--- /dev/null
+From d47748e5ae5af6572e520cc9767bbe70c22ea498 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Thu, 1 Nov 2018 21:31:39 +0100
+Subject: ovl: automatically enable redirect_dir on metacopy=on
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit d47748e5ae5af6572e520cc9767bbe70c22ea498 upstream.
+
+Current behavior is to automatically disable metacopy if redirect_dir is
+not enabled and proceed with the mount.
+
+If "metacopy=on" mount option was given, then this behavior can confuse the
+user: no mount failure, yet metacopy is disabled.
+
+This patch makes metacopy=on imply redirect_dir=on.
+
+The converse is also true: turning off full redirect with redirect_dir=
+{off|follow|nofollow} will disable metacopy.
+
+If both metacopy=on and redirect_dir={off|follow|nofollow} is specified,
+then mount will fail, since there's no way to correctly resolve the
+conflict.
+
+Reported-by: Daniel Walsh <dwalsh@redhat.com>
+Fixes: d5791044d2e5 ("ovl: Provide a mount option metacopy=on/off...")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/overlayfs.txt | 6 +++++
+ fs/overlayfs/super.c | 36 +++++++++++++++++++++++++-------
+ 2 files changed, 35 insertions(+), 7 deletions(-)
+
+--- a/Documentation/filesystems/overlayfs.txt
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -286,6 +286,12 @@ pointed by REDIRECT. This should not be
+ "trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
+ for untrusted layers like from a pen drive.
+
++Note: redirect_dir={off|nofollow|follow(*)} conflicts with metacopy=on, and
++results in an error.
++
++(*) redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
++given.
++
+ Sharing and copying layers
+ --------------------------
+
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -472,6 +472,7 @@ static int ovl_parse_opt(char *opt, stru
+ {
+ char *p;
+ int err;
++ bool metacopy_opt = false, redirect_opt = false;
+
+ config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL);
+ if (!config->redirect_mode)
+@@ -516,6 +517,7 @@ static int ovl_parse_opt(char *opt, stru
+ config->redirect_mode = match_strdup(&args[0]);
+ if (!config->redirect_mode)
+ return -ENOMEM;
++ redirect_opt = true;
+ break;
+
+ case OPT_INDEX_ON:
+@@ -548,6 +550,7 @@ static int ovl_parse_opt(char *opt, stru
+
+ case OPT_METACOPY_ON:
+ config->metacopy = true;
++ metacopy_opt = true;
+ break;
+
+ case OPT_METACOPY_OFF:
+@@ -572,13 +575,32 @@ static int ovl_parse_opt(char *opt, stru
+ if (err)
+ return err;
+
+- /* metacopy feature with upper requires redirect_dir=on */
+- if (config->upperdir && config->metacopy && !config->redirect_dir) {
+- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=on\", falling back to metacopy=off.\n");
+- config->metacopy = false;
+- } else if (config->metacopy && !config->redirect_follow) {
+- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=follow\" on non-upper mount, falling back to metacopy=off.\n");
+- config->metacopy = false;
++ /*
++ * This is to make the logic below simpler. It doesn't make any other
++ * difference, since config->redirect_dir is only used for upper.
++ */
++ if (!config->upperdir && config->redirect_follow)
++ config->redirect_dir = true;
++
++ /* Resolve metacopy -> redirect_dir dependency */
++ if (config->metacopy && !config->redirect_dir) {
++ if (metacopy_opt && redirect_opt) {
++ pr_err("overlayfs: conflicting options: metacopy=on,redirect_dir=%s\n",
++ config->redirect_mode);
++ return -EINVAL;
++ }
++ if (redirect_opt) {
++ /*
++ * There was an explicit redirect_dir=... that resulted
++ * in this conflict.
++ */
++ pr_info("overlayfs: disabling metacopy due to redirect_dir=%s\n",
++ config->redirect_mode);
++ config->metacopy = false;
++ } else {
++ /* Automatically enable redirect otherwise. */
++ config->redirect_follow = config->redirect_dir = true;
++ }
+ }
+
+ return 0;
--- /dev/null
+From 5e1275808630ea3b2c97c776f40e475017535f72 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 31 Oct 2018 12:15:23 +0100
+Subject: ovl: check whiteout in ovl_create_over_whiteout()
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 5e1275808630ea3b2c97c776f40e475017535f72 upstream.
