- 05 Nov, 2015 1 commit
-
-
Christoph Hellwig authored
When dropping a lock while iterating a list we must restart the search as other threads could have manipulated the list under us. Without this we can get stuck in an endless loop. This bug was introduced by commit bc3f02a7 Author: Dan Williams <djbw@fb.com> Date: Tue Aug 28 22:12:10 2012 -0700 [SCSI] scsi_remove_target: fix softlockup regression on hot remove Which was itself trying to fix a reported soft lockup issue http://thread.gmane.org/gmane.linux.kernel/1348679 However, we believe even with this revert of the original patch, the soft lockup problem has been fixed by commit f2495e22 Author: James Bottomley <JBottomley@Parallels.com> Date: Tue Jan 21 07:01:41 2014 -0800 [SCSI] dual scan thread bug fix Thanks go to Dan Williams <dan.j.williams@intel.com> for tracking all this prior history down. Reported-by:
Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by:
Christoph Hellwig <hch@lst.de> Tested-by:
James Bottomley <JBottomley@Odin.com>
-
- 30 Oct, 2015 37 commits
-
-
Matthew R. Ochs authored
Contexts may be skipped over for cleanup in situations where contention for the adapter's table-list mutex is experienced in the presence of a signal during the execution of the release handler. This can lead to two known issues: - A hang condition on remove as that path tries to wait for users to cleanup - something that will never complete should this scenario play out as the user has already cleaned up from their perspective. - An Oops in the unmap_mapping_range() call that is made as part of the user waiting mechanism that is invoked on remove when contexts are found to still exist. The root cause of this issue can be found in get_context() and how the table-list mutex is acquired. As this code path is shared by several different access points within the driver, a decision was made during the development cycle to acquire this mutex in this location using the interruptible version of the mutex locking service. In almost all of the use-cases and environmental scenarios this holds up, even when the mutex is contended. However, for critical system threads (such as the release handler), failing to acquire the mutex and bailing with the intention of the user being able to try again later is unacceptable. In such a scenario, the context _must_ be derived as it is on an irreversible path to being freed. Without being able to derive the context, the code mistakenly assumes that it has already been freed and proceeds to free up the underlying CXL context resources. From this point on, any usage of [the now stale] CXL context resources will result in undefined behavior. This is root cause of the Oops mentioned as the second known issue as the mapping passed to the unmap_mapping_range() service is owned by the CXL context. To fix this problem, acquisition of the table-list mutex within get_context() is simply changed to use the uninterruptible version of the mutex locking service. This is safe as the timing windows for holding this mutex are short and also protected against blocking. Signed-off-by:
Matthew R. Ochs <mrochs@linux.vnet.ibm.com> Acked-by:
Manoj Kumar <manoj@linux.vnet.ibm.com> Reviewed-by:
Andrew Donnellan <andrew.donnellan@au1.ibm.com> Signed-off-by:
-
Matthew R. Ochs authored
When running with lock instrumentation (e.g. lockdep), some of the instrumentation can become disabled at probe time for a cxlflash adapter. This is due to a missing lock registration for the tmf_slock. The fix is to call spin_lock_init() for the tmf_slock during probe. Signed-off-by:
-
Matthew R. Ochs authored
The port selection mask of a LUN can be corrupted when the manage LUN ioctl (DK_CXLFLASH_MANAGE_LUN) is issued more than once for any device. This mask indicates to the AFU which port[s] can be used for a data transfer to/from a particular LUN. The mask is critical to ensuring the correct behavior when using the virtual LUN function of this adapter. When the mask is configured for both ports, an I/O may be sent to either port as the AFU assumes that each port has access to the same physical device (specified by LUN ID in the port LUN table). In a situation where the mask becomes incorrectly configured to reflect access to both ports when in fact there is only access through a single port, an I/O can be targeted to the wrong physical device. This can lead to data corruption among other ill effects (e.g. security leaks). The cause for this corruption is the assumption that the ioctl will only be called a second time for a LUN when it is being configured for access via a second port. A boolean 'newly_created' variable is used to differentiate between a LUN that was created (and subsequently configured for single port access) and one that is destined for access across both ports. While initially set to 'true', this sticky boolean is toggled to the 'false' state during a lookup on any next ioctl performed on a device with a matching WWN/WWID. The code fails to realize that the match could in fact be the same device calling in again. From here, an assumption is made that any LUN with 'newly_created' set to 'false' is configured for access over both ports and the port selection mask is set to reflect this. Any future attempts to use this LUN for hosting a virtual LUN will result in the port LUN table being incorrectly programmed. As a remedy, the 'newly_created' concept was removed entirely and replaced with code that always constructs the port selection mask based upon the SCSI channel of the LUN being accessed. The bits remain sticky, therefore allowing for a device to be accessed over both ports when that is in fact the correct physical configuration. Also included in this commit are a few minor related changes to enhance the fix and provide better debug information for port selection mask and port LUN table bugs in the future. These include renaming refresh_local() to lookup_local(), tracing the WWN/WWID as a big-endian entity, and tracing the port selection mask, SCSI channel, and LUN ID each time the port LUN table is programmed. Signed-off-by:
-
Manoj Kumar authored
A 'login timed out' asynchronous error interrupt is generated if no response is seen to a FLOGI within 2 seconds. If the time out error is not escalated to a LINK_RESET the port will not be available for use. This fix provides the required escalation. Signed-off-by:
Brian King <brking@linux.vnet.ibm.com> Reviewed-by:
Tomas Henzl <thenzl@redhat.com> Signed-off-by:
-
Matthew R. Ochs authored
When running with an unsupported AFU, the cxlflash driver fails the probe. When the driver is removed, the following Oops is encountered on a show_interrupts() thread: Call Trace: [c000001fba5a7a10] [0000000000000003] 0x3 (unreliable) [c000001fba5a7a60] [c00000000053dcf4] vsnprintf+0x204/0x4c0 [c000001fba5a7ae0] [c00000000030045c] seq_vprintf+0x5c/0xd0 [c000001fba5a7b20] [c00000000030051c] seq_printf+0x4c/0x60 [c000001fba5a7b50] [c00000000013e140] show_interrupts+0x370/0x4f0 [c000001fba5a7c10] [c0000000002ff898] seq_read+0xe8/0x530 [c000001fba5a7ca0] [c00000000035d5c0] proc_reg_read+0xb0/0x110 [c000001fba5a7cf0] [c0000000002ca74c] __vfs_read+0x6c/0x180 [c000001fba5a7d90] [c0000000002cb464] vfs_read+0xa4/0x1c0 [c000001fba5a7de0] [c0000000002cc51c] SyS_read+0x6c/0x110 [c000001fba5a7e30] [c000000000009204] system_call+0x38/0xb4 The Oops is due to not cleaning up correctly on the unsupported AFU error path, leaving various allocated and registered resources. In this case, interrupts are in a semi-allocated/registered state, which the show_interrupts() thread attempts to use. To fix, the cleanup logic in init_afu() is consolidated to error gates at the bottom of the function and the appropriate goto is added to each error path. As a mini side fix while refactoring in this routine, the else statement following the AFU version evaluation is eliminated as it is not needed. Signed-off-by:
-
Matthew R. Ochs authored
Ioctl threads that use scsi_execute() can run for an excessive amount of time due to the fact that they have lengthy timeouts and retry logic built in. Under normal operation this is not an issue. However, once EEH enters the picture, a long execution time coupled with the possibility that a timeout can trigger entry to the driver via registered reset callbacks becomes a liability. In particular, a deadlock can occur when an EEH event is encountered while in running in scsi_execute(). As part of the recovery, the EEH handler drains all currently running ioctls, waiting until they have completed before proceeding with a reset. As the scsi_execute()'s are situated on the ioctl path, the EEH handler will wait until they (and the remainder of the ioctl handler they're associated with) have completed. Normally this would not be much of an issue aside from the longer recovery period. Unfortunately, the scsi_execute() triggers a reset when it times out. The reset handler will see that the device is already being reset and wait until that reset completed. This creates a condition where the EEH handler becomes stuck, infinitely waiting for the ioctl thread to complete. To avoid this behavior, temporarily unmark the scsi_execute() threads as an ioctl thread by releasing the ioctl read semaphore. This allows the EEH handler to proceed with a recovery while the thread is still running. Once the scsi_execute() returns, the ioctl read semaphore is reacquired and the adapter state is rechecked in case it changed while inside of scsi_execute(). The state check will wait if the adapter is still being recovered or returns a failure if the recovery failed. In the event that the adapter reset failed, the failure is simply returned as the ioctl would be unable to continue. Reported-by:
Daniel Axtens <dja@axtens.net> Reviewed-by:
-
Matthew R. Ochs authored
The trace following the failure of alloc_mem() incorrectly identifies which function failed. This can lead to misdiagnosing a failure. Fix the string to correctly indicate that alloc_mem() failed. Reported-by:
-
Matthew R. Ochs authored
The fops owned by the adapter can be corrupted in certain scenarios, opening a window where certain fops are temporarily NULLed before being reset to their proper value. This can potentially lead software to make incorrect decisions, leaving the user with the inability to function as intended. An example of this behavior can be observed when there are a number of users with a high rate of turn around (attach to LUN, perform an I/O, detach from LUN, repeat). Every so often a user is given a valid context and adapter file descriptor, but the file associated with the descriptor lacks the correct read permission bit (FMODE_CAN_READ) and thus the read system call bails before calling the valid read fop. Background: The fops is stored in the adapter structure to provide the ability to lookup the adapter structure from within the fop handler. CXL services use the file's private_data and at present, the CXL context does not have a private section. In an effort to limit areas of the cxlflash driver with code specific the superpipe function, a design choice was made to keep the details of the fops situated away from the legacy portions of the driver. This drove the behavior that the adapter fops is set at the beginning of the disk attach ioctl handler when there are no users present. The corruption that this fix remedies is due to the fact that the fops is initially defaulted to values found within a static structure. When the fops is handed down to the CXL services later in the attach path, certain services are patched. The fops structure remains correct until the user count drops to 0 and the fops is reset, triggering the process to repeat again. The user counts are tightly coupled with the creation and deletion of the user context. If multiple users perform a disk attach at the same time, when the user count is currently 0, some users can be in the middle of obtaining a file descriptor and have not yet reached the context creation code that [in addition to creating the context] increments the user count. Subsequent users coming in to perform the attach see that the user count is still 0, and reinitialize the fops, temporarily removing the patched fops. The users that are in the middle obtaining their file descriptor may then receive an invalid descriptor. The fix simply removes the user count altogether and moves the fops initialization to probe time such that it is only performed one time for the life of the adapter. In the future, if the CXL services adopt a private member for their context, that could be used to store the adapter structure reference and cxlflash could revert to a model that does not require an embedded fops. Signed-off-by:
-
Manoj Kumar authored
The operator used to double the master context response delay is incorrect and does not result in delay doubling. To fix, use a left shift instead of the XOR operator. Reported-by:
-
Matthew R. Ochs authored
Add stanza for cxlflash SCSI driver. Signed-off-by:
-
Matthew R. Ochs authored
Following an adapter reset, the AFU RRQ that resides in host memory holds stale data. This can lead to a condition where the RRQ interrupt handler tries to process stale entries and/or endlessly loops due to an out of sync generation bit. To fix, the AFU RRQ in host memory needs to be cleared after each reset. Signed-off-by:
-
Matthew R. Ochs authored
There are several spelling and grammar mistakes throughout the driver. Additionally there are a handful of places where there are extra lines and unnecessary variables/statements. These are a nuisance and pollute the driver. Fix spelling and grammar issues. Update some comments for clarity and consistency. Remove extra lines and a few unneeded variables/statements. Signed-off-by:
-
Matthew R. Ochs authored
The process_sense() routine can perform a read capacity which can take some time to complete. If an EEH occurs while waiting on the read capacity, the EEH handler will wait to obtain the context's mutex in order to put the context in an error state. The EEH handler will sit and wait until the context is free, but this wait can potentially last forever (deadlock) if the scsi_execute() that performs the read capacity experiences a timeout and calls into the reset callback. When that occurs, the reset callback sees that the device is already being reset and waits for the reset to complete. This leaves two threads waiting on the other. To address this issue, make the context unavailable to new, non-system owned threads and release the context while calling into process_sense(). After returning from process_sense() the context mutex is reacquired and the context is made available again. The context can be safely moved to the error state if needed during the unavailable window as no other threads will hold its reference. Signed-off-by:
-
Matthew R. Ochs authored
Sparse uncovered several errors with MMIO operations (accessing directly) and handling endianness. These can cause issues when running in different environments. Introduce __iomem and proper endianness tags/swaps where appropriate to make driver sparse clean. Signed-off-by:
-
Matthew R. Ochs authored
Several function prologs have incorrect parameter names and return code descriptions. This can lead to confusion when reviewing the source and creates inaccurate documentation. To remedy, update the function prologs to properly reflect parameter names and return codes. Signed-off-by:
-
Matthew R. Ochs authored
The host reset handler is called with I/O already blocked, thus there is no need to explicitly block and unblock I/O in the handler. Signed-off-by:
-
Matthew R. Ochs authored
When the device reset handler is entered while a reset operation is taking place, the handler exits without actually sending a reset (TMF) to the targeted device. This behavior is incorrect as the device is not reset. Further complicating matters is the fact that a success is returned even when the TMF was not sent. To fix, the state is rechecked after coming out of the reset state. When the state is normal, a TMF will be sent out. Signed-off-by:
-
Matthew R. Ochs authored
The workq can process work in parallel with a remove event, leading to a condition where the workq handler can access freed memory. To remedy, the workq should be terminated prior to freeing memory. Move the termination call earlier in remove and use cancel_work_sync() instead of flush_work() as there is not a need to process any scheduled work when shutting down. Signed-off-by:
-
Matthew R. Ochs authored
Currently, scsi_host_put() is being called prematurely in the remove path and is missing entirely in an error cleanup path. The former can lead to memory being freed too early with subsequent access potentially corrupting data whilst the former would result in a memory leak. Move the usage on remove to be the last cleanup action taken and introduce a call to scsi_host_put() in the one initialization error path that does not use remove to cleanup. Signed-off-by:
-
Matthew R. Ochs authored
The AFU version is stored as a non-terminated string of bytes within a 64-bit little-endian register. Presently the value is read directly (no MMIO accessor) and is stored in a buffer that is not big enough to contain a NULL terminator. Additionally the version obtained is not evaluated against a known value to prevent usage with unsupported AFUs. All of these deficiencies can lead to a variety of problems. To remedy, use the correct MMIO accessor to read the version value into a null-terminated buffer and add a check to prevent an incompatible AFU from being used with this driver. Signed-off-by:
-
Matthew R. Ochs authored
At present, both ports must be online for the device to configure properly. Remove this dependency and the unnecessary internal LUN override logic as well. Additionally, as a refactoring measure, change the return code variable name to match that used throughout the driver. With this change, the card will be able to configure even when the link is down. At some later point when the link is transitioned to 'up', a link state change interrupt will trigger the port configuration. Note that despite its void-like behavior, the function was left with a return code for right now in case its behavior needs to be altered again in the near future based on testing. Signed-off-by:
-
Matthew R. Ochs authored
A bug was introduced earlier in the development cycle when cleaning up logic statements. Instead of skipping bits that are not set, set bits are skipped, causing async interrupts to not be handled correctly. To fix, simply add back in the proper evaluation for an unset bit. Signed-off-by:
-
Matthew R. Ochs authored
Following a link up event, the LUNs available to the host may have changed. Without rescanning the host, the LUN topology is unknown to the user. In such a state, the user would be unable to locate provisioned resources. To remedy, the host should be rescanned after a link up event. Signed-off-by:
-
Matthew R. Ochs authored
The resid is incorrectly set which can lead to unnecessary retry attempts by the stack. This is due to resid _always_ being set using a value returned from the adapter. Instead, the value should only be interpreted and set when in an underrun scenario. Signed-off-by:
-
Matthew R. Ochs authored
Borrowing the TMF waitq's spinlock causes a stall condition when waiting for the TMF to complete. To remedy, introduce our own spin lock to serialize TMF and use the appropriate wait services. Also add a timeout while waiting for a TMF completion. When a TMF times out, report back a failure such that a bigger hammer reset can occur. Signed-off-by:
-
Matthew R. Ochs authored
During run-time the driver can be very chatty and spam the system kernel log. Various print statements can be limited and/or moved to development-only mode. Additionally, numerous prints can be converted to trace the corresponding device. Lastly, one spelling correction was made: 'entra' to 'extra'. The following changes were made: - pr_debug to pr_devel - pr_debug to pr_debug_ratelimited - pr_err to dev_err - pr_debug to dev_dbg Signed-off-by:
-
Matthew R. Ochs authored
Implement the following suggestions and add two new attributes to allow for debugging the port LUN table. - use scnprintf() instead of snprintf() - use DEVICE_ATTR_RO and DEVICE_ATTR_RW Suggested-by:
Shane Seymour <shane.seymour@hp.com> Signed-off-by:
-
Matthew R. Ochs authored
Found during code inspection, that the following functions are not being used outside of the file where they are defined. Make them static. int cxlflash_send_cmd(struct afu *, struct afu_cmd *); void cxlflash_wait_resp(struct afu *, struct afu_cmd *); int cxlflash_afu_reset(struct cxlflash_cfg *); struct afu_cmd *cxlflash_cmd_checkout(struct afu *); void cxlflash_cmd_checkin(struct afu_cmd *); void init_pcr(struct cxlflash_cfg *); int init_global(struct cxlflash_cfg *); Signed-off-by:
-
Matthew R. Ochs authored
Limbo is not an accurate representation of this state and is also not consistent with the terminology that other drivers use to represent this concept. Rename the state and and its associated waitq to 'reset'. Signed-off-by:
-
Matthew R. Ochs authored
During an EEH freeze event, certain CXL services should not be called until after the hardware reset has taken place. Doing so can result in unnecessary failures and possibly cause other ill effects by triggering hardware accesses. This translates to a requirement to quiesce all threads that may potentially use CXL runtime service during this window. In particular, multiple ioctls make use of the CXL services when acting on contexts on behalf of the user. Thus, it is essential to 'drain' running ioctls _before_ proceeding with handling the EEH freeze event. Create the ability to drain ioctls by wrapping the ioctl handler call in a read semaphore and then implementing a small routine that obtains the write semaphore, effectively creating a wait point for all currently executing ioctls. Signed-off-by:
-
Matthew R. Ochs authored
The context encode mask covers more than 32-bits, making it a long integer. This should be noted by appending the ULL width suffix to the mask. Signed-off-by:
-
Matthew R. Ochs authored
Using sizeof(bool) is considered poor form for various reasons and sparse warns us of that. Correct by changing type from bool to u8. Signed-off-by:
-
Matthew R. Ochs authored
If the same virtual LUN is accessed over multiple cards, only accesses made over the first card will be valid. Accesses made over the second card will go to the wrong LUN causing data corruption. This is because the global LUN's mode word was being used to determine whether the LUN table for that card needs to be programmed. The mode word would be setup by the first card, causing the LUN table for the second card to not be programmed. By unconditionally initializing the LUN table (not depending on the mode word), the problem is avoided. Signed-off-by:
-
Matthew R. Ochs authored
When a LUN is removed, the sdev that is associated with the LUN remains intact until its reference count drops to 0. In order to prevent an sdev from being removed while a context is still associated with it, obtain an additional reference per-context for each LUN attached to the context. This resolves a potential Oops in the release handler when a dealing with a LUN that has already been removed. Signed-off-by:
-
Manoj Kumar authored
The timeout value for read capacity is too small. Certain devices may take longer to respond and thus the command may prematurely timeout. Additionally the literal used for the timeout is stale. Update the timeout to 30 seconds (matches the value used in sd.c) and rework the timeout literal to a more appropriate description. Signed-off-by:
-
Manoj Kumar authored
Magic numbers are not meaningful and can create confusion. As a remedy, replace them with descriptive literals. Replace 512 with literal MAX_SECTOR_UNIT. Replace 5 with literal CMD_RETRIES. Signed-off-by:
-
Manoj Kumar authored
If two concurrent MANAGE_LUN ioctls are issued with the same WWID parameter, it would result in an incorrect value of port_sel. This is because port_sel is modified without any locks being held. If the first caller stalls after the return from find_and_create_lun(), the value of port_sel will be set incorrectly to indicate a single port, though in this case it should have been set to both ports. To fix, use the global mutex to serialize the lookup of the WWID and the subsequent modification of port_sel. Signed-off-by:
-
- 27 Oct, 2015 2 commits
-
-
Alan Stern authored
The "compatible" matching algorithm used for looking up old-style blacklist entries in a scsi_dev_info_list is buggy. The core of the algorithm looks like this: if (memcmp(devinfo->vendor, vendor, min(max, strlen(devinfo->vendor)))) /* not a match */ where max is the length of the device's vendor string after leading spaces have been removed but trailing spaces have not. Because of the min() computation, either entry could be a proper substring of the other and the code would still think that they match. In the case originally reported, the device's vendor and product strings were "Inateck " and " ". These matched against the following entry in the global device list: {"", "Scanner", "1.80", BLIST_NOLUN} because "" is a substring of "Inateck " and "" (the result of removing leading spaces from the device's product string) is a substring of "Scanner". The mistaken match prevented the system from scanning and finding the device's second Logical Unit. This patch fixes the problem by making two changes. First, the code for leading-space removal is hoisted out of the loop. (This means it will sometimes run unnecessarily, but since a large percentage of all lookups involve the "compatible" entries in global device list, this should be an overall improvement.) Second and more importantly, the patch removes trailing spaces and adds a check to verify that the two resulting strings are exactly the same length. This prevents matches where one entry is a proper substring of the other. Signed-off-by:Alan Stern <stern@rowland.harvard.edu> Reported-by:
Giulio Bernardi <ugilio@gmail.com> Tested-by:
-
Alan Stern authored
In drivers/scsi/scsi_devinfo.c, the scsi_dev_info_list_del_keyed() and scsi_get_device_flags_keyed() routines contain a large amount of duplicate code for finding vendor/product matches in a scsi_dev_info_list. This patch factors out the duplicate code and puts it in a separate function, scsi_dev_info_list_find(). Signed-off-by:
-
