scsi_add_host() allocates shost->can_queue tags. ufshcd_init() sets
shost->can_queue to hba->nutrs. In other words, we know that tag values
will less than hba->nutrs. Hence remove the checks that verify that
blk_get_request() returns a tag less than hba->nutrs. This check was
introduced by commit 14497328b6 ("scsi: ufs: verify command tag
validity").
Keep the tag >= 0 check because it helps to detect use-after-free issues.
Link: https://lore.kernel.org/r/20210722033439.26550-7-bvanassche@acm.org
CC: Avri Altman <avri.altman@wdc.com>
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 4728ab4a8e)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: I3c947ae3e2cce5712fd82fef9cfb937a80db0867
drivers/scsi/ufs/ufshcd.c:9770:12: warning: ‘ufshcd_rpmb_resume’ defined but not used [-Wunused-function]
static int ufshcd_rpmb_resume(struct device *dev)
^~~~~~~~~~~~~~~~~~
drivers/scsi/ufs/ufshcd.c:9037:12: warning: ‘ufshcd_wl_runtime_resume’ defined but not used [-Wunused-function]
static int ufshcd_wl_runtime_resume(struct device *dev)
^~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/ufs/ufshcd.c:9017:12: warning: ‘ufshcd_wl_runtime_suspend’ defined but not used [-Wunused-function]
static int ufshcd_wl_runtime_suspend(struct device *dev)
^~~~~~~~~~~~~~~~~~~~~~~~~
Move it into #ifdef block to fix this.
Link: https://lore.kernel.org/r/20210617031326.36908-1-yuehaibing@huawei.com
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 75d645a61c)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: I3aa95339887bc0d6db1014ec8748668eed445152
For the query request, we already have query_trace, but in
ufshcd_send_command(), there will add two more redundant traces. Since
lrbp->cmd is NULL in the query request, the two trace events below provide
nothing except the tag and DB. Instead of letting them take up the limited
trace ring buffer, it’s better not to print these traces in case of cmd ==
NULL.
ufshcd_command: send_req: ff3b0000.ufs: tag: 28, DB: 0x0, size: -1, IS: 0, LBA: 18446744073709551615, opcode: 0x0 (0x0), group_id: 0x0
ufshcd_command: dev_complete: ff3b0000.ufs: tag: 28, DB: 0x0, size: -1, IS: 0, LBA: 18446744073709551615, opcode: 0x0 (0x0), group_id: 0x0
Link: https://lore.kernel.org/r/20210531104308.391842-4-huobean@gmail.com
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 44b5de3635)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: I3ebce009d5499a377daac09218c1f156ce0d8ad5
The current UPIU completion event trace still prints the COMMAND UPIU
header, rather than the RSP UPIU header. This makes UPIU command trace
useless in problem shooting in case we receive a trace log from the
customer/field.
There are two important fields in RSP UPIU:
1. The response field, which indicates the UFS defined overall success or
failure of the series of Command, Data and RESPONSE UPIU’s that make up
the execution of a task.
2. The Status field, which contains the command set specific status for a
specific command issued by the initiator device.
Before this commit, the UPIU paired trace events:
ufshcd_upiu: send_req: fe3b0000.ufs: HDR:01 20 00 1c 00 00 00 00 00 00 00 00, CDB:3b e1 00 00 00 00 00 00 30 00 00 00 00 00 00 00
ufshcd_upiu: complete_rsp: fe3b0000.ufs: HDR:01 20 00 1c 00 00 00 00 00 00 00 00, CDB:3b e1 00 00 00 00 00 00 30 00 00 00 00 00 00 00
After this commit:
ufshcd_upiu: send_req: fe3b0000.ufs: HDR:01 20 00 1c 00 00 00 00 00 00 00 00, CDB:3b e1 00 00 00 00 00 00 30 00 00 00 00 00 00 00
ufshcd_upiu: complete_rsp: fe3b0000.ufs: HDR:21 00 00 1c 00 00 00 00 00 00 00 00, CDB:3b e1 00 00 00 00 00 00 30 00 00 00 00 00 00 00
Link: https://lore.kernel.org/r/20210531104308.391842-3-huobean@gmail.com
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 89ac2c3b28)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: I4c6a8c6575c5e19e8343af048bbbd578128788b3
Replace the check for DRIVER_SENSE with a check for
scsi_status_is_check_condition().
