summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-08-12scsi: mac_scsi: Enable scatter/gather by defaultFinn Thain
Now that FLAG_DMA_FIXUP has itself been fixed up, it can be used to enable scatter/gather. Increase the default value for sg_tablesize to SG_ALL for those systems which are compatible with FLAG_DMA_FIXUP. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@linux-m68k.org> Link: https://lore.kernel.org/r/f155ba5ce93055cbc6ac6d4026673f40f826edb8.1723001788.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: NCR5380: Check for phase match during PDMA fixupFinn Thain
It's not an error for a target to change the bus phase during a transfer. Unfortunately, the FLAG_DMA_FIXUP workaround does not allow for that -- a phase change produces a DRQ timeout error and the device borken flag will be set. Check the phase match bit during FLAG_DMA_FIXUP processing. Don't forget to decrement the command residual. While we are here, change shost_printk() into scmd_printk() for better consistency with other DMA error messages. Tested-by: Stan Johnson <userm57@yahoo.com> Fixes: 55181be8ced1 ("ncr5380: Replace redundant flags with FLAG_NO_DMA_FIXUP") Signed-off-by: Finn Thain <fthain@linux-m68k.org> Link: https://lore.kernel.org/r/99dc7d1f4c825621b5b120963a69f6cd3e9ca659.1723001788.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mac_scsi: Disallow bus errors during PDMA sendFinn Thain
SD cards can produce write latency spikes on the order of a hundred milliseconds. If the target firmware does not hide that latency during DATA IN and OUT phases it can cause the PDMA circuitry to raise a processor bus fault which in turn leads to an unreliable byte count and a DMA overrun. The Last Byte Sent flag is used to detect the overrun but this mechanism is unreliable on some systems. Instead, set a DID_ERROR result whenever there is a bus fault during a PDMA send, unless the cause was a phase mismatch. Cc: stable@vger.kernel.org # 5.15+ Reported-and-tested-by: Stan Johnson <userm57@yahoo.com> Fixes: 7c1f3e3447a1 ("scsi: mac_scsi: Treat Last Byte Sent time-out as failure") Signed-off-by: Finn Thain <fthain@linux-m68k.org> Link: https://lore.kernel.org/r/cc38df687ace2c4ffc375a683b2502fc476b600d.1723001788.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mac_scsi: Refactor polling loopFinn Thain
Before the error handling can be revised, some preparation is needed. Refactor the polling loop with a new function, macscsi_wait_for_drq(). This function will gain more call sites in the next patch. Cc: stable@vger.kernel.org # 5.15+ Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@linux-m68k.org> Link: https://lore.kernel.org/r/6a5ffabb4290c0d138c6d285fda8fa3902e926f0.1723001788.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mac_scsi: Revise printk(KERN_DEBUG ...) messagesFinn Thain
After a bus fault, capture and log the chip registers immediately, if the NDEBUG_PSEUDO_DMA macro is defined. Remove some printk(KERN_DEBUG ...) messages that aren't needed any more. Don't skip the debug message when bytes == 0. Show all of the byte counters in the debug messages. Cc: stable@vger.kernel.org # 5.15+ Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@linux-m68k.org> Link: https://lore.kernel.org/r/7573c79f4e488fc00af2b8a191e257ca945e0409.1723001788.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mpi3mr: Driver version update to 8.10.0.5.50Ranjan Kumar
Update driver version to 8.10.0.5.50. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Link: https://lore.kernel.org/r/20240808125418.8832-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mpi3mr: Update consumer index of reply queues after every 100 repliesRanjan Kumar
Instead of updating the ConsumerIndex of the Admin and Operational ReplyQueues after processing all replies in the queue, the index will now be periodically updated after processing every 100 replies. Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com> Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com> Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Link: https://lore.kernel.org/r/20240808125418.8832-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: mpi3mr: Return complete ioc_status for ioctl commandsRanjan Kumar
