| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
|
|
Commit 4a2e5409472e ("ata: libata-sff: don't busy-wait for PIO data-in
command completion") allowed the interrupt handler to queue
ap->sff_pio_task from ata_sff_hsm_move() when a PIO data-in command is
still busy after its final data block.
ata_sff_flush_pio_task(), however, was written under the assumption that
cancel_delayed_work_sync() is enough to prevent sff_pio_task from being
queued again before the HSM state is reset to HSM_ST_IDLE and
sff_pio_task_link is cleared.
The flush runs early during error handling, at a point where the timed
out command is still active, the port is not frozen yet, and interrupts
are still being serviced. If the final data-block interrupt of a PIO
data-in command is serviced in the window between
cancel_delayed_work_sync() and the reset of hsm_task_state, the
interrupt handler queues sff_pio_task after the cancel has completed.
When that work item then executes on ata_sff_wq after the flush cleared
ap->sff_pio_task_link, ata_sff_pio_task() hits
BUG_ON(ap->sff_pio_task_link == NULL) while holding the host lock with
interrupts disabled; alternatively it proceeds on a stale link while
error handling owns the port.
Fix this by resetting hsm_task_state to HSM_ST_IDLE before cancelling
the work item. Once the state is IDLE, __ata_sff_port_intr() can no
longer enter ata_sff_hsm_move(), so the interrupt handler can no longer
queue the pio task, and cancel_delayed_work_sync() drains whatever was
queued before the reset.
Also make ata_sff_pio_task() bail out quietly when the HSM state was
marked idle by the flush, both at entry and after re-acquiring the port
lock following ata_msleep(), since a work item can already be running
when the flush resets the state.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-ide/sashiko-outbox-177477@kernel.org/
Fixes: 4a2e5409472e ("ata: libata-sff: don't busy-wait for PIO data-in command completion")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20261020101107.1449635-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
The libata.force parameter can force a transfer mode (pio0-6, mwdma0-4,
udma0-7) for a port or device. ata_force_xfermask() applies it in
ata_do_set_mode() right after ata_dev_xfermask() has limited the device
masks to what the host supports. It replaces those masks with the forced
mode without checking the host masks, so a mode the controller does not
support is passed to the driver's ->set_piomode() or ->set_dmamode().
Several PATA drivers rely on the host masks to keep the mode number in
range when indexing their timing tables. ata_piix, pata_efar,
pata_it8213, pata_oldpiix, pata_radisys and pata_rdc declare ATA_PIO4
and ATA_MWDMA12_ONLY, index a five-entry PIO timing table with
pio_mode - XFER_PIO_0, and index a three-entry needed_pio[] table with
dma_mode - XFER_MW_DMA_0. Booting with libata.force=pio5, pio6, mwdma3
or mwdma4 makes them read past those tables, use the values read as
further indices into the timing table, and write the result to the
controller's timing registers.
Make ata_force_xfermask() skip, with a warning, a forced transfer mode
that is not in the port's PIO, MWDMA or UDMA mask, and keep looking for
an earlier matching libata.force entry, as it already does for entries
that do not apply to the device. With libata.force=pio4,1.0:pio5 on a
PIO4 host, device 1.0 now gets pio4 instead of pio5. Forcing a mode the
host supports still works as before, including a mode that
ata_dev_xfermask() removed for the device or cable.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 332673257056 ("libata: implement libata.force module parameter")
Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20261015194935.1497-1-rand.sec96@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ahci_get_port_mask() returns zero for absent or unmatched parameters,
overwriting the mask set by the Marvell PATA quirk.
Update the mask in place only when parsing a global value or a matching
device entry. Leave the mask unchanged on parsing errors.
Fixes: 70c1595c181c ("ata: ahci: Allow ignoring the external/hotplug capability of ports")
Suggested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: zhoumin <teczm@foxmail.com>
Link: https://lore.kernel.org/r/tencent_26064A115A53E4C6D00433C89E1894E2D808@qq.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ata_dev_quirks() uses the first entry in __ata_dev_quirks[] that
matches the device and ignores all later entries. Commit 38d431229bfb
("ata: libata: exclude FUA support for known buggy drives") appended
three ATA_QUIRK_NO_FUA entries to the end of the table, with model
patterns meant to cover whole product lines. Earlier entries already
match some or all of these drives, so NO_FUA is not always applied:
- "INTEL*SSDSC2CT*" never takes effect. Every model it matches also
matches the earlier "INTEL*SSD*" entry, so these drives only get
ATA_QUIRK_ZERO_AFTER_TRIM.
- "WDC*WD2500J*" does not take effect for "WDC WD2500JD-*" drives,
which match the earlier ATA_QUIRK_WD_BROKEN_LPM entry.
- "OCZ-VERTEX*" does not take effect for "OCZ-VERTEX" drives with
firmware "1.30", which match the earlier ATA_QUIRK_BROKEN_HPA entry.
Move the Intel entry in front of "INTEL*SSD*" and keep
ATA_QUIRK_ZERO_AFTER_TRIM in it, so these drives stay on the
ZERO_AFTER_TRIM whitelist. Add ATA_QUIRK_NO_FUA to the WD2500JD and
OCZ Vertex 1.30 entries. The quirks of all other drives are unchanged.
libata only uses FUA when it is enabled with libata.fua=1, so systems
using the default setting are not affected.
Fixes: 38d431229bfb ("ata: libata: exclude FUA support for known buggy drives")
Assisted-by: LLM
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20261013193915.174460-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ahci_do_softreset() disables FBS before resetting a device behind a port
multiplier, as required by AHCI 1.2 section 9.3.9, and re-enables it only
when that softreset succeeds. If it fails, for example because a
hot-plugged drive is still spinning up ("softreset failed (device not
ready)"), EH escalates to a hardreset of the PMP link, and nothing turns
FBS back on: only ahci_pmp_attach() does, which runs at the next boot.
The port keeps working with command-based switching until then.
Seen on a Marvell 88SE9235 (1b4b:9235) with Marvell 88SM9705 port
multipliers (1b4b:9705, in a Synology DX1222 expansion unit): after
hot-plugging a drive, the kernel logged "FBS is disabled" followed by
"softreset failed (device not ready)" and a PMP hardreset, and never
"FBS is enabled" again (twice, on two different ports).
At the end of ahci_error_handler(), re-enable FBS if a PMP is still
attached and FBS is supported but disabled.
Fixes: 89dafa20f3da ("ahci: disabled FBS prior to issuing software reset")
Assisted-by: LLM
Signed-off-by: Kyrylo Biryuk <illofspeed@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20261012103917.389-1-illofspeed@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Enable the SoC SATA LED controller in mv_soc_enable_leds().
Set the LED controller enable and device presence multiplexing bits
in the SoC SATA host-controller register. This enables SATA device
presence indication on boards using the SoC SATA controller.
