From: Greg Kroah-Hartman Date: Tue, 23 Jul 2013 04:03:29 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.3~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3fb98d4a1fc787247e38f468635435d7e1a6e6f4;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: b43-ensue-that-bcma-is-y-when-b43-is-y.patch scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch scsi-sd-update-write-same-heuristics.patch scsi-zfcp-block-queue-limits-with-data-router.patch scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch sunrpc-fix-races-on-pipefs-mount-notifications.patch sunrpc-fix-races-on-pipefs-umount-notifications.patch sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch --- diff --git a/queue-3.10/b43-ensue-that-bcma-is-y-when-b43-is-y.patch b/queue-3.10/b43-ensue-that-bcma-is-y-when-b43-is-y.patch new file mode 100644 index 00000000000..9be5e9efb10 --- /dev/null +++ b/queue-3.10/b43-ensue-that-bcma-is-y-when-b43-is-y.patch @@ -0,0 +1,46 @@ +From 693026ef2e751fd94d2e6c71028e68343cc875d5 Mon Sep 17 00:00:00 2001 +From: Hauke Mehrtens +Date: Sun, 9 Jun 2013 18:53:58 +0200 +Subject: b43: ensue that BCMA is "y" when B43 is "y" + +From: Hauke Mehrtens + +commit 693026ef2e751fd94d2e6c71028e68343cc875d5 upstream. + +When b43 gets build into the kernel and it should use bcma we have to +ensure that bcma was also build into the kernel and not as a module. +In this patch this is also done for SSB, although you can not +build b43 without ssb support for now. + +This fixes a build problem reported by Randy Dunlap in +5187EB95.2060605@infradead.org + +Reported-By: Randy Dunlap +Signed-off-by: Hauke Mehrtens +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/Kconfig ++++ b/drivers/net/wireless/b43/Kconfig +@@ -28,7 +28,7 @@ config B43 + + config B43_BCMA + bool "Support for BCMA bus" +- depends on B43 && BCMA ++ depends on B43 && (BCMA = y || BCMA = B43) + default y + + config B43_BCMA_EXTRA +@@ -39,7 +39,7 @@ config B43_BCMA_EXTRA + + config B43_SSB + bool +- depends on B43 && SSB ++ depends on B43 && (SSB = y || SSB = B43) + default y + + # Auto-select SSB PCI-HOST support, if possible diff --git a/queue-3.10/scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch b/queue-3.10/scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch new file mode 100644 index 00000000000..22e7f0a98e4 --- /dev/null +++ b/queue-3.10/scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch @@ -0,0 +1,40 @@ +From c5bebd829dd95602c15f8da8cc50fa938b5e0254 Mon Sep 17 00:00:00 2001 +From: Mahesh Rajashekhara +Date: Tue, 18 Jun 2013 17:02:07 +0530 +Subject: SCSI: aacraid: Fix for arrays are going offline in the system. System hangs + +From: Mahesh Rajashekhara + +commit c5bebd829dd95602c15f8da8cc50fa938b5e0254 upstream. + +One of the customer had reported that the set of raid logical arrays will +become unavailable (I/O offline) after a long hours of IO stress test. The OS +wouldn`t be accessible afterwards and require a hard reset. + +This driver patch has a fix for race condition between the doorbell and the +circular buffer. The driver is modified to do an extra read after clearing the +doorbell in case there had been a completion posted during the small timing +window. + +With this fix, we ran IO stress for ~13 days. There were no IO failures. + +Signed-off-by: Mahesh Rajashekhara +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aacraid/src.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -93,6 +93,9 @@ static irqreturn_t aac_src_intr_message( + int send_it = 0; + extern int aac_sync_mode; + ++ src_writel(dev, MUnit.ODR_C, bellbits); ++ src_readl(dev, MUnit.ODR_C); ++ + if (!aac_sync_mode) { + src_writel(dev, MUnit.ODR_C, bellbits); + src_readl(dev, MUnit.ODR_C); diff --git a/queue-3.10/scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch b/queue-3.10/scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch new file mode 100644 index 00000000000..f69c54f4377 --- /dev/null +++ b/queue-3.10/scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch @@ -0,0 +1,35 @@ +From 48ba2efc382f94fae16ca8ca011e5961a81ad1ea Mon Sep 17 00:00:00 2001 +From: Sreekanth Reddy +Date: Sat, 2 Feb 2013 00:58:20 +0530 +Subject: SCSI: mpt2sas: fix firmware failure with wrong task attribute + +From: Sreekanth Reddy + +commit 48ba2efc382f94fae16ca8ca011e5961a81ad1ea upstream. + +When SCSI command is received with task attribute not set, set it to SIMPLE. +Previously it is set to untagged. This causes the firmware to fail the commands. + +Signed-off-by: Sreekanth Reddy +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -3994,11 +3994,7 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd, + else + mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ; + } else +-/* MPI Revision I (UNIT = 0xA) - removed MPI2_SCSIIO_CONTROL_UNTAGGED */ +-/* mpi_control |= MPI2_SCSIIO_CONTROL_UNTAGGED; +- */ +- mpi_control |= (0x500); +- ++ mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ; + } else + mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ; + /* Make sure Device is not raid volume. diff --git a/queue-3.10/scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch b/queue-3.10/scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch new file mode 100644 index 00000000000..0f53580b62c --- /dev/null +++ b/queue-3.10/scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch @@ -0,0 +1,102 @@ +From b0df96a0068daee4f9c2189c29b9053eb6e46b17 Mon Sep 17 00:00:00 2001 +From: "Reddy, Sreekanth" +Date: Tue, 26 Feb 2013 16:59:59 +0530 +Subject: SCSI: mpt2sas: Fix for issue Missing delay not getting set during system bootup + +From: "Reddy, Sreekanth" + +commit b0df96a0068daee4f9c2189c29b9053eb6e46b17 upstream. + +Missing delay is not getting set properly. The reason is that it is not +defined in the same file from where it is being invoked. The fix is to move +the missing delay module parameter from mpt2sas_base.c to mpt2sas_scsh.c. + +Signed-off-by: Sreekanth Reddy +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt2sas/mpt2sas_base.c | 13 +++---------- + drivers/scsi/mpt2sas/mpt2sas_base.h | 3 +++ + drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +++++++- + 3 files changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/scsi/mpt2sas/mpt2sas_base.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c +@@ -80,10 +80,6 @@ static int msix_disable = -1; + module_param(msix_disable, int, 0); + MODULE_PARM_DESC(msix_disable, " disable msix routed interrupts (default=0)"); + +-static int missing_delay[2] = {-1, -1}; +-module_param_array(missing_delay, int, NULL, 0); +-MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay"); +- + static int mpt2sas_fwfault_debug; + MODULE_PARM_DESC(mpt2sas_fwfault_debug, " enable detection of firmware fault " + "and halt firmware - (default=0)"); +@@ -2199,7 +2195,7 @@ _base_display_ioc_capabilities(struct MP + } + + /** +- * _base_update_missing_delay - change the missing delay timers ++ * mpt2sas_base_update_missing_delay - change the missing delay timers + * @ioc: per adapter object + * @device_missing_delay: amount of time till device is reported missing + * @io_missing_delay: interval IO is returned when there is a missing device +@@ -2210,8 +2206,8 @@ _base_display_ioc_capabilities(struct MP + * delay, as well as the io missing delay. This should be called at driver + * load time. + */ +-static void +-_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc, ++void ++mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc, + u16 device_missing_delay, u8 io_missing_delay) + { + u16 dmd, dmd_new, dmd_orignal; +@@ -4407,9 +4403,6 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPT + if (r) + goto out_free_resources; + +- if (missing_delay[0] != -1 && missing_delay[1] != -1) +- _base_update_missing_delay(ioc, missing_delay[0], +- missing_delay[1]); + ioc->non_operational_loop = 0; + + return 0; +--- a/drivers/scsi/mpt2sas/mpt2sas_base.h ++++ b/drivers/scsi/mpt2sas/mpt2sas_base.h +@@ -1055,6 +1055,9 @@ void mpt2sas_base_validate_event_type(st + + void mpt2sas_halt_firmware(struct MPT2SAS_ADAPTER *ioc); + ++void mpt2sas_base_update_missing_delay(struct MPT2SAS_ADAPTER *ioc, ++ u16 device_missing_delay, u8 io_missing_delay); ++ + int mpt2sas_port_enable(struct MPT2SAS_ADAPTER *ioc); + + /* scsih shared API */ +--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c +@@ -101,6 +101,10 @@ static ushort max_sectors = 0xFFFF; + module_param(max_sectors, ushort, 0); + MODULE_PARM_DESC(max_sectors, "max sectors, range 64 to 32767 default=32767"); + ++static int missing_delay[2] = {-1, -1}; ++module_param_array(missing_delay, int, NULL, 0); ++MODULE_PARM_DESC(missing_delay, " device missing delay , io missing delay"); ++ + /* scsi-mid layer global parmeter is max_report_luns, which is 511 */ + #define MPT2SAS_MAX_LUN (16895) + static int max_lun = MPT2SAS_MAX_LUN; +@@ -7299,7 +7303,9 @@ _firmware_event_work(struct work_struct + case MPT2SAS_PORT_ENABLE_COMPLETE: + ioc->start_scan = 0; + +- ++ if (missing_delay[0] != -1 && missing_delay[1] != -1) ++ mpt2sas_base_update_missing_delay(ioc, missing_delay[0], ++ missing_delay[1]); + + dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "port enable: complete " + "from worker thread\n", ioc->name)); diff --git a/queue-3.10/scsi-sd-update-write-same-heuristics.patch b/queue-3.10/scsi-sd-update-write-same-heuristics.patch new file mode 100644 index 00000000000..2ebdbe36ed0 --- /dev/null +++ b/queue-3.10/scsi-sd-update-write-same-heuristics.patch @@ -0,0 +1,160 @@ +From 66c28f97120e8a621afd5aa7a31c4b85c547d33d Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Thu, 6 Jun 2013 22:15:55 -0400 +Subject: SCSI: sd: Update WRITE SAME heuristics + +From: "Martin K. Petersen" + +commit 66c28f97120e8a621afd5aa7a31c4b85c547d33d upstream. + +SATA drives located behind a SAS controller would incorrectly receive +WRITE SAME commands. Tweak the heuristics so that: + + - If REPORT SUPPORTED OPERATION CODES is provided we will use that to + choose between WRITE SAME(16), WRITE SAME(10) and disabled. This also + fixes an issue with the old code which would issue WRITE SAME(10) + despite the command not being whitelisted in REPORT SUPPORTED + OPERATION CODES. + + - If REPORT SUPPORTED OPERATION CODES is not provided we will fall back + to WRITE SAME(10) unless the device has an ATA Information VPD page. + The assumption is that a SATL which is smart enough to implement + WRITE SAME would also provide REPORT SUPPORTED OPERATION CODES. + +To facilitate the new heuristics scsi_report_opcode() has been modified +to so we can distinguish between "operation not supported" and "RSOC not +supported". + +Reported-by: H. Peter Anvin +Tested-by: Bernd Schubert +Signed-off-by: Martin K. Petersen +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi.c | 8 ++++---- + drivers/scsi/sd.c | 46 ++++++++++++++++++++++++++++++++-------------- + drivers/scsi/sd.h | 1 + + 3 files changed, 37 insertions(+), 18 deletions(-) + +--- a/drivers/scsi/scsi.c ++++ b/drivers/scsi/scsi.c +@@ -1070,8 +1070,8 @@ EXPORT_SYMBOL_GPL(scsi_get_vpd_page); + * @opcode: opcode for command to look up + * + * Uses the REPORT SUPPORTED OPERATION CODES to look up the given +- * opcode. Returns 0 if RSOC fails or if the command opcode is +- * unsupported. Returns 1 if the device claims to support the command. ++ * opcode. Returns -EINVAL if RSOC fails, 0 if the command opcode is ++ * unsupported and 1 if the device claims to support the command. + */ + int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer, + unsigned int len, unsigned char opcode) +@@ -1081,7 +1081,7 @@ int scsi_report_opcode(struct scsi_devic + int result; + + if (sdev->no_report_opcodes || sdev->scsi_level < SCSI_SPC_3) +- return 0; ++ return -EINVAL; + + memset(cmd, 0, 16); + cmd[0] = MAINTENANCE_IN; +@@ -1097,7 +1097,7 @@ int scsi_report_opcode(struct scsi_devic + if (result && scsi_sense_valid(&sshdr) && + sshdr.sense_key == ILLEGAL_REQUEST && + (sshdr.asc == 0x20 || sshdr.asc == 0x24) && sshdr.ascq == 0x00) +- return 0; ++ return -EINVAL; + + if ((buffer[1] & 3) == 3) /* Command supported */ + return 1; +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -442,8 +442,10 @@ sd_store_write_same_blocks(struct device + + if (max == 0) + sdp->no_write_same = 1; +- else if (max <= SD_MAX_WS16_BLOCKS) ++ else if (max <= SD_MAX_WS16_BLOCKS) { ++ sdp->no_write_same = 0; + sdkp->max_ws_blocks = max; ++ } + + sd_config_write_same(sdkp); + +@@ -740,7 +742,6 @@ static void sd_config_write_same(struct + { + struct request_queue *q = sdkp->disk->queue; + unsigned int logical_block_size = sdkp->device->sector_size; +- unsigned int blocks = 0; + + if (sdkp->device->no_write_same) { + sdkp->max_ws_blocks = 0; +@@ -752,18 +753,20 @@ static void sd_config_write_same(struct + * blocks per I/O unless the device explicitly advertises a + * bigger limit. + */ +- if (sdkp->max_ws_blocks == 0) +- sdkp->max_ws_blocks = SD_MAX_WS10_BLOCKS; +- +- if (sdkp->ws16 || sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS) +- blocks = min_not_zero(sdkp->max_ws_blocks, +- (u32)SD_MAX_WS16_BLOCKS); +- else +- blocks = min_not_zero(sdkp->max_ws_blocks, +- (u32)SD_MAX_WS10_BLOCKS); ++ if (sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS) ++ sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks, ++ (u32)SD_MAX_WS16_BLOCKS); ++ else if (sdkp->ws16 || sdkp->ws10 || sdkp->device->no_report_opcodes) ++ sdkp->max_ws_blocks = min_not_zero(sdkp->max_ws_blocks, ++ (u32)SD_MAX_WS10_BLOCKS); ++ else { ++ sdkp->device->no_write_same = 1; ++ sdkp->max_ws_blocks = 0; ++ } + + out: +- blk_queue_max_write_same_sectors(q, blocks * (logical_block_size >> 9)); ++ blk_queue_max_write_same_sectors(q, sdkp->max_ws_blocks * ++ (logical_block_size >> 9)); + } + + /** +@@ -2635,9 +2638,24 @@ static void sd_read_block_provisioning(s + + static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer) + { +- if (scsi_report_opcode(sdkp->device, buffer, SD_BUF_SIZE, +- WRITE_SAME_16)) ++ struct scsi_device *sdev = sdkp->device; ++ ++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) { ++ sdev->no_report_opcodes = 1; ++ ++ /* Disable WRITE SAME if REPORT SUPPORTED OPERATION ++ * CODES is unsupported and the device has an ATA ++ * Information VPD page (SAT). ++ */ ++ if (!scsi_get_vpd_page(sdev, 0x89, buffer, SD_BUF_SIZE)) ++ sdev->no_write_same = 1; ++ } ++ ++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME_16) == 1) + sdkp->ws16 = 1; ++ ++ if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, WRITE_SAME) == 1) ++ sdkp->ws10 = 1; + } + + static int sd_try_extended_inquiry(struct scsi_device *sdp) +--- a/drivers/scsi/sd.h ++++ b/drivers/scsi/sd.h +@@ -84,6 +84,7 @@ struct scsi_disk { + unsigned lbpws : 1; + unsigned lbpws10 : 1; + unsigned lbpvpd : 1; ++ unsigned ws10 : 1; + unsigned ws16 : 1; + }; + #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev) diff --git a/queue-3.10/scsi-zfcp-block-queue-limits-with-data-router.patch b/queue-3.10/scsi-zfcp-block-queue-limits-with-data-router.patch new file mode 100644 index 00000000000..09e28abd23a --- /dev/null +++ b/queue-3.10/scsi-zfcp-block-queue-limits-with-data-router.patch @@ -0,0 +1,70 @@ +From 5fea4291deacd80188b996d2f555fc6a1940e5d4 Mon Sep 17 00:00:00 2001 +From: Steffen Maier +Date: Fri, 26 Apr 2013 17:33:45 +0200 +Subject: SCSI: zfcp: block queue limits with data router + +From: Steffen Maier + +commit 5fea4291deacd80188b996d2f555fc6a1940e5d4 upstream. + +Commit 86a9668a8d29ea711613e1cb37efa68e7c4db564 +"[SCSI] zfcp: support for hardware data router" +reduced the initial block queue limits in the scsi_host_template to the +absolute minimum and adjusted them later on. However, the adjustment was +too late for the BSG devices of Scsi_Host and fc_host. + +Therefore, ioctl(..., SG_IO, ...) with request or response size > 4kB to a +BSG device of an fc_host or a Scsi_Host fails with EINVAL. As a result, +users of such ioctl such as HBA_SendCTPassThru() in libzfcphbaapi return +with error HBA_STATUS_ERROR. + +Initialize the block queue limits in zfcp_scsi_host_template to the +greatest common denominator (GCD). + +While we cannot exploit the slightly enlarged maximum request size with +data router, this should be neglectible. Doing so also avoids running into +trouble after live guest relocation (LGR) / migration from a data router +FCP device to an FCP device that does not support data router. In that +case, zfcp would figure out the new limits on adapter recovery, but the +fc_host and Scsi_Host (plus in fact all sdevs) still exist with the old and +now too large queue limits. + +It should also OK, not to use half the size as in the DIX case, because +fc_host and Scsi_Host do not transport FCP requests including SCSI commands +using protection data. + +Signed-off-by: Steffen Maier +Reviewed-by: Martin Peschke +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/scsi/zfcp_scsi.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -3,7 +3,7 @@ + * + * Interface to Linux SCSI midlayer. + * +- * Copyright IBM Corp. 2002, 2010 ++ * Copyright IBM Corp. 2002, 2013 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -311,8 +311,12 @@ static struct scsi_host_template zfcp_sc + .proc_name = "zfcp", + .can_queue = 4096, + .this_id = -1, +- .sg_tablesize = 1, /* adjusted later */ +- .max_sectors = 8, /* adjusted later */ ++ .sg_tablesize = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1) ++ * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2), ++ /* GCD, adjusted later */ ++ .max_sectors = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1) ++ * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8, ++ /* GCD, adjusted later */ + .dma_boundary = ZFCP_QDIO_SBALE_LEN - 1, + .cmd_per_lun = 1, + .use_clustering = 1, diff --git a/queue-3.10/scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch b/queue-3.10/scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch new file mode 100644 index 00000000000..7173b51e4c4 --- /dev/null +++ b/queue-3.10/scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch @@ -0,0 +1,46 @@ +From f76ccaac4f82c463a037aa4a1e4ccb85c7011814 Mon Sep 17 00:00:00 2001 +From: Daniel Hansel +Date: Fri, 26 Apr 2013 17:32:14 +0200 +Subject: SCSI: zfcp: fix adapter (re)open recovery while link to SAN is down + +From: Daniel Hansel + +commit f76ccaac4f82c463a037aa4a1e4ccb85c7011814 upstream. + +FCP device remains in status ERP_FAILED when device is switched online +or adapter recovery is triggered while link to SAN is down. + +When Exchange Configuration Data command returns the FSF status +FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE it aborts the exchange process. +The only retries are done during the common error recovery procedure +(i.e. max. 3 retries with 8sec sleep between) and remains in status +ERP_FAILED with QDIO down. + +This commit reverts the commit 0df138476c8306478d6e726f044868b4bccf411c +(zfcp: Fix adapter activation on link down). +When FSF status FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE is received the +adapter recovery will be finished without any retries. QDIO will be +up now and status changes such as LINK UP will be received now. + +Signed-off-by: Daniel Hansel +Signed-off-by: Steffen Maier +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/scsi/zfcp_fsf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -563,6 +563,10 @@ static void zfcp_fsf_exchange_config_dat + fc_host_port_type(shost) = FC_PORTTYPE_UNKNOWN; + adapter->hydra_version = 0; + ++ /* avoids adapter shutdown to be able to recognize ++ * events such as LINK UP */ ++ atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK, ++ &adapter->status); + zfcp_fsf_link_down_info_eval(req, + &qtcb->header.fsf_status_qual.link_down_info); + break; diff --git a/queue-3.10/scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch b/queue-3.10/scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch new file mode 100644 index 00000000000..dca5ac318f8 --- /dev/null +++ b/queue-3.10/scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch @@ -0,0 +1,135 @@ +From 9edf7d75ee5f21663a0183d21f702682d0ef132f Mon Sep 17 00:00:00 2001 +From: Steffen Maier +Date: Fri, 26 Apr 2013 17:34:54 +0200 +Subject: SCSI: zfcp: status read buffers on first adapter open with link down + +From: Steffen Maier + +commit 9edf7d75ee5f21663a0183d21f702682d0ef132f upstream. + +Commit 64deb6efdc5504ce97b5c1c6f281fffbc150bd93 +"[SCSI] zfcp: Use status_read_buf_num provided by FCP channel" +started using a value returned by the channel but only evaluated the value +if the fabric link is up. +Commit 8d88cf3f3b9af4713642caeb221b6d6a42019001 +"[SCSI] zfcp: Update status read mempool" +introduced mempool resizings based on the above value. +On setting an FCP device online for the very first time since boot, a new +zeroed adapter object is allocated. If the link is down, the number of +status read requests remains zero. Since just the config data exchange is +incomplete, we proceed with adapter open recovery. However, we +unconditionally call mempool_resize with adapter->stat_read_buf_num == 0 in +this case. + +This causes a kernel message "kernel BUG at mm/mempool.c:131!" in process +"zfcperp" with last function mempool_resize in Krnl PSW +and zfcp_erp_thread in the Call Trace. + +Don't evaluate channel values which are invalid on link down. The number of +status read requests is always valid, evaluated, and set to a positive +minimum greater than zero. The adapter open recovery can proceed and the +channel has status read buffers to inform us on a future link up event. +While we are not aware of any other code path that could result in mempool +resize attempts of size zero, we still also initialize the number of status +read buffers to be posted to a static minimum number on adapter object +allocation. + +Signed-off-by: Steffen Maier +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/scsi/zfcp_aux.c | 5 ++++- + drivers/s390/scsi/zfcp_fsf.c | 23 ++++++++++++++++------- + 2 files changed, 20 insertions(+), 8 deletions(-) + +--- a/drivers/s390/scsi/zfcp_aux.c ++++ b/drivers/s390/scsi/zfcp_aux.c +@@ -3,7 +3,7 @@ + * + * Module interface and handling of zfcp data structures. + * +- * Copyright IBM Corp. 2002, 2010 ++ * Copyright IBM Corp. 2002, 2013 + */ + + /* +@@ -23,6 +23,7 @@ + * Christof Schmitt + * Martin Petermann + * Sven Schuetz ++ * Steffen Maier + */ + + #define KMSG_COMPONENT "zfcp" +@@ -415,6 +416,8 @@ struct zfcp_adapter *zfcp_adapter_enqueu + adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN; + adapter->ccw_device->dev.dma_parms = &adapter->dma_parms; + ++ adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM; ++ + if (!zfcp_scsi_adapter_register(adapter)) + return adapter; + +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -3,7 +3,7 @@ + * + * Implementation of FSF commands. + * +- * Copyright IBM Corp. 2002, 2010 ++ * Copyright IBM Corp. 2002, 2013 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -483,12 +483,8 @@ static int zfcp_fsf_exchange_config_eval + + fc_host_port_name(shost) = nsp->fl_wwpn; + fc_host_node_name(shost) = nsp->fl_wwnn; +- fc_host_port_id(shost) = ntoh24(bottom->s_id); +- fc_host_speed(shost) = +- zfcp_fsf_convert_portspeed(bottom->fc_link_speed); + fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3; + +- adapter->hydra_version = bottom->adapter_type; + adapter->timer_ticks = bottom->timer_interval & ZFCP_FSF_TIMER_INT_MASK; + adapter->stat_read_buf_num = max(bottom->status_read_buf_num, + (u16)FSF_STATUS_READS_RECOM); +@@ -496,6 +492,19 @@ static int zfcp_fsf_exchange_config_eval + if (fc_host_permanent_port_name(shost) == -1) + fc_host_permanent_port_name(shost) = fc_host_port_name(shost); + ++ zfcp_scsi_set_prot(adapter); ++ ++ /* no error return above here, otherwise must fix call chains */ ++ /* do not evaluate invalid fields */ ++ if (req->qtcb->header.fsf_status == FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE) ++ return 0; ++ ++ fc_host_port_id(shost) = ntoh24(bottom->s_id); ++ fc_host_speed(shost) = ++ zfcp_fsf_convert_portspeed(bottom->fc_link_speed); ++ ++ adapter->hydra_version = bottom->adapter_type; ++ + switch (bottom->fc_topology) { + case FSF_TOPO_P2P: + adapter->peer_d_id = ntoh24(bottom->peer_d_id); +@@ -517,8 +526,6 @@ static int zfcp_fsf_exchange_config_eval + return -EIO; + } + +- zfcp_scsi_set_prot(adapter); +- + return 0; + } + +@@ -569,6 +576,8 @@ static void zfcp_fsf_exchange_config_dat + &adapter->status); + zfcp_fsf_link_down_info_eval(req, + &qtcb->header.fsf_status_qual.link_down_info); ++ if (zfcp_fsf_exchange_config_evaluate(req)) ++ return; + break; + default: + zfcp_erp_adapter_shutdown(adapter, 0, "fsecdh3"); diff --git a/queue-3.10/series b/queue-3.10/series index 576312830df..e76fa54d2c8 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -57,3 +57,15 @@ rt2x00-rt2800lib-fix-default-tx-power-check-for-rt55xx.patch ath9k_hw-assign-default-xlna-config-for-ar9485.patch ath9k-fix-noisefloor-calibration.patch ath9k-do-not-assign-noise-for-null-caldata.patch +scsi-sd-update-write-same-heuristics.patch +scsi-aacraid-fix-for-arrays-are-going-offline-in-the-system.-system-hangs.patch +scsi-zfcp-fix-adapter-re-open-recovery-while-link-to-san-is-down.patch +scsi-zfcp-block-queue-limits-with-data-router.patch +scsi-zfcp-status-read-buffers-on-first-adapter-open-with-link-down.patch +scsi-mpt2sas-fix-firmware-failure-with-wrong-task-attribute.patch +scsi-mpt2sas-fix-for-issue-missing-delay-not-getting-set-during-system-bootup.patch +sunrpc-fix-races-on-pipefs-mount-notifications.patch +sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch +sunrpc-fix-races-on-pipefs-umount-notifications.patch +virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch +b43-ensue-that-bcma-is-y-when-b43-is-y.patch diff --git a/queue-3.10/sunrpc-fix-races-on-pipefs-mount-notifications.patch b/queue-3.10/sunrpc-fix-races-on-pipefs-mount-notifications.patch new file mode 100644 index 00000000000..53091a23c3e --- /dev/null +++ b/queue-3.10/sunrpc-fix-races-on-pipefs-mount-notifications.patch @@ -0,0 +1,131 @@ +From 384816051ca9125cd54750e59c780c2a2655fa4f Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Mon, 24 Jun 2013 11:52:38 +0400 +Subject: SUNRPC: fix races on PipeFS MOUNT notifications + +From: Stanislav Kinsbursky + +commit 384816051ca9125cd54750e59c780c2a2655fa4f upstream. + +Below are races, when RPC client can be created without PiepFS dentries + +CPU#0 CPU#1 +----------------------------- ----------------------------- +rpc_new_client rpc_fill_super +rpc_setup_pipedir +mutex_lock(&sn->pipefs_sb_lock) +rpc_get_sb_net == NULL +(no per-net PipeFS superblock) + sn->pipefs_sb = sb; + notifier_call_chain(MOUNT) + (client is not in the list) +rpc_register_client +(client without pipes dentries) + +To fix this patch: +1) makes PipeFS mount notification call with pipefs_sb_lock being held. +2) releases pipefs_sb_lock on new SUNRPC client creation only after +registration. + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 26 +++++++++++++++----------- + net/sunrpc/rpc_pipe.c | 3 +++ + 2 files changed, 18 insertions(+), 11 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -157,20 +157,15 @@ static struct dentry *rpc_setup_pipedir_ + } + + static int +-rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name) ++rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name, ++ struct super_block *pipefs_sb) + { +- struct net *net = rpc_net_ns(clnt); +- struct super_block *pipefs_sb; + struct dentry *dentry; + + clnt->cl_dentry = NULL; + if (dir_name == NULL) + return 0; +- pipefs_sb = rpc_get_sb_net(net); +- if (!pipefs_sb) +- return 0; + dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt, dir_name); +- rpc_put_sb_net(net); + if (IS_ERR(dentry)) + return PTR_ERR(dentry); + clnt->cl_dentry = dentry; +@@ -296,6 +291,7 @@ static struct rpc_clnt * rpc_new_client( + struct rpc_clnt *clnt = NULL; + struct rpc_auth *auth; + int err; ++ struct super_block *pipefs_sb; + + /* sanity check the name before trying to print it */ + dprintk("RPC: creating %s client for %s (xprt %p)\n", +@@ -354,9 +350,12 @@ static struct rpc_clnt * rpc_new_client( + + atomic_set(&clnt->cl_count, 1); + +- err = rpc_setup_pipedir(clnt, program->pipe_dir_name); +- if (err < 0) +- goto out_no_path; ++ pipefs_sb = rpc_get_sb_net(rpc_net_ns(clnt)); ++ if (pipefs_sb) { ++ err = rpc_setup_pipedir(clnt, program->pipe_dir_name, pipefs_sb); ++ if (err) ++ goto out_no_path; ++ } + + auth = rpcauth_create(args->authflavor, clnt); + if (IS_ERR(auth)) { +@@ -369,11 +368,16 @@ static struct rpc_clnt * rpc_new_client( + /* save the nodename */ + rpc_clnt_set_nodename(clnt, utsname()->nodename); + rpc_register_client(clnt); ++ if (pipefs_sb) ++ rpc_put_sb_net(rpc_net_ns(clnt)); + return clnt; + + out_no_auth: +- rpc_clnt_remove_pipedir(clnt); ++ if (pipefs_sb) ++ __rpc_clnt_remove_pipedir(clnt); + out_no_path: ++ if (pipefs_sb) ++ rpc_put_sb_net(rpc_net_ns(clnt)); + kfree(clnt->cl_principal); + out_no_principal: + rpc_free_iostats(clnt->cl_metrics); +--- a/net/sunrpc/rpc_pipe.c ++++ b/net/sunrpc/rpc_pipe.c +@@ -1126,6 +1126,7 @@ rpc_fill_super(struct super_block *sb, v + return -ENOMEM; + dprintk("RPC: sending pipefs MOUNT notification for net %p%s\n", + net, NET_NAME(net)); ++ mutex_lock(&sn->pipefs_sb_lock); + sn->pipefs_sb = sb; + err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list, + RPC_PIPEFS_MOUNT, +@@ -1133,6 +1134,7 @@ rpc_fill_super(struct super_block *sb, v + if (err) + goto err_depopulate; + sb->s_fs_info = get_net(net); ++ mutex_unlock(&sn->pipefs_sb_lock); + return 0; + + err_depopulate: +@@ -1141,6 +1143,7 @@ err_depopulate: + sb); + sn->pipefs_sb = NULL; + __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF); ++ mutex_unlock(&sn->pipefs_sb_lock); + return err; + } + diff --git a/queue-3.10/sunrpc-fix-races-on-pipefs-umount-notifications.patch b/queue-3.10/sunrpc-fix-races-on-pipefs-umount-notifications.patch new file mode 100644 index 00000000000..86c14a5af28 --- /dev/null +++ b/queue-3.10/sunrpc-fix-races-on-pipefs-umount-notifications.patch @@ -0,0 +1,84 @@ +From adb6fa7ffe9031857ec14b8aab75c9ab65556cbc Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Wed, 26 Jun 2013 10:15:14 +0400 +Subject: SUNRPC: fix races on PipeFS UMOUNT notifications + +From: Stanislav Kinsbursky + +commit adb6fa7ffe9031857ec14b8aab75c9ab65556cbc upstream. + +CPU#0 CPU#1 +----------------------------- ----------------------------- +rpc_kill_sb +sn->pipefs_sb = NULL rpc_release_client +(UMOUNT_EVENT) rpc_free_auth +rpc_pipefs_event +rpc_get_client_for_event +!atomic_inc_not_zero(cl_count) + + atomic_inc(cl_count) + rpc_free_client + rpc_clnt_remove_pipedir + + +To fix this, this patch does the following: + +1) Calls RPC_PIPEFS_UMOUNT notification with sn->pipefs_sb_lock being held. +2) Removes SUNRPC client from the list AFTER pipes destroying. +3) Doesn't hold RPC client on notification: if client in the list, then it +can't be destroyed while sn->pipefs_sb_lock in hold by notification caller. + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 5 +---- + net/sunrpc/rpc_pipe.c | 2 +- + 2 files changed, 2 insertions(+), 5 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -238,8 +238,6 @@ static struct rpc_clnt *rpc_get_client_f + continue; + if (rpc_clnt_skip_event(clnt, event)) + continue; +- if (atomic_inc_not_zero(&clnt->cl_count) == 0) +- continue; + spin_unlock(&sn->rpc_client_lock); + return clnt; + } +@@ -256,7 +254,6 @@ static int rpc_pipefs_event(struct notif + + while ((clnt = rpc_get_client_for_event(sb->s_fs_info, event))) { + error = __rpc_pipefs_event(clnt, event, sb); +- rpc_release_client(clnt); + if (error) + break; + } +@@ -643,8 +640,8 @@ rpc_free_client(struct rpc_clnt *clnt) + rcu_dereference(clnt->cl_xprt)->servername); + if (clnt->cl_parent != clnt) + rpc_release_client(clnt->cl_parent); +- rpc_unregister_client(clnt); + rpc_clnt_remove_pipedir(clnt); ++ rpc_unregister_client(clnt); + rpc_free_iostats(clnt->cl_metrics); + kfree(clnt->cl_principal); + clnt->cl_metrics = NULL; +--- a/net/sunrpc/rpc_pipe.c ++++ b/net/sunrpc/rpc_pipe.c +@@ -1165,12 +1165,12 @@ static void rpc_kill_sb(struct super_blo + goto out; + } + sn->pipefs_sb = NULL; +- mutex_unlock(&sn->pipefs_sb_lock); + dprintk("RPC: sending pipefs UMOUNT notification for net %p%s\n", + net, NET_NAME(net)); + blocking_notifier_call_chain(&rpc_pipefs_notifier_list, + RPC_PIPEFS_UMOUNT, + sb); ++ mutex_unlock(&sn->pipefs_sb_lock); + put_net(net); + out: + kill_litter_super(sb); diff --git a/queue-3.10/sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch b/queue-3.10/sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch new file mode 100644 index 00000000000..ba55986156d --- /dev/null +++ b/queue-3.10/sunrpc-pipefs-mount-notification-optimization-for-dying-clients.patch @@ -0,0 +1,33 @@ +From 4f6bb246f69443549fbbd0f2abaf863243cb35e9 Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Mon, 24 Jun 2013 11:52:59 +0400 +Subject: SUNRPC: PipeFS MOUNT notification optimization for dying clients + +From: Stanislav Kinsbursky + +commit 4f6bb246f69443549fbbd0f2abaf863243cb35e9 upstream. + +Not need to create pipes for dying client. So just skip them. + +Note: we can safely dereference the client structure, because notification +caller is holding sn->pipefs_sb_lock. + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -177,6 +177,8 @@ static inline int rpc_clnt_skip_event(st + if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) || + ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry)) + return 1; ++ if ((event == RPC_PIPEFS_MOUNT) && atomic_read(&clnt->cl_count) == 0) ++ return 1; + return 0; + } + diff --git a/queue-3.10/virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch b/queue-3.10/virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch new file mode 100644 index 00000000000..bda9b0e9d76 --- /dev/null +++ b/queue-3.10/virtio_balloon-leak_balloon-only-tell-host-if-we-got-pages-deflated.patch @@ -0,0 +1,41 @@ +From 8c6bab4f3874d31804a00782c48a8f244a0d3cc0 Mon Sep 17 00:00:00 2001 +From: Luiz Capitulino +Date: Tue, 2 Jul 2013 15:35:13 +0930 +Subject: virtio_balloon: leak_balloon(): only tell host if we got pages deflated + +From: Luiz Capitulino + +commit 8c6bab4f3874d31804a00782c48a8f244a0d3cc0 upstream. + +balloon_page_dequeue() can return NULL. If it does for the first page +being freed then leak_balloon() will create a scatter list with len=0. +Which in turn seems to generate an invalid virtio request. + +I didn't get this in practice, I found it by code review. On the other +hand, such an invalid virtio request will cause errors in QEMU and +fill_balloon() also performs the same check implemented by this commit. + +This bug was introduced in e2250429. + +Signed-off-by: Luiz Capitulino +Acked-by: Rafael Aquini +Signed-off-by: Andrew Morton +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_balloon.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -191,7 +191,8 @@ static void leak_balloon(struct virtio_b + * virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST); + * is true, we *have* to do it in this order + */ +- tell_host(vb, vb->deflate_vq); ++ if (vb->num_pfns != 0) ++ tell_host(vb, vb->deflate_vq); + mutex_unlock(&vb->balloon_lock); + release_pages_by_pfn(vb->pfns, vb->num_pfns); + }