The driver masked the loginfo available bit in the iocstatus before passing it to the applications, causing a mismatch in error messages between Linux and other operating systems. Modify driver to return unmasked (complete) iocstatus, including the loginfo available bit, for the MPI commands sent through the ioctl interface. Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com> Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com> Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Link: https://lore.kernel.org/r/20240808125418.8832-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: snic: Avoid creating two slab caches with the same namePedro Falcato
In the spirit of [1], fix the copy-paste typo and use unique names for both caches. [1]: https://lore.kernel.org/all/20240807090746.2146479-1-pedro.falcato@gmail.com/ Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com> Link: https://lore.kernel.org/r/20240807095709.2200728-1-pedro.falcato@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: ufs: ufshcd-pltfrm: Use of_property_count_u32_elems() to get property ↵Rob Herring (Arm)
length Replace of_get_property() with the type specific of_property_count_u32_elems() to get the property length. This is part of a larger effort to remove callers of of_get_property() and similar functions. of_get_property() leaks the DT property data pointer which is a problem for dynamically allocated nodes which may be freed. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20240808170704.1438658-1-robh@kernel.org Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: ufs: ufshcd-pltfrm: Use of_property_present()Rob Herring (Arm)
Use of_property_present() to test for property presence rather than of_find_property(). This is part of a larger effort to remove callers of of_find_property() and similar functions. of_find_property() leaks the DT struct property and data pointers which is a problem for dynamically allocated nodes which may be freed. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20240808170644.1436991-1-robh@kernel.org Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: block: Don't check REQ_ATOMIC for readsJohn Garry
We check in submit_bio_noacct() if flag REQ_ATOMIC is set for both read and write operations, and then validate the atomic operation if set. Flag REQ_ATOMIC can only be set for writes, so don't bother checking for reads. Fixes: 9da3d1e912f3 ("block: Add core atomic write support") Signed-off-by: John Garry <john.g.garry@oracle.com> Link: https://lore.kernel.org/r/20240805113315.1048591-3-john.g.garry@oracle.com Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-12scsi: sd: Don't check if a write for REQ_ATOMICJohn Garry
Flag REQ_ATOMIC can only be set for writes, so don't check if the operation is also a write in sd_setup_read_write_cmnd(). Fixes: bf4ae8f2e640 ("scsi: sd: Atomic write support") Signed-off-by: John Garry <john.g.garry@oracle.com> Link: https://lore.kernel.org/r/20240805113315.1048591-2-john.g.garry@oracle.com Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02Merge patch series "smartpqi updates"Martin K. Petersen
Don Brace <don.brace@microchip.com> says: These patches are based on Martin Petersen's 6.11/scsi-queue tree https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 6.11/scsi-queue The functional changes of note to smartpqi are for: multipath failover and improving the accuracy of our RAID bypass counter. For multipath we are: Reverting commit 94a68c814328 ("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer") because under certain rare conditions involving encryption-enabled devices, a false path failure is reported to the SML causing multipath to failover to the other path. Improving errors returned from the driver back to the SML by checking for error codes returned from the firmware and returning the correct ASC/ASCQ codes to the SML. The other two patches add PCI-IDs for new controllers and change the driver version. Link: https://lore.kernel.org/r/20240711194704.982400-1-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: smartpqi: Update driver version to 2.1.28-025Don Brace
Update driver version to 2.1.28-025. Reviewed-by: Mike Tran <mike.tran@microchip.com> Reviewed-by: Gerry Morong <gerry.morong@microchip.com> Reviewed-by: Scott Benesh <scott.benesh@microchip.com> Reviewed-by: Scott Teel <scott.teel@microchip.com> Signed-off-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/r/20240711194704.982400-6-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: smartpqi: Improve handling of multipath failoverKevin Barnett
