12 Aug, 2013

1 commit

  • Pull SCSI fixes from James Bottomley:
    "This is three bug fixes: An fnic warning caused by sleeping under a
    lock, a major regression with our updated WRITE SAME/UNMAP logic which
    caused tons of USB devices (and one RAID card) to cease to function
    and a megaraid_sas firmware initialisation problem which causes kdump
    failures"

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
    [SCSI] Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
    [SCSI] fnic: BUG: sleeping function called from invalid context during probe
    [SCSI] megaraid_sas: megaraid_sas driver init fails in kdump kernel

    Linus Torvalds
     

09 Aug, 2013

1 commit

  • Pull virtio fixes from Rusty Russell:
    "More virtio console fixes than I'm happy with, but all real issues,
    and all CC:stable.."

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
    virtio-scsi: Fix virtqueue affinity setup
    virtio: console: return -ENODEV on all read operations after unplug
    virtio: console: fix raising SIGIO after port unplug
    virtio: console: clean up port data immediately at time of unplug
    virtio: console: fix race in port_fops_open() and port unplug
    virtio: console: fix race with port unplug and open/close
    virtio/console: Add pipe_lock/unlock for splice_write
    virtio/console: Quit from splice_write if pipe->nrbufs is 0

    Linus Torvalds
     

03 Aug, 2013

3 commits

  • If a device has the skip_vpd_pages flag set we should simply fail the
    scsi_get_vpd_page() call.

    Signed-off-by: Martin K. Petersen
    Acked-by: Alan Stern
    Tested-by: Stuart Foster
    Cc: stable@vger.kernel.org
    Signed-off-by: James Bottomley

    Martin K. Petersen
     
  • I hit this during driver probe with the latest fnic updates (this trace
    is from a backport into a distro kernel, but the issue is the same).

    > BUG: sleeping function called from invalid context at mm/slab.c:3113
    > in_atomic(): 0, irqs_disabled(): 1, pid: 610, name: work_for_cpu
    > INFO: lockdep is turned off.
    > irq event stamp: 0
    > hardirqs last enabled at (0): [] (null)
    > hardirqs last disabled at (0): []
    > copy_process+0x5e5/0x1670
    > softirqs last enabled at (0): []
    > copy_process+0x5e5/0x1670
    > softirqs last disabled at (0): [] (null)
    > Pid: 610, comm: work_for_cpu Not tainted
    > Call Trace:
    > [] ? print_irqtrace_events+0xd0/0xe0
    > [] ? __might_sleep+0xf7/0x130
    > [] ? kmem_cache_alloc_trace+0x20b/0x2d0
    > [] ? __create_workqueue_key+0x3e/0x1d0
    > [] ? __create_workqueue_key+0x3e/0x1d0
    > [] ? fnic_probe+0x977/0x11aa [fnic]
    > [] ? fnic_probe+0x9a3/0x11aa [fnic]
    > [] ? do_work_for_cpu+0x0/0x30
    > [] ? local_pci_probe+0x17/0x20
    > [] ? do_work_for_cpu+0x18/0x30
    > [] ? kthread+0x96/0xa0
    > [] ? child_rip+0xa/0x20
    > [] ? _spin_unlock_irq+0x30/0x40
    > [] ? restore_args+0x0/0x30
    > [] ? kthread+0x0/0xa0
    > [] ? child_rip+0x0/0x20

    The problem is in this hunk of "FIP VLAN Discovery Feature Support"
    (d3c995f1dcf938f1084388d92b8fb97bec366566)

    create_singlethreaded_workqueue cannot be called with irqs disabled

    @@ -620,7 +634,29 @@ static int __devinit fnic_probe(struct pci_dev
    *pdev,
    vnic_dev_packet_filter(fnic->vdev, 1, 1, 0, 0, 0);
    vnic_dev_add_addr(fnic->vdev, FIP_ALL_ENODE_MACS);
    vnic_dev_add_addr(fnic->vdev, fnic->ctlr.ctl_src_addr);
    + fnic->set_vlan = fnic_set_vlan;
    fcoe_ctlr_init(&fnic->ctlr, FIP_MODE_AUTO);
    + setup_timer(&fnic->fip_timer, fnic_fip_notify_timer,
    + (unsigned long)fnic);
    + spin_lock_init(&fnic->vlans_lock);
    + INIT_WORK(&fnic->fip_frame_work, fnic_handle_fip_frame);
    + INIT_WORK(&fnic->event_work, fnic_handle_event);
    + skb_queue_head_init(&fnic->fip_frame_queue);
    + spin_lock_irqsave(&fnic_list_lock, flags);
    + if (!fnic_fip_queue) {
    + fnic_fip_queue =
    + create_singlethread_workqueue("fnic_fip_q");
    + if (!fnic_fip_queue) {
    + spin_unlock_irqrestore(&fnic_list_lock, flags);
    + printk(KERN_ERR PFX "fnic FIP work queue "
    + "create failed\n");
    + err = -ENOMEM;
    + goto err_out_free_max_pool;
    + }
    + }
    + spin_unlock_irqrestore(&fnic_list_lock, flags);
    + INIT_LIST_HEAD(&fnic->evlist);
    + INIT_LIST_HEAD(&fnic->vlans);
    } else {
    shost_printk(KERN_INFO, fnic->lport->host,
    "firmware uses non-FIP mode\n");

    The attempts to make fnic_fip_queue a single instance for the driver
    while it's being created in probe look awkward anyway, why is this not
    created in fnic_init_module like the event workqueue?

    Signed-off-by: Chris Leech
    Tested-by: Anantha Tungarakodi
    Acked-by: Hiral Patel
    Signed-off-by: James Bottomley

    Chris Leech
     
  • Problem: When Hardware IOMMU is on, megaraid_sas driver initialization fails
    in kdump kernel with LSI MegaRAID controller(device id-0x73).

    Actually this issue needs fix in firmware, but for firmware running in field,
    this driver fix is proposed to resolve the issue. At firmware initialization
    time, if firmware does not come to ready state, driver will reset the adapter
    and retry for firmware transition to ready state unconditionally(not only
    executed for kdump kernel).

    Signed-off-by: Sumit Saxena
    Signed-off-by: Kashyap Desai
    Cc: stable@vger.kernel.org
    Signed-off-by: James Bottomley

    Sumit.Saxena@lsi.com
     

01 Aug, 2013

1 commit

  • vscsi->num_queues counts the number of request virtqueue which does not
    include the control and event virtqueue. It is wrong to subtract
    VIRTIO_SCSI_VQ_BASE from vscsi->num_queues.

    This patch fixes the following panic.

    (qemu) device_del scsi0

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
    IP: [] __virtscsi_set_affinity+0x6f/0x120
    PGD 0
    Oops: 0000 [#1] SMP
    Modules linked in:
    CPU: 0 PID: 659 Comm: kworker/0:1 Not tainted 3.11.0-rc2+ #1172
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Workqueue: kacpi_hotplug _handle_hotplug_event_func
    task: ffff88007bee1cc0 ti: ffff88007bfe4000 task.ti: ffff88007bfe4000
    RIP: 0010:[] [] __virtscsi_set_affinity+0x6f/0x120
    RSP: 0018:ffff88007bfe5a38 EFLAGS: 00010202
    RAX: 0000000000000010 RBX: ffff880077fd0d28 RCX: 0000000000000050
    RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000000
    RBP: ffff88007bfe5a58 R08: ffff880077f6ff00 R09: 0000000000000001
    R10: ffffffff8143e673 R11: 0000000000000001 R12: 0000000000000001
    R13: ffff880077fd0800 R14: 0000000000000000 R15: ffff88007bf489b0
    FS: 0000000000000000(0000) GS:ffff88007ea00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000020 CR3: 0000000079f8b000 CR4: 00000000000006f0
    Stack:
    ffff880077fd0d28 0000000000000000 ffff880077fd0800 0000000000000008
    ffff88007bfe5a78 ffffffff8179b37d ffff88007bccc800 ffff88007bccc800
    ffff88007bfe5a98 ffffffff8179b3b6 ffff88007bccc800 ffff880077fd0d28
    Call Trace:
    [] virtscsi_set_affinity+0x2d/0x40
    [] virtscsi_remove_vqs+0x26/0x50
    [] virtscsi_remove+0x82/0xa0
    [] virtio_dev_remove+0x22/0x70
    [] __device_release_driver+0x69/0xd0
    [] device_release_driver+0x2d/0x40
    [] bus_remove_device+0x116/0x150
    [] device_del+0x126/0x1e0
    [] device_unregister+0x16/0x30
    [] unregister_virtio_device+0x19/0x30
    [] virtio_pci_remove+0x36/0x80
    [] pci_device_remove+0x37/0x70
    [] __device_release_driver+0x69/0xd0
    [] device_release_driver+0x2d/0x40
    [] bus_remove_device+0x116/0x150
    [] device_del+0x126/0x1e0
    [] pci_stop_bus_device+0x9c/0xb0
    [] pci_stop_and_remove_bus_device+0x16/0x30
    [] acpiphp_disable_slot+0x8e/0x150
    [] hotplug_event_func+0xba/0x1a0
    [] ? acpi_os_release_object+0xe/0x12
    [] _handle_hotplug_event_func+0x31/0x70
    [] process_one_work+0x183/0x500
    [] worker_thread+0x122/0x400
    [] ? manage_workers+0x2d0/0x2d0
    [] kthread+0xce/0xe0
    [] ? kthread_freezable_should_stop+0x70/0x70
    [] ret_from_fork+0x7c/0xb0
    [] ? kthread_freezable_should_stop+0x70/0x70
    Code: 01 00 00 00 74 59 45 31 e4 83 bb c8 01 00 00 02 74 46 66 2e 0f 1f 84 00 00 00 00 00 49 63 c4 48 c1 e0 04 48 8b bc 0
    3 10 02 00 00 8b 47 20 48 8b 80 d0 01 00 00 48 8b 40 50 48 85 c0 74 07 be
    RIP [] __virtscsi_set_affinity+0x6f/0x120
    RSP
    CR2: 0000000000000020
    ---[ end trace 99679331a3775f48 ]---

    CC: stable@vger.kernel.org
    Signed-off-by: Asias He
    Reviewed-by: Wanlong Gao
    Signed-off-by: Rusty Russell

    Asias He
     

25 Jul, 2013

1 commit

  • Oops, apparently no-one I cc'd at intel actually bothered to check this
    patch for the isci driver:

    commit e73823f7a2c921dcf068d34ea03bd682498d9e42
    Author: James Bottomley
    Date: Tue May 7 15:38:18 2013 -0700

    [SCSI] libsas: implement > 16 byte CDB support

    sci_swab32_cpy needs multiples of four, so for commands that aren't that, it's
    rounding the wrong way. fix by doing (len+3)/4 instead of len/4.

    Reported-by: Tony Luck
    Tested-by: Tony Luck
    Signed-off-by: James Bottomley

    James Bottomley
     

24 Jul, 2013

1 commit

  • slot->response is a 64 bit quantity (and accessed as such), but its alignment
    is only 32 bits. This doesn't cause a problem on x86, but apparently causes a
    kernel panic on Tile:

    Stack dump complete Kernel panic - not syncing:
    Kernel unalign fault running the idle task!
    Starting stack dump of tid 0, pid 0 (swapper) on cpu 1 at cycle 341586172541
    frame 0: 0xfffffff700140ee0 dump_stack+0x0/0x20 (sp 0xfffffe43ffedf420)
    frame 1: 0xfffffff700283270 panic+0x150/0x3a0 (sp 0xfffffe43ffedf420)
    frame 2: 0xfffffff70012bff8 jit_bundle_gen+0xfd8/0x27e0 (sp 0xfffffe43ffedf4c8)
    frame 3: 0xfffffff7003b5b68 do_unaligned+0xc0/0x5a0 (sp 0xfffffe43ffedf710)
    frame 4: 0xfffffff70044ca78 handle_interrupt+0x270/0x278 (sp 0xfffffe43ffedf840)

    frame 5: 0xfffffff7002ac370 mvs_slot_complete+0x5f0/0x12a0 (sp 0xfffffe43ffedfa90)
    frame 6: 0xfffffff7002abec0 mvs_slot_complete+0x140/0x12a0 (sp 0xfffffe43ffedfa90)
    frame 7: 0xfffffff7005cc840 mvs_int_rx+0x140/0x2a0 (sp 0xfffffe43ffedfb00)
    frame 8: 0xfffffff7005bbaf0 mvs_94xx_isr+0xd8/0x2b8 (sp 0xfffffe43ffedfb68)
    frame 9: 0xfffffff700658ba0 mvs_tasklet+0x128/0x1f8 (sp 0xfffffe43ffedfba8)
    frame 10: 0xfffffff7003e8230 tasklet_action+0x178/0x2c8 (sp 0xfffffe43ffedfbe0)
    frame 11: 0xfffffff700103850 __do_softirq+0x210/0x398 (sp 0xfffffe43ffedfc40)
    frame 12: 0xfffffff700180308 do_softirq+0xc8/0x140 (sp 0xfffffe43ffedfcd8)
    frame 13: 0xfffffff7000bd7f0 irq_exit+0xb0/0x158 (sp 0xfffffe43ffedfcf0)
    frame 14: 0xfffffff70013fa58 tile_dev_intr+0x1d8/0x2f0 (sp 0xfffffe43ffedfd00)
    frame 15: 0xfffffff70044ca78 handle_interrupt+0x270/0x278 (sp 0xfffffe43ffedfd40)

    frame 16: 0xfffffff700143e68 _cpu_idle_nap+0x0/0x18 (sp 0xfffffe43ffedffb0)
    frame 17: 0xfffffff700482480 cpu_idle+0x310/0x428 (sp 0xfffffe43ffedffb0)

    Since the check is just for non-zero, split it to be two 32 bit accesses
    (preserving speed in the fast path) and do a get_unaligned() in the slow path.

    This is a modification of a wholly get_unaligned patch submitted by Paul Guo

    Reported-by: Paul Guo
    Signed-off-by: James Bottomley

    James Bottomley
     

23 Jul, 2013

3 commits

  • sd_prep_fn will allocate a larger CDB for the command via mempool_alloc
    for devices using DIF type 2 protection. This CDB was being freed
    in sd_done, which results in a kernel crash if the command is retried
    due to a UNIT ATTENTION. This change moves the code to free the larger
    CDB into sd_unprep_fn instead, which is invoked after the request is
    complete.

    It is no longer necessary to call scsi_print_command separately for
    this case as the ->cmnd will no longer be NULL in the normal code path.

    Also removed conditional test for DIF type 2 when freeing the larger
    CDB because the protection_type could have been changed via sysfs while
    the command was executing.