Audit all callsites to ensure the SAM status is set correctly. For
backwards compability move the DRIVER_SENSE definition to sg.h, and update
sg, bsg, and scsi_ioctl to set the DRIVER_SENSE driver_status whenever
SAM_STAT_CHECK_CONDITION is present.
[mkp: fix zeroday srp warning]
Link: https://lore.kernel.org/r/20210427083046.31620-10-hare@suse.de
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Change-Id: I05183efdcedfcc89fd694205b7f38d16fe5ad7d2
[ bvanassche: only modify the UFS driver ]
(cherry picked from commit 464a00c9e0)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Return the actual error code in __scsi_execute() (which, according to the
documentation, should have happened anyway). And audit all callers to cope
with negative return values from __scsi_execute() and friends.
[mkp: resolve conflict and return bool]
Link: https://lore.kernel.org/r/20210427083046.31620-7-hare@suse.de
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Change-Id: I8c5cc74bbbb0f7d616f36af6db6affbbd00c4ee4
[ bvanassche: only modify the UFS driver ]
(cherry picked from commit ced202f7bd)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
From ufshcd_transfer_req_compl():
Resetting interrupt aggregation counters first and reading the
DOOR_BELL afterward allows us to handle all the completed requests. In
order to prevent other interrupts starvation the DB is read once after
reset. The down side of this solution is the possibility of false
interrupt if device completes another request after resetting
aggregation and before reading the DB.
Prevent that ufshcd_intr() reports a false positive "Unhandled interrupt"
message if the above scenario is triggered.
Link: https://lore.kernel.org/r/20210519202058.12634-2-bvanassche@acm.org
Cc: Stanley Chu <stanley.chu@mediatek.com>
Cc: Can Guo <cang@codeaurora.org>
Cc: Bean Huo <beanhuo@micron.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Asutosh Das <asutoshd@codeaurora.org>
Suggested-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 40d2fd05ec)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: Icda80ad1e321b1053eb4e00a42285f577a5acd20
Don't populate the const array granularity_tbl on the stack but instead
make it static. Makes the object code smaller by 190 bytes:
Before:
text data bss dec hex filename
25563 6908 0 32471 7ed7 ./drivers/scsi/ufs/ufs-exynos.o
After:
text data bss dec hex filename
25213 7068 0 32281 7e19 ./drivers/scsi/ufs/ufs-exynos.o
(gcc version 10.3.0)
Link: https://lore.kernel.org/r/20210505190104.70112-1-colin.king@canonical.com
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 5ac3c649f1)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: Ie9b8b6a72d28ff3405dc03ca242ab5eb09dd8427
In the Linux kernel definitions of data structures should occur in .c
files. Hence move the exynos7_uic_attr definition from a .h into a .c
file. Additionally, declare exynos_ufs_drvs static. This patch fixes the
following two sparse warnings:
drivers/scsi/ufs/ufs-exynos.h:248:28: warning: symbol 'exynos_ufs_drvs' was not declared. Should it be static?
drivers/scsi/ufs/ufs-exynos.h:250:28: warning: symbol 'exynos7_uic_attr' was not declared. Should it be static?
Link: https://lore.kernel.org/r/20210509213817.4348-1-bvanassche@acm.org
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Kiwoong Kim <kwmad.kim@samsung.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit b592d66235)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: Ib0969ddff36ecae04e0917ae74ba73124eebf632
During runtime-suspend of ufs host, the SCSI devices are already suspended
and so are the queues associated with them. However, the ufs host sends SSU
(START_STOP_UNIT) to the wlun during runtime-suspend.