Improve multipath failovers by mapping firmware errors into I/O errors. In some rare instances, firmware does not return the proper error code for I/O errors caused by a multipath path failure. Map I/O errors returned by firmware into errors that help the multipath layer to detect the failure of a path. Reviewed-by: Gerry Morong <gerry.morong@microchip.com> Reviewed-by: Scott Benesh <scott.benesh@microchip.com> Reviewed-by: Scott Teel <scott.teel@microchip.com> Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com> Signed-off-by: Kevin Barnett <kevin.barnett@microchip.com> Signed-off-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/r/20240711194704.982400-5-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: smartpqi: revert propagate-the-multipath-failure-to-SML-quicklyGilbert Wu
Correct a rare multipath failure issue by reverting commit 94a68c814328 ("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer") [1]. Reason for revert: The patch propagated the path failure to SML quickly when one of the path fails during IO and AIO path gets disabled for a multipath device. But it created a new issue: when creating a volume on an encryption-enabled controller, the firmware reports the AIO path is disabled, which cause the driver to report a path failure to SML for a multipath device. There will be a new fix to handle "Illegal request" and "Invalid field in parameter list" on RAID path when the AIO path is disabled on a multipath device. [1] https://lore.kernel.org/all/164375209313.440833.9992416628621839233.stgit@brunhilda.pdev.net/ Fixes: 94a68c814328 ("scsi: smartpqi: Quickly propagate path failures to SCSI midlayer") Reviewed-by: Scott Benesh <scott.benesh@microchip.com> Reviewed-by: Scott Teel <scott.teel@microchip.com> Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com> Signed-off-by: Gilbert Wu <Gilbert.Wu@microchip.com> Signed-off-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/r/20240711194704.982400-4-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: smartpqi: Improve accuracy/performance of raid-bypass-counterKevin Barnett
The original implementation of this counter used an atomic variable. However, this implementation negatively impacted performance in some configurations. Switch to using per_cpu variables. Reviewed-by: Scott Benesh <scott.benesh@microchip.com> Reviewed-by: Scott Teel <scott.teel@microchip.com> Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com> Co-developed-by: Mahesh Rajashekhara <mahesh.rajashekhara@microchip.com> Signed-off-by: Mahesh Rajashekhara <mahesh.rajashekhara@microchip.com> Signed-off-by: Kevin Barnett <kevin.barnett@microchip.com> Signed-off-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/r/20240711194704.982400-3-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: smartpqi: Add new controller PCI IDsDavid Strahan
All PCI ID entries in hex. Add new inagile PCI IDs: VID / DID / SVID / SDID ---- ---- ---- ---- SMART-HBA 8242-24i 9005 / 028f / 1ff9 / 0045 RAID 8236-16i 9005 / 028f / 1ff9 / 0046 RAID 8240-24i 9005 / 028f / 1ff9 / 0047 SMART-HBA 8238-16i 9005 / 028f / 1ff9 / 0048 PM8222-SHBA 9005 / 028f / 1ff9 / 004a RAID PM8204-2GB 9005 / 028f / 1ff9 / 004b RAID PM8204-4GB 9005 / 028f / 1ff9 / 004c PM8222-HBA 9005 / 028f / 1ff9 / 004f MT0804M6R 9005 / 028f / 1ff9 / 0051 MT0801M6E 9005 / 028f / 1ff9 / 0052 MT0808M6R 9005 / 028f / 1ff9 / 0053 MT0800M6H 9005 / 028f / 1ff9 / 0054 RS0800M5H24i 9005 / 028f / 1ff9 / 006b RS0800M5E8i 9005 / 028f / 1ff9 / 006c RS0800M5H8i 9005 / 028f / 1ff9 / 006d RS0804M5R16i 9005 / 028f / 1ff9 / 006f RS0800M5E24i 9005 / 028f / 1ff9 / 0070 RS0800M5H16i 9005 / 028f / 1ff9 / 0071 RS0800M5E16i 9005 / 028f / 1ff9 / 0072 RT0800M7E 9005 / 028f / 1ff9 / 0086 RT0800M7H 9005 / 028f / 1ff9 / 0087 RT0804M7R 9005 / 028f / 1ff9 / 0088 RT0808M7R 9005 / 028f / 1ff9 / 0089 RT1608M6R16i 9005 / 028f / 1ff9 / 00a1 Add new h3c pci_id: VID / DID / SVID / SDID ---- ---- ---- ---- UN RAID P4408-Mr-2 9005 / 028f / 193d / 1110 Add new powerleader pci ids: VID / DID / SVID / SDID ---- ---- ---- ---- PL SmartROC PM8204 9005 / 028f / 1f3a / 0104 Reviewed-by: Scott Benesh <scott.benesh@microchip.com> Reviewed-by: Scott Teel <scott.teel@microchip.com> Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com> Signed-off-by: David Strahan <David.Strahan@microchip.com> Signed-off-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/r/20240711194704.982400-2-don.brace@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02Merge patch series "Update lpfc to revision 14.4.0.4"Martin K. Petersen
Justin Tee <justintee8345@gmail.com> says: Update lpfc to revision 14.4.0.4 This patch set contains diagnostic logging improvements, a minor clean up when submitting abort requests, a bug fix related to reset and errata paths, and modifications to FLOGI and PRLO ELS command handling. The patches were cut against Martin's 6.11/scsi-queue tree. Link: https://lore.kernel.org/r/20240726231512.92867-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Copyright updates for 14.4.0.4 patchesJustin Tee
Update copyrights to 2024 for files modified in the 14.4.0.4 patch set. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Update lpfc version to 14.4.0.4Justin Tee
Update lpfc version to 14.4.0.4 Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Update PRLO handling in direct attached topologyJustin Tee
A kref imbalance occurs when handling an unsolicited PRLO in direct attached topology. Rework PRLO rcv handling when in MAPPED state. Save the state that we were handling a PRLO by setting nlp_last_elscmd to ELS_CMD_PRLO. Then in the lpfc_cmpl_els_logo_acc() completion routine, manually restart discovery. By issuing the PLOGI, which nlp_gets, before nlp_put at the end of the lpfc_cmpl_els_logo_acc() routine, we are saving us from a final nlp_put. And, we are still allowing the unreg_rpi to happen. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached ↵Justin Tee
topology In direct attached topology, certain target vendors that are quick to issue FLOGI followed by a cable pull for more than dev_loss_tmo may result in a kref imbalance for the remote port ndlp object. Add an nlp_get when the defer_flogi_acc flag is set. This is expected to balance the nlp_put in the defer_flogi_acc clause in the lpfc_issue_els_flogi() routine. Because we need to retain the ndlp ptr, reorganize all of the defer_flogi_acc information into one lpfc_defer_flogi_acc struct. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Fix unintentional double clearing of vmid_flagJustin Tee
The vport->vmid_flag is unintentionally cleared twice after an issue_lip via the lpfc_reinit_vmid routine(). The first call to lpfc_reinit_vmid() is in lpfc_cmpl_els_flogi(). Then lpfc_cmpl_els_flogi_fabric() calls lpfc_register_new_vport(), which calls lpfc_cmpl_reg_new_vport() when the mbox command completes and calls lpfc_reinit_vmid() a second time. Fix by moving the vmid_flag clear outside of the lpfc_reinit_vmid() routine so that vmid_flag is only cleared once upon FLOGI completion. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata pathsJustin Tee
When the HBA is undergoing a reset or is handling an errata event, NULL ptr dereference crashes may occur in routines such as lpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or lpfc_abort_handler(). Add NULL ptr checks before dereferencing hdwq pointers that may have been freed due to operations colliding with a reset or errata event handler. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Remove redundant vport assignment when building an abort requestJustin Tee
The lpfc_sli_issue_abort_iotag() routine has a redundant assignment of abtsiocbp->vport = vport; The duplicate lines are from a previous refactoring, and this patch removes the accidental redundancy. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: lpfc: Change diagnostic log flag during receipt of unknown ELS cmdsJustin Tee
During diagnostics, it has been determined that the 0115 log message for receipt of unknown ELS cmds does not benefit from trace buffer dumps. The trace buffer dump floods the console with unnecessary information, and the singular LOG_ELS flag has proven more beneficial in debugging efforts when dealing with unknown ELS cmds. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20240726231512.92867-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: ufs: core: Support Updating UIC Command TimeoutBao D. Nguyen
The default UIC command timeout still remains 500ms. Allow platform drivers to override the UIC command timeout if desired. In a real product, the 500ms timeout value is probably good enough. However, during the product development where there are a lot of logging and debug messages being printed to the UART console, interrupt starvations happen occasionally because the UART may print long debug messages from different modules in the system. While printing, the UART may have interrupts disabled for more than 500ms, causing UIC command timeout. The UIC command timeout would trigger more printing from the UFS driver, and eventually a watchdog timeout may occur unnecessarily. Add support for overriding the UIC command timeout value with the newly created uic_cmd_timeout kernel module parameter. Default value is 500ms. Supported values range from 500ms to 2 seconds. Signed-off-by: Bao D. Nguyen <quic_nguyenb@quicinc.com> Link: https://lore.kernel.org/r/e4e1c87f3f867f270a3d4b5d57a00139ff0e9741.1721792309.git.quic_nguyenb@quicinc.com Suggested-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02Merge patch series "scsi: aacraid: struct sgmap: Replace 1-element arrays ↵Martin K. Petersen
with flexible arrays" Kees Cook <kees@kernel.org> says: This replaces some of the last remaining uses in the kernel of 1-element "fake" flexible arrays with modern C99 flexible arrays. Some refactoring is done to ease this, and binary differences are identified. For the on stack size changes in patch 2, the "yes, that is the source of the binary differences" debugging patch can be found here[1]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=dev/v6.10-rc2/1-element&id=45e6226bcbc5e982541754eca7ac29f403e82f5e Link: https://lore.kernel.org/r/20240711212732.work.162-kees@kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with ↵Kees Cook
flexible arrays Replace the deprecated[1] use of 1-element arrays in struct sgmap, struct sgmap64, struct sgmapraw, struct user_sgmap, and struct user_sgmap64 with modern flexible arrays. Additionally remove struct user_sgmapraw as it is unused. The resulting binary output differences from this change are limited only to stack space consumption of the smaller "srbu" variable in aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), as well as the smaller associated pair of memcpy()s in aac_send_safw_bmic_cmd(). Artificially growing the size of srbu back to its prior size removes all binary differences[2]. As an aside, after studying the aacraid driver code I wonder how aac_send_wellness_command() ever works. It is reporting a size 4 bytes too small for what it has constructed in memory in the DMA region: sgentry64 is size 12, whereas sgentry is size 8. Perhaps the hardware doesn't care. (Regardless, it is unchanged by this patch.) Link: https://github.com/KSPP/linux/issues/79 [1] Link: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=dev/v6.10-rc2/1-element&id=45e6226bcbc5e982541754eca7ac29f403e82f5e [2] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711215739.208776-2-kees@kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: aacraid: Rearrange order of struct aac_srb_unitKees Cook
struct aac_srb_unit contains struct aac_srb, which contains struct sgmap, which ends in a (currently) "fake" (1-element) flexible array. Converting this to a flexible array is needed so that runtime bounds checking won't think the array is fixed size (i.e. under CONFIG_FORTIFY_SOURCE=y and/or CONFIG_UBSAN_BOUNDS=y), as other parts of aacraid use struct sgmap as a flexible array. It is not legal to have a flexible array in the middle of a structure, so it either needs to be split up or rearranged so that it is at the end of the structure. Luckily, struct aac_srb_unit, which is exclusively consumed/updated by aac_send_safw_bmic_cmd(), does not depend on member ordering. The values set in the on-stack struct aac_srb_unit instance "srbu" by the only two callers, aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), do not contain anything in srbu.srb.sgmap.sg, and they both implicitly initialize srbu.srb.sgmap.count to 0 during memset(). For example: memset(&srbu, 0, sizeof(struct aac_srb_unit)); srbcmd = &srbu.srb; srbcmd->flags = cpu_to_le32(SRB_DataIn); srbcmd->cdb[0] = CISS_REPORT_PHYSICAL_LUNS; srbcmd->cdb[1] = 2; /* extended reporting */ srbcmd->cdb[8] = (u8)(datasize >> 8); srbcmd->cdb[9] = (u8)(datasize); rcode = aac_send_safw_bmic_cmd(dev, &srbu, phys_luns, datasize); During aac_send_safw_bmic_cmd(), a separate srb is mapped into DMA, and has