From: Greg Kroah-Hartman Date: Mon, 7 Jul 2014 03:06:54 +0000 (-0700) Subject: 3.15-stable patches X-Git-Tag: v3.4.98~65 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1c8fdf9112b5b9ddff52d6c3916cbc1be1ef8d6f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.15-stable patches added patches: ibmvscsi-abort-init-sequence-during-error-recovery.patch ibmvscsi-add-memory-barriers-for-send-receive.patch scsi_error-fix-invalid-setting-of-host-byte.patch virtio-scsi-avoid-cancelling-uninitialized-work-items.patch virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch --- diff --git a/queue-3.15/ibmvscsi-abort-init-sequence-during-error-recovery.patch b/queue-3.15/ibmvscsi-abort-init-sequence-during-error-recovery.patch new file mode 100644 index 00000000000..1ce17234086 --- /dev/null +++ b/queue-3.15/ibmvscsi-abort-init-sequence-during-error-recovery.patch @@ -0,0 +1,36 @@ +From 9ee755974bea2f9880e517ec985dc9dede1b3a36 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Fri, 23 May 2014 10:52:10 -0500 +Subject: ibmvscsi: Abort init sequence during error recovery + +From: Brian King + +commit 9ee755974bea2f9880e517ec985dc9dede1b3a36 upstream. + +If a CRQ reset is triggered for some reason while in the middle +of performing VSCSI adapter initialization, we don't want to +call the done function for the initialization MAD commands as +this will only result in two threads attempting initialization +at the same time, resulting in failures. + +Signed-off-by: Brian King +Acked-by: Nathan Fontenot +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ibmvscsi/ibmvscsi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -797,7 +797,8 @@ static void purge_requests(struct ibmvsc + evt->hostdata->dev); + if (evt->cmnd_done) + evt->cmnd_done(evt->cmnd); +- } else if (evt->done) ++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT && ++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ) + evt->done(evt); + free_event_struct(&evt->hostdata->pool, evt); + spin_lock_irqsave(hostdata->host->host_lock, flags); diff --git a/queue-3.15/ibmvscsi-add-memory-barriers-for-send-receive.patch b/queue-3.15/ibmvscsi-add-memory-barriers-for-send-receive.patch new file mode 100644 index 00000000000..6c92d7d1453 --- /dev/null +++ b/queue-3.15/ibmvscsi-add-memory-barriers-for-send-receive.patch @@ -0,0 +1,48 @@ +From 7114aae02742d6b5c5a0d39a41deb61d415d3717 Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Fri, 23 May 2014 10:52:11 -0500 +Subject: ibmvscsi: Add memory barriers for send / receive + +From: Brian King + +commit 7114aae02742d6b5c5a0d39a41deb61d415d3717 upstream. + +Add a memory barrier prior to sending a new command to the VIOS +to ensure the VIOS does not receive stale data in the command buffer. +Also add a memory barrier when processing the CRQ for completed commands. + +Signed-off-by: Brian King +Acked-by: Nathan Fontenot +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ibmvscsi/ibmvscsi.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -185,6 +185,11 @@ static struct viosrp_crq *crq_queue_next + if (crq->valid & 0x80) { + if (++queue->cur == queue->size) + queue->cur = 0; ++ ++ /* Ensure the read of the valid bit occurs before reading any ++ * other bits of the CRQ entry ++ */ ++ rmb(); + } else + crq = NULL; + spin_unlock_irqrestore(&queue->lock, flags); +@@ -203,6 +208,11 @@ static int ibmvscsi_send_crq(struct ibmv + { + struct vio_dev *vdev = to_vio_dev(hostdata->dev); + ++ /* ++ * Ensure the command buffer is flushed to memory before handing it ++ * over to the VIOS to prevent it from fetching any stale data. ++ */ ++ mb(); + return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, word1, word2); + } + diff --git a/queue-3.15/scsi_error-fix-invalid-setting-of-host-byte.patch b/queue-3.15/scsi_error-fix-invalid-setting-of-host-byte.patch new file mode 100644 index 00000000000..314977dbc7c --- /dev/null +++ b/queue-3.15/scsi_error-fix-invalid-setting-of-host-byte.patch @@ -0,0 +1,68 @@ +From 8922a908908ff947f1f211e07e2e97f1169ad3cb Mon Sep 17 00:00:00 2001 +From: Ulrich Obergfell +Date: Wed, 4 Jun 2014 13:34:57 +0200 +Subject: scsi_error: fix invalid setting of host byte + +From: Ulrich Obergfell + +commit 8922a908908ff947f1f211e07e2e97f1169ad3cb upstream. + +After scsi_try_to_abort_cmd returns, the eh_abort_handler may have +already found that the command has completed in the device, causing +the host_byte to be nonzero (e.g. it could be DID_ABORT). When +this happens, ORing DID_TIME_OUT into the host byte will corrupt +the result field and initiate an unwanted command retry. + +Fix this by using set_host_byte instead, following the model of +commit 2082ebc45af9c9c648383b8cde0dc1948eadbf31. + +Signed-off-by: Ulrich Obergfell +[Fix all instances according to review comments. - Paolo] +Signed-off-by: Paolo Bonzini +Signed-off-by: Christoph Hellwig +Reviewed-by: Ewan D. Milne +Reviewed-by: Hannes Reinecke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_error.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -131,7 +131,7 @@ scmd_eh_abort_handler(struct work_struct + "aborting command %p\n", scmd)); + rtn = scsi_try_to_abort_cmd(sdev->host->hostt, scmd); + if (rtn == SUCCESS) { +- scmd->result |= DID_TIME_OUT << 16; ++ set_host_byte(scmd, DID_TIME_OUT); + if (scsi_host_eh_past_deadline(sdev->host)) { + SCSI_LOG_ERROR_RECOVERY(3, + scmd_printk(KERN_INFO, scmd, +@@ -167,7 +167,7 @@ scmd_eh_abort_handler(struct work_struct + scmd_printk(KERN_WARNING, scmd, + "scmd %p terminate " + "aborted command\n", scmd)); +- scmd->result |= DID_TIME_OUT << 16; ++ set_host_byte(scmd, DID_TIME_OUT); + scsi_finish_command(scmd); + } + } +@@ -291,7 +291,7 @@ enum blk_eh_timer_return scsi_times_out( + if (scsi_abort_command(scmd) == SUCCESS) + return BLK_EH_NOT_HANDLED; + +- scmd->result |= DID_TIME_OUT << 16; ++ set_host_byte(scmd, DID_TIME_OUT); + + if (unlikely(rtn == BLK_EH_NOT_HANDLED && + !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))) +@@ -1776,7 +1776,7 @@ int scsi_decide_disposition(struct scsi_ + break; + case DID_ABORT: + if (scmd->eh_eflags & SCSI_EH_ABORT_SCHEDULED) { +- scmd->result |= DID_TIME_OUT << 16; ++ set_host_byte(scmd, DID_TIME_OUT); + return SUCCESS; + } + case DID_NO_CONNECT: diff --git a/queue-3.15/series b/queue-3.15/series index 6ed8d4c48ba..11143d74526 100644 --- a/queue-3.15/series +++ b/queue-3.15/series @@ -1,2 +1,7 @@ scsi-use-the-scsi-data-buffer-length-to-extract-transfer-size.patch usb-storage-scsi-add-broken_fua-blacklist-flag.patch +ibmvscsi-abort-init-sequence-during-error-recovery.patch +ibmvscsi-add-memory-barriers-for-send-receive.patch +virtio-scsi-avoid-cancelling-uninitialized-work-items.patch +scsi_error-fix-invalid-setting-of-host-byte.patch +virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch diff --git a/queue-3.15/virtio-scsi-avoid-cancelling-uninitialized-work-items.patch b/queue-3.15/virtio-scsi-avoid-cancelling-uninitialized-work-items.patch new file mode 100644 index 00000000000..f808d98e11c --- /dev/null +++ b/queue-3.15/virtio-scsi-avoid-cancelling-uninitialized-work-items.patch @@ -0,0 +1,49 @@ +From cdda0e5acbb78f7b777049f8c27899e5c5bb368f Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 4 Jun 2014 13:34:56 +0200 +Subject: virtio-scsi: avoid cancelling uninitialized work items + +From: Paolo Bonzini + +commit cdda0e5acbb78f7b777049f8c27899e5c5bb368f upstream. + +Calling the workqueue interface on uninitialized work items isn't a +good idea even if they're zeroed. It's not failing catastrophically only +through happy accidents. + +Signed-off-by: Paolo Bonzini +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/virtio_scsi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -291,6 +291,8 @@ static void virtscsi_ctrl_done(struct vi + virtscsi_vq_done(vscsi, &vscsi->ctrl_vq, virtscsi_complete_free); + }; + ++static void virtscsi_handle_event(struct work_struct *work); ++ + static int virtscsi_kick_event(struct virtio_scsi *vscsi, + struct virtio_scsi_event_node *event_node) + { +@@ -298,6 +300,7 @@ static int virtscsi_kick_event(struct vi + struct scatterlist sg; + unsigned long flags; + ++ INIT_WORK(&event_node->work, virtscsi_handle_event); + sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event)); + + spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags); +@@ -415,7 +418,6 @@ static void virtscsi_complete_event(stru + { + struct virtio_scsi_event_node *event_node = buf; + +- INIT_WORK(&event_node->work, virtscsi_handle_event); + schedule_work(&event_node->work); + } + diff --git a/queue-3.15/virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch b/queue-3.15/virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch new file mode 100644 index 00000000000..61f3b7cabff --- /dev/null +++ b/queue-3.15/virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch @@ -0,0 +1,62 @@ +From 8faeb529b2dabb9df691d614dda18910a43d05c9 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 4 Jun 2014 13:34:58 +0200 +Subject: virtio-scsi: fix various bad behavior on aborted requests + +From: Paolo Bonzini + +commit 8faeb529b2dabb9df691d614dda18910a43d05c9 upstream. + +Even though the virtio-scsi spec guarantees that all requests related +to the TMF will have been completed by the time the TMF itself completes, +the request queue's callback might not have run yet. This causes requests +to be completed more than once, and as a result triggers a variety of +BUGs or oopses. + +Signed-off-by: Paolo Bonzini +Reviewed-by: Venkatesh Srinivas +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/virtio_scsi.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -273,6 +273,16 @@ static void virtscsi_req_done(struct vir + virtscsi_vq_done(vscsi, req_vq, virtscsi_complete_cmd); + }; + ++static void virtscsi_poll_requests(struct virtio_scsi *vscsi) ++{ ++ int i, num_vqs; ++ ++ num_vqs = vscsi->num_queues; ++ for (i = 0; i < num_vqs; i++) ++ virtscsi_vq_done(vscsi, &vscsi->req_vqs[i], ++ virtscsi_complete_cmd); ++} ++ + static void virtscsi_complete_free(struct virtio_scsi *vscsi, void *buf) + { + struct virtio_scsi_cmd *cmd = buf; +@@ -607,6 +617,18 @@ static int virtscsi_tmf(struct virtio_sc + cmd->resp.tmf.response == VIRTIO_SCSI_S_FUNCTION_SUCCEEDED) + ret = SUCCESS; + ++ /* ++ * The spec guarantees that all requests related to the TMF have ++ * been completed, but the callback might not have run yet if ++ * we're using independent interrupts (e.g. MSI). Poll the ++ * virtqueues once. ++ * ++ * In the abort case, sc->scsi_done will do nothing, because ++ * the block layer must have detected a timeout and as a result ++ * REQ_ATOM_COMPLETE has been set. ++ */ ++ virtscsi_poll_requests(vscsi); ++ + out: + mempool_free(cmd, virtscsi_cmd_pool); + return ret;