reply descriptor associated with this queue - * @name: Name of the request queue - * @busy: Atomic counter indicating if the queue is busy + * @adapter: Pointer to the associated LeapRAID adapter. + * @msix_idx: MSI-X vector index used by this queue. + * @rep_post_host_idx: Index of the last processed reply descriptor. + * @rep_desc: Pointer to the reply descriptor associated with this queue. + * @name: Name of the request queue. + * @busy: Atomic counter indicating if the queue is busy. */ struct leapraid_rq { struct leapraid_adapter *adapter; @@ -575,8 +630,8 @@ struct leapraid_rq { /** * struct leapraid_int_rq - Internal request queue for a CPU * - * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRAID request queue structure + * @affinity_hint: CPU affinity mask for the queue. + * @rq: Underlying LeapRAID request queue structure. */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -586,9 +641,9 @@ struct leapraid_int_rq { /** * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * - * @busy: Atomic flag indicating request is being processed - * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRAID request structure + * @busy: Atomic flag indicating request is being processed. + * @pause: Atomic flag to temporarily suspend polling. + * @rq: The underlying LeapRAID request structure. */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -597,22 +652,25 @@ struct leapraid_blk_mq_poll_rq { }; /** - * struct leapraid_notification_desc - Notification - * descriptor for LeapRAID + * struct leapraid_notification_desc - Notification descriptor for LeapRAID * - * @iopoll_qdex: Index of the I/O polling queue - * @iopoll_qcnt: Count of I/O polling queues - * @msix_enable: Flag indicating MSI-X is enabled - * @msix_cpu_map: CPU map for MSI-X interrupts - * @msix_cpu_map_sz: Size of the MSI-X CPU map - * @int_rqs: Array of interrupt request queues - * @int_rqs_allocated: Count of allocated interrupt request queues - * @blk_mq_poll_rqs: Array of blk-mq polling requests + * @iopoll_qdex: Index of the I/O polling queue. + * @iopoll_qcnt: Count of I/O polling queues. + * @msix_enable: Flag indicating MSI-X is enabled. + * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. + * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. + * @msix_cpu_map: CPU map for MSI-X interrupts. + * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @int_rqs: Array of interrupt request queues. + * @int_rqs_allocated: Count of allocated interrupt request queues. + * @blk_mq_poll_rqs: Array of blk-mq polling requests. */ struct leapraid_notification_desc { u32 iopoll_qdex; u32 iopoll_qcnt; - bool msix_enable; + u8 msix_enable; + u8 irq_vectors_allocated; + u8 irq_mode; u8 *msix_cpu_map; u32 msix_cpu_map_sz; struct leapraid_int_rq *int_rqs; @@ -620,82 +678,104 @@ struct leapraid_notification_desc { struct leapraid_blk_mq_poll_rq *blk_mq_poll_rqs; }; +/** + * struct leapraid_overheat_desc - Overheat descriptor for LeapRAID + * + * @fault_overheat_wq: Workqueue for adapter thermal overheat operations. + * @fault_overheat_work: Work structure for thermal overheat. + * @thermal_alert: Flag indicating if adapter thermal alert is active. + * @fault_overheat_wq_name: Name of the fault overheat workqueue. + */ +struct leapraid_overheat_desc { + struct workqueue_struct *fault_overheat_wq; + struct work_struct fault_overheat_work; + atomic_t thermal_alert; + char fault_overheat_wq_name[48]; +}; + /** * struct leapraid_reset_desc - Reset descriptor for LeapRAID * - * @fault_reset_wq: Workqueue for fault reset operations - * @fault_reset_work: Delayed work structure for fault reset - * @fault_reset_wq_name: Name of the fault reset workqueue - * @host_diag_mutex: Mutex for host diagnostic operations - * @adapter_reset_lock: Spinlock for adapter reset operations - * @adapter_reset_mutex: Mutex for adapter reset operations - * @adapter_link_resetting: Flag indicating if adapter link is resetting - * @adapter_reset_results: Results of the adapter reset operation - * @pending_io_cnt: Count of pending I/O operations - * @reset_wait_queue: Wait queue for reset operations - * @reset_cnt: Counter for reset operations + * @fault_reset_wq: Workqueue for fault reset operations. + * @fault_reset_work: Delayed work structure for fault reset. + * @fault_reset_wq_name: Name of the fault reset workqueue. + * @host_diag_mutex: Mutex for host diagnostic operations. + * @adapter_reset_lock: Spinlock for adapter reset operations. + * @adapter_reset_mutex: Mutex for adapter reset operations. + * @adapter_link_resetting: Flag indicating if adapter link is resetting. + * @adapter_reset_results: Results of the adapter reset operation. + * @pending_io_cnt: Count of pending I/O operations. + * @reset_wait_queue: Wait queue for reset operations. + * @reset_cnt: Counter for reset operations. + * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; struct delayed_work fault_reset_work; char fault_reset_wq_name[48]; - struct mutex host_diag_mutex; - spinlock_t adapter_reset_lock; - struct mutex adapter_reset_mutex; - bool adapter_link_resetting; + struct mutex host_diag_mutex; /* Mutex for operations. */ + spinlock_t adapter_reset_lock; /* Protects adapter reset state. */ + struct mutex adapter_reset_mutex; /* Serializes adapter reset. */ + u8 adapter_link_resetting; int adapter_reset_results; int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; + u32 last_reset_cnt; }; /** - * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRAID + * struct leapraid_scan_dev_desc - Scan device descriptor for LeapRAID * - * @wait_scan_dev_done: Flag indicating if scan device operation is done - * @driver_loading: Flag indicating if driver is loading - * @first_scan_dev_fired: Flag indicating if first scan device operation fired - * @scan_dev_failed: Flag indicating if scan device operation failed - * @scan_start: Flag indicating if scan operation started - * @scan_start_failed: Count of failed scan start operations + * @wait_scan_dev_done: Flag indicating if scan device operation is done. + * @driver_loading: Flag indicating if driver is loading. + * @first_scan_dev_fired: Flag indicating if first scan device operation fired. + * @scan_dev_failed: Flag indicating if scan device operation failed. + * @scan_start: Flag indicating if scan operation started. + * @scan_start_failed: Count of failed scan start operations. */ struct leapraid_scan_dev_desc { - bool wait_scan_dev_done; - bool driver_loading; - bool first_scan_dev_fired; - bool scan_dev_failed; - bool scan_start; + u8 wait_scan_dev_done; + u8 driver_loading; + wait_queue_head_t wait_driver_loading; + u8 first_scan_dev_fired; + u8 scan_dev_failed; + u8 scan_start; u16 scan_start_failed; }; /** * struct leapraid_access_ctrl - Access control structure for LeapRAID * - * @pci_access_lock: Mutex for PCI access control - * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active - * @shost_recovering: Flag indicating if host is recovering - * @host_removing: Flag indicating if host is being removed - * @pcie_recovering: Flag indicating if PCIe is recovering + * @pci_access_lock: Mutex for PCI access control. + * @shost_recovering: Flag indicating if host is recovering. + * @shost_recover_async: Flag indicating if host is recovering + * and the 0xFFFF event. + * @shost_recover_wq: Wait queue for threads waiting on shost_recover_async. + * @host_removing: Flag indicating if host is being removed. + * @pcie_recovering: Flag indicating if PCIe is recovering. */ struct leapraid_access_ctrl { - struct mutex pci_access_lock; - bool adapter_thermal_alert; - bool shost_recovering; - bool host_removing; - bool pcie_recovering; + struct mutex pci_access_lock; /* serializes PCI register access. */ + u8 shost_recovering; + wait_queue_head_t recovery_waitq; + u8 shost_recover_async; + wait_queue_head_t shost_recover_wq; + u8 host_removing; + u8 pcie_recovering; }; /** * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * - * @fw_log_buffer: Buffer for firmware log data - * @fw_log_buffer_dma: DMA address of the firmware log buffer - * @fw_log_wq_name: Name of the firmware log workqueue - * @fw_log_wq: Workqueue for firmware log operations - * @fw_log_work: Delayed work structure for firmware log - * @open_pcie_trace: Flag indicating if PCIe tracing is open - * @fw_log_init_flag: Flag indicating if firmware log is initialized + * @fw_log_buffer: Buffer for firmware log data. + * @fw_log_buffer_dma: DMA address of the firmware log buffer. + * @fw_log_wq_name: Name of the firmware log workqueue. + * @fw_log_wq: Workqueue for firmware log operations. + * @fw_log_work: Delayed work structure for firmware log. + * @open_pcie_trace: Flag indicating if PCIe tracing is open. + * @fw_log_init_flag: Flag indicating if firmware log is initialized. + * @pre_debug_log: Last DebugLog register snapshot for change detection. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -705,6 +785,7 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; + u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -713,13 +794,13 @@ struct leapraid_fw_log_desc { /** * struct leapraid_card_port - Card port structure for LeapRAID * - * @list: List head for card port - * @vphys_list: List head for virtual phy list - * @port_id: Port ID - * @sas_address: SAS address - * @phy_mask: Mask of phy - * @vphys_mask: Mask of virtual phy - * @flg: Flags for the port + * @list: List head for card port. + * @vphys_list: List head for virtual PHY list. + * @port_id: Port ID. + * @sas_address: SAS address. + * @phy_mask: Mask of PHY. + * @vphys_mask: Mask of virtual PHY. + * @flg: Flags for the port. */ struct leapraid_card_port { struct list_head list; @@ -732,18 +813,18 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRAID + * struct leapraid_card_phy - Card PHY structure for LeapRAID * - * @port_siblings: List head for port siblings - * @card_port: Pointer to the card port - * @identify: SAS identify structure - * @remote_identify: Remote SAS identify structure - * @phy: SAS phy structure - * @phy_id: Phy ID - * @hdl: Handle for the port - * @attached_hdl: Handle for the attached port - * @phy_is_assigned: Flag indicating if phy is assigned - * @vphy: Flag indicating if virtual phy + * @port_siblings: List head for port siblings. + * @card_port: Pointer to the card port. + * @identify: SAS identify structure. + * @remote_identify: Remote SAS identify structure. + * @phy: SAS PHY structure. + * @phy_id: PHY ID. + * @hdl: Handle for the port. + * @attached_hdl: Handle for the attached port. + * @phy_is_assigned: Flag indicating if PHY is assigned. + * @vphy: Flag indicating if virtual PHY. */ struct leapraid_card_phy { struct list_head port_siblings; @@ -754,26 +835,26 @@ struct leapraid_card_phy { u8 phy_id; u16 hdl; u16 attached_hdl; - bool phy_is_assigned; - bool vphy; + u8 phy_is_assigned; + u8 vphy; }; /** * struct leapraid_topo_node - SAS topology node for LeapRAID * - * @list: List head for linking nodes - * @sas_port_list: List of SAS ports - * @card_port: Associated card port - * @card_phy: Associated card PHY - * @rphy: SAS remote PHY device - * @parent_dev: Parent device pointer - * @sas_address: SAS address of this node - * @sas_address_parent: Parent node's SAS address - * @phys_num: Number of physical links - * @hdl: Handle identifier - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical identifier - * @resp: Response status flag + * @list: List head for linking nodes. + * @sas_port_list: List of SAS ports. + * @card_port: Associated card port. + * @card_phy: Associated card PHY. + * @rphy: SAS remote PHY device. + * @parent_dev: Parent device pointer. + * @sas_address: SAS address of this node. + * @sas_address_parent: Parent node's SAS address. + * @phys_num: Number of physical links. + * @hdl: Handle identifier. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical identifier. + * @resp: Response status flag. */ struct leapraid_topo_node { struct list_head list; @@ -788,32 +869,32 @@ struct leapraid_topo_node { u16 hdl; u16 enc_hdl; u64 enc_lid; - bool resp; + u8 resp; }; /** * struct leapraid_dev_topo - LeapRAID device topology management structure * - * @topo_node_lock: Spinlock for protecting topology node operations - * @sas_dev_lock: Spinlock for SAS device list access - * @raid_volume_lock: Spinlock for RAID volume list access - * @sas_id: SAS domain identifier - * @card: Main card topology node - * @exp_list: List of expander devices - * @enc_list: List of enclosure devices - * @sas_dev_list: List of SAS devices - * @sas_dev_init_list: List of SAS devices being initialized - * @raid_volume_list: List of RAID volumes - * @card_port_list: List of card ports - * @pd_hdls: Array of physical disk handles - * @dev_removing: Array tracking devices being removed - * @pending_dev_add: Array tracking devices pending addition - * @blocking_hdls: Array of blocking handles + * @topo_node_lock: Spinlock for protecting topology node operations. + * @sas_dev_lock: Spinlock for SAS device list access. + * @raid_volume_lock: Spinlock for RAID volume list access. + * @enc_lock: Spinlock for enclosure device list access. + * @sas_id: SAS domain identifier. + * @card: Main card topology node. + * @exp_list: List of expander devices. + * @enc_list: List of enclosure devices. + * @sas_dev_list: List of SAS devices. + * @sas_dev_init_list: List of SAS devices being initialized. + * @raid_volume_list: List of RAID volumes. + * @card_port_list: List of card ports. + * @pd_hdls: Array of physical disk handles. + * @blocking_hdls: Array of blocking handles. */ struct leapraid_dev_topo { - spinlock_t topo_node_lock; - spinlock_t sas_dev_lock; - spinlock_t raid_volume_lock; + spinlock_t topo_node_lock; /* Protects topology node. */ + spinlock_t sas_dev_lock; /* Protects SAS device list access. */ + spinlock_t raid_volume_lock; /* Protects RAID volume list access. */ + spinlock_t enc_lock; /* Protects enclosure device list access. */ int sas_id; struct leapraid_topo_node card; struct list_head exp_list; @@ -823,21 +904,17 @@ struct leapraid_dev_topo { struct list_head raid_volume_list; struct list_head card_port_list; u16 pd_hdls_sz; - void *pd_hdls; - void *blocking_hdls; - u16 pending_dev_add_sz; - void *pending_dev_add; - u16 dev_removing_sz; - void *dev_removing; + unsigned long *pd_hdls; + unsigned long *blocking_hdls; }; /** * struct leapraid_boot_dev - Boot device structure for LeapRAID * - * @dev: Device pointer - * @chnl: Channel number - * @form: Form factor - * @pg_dev: Config page device content + * @dev: Device pointer. + * @chnl: Channel number. + * @form: Form factor. + * @pg_dev: Config page device content. */ struct leapraid_boot_dev { void *dev; @@ -848,11 +925,14 @@ struct leapraid_boot_dev { /** * struct leapraid_boot_devs - Boot device management structure - * @requested_boot_dev: Requested primary boot device - * @requested_alt_boot_dev: Requested alternate boot device - * @current_boot_dev: Currently active boot device + * + * @lock: Spinlock protecting boot device cache access. + * @requested_boot_dev: Requested primary boot device. + * @requested_alt_boot_dev: Requested alternate boot device. + * @current_boot_dev: Currently active boot device. */ struct leapraid_boot_devs { + spinlock_t lock; /* protects boot dev */ struct leapraid_boot_dev requested_boot_dev; struct leapraid_boot_dev requested_alt_boot_dev; struct leapraid_boot_dev current_boot_dev; @@ -860,9 +940,10 @@ struct leapraid_boot_devs { /** * struct leapraid_smart_poll_desc - SMART polling descriptor - * @smart_poll_wq: Workqueue for SMART polling tasks - * @smart_poll_work: Delayed work for SMART polling operations - * @smart_poll_wq_name: Workqueue name string + * + * @smart_poll_wq: Workqueue for SMART polling tasks. + * @smart_poll_work: Delayed work for SMART polling operations. + * @smart_poll_wq_name: Workqueue name string. */ struct leapraid_smart_poll_desc { struct workqueue_struct *smart_poll_wq; @@ -872,26 +953,28 @@ struct leapraid_smart_poll_desc { /** * struct leapraid_adapter - Main LeapRAID adapter structure - * @list: List head for adapter management - * @shost: SCSI host structure - * @pdev: PCI device structure - * @iomem_base: I/O memory mapped base address - * @rep_msg_host_idx: Host index for reply messages - * @mask_int: Interrupt masking flag - * @timestamp_sync_cnt: Timestamp synchronization counter - * @adapter_attr: Adapter attributes - * @mem_desc: Memory descriptor - * @driver_cmds: Driver commands - * @dynamic_task_desc: Dynamic task descriptor - * @fw_evt_s: Firmware event structure - * @notification_desc: Notification descriptor - * @reset_desc: Reset descriptor - * @scan_dev_desc: Device scan descriptor - * @access_ctrl: Access control - * @fw_log_desc: Firmware log descriptor - * @dev_topo: Device topology - * @boot_devs: Boot devices - * @smart_poll_desc: SMART polling descriptor + * + * @list: List head for adapter management. + * @shost: SCSI host structure. + * @pdev: PCI device structure. + * @iomem_base: I/O memory mapped base address. + * @rep_msg_host_idx: Host index for reply messages. + * @mask_int: Interrupt masking flag. + * @timestamp_sync_cnt: Timestamp synchronization counter. + * @adapter_attr: Adapter attributes. + * @mem_desc: Memory descriptor. + * @driver_cmds: Driver commands. + * @dynamic_task_desc: Dynamic task descriptor. + * @fw_evt_s: Firmware event structure. + * @notification_desc: Notification descriptor. + * @reset_desc: Reset descriptor. + * @scan_dev_desc: Device scan descriptor. + * @access_ctrl: Access control. + * @fw_log_desc: Firmware log descriptor. + * @dev_topo: Device topology. + * @boot_devs: Boot devices. + * @smart_poll_desc: SMART polling descriptor. + * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { struct list_head list; @@ -899,7 +982,7 @@ struct leapraid_adapter { struct pci_dev *pdev; struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; - bool mask_int; + u8 mask_int; u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; @@ -915,6 +998,7 @@ struct leapraid_adapter { struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; struct leapraid_smart_poll_desc smart_poll_desc; + struct leapraid_overheat_desc overheat_desc; }; union cfg_param_1 { @@ -931,6 +1015,7 @@ union cfg_param_2 { enum config_page_action { GET_BIOS_PG2, GET_BIOS_PG3, + GET_MANUFACTURING_PG0, GET_SAS_DEVICE_PG0, GET_SAS_IOUNIT_PG0, GET_SAS_IOUNIT_PG1, @@ -945,8 +1030,9 @@ enum config_page_action { /** * struct leapraid_enc_node - Enclosure node structure - * @list: List head for enclosure management - * @pg0: Enclosure page 0 data + * + * @list: List head for enclosure management. + * @pg0: Enclosure page 0 data. */ struct leapraid_enc_node { struct list_head list; @@ -955,20 +1041,23 @@ struct leapraid_enc_node { /** * struct leapraid_raid_volume - RAID volume structure - * @list: List head for volume management - * @starget: SCSI target structure - * @sdev: SCSI device structure - * @id: Volume ID - * @channel: SCSI channel - * @wwid: World Wide Identifier - * @hdl: Volume handle - * @vol_type: Volume type - * @pd_num: Number of physical disks - * @resp: Response status - * @dev_info: Device information + * + * @list: List head for volume management. + * @refcnt: Reference count. + * @starget: SCSI target structure. + * @sdev: SCSI device structure. + * @id: Volume ID. + * @channel: SCSI channel. + * @wwid: World wide Identifier. + * @hdl: Volume handle. + * @vol_type: Volume type. + * @pd_num: Number of physical disks. + * @resp: Response status. + * @dev_info: Device information. */ struct leapraid_raid_volume { struct list_head list; + struct kref refcnt; struct scsi_target *starget; struct scsi_device *sdev; unsigned int id; @@ -981,20 +1070,31 @@ struct leapraid_raid_volume { u32 dev_info; }; +static inline void leapraid_raid_volume_free(struct kref *ref) +{ + kfree(container_of(ref, struct leapraid_raid_volume, refcnt)); +} + +#define leapraid_raid_volume_get(volume) \ + kref_get(&(volume)->refcnt) +#define leapraid_raid_volume_put(volume) \ + kref_put(&(volume)->refcnt, leapraid_raid_volume_free) + #define LEAPRAID_TGT_FLG_RAID_MEMBER 0x01 #define LEAPRAID_TGT_FLG_VOLUME 0x02 #define LEAPRAID_NO_ULD_ATTACH 1 /** * struct leapraid_starget_priv - SCSI target private data - * @starget: SCSI target structure - * @sas_address: SAS address - * @hdl: Device handle - * @num_luns: Number of LUNs - * @flg: Flags - * @deleted: Deletion flag - * @tm_busy: Task management busy flag - * @card_port: Associated card port - * @sas_dev: SAS device structure + * + * @starget: SCSI target structure. + * @sas_address: SAS address. + * @hdl: Device handle. + * @num_luns: Number of LUNs. + * @flg: Flags. + * @deleted: Deletion flag. + * @tm_busy: Task management busy flag. + * @card_port: Associated card port. + * @sas_dev: SAS device structure. */ struct leapraid_starget_priv { struct scsi_target *starget; @@ -1002,8 +1102,8 @@ struct leapraid_starget_priv { u16 hdl; int num_luns; u32 flg; - bool deleted; - bool tm_busy; + u8 deleted; + u8 tm_busy; struct leapraid_card_port *card_port; struct leapraid_sas_dev *sas_dev; }; @@ -1011,50 +1111,52 @@ struct leapraid_starget_priv { #define LEAPRAID_DEVICE_FLG_INIT 0x01 /** * struct leapraid_sdev_priv - SCSI device private data - * @starget_priv: Associated target private data - * @lun: Logical Unit Number - * @flg: Flags - * @block: Block flag - * @deleted: Deletion flag - * @sep: SEP flag + * + * @starget_priv: Associated target private data. + * @lun: Logical Unit Number. + * @flg: Flags. + * @block: Block flag. + * @deleted: Deletion flag. + * @sep: SEP flag. */ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - bool ncq; - bool block; - bool deleted; - bool sep; + u8 ncq; + u8 block; + u8 deleted; + u8 sep; }; /** * struct leapraid_sas_dev - SAS device structure - * @list: List head for device management - * @starget: SCSI target structure - * @card_port: Associated card port - * @rphy: SAS remote PHY - * @refcnt: Reference count - * @id: Device ID - * @channel: SCSI channel - * @slot: Slot number - * @phy: PHY identifier - * @resp: Response status - * @led_on: LED state - * @sas_addr: SAS address - * @dev_name: Device name - * @hdl: Device handle - * @parent_sas_addr: Parent SAS address - * @enc_hdl: Enclosure handle - * @enc_lid: Enclosure logical ID - * @volume_hdl: Volume handle - * @volume_wwid: Volume WWID - * @dev_info: Device information - * @pend_sas_rphy_add: Pending SAS rphy addition flag - * @enc_level: Enclosure level - * @port_type: Port type - * @connector_name: Connector name - * @support_smart: SMART support flag + * + * @list: List head for device management. + * @starget: SCSI target structure. + * @card_port: Associated card port. + * @rphy: SAS remote PHY. + * @refcnt: Reference count. + * @id: Device ID. + * @channel: SCSI channel. + * @slot: Slot number. + * @phy: PHY identifier. + * @resp: Response status. + * @led_on: LED state. + * @sas_addr: SAS address. + * @dev_name: Device name. + * @hdl: Device handle. + * @parent_sas_addr: Parent SAS address. + * @enc_hdl: Enclosure handle. + * @enc_lid: Enclosure logical ID. + * @volume_hdl: Volume handle. + * @volume_wwid: Volume WWID. + * @dev_info: Device information. + * @pend_sas_rphy_add: Pending SAS remote PHY addition flag. + * @enc_level: Enclosure level. + * @port_connection: Port connection. + * @connector_name: Connector name. + * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1066,8 +1168,8 @@ struct leapraid_sas_dev { unsigned int channel; u16 slot; u8 phy; - bool resp; - bool led_on; + u8 resp; + u8 led_on; u64 sas_addr; u64 dev_name; u16 hdl; @@ -1079,9 +1181,9 @@ struct leapraid_sas_dev { u32 dev_info; u8 pend_sas_rphy_add; u8 enc_level; - u8 port_type; - u8 connector_name[5]; - bool support_smart; + u8 port_connection; + u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; + u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1092,15 +1194,19 @@ static inline void leapraid_sdev_free(struct kref *ref) #define leapraid_sdev_get(sdev) kref_get(&(sdev)->refcnt) #define leapraid_sdev_put(sdev) kref_put(&(sdev)->refcnt, leapraid_sdev_free) +void leapraid_boot_dev_get(void *dev, u32 chnl); +void leapraid_boot_dev_put(void *dev, u32 chnl); + /** * struct leapraid_sas_port - SAS port structure - * @port_list: List head for port management - * @phy_list: List of PHYs in this port - * @port: SAS port structure - * @card_port: Associated card port - * @remote_identify: Remote device identification - * @rphy: SAS remote PHY - * @phys_num: Number of PHYs in this port + * + * @port_list: List head for port management. + * @phy_list: List of PHYs in this port. + * @port: SAS port structure. + * @card_port: Associated card port. + * @remote_identify: Remote device identification. + * @rphy: SAS remote PHY. + * @phys_num: Number of PHYs in this port. */ struct leapraid_sas_port { struct list_head port_list; @@ -1115,10 +1221,11 @@ struct leapraid_sas_port { #define LEAPRAID_VPHY_FLG_DIRTY 0x01 /** * struct leapraid_vphy - Virtual PHY structure - * @list: List head for PHY management - * @sas_address: SAS address - * @phy_mask: PHY mask - * @flg: Flags + * + * @list: List head for PHY management. + * @sas_address: SAS address. + * @phy_mask: PHY mask. + * @flg: Flags. */ struct leapraid_vphy { struct list_head list; @@ -1127,23 +1234,44 @@ struct leapraid_vphy { u8 flg; }; +/** + * struct leapraid_tgt_rst_list - Target reset tracking entry + * @list: List node used to link reset entries. + * @handle: Device handle of the target being reset. + * @state: Current state of the target reset operation. + * + * Each entry represents a target device that is undergoing or has + * undergone a target reset operation. + */ struct leapraid_tgt_rst_list { struct list_head list; u16 handle; u16 state; }; -struct leapraid_sc_list { - struct list_head list; - u16 handle; -}; - +/** + * struct sense_info - Parsed SCSI sense information + * @sense_key: Sense key extracted from sense data. + * @asc: Additional Sense Code (ASC). + * @ascq: Additional Sense Code Qualifier (ASCQ). + * + * This structure stores key fields parsed from SCSI sense data to + * simplify error handling and reporting. + */ struct sense_info { u8 sense_key; u8 asc; u8 ascq; }; +/** + * struct leapraid_fw_log_info - Firmware log position information + * @user_position: Current log read position used by the driver. + * @adapter_position: Current log write position maintained by firmware. + * + * This structure tracks firmware log buffer positions used for retrieving + * log entries from the adapter. + */ struct leapraid_fw_log_info { u32 user_position; u32 adapter_position; @@ -1151,8 +1279,9 @@ struct leapraid_fw_log_info { /** * enum reset_type - Reset type enumeration - * @FULL_RESET: Full hardware reset - * @PART_RESET: Partial reset + * + * @FULL_RESET: Full hardware reset. + * @PART_RESET: Partial reset. */ enum reset_type { FULL_RESET, @@ -1174,22 +1303,23 @@ enum leapraid_port_checking_state { /** * struct leapraid_card_port_feature - Card port feature - * @dirty_flg: Dirty flag indicator - * @same_addr: Same address flag - * @exact_phy: Exact PHY match flag - * @phy_overlap: PHY overlap bitmap - * @same_port: Same port flag - * @cur_chking_old_port: Current checking old port - * @expected_old_port: Expected old port - * @same_addr_port_count: Same address port count - * @checking_state: Port checking state + * + * @dirty_flg: Dirty flag indicator. + * @same_addr: Same address flag. + * @exact_phy: Exact PHY match flag. + * @phy_overlap: PHY overlap bitmap. + * @same_port: Same port flag. + * @cur_chking_old_port: Current checking old port. + * @expected_old_port: Expected old port. + * @same_addr_port_count: Same address port count. + * @checking_state: Port checking state. */ struct leapraid_card_port_feature { u8 dirty_flg; - bool same_addr; - bool exact_phy; + u8 same_addr; + u8 exact_phy; u32 phy_overlap; - bool same_port; + u8 same_port; struct leapraid_card_port *cur_chking_old_port; struct leapraid_card_port *expected_old_port; int same_addr_port_count; @@ -1224,7 +1354,7 @@ struct leapraid_rep_manu_reply { u8 vendor_identification[SAS_EXPANDER_VENDOR_ID_LEN]; u8 product_identification[SAS_EXPANDER_PRODUCT_ID_LEN]; u8 product_revision_level[SAS_EXPANDER_PRODUCT_REV_LEN]; - u8 component_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; + u8 comp_vendor_identification[SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN]; u16 component_id; u8 component_revision_level; u8 r3; @@ -1233,20 +1363,21 @@ struct leapraid_rep_manu_reply { /** * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * @hdl: Device handle - * @lun: Logical Unit Number - * @raid_member: RAID member flag - * @dir: DMA data direction - * @data_length: Data transfer length - * @data_buffer: Data buffer pointer - * @cdb_length: CDB length - * @cdb: Command Descriptor Block - * @time_out: Timeout + * + * @hdl: Device handle. + * @lun: Logical Unit Number. + * @raid_member: RAID member flag. + * @dir: DMA data direction. + * @data_length: Data transfer length. + * @data_buffer: Data buffer pointer. + * @cdb_length: CDB length. + * @cdb: Command Descriptor Block. + * @time_out: Timeout. */ struct leapraid_scsi_cmd_desc { u16 hdl; u32 lun; - bool raid_member; + u8 raid_member; enum dma_data_direction dir; u32 data_length; void *data_buffer; @@ -1273,7 +1404,8 @@ void leapraid_mask_int(struct leapraid_adapter *adapter); void leapraid_unmask_int(struct leapraid_adapter *adapter); u32 leapraid_get_adapter_state(struct leapraid_adapter *adapter); bool leapraid_pci_removed(struct leapraid_adapter *adapter); -int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter); +int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, + const char *caller); void *leapraid_get_task_desc(struct leapraid_adapter *adapter, u16 taskid); void *leapraid_get_sense_buffer(struct leapraid_adapter *adapter, u16 taskid); __le32 leapraid_get_sense_buffer_dma(struct leapraid_adapter *adapter, @@ -1285,11 +1417,11 @@ u16 leapraid_alloc_scsiio_taskid(struct leapraid_adapter *adapter, void leapraid_free_taskid(struct leapraid_adapter *adapter, u16 taskid); struct leapraid_io_req_tracker *leapraid_get_io_tracker_from_taskid( struct leapraid_adapter *adapter, u16 taskid); -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd); struct scsi_cmnd *leapraid_get_scmd_from_taskid( struct leapraid_adapter *adapter, u16 taskid); int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev); void leapraid_scan_dev_done(struct leapraid_adapter *adapter); +void leapraid_cleanup_lists(struct leapraid_adapter *adapter); void leapraid_wait_cmds_done(struct leapraid_adapter *adapter); void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter); void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll); @@ -1305,14 +1437,16 @@ int leapraid_issue_locked_tm(struct leapraid_adapter *adapter, u16 handle, int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 handle, uint channel, uint id, uint lun, u8 type, u16 taskid_task, u8 tr_method); -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep); +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep); int leapraid_get_volume_cap(struct leapraid_adapter *adapter, struct leapraid_raid_volume *raid_volume); -int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_init_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); +int leapraid_internal_exit_cmd_priv( + struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); bool leapraid_scmd_find_by_lun(struct leapraid_adapter *adapter, uint id, unsigned int lun, uint channel); @@ -1381,10 +1515,13 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth); +void leapraid_log_req_context(struct leapraid_adapter *adapter, + const void *req_data); + +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); int leapraid_ctl_release(struct inode *inode, struct file *filep); -void leapraid_ctl_init(void); +int leapraid_ctl_init(void); void leapraid_ctl_exit(void); extern struct sas_function_template leapraid_transport_functions; @@ -1407,17 +1544,20 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, u64 sas_address, u16 handle, u8 phy_number, u8 link_rate, struct leapraid_card_port *card_port); -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *topo_node, - struct leapraid_card_phy *card_phy); -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, - struct leapraid_topo_node *sas_node, - struct leapraid_card_phy *card_phy, - u64 sas_address, - struct leapraid_card_port *card_port); +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *topo_node, + struct leapraid_card_phy *card_phy); +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, + struct leapraid_topo_node *sas_node, + struct leapraid_card_phy *card_phy, + u64 sas_address, + struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); void leapraid_smart_polling_start(struct leapraid_adapter *adapter); void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); +void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 6635e74fd8ff..5a6cda0b5ea8 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <linux/module.h> #include "leapraid_func.h" @@ -18,16 +17,16 @@ MODULE_DESCRIPTION(LEAPRAID_DESCRIPTION); MODULE_LICENSE("GPL"); MODULE_VERSION(LEAPRAID_DRIVER_VERSION); -static int leapraid_ids; +static atomic_t leapraid_ids = ATOMIC_INIT(0); static int open_pcie_trace = 1; module_param(open_pcie_trace, int, 0644); -MODULE_PARM_DESC(open_pcie_trace, "open_pcie_trace: default=1(open)/0(close)"); +MODULE_PARM_DESC(open_pcie_trace, "Default=1(open)/0(close)"); static int enable_mp = 1; module_param(enable_mp, int, 0444); MODULE_PARM_DESC(enable_mp, - "enable multipath on target device. default=1(enable)"); + "Enable multipath on target device. default=1(enable)"); static inline void leapraid_get_sense_data(char *sense, struct sense_info *data) @@ -46,14 +45,9 @@ static inline void leapraid_get_sense_data(char *sense, } } -static struct Scsi_Host *pdev_to_shost(struct pci_dev *pdev) -{ - return pci_get_drvdata(pdev); -} - static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost) return NULL; @@ -61,18 +55,13 @@ static struct leapraid_adapter *pdev_to_adapter(struct pci_dev *pdev) return shost_priv(shost); } -struct leapraid_io_req_tracker *leapraid_get_scmd_priv(struct scsi_cmnd *scmd) -{ - return (struct leapraid_io_req_tracker *)scmd->host_scribble; -} - void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) { struct leapraid_sdev_priv *sdev_priv; struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -82,7 +71,7 @@ void leapraid_set_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = true; + sdev_priv->starget_priv->tm_busy = 1; skip = true; } } @@ -94,7 +83,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) struct scsi_device *sdev; bool skip = false; - /* don't break out of the loop */ + /* Iterate over all devices. */ shost_for_each_device(sdev, adapter->shost) { if (skip) continue; @@ -104,7 +93,7 @@ void leapraid_clear_tm_flg(struct leapraid_adapter *adapter, u16 hdl) continue; if (sdev_priv->starget_priv->hdl == hdl) { - sdev_priv->starget_priv->tm_busy = false; + sdev_priv->starget_priv->tm_busy = 0; skip = true; } } @@ -136,21 +125,19 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid) { - if ((adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && + (adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.driver_scsiio_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid) { - if ((adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_DONE) || - (adapter->driver_cmds.ctl_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - } + if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && + (adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_DONE || + adapter->driver_cmds.ctl_cmd.status & + LEAPRAID_CMD_NOT_USED)) + rc = SUCCESS; return rc; } @@ -197,7 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsi_tm_req *scsi_tm_req; struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; - u16 msix_task = 0; + u16 msix_task; bool issue_reset = false; u32 db; int rc; @@ -208,7 +195,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) { dev_info(&adapter->pdev->dev, - "%s %s: host is recovering, skip tm command!\n", + "%s %s: Host is recovering, skip tm command!\n", __func__, adapter->adapter_attr.name); return FAILED; } @@ -216,24 +203,25 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, db = leapraid_readl(&adapter->iomem_base->db); if (db & LEAPRAID_DB_USED) { dev_info(&adapter->pdev->dev, - "%s unexpected db status, issuing hard reset!\n", + "%s Unexpected db status, issuing hard reset!\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if ((db & LEAPRAID_DB_MASK) == LEAPRAID_DB_FAULT) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - return (!rc) ? SUCCESS : FAILED; + return !rc ? SUCCESS : FAILED; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - io_req_tracker = leapraid_get_io_tracker_from_taskid(adapter, - target_taskid); + io_req_tracker = + leapraid_get_io_tracker_from_taskid(adapter, + target_taskid); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_PENDING; scsi_tm_req = @@ -241,7 +229,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, adapter->driver_cmds.tm_cmd.hp_taskid); leapraid_build_tm_req(scsi_tm_req, hdl, lun, type, tr_method, target_taskid); - memset((void *)(&adapter->driver_cmds.tm_cmd.reply), 0, + memset(&adapter->driver_cmds.tm_cmd.reply, 0, sizeof(struct leapraid_scsi_tm_rep)); leapraid_set_tm_flg(adapter, hdl); init_completion(&adapter->driver_cmds.tm_cmd.done); @@ -257,16 +245,20 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { + dev_err(&adapter->pdev->dev, + "%s: TM cmd timeout, status=0x%x\n", + __func__, adapter->driver_cmds.tm_cmd.status); + leapraid_log_req_context(adapter, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); if (issue_reset) { dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", + "%s:%d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - rc = (!rc) ? SUCCESS : FAILED; - goto out; + rc = !rc ? SUCCESS : FAILED; + goto out_cleanup; } } @@ -276,15 +268,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, case LEAPRAID_TM_TASKTYPE_TARGET_RESET: case LEAPRAID_TM_TASKTYPE_ABRT_TASK_SET: case LEAPRAID_TM_TASKTYPE_LOGICAL_UNIT_RESET: - rc = leapraid_tm_post_processing(adapter, hdl, channel, id, lun, - type, target_taskid); + rc = leapraid_tm_post_processing(adapter, hdl, channel, id, + lun, type, target_taskid); break; case LEAPRAID_TM_TASKTYPE_ABORT_TASK: rc = SUCCESS; scsiio_req = leapraid_get_task_desc(adapter, target_taskid); if (le16_to_cpu(scsiio_req->dev_hdl) != hdl) break; - dev_err(&adapter->pdev->dev, "%s abort failed, hdl=0x%04x\n", + dev_err(&adapter->pdev->dev, "%s: Abort failed, hdl=0x%04x\n", adapter->adapter_attr.name, hdl); rc = FAILED; break; @@ -296,7 +288,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, break; } -out: +out_cleanup: leapraid_clear_tm_flg(adapter, hdl); adapter->driver_cmds.tm_cmd.status = LEAPRAID_CMD_NOT_USED; return rc; @@ -327,20 +319,25 @@ void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl) sas_dev = leapraid_hold_lock_get_sas_dev_by_hdl(adapter, hdl); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + return; } starget = sas_dev->starget; - starget_priv = starget->hostdata; - if ((starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) || - (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { + starget_priv = starget ? starget->hostdata : NULL; + if (!starget_priv) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); - goto out; + goto release_sdev; + } + + if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || + starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); + goto release_sdev; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); leapraid_async_turn_on_led(adapter, hdl); -out: +release_sdev: if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -420,7 +417,8 @@ static void leapraid_handle_success_status( scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; } -static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, +static void leapraid_scsiio_done_dispatch( + struct leapraid_adapter *adapter, struct leapraid_scsiio_rep *scsiio_rep, struct leapraid_sdev_priv *sdev_priv, struct scsi_cmnd *scmd, @@ -442,9 +440,8 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, xfer_cnt == 0 && (scsi_status == LEAPRAID_SCSI_STATUS_BUSY || scsi_status == LEAPRAID_SCSI_STATUS_RESERVATION_CONFLICT || - scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) { + scsi_status == LEAPRAID_SCSI_STATUS_TASK_SET_FULL)) adapter_status = LEAPRAID_ADAPTER_STATUS_SUCCESS; - } switch (adapter_status) { case LEAPRAID_ADAPTER_STATUS_SCSI_DEVICE_NOT_THERE: @@ -516,7 +513,7 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, scsi_print_command(scmd); dev_warn(&adapter->pdev->dev, - "scsiio warn: hdl=0x%x, status are: 0x%x, 0x%x, 0x%x\n", + "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, scsi_status, scsi_state); @@ -526,24 +523,23 @@ static void leapraid_scsiio_done_dispatch(struct leapraid_adapter *adapter, sz = min_t(u32, SCSI_SENSE_BUFFERSIZE, le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, - &sshdr)) { + &sshdr)) dev_warn(&adapter->pdev->dev, - "sense: key=0x%x asc=0x%x ascq=0x%x\n", + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", sshdr.sense_key, sshdr.asc, sshdr.ascq); - } else { + else dev_warn(&adapter->pdev->dev, - "sense: invalid sense data\n"); - } + "Sense: Invalid sense data\n"); } } -u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, - u8 msix_index, u32 rep) +bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, + u8 msix_index, u32 rep) { - struct leapraid_scsiio_rep *scsiio_rep = NULL; - struct leapraid_sdev_priv *sdev_priv = NULL; - struct scsi_cmnd *scmd = NULL; + struct leapraid_scsiio_rep *scsiio_rep; + struct leapraid_sdev_priv *sdev_priv; + struct scsi_cmnd *scmd; u32 response_code = 0; if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) @@ -551,12 +547,12 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, else scmd = adapter->driver_cmds.internal_scmd; if (!scmd) - return 1; + return true; scsiio_rep = leapraid_get_reply_vaddr(adapter, rep); if (!scsiio_rep) { scmd->result = DID_OK << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } sdev_priv = scmd->device->hostdata; @@ -564,7 +560,7 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, !sdev_priv->starget_priv || sdev_priv->starget_priv->deleted) { scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; - goto out; + goto out_scsiio_done; } if (scsiio_rep->scsi_state & LEAPRAID_SCSI_STATE_RESPONSE_INFO_VALID) @@ -574,33 +570,51 @@ u8 leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, leapraid_scsiio_done_dispatch(adapter, scsiio_rep, sdev_priv, scmd, taskid, response_code); -out: +out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid)) { + if (unlikely(taskid == + adapter->driver_cmds.driver_scsiio_cmd.taskid)) { adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_DONE; complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return 0; + return false; } leapraid_free_taskid(adapter, taskid); scmd->scsi_done(scmd); - return 0; + return false; } static void leapraid_probe_raid(struct leapraid_adapter *adapter) { - struct leapraid_raid_volume *raid_volume, *raid_volume_next; + struct leapraid_raid_volume *raid_volume, *next_raid_volume; + unsigned long flags; + LIST_HEAD(head); int rc; - list_for_each_entry_safe(raid_volume, raid_volume_next, - &adapter->dev_topo.raid_volume_list, list) { - if (raid_volume->starget) + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_splice_init(&adapter->dev_topo.raid_volume_list, &head); + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); + + list_for_each_entry_safe(raid_volume, next_raid_volume, &head, list) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + list_move_tail(&raid_volume->list, + &adapter->dev_topo.raid_volume_list); + if (raid_volume->starget) { + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); continue; + } + + leapraid_raid_volume_get(raid_volume); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); rc = scsi_add_device(adapter->shost, RAID_CHANNEL, raid_volume->id, 0); if (rc) leapraid_raid_volume_remove(adapter, raid_volume); + + leapraid_raid_volume_put(raid_volume); } } @@ -629,7 +643,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev = leapraid_get_next_sas_dev_from_init_list(adapter); if (!sas_dev) break; - added = leapraid_transport_port_add(adapter, sas_dev->hdl, sas_dev->parent_sas_addr, @@ -657,32 +670,52 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) } } -static bool leapraid_get_boot_dev(struct leapraid_boot_dev *boot_dev, +static bool leapraid_get_boot_dev(struct leapraid_adapter *adapter, + struct leapraid_boot_dev *boot_dev, void **pdev, u32 *pchnl) { - if (boot_dev->dev) { - *pdev = boot_dev->dev; - *pchnl = boot_dev->chnl; - return true; + unsigned long flags; + void *dev; + u32 chnl; + + spin_lock_irqsave(&adapter->boot_devs.lock, flags); + if (!boot_dev->dev) { + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + return false; } - return false; + + dev = boot_dev->dev; + chnl = boot_dev->chnl; + leapraid_boot_dev_get(dev, chnl); + spin_unlock_irqrestore(&adapter->boot_devs.lock, flags); + + *pdev = dev; + *pchnl = chnl; + return true; } static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) { + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; + struct leapraid_sas_port *sport; + unsigned long flags; void *dev = NULL; u32 chnl; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_boot_dev, + &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.requested_alt_boot_dev, + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.requested_alt_boot_dev, &dev, &chnl)) goto boot_dev_found; - if (leapraid_get_boot_dev(&adapter->boot_devs.current_boot_dev, &dev, - &chnl)) + if (leapraid_get_boot_dev(adapter, + &adapter->boot_devs.current_boot_dev, + &dev, &chnl)) goto boot_dev_found; return; @@ -690,12 +723,10 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) boot_dev_found: switch (chnl) { case RAID_CHANNEL: - { - struct leapraid_raid_volume *raid_volume = - (struct leapraid_raid_volume *)dev; + raid_volume = dev; if (raid_volume->starget) - return; + break; /* TODO eedp */ @@ -703,16 +734,11 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) raid_volume->id, 0)) leapraid_raid_volume_remove(adapter, raid_volume); break; - } default: - { - struct leapraid_sas_dev *sas_dev = - (struct leapraid_sas_dev *)dev; - struct leapraid_sas_port *sas_port; - unsigned long flags; + sas_dev = dev; if (sas_dev->starget) - return; + break; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); list_move_tail(&sas_dev->list, @@ -720,16 +746,17 @@ static void leapraid_probe_boot_dev(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (!sas_dev->card_port) - return; + break; - sas_port = leapraid_transport_port_add(adapter, sas_dev->hdl, - sas_dev->parent_sas_addr, - sas_dev->card_port); - if (!sas_port) + sport = leapraid_transport_port_add(adapter, sas_dev->hdl, + sas_dev->parent_sas_addr, + sas_dev->card_port); + if (!sport) leapraid_sas_dev_remove(adapter, sas_dev); break; } - } + + leapraid_boot_dev_put(dev, chnl); } static void leapraid_probe_devices(struct leapraid_adapter *adapter) @@ -747,69 +774,23 @@ static void leapraid_probe_devices(struct leapraid_adapter *adapter) void leapraid_scan_dev_done(struct leapraid_adapter *adapter) { if (adapter->scan_dev_desc.wait_scan_dev_done) { - adapter->scan_dev_desc.wait_scan_dev_done = false; + adapter->scan_dev_desc.wait_scan_dev_done = 0; leapraid_probe_devices(adapter); } + adapter->scan_dev_desc.scan_start = 0; + leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_smart_polling_start(adapter); } -static void leapraid_ir_shutdown(struct leapraid_adapter *adapter) -{ - struct leapraid_raid_act_req *raid_act_req; - struct leapraid_raid_act_rep *raid_act_rep; - struct leapraid_driver_cmd *raid_action_cmd; - - if (!adapter || !adapter->adapter_attr.raid_support) - return; - - if (list_empty(&adapter->dev_topo.raid_volume_list)) - return; - - if (leapraid_pci_removed(adapter)) - return; - - raid_action_cmd = &adapter->driver_cmds.raid_action_cmd; - - mutex_lock(&raid_action_cmd->mutex); - raid_action_cmd->status = LEAPRAID_CMD_PENDING; - - raid_act_req = leapraid_get_task_desc(adapter, - raid_action_cmd->inter_taskid); - memset(raid_act_req, 0, sizeof(struct leapraid_raid_act_req)); - raid_act_req->func = LEAPRAID_FUNC_RAID_ACTION; - raid_act_req->act = LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED; - - dev_info(&adapter->pdev->dev, "ir shutdown start\n"); - init_completion(&raid_action_cmd->done); - leapraid_fire_task(adapter, raid_action_cmd->inter_taskid); - wait_for_completion_timeout(&raid_action_cmd->done, - LEAPRAID_RAID_ACTION_CMD_TIMEOUT * HZ); - - if (!(raid_action_cmd->status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timeout waiting for ir shutdown\n", __func__); - goto out; - } - - if (raid_action_cmd->status & LEAPRAID_CMD_REPLY_VALID) { - raid_act_rep = (void *)(&raid_action_cmd->reply); - dev_info(&adapter->pdev->dev, - "ir shutdown done, adapter status=0x%04x\n", - le16_to_cpu(raid_act_rep->adapter_status)); - } - -out: - raid_action_cmd->status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&raid_action_cmd->mutex); -} - static const struct pci_device_id leapraid_pci_table[] = { - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA) }, - { PCI_DEVICE(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_RAID) }, + { PCI_DEVICE_SUB(LEAPRAID_VENDOR_ID, LEAPRAID_DEVID_HBA, + LEAPRAID_SUBVENDOR_ID, + LEAPRAID_SUBDEVID_HBA) }, { 0, } }; @@ -819,7 +800,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, u8 opcode; if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.adapter_thermal_alert) + atomic_read(&adapter->overheat_desc.thermal_alert)) return false; if (adapter->access_ctrl.host_removing) { @@ -829,8 +810,8 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, opcode = scmd->cmnd[0]; if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) return true; - else - return false; + + return false; } return true; } @@ -860,28 +841,33 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, scmd->result = (DRIVER_SENSE << LEAPRAID_SCSI_DRIVER_SHIFT) | (DID_OK << LEAPRAID_SCSI_HOST_SHIFT) | SAM_STAT_CHECK_CONDITION; - goto done_out; + goto scsiio_done; } if (adapter->access_ctrl.shost_recovering || adapter->reset_desc.adapter_link_resetting) { *rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; - } else if (starget_priv->deleted || sdev_priv->deleted) { + return false; + } + + if (starget_priv->deleted || sdev_priv->deleted) goto no_connect; - } else if (starget_priv->tm_busy || sdev_priv->block) { + + if (starget_priv->tm_busy || sdev_priv->block) { *rc = SCSI_MLQUEUE_DEVICE_BUSY; - goto out; + return false; } return true; no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; -done_out: +scsiio_done: if (likely(scmd != adapter->driver_cmds.internal_scmd)) scmd->scsi_done(scmd); -out: + else + *rc = LEAPRAID_OPERATION_FAILED; + return false; } @@ -909,12 +895,14 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; if (scmd->cmd_len == 32) - control |= 4 << LEAPRAID_SCSIIO_CTRL_ADDCDBLEN_SHIFT; + control |= LEAPRAID_SCSIIO_CTRL_CDB_32BYTE << + LEAPRAID_SCSIIO_CTRL_CDB_LEN_SHIFT; return control; } -int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) +int leapraid_queuecommand(struct Scsi_Host *shost, + struct scsi_cmnd *scmd) { struct leapraid_adapter *adapter = shost_priv(scmd->device->host); struct leapraid_sdev_priv *sdev_priv = scmd->device->hostdata; @@ -926,7 +914,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) int rc = 0; if (!leapraid_should_queuecommand(adapter, sdev_priv, scmd, &rc)) - goto out; + return rc; starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; @@ -938,11 +926,11 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) - scsiio_req->func = LEAPRAID_FUNC_RAID_SCSIIO_PASSTHROUGH; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH; else - scsiio_req->func = LEAPRAID_FUNC_SCSIIO_REQ; + scsiio_req->func = LEAPRAID_FUNC_SCSIIO; scsiio_req->dev_hdl = cpu_to_le16(hdl); scsiio_req->data_len = cpu_to_le32(scsi_bufflen(scmd)); @@ -960,23 +948,21 @@ int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd) if (scsiio_req->data_len) { if (leapraid_build_scmd_ieee_sg(adapter, scmd, taskid)) { leapraid_free_taskid(adapter, taskid); - rc = SCSI_MLQUEUE_HOST_BUSY; - goto out; + return SCSI_MLQUEUE_HOST_BUSY; } } else { leapraid_build_ieee_nodata_sg(adapter, &scsiio_req->sgl); } - if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO_REQ)) { + if (likely(scsiio_req->func == LEAPRAID_FUNC_SCSIIO)) leapraid_fire_scsi_io(adapter, taskid, - le16_to_cpu(scsiio_req->dev_hdl)); - } else { + le16_to_cpu(scsiio_req->dev_hdl)); + else leapraid_fire_task(adapter, taskid); - } + dev_dbg(&adapter->pdev->dev, "LEAPRAID_SCSIIO: Send Descriptor taskid %d, req type 0x%x\n", taskid, scsiio_req->func); -out: return rc; } @@ -999,9 +985,9 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, scsi_print_command(scmd); if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - io_req_tracker = leapraid_get_scmd_priv(scmd); + io_req_tracker = (struct leapraid_io_req_tracker *)scmd->host_scribble; dev_info(&adapter->pdev->dev, - "EH ABORT: scmd=0x%p, pending=%u ms, tout=%u ms, req tag=%d\n", + "EH ABORT: scmd=0x%p, pend=%ums, tout=%ums, tag=%d\n", scmd, jiffies_to_msecs(jiffies - scmd->jiffies_at_alloc), (scmd->request->timeout / HZ) * 1000, @@ -1014,48 +1000,47 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH %s failed: %s scmd=0x%p\n", str, (adapter->access_ctrl.host_removing ? "shost removing!" : "pci_dev removed!"), scmd); - if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) - if (io_req_tracker && io_req_tracker->taskid) - leapraid_free_taskid(adapter, - io_req_tracker->taskid); + if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK && + io_req_tracker && io_req_tracker->taskid) + leapraid_free_taskid(adapter, io_req_tracker->taskid); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; #ifdef FAST_IO_FAIL rc = FAST_IO_FAIL; #else rc = FAILED; #endif - goto out; + goto out_eh_done; } sdev_priv = scmd->device->hostdata; if (!sdev_priv || !sdev_priv->starget_priv) { dev_warn(&adapter->pdev->dev, - "EH %s: sdev or starget gone, scmd=0x%p\n", + "EH %s: SAS dev or starget gone, scmd=0x%p\n", str, scmd); scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scmd->scsi_done(scmd); rc = SUCCESS; - goto out; + goto out_eh_done; } if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { if (!io_req_tracker) { dev_warn(&adapter->pdev->dev, - "EH ABORT: no io tracker, scmd 0x%p\n", scmd); + "EH ABORT: No I/O tracker, scmd 0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = SUCCESS; - goto out; + goto out_eh_done; } if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { dev_err(&adapter->pdev->dev, - "EH ABORT: skip RAID/VOLUME target, scmd=0x%p\n", + "EH ABORT: Skip RAID/VOLUME, scmd=0x%p\n", scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } hdl = sdev_priv->starget_priv->hdl; @@ -1073,11 +1058,11 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, if (!hdl) { dev_err(&adapter->pdev->dev, - "EH %s failed: target handle is 0, scmd=0x%p\n", + "EH %s failed: Target handle 0, scmd=0x%p\n", str, scmd); scmd->result = DID_RESET << LEAPRAID_SCSI_HOST_SHIFT; rc = FAILED; - goto out; + goto out_eh_done; } } @@ -1085,24 +1070,27 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, "EH issue TM: type=%s, scmd=0x%p, hdl=0x%x\n", str, scmd, hdl); - rc = leapraid_issue_locked_tm(adapter, hdl, scmd->device->channel, - scmd->device->id, - (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? - 0 : scmd->device->lun), - type, - (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? - io_req_tracker->taskid : 0), - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - -out: + rc = leapraid_issue_locked_tm( + adapter, + hdl, + scmd->device->channel, + scmd->device->id, + (type == LEAPRAID_TM_TASKTYPE_TARGET_RESET ? + 0 : scmd->device->lun), + type, + (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK ? + io_req_tracker->taskid : 0), + LEAPRAID_TM_MSGFLAGS_LINK_RESET); + +out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { dev_info(&adapter->pdev->dev, "EH ABORT result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); } else { dev_info(&adapter->pdev->dev, "EH %s result: %s, scmd=0x%p\n", - str, ((rc == SUCCESS) ? "success" : "failed"), scmd); + str, rc == SUCCESS ? "success" : "failed", scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1145,19 +1133,19 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) (adapter->access_ctrl.host_removing ? "shost removing!" : "driver loading!"), scmd); rc = FAILED; - goto out; + goto out_host_reset_done; } - dev_info(&adapter->pdev->dev, "%s:%d issuing hard reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: Issuing hard reset\n", __func__, __LINE__); if (leapraid_hard_reset_handler(adapter, FULL_RESET) < 0) rc = FAILED; else rc = SUCCESS; -out: +out_host_reset_done: dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - ((rc == SUCCESS) ? "success" : "failed"), scmd); + rc == SUCCESS ? "success" : "failed", scmd); return rc; } @@ -1183,30 +1171,35 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) stgt_priv->num_luns++; sdev_priv->starget_priv = stgt_priv; sdev->hostdata = sdev_priv; - if ((stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER)) + if (stgt_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) sdev->no_uld_attach = LEAPRAID_NO_ULD_ATTACH; shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); if (tgt->channel == RAID_CHANNEL) { - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); - if (raid_volume) + if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, + flags); raid_volume->sdev = sdev; - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, - flags); + spin_unlock_irqrestore( + &adapter->dev_topo.raid_volume_lock, flags); + leapraid_raid_volume_put(raid_volume); + } } if (!(stgt_priv->flg & LEAPRAID_TGT_FLG_VOLUME)) { spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - stgt_priv->sas_address, - stgt_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + stgt_priv->sas_address, + stgt_priv->card_port); if (sas_dev && !sas_dev->starget) { sdev_printk(KERN_INFO, sdev, - "%s: assign starget to sas_dev\n", __func__); + "%s: Assign starget to sas_dev\n", + __func__); sas_dev->starget = tgt; } @@ -1224,7 +1217,6 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) struct leapraid_raid_volume *raid_volume; struct leapraid_starget_priv *starget_priv; struct leapraid_sdev_priv *sdev_priv; - unsigned long flags; int qd; u16 hdl; @@ -1232,37 +1224,38 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) starget_priv = sdev_priv->starget_priv; hdl = starget_priv->hdl; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (!raid_volume) { sdev_printk(KERN_WARNING, sdev, - "%s: raid_volume not found, hdl=0x%x\n", + "%s: RAID volume not found, hdl=0x%x\n", __func__, hdl); return 1; } if (leapraid_get_volume_cap(adapter, raid_volume)) { sdev_printk(KERN_ERR, sdev, - "%s: failed to get volume cap, hdl=0x%x\n", + "%s: Failed to get volume cap, hdl=0x%x\n", __func__, hdl); + leapraid_raid_volume_put(raid_volume); return 1; } qd = (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) ? - LEAPRAID_SAS_QUEUE_DEPTH : LEAPRAID_SATA_QUEUE_DEPTH; + adapter->adapter_attr.narrowport_max_queue_depth : + adapter->adapter_attr.sata_max_queue_depth; if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) - qd = LEAPRAID_RAID_QUEUE_DEPTH; + qd = adapter->adapter_attr.raid_volume_max_queue_depth; sdev_printk(KERN_INFO, sdev, - "raid volume: hdl=0x%04x, wwid=0x%016llx\n", + "RAID volume: hdl=0x%04x, wwid=0x%016llx\n", raid_volume->hdl, (unsigned long long)raid_volume->wwid); if (shost->max_sectors > LEAPRAID_MAX_SECTORS) blk_queue_max_hw_sectors(sdev->request_queue, LEAPRAID_MAX_SECTORS); - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); + leapraid_raid_volume_put(raid_volume); return 0; } @@ -1280,13 +1273,14 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sdev_priv = sdev->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); *is_target_ssp = false; - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr(adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr( + adapter, + sdev_priv->starget_priv->sas_address, + sdev_priv->starget_priv->card_port); if (!sas_dev) { spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); sdev_printk(KERN_WARNING, sdev, - "%s: sas_dev not found, sas=0x%llx\n", + "%s: SAS dev not found, sas=0x%llx\n", __func__, sdev_priv->starget_priv->sas_address); return 1; } @@ -1295,18 +1289,18 @@ static int leapraid_slave_configure_extra(struct scsi_device *sdev, sas_dev->volume_hdl = vol_hdl; sas_dev->volume_wwid = volume_wwid; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { - *qd = (sas_dev->port_type > 1) ? + *qd = (sas_dev->port_connection > 1) ? adapter->adapter_attr.wideport_max_queue_depth : adapter->adapter_attr.narrowport_max_queue_depth; *is_target_ssp = true; if (sas_dev->dev_info & LEAPRAID_DEVTYP_SEP) - sdev_priv->sep = true; + sdev_priv->sep = 1; } else { *qd = adapter->adapter_attr.sata_max_queue_depth; } sdev_printk(KERN_INFO, sdev, - "sdev: dev name=0x%016llx, sas addr=0x%016llx\n", + "device name=0x%016llx, SAS addr=0x%016llx\n", (unsigned long long)sas_dev->dev_name, (unsigned long long)sas_dev->sas_addr); leapraid_sdev_put(sas_dev); @@ -1337,7 +1331,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER) { if (leapraid_cfg_get_volume_hdl(adapter, hdl, &vol_hdl)) { sdev_printk(KERN_WARNING, sdev, - "%s: get volume hdl failed, hdl=0x%x\n", + "%s: Get volume hdl failed, hdl=0x%x\n", __func__, hdl); return 1; } @@ -1345,7 +1339,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) if (vol_hdl && leapraid_cfg_get_volume_wwid(adapter, vol_hdl, &volume_wwid)) { sdev_printk(KERN_WARNING, sdev, - "%s: get wwid failed, volume_hdl=0x%x\n", + "%s: Get wwid failed, volume_hdl=0x%x\n", __func__, vol_hdl); return 1; } @@ -1358,7 +1352,7 @@ static int leapraid_slave_configure(struct scsi_device *sdev) return 1; } - leapraid_adjust_sdev_queue_depth(sdev, qd); + leapraid_change_queue_depth(sdev, qd); if (is_target_ssp) sas_read_port_mode_page(sdev); @@ -1405,17 +1399,19 @@ static int leapraid_target_alloc_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + starget_priv = tgt->hostdata; raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); starget_priv->hdl = raid_volume->hdl; starget_priv->sas_address = raid_volume->wwid; starget_priv->flg |= LEAPRAID_TGT_FLG_VOLUME; raid_volume->starget = tgt; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); return 0; } @@ -1430,12 +1426,13 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) shost = dev_to_shost(&tgt->dev); adapter = shost_priv(shost); - starget_priv = (struct leapraid_starget_priv *)tgt->hostdata; + starget_priv = tgt->hostdata; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); rphy = dev_to_rphy(tgt->dev.parent); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, - rphy->identify.sas_address, - rphy); + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, + rphy->identify.sas_address, + rphy); if (sas_dev) { starget_priv->sas_dev = sas_dev; starget_priv->card_port = sas_dev->card_port; @@ -1444,8 +1441,10 @@ static int leapraid_target_alloc_sas(struct scsi_target *tgt) sas_dev->channel = tgt->channel; sas_dev->id = tgt->id; sas_dev->starget = tgt; - if (test_bit(sas_dev->hdl, - (unsigned long *)adapter->dev_topo.pd_hdls)) + if (sas_dev->hdl && + sas_dev->hdl <= + adapter->adapter_attr.features.max_dev_handle && + test_bit(sas_dev->hdl, adapter->dev_topo.pd_hdls)) starget_priv->flg |= LEAPRAID_TGT_FLG_RAID_MEMBER; } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); @@ -1477,14 +1476,16 @@ static void leapraid_target_destroy_raid(struct scsi_target *tgt) struct leapraid_adapter *adapter = shost_priv(shost); unsigned long flags; - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume = leapraid_raid_volume_find_by_id(adapter, tgt->id, tgt->channel); if (raid_volume) { + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); raid_volume->starget = NULL; raid_volume->sdev = NULL; + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + leapraid_raid_volume_put(raid_volume); } - spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); } static void leapraid_target_destroy_sas(struct scsi_target *tgt) @@ -1526,12 +1527,12 @@ static void leapraid_target_destroy(struct scsi_target *tgt) if (tgt->channel == RAID_CHANNEL) { leapraid_target_destroy_raid(tgt); - goto out; + goto out_free; } leapraid_target_destroy_sas(tgt); -out: +out_free: kfree(starget_priv); tgt->hostdata = NULL; } @@ -1552,24 +1553,27 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, if (adapter->driver_cmds.scan_dev_cmd.status & LEAPRAID_CMD_RESET) { dev_err(&adapter->pdev->dev, - "device scan: aborted due to reset\n"); + "Device scan: Aborted due to reset\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->scan_dev_desc.driver_loading = false; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return true; } if (adapter->scan_dev_desc.scan_start_failed) { dev_err(&adapter->pdev->dev, - "device scan: failed with adapter_status=0x%08x\n", + "Device scan: Failed with adapter_status=0x%08x\n", adapter->scan_dev_desc.scan_start_failed); - adapter->scan_dev_desc.driver_loading = false; - adapter->scan_dev_desc.wait_scan_dev_done = false; - adapter->access_ctrl.host_removing = true; + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.wait_scan_dev_done = 0; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "device scan: SUCCESS\n"); + dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1584,8 +1588,9 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; dev_err(&adapter->pdev->dev, - "device scan: failed with timeout 300s\n"); - adapter->scan_dev_desc.driver_loading = false; + "Device scan: Failed with timeout 300s\n"); + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); return 1; } @@ -1595,10 +1600,12 @@ static int leapraid_scan_finished(struct Scsi_Host *shost, unsigned long time) if (need_hard_reset) { adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - if (leapraid_hard_reset_handler(adapter, PART_RESET)) - adapter->scan_dev_desc.driver_loading = false; + if (leapraid_hard_reset_handler(adapter, PART_RESET)) { + adapter->scan_dev_desc.driver_loading = 0; + wake_up(&adapter->scan_dev_desc.wait_driver_loading); + } } return 1; @@ -1608,18 +1615,88 @@ static void leapraid_scan_start(struct Scsi_Host *shost) { struct leapraid_adapter *adapter = shost_priv(shost); - adapter->scan_dev_desc.scan_start = true; + adapter->scan_dev_desc.scan_start = 1; leapraid_scan_dev(adapter, true); } +static u32 leapraid_get_raid_qd(struct leapraid_adapter *adapter, + const struct leapraid_raid_volume *raid_volume, + bool default_qd) +{ + const struct leapraid_adapter_attr *attr = &adapter->adapter_attr; + + if (raid_volume->vol_type != LEAPRAID_VOL_TYPE_RAID0) + return default_qd ? LEAPRAID_RAID_QUEUE_DEPTH : + attr->raid_volume_max_queue_depth; + + if (raid_volume->dev_info & LEAPRAID_DEVTYP_SSP_TGT) + return default_qd ? LEAPRAID_SAS_QUEUE_DEPTH : + attr->narrowport_max_queue_depth; + + return default_qd ? LEAPRAID_SATA_QUEUE_DEPTH : + attr->sata_max_queue_depth; +} + static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) { struct Scsi_Host *shost; + struct leapraid_adapter *adapter; + struct leapraid_starget_priv *starget_priv; + struct leapraid_sdev_priv *sdev_priv; + struct leapraid_raid_volume *raid_volume; + struct leapraid_sas_dev *sas_dev; int max_depth; + u32 default_qdepth = 0; + u32 fw_qdepth = 0; shost = sdev->host; + adapter = shost_priv(shost); max_depth = shost->can_queue; + sdev_priv = sdev->hostdata; + if (!sdev_priv) + goto out_tag_check; + + starget_priv = sdev_priv->starget_priv; + if (!starget_priv) + goto out_tag_check; + + if (starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME) { + raid_volume = leapraid_raid_volume_find_by_hdl( + adapter, starget_priv->hdl); + if (raid_volume) { + default_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, true); + fw_qdepth = leapraid_get_raid_qd( + adapter, raid_volume, false); + leapraid_raid_volume_put(raid_volume); + } + goto out_limit_check; + } + + sas_dev = leapraid_get_sas_dev_from_tgt(adapter, starget_priv); + if (sas_dev) { + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SSP_TGT) { + default_qdepth = LEAPRAID_SAS_QUEUE_DEPTH; + fw_qdepth = (sas_dev->port_connection > 1) ? + adapter->adapter_attr.wideport_max_queue_depth : + adapter->adapter_attr.narrowport_max_queue_depth; + } + if (sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV) { + default_qdepth = LEAPRAID_SATA_QUEUE_DEPTH; + fw_qdepth = adapter->adapter_attr.sata_max_queue_depth; + } + leapraid_sdev_put(sas_dev); + } + +out_limit_check: + if (fw_qdepth > shost->can_queue && default_qdepth) + fw_qdepth = default_qdepth; + + if (fw_qdepth) + max_depth = min_t(int, max_depth, fw_qdepth); + +out_tag_check: if (!sdev->tagged_supported) max_depth = 1; @@ -1629,26 +1706,21 @@ static int leapraid_calc_max_queue_depth(struct scsi_device *sdev, int qdepth) return qdepth; } -static int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) +int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth) { qdepth = leapraid_calc_max_queue_depth(sdev, qdepth); scsi_change_queue_depth(sdev, qdepth); return sdev->queue_depth; } -void leapraid_adjust_sdev_queue_depth(struct scsi_device *sdev, int qdepth) -{ - leapraid_change_queue_depth(sdev, qdepth); -} - static int leapraid_bios_param(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[]) { - int heads = 0; - int sectors = 0; + int heads; + int sectors; sector_t cylinders; if (scsi_partsize(bdev, capacity, geom)) @@ -1692,12 +1764,24 @@ static ssize_t host_sas_address_show(struct device *cdev, (unsigned long long)adapter->dev_topo.card.sas_address); } +static ssize_t board_name_show(struct device *cdev, + struct device_attribute *attr, char *buf) +{ + struct Scsi_Host *shost = class_to_shost(cdev); + struct leapraid_adapter *adapter = shost_priv(shost); + + return scnprintf(buf, PAGE_SIZE, "%s\n", + adapter->adapter_attr.board_name); +} + static DEVICE_ATTR_RO(fw_queue_depth); static DEVICE_ATTR_RO(host_sas_address); +static DEVICE_ATTR_RO(board_name); static struct device_attribute *leapraid_shost_attrs[] = { &dev_attr_fw_queue_depth, &dev_attr_host_sas_address, + &dev_attr_board_name, NULL, }; @@ -1706,9 +1790,18 @@ static ssize_t sas_address_show(struct device *dev, { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + u64 sas_address; + + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + + sas_address = sas_device_priv_data->starget_priv->sas_address; return scnprintf(buf, PAGE_SIZE, "0x%016llx\n", - (unsigned long long)sas_device_priv_data->starget_priv->sas_address); + (unsigned long long)sas_address); } static ssize_t sas_device_handle_show(struct device *dev, @@ -1717,6 +1810,12 @@ static ssize_t sas_device_handle_show(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv or starget_priv\n", __func__); + return -EINVAL; + } + return scnprintf(buf, PAGE_SIZE, "0x%04x\n", sas_device_priv_data->starget_priv->hdl); } @@ -1727,6 +1826,12 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } + return scnprintf(buf, PAGE_SIZE, "%d\n", sas_device_priv_data->ncq); } @@ -1737,21 +1842,34 @@ static ssize_t sas_ncq_store(struct device *dev, struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; unsigned char *vpd_pg89; - int ncq_op = 0; - bool ncq_supported = false; + int ncq_op; + bool ncq_supported; + + if (!sas_device_priv_data) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid sdev_priv\n", __func__); + return -EINVAL; + } if (kstrtoint(buf, 0, &ncq_op)) - goto out; + return -EINVAL; + + if (ncq_op != 0 && ncq_op != 1) { + dev_err(&sdev->sdev_gendev, + "%s: Invalid NCQ value %d (only 0/1 allowed)\n", + __func__, ncq_op); + return -EINVAL; + } vpd_pg89 = kmalloc(LEAPRAID_VPD_PG89_MAX_LEN, GFP_KERNEL); if (!vpd_pg89) - goto out; + return -ENOMEM; if (!scsi_device_supports_vpd(sdev) || scsi_get_vpd_page(sdev, LEAPRAID_VPD_PAGE_ATA_INFO, vpd_pg89, LEAPRAID_VPD_PG89_MAX_LEN)) { kfree(vpd_pg89); - goto out; + return -EINVAL; } ncq_supported = (vpd_pg89[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> @@ -1760,9 +1878,7 @@ static ssize_t sas_ncq_store(struct device *dev, kfree(vpd_pg89); if (ncq_supported) sas_device_priv_data->ncq = ncq_op; - return strlen(buf); -out: - return -EINVAL; + return count; } static DEVICE_ATTR_RO(sas_address); @@ -1798,7 +1914,7 @@ static struct scsi_host_template leapraid_driver_template = { .can_queue = LEAPRAID_CAN_QUEUE_MIN, .this_id = LEAPRAID_THIS_ID_NONE, .sg_tablesize = LEAPRAID_SG_DEPTH, - .max_sectors = LEAPRAID_DEF_MAX_SECTORS, + .max_sectors = LEAPRAID_MAX_SECTORS, .max_segment_size = LEAPRAID_MAX_SEGMENT_SIZE, .cmd_per_lun = LEAPRAID_CMD_PER_LUN, .shost_attrs = leapraid_shost_attrs, @@ -1818,6 +1934,8 @@ static void leapraid_lock_init(struct leapraid_adapter *adapter) spin_lock_init(&adapter->dev_topo.topo_node_lock); spin_lock_init(&adapter->fw_evt_s.fw_evt_lock); spin_lock_init(&adapter->dev_topo.raid_volume_lock); + spin_lock_init(&adapter->dev_topo.enc_lock); + spin_lock_init(&adapter->boot_devs.lock); } static void leapraid_list_init(struct leapraid_adapter *adapter) @@ -1834,18 +1952,23 @@ static void leapraid_list_init(struct leapraid_adapter *adapter) static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) { - struct leapraid_adapter *adapter = NULL; - struct Scsi_Host *shost = NULL; + struct leapraid_adapter *adapter; + struct Scsi_Host *shost; int rc; shost = scsi_host_alloc(&leapraid_driver_template, sizeof(struct leapraid_adapter)); - if (!shost) + if (!shost) { + dev_err(&pdev->dev, + "%s: SCSI host alloc failed\n", __func__); return -ENODEV; + } adapter = shost_priv(shost); memset(adapter, 0, sizeof(struct leapraid_adapter)); - adapter->adapter_attr.id = leapraid_ids++; + + init_waitqueue_head(&adapter->access_ctrl.recovery_waitq); + adapter->adapter_attr.id = atomic_inc_return(&leapraid_ids) - 1; adapter->adapter_attr.enable_mp = enable_mp; @@ -1860,8 +1983,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; leapraid_lock_init(adapter); leapraid_list_init(adapter); - sprintf(adapter->adapter_attr.name, "%s%d", - LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); + snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", + LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id); shost->max_cmd_len = LEAPRAID_MAX_CDB_LEN; shost->max_lun = LEAPRAID_MAX_LUNS; @@ -1875,12 +1998,17 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter->fw_evt_s.fw_evt_thread = alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); if (!adapter->fw_evt_s.fw_evt_thread) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create fw event workqueue\n", __func__); rc = -ENODEV; goto evt_wq_fail; } - adapter->scan_dev_desc.driver_loading = true; - if ((leapraid_ctrl_init(adapter))) { + init_waitqueue_head(&adapter->scan_dev_desc.wait_driver_loading); + adapter->scan_dev_desc.driver_loading = 1; + if (leapraid_ctrl_init(adapter)) { + dev_err(&adapter->pdev->dev, + "%s: Adapter init failed\n", __func__); rc = -ENODEV; goto ctrl_init_fail; } @@ -1888,9 +2016,8 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) rc = scsi_add_host(shost, &pdev->dev); if (rc) { - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); + dev_err(&pdev->dev, + "%s: SCSI host add failed\n", __func__); goto scsi_add_shost_fail; } @@ -1900,6 +2027,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) scsi_add_shost_fail: leapraid_remove_ctrl(adapter); ctrl_init_fail: + leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: spin_lock(&leapraid_adapter_lock); @@ -1909,7 +2037,7 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) return rc; } -static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) +void leapraid_cleanup_lists(struct leapraid_adapter *adapter) { struct leapraid_raid_volume *raid_volume, *next_raid_volume; struct leapraid_starget_priv *starget_priv_data; @@ -1921,12 +2049,14 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) &adapter->dev_topo.raid_volume_list, list) { if (raid_volume->starget) { starget_priv_data = raid_volume->starget->hostdata; - starget_priv_data->deleted = true; + if (starget_priv_data) + starget_priv_data->deleted = 1; scsi_remove_target(&raid_volume->starget->dev); } - pr_info("removing hdl=0x%04x, wwid=0x%016llx\n", - raid_volume->hdl, - (unsigned long long)raid_volume->wwid); + dev_info(&adapter->pdev->dev, + "removing hdl=0x%04x, wwid=0x%016llx\n", + raid_volume->hdl, + (unsigned long long)raid_volume->wwid); leapraid_raid_volume_remove(adapter, raid_volume); } @@ -1935,16 +2065,18 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) port_list) { if (leapraid_port->remote_identify.device_type == SAS_END_DEVICE) - leapraid_sas_dev_remove_by_sas_address(adapter, + leapraid_sas_dev_remove_by_sas_address( + adapter, leapraid_port->remote_identify.sas_address, leapraid_port->card_port); else if (leapraid_port->remote_identify.device_type == SAS_EDGE_EXPANDER_DEVICE || leapraid_port->remote_identify.device_type == SAS_FANOUT_EXPANDER_DEVICE) - leapraid_exp_rm(adapter, - leapraid_port->remote_identify.sas_address, - leapraid_port->card_port); + leapraid_exp_rm( + adapter, + leapraid_port->remote_identify.sas_address, + leapraid_port->card_port); } list_for_each_entry_safe(port, port_next, @@ -1969,27 +2101,26 @@ static void leapraid_cleanup_lists(struct leapraid_adapter *adapter) static void leapraid_remove(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to remove!\n"); + dev_err(&pdev->dev, "Unable to remove!\n"); return; } - while (adapter->scan_dev_desc.driver_loading) - ssleep(1); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !adapter->scan_dev_desc.driver_loading); + wait_event(adapter->scan_dev_desc.wait_driver_loading, + !atomic_read(&adapter->overheat_desc.thermal_alert)); - while (adapter->access_ctrl.shost_recovering) - ssleep(1); - - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_smart_polling_stop(adapter); - leapraid_free_internal_scsi_cmd(adapter); if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); @@ -2004,7 +2135,6 @@ static void leapraid_remove(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); @@ -2017,18 +2147,20 @@ static void leapraid_remove(struct pci_dev *pdev) static void leapraid_shutdown(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct workqueue_struct *wq; unsigned long flags; if (!shost || !adapter) { - dev_err(&pdev->dev, "unable to shutdown!\n"); + dev_err(&pdev->dev, "Unable to shutdown!\n"); return; } - adapter->access_ctrl.host_removing = true; + adapter->access_ctrl.host_removing = 1; + wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); + leapraid_overheat_cleanup(adapter); leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; @@ -2037,7 +2169,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) if (wq) destroy_workqueue(wq); - leapraid_ir_shutdown(adapter); leapraid_disable_controller(adapter); } @@ -2045,29 +2176,31 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to error detected for device\n"); + dev_err(&pdev->dev, "Failed to error detected for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - pr_err("%s: pci error detected, state=%d\n", - adapter->adapter_attr.name, state); + dev_err(&pdev->dev, "%s: PCI error detected, state=%d\n", + adapter->adapter_attr.name, state); switch (state) { case pci_channel_io_normal: return PCI_ERS_RESULT_CAN_RECOVER; case pci_channel_io_frozen: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); return PCI_ERS_RESULT_NEED_RESET; case pci_channel_io_perm_failure: - adapter->access_ctrl.pcie_recovering = true; + adapter->access_ctrl.pcie_recovering = 1; + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); @@ -2082,15 +2215,15 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to enable mmio for device\n"); + "Failed to enable mmio for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_info(&pdev->dev, "%s: pci error mmio enabled\n", + dev_info(&pdev->dev, "%s: PCI error mmio enabled\n", adapter->adapter_attr.name); return PCI_ERS_RESULT_RECOVERED; @@ -2099,43 +2232,47 @@ static pci_ers_result_t leapraid_pci_mmio_enabled(struct pci_dev *pdev) static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "failed to slot reset for device\n"); + "Failed to slot reset for device\n"); return PCI_ERS_RESULT_DISCONNECT; } - dev_err(&pdev->dev, "%s pci error slot reset\n", + dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = false; + adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); - if (leapraid_set_pcie_and_notification(adapter)) + if (leapraid_set_pcie_and_notification(adapter)) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return PCI_ERS_RESULT_DISCONNECT; + } - dev_info(&pdev->dev, "%s: hard reset triggered by pci slot reset\n", + dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, (rc == 0) ? "success" : "failed"); + adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); - return (rc == 0) ? PCI_ERS_RESULT_RECOVERED : + return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; } static void leapraid_pci_resume(struct pci_dev *pdev) { - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); struct leapraid_adapter *adapter = pdev_to_adapter(pdev); if (!shost || !adapter) { - dev_err(&pdev->dev, "failed to resume\n"); + dev_err(&pdev->dev, "Failed to resume\n"); return; } @@ -2159,24 +2296,24 @@ static struct pci_error_handlers leapraid_err_handler = { static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state; if (!shost || !adapter) { dev_err(&pdev->dev, - "suspend failed, invalid host or adapter\n"); + "Suspend failed, invalid host or adapter\n"); return -ENXIO; } + leapraid_overheat_cleanup(adapter); leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); flush_scheduled_work(); scsi_block_requests(shost); device_state = pci_choose_state(pdev, state); - leapraid_ir_shutdown(adapter); - dev_info(&pdev->dev, "entering PCI power state D%d, (slot=%s)\n", + dev_info(&pdev->dev, "Entering PCI power state D%d, (slot=%s)\n", device_state, pci_name(pdev)); pci_save_state(pdev); @@ -2188,18 +2325,18 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) static int leapraid_resume(struct pci_dev *pdev) { struct leapraid_adapter *adapter = pdev_to_adapter(pdev); - struct Scsi_Host *shost = pdev_to_shost(pdev); + struct Scsi_Host *shost = pci_get_drvdata(pdev); pci_power_t device_state = pdev->current_state; int rc; if (!shost || !adapter) { dev_err(&pdev->dev, - "resume failed, invalid host or adapter\n"); + "Resume failed, invalid host or adapter\n"); return -ENXIO; } dev_info(&pdev->dev, - "resuming device %s, previous state D%d\n", + "Resuming device %s, previous state D%d\n", pci_name(pdev), device_state); pci_set_power_state(pdev, PCI_D0); @@ -2207,12 +2344,22 @@ static int leapraid_resume(struct pci_dev *pdev) pci_restore_state(pdev); adapter->pdev = pdev; rc = leapraid_set_pcie_and_notification(adapter); - if (rc) + if (rc) { + dev_err(&pdev->dev, + "%s: Failed to set PCIe state and notification\n", + __func__); return rc; + } - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, PART_RESET); + rc = leapraid_hard_reset_handler(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed during resume, rc=%d\n", + __func__, rc); + return rc; + } scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); @@ -2238,29 +2385,37 @@ static int __init leapraid_init(void) { int error; - pr_info("%s version %s loaded\n", LEAPRAID_DRIVER_NAME, - LEAPRAID_DRIVER_VERSION); + pr_info("%s initializing\n", LEAPRAID_DRIVER_NAME); leapraid_transport_template = sas_attach_transport(&leapraid_transport_functions); - if (!leapraid_transport_template) + if (!leapraid_transport_template) { + pr_err("%s: Failed to attach SAS transport\n", + LEAPRAID_DRIVER_NAME); return -ENODEV; - - leapraid_ids = 0; - - leapraid_ctl_init(); + } error = pci_register_driver(&leapraid_driver); - if (error) + if (error) { + pr_err("%s: PCI driver registration failed: %d\n", + LEAPRAID_DRIVER_NAME, error); + sas_release_transport(leapraid_transport_template); + return error; + } + + error = leapraid_ctl_init(); + if (error) { + pci_unregister_driver(&leapraid_driver); sas_release_transport(leapraid_transport_template); + return error; + } - return error; + return 0; } static void __exit leapraid_exit(void) { - pr_info("leapraid version %s unloading\n", - LEAPRAID_DRIVER_VERSION); + pr_info("%s exiting\n", LEAPRAID_DRIVER_NAME); leapraid_ctl_exit(); pci_unregister_driver(&leapraid_driver); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index d224449732a3..738bc55df416 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -1,10 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright (C) 2025 LeapIO Tech Inc. + * Copyright (C) 2026 LeapIO Tech Inc. * - * LeapRAID Storage and RAID Controller driver. + * LeapRAID storage and RAID controller driver. */ - #include <scsi/scsi_host.h> #include "leapraid_func.h" @@ -16,10 +15,8 @@ static struct leapraid_topo_node *leapraid_transport_topo_node_by_sas_addr( { if (adapter->dev_topo.card.sas_address == sas_addr) return &adapter->dev_topo.card; - else - return leapraid_exp_find_by_sas_address(adapter, - sas_addr, - card_port); + + return leapraid_exp_find_by_sas_address(adapter, sas_addr, card_port); } static u8 leapraid_get_port_id_by_expander(struct leapraid_adapter *adapter, @@ -49,7 +46,8 @@ static u8 leapraid_get_port_id_by_end_dev(struct leapraid_adapter *adapter, u8 port_id = 0xFF; spin_lock_irqsave(&adapter->dev_topo.sas_dev_lock, flags); - sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy(adapter, + sas_dev = leapraid_hold_lock_get_sas_dev_by_addr_and_rphy( + adapter, rphy->identify.sas_address, rphy); if (sas_dev) { @@ -131,10 +129,9 @@ static enum sas_linkrate leapraid_transport_convert_phy_link_rate(u8 link_rate) }, }; - for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) { + for (i = 0; i < ARRAY_SIZE(linkrate_table); i++) if (linkrate_table[i].in == link_rate) return linkrate_table[i].out; - } return SAS_LINK_RATE_UNKNOWN; } @@ -192,7 +189,7 @@ static void leapraid_set_identify_protocol_flags(u32 dev_info, }; for (i = 0; i < ARRAY_SIZE(mappings); i++) - if ((dev_info & mappings[i].mask) && mappings[i].target) + if (dev_info & mappings[i].mask && mappings[i].target) *mappings[i].target |= mappings[i].protocol; } @@ -207,13 +204,19 @@ static int leapraid_transport_set_identify(struct leapraid_adapter *adapter, if ((adapter->access_ctrl.shost_recovering && !adapter->scan_dev_desc.driver_loading) || - adapter->access_ctrl.pcie_recovering) + adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; + } cfgp1.form = LEAPRAID_SAS_DEV_CFG_PGAD_HDL; cfgp2.handle = hdl; - if ((leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, - cfgp2, GET_SAS_DEVICE_PG0))) + if (leapraid_op_config_page(adapter, &sas_dev_pg0, cfgp1, + cfgp2, GET_SAS_DEVICE_PG0)) return -ENXIO; memset(identify, 0, sizeof(struct sas_identify)); @@ -248,27 +251,34 @@ static void leapraid_transport_exp_set_edev(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; struct leapraid_rep_manu_reply *rep_manu_reply; u8 *component_id; - ssize_t __maybe_unused ret; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; if (le16_to_cpu(smp_passthrough_rep->resp_data_len) != sizeof(struct leapraid_rep_manu_reply)) return; rep_manu_reply = data_out + sizeof(struct leapraid_rep_manu_request); - ret = strscpy(edev->vendor_id, rep_manu_reply->vendor_identification, - SAS_EXPANDER_VENDOR_ID_LEN); - ret = strscpy(edev->product_id, rep_manu_reply->product_identification, - SAS_EXPANDER_PRODUCT_ID_LEN); - ret = strscpy(edev->product_rev, - rep_manu_reply->product_revision_level, - SAS_EXPANDER_PRODUCT_REV_LEN); + + memcpy(edev->vendor_id, rep_manu_reply->vendor_identification, + SAS_EXPANDER_VENDOR_ID_LEN); + edev->vendor_id[SAS_EXPANDER_VENDOR_ID_LEN] = '\0'; + + memcpy(edev->product_id, rep_manu_reply->product_identification, + SAS_EXPANDER_PRODUCT_ID_LEN); + edev->product_id[SAS_EXPANDER_PRODUCT_ID_LEN] = '\0'; + + memcpy(edev->product_rev, rep_manu_reply->product_revision_level, + SAS_EXPANDER_PRODUCT_REV_LEN); + edev->product_rev[SAS_EXPANDER_PRODUCT_REV_LEN] = '\0'; + edev->level = rep_manu_reply->sas_format & 1; if (edev->level) { - ret = strscpy(edev->component_vendor_id, - rep_manu_reply->component_vendor_identification, - SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + memcpy(edev->component_vendor_id, + rep_manu_reply->comp_vendor_identification, + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN); + edev->component_vendor_id[ + SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN] = '\0'; component_id = (u8 *)&rep_manu_reply->component_id; edev->component_id = component_id[0] << 8 | component_id[1]; @@ -291,18 +301,24 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, size_t c2h_size; size_t h2c_size; void *psge; - int rc = 0; + int rc; if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_warn(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); return -EFAULT; } mutex_lock(&adapter->driver_cmds.transport_cmd.mutex); adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) - goto out; + goto out_cleanup; h2c_size = sizeof(struct leapraid_rep_manu_request); c2h_size = sizeof(struct leapraid_rep_manu_reply); @@ -312,7 +328,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, GFP_ATOMIC); if (!data_out) { rc = -ENOMEM; - goto out; + goto out_cleanup; } rep_manu_request = data_out; @@ -323,8 +339,9 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->request_length = 0; smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_get_task_desc( + adapter, + adapter->driver_cmds.transport_cmd.inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -342,11 +359,13 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { + rc = -ETIMEDOUT; dev_err(&adapter->pdev->dev, - "%s: smp passthrough to exp timeout\n", - __func__); + "%s: SMP passthrough timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & - LEAPRAID_CMD_RESET)) + LEAPRAID_CMD_RESET)) issue_reset = true; goto hard_reset; @@ -358,11 +377,11 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, hard_reset: if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d call hard_reset\n", + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); + rc = leapraid_hard_reset_handler(adapter, FULL_RESET); } -out: +out_cleanup: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; if (data_out) dma_free_coherent(&adapter->pdev->dev, h2c_size + c2h_size, @@ -376,13 +395,14 @@ static void leapraid_transport_del_port(struct leapraid_adapter *adapter, struct leapraid_sas_port *sas_port) { dev_info(&sas_port->port->dev, - "remove port: sas addr=0x%016llx\n", + "Remove port: SAS addr=0x%016llx\n", (unsigned long long)sas_port->remote_identify.sas_address); switch (sas_port->remote_identify.device_type) { case SAS_END_DEVICE: - leapraid_sas_dev_remove_by_sas_address(adapter, - sas_port->remote_identify.sas_address, - sas_port->card_port); + leapraid_sas_dev_remove_by_sas_address( + adapter, + sas_port->remote_identify.sas_address, + sas_port->card_port); break; case SAS_EDGE_EXPANDER_DEVICE: case SAS_FANOUT_EXPANDER_DEVICE: @@ -399,13 +419,13 @@ static void leapraid_transport_del_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "remove phy: sas addr=0x%016llx, phy=%d\n", + "Remove PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_del(&card_phy->port_siblings); sas_port->phys_num--; sas_port_delete_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; } static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, @@ -413,16 +433,17 @@ static void leapraid_transport_add_phy(struct leapraid_adapter *adapter, struct leapraid_card_phy *card_phy) { dev_info(&card_phy->phy->dev, - "add phy: sas addr=0x%016llx, phy=%d\n", + "Add PHY: SAS addr=0x%016llx, phy=%d\n", (unsigned long long)sas_port->remote_identify.sas_address, card_phy->phy_id); list_add_tail(&card_phy->port_siblings, &sas_port->phy_list); sas_port->phys_num++; sas_port_add_phy(sas_port->port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; } -void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_attach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *card_phy, u64 sas_address, @@ -454,7 +475,8 @@ void leapraid_transport_attach_phy_to_port(struct leapraid_adapter *adapter, } } -void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, +void leapraid_transport_detach_phy_to_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, struct leapraid_card_phy *target_card_phy) { @@ -482,7 +504,8 @@ void leapraid_transport_detach_phy_to_port(struct leapraid_adapter *adapter, } } -static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, +static void leapraid_detach_phy_from_old_port( + struct leapraid_adapter *adapter, struct leapraid_topo_node *topo_node, u64 sas_address, struct leapraid_card_port *card_port) @@ -495,9 +518,10 @@ static void leapraid_detach_phy_from_old_port(struct leapraid_adapter *adapter, topo_node->card_phy[i].card_port != card_port) continue; if (topo_node->card_phy[i].phy_is_assigned) - leapraid_transport_detach_phy_to_port(adapter, - topo_node, - &topo_node->card_phy[i]); + leapraid_transport_detach_phy_to_port( + adapter, + topo_node, + &topo_node->card_phy[i]); } } @@ -512,8 +536,11 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( unsigned long flags; sas_port = kzalloc(sizeof(*sas_port), GFP_KERNEL); - if (!sas_port) + if (!sas_port) { + dev_warn(&adapter->pdev->dev, + "%s: Failed alloc sas_port\n", __func__); return NULL; + } INIT_LIST_HEAD(&sas_port->port_list); INIT_LIST_HEAD(&sas_port->phy_list); @@ -526,27 +553,30 @@ static struct leapraid_sas_port *leapraid_prepare_sas_port( if (!topo_node) { dev_err(&adapter->pdev->dev, - "%s: failed to find parent node for sas addr 0x%016llx!\n", + "%s: Failed to locate parent for SAS 0x%016llx!\n", __func__, sas_address); - kfree(sas_port); - return NULL; + goto out_cleanup; } if (leapraid_transport_set_identify(adapter, handle, - &sas_port->remote_identify)) { - kfree(sas_port); - return NULL; - } + &sas_port->remote_identify)) + goto out_cleanup; if (sas_port->remote_identify.device_type == SAS_PHY_UNUSED) { - kfree(sas_port); - return NULL; + dev_warn(&adapter->pdev->dev, + "%s: Failed, device type is SAS_PHY_UNUSED\n", + __func__); + goto out_cleanup; } sas_port->card_port = card_port; *out_topo_node = topo_node; return sas_port; + +out_cleanup: + kfree(sas_port); + return NULL; } static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, @@ -576,12 +606,12 @@ static int leapraid_bind_phys_and_vphy(struct leapraid_adapter *adapter, vphy = leapraid_get_vphy_by_phy(card_port, i); if (!vphy) - return -1; + return LEAPRAID_OPERATION_FAILED; } } *out_vphy = vphy; - return sas_port->phys_num ? 0 : -1; + return sas_port->phys_num ? 0 : LEAPRAID_OPERATION_FAILED; } static struct sas_rphy *leapraid_create_and_register_rphy( @@ -596,26 +626,42 @@ static struct sas_rphy *leapraid_create_and_register_rphy( struct sas_port *port; struct sas_rphy *rphy; - if (!topo_node->parent_dev) - return NULL; + if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { + sas_dev = leapraid_get_sas_dev_by_addr( + adapter, + sas_port->remote_identify.sas_address, + card_port); + if (!sas_dev) + return NULL; + sas_dev->pend_sas_rphy_add = 1; + } + + if (!topo_node->parent_dev) { + dev_warn(&adapter->pdev->dev, + "%s: topo_node parent device is NULL\n", __func__); + goto cleanup_sas_dev; + } port = sas_port_alloc_num(topo_node->parent_dev); - if (sas_port_add(port)) - return NULL; + if (!port) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate SAS port\n", __func__); + goto cleanup_sas_dev; + } + + if (sas_port_add(port)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to add SAS port\n", __func__); + goto out_delete_port; + } list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { sas_port_add_phy(port, card_phy->phy); - card_phy->phy_is_assigned = true; + card_phy->phy_is_assigned = 1; card_phy->card_port = card_port; } - if (sas_port->remote_identify.device_type == SAS_END_DEVICE) { - sas_dev = leapraid_get_sas_dev_by_addr(adapter, - sas_port->remote_identify.sas_address, - card_port); - if (!sas_dev) - return NULL; - sas_dev->pend_sas_rphy_add = 1; + if (sas_dev) { rphy = sas_end_device_alloc(port); sas_dev->rphy = rphy; @@ -625,28 +671,63 @@ static struct sas_rphy *leapraid_create_and_register_rphy( else vphy->sas_address = sas_dev->sas_addr; } - } else { - rphy = sas_expander_alloc(port, - sas_port->remote_identify.device_type); + rphy = sas_expander_alloc( + port, + sas_port->remote_identify.device_type); if (topo_node->hdl <= adapter->dev_topo.card.phys_num) card_port->sas_address = sas_port->remote_identify.sas_address; } + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to allocate RPHY\n", __func__); + goto cleanup_card_phy; + } + rphy->identify = sas_port->remote_identify; - if (sas_rphy_add(rphy)) + if (sas_rphy_add(rphy)) { dev_err(&adapter->pdev->dev, - "%s: failed to add rphy\n", __func__); + "%s: Failed to add RPHY\n", __func__); + if (sas_dev) + sas_dev->rphy = NULL; + + sas_rphy_free(rphy); + goto cleanup_card_phy; + } + sas_port->port = port; if (sas_dev) { sas_dev->pend_sas_rphy_add = 0; leapraid_sdev_put(sas_dev); } - sas_port->port = port; return rphy; + +cleanup_card_phy: + if (topo_node->hdl <= adapter->dev_topo.card.phys_num) { + if (!vphy) + card_port->sas_address = 0; + else + vphy->sas_address = 0; + } + + list_for_each_entry(card_phy, &sas_port->phy_list, port_siblings) { + card_phy->phy_is_assigned = 0; + card_phy->card_port = NULL; + } + +out_delete_port: + sas_port_delete(port); + +cleanup_sas_dev: + if (sas_dev) { + sas_dev->pend_sas_rphy_add = 0; + leapraid_sdev_put(sas_dev); + } + return NULL; } struct leapraid_sas_port *leapraid_transport_port_add( @@ -656,35 +737,45 @@ struct leapraid_sas_port *leapraid_transport_port_add( { struct leapraid_card_phy *card_phy, *card_phy_next; struct leapraid_topo_node *topo_node = NULL; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_vphy *vphy = NULL; - struct sas_rphy *rphy = NULL; + struct sas_rphy *rphy; unsigned long flags; - if (!card_port) + if (!card_port) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid card_port\n", __func__); return NULL; + } sas_port = leapraid_prepare_sas_port(adapter, hdl, sas_address, card_port, &topo_node); if (!sas_port) return NULL; - leapraid_detach_phy_from_old_port(adapter, - topo_node, - sas_port->remote_identify.sas_address, - card_port); + leapraid_detach_phy_from_old_port( + adapter, + topo_node, + sas_port->remote_identify.sas_address, + card_port); if (leapraid_bind_phys_and_vphy(adapter, sas_port, topo_node, - card_port, &vphy)) + card_port, &vphy)) { + dev_err(&adapter->pdev->dev, + "%s: Failed to bind phy to vphy\n", __func__); goto out_fail; + } rphy = leapraid_create_and_register_rphy(adapter, sas_port, topo_node, card_port, vphy); - if (!rphy) + if (!rphy) { + dev_err(&adapter->pdev->dev, + "%s: Failed to create rphy\n", __func__); goto out_fail; + } dev_info(&rphy->dev, - "%s: added dev: hdl=0x%04x, sas addr=0x%016llx\n", + "%s: Added dev: hdl=0x%04x, SAS addr=0x%016llx\n", __func__, hdl, (unsigned long long)sas_port->remote_identify.sas_address); @@ -695,20 +786,27 @@ struct leapraid_sas_port *leapraid_transport_port_add( spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); if (sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_EDGE_EXPANDER || + SAS_EDGE_EXPANDER_DEVICE || sas_port->remote_identify.device_type == - LEAPRAID_DEVTYP_FANOUT_EXPANDER) - leapraid_transport_exp_report_manu(adapter, - sas_port->remote_identify.sas_address, - rphy_to_expander_device(rphy), - card_port->port_id); + SAS_FANOUT_EXPANDER_DEVICE) + leapraid_transport_exp_report_manu( + adapter, + sas_port->remote_identify.sas_address, + rphy_to_expander_device(rphy), + card_port->port_id); return sas_port; out_fail: list_for_each_entry_safe(card_phy, card_phy_next, - &sas_port->phy_list, port_siblings) - list_del(&card_phy->port_siblings); + &sas_port->phy_list, port_siblings) { + if (topo_node->hdl <= adapter->dev_topo.card.phys_num && + !card_phy->vphy) + card_port->phy_mask &= ~BIT(card_phy->phy_id); + + list_del_init(&card_phy->port_siblings); + } + kfree(sas_port); return NULL; } @@ -750,10 +848,10 @@ static void leapraid_cleanup_card_port_and_vphys( if (vphy->sas_address != sas_address) continue; - dev_info(&adapter->pdev->dev, - "%s: remove vphy: %p from port: %p, port_id=%d\n", - __func__, vphy, remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove vphy=%p from port=%p port_id=%d\n", + __func__, vphy, remove_card_port, + remove_card_port->port_id); remove_card_port->vphys_mask &= ~vphy->phy_mask; list_del(&vphy->list); @@ -762,11 +860,11 @@ static void leapraid_cleanup_card_port_and_vphys( if (!remove_card_port->vphys_mask && !remove_card_port->sas_address) { - dev_info(&adapter->pdev->dev, - "%s: remove empty hba_port: %p, port_id=%d\n", - __func__, - remove_card_port, - remove_card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove empty hba_port: %p, port_id=%d\n", + __func__, + remove_card_port, + remove_card_port->port_id); list_del(&remove_card_port->list); kfree(remove_card_port); remove_card_port = NULL; @@ -782,15 +880,15 @@ static void leapraid_cleanup_card_port_and_vphys( continue; if (!remove_card_port->vphys_mask) { - dev_info(&adapter->pdev->dev, - "%s: remove hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "%s: Remove hba_port: %p, port_id=%d\n", + __func__, card_port, card_port->port_id); list_del(&card_port->list); kfree(card_port); } else { - dev_info(&adapter->pdev->dev, - "%s: clear sas_address of hba_port: %p, port_id=%d\n", - __func__, card_port, card_port->port_id); + dev_dbg(&adapter->pdev->dev, + "Clear sas_address of port=%p, port_id=%d\n", + card_port, card_port->port_id); remove_card_port->sas_address = 0; } break; @@ -802,22 +900,23 @@ static void leapraid_clear_topo_node_phys(struct leapraid_topo_node *topo_node, { int i; - for (i = 0; i < topo_node->phys_num; i++) { + for (i = 0; i < topo_node->phys_num; i++) if (topo_node->card_phy[i].remote_identify.sas_address == sas_address) { memset(&topo_node->card_phy[i].remote_identify, 0, sizeof(struct sas_identify)); - topo_node->card_phy[i].vphy = false; + topo_node->card_phy[i].vphy = 0; } - } } -void leapraid_transport_port_remove(struct leapraid_adapter *adapter, - u64 sas_address, u64 sas_address_parent, +void leapraid_transport_port_remove( + struct leapraid_adapter *adapter, + u64 sas_address, + u64 sas_address_parent, struct leapraid_card_port *remove_card_port) { struct leapraid_card_phy *card_phy, *card_phy_next; - struct leapraid_sas_port *sas_port = NULL; + struct leapraid_sas_port *sas_port; struct leapraid_topo_node *topo_node; unsigned long flags; bool found = false; @@ -855,7 +954,7 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, list_for_each_entry_safe(card_phy, card_phy_next, &sas_port->phy_list, port_siblings) { - card_phy->phy_is_assigned = false; + card_phy->phy_is_assigned = 0; if (!adapter->access_ctrl.host_removing) sas_port_delete_phy(sas_port->port, card_phy->phy); @@ -865,9 +964,9 @@ void leapraid_transport_port_remove(struct leapraid_adapter *adapter, if (!adapter->access_ctrl.host_removing) sas_port_delete(sas_port->port); - dev_info(&adapter->pdev->dev, - "%s: removed sas_port for sas addr=0x%016llx\n", - __func__, (unsigned long long)sas_address); + dev_dbg(&adapter->pdev->dev, + "%s: Removed sas_port for SAS addr=0x%016llx\n", + __func__, (unsigned long long)sas_address); kfree(sas_port); } @@ -902,9 +1001,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_HWRATE_MIN_RATE_MASK); phy->maximum_linkrate_hw = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->hw_link_rate >> 4) : + phy_pg0->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->hw_link_rate >> 4); + exp_pg1->hw_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->minimum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( phy_pg0->p_link_rate & @@ -914,9 +1015,11 @@ static void leapraid_init_sas_or_exp_phy(struct leapraid_adapter *adapter, LEAPRAID_SAS_PRATE_MIN_RATE_MASK); phy->maximum_linkrate = phy_pg0 ? leapraid_transport_convert_phy_link_rate( - phy_pg0->p_link_rate >> 4) : + phy_pg0->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT) : leapraid_transport_convert_phy_link_rate( - exp_pg1->p_link_rate >> 4); + exp_pg1->p_link_rate >> + LEAPRAID_SAS_NEG_LINK_RATE_SHIFT); phy->hostdata = card_phy->card_port; } @@ -926,30 +1029,33 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy handle identify failed!\n", __func__); + "%s: Set PHY handle identify failed!\n", __func__); sas_phy_free(phy); return; } card_phy->attached_hdl = le16_to_cpu(phy_pg0->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) { dev_err(&adapter->pdev->dev, - "%s set phy attached handle identify failed!\n", + "%s: Set PHY attached hdl identify failed!\n", __func__); sas_phy_free(phy); return; @@ -958,7 +1064,9 @@ void leapraid_transport_add_card_phy(struct leapraid_adapter *adapter, leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, phy_pg0, NULL); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return; } @@ -972,38 +1080,41 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, struct device *parent_dev) { struct sas_phy *phy; + int ret; INIT_LIST_HEAD(&card_phy->port_siblings); phy = sas_phy_alloc(parent_dev, card_phy->phy_id); if (!phy) { dev_err(&adapter->pdev->dev, - "%s sas_phy_alloc failed!\n", __func__); + "%s: sas_phy_alloc failed!\n", __func__); return -EFAULT; } - if ((leapraid_transport_set_identify(adapter, card_phy->hdl, - &card_phy->identify))) { + if (leapraid_transport_set_identify(adapter, card_phy->hdl, + &card_phy->identify)) { dev_err(&adapter->pdev->dev, - "%s set phy hdl identify failed!\n", __func__); + "%s: Set PHY hdl identify failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } card_phy->attached_hdl = le16_to_cpu(exp_pg1->attached_dev_hdl); if (card_phy->attached_hdl) { - if (leapraid_transport_set_identify(adapter, - card_phy->attached_hdl, - &card_phy->remote_identify)) { - dev_err(&adapter->pdev->dev, - "%s set phy attached hdl identify failed!\n", - __func__); - sas_phy_free(phy); - } + ret = leapraid_transport_set_identify( + adapter, + card_phy->attached_hdl, + &card_phy->remote_identify); + if (ret) + dev_warn(&adapter->pdev->dev, + "%s: Set PHY attached hdl identify failed!\n", + __func__); } leapraid_init_sas_or_exp_phy(adapter, card_phy, phy, NULL, exp_pg1); - if ((sas_phy_add(phy))) { + if (sas_phy_add(phy)) { + dev_err(&adapter->pdev->dev, + "%s: SAS PHY add failed!\n", __func__); sas_phy_free(phy); return -EFAULT; } @@ -1012,13 +1123,14 @@ int leapraid_transport_add_exp_phy(struct leapraid_adapter *adapter, return 0; } -void leapraid_transport_update_links(struct leapraid_adapter *adapter, +void leapraid_transport_update_links( + struct leapraid_adapter *adapter, u64 sas_address, u16 hdl, u8 phy_index, u8 link_rate, struct leapraid_card_port *target_card_port) { struct leapraid_topo_node *topo_node; struct leapraid_card_phy *card_phy; - struct leapraid_card_port *card_port = NULL; + struct leapraid_card_port *card_port; unsigned long flags; if (adapter->access_ctrl.shost_recovering || @@ -1053,10 +1165,12 @@ void leapraid_transport_update_links(struct leapraid_adapter *adapter, BIT(card_phy->phy_id); } } - leapraid_transport_attach_phy_to_port(adapter, topo_node, - card_phy, - card_phy->remote_identify.sas_address, - target_card_port); + leapraid_transport_attach_phy_to_port( + adapter, + topo_node, + card_phy, + card_phy->remote_identify.sas_address, + target_card_port); } else { memset(&card_phy->remote_identify, 0, sizeof(struct sas_identify)); @@ -1079,8 +1193,12 @@ static int leapraid_dma_map_buffer(struct device *dev, struct bsg_buffer *buf, *dma_len = buf->payload_len; } else { - if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) + if (!dma_map_sg(dev, buf->sg_list, 1, DMA_BIDIRECTIONAL)) { + dev_err(dev, + "%s: Failed to map sg buffer for dma\n", + __func__); return -ENOMEM; + } *dma_addr = sg_dma_address(buf->sg_list); *dma_len = sg_dma_len(buf->sg_list); @@ -1106,11 +1224,11 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr, size_t c2h_size) { struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; void *psge; - smp_passthrough_req = - leapraid_get_task_desc(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(*smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -1130,30 +1248,36 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, - "%s: sending smp request\n", __func__); + const struct leapraid_smp_passthrough_req *smp_passthrough_req; + + dev_dbg(&adapter->pdev->dev, + "%s: Sending smp request\n", __func__); + smp_passthrough_req = leapraid_get_task_desc( + adapter, adapter->driver_cmds.transport_cmd.inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); leapraid_fire_task(adapter, adapter->driver_cmds.transport_cmd.inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, "%s: timeout\n", __func__); + dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", + __func__, adapter->driver_cmds.transport_cmd.status); + leapraid_log_req_context(adapter, smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { - dev_info(&adapter->pdev->dev, - "%s:%d call hard_reset\n", - __func__, __LINE__); + dev_dbg(&adapter->pdev->dev, + "%s:%d: call hard_reset\n", + __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); return -ETIMEDOUT; } } - dev_info(&adapter->pdev->dev, "%s: smp request complete\n", __func__); + dev_dbg(&adapter->pdev->dev, "%s: SMP request complete\n", __func__); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_REPLY_VALID)) { dev_err(&adapter->pdev->dev, - "%s: smp request no reply\n", __func__); + "%s: SMP request no reply\n", __func__); return -ENXIO; } @@ -1167,10 +1291,10 @@ static void leapraid_handle_smp_rep(struct leapraid_adapter *adapter, struct leapraid_smp_passthrough_rep *smp_passthrough_rep; smp_passthrough_rep = - (void *)(&adapter->driver_cmds.transport_cmd.reply); + (void *)&adapter->driver_cmds.transport_cmd.reply; - dev_info(&adapter->pdev->dev, "%s: response data len=%d\n", - __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); + dev_dbg(&adapter->pdev->dev, "%s: Response data len=%d\n", + __func__, le16_to_cpu(smp_passthrough_rep->resp_data_len)); memcpy(job->reply, smp_passthrough_rep, sizeof(*smp_passthrough_rep)); job->reply_len = sizeof(*smp_passthrough_rep); @@ -1198,13 +1322,19 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.pcie_recovering) { + dev_err(&adapter->pdev->dev, + "%s: Failed, shost_recovering=%d pcie_recovering=%d\n", + __func__, + adapter->access_ctrl.shost_recovering, + adapter->access_ctrl.pcie_recovering); rc = -EFAULT; - goto done; + goto exit_bsg_job; } - rc = mutex_lock_interruptible(&adapter->driver_cmds.transport_cmd.mutex); + rc = mutex_lock_interruptible(&adapter->driver_cmds + .transport_cmd.mutex); if (rc) - goto done; + goto exit_bsg_job; adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_PENDING; rc = leapraid_dma_map_buffer(&adapter->pdev->dev, @@ -1223,7 +1353,8 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; - rc = leapraid_check_adapter_is_op(adapter); + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, + __func__); if (rc) goto free_rep_buf; @@ -1245,7 +1376,7 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, release_lock: adapter->driver_cmds.transport_cmd.status = LEAPRAID_CMD_NOT_USED; mutex_unlock(&adapter->driver_cmds.transport_cmd.mutex); -done: +exit_bsg_job: bsg_job_done(job, rc, reslen); } -- 2.25.1

2 1

[PATCH OLK-6.6] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
by Yi Yang 26 May '26

26 May '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v6.6.135 commit 066c760acead1fb743bae294dbd89f479ae43b9b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14894 CVE: CVE-2026-43336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream. Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- lib/crypto/chacha.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/crypto/chacha.c b/lib/crypto/chacha.c index b748fd3d256e..1bff9f283777 100644 --- a/lib/crypto/chacha.c +++ b/lib/crypto/chacha.c @@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8 *stream, int nrounds) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); state[12]++; + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(chacha_block_generic); @@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds) memcpy(&stream[0], &x[0], 16); memcpy(&stream[4], &x[12], 16); + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(hchacha_block_generic); -- 2.25.1

2 1

[PATCH OLK-5.10] lib/crypto: chacha: Zeroize permuted_state before it leaves scope
by Yi Yang 26 May '26

26 May '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v5.10.253 commit e90ee961af515a484f091678ce58a4c3f7b73b02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14894 CVE: CVE-2026-43336 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 upstream. Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- lib/crypto/chacha.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/crypto/chacha.c b/lib/crypto/chacha.c index b748fd3d256e..1bff9f283777 100644 --- a/lib/crypto/chacha.c +++ b/lib/crypto/chacha.c @@ -86,6 +86,8 @@ void chacha_block_generic(u32 *state, u8 *stream, int nrounds) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); state[12]++; + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(chacha_block_generic); @@ -110,5 +112,7 @@ void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds) memcpy(&stream[0], &x[0], 16); memcpy(&stream[4], &x[12], 16); + + memzero_explicit(x, sizeof(x)); } EXPORT_SYMBOL(hchacha_block_generic); -- 2.25.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 26 May '26

26 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace3c6..4f2f82293125 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1911,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 26 May '26

26 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) mode change 100644 => 100755 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c old mode 100644 new mode 100755 index 01eed3ace3c6..4f2f82293125 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1911,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/tracepoint.c [a9cfb8778c43 ("tracing: Introduce tracepoint extended structure") is not backport yet.] Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 2dff7f1a27ec..7642926517cf 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -358,6 +358,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->unregfunc && !static_key_enabled(&tp->key)) + tp->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Rebuild full_name on each hist_field_name() call
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.141 commit 9399a92989354e34086f9a5c379493217df83c5e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 ] hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Tested-by: Tom Zanussi <zanussi(a)kernel.org> Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index f22aa4afaa6d..b6c4e2f26e3f 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1349,12 +1349,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) { if (field->system) { static char full_name[MAX_FILTER_STR_VAL]; + int len; + + len = snprintf(full_name, sizeof(full_name), "%s.%s.%s", + field->system, field->event_name, + field->name); + if (len >= sizeof(full_name)) + return NULL; - strcat(full_name, field->system); - strcat(full_name, "."); - strcat(full_name, field->event_name); - strcat(full_name, "."); - strcat(full_name, field->name); field_name = full_name; } else field_name = field->name; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Rebuild full_name on each hist_field_name() call
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.1-rc1 commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Tested-by: Tom Zanussi <zanussi(a)kernel.org> Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 557b8c28faf4..f67367e487cb 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1104,12 +1104,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) { if (field->system) { static char full_name[MAX_FILTER_STR_VAL]; + int len; + + len = snprintf(full_name, sizeof(full_name), "%s.%s.%s", + field->system, field->event_name, + field->name); + if (len >= sizeof(full_name)) + return NULL; - strcat(full_name, field->system); - strcat(full_name, "."); - strcat(full_name, field->event_name); - strcat(full_name, "."); - strcat(full_name, field->name); field_name = full_name; } else field_name = field->name; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.0 commit 4346be6577aaa04586167402ae87bbdbe32484a4 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 3e020511885c..f2ced0ac04eb 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -352,7 +352,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2

[PATCH OLK-6.6] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.136 commit feba4907c30284b6d1ec0b350320242d4f288fc9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4346be6577aaa04586167402ae87bbdbe32484a4 ] parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index b168d6dd0773..6a96b03aae62 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -886,7 +886,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2