    Signed-off-by: Ewan D. Milne
    Acked-by: Martin K. Petersen
    Cc:
    Signed-off-by: James Bottomley

    Ewan D. Milne
     
  • This fixes a regression where Xyratex controllers and disks were lost by the
    driver:

    https://bugzilla.kernel.org/show_bug.cgi?id=59601

    Reported-by: Jack Hill
    Signed-off-by: Saurav Kashyap
    Signed-off-by: Giridhar Malavali
    Cc:
    Signed-off-by: James Bottomley

    Saurav Kashyap
     
  • This commit fixes a race condition in the isci driver abort task and SSP
    device task management path. The race is caused when an I/O termination
    in the SCU hardware is necessary because of an SSP target timeout condition,
    and the check of the I/O end state races against the HW-termination-driven
    end state. The failure of the race meant that no TMF was sent to the device
    to clean-up the pending I/O.

    Signed-off-by: Jeff Skirvin
    Reviewed-by: Lukasz Dorau
    Cc:
    Signed-off-by: James Bottomley

    Jeff Skirvin
     

14 Jul, 2013

1 commit

  • Pull final round of SCSI updates from James Bottomley:
    "This is the remaining set of SCSI patches for the merge window. It's
    mostly driver updates (scsi_debug, qla2xxx, storvsc, mp3sas). There
    are also several bug fixes in fcoe, libfc, and megaraid_sas. We also
    have a couple of core changes to try to make device destruction more
    deterministic"

    * tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (46 commits)
    [SCSI] scsi constants: command, sense key + additional sense strings
    fcoe: Reduce number of sparse warnings
    fcoe: Stop fc_rport_priv structure leak
    libfcoe: Fix meaningless log statement
    libfc: Differentiate echange timer cancellation debug statements
    libfc: Remove extra space in fc_exch_timer_cancel definition
    fcoe: fix the link error status block sparse warnings
    fcoe: Fix smatch warning in fcoe_fdmi_info function
    libfc: Reject PLOGI from nodes with incompatible role
    [SCSI] enable destruction of blocked devices which fail LUN scanning
    [SCSI] Fix race between starved list and device removal
    [SCSI] megaraid_sas: fix a bug for 64 bit arches
    [SCSI] scsi_debug: reduce duplication between prot_verify_read and prot_verify_write
    [SCSI] scsi_debug: simplify offset calculation for dif_storep
    [SCSI] scsi_debug: invalidate protection info for unmapped region
    [SCSI] scsi_debug: fix NULL pointer dereference with parameters dif=0 dix=1
    [SCSI] scsi_debug: fix incorrectly nested kmap_atomic()
    [SCSI] scsi_debug: fix invalid address passed to kunmap_atomic()
    [SCSI] mpt3sas: Bump driver version to v02.100.00.00
    [SCSI] mpt3sas: when async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed
    ...

    Linus Torvalds
     

13 Jul, 2013

1 commit


12 Jul, 2013

1 commit

  • Pull SCSI target updates from Nicholas Bellinger:
    "Lots of activity this round on performance improvements in target-core
    while benchmarking the prototype scsi-mq initiator code with
    vhost-scsi fabric ports, along with a number of iscsi/iser-target
    improvements and hardening fixes for exception path cases post v3.10
    merge.

    The highlights include:

    - Make persistent reservations APTPL buffer allocated on-demand, and
    drop per t10_reservation buffer. (grover)
    - Make virtual LUN=0 a NULLIO device, and skip allocation of NULLIO
    device pages (grover)
    - Add transport_cmd_check_stop write_pending bit to avoid extra
    access of ->t_state_lock is WRITE I/O submission fast-path. (nab)
    - Drop unnecessary CMD_T_DEV_ACTIVE check from
    transport_lun_remove_cmd to avoid extra access of ->t_state_lock in
    release fast-path. (nab)
    - Avoid extra t_state_lock access in __target_execute_cmd fast-path
    (nab)
    - Drop unnecessary vhost-scsi wait_for_tasks=true usage +
    ->t_state_lock access in release fast-path. (nab)
    - Convert vhost-scsi to use modern se_cmd->cmd_kref
    TARGET_SCF_ACK_KREF usage (nab)
    - Add tracepoints for SCSI commands being processed (roland)
    - Refactoring of iscsi-target handling of ISCSI_OP_NOOP +
    ISCSI_OP_TEXT to be transport independent (nab)
    - Add iscsi-target SendTargets=$IQN support for in-band discovery
    (nab)
    - Add iser-target support for in-band discovery (nab + Or)
    - Add iscsi-target demo-mode TPG authentication context support (nab)
    - Fix isert_put_reject payload buffer post (nab)
    - Fix iscsit_add_reject* usage for iser (nab)
    - Fix iscsit_sequence_cmd reject handling for iser (nab)
    - Fix ISCSI_OP_SCSI_TMFUNC handling for iser (nab)
    - Fix session reset bug with RDMA_CM_EVENT_DISCONNECTED (nab)

