From 159a28aaaafa67a34cf58b92dd94b5dac657149e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 20 Mar 2014 15:12:18 -0700 Subject: [PATCH] 3.13-stable patches added patches: can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch net-unix-socket-code-abuses-csum_partial.patch scsi-isci-correct-erroneous-for_each_isci_host-macro.patch scsi-isci-fix-reset-timeout-handling.patch scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch scsi-storvsc-null-pointer-dereference-fix.patch --- ...-en-dis-able-into-seperate-functions.patch | 69 ++++++++ ...rst-disable-chip-then-all-interrupts.patch | 44 +++++ ...-low-power-mode-in-chip_-en-dis-able.patch | 153 ++++++++++++++++++ ...ror-path-if-flexcan_chip_start-fails.patch | 39 +++++ ...an_remove-add-missing-netif_napi_del.patch | 32 ++++ ...unix-socket-code-abuses-csum_partial.patch | 83 ++++++++++ ...t-erroneous-for_each_isci_host-macro.patch | 75 +++++++++ ...scsi-isci-fix-reset-timeout-handling.patch | 62 +++++++ ...xx-fix-multiqueue-msi-x-registration.patch | 98 +++++++++++ ...itialization-for-isp25xx-and-isp83xx.patch | 30 ++++ ...storvsc-null-pointer-dereference-fix.patch | 51 ++++++ queue-3.13/series | 11 ++ 12 files changed, 747 insertions(+) create mode 100644 queue-3.13/can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch create mode 100644 queue-3.13/can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch create mode 100644 queue-3.13/can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch create mode 100644 queue-3.13/can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch create mode 100644 queue-3.13/can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch create mode 100644 queue-3.13/net-unix-socket-code-abuses-csum_partial.patch create mode 100644 queue-3.13/scsi-isci-correct-erroneous-for_each_isci_host-macro.patch create mode 100644 queue-3.13/scsi-isci-fix-reset-timeout-handling.patch create mode 100644 queue-3.13/scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch create mode 100644 queue-3.13/scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch create mode 100644 queue-3.13/scsi-storvsc-null-pointer-dereference-fix.patch diff --git a/queue-3.13/can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch b/queue-3.13/can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch new file mode 100644 index 00000000000..d89f68990b5 --- /dev/null +++ b/queue-3.13/can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch @@ -0,0 +1,69 @@ +From f003698e23f6f56a791774f14d0ac35d04872490 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 28 Feb 2014 17:18:27 +0100 +Subject: can: flexcan: factor out transceiver {en,dis}able into seperate functions + +From: Marc Kleine-Budde + +commit f003698e23f6f56a791774f14d0ac35d04872490 upstream. + +This patch moves the transceiver enable and disable into seperate functions, +where the NULL pointer check is hidden. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -261,6 +261,22 @@ static inline void flexcan_write(u32 val + } + #endif + ++static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv) ++{ ++ if (!priv->reg_xceiver) ++ return 0; ++ ++ return regulator_enable(priv->reg_xceiver); ++} ++ ++static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv) ++{ ++ if (!priv->reg_xceiver) ++ return 0; ++ ++ return regulator_disable(priv->reg_xceiver); ++} ++ + static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv, + u32 reg_esr) + { +@@ -805,11 +821,9 @@ static int flexcan_chip_start(struct net + if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES) + flexcan_write(0x0, ®s->rxfgmask); + +- if (priv->reg_xceiver) { +- err = regulator_enable(priv->reg_xceiver); +- if (err) +- goto out; +- } ++ err = flexcan_transceiver_enable(priv); ++ if (err) ++ goto out; + + /* synchronize with the can bus */ + reg_mcr = flexcan_read(®s->mcr); +@@ -854,8 +868,7 @@ static void flexcan_chip_stop(struct net + flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL, + ®s->ctrl); + +- if (priv->reg_xceiver) +- regulator_disable(priv->reg_xceiver); ++ flexcan_transceiver_disable(priv); + priv->can.state = CAN_STATE_STOPPED; + + return; diff --git a/queue-3.13/can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch b/queue-3.13/can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch new file mode 100644 index 00000000000..d9c4a08c7ae --- /dev/null +++ b/queue-3.13/can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch @@ -0,0 +1,44 @@ +From 5be93bdda64e85450598c6e97f79fb8f6acf30e0 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Wed, 19 Feb 2014 12:00:51 +0100 +Subject: can: flexcan: fix shutdown: first disable chip, then all interrupts + +From: Marc Kleine-Budde + +commit 5be93bdda64e85450598c6e97f79fb8f6acf30e0 upstream. + +When shutting down the CAN interface (ifconfig canX down) during high CAN bus +loads, the CAN core might hang and freeze the whole CPU. + +This patch fixes the shutdown sequence by first disabling the CAN core then +disabling all interrupts. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -824,14 +824,16 @@ static void flexcan_chip_stop(struct net + struct flexcan_regs __iomem *regs = priv->base; + u32 reg; + +- /* Disable all interrupts */ +- flexcan_write(0, ®s->imask1); +- + /* Disable + halt module */ + reg = flexcan_read(®s->mcr); + reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT; + flexcan_write(reg, ®s->mcr); + ++ /* Disable all interrupts */ ++ flexcan_write(0, ®s->imask1); ++ flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL, ++ ®s->ctrl); ++ + if (priv->reg_xceiver) + regulator_disable(priv->reg_xceiver); + priv->can.state = CAN_STATE_STOPPED; diff --git a/queue-3.13/can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch b/queue-3.13/can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch new file mode 100644 index 00000000000..ab30501f85f --- /dev/null +++ b/queue-3.13/can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch @@ -0,0 +1,153 @@ +From 9b00b300e7bce032c467c36ca47fe2a776887fc2 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 28 Feb 2014 15:30:18 +0100 +Subject: can: flexcan: fix transition from and to low power mode in chip_{en,dis}able + +From: Marc Kleine-Budde + +commit 9b00b300e7bce032c467c36ca47fe2a776887fc2 upstream. + +In flexcan_chip_enable() and flexcan_chip_disable() fixed delays are used. +Experiments have shown that the transition from and to low power mode may take +several microseconds. + +This patch adds a while loop which polls the Low Power Mode ACK bit (LPM_ACK) +that indicates a successfull mode change. If the function runs into a timeout a +error value is returned. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 50 ++++++++++++++++++++++++++++++++++------------ + 1 file changed, 38 insertions(+), 12 deletions(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -144,6 +144,8 @@ + + #define FLEXCAN_MB_CODE_MASK (0xf0ffffff) + ++#define FLEXCAN_TIMEOUT_US (50) ++ + /* + * FLEXCAN hardware feature flags + * +@@ -266,26 +268,42 @@ static inline int flexcan_has_and_handle + (reg_esr & FLEXCAN_ESR_ERR_BUS); + } + +-static inline void flexcan_chip_enable(struct flexcan_priv *priv) ++static int flexcan_chip_enable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->base; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = flexcan_read(®s->mcr); + reg &= ~FLEXCAN_MCR_MDIS; + flexcan_write(reg, ®s->mcr); + +- udelay(10); ++ while (timeout-- && (flexcan_read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ usleep_range(10, 20); ++ ++ if (flexcan_read(®s->mcr) & FLEXCAN_MCR_LPM_ACK) ++ return -ETIMEDOUT; ++ ++ return 0; + } + +-static inline void flexcan_chip_disable(struct flexcan_priv *priv) ++static int flexcan_chip_disable(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->base; ++ unsigned int timeout = FLEXCAN_TIMEOUT_US / 10; + u32 reg; + + reg = flexcan_read(®s->mcr); + reg |= FLEXCAN_MCR_MDIS; + flexcan_write(reg, ®s->mcr); ++ ++ while (timeout-- && !(flexcan_read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ usleep_range(10, 20); ++ ++ if (!