Signed-off-by: Carlos Junior <cjuniorfox@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260928133040.222155-1-cjuniorfox@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Since commit 2e1d2e65e773 ("ata: libata-scsi: terminate deferred commands
on time out"), atapi_qc_complete() sets SAM_STAT_CHECK_CONDITION for a
failed command only if cmd->result is zero, so that the DID_TIME_OUT or
DID_REQUEUE host byte of a terminated command is preserved.
However, cmd->result can also be non-zero for a regular failed ATAPI
command completed through libata EH: ata_eh_analyze_tf() calls
ata_eh_decide_disposition(), that is, scsi_check_sense(), on the sense
data obtained with REQUEST SENSE, and scsi_check_sense() sets the SCSI
midlayer internal byte of the result for some sense codes, e.g.
SCSIML_STAT_TGT_FAILURE for ILLEGAL REQUEST with ASC 0x20 (INVALID
COMMAND OPERATION CODE) or 0x24 (INVALID FIELD IN CDB), or
SCSIML_STAT_MED_ERROR for MEDIUM ERROR with ASC 0x11 (UNRECOVERED READ
ERROR). For such commands, atapi_qc_complete() keeps the result as is and
the command completes with a GOOD status byte, even though it failed and
valid sense data is available.
As a result, passthrough users see these failed ATAPI commands as
successful. For example, with the emulated IDE CD-ROM drive of QEMU and
no medium loaded, a PLAY AUDIO MSF command issued with SG_IO completes
with status 0x00 (and no DRIVER_SENSE) instead of 0x02 (CHECK CONDITION)
with sense key ILLEGAL REQUEST, ASC/ASCQ 0x20/0x00, and the CDROM ioctls
CDROMPLAYTRKIND, CDROMSUBCHNL, CDROMPAUSE, CDROMRESUME, CDROMPLAYMSF and
CDROM_GET_MCN return 0 instead of -ENOMEDIUM or -EOPNOTSUPP.
Fix this by setting the status byte to SAM_STAT_CHECK_CONDITION whenever
the host byte is not set. Use set_status_byte() rather than overwriting
the whole result, so that the SCSI midlayer internal byte set by
scsi_check_sense() is preserved, as ata_scsi_qc_complete() already does
for ATA commands.
Fixes: 2e1d2e65e773 ("ata: libata-scsi: terminate deferred commands on time out")
Cc: stable@vger.kernel.org
Suggested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260929164135.266708-1-hengyul@cs.unc.edu
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
This reverts commit 105c42566a550e2d05fc14f763216a8765ee5d0e.
The 32-bit quirk was incorrectly applied to JMicron JMicron JMB582/JMB585,
but it turns out that the root cause was actually a problem with BIOS
configuration of PCIe root ports, enabling a features that causes problems
with 64-bit DMA.
This problem has now been fixed in commit 4fde44822512 ("x86/PCI: Disable
enhanced atomics on AMD NBIO 7.7 and 7.11").
Since the real root cause has now been fixed, we can revert this incorrect
quirk.
Cc: Arthur Husband <artmoty@gmail.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20260908190600.226485-3-mario.limonciello@amd.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
buffer holds the device's REQUEST SENSE reply, and
ata_scsi_set_passthru_sense_fields() trusts its additional length
byte, sb[7], when adding the ATA Status Return descriptor. A faulty
or malicious device can use that to make the kernel read and write
past the 96-byte buffer in three ways:
- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
its clamp against sb[7] does nothing and the walk runs off the end.
- A type-9 descriptor found near the end is filled in unchecked.
- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
so len 75..82 writes up to 8 bytes past the end.
Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
reply patched:
BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50
Both are gone with this patch, and a valid descriptor is still filled
in.
Fixes: 97981926224a ("ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Link: https://lore.kernel.org/r/20260923175203.1576825-1-matthias.goergens@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Merge Linux 7.3-rc2 to resolve libata and mpi3mr merge conflicts.
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Conflicts:
drivers/ata/libata-scsi.c
drivers/scsi/mpi3mr/mpi3mr_transport.c
|
|
idr_alloc() expects an inclusive start and an exclusive end, so passing
port->number as both arguments produces an empty range. Because
idr_alloc() only falls back to INT_MAX when end <= 0, the allocation
succeeds solely for parport0 and returns -ENOSPC for every other port,
which pata_parport_attach() silently ignores. As a result only
parport0 gets probed and any higher-numbered parports are never
attached.
Use port->number + 1 as the end so the range [port->number,
port->number + 1) contains exactly the desired ID.
Fixes: 246a1c4c6b7f ("ata: pata_parport: add driver (PARIDE replacement)")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/cee1a15d98cd0d55f41fd65ca9d222b68a74e7d3.1790047457.git.xiaopei01@kylinos.cn
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
kmap_atomic() is deprecated in favour of kmap_local_page(), as described
in Documentation/mm/highmem.rst.
ata_pio_xfer() and __atapi_pio_bytes() each map a single page, pass the
address to ->sff_data_xfer() for one transfer and unmap it again, so the
mapping never leaves the function that created it.
Neither needs the pagefault_disable() and preempt_disable() implied by
kmap_atomic(). ->sff_data_xfer() only moves data between the device and
the mapped buffer, and both functions are reached only through
ata_sff_hsm_move() with the host lock held, whether from the PIO task,
an interrupt handler or EH. kmap_local_page() is fine in all of these.
Assisted-by: LLM sparse
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260921182448.194307-1-danishkhateeb03@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
A Samsung SSD 870 QVO 8TB connected to an AMD 600 Series chipset SATA
controller is reported to time out on STANDBY IMMEDIATE during system
suspend with med_power_with_dipm enabled. The command completes when
using max_performance instead.
The existing Samsung LPM quirk only matches ATI controllers, leaving
AMD controllers unaffected. Rename it to
ATA_QUIRK_NO_LPM_ON_ATI_AND_AMD and extend the vendor check to AMD for
the same Samsung SSD model patterns. Keep LPM behavior unchanged for
other controller vendors, including Intel.
Leave ATA_QUIRK_NO_NCQ_ON_ATI restricted to ATI, since the reported AMD
issue concerns LPM rather than NCQ.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221986
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
Link: https://lore.kernel.org/r/20260918124030.1962773-5-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
When an ATA_12, ATA_16, or ATA_32 pass-through command with a
multi-sector PIO command opcode (ATA_CMD_READ_MULTI,
ATA_CMD_WRITE_MULTI, ATA_CMD_READ_MULTI_EXT, ATA_CMD_WRITE_MULTI_EXT, or
ATA_CMD_WRITE_MULTI_FUA_EXT) is submitted via SG_IO on a device where
multiple-sector mode is not configured (dev->multi_count == 0),
ata_scsi_pass_thru() currently logs a warning and still dispatches the
taskfile. When the DRQ interrupt fires, ata_pio_sectors() triggers
WARN_ON_ONCE(qc->dev->multi_count == 0) and computes
nsect = min((qc->nbytes - qc->curbytes) / qc->sect_size, 0) = 0, failing
to transfer any sectors:
ata1.00: invalid multi_count 1 ignored
WARNING: drivers/ata/libata-sff.c:666 at ata_pio_sectors+0x27d/0x300
Call Trace:
<IRQ>
ata_sff_hsm_move+0x211/0x22e0
__ata_sff_port_intr+0x1c8/0x520
ata_bmdma_port_intr+0xa1/0x5b0
ata_bmdma_interrupt+0x1f5/0x550
Per ACS-3 section 7.12.7.21, if IDENTIFY DEVICE word 59 bit 8 is cleared
to zero (multi_count == 0) and a READ MULTIPLE or WRITE MULTIPLE command
is received without a preceding successful SET MULTIPLE MODE command, the
device returns command aborted (ABRT). Per the SAT specification, an ABRT
error translates to the ABORTED COMMAND sense key with NO ADDITIONAL SENSE
INFORMATION (0x00, 0x00).
