Linux SCSI subsystem development
 help / color / mirror / Atom feed
* [PATCH] scsi: smartpqi: add new pci device-ids
@ 2026-07-22 20:23 David Strahan
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl David Strahan
                   ` (3 more replies)
  0 siblings, 4 replies; 7+ messages in thread
From: David Strahan @ 2026-07-22 20:23 UTC (permalink / raw)
  To: david.strahan, linux-scsi; +Cc: don.brace

From: David Strahan <David.Strahan@microchip.com>

All PCI ID entries in Hex.

Add PCI IDs for Hurray Data controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 207d / 4246
                                            9005 / 028f / 207d / 4256
                                            9005 / 028f / 207d / 4356
                                            9005 / 028f / 207d / 4940
                                            9005 / 028f / 207d / 4a46

Add PCI IDs for ZTE controllers:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1cf2 / 5451
                                            9005 / 028f / 1cf2 / 5452
                                            9005 / 028f / 1cf2 / 5453

Add PCI ID for Ramaxel controller:
                                            VID  / DID  / SVID / SDID
                                            ----   ----   ----   ----
                                            9005 / 028f / 1f3f / 0670

Signed-off-by: David Strahan <david.strahan@microchip.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 36 +++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 473f1c9..8c2fc0d 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -10314,10 +10314,30 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4240)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4246)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4256)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4356)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x207d, 0x4840)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4940)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x207d, 0x4a46)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_ADVANTECH, 0x8312)
@@ -10502,6 +10522,18 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x544f)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5451)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5452)
+	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1cf2, 0x5453)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1cf2, 0x54da)
@@ -10542,6 +10574,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       0x1f3f, 0x0610)
 	},
+	{
+		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+			       0x1f3f, 0x0670)
+	},
 	{
 		PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
 			       PCI_VENDOR_ID_LENOVO, 0x0220)
-- 
2.47.3


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl
  2026-07-22 20:23 [PATCH] scsi: smartpqi: add new pci device-ids David Strahan
@ 2026-07-22 20:23 ` David Strahan
  2026-07-22 20:39   ` sashiko-bot
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches David Strahan
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 7+ messages in thread
From: David Strahan @ 2026-07-22 20:23 UTC (permalink / raw)
  To: david.strahan, linux-scsi; +Cc: don.brace

From: David Strahan <David.Strahan@microchip.com>

Add pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl
requests. The existing passthru ioctl uses a 16-bit integer for
the I/O buffer size, limiting transfers to 64KB. The big passthru
ioctl uses BIG_IOCTL_Command_struct which stores the buffer size as
a 32-bit integer, allowing larger transfers required by some
management utilities.

Add CCISS_BIG_PASSTHRU_SUPPORTED to uapi/linux/cciss_ioctl.h and
return 0 from pqi_ioctl() to advertise driver support.
Userspace tools can send this ioctl to probe whether the driver
supports CCISS_BIG_PASSTHRU before issuing it.

Co-developed-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: David Strahan <david.strahan@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 144 ++++++++++++++++++++++++++
 include/uapi/linux/cciss_ioctl.h      |   1 +
 2 files changed, 145 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 3a75b9f..473f1c9 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -6935,6 +6935,144 @@ out:
 	return rc;
 }
 
+static int pqi_big_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
+{
+	int rc;
+	char *kernel_buffer = NULL;
+	u16 iu_length;
+	size_t sense_data_length;
+	BIG_IOCTL_Command_struct iocommand;
+	struct pqi_raid_path_request request;
+	struct pqi_raid_error_info pqi_error_info;
+	struct ciss_error_info ciss_error_info;
+
+	if (pqi_ctrl_offline(ctrl_info))
+		return -ENXIO;
+	if (pqi_ofa_in_progress(ctrl_info) && pqi_ctrl_blocked(ctrl_info))
+		return -EBUSY;
+	if (!arg)
+		return -EINVAL;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
+	if (copy_from_user(&iocommand, arg, sizeof(iocommand)))
+		return -EFAULT;
+	if (iocommand.buf_size < 1 &&
+		iocommand.Request.Type.Direction != XFER_NONE)
+		return -EINVAL;
+	if (iocommand.Request.CDBLen > sizeof(request.cdb))
+		return -EINVAL;
+	if (iocommand.Request.Type.Type != TYPE_CMD)
+		return -EINVAL;
+
+	switch (iocommand.Request.Type.Direction) {
+	case XFER_NONE:
+	case XFER_WRITE:
+	case XFER_READ:
+	case XFER_READ | XFER_WRITE:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (iocommand.buf_size > 0) {
+		kernel_buffer = kmalloc(iocommand.buf_size, GFP_KERNEL);
+		if (!kernel_buffer)
+			return -ENOMEM;
+		if (iocommand.Request.Type.Direction & XFER_WRITE) {
+			if (copy_from_user(kernel_buffer, iocommand.buf,
+				iocommand.buf_size)) {
+				rc = -EFAULT;
+				goto out;
+			}
+		} else {
+			memset(kernel_buffer, 0, iocommand.buf_size);
+		}
+	}
+
+	memset(&request, 0, sizeof(request));
+
+	request.header.iu_type = PQI_REQUEST_IU_RAID_PATH_IO;
+	iu_length = offsetof(struct pqi_raid_path_request, sg_descriptors) -
+		PQI_REQUEST_HEADER_LENGTH;
+	memcpy(request.lun_number, iocommand.LUN_info.LunAddrBytes, sizeof(request.lun_number));
+	memcpy(request.cdb, iocommand.Request.CDB, iocommand.Request.CDBLen);
+	request.additional_cdb_bytes_usage = SOP_ADDITIONAL_CDB_BYTES_0;
+
+	switch (iocommand.Request.Type.Direction) {
+	case XFER_NONE:
+		request.data_direction = SOP_NO_DIRECTION_FLAG;
+		break;
+	case XFER_WRITE:
+		request.data_direction = SOP_WRITE_FLAG;
+		break;
+	case XFER_READ:
+		request.data_direction = SOP_READ_FLAG;
+		break;
+	case XFER_READ | XFER_WRITE:
+		request.data_direction = SOP_BIDIRECTIONAL;
+		break;
+	}
+
+	request.task_attribute = SOP_TASK_ATTRIBUTE_SIMPLE;
+
+	if (iocommand.buf_size > 0) {
+		put_unaligned_le32(iocommand.buf_size, &request.buffer_length);
+
+		rc = pqi_map_single(ctrl_info->pci_dev,
+			&request.sg_descriptors[0], kernel_buffer,
+			iocommand.buf_size, DMA_BIDIRECTIONAL);
+		if (rc)
+			goto out;
+
+		iu_length += sizeof(request.sg_descriptors[0]);
+	}
+
+	put_unaligned_le16(iu_length, &request.header.iu_length);
+
+	if (ctrl_info->raid_iu_timeout_supported)
+		put_unaligned_le32(iocommand.Request.Timeout, &request.timeout);
+
+	rc = pqi_submit_raid_request_synchronous(ctrl_info, &request.header,
+		PQI_SYNC_FLAGS_INTERRUPTABLE, &pqi_error_info);
+
+	if (iocommand.buf_size > 0)
+		pqi_pci_unmap(ctrl_info->pci_dev, request.sg_descriptors, 1, DMA_BIDIRECTIONAL);
+
+	memset(&iocommand.error_info, 0, sizeof(iocommand.error_info));
+
+	if (rc == 0) {
+		pqi_error_info_to_ciss(&pqi_error_info, &ciss_error_info);
+		iocommand.error_info.ScsiStatus = ciss_error_info.scsi_status;
+		iocommand.error_info.CommandStatus = ciss_error_info.command_status;
+		sense_data_length = ciss_error_info.sense_data_length;
+		if (sense_data_length) {
+			if (sense_data_length > sizeof(iocommand.error_info.SenseInfo))
+				sense_data_length = sizeof(iocommand.error_info.SenseInfo);
+			memcpy(iocommand.error_info.SenseInfo,
+				pqi_error_info.data, sense_data_length);
+			iocommand.error_info.SenseLen = sense_data_length;
+		}
+	}
+
+	if (copy_to_user(arg, &iocommand, sizeof(iocommand))) {
+		rc = -EFAULT;
+		goto out;
+	}
+
+	if (rc == 0 && iocommand.buf_size > 0 &&
+		(iocommand.Request.Type.Direction & XFER_READ)) {
+		if (copy_to_user(iocommand.buf, kernel_buffer,
+			iocommand.buf_size)) {
+			rc = -EFAULT;
+		}
+	}
+
+out:
+	kfree(kernel_buffer);
+
+	return rc;
+}
+
 static int pqi_ioctl(struct scsi_device *sdev, unsigned int cmd,
 		     void __user *arg)
 {
@@ -6958,6 +7096,12 @@ static int pqi_ioctl(struct scsi_device *sdev, unsigned int cmd,
 	case CCISS_PASSTHRU:
 		rc = pqi_passthru_ioctl(ctrl_info, arg);
 		break;
+	case CCISS_BIG_PASSTHRU:
+		rc = pqi_big_passthru_ioctl(ctrl_info, arg);
+		break;
+	case CCISS_BIG_PASSTHRU_SUPPORTED:
+		rc = 0;
+		break;
 	default:
 		rc = -EINVAL;
 		break;
diff --git a/include/uapi/linux/cciss_ioctl.h b/include/uapi/linux/cciss_ioctl.h
index 5622301..8295f1b 100644
--- a/include/uapi/linux/cciss_ioctl.h
+++ b/include/uapi/linux/cciss_ioctl.h
@@ -85,5 +85,6 @@ typedef struct _LogvolInfo_struct{
 #define CCISS_RESCANDISK   _IO(CCISS_IOC_MAGIC, 16)
 #define CCISS_GETLUNINFO   _IOR(CCISS_IOC_MAGIC, 17, LogvolInfo_struct)
 #define CCISS_BIG_PASSTHRU _IOWR(CCISS_IOC_MAGIC, 18, BIG_IOCTL_Command_struct)
+#define CCISS_BIG_PASSTHRU_SUPPORTED _IO(CCISS_IOC_MAGIC, 19)
 
