From patchwork Thu Jan 28 04:16:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Can Guo X-Patchwork-Id: 12051711 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1B69C433DB for ; Thu, 28 Jan 2021 04:18:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 733C164DD6 for ; Thu, 28 Jan 2021 04:18:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231272AbhA1ESJ (ORCPT ); Wed, 27 Jan 2021 23:18:09 -0500 Received: from labrats.qualcomm.com ([199.106.110.90]:40784 "EHLO labrats.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231243AbhA1ESF (ORCPT ); Wed, 27 Jan 2021 23:18:05 -0500 IronPort-SDR: uis1MRu9wOS/NldmsOhX/HutjYmbB/JNYuv7iW4+GFNHgfwxrlgqtngdvcI3YTiwnSKBYMMnX3 H+aHPlk67ZGR3x5e/w8t6p7o6SWAbgqZj8ezrRNIjGqswB0qS3ae+ywx9AkbaisKL7ITpHRRvR npbnw8GZGQTOJHBS+KCQ/aIS3/uSce0zdAwVEoXaDubkLqx1PhS/w7pwnk0lH33jVQoXpdYf35 iVzs2ISTKp8id5pXpj01jDYHUAm8ZAm0eIy8zEvRUZ7UP5CApvO9s3pv4nAujA4kepIRQMcOY+ UZw= X-IronPort-AV: E=Sophos;i="5.79,381,1602572400"; d="scan'208";a="47715649" Received: from unknown (HELO ironmsg02-sd.qualcomm.com) ([10.53.140.142]) by labrats.qualcomm.com with ESMTP; 27 Jan 2021 20:17:45 -0800 X-QCInternal: smtphost Received: from wsp769891wss.qualcomm.com (HELO stor-presley.qualcomm.com) ([192.168.140.85]) by ironmsg02-sd.qualcomm.com with ESMTP; 27 Jan 2021 20:17:43 -0800 Received: by stor-presley.qualcomm.com (Postfix, from userid 359480) id 4A40A219A2; Wed, 27 Jan 2021 20:17:43 -0800 (PST) From: Can Guo To: jaegeuk@kernel.org, bvanassche@acm.org, asutoshd@codeaurora.org, nguyenb@codeaurora.org, hongwus@codeaurora.org, linux-scsi@vger.kernel.org, kernel-team@android.com, cang@codeaurora.org Cc: Alim Akhtar , Avri Altman , "James E.J. Bottomley" , "Martin K. Petersen" , Stanley Chu , Bean Huo , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v3 1/3] scsi: ufs: Fix task management request completion timeout Date: Wed, 27 Jan 2021 20:16:02 -0800 Message-Id: <1611807365-35513-2-git-send-email-cang@codeaurora.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1611807365-35513-1-git-send-email-cang@codeaurora.org> References: <1611807365-35513-1-git-send-email-cang@codeaurora.org> Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org ufshcd_tmc_handler() calls blk_mq_tagset_busy_iter(fn = ufshcd_compl_tm()), but since blk_mq_tagset_busy_iter() only iterates over all reserved tags and requests which are not in IDLE state, ufshcd_compl_tm() never gets a chance to run. Thus, TMR always ends up with completion timeout. Fix it by calling blk_mq_start_request() in __ufshcd_issue_tm_cmd(). Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs") Signed-off-by: Can Guo --- drivers/scsi/ufs/ufshcd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 8da75e6..c0c5925 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -6395,6 +6395,7 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, spin_lock_irqsave(host->host_lock, flags); task_tag = hba->nutrs + free_slot; + blk_mq_start_request(req); treq->req_header.dword_0 |= cpu_to_be32(task_tag); From patchwork Thu Jan 28 04:16:03 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Can Guo X-Patchwork-Id: 12051713 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF2F2C433DB for ; Thu, 28 Jan 2021 04:18:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8864B64DD6 for ; Thu, 28 Jan 2021 04:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231398AbhA1ES1 (ORCPT ); Wed, 27 Jan 2021 23:18:27 -0500 Received: from labrats.qualcomm.com ([199.106.110.90]:40784 "EHLO labrats.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231243AbhA1ESX (ORCPT ); Wed, 27 Jan 2021 23:18:23 -0500 IronPort-SDR: vRrkMxQsdGMEIcqNhHyKASMbZVtumbeFANqc7e5DocJgLnQtUp2OhGSesWcldGsJK8yTQXgkoZ IyenLQj5tnEdL4wHTQ5/VVXGWsfTXNmEUZCeXatU4lK6faThte6B8mfZPhlmGiWsIzd/a1D6+V F5k9BfwDsQBwnq2QjkE8+1mJwazKzaR6Woo0HHttniA7vXYI0AKIA2EzWcKQmuHq+r7TJbTwN9 n2wpS4ZmnyFVDy5rTIjsd8HVV93DUPGreLkpJAi9ognRAGU4XKZ0TUhZjr5dWfr/K9ZApii+Sk aBw= X-IronPort-AV: E=Sophos;i="5.79,381,1602572400"; d="scan'208";a="47715650" Received: from unknown (HELO ironmsg02-sd.qualcomm.com) ([10.53.140.142]) by labrats.qualcomm.com with ESMTP; 27 Jan 2021 20:17:48 -0800 X-QCInternal: smtphost Received: from wsp769891wss.qualcomm.com (HELO stor-presley.qualcomm.com) ([192.168.140.85]) by ironmsg02-sd.qualcomm.com with ESMTP; 27 Jan 2021 20:17:47 -0800 Received: by stor-presley.qualcomm.com (Postfix, from userid 359480) id B120A219A2; Wed, 27 Jan 2021 20:17:47 -0800 (PST) From: Can Guo To: jaegeuk@kernel.org, bvanassche@acm.org, asutoshd@codeaurora.org, nguyenb@codeaurora.org, hongwus@codeaurora.org, linux-scsi@vger.kernel.org, kernel-team@android.com, cang@codeaurora.org Cc: Alim Akhtar , Avri Altman , "James E.J. Bottomley" , "Martin K. Petersen" , Stanley Chu , Bean Huo , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v3 2/3] scsi: ufs: Fix a race condition btw task management request send and compl Date: Wed, 27 Jan 2021 20:16:03 -0800 Message-Id: <1611807365-35513-3-git-send-email-cang@codeaurora.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1611807365-35513-1-git-send-email-cang@codeaurora.org> References: <1611807365-35513-1-git-send-email-cang@codeaurora.org> Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org ufshcd_compl_tm() looks for all 0 bits in the REG_UTP_TASK_REQ_DOOR_BELL and call complete() for each req who has the req->end_io_data set. There can be a race condition btw tmc send/compl, because the req->end_io_data is set, in __ufshcd_issue_tm_cmd(), without host lock protection, so it is possible that when ufshcd_compl_tm() checks the req->end_io_data, it is set but the corresponding tag has not been set in REG_UTP_TASK_REQ_DOOR_BELL. Thus, ufshcd_tmc_handler() may wrongly complete TMRs which have not been sent out. Fix it by protecting req->end_io_data with host lock, and let ufshcd_compl_tm() only handle those tm cmds which have been completed instead of looking for 0 bits in the REG_UTP_TASK_REQ_DOOR_BELL. Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs") Signed-off-by: Can Guo --- drivers/scsi/ufs/ufshcd.c | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index c0c5925..43894a3 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -6225,7 +6225,7 @@ static irqreturn_t ufshcd_check_errors(struct ufs_hba *hba) struct ctm_info { struct ufs_hba *hba; - unsigned long pending; + unsigned long completed; unsigned int ncpl; }; @@ -6234,13 +6234,13 @@ static bool ufshcd_compl_tm(struct request *req, void *priv, bool reserved) struct ctm_info *const ci = priv; struct completion *c; - WARN_ON_ONCE(reserved); - if (test_bit(req->tag, &ci->pending)) - return true; - ci->ncpl++; - c = req->end_io_data; - if (c) - complete(c); + if (test_bit(req->tag, &ci->completed)) { + __clear_bit(req->tag, &ci->hba->outstanding_tasks); + ci->ncpl++; + c = req->end_io_data; + if (c) + complete(c); + } return true; } @@ -6255,12 +6255,19 @@ static bool ufshcd_compl_tm(struct request *req, void *priv, bool reserved) static irqreturn_t ufshcd_tmc_handler(struct ufs_hba *hba) { struct request_queue *q = hba->tmf_queue; + u32 tm_doorbell; + unsigned long completed; struct ctm_info ci = { - .hba = hba, - .pending = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL), + .hba = hba, + .ncpl = 0, }; - blk_mq_tagset_busy_iter(q->tag_set, ufshcd_compl_tm, &ci); + tm_doorbell = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL); + completed = tm_doorbell ^ hba->outstanding_tasks; + if (completed) { + ci.completed = completed; + blk_mq_tagset_busy_iter(q->tag_set, ufshcd_compl_tm, &ci); + } return ci.ncpl ? IRQ_HANDLED : IRQ_NONE; } @@ -6388,12 +6395,12 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, if (IS_ERR(req)) return PTR_ERR(req); - req->end_io_data = &wait; free_slot = req->tag; WARN_ON_ONCE(free_slot < 0 || free_slot >= hba->nutmrs); ufshcd_hold(hba, false); spin_lock_irqsave(host->host_lock, flags); + req->end_io_data = &wait; task_tag = hba->nutrs + free_slot; blk_mq_start_request(req); @@ -6420,11 +6427,13 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, err = wait_for_completion_io_timeout(&wait, msecs_to_jiffies(TM_CMD_TIMEOUT)); if (!err) { + spin_lock_irqsave(hba->host->host_lock, flags); /* * Make sure that ufshcd_compl_tm() does not trigger a * use-after-free. */ req->end_io_data = NULL; + spin_unlock_irqrestore(hba->host->host_lock, flags); ufshcd_add_tm_upiu_trace(hba, task_tag, UFS_TM_ERR); dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n", __func__, tm_function); From patchwork Thu Jan 28 04:16:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Can Guo X-Patchwork-Id: 12051715 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F221C433E6 for ; Thu, 28 Jan 2021 04:18:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9DA2564D9D for ; Thu, 28 Jan 2021 04:18:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231324AbhA1ESh (ORCPT ); Wed, 27 Jan 2021 23:18:37 -0500 Received: from labrats.qualcomm.com ([199.106.110.90]:22726 "EHLO labrats.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231351AbhA1ES2 (ORCPT ); Wed, 27 Jan 2021 23:18:28 -0500 IronPort-SDR: +1Hantmt2t8cJXJgQgpH1FLK8wvv45XYPozdeR4PYgUE1ibN7LOhk3+moEfUewwPcUWCINjpFM JQ627oOiFi1rdjyEBtzWAQr7Vk7D0opRKLUEgrK4H56YUFis1c5+HfIeWGL2pUpAmaKayZqSWj 7NxP7jBAWOovoq2wlFtlPHLV69odlMs9RFlEHgjndDNdYC0VROGQcFouuowxOCQGlOkhpX+zle iB7NSQ4UH6+xcbTL9+HlYGcPBKA5AsB6dEH5QfnOK6aGAxEzcuJvYRj+fGME5CJFn5ImLW0xQK /bw= X-IronPort-AV: E=Sophos;i="5.79,381,1602572400"; d="scan'208";a="47715651" Received: from unknown (HELO ironmsg02-sd.qualcomm.com) ([10.53.140.142]) by labrats.qualcomm.com with ESMTP; 27 Jan 2021 20:17:52 -0800 X-QCInternal: smtphost Received: from wsp769891wss.qualcomm.com (HELO stor-presley.qualcomm.com) ([192.168.140.85]) by ironmsg02-sd.qualcomm.com with ESMTP; 27 Jan 2021 20:17:52 -0800 Received: by stor-presley.qualcomm.com (Postfix, from userid 359480) id 159E5219A2; Wed, 27 Jan 2021 20:17:52 -0800 (PST) From: Can Guo To: jaegeuk@kernel.org, bvanassche@acm.org, asutoshd@codeaurora.org, nguyenb@codeaurora.org, hongwus@codeaurora.org, linux-scsi@vger.kernel.org, kernel-team@android.com, cang@codeaurora.org Cc: Alim Akhtar , Avri Altman , "James E.J. Bottomley" , "Martin K. Petersen" , Stanley Chu , Bean Huo , Sujit Reddy Thumma , Vinayak Holikatti , Yaniv Gardi , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v3 3/3] scsi: ufs: Fix wrong Task Tag used in task management request UPIUs Date: Wed, 27 Jan 2021 20:16:04 -0800 Message-Id: <1611807365-35513-4-git-send-email-cang@codeaurora.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1611807365-35513-1-git-send-email-cang@codeaurora.org> References: <1611807365-35513-1-git-send-email-cang@codeaurora.org> Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org In __ufshcd_issue_tm_cmd(), it is not right to use hba->nutrs + req->tag as the Task Tag in one TMR UPIU. Directly use req->tag as the Task Tag. Fixes: e293313262d3 ("scsi: ufs: Fix broken task management command implementation") Signed-off-by: Can Guo Reviewed-by: Bart Van Assche --- drivers/scsi/ufs/ufshcd.c | 36 +++++++++++++++--------------------- 1 file changed, 15 insertions(+), 21 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 43894a3..72fa14b 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -6384,38 +6384,33 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, DECLARE_COMPLETION_ONSTACK(wait); struct request *req; unsigned long flags; - int free_slot, task_tag, err; + int task_tag, err; /* - * Get free slot, sleep if slots are unavailable. - * Even though we use wait_event() which sleeps indefinitely, - * the maximum wait time is bounded by %TM_CMD_TIMEOUT. + * blk_get_request() used here is only to get a free tag. */ req = blk_get_request(q, REQ_OP_DRV_OUT, 0); if (IS_ERR(req)) return PTR_ERR(req); - free_slot = req->tag; - WARN_ON_ONCE(free_slot < 0 || free_slot >= hba->nutmrs); ufshcd_hold(hba, false); - spin_lock_irqsave(host->host_lock, flags); req->end_io_data = &wait; - task_tag = hba->nutrs + free_slot; blk_mq_start_request(req); + task_tag = req->tag; treq->req_header.dword_0 |= cpu_to_be32(task_tag); - memcpy(hba->utmrdl_base_addr + free_slot, treq, sizeof(*treq)); - ufshcd_vops_setup_task_mgmt(hba, free_slot, tm_function); + memcpy(hba->utmrdl_base_addr + task_tag, treq, sizeof(*treq)); + ufshcd_vops_setup_task_mgmt(hba, task_tag, tm_function); /* send command to the controller */ - __set_bit(free_slot, &hba->outstanding_tasks); + __set_bit(task_tag, &hba->outstanding_tasks); /* Make sure descriptors are ready before ringing the task doorbell */ wmb(); - ufshcd_writel(hba, 1 << free_slot, REG_UTP_TASK_REQ_DOOR_BELL); + ufshcd_writel(hba, 1 << task_tag, REG_UTP_TASK_REQ_DOOR_BELL); /* Make sure that doorbell is committed immediately */ wmb(); @@ -6437,24 +6432,23 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, ufshcd_add_tm_upiu_trace(hba, task_tag, UFS_TM_ERR); dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n", __func__, tm_function); - if (ufshcd_clear_tm_cmd(hba, free_slot)) - dev_WARN(hba->dev, "%s: unable clear tm cmd (slot %d) after timeout\n", - __func__, free_slot); + if (ufshcd_clear_tm_cmd(hba, task_tag)) { + dev_WARN(hba->dev, "%s: unable to clear tm cmd (slot %d) after timeout\n", + __func__, task_tag); + } else { + __clear_bit(task_tag, &hba->outstanding_tasks); + } err = -ETIMEDOUT; } else { err = 0; - memcpy(treq, hba->utmrdl_base_addr + free_slot, sizeof(*treq)); + memcpy(treq, hba->utmrdl_base_addr + task_tag, sizeof(*treq)); ufshcd_add_tm_upiu_trace(hba, task_tag, UFS_TM_COMP); } - spin_lock_irqsave(hba->host->host_lock, flags); - __clear_bit(free_slot, &hba->outstanding_tasks); - spin_unlock_irqrestore(hba->host->host_lock, flags); - + ufshcd_release(hba); blk_put_request(req); - ufshcd_release(hba); return err; }