aboutsummaryrefslogtreecommitdiff
path: root/drivers/scsi
AgeCommit message (Collapse)Author
2011-08-15mpt2sas: Fixed Big Indian Issues on 32 bit PPCKashyap, Desai
commit c97951ec46d4b076c2236b77db34eeed6dddb8eb upstream. This patch addresses many endian issues solved by runing sparse with the option __CHECK_ENDIAN__ turned on. Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04hpsa: do not attempt to read from a write-only registerStephen M. Cameron
commit fec62c368b9c8b05d5124ca6c3b8336b537f26f3 upstream. Most smartarrays tolerate it, but a few new ones don't. Without this change some newer Smart Arrays will lock up and i/o will grind to a halt. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04pmcraid: reject negative request sizeDan Rosenberg
commit b5b515445f4f5a905c5dd27e6e682868ccd6c09d upstream. There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. First, the user can call pmcraid_chr_ioctl(), with a type PMCRAID_PASSTHROUGH_IOCTL. This calls through to pmcraid_ioctl_passthrough(). Next, a pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. It looks like preventing this value from being negative in pmcraid_ioctl_passthrough() would be sufficient. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04fix crash in scsi_dispatch_cmd()James Bottomley
commit bfe159a51203c15d23cb3158fffdc25ec4b4dda1 upstream. USB surprise removal of sr is triggering an oops in scsi_dispatch_command(). What seems to be happening is that USB is hanging on to a queue reference until the last close of the upper device, so the crash is caused by surprise remove of a mounted CD followed by attempted unmount. The problem is that USB doesn't issue its final commands as part of the SCSI teardown path, but on last close when the block queue is long gone. The long term fix is probably to make sr do the teardown in the same way as sd (so remove all the lower bits on ejection, but keep the upper disk alive until last close of user space). However, the current oops can be simply fixed by not allowing any commands to be sent to a dead queue. Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04ses: requesting a fault indicationDouglas Gilbert
commit 2a350cab9daf9a46322d83b091bb05cf54ccf6ab upstream. Noticed that when the sysfs interface of the SCSI SES driver was used to request a fault indication the LED flashed but the buzzer didn't sound. So it was doing what REQUEST IDENT (locate) should do. Changelog: - fix the setting of REQUEST FAULT for the device slot and array device slot elements in the enclosure control diagnostic page - note the potentially defective code that reads the FAULT SENSED and FAULT REQUESTED bits from the enclosure status diagnostic page The attached patch is against git/scsi-misc-2.6 Signed-off-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04sr: check_events() ignore GET_EVENT when TUR says otherwiseKay Sievers
commit 79b9677d885d1a792bc103f2febb06f91f92de43 upstream. Some broken devices indicates that media has changed on every GET_EVENT_STATUS_NOTIFICATION. This translates into MEDIA_CHANGE uevent on every open() which lets udev run into a loop. Verify GET_EVENT result against TUR and if it generates spurious events for several times in a row, ignore the GET_EVENT events, and trust only the TUR status. This is the log of a USB stick with a (broken) fake CDROM drive: scsi 5:0:0:0: Direct-Access SanDisk U3 Cruzer Micro 8.02 PQ: 0 ANSI: 0 CCS sd 5:0:0:0: Attached scsi generic sg3 type 0 scsi 5:0:0:1: CD-ROM SanDisk U3 Cruzer Micro 8.02 PQ: 0 ANSI: 0 sd 5:0:0:0: [sdb] Attached SCSI removable disk sr2: scsi3-mmc drive: 48x/48x tray sr 5:0:0:1: Attached scsi CD-ROM sr2 sr 5:0:0:1: Attached scsi generic sg4 type 5 sr2: GET_EVENT and TUR disagree continuously, suppress GET_EVENT events sd 5:0:0:0: [sdb] 31777279 512-byte logical blocks: (16.2 GB/15.1 GiB) sd 5:0:0:0: [sdb] No Caching mode page present sd 5:0:0:0: [sdb] Assuming drive cache: write through sd 5:0:0:0: [sdb] No Caching mode page present sd 5:0:0:0: [sdb] Assuming drive cache: write through sdb: sdb1 -tj: Updated to consider only spurious GET_EVENT events among different types of disagreement and allow using TUR for kernel event polling after GET_EVENT is ignored. Reported-By: Markus Rathgeb maggu2810@googlemail.com Signed-off-by: Kay Sievers <kay.sievers@vrfy.org> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04Blacklist Traxdata CDR4120 and IOMEGA Zip drive to avoid lock ups.Werner Fink
commit 82103978189e9731658cd32da5eb85ab7b8542b8 upstream. This patch resulted from the discussion at https://bugzilla.novell.com/show_bug.cgi?id=679277, https://bugzilla.novell.com/show_bug.cgi?id=681840 . Signed-off-by: Werner Fink <werner@novell.com> Signed-off-by: Ankit Jain <jankit@suse.de> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-04libsas: remove expander from dev list on errorLuben Tuikov
commit 5911e963d3718e306bcac387b83e259aa4228896 upstream. If expander discovery fails (sas_discover_expander()), remove the expander from the port device list (sas_ex_discover_expander()), before freeing it. Else the list is corrupted and, e.g., when we attempt to send SMP commands to other devices, the kernel oopses. Signed-off-by: Luben Tuikov <ltuikov@yahoo.com> Reviewed-by: Jack Wang <jack_wang@usish.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-07-03[SCSI] isci: fix checkpatch errorsJames Bottomley
