From: Arun Easi <aeasi@marvell.com>

Date: Tue, 12 Jul 2022 22:20:39 -0700

Subject: scsi: qla2xxx: Fix response queue handler reading stale packets

Patch-mainline: v5.20-rc1

Git-commit: b1f707146923335849fb70237eec27d4d1ae7d62

References: bsc#1201651

On some platforms, the current logic of relying on finding new packet

solely based on signature pattern can lead to driver reading stale

packets. Though this is a bug in those platforms, reduce such exposures by

limiting reading packets until the IN pointer.

Two module parameters are introduced:

  ql2xrspq_follow_inptr:

    When set, on newer adapters that has queue pointer shadowing, look for

    response packets only until response queue in pointer.

    When reset, response packets are read based on a signature pattern

    logic (old way).

  ql2xrspq_follow_inptr_legacy:

    Like ql2xrspq_follow_inptr, but for those adapters where there is no

    queue pointer shadowing.

Link: https://lore.kernel.org/r/20220713052045.10683-5-njavali@marvell.com

Cc: stable@vger.kernel.org

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

Signed-off-by: Arun Easi <aeasi@marvell.com>

Signed-off-by: Nilesh Javali <njavali@marvell.com>

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Acked-by: Daniel Wagner <dwagner@suse.de>

---

 drivers/scsi/qla2xxx/qla_gbl.h |    2 ++

 drivers/scsi/qla2xxx/qla_isr.c |   24 +++++++++++++++++++++++-

 drivers/scsi/qla2xxx/qla_os.c  |    9 +++++++++

 3 files changed, 34 insertions(+), 1 deletion(-)

--- a/drivers/scsi/qla2xxx/qla_gbl.h

+++ b/drivers/scsi/qla2xxx/qla_gbl.h

@@ -195,6 +195,8 @@ extern int ql2xsecenable;

 extern int ql2xenforce_iocb_limit;

 extern int ql2xabts_wait_nvme;

 extern u32 ql2xnvme_queues;

+extern int ql2xrspq_follow_inptr;

+extern int ql2xrspq_follow_inptr_legacy;

 extern int qla2x00_loop_reset(scsi_qla_host_t *);

 extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int);

--- a/drivers/scsi/qla2xxx/qla_isr.c

+++ b/drivers/scsi/qla2xxx/qla_isr.c

@@ -3790,6 +3790,8 @@ void qla24xx_process_response_queue(stru

 	struct qla_hw_data *ha = vha->hw;

 	struct purex_entry_24xx *purex_entry;

 	struct purex_item *pure_item;

+	u16 rsp_in = 0;

+	int follow_inptr, is_shadow_hba;

 	if (!ha->flags.fw_started)

 		return;

@@ -3799,7 +3801,25 @@ void qla24xx_process_response_queue(stru

 		qla_cpu_update(rsp->qpair, smp_processor_id());

 	}

-	while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) {

+#define __update_rsp_in(_update, _is_shadow_hba, _rsp, _rsp_in)		\

+	do {								\

+		if (_update) {						\

+			_rsp_in = _is_shadow_hba ? *(_rsp)->in_ptr :	\

+				rd_reg_dword_relaxed((_rsp)->rsp_q_in);	\

+		}							\

+	} while (0)

+

+	is_shadow_hba = IS_SHADOW_REG_CAPABLE(ha);

+	follow_inptr = is_shadow_hba ? ql2xrspq_follow_inptr :

+				ql2xrspq_follow_inptr_legacy;

+

+	__update_rsp_in(follow_inptr, is_shadow_hba, rsp, rsp_in);

+

+	while ((likely(follow_inptr &&

+		       rsp->ring_index != rsp_in &&

+		       rsp->ring_ptr->signature != RESPONSE_PROCESSED)) ||

+		       (!follow_inptr &&

+			rsp->ring_ptr->signature != RESPONSE_PROCESSED)) {

 		pkt = (struct sts_entry_24xx *)rsp->ring_ptr;

 		rsp->ring_index++;

@@ -3912,6 +3932,8 @@ void qla24xx_process_response_queue(stru

 				}

 				pure_item = qla27xx_copy_fpin_pkt(vha,

 							  (void **)&pkt, &rsp;;

+				__update_rsp_in(follow_inptr, is_shadow_hba,

+						rsp, rsp_in);

 				if (!pure_item)

 					break;

 				qla24xx_queue_purex_item(vha, pure_item,

--- a/drivers/scsi/qla2xxx/qla_os.c

+++ b/drivers/scsi/qla2xxx/qla_os.c

@@ -339,6 +339,15 @@ module_param(ql2xabts_wait_nvme, int, 04

 MODULE_PARM_DESC(ql2xabts_wait_nvme,

 		 "To wait for ABTS response on I/O timeouts for NVMe. (default: 1)");

+int ql2xrspq_follow_inptr = 1;

+module_param(ql2xrspq_follow_inptr, int, 0644);

+MODULE_PARM_DESC(ql2xrspq_follow_inptr,

+		 "Follow RSP IN pointer for RSP updates for HBAs 27xx and newer (default: 1).");

+

+int ql2xrspq_follow_inptr_legacy = 1;

+module_param(ql2xrspq_follow_inptr_legacy, int, 0644);

+MODULE_PARM_DESC(ql2xrspq_follow_inptr_legacy,

+		 "Follow RSP IN pointer for RSP updates for HBAs older than 27XX. (default: 1).");

 u32 ql2xdelay_before_pci_error_handling = 5;

 module_param(ql2xdelay_before_pci_error_handling, uint, 0644);