Fail multi-sector taskfile commands in ata_scsi_pass_thru() with
ata_scsi_set_sense(dev, scmd, ABORTED_COMMAND, 0, 0) when
dev->multi_count == 0.
Fixes: 1dce589c38c3 ("libata passthru: support PIO multi commands")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260921032556.1160734-1-benquike@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
DMA engine consumers must not call the channel's callback function pointers
directly. Use the standard dmaengine wrapper APIs instead.
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260917190315.1188379-1-Frank.Li@oss.nxp.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Recent 4bbc16a353a9 commit changed the timing when interrupts are
enabled. However it didn't account for the libATA registration step. So
it's possible that interrupts are enabled when the device is not
registered with libATA core.
Resolve the issue by failing the entire registration process in case of
failure to register with libATA.
Fixes: 4bbc16a353a9 ("ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered")
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
Link: https://lore.kernel.org/r/20260917150707.1643330-1-nik.borisov@suse.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Damien Le Moal <dlemoal@kernel.org> says:
This patch series defines as macros all ASC/ASCQ combinations present in
https://www.t10.org/lists/asc-num.txt and converts the SCSI core code and
SCSI low level drivers to use these macros instead of hard-coded
ASC/ASCQs. To do this, struct scsi_sense_hdr and struct scsi_failure are
modified to replace the asc and ascq 8-bits fields with a 16-bits
sense_code field.
This cleans up the code in many places and makes it easier, and self
documented, to test sense codes in the case of errors.
Overall, there should be no functional chnages here.
Note: this series currently applies cleanly only to the scsi-staging tree.
It does not apply to Linus tree as commit 6d81700ad7c4 ("ata: libata-scsi:
do not raise UA for storage element depopulation and restoration") creates
a conflict with patch 37. The conflict is trivial to resolve, but this
will create a conflict in linux-next. Could you maybe rebase scsi-staging
on rc2 ?
Also please note that sashiko did comment about several pre-existing
issues for different drivers, but I am not addressing these issues in
this series.
[mkp: fixed ufs conflict]
Link: https://patch.msgid.link/20260908090308.1085097-1-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
|
|
Refactor libata core code to use the 16-bit sense_code field of struct
scsi_sense_hdr and replace all hard-coded additional sense codes and
additional sense code qualifiers with the enum values defined in
include/scsi/scsi_sense.h. This helps with code clarity as the sense codes
being processed are easier to test and self-documented.
No functional change intended.
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Acked-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260908090308.1085097-38-dlemoal@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
|
|
make htmldocs fails with:
Documentation/driver-api/libata:604: ./drivers/ata/libata-scsi.c:2301:
ERROR: Unexpected indentation. [docutils]
The Return: section of ata_dsm_trim_pages() ends its first sentence with
a colon and continues with an indented bullet list. reStructuredText
requires a blank line before an indented block, so docutils chokes on
the list.
Simply adding the missing blank line does not work either: Return: is a
kernel-doc "special section", which is terminated by the first blank
line, so the bullet list would end up in the Description section,
detached from the sentence introducing it.
Spell the two bounds out as prose instead, so that the Return: section
stays self-contained. Documentation-only change.
Fixes: e64e6b5dc867 ("ata: libata-scsi: scale DSM TRIM payload by MAX PAGES PER DSM COMMAND")
Reported-by: Thomas Huth <thuth@redhat.com>
Closes: https://lore.kernel.org/linux-ide/b0a0b8e8-cc4f-4c7b-8bc5-fee0712d405a@redhat.com/
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/r/20260916130031.29990-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ahci_platform_get_resources()
of_find_device_by_node() takes a reference on the port platform device,
which is only used to look up its port regulator and is never released,
neither on success nor on the error paths. Drop the reference with
put_device() once the regulator has been obtained, which covers both the
success and error paths.
Fixes: c7d7ddee7e24 ("ata: libahci: Allow using multiple regulators")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/r/20260915065933.1733061-1-vulab@iscas.ac.cn
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ata_host_register() does not start the ports of the host, it requires
them to have been started already:
/* host must have been started */
if (!(host->flags & ATA_HOST_STARTED)) {
dev_err(host->dev, "BUG: trying to register unstarted host\n");
WARN_ON(1);
return -EINVAL;
}
Fix the kdoc accordingly, and fix the grammar of the last sentence while
at it.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-14-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ata_host_start() registers ata_host_stop() as a devres action as soon as
it has succeeded, which hands the release of the host resources over to
devres: ->port_stop() and ->host_stop() are then called by the driver
core when probe() fails.
ata_host_activate() and ahci_host_activate_multi_irqs() can both fail
after ata_host_start() has succeeded, e.g. if devm_request_irq() or
ata_host_register() fails, and they return the error with the devres
action still registered. A driver which releases the host resources in
its probe() error path therefore releases them twice: once itself and
once through ->host_stop().
All ahci-platform drivers are in that situation, e.g. ahci_probe() calls
ahci_platform_disable_resources() while ahci_host_stop() does the same
through devres. This gives refcount underflow warnings from the clk,
regulator and phy cores and, for shared resources, can disable resources
which are still in use by other devices.
Add ata_host_undo_start(), which stops the ports and drops the devres
action without calling ->host_stop(), and call it from both activation
helpers when they fail. Releasing the host resources on failure is then
always left to the caller, which is what all callers having a probe()
error path already assume.
This changes the semantics for the drivers which implement ->host_stop()
while also completely lacking error handling for the activate host call.
Add activate host error handling for sata_qstor and sata_fsl. For
sata_fsl this also means that hcr_base and host_priv are now released
when activating the host fails, which ->host_stop() did not do when
ata_host_start() itself failed.
Note that ata_pci_sff_activate_host() is deliberately left as is: none of
its callers releases the host resources in its probe() error path, they
all rely on ->host_stop() being called by devres, including
ata_pci_init_one(), which releases the devres group of the host itself.