+
+Kaixuxia repors that it's possible to crash overlayfs by removing the
+whiteout on the upper layer before creating a directory over it. This is a
+reproducer:
+
+ mkdir lower upper work merge
+ touch lower/file
+ mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
+ rm merge/file
+ ls -al merge/file
+ rm upper/file
+ ls -al merge/
+ mkdir merge/file
+
+Before commencing with a vfs_rename(..., RENAME_EXCHANGE) verify that the
+lookup of "upper" is positive and is a whiteout, and return ESTALE
+otherwise.
+
+Reported by: kaixuxia <xiakaixu1987@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Fixes: e9be9d5e76e3 ("overlay filesystem")
+Cc: <stable@vger.kernel.org> # v3.18
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/dir.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -463,6 +463,10 @@ static int ovl_create_over_whiteout(stru
+ if (IS_ERR(upper))
+ goto out_unlock;
+
++ err = -ESTALE;
++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper)))
++ goto out_dput;
++
+ newdentry = ovl_create_temp(workdir, cattr);
+ err = PTR_ERR(newdentry);
+ if (IS_ERR(newdentry))
--- /dev/null
+From babf4770be0adc69e6d2de150f4040f175e24beb Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Wed, 10 Oct 2018 19:10:06 +0300
+Subject: ovl: fix error handling in ovl_verify_set_fh()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit babf4770be0adc69e6d2de150f4040f175e24beb upstream.
+
+We hit a BUG on kfree of an ERR_PTR()...
+
+Reported-by: syzbot+ff03fe05c717b82502d0@syzkaller.appspotmail.com
+Fixes: 8b88a2e64036 ("ovl: verify upper root dir matches lower root dir")
+Cc: <stable@vger.kernel.org> # v4.13
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/namei.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -422,8 +422,10 @@ int ovl_verify_set_fh(struct dentry *den
+
+ fh = ovl_encode_real_fh(real, is_upper);
+ err = PTR_ERR(fh);
+- if (IS_ERR(fh))
++ if (IS_ERR(fh)) {
++ fh = NULL;
+ goto fail;
++ }
+
+ err = ovl_verify_fh(dentry, name, fh);
+ if (set && err == -ENODATA)
--- /dev/null
+From 6cd078702f2f33cb6b19a682de3e9184112f1a46 Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Thu, 18 Oct 2018 09:45:49 +0300
+Subject: ovl: fix recursive oi->lock in ovl_link()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 6cd078702f2f33cb6b19a682de3e9184112f1a46 upstream.
+
+linking a non-copied-up file into a non-copied-up parent results in a
+nested call to mutex_lock_interruptible(&oi->lock). Fix this by copying up
+target parent before ovl_nlink_start(), same as done in ovl_rename().
+
+~/unionmount-testsuite$ ./run --ov -s
+~/unionmount-testsuite$ ln /mnt/a/foo100 /mnt/a/dir100/
+
+ WARNING: possible recursive locking detected
+ --------------------------------------------
+ ln/1545 is trying to acquire lock:
+ 00000000bcce7c4c (&ovl_i_lock_key[depth]){+.+.}, at:
+ ovl_copy_up_start+0x28/0x7d
+ but task is already holding lock:
+ 0000000026d73d5b (&ovl_i_lock_key[depth]){+.+.}, at:
+ ovl_nlink_start+0x3c/0xc1
+
+[SzM: this seems to be a false positive, but doing the copy-up first is
+harmless and removes the lockdep splat]
+
+Reported-by: syzbot+3ef5c0d1a5cb0b21e6be@syzkaller.appspotmail.com
+Fixes: 5f8415d6b87e ("ovl: persistent overlay inode nlink for...")
+Cc: <stable@vger.kernel.org> # v4.13
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/dir.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -663,6 +663,10 @@ static int ovl_link(struct dentry *old,
+ if (err)
+ goto out_drop_write;
+
++ err = ovl_copy_up(new->d_parent);
++ if (err)
++ goto out_drop_write;
++
+ if (ovl_is_metacopy_dentry(old)) {
+ err = ovl_set_redirect(old, false);
+ if (err)
--- /dev/null
+From 8235f4b5aeba868739f6e12a51ad92689e3f78ef Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:19 -0700
+Subject: scsi: qla2xxx: Fix early srb free on abort
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 8235f4b5aeba868739f6e12a51ad92689e3f78ef upstream.
