We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Cc: <stable@vger.kernel.org>
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Fix to return error code -ENOMEM from the dma mapping error handling
case instead of 0, as done elsewhere in this function.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

These should go together with the rest of the T10 protection information
defintions.

[mkp: s/T10_DIF/T10_PI/]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Instead of defining a local version of it.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

And remove the declaration of the latter in sd.h as scsi_debug was the
only user.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Fix to return error code -ENOMEM from the workqueue alloc error handling
case instead of 0, as done elsewhere in this function.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Reviewed-by: Scott Benesh <scott.benest@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Reviewed-by: Scott Benesh <scott.benest@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Before using vendor-specific VPD pages for getting raid_level and
device_id, check for page support.  If page isn't supported, don't try
to use it.  Also, pay attention to return status on hpsa_get_device_id.

[mkp: fix boolean return warnings reported by kbuild test robot]
Reviewed-by: Scott Benesh <scott.benest@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

A device can be deleted causing NULL pointer issues.
Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Currently we are checking for external status before we are determining
if a device is an external device.
Reviewed-by: Scott Benesh <scott.benest@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Large PIO transfers are broken up into chunks to try to avoid disabling
local IRQs for long periods. But IRQs are still disabled for too long
and this causes SCC FIFO overruns during serial port transfers.

This patch reduces the PIO chunk size to reduce interrupt latency to
something on the order of milliseconds, at the expense of additional CPU
overhead from extra iterations of the NCR5380_main() loop.

That CPU overhead is a problem for slow machines (e.g. mac_scsi on 25
MHz 68030) but these machines generally use PDMA not PIO. This patch
doesn't make the overhead any worse on my Mac LC III (because it only
gets about 510 accesses per ms).

This patch decreases disk performance by a fraction of one percent for
dmx3191d on my 333 MHz PowerPC 750. Other affected hardware (such as
g_NCR5380 on x86) was not tested but 5380 ISA cards generally use PDMA
and not PIO.

[mkp: fix whitespace]
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

There is only one waiter for the completion, therefore there is no need
to use complete_all(). Let's make that clear by using complete() instead
of complete_all().

The usage pattern of the completion is:

waiter context                          waker context

virtscsi_tmf()
  DECLARE_COMPLETION_ONSTACK()
  virtscsi_kick_cmd()
  wait_for_completion()

                                        virtscsi_complete_free()
                                          complete()
Signed-off-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

There is only one waiter for the completion, therefore there is no need
to use complete_all(). Let's make that clear by using complete() instead
of complete_all().

The usage pattern of the completion is:

waiter context                          waker context

sym_eh_handler()
  struct completion eh_done
  init_completion(eh_done)
  pci_channel_offline()
  wait_for_completion_timeout(eh_done)

                                        sym2_io_resume()
                                          complete(eh_done)
Signed-off-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The (re)initializing of the completion object should be done before we
trigger the transfer. Doing this after triggering the hardware opens up
a race window. Without the timeout we would problaly even deadlock. Use
also reinit_completion because we initalize the whole data structure in
csio_scscim_init().

There is only one waiter for the completion, therefore there is no need
to use complete_all(). Let's make that clear by using complete() instead
of complete_all().

The usage pattern of the completion is:

waiter context                          waker context

csio_eh_abort_handler()
  reinit_completion()
  wait_for_completion_timeout()

                                        csio_scsi_err_handler()
                                          complete()

[mkp: fix typo]
Signed-off-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

A dev_printk message spans two lines and the literal string is missing a
white space between words. Add the white space.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

When the v2 hw is attached with many disks through an expander, there
may be OOB reset resulting in a PHY going down after the speed is
negotiated (very low probability).

This issue is resolved by modifying the link control registers to send
three identify frames before the PHY is ready (according to 6.10.3.3.2
in SAS 3.0 spec) and close ready when the PHY is down.
Signed-off-by: NengLong Zhao <zhaonenglong@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

In setup_itct_v2_hw(), SATA device type SAS_SATA_PENDING is missing, so
add it.

Note: The HiSi SAS controller does not support SATA PM, so do not handle
SAS_SATA_PM_PORT or SAS_SATA_PM.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Function config_id_frame_v1_hw() is called twice for each PHY during
initialisation, which is unneeded.

So remove init_id_frame_v1_hw(), which only calls
config_id_frame_v1_hw().

We will keep the call to config_id_frame_v1_hw() in start_phy_v1_hw()
since it will be used for PHY reset functions.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Function config_id_frame_v2_hw() is called twice for each PHY during
initialisation, which is unneeded.

So remove init_id_frame_v2_hw(), which only calls
config_id_frame_v2_hw().

