linux.git/drivers/ata, branch v4.5-rc5 Linux kernel source tree ahci: Intel DNV device IDs SATA 2016-02-10T16:35:55+00:00 Alexandra Yates alexandra.yates@linux.intel.com 2016-02-05T23:27:49+00:00 342decff2b846b46fa61eb5ee40986fab79a9a32 Adding Intel codename DNV platform device IDs for SATA. Signed-off-by: Alexandra Yates <alexandra.yates@linux.intel.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org 
Adding Intel codename DNV platform device IDs for SATA.

Signed-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
libata: fix sff host state machine locking while polling 2016-02-01T16:33:21+00:00 Tejun Heo tj@kernel.org 2016-02-01T16:33:21+00:00 8eee1d3ed5b6fc8e14389567c9a6f53f82bb7224 The bulk of ATA host state machine is implemented by ata_sff_hsm_move(). The function is called from either the interrupt handler or, if polling, a work item. Unlike from the interrupt path, the polling path calls the function without holding the host lock and ata_sff_hsm_move() selectively grabs the lock. This is completely broken. If an IRQ triggers while polling is in progress, the two can easily race and end up accessing the hardware and updating state machine state at the same time. This can put the state machine in an illegal state and lead to a crash like the following. kernel BUG at drivers/ata/libata-sff.c:1302! invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 1 PID: 10679 Comm: syz-executor Not tainted 4.5.0-rc1+ #300 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88002bd00000 ti: ffff88002e048000 task.ti: ffff88002e048000 RIP: 0010:[<ffffffff83a83409>] [<ffffffff83a83409>] ata_sff_hsm_move+0x619/0x1c60 ... Call Trace: <IRQ> [<ffffffff83a84c31>] __ata_sff_port_intr+0x1e1/0x3a0 drivers/ata/libata-sff.c:1584 [<ffffffff83a85611>] ata_bmdma_port_intr+0x71/0x400 drivers/ata/libata-sff.c:2877 [< inline >] __ata_sff_interrupt drivers/ata/libata-sff.c:1629 [<ffffffff83a85bf3>] ata_bmdma_interrupt+0x253/0x580 drivers/ata/libata-sff.c:2902 [<ffffffff81479f98>] handle_irq_event_percpu+0x108/0x7e0 kernel/irq/handle.c:157 [<ffffffff8147a717>] handle_irq_event+0xa7/0x140 kernel/irq/handle.c:205 [<ffffffff81484573>] handle_edge_irq+0x1e3/0x8d0 kernel/irq/chip.c:623 [< inline >] generic_handle_irq_desc include/linux/irqdesc.h:146 [<ffffffff811a92bc>] handle_irq+0x10c/0x2a0 arch/x86/kernel/irq_64.c:78 [<ffffffff811a7e4d>] do_IRQ+0x7d/0x1a0 arch/x86/kernel/irq.c:240 [<ffffffff86653d4c>] common_interrupt+0x8c/0x8c arch/x86/entry/entry_64.S:520 <EOI> [< inline >] rcu_lock_acquire include/linux/rcupdate.h:490 [< inline >] rcu_read_lock include/linux/rcupdate.h:874 [<ffffffff8164b4a1>] filemap_map_pages+0x131/0xba0 mm/filemap.c:2145 [< inline >] do_fault_around mm/memory.c:2943 [< inline >] do_read_fault mm/memory.c:2962 [< inline >] do_fault mm/memory.c:3133 [< inline >] handle_pte_fault mm/memory.c:3308 [< inline >] __handle_mm_fault mm/memory.c:3418 [<ffffffff816efb16>] handle_mm_fault+0x2516/0x49a0 mm/memory.c:3447 [<ffffffff8127dc16>] __do_page_fault+0x376/0x960 arch/x86/mm/fault.c:1238 [<ffffffff8127e358>] trace_do_page_fault+0xe8/0x420 arch/x86/mm/fault.c:1331 [<ffffffff8126f514>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:264 [<ffffffff86655578>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:986 Fix it by ensuring that the polling path is holding the host lock before entering ata_sff_hsm_move() so that all hardware accesses and state updates are performed under the host lock. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com> Link: http://lkml.kernel.org/g/CACT4Y+b_JsOxJu2EZyEf+mOXORc_zid5V1-pLZSroJVxyWdSpw@mail.gmail.com Cc: stable@vger.kernel.org 
The bulk of ATA host state machine is implemented by
ata_sff_hsm_move().  The function is called from either the interrupt
handler or, if polling, a work item.  Unlike from the interrupt path,
the polling path calls the function without holding the host lock and
ata_sff_hsm_move() selectively grabs the lock.

