The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".
This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.
PR: 215474
Reported by: Coverity
CID: 1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID: 1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID: 1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID: 1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID: 1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID: 1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID: 1010035 1010036 1010042 1010041 1010040 1010039
Reviewed by: imp, sephe, slm
MFC after: 4 weeks
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D9037
Differential Revision: https://reviews.freebsd.org/D9038
passing it to firmware for all Gen3 controllers.
For Thunderbolt controller, keep the legacy behavior i.e. return the SYNCHRONIZE_CACHE command with success status from driver itself.
There is Sysctl parameter 'block_sync_cache' is provided to enable customers either to block/unblock these commands to facilitate
legacy behavior if there is a compatibility issue. Default value for module parameter is to unblock this command.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: Broadcom Limited/AVAGO Technologies
and return without processing event in AEN thread, if controller reset is in progress.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: Broadcom Limited/AVAGO Technologies
If a SCSI IO times out, then before initiating OCR, now the driver will try to send a
target reset to the particular target for which the IO is timed out. If that also fails,
then the driver will initiate OCR.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: Broadcom Limited/AVAGO Technologies
Did the same by setting sc->aen_cmd = NULL when aborting AEN is successful.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: Broadcom Limited/AVAGO Technologies
MFI linked list in megaraid_sas driver is used for mfi-mpt pass-through commands.
This list can be corrupted due to many possible race conditions in driver and
eventually we may see kernel panic.
One example -
MFI frame is freed from calling process as driver send command via polling method and interrupt
for that command comes after driver free mfi frame (actually even after some other context reuse
the mfi frame). When driver receive MPT frame in ISR, driver will be using the index of MFI and
access that MFI frame and finally in-used MFI frames list will be corrupted.
High level description of new solution -
Free MFI and MPT command from same context.
Free both the command either from process (from where mfi-mpt pass-through was called) or from
ISR context. Do not split freeing of MFI and MPT, because it creates the race condition which
will do MFI/MPT list.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: Broadcom Limited/AVAGO Technologies
NOTE:
The FreeBSD system currently restricts the MAX IO size to MAXPHYS which
in turn is 128KB. We tested the 1MB IO by converting the MAXPHYS to 1MB.
Following is the mail reference:
http://lists.freebsd.org/pipermail/freebsd-scsi/2015-January/006568.html
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: AVAGO Technologies
JBODs. Driver has to sync the JBOD map with firmware and use sequence number
as a reference for JBOD FastPath I/O's.
Submitted by: Sumit Saxena <sumit.saxena@broadcom.com>
Reviewed by: Kashyap Desai <Kashyap.Desai@broadcom.com>
MFC after: 3 days
Sponsored by: AVAGO Technologies
Switch from make_dev_alias to make_dev_alias_p since make_dev_alias_p can
gracefully fail if the /dev/megaraid_sas_ioctl_node symlink already exists.
This can happen if mfi(4) and mrsas(4) are both attached to cards and
providing Linux emulation support. Let the first one win. An equivalent
change has been done in mfi(4). Extra credit would be to pass the
Linux emulation call to the other driver when appropriate. This will
probably be a rare case and the user can manually change where the symlink
points to.
MFC after: 3 days
and there are some pending IOs at the time of OCR. This is mainly because of
recursive mutext in OCR and IO completion function call. Generic IO completion (from ISR) needs
sim_lock to be held before it calls completion to CAM (xpt_done), but in case of OCR path mrsas_ocr thread
itself take sim_lock, so this condition is now handled in this patch.
MFC after: 3 days
1. While disabling interrupt the FW disables interrupts for only 16 vectors.
In case of Invader which supports 96 MSI-x vectors, some spurious interrupts
may come on other vectors even after interrupt disable. So, driver uses a flag
and ignores the spurious interrupts.
2. Reply queue depth is made double the number of commands supported by FW.
3. Misplaced interrupt enable code is now moved down in the OCR path.
4. Updated error handling code in OCR path.
5. Removed un-necessary print.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
issued through the ioctl() interface prior to the kill adapter. This ensures
userspace ioctl() system calls issued just before a kill adapter don't get stuck in
wait state and IOCTLs are returned to application.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
MEGASAS_HBA_OPERATIONAL before getting new RAID map.
There will be a small window where IO will come from OS with old RAID map.
This patch will update adapter state to MEGASAS_HBA_OPERATIONAL,
only after driver has new RAID map to avoid any IOs getting build using old RAID map.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
for two Drive Raid-1 configuration only.
Now, Driver support fast path read load balancing for all (any number of disk) Raid-1 configuration.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
FW expose Secure Jbod support via Controller properity.
Firmware expect IOs to be received from different IO path than
conventional fast path queue, in case of SED drives.
To have Secure jbod support user need driver and firmware support.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
Previously, any timeout value for which (timeout * hz) will overflow the
signed integer, will give weird results, since callout(9) routines will
convert negative values of ticks to '1'. For unsigned integer overflow we
will get sufficiently smaller timeout values than expected.
Switch from callout_reset, which requires conversion to int based ticks
to callout_reset_sbt to avoid this.
Also correct isci to correctly resolve ccb timeout.
This was based on the original work done by Eygene Ryabinkin
<rea@freebsd.org> back in 5 Aug 2011 which used a macro to help avoid
the overlow.
Differential Revision: https://reviews.freebsd.org/D1157
Reviewed by: mav, davide
MFC after: 1 month
Sponsored by: Multiplay
- Wrong integer type was specified.
- Wrong or missing "access" specifier. The "access" specifier
sometimes included the SYSCTL type, which it should not, except for
procedural SYSCTL nodes.
- Logical OR where binary OR was expected.
- Properly assert the "access" argument passed to all SYSCTL macros,
using the CTASSERT macro. This applies to both static- and dynamically
created SYSCTLs.
- Properly assert the the data type for both static and dynamic
SYSCTLs. In the case of static SYSCTLs we only assert that the data
pointed to by the SYSCTL data pointer has the correct size, hence
there is no easy way to assert types in the C language outside a
C-function.
- Rewrote some code which doesn't pass a constant "access" specifier
when creating dynamic SYSCTL nodes, which is now a requirement.
- Updated "EXAMPLES" section in SYSCTL manual page.
MFC after: 3 days
Sponsored by: Mellanox Technologies
This is a duplicate variable reference in mrsas, so now this patch isolate atomic_ variable and relavent
function call using prefix mrsas_xx.
Issue was introduced in r272737.
MFC after: 2 weeks
Sponsored by: Avago Technology
where as there are limited number(32) of mfi commands in the pool.
The mfi command pool is now restricted to 27 simultaneous accesses by using
a counting semaphore while calling the passthru function.
In the mrsas_cam.c source file there was a same function name mrsas_poll(),
which was same as the mrsas_poll() implemented in the mrsas.c file for the
polling interface.
To clearly distinguish the functionality by usage we have renamed the former
as mrsas_cam_poll().
In the passthru function let's say it has got an mfi command from the pool
but it has failed in one of the DMA function call which will lead to leak
an mfi command because in the ERROR case it directly returns and not freeing up
the occupied mfi command.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
It is meant to notify the applications which will be waiting for some
controller events to be occured.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
This Driver will create multiple MSI-x vector depending upon what FW expose.
As of now 12 Gbp/s MR controller (Invader and Fury) expose 96 msix vector.
As of now 6 Gbp/s MR controller (Thunderbolt) expose 16 msix vector.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
snv add, so I have added $FreeBSD$ as comment.
This commit is contininous of last mrsas commit, so that compilation
does not break.
Obtained from: AVAGO Technologies
MFC after: 2 weeks
machine, for which 32bit compatibilty code has been added.
As in linux there is only one device entry that is used to fire IOCTL commands,
a new device entry megaraid_sas_ioctl_node is added for solely this
purpose.
From one dev node i.e mrgaraid_sa_ioctl_node we have to find out the
controller instance in case of multicontroller, for which one management info
structure has been added.
Reviewed by: ambrisko
MFC after: 2 weeks
Sponsored by: AVAGO Technologies
E.g: If the user wants to create more than 64VD on a controller,
it is not possible on current firmware/driver.
New feature and requirement to support upto 256VD, firmware/driver/apps need changes.
In addition to that, there must be a backward compatibility of the new driver with the
older firmware and vice versa.
RAID map is the interface between Driver and FW to fetch all required
fields(attributes) for each Virtual Drives.
In the earlier design driver was using the FW copy of RAID map where as
in the new design the Driver will keep the RAID map copy of its own; on which
it will operate for any raid map access in fast path.
Local driver raid map copy will provide ease of access through out the code
and provide generic interface for future FW raid map changes.
For the backward compatibility driver will notify FW that it supports 256VD
to the FW in driver capability field.
Based on the controller properly returned by the FW, the Driver will know
whether it supports 256VD or not and will copy the RAID map accordingly.
At any given time, driver will always have old or new Raid map.
Reviewed by : ambrisko
MFC after : 2 weeks
Sponsored by: AVAGO Technologies
This happen when converting any JBOD to RAID or creating
any new RAID from Unconfigured Drives.
Without this fix, user may see below call trace if WITNESS is enabled.
witness_warn() at witness_warn+0x4b5/frame 0xfffffe011f929a00
uma_zalloc_arg() at uma_zalloc_arg+0x3b/frame 0xfffffe011f929a70
malloc() at malloc+0x192/frame 0xfffffe011f929ac0
mrsas_bus_scan_sim() at mrsas_bus_scan_sim+0x32/frame 0xfffffe011f929af0
mrsas_aen_handler() at mrsas_aen_handler+0x11c/frame 0xfffffe011f929b20
taskqueue_run_locked() at taskqueue_run_locked+0xf0/frame 0xfffffe011f929b80
taskqueue_thread_loop() at taskqueue_thread_loop+0x9b/frame 0xfffffe011f929bb0
fork_exit() at fork_exit+0x84/frame 0xfffffe011f929bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe011f929bf0
Submitted by: kadesai
Reviewed by: ambrisko
MFC after: 3 days