 #endif /* _UAPICCISS_IOCTLH */
-- 
2.47.3


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches
  2026-07-22 20:23 [PATCH] scsi: smartpqi: add new pci device-ids David Strahan
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl David Strahan
@ 2026-07-22 20:23 ` David Strahan
  2026-07-22 20:39   ` sashiko-bot
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: update version to 2.1.42-011 David Strahan
  2026-07-22 22:48 ` [PATCH] scsi: smartpqi: add new pci device-ids (please disregard, duplicate) David Strahan
  3 siblings, 1 reply; 7+ messages in thread
From: David Strahan @ 2026-07-22 20:23 UTC (permalink / raw)
  To: david.strahan, linux-scsi; +Cc: don.brace

From: David Strahan <David.Strahan@microchip.com>

On recent Linux kernels the driver can enter a retry loop on the
AIO fast path when a request is retried, looping until timeout.
A diagnostic path that takes a physical drive offline on AIO-bypass
failure is also never entered on affected kernels.

Register a per-command initialization callback with the SCSI
core. Its presence causes the core to skip the per-dispatch
clear, so the retry marker now survives across the requeue and
the AIO-to-RAID fallback proceeds as intended. The driver takes
over the marker's lifetime: it is zeroed at tag allocation,
preserved across the retry requeue so the error path can act on
it, and cleared on terminal completion so the tag starts clean on
its next use.

Fixes: dce5c4afd035 ("scsi: core: Clear driver private data when retrying request")
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
Signed-off-by: David Strahan <david.strahan@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5ec583d..3a75b9f 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -66,6 +66,12 @@ static struct pqi_cmd_priv *pqi_cmd_priv(struct scsi_cmnd *cmd)
 	return scsi_cmd_priv(cmd);
 }
 
+static int pqi_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+{
+	memset(pqi_cmd_priv(cmd), 0, sizeof(struct pqi_cmd_priv));
+	return 0;
+}
+
 static void pqi_verify_structures(void);
 static void pqi_take_ctrl_offline(struct pqi_ctrl_info *ctrl_info,
 	enum pqi_ctrl_shutdown_reason ctrl_shutdown_reason);
@@ -5958,6 +5964,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
 	struct pqi_scsi_dev *device;
 	struct completion *wait;
 
