GitHub/LineageOS/android_kernel_motorola_exynos9610.git
9 years agompt3sas: Bump mpt3sas Driver version to v5.100.00.00
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:53 +0000 (12:24 +0530)]
mpt3sas: Bump mpt3sas Driver version to v5.100.00.00

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: Provides the physical location of sas drives
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:52 +0000 (12:24 +0530)]
mpt3sas: Provides the physical location of sas drives

This Patch will provide more details of the devices such as slot number,
enclosure logical id, enclosure level & connector name in the following
scenarios,

- When end device is added in the topology,

- When the end device is removed from the setup,

- When the SCSI mid layer issues TASK ABORT/ DEVICE RESET/ TARGET RESET during
  error handling,

- When any command to the device fails with Sense key Hardware error or Medium
  error or Unit Attention,

- When firmware returns device error or device not ready status for the end
  device,

- When a Predicted fault is detected on an end device.

This information can be used by the user to identify the location of the
desired drive in the topology.

Driver will get these information by reading the sas device page0.

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: MPI 2.5 Rev I (2.5.4) specifications.
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:51 +0000 (12:24 +0530)]
mpt3sas: MPI 2.5 Rev I (2.5.4) specifications.

Update MPI 2.5 Release: MPI 2.5 Rev I (2.5.4) specification and 2.00.33 header
files

Below is the change set from the MPI specification for I Rev

1) Added Base Enclosure Level bit to the Flags field of Manufacturing Page 7.

2) Updated description of the MaxTargetPortConnectTime field of SAS IO Unit
   Page 1.

3) Added EnclosureLevel and ConnectorName fields to SAS Device Page 0. Also,
   added EnclosureLevel and ConnectorName Valid bit to the Flags field.

4) Added EnclosureLevel field to SAS Enclosure Page 0. Also, added
   EnclosureLevel Valid bit to the Flags field.

5) Added value for BIOS image to HashImageType.

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: Remove redundancy code while freeing the controller resources.
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:50 +0000 (12:24 +0530)]
mpt3sas: Remove redundancy code while freeing the controller resources.

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: Don't block the drive when drive addition under the control of SML
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:49 +0000 (12:24 +0530)]
mpt3sas: Don't block the drive when drive addition under the control of SML

During hot-plugging of a disk(having a flaky link), the disk addition
stops and any further disk addition or removal doesn't happen on that
controller.

This is because, when driver receives DELAY_NOT_RESPONDING event for a disk
while it is undergoing addition at the SCSI Transport layer, the driver
would block the I/O to that disk resulting in a deadlock. i.e the disk
addition work couldn't be completed at the SCSI Transport Layer as it
can't send any I/Os (such as Inquiry, Report LUNs etc) to the disk as
I/Os are blocked to this drive. Also any subsequent device removal
(TARGET_NOT_RESPONDING) or link update(RC_PHY_CHANGED) event couldn't be
processed as they are in the queue to get processed after disk addition
event.

Description of Change:
Don't block the drive when drive addition is under the control of SML.
So that SML won't be blocked of issuing the device dicovery commands
(such as Inquiry, Report LUNs etc).

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: Get IOC_FACTS information using handshake protocol only after HBA card gets...
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:48 +0000 (12:24 +0530)]
mpt3sas: Get IOC_FACTS information using handshake protocol only after HBA card gets into READY or Operational state.

Driver initialization fails if driver tries to send IOC facts request message
when the IOC is in reset or in a fault state.

This patch will make sure that

 1.Driver to send IOC facts request message only if HBA is in operational or
   ready state.

 2.If IOC is in fault state, a diagnostic reset would be issued.

 3.If IOC is in reset state then driver will wait for 10 seconds to exit out
   of reset state.  If the HBA continues to be in reset state, then the HBA
   wouldn't be claimed by the driver.

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt3sas: Added Combined Reply Queue feature to extend up-to 96 MSIX vector support
Sreekanth Reddy [Tue, 30 Jun 2015 06:54:47 +0000 (12:24 +0530)]
mpt3sas: Added Combined Reply Queue feature to extend up-to 96 MSIX vector support

In this patch, increased the number of MSIX vector support for SAS3 C0 HBAs to
up-to 96.

Following are changes that are done in this patch

1. This feature is enabled only for SAS3 C0 and higher revision cards and also
only when reply post free queue count is greater than 8.

2. To support this feature 12 SupplementalReplyPostHostIndex system interfaces
are used. MSI-X index numbered from 0 to 7 use the first
SupplementalReplyPostHostIndex system interface to update its corresponding
ReplyPostHostIndex values, MSI-X index numbered from 8 to 15 will use the
second SupplementalReplyPostHostIndex system interface and so on. These 12
SuppementalReplyPostHostIndex system interfaces address are saved in the array
replyPostRegisterIndex[].

3. As each SupplementalReplyPostHostIndex register supports 8 MSI-X
vectors. So MSIxIndex field in these register must contain a value between 0
and 7.

4. After processing the reply descriptors from a reply post free queues then
update the new reply post host index value in ReplyPostHostIndex field and
(msix_index mod 8) value in MSIxIndex field of SupplementalReplyPostHostIndex
register. The Address of this SupplementalReplyPostHostIndex register is
retrived from (msix_index/8)th entry of replyPostRegisterIndex[] array.

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoaic94xx: set an error code on failure
Dan Carpenter [Tue, 18 Aug 2015 09:20:29 +0000 (12:20 +0300)]
aic94xx: set an error code on failure

We recently did some cleanup here and now the static checkers notice
that there is a missing error code when ioremap() fails.  Let's set it
to -ENOMEM.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: Set the error code correctly in failure conditions
K. Y. Srinivasan [Thu, 13 Aug 2015 15:43:52 +0000 (08:43 -0700)]
storvsc: Set the error code correctly in failure conditions

In the function storvsc_channel_init(), error code was not getting
set correctly in some of the failure cases. Fix this issue.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: Allow write_same when host is windows 10
Keith Mange [Thu, 13 Aug 2015 15:43:51 +0000 (08:43 -0700)]
storvsc: Allow write_same when host is windows 10

Allow WRITE_SAME for Windows10 and above hosts.

Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: use storage protocol version to determine storage capabilities
Keith Mange [Thu, 13 Aug 2015 15:43:50 +0000 (08:43 -0700)]
storvsc: use storage protocol version to determine storage capabilities

Use storage protocol version instead of vmbus protocol
version when determining storage capabilities.

Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: use correct defaults for values determined by protocol negotiation
Keith Mange [Thu, 13 Aug 2015 15:43:49 +0000 (08:43 -0700)]
storvsc: use correct defaults for values determined by protocol negotiation

Use correct defaults for values determined by protocol negotiation,
instead of resetting them with every scsi controller.

Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: Untangle the storage protocol negotiation from the vmbus protocol negotiation.
Keith Mange [Thu, 13 Aug 2015 15:43:48 +0000 (08:43 -0700)]
storvsc: Untangle the storage protocol negotiation from the vmbus protocol negotiation.

Currently we are making decisions based on vmbus protocol versions
that have been negotiated; use storage potocol versions instead.

[jejb: fold ARRAY_SIZE conversion suggested by Johannes Thumshirn
<jthumshirn@suse.de>
make vmstor_protocol static]
Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: Use a single value to track protocol versions
Keith Mange [Thu, 13 Aug 2015 15:43:47 +0000 (08:43 -0700)]
storvsc: Use a single value to track protocol versions

Use a single value to track protocol versions to simplify
comparisons and to be consistent with vmbus version tracking.

Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: Rather than look for sets of specific protocol versions, make decisions...
Keith Mange [Thu, 13 Aug 2015 15:43:46 +0000 (08:43 -0700)]
storvsc: Rather than look for sets of specific protocol versions, make decisions based on ranges.

Rather than look for sets of specific protocol versions,
make decisions based on ranges. This will be safer and require fewer changes
going forward as we add more storage protocol versions.

Tested-by: Alex Ng <alexng@microsoft.com>
Signed-off-by: Keith Mange <keith.mange@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: Remove unused variable from queuecommand
Matthew R. Ochs [Wed, 26 Aug 2015 23:36:12 +0000 (18:36 -0500)]
cxlflash: Remove unused variable from queuecommand

The queuecommand routine has a local dev pointer used for the
dev_* prints. The two prints that currently exist are tucked
under a debug define and thus can be left out. Use the actual
location instead of a local to avoid this warning.

This patch is intended to be applied after the "CXL Flash Error
Recovery and Superpipe" series.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: shift wrapping bug in afu_link_reset()
Dan Carpenter [Tue, 18 Aug 2015 08:57:43 +0000 (11:57 +0300)]
cxlflash: shift wrapping bug in afu_link_reset()

"port_sel" is a u64 so the shifting should also be a 64 bit shift.

Fixes: c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: off by one bug in cxlflash_show_port_status()
Dan Carpenter [Fri, 14 Aug 2015 20:35:25 +0000 (23:35 +0300)]
cxlflash: off by one bug in cxlflash_show_port_status()

The > should be >= or we read one element past the end of the array.

Fixes: c21e0bbfc485 ('cxlflash: Base support for IBM CXL Flash Adapter')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: Virtual LUN support
Matthew R. Ochs [Fri, 14 Aug 2015 02:47:53 +0000 (21:47 -0500)]
cxlflash: Virtual LUN support

Add support for physical LUN segmentation (virtual LUNs) to device
driver supporting the IBM CXL Flash adapter. This patch allows user
space applications to virtually segment a physical LUN into N virtual
LUNs, taking advantage of the translation features provided by this
adapter.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reviewed-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: Superpipe support
Matthew R. Ochs [Fri, 14 Aug 2015 02:47:43 +0000 (21:47 -0500)]
cxlflash: Superpipe support

Add superpipe supporting infrastructure to device driver for the IBM CXL
Flash adapter. This patch allows userspace applications to take advantage
of the accelerated I/O features that this adapter provides and bypass the
traditional filesystem stack.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reviewed-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: Base error recovery support
Matthew R. Ochs [Fri, 14 Aug 2015 02:47:34 +0000 (21:47 -0500)]
cxlflash: Base error recovery support

Introduce support for enhanced I/O error handling.

A device state is added to track 3 possible states of the device:

Normal - the device is operating normally and is fully operational

Limbo - the device is in a reset/recovery scenario and its operational
        status is paused

Failed/terminating - the device has either failed to be reset/recovered
                     or is being terminated (removed); it is no longer
                     operational

All operations are allowed when the device is operating normally. When the
device transitions to limbo state, I/O must be paused. To help accomplish
this, a wait queue is introduced where existing and new threads can wait
until the device is no longer in limbo. When coming out of limbo, threads
need to check the state and error out gracefully when encountering the
failed state. When the device transitions to the failed/terminating state,
normal operations are no longer allowed. Only specially designated
operations related to graceful cleanup are permitted.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Update driver version to 8.07.00.26-k
Himanshu Madhani [Tue, 4 Aug 2015 17:38:04 +0000 (13:38 -0400)]
qla2xxx: Update driver version to 8.07.00.26-k

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Add pci device id 0x2261.
Sawan Chandak [Tue, 4 Aug 2015 17:38:03 +0000 (13:38 -0400)]
qla2xxx: Add pci device id 0x2261.

Signed-off-by: Sawan Chandak <sawan.chandak@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Fix missing device login retries.
Arun Easi [Tue, 4 Aug 2015 17:38:02 +0000 (13:38 -0400)]
qla2xxx: Fix missing device login retries.

On certain conditions, login failures will just invoke
qla2x00_mark_device_lost() with the intend to do login again;
but if login_retry has been set already, that would fail to set the
relogin needed flag which is required to wakeup the DPC to retry.

Signed-off-by: Arun Easi <arun.easi@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: do not clear slot in outstanding cmd array
Himanshu Madhani [Tue, 4 Aug 2015 17:38:01 +0000 (13:38 -0400)]
qla2xxx: do not clear slot in outstanding cmd array

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Remove decrement of sp reference count in abort handler.
Chad Dupuis [Tue, 4 Aug 2015 17:38:00 +0000 (13:38 -0400)]
qla2xxx: Remove decrement of sp reference count in abort handler.

Fix for memory leak when command is not found by firmware due to
mismatch in sp reference count.

Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Add support to show MPI and PEP FW version for ISP27xx.
Sawan Chandak [Tue, 4 Aug 2015 17:37:59 +0000 (13:37 -0400)]
qla2xxx: Add support to show MPI and PEP FW version for ISP27xx.

Signed-off-by: Sawan Chandak <sawan.chandak@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Do not reset ISP for error entry with an out of range handle.
Chad Dupuis [Tue, 4 Aug 2015 17:37:58 +0000 (13:37 -0400)]
qla2xxx: Do not reset ISP for error entry with an out of range handle.