srbu.srb copied into it: srb = fib_data(fibptr); memcpy(srb, &srbu->srb, sizeof(struct aac_srb)); Only then is srb.sgmap.count written and srb->sg populated: srb->count = cpu_to_le32(xfer_len); sg64 = (struct sgmap64 *)&srb->sg; sg64->count = cpu_to_le32(1); sg64->sg[0].addr[1] = cpu_to_le32(upper_32_bits(addr)); sg64->sg[0].addr[0] = cpu_to_le32(lower_32_bits(addr)); sg64->sg[0].count = cpu_to_le32(xfer_len); But this is happening in the DMA memory, not in srbu.srb. An attempt to copy the changes back to srbu does happen: /* * Copy the updated data for other dumping or other usage if * needed */ memcpy(&srbu->srb, srb, sizeof(struct aac_srb)); But this was never correct: the sg64 (3 u32s) overlap of srb.sg (2 u32s) always meant that srbu.srb would have held truncated information and any attempt to walk srbu.srb.sg.sg based on the value of srbu.srb.sg.count would result in attempting to parse past the end of srbu.srb.sg.sg[0] into srbu.srb_reply. After getting a reply from hardware, the reply is copied into srbu.srb_reply: srb_reply = (struct aac_srb_reply *)fib_data(fibptr); memcpy(&srbu->srb_reply, srb_reply, sizeof(struct aac_srb_reply)); This has always been fixed-size, so there's no issue here. It is worth noting that the two callers _never check_ srbu contents -- neither srbu.srb nor srbu.srb_reply is examined. (They depend on the mapped xfer_buf instead.) Therefore, the ordering of members in struct aac_srb_unit does not matter, and the flexible array member can moved to the end. (Additionally, the two memcpy()s that update srbu could be entirely removed as they are never consumed, but I left that as-is.) Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711215739.208776-1-kees@kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02Merge patch series "scsi: message: fusion: Replace 1-element arrays with ↵Martin K. Petersen
flexible arrays" Kees Cook <kees@kernel.org> says: Replace all remaining uses of deprecated 1-element "fake" flexible arrays with modern C99 flexible arrays. Add __counted_by annotations at the same time. Link: https://lore.kernel.org/r/20240711172432.work.523-kees@kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _CONFIG_PAGE_IOC_4: Replace 1-element array ↵Kees Cook
with flexible array Replace the deprecated[1] use of a 1-element array in struct _CONFIG_PAGE_IOC_4 with a modern flexible array. Additionally add __counted_by annotation since SEP is only ever accessed after updating ACtiveSEP: lsi/mpi_cnfg.h: IOC_4_SEP SEP[] __counted_by(ActiveSEP); /* 08h */ mptsas.c: ii = IOCPage4Ptr->ActiveSEP++; mptsas.c: IOCPage4Ptr->SEP[ii].SEPTargetID = id; mptsas.c: IOCPage4Ptr->SEP[ii].SEPBus = channel; No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-6-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _CONFIG_PAGE_IOC_3: Replace 1-element array ↵Kees Cook
with flexible array Replace the deprecated[1] use of a 1-element array in struct _CONFIG_PAGE_IOC_3 with a modern flexible array. Additionally add __counted_by annotation since PhysDisk is only ever accessed via a loops bounded by NumPhysDisks: lsi/mpi_cnfg.h: IOC_3_PHYS_DISK PhysDisk[] __counted_by(NumPhysDisks); /* 08h */ mptscsih.c: for (i = 0; i < ioc->raid_data.pIocPg3->NumPhysDisks; i++) { mptscsih.c: if ((id == ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskID) && mptscsih.c: (channel == ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskBus)) { mptscsih.c: for (i = 0; i < ioc->raid_data.pIocPg3->NumPhysDisks; i++) { mptscsih.c: ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskNum); mptscsih.c: ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskNum, mptscsih.c: for (i = 0; i < ioc->raid_data.pIocPg3->NumPhysDisks; i++) { mptscsih.c: if ((id == ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskID) && mptscsih.c: (channel == ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskBus)) { mptscsih.c: rc = ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskNum; mptscsih.c: for (i = 0; i < ioc->raid_data.pIocPg3->NumPhysDisks; i++) { mptscsih.c: ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskNum); mptscsih.c: ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskNum, No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-5-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _CONFIG_PAGE_IOC_2: Replace 1-element array ↵Kees Cook
