[PATCH v1 0/4] smartpqi: fixes and updates for 2.1.42-011

[PATCH v1 0/4] smartpqi: fixes and updates for 2.1.42-011

[David Strahan]

From: David Strahan <David.Strahan@microchip.com>

These patches are based on Martin Petersen's 7.2/scsi-queue tree
https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
 7.2/scsi-queue

This patch series includes four patches, with two main functional changes:

1. smartpqi-Fix-AIO-retry-marker-cleared-by-SCSI-core-between-dispatches

   On recent Linux kernels the driver can enter a retry loop on the
   AIO fast path when a request is retried, looping until timeout, and
   a diagnostic path that takes a physical drive offline on AIO-bypass
   failure is never entered.

   Registers a per-command initialization callback with the SCSI core
   so its presence causes the core to skip the per-dispatch clear of
   the retry marker, letting it survive the requeue so the AIO-to-RAID
   fallback proceeds as intended.

2. smartpqi-add-support-for-CCISS_BIG_PASSTHRU-ioctl

   Adds pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl
   requests. The existing passthru ioctl uses a 16-bit integer for the
   I/O buffer size, limiting transfers to 64KB. The big passthru ioctl
   uses BIG_IOCTL_Command_struct, which stores the buffer size as a
   32-bit integer, allowing the larger transfers required by some
   management utilities.

The other two patches:
3. smartpqi-add-new-pci-device-ids
   Adds PCI IDs for new Hurray Data, ZTE, and Ramaxel controllers.
   No functional changes.
4. smartpqi-update-driver-version-to-2.1.42-011
   Updates the driver version string.
   No functional changes.

[PATCH v1 1/4] smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

[David Strahan]

From: David Strahan <David.Strahan@microchip.com>

On recent Linux kernels the driver can enter a retry loop on the
AIO fast path when a request is retried, looping until timeout.
A diagnostic path that takes a physical drive offline on AIO-bypass
failure is also never entered on affected kernels.

Register a per-command initialization callback with the SCSI
core. Its presence causes the core to skip the per-dispatch
clear, so the retry marker now survives across the requeue and
the AIO-to-RAID fallback proceeds as intended. The driver takes
over the marker's lifetime: it is zeroed at tag allocation,
preserved across the retry requeue so the error path can act on
it, and cleared on terminal completion so the tag starts clean on
its next use.

Fixes: dce5c4afd035 ("scsi: core: Clear driver private data when retrying request")
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
Signed-off-by: David Strahan <david.strahan@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5ec583d..3a75b9f 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -66,6 +66,12 @@ static struct pqi_cmd_priv *pqi_cmd_priv(struct scsi_cmnd *cmd)
 	return scsi_cmd_priv(cmd);
 }
 
+static int pqi_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+{
+	memset(pqi_cmd_priv(cmd), 0, sizeof(struct pqi_cmd_priv));
+	return 0;
+}
+
 static void pqi_verify_structures(void);
 static void pqi_take_ctrl_offline(struct pqi_ctrl_info *ctrl_info,
 	enum pqi_ctrl_shutdown_reason ctrl_shutdown_reason);
@@ -5958,6 +5964,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
 	struct pqi_scsi_dev *device;
 	struct completion *wait;
 
+	/*
+	 * Clear the AIO-retry marker on final completion so the tag
+	 * starts clean on its next dispatch.  On DID_IMM_RETRY leave
+	 * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
+	 * bumps the marker to steer the requeue onto the RAID path,
+	 * and pqi_process_raid_io_error() consumes the non-zero
+	 * marker to offline a misbehaving drive.
+	 */
+	if (host_byte(scmd->result) != DID_IMM_RETRY)
+		pqi_cmd_priv(scmd)->this_residual = 0;
+
 	if (!scmd->device) {
 		set_host_byte(scmd, DID_NO_CONNECT);
 		return;
@@ -7612,6 +7629,7 @@ static const struct scsi_host_template pqi_driver_template = {
 	.sdev_groups = pqi_sdev_groups,
 	.shost_groups = pqi_shost_groups,
 	.cmd_size = sizeof(struct pqi_cmd_priv),
+	.init_cmd_priv = pqi_init_cmd_priv,
 };
 
 static int pqi_register_scsi(struct pqi_ctrl_info *ctrl_info)
-- 
2.52.0

[PATCH v1 2/4] smartpqi: add support for CCISS_BIG_PASSTHRU ioctl

[David Strahan]

From: David Strahan <David.Strahan@microchip.com>

smartpqi: add support for CCISS_BIG_PASSTHRU ioctl

Add pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl
requests. The existing passthru ioctl uses a 16-bit integer for
the I/O buffer size, limiting transfers to 64KB. The big passthru
ioctl uses BIG_IOCTL_Command_struct which stores the buffer size as
a 32-bit integer, allowing larger transfers required by some
management utilities.

Add CCISS_BIG_PASSTHRU_SUPPORTED to uapi/linux/cciss_ioctl.h and
return 0 from pqi_ioctl() to advertise driver support.
Userspace tools can send this ioctl to probe whether the driver
supports CCISS_BIG_PASSTHRU before issuing it.

Co-developed-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: David Strahan <david.strahan@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 144 ++++++++++++++++++++++++++
 include/uapi/linux/cciss_ioctl.h      |   1 +
 2 files changed, 145 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 3a75b9f..473f1c9 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -6935,6 +6935,144 @@ out:
 	return rc;
 }
 
+static int pqi_big_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
+{
+	int rc;
+	char *kernel_buffer = NULL;
+	u16 iu_length;
+	size_t sense_data_length;
+	BIG_IOCTL_Command_struct iocommand;
+	struct pqi_raid_path_request request;
+	struct pqi_raid_error_info pqi_error_info;
+	struct ciss_error_info ciss_error_info;
+
+	if (pqi_ctrl_offline(ctrl_info))
+		return -ENXIO;
+	if (pqi_ofa_in_progress(ctrl_info) && pqi_ctrl_blocked(ctrl_info))
+		return -EBUSY;
+	if (!arg)
+		return -EINVAL;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
+	if (copy_from_user(&iocommand, arg, sizeof(iocommand)))
+		return -EFAULT;
+	if (iocommand.buf_size < 1 &&
+		iocommand.Request.Type.Direction != XFER_NONE)
+		return -EINVAL;
+	if (iocommand.Request.CDBLen > sizeof(request.cdb))
+		return -EINVAL;
+	if (iocommand.Request.Type.Type != TYPE_CMD)
+		return -EINVAL;
+
+	switch (iocommand.Request.Type.Direction) {
+	case XFER_NONE:
+	case XFER_WRITE:
+	case XFER_READ:
+	case XFER_READ | XFER_WRITE:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (iocommand.buf_size > 0) {
+		kernel_buffer = kmalloc(iocommand.buf_size, GFP_KERNEL);
+		if (!kernel_buffer)
+			return -ENOMEM;
+		if (iocommand.Request.Type.Direction & XFER_WRITE) {
+			if (copy_from_user(kernel_buffer, iocommand.buf,
+				iocommand.buf_size)) {
+				rc = -EFAULT;
+				goto out;
+			}
+		} else {
+			memset(kernel_buffer, 0, iocommand.buf_size);
+		}
+	}
+
+	memset(&request, 0, sizeof(request));
+
+	request.header.iu_type = PQI_REQUEST_IU_RAID_PATH_IO;
+	iu_length = offsetof(struct pqi_raid_path_request, sg_descriptors) -
+		PQI_REQUEST_HEADER_LENGTH;
+	memcpy(request.lun_number, iocommand.LUN_info.LunAddrBytes, sizeof(request.lun_number));
+	memcpy(request.cdb, iocommand.Request.CDB, iocommand.Request.CDBLen);
+	request.additional_cdb_bytes_usage = SOP_ADDITIONAL_CDB_BYTES_0;
+
+	switch (iocommand.Request.Type.Direction) {
+	case XFER_NONE:
+		request.data_direction = SOP_NO_DIRECTION_FLAG;
+		break;
+	case XFER_WRITE:
+		request.data_direction = SOP_WRITE_FLAG;
+		break;
+	case XFER_READ:
+		request.data_direction = SOP_READ_FLAG;
+		break;
+	case XFER_READ | XFER_WRITE:
+		request.data_direction = SOP_BIDIRECTIONAL;
+		break;
+	}
+
+	request.task_attribute = SOP_TASK_ATTRIBUTE_SIMPLE;