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2011-07-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isciJames Bottomley
2011-07-03isci: Device reset should request sas_phy_reset(phy, true)Jeff Skirvin
The hard_reset parameter passed to the LLDD in the direct-attached phy control case allows the LLDD to filter link failure events while the direct-attached device reset is executing. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: pare back error messsagesDan Williams
The messages emitted from task.c and some from request.c likely duplicate (in a less undertandable way) what is reported by the midlayer. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: cleanup silicon revision detectionDan Williams
Perform checking per-pci device (even though all systems will only have 1 pci device in this generation), and delete support for silicon that does not report a proper revision (i.e. A0). Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: merge scu_unsolicited_frame.h into unsolicited_frame_control.hDan Williams
Does not need its own file. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: merge sata.[ch] into request.cDan Williams
Undo some needless separation. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: kill 'get/set' macrosDan Williams
Most of these simple dereference macros are longer than their open coded equivalent. Deleting enum sci_controller_mode is thrown in for good measure. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: retire scic_sds_ and scic_ prefixesDan Williams
The distinction between scic_sds_ scic_ and sci_ are no longer relevant so just unify the prefixes on sci_. The distinction between isci_ and sci_ is historically significant, and useful for comparing the old 'core' to the current Linux driver. 'sci_' represents the former core as well as the routines that are closer to the hardware and protocol than their 'isci_' brethren. sci == sas controller interface. Also unwind the 'sds1' out of the parameter structs. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify isci_host and scic_sds_controllerDan Williams
Remove the distinction between these two implementations and unify on isci_host (local instances named ihost). Hmmm, we had two 'oem_parameters' instances, one was unused... nice. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify isci_remote_device and scic_sds_remote_deviceDan Williams
Remove the distinction between these two implementations and unify on isci_remote_device (local instances named idev). Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify isci_port and scic_sds_portDan Williams
Remove the distinction between these two implementations and unify on isci_port (local instances named iport). The duplicate '->owning_port' and '->isci_port' in both isci_phy and isci_remote_device will be fixed in a later patch... this is just the straightforward rename/unification. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix scic_sds_remote_device_terminate_requestsDan Williams
Commit 0815632 "isci: unify remote_device stop_handlers" introduced the possibility that not all requests get terminated if we reach the request_count. Now that we properly reference count devices we don't need this self-defense and can do the straightforward scan of all active requests. Reported-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Acked-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify isci_phy and scic_sds_phyDan Williams
They are one in the same object so remove the distinction. The near duplicate fields (owning_port, and isci_port) will be cleaned up after the scic_sds_port isci_port unification. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify isci_request and scic_sds_requestDan Williams
They are one in the same object so remove the distinction. The near duplicate fields (owning_controller, and isci_host) will be cleaned up after the scic_sds_contoller isci_host unification. Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: rename / clean up scic_sds_stp_requestDan Williams
* Rename scic_sds_stp_request to isci_stp_request * Remove the unused fields and union indirection Reported-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: preallocate requestsDan Williams
the dma_pool interface is optimized for object_size << page_size which is not the case with isci_request objects and the dma_pool routines show up in the top of the profile. The old io_request_table which tracked whether tci slots were in-flight or not is replaced with an IREQ_ACTIVE flag per request. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: combine request flagsDan Williams
Combine three bools into one unsigned long 'flags'. Doesn't increase the request size due to packing. (to do: optimize the structure layout). Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: unify can_queue tracking on the tci_pool, uplevel tag assignmentDan Williams
The tci_pool tracks our outstanding command slots which are also the 'index' portion of our tags. Grabbing the tag early in ->lldd_execute_task let's us drop the isci_host_can_queue() and ->was_tag_assigned_by_user infrastructure. ->was_tag_assigned_by_user required the task context to be duplicated in request-local buffer. With the tci established early we can build the task_context directly into its final location and skip a memcpy. With the task context buffer at a known address at request construction we have the opportunity/obligation to also fix sgl handling. This rework feels like it belongs in another patch but the sgl handling and task_context are too intertwined. 1/ fix the 'ab' pair embedded in the task context to point to the 'cd' pair in the task context (previously we were prematurely linking to the staging buffer). 2/ fix the broken iteration of pio sgls that assumes all sgls are relative to the request, and does a dangerous looking reverse lookup of physical address to virtual address. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Terminate dev requests on FIS err bit rx in NCQJeff Skirvin
When the remote device transitions to a not-ready state because of an NCQ error condition, all outstanding requests to that device are terminated and completed to libsas on the normal path. The device then waits for a READ LOG EXT command to issue on the task management path. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix frame received lockingDan Williams
Updates to the frame_rcvd before need to be atomic with respect to when they are evaluated by libsas. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: possible buffer overflow in isci_parse_oem_parameters fixedMaciej Patelczyk
scu_index is a parameter of isci_parse_eom_parameters and is an index in controller table. There is a check: scu_index > SCI_MAX_CONTROLLERS which is insufficient and should be: scu_index >= SCI_MAX_CONTROLLERS. scu_index is used as an index in the table which size is SCI_MAX_CONTROLLERS. Signed-off-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix isci_task_execute_tmf completionDan Williams
1/ fix the timeout for wait_for_completion_timeout 2/ In the tmf timeout case we need to wait for our termination callback 3/ Once the request is successfully started it will be freed according to the normal lifetime for requests. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix support for arbitrarily large smp requestsDan Williams
Instead of duplicating the smp request buffer reuse the one provided by libsas. This future proofs the driver to support arbitrarily large smp requests, and shrinks the request structure size by ~700 bytes. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix dma_unmap_sg usageDan Williams
One bug and a cleanup: 1/ Fix cases where we were unmapping invalid addresses (smp requests were being unmapped) [ 604.662770] ------------[ cut here ]------------ [ 604.668026] WARNING: at lib/dma-debug.c:800 check_unmap+0x418/0x740() [ 604.675315] Hardware name: SandyBridge Platform [ 604.680465] isci 0000:03:00.0: DMA-API: device driver tries to free an invalid DMA memory address 2/ The unmap routine is too large to be an inline function, and isci_request_io_request_get_next_sge is unused. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix smp response frame overrunDan Williams
Due to a typo we currently copy way too much when copying over the response data, but since a request is likely backed by a full page allocation we don't corrupt live data. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: kill device_sequenceDan Williams
Now that we have upleveled device reassignment protection to the isci_remote_device reference count we no longer need this level of self-defense. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: kill isci_remote_device_change_state()Dan Williams
Now that "stopping/stopped" are one in the same and signalled by a NULL device pointer the rest of the device status infrastructure can be removed (->status and ->state_lock). The "not ready for i/o state" is replaced with a state flag, and is evaluated under scic_lock so that we don't see transients from taking the device reference to submitting the i/o. This also fixes a potential leakage of can_queue slots in the rare case that SAS_TASK_ABORTED is set at submission. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: atomic device lookup and reference countingDan Williams
We have unsafe references to remote devices that are notified to disappear at lldd_dev_gone. In order to clean this up we need a single canonical source for device lookups and stable references once a lookup succeeds. Towards that end guarantee that domain_device.lldd_dev is NULL as soon as we start the process of stopping a device. Any code path that wants to safely lookup a remote device must do so through task->dev->lldd_dev (isci_lookup_device()). For in-flight references outside of scic_lock we need reference counting to ensure that the device is not recycled before we are done with it. Simplify device back references to just scic_sds_request.target_device which is now the only permissible internal reference that is maintained relative to the reference count. There were two occasions where we wanted new i/o's to be treated as SAS_TASK_UNDELIVERED but where the domain_dev->lldd_dev link is still intact. Introduce a 'gone' flag to prevent i/o while waiting for libsas to take action on the port down event. One 'core' leftover is that we currently call scic_remote_device_destruct() from isci_remote_device_deconstruct() which is called when the 'core' says the device is stopped. It would be more natural for the final put to trigger isci_remote_device_deconstruct() but this implementation is deferred as it requires other changes. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix ssp response iu buffer size in isci_tmfDan Williams
In isci_task_request_complete() we save the response/sense data from the command. Make sure isci_tmf has enough space to hold the full response. [ it does not look like we actually use this data, and response_data_len/sense_data_len should be specifying the byte count, in any event do the simple fix first so we don't corrupt memory ] Reported-by: Adam Gruchala <adam.gruchala@intel.com> Tested-by: Edmund Nadolski <edmund.nadolski@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: cleanup request allocationDan Williams
Rather than return an error code and update a pointer that was passed by reference just return the request object directly (or null if allocation failed). Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: cleanup/optimize queue increment macrosDan Williams
Every single i/o or event completion incurs a test and branch to see if the cycle bit changed. For power-of-2 queue sizes the cycle bit can be read directly from the rollover of the queue pointer. Likely premature optimization, but the hidden if() and hidden assignments / side-effects in the macros were already asking to be cleaned up. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: cleanup tag macrosDan Williams
A tag is a 16 bit number where the upper four bits is a sequence number and the remainder is the task context index (tci). Sanitize the macro names and shave 256-bytes out of scic_sds_controller by reducing the size of io_request_sequence. scic_sds_io_tag_construct --> ISCI_TAG scic_sds_io_tag_get_sequence --> ISCI_TAG_SEQ scic_sds_io_tag_get_index() --> ISCI_TAG_TCI scic_sds_io_sequence_increment() [delete / open code] Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: cleanup/optimize pool implementationDan Williams
The circ_buf macros are ~6% faster, as measured by perf, because they take advantage of power-of-two math assumptions i.e. no test and branch for rollover. Their semantics are clearer than the hidden side effects in pool.h (like sci_pool_get() which hides an assignment). Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Disable link layer hang detectionJeff Skirvin
Some targets exceed the hang detect timer. Use the OS timeout to catch hung tasks. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Hard reset failure will link reset all phys in the portJeff Skirvin
In the case where the hard reset process fails, each link in the port is put through a link reset sequence. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Explicitly decode remote node ready and suspended statesJeff Skirvin
The remote node context should only signal a device reset condition in a suspended state. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: fix isci_terminate_pending() list managementDan Williams
Walk through the list of pending requests being careful to consider that multiple requests can be terminated when the lock is dropped (i.e. invalidating the 'next' reference established by list_for_each_entry_safe). Also noticed that all callers to isci_terminate_pending_requests() specifying terminating, so just drop the parameter. Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Handle timed-out request terminations correctlyJeff Skirvin
In the situation where a termination of an I/O times-out, make sure that the linkage from the request to the task is severed completely. Also make sure that the selection of tasks to terminate occurs under scic_lock. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Requests that do not start must be set to "complete"Jeff Skirvin
Requests that fail at start because of a reset pending condition must be set to complete in order to allow for later cleanup. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: Add decode for SMP request retry error conditionJeff Skirvin
There are situations with slow expanders in which a first attempt to execute an SMP request will fail with a timeout. Immediate subsequent retries will generally succeed. This change makes sure SMP I/O failures are immediately failed to libsas so that retries happen with no discovery process timeout delay. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2011-07-03isci: filter broadcast change notifications during SMP phy resetsJeff Skirvin
When resetting a sata device in the domain we have seen occasions where libsas prematurely marks a device gone in the time it takes for the device to re-establish the link. This plays badly with software raid arrays. Other libsas drivers have non-uniform delays in their reset handlers to try to cover this condition, but not sufficient to close the hole. Given that a sata device can take many seconds to recover we filter bcns and poll for the device reattach state before notifying libsas that the port needs the domain to be rediscovered. Once this has been proven out at the lldd level we can think about uplevelling this feature to a common implementation in libsas. Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com> [ use kzalloc instead of kmem_cache ] Signed-off-by: Dave Jiang <dave.jiang@intel.com> [ use eventq and time macros ] Signed-off-by: Dan Williams <dan.j.williams@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 23:15:36 +0000