(flexcan_read(®s->mcr) & FLEXCAN_MCR_LPM_ACK)) ++ return -ETIMEDOUT; ++ ++ return 0; + } + + static int flexcan_get_berr_counter(const struct net_device *dev, +@@ -706,7 +724,9 @@ static int flexcan_chip_start(struct net + u32 reg_mcr, reg_ctrl; + + /* enable module */ +- flexcan_chip_enable(priv); ++ err = flexcan_chip_enable(priv); ++ if (err) ++ return err; + + /* soft reset */ + flexcan_write(FLEXCAN_MCR_SOFTRST, ®s->mcr); +@@ -946,12 +966,16 @@ static int register_flexcandev(struct ne + goto out_disable_ipg; + + /* select "bus clock", chip must be disabled */ +- flexcan_chip_disable(priv); ++ err = flexcan_chip_disable(priv); ++ if (err) ++ goto out_disable_per; + reg = flexcan_read(®s->ctrl); + reg |= FLEXCAN_CTRL_CLK_SRC; + flexcan_write(reg, ®s->ctrl); + +- flexcan_chip_enable(priv); ++ err = flexcan_chip_enable(priv); ++ if (err) ++ goto out_chip_disable; + + /* set freeze, halt and activate FIFO, restrict register access */ + reg = flexcan_read(®s->mcr); +@@ -968,14 +992,15 @@ static int register_flexcandev(struct ne + if (!(reg & FLEXCAN_MCR_FEN)) { + netdev_err(dev, "Could not enable RX FIFO, unsupported core\n"); + err = -ENODEV; +- goto out_disable_per; ++ goto out_chip_disable; + } + + err = register_candev(dev); + +- out_disable_per: + /* disable core and turn off clocks */ ++ out_chip_disable: + flexcan_chip_disable(priv); ++ out_disable_per: + clk_disable_unprepare(priv->clk_per); + out_disable_ipg: + clk_disable_unprepare(priv->clk_ipg); +@@ -1118,8 +1143,11 @@ static int flexcan_suspend(struct device + { + struct net_device *dev = dev_get_drvdata(device); + struct flexcan_priv *priv = netdev_priv(dev); ++ int err; + +- flexcan_chip_disable(priv); ++ err = flexcan_chip_disable(priv); ++ if (err) ++ return err; + + if (netif_running(dev)) { + netif_stop_queue(dev); +@@ -1140,9 +1168,7 @@ static int flexcan_resume(struct device + netif_device_attach(dev); + netif_start_queue(dev); + } +- flexcan_chip_enable(priv); +- +- return 0; ++ return flexcan_chip_enable(priv); + } + #endif /* CONFIG_PM_SLEEP */ + diff --git a/queue-3.13/can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch b/queue-3.13/can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch new file mode 100644 index 00000000000..e433a68d27c --- /dev/null +++ b/queue-3.13/can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch @@ -0,0 +1,39 @@ +From 7e9e148af01ef388efb6e2490805970be4622792 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 28 Feb 2014 14:52:01 +0100 +Subject: can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails + +From: Marc Kleine-Budde + +commit 7e9e148af01ef388efb6e2490805970be4622792 upstream. + +If flexcan_chip_start() in flexcan_open() fails, the interrupt is not freed, +this patch adds the missing cleanup. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -865,7 +865,7 @@ static int flexcan_open(struct net_devic + /* start chip and queuing */ + err = flexcan_chip_start(dev); + if (err) +- goto out_close; ++ goto out_free_irq; + + can_led_event(dev, CAN_LED_EVENT_OPEN); + +@@ -874,6 +874,8 @@ static int flexcan_open(struct net_devic + + return 0; + ++ out_free_irq: ++ free_irq(dev->irq, dev); + out_close: + close_candev(dev); + out_disable_per: diff --git a/queue-3.13/can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch b/queue-3.13/can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch new file mode 100644 index 00000000000..03e6c29b739 --- /dev/null +++ b/queue-3.13/can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch @@ -0,0 +1,32 @@ +From d96e43e8fce28cf97df576a07af9d65657a41a6f Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Fri, 28 Feb 2014 20:48:36 +0100 +Subject: can: flexcan: flexcan_remove(): add missing netif_napi_del() + +From: Marc Kleine-Budde + +commit d96e43e8fce28cf97df576a07af9d65657a41a6f upstream. + +This patch adds the missing netif_napi_del() to the flexcan_remove() function. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/flexcan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1143,9 +1143,10 @@ static int flexcan_probe(struct platform + static int flexcan_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); ++ struct flexcan_priv *priv = netdev_priv(dev); + + unregister_flexcandev(dev); +- ++ netif_napi_del(&priv->napi); + free_candev(dev); + + return 0; diff --git a/queue-3.13/net-unix-socket-code-abuses-csum_partial.patch b/queue-3.13/net-unix-socket-code-abuses-csum_partial.patch new file mode 100644 index 00000000000..064b49407b5 --- /dev/null +++ b/queue-3.13/net-unix-socket-code-abuses-csum_partial.patch @@ -0,0 +1,83 @@ +From 0a13404dd3bf4ea870e3d96270b5a382edca85c0 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Wed, 5 Mar 2014 14:29:58 +1100 +Subject: net: unix socket code abuses csum_partial + +From: Anton Blanchard + +commit 0a13404dd3bf4ea870e3d96270b5a382edca85c0 upstream. + +The unix socket code is using the result of csum_partial to +hash into a lookup table: + + unix_hash_fold(csum_partial(sunaddr, len, 0)); + +csum_partial is only guaranteed to produce something that can be +folded into a checksum, as its prototype explains: + + * returns a 32-bit number suitable for feeding into itself + * or csum_tcpudp_magic + +The 32bit value should not be used directly. + +Depending on the alignment, the ppc64 csum_partial will return +different 32bit partial checksums that will fold into the same +16bit checksum. + +This difference causes the following testcase (courtesy of +Gustavo) to sometimes fail: + +#include +#include + +int main() +{ + int fd = socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0); + + int i = 1; + setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &i, 4); + + struct sockaddr addr; + addr.sa_family = AF_LOCAL; + bind(fd, &addr, 2); + + listen(fd, 128); + + struct sockaddr_storage ss; + socklen_t sslen = (socklen_t)sizeof(ss); + getsockname(fd, (struct sockaddr*)&ss, &sslen); + + fd = socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0); + + if (connect(fd, (struct sockaddr*)&ss, sslen) == -1){ + perror(NULL); + return 1; + } + printf("OK\n"); + return 0; +} + +As suggested by davem, fix this by using csum_fold to fold the +partial 32bit checksum into a 16bit checksum before using it. + +Signed-off-by: Anton Blanchard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/unix/af_unix.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -161,9 +161,8 @@ static inline void unix_set_secdata(stru + + static inline unsigned int unix_hash_fold(__wsum n) + { +- unsigned int hash = (__force unsigned int)n; ++ unsigned int hash = (__force unsigned int)csum_fold(n); + +- hash ^= hash>>16; + hash ^= hash>>8; + return hash&(UNIX_HASH_SIZE-1); + } diff --git a/queue-3.13/scsi-isci-correct-erroneous-for_each_isci_host-macro.patch b/queue-3.13/scsi-isci-correct-erroneous-for_each_isci_host-macro.patch new file mode 100644 index 00000000000..576ed66cdb5 --- /dev/null +++ b/queue-3.13/scsi-isci-correct-erroneous-for_each_isci_host-macro.patch @@ -0,0 +1,75 @@ +From c59053a23d586675c25d789a7494adfdc02fba57 Mon Sep 17 00:00:00 2001 +From: Lukasz Dorau +Date: Thu, 6 Feb 2014 12:23:20 -0800 +Subject: SCSI: isci: correct erroneous for_each_isci_host macro + +From: Lukasz Dorau + +commit c59053a23d586675c25d789a7494adfdc02fba57 upstream. + +In the first place, the loop 'for' in the macro 'for_each_isci_host' +(drivers/scsi/isci/host.h:314) is incorrect, because it accesses +the 3rd element of 2 element array. After the 2nd iteration it executes +the instruction: + ihost = to_pci_info(pdev)->hosts[2] +(while the size of the 'hosts' array equals 2) and reads an +out of range element. + +In the second place, this loop is incorrectly optimized by GCC v4.8 +(see http://marc.info/?l=linux-kernel&m=138998871911336&w=2). +As a result, on platforms with two SCU controllers, +the loop is executed more times than it can be (for i=0,1 and 2). +It causes kernel panic during entering the S3 state +and the following oops after 'rmmod isci': + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] __list_add+0x1b/0xc0 +Oops: 0000 [#1] SMP +RIP: 0010:[] [] __list_add+0x1b/0xc0 +Call Trace: + [] __mutex_lock_slowpath+0x114/0x1b0 + [] mutex_lock+0x1f/0x30 + [] sas_disable_events+0x1b/0x50 [libsas] + [] sas_unregister_ha+0x18/0x60 [libsas] + [] isci_unregister+0x1e/0x40 [isci] + [] isci_pci_remove+0x5d/0x100 [isci] + [] pci_device_remove+0x3b/0xb0 + [] __device_release_driver+0x7f/0xf0 + [] driver_detach+0xa8/0xb0 + [] bus_remove_driver+0x9b/0x120 + [] driver_unregister+0x2c/0x50 + [] pci_unregister_driver+0x23/0x80 + [] isci_exit+0x10/0x1e [isci] + [] SyS_delete_module+0x16b/0x2d0 + [] ? do_notify_resume+0x61/0xa0 + [] system_call_fastpath+0x16/0x1b + +The loop has been corrected. +This patch fixes kernel panic during entering the S3 state +and the above oops. + +Signed-off-by: Lukasz Dorau +Reviewed-by: Maciej Patelczyk +Tested-by: Lukasz Dorau +Signed-off-by: Dan Williams +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/isci/host.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/isci/host.h ++++ b/drivers/scsi/isci/host.h +@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost + } + + #define for_each_isci_host(id, ihost, pdev) \ +- for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \ +- id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \ +- ihost = to_pci_info(pdev)->hosts[++id]) ++ for (id = 0; id < SCI_MAX_CONTROLLERS && \ ++ (ihost = to_pci_info(pdev)->hosts[id]); id++) + + static inline void wait_for_start(struct isci_host *ihost) + { diff --git a/queue-3.13/scsi-isci-fix-reset-timeout-handling.patch b/queue-3.13/scsi-isci-fix-reset-timeout-handling.patch new file mode 100644 index 00000000000..ee86e2ca054 --- /dev/null +++ b/queue-3.13/scsi-isci-fix-reset-timeout-handling.patch @@ -0,0 +1,62 @@ +From ddfadd7736b677de2d4ca2cd5b4b655368c85a7a Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 6 Feb 2014 12:23:01 -0800 +Subject: SCSI: isci: fix reset timeout handling + +From: Dan Williams + +commit ddfadd7736b677de2d4ca2cd5b4b655368c85a7a upstream. + +Remove an erroneous BUG_ON() in the case of a hard reset timeout. The +reset timeout handler puts the port into the "awaiting link-up" state. +The timeout causes the device to be disconnected and we need to be in +the awaiting link-up state to re-connect the port. The BUG_ON() made +the incorrect assumption that resets never timeout and we always +complete the reset in the "resetting" state. + +Testing this patch also uncovered that libata continues to attempt to +reset the port long after the driver has torn down the context. Once +the driver has committed to abandoning the link it must indicate to +libata that recovery ends by returning -ENODEV from +->lldd_I_T_nexus_reset(). + +Acked-by: Lukasz Dorau +Reported-by: David Milburn +Reported-by: Xun Ni +Tested-by: Xun Ni +Signed-off-by: Dan Williams +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/isci/port_config.c | 7 ------- + drivers/scsi/isci/task.c | 2 +- + 2 files changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/scsi/isci/port_config.c ++++ b/drivers/scsi/isci/port_config.c +@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct + SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION); + } else { + /* the phy is already the part of the port */ +- u32 port_state = iport->sm.current_state_id; +- +- /* if the PORT'S state is resetting then the link up is from +- * port hard reset in this case, we need to tell the port +- * that link up is recieved +- */ +- BUG_ON(port_state != SCI_PORT_RESETTING); + port_agent->phy_ready_mask |= 1 << phy_index; + sci_port_link_up(iport, iphy); + } +--- a/drivers/scsi/isci/task.c ++++ b/drivers/scsi/isci/task.c +@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct dom + /* XXX: need to cleanup any ireqs targeting this + * domain_device + */ +- ret = TMF_RESP_FUNC_COMPLETE; ++ ret = -ENODEV; + goto out; + } + diff --git a/queue-3.13/scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch b/queue-3.13/scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch new file mode 100644 index 00000000000..9fcade15bb8 --- /dev/null +++ b/queue-3.13/scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch @@ -0,0 +1,98 @@ +From f324777ea88bab2522602671e46fc0851d7d5e35 Mon Sep 17 00:00:00 2001 +From: Chad Dupuis +Date: Wed, 26 Feb 2014 04:15:14 -0500 +Subject: SCSI: qla2xxx: Fix