+
+	if (iocommand.buf_size > 0) {
+		put_unaligned_le32(iocommand.buf_size, &request.buffer_length);
+
+		rc = pqi_map_single(ctrl_info->pci_dev,
+			&request.sg_descriptors[0], kernel_buffer,
+			iocommand.buf_size, DMA_BIDIRECTIONAL);
+		if (rc)
+			goto out;
+
+		iu_length += sizeof(request.sg_descriptors[0]);
+	}
+
+	put_unaligned_le16(iu_length, &request.header.iu_length);
+
+	if (ctrl_info->raid_iu_timeout_supported)
+		put_unaligned_le32(iocommand.Request.Timeout, &request.timeout);
+
+	rc = pqi_submit_raid_request_synchronous(ctrl_info, &request.header,
+		PQI_SYNC_FLAGS_INTERRUPTABLE, &pqi_error_info);
+
+	if (iocommand.buf_size > 0)
+		pqi_pci_unmap(ctrl_info->pci_dev, request.sg_descriptors, 1, DMA_BIDIRECTIONAL);
+
+	memset(&iocommand.error_info, 0, sizeof(iocommand.error_info));
+
+	if (rc == 0) {
+		pqi_error_info_to_ciss(&pqi_error_info, &ciss_error_info);
+		iocommand.error_info.ScsiStatus = ciss_error_info.scsi_status;
+		iocommand.error_info.CommandStatus = ciss_error_info.command_status;
+		sense_data_length = ciss_error_info.sense_data_length;
+		if (sense_data_length) {
+			if (sense_data_length > sizeof(iocommand.error_info.SenseInfo))
+				sense_data_length = sizeof(iocommand.error_info.SenseInfo);
+			memcpy(iocommand.error_info.SenseInfo,
+				pqi_error_info.data, sense_data_length);
+			iocommand.error_info.SenseLen = sense_data_length;
+		}
+	}
+
+	if (copy_to_user(arg, &iocommand, sizeof(iocommand))) {
+		rc = -EFAULT;
+		goto out;
+	}
+
+	if (rc == 0 && iocommand.buf_size > 0 &&
+		(iocommand.Request.Type.Direction & XFER_READ)) {
+		if (copy_to_user(iocommand.buf, kernel_buffer,
+			iocommand.buf_size)) {
+			rc = -EFAULT;
+		}
+	}
+
+out:
+	kfree(kernel_buffer);
+
+	return rc;
+}
+
 static int pqi_ioctl(struct scsi_device *sdev, unsigned int cmd,
 		     void __user *arg)
 {
@@ -6958,6 +7096,12 @@ static int pqi_ioctl(struct scsi_device *sdev, unsigned int cmd,
 	case CCISS_PASSTHRU:
 		rc = pqi_passthru_ioctl(ctrl_info, arg);
 		break;
+	case CCISS_BIG_PASSTHRU:
+		rc = pqi_big_passthru_ioctl(ctrl_info, arg);
+		break;
+	case CCISS_BIG_PASSTHRU_SUPPORTED:
+		rc = 0;
+		break;
 	default:
 		rc = -EINVAL;
 		break;
diff --git a/include/uapi/linux/cciss_ioctl.h b/include/uapi/linux/cciss_ioctl.h
index 5622301..8295f1b 100644
--- a/include/uapi/linux/cciss_ioctl.h
+++ b/include/uapi/linux/cciss_ioctl.h
@@ -85,5 +85,6 @@ typedef struct _LogvolInfo_struct{
 #define CCISS_RESCANDISK   _IO(CCISS_IOC_MAGIC, 16)
 #define CCISS_GETLUNINFO   _IOR(CCISS_IOC_MAGIC, 17, LogvolInfo_struct)
 #define CCISS_BIG_PASSTHRU _IOWR(CCISS_IOC_MAGIC, 18, BIG_IOCTL_Command_struct)
+#define CCISS_BIG_PASSTHRU_SUPPORTED _IO(CCISS_IOC_MAGIC, 19)
 
 #endif /* _UAPICCISS_IOCTLH */
-- 
2.52.0

[PATCH v1 3/4] smartpqi: add new pci device-ids

[David Strahan]

From: David Strahan <David.Strahan@microchip.com>

smartpqi: Add new controller PCI IDs

All PCI ID entries in Hex.

Add PCI IDs for Hurray Data controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 207d / 4246
                                            9005 / 028f / 207d / 4256
                                            9005 / 028f / 207d / 4356
                                            9005 / 028f / 207d / 4940
                                            9005 / 028f / 207d / 4a46

Add PCI IDs for ZTE controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1cf2 / 5451
                                            9005 / 028f / 1cf2 / 5452
                                            9005 / 028f / 1cf2 / 5453

Add PCI ID for Ramaxel controller:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1f3f / 0670

Signed-off-by: David Strahan <david.strahan@microchip.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 36 +++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 473f1c9..8c2fc0d 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -10314,10 +10314,30 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4240)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4246)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4256)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4356)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4840)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4940)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4a46)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_ADVANTECH, 0x8312)
@@ -10502,6 +10522,18 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x544f)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5451)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5452)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5453)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x54da)
@@ -10542,6 +10574,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1f3f, 0x0610)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1f3f, 0x0670)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_LENOVO, 0x0220)
-- 
2.52.0

[PATCH v1 4/4] smartpqi: update version to 2.1.42-011

[David Strahan]

From: David Strahan <David.Strahan@microchip.com>

Update driver version to 2.1.42-011

Signed-off-by: David Strahan <david.strahan@microchip.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 8c2fc0d..140e8a6 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -34,11 +34,11 @@
 #define BUILD_TIMESTAMP
 #endif
 
-#define DRIVER_VERSION		"2.1.36-026"
+#define DRIVER_VERSION		"2.1.42-011"
 #define DRIVER_MAJOR		2
 #define DRIVER_MINOR		1
-#define DRIVER_RELEASE		36
-#define DRIVER_REVISION		26
+#define DRIVER_RELEASE		42
+#define DRIVER_REVISION		11
 
 #define DRIVER_NAME		"Microchip SmartPQI Driver (v" \
 				DRIVER_VERSION BUILD_TIMESTAMP ")"
-- 
2.52.0

Re: [PATCH v1 2/4] smartpqi: add support for CCISS_BIG_PASSTHRU ioctl

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unbounded `kmalloc` of user-controlled size prevents large transfers and triggers page allocation warnings.
- [High] Missing 32-bit compat ioctl translation for `CCISS_BIG_PASSTHRU`.
--

--- Patch [2]: [PATCH v1 2/4] smartpqi: add support for CCISS_BIG_PASSTHRU ioctl ---
commit 89c5d7119f80d6cae47c460c85b511017c1cd263
Author: David Strahan <David.Strahan@microchip.com>

smartpqi: add support for CCISS_BIG_PASSTHRU ioctl
    
This commit adds pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl
requests. The new ioctl uses BIG_IOCTL_Command_struct which stores the buffer
size as a 32-bit integer, allowing larger transfers than the previous 64KB
limit.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> index 3a75b9fbedf45..473f1c9e47380 100644
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c

[ ... ]

> @@ -6935,6 +6935,144 @@ static int pqi_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
>  	return rc;
>  }
>  
> +static int pqi_big_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
> +{

[ ... ]

> +	if (iocommand.buf_size > 0) {
> +		kernel_buffer = kmalloc(iocommand.buf_size, GFP_KERNEL);

[Severity: High]
Will this trigger page allocation warnings for large transfers?

Since iocommand.buf_size is a user-controlled 32-bit integer passed directly
here, a large allocation without __GFP_NOWARN could trigger a page allocation
warning if it exceeds MAX_PAGE_ORDER. This might panic systems that have 
panic_on_warn set.

> +		if (!kernel_buffer)
> +			return -ENOMEM;

[ ... ]

> +	if (iocommand.buf_size > 0) {
> +		put_unaligned_le32(iocommand.buf_size, &request.buffer_length);
> +
> +		rc = pqi_map_single(ctrl_info->pci_dev,
> +			&request.sg_descriptors[0], kernel_buffer,
> +			iocommand.buf_size, DMA_BIDIRECTIONAL);

[Severity: High]
Does this prevent the driver from handling the large chunked transfers this
ioctl was designed for?

Since the entire buffer is mapped to a single scatter-gather descriptor here
(sg_descriptors[0]), it seems to require physically contiguous memory from
the earlier kmalloc() call, rather than utilizing scatter-gather arrays for
large payloads. Memory fragmentation could cause large transfer requests to fail.

> +		if (rc)
> +			goto out;

[ ... ]

> @@ -6958,6 +7096,12 @@ static int pqi_ioctl(struct scsi_device *sdev, unsigned int cmd,
>  	case CCISS_PASSTHRU:
>  		rc = pqi_passthru_ioctl(ctrl_info, arg);
>  		break;
> +	case CCISS_BIG_PASSTHRU:
> +		rc = pqi_big_passthru_ioctl(ctrl_info, arg);
> +		break;
> +	case CCISS_BIG_PASSTHRU_SUPPORTED:
> +		rc = 0;
> +		break;
>  	default:
>  		rc = -EINVAL;

[Severity: High]
Is a compat_ioctl handler needed for 32-bit applications?