with flexible array Replace the deprecated[1] use of a 1-element array in struct _CONFIG_PAGE_IOC_2 with a modern flexible array. Additionally add __counted_by annotation since RaidVolume is only ever accessed from loops controlled by NumActiveVolumes: lsi/mpi_cnfg.h: CONFIG_PAGE_IOC_2_RAID_VOL RaidVolume[] __counted_by(NumActiveVolumes); /* 0Ch */ mptbase.c: for (i = 0; i < pIoc2->NumActiveVolumes ; i++) mptbase.c: pIoc2->RaidVolume[i].VolumeBus, mptbase.c: pIoc2->RaidVolume[i].VolumeID); mptsas.c: for (i = 0; i < ioc->raid_data.pIocPg2->NumActiveVolumes; i++) { mptsas.c: RaidVolume[i].VolumeID) { mptsas.c: RaidVolume[i].VolumeBus; mptsas.c: for (i = 0; i < ioc->raid_data.pIocPg2->NumActiveVolumes; i++) { mptsas.c: ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID, 0); mptsas.c: ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID); mptsas.c: ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID, 0); mptsas.c: for (i = 0; i < ioc->raid_data.pIocPg2->NumActiveVolumes; i++) { mptsas.c: if (ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID == mptsas.c: for (i = 0; i < ioc->raid_data.pIocPg2->NumActiveVolumes; i++) mptsas.c: if (ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID == id) mptspi.c: for (i=0; i < ioc->raid_data.pIocPg2->NumActiveVolumes; i++) { mptspi.c: if (ioc->raid_data.pIocPg2->RaidVolume[i].VolumeID == id) { No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-4-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _CONFIG_PAGE_RAID_PHYS_DISK_1: Replace ↵Kees Cook
1-element array with flexible array Replace the deprecated[1] use of a 1-element array in struct _CONFIG_PAGE_RAID_PHYS_DISK_1 with a modern flexible array. Additionally add __counted_by annotation since Path is only ever accessed via a loops bounded by NumPhysDiskPaths: lsi/mpi_cnfg.h: RAID_PHYS_DISK1_PATH Path[] __counted_by(NumPhysDiskPaths);/* 0Ch */ mptbase.c: phys_disk->NumPhysDiskPaths = buffer->NumPhysDiskPaths; mptbase.c: for (i = 0; i < phys_disk->NumPhysDiskPaths; i++) { mptbase.c: phys_disk->Path[i].PhysDiskID = buffer->Path[i].PhysDiskID; mptbase.c: phys_disk->Path[i].PhysDiskBus = buffer->Path[i].PhysDiskBus; No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-3-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _CONFIG_PAGE_SAS_IO_UNIT_0: Replace 1-element ↵Kees Cook
array with flexible array Replace the deprecated[1] use of a 1-element array in struct _CONFIG_PAGE_SAS_IO_UNIT_0 with a modern flexible array. Additionally add __counted_by annotation since PhyData is only ever accessed via a loops bounded by NumPhys: lsi/mpi_cnfg.h: MPI_SAS_IO_UNIT0_PHY_DATA PhyData[] __counted_by(NumPhys); /* 10h */ mptsas.c: port_info->num_phys = buffer->NumPhys; mptsas.c: for (i = 0; i < port_info->num_phys; i++) { mptsas.c: mptsas_print_phy_data(ioc, &buffer->PhyData[i]); mptsas.c: port_info->phy_info[i].phy_id = i; mptsas.c: port_info->phy_info[i].port_id = mptsas.c: buffer->PhyData[i].Port; mptsas.c: port_info->phy_info[i].negotiated_link_rate = mptsas.c: buffer->PhyData[i].NegotiatedLinkRate; No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-2-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: message: fusion: struct _RAID_VOL0_SETTINGS: Replace 1-element array ↵Kees Cook
with flexible array Replace the deprecated[1] use of a 1-element array in struct _RAID_VOL0_SETTINGS with a modern flexible array. Additionally add __counted_by annotation since PhysDisk is only ever accessed via a loops bounded by NumPhysDisks: lsi/mpi_cnfg.h: RAID_VOL0_PHYS_DISK PhysDisk[] __counted_by(NumPhysDisks); /* 28h */ mptbase.c: for (i = 0; i < buffer->NumPhysDisks; i++) { mptbase.c: buffer->PhysDisk[i].PhysDiskNum, &phys_disk) != 0) mptsas.c: for (i = 0; i < buffer->NumPhysDisks; i++) { mptsas.c: buffer->PhysDisk[i].PhysDiskNum, &phys_disk) != 0) mptsas.c: for (i = 0; i < buffer->NumPhysDisks; i++) { mptsas.c: buffer->PhysDisk[i].PhysDiskNum, &phys_disk) != 0) No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711172821.123936-1-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: ipr: Replace 1-element arrays with flexible arraysKees Cook
Replace the deprecated[1] use of a 1-element arrays in struct ipr_hostrcb_fabric_desc and struct ipr_hostrcb64_fabric_desc with modern flexible arrays. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711180702.work.536-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with ↵Kees Cook
flexible array Replace the deprecated[1] use of a 1-element array in struct aac_ciss_phys_luns_resp with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711175055.work.928-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: aacraid: union aac_init: Replace 1-element array with flexible arrayKees Cook
Replace the deprecated[1] use of a 1-element array in union aac_init with a modern flexible array. Additionally add __counted_by annotation since rrq is only ever accessed after rr_queue_count has been set (with the same value used to control the loop): init->r8.rr_queue_count = cpu_to_le32(dev->max_msix); ... for (i = 0; i < dev->max_msix; i++) { addr = (u64)dev->host_rrq_pa + dev->vector_cap * i * sizeof(u32); init->r8.rrq[i].host_addr_high = cpu_to_le32( upper_32_bits(addr)); No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711174815.work.689-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: megaraid_sas: struct MR_HOST_DEVICE_LIST: Replace 1-element array with ↵Kees Cook
flexible array Replace the deprecated[1] use of a 1-element array in struct MR_HOST_DEVICE_LIST with a modern flexible array. One binary difference appears in megasas_host_device_list_query(): struct MR_HOST_DEVICE_LIST *ci; ... ci = instance->host_device_list_buf; ... memset(ci, 0, sizeof(*ci)); The memset() clears only the non-flexible array fields. Looking at the rest of the function, this appears to be fine: firmware is using this region to communicate with the kernel, so it likely never made sense to clear the first MR_HOST_DEVICE_LIST_ENTRY. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155841.work.839-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: megaraid_sas: struct MR_LD_VF_MAP: Replace 1-element arrays with ↵Kees Cook
flexible arrays Replace the deprecated[1] use of a 1-element array in struct MR_LD_VF_MAP with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155823.work.778-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02Merge patch series "scsi: mpi3mr: Replace 1-element arrays with flexible arrays"Martin K. Petersen
Kees Cook <kees@kernel.org> says: Replace all the uses of deprecated 1-element "fake" flexible arrays with modern C99 flexible arrays. Link: https://lore.kernel.org/r/20240711155446.work.681-kees@kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: mpi3mr: struct mpi3_sas_io_unit_page1: Replace 1-element array with ↵Kees Cook
flexible array Replace the deprecated[1] use of a 1-element array in struct mpi3_sas_io_unit_page1 with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155637.3757036-4-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: mpi3mr: struct mpi3_sas_io_unit_page0: Replace 1-element array with ↵Kees Cook
flexible array Replace the deprecated[1] use of a 1-element array in struct mpi3_sas_io_unit_page0 with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155637.3757036-3-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: mpi3mr: struct mpi3_event_data_pcie_topology_change_list: Replace ↵Kees Cook
1-element array with flexible array Replace the deprecated[1] use of a 1-element array in struct mpi3_event_data_pcie_topology_change_list with a modern flexible array. Additionally add __counted_by annotation since port_entry is only ever accessed in loops controlled by num_entries. For example: for (i = 0; i < event_data->num_entries; i++) { handle = le16_to_cpu(event_data->port_entry[i].attached_dev_handle); No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155637.3757036-2-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-08-02scsi: mpi3mr: struct mpi3_event_data_sas_topology_change_list: Replace ↵Kees Cook
1-element array with flexible array Replace the deprecated[1] use of a 1-element array in struct mpi3_event_data_sas_topology_change_list with a modern flexible array. Additionally add __counted_by annotation since phy_entry is only ever accessed in loops controlled by num_entries. For example: for (i = 0; i < event_data->num_entries; i++) { ... handle = le16_to_cpu(event_data->phy_entry[i].attached_dev_handle); No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://lore.kernel.org/r/20240711155637.3757036-1-kees@kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2024-07-28Linux 6.11-rc1Linus Torvalds
generated by cgit (git 2.34.1) at 2025-09-19 05:40:04 +0000