linux-stable.git/drivers/ata, branch v3.18.78

libata: transport: Remove circular dependency at free time

2017-10-08T08:11:22+00:00

[ Upstream commit d85fc67dd11e9a32966140677d4d6429ca540b25 ]

Without this patch, failed probe would not free resources like irq.

ata port tdev object currently hold a reference to the ata port
object.  Therefore the ata port object release function will not get
called until the ata_tport_release is called. But that would never
happen, releasing the last reference of ata port dev is done by
scsi_host_release, which is called by ata_host_release when the ata
port object is released.

The ata device objects actually do not need to explicitly hold a
reference to their real counterpart, given the transport objects are
the children of these objects and device_add() is call for each child.
We know the parent will not be deleted until we call the child's
device_del().

Reported-by: Matthew Whitehead 
Tested-by: Matthew Whitehead 
Suggested-by: Tejun Heo 
Signed-off-by: Gwendal Grignou 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

cs5536: add support for IDE controller variant

2017-09-13T21:03:46+00:00

commit 591b6bb605785c12a21e8b07a08a277065b655a5 upstream.

Several legacy devices such as Geode-based Cisco ASA appliances
and DB800 development board do possess CS5536 IDE controller
with different PCI id than existing one. Using pata_generic is
not always feasible as at least DB800 requires MSR quirk from
pata_cs5536 to be used with vendor firmware.

Signed-off-by: Andrey Korolyov 
Signed-off-by: Tejun Heo 
Signed-off-by: Greg Kroah-Hartman

libata: array underflow in ata_find_dev()

2017-08-11T16:30:13+00:00

commit 59a5e266c3f5c1567508888dd61a45b86daed0fa upstream.

My static checker complains that "devno" can be negative, meaning that
we read before the start of the loop.  I've looked at the code, and I
think the warning is right.  This come from /proc so it's root only or
it would be quite a quite a serious bug.  The call tree looks like this:

proc_scsi_write() <- gets id and channel from simple_strtoul()
-> scsi_add_single_device() <- calls shost->transportt->user_scan()
   -> ata_scsi_user_scan()
      -> ata_find_dev()

Signed-off-by: Dan Carpenter 
Signed-off-by: Tejun Heo 
Signed-off-by: Greg Kroah-Hartman

ata: hpt366: fix constant cast warning

2017-02-08T08:43:03+00:00

commit 6ec0a86c645be3fce7ade42f165a6a417c3503b1 upstream.

gcc-5.x warns about a preexisting problem in the hpt36x pata driver:

drivers/ata/pata_hpt366.c: In function 'hpt36x_init_one':
drivers/ata/pata_hpt366.c:376:9: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-array-qualifiers]

Other ata drivers have the same problem, as ata_pci_bmdma_init_one
takes a non-const pointer, and they solve it by using a cast to
turn that pointer into a normal non-const pointer.

I also tried to change the ata core code to make host->private_data
a const pointer, but that quickly got out of hand, as some other
drivers expect it to be writable, so I ended up using the same
hack as the others here.

Signed-off-by: Arnd Bergmann 
Acked-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Tejun Heo 
Signed-off-by: Greg Kroah-Hartman

scsi: fix race between simultaneous decrements of ->host_failed

2016-07-11T15:10:54+00:00

[ Upstream commit 72d8c36ec364c82bf1bf0c64dfa1041cfaf139f7 ]

sas_ata_strategy_handler() adds the works of the ata error handler to
system_unbound_wq. This workqueue asynchronously runs work items, so the
ata error handler will be performed concurrently on different CPUs. In
this case, ->host_failed will be decreased simultaneously in
scsi_eh_finish_cmd() on different CPUs, and become abnormal.

It will lead to permanently inequality between ->host_failed and
->host_busy, and scsi error handler thread won't start running. IO
errors after that won't be handled.

Since all scmds must have been handled in the strategy handler, just
remove the decrement in scsi_eh_finish_cmd() and zero ->host_busy after
the strategy handler to fix this race.