BIG_IOCTL_Command_struct contains a trailing pointer (BYTE __user *buf), so
its size varies between 32-bit and 64-bit architectures (88 vs 96 bytes).
Because the _IOWR macro embeds the structure size in the ioctl command
number, a 32-bit application will emit a different command number
(e.g., CCISS_BIG_PASSTHRU32) than the 64-bit kernel expects.

Since there is no compat_ioctl callback for the smartpqi driver, will the
32-bit ioctl fall through to this default -EINVAL case?

Interestingly, since CCISS_BIG_PASSTHRU_SUPPORTED uses the _IO macro, it
is size-independent, so 32-bit utilities might successfully probe for
support but fail when actually issuing the transfer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722220401.6357-1-david.strahan@microchip.com?part=2

Re: [PATCH v1 1/4] smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] State leakage across blk-mq tag reuse leads to erroneous drive offlining. By registering `.init_cmd_priv`, the driver opts out of the SCSI core's per-dispatch zeroing of private command data, but fails to reliably clear `this_residual` on all completion paths.
--

--- Patch [1]: [PATCH v1 1/4] smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. ---
commit 594ef5db683084e131dde7930f0e556c7584b609
Author: David Strahan <David.Strahan@microchip.com>

smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

This commit fixes an AIO retry loop issue by registering a per-command
initialization callback with the SCSI core to skip the per-dispatch clear.
This allows the retry marker to survive requeues, while the driver takes
over the responsibility of clearing it on terminal completion.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> index 5ec583dc2e7df..3a75b9fbedf45 100644
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c
> @@ -66,6 +66,12 @@ static struct pqi_cmd_priv *pqi_cmd_priv(struct scsi_cmnd *cmd)
>  	return scsi_cmd_priv(cmd);
>  }
>  
> +static int pqi_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
> +{
> +	memset(pqi_cmd_priv(cmd), 0, sizeof(struct pqi_cmd_priv));
> +	return 0;
> +}
> +

[ ... ]

> @@ -5958,6 +5964,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
>  	struct pqi_scsi_dev *device;
>  	struct completion *wait;
>  
> +	/*
> +	 * Clear the AIO-retry marker on final completion so the tag
> +	 * starts clean on its next dispatch.  On DID_IMM_RETRY leave
> +	 * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
> +	 * bumps the marker to steer the requeue onto the RAID path,
> +	 * and pqi_process_raid_io_error() consumes the non-zero
> +	 * marker to offline a misbehaving drive.
> +	 */
> +	if (host_byte(scmd->result) != DID_IMM_RETRY)
> +		pqi_cmd_priv(scmd)->this_residual = 0;
> +

[Severity: High]
Does this reliably clear the marker on all completion paths?

If a command is aborted via the SCSI error handler, it can be terminated
directly by the SCSI midlayer via scsi_finish_command(), which bypasses
pqi_prep_for_scsi_done().

Because pqi_init_cmd_priv() prevents the core from zeroing the private data
on dispatch, a reused blk-mq tag could inherit this stale marker state.

If the dirty tag is subsequently used for a request to a physical drive and
encounters an ILLEGAL_REQUEST, it appears pqi_process_raid_io_error() could
misinterpret the leaked marker and erroneously offline a healthy drive:

pqi_process_raid_io_error() {
    ...
    if (pqi_cmd_priv(scmd)->this_residual &&
        !pqi_is_logical_device(scmd->device->hostdata) &&
        scsi_status == SAM_STAT_CHECK_CONDITION &&
        host_byte == DID_OK &&
        sense_data_length &&
        scsi_normalize_sense(error_info->data, sense_data_length, &sshdr) &&
        sshdr.sense_key == ILLEGAL_REQUEST &&
        sshdr.asc == 0x26 &&
        sshdr.ascq == 0x0) {
            host_byte = DID_NO_CONNECT;
            pqi_take_device_offline(scmd->device, "AIO");
    ...
}

Could this lead to unintended drive offlining if the tag is reused?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722220401.6357-1-david.strahan@microchip.com?part=1