--- /dev/null
+From 693026ef2e751fd94d2e6c71028e68343cc875d5 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sun, 9 Jun 2013 18:53:58 +0200
+Subject: b43: ensue that BCMA is "y" when B43 is "y"
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+commit 693026ef2e751fd94d2e6c71028e68343cc875d5 upstream.
+
+When b43 gets build into the kernel and it should use bcma we have to
+ensure that bcma was also build into the kernel and not as a module.
+In this patch this is also done for SSB, although you can not
+build b43 without ssb support for now.
+
+This fixes a build problem reported by Randy Dunlap in
+5187EB95.2060605@infradead.org
+
+Reported-By: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/Kconfig
++++ b/drivers/net/wireless/b43/Kconfig
+@@ -28,7 +28,7 @@ config B43
+
+ config B43_BCMA
+ bool "Support for BCMA bus"
+- depends on B43 && BCMA
++ depends on B43 && (BCMA = y || BCMA = B43)
+ default y
+
+ config B43_BCMA_EXTRA
+@@ -39,7 +39,7 @@ config B43_BCMA_EXTRA
+
+ config B43_SSB
+ bool
+- depends on B43 && SSB
++ depends on B43 && (SSB = y || SSB = B43)
+ default y
+
+ # Auto-select SSB PCI-HOST support, if possible
--- /dev/null
+From c5bebd829dd95602c15f8da8cc50fa938b5e0254 Mon Sep 17 00:00:00 2001
+From: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
+Date: Tue, 18 Jun 2013 17:02:07 +0530
+Subject: SCSI: aacraid: Fix for arrays are going offline in the system. System hangs
+
+From: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
+
+commit c5bebd829dd95602c15f8da8cc50fa938b5e0254 upstream.
+
+One of the customer had reported that the set of raid logical arrays will
+become unavailable (I/O offline) after a long hours of IO stress test. The OS
+wouldn`t be accessible afterwards and require a hard reset.
+
+This driver patch has a fix for race condition between the doorbell and the
+circular buffer. The driver is modified to do an extra read after clearing the
+doorbell in case there had been a completion posted during the small timing
+window.
+
+With this fix, we ran IO stress for ~13 days. There were no IO failures.
+
+Signed-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/aacraid/src.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/aacraid/src.c
++++ b/drivers/scsi/aacraid/src.c
+@@ -93,6 +93,9 @@ static irqreturn_t aac_src_intr_message(
+ int send_it = 0;
+ extern int aac_sync_mode;
+
++ src_writel(dev, MUnit.ODR_C, bellbits);
++ src_readl(dev, MUnit.ODR_C);
++
+ if (!aac_sync_mode) {
+ src_writel(dev, MUnit.ODR_C, bellbits);
+ src_readl(dev, MUnit.ODR_C);
--- /dev/null
+From 48ba2efc382f94fae16ca8ca011e5961a81ad1ea Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
+Date: Sat, 2 Feb 2013 00:58:20 +0530
+Subject: SCSI: mpt2sas: fix firmware failure with wrong task attribute
+
+From: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
+
+commit 48ba2efc382f94fae16ca8ca011e5961a81ad1ea upstream.
+
+When SCSI command is received with task attribute not set, set it to SIMPLE.
+Previously it is set to untagged. This causes the firmware to fail the commands.
+
+Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -3994,11 +3994,7 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd,
+ else
+ mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ } else
+-/* MPI Revision I (UNIT = 0xA) - removed MPI2_SCSIIO_CONTROL_UNTAGGED */
+-/* mpi_control |= MPI2_SCSIIO_CONTROL_UNTAGGED;
+- */
+- mpi_control |= (0x500);
+-
++ mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ } else
+ mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
+ /* Make sure Device is not raid volume.
--- /dev/null
+From b0df96a0068daee4f9c2189c29b9053eb6e46b17 Mon Sep 17 00:00:00 2001
+From: "Reddy, Sreekanth" <Sreekanth.Reddy@lsi.com>
+Date: Tue, 26 Feb 2013 16:59:59 +0530
+Subject: SCSI: mpt2sas: Fix for issue Missing delay not getting set during system bootup
+
+From: "Reddy, Sreekanth" <Sreekanth.Reddy@lsi.com>
+
+commit b0df96a0068daee4f9c2189c29b9053eb6e46b17 upstream.
+
+Missing delay is not getting set properly. The reason is that it is not
+defined in the same file from where it is being invoked. The fix is to move
+the missing delay module parameter from mpt2sas_base.c to mpt2sas_scsh.c.
+
+Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 13 +++----------
+ drivers/scsi/mpt2sas/mpt2sas_base.h | 3 +++
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +++++++-
+ 3 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -80,10 +80,6 @@ static int msix_disable = -1;
+ module_param(msix_disable, int, 0);
+ MODULE_PARM_DESC(msix_disable, " disable msix routed interrupts (default=0)");
+
+-static int missing_delay[2] = {-1, -1};
+-module_param_array(missing_delay, int, NULL, 0);
+-MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay");
+-
+ static int mpt2sas_fwfault_debug;
+ MODULE_PARM_DESC(mpt2sas_fwfault_debug, " enable detection of firmware fault "
+ "and halt firmware - (default=0)");
+@@ -2199,7 +2195,7 @@ _base_display_ioc_capabilities(struct MP
+ }
+
+ /**
+- * _base_update_missing_delay - change the missing delay timers
++ * mpt2sas_base_update_missing_delay - change the missing delay timers
+ * @ioc: per adapter object
+ * @device_missing_delay: amount of time till device is reported missing
+ * @io_missing_delay: interval IO is returned when there is a missing device
+@@ -2210,8 +2206,8 @@ _base_display_ioc_capabilities(struct MP
+ * delay, as well as the io missing delay. This should be called at driver
+ * load time.
+ */
+-static void
+-_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
++void
++mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
+ u16 device_missing_delay, u8 io_missing_delay)
+ {
+ u16 dmd, dmd_new, dmd_orignal;
+@@ -4407,9 +4403,6 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPT
+ if (r)
+ goto out_free_resources;
+
+- if (missing_delay[0] != -1 && missing_delay[1] != -1)
+- _base_update_missing_delay(ioc, missing_delay[0],
+- missing_delay[1]);
+ ioc->non_operational_loop = 0;
+
+ return 0;
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
+@@ -1055,6 +1055,9 @@ void mpt2sas_base_validate_event_type(st
+
+ void mpt2sas_halt_firmware(struct MPT2SAS_ADAPTER *ioc);
+
++void mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc,
++ u16 device_missing_delay, u8 io_missing_delay);
++
+ int mpt2sas_port_enable(struct MPT2SAS_ADAPTER *ioc);
+
+ /* scsih shared API */
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -101,6 +101,10 @@ static ushort max_sectors = 0xFFFF;
+ module_param(max_sectors, ushort, 0);
+ MODULE_PARM_DESC(max_sectors, "max sectors, range 64 to 32767 default=32767");
+
++static int missing_delay[2] = {-1, -1};
++module_param_array(missing_delay, int, NULL, 0);
++MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay");
++
+ /* scsi-mid layer global parmeter is max_report_luns, which is 511 */
+ #define MPT2SAS_MAX_LUN (16895)
+ static int max_lun = MPT2SAS_MAX_LUN;
+@@ -7299,7 +7303,9 @@ _firmware_event_work(struct work_struct
+ case MPT2SAS_PORT_ENABLE_COMPLETE:
+ ioc->start_scan = 0;
+
+-
++ if (missing_delay[0] != -1 && missing_delay[1] != -1)
++ mpt2sas_base_update_missing_delay(ioc, missing_delay[0],
++ missing_delay[1]);
+
+ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "port enable: complete "
+ "from worker thread\n", ioc->name));
--- /dev/null
+From 66c28f97120e8a621afd5aa7a31c4b85c547d33d Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Thu, 6 Jun 2013 22:15:55 -0400
+Subject: SCSI: sd: Update WRITE SAME heuristics
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 66c28f97120e8a621afd5aa7a31c4b85c547d33d upstream.
+
+SATA drives located behind a SAS controller would incorrectly receive
+WRITE SAME commands. Tweak the heuristics so that:
+
+ - If REPORT SUPPORTED OPERATION CODES is provided we will use that to
+ choose between WRITE SAME(16), WRITE SAME(10) and disabled. This also
+ fixes an issue with the old code which would issue WRITE SAME(10)
+ despite the command not being whitelisted in REPORT SUPPORTED
+ OPERATION CODES.
+
+ - If REPORT SUPPORTED OPERATION CODES is not provided we will fall back
+ to WRITE SAME(10) unless the device has an ATA Information VPD page.
+ The assumption is that a SATL which is smart enough to implement
+ WRITE SAME would also provide REPORT SUPPORTED OPERATION CODES.
+
+To facilitate the new heuristics scsi_report_opcode() has been modified
+to so we can distinguish between "operation not supported" and "RSOC not
+supported".
+
+Reported-by: H. Peter Anvin <hpa@zytor.com>
+Tested-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi.c | 8 ++++----
+ drivers/scsi/sd.c | 46 ++++++++++++++++++++++++++++++++--------------
+ drivers/scsi/sd.h | 1 +
+ 3 files changed, 37 insertions(+), 18 deletions(-)
+
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -1070,8 +1070,8 @@ EXPORT_SYMBOL_GPL(scsi_get_vpd_page);
+ * @opcode: opcode for command to look up
+ *
+ * Uses the REPORT SUPPORTED OPERATION CODES to look up the given
+- * opcode. Returns 0 if RSOC fails or if the command opcode is
+- * unsupported. Returns 1 if the device claims to support the command.
++ * opcode. Returns -EINVAL if RSOC fails, 0 if the command opcode is
++ * unsupported and 1 if the device claims to support the command.
+ */
+ int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+ unsigned int len, unsigned char opcode)
+@@ -1081,7 +1081,7 @@ int scsi_report_opcode(struct scsi_devic
+ int result;
+
+ if (sdev->no_report_opcodes || sdev->scsi_level < SCSI_SPC_3)
+- return 0;
++ return -EINVAL;
+
+ memset(cmd, 0, 16);
+ cmd[0] = MAINTENANCE_IN;
+@@ -1097,7 +1097,7 @@ int scsi_report_opcode(struct scsi_devic
+ if (result && scsi_sense_valid(&sshdr) &&
+ sshdr.sense_key == ILLEGAL_REQUEST &&
+ (sshdr.asc == 0x20 || sshdr.asc == 0x24) && sshdr.ascq == 0x00)
+- return 0;
++ return -EINVAL;
+
+ if ((buffer[1] & 3) == 3) /* Command supported */
+ return 1;
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -442,8 +442,10 @@ sd_store_write_same_blocks(struct device
+
+ if (max == 0)
+ sdp->no_write_same = 1;
+- else if (max <= SD_MAX_WS16_BLOCKS)
++ else if (max <= SD_MAX_WS16_BLOCKS) {
++ sdp->no_write_same = 0;
+ sdkp->max_ws_blocks = max;
++ }
+
+ sd_config_write_same(sdkp);
+
+@@ -740,7 +742,6 @@ static void sd_config_write_same(struct
+ {
+ struct request_queue *q = sdkp->disk->queue;
+ unsigned int logical_block_size = sdkp->device->sector_size;
+- unsigned int blocks = 0;
+
+ if (sdkp->device->no_write_same) {
+ sdkp->max_ws_blocks = 0;
+@@ -752,18 +753,20 @@ static void sd_config_write_same(struct
+ * blocks per I/O unless the device explicitly advertises a
+ * bigger limit.
+ */
+- if (sdkp->max_ws_blocks == 0)
+- sdkp->max_ws_blocks = SD_MAX_WS10_BLOCKS;
+-
+- if (sdkp->ws16 || sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS)
+- blocks = min_not_zero(sdkp->max_ws_blocks,
+- (u32)SD_MAX_WS16_BLOCKS);
+- else
+- blocks = min_not_zero(sdkp->max_ws_blocks,
+- (u32)SD_MAX_WS10_BLOCKS);
++ if (sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS)
++ sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks,
++ (u32)SD_MAX_WS16_BLOCKS);
++ else if (sdkp->ws16 || sdkp->ws10 || sdkp->device->no_report_opcodes)
++ sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks,
++ (u32)SD_MAX_WS10_BLOCKS);
++ else {
++ sdkp->device->no_write_same = 1;
++ sdkp->max_ws_blocks = 0;
++ }
+
+ out:
+- blk_queue_max_write_same_sectors(q, blocks * (logical_block_size >> 9));
++ blk_queue_max_write_same_sectors(q, sdkp->max_ws_blocks *
++ (logical_block_size >> 9));
+ }
+
+ /**
+@@ -2635,9 +2638,24 @@ static void sd_read_block_provisioning(s
+
+ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
+ {
+- if (scsi_report_opcode(sdkp->device, buffer, SD_BUF_SIZE,
+- WRITE_SAME_16))
++ struct scsi_device *sdev = sdkp->device;
++
++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
++ sdev->no_report_opcodes = 1;
++
++ /* Disable WRITE SAME if REPORT SUPPORTED OPERATION
++ * CODES is unsupported and the device has an ATA
++ * Information VPD page (SAT).
++ */
++ if (!scsi_get_vpd_page(sdev, 0x89, buffer, SD_BUF_SIZE))
++ sdev->no_write_same = 1;
++ }
++
++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME_16) == 1)
+ sdkp->ws16 = 1;
++
++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME) == 1)
++ sdkp->ws10 = 1;
+ }
+
+ static int sd_try_extended_inquiry(struct scsi_device *sdp)
+--- a/drivers/scsi/sd.h
++++ b/drivers/scsi/sd.h
+@@ -84,6 +84,7 @@ struct scsi_disk {
+ unsigned lbpws : 1;
+ unsigned lbpws10 : 1;
+ unsigned lbpvpd : 1;
++ unsigned ws10 : 1;
+ unsigned ws16 : 1;
+ };
+ #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev)
--- /dev/null
+From 5fea4291deacd80188b996d2f555fc6a1940e5d4 Mon Sep 17 00:00:00 2001
+From: Steffen Maier <maier@linux.vnet.ibm.com>
+Date: Fri, 26 Apr 2013 17:33:45 +0200
+Subject: SCSI: zfcp: block queue limits with data router
+
+From: Steffen Maier <maier@linux.vnet.ibm.com>
+
+commit 5fea4291deacd80188b996d2f555fc6a1940e5d4 upstream.
+
+Commit 86a9668a8d29ea711613e1cb37efa68e7c4db564
+"[SCSI] zfcp: support for hardware data router"
+reduced the initial block queue limits in the scsi_host_template to the
+absolute minimum and adjusted them later on. However, the adjustment was
+too late for the BSG devices of Scsi_Host and fc_host.
+
+Therefore, ioctl(..., SG_IO, ...) with request or response size > 4kB to a
+BSG device of an fc_host or a Scsi_Host fails with EINVAL. As a result,
+users of such ioctl such as HBA_SendCTPassThru() in libzfcphbaapi return
+with error HBA_STATUS_ERROR.
+
+Initialize the block queue limits in zfcp_scsi_host_template to the
+greatest common denominator (GCD).
+
+While we cannot exploit the slightly enlarged maximum request size with
+data router, this should be neglectible. Doing so also avoids running into
+trouble after live guest relocation (LGR) / migration from a data router
+FCP device to an FCP device that does not support data router. In that
+case, zfcp would figure out the new limits on adapter recovery, but the
+fc_host and Scsi_Host (plus in fact all sdevs) still exist with the old and
+now too large queue limits.
+
+It should also OK, not to use half the size as in the DIX case, because
+fc_host and Scsi_Host do not transport FCP requests including SCSI commands
+using protection data.
+
+Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
+Reviewed-by: Martin Peschke <mpeschke@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/scsi/zfcp_scsi.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -3,7 +3,7 @@
+ *
+ * Interface to Linux SCSI midlayer.
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -311,8 +311,12 @@ static struct scsi_host_template zfcp_sc
+ .proc_name = "zfcp",
+ .can_queue = 4096,
+ .this_id = -1,
+- .sg_tablesize = 1, /* adjusted later */
+- .max_sectors = 8, /* adjusted later */
++ .sg_tablesize = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
++ * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2),
++ /* GCD, adjusted later */
++ .max_sectors = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
++ * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
++ /* GCD, adjusted later */
+ .dma_boundary = ZFCP_QDIO_SBALE_LEN - 1,
+ .cmd_per_lun = 1,
+ .use_clustering = 1,
--- /dev/null
+From f76ccaac4f82c463a037aa4a1e4ccb85c7011814 Mon Sep 17 00:00:00 2001
+From: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com>
+Date: Fri, 26 Apr 2013 17:32:14 +0200
+Subject: SCSI: zfcp: fix adapter (re)open recovery while link to SAN is down
+
+From: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com>
+
+commit f76ccaac4f82c463a037aa4a1e4ccb85c7011814 upstream.
+
+FCP device remains in status ERP_FAILED when device is switched online
+or adapter recovery is triggered while link to SAN is down.
+
+When Exchange Configuration Data command returns the FSF status
+FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE it aborts the exchange process.
+The only retries are done during the common error recovery procedure
+(i.e. max. 3 retries with 8sec sleep between) and remains in status
+ERP_FAILED with QDIO down.
+
+This commit reverts the commit 0df138476c8306478d6e726f044868b4bccf411c
+(zfcp: Fix adapter activation on link down).
+When FSF status FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE is received the
+adapter recovery will be finished without any retries. QDIO will be
+up now and status changes such as LINK UP will be received now.
+
+Signed-off-by: Daniel Hansel <daniel.hansel@linux.vnet.ibm.com>
+Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/scsi/zfcp_fsf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -563,6 +563,10 @@ static void zfcp_fsf_exchange_config_dat
+ fc_host_port_type(shost) = FC_PORTTYPE_UNKNOWN;
+ adapter->hydra_version = 0;
+
++ /* avoids adapter shutdown to be able to recognize
++ * events such as LINK UP */
++ atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK,
++ &adapter->status);
+ zfcp_fsf_link_down_info_eval(req,
+ &qtcb->header.fsf_status_qual.link_down_info);
+ break;
--- /dev/null
+From 9edf7d75ee5f21663a0183d21f702682d0ef132f Mon Sep 17 00:00:00 2001
+From: Steffen Maier <maier@linux.vnet.ibm.com>
+Date: Fri, 26 Apr 2013 17:34:54 +0200
+Subject: SCSI: zfcp: status read buffers on first adapter open with link down
+
+From: Steffen Maier <maier@linux.vnet.ibm.com>
+
+commit 9edf7d75ee5f21663a0183d21f702682d0ef132f upstream.
+
+Commit 64deb6efdc5504ce97b5c1c6f281fffbc150bd93
+"[SCSI] zfcp: Use status_read_buf_num provided by FCP channel"
+started using a value returned by the channel but only evaluated the value
+if the fabric link is up.
+Commit 8d88cf3f3b9af4713642caeb221b6d6a42019001
+"[SCSI] zfcp: Update status read mempool"
+introduced mempool resizings based on the above value.
+On setting an FCP device online for the very first time since boot, a new
+zeroed adapter object is allocated. If the link is down, the number of
+status read requests remains zero. Since just the config data exchange is
+incomplete, we proceed with adapter open recovery. However, we
+unconditionally call mempool_resize with adapter->stat_read_buf_num == 0 in
+this case.
+
+This causes a kernel message "kernel BUG at mm/mempool.c:131!" in process
+"zfcperp<FCP-device-bus-ID>" with last function mempool_resize in Krnl PSW
+and zfcp_erp_thread in the Call Trace.
+
+Don't evaluate channel values which are invalid on link down. The number of
+status read requests is always valid, evaluated, and set to a positive
+minimum greater than zero. The adapter open recovery can proceed and the
+channel has status read buffers to inform us on a future link up event.
+While we are not aware of any other code path that could result in mempool
+resize attempts of size zero, we still also initialize the number of status
+read buffers to be posted to a static minimum number on adapter object
+allocation.
+
+Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/scsi/zfcp_aux.c | 5 ++++-
+ drivers/s390/scsi/zfcp_fsf.c | 23 ++++++++++++++++-------
+ 2 files changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -3,7 +3,7 @@
+ *
+ * Module interface and handling of zfcp data structures.
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+ */
+
+ /*
+@@ -23,6 +23,7 @@
+ * Christof Schmitt
+ * Martin Petermann
+ * Sven Schuetz
++ * Steffen Maier
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -415,6 +416,8 @@ struct zfcp_adapter *zfcp_adapter_enqueu
+ adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
+ adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
+
++ adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
++
+ if (!zfcp_scsi_adapter_register(adapter))
+ return adapter;
+
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -3,7 +3,7 @@
+ *
+ * Implementation of FSF commands.
+ *
+- * Copyright IBM Corp. 2002, 2010
++ * Copyright IBM Corp. 2002, 2013
+ */
+
+ #define KMSG_COMPONENT "zfcp"
+@@ -483,12 +483,8 @@ static int zfcp_fsf_exchange_config_eval
+
+ fc_host_port_name(shost) = nsp->fl_wwpn;
+ fc_host_node_name(shost) = nsp->fl_wwnn;
+- fc_host_port_id(shost) = ntoh24(bottom->s_id);
+- fc_host_speed(shost) =
+- zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
+ fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+
+- adapter->hydra_version = bottom->adapter_type;
+ adapter->timer_ticks = bottom->timer_interval & ZFCP_FSF_TIMER_INT_MASK;
+ adapter->stat_read_buf_num = max(bottom->status_read_buf_num,
+ (u16)FSF_STATUS_READS_RECOM);
+@@ -496,6 +492,19 @@ static int zfcp_fsf_exchange_config_eval
+ if (fc_host_permanent_port_name(shost) == -1)
+ fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
+
++ zfcp_scsi_set_prot(adapter);
++
++ /* no error return above here, otherwise must fix call chains */
++ /* do not evaluate invalid fields */
++ if (req->qtcb->header.fsf_status == FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE)
++ return 0;
++
++ fc_host_port_id(shost) = ntoh24(bottom->s_id);
++ fc_host_speed(shost) =
++ zfcp_fsf_convert_portspeed(bottom->fc_link_speed);
++
++ adapter->hydra_version = bottom->adapter_type;
++
+ switch (bottom->fc_topology) {
+ case FSF_TOPO_P2P:
+ adapter->peer_d_id = ntoh24(bottom->peer_d_id);
+@@ -517,8 +526,6 @@ static int zfcp_fsf_exchange_config_eval
+ return -EIO;
+ }
+
+- zfcp_scsi_set_prot(adapter);
+-
+ return 0;
+ }
+
+@@ -569,6 +576,8 @@ static void zfcp_fsf_exchange_config_dat
+ &adapter->status);
+ zfcp_fsf_link_down_info_eval(req,
+ &qtcb->header.fsf_status_qual.link_down_info);
++ if (zfcp_fsf_exchange_config_evaluate(req))
++ return;
+ break;
+ default:
+ zfcp_erp_adapter_shutdown(adapter, 0, "fsecdh3");
ath9k_hw-assign-default-xlna-config-for-ar9485.patch
ath9k-fix-noisefloor-calibration.patch
ath9k-do-not-assign-noise-for-null-caldata.patch
+scsi-sd-update-write-same-heuristics.patch
+scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch
+scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch
+scsi-zfcp-block-queue-limits-with-data-router.patch
+scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch
+scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch
+scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch
+sunrpc-fix-races-on-pipefs-mount-notifications.patch
+sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch
+sunrpc-fix-races-on-pipefs-umount-notifications.patch
+virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch
+b43-ensue-that-bcma-is-y-when-b43-is-y.patch
--- /dev/null
+From 384816051ca9125cd54750e59c780c2a2655fa4f Mon Sep 17 00:00:00 2001
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Date: Mon, 24 Jun 2013 11:52:38 +0400
+Subject: SUNRPC: fix races on PipeFS MOUNT notifications
+
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+
+commit 384816051ca9125cd54750e59c780c2a2655fa4f upstream.
+
+Below are races, when RPC client can be created without PiepFS dentries
+
+CPU#0 CPU#1
+----------------------------- -----------------------------
+rpc_new_client rpc_fill_super
+rpc_setup_pipedir
+mutex_lock(&sn->pipefs_sb_lock)
+rpc_get_sb_net == NULL
+(no per-net PipeFS superblock)
+ sn->pipefs_sb = sb;
+ notifier_call_chain(MOUNT)
+ (client is not in the list)
+rpc_register_client
+(client without pipes dentries)
+
+To fix this patch:
+1) makes PipeFS mount notification call with pipefs_sb_lock being held.
+2) releases pipefs_sb_lock on new SUNRPC client creation only after
+registration.
+
+Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 26 +++++++++++++++-----------
+ net/sunrpc/rpc_pipe.c | 3 +++
+ 2 files changed, 18 insertions(+), 11 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -157,20 +157,15 @@ static struct dentry *rpc_setup_pipedir_
+ }
+
+ static int
+-rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
++rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name,
++ struct super_block *pipefs_sb)
+ {
+- struct net *net = rpc_net_ns(clnt);
+- struct super_block *pipefs_sb;
+ struct dentry *dentry;
+
+ clnt->cl_dentry = NULL;
+ if (dir_name == NULL)
+ return 0;
+- pipefs_sb = rpc_get_sb_net(net);
+- if (!pipefs_sb)
+- return 0;
+ dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt, dir_name);
+- rpc_put_sb_net(net);
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
+ clnt->cl_dentry = dentry;
+@@ -296,6 +291,7 @@ static struct rpc_clnt * rpc_new_client(
+ struct rpc_clnt *clnt = NULL;
+ struct rpc_auth *auth;
+ int err;
++ struct super_block *pipefs_sb;
+
+ /* sanity check the name before trying to print it */
+ dprintk("RPC: creating %s client for %s (xprt %p)\n",
+@@ -354,9 +350,12 @@ static struct rpc_clnt * rpc_new_client(
+
+ atomic_set(&clnt->cl_count, 1);
+
+- err = rpc_setup_pipedir(clnt, program->pipe_dir_name);
+- if (err < 0)
+- goto out_no_path;
++ pipefs_sb = rpc_get_sb_net(rpc_net_ns(clnt));
++ if (pipefs_sb) {
++ err = rpc_setup_pipedir(clnt, program->pipe_dir_name, pipefs_sb);
++ if (err)
++ goto out_no_path;
++ }
+
+ auth = rpcauth_create(args->authflavor, clnt);
+ if (IS_ERR(auth)) {
+@@ -369,11 +368,16 @@ static struct rpc_clnt * rpc_new_client(
+ /* save the nodename */
+ rpc_clnt_set_nodename(clnt, utsname()->nodename);
+ rpc_register_client(clnt);
++ if (pipefs_sb)
++ rpc_put_sb_net(rpc_net_ns(clnt));
+ return clnt;
+
+ out_no_auth:
+- rpc_clnt_remove_pipedir(clnt);
++ if (pipefs_sb)
++ __rpc_clnt_remove_pipedir(clnt);
+ out_no_path:
++ if (pipefs_sb)
++ rpc_put_sb_net(rpc_net_ns(clnt));
+ kfree(clnt->cl_principal);
+ out_no_principal:
+ rpc_free_iostats(clnt->cl_metrics);
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1126,6 +1126,7 @@ rpc_fill_super(struct super_block *sb, v
+ return -ENOMEM;
+ dprintk("RPC: sending pipefs MOUNT notification for net %p%s\n",
+ net, NET_NAME(net));
++ mutex_lock(&sn->pipefs_sb_lock);
+ sn->pipefs_sb = sb;
+ err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
+ RPC_PIPEFS_MOUNT,
+@@ -1133,6 +1134,7 @@ rpc_fill_super(struct super_block *sb, v
+ if (err)
+ goto err_depopulate;
+ sb->s_fs_info = get_net(net);
++ mutex_unlock(&sn->pipefs_sb_lock);
+ return 0;
+
+ err_depopulate:
+@@ -1141,6 +1143,7 @@ err_depopulate:
+ sb);
+ sn->pipefs_sb = NULL;
+ __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
++ mutex_unlock(&sn->pipefs_sb_lock);
+ return err;
+ }
+
--- /dev/null
+From adb6fa7ffe9031857ec14b8aab75c9ab65556cbc Mon Sep 17 00:00:00 2001
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Date: Wed, 26 Jun 2013 10:15:14 +0400
+Subject: SUNRPC: fix races on PipeFS UMOUNT notifications
+
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+
+commit adb6fa7ffe9031857ec14b8aab75c9ab65556cbc upstream.
+
+CPU#0 CPU#1
+----------------------------- -----------------------------
+rpc_kill_sb
+sn->pipefs_sb = NULL rpc_release_client
+(UMOUNT_EVENT) rpc_free_auth
+rpc_pipefs_event
+rpc_get_client_for_event
+!atomic_inc_not_zero(cl_count)
+<skip the client>
+ atomic_inc(cl_count)
+ rpc_free_client
+ rpc_clnt_remove_pipedir
+ <skip client dir removing>
+
+To fix this, this patch does the following:
+
+1) Calls RPC_PIPEFS_UMOUNT notification with sn->pipefs_sb_lock being held.
+2) Removes SUNRPC client from the list AFTER pipes destroying.
+3) Doesn't hold RPC client on notification: if client in the list, then it
+can't be destroyed while sn->pipefs_sb_lock in hold by notification caller.
+
+Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 5 +----
+ net/sunrpc/rpc_pipe.c | 2 +-
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -238,8 +238,6 @@ static struct rpc_clnt *rpc_get_client_f
+ continue;
+ if (rpc_clnt_skip_event(clnt, event))
+ continue;
+- if (atomic_inc_not_zero(&clnt->cl_count) == 0)
+- continue;
+ spin_unlock(&sn->rpc_client_lock);
+ return clnt;
+ }
+@@ -256,7 +254,6 @@ static int rpc_pipefs_event(struct notif
+
+ while ((clnt = rpc_get_client_for_event(sb->s_fs_info, event))) {
+ error = __rpc_pipefs_event(clnt, event, sb);
+- rpc_release_client(clnt);
+ if (error)
+ break;
+ }
+@@ -643,8 +640,8 @@ rpc_free_client(struct rpc_clnt *clnt)
+ rcu_dereference(clnt->cl_xprt)->servername);
+ if (clnt->cl_parent != clnt)
+ rpc_release_client(clnt->cl_parent);
+- rpc_unregister_client(clnt);
+ rpc_clnt_remove_pipedir(clnt);
++ rpc_unregister_client(clnt);
+ rpc_free_iostats(clnt->cl_metrics);
+ kfree(clnt->cl_principal);
+ clnt->cl_metrics = NULL;
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1165,12 +1165,12 @@ static void rpc_kill_sb(struct super_blo
+ goto out;
+ }
+ sn->pipefs_sb = NULL;
+- mutex_unlock(&sn->pipefs_sb_lock);
+ dprintk("RPC: sending pipefs UMOUNT notification for net %p%s\n",
+ net, NET_NAME(net));
+ blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
+ RPC_PIPEFS_UMOUNT,
+ sb);
++ mutex_unlock(&sn->pipefs_sb_lock);
+ put_net(net);
+ out:
+ kill_litter_super(sb);
--- /dev/null
+From 4f6bb246f69443549fbbd0f2abaf863243cb35e9 Mon Sep 17 00:00:00 2001
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Date: Mon, 24 Jun 2013 11:52:59 +0400
+Subject: SUNRPC: PipeFS MOUNT notification optimization for dying clients
+
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+
+commit 4f6bb246f69443549fbbd0f2abaf863243cb35e9 upstream.
+
+Not need to create pipes for dying client. So just skip them.
+
+Note: we can safely dereference the client structure, because notification
+caller is holding sn->pipefs_sb_lock.
+
+Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -177,6 +177,8 @@ static inline int rpc_clnt_skip_event(st
+ if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+ ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+ return 1;
++ if ((event == RPC_PIPEFS_MOUNT) && atomic_read(&clnt->cl_count) == 0)
++ return 1;
+ return 0;
+ }
+
--- /dev/null
+From 8c6bab4f3874d31804a00782c48a8f244a0d3cc0 Mon Sep 17 00:00:00 2001
+From: Luiz Capitulino <lcapitulino@redhat.com>
+Date: Tue, 2 Jul 2013 15:35:13 +0930
+Subject: virtio_balloon: leak_balloon(): only tell host if we got pages deflated
+
+From: Luiz Capitulino <lcapitulino@redhat.com>
+
+commit 8c6bab4f3874d31804a00782c48a8f244a0d3cc0 upstream.
+
+balloon_page_dequeue() can return NULL. If it does for the first page
+being freed then leak_balloon() will create a scatter list with len=0.
+Which in turn seems to generate an invalid virtio request.
+
+I didn't get this in practice, I found it by code review. On the other
+hand, such an invalid virtio request will cause errors in QEMU and
+fill_balloon() also performs the same check implemented by this commit.
+
+This bug was introduced in e2250429.
+
+Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
+Acked-by: Rafael Aquini <aquini@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_balloon.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -191,7 +191,8 @@ static void leak_balloon(struct virtio_b
+ * virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
+ * is true, we *have* to do it in this order
+ */
+- tell_host(vb, vb->deflate_vq);
++ if (vb->num_pfns != 0)
++ tell_host(vb, vb->deflate_vq);
+ mutex_unlock(&vb->balloon_lock);
+ release_pages_by_pfn(vb->pfns, vb->num_pfns);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