+	/*
+	 * Clear the AIO-retry marker on final completion so the tag
+	 * starts clean on its next dispatch.  On DID_IMM_RETRY leave
+	 * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
+	 * bumps the marker to steer the requeue onto the RAID path,
+	 * and pqi_process_raid_io_error() consumes the non-zero
+	 * marker to offline a misbehaving drive.
+	 */
+	if (host_byte(scmd->result) != DID_IMM_RETRY)
+		pqi_cmd_priv(scmd)->this_residual = 0;
+
 	if (!scmd->device) {
 		set_host_byte(scmd, DID_NO_CONNECT);
 		return;
@@ -7612,6 +7629,7 @@ static const struct scsi_host_template pqi_driver_template = {
 	.sdev_groups = pqi_sdev_groups,
 	.shost_groups = pqi_shost_groups,
 	.cmd_size = sizeof(struct pqi_cmd_priv),
+	.init_cmd_priv = pqi_init_cmd_priv,
 };
 
 static int pqi_register_scsi(struct pqi_ctrl_info *ctrl_info)
-- 
2.47.3


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH] scsi: smartpqi: update version to 2.1.42-011
  2026-07-22 20:23 [PATCH] scsi: smartpqi: add new pci device-ids David Strahan
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl David Strahan
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches David Strahan
@ 2026-07-22 20:23 ` David Strahan
  2026-07-22 22:48 ` [PATCH] scsi: smartpqi: add new pci device-ids (please disregard, duplicate) David Strahan
  3 siblings, 0 replies; 7+ messages in thread
From: David Strahan @ 2026-07-22 20:23 UTC (permalink / raw)
  To: david.strahan, linux-scsi; +Cc: don.brace

From: David Strahan <David.Strahan@microchip.com>

Update driver version to 2.1.42-011

Signed-off-by: David Strahan <david.strahan@microchip.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 8c2fc0d..140e8a6 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -34,11 +34,11 @@
 #define BUILD_TIMESTAMP
 #endif
 
-#define DRIVER_VERSION		"2.1.36-026"
+#define DRIVER_VERSION		"2.1.42-011"
 #define DRIVER_MAJOR		2
 #define DRIVER_MINOR		1
-#define DRIVER_RELEASE		36
-#define DRIVER_REVISION		26
+#define DRIVER_RELEASE		42
+#define DRIVER_REVISION		11
 
 #define DRIVER_NAME		"Microchip SmartPQI Driver (v" \
 				DRIVER_VERSION BUILD_TIMESTAMP ")"
-- 
2.47.3


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl David Strahan
@ 2026-07-22 20:39   ` sashiko-bot
  0 siblings, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-07-22 20:39 UTC (permalink / raw)
  To: David Strahan; +Cc: linux-scsi

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unbounded user-controlled kmalloc and hardware transfer violation in pqi_big_passthru_ioctl
--

--- Patch [1]: [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl ---
commit 76afabc08948098cc8542c214646dcdc2c4154bf
Author: David Strahan <David.Strahan@microchip.com>

scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl

This commit adds pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl
requests. It allows larger transfer sizes by using BIG_IOCTL_Command_struct
which stores the buffer size as a 32-bit integer.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c
[ ... ]
> @@ -6918,6 +6918,144 @@ static int pqi_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
[ ... ]
> +static int pqi_big_passthru_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
> +{
[ ... ]
> +	if (iocommand.buf_size > 0) {
> +		kernel_buffer = kmalloc(iocommand.buf_size, GFP_KERNEL);

[Severity: High]
Since buf_size is a 32-bit integer controlled by userspace, can passing it
directly to kmalloc() with GFP_KERNEL cause page allocation warnings or
trigger memory pressure if the size is excessively large?

Could this allocation benefit from bounds checking or __GFP_NOWARN?

> +		if (!kernel_buffer)
> +			return -ENOMEM;
[ ... ]
> +	if (iocommand.buf_size > 0) {
> +		put_unaligned_le32(iocommand.buf_size, &request.buffer_length);
> +
> +		rc = pqi_map_single(ctrl_info->pci_dev,
> +			&request.sg_descriptors[0], kernel_buffer,
> +			iocommand.buf_size, DMA_BIDIRECTIONAL);

[Severity: High]
Does mapping the entire contiguous buffer into a single SG descriptor ignore
the hardware's max_transfer_size limits and the malloc_size chunking
mechanism?