Instead of resetting the adapter wait for the login to timeout
and retry. Resetting the adapter can cause extended path recovery
times.

Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Do not reset adapter if SRB handle is in range.
Chad Dupuis [Tue, 4 Aug 2015 17:37:57 +0000 (13:37 -0400)]
qla2xxx: Do not reset adapter if SRB handle is in range.

If an SRB is NULL but the handle is in range just drop the
command instead of also resetting the adapter. If the handle
is in range then the command was valid at some point and may
have been aborted. Resetting the adapter can lead to extended
recovery times in this case.

Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Do not crash system for sp ref count zero
Hiral Patel [Tue, 4 Aug 2015 17:37:56 +0000 (13:37 -0400)]
qla2xxx: Do not crash system for sp ref count zero

Aovid crashing the system in the scenario where firmware
just completes the command and it can not find the command
during abort mailbox processing. This scenario can lead to
sp reference counter being zero. Instead of crashing the
system, use WARN_ON to print warning in log file.

Signed-off-by: Hiral Patel <hiral.patel@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Add adapter checks for FAWWN functionality.
Saurav Kashyap [Tue, 4 Aug 2015 17:37:55 +0000 (13:37 -0400)]
qla2xxx: Add adapter checks for FAWWN functionality.

Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Pause risc before manipulating risc semaphore.
Joe Carnuccio [Tue, 4 Aug 2015 17:37:54 +0000 (13:37 -0400)]
qla2xxx: Pause risc before manipulating risc semaphore.

Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Use ssdid to gate semaphore manipulation.
Joe Carnuccio [Tue, 4 Aug 2015 17:37:53 +0000 (13:37 -0400)]
qla2xxx: Use ssdid to gate semaphore manipulation.

Execute qla25xx_manipulate_risc_semaphore() only for
ssdid 0x0175 and 0x0240.

Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Handle AEN8014 incoming port logout.
Joe Carnuccio [Tue, 4 Aug 2015 17:37:52 +0000 (13:37 -0400)]
qla2xxx: Handle AEN8014 incoming port logout.

When we get logged out, mark the port lost and set dpc flag for relogin.

Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Add serdes register read/write support for ISP25xx.
Joe Carnuccio [Tue, 4 Aug 2015 17:37:51 +0000 (13:37 -0400)]
qla2xxx: Add serdes register read/write support for ISP25xx.

Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoscsi_error: should not get sense for timeout IO in scsi error handler
jiang.biao2@zte.com.cn [Fri, 31 Jul 2015 09:52:10 +0000 (17:52 +0800)]
scsi_error: should not get sense for timeout IO in scsi error handler

scsi_error: should not get sense for timeout IO in scsi error handler

When an IO timeout occurs, the IO will be aborted in
scsi_abort_command() and SCSI_EH_ABORT_SCHEDULED will be set. Because
of that, the SCSI_EH_CANCEL_CMD will be clear in scsi_eh_scmd_add().
So when scsi error handler starts, it will get sense for this
timeout IO and the scmd of the IO request will be reused. In that
case, the scmd may be double released when racing with io_done(),
which will result in crash.
SO SCSI_EH_ABORT_SCHEDULED should also be checked when getting sense.
The bug maybe reproduced when the link between host and disk is
unstable.

Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn>
Signed-off-by: Long Chun <long.chun@zte.com.cn>
Reviewed-by: Tan Hu <tan.hu@zte.com.cn>
Reviewed-by: Chen Donghai <chen.donghai@zte.com.cn>
Reviewed-by: Cai Qu <cai.qu@zte.com.cn>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Bump pm80xx driver version to 0.1.38
Viswas G [Tue, 11 Aug 2015 09:36:32 +0000 (15:06 +0530)]
pm80xx: Bump pm80xx driver version to 0.1.38

Bump pm80xx driver version to 0.1.38.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Handling Invalid SSP Response frame
Viswas G [Tue, 11 Aug 2015 09:36:31 +0000 (15:06 +0530)]
pm80xx: Handling Invalid SSP Response frame

The request has to be retried incase if the length of the SSP
Response IU is invalid.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Add PORT RECOVERY TIMEOUT support
Viswas G [Tue, 11 Aug 2015 09:36:30 +0000 (15:06 +0530)]
pm80xx: Add PORT RECOVERY TIMEOUT support

PORT RECOVERY TIMEOUT is the maximum time between the controller's
detection of the PHY down until the receipt of the ID_Frame (from the
same remote SAS port). If the time expires before the ID_FRAME is
received, the port is considered INVALID and can be removed. The
IOP_EVENT_PORT_RECOVERY_TIMER_TMO event is reported following the
IOP_EVENT_ PHY_DOWN event when the PHY/port does not recover after
Port Recovery Time.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Remove unnecessary phy disconnect while link error
Viswas G [Tue, 11 Aug 2015 09:36:29 +0000 (15:06 +0530)]
pm80xx: Remove unnecessary phy disconnect while link error

If the link error happens, we don't need to disconnect the phy,
which will remove the drive. Instead acknowledging the controller
and logging the error will be enough.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Fix for Incorrect DMA Unmapping of SG List
Viswas G [Tue, 11 Aug 2015 09:36:28 +0000 (15:06 +0530)]
pm80xx: Fix for Incorrect DMA Unmapping of SG List

In pm8001_ccb_task_free(), the dma unmapping is done based on
ccb->n_elem value. This should be initialized to zero in the
task_abort(). Otherwise, pm8001_ccb_task_free() will try for
dma_unmap_sg() which is invalid for task abort and can lead to
kernel crash.

Changes From V1:
None

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Update For Thermal Page Code
Viswas G [Tue, 11 Aug 2015 09:36:27 +0000 (15:06 +0530)]
pm80xx: Update For Thermal Page Code

Thermal page code has been changed to 7 for the 12G controllers.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Corrected device state changes in I_T_Nexus_Reset.
Viswas G [Tue, 11 Aug 2015 09:36:26 +0000 (15:06 +0530)]
pm80xx: Corrected device state changes in I_T_Nexus_Reset.

In Nexus reset the device state request are not needed.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Updated link rate
Viswas G [Tue, 11 Aug 2015 09:36:25 +0000 (15:06 +0530)]
pm80xx: Updated link rate

Updated 12G linkrate to libsas.

Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Reviewed-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoMAINTAINERS: update email for pm8001
Jack Wang [Wed, 29 Jul 2015 10:02:50 +0000 (12:02 +0200)]
MAINTAINERS: update email for pm8001

Company has policy to use company email address, so update
my email address to company address.

Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agolpfc: Use && instead of & for boolean expression
Sebastian Herbszt [Wed, 22 Jul 2015 08:53:22 +0000 (10:53 +0200)]
lpfc: Use && instead of & for boolean expression

Use logical instead of bitwise AND.

Signed-off-by: Sebastian Herbszt <herbszt@gmx.de>
Reviewed-by: James Smart <james.smart@avagotech.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Return the fabric command state for non-task management requests
Dilip Kumar Uppugandla [Tue, 21 Jul 2015 22:07:55 +0000 (15:07 -0700)]
qla2xxx: Return the fabric command state for non-task management requests

Invoking get_cmd_state for qla2xxx always returns 0. Instead change it
to return the actual fabric state from qla_tgt_cmd. This will help with
debugging.

Signed-off-by: Dilip Kumar Uppugandla <dilip@purestorage.com>
Signed-off-by: Spencer Baugh <sbaugh@catern.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: fix rmmod issues
Don Brace [Sat, 18 Jul 2015 16:13:15 +0000 (11:13 -0500)]
hpsa: fix rmmod issues

The driver is calling hpsa_shutdown before calling scsi_remove_host.
hpsa_shutdown is disabling interrupts.

scsi_remove_host can trigger I/O operations, such as
SYNCHRONIZE CACHE when multipath is enabled which hang the system.

Call scsi_remove_host before calling hpsa_shutdown.

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: fix issues with multilun devices
shane.seymour [Sat, 18 Jul 2015 16:13:09 +0000 (11:13 -0500)]
hpsa: fix issues with multilun devices

A regression was introduced into the hpsa driver a while back so
non-zero LUNs of multi-LUN devices may no longer be presented via
a SAS based Smart Array. I have not done a bisection to discover
the change that caused it.

The CISS firmware specification (available on sourceforge)
defines an 8 byte lunid that describes devices that the Smart
Array can see/present to the system. The current code in the hpsa
driver attempts to find matches for non-zero LUNs with LUN 0 for
a bus/target by zeroing out byte 4 of the lunid and find a match.

This method is sufficient for SCSI based Smart Arrays because
byte 5 is always 0. For SAS based Smart arrays byte 5 of the
lunid contains the path number for a multipath device and
either one or two bits (the documentation does not define how
many bits are used but it appears it may be one only) that
indicate if the given path number in byte 5 must always be
used to access that device. Byte 5 may not always be zero.

The following are lunids (spaces added for clarity) for a
MSL2024 single drive library connected via a H241 Smart Array:

00 00 00 00 01 00 00 01 (changer)
00 00 00 00 00 80 00 01 (tape)

In the 4th byte (counting from 0) you can see that the tape
is LUN 0 and the changer is LUN 1. The 0x80 set in the 5th byte
for the tape drive means the driver should force access to
path 0 (the library in this case was connected to one path only
anyway).

After the changes we can see the following in the dmesg output:

scsi 0:3:0:0: RAID              HP       H241             1.18 \
PQ: 0 ANSI: 5
scsi 0:2:0:0: Sequential-Access HP       Ultrium 6-SCSI   354W \
PQ: 0 ANSI: 6
scsi 0:2:0:1: Medium Changer    HP       MSL G3 Series    8.70 \
PQ: 0 ANSI: 5

Showing that the changer is correctly identified as LUN 1 of
bus 2 target 0. Before the change the changer device is not seen.

Suggested-by: shane.seymour <shane.seymour@hp.com>
Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: add in new offline mode
Scott Benesh [Sat, 18 Jul 2015 16:13:04 +0000 (11:13 -0500)]
hpsa: add in new offline mode

prevent adding volumes that are not available.

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Justin Lindley <justin.lindley@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoChange how controllers in mixed mode are handled.
Kevin Barnett [Sat, 18 Jul 2015 16:12:59 +0000 (11:12 -0500)]
Change how controllers in mixed mode are handled.

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: add in new controllers
Don Brace [Sat, 18 Jul 2015 16:12:54 +0000 (11:12 -0500)]
hpsa: add in new controllers

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: cleanup update scsi devices
Don Brace [Sat, 18 Jul 2015 16:12:49 +0000 (11:12 -0500)]
hpsa: cleanup update scsi devices

showing that tables have been updated unnecessarily.

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: add sysfs entry path_info to show box and bay information
Joe Handzik [Sat, 18 Jul 2015 16:12:43 +0000 (11:12 -0500)]
hpsa: add sysfs entry path_info to show box and bay information

host no, bus, target, lun, scsi_device_type
for hba mode add: box and bay information

report if the path is active/inactive

Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: add PMC to copyright
Don Brace [Sat, 18 Jul 2015 16:12:38 +0000 (11:12 -0500)]
hpsa: add PMC to copyright

need to add PMC to copyright notice and update the Hewlett-Packard
copyright notification.

Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Justin Lindley <justin.lindley@pmcs.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: correct static checker warnings on driver init cleanup
Don Brace [Sat, 18 Jul 2015 16:12:33 +0000 (11:12 -0500)]
hpsa: correct static checker warnings on driver init cleanup

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: correct decode sense data
Don Brace [Sat, 18 Jul 2015 16:12:28 +0000 (11:12 -0500)]
hpsa: correct decode sense data

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: Correct double unlock of mutex
Don Brace [Sat, 18 Jul 2015 16:12:22 +0000 (11:12 -0500)]
hpsa: Correct double unlock of mutex

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Scott Teel <scott.teel@pmcs.com>
Reviewed-by: Kevin Barnett <kevin.barnett@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agompt2sas, mpt3sas: Abort initialization if no memory I/O resources detected
Sreekanth Reddy [Wed, 15 Jul 2015 04:49:56 +0000 (10:19 +0530)]
mpt2sas, mpt3sas: Abort initialization if no memory I/O resources detected

Driver crashes if the BIOS do not set up at least one
memory I/O resource. This failure can happen if the device is too
slow to respond during POST and is missed by the BIOS, but Linux
then detects the device later in the boot process.

Based on a patch from Timothy Pearson <tpearson@raptorengineeringinc.com>

Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@avagotech.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Avoid that sparse complains about context imbalances
Bart Van Assche [Thu, 9 Jul 2015 14:25:46 +0000 (07:25 -0700)]
qla2xxx: Avoid that sparse complains about context imbalances

Surround conditional locking statements with "#ifndef __CHECKER__" /
"#endif" to hide these for the sparse static source code analysis
tool.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Remove dead code
Bart Van Assche [Thu, 9 Jul 2015 14:25:25 +0000 (07:25 -0700)]
qla2xxx: Remove dead code

The "return QLA_SUCCESS" statement just above the "fw_load_failed"
label cannot be reached, hence remove it. Additionally remove the
"else" keyword since the code block below the if-statement ends
with a return statement.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Remove a superfluous test
Bart Van Assche [Thu, 9 Jul 2015 14:25:07 +0000 (07:25 -0700)]
qla2xxx: Remove a superfluous test

Avoid that smatch reports the following warning:

drivers/scsi/qla2xxx/qla_attr.c:1081: qla2x00_model_desc_show() warn: this array is probably non-NULL. 'vha->hw->model_desc'

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Fix sparse annotations
Bart Van Assche [Thu, 9 Jul 2015 14:24:50 +0000 (07:24 -0700)]
qla2xxx: Fix sparse annotations

This patch removes 21 casts between an __iomem pointer type and
another data type but also introduces five new casts (see also
the casts with "__force"). Although this patch does not change
any functionality, IMHO the code with __force casts needs further
review.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Avoid that sparse complains about duplicate [noderef] attributes
Bart Van Assche [Thu, 9 Jul 2015 14:24:27 +0000 (07:24 -0700)]
qla2xxx: Avoid that sparse complains about duplicate [noderef] attributes

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Remove __constant_ prefix
Bart Van Assche [Thu, 9 Jul 2015 14:24:08 +0000 (07:24 -0700)]
qla2xxx: Remove __constant_ prefix

Whether htonl() or __constant_htonl() is used, if the argument
is a constant the conversion happens at compile time. Hence leave
out the __constant_ prefix for this and other endianness
conversion functions. This improves source code readability.

[jejb: checkpatch fixes]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Replace two macros with an inline function
Bart Van Assche [Thu, 9 Jul 2015 14:23:46 +0000 (07:23 -0700)]
qla2xxx: Replace two macros with an inline function

Replace the QLA82XX_ADDR_IN_RANGE() and QLA8044_ADDR_IN_RANGE() macros
with the inline function addr_in_range(). This avoids that the compiler
reports the following warning when building with W=1: comparison of
unsigned expression >= 0 is always true.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Remove set-but-not-used variables
Bart Van Assche [Thu, 9 Jul 2015 14:23:26 +0000 (07:23 -0700)]
qla2xxx: Remove set-but-not-used variables

Detected these variables by building with W=1.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Declare local functions static
Bart Van Assche [Thu, 9 Jul 2015 14:23:02 +0000 (07:23 -0700)]
qla2xxx: Declare local functions static

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: Report both rsp_info and rsp_info_len
Bart Van Assche [Thu, 9 Jul 2015 14:22:38 +0000 (07:22 -0700)]
qla2xxx: Report both rsp_info and rsp_info_len

Let the debug statement in qlafx00_tm_iocb_entry() report both rsp_info
and rsp_info_len instead of reporting rsp_info_len twice.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agost: Destroy st_index_idr on module exit
Johannes Thumshirn [Wed, 8 Jul 2015 15:24:01 +0000 (17:24 +0200)]
st: Destroy st_index_idr on module exit

Destroy st_index_idr on module exit, reclaiming the allocated memory.

This was detected by the following semantic patch (written by Luis Rodriguez
<mcgrof@suse.com>)
<SmPL>
@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@

module_init(init);

@ defines_module_exit @
identifier exit;
@@

module_exit(exit);

@ declares_idr depends on defines_module_init && defines_module_exit @
identifier idr;
@@

DEFINE_IDR(idr);

@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 idr_destroy(&idr);
 ...
}

@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 +idr_destroy(&idr);
}
</SmPL>

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agomegaraid_sas: fix whitespace errors
Bjorn Helgaas [Tue, 7 Jul 2015 20:52:45 +0000 (15:52 -0500)]
megaraid_sas: fix whitespace errors

Fix whitespace and indentation errors.  No code change.

[jejb: checkpatch fixes]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Sumit Saxena <sumit.saxena@avagotech.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agomegaraid_sas: use dev_printk when possible
Bjorn Helgaas [Tue, 7 Jul 2015 20:52:34 +0000 (15:52 -0500)]
megaraid_sas: use dev_printk when possible

Use dev_printk() when possible to make messages more useful.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Sumit Saxena <sumit.saxena@avagotech.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agomegaraid : use dev_printk when possible
Bjorn Helgaas [Tue, 7 Jul 2015 20:52:25 +0000 (15:52 -0500)]
megaraid : use dev_printk when possible

Use dev_printk() when possible to make messages more useful.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Acked-by: Sumit Saxena <sumit.saxena@avagotech.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoscsi: Add ALUA state change UA handling
Hannes Reinecke [Mon, 6 Jul 2015 11:41:53 +0000 (13:41 +0200)]
scsi: Add ALUA state change UA handling

Log the ALUA state change unit attention correctly with
the message log and emit an event to allow user-space
tools to react to it.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agomptfusion: prevent some memory corruption
Dan Carpenter [Fri, 3 Jul 2015 08:53:03 +0000 (11:53 +0300)]
mptfusion: prevent some memory corruption

These are signed values the come from the user, we put a cap on the
upper bounds but not on the lower bounds.

We use "karg.dataSgeOffset" to calculate "sz".  We verify "sz" and
proceed as if that means that "karg.dataSgeOffset" is correct but this
fails to consider that the "sz" calculations can have integer overflows.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: use shost_for_each_device() instead of open coding
Vitaly Kuznetsov [Wed, 1 Jul 2015 09:31:27 +0000 (11:31 +0200)]
storvsc: use shost_for_each_device() instead of open coding

Comment in struct Scsi_Host says that drivers are not supposed to access
__devices directly. storvsc_host_scan() doesn't happen in irq context
so we can just use shost_for_each_device().

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Long Li <longli@microsoft.com>
Acked-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agostorvsc: be more picky about scmnd->sc_data_direction
Vitaly Kuznetsov [Thu, 25 Jun 2015 16:12:11 +0000 (18:12 +0200)]
storvsc: be more picky about scmnd->sc_data_direction

Under the 'default' case in scmnd->sc_data_direction we have 3 options:
- DMA_NONE which we handle correctly.
- DMA_BIDIRECTIONAL which is never supposed to be set by SCSI stack.
- Garbage value.

