23 Sep, 2020

1 commit

  • sg_init_table zeroes its first argument, so the allocation of that argument
    doesn't have to.

    the semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    expression x;
    @@

    x =
    - kzalloc
    + kmalloc
    (...)
    ...
    sg_init_table(x,...)
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Jens Axboe

    Julia Lawall
     

17 Aug, 2020

1 commit


24 Jun, 2020

1 commit

  • Move the call to blk_should_fake_timeout out of blk_mq_complete_request
    and into the drivers, skipping call sites that are obvious error
    handlers, and remove the now superflous blk_mq_force_complete_rq helper.
    This ensures we don't keep injecting errors into completions that just
    terminate the Linux request after the hardware has been reset or the
    command has been aborted.

    Reviewed-by: Daniel Wagner
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

21 Dec, 2019

1 commit

  • This patch fixes the following sparse warnings:

    block/bsg-lib.c:269:19: warning: incorrect type in initializer (different base types)
    block/bsg-lib.c:269:19: expected int sts
    block/bsg-lib.c:269:19: got restricted blk_status_t [usertype]
    block/bsg-lib.c:286:16: warning: incorrect type in return expression (different base types)
    block/bsg-lib.c:286:16: expected restricted blk_status_t
    block/bsg-lib.c:286:16: got int [assigned] sts

    Cc: Martin Wilck
    Fixes: d46fe2cb2dce ("block: drop device references in bsg_queue_rq()")
    Signed-off-by: Bart Van Assche
    Signed-off-by: Jens Axboe

    Bart Van Assche
     

24 Sep, 2019

1 commit


01 Jun, 2019

1 commit


01 May, 2019

1 commit


06 Feb, 2019

1 commit


08 Nov, 2018

5 commits

  • Get rid of the special bsg job fn and timeout handler, move them
    into a private bsg_set instead.

    Mostly from Christoph, with fixes for error handling and cleanups.

    Reviewed-by: Hannes Reinecke
    Tested-by: Ming Lei
    Reviewed-by: Omar Sandoval
    Signed-off-by: Jens Axboe

    Jens Axboe
     
  • The only user of legacy timing now is BSG, which is invoked
    from the mq timeout handler. Kill the legacy code, and rename
    the q->rq_timed_out_fn to q->bsg_job_timeout_fn.

    Reviewed-by: Hannes Reinecke
    Tested-by: Ming Lei
    Reviewed-by: Omar Sandoval
    Signed-off-by: Jens Axboe

    Jens Axboe
     
  • Requires a few changes to the FC transport class as well.

    Cc: linux-scsi@vger.kernel.org
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Tested-by: Benjamin Block
    Tested-by: Ming Lei
    Reviewed-by: Omar Sandoval
    Signed-off-by: Jens Axboe

    Jens Axboe
     
  • All drivers do unregister + cleanup, provide a helper for that.

    Cc: linux-scsi@vger.kernel.org
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Reviewed-by: Christoph Hellwig
    Tested-by: Benjamin Block
    Tested-by: Ming Lei
    Reviewed-by: Omar Sandoval
    Signed-off-by: Jens Axboe

    Jens Axboe
     
  • This will ease in the conversion to blk-mq, where we can't set
    a timeout handler after queue init.

    Cc: Johannes Thumshirn
    Cc: linux-scsi@vger.kernel.org
    Reviewed-by: Hannes Reinecke
    Tested-by: Benjamin Block
    Tested-by: Ming Lei
    Reviewed-by: Omar Sandoval
    Signed-off-by: Jens Axboe

    Jens Axboe
     

01 Aug, 2018

1 commit


30 May, 2018

1 commit

  • Bsg holding a reference to the parent device may result in a crash if a
    bsg file handle is closed after the parent device driver has unloaded.

    Holding a reference is not really needed: the parent device must exist
    between bsg_register_queue and bsg_unregister_queue. Before the device
    goes away the caller does blk_cleanup_queue so that all in-flight
    requests to the device are gone and all new requests cannot pass beyond
    the queue. The queue itself is a refcounted object and it will stay
    alive with a bsg file.

    Based on analysis, previous patch and changelog from Anatoliy Glagolev.

    Reported-by: Anatoliy Glagolev
    Reviewed-by: James E.J. Bottomley
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

14 Mar, 2018

3 commits

  • The current BSG design tries to shoe-horn the transport-specific
    passthrough commands into the overall framework for SCSI passthrough
    requests. This has a couple problems:

    - each passthrough queue has to set the QUEUE_FLAG_SCSI_PASSTHROUGH flag
    despite not dealing with SCSI commands at all. Because of that these
    queues could also incorrectly accept SCSI commands from in-kernel
    users or through the legacy SCSI_IOCTL_SEND_COMMAND ioctl.
    - the real SCSI bsg queues also incorrectly accept bsg requests of the
    BSG_SUB_PROTOCOL_SCSI_TRANSPORT type
    - the bsg transport code is almost unredable because it tries to reuse
    different SCSI concepts for its own purpose.

    This patch instead adds a new bsg_ops structure to handle the two cases
    differently, and thus solves all of the above problems. Another side
    effect is that the bsg-lib queues also don't need to embedd a
    struct scsi_request anymore.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     
  • Users of the bsg-lib interface should only use the bsg_job data structure
    and not know about implementation details of it.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Benjamin Block
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     
  • The zfcp driver wants to know the timeout for a bsg job, so add a field
    to struct bsg_job for it in preparation of not exposing the request
    to the bsg-lib users.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Benjamin Block
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

09 Mar, 2018

1 commit

  • This patch has been generated as follows:

    for verb in set_unlocked clear_unlocked set clear; do
    replace-in-files queue_flag_${verb} blk_queue_flag_${verb%_unlocked} \
    $(git grep -lw queue_flag_${verb} drivers block/bsg*)
    done

    Except for protecting all queue flag changes with the queue lock
    this patch does not change any functionality.

    Cc: Mike Snitzer
    Cc: Shaohua Li
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Ming Lei
    Signed-off-by: Bart Van Assche
    Reviewed-by: Martin K. Petersen
    Reviewed-by: Johannes Thumshirn
    Acked-by: Martin K. Petersen
    Signed-off-by: Jens Axboe

    Bart Van Assche
     

10 Jan, 2018

1 commit

  • Commit 3a025e1d1c2e ("Add optional check for bad kernel-doc comments")
    causes W=1 the kernel-doc script to be run and thereby causes several
    new warnings to appear when building the kernel with W=1. Fix the
    block layer kernel-doc headers such that the block layer again builds
    cleanly with W=1.

    Signed-off-by: Bart Van Assche
    Cc: Martin K. Petersen
    Cc: Christoph Hellwig
    Cc: Hannes Reinecke
    Cc: Johannes Thumshirn
    Signed-off-by: Jens Axboe

    Bart Van Assche
     

04 Oct, 2017

1 commit

  • When under memory-pressure it is possible that the mempool which backs
    the 'struct request_queue' will make use of up to BLKDEV_MIN_RQ count
    emergency buffers - in case it can't get a regular allocation. These
    buffers are preallocated and once they are also used, they are
    re-supplied with old finished requests from the same request_queue (see
    mempool_free()).

    The bug is, when re-supplying the emergency pool, the old requests are
    not again ran through the callback mempool_t->alloc(), and thus also not
    through the callback bsg_init_rq(). Thus we skip initialization, and
    while the sense-buffer still should be good, scsi_request->cmd might
    have become to be an invalid pointer in the meantime. When the request
    is initialized in bsg.c, and the user's CDB is larger than BLK_MAX_CDB,
    bsg will replace it with a custom allocated buffer, which is freed when
    the user's command is finished, thus it dangles afterwards. When next a
    command is sent by the user that has a smaller/similar CDB as
    BLK_MAX_CDB, bsg will assume that scsi_request->cmd is backed by
    scsi_request->__cmd, will not make a custom allocation, and write into
    undefined memory.