The BIG_IOCTL_Command_struct is explicitly designed to break large transfers
into malloc_size chunks across multiple SG entries. This implementation
places everything into a single descriptor. Can sending an unchunked oversized
DMA request crash the controller firmware or cause a hardware hang?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722202327.5242-2-david.strahan@microchip.com?part=1

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches David Strahan
@ 2026-07-22 20:39   ` sashiko-bot
  0 siblings, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-07-22 20:39 UTC (permalink / raw)
  To: David Strahan; +Cc: linux-scsi

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The driver-private retry marker (`this_residual`) is leaked across block layer tag reuses if a command completing with `DID_IMM_RETRY` is terminally completed by the SCSI midlayer. This permanently poisons the tag, disabling AIO bypass for future requests and causing the driver to erroneously offline healthy physical drives on routine errors.
--

--- Patch [1]: [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches ---
commit b11e42cf8728d0b2c04d732af5bc5bfb1648bc25
Author: David Strahan <David.Strahan@microchip.com>

scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches

This patch registers a per-command initialization callback to prevent the
SCSI core from clearing driver private data between dispatches. It allows an
AIO retry marker (this_residual) to survive requeues, with the driver taking
over the responsibility of clearing the marker on terminal completions.

> diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
> --- a/drivers/scsi/smartpqi/smartpqi_init.c
> +++ b/drivers/scsi/smartpqi/smartpqi_init.c

[ ... ]

> @@ -5958,6 +5964,17 @@ void pqi_prep_for_scsi_done(struct scsi_cmnd *scmd)
>  	struct pqi_scsi_dev *device;
>  	struct completion *wait;
>  
> +	/*
> +	 * Clear the AIO-retry marker on final completion so the tag
> +	 * starts clean on its next dispatch.  On DID_IMM_RETRY leave
> +	 * it intact: pqi_aio_io_complete() sets DID_IMM_RETRY and
> +	 * bumps the marker to steer the requeue onto the RAID path,
> +	 * and pqi_process_raid_io_error() consumes the non-zero
> +	 * marker to offline a misbehaving drive.
> +	 */
> +	if (host_byte(scmd->result) != DID_IMM_RETRY)
> +		pqi_cmd_priv(scmd)->this_residual = 0;
> +

[Severity: High]
Does this code risk leaking the this_residual marker across unrelated
requests that reuse the same blk-mq tag?

If a command completing with DID_IMM_RETRY is terminally completed by the
SCSI midlayer instead of being requeued (for instance, if
scsi_cmd_runtime_exceeced(cmd) overrides the disposition to SUCCESS in
scsi_lib.c:scsi_complete()), the driver-private command data will not be
cleared here.

Because this patch disables the SCSI core's per-dispatch zeroing via
pqi_init_cmd_priv(), the stale this_residual > 0 marker would remain on
the tag.

If that poisoned tag is reused for a new request targeting a physical drive,
and the new request encounters a routine SCSI error (like ILLEGAL_REQUEST),
would pqi_process_raid_io_error() misinterpret the stale marker as a failed
AIO retry and erroneously call pqi_take_device_offline() on a healthy
physical drive?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722202327.5242-3-david.strahan@microchip.com?part=1

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] scsi: smartpqi: add new pci device-ids (please disregard, duplicate)
  2026-07-22 20:23 [PATCH] scsi: smartpqi: add new pci device-ids David Strahan
                   ` (2 preceding siblings ...)
  2026-07-22 20:23 ` [PATCH] scsi: smartpqi: update version to 2.1.42-011 David Strahan
@ 2026-07-22 22:48 ` David Strahan
  3 siblings, 0 replies; 7+ messages in thread
From: David Strahan @ 2026-07-22 22:48 UTC (permalink / raw)
  To: linux-scsi; +Cc: David Strahan

Please disregard this patch and the three others posted in this same
thread (CCISS_BIG_PASSTHRU ioctl support, the AIO retry marker fix,
and the version bump to 2.1.42-011). They were sent by mistake, from
a stale local copy, without a cover letter or version tag.

A correctly formatted series covering the same 4 changes has been
posted separately as "[PATCH v1 0/4] smartpqi: fixes and updates for
2.1.42-011":

  https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/

Apologies for the noise.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2026-07-22 22:49 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-22 20:23 [PATCH] scsi: smartpqi: add new pci device-ids David Strahan
2026-07-22 20:23 ` [PATCH] scsi: smartpqi: add support for CCISS_BIG_PASSTHRU ioctl David Strahan
2026-07-22 20:39   ` sashiko-bot
2026-07-22 20:23 ` [PATCH] scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches David Strahan
2026-07-22 20:39   ` sashiko-bot
2026-07-22 20:23 ` [PATCH] scsi: smartpqi: update version to 2.1.42-011 David Strahan
2026-07-22 22:48 ` [PATCH] scsi: smartpqi: add new pci device-ids (please disregard, duplicate) David Strahan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox