···1202312023 iounmap(phba->sli4_hba.conf_regs_memmap_p);1202412024 if (phba->sli4_hba.dpp_regs_memmap_p)1202512025 iounmap(phba->sli4_hba.dpp_regs_memmap_p);1202612026+ if (phba->sli4_hba.dpp_regs_memmap_wc_p)1202712027+ iounmap(phba->sli4_hba.dpp_regs_memmap_wc_p);1202612028 break;1202712029 case LPFC_SLI_INTF_IF_TYPE_1:1202812030 break;
+30-6
drivers/scsi/lpfc/lpfc_sli.c
···1597015970 return NULL;1597115971}15972159721597315973+static __maybe_unused void __iomem *1597415974+lpfc_dpp_wc_map(struct lpfc_hba *phba, uint8_t dpp_barset)1597515975+{1597615976+1597715977+ /* DPP region is supposed to cover 64-bit BAR2 */1597815978+ if (dpp_barset != WQ_PCI_BAR_4_AND_5) {1597915979+ lpfc_log_msg(phba, KERN_WARNING, LOG_INIT,1598015980+ "3273 dpp_barset x%x != WQ_PCI_BAR_4_AND_5\n",1598115981+ dpp_barset);1598215982+ return NULL;1598315983+ }1598415984+1598515985+ if (!phba->sli4_hba.dpp_regs_memmap_wc_p) {1598615986+ void __iomem *dpp_map;1598715987+1598815988+ dpp_map = ioremap_wc(phba->pci_bar2_map,1598915989+ pci_resource_len(phba->pcidev,1599015990+ PCI_64BIT_BAR4));1599115991+1599215992+ if (dpp_map)1599315993+ phba->sli4_hba.dpp_regs_memmap_wc_p = dpp_map;1599415994+ }1599515995+1599615996+ return phba->sli4_hba.dpp_regs_memmap_wc_p;1599715997+}1599815998+1597315999/**1597416000 * lpfc_modify_hba_eq_delay - Modify Delay Multiplier on EQs1597516001 * @phba: HBA structure that EQs are on.···1695916933 uint8_t dpp_barset;1696016934 uint32_t dpp_offset;1696116935 uint8_t wq_create_version;1696216962-#ifdef CONFIG_X861696316963- unsigned long pg_addr;1696416964-#endif16965169361696616937 /* sanity check on queue memory */1696716938 if (!wq || !cq)···17144171211714517122#ifdef CONFIG_X861714617123 /* Enable combined writes for DPP aperture */1714717147- pg_addr = (unsigned long)(wq->dpp_regaddr) & PAGE_MASK;1714817148- rc = set_memory_wc(pg_addr, 1);1714917149- if (rc) {1712417124+ bar_memmap_p = lpfc_dpp_wc_map(phba, dpp_barset);1712517125+ if (!bar_memmap_p) {1715017126 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,1715117127 "3272 Cannot setup Combined "1715217128 "Write on WQ[%d] - disable DPP\n",1715317129 wq->queue_id);1715417130 phba->cfg_enable_dpp = 0;1713117131+ } else {1713217132+ wq->dpp_regaddr = bar_memmap_p + dpp_offset;1715517133 }1715617134#else1715717135 phba->cfg_enable_dpp = 0;
+3
drivers/scsi/lpfc/lpfc_sli4.h
···788788 void __iomem *dpp_regs_memmap_p; /* Kernel memory mapped address for789789 * dpp registers790790 */791791+ void __iomem *dpp_regs_memmap_wc_p;/* Kernel memory mapped address for792792+ * dpp registers with write combining793793+ */791794 union {792795 struct {793796 /* IF Type 0, BAR 0 PCI cfg space reg mem map */
···360360 * default device queue depth to figure out sbitmap shift361361 * since we use this queue depth most of times.362362 */363363- if (scsi_realloc_sdev_budget_map(sdev, depth)) {364364- put_device(&starget->dev);365365- kfree(sdev);366366- goto out;367367- }363363+ if (scsi_realloc_sdev_budget_map(sdev, depth))364364+ goto out_device_destroy;368365369366 scsi_change_queue_depth(sdev, depth);370367
+1-1
drivers/scsi/scsi_transport_sas.c