+
+Task abort can take 2 paths: 1) serial/synchronous abort where the calling
+thread will put to sleep, wait for completion and free cmd resource. 2) async
+abort where the cmd free will be free by the completion thread. For path 2,
+driver is freeing the SRB too early.
+
+Fixes: f6145e86d21f ("scsi: qla2xxx: Fix race between switch cmd completion and timeout")
+Cc: stable@vger.kernel.org # 4.19
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1788,6 +1788,8 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, b
+ wait_for_completion(&abt_iocb->u.abt.comp);
+ rval = abt_iocb->u.abt.comp_status == CS_COMPLETE ?
+ QLA_SUCCESS : QLA_FUNCTION_FAILED;
++ } else {
++ goto done;
+ }
+
+ done_free_sp:
--- /dev/null
+From bcc71cc3cde1468958a3ea859276d8d1a1a68265 Mon Sep 17 00:00:00 2001
+From: Giridhar Malavali <giridhar.malavali@cavium.com>
+Date: Wed, 26 Sep 2018 22:05:17 -0700
+Subject: scsi: qla2xxx: Fix for double free of SRB structure
+
+From: Giridhar Malavali <giridhar.malavali@cavium.com>
+
+commit bcc71cc3cde1468958a3ea859276d8d1a1a68265 upstream.
+
+This patch fixes issue during switch command query where driver was freeing
+SRB resources multiple times
+
+Following stack trace will be seen
+[ 853.436234] BUG: unable to handle kernel NULL pointer dereference at
+0000000000000001
+[ 853.436348] IP: [<ffffffff811df514>] kmem_cache_alloc+0x74/0x1e0
+[ 853.436476] PGD 0
+[ 853.436601] Oops: 0000 [#1] SMP
+
+[ 853.454700] [<ffffffff81099f6a>] ? mod_timer+0x14a/0x220
+[ 853.455543] [<ffffffff81185465>] mempool_alloc_slab+0x15/0x20
+[ 853.456395] [<ffffffff811855a9>] mempool_alloc+0x69/0x170
+[ 853.457257] [<ffffffff81098af2>] ? internal_add_timer+0x32/0x70
+[ 853.458136] [<ffffffffc0092d2b>] qla2xxx_queuecommand+0x29b/0x3f0 [qla2xxx]
+[ 853.459024] [<ffffffff8146535a>] scsi_dispatch_cmd+0xaa/0x230
+[ 853.459923] [<ffffffff8146e11f>] scsi_request_fn+0x4df/0x680
+[ 853.460829] [<ffffffff81029557>] ? __switch_to+0xd7/0x510
+[ 853.461747] [<ffffffff812f7113>] __blk_run_queue+0x33/0x40
+[ 853.462670] [<ffffffff812f7735>] blk_delay_work+0x25/0x40
+[ 853.463603] [<ffffffff810a882a>] process_one_work+0x17a/0x440
+[ 853.464546] [<ffffffff810a94f6>] worker_thread+0x126/0x3c0
+[ 853.465501] [<ffffffff810a93d0>] ? manage_workers.isra.24+0x2a0/0x2a0
+[ 853.466447] [<ffffffff810b099f>] kthread+0xcf/0xe0
+[ 853.467379] [<ffffffff810b08d0>] ? insert_kthread_work+0x40/0x40
+[ 853.470172] Code: db e2 7e 49 8b 50 08 4d 8b 20 49 8b 40 10 4d 85 e4 0f 84 20
+01 00 00 48 85 c0 0f 84 17 01 00 00 49 63 46 20 48 8d 4a 01 4d 8b 06 <49> 8b 1c
+04 4c 89 e0 65 49 0f c7 08 0f 94 c0 84 c0 74 ba 49 63
+[ 853.472072] RIP [<ffffffff811df514>] kmem_cache_alloc+0x74/0x1e0
+[ 853.472971] RSP <ffff88103726fc50>
+
+Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 3 +++
+ drivers/scsi/qla2xxx/qla_init.c | 15 +++++++++++++--
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3261,6 +3261,9 @@ static void qla24xx_async_gpsc_sp_done(v
+ "Async done-%s res %x, WWPN %8phC \n",
+ sp->name, res, fcport->port_name);
+
++ if (res == QLA_FUNCTION_TIMEOUT)
++ return;
++
+ if (res == (DID_ERROR << 16)) {
+ /* entry status error */
+ goto done;
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -52,12 +52,14 @@ qla2x00_sp_timeout(struct timer_list *t)
+ struct srb_iocb *iocb;
+ struct req_que *req;
+ unsigned long flags;
++ struct qla_hw_data *ha = sp->vha->hw;
+
+- spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
++ WARN_ON(irqs_disabled());
++ spin_lock_irqsave(&ha->hardware_lock, flags);
+ req = sp->qpair->req;
+ req->outstanding_cmds[sp->handle] = NULL;
+ iocb = &sp->u.iocb_cmd;
+- spin_unlock_irqrestore(sp->qpair->qp_lock_ptr, flags);
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ iocb->timeout(sp);
+ }
+
+@@ -972,6 +974,15 @@ void qla24xx_async_gpdb_sp_done(void *s,
+
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+
++ if (res == QLA_FUNCTION_TIMEOUT)
++ return;
++
++ if (res == QLA_FUNCTION_TIMEOUT) {
++ dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in,
++ sp->u.iocb_cmd.u.mbx.in_dma);
++ return;
++ }
++
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPDB_DONE;
+ ea.fcport = fcport;
--- /dev/null
+From 4c1458df9635c7e3ced155f594d2e7dfd7254e21 Mon Sep 17 00:00:00 2001
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+Date: Fri, 31 Aug 2018 11:24:27 -0700
+Subject: scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
+
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+
+commit 4c1458df9635c7e3ced155f594d2e7dfd7254e21 upstream.
+
+Fixes: 6246b8a1d26c7c ("[SCSI] qla2xxx: Enhancements to support ISP83xx.")
+Fixes: 1bb395485160d2 ("qla2xxx: Correct iiDMA-update calling conventions.")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3762,10 +3762,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *
+ mcp->mb[0] = MBC_PORT_PARAMS;
+ mcp->mb[1] = loop_id;
+ mcp->mb[2] = BIT_0;
+- if (IS_CNA_CAPABLE(vha->hw))
+- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+- else
+- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0);
++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+ mcp->mb[9] = vha->vp_idx;
+ mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0;
+ mcp->in_mb = MBX_3|MBX_1|MBX_0;
--- /dev/null
+From f7d61c995df74d6bb57bbff6a2b7b1874c4a2baa Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Wed, 26 Sep 2018 22:05:11 -0700
+Subject: scsi: qla2xxx: Fix NVMe session hang on unload
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit f7d61c995df74d6bb57bbff6a2b7b1874c4a2baa upstream.
+
+Send aborts only when chip is active.
+
+Fixes: 623ee824e579 ("scsi: qla2xxx: Fix FC-NVMe IO abort during driver reset")
+Cc: <stable@vger.kernel.org> # 4.14
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -607,7 +607,7 @@ void qla_nvme_abort(struct qla_hw_data *
+ {
+ int rval;
+
+- if (!test_bit(ABORT_ISP_ACTIVE, &sp->vha->dpc_flags)) {
++ if (ha->flags.fw_started) {
+ rval = ha->isp_ops->abort_command(sp);
+ if (!rval && !qla_nvme_wait_on_command(sp))
+ ql_log(ql_log_warn, NULL, 0x2112,
--- /dev/null
+From b86ac8fd4b2f6ec2f9ca9194c56eac12d620096f Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Fri, 31 Aug 2018 11:24:26 -0700
+Subject: scsi: qla2xxx: Fix process response queue for ISP26XX and above
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit b86ac8fd4b2f6ec2f9ca9194c56eac12d620096f upstream.
+
+This patch improves performance for 16G and above adapter by removing
+additional call to process_response_queue().
+
+[mkp: typo]
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 --
+ drivers/scsi/qla2xxx/qla_iocb.c | 17 -----------------
+ 2 files changed, 19 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -7142,7 +7142,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vh
+ }
+ icb->firmware_options_2 &= cpu_to_le32(
+ ~(BIT_3 | BIT_2 | BIT_1 | BIT_0));
+- vha->flags.process_response_queue = 0;
+ if (ha->zio_mode != QLA_ZIO_DISABLED) {
+ ha->zio_mode = QLA_ZIO_MODE_6;
+
+@@ -7153,7 +7152,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vh
+ icb->firmware_options_2 |= cpu_to_le32(
+ (uint32_t)ha->zio_mode);
+ icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer);
+- vha->flags.process_response_queue = 1;
+ }
+
+ if (rval) {
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return QLA_SUCCESS;
+@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+-
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+ return QLA_SUCCESS;
+
--- /dev/null
+From 5c6400536481d9ef44ef94e7bf2c7b8e81534db7 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Wed, 26 Sep 2018 22:05:14 -0700
+Subject: scsi: qla2xxx: Fix re-using LoopID when handle is in use
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 5c6400536481d9ef44ef94e7bf2c7b8e81534db7 upstream.
+
+This patch fixes issue where driver clears NPort ID map instead of marking
+handle in use. Once driver clears NPort ID from the database, it can reuse
+the same NPort ID resulting in a PLOGI failure.
+
+[mkp: fixed Himanshu's SoB]
+
+Fixes: a084fd68e1d2 ("scsi: qla2xxx: Fix re-login for Nport Handle in use")
+Cc: <stable@vger.kernel.org>
+Signed-of-by: Quinn Tran <quinn.tran@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Himanshu Madhani <hmadhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 18 ++++--------------
+ drivers/scsi/qla2xxx/qla_target.c | 3 ++-
+ 2 files changed, 6 insertions(+), 15 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1954,25 +1954,15 @@ qla24xx_handle_plogi_done_event(struct s
+ cid.b.rsvd_1 = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20ec,
+- "%s %d %8phC LoopID 0x%x in use post gnl\n",
++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n",
+ __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->loop_id);
++ ea->fcport->loop_id, cid.b24);
+
+- if (IS_SW_RESV_ADDR(cid)) {
+- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
+- ea->fcport->loop_id = FC_NO_LOOP_ID;
+- } else {
+- qla2x00_clear_loop_id(ea->fcport);
+- }
++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
++ ea->fcport->loop_id = FC_NO_LOOP_ID;
+ qla24xx_post_gnl_work(vha, ea->fcport);
+ break;
+ case MBS_PORT_ID_USED:
+- ql_dbg(ql_dbg_disc, vha, 0x20ed,
+- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n",
+- __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area,
+- ea->fcport->d_id.b.al_pa);
+-
+ lid = ea->iop[1] & 0xffff;
+ qlt_find_sess_invalidate_other(vha,
+ wwn_to_u64(ea->fcport->port_name),
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1261,7 +1261,8 @@ void qlt_schedule_sess_for_deletion(stru
+ qla24xx_chk_fcp_state(sess);
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
+- "Scheduling sess %p for deletion\n", sess);
++ "Scheduling sess %p for deletion %8phC\n",
++ sess, sess->port_name);
+
+ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
--- /dev/null
+From 56d942de59ebfa2e970a6cd33299d1984710b6c0 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:22 -0700
+Subject: scsi: qla2xxx: Reject bsg request if chip is down.
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 56d942de59ebfa2e970a6cd33299d1984710b6c0 upstream.
+
+Reject bsg request if chip is down. This prevent erroneous timeout.
+
+Fixes: d051a5aa1c23 ("[SCSI] qla2xxx: Add an "is reset active" helper.")
+Cc: stable@vger.kernel.org # 4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -2487,7 +2487,7 @@ qla24xx_bsg_request(struct bsg_job *bsg_
+ vha = shost_priv(host);
+ }
+
+- if (qla2x00_reset_active(vha)) {
++ if (qla2x00_chip_is_down(vha)) {
+ ql_dbg(ql_dbg_user, vha, 0x709f,
+ "BSG: ISP abort active/needed -- cmd=%d.\n",
+ bsg_request->msgcode);
--- /dev/null
+From 7c388f91ec1a59b0ed815b07b90536e2d57e1e1f Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:24 -0700
+Subject: scsi: qla2xxx: Remove stale debug trace message from tcm_qla2xxx
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 7c388f91ec1a59b0ed815b07b90536e2d57e1e1f upstream.
+
+Remove stale debug trace.
+
+Fixes: 1eb42f965ced ("qla2xxx: Make trace flags more readable")
+Cc: stable@vger.kernel.org #4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(stru
+ cmd->sg_cnt = 0;
+ cmd->offset = 0;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- if (cmd->trc_flags & TRC_XMIT_STATUS) {
+- pr_crit("Multiple calls for status = %p.\n", cmd);
+- dump_stack();
+- }
+ cmd->trc_flags |= TRC_XMIT_STATUS;
+
+ if (se_cmd->data_direction == DMA_FROM_DEVICE) {
--- /dev/null
+From 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 11 Sep 2018 10:18:21 -0700
+Subject: scsi: qla2xxx: shutdown chip if reset fail
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+commit 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 upstream.
+
+If chip unable to fully initialize, use full shutdown sequence to clear out
+any stale FW state.
+
+Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
+Cc: stable@vger.kernel.org #4.10
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -6684,7 +6684,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
+ * The next call disables the board
+ * completely.
+ */
+- ha->isp_ops->reset_adapter(vha);
++ qla2x00_abort_isp_cleanup(vha);
+ vha->flags.online = 0;
+ clear_bit(ISP_ABORT_RETRY,
+ &vha->dpc_flags);
--- /dev/null
+From 641a41dbba217ee5bd26abe6be77f8cead9cd00e Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Tue, 30 Oct 2018 15:13:35 +0900
+Subject: serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit 641a41dbba217ee5bd26abe6be77f8cead9cd00e upstream.
+
+This patch fixes an issue that the sci_remove() could not remove
+dev_attr_rx_fifo_timeout because uart_remove_one_port() set
+the port->port.type to PORT_UNKNOWN.
+
+Reported-by: Hiromitsu Yamasaki <hiromitsu.yamasaki.ym@renesas.com>
+Fixes: 5d23188a473d ("serial: sh-sci: make RX FIFO parameters tunable via sysfs")
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sh-sci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_drive
+ static int sci_remove(struct platform_device *dev)
+ {
+ struct sci_port *port = platform_get_drvdata(dev);
++ unsigned int type = port->port.type; /* uart_remove_... clears it */
+
+ sci_ports_in_use &= ~BIT(port->port.line);
+ uart_remove_one_port(&sci_uart_driver, &port->port);
+@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_de
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_trigger.attr);
+ }
+- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB ||
+- port->port.type == PORT_HSCIF) {
++ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) {
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_timeout.attr);
+ }
drm-amdgpu-fix-integer-overflow-test-in-amdgpu_bo_list_create.patch
media-ov5640-fix-restore-of-last-mode-set.patch
cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch
+ovl-fix-error-handling-in-ovl_verify_set_fh.patch
+ovl-fix-recursive-oi-lock-in-ovl_link.patch
+ovl-check-whiteout-in-ovl_create_over_whiteout.patch
+ovl-automatically-enable-redirect_dir-on-metacopy-on.patch
+serial-sh-sci-fix-could-not-remove-dev_attr_rx_fifo_timeout.patch
+scsi-qla2xxx-fix-incorrect-port-speed-being-set-for-fc-adapters.patch
+scsi-qla2xxx-fix-process-response-queue-for-isp26xx-and-above.patch
+scsi-qla2xxx-remove-stale-debug-trace-message-from-tcm_qla2xxx.patch
+scsi-qla2xxx-fix-early-srb-free-on-abort.patch
+scsi-qla2xxx-shutdown-chip-if-reset-fail.patch
+scsi-qla2xxx-reject-bsg-request-if-chip-is-down.patch
+scsi-qla2xxx-fix-re-using-loopid-when-handle-is-in-use.patch
+scsi-qla2xxx-fix-for-double-free-of-srb-structure.patch
+scsi-qla2xxx-fix-nvme-session-hang-on-unload.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