    The last five iscsi/iser-target items are CC'ed to stable, as they do
    address issues present in v3.10 code. They are certainly larger than
    I'd like for stable patch set, but are important to ensure proper
    REJECT exception handling in iser-target for 3.10.y"

    * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (51 commits)
    iser-target: Ignore non TEXT + LOGOUT opcodes for discovery
    target: make queue_tm_rsp() return void
    target: remove unused codes from enum tcm_tmrsp_table
    iscsi-target: kstrtou* configfs attribute parameter cleanups
    iscsi-target: Fix tfc_tpg_auth_cit configfs length overflow
    iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    iser-target: Add support for ISCSI_OP_TEXT opcode + payload handling
    iser-target: Rename sense_buf_[dma,len] to pdu_[dma,len]
    iser-target: Add vendor_err debug output
    target: Add (obsolete) checking for PMI/LBA fields in READ CAPACITY(10)
    target: Return correct sense data for IO past the end of a device
    target: Add tracepoints for SCSI commands being processed
    iser-target: Fix session reset bug with RDMA_CM_EVENT_DISCONNECTED
    iscsi-target: Fix ISCSI_OP_SCSI_TMFUNC handling for iser
    iscsi-target: Fix iscsit_sequence_cmd reject handling for iser
    iscsi-target: Fix iscsit_add_reject* usage for iser
    iser-target: Fix isert_put_reject payload buffer post
    iscsi-target: missing kfree() on error path
    iscsi-target: Drop left-over iscsi_conn->bad_hdr
    target: Make core_scsi3_update_and_write_aptpl return sense_reason_t
    ...

    Linus Torvalds
     

10 Jul, 2013

11 commits

  • Pull networking updates from David Miller:
    "This is a re-do of the net-next pull request for the current merge
    window. The only difference from the one I made the other day is that
    this has Eliezer's interface renames and the timeout handling changes
    made based upon your feedback, as well as a few bug fixes that have
    trickeled in.

    Highlights:

    1) Low latency device polling, eliminating the cost of interrupt
    handling and context switches. Allows direct polling of a network
    device from socket operations, such as recvmsg() and poll().

    Currently ixgbe, mlx4, and bnx2x support this feature.

    Full high level description, performance numbers, and design in
    commit 0a4db187a999 ("Merge branch 'll_poll'")

    From Eliezer Tamir.

    2) With the routing cache removed, ip_check_mc_rcu() gets exercised
    more than ever before in the case where we have lots of multicast
    addresses. Use a hash table instead of a simple linked list, from
    Eric Dumazet.

    3) Add driver for Atheros CQA98xx 802.11ac wireless devices, from
    Bartosz Markowski, Janusz Dziedzic, Kalle Valo, Marek Kwaczynski,
    Marek Puzyniak, Michal Kazior, and Sujith Manoharan.

    4) Support reporting the TUN device persist flag to userspace, from
    Pavel Emelyanov.

    5) Allow controlling network device VF link state using netlink, from
    Rony Efraim.

    6) Support GRE tunneling in openvswitch, from Pravin B Shelar.

    7) Adjust SOCK_MIN_RCVBUF and SOCK_MIN_SNDBUF for modern times, from
    Daniel Borkmann and Eric Dumazet.

    8) Allow controlling of TCP quickack behavior on a per-route basis,
    from Cong Wang.

    9) Several bug fixes and improvements to vxlan from Stephen
    Hemminger, Pravin B Shelar, and Mike Rapoport. In particular,
    support receiving on multiple UDP ports.

    10) Major cleanups, particular in the area of debugging and cookie
    lifetime handline, to the SCTP protocol code. From Daniel
    Borkmann.

    11) Allow packets to cross network namespaces when traversing tunnel
    devices. From Nicolas Dichtel.

    12) Allow monitoring netlink traffic via AF_PACKET sockets, in a
    manner akin to how we monitor real network traffic via ptype_all.
    From Daniel Borkmann.

    13) Several bug fixes and improvements for the new alx device driver,
    from Johannes Berg.

    14) Fix scalability issues in the netem packet scheduler's time queue,
    by using an rbtree. From Eric Dumazet.

    15) Several bug fixes in TCP loss recovery handling, from Yuchung
    Cheng.

    16) Add support for GSO segmentation of MPLS packets, from Simon
    Horman.

    17) Make network notifiers have a real data type for the opaque
    pointer that's passed into them. Use this to properly handle
    network device flag changes in arp_netdev_event(). From Jiri
    Pirko and Timo Teräs.

    18) Convert several drivers over to module_pci_driver(), from Peter
    Huewe.

    19) tcp_fixup_rcvbuf() can loop 500 times over loopback, just use a
    O(1) calculation instead. From Eric Dumazet.

    20) Support setting of explicit tunnel peer addresses in ipv6, just
    like ipv4. From Nicolas Dichtel.

    21) Protect x86 BPF JIT against spraying attacks, from Eric Dumazet.

