--- /dev/null
+From 9ee755974bea2f9880e517ec985dc9dede1b3a36 Mon Sep 17 00:00:00 2001
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Fri, 23 May 2014 10:52:10 -0500
+Subject: ibmvscsi: Abort init sequence during error recovery
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 9ee755974bea2f9880e517ec985dc9dede1b3a36 upstream.
+
+If a CRQ reset is triggered for some reason while in the middle
+of performing VSCSI adapter initialization, we don't want to
+call the done function for the initialization MAD commands as
+this will only result in two threads attempting initialization
+at the same time, resulting in failures.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/ibmvscsi/ibmvscsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -797,7 +797,8 @@ static void purge_requests(struct ibmvsc
+ evt->hostdata->dev);
+ if (evt->cmnd_done)
+ evt->cmnd_done(evt->cmnd);
+- } else if (evt->done)
++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
+ evt->done(evt);
+ free_event_struct(&evt->hostdata->pool, evt);
+ spin_lock_irqsave(hostdata->host->host_lock, flags);
--- /dev/null
+From 7114aae02742d6b5c5a0d39a41deb61d415d3717 Mon Sep 17 00:00:00 2001
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Fri, 23 May 2014 10:52:11 -0500
+Subject: ibmvscsi: Add memory barriers for send / receive
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 7114aae02742d6b5c5a0d39a41deb61d415d3717 upstream.
+
+Add a memory barrier prior to sending a new command to the VIOS
+to ensure the VIOS does not receive stale data in the command buffer.
+Also add a memory barrier when processing the CRQ for completed commands.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/ibmvscsi/ibmvscsi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next
+ if (crq->valid & 0x80) {
+ if (++queue->cur == queue->size)
+ queue->cur = 0;
++
++ /* Ensure the read of the valid bit occurs before reading any
++ * other bits of the CRQ entry
++ */
++ rmb();
+ } else
+ crq = NULL;
+ spin_unlock_irqrestore(&queue->lock, flags);
+@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmv
+ {
+ struct vio_dev *vdev = to_vio_dev(hostdata->dev);
+
++ /*
++ * Ensure the command buffer is flushed to memory before handing it
++ * over to the VIOS to prevent it from fetching any stale data.
++ */
++ mb();
+ return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2);
+ }
+
--- /dev/null
+From 8922a908908ff947f1f211e07e2e97f1169ad3cb Mon Sep 17 00:00:00 2001
+From: Ulrich Obergfell <uobergfe@redhat.com>
+Date: Wed, 4 Jun 2014 13:34:57 +0200
+Subject: scsi_error: fix invalid setting of host byte
+
+From: Ulrich Obergfell <uobergfe@redhat.com>
+
+commit 8922a908908ff947f1f211e07e2e97f1169ad3cb upstream.
+
+After scsi_try_to_abort_cmd returns, the eh_abort_handler may have
+already found that the command has completed in the device, causing
+the host_byte to be nonzero (e.g. it could be DID_ABORT). When
+this happens, ORing DID_TIME_OUT into the host byte will corrupt
+the result field and initiate an unwanted command retry.
+
+Fix this by using set_host_byte instead, following the model of
+commit 2082ebc45af9c9c648383b8cde0dc1948eadbf31.
+
+Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com>
+[Fix all instances according to review comments. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_error.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct
+ "aborting command %p\n", scmd));
+ rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd);
+ if (rtn == SUCCESS) {
+- scmd->result |= DID_TIME_OUT << 16;
++ set_host_byte(scmd, DID_TIME_OUT);
+ if (scsi_host_eh_past_deadline(sdev->host)) {
+ SCSI_LOG_ERROR_RECOVERY(3,
+ scmd_printk(KERN_INFO, scmd,
+@@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct
+ scmd_printk(KERN_WARNING, scmd,
+ "scmd %p terminate "
+ "aborted command\n", scmd));
+- scmd->result |= DID_TIME_OUT << 16;
++ set_host_byte(scmd, DID_TIME_OUT);
+ scsi_finish_command(scmd);
+ }
+ }
+@@ -291,7 +291,7 @@ enum blk_eh_timer_return scsi_times_out(
+ if (scsi_abort_command(scmd) == SUCCESS)
+ return BLK_EH_NOT_HANDLED;
+
+- scmd->result |= DID_TIME_OUT << 16;
++ set_host_byte(scmd, DID_TIME_OUT);
+
+ if (unlikely(rtn == BLK_EH_NOT_HANDLED &&
+ !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)))
+@@ -1776,7 +1776,7 @@ int scsi_decide_disposition(struct scsi_
+ break;
+ case DID_ABORT:
+ if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) {
+- scmd->result |= DID_TIME_OUT << 16;
++ set_host_byte(scmd, DID_TIME_OUT);
+ return SUCCESS;
+ }
+ case DID_NO_CONNECT:
scsi-use-the-scsi-data-buffer-length-to-extract-transfer-size.patch
usb-storage-scsi-add-broken_fua-blacklist-flag.patch
+ibmvscsi-abort-init-sequence-during-error-recovery.patch
+ibmvscsi-add-memory-barriers-for-send-receive.patch
+virtio-scsi-avoid-cancelling-uninitialized-work-items.patch
+scsi_error-fix-invalid-setting-of-host-byte.patch
+virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch
--- /dev/null
+From cdda0e5acbb78f7b777049f8c27899e5c5bb368f Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 4 Jun 2014 13:34:56 +0200
+Subject: virtio-scsi: avoid cancelling uninitialized work items
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit cdda0e5acbb78f7b777049f8c27899e5c5bb368f upstream.
+
+Calling the workqueue interface on uninitialized work items isn't a
+good idea even if they're zeroed. It's not failing catastrophically only
+through happy accidents.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/virtio_scsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -291,6 +291,8 @@ static void virtscsi_ctrl_done(struct vi
+ virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free);
+ };
+
++static void virtscsi_handle_event(struct work_struct *work);
++
+ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
+ struct virtio_scsi_event_node *event_node)
+ {
+@@ -298,6 +300,7 @@ static int virtscsi_kick_event(struct vi
+ struct scatterlist sg;
+ unsigned long flags;
+
++ INIT_WORK(&event_node->work, virtscsi_handle_event);
+ sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
+
+ spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
+@@ -415,7 +418,6 @@ static void virtscsi_complete_event(stru
+ {
+ struct virtio_scsi_event_node *event_node = buf;
+
+- INIT_WORK(&event_node->work, virtscsi_handle_event);
+ schedule_work(&event_node->work);
+ }
+
--- /dev/null
+From 8faeb529b2dabb9df691d614dda18910a43d05c9 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 4 Jun 2014 13:34:58 +0200
+Subject: virtio-scsi: fix various bad behavior on aborted requests
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 8faeb529b2dabb9df691d614dda18910a43d05c9 upstream.
+
+Even though the virtio-scsi spec guarantees that all requests related
+to the TMF will have been completed by the time the TMF itself completes,
+the request queue's callback might not have run yet. This causes requests
+to be completed more than once, and as a result triggers a variety of
+BUGs or oopses.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Venkatesh Srinivas <venkateshs@google.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/virtio_scsi.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -273,6 +273,16 @@ static void virtscsi_req_done(struct vir
+ virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd);
+ };
+
++static void virtscsi_poll_requests(struct virtio_scsi *vscsi)
++{
++ int i, num_vqs;
++
++ num_vqs = vscsi->num_queues;
++ for (i = 0; i < num_vqs; i++)
++ virtscsi_vq_done(vscsi, &vscsi->req_vqs[i],
++ virtscsi_complete_cmd);
++}
++
+ static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf)
+ {
+ struct virtio_scsi_cmd *cmd = buf;
+@@ -607,6 +617,18 @@ static int virtscsi_tmf(struct virtio_sc
+ cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED)
+ ret = SUCCESS;
+
++ /*
++ * The spec guarantees that all requests related to the TMF have
++ * been completed, but the callback might not have run yet if
++ * we're using independent interrupts (e.g. MSI). Poll the
++ * virtqueues once.
++ *
++ * In the abort case, sc->scsi_done will do nothing, because
++ * the block layer must have detected a timeout and as a result
++ * REQ_ATOM_COMPLETE has been set.
++ */
++ virtscsi_poll_requests(vscsi);
++
+ out:
+ mempool_free(cmd, virtscsi_cmd_pool);
+ return ret;
projects / thirdparty / kernel / stable-queue.git / commitdiff