Do WARN() and return -EINVAL in the last two cases. virtio_scsi does
BUG_ON() here but it looks like an overkill.

Reported-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agost: convert DRIVER_ATTR macros to DRIVER_ATTR_RO
Seymour, Shane M [Wed, 24 Jun 2015 06:54:35 +0000 (06:54 +0000)]
st: convert DRIVER_ATTR macros to DRIVER_ATTR_RO

Convert DRIVER_ATTR macros to DRIVER_ATTR_RO requested by
Greg KH. Also switched to using scnprintf instead of snprintf
per Documentation/filesystems/sysfs.txt.

Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Shane Seymour <shane.seymour@hp.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer
linux [Fri, 31 Jul 2015 03:25:55 +0000 (11:25 +0800)]
hptiop: Support HighPoint RR36xx HBAs and Support SAS tape and SAS media changer

Support HighPoint RR36xx HBAs which are based on Marvell Frey.
Support SAS tape and SAS media changer.

[jejb: remove now unused label]
Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agost: convert to using driver attr groups for sysfs
Seymour, Shane M [Tue, 23 Jun 2015 08:11:00 +0000 (08:11 +0000)]
st: convert to using driver attr groups for sysfs

This patch changes the st driver to use attribute groups so
driver sysfs files are created automatically. See the
following for reference:

http://kroah.com/log/blog/2013/06/26/how-to-create-a-sysfs-file-correctly/

Signed-off-by: Shane Seymour <shane.seymour@hp.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agobfa: fix leak of bfad_im_port_index on module unload
Alexey Khoroshilov [Thu, 11 Jun 2015 22:50:45 +0000 (01:50 +0300)]
bfa: fix leak of bfad_im_port_index on module unload

Resources allocated within bfad_im_port_index idr are not deallocated
on module unload. The patch adds idr_destroy() in exit function.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agolibfc: Fix a typo in a source code comment
Bart Van Assche [Fri, 5 Jun 2015 21:20:40 +0000 (14:20 -0700)]
libfc: Fix a typo in a source code comment

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agomvsas: always iounmap resources
Johannes Thumshirn [Fri, 22 May 2015 09:15:02 +0000 (11:15 +0200)]
mvsas: always iounmap resources

In case pci_resource_start() or pci_resource_len() reutrn 0, mvsas_ioremap
returns without doing an iounmap() of mvi->regs_ex.

Found by the cocinelle tool.

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoqla2xxx: prevent board_disable from running during EEH
Thadeu Lima de Souza Cascardo [Thu, 30 Apr 2015 12:13:05 +0000 (09:13 -0300)]
qla2xxx: prevent board_disable from running during EEH

Commit f3ddac1918fe963bcbf8d407a3a3c0881b47248b ("[SCSI] qla2xxx:
Disable adapter when we encounter a PCI disconnect.") has introduced a
code that disables the board, releasing some resources, when reading
0xffffffff.

In case this happens when there is an EEH, this read will trigger EEH
detection and set PCI channel offline. EEH will be able to recover the
card from this state by doing a reset, so it's a better option than
simply disabling the card.

Since eeh_check_failure will mark the channel as offline before
returning the read value, in case there really was an EEH, we can simply
check for pci_channel_offline, preventing the board_disable code from
running if it's true.

Without this patch, EEH code will try to access those same resources
that board_disable will try to free. This race can cause EEH recovery to
fail.

[  504.370577] EEH: Notify device driver to resume
[  504.370580] qla2xxx [0001:07:00.0]-9002:2: The device failed to resume I/O from slot/link_reset.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agopm80xx: Added pm8006 controller support
Suresh Thiagarajan [Thu, 12 Feb 2015 06:34:37 +0000 (12:04 +0530)]
pm80xx: Added pm8006 controller support

Signed-off-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Acked-by: Jack Wang <xjtuwjp@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agocxlflash: Base support for IBM CXL Flash Adapter
Matthew R. Ochs [Tue, 9 Jun 2015 22:15:52 +0000 (17:15 -0500)]
cxlflash: Base support for IBM CXL Flash Adapter

SCSI device driver to support filesystem access on the IBM CXL Flash adapter.

Supported-by: Stephen Bates <stephen.bates@pmcs.com>
Reviewed-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agohpsa: fix an sprintf() overflow in the reset handler
Dan Carpenter [Thu, 4 Jun 2015 14:47:56 +0000 (17:47 +0300)]
hpsa: fix an sprintf() overflow in the reset handler

The string "cmd %d RESET FAILED, new lockup detected" is not quite
large enough so the sprintf() will overflow.  I have increased the size
of the buffer and also changed the sprintf calls to snprintf.

Fixes: 73153fe533bc ('hpsa: use block layer tag for command allocation')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Don Brace <don.brace@pmcs.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoiSCSI: let session recovery_tmo sysfs writes persist across recovery
Chris Leech [Tue, 16 Jun 2015 23:07:13 +0000 (16:07 -0700)]
iSCSI: let session recovery_tmo sysfs writes persist across recovery

The iSCSI session recovery_tmo setting is writeable in sysfs, but it's
also set every time a connection is established when parameters are set
from iscsid over netlink.  That results in the timeout being reset to
the default value after every recovery.

The DM multipath tools want to use the sysfs interface to lower the
default timeout when there are multiple paths to fail over.  It has
caused confusion that we have a writeable sysfs value that seem to keep
resetting itself.

This patch adds an in-kernel flag that gets set once a sysfs write
occurs, and then ignores netlink parameter setting once it's been
modified via the sysfs interface.  My thinking here is that the sysfs
interface is much simpler for external tools to influence the session
timeout, but if we're going to allow it to be modified directly we
should ensure that setting is maintained.

Signed-off-by: Chris Leech <cleech@redhat.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Driver version 2.6.2
Brian King [Fri, 12 Jun 2015 01:45:22 +0000 (20:45 -0500)]
ipr: Driver version 2.6.2

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Endian / sparse fixes
Brian King [Fri, 12 Jun 2015 01:45:20 +0000 (20:45 -0500)]
ipr: Endian / sparse fixes

Some misc fixes for endianness checking with sparse so sparse with
endian checking now runs clean. Fixes a minor bug in the process
which was uncovered by sparse which would result in unnecessary
error recovery for check conditions.