    22) Prevent a single high rate flow from overruning an individual cpu
    during RX packet processing via selective flow shedding. From
    Willem de Bruijn.

    23) Don't use spinlocks in TCP md5 signing fast paths, from Eric
    Dumazet.

    24) Don't just drop GSO packets which are above the TBF scheduler's
    burst limit, chop them up so they are in-bounds instead. Also
    from Eric Dumazet.

    25) VLAN offloads are missed when configured on top of a bridge, fix
    from Vlad Yasevich.

    26) Support IPV6 in ping sockets. From Lorenzo Colitti.

    27) Receive flow steering targets should be updated at poll() time
    too, from David Majnemer.

    28) Fix several corner case regressions in PMTU/redirect handling due
    to the routing cache removal, from Timo Teräs.

    29) We have to be mindful of ipv4 mapped ipv6 sockets in
    upd_v6_push_pending_frames(). From Hannes Frederic Sowa.

    30) Fix L2TP sequence number handling bugs, from James Chapman."

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1214 commits)
    drivers/net: caif: fix wrong rtnl_is_locked() usage
    drivers/net: enic: release rtnl_lock on error-path
    vhost-net: fix use-after-free in vhost_net_flush
    net: mv643xx_eth: do not use port number as platform device id
    net: sctp: confirm route during forward progress
    virtio_net: fix race in RX VQ processing
    virtio: support unlocked queue poll
    net/cadence/macb: fix bug/typo in extracting gem_irq_read_clear bit
    Documentation: Fix references to defunct linux-net@vger.kernel.org
    net/fs: change busy poll time accounting
    net: rename low latency sockets functions to busy poll
    bridge: fix some kernel warning in multicast timer
    sfc: Fix memory leak when discarding scattered packets
    sit: fix tunnel update via netlink
    dt:net:stmmac: Add dt specific phy reset callback support.
    dt:net:stmmac: Add support to dwmac version 3.610 and 3.710
    dt:net:stmmac: Allocate platform data only if its NULL.
    net:stmmac: fix memleak in the open method
    ipv6: rt6_check_neigh should successfully verify neigh if no NUD information are available
    net: ipv6: fix wrong ping_v6_sendmsg return value
    ...

    Linus Torvalds
     
  • It has been several years since the SCSI constants.c
    file has been updated. The attached is against lk 3.10
    and brings the command strings, sense keys and additional
    sense code strings into sync with spc4r36g.pdf.

    Certain SCSI command names that previously only took the
    opcode (i.e. byte 0 of the cdb) into account, have been
    split into several command names using the associated
    service action field to differentiate. For example,
    persistent reservations that previously had 2 commands
    (i.e. "in" and "out") have been expanded to 12 commands
    (e.g. "Persistent reserve in, read reservation").

    Sync SCSI command names, sense key strings and additional
    sense code strings with SPC-4 draft revision 36g

    [jejb: whitespace fix]
    Signed-off-by: Douglas Gilbert
    Signed-off-by: James Bottomley

    Douglas Gilbert
     
  • Declare local variables and functions 'static'. This patch does not
    change any functionality.

    Signed-off-by: Bart Van Assche
    Signed-off-by: Robert Love

    Bart Van Assche
     
  • When repeatedly doing rmmod and modprobe on the ixgbe
    driver while FCoE is active in a VN2VN configuration,
    memory leaks would be discovered by kmemleak with the
    following backtrace:

    unreferenced object 0xffff88003d076000 (size 1024):
    comm "kworker/0:3", pid 2998, jiffies 4295436448 (age 1015.332s)
    hex dump (first 32 bytes):
    48 8a fe 6f 00 88 ff ff 00 00 00 00 00 00 00 00 H..o............
    01 00 00 00 02 00 00 00 7b ac 87 21 1b 00 00 10 ........{..!....
    backtrace:
    [] kmemleak_alloc+0x5b/0xc0
    [] __kmalloc+0xd8/0x1b0
    [] fc_rport_create+0x48/0x1f0 [libfc]
    [] fcoe_ctlr_vn_add.isra.10+0x56/0x1a0 [libfcoe]
    [] fcoe_ctlr_vn_recv+0x8b0/0xab0 [libfcoe]
    [] fcoe_ctlr_recv_work+0x4c6/0xf60 [libfcoe]
    [] process_one_work+0x1e4/0x4d0
    [] worker_thread+0x10f/0x380
    [] kthread+0xea/0xf0
    [] ret_from_fork+0x7c/0xb0
    [] 0xffffffffffffffff

    This patch stops the leak of the fc_rport_priv structure.

    Signed-off-by: Mark Rustad
    Tested-by: Jack Morgan
    Signed-off-by: Robert Love

    Mark Rustad
     
  • ctlr_dev was initialized to NULL, and never re-assigned. This
    caused the log statement to always report failure. This patch
    removes the unused variable and fixes the log statement to always
    report 'success', as that is what should be logged if the code
    reaches this point.

    Signed-off-by: Robert Love
    Tested-by: Jack Morgan
    Acked-by: Neil Horman

    Robert Love
     
  • There are two debug statements with the same output string regarding
    echange timer cancellation. This patch simply changes the output of
    one string so that they can be differentiated.

    Signed-off-by: Robert Love
    Tested-by: Jack Morgan
    Acked-by: Neil Horman

    Robert Love
     
  • Simply remove an extra space that violates coding style.

    Signed-off-by: Robert Love
    Tested-by: Jack Morgan
    Acked-by: Neil Horman

    Robert Love
     
  • Both fcoe_fc_els_lesb and fc_els_lesb are in __be32 already, and both are
    exactly the same size in bytes, with somewhat different member names to
    reflect the fact the former is for Ethernet media the latter is for Fiber
    Channel, so, remove conversion and use __be32 directly. This fixes the warning
    from sparse check.

    Signed-off-by: Yi Zou
    Reported-by: Fengguang Wu
    Tested-by: Jack Morgan
    Signed-off-by: Robert Love

    Yi Zou
     
  • do_device_access() is a function that abstracts copying SG list from/to
    ramdisk storage (fake_storep).

    It must deal with the ranges exceeding actual fake_storep size, because
    such ranges are valid if virtual_gb is set greater than zero, and they
    should be treated as fake_storep is repeatedly mirrored up to virtual
    size.

    Unfortunately, it can't deal with the range which wraps around the end of
    fake_storep. A wrap around range is copied by two
    sg_copy_{from,to}_buffer() calls, but sg_copy_{from,to}_buffer() can't
    copy from/to in the middle of SG list, therefore the second call can't
    copy correctly.

    This fixes it by using sg_pcopy_{from,to}_buffer() that can copy from/to
    the middle of SG list.

    This also simplifies the assignment of sdb->resid in
    fill_from_dev_buffer(). Because fill_from_dev_buffer() is now only called
    once per command execution cycle. So it is not necessary to take care to
    decrease sdb->resid if fill_from_dev_buffer() is called more than once.

    Signed-off-by: Akinobu Mita
    Cc: "David S. Miller"
    Cc: "James E.J. Bottomley"
    Cc: Douglas Gilbert
    Cc: Herbert Xu
    Cc: Horia Geanta
    Cc: Imre Deak
    Cc: Tejun Heo
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Akinobu Mita
     
  • This patch fixes a smatch warning as below:

    smatch warnings:
    drivers/scsi/fcoe/fcoe.c:782 fcoe_fdmi_info() warn: 'fdmi' puts 896 bytes on
    stack

    Reported-by: Fengguang Wu
    Signed-off-by: Neerav Parikh
    Tested-by: Jack Morgan
    Signed-off-by: Robert Love

    Neerav Parikh
     
  • Reject a PLOGI from a node with an incompatible role,
    that is, initiator-to-initiator or target-to-target.

    Signed-off-by: Mark Rustad
    Reviewed-by: Yi Zou
    Tested-by: Jack Morgan
    Signed-off-by: Robert Love

    Mark Rustad
     

09 Jul, 2013

15 commits

  • If something goes wrong during LUN scanning, e.g. a transport layer
    failure occurs, then __scsi_remove_device() can get invoked by the
    LUN scanning code for a SCSI device in state SDEV_CREATED_BLOCK and
    before the SCSI device has been added to sysfs (is_visible == 0).
    Make sure that even in this case the transition into state SDEV_DEL
    occurs. This avoids that __scsi_remove_device() can get invoked a
    second time by scsi_forget_host() if this last function is invoked
    from another thread than the thread that performs LUN scanning.

    Signed-off-by: Bart Van Assche
    Signed-off-by: James Bottomley

    Bart Van Assche
     
  • scsi_run_queue() examines all SCSI devices that are present on
    the starved list. Since scsi_run_queue() unlocks the SCSI host
    lock a SCSI device can get removed after it has been removed
    from the starved list and before its queue is run. Protect
    against that race condition by holding a reference on the
    queue while running it.

    Reported-by: Chanho Min
    Reviewed-by: Bart Van Assche
    Signed-off-by: James Bottomley

    James Bottomley
     
  • On 64 bit then -1UL and -1U are not equal, so these conditions don't
    work as intended and it breaks error handling.

    Signed-off-by: Dan Carpenter
    Acked-by: Sumit Saxena
    Signed-off-by: James Bottomley

    Dan Carpenter
     
  • In order to reduce code duplication between prot_verify_read() and
    prot_verify_write(), this moves common code into the new functions.

    [jejb: fix unitialised variable warning]
    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • dif_storep is declared as pointer to unsigned char type. But it is
    actually used to store vmalloced array of struct sd_dif_tuple.

    This changes the type of dif_storep to the pointer to struct sd_dif_tuple.
    It simplifies offset calculation for dif_storep and enables to remove
    hardcoded size of struct sd_dif_tuple.

    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • When UNMAP command is issued with the data integrity support enabled,
    the protection info for the unmapped region is remain unchanged.
    So READ command for the region later on causes data integrity failure.