    Fix this by splitting bsg_init_rq() into two functions:
    - bsg_init_rq() is changed to only do the allocation of the
    sense-buffer, which is used to back the bsg job's reply buffer. This
    pointer should never change during the lifetime of a scsi_request, so
    it doesn't need re-initialization.
    - bsg_initialize_rq() is a new function that makes use of
    'struct request_queue's initialize_rq_fn callback (which was
    introduced in v4.12). This is always called before the request is
    given out via blk_get_request(). This function does the remaining
    initialization that was previously done in bsg_init_rq(), and will
    also do it when the request is taken from the emergency-pool of the
    backing mempool.

    Fixes: 50b4d485528d ("bsg-lib: fix kernel panic resulting from missing allocation of reply-buffer")
    Cc: # 4.11+
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Johannes Thumshirn
    Reviewed-by: Christoph Hellwig
    Signed-off-by: Benjamin Block
    Signed-off-by: Jens Axboe

    Benjamin Block
     

25 Sep, 2017

1 commit


08 Sep, 2017

1 commit

  • Pull SCSI updates from James Bottomley:
    "This is mostly updates of the usual suspects: lpfc, qla2xxx, hisi_sas,
    megaraid_sas, zfcp and a host of minor updates.

    The major driver change here is the elimination of the block based
    cciss driver in favour of the SCSI based hpsa driver (which now drives
    all the legacy cases cciss used to be required for). Plus a reset
    handler clean up and the redo of the SAS SMP handler to use bsg lib"

    * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (279 commits)
    scsi: scsi-mq: Always unprepare before requeuing a request
    scsi: Show .retries and .jiffies_at_alloc in debugfs
    scsi: Improve requeuing behavior
    scsi: Call scsi_initialize_rq() for filesystem requests
    scsi: qla2xxx: Reset the logo flag, after target re-login.
    scsi: qla2xxx: Fix slow mem alloc behind lock
    scsi: qla2xxx: Clear fc4f_nvme flag
    scsi: qla2xxx: add missing includes for qla_isr
    scsi: qla2xxx: Fix an integer overflow in sysfs code
    scsi: aacraid: report -ENOMEM to upper layer from aac_convert_sgraw2()
    scsi: aacraid: get rid of one level of indentation
    scsi: aacraid: fix indentation errors
    scsi: storvsc: fix memory leak on ring buffer busy
    scsi: scsi_transport_sas: switch to bsg-lib for SMP passthrough
    scsi: smartpqi: remove the smp_handler stub
    scsi: hpsa: remove the smp_handler stub
    scsi: bsg-lib: pass the release callback through bsg_setup_queue
    scsi: Rework handling of scsi_device.vpd_pg8[03]
    scsi: Rework the code for caching Vital Product Data (VPD)
    scsi: rcu: Introduce rcu_swap_protected()
    ...

    Linus Torvalds
     

30 Aug, 2017

1 commit


24 Aug, 2017

1 commit

  • Since we split the scsi_request out of struct request bsg fails to
    provide a reply-buffer for the drivers. This was done via the pointer
    for sense-data, that is not preallocated anymore.

    Failing to allocate/assign it results in illegal dereferences because
    LLDs use this pointer unquestioned.

    An example panic on s390x, using the zFCP driver, looks like this (I had
    debugging on, otherwise NULL-pointer dereferences wouldn't even panic on
    s390x):

    Unable to handle kernel pointer dereference in virtual kernel address space
    Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6403
    Fault in home space mode while using kernel ASCE.
    AS:0000000001590007 R3:0000000000000024
    Oops: 0038 ilc:2 [#1] PREEMPT SMP DEBUG_PAGEALLOC
    Modules linked in:
    CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.12.0-bsg-regression+ #3
    Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
    task: 0000000065cb0100 task.stack: 0000000065cb4000
    Krnl PSW : 0704e00180000000 000003ff801e4156 (zfcp_fc_ct_els_job_handler+0x16/0x58 [zfcp])
    R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
    Krnl GPRS: 0000000000000001 000000005fa9d0d0 000000005fa9d078 0000000000e16866
    000003ff00000290 6b6b6b6b6b6b6b6b 0000000059f78f00 000000000000000f
    00000000593a0958 00000000593a0958 0000000060d88800 000000005ddd4c38
    0000000058b50100 07000000659cba08 000003ff801e8556 00000000659cb9a8
    Krnl Code: 000003ff801e4146: e31020500004 lg %r1,80(%r2)
    000003ff801e414c: 58402040 l %r4,64(%r2)
    #000003ff801e4150: e35020200004 lg %r5,32(%r2)
    >000003ff801e4156: 50405004 st %r4,4(%r5)
    000003ff801e415a: e54c50080000 mvhi 8(%r5),0
    000003ff801e4160: e33010280012 lt %r3,40(%r1)
    000003ff801e4166: a718fffb lhi %r1,-5
    000003ff801e416a: 1803 lr %r0,%r3
    Call Trace:
    ([] zfcp_fsf_req_complete+0x726/0x768 [zfcp])
    [] zfcp_fsf_reqid_check+0x102/0x180 [zfcp]
    [] zfcp_qdio_int_resp+0x230/0x278 [zfcp]
    [] qdio_kick_handler+0x2ae/0x2c8
    [] __tiqdio_inbound_processing+0x406/0xc10
    [] tasklet_action+0x15a/0x1d8
    [] __do_softirq+0x3ec/0x848
    [] irq_exit+0x74/0xf8
    [] do_IRQ+0xba/0xf0
    [] io_int_handler+0x104/0x2d4
    [] enabled_wait+0xb6/0x188
    ([] enabled_wait+0x9e/0x188)
    [] arch_cpu_idle+0x32/0x50
    [] default_idle_call+0x52/0x68
    [] do_idle+0x102/0x188
    [] cpu_startup_entry+0x3e/0x48
    [] smp_start_secondary+0x11c/0x130
    [] restart_int_handler+0x62/0x78
    [] (null)
    INFO: lockdep is turned off.
    Last Breaking-Event-Address:
    [] zfcp_fc_ct_job_handler+0x3e/0x48 [zfcp]

    Kernel panic - not syncing: Fatal exception in interrupt

    This patch moves bsg-lib to allocate and setup struct bsg_job ahead of
    time, including the allocation of a buffer for the reply-data.

    This means, struct bsg_job is not allocated separately anymore, but as part
    of struct request allocation - similar to struct scsi_cmd. Reflect this in
    the function names that used to handle creation/destruction of struct
    bsg_job.

    Reported-by: Steffen Maier
    Suggested-by: Christoph Hellwig
    Reviewed-by: Christoph Hellwig
    Signed-off-by: Benjamin Block
    Fixes: 82ed4db499b8 ("block: split scsi_request out of struct request")
    Cc: #4.11+
    Signed-off-by: Jens Axboe

    Benjamin Block
     

09 Jun, 2017

1 commit

  • Currently we use nornal Linux errno values in the block layer, and while
    we accept any error a few have overloaded magic meanings. This patch
    instead introduces a new blk_status_t value that holds block layer specific
    status codes and explicitly explains their meaning. Helpers to convert from
    and to the previous special meanings are provided for now, but I suspect
    we want to get rid of them in the long run - those drivers that have a
    errno input (e.g. networking) usually get errnos that don't know about
    the special block layer overloads, and similarly returning them to userspace
    will usually return somethings that strictly speaking isn't correct
    for file system operations, but that's left as an exercise for later.

    For now the set of errors is a very limited set that closely corresponds
    to the previous overloaded errno values, but there is some low hanging
    fruite to improve it.

    blk_status_t (ab)uses the sparse __bitwise annotations to allow for sparse
    typechecking, so that we can easily catch places passing the wrong values.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

02 Jun, 2017

1 commit

  • From the context where a SCSI command is submitted it is not always
    possible to figure out whether or not the queue the command is
    submitted to has struct scsi_request as the first member of its
    private data. Hence introduce the flag QUEUE_FLAG_SCSI_PASSTHROUGH.

    Signed-off-by: Bart Van Assche
    Reviewed-by: Hannes Reinecke
    Reviewed-by: Christoph Hellwig
    Reviewed-by: Martin K. Petersen
    Cc: Omar Sandoval
    Cc: Don Brace
    Signed-off-by: Jens Axboe

    Bart Van Assche
     

21 Apr, 2017

1 commit

  • This passes on the scsi_cmnd result field to users of passthrough
    requests. Currently we abuse req->errors for this purpose, but that
    field will go away in its current form.

    Note that the old IDE code abuses the errors field in very creative
    ways and stores all kinds of different values in it. I didn't dare
    to touch this magic, so the abuses are brought forward 1:1.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Martin K. Petersen
    Reviewed-by: Bart Van Assche
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

28 Jan, 2017

2 commits


15 Dec, 2016

1 commit

  • Pull SCSI updates from James Bottomley:
    "This update includes the usual round of major driver updates (ncr5380,
    lpfc, hisi_sas, megaraid_sas, ufs, ibmvscsis, mpt3sas).

    There's also an assortment of minor fixes, mostly in error legs or
    other not very user visible stuff. The major change is the
    pci_alloc_irq_vectors replacement for the old pci_msix_.. calls; this
    effectively makes IRQ mapping generic for the drivers and allows
    blk_mq to use the information"

    * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (256 commits)
    scsi: qla4xxx: switch to pci_alloc_irq_vectors
    scsi: hisi_sas: support deferred probe for v2 hw
    scsi: megaraid_sas: switch to pci_alloc_irq_vectors
    scsi: scsi_devinfo: remove synchronous ALUA for NETAPP devices
    scsi: be2iscsi: set errno on error path
    scsi: be2iscsi: set errno on error path
    scsi: hpsa: fallback to use legacy REPORT PHYS command
    scsi: scsi_dh_alua: Fix RCU annotations
    scsi: hpsa: use %phN for short hex dumps
    scsi: hisi_sas: fix free'ing in probe and remove
    scsi: isci: switch to pci_alloc_irq_vectors
    scsi: ipr: Fix runaway IRQs when falling back from MSI to LSI
    scsi: dpt_i2o: double free on error path
    scsi: cxlflash: Migrate scsi command pointer to AFU command
    scsi: cxlflash: Migrate IOARRIN specific routines to function pointers
    scsi: cxlflash: Cleanup queuecommand()
    scsi: cxlflash: Cleanup send_tmf()
    scsi: cxlflash: Remove AFU command lock
    scsi: cxlflash: Wait for active AFU commands to timeout upon tear down
    scsi: cxlflash: Remove private command pool
    ...

    Linus Torvalds
     

18 Nov, 2016

5 commits


15 Nov, 2016

1 commit


06 Dec, 2012

1 commit


25 Jun, 2012

1 commit

  • iscsi_remove_host() uses bsg_remove_queue() which implements custom
    queue draining. fc_bsg_remove() open-codes mostly identical logic.

    The draining logic isn't correct in that blk_stop_queue() doesn't
    prevent new requests from being queued - it just stops processing, so
    nothing prevents new requests to be queued after the logic determines
    that the queue is drained.

    blk_cleanup_queue() now implements proper queue draining and these
    custom draining logics aren't necessary. Drop them and use
    bsg_unregister_queue() + blk_cleanup_queue() instead.

    Signed-off-by: Tejun Heo
    Reviewed-by: Mike Christie
    Acked-by: Vivek Goyal
    Cc: James Bottomley
    Cc: James Smart
    Signed-off-by: Jens Axboe

    Tejun Heo
     

01 Nov, 2011

1 commit