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Byte swapping for device_id attribute in sysfs
Wen Xiong [Fri, 12 Jun 2015 01:45:18 +0000 (20:45 -0500)]
ipr: Byte swapping for device_id attribute in sysfs

On LE system, users see the wrong device_id attribute. This patch
does necessary byte swapping for device_id attribute and works on
both of LE and BE systems.

Signed-off-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoscsi: retry MODE SENSE on unit attention
Hannes Reinecke [Fri, 12 Jun 2015 14:12:48 +0000 (16:12 +0200)]
scsi: retry MODE SENSE on unit attention

The 'sd' driver is calling scsi_mode_sense() to figure out
internal details. But scsi_mode_sense() never checks for
any pending unit attentions, so we're getting annoying error
messages like:

MODE SENSE: unimplemented page/subpage: 0x00/0x00

and a possible wrong decision for device cache handling.

Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoscsi: fix memory leak with scsi-mq
Tony Battersby [Thu, 16 Jul 2015 15:40:41 +0000 (11:40 -0400)]
scsi: fix memory leak with scsi-mq

Fix a memory leak with scsi-mq triggered by commands with large data
transfer length.

__sg_alloc_table() sets both table->nents and table->orig_nents to the
same value.  When the scatterlist is DMA-mapped, table->nents is
overwritten with the (possibly smaller) size of the DMA-mapped
scatterlist, while table->orig_nents retains the original size of the
allocated scatterlist.  scsi_free_sgtable() should therefore check
orig_nents instead of nents, and all code that initializes sdb->table
without calling __sg_alloc_table() should set both nents and orig_nents.

Fixes: d285203cf647 ("scsi: add support for a blk-mq based I/O path.")
Cc: <stable@vger.kernel.org> # 3.17+
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Fix invalid array indexing for HRRQ
Brian King [Tue, 14 Jul 2015 16:41:33 +0000 (11:41 -0500)]
ipr: Fix invalid array indexing for HRRQ

Fixes another signed / unsigned array indexing bug in the ipr driver.
Currently, when hrrq_index wraps, it becomes a negative number. We
do the modulo, but still have a negative number, so we end up indexing
backwards in the array. Given where the hrrq array is located in memory,
we probably won't actually reference memory we don't own, but nonetheless
ipr is still looking at data within struct ipr_ioa_cfg and interpreting it as
struct ipr_hrr_queue data, so bad things could certainly happen.

Each ipr adapter has anywhere from 1 to 16 HRRQs. By default, we use 2 on new
adapters.  Let's take an example:

Assume ioa_cfg->hrrq_index=0x7fffffffe and ioa_cfg->hrrq_num=4:

The atomic_add_return will then return -1. We mod this with 3 and get -2, add
one and get -1 for an array index.

On adapters which support more than a single HRRQ, we dedicate HRRQ to adapter
initialization and error interrupts so that we can optimize the other queues
for fast path I/O. So all normal I/O uses HRRQ 1-15. So we want to spread the
I/O requests across those HRRQs.

With the default module parameter settings, this bug won't hit, only when
someone sets the ipr.number_of_msix parameter to a value larger than 3 is when
bad things start to happen.

Cc: <stable@vger.kernel.org>
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Fix incorrect trace indexing
Brian King [Tue, 14 Jul 2015 16:41:31 +0000 (11:41 -0500)]
ipr: Fix incorrect trace indexing

When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not belong to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.

Cc: <stable@vger.kernel.org>
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoipr: Fix locking for unit attention handling
Brian King [Tue, 14 Jul 2015 16:41:29 +0000 (11:41 -0500)]
ipr: Fix locking for unit attention handling

Make sure we have the host lock held when calling scsi_report_bus_reset. Fixes
a crash seen as the __devices list in the scsi host was changing as we were
iterating through it.

Cc: <stable@vger.kernel.org>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoscsi: fix host max depth checking for the 'queue_depth' sysfs interface
Jens Axboe [Mon, 13 Jul 2015 14:24:39 +0000 (08:24 -0600)]
scsi: fix host max depth checking for the 'queue_depth' sysfs interface

Commit 1e6f2416044c0 changed the scsi sysfs 'queue_depth' code to
rejects depths higher than the scsi host template setting. But lots
of hosts set this to 1, and update the settings in the scsi host
when the controller/devices probing happens.

This breaks (at least) mpt2sas and mpt3sas runtime setting of queue
depth, returning EINVAL for all settings but '1'. And once it's set to
1, there's no way to go back up.

Cc: stable@vger.kernel.org
Fixes: 1e6f2416044c0 "scsi: don't allow setting of queue_depth bigger than can_queue"
Signed-off-by: Jens Axboe <axboe@fb.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agost: null pointer dereference panic caused by use after kref_put by st_open
Seymour, Shane M [Thu, 2 Jul 2015 12:01:10 +0000 (12:01 +0000)]
st: null pointer dereference panic caused by use after kref_put by st_open

Two SLES11 SP3 servers encountered similar crashes simultaneously
following some kind of SAN/tape target issue:

...
qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 --  1 2002.
qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 --  1 2002.
qla2xxx [0000:81:00.0]-8009:3: DEVICE RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-800f:3: DEVICE RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-8009:3: TARGET RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-800f:3: TARGET RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0.
qla2xxx [0000:81:00.0]-8012:3: BUS RESET ISSUED nexus=3:0:2.
qla2xxx [0000:81:00.0]-802b:3: BUS RESET SUCCEEDED nexus=3:0:2.
qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).
qla2xxx [0000:81:00.0]-8018:3: ADAPTER RESET ISSUED nexus=3:0:2.
qla2xxx [0000:81:00.0]-00af:3: Performing ISP error recovery - ha=ffff88bf04d18000.
 rport-3:0-0: blocked FC remote port time out: removing target and saving binding
qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).
qla2xxx [0000:81:00.0]-8017:3: ADAPTER RESET SUCCEEDED nexus=3:0:2.
 rport-2:0-0: blocked FC remote port time out: removing target and saving binding
sg_rq_end_io: device detached
BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8
IP: [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90
PGD 7e6586f067 PUD 7e5af06067 PMD 0 [1739975.390354] Oops: 0002 [#1] SMP
CPU 0
...
Supported: No, Proprietary modules are loaded [1739975.390463]
Pid: 27965, comm: ABCD Tainted: PF           X 3.0.101-0.29-default #1 HP ProLiant DL580 Gen8
RIP: 0010:[<ffffffff8133b268>]  [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90
RSP: 0018:ffff8839dc1e7c68  EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff883f0592fc00 RCX: 0000000000000090
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000138
RBP: 0000000000000138 R08: 0000000000000010 R09: ffffffff81bd39d0
R10: 00000000000009c0 R11: ffffffff81025790 R12: 0000000000000001
R13: ffff883022212b80 R14: 0000000000000004 R15: ffff883022212b80
FS:  00007f8e54560720(0000) GS:ffff88407f800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000000000002a8 CR3: 0000007e6ced6000 CR4: 00000000001407f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ABCD (pid: 27965, threadinfo ffff8839dc1e6000, task ffff883592e0c640)
Stack:
 ffff883f0592fc00 00000000fffffffa 0000000000000001 ffff883022212b80
 ffff883eff772400 ffffffffa03fa309 0000000000000000 0000000000000000
 ffffffffa04003a0 ffff883f063196c0 ffff887f0379a930 ffffffff8115ea1e
Call Trace:
 [<ffffffffa03fa309>] st_open+0x129/0x240 [st]
 [<ffffffff8115ea1e>] chrdev_open+0x13e/0x200
 [<ffffffff811588a8>] __dentry_open+0x198/0x310
 [<ffffffff81167d74>] do_last+0x1f4/0x800
 [<ffffffff81168fe9>] path_openat+0xd9/0x420
 [<ffffffff8116946c>] do_filp_open+0x4c/0xc0
 [<ffffffff8115a00f>] do_sys_open+0x17f/0x250
 [<ffffffff81468d92>] system_call_fastpath+0x16/0x1b
 [<00007f8e4f617fd0>] 0x7f8e4f617fcf
Code: eb d3 90 48 83 ec 28 40 f6 c6 04 48 89 6c 24 08 4c 89 74 24 20 48 89 fd 48 89 1c 24 4c 89 64 24 10 41 89 f6 4c 89 6c 24 18 74 11 <f0> ff 8f 70 01 00 00 0f 94 c0 45 31 ed 84 c0 74 2b 4c 8d a5 a0
RIP  [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90
 RSP <ffff8839dc1e7c68>
CR2: 00000000000002a8

Analysis reveals the cause of the crash to be due to STp->device
being NULL. The pointer was NULLed via scsi_tape_put(STp) when it
calls scsi_tape_release(). In st_open() we jump to err_out after
scsi_block_when_processing_errors() completes and returns the
device as offline (sdev_state was SDEV_DEL):

1180 /* Open the device. Needs to take the BKL only because of incrementing the SCSI host
1181    module count. */
1182 static int st_open(struct inode *inode, struct file *filp)
1183 {
1184         int i, retval = (-EIO);
1185         int resumed = 0;
1186         struct scsi_tape *STp;
1187         struct st_partstat *STps;
1188         int dev = TAPE_NR(inode);
1189         char *name;
...
1217         if (scsi_autopm_get_device(STp->device) < 0) {
1218                 retval = -EIO;
1219                 goto err_out;
1220         }
1221         resumed = 1;
1222         if (!scsi_block_when_processing_errors(STp->device)) {
1223                 retval = (-ENXIO);
1224                 goto err_out;
1225         }
...
1264  err_out:
1265         normalize_buffer(STp->buffer);
1266         spin_lock(&st_use_lock);
1267         STp->in_use = 0;
1268         spin_unlock(&st_use_lock);
1269         scsi_tape_put(STp); <-- STp->device = 0 after this
1270         if (resumed)
1271                 scsi_autopm_put_device(STp->device);
1272         return retval;

The ref count for the struct scsi_tape had already been reduced
to 1 when the .remove method of the st module had been called.
The kref_put() in scsi_tape_put() caused scsi_tape_release()
to be called:

0266 static void scsi_tape_put(struct scsi_tape *STp)
0267 {
0268         struct scsi_device *sdev = STp->device;
0269
0270         mutex_lock(&st_ref_mutex);
0271         kref_put(&STp->kref, scsi_tape_release); <-- calls this
0272         scsi_device_put(sdev);
0273         mutex_unlock(&st_ref_mutex);
0274 }

In scsi_tape_release() the struct scsi_device in the struct
scsi_tape gets set to NULL:

4273 static void scsi_tape_release(struct kref *kref)
4274 {
4275         struct scsi_tape *tpnt = to_scsi_tape(kref);
4276         struct gendisk *disk = tpnt->disk;
4277
4278         tpnt->device = NULL; <<<---- where the dev is nulled
4279
4280         if (tpnt->buffer) {
4281                 normalize_buffer(tpnt->buffer);
4282                 kfree(tpnt->buffer->reserved_pages);
4283                 kfree(tpnt->buffer);
4284         }
4285
4286         disk->private_data = NULL;
4287         put_disk(disk);
4288         kfree(tpnt);
4289         return;
4290 }

Although the problem was reported on SLES11.3 the problem appears
in linux-next as well.

The crash is fixed by reordering the code so we no longer access
the struct scsi_tape after the kref_put() is done on it in st_open().

Signed-off-by: Shane Seymour <shane.seymour@hp.com>
Signed-off-by: Darren Lavender <darren.lavender@hp.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.com>
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <JBottomley@Odin.com>
9 years agoLinux 4.2-rc2
Linus Torvalds [Sun, 12 Jul 2015 22:10:30 +0000 (15:10 -0700)]
Linux 4.2-rc2

9 years agoRevert "drm/i915: Use crtc_state->active in primary check_plane func"
Linus Torvalds [Sun, 12 Jul 2015 22:00:20 +0000 (15:00 -0700)]
Revert "drm/i915: Use crtc_state->active in primary check_plane func"

This reverts commit dec4f799d0a4c9edae20512fa60b0a36f3299ca2.

Jörg Otte reports a NULL pointder dereference due to this commit, as
'crtc_state' very much can be NULL:

        crtc_state = state->base.state ?
                intel_atomic_get_crtc_state(state->base.state, intel_crtc) : NULL;

So the change to test 'crtc_state->base.active' cannot possibly be
correct as-is.

There may be some other minimal fix (like just checking crtc_state for
NULL), but I'm just reverting it now for the rc2 release, and people
like Daniel Vetter who actually know this code will figure out what the
right solution is in the longer term.

Reported-and-bisected-by: Jörg Otte <jrg.otte@gmail.com>
Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
CC: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>