    This fixes it by invalidating protection info for the unmapped region
    by filling with 0xff pattern.

    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • The protection info dif_storep is allocated only when parameter dif is
    not zero. But it will be accessed when reading or writing to the storage
    installed with parameter dix is not zero.

    So kernel crashes if scsi_debug module is loaded with parameters dix=1 and
    dif=0.

    This fixes it by making dif_storep available if parameter dix is not zero
    instead of checking if parameter dif is not zero.

    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • In the function prot_verify_write(), kmap_atomic()/kunmap_atomic() for
    data page and kmap_atomic()/kunmap_atomic() for protection information
    page are not nested each other.

    It worked perfectly before commit 3e4d3af501cccdc8a8cca41bdbe57d54ad7e7e73
    ("mm: stack based kmap_atomic()"). Because the kmap_atomic slot KM_IRQ0
    was used for data page and the slot KM_IRQ1 was used for protection page.

    But KM_types are gone and kmap_atomic() is using stack based implementation.
    So two different kmap_atomic() usages must be strictly nested now.

    This change ensures kmap_atomic() usage is strictly nested.

    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • In the function prot_verify_write(), the kmap address 'daddr' is
    incremented in the loop for each data page. Finally 'daddr' reaches
    the next page boundary in the end of the loop, and the invalid address
    is passed to kunmap_atomic().

    Fix the issue by not incrementing 'daddr' in the loop and offsetting it
    by the loop counter on demand.

    Signed-off-by: Akinobu Mita
    Acked-by: Douglas Gilbert
    Acked-by: "Martin K. Petersen"
    Signed-off-by: James Bottomley

    Akinobu Mita
     
  • Bump driver version to v02.100.00.00.

    Signed-off-by: Sreekanth Reddy
    Signed-off-by: James Bottomley

    Sreekanth Reddy
     
  • …removed but their transport layer entries are not removed

    When Async scanning mode is enabled and device scanning is in progress,
    devices should not be removed. But in actuality, devices are removed but
    their transport layer entries are not removed. This causes error to add
    the same device to the transport layer after host reset or diagnostic
    reset.

    So, in this patch, modified the code in such a way that device is not removed
    when Async scanning mode is enabled and device scanning is in progress.

    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>

    Sreekanth Reddy
     
  • Change set in MPI v2.5 Rev F(v2.5.1.1) specification and 2.00.29 header files

    1. Added a bit to the IOCExceptions field of the IOCFacts Reply to indicate
    that the IOC detected a partial memory failure.
    2. Added ElapsedSeconds field to RAID Volume Indicator Structure. Added
    Elapsed Seconds Valid flag to Flags field of this structure.
    3. Added ElapsedSeconds field to Integrated RAID Operations Status Event Data.
    4. Added two new AbortType values for TargetModeAbort Request, one to abort
    all I/Os from a single initiator, and the other to abort only Command IUs.
    5. Added a new chapter covering DMA Flags and Multicast Modes.
    6. In the IOCSettings field of BIOS Page 1, modified the Adapter Support bits
    description to specify X86 BIOS.
    7. Marked bit 0 of the ControlFlags field of SAS IO Unit Page 1 as
    obsolete. This was the Clear SATA Affiliation flag.
    8. Added additional requirements for certain IOCs that support more than eight
    MSI-x vectors.

    Signed-off-by: Sreekanth Reddy
    Signed-off-by: James Bottomley

    Sreekanth Reddy
     
  • Infinite loop can occur if IOCStatus is not equal to
    MPI2_IOCSTATUS_CONFIG_INVALID_PAGE value in the while loops in functions
    _scsih_search_responding_sas_devices,
    _scsih_search_responding_raid_devices and
    _scsih_search_responding_expanders

    So, Instead of checking for MPI2_IOCSTATUS_CONFIG_INVALID_PAGE value,
    in this patch code is modified to check for IOCStatus not equals to
    MPI2_IOCSTATUS_SUCCESS to break the while loop.

    Signed-off-by: Sreekanth Reddy
    Cc: stable@vger.kernel.org
    Signed-off-by: James Bottomley

    Sreekanth Reddy
     
  • …LUN 0 configured expander

    With some enclosures when LUN 0 is not created but LUN 1 or LUN X is created
    then SCSI scan procedure calls target_alloc, slave_alloc call back functions
    for LUN 0 and slave_destory() for same LUN 0.

    In these kind of cases within slave_destroy, pointer to scsi_target in
    _sas_device structure is set to NULL, following which when slave_alloc for LUN
    1 is called then starget would not be set properly for this LUN. So,
    scsi_target pointer pointing to NULL value would lead to a crash later in the
    discovery procedure.

    To solve this issue set the sas_device's scsi_target pointer to scsi_device's
    scsi_target if it is NULL earlier in slave_alloc callback function.

    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>

    Sreekanth Reddy
     
  • Hardware timing requirements is updated in order to comply with firmware
    requirement.

    Signed-off-by: Sreekanth Reddy
    Signed-off-by: James Bottomley

    Sreekanth Reddy