This is completely broken.  If an IRQ triggers while polling is in
progress, the two can easily race and end up accessing the hardware
and updating state machine state at the same time.  This can put the
state machine in an illegal state and lead to a crash like the
following.

  kernel BUG at drivers/ata/libata-sff.c:1302!
  invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
  Modules linked in:
  CPU: 1 PID: 10679 Comm: syz-executor Not tainted 4.5.0-rc1+ #300
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff88002bd00000 ti: ffff88002e048000 task.ti: ffff88002e048000
  RIP: 0010:[<ffffffff83a83409>]  [<ffffffff83a83409>] ata_sff_hsm_move+0x619/0x1c60
  ...
  Call Trace:
   <IRQ>
   [<ffffffff83a84c31>] __ata_sff_port_intr+0x1e1/0x3a0 drivers/ata/libata-sff.c:1584
   [<ffffffff83a85611>] ata_bmdma_port_intr+0x71/0x400 drivers/ata/libata-sff.c:2877
   [<     inline     >] __ata_sff_interrupt drivers/ata/libata-sff.c:1629
   [<ffffffff83a85bf3>] ata_bmdma_interrupt+0x253/0x580 drivers/ata/libata-sff.c:2902
   [<ffffffff81479f98>] handle_irq_event_percpu+0x108/0x7e0 kernel/irq/handle.c:157
   [<ffffffff8147a717>] handle_irq_event+0xa7/0x140 kernel/irq/handle.c:205
   [<ffffffff81484573>] handle_edge_irq+0x1e3/0x8d0 kernel/irq/chip.c:623
   [<     inline     >] generic_handle_irq_desc include/linux/irqdesc.h:146
   [<ffffffff811a92bc>] handle_irq+0x10c/0x2a0 arch/x86/kernel/irq_64.c:78
   [<ffffffff811a7e4d>] do_IRQ+0x7d/0x1a0 arch/x86/kernel/irq.c:240
   [<ffffffff86653d4c>] common_interrupt+0x8c/0x8c arch/x86/entry/entry_64.S:520
   <EOI>
   [<     inline     >] rcu_lock_acquire include/linux/rcupdate.h:490
   [<     inline     >] rcu_read_lock include/linux/rcupdate.h:874
   [<ffffffff8164b4a1>] filemap_map_pages+0x131/0xba0 mm/filemap.c:2145
   [<     inline     >] do_fault_around mm/memory.c:2943
   [<     inline     >] do_read_fault mm/memory.c:2962
   [<     inline     >] do_fault mm/memory.c:3133
   [<     inline     >] handle_pte_fault mm/memory.c:3308
   [<     inline     >] __handle_mm_fault mm/memory.c:3418
   [<ffffffff816efb16>] handle_mm_fault+0x2516/0x49a0 mm/memory.c:3447
   [<ffffffff8127dc16>] __do_page_fault+0x376/0x960 arch/x86/mm/fault.c:1238
   [<ffffffff8127e358>] trace_do_page_fault+0xe8/0x420 arch/x86/mm/fault.c:1331
   [<ffffffff8126f514>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:264
   [<ffffffff86655578>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:986

Fix it by ensuring that the polling path is holding the host lock
before entering ata_sff_hsm_move() so that all hardware accesses and
state updates are performed under the host lock.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/g/CACT4Y+b_JsOxJu2EZyEf+mOXORc_zid5V1-pLZSroJVxyWdSpw@mail.gmail.com
Cc: stable@vger.kernel.org
libata-sff: use WARN instead of BUG on illegal host state machine state 2016-01-29T12:06:53+00:00 Tejun Heo tj@kernel.org 2016-01-29T12:06:53+00:00 a588afc920bc50e894f6ae2874c4281c795e0979 ata_sff_hsm_move() triggers BUG if it sees a host state machine state that it dind't expect. The risk for data corruption when the condition occurs is low as it's highly unlikely that it would lead to spurious completion of commands. The BUG occasionally triggered for subtle race conditions in the driver. Let's downgrade it to WARN so that it doesn't kill the machine unnecessarily. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Dmitry Vyukov <dvyukov@google.com> 
ata_sff_hsm_move() triggers BUG if it sees a host state machine state
that it dind't expect.  The risk for data corruption when the
condition occurs is low as it's highly unlikely that it would lead to
spurious completion of commands.  The BUG occasionally triggered for
subtle race conditions in the driver.  Let's downgrade it to WARN so
that it doesn't kill the machine unnecessarily.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
libata: disable forced PORTS_IMPL for >= AHCI 1.3 2016-01-25T20:45:55+00:00 Tejun Heo tj@kernel.org 2016-01-15T20:13:05+00:00 566d1827df2ef0cbe921d3d6946ac3007b1a6938 Some early controllers incorrectly reported zero ports in PORTS_IMPL register and the ahci driver fabricates PORTS_IMPL from the number of ports in those cases. This hasn't mattered but with the new nvme controllers there are cases where zero PORTS_IMPL is valid and should be honored. Disable the workaround for >= AHCI 1.3. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Andy Lutomirski <luto@amacapital.net> Link: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Cc: stable@vger.kernel.org 
Some early controllers incorrectly reported zero ports in PORTS_IMPL
register and the ahci driver fabricates PORTS_IMPL from the number of
ports in those cases.  This hasn't mattered but with the new nvme
controllers there are cases where zero PORTS_IMPL is valid and should
be honored.

Disable the workaround for >= AHCI 1.3.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Link: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Cc: stable@vger.kernel.org
libata: blacklist a Viking flash model for MWDMA corruption 2016-01-25T20:24:13+00:00 Shikha Jain shikjain@cisco.com 2016-01-11T22:55:45+00:00 b00622fc34e9d45069bd6e328dfd47ea2ef61468 Viking flash model VRFDFC22048UCHC-TE causes data corruption in MWDMA mode. Cc: xe-kernel@external.cisco.com Signed-off-by: Shikha Jain <shikjain@cisco.com> Signed-off-by: Anil Veliyankara Madam <aveliyan@cisco.com> Signed-off-by: Tejun Heo <tj@kernel.org> 
Viking flash model VRFDFC22048UCHC-TE causes data corruption in MWDMA mode.

Cc: xe-kernel@external.cisco.com
Signed-off-by: Shikha Jain <shikjain@cisco.com>
Signed-off-by: Anil Veliyankara Madam <aveliyan@cisco.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
drivers: ata: wake port before DMA stop for ALPM 2016-01-25T20:20:44+00:00 Danesh Petigara dpetigara@broadcom.com 2016-01-11T21:22:26+00:00 fb3296335500aaff61333df8eabbccf28761c79d The AHCI driver code stops and starts port DMA engines at will without considering the power state of the particular port. The AHCI specification isn't very clear on how to handle this scenario, leaving implementation open to interpretation. Broadcom's STB SATA host controller is unable to handle port DMA controller restarts when the port in question is in low power mode. When a port enters partial or slumber mode, its PHY is powered down. When a controller restart is requested, the controller's internal state machine expects the PHY to be brought back up by software which never happens in this case, resulting in failures. To avoid this situation, logic is added to manually wake up the port just before its DMA engine is stopped, if the port happens to be in a low power state. HBA initiated power management ensures that the port eventually returns to its configured low power state, when the link is idle (as per the conditions listed in the spec). A new host flag is also added to ensure this logic is only exercised for hosts with the above limitation. tj: Formatting changes. Signed-off-by: Danesh Petigara <dpetigara@broadcom.com> Reviewed-by: Markus Mayer <mmayer@broadcom.com> Signed-off-by: Tejun Heo <tj@kernel.org> 
The AHCI driver code stops and starts port DMA engines at will
without considering the power state of the particular port. The
AHCI specification isn't very clear on how to handle this scenario,
leaving implementation open to interpretation.

Broadcom's STB SATA host controller is unable to handle port DMA
controller restarts when the port in question is in low power mode.
When a port enters partial or slumber mode, its PHY is powered down.
When a controller restart is requested, the controller's internal
state machine expects the PHY to be brought back up by software which
never happens in this case, resulting in failures.

To avoid this situation, logic is added to manually wake up the port
just before its DMA engine is stopped, if the port happens to be in
a low power state. HBA initiated power management ensures that the port
eventually returns to its configured low power state, when the link is
idle (as per the conditions listed in the spec). A new host flag is also
added to ensure this logic is only exercised for hosts with the above
limitation.

tj: Formatting changes.

Signed-off-by: Danesh Petigara <dpetigara@broadcom.com>
Reviewed-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Merge branch 'for-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2016-01-12T03:33:59+00:00 Linus Torvalds torvalds@linux-foundation.org 2016-01-12T03:33:59+00:00 8c930204ce76eddeb2e1af66a75f0ab2506c76e2 Pull libata updates from Tejun Heo: "Mostly low level driver specific changes. Two changes are somewhat noteworthy. First, Dan's patchset to support per-port msix interrupt handling for ahci, which was tried last cycle but had to be backed out due to a couple issues, is back and seems to be working fine. Second, libata exception handling now uses usleep_range() instead of msleep() for sleeps < 20ms which can make things snappier in some corner cases" * 'for-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: skip debounce delay on link resume ata: ahci_brcmstb: disable DIPM support ata: ahci_brcmstb: enable support for ALPM drivers: libata-core: Use usleep_range() instead of msleep() for short sleeps (<20 ms) sata_sx4: correctly handling failed allocation ata: ahci_brcmstb: add support for MIPS-based platforms ahci: qoriq: Adjust the default register values on ls1021a ahci: qoriq: Update the default Rx watermark value ahci: qoriq: Adjust the default register values on ls1043a ahci: compile out msi/msix infrastructure ata: core: fix irq description on AHCI single irq systems ata: ahci_brcmstb: remove unused definitions ata: ahci_brcmstb: add a quirk for MIPS-based platforms ata: ahci_brcmstb: disable NCQ for MIPS-based platforms ata: sata_rcar: Remove obsolete platform_device_id entries sata_rcar: Add compatible string for r8a7795 ahci: kill 'intr_status' ahci: switch from 'threaded' to 'hardirq' interrupt handling ahci: per-port msix support 
Pull libata updates from Tejun Heo:
 "Mostly low level driver specific changes.

  Two changes are somewhat noteworthy.  First, Dan's patchset to support
  per-port msix interrupt handling for ahci, which was tried last cycle
  but had to be backed out due to a couple issues, is back and seems to
  be working fine.  Second, libata exception handling now uses
  usleep_range() instead of msleep() for sleeps < 20ms which can make
  things snappier in some corner cases"

* 'for-4.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  libata: skip debounce delay on link resume
  ata: ahci_brcmstb: disable DIPM support
  ata: ahci_brcmstb: enable support for ALPM
  drivers: libata-core: Use usleep_range() instead of msleep() for short sleeps (<20 ms)
  sata_sx4: correctly handling failed allocation
  ata: ahci_brcmstb: add support for MIPS-based platforms
  ahci: qoriq: Adjust the default register values on ls1021a
  ahci: qoriq: Update the default Rx watermark value
  ahci: qoriq: Adjust the default register values on ls1043a
  ahci: compile out msi/msix infrastructure
  ata: core: fix irq description on AHCI single irq systems
  ata: ahci_brcmstb: remove unused definitions
  ata: ahci_brcmstb: add a quirk for MIPS-based platforms
  ata: ahci_brcmstb: disable NCQ for MIPS-based platforms
  ata: sata_rcar: Remove obsolete platform_device_id entries
  sata_rcar: Add compatible string for r8a7795
  ahci: kill 'intr_status'
  ahci: switch from 'threaded' to 'hardirq' interrupt handling
  ahci: per-port msix support
libata: skip debounce delay on link resume 2016-01-08T16:50:14+00:00 Danesh Petigara dpetigara@broadcom.com 2016-01-08T00:03:33+00:00 e39b2bb3b72b999a04e8d295882be3255aca5ade The link resume logic uses a 200msec delay while debouncing the SControl register. The rationale behind that delay is to accommodate some PHYs that behave badly if their SStatus/ SControl registers are pounded immediately on resume. The Broadcom STB SATA PHY does not seem to have this issue. This patch introduces a new link flag that allows platforms to skip the debounce delay if it isn't needed. Signed-off-by: Danesh Petigara <dpetigara@broadcom.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> 
The link resume logic uses a 200msec delay while debouncing
the SControl register. The rationale behind that delay is
to accommodate some PHYs that behave badly if their SStatus/
SControl registers are pounded immediately on resume.
The Broadcom STB SATA PHY does not seem to have this issue.
This patch introduces a new link flag that allows platforms
to skip the debounce delay if it isn't needed.

Signed-off-by: Danesh Petigara <dpetigara@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
ata: ahci_brcmstb: disable DIPM support 2016-01-08T16:29:38+00:00 Danesh Petigara dpetigara@broadcom.com 2016-01-08T00:03:31+00:00 6ca92dd7aff899777a3081c5948409f4bdef7d38 The Broadcom STB SATA host controller does not support device initiated power management. Disable support for this feature so the driver never sends SETFEATURES commands to the device to enable/disable DIPM. Signed-off-by: Danesh Petigara <dpetigara@broadcom.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> 
The Broadcom STB SATA host controller does not support device
initiated power management. Disable support for this feature
so the driver never sends SETFEATURES commands to the device
to enable/disable DIPM.

Signed-off-by: Danesh Petigara <dpetigara@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
ata: ahci_brcmstb: enable support for ALPM 2016-01-08T16:28:08+00:00 Danesh Petigara dpetigara@broadcom.com 2016-01-08T00:03:30+00:00 6863caaf15fce962db0387e852b26d9fbf206cfe Enable support for ALPM in the host controller's capabilities register. Also adjust the PLL timeout to give it enough time to lock when the port exits slumber mode. tj: minor style updates Signed-off-by: Danesh Petigara <dpetigara@broadcom.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> 
Enable support for ALPM in the host controller's capabilities
register. Also adjust the PLL  timeout to give it enough time
to lock when the port exits slumber mode.

tj: minor style updates

Signed-off-by: Danesh Petigara <dpetigara@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>