Fixes: 1896b15eddb4 ("ahci_platform: perform platform exit in host_stop() hook")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-13-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ahci_host_activate_multi_irqs() requests one IRQ per port, but it does
not free them when requesting one of them, or when registering the host,
fails. The IRQs are only freed by the driver core, when it releases the
devres of the device after probe() has returned, while the caller of
ahci_host_activate() releases the resources of the host in its probe()
error path, e.g. ahci_probe() disables the clocks, regulators, resets and
PHYs of the host. An IRQ handler running in that window would access the
MMIO of a host which is no longer clocked.
ahci_host_activate_multi_irqs() did free the IRQs until commit
0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs"), which
removed the explicit free because devm makes it unnecessary. That is true
for freeing the IRQs as such, but not for the window described above:
devres is only released after probe() has returned, i.e. after the error
path of the caller has released the resources of the host.
Note that this window cannot be hit with the current users: the only user
of AHCI_HFLAG_MULTI_MSI is the AHCI PCI driver, which does not release
any resource in its probe() error path, and the ports of the host are
still frozen, i.e. their interrupts are masked, when ata_host_register()
fails.
Free the IRQs explicitly again, like ata_host_activate() does, so that
the IRQ handlers cannot run once ahci_host_activate() has failed.
Fixes: 0a142b26921c ("ahci: cleanup ahci_host_activate_multi_irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-12-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
sata_fsl_host_stop() releases hcr_base and host_priv:
static void sata_fsl_host_stop(struct ata_host *host)
{
struct sata_fsl_host_priv *host_priv = host->private_data;
iounmap(host_priv->hcr_base);
kfree(host_priv);
}
->host_stop() is called by the driver core through the ata_host_stop()
devres action which ata_host_start() registers, so it is called both when
the device is unbound and when probe() fails after the host has been
started.
The error_exit_with_cleanup label of sata_fsl_probe() releases hcr_base
and host_priv as well, and it is reachable from the two
device_create_file() calls which are done after the host has been
activated. In that case sata_fsl_host_stop() runs on an already freed
host_priv, resulting in a use-after-free and a double iounmap()/kfree().
Add a separate error label for the failures happening after the host has
been activated, which only detaches the host and leaves hcr_base and
host_priv to sata_fsl_host_stop().
Note that ata_host_detach() is dropped from error_exit_with_cleanup, as
that label is now only reachable while host is still NULL.
Fixes: 6c8ad7e8cf29 ("sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-11-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
st_ahci_probe_resets() deasserts the "pwr-dwn" reset, but the probe()
error path of st_ahci_probe() only releases the host resources, so the
SATA IP is left powered up when probe() fails after
st_ahci_probe_resets() has succeeded, e.g. when
ahci_platform_enable_resources() fails.
The reset is asserted by st_ahci_host_stop(), however ->host_stop() is
only called through the ata_host_stop() devres action registered by
ata_host_start(), so it does not cover any failure happening before the
host has been started.
Factor the assert out into st_ahci_assert_pwrdwn() and call it when
either ahci_platform_enable_resources() or ahci_platform_init_host()
fails. The "pwr-dwn" reset control is an exclusive one, so asserting it
once more from st_ahci_host_stop() is harmless.
No functional change intended for ->host_stop() and st_ahci_suspend().
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-10-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
st_ahci_probe_resets() treats any error from devm_reset_control_get() as
"reset control not defined" and continues with a NULL reset control:
drv_data->pwr = devm_reset_control_get(dev, "pwr-dwn");
if (IS_ERR(drv_data->pwr)) {
dev_info(dev, "power reset control not defined\n");
drv_data->pwr = NULL;
}
This also swallows -EPROBE_DEFER, which is returned when the reset
controller providing the reset has not been probed yet. probe() then
continues as if the device tree did not specify any reset, so the resets
of the SATA IP are never deasserted, and st_ahci_configure_oob() and
ahci_platform_init_host() access the MMIO of an IP which is still held in
reset and powered down, which can result in an external abort.
The resets are optional in the binding, as they are not part of its
required properties, so use devm_reset_control_get_optional(), which
returns NULL if the reset is not specified in the device tree, and
propagate all other errors.
Note that an absent reset is now indicated by a NULL reset control
instead of an error, so the "reset control not defined" messages are
dropped.
Fixes: 76884cb2f7da ("ahci: st: Add support for ST's SATA IP")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-9-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for
JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board.
The failure is seen as soon as the ahci driver is probed, and booting with
iommu=off does not solve the problem.
Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0'
for HBAs that do not support 64-bit addressing.
For HBAs that do support 64-bit addressing, the registers are read write,
with a reset value that is Implementation Specific.
When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit
addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64.
Thus, in this case, we need to explicitly clear the registers to 0.
Fixes: 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585")
Fixes: c7a42156d99b ("ahci: disable 64bit dma on sb600")
Cc: stable@vger.kernel.org
Reported-by: Roland Waltersson <roland.waltersson@netinsight.net>
Closes: https://lore.kernel.org/linux-ide/IA0PR17MB668730A4ECCD65F7A1DC3EDC9EB62@IA0PR17MB6687.namprd17.prod.outlook.com/
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260904134310.1465051-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
The sata_inic162x driver was labeled as "very experimental" in
commit bb9696192826 ("libata: make it clear that sata_inic162x is
experimental") due to data corruption issues, but not marked as broken.
Since then, no changes have been made to it that could fix these
issues. Since the driver was not marked as broken, and the message
about potential data corruption is only visible in the code and dmesg,
it is possible that someone could enable the driver without realizing
its potential for data corruption. Remove the driver to protect users'
data.
Fixes: 1fd7a697a37b ("sata_inic162x: finally, driver for initio 162x SATA controllers, take #2")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915014714.41274-1-enelsonmoore@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
The ata_scsi_remove_dev() comment misspells its caller as
ata_eh_scsi_hotplug(). The caller is ata_scsi_hotplug(). Correct the
reference, which predates libata's move from drivers/scsi to
drivers/ata.
Fixes: 580b2102327a ("[PATCH] libata-hp: implement SCSI part of hotplug")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260912101215.86413-1-kmehltretter@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Replace the deprecated SIMPLE_DEV_PM_OPS macro with the recommended
DEFINE_SIMPLE_DEV_PM_OPS. Use pm_ptr(&ahci_da850_pm_ops) to complete
the API migration and allow the structure to be correctly dropped
when CONFIG_PM_SLEEP=n.
Signed-off-by: Li Jun <lijun01@kylinos.cn>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260908094901.2527974-1-lijun01@kylinos.cn
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
restoration
The libata command completion for the ATA commands REMOVE ELEMENT AND
TRUNCATE and RESTORE ELEMENTS AND REBUILD is handled using the function
ata_scsi_depop_ua_cap_changed_complete(). This completion function raises
a UNIT ATTENTION with the additional sense code CAPACITY DATA HAS CHANGED.
But doing so, the scsi layer seeing the UNIT ATTENTION sense key ends up
failing the command, even if the command result is in fact OK.
The SAT specifications do provide more details about the capacity change
should be notified, and that relies on the ACCESSIBLE CAPACITY field of
the IDENTIFY DATA retrieved before or after the command is issued, and
then raising a UNIT ATTENTION if the capacity has really changed. However,
we do not have any simple mean to raise a unit attention from libata-scsi.
So rather than seeing the REMOVE ELEMENT AND TRUNCATE and RESTORE ELEMENTS
AND REBUILD commands failing, remove the function
ata_scsi_depop_ua_cap_changed_complete() and rely on the regular
completion callback. Since for now these commands can only be issued as
passthrough commands, the user is responsible for revalidating the device
capacity after executing these commands.
Fixes: db496721cb0d ("ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command")
Fixes: 1e307ca61a9c ("ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command")
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260902020828.1436048-1-dlemoal@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
ahci_single_level_irq_intr() services the ports first and clears the
global HOST_IRQ_STAT afterwards, as recommended by AHCI 1.1 section
10.6.2. The Marvell 88SE6111/6121/6145 family stops reporting interrupts
for a port when HOST_IRQ_STAT is cleared while PxIS still holds bits:
PxIS keeps its content, HOST_IRQ_STAT reads back as 0, the port is never
looked at again, and the command in flight only ends in a timeout.
Measured on a Seagate Blackarmor NAS440 (Marvell 88F6281 Kirkwood,
88SE6121 rev B2 behind PCIe) by polling the AHCI registers from userspace
while an IDENTIFY was outstanding:
t=303.046 irqs 127 PxIS 0x00000000 PxCI 0x00000001
IDENTIFY issued
t=303.057 irqs 128 PxIS 0x00000020 PxCI 0x00000000
CI cleared, DPS set, one interrupt taken
... PxIS stays 0x00000020, HOST_IRQ_STAT stays 0 ...
t~308.05 qc timeout after 5000 msecs
The command had completed - PxCI was clear and PxIS had DPS set - so
ahci_qc_complete() would have completed it. It never got the chance
because the handler read HOST_IRQ_STAT as 0 and returned IRQ_NONE.
Marvell's own driver for these chips clears the two registers in the
opposite order and says so ("clear global before channel"), and
ahci_xgene handles its broken edge latch the same way. Since the
reordering costs at most one spurious interrupt per valid one on
conforming controllers, do it in a private interrupt handler selected for
board_ahci_mv instead of changing libahci for everyone.
With this applied, SATA-2 and SATA-3 disks work at 3.0 Gbps on the
88SE6121 without the drive-side 1.5 Gbps jumper that was needed before.
Time from link up to a successful IDENTIFY:
WDC WD5000AADS-00S9B0 port 0 7 ms (never identified before)
WDC WD3202ABYS-01B7A0 port 1 28 ms
WDC WD30EFRX-68EUZN0 port 1 200 ms (3 TB, HPA detection ok)
Only the 88SE6121 was tested; board_ahci_mv also covers the 88SE6145,
which Marvell's driver treats identically.
Fixes: cd70c26617f4 ("[libata] AHCI: Add support for Marvell AHCI-like chips (initially 6145)")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-ide/db6b48b7-d69a-564b-24f0-75fbd6a9e543@noerenberg.de/
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216094
Signed-off-by: Hajo Noerenberg <hajo-linux-ide@noerenberg.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Acked-by: Pali Rohar <pali@kernel.org>
Link: https://lore.kernel.org/r/20260831124303.920391-1-hajo-linux-ide@noerenberg.de
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Back in the 2.6.xx days, it was possible to for low-level drivers to set
the shost lock pointer. That is why there is a default lock and a
pointer to the shost lock.
However, support for this has long been removed, so drop
Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock.
Getting the address of embedded host_lock structure just requires adding
a fixed offset value to the shost pointer. However, getting the value of
the host_lock pointer requires loading from a fixed offset to the shost
pointer. The latter should be very slightly slower, which is relevant as
this lock is used a lot throughout the core code and drivers.
Signed-off-by: John Garry <john.garry@linux.dev>
Acked-by: Damien Le Moal <dlemoal@kernel.org> # ata parts
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
|
|
The function new_device_store() calls driver_find() without any
protection against concurrent driver unregistration. This can lead
to a use-after-free (UAF) when a driver is unloaded (via rmmod)
in parallel with a new device addition via sysfs.
The race window exists because driver_find() returns a pointer to
the driver's private data, but does not increase its reference
count. The caller is responsible for ensuring the driver remains
valid, but new_device_store() did not hold any lock or reference
during the lookup and subsequent use.
Concurrently, pata_parport_unregister_driver() releases the
pi_mutex before calling driver_unregister(), allowing new_device_store
to proceed with a stale pointer after the driver has been freed.
Fix this by expanding the critical section protected by pi_mutex
in both functions:
- In new_device_store(): acquire pi_mutex before calling driver_find(),
and keep it held until all uses of the found driver pointer are
completed.
- In pata_parport_unregister_driver(): hold pi_mutex throughout the
entire unregistration process, including the driver_unregister()
call, so that no concurrent lookup can see a partially removed
driver.
Thread A (new_device_store) | Thread B (pata_parport_unregister_driver)
driver_find("ate") |
| mutex_lock(&pi_mutex)
| idr_remove(&protocols, id)
| mutex_unlock(&pi_mutex)
| driver_unregister(&pr->driver)
| (frees driver_private)
/* continues using stale driv */|
-> UAF! |
Logs:
BUG: KASAN: slab-use-after-free in driver_find+0xd0/0xd4
Read of size 8 at addr ffffff9f970dc690 by task sh/4737
Call trace:
show_stack+0x14/0x1c (C)
dump_stack_lvl+0x70/0x84
print_report+0xf4/0x5a4
kasan_report+0xa0/0xe4
__asan_report_load8_noabort+0x18/0x20
driver_find+0xd0/0xd4
new_device_store+0x140/0x30c [pata_parport]
bus_attr_store+0x5c/0x94
sysfs_kf_write+0x1c4/0x25c
...
Allocated by task 4734:
kasan_save_stack+0x28/0x4c
kasan_save_track+0x1c/0x34
kasan_save_alloc_info+0x3c/0x4c
__kasan_kmalloc+0x98/0xac
__kmalloc_cache_noprof+0x158/0x3cc
bus_add_driver+0x70/0x4d8
driver_register+0xf0/0x3b0
pata_parport_register_driver+0xb8/0x1c4 [pata_parport]
0xffffffc07f5ce014
do_one_initcall+0xb8/0x36c
do_init_module+0x230/0x6d4
...
Freed by task 4737:
kasan_save_stack+0x28/0x4c
kasan_save_track+0x1c/0x34
kasan_save_free_info+0x48/0x8c
__kasan_slab_free+0x5c/0x84
kfree+0x174/0x3e0
driver_release+0x1c/0x7c
kobject_put+0x178/0x47c
driver_find+0x78/0xd4
new_device_store+0x140/0x30c [pata_parport]
bus_attr_store+0x5c/0x94
sysfs_kf_write+0x1c4/0x25c
...
Fixes: 246a1c4c6b7f ("ata: pata_parport: add driver (PARIDE replacement)")
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/lkml/20260728024015.2014674-1-shuangpeng.kernel@gmail.com/
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/77dad1184ebd0e1e7ea541d4207568f8bc5ec01f.1785381141.git.xiaopei01@kylinos.cn
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
Driver for the on-board IDE interface on CS-Lab Warp Expansion Card
(NOTE that idemode=native has to be set in Warp Configuration)
Assisted-by: Claude_Code:claude-opus-5
Signed-off-by: Paolo Pisati <p.pisati@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260826160911.460165-2-p.pisati@gmail.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
It appears that libahci.c, ahci.c as well as the ahci_brcm, ahci_ceva
and ahci_qoriq drivers are using runtime PM operations without including
<linux/pm_runtime.h>. This header is somehow being indirectly provided
by <linux/phy/phy.h>, which would like to drop it (none of the functions
it exports need it).
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Acked-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260810132502.460566-1-vladimir.oltean@nxp.com
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
syzbot force-bound ata_generic to 0000:00:03.0 on a QEMU arm64 virt
machine. That device is a virtio-blk-pci device holding the root file
system, and it reports PCI class 0x010000, i.e. PCI_CLASS_STORAGE_SCSI.
QEMU gives the virtio-blk-pci device a legacy virtio I/O BAR0 and a 4 KiB
MSI-X BAR1, so both resources are non-empty, the port is not discarded,
and the device control register ends up in the middle of the MSI-X table.
The emulated device rejects the byte write, and arm64 reports the
resulting bus error as a fatal synchronous external abort:
Internal error: synchronous external abort: 0000000096000050 [#1] SMP
pc : ata_sff_freeze+0x7c/0x90 drivers/ata/libata-sff.c:1606
Call trace:
ata_sff_freeze+0x7c/0x90
ata_eh_freeze_port+0x34/0x5c
ata_host_start+0x13c/0x228
ata_pci_sff_activate_host+0x50/0x340
ata_pci_init_one+0x19c/0x1d8
ata_pci_bmdma_init_one+0x14/0x20
ata_generic_init_one+0xc4/0x1ac
local_pci_probe+0x40/0xa8
pci_device_probe+0xd8/0x288
really_probe+0xbc/0x2bc
device_driver_attach+0x48/0xb4
bind_store+0x7c/0xd8
Refuse devices which neither report the IDE class nor appear in our ID
table. Table entries keep binding as before, because some of the listed
controllers cannot be assumed to report the IDE class. A controller which
needs ata_generic but does not report the IDE class should get an ID table
entry, which is what the table is for.
Binding a driver to unrelated hardware requires root and is what
driver_override is meant to do, so this does not fix a privilege boundary.
This change only stops ata_generic from binding to a PCI device which it
has no reason to believe to be an IDE controller.
Reported-by: syzbot+891c7b195b408052e519@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-ide/6a82bc54.10853dc7.22f513.001b.GAE@google.com/
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260818094205.2672967-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI updates from Bjorn Helgaas:
"Resource management:
- Add hotplug reservation only once (not at each level of the
hierarchy) so bridge windows don't grow more than necessary (Ilpo
Järvinen)
Driver binding:
- Rework device matching so device ID lifetime only needs to cover
the probe path since dynamic IDs can be removed at any time (Gary
Guo)
Error handling:
- Update mappings of AER errors to agent & layer and log them for
each individual error when multiple errors detected (Lukas Wunner)
- Log Error Source only once, not twice in separate messages (Lukas
Wunner)
- Emit TLP Log only for unmasked errors (Lukas Wunner)
- Support Advisory Non-Fatal Errors (Lukas Wunner)
- Allow DPC on all Downstream Ports, not just Root Ports, when OS
controls AER (Darshit Shah)
ASPM:
- Program the same ASPM Control values for every function of
multi-function devices, as recommended by the PCIe spec (Krishna
Chaitanya Chundru)
- Avoid L0s for Realtek RTS525A, where it causes an AER interrupt
storm (Max Lee)
- Avoid ASPM L0s, L1, and L1 PM Substates based on 'aspm-no-l0s',
'aspm-no-l1' [1], and 'aspm-no-l1ss' DT properties (Krishna
Chaitanya Chundru)
Power management:
- Allow D3 for native hotplug-capable Root Ports on non-x86 platforms
(we avoid D3 for these ports on x86 because some old platforms
didn't validate it) (Manivannan Sadhasivam)
- Allow portdrv to claim Ports even if they don't support services
(AER, PME, DPC, hotplug, etc) so it can do power management (Brian
Norris)
Power control:
- Add support for PCIe WAKE# interrupt when described via DT (Krishna
Chaitanya Chundru)
- For the TC9563 PCIe switch:
- Take a reference on the I2C adapter to avoid uninterruptible
hang when unloading an I2C module while in-use (Johan Hovold)
- Update DT binding and driver to restrict Tx Amplitude, DFE and
N_FTS to USP, DSP1 and DSP2 (Manivannan Sadhasivam)
- Power off only external-facing ports (DSP1, DSP2), leaving USP
and DSP3 (aka VDSP) powered up (Manivannan Sadhasivam)
- Move integrated MAC Endpoint out of the list of internal ports
and configure it separately (Manivannan Sadhasivam)
Virtualization:
- Add ACS quirk for Pericom PI7C9X2G608 switches (Tim Harvey)
- Fix a long-standing bug in the Intel PCH Root Port MPC ACS quirk
that didn't update the intended INTEL_MPC_REG_IRBNCE bit because it
used a 16-bit config write when a 32-bit write was intended
(Mohamad Raizudeen)
Procfs:
- Avoid spurious runtime PM wakeup on config space accesses that are
outside config space and fail before reaching PCI (Krzysztof
Wilczyński)
- Warn on user-space writes to kernel-exclusive config space regions,
as we already do for sysfs (Krzysztof Wilczyński)
- Check credentials of opener, not reader, for config space reads, as
we already do for sysfs (Krzysztof Wilczyński)
Sysfs:
- In pci_write_legacy_io(), avoid out-of-bounds reads from the user
buffer and fix incorrect ioport write data (1-byte writes on
little-endian powerpc, 2- and 4-byte writes on big-endian powerpc)
(Krzysztof Wilczyński)
- In pci_read_legacy_io(), fix incorrect ioport read data for 2- and
4-byte reads on big-endian powerpc (Krzysztof Wilczyński)
- Fix I/O port accessor argument order in Alpha pci_legacy_write()
(Krzysztof Wilczyński)
- Avoid spurious runtime PM wakeup on config space accesses that are
outside config space and fail before reaching PCI (Krzysztof
Wilczyński)
- Return -EINVAL, not -ENODEV, for mmap of I/O BAR that fails because
the arch doesn't support it, as we do for procfs (Krzysztof
Wilczyński)
- Check for LOCKDOWN_PCI_ACCESS for legacy_io and legacy_mem, as we
do for other config space accessors (Krzysztof Wilczyński)
Peer-to-peer DMA:
- Add Nvidia Vera Rubin to list of platforms that support P2PDMA
(Leon Romanovsky)
Endpoint framework:
- Check doorbell SUCCESS bit in pci_endpoint_test to avoid treating
some failures as successes (Niklas Cassel)
- Fail doorbell test when the trigger IRQ is missed (Niklas Cassel)
New native PCIe controller drivers:
- Add DT binding and driver for NVIDIA Tegra264 (Thierry Reding)
Native PCIe controllers:
- Use common wait time definitions for PCIe link monitoring instead
of defining driver-private duplicates (Thierry Reding)
Generic host bridge driver:
- Fix NULL pointer dereference that caused enumeration failures on
32-bit CAM systems (Steffen Persvold)
Amlogic Meson PCIe controller driver:
- Correct the PERST# GPIO state so it remains asserted until power
and REFCLK become stable to fix enumeration failure (Ronald
Claveau)
ASPEED PCIe controller driver:
- Switch to irq_domain_create_linear() so we can obsolete
irq_domain_add_linear() (Jiri Slaby)
Cadence PCIe controller driver:
- Add MODULE_DEVICE_TABLE to generate module aliases for OF-based
module autoloading (Pengpeng Hou)
- Add debugfs 'ltssm_status' file for LGA- and HPA-based Cadence
controllers (Hans Zhang)
- Support up to x4 (not x2) lanes for J200 (Takuma Fujiwara)
- Fix host/endpoint dependencies for cadence-plat driver to fix link
error when cadence-plat is built-in but the host or endpoint driver
is modular (Aksh Garg)
Freescale i.MX6 PCIe controller driver:
- Add imx6 intr/aer/pme interrupt lines for i.MX95 (Richard Zhu)
- Remove PERST# checking from pci_host_common_parse_port() so callers
can decide whether to fall back to legacy DT binding with PERST# in
the host bridge (Sherry Sun)
- Fix build issues when PCI_PWRCTRL_GENERIC or PCI_HOST_COMMON is a
module (Arnd Bergmann)
- Create pwrctrl devices only once by doing it from imx_pcie_probe()
instead of imx_pcie_host_init(), which is used during both probe
and resume (Sherry Sun)
- Use 'dw_pcie_rp->skip_pwrctrl_off' to avoid powering off devices
during suspend to preserve wakeup capability (Sherry Sun)
- Add runtime PM support for i.MX95 to allow dynamic power management
when the link is idle (Richard Zhu)
Intel VMD host bridge driver:
- Support device ID 0x28C1 and assume that BIOS has already
enumerated the hierarchy below VMD and stored bus range info for OS
to use (Nirmal Patel)
- Add support for VMCONFIG BUS_RESTRICT_CFG=3, which makes it
possible to enumerate downstream devices on Intel Arrow Lake-HX
systems and probably others (Ali Alaei)
- Pay attention to _OSC negotiation for VMD hierarchy only when
running on bare metal, not when running in a VM (Nirmal Patel)
- Add Nova Lake (NVL) and Dunlow (DNL) Device IDs (Szymon Durawa)
MediaTek PCIe controller driver:
- Add support for PCIe controller in EcoNet EN7528 and EN751221 SoCs
(Caleb James DeLisle)
MediaTek PCIe Gen3 controller driver:
- Add mediatek-gen3 'memory-region' for restricted DMA buffer
(Chen-Yu Tsai)
NVIDIA Tegra264 PCIe controller driver:
- Distinguish Tegra264 C0 PCIe controller for internal GPU from C1-C5
controllers so the unit address matches the first 'reg' entry
(Thierry Reding)
- Add Tegra264 Root Port stanzas to prepare for generic WAKE#
handling (Thierry Reding)
Qualcomm PCIe controller driver:
- Add IPQ9650 compatible with global interrupt (Kathiravan
Thirumoorthy)
- Add IPQ5210 compatible with IPQ9574 fallback (Varadarajan
Narayanan)
- Add DT binding and driver support for Hawi SoC (Matthew Leung)
- Skip PERST# GPIOs provided by downstream PCIe devices, which should
be handled by drivers of those devices (Manivannan Sadhasivam)
- Stop advertising Attention Button Present (no Qcom SoCs support
Attention Buttons) so pciehp can use Presence Detect Changed events
(Qiang Yu)
Renesas R-Car PCIe controller driver:
- Add rcar-gen4-pci-host optional 'msi-parent' for GIT ITS (Marek
Vasut)
- When MSI is enabled but iMSI-RX is not used, configure AXIINTC to
allow GIT ITS to handle MSI (Marek Vasut)
- Refactor GIC600 implementation to make it easier to add platforms
that only support 32-bit addressing (Marek Vasut)
- Add Renesas R-Car Gen4 S4/V4H/V4M to the list of GIC600
integrations that only support 32-bit addressing (Marek Vasut)
Renesas RZ/G3S PCIe controller driver:
- Add DT binding and driver support for RZ/V2H(P) SoC, which contains
two PCIe controllers, configured either as a single x4 link or two
independent x2 link controllers (Lad Prabhakar)
SpacemiT K1 PCIe controller driver:
- Add missing MODULE_DEVICE_TABLE() to generate module alias info for
OF-based module autoloading (Pengpeng Hou)
StarFive PCIe controller driver:
- Fix resource leaks on error paths in host_init() (Ali Tariq)
- Fix runtime PM handling and teardown ordering to avoid register
access while power or clocks are disabled (Ali Tariq)
- Check for runtime PM resume failure to avoid register access while
power or clocks are disabled (Ali Tariq)
Synopsys DesignWare PCIe controller driver:
- Add LECARC PMU IDs to the DWC RAS/DES VSEC list so it can take
advantage of the existing debugfs support for silicon debug, error
injection, and event counters (Brett Zhou)
- Factor pcie_valid_speed() and pci_bus_speed2lnkctl2() out of bwctrl
so they can be shared by the DWC core (Hans Zhang)
- Flush MSI writes from endpoint before unmapping the iATU, as we
already do for MSI-X writes (Niklas Cassel)
- Unmap MSI iATU window before mapping MSI-X window, to avoid a
subsequent MSI write using a disabled aperture and losing the
interrupt (Niklas Cassel)
- Change endpoint .pre_init() and .init() callbacks to return errors
and handle them (Marek Vasut)
UltraRISC PCIe controller driver:
- Add 'core', 'dbi', and 'aux' clocks to DT binding and manage them
in the driver (Jia Wang)
- Use module_platform_driver() since this may be built as a module,
though not removable because IRQs can't be safely disposed (Jia
Wang)
MicroSemi Switchtec management driver:
- Add Microchip PCI1008 device ID and include it in NTB DMA alias
quirk (Logan Gunthorpe)
Miscellaneous:
- Document how to write PCI Host Controller drivers (Manivannan
Sadhasivam)
- Fix typos in documentation (D'Orus Tsitera)
- Use %pe format specifier to print error pointers so we get symbolic
errname when available (Krzysztof Wilczyński)"
* tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (124 commits)
PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs
PCI: tegra264: Add Tegra264 support
dt-bindings: PCI: tegra264: Switch to PCIe Root Port bindings
dt-bindings: PCI: tegra264: Strictly distinguish C0 from C1-C5
PCI/AER: Support Advisory Non-Fatal Errors
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
PCI: dwc: Handle return value from endpoint .pre_init callback
PCI: dwc: Handle return value from endpoint .init callback
PCI: dwc: Add PCI ID for LECARC PCIe PMU
PCI/ASPM: Mask ASPM states based on Devicetree properties
PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
Documentation: PCI: Document how to write PCI Host Controller drivers
PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
PCI: Add support for PCIe WAKE# interrupt
PCI: Allow D3 for native hotplug-capable Root Ports on non-x86 platforms
dt-bindings: PCI: Correct white-space style
PCI/ASPM: Avoid L0s for Realtek RTS525A
PCI: ultrarisc: Use module_platform_driver()
PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks
dt-bindings: PCI: ultrarisc: Add required DP1000 PCIe clocks
...
|
|
Pull SCSI updates from James Bottomley:
"One new driver: leapraid (similar to mpi3mr but OK'd by Broadcom). The
usual suspects for driver updates (ufs, qla2xxx, smartpqi, zfcp, fnic,
ibmvfc) plus a few small core updates: a fix for an uninitialized sg
list pad bytes plus the removal of the dma mask check for max sectors.
The big update in the sd driver is mostly code refactoring for obscure
error leg handling"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (195 commits)
scsi: fnic: Fix built-in NVMe/FC build
scsi: fnic: Fix invalid comparison for error
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
scsi: zfcp: Enable CONTEXT_ANALYSIS
scsi: zfcp: Add __must_hold() attribute to zfcp_qdio_sbal_get()
scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
scsi: storvsc: Support manual scans for all Hyper-V targets
scsi: sd: Fix sd_done() sense handling condition
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
scsi: leapraid: Add driver documentation
scsi: leapraid: Add new SCSI driver
scsi: ufs: Add support for the aggregated read query opcode
scsi: ufs: Use unsigned types for the BSG query
scsi: ibmvfc: Fix spelling mistake "Deleteing" -> "Deleting"
scsi: qla2xxx: Update version to 12.00.00.2607b2
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata updates from Damien Le Moal:
- Some code cleanups to rename the function used to identify ZAC
devices and declare some local functions static (me)
- Refactoring and improvement of the translation of the SCSI REPORT
SUPPORTED OPCODES command to allow users access to the entire list of
supported commands (me)
- Fix the translation of the WRITE SAME command with UNMAP bit set (DSM
TRIM) for devices with a sector size larger than 2K and devices that
support multiple TRIM segments (Niklas)
- Add support detecting support for and translating the SCSI commands
related to the storage elements depopulation feature (GET PHYSICAL
ELEMENT STATUS, REMOVE ELEMENT AND TRUCATE, REMOVE ELEMENT AND MODIFY
ZONES and RESTORE ELEMENTS AND REBUILD) (me)
- Improvements to the sata_mv driver probe code (clocks and IRQ
initialization) (Rosen)
- Improve resource initialization in the pata_rb532_cf, pata_pxa,
sata_highbank and ahci_da850 drivers (Rosen)
- Improve PIO data-in command completions to better hndle slow devices,
e.g. CF cards (Richard)
- Improve the DMA channel management using device resources in the
pata_pxa driver (Rosen)
- Fix the pata_ep93xx driver to correctly fallback to PIO mode if DMA
initialization fails (Rosen)
- Use named initializers to define the match tables of the ahci_xgene,
ahci_qoriq and ahci_platform drivers (Pawel)
* tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (28 commits)
ata: use named initializers for acpi_device_id
ata: pata_ep93xx: fix PIO fallback when DMA init fails
ata: pata_pxa: use devres for DMA channel management
ata: libata-sff: don't busy-wait for PIO data-in command completion
ata: ahci_da850: use devm_platform_ioremap_resource()
ata: sata_highbank: use devm_platform_ioremap_resource
ata: pata_pxa: use devm_platform_ioremap_resource
ata: pata_rb532_cf: use devm_platform_ioremap_resource()
ata: sata_mv: use devm clock helpers
ata: sata_mv: Use platform_get_irq() to get interrupt
ata: pata_mpc52xx: Remove redundant dev_err()
ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() static
ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES command
ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command
ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command
ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS command
ata: libata-core: detect support for depopulation capabilities
ata: libata-scsi: improve ata_get_xlat_func
ata: libata: improve the definition of device flags
scsi: define depopulation capabilities related service actions
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Disable link power management on yet another misbehaving WD drive
(Niklas)
- Fix a use after free issue in the pata_sl82c105 driver (Hongyan)
* tag 'ata-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: pata_sl82c105: fix bridge revision use-after-free
ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
|
|
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.
Read the revision before dropping the reference.
Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
Use a named initializer for the acpi_device_id fields which makes the code
more readable and consistent with how lists are initialized in the rest of
the kernel code base. Also drop explicitly setting fields to 0 where it is
redundant.
While we are at it - unify the list terminator to have a single space
between the brackets and no trailing comma.
Signed-off-by: Pawel Zalewski (The Capable Hub) <pzalewski@thegoodpenguin.co.uk>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
According to a user report, WDC WD141KFGX-68FH9N0 has problems with LPM.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220693
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Fix PCI resource initialization in the sata_mv driver to keep legacy
Marvell boards functional (Rosen)
- Fix ahci_ceva driver initialization error path (Radhey)
- Fix libata header file to remove a kernel doc compilation warning
(Randy)
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt)
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me)
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas)
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas)
* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ata: libata-core: Disable LPM on WD Green 2.5 480GB
ata: libata-core: Disable LPM on some WD drives
scsi: libsas: terminate deferred commands on time out
ata: libata-scsi: schedule deferred atapi command
ata: libata-scsi: terminate deferred commands on time out
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ata: libata: avoid kernel-doc warnings
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
ata: sata_mv: accept 1 or 2 resources in platform probe
|
|
The inner loop of ata_scsi_lpm_supported() uses the wrong variable when
iterating.
It should obviously use the link that we are currently iterating over,
rather than always using the host link.
ata_scsi_lpm_supported() is used to control if a user should be allowed
to change lpm policy (from the default) via sysfs.
Thus, this bug could potentially disallow users to change the LPM policy
for certain SATA devices via sysfs.
Cc: stable@vger.kernel.org
Fixes: 0060beec0bfa ("ata: libata-sata: Add link_power_management_supported sysfs attribute")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-ide/20260728112200.B99F21F000E9@smtp.kernel.org/
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
|
According to a user report, the WD Green 2.5 480GB has problems with LPM.
Link: https://lore.kernel.org/linux-ide/CAGiKK17Fg4SgS+y0GzD3new44QzD_yPZU5V3ZeHdUr9mFnfn1Q@mail.gmail.com/
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
|