···17341734 break;1735173517361736 default:17371737- if (channel < shost->max_channel) {17371737+ if (channel <= shost->max_channel) {17381738 res = scsi_scan_host_selected(shost, channel, id, lun,17391739 SCSI_SCAN_MANUAL);17401740 } else {
+3-4
drivers/scsi/ses.c
···215215 unsigned char *type_ptr = ses_dev->page1_types;216216 unsigned char *desc_ptr = ses_dev->page2 + 8;217217218218- if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len) < 0)218218+ if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len))219219 return NULL;220220221221 for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {···528528};529529530530static int ses_enclosure_find_by_addr(struct enclosure_device *edev,531531- void *data)531531+ struct efd *efd)532532{533533- struct efd *efd = data;534533 int i;535534 struct ses_component *scomp;536535···682683 if (efd.addr) {683684 efd.dev = &sdev->sdev_gendev;684685685685- enclosure_for_each_device(ses_enclosure_find_by_addr, &efd);686686+ ses_enclosure_find_by_addr(edev, &efd);686687 }687688}688689
···18561856 cmd_request->payload_sz = payload_sz;1857185718581858 /* Invokes the vsc to start an IO */18591859- ret = storvsc_do_io(dev, cmd_request, get_cpu());18601860- put_cpu();18591859+ migrate_disable();18601860+ ret = storvsc_do_io(dev, cmd_request, smp_processor_id());18611861+ migrate_enable();1861186218621863 if (ret)18631864 scsi_dma_unmap(scmnd);
+46-6
drivers/target/loopback/tcm_loop.c
···2626#include <linux/slab.h>2727#include <linux/types.h>2828#include <linux/configfs.h>2929+#include <linux/blk-mq.h>2930#include <scsi/scsi.h>3031#include <scsi/scsi_tcq.h>3132#include <scsi/scsi_host.h>···270269 return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;271270}272271272272+static bool tcm_loop_flush_work_iter(struct request *rq, void *data)273273+{274274+ struct scsi_cmnd *sc = blk_mq_rq_to_pdu(rq);275275+ struct tcm_loop_cmd *tl_cmd = scsi_cmd_priv(sc);276276+ struct se_cmd *se_cmd = &tl_cmd->tl_se_cmd;277277+278278+ flush_work(&se_cmd->work);279279+ return true;280280+}281281+273282static int tcm_loop_target_reset(struct scsi_cmnd *sc)274283{275284 struct tcm_loop_hba *tl_hba;276285 struct tcm_loop_tpg *tl_tpg;286286+ struct Scsi_Host *sh = sc->device->host;287287+ int ret;277288278289 /*279290 * Locate the tcm_loop_hba_t pointer280291 */281281- tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host);292292+ tl_hba = *(struct tcm_loop_hba **)shost_priv(sh);282293 if (!tl_hba) {283294 pr_err("Unable to perform device reset without active I_T Nexus\n");284295 return FAILED;···299286 * Locate the tl_tpg pointer from TargetID in sc->device->id300287 */301288 tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];302302- if (tl_tpg) {303303- tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;304304- return SUCCESS;305305- }306306- return FAILED;289289+ if (!tl_tpg)290290+ return FAILED;291291+292292+ /*293293+ * Issue a LUN_RESET to drain all commands that the target core294294+ * knows about. This handles commands not yet marked CMD_T_COMPLETE.295295+ */296296+ ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, 0, TMR_LUN_RESET);297297+ if (ret != TMR_FUNCTION_COMPLETE)298298+ return FAILED;299299+300300+ /*301301+ * Flush any deferred target core completion work that may still be302302+ * queued. Commands that already had CMD_T_COMPLETE set before the TMR303303+ * are skipped by the TMR drain, but their async completion work304304+ * (transport_lun_remove_cmd → percpu_ref_put, release_cmd → scsi_done)305305+ * may still be pending in target_completion_wq.306306+ *307307+ * The SCSI EH will reuse in-flight scsi_cmnd structures for recovery308308+ * commands (e.g. TUR) immediately after this handler returns SUCCESS —309309+ * if deferred work is still pending, the memset in queuecommand would310310+ * zero the se_cmd while the work accesses it, leaking the LUN311311+ * percpu_ref and hanging configfs unlink forever.312312+ *313313+ * Use blk_mq_tagset_busy_iter() to find all started requests and314314+ * flush_work() on each — the same pattern used by mpi3mr, scsi_debug,315315+ * and other SCSI drivers to drain outstanding commands during reset.316316+ */317317+ blk_mq_tagset_busy_iter(&sh->tag_set, tcm_loop_flush_work_iter, NULL);318318+319319+ tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;320320+ return SUCCESS;307321}308322309323static const struct scsi_host_template tcm_loop_driver_template = {
+6-9
drivers/target/target_core_configfs.c
···108108 const char *page, size_t count)109109{110110 ssize_t read_bytes;111111- struct file *fp;112111 ssize_t r = -EINVAL;112112+ struct path path = {};113113114114 mutex_lock(&target_devices_lock);115115 if (target_devices) {···131131 db_root_stage[read_bytes - 1] = '\0';132132133133 /* validate new db root before accepting it */134134- fp = filp_open(db_root_stage, O_RDONLY, 0);135135- if (IS_ERR(fp)) {134134+ r = kern_path(db_root_stage, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);135135+ if (r) {136136 pr_err("db_root: cannot open: %s\n", db_root_stage);137137+ if (r == -ENOTDIR)138138+ pr_err("db_root: not a directory: %s\n", db_root_stage);137139 goto unlock;138140 }139139- if (!S_ISDIR(file_inode(fp)->i_mode)) {140140- filp_close(fp, NULL);141141- pr_err("db_root: not a directory: %s\n", db_root_stage);142142- goto unlock;143143- }144144- filp_close(fp, NULL);141141+ path_put(&path);145142146143 strscpy(db_root, db_root_stage);147144 pr_debug("Target_Core_ConfigFS: db_root set to %s\n", db_root);
+1-1
drivers/target/target_core_file.c
···276276 ssize_t len = 0;277277 int ret = 0, i;278278279279- aio_cmd = kmalloc_flex(*aio_cmd, bvecs, sgl_nents);279279+ aio_cmd = kzalloc_flex(*aio_cmd, bvecs, sgl_nents);280280 if (!aio_cmd)281281 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;282282
+35-14
drivers/ufs/core/ufshcd.c
···2424#include <linux/pm_opp.h>2525#include <linux/regulator/consumer.h>2626#include <linux/sched/clock.h>2727+#include <linux/sizes.h>2728#include <linux/iopoll.h>2829#include <scsi/scsi_cmnd.h>2930#include <scsi/scsi_dbg.h>···514513515514 if (hba->mcq_enabled) {516515 struct ufs_hw_queue *hwq = ufshcd_mcq_req_to_hwq(hba, rq);517517-518518- hwq_id = hwq->id;516516+ if (hwq)517517+ hwq_id = hwq->id;519518 } else {520519 doorbell = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);521520 }···44344433 spin_unlock_irqrestore(hba->host->host_lock, flags);44354434 mutex_unlock(&hba->uic_cmd_mutex);4436443544374437- /*44384438- * If the h8 exit fails during the runtime resume process, it becomes44394439- * stuck and cannot be recovered through the error handler. To fix44404440- * this, use link recovery instead of the error handler.44414441- */44424442- if (ret && hba->pm_op_in_progress)44434443- ret = ufshcd_link_recovery(hba);44444444-44454436 return ret;44464437}44474438···53655372 hba->dev_info.rpmb_region_size[1] = desc_buf[RPMB_UNIT_DESC_PARAM_REGION1_SIZE];53665373 hba->dev_info.rpmb_region_size[2] = desc_buf[RPMB_UNIT_DESC_PARAM_REGION2_SIZE];53675374 hba->dev_info.rpmb_region_size[3] = desc_buf[RPMB_UNIT_DESC_PARAM_REGION3_SIZE];53755375+53765376+ if (hba->dev_info.wspecversion <= 0x0220) {53775377+ /*53785378+ * These older spec chips have only one RPMB region,53795379+ * sized between 128 kB minimum and 16 MB maximum.53805380+ * No per region size fields are provided (respective53815381+ * REGIONX_SIZE fields always contain zeros), so get53825382+ * it from the logical block count and size fields for53835383+ * compatibility53845384+ *53855385+ * (See JESD220C-2_2 Section 14.1.4.653865386+ * RPMB Unit Descriptor,* offset 13h, 4 bytes)53875387+ */53885388+ hba->dev_info.rpmb_region_size[0] =53895389+ (get_unaligned_be64(desc_buf53905390+ + RPMB_UNIT_DESC_PARAM_LOGICAL_BLK_COUNT)53915391+ << desc_buf[RPMB_UNIT_DESC_PARAM_LOGICAL_BLK_SIZE])53925392+ / SZ_128K;53935393+ }53685394 }5369539553705396···6101608961026090 hba->auto_bkops_enabled = false;61036091 trace_ufshcd_auto_bkops_state(hba, "Disabled");60926092+ hba->urgent_bkops_lvl = BKOPS_STATUS_PERF_IMPACT;61046093 hba->is_urgent_bkops_lvl_checked = false;61056094out:61066095 return err;···62056192 * impacted or critical. Handle these device by determining their urgent62066193 * bkops status at runtime.62076194 */62086208- if (curr_status < BKOPS_STATUS_PERF_IMPACT) {61956195+ if ((curr_status > BKOPS_STATUS_NO_OP) && (curr_status < BKOPS_STATUS_PERF_IMPACT)) {62096196 dev_err(hba->dev, "%s: device raised urgent BKOPS exception for bkops status %d\n",62106197 __func__, curr_status);62116198 /* update the current status as the urgent bkops level */···7247723472487235 ret = ufshcd_vops_get_outstanding_cqs(hba, &outstanding_cqs);72497236 if (ret)72507250- outstanding_cqs = (1U << hba->nr_hw_queues) - 1;72377237+ outstanding_cqs = (1ULL << hba->nr_hw_queues) - 1;7251723872527239 /* Exclude the poll queues */72537240 nr_queues = hba->nr_hw_queues - hba->nr_queues[HCTX_TYPE_POLL];···1023910226 }10240102271024110228 flush_work(&hba->eeh_work);1022910229+ cancel_delayed_work_sync(&hba->ufs_rtc_update_work);10242102301024310231 ret = ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE);1024410232 if (ret)···1029410280 if (ret)1029510281 goto set_link_active;10296102821029710297- cancel_delayed_work_sync(&hba->ufs_rtc_update_work);1029810283 goto out;10299102841030010285set_link_active:···1036510352 } else {1036610353 dev_err(hba->dev, "%s: hibern8 exit failed %d\n",1036710354 __func__, ret);1036810368- goto vendor_suspend;1035510355+ /*1035610356+ * If the h8 exit fails during the runtime resume1035710357+ * process, it becomes stuck and cannot be recovered1035810358+ * through the error handler. To fix this, use link1035910359+ * recovery instead of the error handler.1036010360+ */1036110361+ ret = ufshcd_link_recovery(hba);1036210362+ if (ret)1036310363+ goto vendor_suspend;1036910364 }1037010365 } else if (ufshcd_is_link_off(hba)) {1037110366 /*