Fixes: 50824d6c5657 ("[SCSI] libsas: async ata-eh")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Fang 
Reviewed-by: James Bottomley 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

ata: ahci-platform: Add ports-implemented DT bindings.

2016-05-17T18:31:17+00:00

[ Upstream commit 17dcc37e3e847bc0e67a5b1ec52471fcc6c18682 ]

On some SOCs PORTS_IMPL register value is never programmed by the
firmware and left at zero value. Which means that no sata ports are
available for software. AHCI driver used to cope up with this by
fabricating the port_map if the PORTS_IMPL register is read zero,
but recent patch broke this workaround as zero value was valid for
NVMe disks.

This patch adds ports-implemented DT bindings as workaround for this issue
in a way that DT can can override the PORTS_IMPL register in cases where
the firmware did not program it already.

Fixes: 566d1827df2e ("libata: disable forced PORTS_IMPL for >= AHCI 1.3")
Cc: stable@vger.kernel.org # v4.5+
Signed-off-by: Srinivas Kandagatla 
Acked-by: Tejun Heo 
Reviewed-by: Andy Gross 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin

libahci: save port map for forced port map

2016-05-17T18:31:09+00:00

[ Upstream commit 2fd0f46cb1b82587c7ae4a616d69057fb9bd0af7 ]

In usecases where force_port_map is used saved_port_map is never set,
resulting in not programming the PORTS_IMPL register as part of initial
config. This patch fixes this by setting it to port_map even in case
where force_port_map is used, making it more inline with other parts of
the code.

Fixes: 566d1827df2e ("libata: disable forced PORTS_IMPL for >= AHCI 1.3")
Cc: stable@vger.kernel.org # v4.5+
Signed-off-by: Srinivas Kandagatla 
Acked-by: Tejun Heo 
Reviewed-by: Andy Gross 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin

Adding Intel Lewisburg device IDs for SATA

2016-03-08T02:29:57+00:00

[ Upstream commit f5bdd66c705484b4bc77eb914be15c1b7881fae7 ]

This patch complements the list of device IDs previously
added for lewisburg sata.

Signed-off-by: Alexandra Yates 
Signed-off-by: Tejun Heo 
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin

ahci: Order SATA device IDs for codename Lewisburg

2016-03-08T02:29:48+00:00

[ Upstream commit 4d92f0099a06ef0e36c7673f7c090f1a448b2d1b ]

This change was to preserve the ascending order of device IDs.
There was an exception with the first two Lewisburg device IDs to
keep all device IDs of the same kind grouped by code name.

Signed-off-by: Alexandra Yates 
signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin

libata: fix HDIO_GET_32BIT ioctl

2016-03-08T02:13:02+00:00

[ Upstream commit 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 ]

As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
work correctly in compat mode with libata.

I have investigated the issue further and found multiple problems
that all appeared with the same commit that originally introduced
HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
a 'long' variable containing either 0 or 1 to user space.

The problems with this are:

* On big-endian machines, this will always write a zero because it
  stores the wrong byte into user space.

* In compat mode, the upper three bytes of the variable are updated
  by the compat_hdio_ioctl() function, but they now contain
  uninitialized stack data.

* The hdparm tool calling this ioctl uses a 'static long' variable
  to store the result. This means at least the upper bytes are
  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
  would fill them with data that remains stale when the low byte
  is overwritten. Fortunately libata doesn't implement any of the
  affected ioctl commands, so this would only happen when we query
  both an IDE and an ATA device in the same command such as
  "hdparm -N -c /dev/hda /dev/sda"

* The libata code for unknown reasons started using ATA_IOC_GET_IO32
  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
  while the ioctl commands that were added later use the normal
  HDIO_* names. This is harmless but rather confusing.

This addresses all four issues by changing the code to use put_user()
on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
does, and by clarifying the names of the ioctl commands.

Signed-off-by: Arnd Bergmann 
Reported-by: Soohoon Lee 
Tested-by: Soohoon Lee 
Cc: stable@vger.kernel.org
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin