lael-labs/linux

Documentation/ABI/stable/configfs-nvmet+352−0

@@ -0,0 +1,352 @@
	1	What: /config/nvmet/ports/N/addr_adrfam
	2	What: /config/nvmet/ports/N/addr_portid
	3	What: /config/nvmet/ports/N/addr_traddr
	4	What: /config/nvmet/ports/N/addr_trsvcid
	5	What: /config/nvmet/ports/N/addr_trtype
	6	What: /config/nvmet/ports/N/addr_treq
	7	Date: June 2016
	8	KernelVersion: 4.8
	9	Contact: Christoph Hellwig <hch@lst.de>
	10	Description:
	11	Address attributes for an NVMe-oF target port.
	12
	13	addr_adrfam: Shows or sets the address family. Accepted
	14	values: "pcie", "ipv4", "ipv6", "ib", "fc", "pci", "loop".
	15
	16	addr_portid: Shows or sets the port identifier (u16).
	17
	18	addr_traddr: Shows or sets the transport address string.
	19
	20	addr_trsvcid: Shows or sets the transport service identifier.
	21
	22	addr_trtype: Shows or sets the transport type. Accepted
	23	values: "rdma", "fc", "tcp", "pci", "loop". Also
	24	initializes default TSAS values.
	25
	26	addr_treq: Shows or sets the transport security requirements.
	27	Accepted values: "not specified", "required",
	28	"not required". For TCP with TLS1.3, "not specified" is
	29	rejected.
	30
	31	All attributes require the port to be disabled before
	32	modification.
	33
	34	What: /config/nvmet/ports/N/referrals/NAME/addr_adrfam
	35	What: /config/nvmet/ports/N/referrals/NAME/addr_portid
	36	What: /config/nvmet/ports/N/referrals/NAME/addr_traddr
	37	What: /config/nvmet/ports/N/referrals/NAME/addr_trsvcid
	38	What: /config/nvmet/ports/N/referrals/NAME/addr_trtype
	39	What: /config/nvmet/ports/N/referrals/NAME/addr_treq
	40	What: /config/nvmet/ports/N/referrals/NAME/enable
	41	Date: June 2016
	42	KernelVersion: 4.8
	43	Contact: Christoph Hellwig <hch@lst.de>
	44	Description:
	45	Address attributes and enable control for a referral entry
	46	under a port. The addr_* attributes have the same semantics
	47	as the corresponding port-level attributes. The enable
	48	attribute shows or sets whether this referral is enabled
	49	(boolean).
	50
	51	What: /config/nvmet/ports/N/param_inline_data_size
	52	Date: June 2018
	53	KernelVersion: 4.19
	54	Contact: Steve Wise <swise@opengridcomputing.com>
	55	Description:
	56	Shows or sets the inline data size for this port. Default
	57	is -1 which lets the transport choose. The port must be
	58	disabled before modification.
	59
	60	What: /config/nvmet/ports/N/ana_groups/ID/ana_state
	61	Date: June 2018
	62	KernelVersion: 4.19
	63	Contact: Christoph Hellwig <hch@lst.de>
	64	Description:
	65	Shows or sets the ANA (Asymmetric Namespace Access) state
	66	for this group on this port. Accepted values: "optimized",
	67	"non-optimized", "inaccessible", "persistent-loss",
	68	"change". Changes trigger an ANA change event.
	69
	70	What: /config/nvmet/ports/N/param_pi_enable
	71	Date: May 2020
	72	KernelVersion: 5.8
	73	Contact: Israel Rukshin <israelr@mellanox.com>
	74	Description:
	75	Shows or sets whether protection information (PI) is
	76	enabled/supported for this port. Accepts boolean value.
	77	Only available when CONFIG_BLK_DEV_INTEGRITY is enabled.
	78	The port must be disabled before modification.
	79
	80	What: /config/nvmet/ports/N/addr_tsas
	81	Date: August 2023
	82	KernelVersion: 6.7
	83	Contact: Hannes Reinecke <hare@suse.de>
	84	Description:
	85	Shows or sets the transport-specific address subtype. For
	86	TCP transport, accepted values: "none", "tls1.3" (requires
	87	CONFIG_NVME_TARGET_TCP_TLS). For RDMA transport, shows the
	88	QP type: "connected" or "datagram". The port must be
	89	disabled before modification.
	90
	91	What: /config/nvmet/ports/N/param_max_queue_size
	92	Date: January 2024
	93	KernelVersion: 6.9
	94	Contact: Max Gurtovoy <mgurtovoy@nvidia.com>
	95	Description:
	96	Shows or sets the maximum queue size for this port. Default
	97	is -1 which lets the transport choose. The port must be
	98	disabled before modification.
	99
	100	What: /config/nvmet/ports/N/param_mdts
	101	Date: April 2026
	102	KernelVersion: 7.1
	103	Contact: Aurelien Aptel <aaptel@nvidia.com>
	104	Description:
	105	Shows or sets the maximum data transfer size for this port.
	106	Default is -1 which lets the transport choose. The port
	107	must be disabled before modification.
	108
	109	What: /config/nvmet/subsystems/NAME/attr_allow_any_host
	110	Date: June 2016
	111	KernelVersion: 4.8
	112	Contact: Christoph Hellwig <hch@lst.de>
	113	Description:
	114	Shows or sets whether any host is allowed to connect.
	115	Accepts boolean value. Cannot be set to 1 if explicit
	116	hosts are linked in the allowed_hosts/ directory.
	117
	118	What: /config/nvmet/subsystems/NAME/namespaces/NSID/device_path
	119	What: /config/nvmet/subsystems/NAME/namespaces/NSID/device_nguid
	120	What: /config/nvmet/subsystems/NAME/namespaces/NSID/enable
	121	Date: June 2016
	122	KernelVersion: 4.8
	123	Contact: Christoph Hellwig <hch@lst.de>
	124	Description:
	125	Namespace attributes added with the initial NVMe target.
	126
	127	device_path: Shows or sets the backend block device path.
	128	The namespace must be disabled before modification.
	129
	130	device_nguid: Shows or sets the NGUID (128-bit identifier).
	131	Accepts 32 hex digits with optional "-" or ":" separators.
	132	The namespace must be disabled before modification.
	133
	134	enable: Shows or sets whether this namespace is enabled
	135	(boolean).
	136
	137	What: /config/nvmet/subsystems/NAME/namespaces/NSID/device_uuid
	138	Date: June 2017
	139	KernelVersion: 4.13
	140	Contact: Johannes Thumshirn <jthumshirn@suse.de>
	141	Description:
	142	Shows or sets the UUID for this namespace. The namespace
	143	must be disabled before modification.
	144
	145	What: /config/nvmet/subsystems/NAME/attr_version
	146	What: /config/nvmet/subsystems/NAME/attr_serial
	147	Date: July 2017
	148	KernelVersion: 4.13
	149	Contact: Johannes Thumshirn <jthumshirn@suse.de>
	150	Description:
	151	attr_version: Shows or sets the NVMe version reported by
	152	this subsystem. Format: "major.minor" or
	153	"major.minor.tertiary". Cannot be changed after the
	154	subsystem has been discovered.
	155
	156	attr_serial: Shows or sets the serial number. Must be a
	157	1-20 byte ASCII string (characters 0x20-0x7e). Cannot be
	158	changed after the subsystem has been discovered.
	159
	160	What: /config/nvmet/subsystems/NAME/namespaces/NSID/ana_grpid
	161	Date: June 2018
	162	KernelVersion: 4.19
	163	Contact: Christoph Hellwig <hch@lst.de>
	164	Description:
	165	Shows or sets the ANA (Asymmetric Namespace Access) Group
	166	ID for this namespace. Must be between 1 and 128. Changing
	167	triggers an ANA event notification.
	168
	169	What: /config/nvmet/subsystems/NAME/namespaces/NSID/buffered_io
	170	Date: June 2018
	171	KernelVersion: 4.19
	172	Contact: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
	173	Description:
	174	Shows or sets whether buffered I/O is used for this
	175	namespace. Accepts boolean value. The namespace must be
	176	disabled before modification.
	177
	178	What: /config/nvmet/subsystems/NAME/namespaces/NSID/p2pmem
	179	Date: October 2018
	180	KernelVersion: 4.20
	181	Contact: Logan Gunthorpe <logang@deltatee.com>
	182	Description:
	183	Shows or sets the P2P DMA memory device for this namespace.
	184	Accepts a PCI device BDF, "auto", or "none". The namespace
	185	must be disabled before modification. Only available when
	186	CONFIG_PCI_P2PDMA is enabled.
	187
	188	What: /config/nvmet/subsystems/NAME/attr_cntlid_min
	189	What: /config/nvmet/subsystems/NAME/attr_cntlid_max
	190	Date: January 2020
	191	KernelVersion: 5.7
	192	Contact: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
	193	Description:
	194	attr_cntlid_min: Shows or sets the minimum controller ID
	195	(u16). Must be nonzero and not greater than attr_cntlid_max.
	196
	197	attr_cntlid_max: Shows or sets the maximum controller ID
	198	(u16). Must be nonzero and not less than attr_cntlid_min.
	199
	200	What: /config/nvmet/subsystems/NAME/attr_model
	201	Date: January 2020
	202	KernelVersion: 5.7
	203	Contact: Mark Ruijter <MRuijter@onestopsystems.com>
	204	Description:
	205	Shows or sets the model number for this subsystem. Must
	206	be a 1-40 byte ASCII string (characters 0x20-0x7e).
	207	Cannot be changed after the subsystem has been discovered.
	208
	209	What: /config/nvmet/subsystems/NAME/attr_pi_enable
	210	Date: May 2020
	211	KernelVersion: 5.8
	212	Contact: Israel Rukshin <israelr@mellanox.com>
	213	Description:
	214	Shows or sets whether protection information (PI) is
	215	enabled/supported for this subsystem. Accepts boolean
	216	value. Only available when CONFIG_BLK_DEV_INTEGRITY is
	217	enabled.
	218
	219	What: /config/nvmet/subsystems/NAME/namespaces/NSID/revalidate_size
	220	Date: May 2020
	221	KernelVersion: 5.8
	222	Contact: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
	223	Description:
	224	Write-only. Writing 1 triggers namespace size revalidation.
	225	If the size has changed, a namespace changed AEN is sent.
	226	The namespace must be enabled.
	227
	228	What: /config/nvmet/subsystems/NAME/passthru/device_path
	229	What: /config/nvmet/subsystems/NAME/passthru/enable
	230	Date: July 2020
	231	KernelVersion: 5.9
	232	Contact: Logan Gunthorpe <logang@deltatee.com>
	233	Description:
	234	Passthrough mode attributes.
	235
	236	device_path: Shows or sets the NVMe controller character
	237	device path (e.g., /dev/nvme0). Cannot be changed while
	238	the passthrough controller is active.
	239
	240	enable: Shows or sets whether passthrough mode is enabled
	241	(boolean).
	242
	243	Only available when CONFIG_NVME_TARGET_PASSTHRU is enabled.
	244
	245	What: /config/nvmet/subsystems/NAME/passthru/admin_timeout
	246	What: /config/nvmet/subsystems/NAME/passthru/io_timeout
	247	Date: November 2020
	248	KernelVersion: 5.11
	249	Contact: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
	250	Description:
	251	admin_timeout: Shows or sets the admin command timeout for
	252	passthrough mode, in jiffies.
	253
	254	io_timeout: Shows or sets the I/O command timeout for
	255	passthrough mode, in jiffies.
	256
	257	Only available when CONFIG_NVME_TARGET_PASSTHRU is enabled.
	258
	259	What: /config/nvmet/subsystems/NAME/passthru/clear_ids
	260	Date: June 2022
	261	KernelVersion: 5.19
	262	Contact: Alan Adamson <alan.adamson@oracle.com>
	263	Description:
	264	Shows or sets whether to clear identify data IDs in
	265	passthrough mode. Only available when
	266	CONFIG_NVME_TARGET_PASSTHRU is enabled.
	267
	268	What: /config/nvmet/subsystems/NAME/attr_qid_max
	269	Date: August 2022
	270	KernelVersion: 6.1
	271	Contact: Daniel Wagner <dwagner@suse.de>
	272	Description:
	273	Shows or sets the maximum queue ID (number of I/O queues,
	274	u16). Must be between 1 and 128. Changing this value
	275	forces reconnection of all connected controllers.
	276
	277	What: /config/nvmet/subsystems/NAME/attr_ieee_oui
	278	Date: November 2022
	279	KernelVersion: 6.2
	280	Contact: Aleksandr Miloserdov <a.miloserdov@yadro.com>
	281	Description:
	282	Shows or sets the IEEE OUI for this subsystem. Displayed
	283	in "0x%06x" format. Must be a 24-bit value. Cannot be
	284	changed after the subsystem has been discovered.
	285
	286	What: /config/nvmet/subsystems/NAME/attr_firmware
	287	Date: November 2022
	288	KernelVersion: 6.2
	289	Contact: Aleksandr Miloserdov <a.miloserdov@yadro.com>
	290	Description:
	291	Shows or sets the firmware revision string for this
	292	subsystem. Must be a 1-8 byte ASCII string (characters
	293	0x20-0x7e). Cannot be changed after the subsystem has
	294	been discovered.
	295
	296	What: /config/nvmet/subsystems/NAME/namespaces/NSID/resv_enable
	297	Date: November 2024
	298	KernelVersion: 6.13
	299	Contact: Guixin Liu <kanie@linux.alibaba.com>
	300	Description:
	301	Shows or sets whether persistent reservation support is
	302	enabled for this namespace. Accepts boolean value. The
	303	namespace must be disabled before modification.
	304
	305	What: /config/nvmet/subsystems/NAME/attr_vendor_id
	306	What: /config/nvmet/subsystems/NAME/attr_subsys_vendor_id
	307	Date: January 2025
	308	KernelVersion: 6.14
	309	Contact: Damien Le Moal <dlemoal@kernel.org>
	310	Description:
	311	attr_vendor_id: Shows or sets the PCI vendor ID reported
	312	by this subsystem. Displayed in "0x%x" format.
	313
	314	attr_subsys_vendor_id: Shows or sets the PCI subsystem
	315	vendor ID. Displayed in "0x%x" format.
	316
	317	What: /config/nvmet/hosts/HOSTNQN/dhchap_key
	318	What: /config/nvmet/hosts/HOSTNQN/dhchap_ctrl_key
	319	What: /config/nvmet/hosts/HOSTNQN/dhchap_hash
	320	What: /config/nvmet/hosts/HOSTNQN/dhchap_dhgroup
	321	Date: June 2022
	322	KernelVersion: 6.0
	323	Contact: Hannes Reinecke <hare@suse.de>
	324	Description:
	325	DH-HMAC-CHAP authentication attributes.
	326
	327	dhchap_key: Shows or sets the host secret key. Accepts a
	328	key string in "DHHC-1:" format.
	329
	330	dhchap_ctrl_key: Shows or sets the controller secret key
	331	for bidirectional authentication. Same format as dhchap_key.
	332
	333	dhchap_hash: Shows or sets the HMAC hash algorithm.
	334	Accepted values: "hmac(sha256)", "hmac(sha384)",
	335	"hmac(sha512)".
	336
	337	dhchap_dhgroup: Shows or sets the Diffie-Hellman group for
	338	DH-HMAC-CHAP key exchange. Accepted values: "null",
	339	"ffdhe2048", "ffdhe3072", "ffdhe4096", "ffdhe6144".
	340	Non-null groups require the corresponding KPP crypto
	341	algorithm to be available.
	342
	343	Only available when CONFIG_NVME_TARGET_AUTH is enabled.
	344
	345	What: /config/nvmet/discovery_nqn
	346	Date: April 2024
	347	KernelVersion: 6.9
	348	Contact: Hannes Reinecke <hare@kernel.org>
	349	Description:
	350	Shows or sets the NQN of the discovery subsystem. The
	351	value must be unique and not duplicate any existing
	352	subsystem name.

Documentation/ABI/stable/sysfs-nvme+453−0

@@ -0,0 +1,453 @@
	1	What: /sys/class/nvme/nvmeX/model
	2	What: /sys/class/nvme/nvmeX/serial
	3	What: /sys/class/nvme/nvmeX/firmware_rev
	4	Date: January 2016
	5	KernelVersion: 4.5
	6	Contact: Keith Busch <kbusch@kernel.org>
	7	Description:
	8	Shows the model, serial number, or firmware revision string
	9	of the NVMe controller, as reported in the Identify
	10	Controller data structure.
	11
	12	What: /sys/class/nvme/nvmeX/cntlid
	13	Date: February 2016
	14	KernelVersion: 4.6
	15	Contact: Ming Lin <ming.l@ssi.samsung.com>
	16	Description:
	17	Shows the controller identifier assigned by the NVMe
	18	subsystem.
	19
	20	What: /sys/class/nvme/nvmeX/cntrltype
	21	What: /sys/class/nvme/nvmeX/dctype
	22	Date: February 2022
	23	KernelVersion: 5.18
	24	Contact: Martin Belanger <martin.belanger@dell.com>
	25	Description:
	26	cntrltype: Shows the controller type. Possible values: "io",
	27	"discovery", "admin", "reserved".
	28
	29	dctype: Shows the discovery controller type. Possible values:
	30	"none", "ddc", "cdc", "reserved".
	31
	32	What: /sys/class/nvme/nvmeX/reset_controller
	33	Date: November 2015
	34	KernelVersion: 4.5
	35	Contact: Christoph Hellwig <hch@lst.de>
	36	Description:
	37	Write-only. Writing any value triggers a synchronous
	38	controller reset.
	39
	40	What: /sys/class/nvme/nvmeX/rescan_controller
	41	Date: April 2016
	42	KernelVersion: 4.7
	43	Contact: Keith Busch <kbusch@kernel.org>
	44	Description:
	45	Write-only. Writing any value triggers a namespace rescan
	46	on this controller.
	47
	48	What: /sys/class/nvme/nvmeX/transport
	49	What: /sys/class/nvme/nvmeX/subsysnqn
	50	What: /sys/class/nvme/nvmeX/address
	51	What: /sys/class/nvme/nvmeX/delete_controller
	52	What: /sys/class/nvme/nvmeX/reconnect_delay
	53	What: /sys/class/nvme/nvmeX/ctrl_loss_tmo
	54	Date: June 2016
	55	KernelVersion: 4.8
	56	Contact: Ming Lin <ming.l@ssi.samsung.com>
	57	Description:
	58	Fabrics controller attributes added with NVMe-oF support.
	59
	60	transport: Shows the transport type string. Possible values:
	61	"pcie", "tcp", "rdma", "fc", "loop".
	62
	63	subsysnqn: Shows the NVMe Qualified Name (NQN) of the
	64	subsystem this controller belongs to.
	65
	66	address: Shows the transport-specific address string. Only
	67	available for fabrics controllers.
	68
	69	delete_controller: Write-only. Triggers deletion of this
	70	fabrics controller.
	71
	72	reconnect_delay: Shows or sets the reconnect delay in
	73	seconds. Reading returns the delay value, or "off" if
	74	disabled.
	75
	76	ctrl_loss_tmo: Shows or sets the controller loss timeout in
	77	seconds. Reading returns the timeout value, or "off" if
	78	infinite reconnects are allowed. Writing a negative value
	79	disables the timeout.
	80
	81	What: /sys/class/nvme/nvmeX/hostnqn
	82	What: /sys/class/nvme/nvmeX/hostid
	83	Date: February 2020
	84	KernelVersion: 5.7
	85	Contact: Sagi Grimberg <sagi@grimberg.me>
	86	Description:
	87	hostnqn: Shows the host NQN used by this fabrics controller.
	88
	89	hostid: Shows the host identifier (UUID format) used by this
	90	fabrics controller.
	91
	92	Only available for fabrics controllers.
	93
	94	What: /sys/class/nvme/nvmeX/fast_io_fail_tmo
	95	Date: November 2020
	96	KernelVersion: 5.11
	97	Contact: Victor Gladkov <Victor.Gladkov@kioxia.com>
	98	Description:
	99	Shows or sets the fast I/O fail timeout in seconds. Reading
	100	returns the timeout value, or "off" if disabled. Writing a
	101	negative value disables the fast I/O fail. Only available
	102	for fabrics controllers.
	103
	104	What: /sys/class/nvme/nvmeX/kato
	105	Date: April 2021
	106	KernelVersion: 5.13
	107	Contact: Hannes Reinecke <hare@suse.de>
	108	Description:
	109	Shows the Keep Alive Timeout value in milliseconds for
	110	this controller.
	111
	112	What: /sys/class/nvme/nvmeX/cmb
	113	Date: October 2016
	114	KernelVersion: 4.9
	115	Contact: Stephen Bates <sbates@raithlin.com>
	116	Description:
	117	Shows the Controller Memory Buffer (CMB) register values
	118	in format "cmbloc : 0x%08x\ncmbsz : 0x%08x\n". Only
	119	visible when the controller has a CMB (cmbsz != 0).
	120	PCI transport only.
	121
	122	What: /sys/class/nvme/nvmeX/cmbloc
	123	What: /sys/class/nvme/nvmeX/cmbsz
	124	What: /sys/class/nvme/nvmeX/hmb
	125	Date: July 2021
	126	KernelVersion: 5.15
	127	Contact: Keith Busch <kbusch@kernel.org>
	128	Description:
	129	cmbloc: Shows the CMBLOC register value.
	130
	131	cmbsz: Shows the CMBSZ register value.
	132
	133	cmbloc and cmbsz are only visible when the controller has
	134	a CMB. PCI transport only.
	135
	136	hmb: Shows or sets whether the Host Memory Buffer (HMB) is
	137	enabled. Reading returns 1 (enabled) or 0 (disabled).
	138	Writing 1 enables HMB; writing 0 disables it. Only
	139	visible when the controller supports HMB (hmpre != 0).
	140	PCI transport only.
	141
	142	What: /sys/class/nvme/nvmeX/state
	143	Date: November 2016
	144	KernelVersion: 4.11
	145	Contact: Sagi Grimberg <sagi@grimberg.me>
	146	Description:
	147	Shows the current state of the controller. Possible values:
	148	"new", "live", "resetting", "connecting", "deleting",
	149	"deleting (no IO)", "dead".
	150
	151	What: /sys/class/nvme/nvmeX/numa_node
	152	Date: November 2018
	153	KernelVersion: 5.0
	154	Contact: Hannes Reinecke <hare@suse.de>
	155	Description:
	156	Shows the NUMA node the controller is attached to.
	157
	158	What: /sys/class/nvme/nvmeX/queue_count
	159	What: /sys/class/nvme/nvmeX/sqsize
	160	Date: September 2019
	161	KernelVersion: 5.4
	162	Contact: James Smart <jsmart2021@gmail.com>
	163	Description:
	164	queue_count: Shows the total number of queues (admin + I/O)
	165	for this controller.
	166
	167	sqsize: Shows the submission queue size for this controller.
	168
	169	What: /sys/class/nvme/nvmeX/dhchap_secret
	170	What: /sys/class/nvme/nvmeX/dhchap_ctrl_secret
	171	Date: June 2022
	172	KernelVersion: 6.0
	173	Contact: Hannes Reinecke <hare@suse.de>
	174	Description:
	175	dhchap_secret: Shows or sets the host DH-HMAC-CHAP secret
	176	for this controller. Reading returns "none" if not set.
	177	Writing must use the "DHHC-1:" key format and triggers
	178	re-authentication.
	179
	180	dhchap_ctrl_secret: Shows or sets the controller
	181	DH-HMAC-CHAP secret for bidirectional authentication.
	182	Same format as dhchap_secret.
	183
	184	Only available when CONFIG_NVME_HOST_AUTH is enabled and
	185	for fabrics controllers.
	186
	187	What: /sys/class/nvme/nvmeX/tls_key
	188	Date: August 2023
	189	KernelVersion: 6.7
	190	Contact: Hannes Reinecke <hare@suse.de>
	191	Description:
	192	Shows the serial of the currently active TLS PSK as hex.
	193	Returns empty if no TLS key is active. Only available for
	194	TCP controllers with TLS or secure concatenation enabled
	195	(CONFIG_NVME_TCP_TLS).
	196
	197	What: /sys/class/nvme/nvmeX/tls_configured_key
	198	Date: July 2024
	199	KernelVersion: 6.12
	200	Contact: Hannes Reinecke <hare@kernel.org>
	201	Description:
	202	Shows the serial of the configured TLS key. Writing 0
	203	triggers a PSK reauthentication (REPLACETLSPSK) with
	204	the target. After reauthentication the returned serial
	205	will be the new key. Only available for TCP controllers
	206	with secure concatenation enabled (CONFIG_NVME_TCP_TLS).
	207
	208	What: /sys/class/nvme/nvmeX/tls_keyring
	209	Date: July 2024
	210	KernelVersion: 6.12
	211	Contact: Hannes Reinecke <hare@kernel.org>
	212	Description:
	213	Shows the TLS keyring description. Only available for TCP
	214	controllers with a keyring configured (CONFIG_NVME_TCP_TLS).
	215
	216	What: /sys/class/nvme/nvmeX/tls_mode
	217	Date: April 2026
	218	KernelVersion: 7.1
	219	Contact: Daniel Wagner <wagi@kernel.org>
	220	Description:
	221	Shows the TLS mode: "tls" for direct TLS or "concat" for
	222	secure concatenation. Only available for TCP controllers
	223	with TLS or secure concatenation enabled
	224	(CONFIG_NVME_TCP_TLS).
	225
	226	What: /sys/class/nvme/nvmeX/passthru_err_log_enabled
	227	Date: January 2024
	228	KernelVersion: 6.8
	229	Contact: Alan Adamson <alan.adamson@oracle.com>
	230	Description:
	231	Shows or sets whether admin passthrough error logging is
	232	enabled for this controller. Reading returns "on" or "off".
	233	Writing accepts a boolean value.
	234
	235	What: /sys/class/nvme/nvmeX/quirks
	236	Date: November 2025
	237	KernelVersion: 7.0
	238	Contact: Maurizio Lombardi <mlombard@redhat.com>
	239	Description:
	240	Shows the active quirk names for this controller, one per
	241	line. Shows "none" if no quirks are active.
	242
	243	What: /sys/class/nvme/nvmeX/admin_timeout
	244	What: /sys/class/nvme/nvmeX/io_timeout
	245	Date: May 2026
	246	KernelVersion: 7.2
	247	Contact: Maurizio Lombardi <mlombard@redhat.com>
	248	Description:
	249	admin_timeout: Shows or sets the admin command timeout in
	250	milliseconds.
	251
	252	io_timeout: Shows or sets the I/O command timeout in
	253	milliseconds. Changes are propagated to all namespace
	254	request queues.
	255
	256	The value must be nonzero. Only writable after the
	257	controller has been started at least once.
	258
	259	What: /sys/block/nvmeXnY/uuid
	260	What: /sys/block/nvmeXnY/eui
	261	What: /sys/block/nvmeXnY/nsid
	262	Date: December 2015
	263	KernelVersion: 4.5
	264	Contact: Keith Busch <kbusch@kernel.org>
	265	Description:
	266	Namespace identification attributes.
	267
	268	uuid: Shows the UUID for this namespace. Falls back to
	269	showing the NGUID for backward compatibility. Hidden if
	270	both are all zeros.
	271
	272	eui: Shows the IEEE Extended Unique Identifier (EUI-64).
	273	Hidden if all zeros.
	274
	275	nsid: Shows the namespace identifier (NSID).
	276
	277	What: /sys/block/nvmeXnY/wwid
	278	Date: February 2016
	279	KernelVersion: 4.6
	280	Contact: Keith Busch <kbusch@kernel.org>
	281	Description:
	282	Shows the World Wide Identifier for this namespace. The
	283	format depends on available identifiers (in priority
	284	order): "uuid.{UUID}", "eui.{NGUID}", "eui.{EUI64}", or
	285	"nvme.{VID}-{SERIAL}-{MODEL}-{NSID}".
	286
	287	What: /sys/block/nvmeXnY/nguid
	288	Date: June 2017
	289	KernelVersion: 4.13
	290	Contact: Johannes Thumshirn <jthumshirn@suse.de>
	291	Description:
	292	Shows the Namespace Globally Unique Identifier (NGUID).
	293	Hidden if the NGUID is all zeros.
	294
	295	What: /sys/block/nvmeXcYnZ/ana_grpid
	296	What: /sys/block/nvmeXcYnZ/ana_state
	297	Date: May 2018
	298	KernelVersion: 4.19
	299	Contact: Christoph Hellwig <hch@lst.de>
	300	Description:
	301	ana_grpid: Shows the ANA Group ID for this namespace
	302	path device.
	303
	304	ana_state: Shows the ANA state. Possible values:
	305	"optimized", "non-optimized", "inaccessible",
	306	"persistent-loss", "change".
	307
	308	Only visible when the controller supports ANA.
	309	Requires CONFIG_NVME_MULTIPATH.
	310
	311	What: /sys/block/nvmeXcYnZ/queue_depth
	312	Date: June 2024
	313	KernelVersion: 6.11
	314	Contact: Thomas Song <tsong@purestorage.com>
	315	Description:
	316	Shows the current active I/O count on this path's
	317	controller. Returns empty if iopolicy is not "queue-depth".
	318	Requires CONFIG_NVME_MULTIPATH.
	319
	320	What: /sys/block/nvmeXcYnZ/numa_nodes
	321	Date: January 2025
	322	KernelVersion: 6.15
	323	Contact: Nilay Shroff <nilay@linux.ibm.com>
	324	Description:
	325	Shows the NUMA node mask for which this path is the
	326	currently selected path. Returns empty if iopolicy is not
	327	"numa". Requires CONFIG_NVME_MULTIPATH.
	328
	329	What: /sys/block/nvmeXnY/delayed_removal_secs
	330	Date: May 2025
	331	KernelVersion: 6.16
	332	Contact: Nilay Shroff <nilay@linux.ibm.com>
	333	Description:
	334	Shows or sets the delayed removal timeout in seconds for
	335	the multipath head device. When nonzero, I/O is queued
	336	instead of failed when all paths are gone, and head removal
	337	is deferred. Only visible on multipath head devices.
	338	Requires CONFIG_NVME_MULTIPATH.
	339
	340	What: /sys/block/nvmeXnY/csi
	341	What: /sys/block/nvmeXnY/metadata_bytes
	342	What: /sys/block/nvmeXnY/nuse
	343	Date: December 2023
	344	KernelVersion: 6.8
	345	Contact: Daniel Wagner <dwagner@suse.de>
	346	Description:
	347	csi: Shows the Command Set Identifier for this namespace.
	348
	349	metadata_bytes: Shows the metadata size in bytes.
	350
	351	nuse: Shows the Namespace Utilization (NUSE) value. Reading
	352	triggers an Identify Namespace command to refresh the
	353	value (rate-limited to avoid excessive commands).
	354
	355	What: /sys/block/nvmeXnY/passthru_err_log_enabled
	356	Date: January 2024
	357	KernelVersion: 6.8
	358	Contact: Alan Adamson <alan.adamson@oracle.com>
	359	Description:
	360	Shows or sets whether I/O passthrough error logging is
	361	enabled for this namespace. Reading returns "on" or "off".
	362	Writing accepts a boolean value.
	363
	364	What: /sys/class/nvme/nvmeX/diag/command_error_count
	365	What: /sys/class/nvme/nvmeX/diag/reset_count
	366	What: /sys/class/nvme/nvmeX/diag/reconnect_count
	367	Date: May 2026
	368	KernelVersion: 7.2
	369	Contact: Nilay Shroff <nilay@linux.ibm.com>
	370	Description:
	371	Controller diagnostic counters.
	372
	373	command_error_count: Admin command error counter.
	374
	375	reset_count: Controller reset counter.
	376
	377	reconnect_count: Accumulated reconnect counter. Only
	378	available for fabrics controllers.
	379
	380	All counters can be reset by writing a value.
	381
	382	What: /sys/block/nvmeXnY/diag/command_retries_count
	383	What: /sys/block/nvmeXnY/diag/command_error_count
	384	Date: May 2026
	385	KernelVersion: 7.2
	386	Contact: Nilay Shroff <nilay@linux.ibm.com>
	387	Description:
	388	Namespace diagnostic counters for non-multipath
	389	configurations (when CONFIG_NVME_MULTIPATH is not
	390	configured).
	391
	392	command_retries_count: I/O command retry counter.
	393
	394	command_error_count: I/O command error counter.
	395
	396	All counters can be reset by writing any value.
	397
	398	What: /sys/block/nvmeXcYnZ/diag/command_retries_count
	399	What: /sys/block/nvmeXcYnZ/diag/command_error_count
	400	What: /sys/block/nvmeXcYnZ/diag/multipath_failover_count
	401	What: /sys/block/nvmeXnY/diag/io_requeue_no_usable_path_count
	402	What: /sys/block/nvmeXnY/diag/io_fail_no_available_path_count
	403	Date: May 2026
	404	KernelVersion: 7.2
	405	Contact: Nilay Shroff <nilay@linux.ibm.com>
	406	Description:
	407	Namespace diagnostic counters for multipath
	408	configurations (when CONFIG_NVME_MULTIPATH is
	409	configured).
	410
	411	command_retries_count: I/O command retry counter.
	412
	413	command_error_count: I/O command error counter.
	414
	415	multipath_failover_count: Multipath failover counter.
	416
	417	io_requeue_no_usable_path_count: Counter of I/Os
	418	requeued because no usable path was available.
	419
	420	io_fail_no_available_path_count: Counter of I/Os
	421	failed because no available path existed.
	422
	423	All counters can be reset by writing any value.
	424
	425	What: /sys/class/nvme-subsystem/nvme-subsysX/model
	426	What: /sys/class/nvme-subsystem/nvme-subsysX/serial
	427	What: /sys/class/nvme-subsystem/nvme-subsysX/firmware_rev
	428	What: /sys/class/nvme-subsystem/nvme-subsysX/subsysnqn
	429	Date: November 2017
	430	KernelVersion: 4.15
	431	Contact: Hannes Reinecke <hare@suse.de>
	432	Description:
	433	Shows the model, serial number, firmware revision, or NQN
	434	of the NVMe subsystem.
	435
	436	What: /sys/class/nvme-subsystem/nvme-subsysX/iopolicy
	437	Date: February 2019
	438	KernelVersion: 5.1
	439	Contact: Hannes Reinecke <hare@suse.de>
	440	Description:
	441	Shows or sets the multipath I/O path selection policy for
	442	this subsystem. Accepted values: "numa", "round-robin",
	443	"queue-depth". Changing the policy clears all current path
	444	selections. Only available when CONFIG_NVME_MULTIPATH is
	445	enabled.
	446
	447	What: /sys/class/nvme-subsystem/nvme-subsysX/subsystype
	448	Date: September 2021
	449	KernelVersion: 5.16
	450	Contact: Hannes Reinecke <hare@suse.de>
	451	Description:
	452	Shows the subsystem type. Possible values: "discovery",
	453	"nvm", "reserved".

Documentation/ABI/testing/sysfs-nvme+0−13

@@ -1,13 +0,0 @@
1	What: /sys/devices/virtual/nvme-fabrics/ctl/.../tls_configured_key
2	Date: November 2025
3	KernelVersion: 6.19
4	Contact: Linux NVMe mailing list <linux-nvme@lists.infradead.org>
5	Description:
6	The file is avaliable when using a secure concatanation
7	connection to a NVMe target. Reading the file will return
8	the serial of the currently negotiated key.
9
10	Writing 0 to the file will trigger a PSK reauthentication
11	(REPLACETLSPSK) with the target. After a reauthentication
12	the value returned by tls_configured_key will be the new
13	serial.

MAINTAINERS+4−0

@@ -19373,6 +19373,9 @@ L: linux-nvme@lists.infradead.org · 19372 unmodified lines
19373	S: Supported	19373	S: Supported
19374	W: http://git.infradead.org/nvme.git	19374	W: http://git.infradead.org/nvme.git
19375	T: git git://git.infradead.org/nvme.git	19375	T: git git://git.infradead.org/nvme.git
		19376	F: Documentation/ABI/stable/sysfs-nvme
		19377	F: Documentation/admin-guide/nvme-multipath.rst
		19378	F: Documentation/fault-injection/nvme-fault-injection.rst
19376	F: Documentation/nvme/	19379	F: Documentation/nvme/
19377	F: drivers/nvme/common/	19380	F: drivers/nvme/common/
19378	F: drivers/nvme/host/	19381	F: drivers/nvme/host/
@@ -19415,6 +19418,7 @@ L: linux-nvme@lists.infradead.org · 36 unmodified lines
19415	S: Supported	19418	S: Supported
19416	W: http://git.infradead.org/nvme.git	19419	W: http://git.infradead.org/nvme.git
19417	T: git git://git.infradead.org/nvme.git	19420	T: git git://git.infradead.org/nvme.git
		19421	F: Documentation/ABI/stable/configfs-nvmet
19418	F: drivers/nvme/target/	19422	F: drivers/nvme/target/
19419		19423
19420	NVMEM FRAMEWORK	19424	NVMEM FRAMEWORK

drivers/nvme/common/auth.c+6−7

 			     const char *psk_digest, u8 **ret_psk)
 {
 	static const u8 default_salt[NVME_AUTH_MAX_DIGEST_SIZE];
-	static const char label[] = "tls13 nvme-tls-psk";
+	static const char label[18] = "tls13 nvme-tls-psk";
-	const size_t label_len = sizeof(label) - 1;
 	u8 prk[NVME_AUTH_MAX_DIGEST_SIZE];
 	size_t hash_len, ctx_len;
 	u8 *hmac_data = NULL, *tls_key;
 	 */
 	hmac_data = kmalloc(/* output length */ 2 +
-			    /* label */ 1 + label_len +
+			    /* label */ 1 + sizeof(label) +
 			    /* context (max) */ 1 + 3 + 1 + strlen(psk_digest) +
 			    /* counter */ 1,
 			    GFP_KERNEL);
 	hmac_data[i++] = hash_len;
 	/* label */
-	static_assert(label_len <= 255);
+	static_assert(sizeof(label) <= 255);
-	hmac_data[i] = label_len;
+	hmac_data[i] = sizeof(label);
-	memcpy(&hmac_data[i + 1], label, label_len);
+	memcpy(&hmac_data[i + 1], label, sizeof(label));
-	i += 1 + label_len;
+	i += 1 + sizeof(label);
 	/* context */
 	ctx_len = sprintf(&hmac_data[i + 1], "%02d %s", hmac_id, psk_digest);

drivers/nvme/host/Makefile+1−0

@@ -1,5 +1,6 @@
1	# SPDX-License-Identifier: GPL-2.0	1	# SPDX-License-Identifier: GPL-2.0
2		2
		3	CONTEXT_ANALYSIS := y
3	ccflags-y += -I$(src)	4	ccflags-y += -I$(src)
4		5
5	obj-$(CONFIG_NVME_CORE) += nvme-core.o	6	obj-$(CONFIG_NVME_CORE) += nvme-core.o

drivers/nvme/host/apple.c+39−27

 #define APPLE_ANS_BOOT_STATUS	 0x1300
 #define APPLE_ANS_BOOT_STATUS_OK 0xde71ce55
-#define APPLE_ANS_UNKNOWN_CTRL	 0x24008
-#define APPLE_ANS_PRP_NULL_CHECK BIT(11)
 #define APPLE_ANS_LINEAR_SQ_CTRL 0x24908
 #define APPLE_ANS_LINEAR_SQ_EN	 BIT(0)
 	bool enabled;
 };
+static inline bool apple_nvme_queue_enabled(struct apple_nvme_queue *q)
+{
+	/* Pair with apple_nvme_enable_queue(). */
+	return smp_load_acquire(&q->enabled);
+}
+static inline void apple_nvme_enable_queue(struct apple_nvme_queue *q)
+{
+	/* Publish queue initialization before setting q->enabled. */
+	smp_store_release(&q->enabled, true);
+}
+static inline void apple_nvme_disable_queue(struct apple_nvme_queue *q)
+{
+	WRITE_ONCE(q->enabled, false);
+}
 /*
  * The apple_nvme_iod describes the data in an I/O.
  *
 	u32 tag = nvme_tag_from_cid(cmd->common.command_id);
 	struct apple_nvmmu_tcb *tcb = &q->tcbs[tag];
-	tcb->opcode = cmd->common.opcode;
+	tcb->opcode = 0;
 	tcb->prp1 = cmd->common.dptr.prp1;
 	tcb->prp2 = cmd->common.dptr.prp2;
 	tcb->length = cmd->rw.length;
 	tcb->command_id = tag;
-	if (nvme_is_write(cmd))
+	if (!cmd->common.dptr.prp1)
+		tcb->dma_flags = 0;
+	else if (nvme_is_write(cmd))
 		tcb->dma_flags = APPLE_ANS_TCB_DMA_TO_DEVICE;
 	else
 		tcb->dma_flags = APPLE_ANS_TCB_DMA_FROM_DEVICE;
 	bool found;
 	DEFINE_IO_COMP_BATCH(iob);
-	if (!READ_ONCE(q->enabled) && !force)
+	if (!apple_nvme_queue_enabled(q) && !force)
 		return false;
 	found = apple_nvme_poll_cq(q, &iob);
 	 * We should not need to do this, but we're still using this to
 	 * ensure we can drain requests on a dying queue.
 	 */
-	if (unlikely(!READ_ONCE(q->enabled)))
+	if (unlikely(!apple_nvme_queue_enabled(q)))
 		return BLK_STS_IOERR;
 	if (!nvme_check_ready(&anv->ctrl, req, true))
 	nvme_quiesce_io_queues(&anv->ctrl);
 	if (!dead) {
-		if (READ_ONCE(anv->ioq.enabled)) {
+		if (apple_nvme_queue_enabled(&anv->ioq)) {
 			apple_nvme_remove_sq(anv);
 			apple_nvme_remove_cq(anv);
 		}
 		nvme_disable_ctrl(&anv->ctrl, false);
 	}
-	WRITE_ONCE(anv->ioq.enabled, false);
+	apple_nvme_disable_queue(&anv->ioq);
-	WRITE_ONCE(anv->adminq.enabled, false);
+	apple_nvme_disable_queue(&anv->adminq);
 	mb(); /* ensure that nvme_queue_rq() sees that enabled is cleared */
 	nvme_quiesce_admin_queue(&anv->ctrl);
 		memset(q->tcbs, 0, anv->hw->max_queue_depth
 			* sizeof(struct apple_nvmmu_tcb));
 	memset(q->cqes, 0, depth * sizeof(struct nvme_completion));
-	WRITE_ONCE(q->enabled, true);
+	apple_nvme_enable_queue(q);
-	wmb(); /* ensure the first interrupt sees the initialization */
 }
 static void apple_nvme_reset_work(struct work_struct *work)
 		/* Setup the NVMMU for the maximum admin and IO queue depth */
 		writel(anv->hw->max_queue_depth - 1,
 			anv->mmio_nvme + APPLE_NVMMU_NUM_TCBS);
-		/*
-		 * This is probably a chicken bit: without it all commands
-		 * where any PRP is set to zero (including those that don't use
-		 * that field) fail and the co-processor complains about
-		 * "completed with err BAD_CMD-" or a "NULL_PRP_PTR_ERR" in the
-		 * syslog
-		 */
-		writel(readl(anv->mmio_nvme + APPLE_ANS_UNKNOWN_CTRL) &
-			~APPLE_ANS_PRP_NULL_CHECK,
-			anv->mmio_nvme + APPLE_ANS_UNKNOWN_CTRL);
 	}
 	/* Setup the admin queue */
 	ret = devm_request_irq(anv->dev, anv->irq, apple_nvme_irq, 0,
 			       "nvme-apple", anv);
-	if (ret) {
+	if (ret)
-		dev_err_probe(dev, ret, "Failed to request IRQ");
 		goto put_dev;
-	}
 	anv->rtk =
 		devm_apple_rtkit_init(dev, anv, NULL, 0, &apple_nvme_rtkit_ops);
 	}
 	ret = nvme_init_ctrl(&anv->ctrl, anv->dev, &nvme_ctrl_ops,
-			     NVME_QUIRK_SKIP_CID_GEN | NVME_QUIRK_IDENTIFY_CNS);
+			     NVME_QUIRK_SKIP_CID_GEN | NVME_QUIRK_IDENTIFY_CNS |
+			     NVME_QUIRK_ADMIN_PAGE_ALIGN);
 	if (ret) {
 		dev_err_probe(dev, ret, "Failed to initialize nvme_ctrl");
 		goto put_dev;
 	nvme_stop_ctrl(&anv->ctrl);
 	nvme_remove_namespaces(&anv->ctrl);
 	apple_nvme_disable(anv, true);
+	if (anv->ctrl.admin_q && !blk_queue_dying(anv->ctrl.admin_q)) {
+		/*
+		 * If the controller was reset during removal, it's possible
+		 * user requests may be waiting on a stopped queue. Start the
+		 * queue to flush these to completion.
+		 */
+		nvme_unquiesce_admin_queue(&anv->ctrl);
+		blk_mq_destroy_queue(anv->ctrl.admin_q);
+	}
 	nvme_uninit_ctrl(&anv->ctrl);
 	if (apple_rtkit_is_running(anv->rtk)) {

drivers/nvme/host/auth.c+2−1

 #include <linux/prandom.h>
 #include <linux/unaligned.h>
 #include <crypto/dh.h>
+#include <crypto/utils.h>
 #include "nvme.h"
 #include "fabrics.h"
 #include <linux/nvme-auth.h>
 		return 0;
 	/* Validate controller response */
-	if (memcmp(chap->response, data->rval, data->hl)) {
+	if (crypto_memneq(chap->response, data->rval, data->hl)) {
 		dev_dbg(ctrl->device, "%s: qid %d ctrl response %*ph\n",
 			__func__, chap->qid, (int)chap->hash_len, data->rval);
 		dev_dbg(ctrl->device, "%s: qid %d host response %*ph\n",

drivers/nvme/host/core.c+45−7

 #define NVME_MINORS		(1U << MINORBITS)
+/*
+ * Write hints (bio->bi_write_stream) are u8, so FDP placement handles beyond
+ * U8_MAX can never be selected. Cap the handle count to bound both the RUH
+ * status buffer and the per-head plids array.
+ */
+#define NVME_MAX_PLIDS		U8_MAX
 struct nvme_ns_info {
 	struct nvme_ns_ids ids;
 	u32 nsid;
 struct workqueue_struct *nvme_delete_wq;
 EXPORT_SYMBOL_GPL(nvme_delete_wq);
-static LIST_HEAD(nvme_subsystems);
 DEFINE_MUTEX(nvme_subsystems_lock);
+static LIST_HEAD_GUARDED(nvme_subsystems, nvme_subsystems_lock);
 static DEFINE_IDA(nvme_instance_ida);
 static dev_t nvme_ctrl_base_chr_devt;
 	kfree(head);
 }
+void nvme_get_ns_head(struct nvme_ns_head *head)
+{
+	kref_get(&head->ref);
+}
 bool nvme_tryget_ns_head(struct nvme_ns_head *head)
 {
 	return kref_get_unless_zero(&head->ref);
 }
 EXPORT_SYMBOL_NS_GPL(nvme_passthru_start, "NVME_TARGET_PASSTHRU");
-void nvme_passthru_end(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u32 effects,
+u32 nvme_passthru_end(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u32 effects,
 		       struct nvme_command *cmd, int status)
 {
 	if (effects & NVME_CMD_EFFECTS_CSE_MASK) {
 		flush_work(&ctrl->scan_work);
 	}
 	if (ns)
-		return;
+		return effects;
 	switch (cmd->common.opcode) {
 	case nvme_admin_set_features:
 	default:
 		break;
 	}
+	return effects;
 }
 EXPORT_SYMBOL_NS_GPL(nvme_passthru_end, "NVME_TARGET_PASSTHRU");
 	for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) {
 		struct nvme_ns_id_desc *cur = data + pos;
+		if (pos + sizeof(*cur) > NVME_IDENTIFY_DATA_SIZE)
+			break;
 		if (cur->nidl == 0)
 			break;
+		if (pos + sizeof(*cur) + cur->nidl > NVME_IDENTIFY_DATA_SIZE)
+			break;
 		len = nvme_process_ns_desc(ctrl, &info->ids, cur, &csi_seen);
 		if (len < 0)
 	lim->max_integrity_segments = ctrl->max_integrity_segments;
 	lim->virt_boundary_mask = ctrl->ops->get_virt_boundary(ctrl, is_admin);
 	lim->max_segment_size = UINT_MAX;
-	lim->dma_alignment = 3;
+	if (is_admin && (ctrl->quirks & NVME_QUIRK_ADMIN_PAGE_ALIGN))
+		lim->dma_alignment = NVME_CTRL_PAGE_SIZE - 1;
+	else
+		lim->dma_alignment = 3;
 }
 static bool nvme_update_disk_info(struct nvme_ns *ns, struct nvme_id_ns *id,
 	if (!info->runs)
 		return ret;
-	size = struct_size(ruhs, ruhsd, S8_MAX - 1);
+	size = struct_size(ruhs, ruhsd, NVME_MAX_PLIDS);
 	ruhs = kzalloc(size, GFP_KERNEL);
 	if (!ruhs)
 		return -ENOMEM;
 		goto free;
 	}
-	head->nr_plids = le16_to_cpu(ruhs->nruhsd);
+	head->nr_plids = min(le16_to_cpu(ruhs->nruhsd), NVME_MAX_PLIDS);
 	if (!head->nr_plids)
 		goto free;
 		lim.max_write_streams = ns_lim->max_write_streams;
 		lim.write_stream_granularity = ns_lim->write_stream_granularity;
 		ret = queue_limits_commit_update(ns->head->disk->queue, &lim);
+		if (ret)
+			goto unfreeze_head_queue;
 		set_capacity_and_notify(ns->head->disk, get_capacity(ns->disk));
 		set_disk_ro(ns->head->disk, nvme_ns_is_readonly(ns, info));
 		nvme_mpath_revalidate_paths(ns->head);
+		ret = nvme_mpath_revalidate_zones(ns->head);
+unfreeze_head_queue:
 		blk_mq_unfreeze_queue(ns->head->disk->queue, memflags);
 	}
 }
 static struct nvme_subsystem *__nvme_find_get_subsystem(const char *subsysnqn)
+	__must_hold(&nvme_subsystems_lock)
 {
 	struct nvme_subsystem *subsys;
 static bool nvme_validate_cntlid(struct nvme_subsystem *subsys,
 		struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+	__must_hold(&nvme_subsystems_lock)
 {
 	struct nvme_ctrl *tmp;
 }
 static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+	__context_unsafe(/* initialize unpublished/lock-guarded variables */)
 {
 	struct nvme_subsystem *subsys, *found;
 	int ret;
 static struct nvme_ns_head *nvme_find_ns_head(struct nvme_ctrl *ctrl,
 		unsigned nsid)
+	__must_hold(&ctrl->subsys->lock)
 {
 	struct nvme_ns_head *h;
 static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys,
 		struct nvme_ns_ids *ids)
+	__must_hold(&subsys->lock)
 {
 	bool has_uuid = !uuid_is_null(&ids->uuid);
 	bool has_nguid = memchr_inv(ids->nguid, 0, sizeof(ids->nguid));
 static void nvme_cdev_rel(struct device *dev)
 {
 	ida_free(&nvme_ns_chr_minor_ida, MINOR(dev->devt));
+	if (dev->parent->class == &nvme_class)
+		nvme_put_ns(container_of(dev, struct nvme_ns, cdev_device));
+	else
+		nvme_put_ns_head(container_of(dev, struct nvme_ns_head,
+				cdev_device));
 }
 void nvme_cdev_del(struct cdev *cdev, struct device *cdev_device)
 	snprintf(name, sizeof(name), "ng%dn%d", ns->ctrl->instance,
 		 ns->head->instance);
+	nvme_get_ns(ns); /* Undone in nvme_cdev_rel() */
 	if (nvme_cdev_add(name, &ns->cdev, &ns->cdev_device,
 			&nvme_ns_chr_fops, ns->ctrl->ops->module)) {
 		dev_err(ns->ctrl->device, "Unable to create the %s device\n",
 			name);
+		nvme_put_ns(ns);
 		return;
 	}
 	set_bit(NVME_NS_CDEV_LIVE, &ns->flags);
 static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
 		struct nvme_ns_info *info)
+	__must_hold(&ctrl->subsys->lock)
 {
 	struct nvme_ns_head *head;
 	size_t size = sizeof(*head);
 	BUILD_BUG_ON(NVME_DSM_MAX_RANGES * sizeof(struct nvme_dsm_range) >
 			PAGE_SIZE);
-	ctrl->discard_page = alloc_page(GFP_KERNEL);
+	ctrl->discard_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
 	if (!ctrl->discard_page) {
 		ret = -ENOMEM;
 		goto out;

drivers/nvme/host/fabrics.c+2−2

 #include "fabrics.h"
 #include <linux/nvme-keyring.h>
-static LIST_HEAD(nvmf_transports);
 static DECLARE_RWSEM(nvmf_transports_rwsem);
+static LIST_HEAD_GUARDED(nvmf_transports, nvmf_transports_rwsem);
-static LIST_HEAD(nvmf_hosts);
 static DEFINE_MUTEX(nvmf_hosts_mutex);
+static LIST_HEAD_GUARDED(nvmf_hosts, nvmf_hosts_mutex);
 static struct nvmf_host *nvmf_default_host;

drivers/nvme/host/fc.c+7−1

 		dev_err(ctrl->dev,
 			"FCP Op failed - rspiu dma mapping failed.\n");
 		ret = -EFAULT;
+		goto out_unmap;
 	}
 	atomic_set(&op->state, FCPOP_STATE_IDLE);
+	return 0;
+out_unmap:
+	fc_dma_unmap_single(ctrl->lport->dev, op->fcp_req.cmddma,
+			sizeof(op->cmd_iu), DMA_TO_DEVICE);
 out_on_error:
 	return ret;
 }
 	return 0;
 delete_queues:
-	for (; i > 0; i--)
+	for (--i; i > 0; i--)
 		__nvme_fc_delete_hw_queue(ctrl, &ctrl->queues[i], i);
 	return ret;
 }

drivers/nvme/host/ioctl.c+79−42

@@ -14,45 +14,54 @@ enum { · 13 unmodified lines
14	NVME_IOCTL_PARTITION = (1 << 1),	14	NVME_IOCTL_PARTITION = (1 << 1),
15	};	15	};
16		16
17	static bool nvme_cmd_allowed(struct nvme_ns ns, struct nvme_command c,	17	static bool nvme_admin_cmd_allowed(struct nvme_ctrl *ctrl,
18	unsigned int flags, bool open_for_write)	18	struct nvme_command *c)
19	{	19	{
20	u32 effects;
21
22	/*
23	* Do not allow unprivileged passthrough on partitions, as that allows an
24	* escape from the containment of the partition.
25	*/
26	if (flags & NVME_IOCTL_PARTITION)
27	goto admin;
28
29	/*
30	* Do not allow unprivileged processes to send vendor specific or fabrics
31	* commands as we can't be sure about their effects.
32	*/
33	if (c->common.opcode >= nvme_cmd_vendor_start \|\|
34	c->common.opcode == nvme_fabrics_command)
35	goto admin;
36
37	/*	20	/*
38	* Do not allow unprivileged passthrough of admin commands except	21	* Do not allow unprivileged passthrough of admin commands except
39	* for a subset of identify commands that contain information required	22	* for a subset of identify commands that contain information required
40	* to form proper I/O commands in userspace and do not expose any	23	* to form proper I/O commands in userspace and do not expose any
41	* potentially sensitive information.	24	* potentially sensitive information.
42	*/	25	*/
43	if (!ns) {	26	switch (c->common.opcode) {
44	if (c->common.opcode == nvme_admin_identify) {	27	case nvme_admin_identify:
45	switch (c->identify.cns) {	28	switch (c->identify.cns) {
46	case NVME_ID_CNS_NS:	29	case NVME_ID_CNS_NS:
47	case NVME_ID_CNS_CS_NS:	30	case NVME_ID_CNS_CS_NS:
48	case NVME_ID_CNS_NS_CS_INDEP:	31	case NVME_ID_CNS_NS_CS_INDEP:
49	case NVME_ID_CNS_CS_CTRL:	32	case NVME_ID_CNS_CS_CTRL:
50	case NVME_ID_CNS_CTRL:	33	case NVME_ID_CNS_CTRL:
51	return true;	34	return true;
52	}	35	}
		36	break;
		37	case nvme_admin_set_features:
		38	/*
		39	* Reject Set Features that change controller state the driver
		40	* manages itself; setting them behind the driver's back from
		41	* userspace leaves it unable to react correctly. Keep Alive is
		42	* only armed for fabrics - on other transports it has no
		43	* reserved tag and harms idle power states.
		44	*/
		45	switch (le32_to_cpu(c->features.fid) & 0xff) {
		46	case NVME_FEAT_KATO:
		47	if (ctrl->ops->flags & NVME_F_FABRICS)
		48	break;
		49	fallthrough;
		50	case NVME_FEAT_HOST_BEHAVIOR:
		51	case NVME_FEAT_HOST_MEM_BUF:
		52	case NVME_FEAT_NUM_QUEUES:
		53	case NVME_FEAT_AUTO_PST:
		54	return false;
53	}	55	}
54	goto admin;	56	break;
55	}	57	}
		58	return capable(CAP_SYS_ADMIN);
		59	}
		60
		61	static bool nvme_ns_cmd_allowed(struct nvme_ns ns, struct nvme_command c,
		62	bool open_for_write)
		63	{
		64	u32 effects;
56		65
57	/*	66	/*
58	* Check if the controller provides a Commands Supported and Effects log	67	* Check if the controller provides a Commands Supported and Effects log
@@ -61,7 +70,7 @@ static bool nvme_cmd_allowed(struct nvme_ns ns, struct nvme_command c, · 2 unmodified lines
61	*/	70	*/
62	effects = nvme_command_effects(ns->ctrl, ns, c->common.opcode);	71	effects = nvme_command_effects(ns->ctrl, ns, c->common.opcode);
63	if (!(effects & NVME_CMD_EFFECTS_CSUPP))	72	if (!(effects & NVME_CMD_EFFECTS_CSUPP))
64	goto admin;	73	return capable(CAP_SYS_ADMIN);
65		74
66	/*	75	/*
67	* Don't allow passthrough for command that have intrusive (or unknown)	76	* Don't allow passthrough for command that have intrusive (or unknown)
@@ -70,7 +79,7 @@ static bool nvme_cmd_allowed(struct nvme_ns ns, struct nvme_command c, · 2 unmodified lines
70	if (effects & ~(NVME_CMD_EFFECTS_CSUPP \| NVME_CMD_EFFECTS_LBCC \|	79	if (effects & ~(NVME_CMD_EFFECTS_CSUPP \| NVME_CMD_EFFECTS_LBCC \|
71	NVME_CMD_EFFECTS_UUID_SEL \|	80	NVME_CMD_EFFECTS_UUID_SEL \|
72	NVME_CMD_EFFECTS_SCOPE_MASK))	81	NVME_CMD_EFFECTS_SCOPE_MASK))
73	goto admin;	82	return capable(CAP_SYS_ADMIN);
74		83
75	/*	84	/*
76	* Only allow I/O commands that transfer data to the controller or that	85	* Only allow I/O commands that transfer data to the controller or that
@@ -79,11 +88,34 @@ static bool nvme_cmd_allowed(struct nvme_ns ns, struct nvme_command c, · 2 unmodified lines
79	*/	88	*/
80	if ((nvme_is_write(c) \|\| (effects & NVME_CMD_EFFECTS_LBCC)) &&	89	if ((nvme_is_write(c) \|\| (effects & NVME_CMD_EFFECTS_LBCC)) &&
81	!open_for_write)	90	!open_for_write)
82	goto admin;	91	return capable(CAP_SYS_ADMIN);
83		92
84	return true;	93	return true;
85	admin:	94	}
86	return capable(CAP_SYS_ADMIN);	95
		96	static bool nvme_cmd_allowed(struct nvme_ctrl ctrl, struct nvme_ns ns,
		97	struct nvme_command *c, unsigned int flags,
		98	bool open_for_write)
		99	{
		100	/*
		101	* Do not allow unprivileged passthrough on partitions, as that
		102	* allows an escape from the containment of the partition.
		103	*/
		104	if (flags & NVME_IOCTL_PARTITION)
		105	return capable(CAP_SYS_ADMIN);
		106
		107	/*
		108	* Do not allow unprivileged processes to send vendor specific or
		109	* fabrics commands as we can't be sure about their effects.
		110	*/
		111	if (c->common.opcode >= nvme_cmd_vendor_start \|\|
		112	c->common.opcode == nvme_fabrics_command)
		113	return capable(CAP_SYS_ADMIN);
		114
		115	if (!ns)
		116	return nvme_admin_cmd_allowed(ctrl, c);
		117
		118	return nvme_ns_cmd_allowed(ns, c, open_for_write);
87	}	119	}
88		120
89	/*	121	/*
@@ -202,7 +234,8 @@ out_free_req: · 112 unmodified lines
202	return ret;	234	return ret;
203	}	235	}
204		236
205	static int nvme_submit_io(struct nvme_ns ns, struct nvme_user_io __user uio)	237	static int nvme_submit_io(struct nvme_ns ns, struct nvme_user_io __user uio,
		238	unsigned int flags, bool open_for_write)
206	{	239	{
207	struct nvme_user_io io;	240	struct nvme_user_io io;
208	struct nvme_command c;	241	struct nvme_command c;
@@ -260,6 +293,9 @@ static int nvme_submit_io(struct nvme_ns ns, struct nvme_user_io __user uio) · 51 unmodified lines
260	c.rw.lbat = cpu_to_le16(io.apptag);	293	c.rw.lbat = cpu_to_le16(io.apptag);
261	c.rw.lbatm = cpu_to_le16(io.appmask);	294	c.rw.lbatm = cpu_to_le16(io.appmask);
262		295
		296	if (!nvme_cmd_allowed(ns->ctrl, ns, &c, flags, open_for_write))
		297	return -EACCES;
		298
263	return nvme_submit_user_cmd(ns->queue, &c, io.addr, length, metadata,	299	return nvme_submit_user_cmd(ns->queue, &c, io.addr, length, metadata,
264	meta_len, NULL, 0, 0);	300	meta_len, NULL, 0, 0);
265	}	301	}
@@ -307,7 +343,7 @@ static int nvme_user_cmd(struct nvme_ctrl ctrl, struct nvme_ns ns, · 41 unmodified lines
307	c.common.cdw14 = cpu_to_le32(cmd.cdw14);	343	c.common.cdw14 = cpu_to_le32(cmd.cdw14);
308	c.common.cdw15 = cpu_to_le32(cmd.cdw15);	344	c.common.cdw15 = cpu_to_le32(cmd.cdw15);
309		345
310	if (!nvme_cmd_allowed(ns, &c, 0, open_for_write))	346	if (!nvme_cmd_allowed(ctrl, ns, &c, 0, open_for_write))
311	return -EACCES;	347	return -EACCES;
312		348
313	if (cmd.timeout_ms)	349	if (cmd.timeout_ms)
@@ -354,7 +390,7 @@ static int nvme_user_cmd64(struct nvme_ctrl ctrl, struct nvme_ns ns, · 40 unmodified lines
354	c.common.cdw14 = cpu_to_le32(cmd.cdw14);	390	c.common.cdw14 = cpu_to_le32(cmd.cdw14);
355	c.common.cdw15 = cpu_to_le32(cmd.cdw15);	391	c.common.cdw15 = cpu_to_le32(cmd.cdw15);
356		392
357	if (!nvme_cmd_allowed(ns, &c, flags, open_for_write))	393	if (!nvme_cmd_allowed(ctrl, ns, &c, flags, open_for_write))
358	return -EACCES;	394	return -EACCES;
359		395
360	if (cmd.timeout_ms)	396	if (cmd.timeout_ms)
@@ -449,6 +485,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl ctrl, struct nvme_ns ns, · 88 unmodified lines
449	const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe,	485	const struct nvme_uring_cmd *cmd = io_uring_sqe128_cmd(ioucmd->sqe,
450	struct nvme_uring_cmd);	486	struct nvme_uring_cmd);
451	struct request_queue *q = ns ? ns->queue : ctrl->admin_q;	487	struct request_queue *q = ns ? ns->queue : ctrl->admin_q;
		488	bool open_for_write = ioucmd->file->f_mode & FMODE_WRITE;
452	struct nvme_uring_data d;	489	struct nvme_uring_data d;
453	struct nvme_command c;	490	struct nvme_command c;
454	struct iov_iter iter;	491	struct iov_iter iter;
@@ -479,7 +516,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl ctrl, struct nvme_ns ns, · 24 unmodified lines
479	c.common.cdw14 = cpu_to_le32(READ_ONCE(cmd->cdw14));	516	c.common.cdw14 = cpu_to_le32(READ_ONCE(cmd->cdw14));
480	c.common.cdw15 = cpu_to_le32(READ_ONCE(cmd->cdw15));	517	c.common.cdw15 = cpu_to_le32(READ_ONCE(cmd->cdw15));
481		518
482	if (!nvme_cmd_allowed(ns, &c, 0, ioucmd->file->f_mode & FMODE_WRITE))	519	if (!nvme_cmd_allowed(ctrl, ns, &c, 0, open_for_write))
483	return -EACCES;	520	return -EACCES;
484		521
485	d.metadata = READ_ONCE(cmd->metadata);	522	d.metadata = READ_ONCE(cmd->metadata);
@@ -595,7 +632,7 @@ static int nvme_ns_ioctl(struct nvme_ns *ns, unsigned int cmd, · 109 unmodified lines
595	case NVME_IOCTL_SUBMIT_IO32:	632	case NVME_IOCTL_SUBMIT_IO32:
596	#endif	633	#endif
597	case NVME_IOCTL_SUBMIT_IO:	634	case NVME_IOCTL_SUBMIT_IO:
598	return nvme_submit_io(ns, argp);	635	return nvme_submit_io(ns, argp, flags, open_for_write);
599	case NVME_IOCTL_IO64_CMD_VEC:	636	case NVME_IOCTL_IO64_CMD_VEC:
600	flags \|= NVME_IOCTL_VEC;	637	flags \|= NVME_IOCTL_VEC;
601	fallthrough;	638	fallthrough;
@@ -692,14 +729,14 @@ int nvme_ns_chr_uring_cmd_iopoll(struct io_uring_cmd *ioucmd, · 90 unmodified lines
692	static int nvme_ns_head_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd,	729	static int nvme_ns_head_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd,
693	void __user argp, struct nvme_ns_head head, int srcu_idx,	730	void __user argp, struct nvme_ns_head head, int srcu_idx,
694	bool open_for_write)	731	bool open_for_write)
695	__releases(&head->srcu)	732	__releases_shared(&head->srcu)
696	{	733	{
697	struct nvme_ctrl *ctrl = ns->ctrl;	734	struct nvme_ctrl *ctrl = ns->ctrl;
698	int ret;	735	int ret;
699		736
700	nvme_get_ctrl(ns->ctrl);	737	nvme_get_ctrl(ns->ctrl);
701	srcu_read_unlock(&head->srcu, srcu_idx);	738	srcu_read_unlock(&head->srcu, srcu_idx);
702	ret = nvme_ctrl_ioctl(ns->ctrl, cmd, argp, open_for_write);	739	ret = nvme_ctrl_ioctl(ctrl, cmd, argp, open_for_write);
703		740
704	nvme_put_ctrl(ctrl);	741	nvme_put_ctrl(ctrl);
705	return ret;	742	return ret;

drivers/nvme/host/multipath.c+34−30

 	kblockd_schedule_work(&head->requeue_work);
 }
+#ifdef CONFIG_BLK_DEV_ZONED
+int nvme_mpath_revalidate_zones(struct nvme_ns_head *head)
+{
+	struct gendisk *disk = head->disk;
+	int ret;
+	if (!disk || !blk_queue_is_zoned(disk->queue) ||
+	    !test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags))
+		return 0;
+	ret = blk_revalidate_disk_zones(disk);
+	if (ret)
+		dev_warn_ratelimited(disk_to_dev(disk),
+				     "failed to revalidate zoned namespace head: %d\n",
+				     ret);
+	return ret;
+}
+#endif /* CONFIG_BLK_DEV_ZONED */
 static bool nvme_path_is_disabled(struct nvme_ns *ns)
 {
 	enum nvme_ctrl_state state = nvme_ctrl_state(ns->ctrl);
 }
 static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node)
+	__must_hold_shared(&head->srcu)
 {
 	int found_distance = INT_MAX, fallback_distance = INT_MAX, distance;
 	struct nvme_ns *found = NULL, *fallback = NULL, *ns;
 static struct nvme_ns *nvme_next_ns(struct nvme_ns_head *head,
 		struct nvme_ns *ns)
+	__must_hold_shared(&head->srcu)
 {
 	ns = list_next_or_null_rcu(&head->list, &ns->siblings, struct nvme_ns,
 			siblings);
 }
 static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head)
+	__must_hold_shared(&head->srcu)
 {
 	struct nvme_ns *ns, *found = NULL;
 	int node = numa_node_id();
 }
 static struct nvme_ns *nvme_queue_depth_path(struct nvme_ns_head *head)
+	__must_hold_shared(&head->srcu)
 {
 	struct nvme_ns *best_opt = NULL, *best_nonopt = NULL, *ns;
 	unsigned int min_depth_opt = UINT_MAX, min_depth_nonopt = UINT_MAX;
 }
 static struct nvme_ns *nvme_numa_path(struct nvme_ns_head *head)
+	__must_hold_shared(&head->srcu)
 {
 	int node = numa_node_id();
 	struct nvme_ns *ns;
 }
 static bool nvme_available_path(struct nvme_ns_head *head)
+	__must_hold_shared(&head->srcu)
 {
 	struct nvme_ns *ns;
 	.pr_ops		= &nvme_pr_ops,
 };
-static inline struct nvme_ns_head *cdev_to_ns_head(struct cdev *cdev)
-{
-	return container_of(cdev, struct nvme_ns_head, cdev);
-}
-static int nvme_ns_head_chr_open(struct inode *inode, struct file *file)
-{
-	if (!nvme_tryget_ns_head(cdev_to_ns_head(inode->i_cdev)))
-		return -ENXIO;
-	return 0;
-}
-static int nvme_ns_head_chr_release(struct inode *inode, struct file *file)
-{
-	nvme_put_ns_head(cdev_to_ns_head(inode->i_cdev));
-	return 0;
-}
 static const struct file_operations nvme_ns_head_chr_fops = {
 	.owner		= THIS_MODULE,
-	.open		= nvme_ns_head_chr_open,
-	.release	= nvme_ns_head_chr_release,
 	.unlocked_ioctl	= nvme_ns_head_chr_ioctl,
 	.compat_ioctl	= compat_ptr_ioctl,
 	.uring_cmd	= nvme_ns_head_chr_uring_cmd,
 	snprintf(name, sizeof(name), "ng%dn%d", head->subsys->instance,
 		 head->instance);
+	nvme_get_ns_head(head); /* Undone in nvme_cdev_rel() */
 	if (nvme_cdev_add(name, &head->cdev, &head->cdev_device,
 			&nvme_ns_head_chr_fops, THIS_MODULE)) {
 		dev_err(disk_to_dev(head->disk),
 			"Unable to create the %s device\n", name);
+		nvme_put_ns_head(head);
 		return;
 	}
 	set_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags);
 {
 	if (test_and_clear_bit(NVME_NSHEAD_DISK_LIVE, &head->flags)) {
 		/*
-		 * requeue I/O after NVME_NSHEAD_DISK_LIVE has been cleared
+		 * Requeue I/O after NVME_NSHEAD_DISK_LIVE has been cleared
-		 * to allow multipath to fail all I/O.
+		 * to allow multipath to fail all I/O. First synchronize to
+		 * add any bios to the requeue list.
 		 */
+		synchronize_srcu(&head->srcu);
 		kblockd_schedule_work(&head->requeue_work);
 		if (test_and_clear_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags))
 			nvme_cdev_del(&head->cdev, &head->cdev_device);
-		synchronize_srcu(&head->srcu);
 		del_gendisk(head->disk);
 	}
 	nvme_put_ns_head(head);
 	struct queue_limits lim;
 	mutex_init(&head->lock);
-	bio_list_init(&head->requeue_list);
 	spin_lock_init(&head->requeue_lock);
 	INIT_WORK(&head->requeue_work, nvme_requeue_work);
 	INIT_WORK(&head->partition_scan_work, nvme_partition_scan_work);
 	INIT_DELAYED_WORK(&head->remove_work, nvme_remove_head_work);
-	head->delayed_removal_secs = 0;
 	/*
 	 * If "multipath_always_on" is enabled, a multipath node is added
 	set_bit(GD_SUPPRESS_PART_SCAN, &head->disk->state);
 	sprintf(head->disk->disk_name, "nvme%dn%d",
 			ctrl->subsys->instance, head->instance);
-	nvme_tryget_ns_head(head);
+	nvme_get_ns_head(head);
 	return 0;
 }
 	mutex_unlock(&head->lock);
 	synchronize_srcu(&head->srcu);
+	nvme_mpath_revalidate_zones(head);
 	kblockd_schedule_work(&head->requeue_work);
 }
 static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data,
 		int (*cb)(struct nvme_ctrl *ctrl, struct nvme_ana_group_desc *,
 			void *))
+		__must_hold(&ctrl->ana_lock)
 {
 	void *base = ctrl->ana_log_buf;
 	size_t offset = sizeof(struct nvme_ana_rsp_hdr);
 		nvme_mpath_set_live(ns);
 	}
-#ifdef CONFIG_BLK_DEV_ZONED
-	if (blk_queue_is_zoned(ns->queue) && ns->head->disk)
-		ns->head->disk->nr_zones = ns->disk->nr_zones;
-#endif
 }
 void nvme_mpath_remove_disk(struct nvme_ns_head *head)

drivers/nvme/host/nvme.h+50−17

 	 * Align dma pool segment size to 512 bytes
 	 */
 	NVME_QUIRK_DMAPOOL_ALIGN_512		= (1 << 22),
+	/*
+	 * Admin queue DMA buffers must be page aligned
+	 */
+	NVME_QUIRK_ADMIN_PAGE_ALIGN		= (1 << 23),
 };
 static inline char *nvme_quirk_name(enum nvme_quirks q)
 		return "broken_msi";
 	case NVME_QUIRK_DMAPOOL_ALIGN_512:
 		return "dmapool_align_512";
+	case NVME_QUIRK_ADMIN_PAGE_ALIGN:
+		return "admin_page_align";
 	}
 	return "unknown";
 	wait_queue_head_t state_wq;
 	struct nvme_subsystem *subsys;
-	struct list_head subsys_entry;
+	struct list_head subsys_entry
+		__guarded_by(&nvme_subsystems_lock);
 	struct opal_dev *opal_dev;
 	 * a separate refcount.
 	 */
 	struct kref		ref;
-	struct list_head	entry;
+	struct list_head	entry
+		__guarded_by(&nvme_subsystems_lock);
 	struct mutex		lock;
-	struct list_head	ctrls;
+	struct list_head	ctrls
-	struct list_head	nsheads;
+		__guarded_by(&nvme_subsystems_lock);
+	struct list_head	nsheads
+		__guarded_by(&lock);
 	char			subnqn[NVMF_NQN_SIZE];
 	char			serial[20];
 	char			model[40];
 	u16			nr_plids;
 	u16			*plids;
 #ifdef CONFIG_NVME_MULTIPATH
-	struct bio_list		requeue_list;
+	struct bio_list		requeue_list
+		__guarded_by(&requeue_lock);
 	spinlock_t		requeue_lock;
 	struct work_struct	requeue_work;
 	struct work_struct	partition_scan_work;
 	struct mutex		lock;
 	unsigned long		flags;
 	struct delayed_work	remove_work;
-	unsigned int		delayed_removal_secs;
+	unsigned int		delayed_removal_secs
+		__guarded_by(&subsys->lock);
 	atomic_long_t		io_requeue_no_usable_path_count;
 	atomic_long_t		io_fail_no_available_path_count;
 #define NVME_NSHEAD_DISK_LIVE		0
 #define NVME_NSHEAD_QUEUE_IF_NO_PATH	1
 #define NVME_NSHEAD_CDEV_LIVE		2
-	struct nvme_ns __rcu	*current_path[];
+	struct nvme_ns __rcu_guarded	*current_path[];
 #endif
 };
 	rq = blk_mq_tag_to_rq(tags, tag);
 	if (unlikely(!rq)) {
-		pr_err("could not locate request for tag %#x\n",
+		pr_err_ratelimited("could not locate request for tag %#x\n",
-			tag);
+				   tag);
 		return NULL;
 	}
 	if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) != genctr)) {
-		dev_err(nvme_req(rq)->ctrl->device,
+		dev_err_ratelimited(nvme_req(rq)->ctrl->device,
 			"request %#x genctr mismatch (got %#x expected %#x)\n",
 			tag, genctr, nvme_genctr_mask(nvme_req(rq)->genctr));
 		return NULL;
 void nvme_queue_scan(struct nvme_ctrl *ctrl);
 int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi,
 		void *log, size_t size, u64 offset);
+void nvme_get_ns_head(struct nvme_ns_head *head);
 bool nvme_tryget_ns_head(struct nvme_ns_head *head);
 void nvme_put_ns_head(struct nvme_ns_head *head);
 int nvme_cdev_add(const char *name, struct cdev *cdev,
 extern const struct block_device_operations nvme_bdev_ops;
 void nvme_delete_ctrl_sync(struct nvme_ctrl *ctrl);
-struct nvme_ns *nvme_find_path(struct nvme_ns_head *head);
+struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
+	__must_hold_shared(&head->srcu);
 #ifdef CONFIG_NVME_MULTIPATH
 static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
 {
 	return ctrl->ana_log_buf != NULL;
 }
-void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
-void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
+	__must_hold(&subsys->lock);
-void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+	__must_hold(&subsys->lock);
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+	__must_hold(&subsys->lock);
 void nvme_mpath_default_iopolicy(struct nvme_subsystem *subsys);
 void nvme_failover_req(struct request *req);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
 }
 #endif /* CONFIG_NVME_MULTIPATH */
+#if defined(CONFIG_NVME_MULTIPATH) && defined(CONFIG_BLK_DEV_ZONED)
+int nvme_mpath_revalidate_zones(struct nvme_ns_head *head);
+#else
+static inline int nvme_mpath_revalidate_zones(struct nvme_ns_head *head)
+{
+	return 0;
+}
+#endif
 int nvme_ns_get_unique_id(struct nvme_ns *ns, u8 id[16],
 		enum blk_unique_id type);
 u32 nvme_command_effects(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 			 u8 opcode);
-u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u8 opcode);
+u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u8 opcode)
+	__cond_acquires(nonzero, &ctrl->subsys->lock)
+	__cond_acquires(nonzero, &ctrl->scan_lock);
 int nvme_execute_rq(struct request *rq, bool at_head);
-void nvme_passthru_end(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u32 effects,
+u32 nvme_passthru_end(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u32 effects,
-		       struct nvme_command *cmd, int status);
+		       struct nvme_command *cmd, int status)
+		       __cond_releases(nonzero, &ctrl->scan_lock)
+		       __cond_releases(nonzero, &ctrl->subsys->lock);
 struct nvme_ctrl *nvme_ctrl_from_file(struct file *file);
 struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid);
 bool nvme_get_ns(struct nvme_ns *ns);

drivers/nvme/host/pci.c+24−7

 		if (nvme_parse_quirk_entry(field, &qlist[i])) {
 			pr_err("nvme: failed to parse quirk string %s\n",
 				value);
+			err = -EINVAL;
 			goto out_free_qlist;
 		}
 	struct nvme_dev *dev;
 	struct nvme_descriptor_pools descriptor_pools;
 	spinlock_t sq_lock;
-	void *sq_cmds;
+	void *sq_cmds
+		__guarded_by(&sq_lock);
 	 /* only used for poll queues: */
 	spinlock_t cq_poll_lock ____cacheline_aligned_in_smp;
 	struct nvme_completion *cqes;
 	u32 __iomem *q_db;
 	u32 q_depth;
 	u16 cq_vector;
-	u16 sq_tail;
-	u16 last_sq_tail;
 	u16 cq_head;
+	u16 sq_tail
+		__guarded_by(&sq_lock);
+	u16 last_sq_tail
+		__guarded_by(&sq_lock);
 	u16 qid;
 	u8 cq_phase;
 	u8 sqes;
  * Write sq tail if we are asked to, or if the next command would wrap.
  */
 static inline void nvme_write_sq_db(struct nvme_queue *nvmeq, bool write_sq)
+	__must_hold(&nvmeq->sq_lock)
 {
 	if (!write_sq) {
 		u16 next_tail = nvmeq->sq_tail + 1;
 static inline void nvme_sq_copy_cmd(struct nvme_queue *nvmeq,
 				    struct nvme_command *cmd)
+	__must_hold(&nvmeq->sq_lock)
 {
 	memcpy(nvmeq->sq_cmds + (nvmeq->sq_tail << nvmeq->sqes),
 		absolute_pointer(cmd), sizeof(*cmd));
 	req = nvme_find_rq(nvme_queue_tagset(nvmeq), command_id);
 	if (unlikely(!req)) {
-		dev_warn(nvmeq->dev->ctrl.device,
+		dev_warn_ratelimited(nvmeq->dev->ctrl.device,
-			"invalid id %d completed on queue %d\n",
+				     "invalid id %d completed on queue %d\n",
-			command_id, le16_to_cpu(cqe->sq_id));
+				     command_id, le16_to_cpu(cqe->sq_id));
 		return;
 	}
-	trace_nvme_sq(req, cqe->sq_head, nvmeq->sq_tail);
+	/*
+	 * Tracing only; annotate a lockless snapshot of nvmeq->sq_tail using
+	 * data_race(). This would also help suppress context analysis warning
+	 * while accessing nvmeq->sq_tail without acquiring ->sq_lock.
+	 */
+	trace_nvme_sq(req, cqe->sq_head, data_race(nvmeq->sq_tail));
 	if (!nvme_try_complete_req(req, cqe->status, cqe->result) &&
 	    !blk_mq_add_to_batch(req, iob,
 				 nvme_req(req)->status != NVME_SC_SUCCESS,
 }
 static void nvme_free_queue(struct nvme_queue *nvmeq)
+	__context_unsafe(/* frees queue which is no longer in use */)
 {
 	dma_free_coherent(nvmeq->dev->dev, CQ_SIZE(nvmeq),
 				(void *)nvmeq->cqes, nvmeq->cq_dma_addr);
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
 				int qid)
+	__context_unsafe(/* safe to allocate sq_cmds without any protection */)
 {
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
 }
 static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid)
+	__context_unsafe(/* initialize unpublished/lock-guarded variables */)
 {
 	struct nvme_dev *dev = nvmeq->dev;
  * Try getting shutdown_lock while setting up IO queues.
  */
 static int nvme_setup_io_queues_trylock(struct nvme_dev *dev)
+	__cond_acquires(0, &dev->shutdown_lock)
 {
 	/*
 	 * Give up if the lock is being held by nvme_dev_disable.
 	result = queue_request_irq(nvmeq);
 	if (result) {
 		dev->online_queues--;
+		nvme_disable_ctrl(&dev->ctrl, false);
 		return result;
 	}
 	nvme_dev_remove_admin(dev);
 	nvme_dbbuf_dma_free(dev);
 	nvme_free_queues(dev, 0);
+	nvme_release_descriptor_pools(dev);
 out_release_iod_mempool:
 	mempool_destroy(dev->dmavec_mempool);
 out_dev_unmap:

drivers/nvme/host/rdma.c+97−63

@@ -16,6 +16,7 @@ · 15 unmodified lines
16	#include <linux/types.h>	16	#include <linux/types.h>
17	#include <linux/list.h>	17	#include <linux/list.h>
18	#include <linux/mutex.h>	18	#include <linux/mutex.h>
		19	#include <linux/async.h>
19	#include <linux/scatterlist.h>	20	#include <linux/scatterlist.h>
20	#include <linux/nvme.h>	21	#include <linux/nvme.h>
21	#include <linux/unaligned.h>	22	#include <linux/unaligned.h>
@@ -39,11 +40,18 @@ · 17 unmodified lines
39	#define NVME_RDMA_METADATA_SGL_SIZE \	40	#define NVME_RDMA_METADATA_SGL_SIZE \
40	(sizeof(struct scatterlist) * NVME_INLINE_METADATA_SG_CNT)	41	(sizeof(struct scatterlist) * NVME_INLINE_METADATA_SG_CNT)
41		42
		43	static DEFINE_MUTEX(device_list_mutex);
		44	static LIST_HEAD_GUARDED(device_list, device_list_mutex);
		45
		46	static DEFINE_MUTEX(nvme_rdma_ctrl_mutex);
		47	static LIST_HEAD_GUARDED(nvme_rdma_ctrl_list, nvme_rdma_ctrl_mutex);
		48
42	struct nvme_rdma_device {	49	struct nvme_rdma_device {
43	struct ib_device *dev;	50	struct ib_device *dev;
44	struct ib_pd *pd;	51	struct ib_pd *pd;
45	struct kref ref;	52	struct kref ref;
46	struct list_head entry;	53	struct list_head entry
		54	__guarded_by(&device_list_mutex);
47	unsigned int num_inline_segments;	55	unsigned int num_inline_segments;
48	};	56	};
49		57
@@ -100,6 +108,11 @@ struct nvme_rdma_queue { · 50 unmodified lines
100	struct mutex queue_lock;	108	struct mutex queue_lock;
101	};	109	};
102		110
		111	struct nvme_rdma_setup_ctx {
		112	struct nvme_rdma_queue *queue;
		113	int *err;
		114	};
		115
103	struct nvme_rdma_ctrl {	116	struct nvme_rdma_ctrl {
104	/* read only in the hot path */	117	/* read only in the hot path */
105	struct nvme_rdma_queue *queues;	118	struct nvme_rdma_queue *queues;
@@ -112,7 +125,8 @@ struct nvme_rdma_ctrl { · 6 unmodified lines
112		125
113	struct delayed_work reconnect_work;	126	struct delayed_work reconnect_work;
114		127
115	struct list_head list;	128	struct list_head list
		129	__guarded_by(&nvme_rdma_ctrl_mutex);
116		130
117	struct blk_mq_tag_set admin_tag_set;	131	struct blk_mq_tag_set admin_tag_set;
118	struct nvme_rdma_device *device;	132	struct nvme_rdma_device *device;
@@ -132,12 +146,6 @@ static inline struct nvme_rdma_ctrl to_rdma_ctrl(struct nvme_ctrl ctrl) · 13 unmodified lines
132	return container_of(ctrl, struct nvme_rdma_ctrl, ctrl);	146	return container_of(ctrl, struct nvme_rdma_ctrl, ctrl);
133	}	147	}
134		148
135	static LIST_HEAD(device_list);
136	static DEFINE_MUTEX(device_list_mutex);
137
138	static LIST_HEAD(nvme_rdma_ctrl_list);
139	static DEFINE_MUTEX(nvme_rdma_ctrl_mutex);
140
141	/*	149	/*
142	* Disabling this option makes small I/O goes faster, but is fundamentally	150	* Disabling this option makes small I/O goes faster, but is fundamentally
143	* unsafe. With it turned off we will have to register a global rkey that	151	* unsafe. With it turned off we will have to register a global rkey that
@@ -566,16 +574,14 @@ out_put_dev: · 422 unmodified lines
566	return ret;	574	return ret;
567	}	575	}
568		576
569	static int nvme_rdma_alloc_queue(struct nvme_rdma_ctrl *ctrl,	577	static int nvme_rdma_alloc_queue(struct nvme_rdma_queue *queue)
570	int idx, size_t queue_size)
571	{	578	{
572	struct nvme_rdma_queue *queue;	579	struct nvme_rdma_ctrl *ctrl = queue->ctrl;
		580	int idx = nvme_rdma_queue_idx(queue);
573	struct sockaddr *src_addr = NULL;	581	struct sockaddr *src_addr = NULL;
574	int ret;	582	int ret;
575		583
576	queue = &ctrl->queues[idx];
577	mutex_init(&queue->queue_lock);	584	mutex_init(&queue->queue_lock);
578	queue->ctrl = ctrl;
579	if (idx && ctrl->ctrl.max_integrity_segments)	585	if (idx && ctrl->ctrl.max_integrity_segments)
580	queue->pi_support = true;	586	queue->pi_support = true;
581	else	587	else
@@ -587,8 +593,6 @@ static int nvme_rdma_alloc_queue(struct nvme_rdma_ctrl *ctrl, · 5 unmodified lines
587	else	593	else
588	queue->cmnd_capsule_len = sizeof(struct nvme_command);	594	queue->cmnd_capsule_len = sizeof(struct nvme_command);
589		595
590	queue->queue_size = queue_size;
591
592	queue->cm_id = rdma_create_id(&init_net, nvme_rdma_cm_handler, queue,	596	queue->cm_id = rdma_create_id(&init_net, nvme_rdma_cm_handler, queue,
593	RDMA_PS_TCP, IB_QPT_RC);	597	RDMA_PS_TCP, IB_QPT_RC);
594	if (IS_ERR(queue->cm_id)) {	598	if (IS_ERR(queue->cm_id)) {
@@ -694,59 +698,68 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx) · 99 unmodified lines
694	return ret;	698	return ret;
695	}	699	}
696		700
697	static int nvme_rdma_start_io_queues(struct nvme_rdma_ctrl *ctrl,	701	static void nvme_rdma_setup_queue_async(void *data, async_cookie_t cookie)
698	int first, int last)
699	{	702	{
700	int i, ret = 0;	703	struct nvme_rdma_setup_ctx *ctx = data;
		704	struct nvme_rdma_queue *queue;
		705	int ret;
701		706
702	for (i = first; i < last; i++) {	707	queue = ctx->queue;
703	ret = nvme_rdma_start_queue(ctrl, i);	708	ret = nvme_rdma_alloc_queue(queue);
704	if (ret)	709	if (ret)
705	goto out_stop_queues;	710	goto out_err;
706	}
707		711
708	return 0;	712	ret = nvme_rdma_start_queue(queue->ctrl, nvme_rdma_queue_idx(queue));
		713	if (ret)
		714	goto out_err;
709		715
710	out_stop_queues:	716	return;
711	for (i--; i >= first; i--)	717	out_err:
712	nvme_rdma_stop_queue(&ctrl->queues[i]);	718	WRITE_ONCE(*ctx->err, ret);
713	return ret;
714	}	719	}
715		720
716	static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)	721	static int nvme_rdma_setup_io_queues(struct nvme_rdma_ctrl *ctrl,
		722	unsigned int first, unsigned int last, size_t queue_size)
717	{	723	{
718	struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;	724	ASYNC_DOMAIN_EXCLUSIVE(queue_domain);
719	unsigned int nr_io_queues;	725	struct nvme_rdma_setup_ctx *ctxs;
720	int i, ret;	726	int nr_queues = last - first;
721		727	int err = 0, i, ret;
722	nr_io_queues = nvmf_nr_io_queues(opts);
723	ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
724	if (ret)
725	return ret;
726		728
727	if (nr_io_queues == 0) {	729	ctxs = kmalloc_objs(*ctxs, nr_queues);
728	dev_err(ctrl->ctrl.device,	730	if (!ctxs)
729	"unable to set any I/O queues\n");
730	return -ENOMEM;	731	return -ENOMEM;
731	}
732		732
733	ctrl->ctrl.queue_count = nr_io_queues + 1;	733	for (i = 0; i < nr_queues; i++) {
734	dev_info(ctrl->ctrl.device,	734	struct nvme_rdma_queue *queue = &ctrl->queues[first + i];
735	"creating %d I/O queues.\n", nr_io_queues);
736		735
737	nvmf_set_io_queues(opts, nr_io_queues, ctrl->io_queues);	736	queue->ctrl = ctrl;
738	for (i = 1; i < ctrl->ctrl.queue_count; i++) {	737	queue->queue_size = queue_size;
739	ret = nvme_rdma_alloc_queue(ctrl, i,	738
740	ctrl->ctrl.sqsize + 1);	739	ctxs[i].queue = queue;
741	if (ret)	740	ctxs[i].err = &err;
742	goto out_free_queues;	741	async_schedule_domain(nvme_rdma_setup_queue_async, &ctxs[i],
		742	&queue_domain);
743	}	743	}
744		744
745	return 0;	745	async_synchronize_full_domain(&queue_domain);
		746	kfree(ctxs);
746		747
		748	ret = READ_ONCE(err);
		749	if (ret)
		750	goto out_free_queues;
		751
		752	return 0;
747	out_free_queues:	753	out_free_queues:
748	for (i--; i >= 1; i--)	754	for (i = 0; i < nr_queues; i++) {
749	nvme_rdma_free_queue(&ctrl->queues[i]);	755	struct nvme_rdma_queue *queue =
		756	&ctrl->queues[first + i];
		757
		758	if (test_bit(NVME_RDMA_Q_LIVE, &queue->flags))
		759	nvme_rdma_stop_queue(queue);
		760	if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
		761	nvme_rdma_free_queue(queue);
		762	}
750		763
751	return ret;	764	return ret;
752	}	765	}
@@ -783,7 +796,9 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, · 30 unmodified lines
783	bool pi_capable = false;	796	bool pi_capable = false;
784	int error;	797	int error;
785		798
786	error = nvme_rdma_alloc_queue(ctrl, 0, NVME_AQ_DEPTH);	799	ctrl->queues[0].ctrl = ctrl;
		800	ctrl->queues[0].queue_size = NVME_AQ_DEPTH;
		801	error = nvme_rdma_alloc_queue(&ctrl->queues[0]);
787	if (error)	802	if (error)
788	return error;	803	return error;
789		804
@@ -863,12 +878,23 @@ out_free_queue: · 73 unmodified lines
863		878
864	static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)	879	static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
865	{	880	{
		881	unsigned int nr_io_queues;
866	int ret, nr_queues;	882	int ret, nr_queues;
867		883
868	ret = nvme_rdma_alloc_io_queues(ctrl);	884	nr_io_queues = nvmf_nr_io_queues(ctrl->ctrl.opts);
		885	ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
869	if (ret)	886	if (ret)
870	return ret;	887	return ret;
871		888
		889	if (nr_io_queues == 0) {
		890	dev_err(ctrl->ctrl.device, "unable to set any I/O queues\n");
		891	return -ENOMEM;
		892	}
		893
		894	ctrl->ctrl.queue_count = nr_io_queues + 1;
		895	dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues);
		896	nvmf_set_io_queues(ctrl->ctrl.opts, nr_io_queues, ctrl->io_queues);
		897
872	if (new) {	898	if (new) {
873	ret = nvme_rdma_alloc_tag_set(&ctrl->ctrl);	899	ret = nvme_rdma_alloc_tag_set(&ctrl->ctrl);
874	if (ret)	900	if (ret)
@@ -881,7 +907,9 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) · 6 unmodified lines
881	* queue number might have changed.	907	* queue number might have changed.
882	*/	908	*/
883	nr_queues = min(ctrl->tag_set.nr_hw_queues + 1, ctrl->ctrl.queue_count);	909	nr_queues = min(ctrl->tag_set.nr_hw_queues + 1, ctrl->ctrl.queue_count);
884	ret = nvme_rdma_start_io_queues(ctrl, 1, nr_queues);	910	ret = nvme_rdma_setup_io_queues(ctrl, 1, nr_queues,
		911	ctrl->ctrl.sqsize + 1);
		912
885	if (ret)	913	if (ret)
886	goto out_cleanup_tagset;	914	goto out_cleanup_tagset;
887		915
@@ -905,12 +933,15 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) · 17 unmodified lines
905		933
906	/*	934	/*
907	* If the number of queues has increased (reconnect case)	935	* If the number of queues has increased (reconnect case)
908	* start all new queues now.	936	* setup all new queues now.
909	*/	937	*/
910	ret = nvme_rdma_start_io_queues(ctrl, nr_queues,	938	if (ctrl->tag_set.nr_hw_queues + 1 > nr_queues) {
911	ctrl->tag_set.nr_hw_queues + 1);	939	ret = nvme_rdma_setup_io_queues(ctrl, nr_queues,
912	if (ret)	940	ctrl->tag_set.nr_hw_queues + 1,
913	goto out_wait_freeze_timed_out;	941	ctrl->ctrl.sqsize + 1);
		942	if (ret)
		943	goto out_wait_freeze_timed_out;
		944	}
914		945
915	return 0;	946	return 0;
916		947
@@ -969,7 +1000,7 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl) · 52 unmodified lines
969	{	1000	{
970	struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);	1001	struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
971		1002
972	if (list_empty(&ctrl->list))	1003	if (list_empty_careful(&ctrl->list))
973	goto free_ctrl;	1004	goto free_ctrl;
974		1005
975	mutex_lock(&nvme_rdma_ctrl_mutex);	1006	mutex_lock(&nvme_rdma_ctrl_mutex);
@@ -2254,7 +2285,10 @@ static struct nvme_rdma_ctrl nvme_rdma_alloc_ctrl(struct device dev, · 1278 unmodified lines
2254	if (!ctrl)	2285	if (!ctrl)
2255	return ERR_PTR(-ENOMEM);	2286	return ERR_PTR(-ENOMEM);
2256	ctrl->ctrl.opts = opts;	2287	ctrl->ctrl.opts = opts;
2257	INIT_LIST_HEAD(&ctrl->list);	2288	/*
		2289	* Safe to init list while allocating ctrl object.
		2290	*/
		2291	context_unsafe(INIT_LIST_HEAD(&ctrl->list));
2258		2292
2259	if (!(opts->mask & NVMF_OPT_TRSVCID)) {	2293	if (!(opts->mask & NVMF_OPT_TRSVCID)) {
2260	opts->trsvcid =	2294	opts->trsvcid =

drivers/nvme/host/sysfs.c+3−1

 		ret = ns_head_update_nuse(head);
 	else
 		ret = ns_update_nuse(disk->private_data);
-	if (ret)
+	if (ret < 0)
 		return ret;
+	else if (ret > 0)
+		return -EIO;
 	return sysfs_emit(buf, "%llu\n", head->nuse);
 }

drivers/nvme/host/tcp.c+64−7

 	struct bio		*curr_bio;
 	struct iov_iter		iter;
+	u32			data_recvd;
 	/* send state */
 	size_t			offset;
 	struct mutex		queue_lock;
 	struct mutex		send_mutex;
+	struct mutex		pf_cache_lock;
 	struct llist_head	req_list;
 	struct list_head	send_list;
 #endif
 };
+static DEFINE_MUTEX(nvme_tcp_ctrl_mutex);
+static LIST_HEAD_GUARDED(nvme_tcp_ctrl_list, nvme_tcp_ctrl_mutex);
 struct nvme_tcp_ctrl {
 	/* read only in the hot path */
 	struct nvme_tcp_queue	*queues;
 	struct blk_mq_tag_set	tag_set;
 	/* other member variables */
-	struct list_head	list;
+	struct list_head	list
+		__guarded_by(&nvme_tcp_ctrl_mutex);
 	struct blk_mq_tag_set	admin_tag_set;
 	struct sockaddr_storage addr;
 	struct sockaddr_storage src_addr;
 	u32			io_queues[HCTX_MAX_TYPES];
 };
-static LIST_HEAD(nvme_tcp_ctrl_list);
-static DEFINE_MUTEX(nvme_tcp_ctrl_mutex);
 static struct workqueue_struct *nvme_tcp_wq;
 static const struct blk_mq_ops nvme_tcp_mq_ops;
 static const struct blk_mq_ops nvme_tcp_admin_mq_ops;
 	struct nvme_tcp_queue *queue = &ctrl->queues[queue_idx];
 	u8 hdgst = nvme_tcp_hdgst_len(queue);
+	mutex_lock(&queue->pf_cache_lock);
 	req->pdu = page_frag_alloc(&queue->pf_cache,
 		sizeof(struct nvme_tcp_cmd_pdu) + hdgst,
 		GFP_KERNEL | __GFP_ZERO);
+	mutex_unlock(&queue->pf_cache_lock);
 	if (!req->pdu)
 		return -ENOMEM;
 	queue_work(nvme_reset_wq, &to_tcp_ctrl(ctrl)->err_work);
 }
+/*
+ * NVMe has no short read: a read that completes successfully must
+ * have transferred everything it asked for.
+ */
+static bool nvme_tcp_data_in_short(struct nvme_tcp_queue *queue,
+				   struct request *rq)
+{
+	struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+	if (le16_to_cpu(req->status) >> 1)
+		return false;
+	if (req_op(rq) != REQ_OP_READ || !req->data_len)
+		return false;
+	if (likely(req->data_recvd == req->data_len))
+		return false;
+	dev_err(queue->ctrl->ctrl.device,
+		"queue %d tag %#x short data-in: got %u of %u\n",
+		nvme_tcp_queue_id(queue), rq->tag,
+		req->data_recvd, req->data_len);
+	return true;
+}
 static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue,
 		struct nvme_completion *cqe)
 {
 	if (req->status == cpu_to_le16(NVME_SC_SUCCESS))
 		req->status = cqe->status;
+	if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+		return -EPROTO;
 	if (!nvme_try_complete_req(rq, req->status, cqe->result))
 		nvme_complete_rq(rq);
 	queue->nr_cqe++;
 static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue,
 		struct nvme_tcp_data_pdu *pdu)
 {
+	struct nvme_tcp_request *req;
 	struct request *rq;
 	rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
 		return -ENOENT;
 	}
-	if (!blk_rq_payload_bytes(rq)) {
+	req = blk_mq_rq_to_pdu(rq);
+	if (!blk_rq_payload_bytes(rq) || !req->curr_bio || !req->data_len) {
 		dev_err(queue->ctrl->ctrl.device,
 			"queue %d tag %#x unexpected data\n",
 			nvme_tcp_queue_id(queue), rq->tag);
 	}
 	req = blk_mq_rq_to_pdu(rq);
+	if (unlikely(rq_data_dir(rq) != WRITE)) {
+		dev_err(queue->ctrl->ctrl.device,
+			"req %d unexpected r2t for a non-write command\n",
+			rq->tag);
+		return -EPROTO;
+	}
 	if (unlikely(!r2t_length)) {
 		dev_err(queue->ctrl->ctrl.device,
 			"req %d r2t len is %u, probably a bug...\n",
 		*len -= recv_len;
 		*offset += recv_len;
 		queue->data_remaining -= recv_len;
+		req->data_recvd += recv_len;
 	}
 	if (!queue->data_remaining) {
 			queue->ddgst_remaining = NVME_TCP_DIGEST_LENGTH;
 		} else {
 			if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) {
+				if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+					return -EPROTO;
 				nvme_tcp_end_request(rq,
 						le16_to_cpu(req->status));
 				queue->nr_cqe++;
 					pdu->command_id);
 		struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+		if (unlikely(nvme_tcp_data_in_short(queue, rq)))
+			return -EPROTO;
 		nvme_tcp_end_request(rq, le16_to_cpu(req->status));
 		queue->nr_cqe++;
 	}
 	struct nvme_tcp_request *async = &ctrl->async_req;
 	u8 hdgst = nvme_tcp_hdgst_len(queue);
+	mutex_lock(&queue->pf_cache_lock);
 	async->pdu = page_frag_alloc(&queue->pf_cache,
 		sizeof(struct nvme_tcp_cmd_pdu) + hdgst,
 		GFP_KERNEL | __GFP_ZERO);
+	mutex_unlock(&queue->pf_cache_lock);
 	if (!async->pdu)
 		return -ENOMEM;
 	kfree(queue->pdu);
 	mutex_destroy(&queue->send_mutex);
 	mutex_destroy(&queue->queue_lock);
+	mutex_destroy(&queue->pf_cache_lock);
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 	lockdep_unregister_key(&queue->nvme_tcp_sk_key);
 	INIT_LIST_HEAD(&queue->send_list);
 	mutex_init(&queue->send_mutex);
 	INIT_WORK(&queue->io_work, nvme_tcp_io_work);
+	mutex_init(&queue->pf_cache_lock);
 	if (qid > 0)
 		queue->cmnd_capsule_len = nctrl->ioccsz * 16;
 err_destroy_mutex:
 	mutex_destroy(&queue->send_mutex);
 	mutex_destroy(&queue->queue_lock);
+	mutex_destroy(&queue->pf_cache_lock);
 	return ret;
 }
 {
 	struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
-	if (list_empty(&ctrl->list))
+	if (list_empty_careful(&ctrl->list))
 		goto free_ctrl;
 	mutex_lock(&nvme_tcp_ctrl_mutex);
 	req->status = cpu_to_le16(NVME_SC_SUCCESS);
 	req->offset = 0;
 	req->data_sent = 0;
+	req->data_recvd = 0;
 	req->pdu_len = 0;
 	req->pdu_sent = 0;
 	req->h2cdata_left = 0;
 	if (!ctrl)
 		return ERR_PTR(-ENOMEM);
-	INIT_LIST_HEAD(&ctrl->list);
+	/*
+	 * Safe to init list while allocating ctrl object.
+	 */
+	context_unsafe(INIT_LIST_HEAD(&ctrl->list));
 	ctrl->ctrl.opts = opts;
 	ctrl->ctrl.queue_count = opts->nr_io_queues + opts->nr_write_queues +
 				opts->nr_poll_queues + 1;
 	}
 	if (opts->mask & NVMF_OPT_HOST_IFACE) {
-		if (!__dev_get_by_name(&init_net, opts->host_iface)) {
+		if (!__dev_get_by_name(current->nsproxy->net_ns,
+				       opts->host_iface)) {
 			pr_err("invalid interface passed: %s\n",
 			       opts->host_iface);
 			ret = -ENODEV;

drivers/nvme/host/zns.c+8−3

 	struct blk_zone zone = { };
 	if ((entry->zt & 0xf) != NVME_ZONE_TYPE_SEQWRITE_REQ) {
-		dev_err(ns->ctrl->device, "invalid zone type %#x\n", entry->zt);
+		dev_err(ns->ctrl->device, "invalid zone type %#x at zone %u\n",
+			entry->zt, idx);
 		return -EINVAL;
 	}
 	struct nvme_zone_report *report;
 	struct nvme_command c = { };
 	int ret, zone_idx = 0;
-	unsigned int nz, i;
+	unsigned int max_in_buf, nz, i;
 	size_t buflen;
 	if (ns->head->ids.csi != NVME_CSI_ZNS)
 	if (!report)
 		return -ENOMEM;
+	max_in_buf = (buflen - sizeof(struct nvme_zone_report)) /
+		sizeof(struct nvme_zone_descriptor);
 	c.zmr.opcode = nvme_cmd_zone_mgmt_recv;
 	c.zmr.nsid = cpu_to_le32(ns->head->ns_id);
 	c.zmr.numd = cpu_to_le32(nvme_bytes_to_numd(buflen));
 			goto out_free;
 		}
-		nz = min((unsigned int)le64_to_cpu(report->nr_zones), nr_zones);
+		nz = min3((unsigned int)le64_to_cpu(report->nr_zones),
+			  nr_zones - zone_idx, max_in_buf);
 		if (!nz)
 			break;

drivers/nvme/target/admin-cmd.c+8−6

 	}
 	log = kzalloc_obj(*log);
-	if (!log)
+	if (!log) {
+		status = NVME_SC_INTERNAL;
 		goto out;
+	}
 	log->endgid = req->cmd->get_log_page.lsi;
 	disk = req->ns->bdev->bd_disk;
 	nvmet_for_each_enabled_ns(&ctrl->subsys->namespaces, idx, ns) {
 		if (ns->nsid <= min_nsid)
 			continue;
-		if (match_css && req->ns->csi != req->cmd->identify.csi)
+		if (match_css && ns->csi != req->cmd->identify.csi)
 			continue;
 		list[i++] = cpu_to_le32(ns->nsid);
 		if (i == buf_size / sizeof(__le32))
 void nvmet_execute_set_features(struct nvmet_req *req)
 {
-	struct nvmet_subsys *subsys = nvmet_req_subsys(req);
+	struct nvmet_ctrl *ctrl = nvmet_req_ctrl(req);
 	u32 cdw10 = le32_to_cpu(req->cmd->common.cdw10);
 	u32 cdw11 = le32_to_cpu(req->cmd->common.cdw11);
 	u16 status = 0;
 			break;
 		}
 		nvmet_set_result(req,
-			(subsys->max_qid - 1) | ((subsys->max_qid - 1) << 16));
+			(ctrl->max_qid - 1) | ((ctrl->max_qid - 1) << 16));
 		break;
 	case NVME_FEAT_IRQ_COALESCE:
 		status = nvmet_set_feat_irq_coalesce(req);
 void nvmet_execute_get_features(struct nvmet_req *req)
 {
-	struct nvmet_subsys *subsys = nvmet_req_subsys(req);
+	struct nvmet_ctrl *ctrl = nvmet_req_ctrl(req);
 	u32 cdw10 = le32_to_cpu(req->cmd->common.cdw10);
 	u16 status = 0;
 		break;
 	case NVME_FEAT_NUM_QUEUES:
 		nvmet_set_result(req,
-			(subsys->max_qid-1) | ((subsys->max_qid-1) << 16));
+			(ctrl->max_qid-1) | ((ctrl->max_qid-1) << 16));
 		break;
 	case NVME_FEAT_KATO:
 		nvmet_get_feat_kato(req);

drivers/nvme/target/configfs.c+6−4

 		const char *page, size_t count)
 {
 	struct nvmet_port *port = to_nvmet_port(item);
-	int ret;
+	int ret, mdts;
 	if (nvmet_is_port_enabled(port, __func__))
 		return -EACCES;
-	ret = kstrtoint(page, 0, &port->mdts);
+	ret = kstrtoint(page, 0, &mdts);
-	if (ret) {
+	if (ret || mdts < 0 || mdts > NVMET_MAX_MDTS) {
-		pr_err("Invalid value '%s' for mdts\n", page);
+		pr_err("Invalid value '%s' for mdts, should be 0-%d\n",
+		       page, NVMET_MAX_MDTS);
 		return -EINVAL;
 	}
+	port->mdts = mdts;
 	return count;
 }

drivers/nvme/target/core.c+31−23

 			goto out_dev_put;
 	}
-	if (percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL))
+	ret = percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL);
+	if (ret)
 		goto out_pr_exit;
 	nvmet_ns_changed(subsys, ns->nsid);
 	ns->enabled = true;
 	xa_set_mark(&subsys->namespaces, ns->nsid, NVMET_NS_ENABLED);
+	nvmet_debugfs_ns_setup(ns);
 	ret = 0;
 out_unlock:
 	mutex_unlock(&subsys->lock);
 	ns->enabled = false;
 	xa_clear_mark(&subsys->namespaces, ns->nsid, NVMET_NS_ENABLED);
+	nvmet_debugfs_ns_free(ns);
 	list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry)
 		pci_dev_put(radix_tree_delete(&ctrl->p2p_ns_map, ns->nsid));
 	if (!ctrl->cqs)
 		return NVME_SC_INTERNAL | NVME_STATUS_DNR;
-	if (cqid > ctrl->subsys->max_qid)
+	if (cqid > ctrl->max_qid)
 		return NVME_SC_QID_INVALID | NVME_STATUS_DNR;
 	if ((create && ctrl->cqs[cqid]) || (!create && !ctrl->cqs[cqid]))
 	if (!ctrl->sqs)
 		return NVME_SC_INTERNAL | NVME_STATUS_DNR;
-	if (sqid > ctrl->subsys->max_qid)
+	if (sqid > ctrl->max_qid)
 		return NVME_SC_QID_INVALID | NVME_STATUS_DNR;
 	if ((create && ctrl->sqs[sqid]) ||
 	if (!ctrl->changed_ns_list)
 		goto out_free_ctrl;
-	ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);
+	/*
+	 * Discovery controllers may use some arbitrary high value
+	 * in order to cleanup stale discovery sessions
+	 */
+	if (nvmet_is_disc_subsys(ctrl->subsys) && !kato)
+		kato = NVMET_DISC_KATO_MS;
+	/* keep-alive timeout in seconds */
+	ctrl->kato = DIV_ROUND_UP(kato, 1000);
+	ctrl->err_counter = 0;
+	spin_lock_init(&ctrl->error_lock);
+	down_read(&nvmet_config_sem);
+	mutex_lock(&subsys->lock);
+	ctrl->max_qid = subsys->max_qid;
+	ctrl->sqs = kzalloc_objs(struct nvmet_sq *, ctrl->max_qid + 1);
 	if (!ctrl->sqs)
 		goto out_free_changed_ns_list;
-	ctrl->cqs = kzalloc_objs(struct nvmet_cq *, subsys->max_qid + 1);
+	ctrl->cqs = kzalloc_objs(struct nvmet_cq *, ctrl->max_qid + 1);
 	if (!ctrl->cqs)
 		goto out_free_sqs;
 	}
 	ctrl->cntlid = ret;
-	/*
-	 * Discovery controllers may use some arbitrary high value
-	 * in order to cleanup stale discovery sessions
-	 */
-	if (nvmet_is_disc_subsys(ctrl->subsys) && !kato)
-		kato = NVMET_DISC_KATO_MS;
-	/* keep-alive timeout in seconds */
-	ctrl->kato = DIV_ROUND_UP(kato, 1000);
-	ctrl->err_counter = 0;
-	spin_lock_init(&ctrl->error_lock);
-	nvmet_start_keep_alive_timer(ctrl);
-	mutex_lock(&subsys->lock);
 	ret = nvmet_ctrl_init_pr(ctrl);
 	if (ret)
 		goto init_pr_fail;
 	nvmet_setup_p2p_ns_map(ctrl, args->p2p_client);
 	nvmet_debugfs_ctrl_setup(ctrl);
 	mutex_unlock(&subsys->lock);
+	up_read(&nvmet_config_sem);
+	nvmet_start_keep_alive_timer(ctrl);
 	if (args->hostid)
 		uuid_copy(&ctrl->hostid, args->hostid);
 	return ctrl;
 init_pr_fail:
-	mutex_unlock(&subsys->lock);
-	nvmet_stop_keep_alive_timer(ctrl);
 	ida_free(&cntlid_ida, ctrl->cntlid);
 out_free_cqs:
 	kfree(ctrl->cqs);
 out_free_sqs:
 	kfree(ctrl->sqs);
 out_free_changed_ns_list:
+	mutex_unlock(&subsys->lock);
+	up_read(&nvmet_config_sem);
 	kfree(ctrl->changed_ns_list);
 out_free_ctrl:
 	kfree(ctrl);

drivers/nvme/target/debugfs.c+103−0

@@ -153,6 +153,109 @@ static int nvmet_ctrl_tls_concat_show(struct seq_file m, void p) · 152 unmodified lines
153	NVMET_DEBUGFS_ATTR(nvmet_ctrl_tls_concat);	153	NVMET_DEBUGFS_ATTR(nvmet_ctrl_tls_concat);
154	#endif	154	#endif
155		155
		156	static const char *const nvmet_pr_type_names[] = {
		157	[NVME_PR_WRITE_EXCLUSIVE] = "write_exclusive",
		158	[NVME_PR_EXCLUSIVE_ACCESS] = "exclusive_access",
		159	[NVME_PR_WRITE_EXCLUSIVE_REG_ONLY] = "write_exclusive_reg_only",
		160	[NVME_PR_EXCLUSIVE_ACCESS_REG_ONLY] = "exclusive_access_reg_only",
		161	[NVME_PR_WRITE_EXCLUSIVE_ALL_REGS] = "write_exclusive_all_regs",
		162	[NVME_PR_EXCLUSIVE_ACCESS_ALL_REGS] = "exclusive_access_all_regs",
		163	};
		164
		165	static const char *nvmet_pr_type_to_str(enum nvme_pr_type type)
		166	{
		167	if (type < ARRAY_SIZE(nvmet_pr_type_names) &&
		168	nvmet_pr_type_names[type])
		169	return nvmet_pr_type_names[type];
		170	return "unknown";
		171	}
		172
		173	static const char *const nvmet_pr_notify_names[] = {
		174	[NVME_PR_NOTIFY_BIT_REG_PREEMPTED] = "reg_preempted",
		175	[NVME_PR_NOTIFY_BIT_RESV_RELEASED] = "resv_released",
		176	[NVME_PR_NOTIFY_BIT_RESV_PREEMPTED] = "resv_preempted",
		177	};
		178
		179	static void nvmet_pr_notify_mask_to_str(struct seq_file *m, unsigned long mask)
		180	{
		181	bool sep = false;
		182	int i;
		183
		184	if (!mask) {
		185	seq_puts(m, "none");
		186	return;
		187	}
		188
		189	for (i = 0; i < ARRAY_SIZE(nvmet_pr_notify_names); i++) {
		190	if (!test_bit(i, &mask) \|\| !nvmet_pr_notify_names[i])
		191	continue;
		192	if (sep)
		193	seq_putc(m, ',');
		194	seq_puts(m, nvmet_pr_notify_names[i]);
		195	sep = true;
		196	}
		197	}
		198
		199	static int nvmet_ns_pr_show(struct seq_file m, void p)
		200	{
		201	struct nvmet_ns *ns = m->private;
		202	struct nvmet_pr *pr = &ns->pr;
		203	struct nvmet_pr_registrant holder, reg;
		204
		205	seq_printf(m, "enable=%d\n", pr->enable);
		206	if (!pr->enable)
		207	return 0;
		208
		209	seq_printf(m, "generation=%u\n", atomic_read(&pr->generation));
		210	seq_puts(m, "notify_mask=");
		211	nvmet_pr_notify_mask_to_str(m, pr->notify_mask);
		212	seq_putc(m, '\n');
		213
		214	rcu_read_lock();
		215	holder = rcu_dereference(pr->holder);
		216	if (holder) {
		217	seq_printf(m, "rtype=%s\n",
		218	nvmet_pr_type_to_str(holder->rtype));
		219	seq_printf(m, "holder=%pUb,0x%llx\n",
		220	&holder->hostid, holder->rkey);
		221	} else {
		222	seq_puts(m, "rtype=none\n");
		223	seq_puts(m, "holder=none\n");
		224	}
		225
		226	list_for_each_entry_rcu(reg, &pr->registrant_list, entry) {
		227	seq_printf(m, "reg=%pUb,0x%llx\n",
		228	&reg->hostid, reg->rkey);
		229	}
		230	rcu_read_unlock();
		231
		232	return 0;
		233	}
		234	NVMET_DEBUGFS_ATTR(nvmet_ns_pr);
		235
		236	void nvmet_debugfs_ns_setup(struct nvmet_ns *ns)
		237	{
		238	char name[16];
		239	struct dentry *parent = ns->subsys->debugfs_dir;
		240
		241	if (!parent)
		242	return;
		243	snprintf(name, sizeof(name), "ns%u", ns->nsid);
		244	ns->debugfs_dir = debugfs_create_dir(name, parent);
		245	if (IS_ERR(ns->debugfs_dir)) {
		246	ns->debugfs_dir = NULL;
		247	return;
		248	}
		249	debugfs_create_file("reservation", 0400, ns->debugfs_dir, ns,
		250	&nvmet_ns_pr_fops);
		251	}
		252
		253	void nvmet_debugfs_ns_free(struct nvmet_ns *ns)
		254	{
		255	debugfs_remove_recursive(ns->debugfs_dir);
		256	ns->debugfs_dir = NULL;
		257	}
		258
156	int nvmet_debugfs_ctrl_setup(struct nvmet_ctrl *ctrl)	259	int nvmet_debugfs_ctrl_setup(struct nvmet_ctrl *ctrl)
157	{	260	{
158	char name[32];	261	char name[32];

drivers/nvme/target/debugfs.h+5−0

 void nvmet_debugfs_subsys_free(struct nvmet_subsys *subsys);
 int nvmet_debugfs_ctrl_setup(struct nvmet_ctrl *ctrl);
 void nvmet_debugfs_ctrl_free(struct nvmet_ctrl *ctrl);
+void nvmet_debugfs_ns_setup(struct nvmet_ns *ns);
+void nvmet_debugfs_ns_free(struct nvmet_ns *ns);
 int __init nvmet_init_debugfs(void);
 void nvmet_exit_debugfs(void);
 }
 static inline void nvmet_debugfs_ctrl_free(struct nvmet_ctrl *ctrl) {}
+static inline void nvmet_debugfs_ns_setup(struct nvmet_ns *ns) {}
+static inline void nvmet_debugfs_ns_free(struct nvmet_ns *ns) {}
 static inline int __init nvmet_init_debugfs(void)
 {
     return 0;

drivers/nvme/target/fabrics-cmd-auth.c+13−4

 #include <linux/random.h>
 #include <linux/nvme-auth.h>
 #include <crypto/kpp.h>
+#include <crypto/utils.h>
 #include "nvmet.h"
 static void nvmet_auth_expired_work(struct work_struct *work)
 	sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;
 }
-static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d)
+static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d, u32 tl)
 {
 	struct nvmet_ctrl *ctrl = req->sq->ctrl;
 	struct nvmf_auth_dhchap_negotiate_data *data = d;
 	int i, hash_id = 0, fallback_hash_id = 0, dhgid, fallback_dhgid;
+	if (tl < sizeof(*data) +
+			sizeof(struct nvmf_auth_dhchap_protocol_descriptor))
+		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
 	pr_debug("%s: ctrl %d qid %d: data sc_d %d napd %d authid %d halen %d dhlen %d\n",
 		 __func__, ctrl->cntlid, req->sq->qid,
 		 data->sc_c, data->napd, data->auth_protocol[0].dhchap.authid,
 	    NVME_AUTH_DHCHAP_AUTH_ID)
 		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
+	if (data->auth_protocol[0].dhchap.dhlen > NVME_AUTH_DHCHAP_MAX_DH_IDS ||
+	    data->auth_protocol[0].dhchap.halen > NVME_AUTH_DHCHAP_MAX_HASH_IDS)
+		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
 	for (i = 0; i < data->auth_protocol[0].dhchap.halen; i++) {
 		u8 host_hmac_id = data->auth_protocol[0].dhchap.idlist[i];
 		return NVME_AUTH_DHCHAP_FAILURE_FAILED;
 	}
-	if (memcmp(data->rval, response, data->hl)) {
+	if (crypto_memneq(data->rval, response, data->hl)) {
 		pr_info("ctrl %d qid %d host response mismatch\n",
 			ctrl->cntlid, req->sq->qid);
 		pr_debug("ctrl %d qid %d rval %*ph\n",
 		} else if (data->auth_id != req->sq->dhchap_step)
 			goto done_failure1;
 		/* Validate negotiation parameters */
-		dhchap_status = nvmet_auth_negotiate(req, d);
+		dhchap_status = nvmet_auth_negotiate(req, d, tl);
 		if (dhchap_status == 0)
 			req->sq->dhchap_step =
 				NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE;
 		return;
 	}
-	d = kmalloc(al, GFP_KERNEL);
+	d = kzalloc(al, GFP_KERNEL);
 	if (!d) {
 		status = NVME_SC_INTERNAL;
 		goto done;

drivers/nvme/target/fabrics-cmd.c+1−1

@@ -370,7 +370,7 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) · 369 unmodified lines
370	goto out;	370	goto out;
371	}	371	}
372		372
373	if (unlikely(qid > ctrl->subsys->max_qid)) {	373	if (unlikely(qid > ctrl->max_qid)) {
374	pr_warn("invalid queue id (%d)\n", qid);	374	pr_warn("invalid queue id (%d)\n", qid);
375	status = NVME_SC_CONNECT_INVALID_PARAM \| NVME_STATUS_DNR;	375	status = NVME_SC_CONNECT_INVALID_PARAM \| NVME_STATUS_DNR;
376	req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(qid);	376	req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(qid);

drivers/nvme/target/fc.c+1−1

@@ -566,7 +566,7 @@ out_fail: · 565 unmodified lines
566	list_del(&iod->ls_rcv_list);	566	list_del(&iod->ls_rcv_list);
567	}	567	}
568		568
569	kfree(iod);	569	kfree(tgtport->iod);
570		570
571	return -EFAULT;	571	return -EFAULT;
572	}	572	}

drivers/nvme/target/nvmet.h+9−0

 	u8			csi;
 	struct nvmet_pr		pr;
 	struct xarray		pr_per_ctrl_refs;
+#ifdef CONFIG_NVME_TARGET_DEBUGFS
+	struct dentry		*debugfs_dir;
+#endif
 };
 static inline struct nvmet_ns *to_nvmet_ns(struct config_item *item)
 	uuid_t			hostid;
 	u16			cntlid;
+	u16			max_qid;
 	u32			kato;
 	struct nvmet_port	*port;
 	return req->sq->ctrl->subsys;
 }
+static inline struct nvmet_ctrl *nvmet_req_ctrl(struct nvmet_req *req)
+{
+	return req->sq->ctrl;
+}
 static inline bool nvmet_is_disc_subsys(struct nvmet_subsys *subsys)
 {
     return subsys->type != NVME_NQN_NVME;

drivers/nvme/target/passthru.c+9−0

 	for (pos = 0; pos < NVME_IDENTIFY_DATA_SIZE; pos += len) {
 		struct nvme_ns_id_desc *cur = data + pos;
+		if (pos + sizeof(*cur) > NVME_IDENTIFY_DATA_SIZE)
+			break;
 		if (cur->nidl == 0)
 			break;
 		if (cur->nidt == NVME_NIDT_CSI) {
+			if (pos + sizeof(*cur) + NVME_NIDT_CSI_LEN >
+						NVME_IDENTIFY_DATA_SIZE)
+				break;
 			memcpy(&csi, cur + 1, NVME_NIDT_CSI_LEN);
 			csi_seen = true;
 			break;
 		}
 		len = sizeof(struct nvme_ns_id_desc) + cur->nidl;
 	}

drivers/nvme/target/pci-epf.c+8−4

 	nvmet_pci_epf_mem_unmap(ctrl->nvme_epf, &cq->pci_map);
 err_internal:
 	status = NVME_SC_INTERNAL | NVME_STATUS_DNR;
+	nvmet_cq_put(&cq->nvme_cq);
 err:
 	if (test_and_clear_bit(NVMET_PCI_EPF_Q_IRQ_ENABLED, &cq->flags))
 		nvmet_pci_epf_remove_irq_vector(ctrl, cq->vector);
 	struct nvmet_pci_epf_iod *iod =
 		container_of(work, struct nvmet_pci_epf_iod, work);
 	struct nvmet_req *req = &iod->req;
+	bool no_wait;
 	int ret;
 	if (!iod->ctrl->link_up) {
 		}
 	}
-	req->execute(req);
 	/*
 	 * If we do not have data to transfer after the command execution
 	 * finishes, nvmet_pci_epf_queue_response() will complete the command
 	 * directly. No need to wait for the completion in this case.
 	 */
-	if (!iod->data_len || iod->dma_dir != DMA_TO_DEVICE)
+	no_wait = !iod->data_len || iod->dma_dir != DMA_TO_DEVICE;
+	req->execute(req);
+	if (no_wait)
 		return;
 	wait_for_completion(&iod->done);
 	}
 	/* Allocate our queues, up to the maximum number. */
-	ctrl->nr_queues = min(ctrl->tctrl->subsys->max_qid + 1, max_nr_queues);
+	ctrl->nr_queues = min(ctrl->tctrl->max_qid + 1, max_nr_queues);
 	ret = nvmet_pci_epf_alloc_queues(ctrl);
 	if (ret)
 		goto out_put_ctrl;

drivers/nvme/target/pr.c+30−7

 #include <linux/unaligned.h>
 #include "nvmet.h"
-#define NVMET_PR_NOTIFI_MASK_ALL \
+#define NVMET_PR_NOTIFY_MASK_ALL \
 	(1 << NVME_PR_NOTIFY_BIT_REG_PREEMPTED | \
 	 1 << NVME_PR_NOTIFY_BIT_RESV_RELEASED | \
 	 1 << NVME_PR_NOTIFY_BIT_RESV_PREEMPTED)
 	unsigned long idx;
 	u16 status;
-	if (mask & ~(NVMET_PR_NOTIFI_MASK_ALL)) {
+	if (mask & ~(NVMET_PR_NOTIFY_MASK_ALL)) {
 		req->error_loc = offsetof(struct nvme_common_command, cdw11);
 		return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 	}
 			nvmet_pr_add_resv_log(ctrl,
 				NVME_PR_LOG_RESERVATION_RELEASED, ns->nsid);
 			nvmet_add_async_event(ctrl, NVME_AER_CSS,
-				NVME_AEN_RESV_LOG_PAGE_AVALIABLE,
+				NVME_AEN_RESV_LOG_PAGE_AVAILABLE,
 				NVME_LOG_RESERVATION);
 		}
 	}
 		if (uuid_equal(hostid, &ctrl->hostid)) {
 			nvmet_pr_add_resv_log(ctrl, log_type, ns->nsid);
 			nvmet_add_async_event(ctrl, NVME_AER_CSS,
-				NVME_AEN_RESV_LOG_PAGE_AVALIABLE,
+				NVME_AEN_RESV_LOG_PAGE_AVAILABLE,
 				NVME_LOG_RESERVATION);
 		}
 	}
 		return;
 	nvmet_pr_send_event_to_host(pr, hostid,
-		NVME_PR_LOG_RESERVATOIN_PREEMPTED);
+		NVME_PR_LOG_RESERVATION_PREEMPTED);
 }
 static void nvmet_pr_registration_preempted(struct nvmet_pr *pr,
 	u16 status = NVME_SC_RESERVATION_CONFLICT | NVME_STATUS_DNR;
 	struct nvmet_ctrl *ctrl = req->sq->ctrl;
 	struct nvmet_pr *pr = &req->ns->pr;
-	struct nvmet_pr_registrant *reg;
+	struct nvmet_pr_registrant *reg, *new = NULL;
 	u64 nrkey = le64_to_cpu(d->nrkey);
+	if (ignore_key && nrkey) {
+		new = kzalloc_obj(*new);
+		if (!new)
+			return NVME_SC_INTERNAL;
+	}
 	down(&pr->pr_sem);
 	list_for_each_entry_rcu(reg, &pr->registrant_list, entry) {
 		if (uuid_equal(&reg->hostid, &ctrl->hostid)) {
 				status = nvmet_pr_update_reg_attr(pr, reg,
 						nvmet_pr_update_reg_rkey,
 						&nrkey);
-			break;
+			goto free_data;
+		}
+	}
+	if (ignore_key) {
+		if (!nrkey) {
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
+			goto free_data;
 		}
+		INIT_LIST_HEAD(&new->entry);
+		new->rkey = nrkey;
+		uuid_copy(&new->hostid, &ctrl->hostid);
+		list_add_tail_rcu(&new->entry, &pr->registrant_list);
+		status = NVME_SC_SUCCESS;
+		goto out;
 	}
+free_data:
+	kfree(new);
+out:
 	up(&pr->pr_sem);
 	return status;
 }

drivers/nvme/target/rdma.c+28−3

 				    req->sg, req->sg_cnt, nvmet_data_dir(req));
 }
-static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
+static void nvmet_rdma_free_rsp_resources(struct nvmet_rdma_rsp *rsp)
 {
 	struct nvmet_rdma_queue *queue = rsp->queue;
-	atomic_add(1 + rsp->n_rdma, &queue->sq_wr_avail);
 	if (rsp->n_rdma)
 		nvmet_rdma_rw_ctx_destroy(rsp);
 	if (rsp->req.sg < rsp->cmd->inline_sg ||
 	    rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
 		nvmet_req_free_sgls(&rsp->req);
+}
+static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
+{
+	struct nvmet_rdma_queue *queue = rsp->queue;
+	atomic_add(1 + rsp->n_rdma, &queue->sq_wr_avail);
+	nvmet_rdma_free_rsp_resources(rsp);
 	if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
 		nvmet_rdma_process_wr_wait_list(queue);
 	goto out;
 }
+static bool nvmet_rdma_reclaim_rsp(struct sbitmap *sb, unsigned int bitnr,
+				   void *data)
+{
+	struct nvmet_rdma_queue *queue = data;
+	nvmet_rdma_free_rsp_resources(&queue->rsps[bitnr]);
+	return true;
+}
 static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
 {
 	ib_drain_qp(queue->qp);
+	/*
+	 * Reclaim resources of a response that is still in-flight when the
+	 * queue is being torn down. This happens when the connection was
+	 * forcefully disconnected while an I/O is in flight.
+	 */
+	sbitmap_for_each_set(&queue->rsp_tags, nvmet_rdma_reclaim_rsp, queue);
 	if (queue->cm_id)
 		rdma_destroy_id(queue->cm_id);
 	ib_destroy_qp(queue->qp);

drivers/nvme/target/tcp.c+17−2

 	if (!len)
 		return 0;
+	/*
+	 * inline_data_size only bounds the in-capsule (type 0x01) SGL
+	 * descriptor below. A non-inline transport SGL data-block
+	 * descriptor skips that check entirely and would otherwise reach
+	 * sgl_alloc() with an attacker-controlled len of up to 4 GiB,
+	 * pinning that much kernel memory for a command that may never
+	 * complete. Bound every descriptor type here, before allocating
+	 * anything, using the same ceiling this file already applies to
+	 * per-PDU H2C data.
+	 */
+	if (len > NVMET_TCP_MAXH2CDATA)
+		return NVME_SC_SGL_INVALID_DATA | NVME_STATUS_DNR;
 	if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) |
 			  NVME_SGL_FMT_OFFSET)) {
 		if (!nvme_is_write(cmd->req.cmd))
 	}
 	cmd->req.transfer_len += len;
-	cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);
+	cmd->req.sg = sgl_alloc(len, GFP_KERNEL | __GFP_NOWARN,
+				&cmd->req.sg_cnt);
 	if (!cmd->req.sg)
 		return NVME_SC_INTERNAL;
 	cmd->cur_sg = cmd->req.sg;
 	if (nvmet_tcp_has_data_in(cmd)) {
-		cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt);
+		cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt,
+					GFP_KERNEL | __GFP_NOWARN);
 		if (!cmd->iov)
 			goto err;
 	}

drivers/nvme/target/zns.c+11−4

 		mutex_unlock(&req->ns->subsys->lock);
 	}
-	if (!bdev_is_zoned(req->ns->bdev)) {
+	if (!req->ns->bdev || !bdev_is_zoned(req->ns->bdev)) {
 		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_identify, nsid);
 		goto out;
 	}
 	/*
-	 * When partial bit is set nr_zones must indicate the number of zone
+	 * Partial report (PR bit set): the host accepts an incomplete listing,
-	 * descriptors actually transferred.
+	 * so cap Number of Zones to the descriptors that fit in the buffer.
+	 * Full report (PR bit clear): Number of Zones is the match count; fail
+	 * if the buffer cannot hold every matching zone descriptor.
 	 */
-	if (req->cmd->zmr.pr)
+	if (req->cmd->zmr.pr) {
 		rz_data.nr_zones = min(rz_data.nr_zones, rz_data.out_nr_zones);
+	} else if (rz_data.nr_zones > rz_data.out_nr_zones) {
+		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
+		goto out;
+	}
 	nr_zones = cpu_to_le64(rz_data.nr_zones);
 	status = nvmet_copy_to_sgl(req, 0, &nr_zones, sizeof(nr_zones));

include/linux/list.h+9−0

 #define LIST_HEAD(name) \
 	struct list_head name = LIST_HEAD_INIT(name)
+/**
+ * LIST_HEAD_GUARDED - define a &struct list_head annotated with __guarded_by()
+ * @name: name of the list_head
+ * @lock: lock protecting the list
+ */
+#define LIST_HEAD_GUARDED(name, lock) \
+	__guarded_by(&(lock)) LIST_HEAD(name)
 /**
  * INIT_LIST_HEAD - Initialize a list_head structure
  * @list: list_head structure to be initialized.
  * if another CPU could re-list_add() it.
  */
 static inline int list_empty_careful(const struct list_head *head)
+	__context_unsafe(/* intentional lockless access to @head */)
 {
 	struct list_head *next = smp_load_acquire(&head->next);
 	return list_is_head(next, head) && (next == READ_ONCE(head->prev));

include/linux/nvme.h+2−2

@@ -2272,14 +2272,14 @@ struct nvme_completion { · 2271 unmodified lines
2272	#define NVME_TERTIARY(ver) ((ver) & 0xff)	2272	#define NVME_TERTIARY(ver) ((ver) & 0xff)
2273		2273
2274	enum {	2274	enum {
2275	NVME_AEN_RESV_LOG_PAGE_AVALIABLE = 0x00,	2275	NVME_AEN_RESV_LOG_PAGE_AVAILABLE = 0x00,
2276	};	2276	};
2277		2277
2278	enum {	2278	enum {
2279	NVME_PR_LOG_EMPTY_LOG_PAGE = 0x00,	2279	NVME_PR_LOG_EMPTY_LOG_PAGE = 0x00,
2280	NVME_PR_LOG_REGISTRATION_PREEMPTED = 0x01,	2280	NVME_PR_LOG_REGISTRATION_PREEMPTED = 0x01,
2281	NVME_PR_LOG_RESERVATION_RELEASED = 0x02,	2281	NVME_PR_LOG_RESERVATION_RELEASED = 0x02,
2282	NVME_PR_LOG_RESERVATOIN_PREEMPTED = 0x03,	2282	NVME_PR_LOG_RESERVATION_PREEMPTED = 0x03,
2283	};	2283	};
2284		2284
2285	enum {	2285	enum {

Merge tag 'nvme-7.3-2026-08-13' of git://git.infradead.org/nvme into for-7.3/block

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code