We will keep the call to config_id_frame_v2_hw() in start_phy_v2_hw()
since it will be used for PHY reset functions.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The endianness for the SAS address in the TX_ID_DWORD registers is set
incorrectly.  We see errors like this in the boot log for v2 hw (which
would have the same issue as v1 hw):

[    7.583284] sas: target proto 0x0 at 50000d1108e7923f:0x1f not handled

This is due to the host SAS addr not matching the PHY SAS addr in the
expander host-attached phy discovery responses.

To fix, we byte swap the SAS addr from BE to LE (which is the endianness
of the SAS controller).
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The endianness for the SAS address in the TX_ID_DWORD registers is set
incorrectly.  We see errors like this in the boot log:

[    7.583284] sas: target proto 0x0 at 50000d1108e7923f:0x1f not handled

This is due to the host SAS addr not matching the PHY SAS addr in the
expander host-attached phy discovery responses.

To fix, we byte swap the SAS addr from BE to LE (which is the endianness
of the SAS controller).
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The device DMA mask was being set after the bulk of the DMA allocations
in the driver init, so potentially DMA allocates fail.  To resolve,
relocate before allocating the DMA memory when initialising the driver.
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

If hisi_sas_task_prep() fails for a SATA device due to PHY down, we
return a failure to libata and also call task_done(), which will cause
ata_qc_complete() to be called twice: - first call from
hisi_sas_task_prep(), which will clear flag ATA_QCFLAG_ACTIVE -
ata_qc_complete() called from libata The warning call trace is as
follows:

[  117.070206] [<ffff0000084f59b0>] __ata_qc_complete+0xf4/0x11c
[  117.070208] [<ffff0000084f5b58>] ata_qc_complete+0x180/0x200
[  117.070210] [<ffff0000084f5dd0>] ata_qc_issue+0x110/0x354
[  117.070212] [<ffff0000084f6254>] ata_exec_internal_sg+0x240/0x4d0
[  117.070214] [<ffff0000084f6544>] ata_exec_internal+0x60/0xa0
[  117.070217] [<ffff000008501580>] ata_read_log_page+0x188/0x1b4
[  117.070218] [<ffff0000085017dc>] ata_eh_analyze_ncq_error+0xa8/0x274
[  117.070220] [<ffff000008501a3c>] ata_eh_link_autopsy+0x94/0x8c8
[  117.070222] [<ffff0000085022a4>] ata_eh_autopsy+0x34/0xe8
[  117.070223] [<ffff00000850540c>] ata_do_eh+0x28/0xc0
[  117.070225] [<ffff0000085054e0>] ata_std_error_handler+0x3c/0x84
[  117.070227] [<ffff000008505140>] ata_scsi_port_error_handler+0x480/0x674
[  117.070230] [<ffff0000084e3020>] async_sas_ata_eh+0x44/0x78
[  117.070231] [<ffff0000080d6b8c>] async_run_entry_fn+0x40/0x104
[  117.070234] [<ffff0000080ce518>] process_one_work+0x128/0x2f0
[  117.070235] [<ffff0000080ce738>] worker_thread+0x58/0x434
[  117.070237] [<ffff0000080d416c>] kthread+0xd4/0xe8
[  117.070240] [<ffff000008084e10>] ret_from_fork+0x10/0x40

The issue is resolved by simply returning a failure status code to the
upper layer.
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

In function phy_up_v2_hw(), we needlessly recalculate the phy linkrate
for all phys, and the calculation is incorrect for phy8, so remove this
code.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The Delivery queue enable register should only be written to once at
reset for v2 hw.
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The memory calculation for the tags bitmap should use BITS_PER_BYTE
macro instead of coincidental same value of sizeof(unsigned long).
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Currently the slot memory is zeroed when it is freed and also when it is
reused, like in hisi_sas_task_prep(). Optimise by avoiding the redundant
zeroing in the free.
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

None of the CHL_INT2 interrupts are serviced in the channel irq ISR, so
leave the interrupt source masked.  The interrupt mask is initially set
in init_reg_v2_hw().
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Optimise by saving an avoidable read in the get_free_slot function.  The
delivery queue write pointer will only be updated by software, so don't
bother re-reading what was already written in the previous call to
start_delivery function.
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Optimise by saving an avoidable read in the cq interrupt.  The queue
read pointer will only be updated by software, so don't bother
re-reading what was already written in the previous interrupt.
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Commit 888baf06 ("scsi: cxlflash: Add kref to context") introduced a
kref to the context. In particular, the detach routine was updated to
use the kref services for managing the removal and destruction of a
context.

As part of this change, the tracking mechanism internal to the detach
handler was refactored. This introduced a bug that can cause the
tracking state to be lost. This can lead to a situation where exclusive
access to a context is prematurely [and unknowingly] relinquished for
the executing thread.

To remedy, only update the tracking state when the kref operation
indicates the context was removed.

Fixes: 888baf06 ("scsi: cxlflash: Add kref to context")
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Acked-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Commit 964497b3 ("cxlflash: Remove dual port online dependency")
logically removed the ability for the WWPN setup routine afu_set_wwpn()
to return a non-success value. This routine can safely be made a void to
simplify the code as there is no longer a need to report a failure.
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Acked-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

When an EEH occurs during device initialization, the port timeout logic
can cause excessive delays as MMIO reads will fail. Depending on where
they are experienced, these delays can lead to a prolonged reset,
causing an unnecessary triggering of other timeout logic in the SCSI
stack or user applications.

To expedite recovery, the port timeout logic is updated to decay the
timeout at a much faster rate when in the presence of a likely EEH
frozen event.
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Acked-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The EEH reset handler is ignorant to the current state of the driver
when processing a frozen event and initiating a device reset. This can
be an issue if an EEH event occurs while a user or stack initiated reset
is executing. More specifically, if an EEH occurs while the SCSI host
reset handler is active, the reset initiated by the EEH thread will
likely collide with the host reset thread. This can leave the device in
an inconsistent state, or worse, cause a system crash.

As a remedy, the EEH handler is updated to evaluate the device state and
take appropriate action (proceed, wait, or disconnect host). The host
reset handler is also updated to handle situations where an EEH occurred
during a host reset. In such situations, the host reset handler will
delay reporting back a success to give the EEH reset an opportunity to
complete.
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Acked-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Commit 704c4b0d ("cxlflash: Shutdown notify support for CXL Flash
cards") was recently introduced to notify the AFU when a system is going
down. Due to the position of the cxlflash driver in the device stack,
cxlflash devices are _always_ removed during a reboot/shutdown. This can
lead to a crash if the cxlflash shutdown hook is invoked _after_ the
shutdown hook for the owning virtual PHB. Furthermore, the current
implementation of shutdown/remove hooks for cxlflash are not tolerant to
being invoked when the device is not enabled. This can also lead to a
crash in situations where the remove hook is invoked after the device
has been removed via the vPHBs shutdown hook. An example of this
scenario would be an EEH reset failure while a reboot/shutdown is in
progress.

To solve both problems, the shutdown hook for cxlflash is updated to
simply remove the device. This path already includes the AFU
notification and thus this solution will continue to perform the
original intent. At the same time, the remove hook is updated to protect
against being called when the device is not enabled.

Fixes: 704c4b0d ("cxlflash: Shutdown notify support for CXL Flash
cards")
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

When a port link is established, the AFU sends a 'link up' interrupt.
After the link is up, corresponding initialization steps are performed
on the card. Following that, when the card is ready for I/O, the AFU
sends 'login succeeded' interrupt. Today, cxlflash invokes
scsi_scan_host() upon receipt of both interrupts.

SCSI commands sent to the port prior to the 'login succeeded' interrupt
will fail with 'port not available' error. This is not desirable.
Moreover, when async_scan is active for the host, subsequent scan calls
are terminated with error. Due to this, the scsi_scan_host() call
performed after 'login succeeded' interrupt could portentially return
error and the devices may not be scanned properly.

To avoid this problem, scsi_scan_host() should be called only after the
'login succeeded' interrupt.
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Fix typo in parameter description.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

I modified a string as described in UFS spec as follow: umpcrs -> upmcrs.

[mkp: applied by hand]
Signed-off-by: Kiwoong Kim <kwmad.kim@samsung.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

We get a few warnings when building kernel with W=1:
drivers/scsi/bnx2fc/bnx2fc_els.c:257:6: warning: no previous prototype for 'bnx2fc_srr_compl' [-Wmissing-prototypes]
drivers/scsi/bnx2fc/bnx2fc_els.c:367:6: warning: no previous prototype for 'bnx2fc_rec_compl' [-Wmissing-prototypes]
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:628:5: warning: no previous prototype for 'bnx2fc_percpu_io_thread' [-Wmissing-prototypes]
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:1413:26: warning: no previous prototype for 'bnx2fc_interface_create' [-Wmissing-prototypes]
drivers/scsi/bnx2fc/bnx2fc_hwi.c:997:21: warning: no previous prototype for 'bnx2fc_alloc_work' [-Wmissing-prototypes]
drivers/scsi/bnx2fc/bnx2fc_io.c:1082:5: warning: no previous prototype for 'bnx2fc_abts_cleanup' [-Wmissing-prototypes]
....

In fact, these functions are only used in the file in which they are
declared and don't need a declaration, but can be made static.  so this
patch marks these functions with 'static'.
Signed-off-by: Baoyou Xie <baoyou.xie@linaro.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>