During the process blk_queue_enter() checks if the queue is not in suspended
state. If so, it waits for the queue to resume, and never comes out of
it. Commit 52abca64fd ("scsi: block: Do not accept any requests while
suspended") adds the check to see if the queue is in suspended state in
blk_queue_enter().
Call trace:
__switch_to+0x174/0x2c4
__schedule+0x478/0x764
schedule+0x9c/0xe0
blk_queue_enter+0x158/0x228
blk_mq_alloc_request+0x40/0xa4
blk_get_request+0x2c/0x70
__scsi_execute+0x60/0x1c4
ufshcd_set_dev_pwr_mode+0x124/0x1e4
ufshcd_suspend+0x208/0x83c
ufshcd_runtime_suspend+0x40/0x154
ufshcd_pltfrm_runtime_suspend+0x14/0x20
pm_generic_runtime_suspend+0x28/0x3c
__rpm_callback+0x80/0x2a4
rpm_suspend+0x308/0x614
rpm_idle+0x158/0x228
pm_runtime_work+0x84/0xac
process_one_work+0x1f0/0x470
worker_thread+0x26c/0x4c8
kthread+0x13c/0x320
ret_from_fork+0x10/0x18
Fix this by registering ufs device wlun as a SCSI driver and registering it
for block runtime-pm. Also make this a supplier for all other LUNs. This
way the wlun device suspends after all the consumers and resumes after HBA
resumes. This also registers a new SCSI driver for rpmb wlun. This new
driver is mostly used to clear rpmb uac.
[mkp: resolve merge conflict with 5.13-rc1 and fix doc warning]
Fixed smatch warnings:
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/4662c462e79e3e7f541f54f88f8993f421026d83.1619223249.git.asutoshd@codeaurora.org
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Co-developed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit b294ff3e34)
Bug: 204438323
Change-Id: Idacf4d4531d794093a7a2152fad5e671b0268f98
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Fix the following out-of-bounds warnings by enclosing some structure
members into new structure objects upiu_req and upiu_rsp:
include/linux/fortify-string.h:20:29: warning: '__builtin_memcpy' offset [29, 48] from the object at 'treq' is out of the bounds of referenced subobject 'req_header' with type 'struct utp_upiu_header' at offset 16 [-Warray-bounds]
include/linux/fortify-string.h:20:29: warning: '__builtin_memcpy' offset [61, 80] from the object at 'treq' is out of the bounds of referenced subobject 'rsp_header' with type 'struct utp_upiu_header' at offset 48 [-Warray-bounds]
arch/m68k/include/asm/string.h:72:25: warning: '__builtin_memcpy' offset [29, 48] from the object at 'treq' is out of the bounds of referenced subobject 'req_header' with type 'struct utp_upiu_header' at offset 16 [-Warray-bounds]
arch/m68k/include/asm/string.h:72:25: warning: '__builtin_memcpy' offset [61, 80] from the object at 'treq' is out of the bounds of referenced subobject 'rsp_header' with type 'struct utp_upiu_header' at offset 48 [-Warray-bounds]
Refactor the code by making it more structured.
The problem is that the original code is trying to copy data into a bunch
of struct members adjacent to each other in a single call to memcpy(). Now
that a new struct _upiu_req_ enclosing all those adjacent members is
introduced, memcpy() doesn't overrun the length of &treq.req_header,
because the address of the new struct object _upiu_req_ is used as the
destination, instead. The same problem is present when memcpy() overruns
the length of the source &treq.rsp_header; in this case the address of the
new struct object _upiu_rsp_ is used, instead.
Also, this helps with the ongoing efforts to enable -Warray-bounds and
avoid confusing the compiler.
Link: https://github.com/KSPP/linux/issues/109
Link: https://lore.kernel.org/lkml/60640558.lsAxiK6otPwTo9rv%25lkp@intel.com/
Link: https://lore.kernel.org/r/20210331224338.GA347171@embeddedor
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Build-tested-by: kernel test robot <lkp@intel.com>
(cherry picked from commit 1352eec8c0)
Bug: 204438323
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Change-Id: I3d49ddb96803bfdca9d19d33fb359bfd623ce41c
There are similar code implementations for WB configuration in
ufshcd_wb_{ctrl, toggle_flush_during_h8, toggle_flush}. Extract the common
parts to create a new helper with a flag parameter to reduce code
duplication.
Meanwhile, rename ufshcd_wb_ctrl() to ufshcd_wb_toggle() for better
readability. And remove unnecessary log messages from ufshcd_wb_config()
since relevant toggle function will emit messages. Also change
ufshcd_wb_toggle_flush{__during_h8} to void type accordingly.
Link: https://lore.kernel.org/r/20210318095536.2048-1-zbestahu@gmail.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Yue Hu <huyue2@yulong.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 3b5f3c0d05)
Bug: 204438323
Change-Id: Id496b92c8fb797f887beb4683412c59c9c4969aa
Signed-off-by: Bart Van Assche <bvanassche@google.com>
An enabled user-specified exception event that does not clear quickly will
repeatedly cause the handler to run. That could unduly disturb the driver
behaviour being tested or debugged. To prevent that add debugfs file
exception_event_rate_limit_ms. When a exception event happens, it is
disabled, and then after a period of time (default 20ms) the exception
event is enabled again.
Note that if the driver also has that exception event enabled, it will not
be disabled.
Link: https://lore.kernel.org/r/20210209062437.6954-5-adrian.hunter@intel.com
Acked-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 7deedfdaec)
Bug: 204438323
Change-Id: Ib660a69b6057d7d3b2b251671d3ff3b9f8d22ca4
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Allow users to enable specific exception events via debugfs.
The bits enabled by the driver ee_drv_ctrl are separated from the bits
enabled by the user ee_usr_ctrl. The control mask ee_mask_ctrl is the
logical-or of those two. A mutex is needed to ensure that the masks match
what was written to the device.
Link: https://lore.kernel.org/r/20210209062437.6954-4-adrian.hunter@intel.com
Acked-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit cd46947561)
Bug: 204438323
Change-Id: I80ae782813983c9637d09625b4e9501e854f1090
Signed-off-by: Bart Van Assche <bvanassche@google.com>
Currently, exception event status can be read from wExceptionEventStatus
attribute (sysfs file attributes/exception_event_status under the UFS host
controller device directory). Polling that attribute to track UFS exception
events is impractical, so add a tracepoint to track exception events for
testing and debugging purposes.
Note, by the time the exception event status is read, the exception event
may have cleared, so the value can be zero - see example below.
Note also, only enabled exception events can be reported. A subsequent
patch adds the ability for users to enable selected exception events via
debugfs.
Example with driver instrumented to enable all exception events:
# echo 1 > /sys/kernel/debug/tracing/events/ufs/ufshcd_exception_event/enable
... do some I/O ...
# cat /sys/kernel/debug/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 3/3 #P:5
#
# _-----=> irqs-off
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / delay
# TASK-PID CPU# |||| TIMESTAMP FUNCTION
# | | | |||| | |
kworker/2:2-173 [002] .... 731.486419: ufshcd_exception_event: 0000:00:12.5: status 0x0
kworker/2:2-173 [002] .... 732.608918: ufshcd_exception_event: 0000:00:12.5: status 0x4
kworker/2:2-173 [002] .... 732.609312: ufshcd_exception_event: 0000:00:12.5: status 0x4
Link: https://lore.kernel.org/r/20210209062437.6954-2-adrian.hunter@intel.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit f7733625ec)
Bug: 204438323
Change-Id: Iebc00a8d240713a2e58753c5f11382159172864b
Signed-off-by: Bart Van Assche <bvanassche@google.com>