multiqueue MSI-X registration. + +From: Chad Dupuis + +commit f324777ea88bab2522602671e46fc0851d7d5e35 upstream. + +This fixes requesting of the MSI-X vectors for the base response queue. +The iteration in the for loop in qla24xx_enable_msix() was incorrect. +We should only iterate of the first two MSI-X vectors and not the total +number of MSI-X vectors that have given to the driver for this device +from pci_enable_msix() in this function. + +Signed-off-by: Chad Dupuis +Signed-off-by: Saurav Kashyap +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_isr.c | 46 ++++++++++++++++++++++++++--------------- + 1 file changed, 30 insertions(+), 16 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -2829,6 +2829,7 @@ static int + qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp) + { + #define MIN_MSIX_COUNT 2 ++#define ATIO_VECTOR 2 + int i, ret; + struct msix_entry *entries; + struct qla_msix_entry *qentry; +@@ -2885,34 +2886,47 @@ msix_failed: + } + + /* Enable MSI-X vectors for the base queue */ +- for (i = 0; i < ha->msix_count; i++) { ++ for (i = 0; i < 2; i++) { + qentry = &ha->msix_entries[i]; +- if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) { +- ret = request_irq(qentry->vector, +- qla83xx_msix_entries[i].handler, +- 0, qla83xx_msix_entries[i].name, rsp); +- } else if (IS_P3P_TYPE(ha)) { ++ if (IS_P3P_TYPE(ha)) + ret = request_irq(qentry->vector, + qla82xx_msix_entries[i].handler, + 0, qla82xx_msix_entries[i].name, rsp); +- } else { ++ else + ret = request_irq(qentry->vector, + msix_entries[i].handler, + 0, msix_entries[i].name, rsp); +- } +- if (ret) { +- ql_log(ql_log_fatal, vha, 0x00cb, +- "MSI-X: unable to register handler -- %x/%d.\n", +- qentry->vector, ret); +- qla24xx_disable_msix(ha); +- ha->mqenable = 0; +- goto msix_out; +- } ++ if (ret) ++ goto msix_register_fail; + qentry->have_irq = 1; + qentry->rsp = rsp; + rsp->msix = qentry; + } + ++ /* ++ * If target mode is enable, also request the vector for the ATIO ++ * queue. ++ */ ++ if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) { ++ qentry = &ha->msix_entries[ATIO_VECTOR]; ++ ret = request_irq(qentry->vector, ++ qla83xx_msix_entries[ATIO_VECTOR].handler, ++ 0, qla83xx_msix_entries[ATIO_VECTOR].name, rsp); ++ qentry->have_irq = 1; ++ qentry->rsp = rsp; ++ rsp->msix = qentry; ++ } ++ ++msix_register_fail: ++ if (ret) { ++ ql_log(ql_log_fatal, vha, 0x00cb, ++ "MSI-X: unable to register handler -- %x/%d.\n", ++ qentry->vector, ret); ++ qla24xx_disable_msix(ha); ++ ha->mqenable = 0; ++ goto msix_out; ++ } ++ + /* Enable MSI-X vector for response queue update for queue 0 */ + if (IS_QLA83XX(ha)) { + if (ha->msixbase && ha->mqiobase && diff --git a/queue-3.13/scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch b/queue-3.13/scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch new file mode 100644 index 00000000000..c0597d3cbc0 --- /dev/null +++ b/queue-3.13/scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch @@ -0,0 +1,30 @@ +From b77ed25c9f8402e8b3e49e220edb4ef09ecfbb53 Mon Sep 17 00:00:00 2001 +From: Giridhar Malavali +Date: Wed, 26 Feb 2014 04:15:12 -0500 +Subject: SCSI: qla2xxx: Poll during initialization for ISP25xx and ISP83xx + +From: Giridhar Malavali + +commit b77ed25c9f8402e8b3e49e220edb4ef09ecfbb53 upstream. + +Signed-off-by: Giridhar Malavali +Signed-off-by: Saurav Kashyap +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_def.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2993,8 +2993,7 @@ struct qla_hw_data { + IS_QLA82XX(ha) || IS_QLA83XX(ha) || \ + IS_QLA8044(ha)) + #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) +-#define IS_NOPOLLING_TYPE(ha) ((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \ +- IS_QLA83XX(ha)) && (ha)->flags.msix_enabled) ++#define IS_NOPOLLING_TYPE(ha) (IS_QLA81XX(ha) && (ha)->flags.msix_enabled) + #define IS_FAC_REQUIRED(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + #define IS_ALOGIO_CAPABLE(ha) (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha)) diff --git a/queue-3.13/scsi-storvsc-null-pointer-dereference-fix.patch b/queue-3.13/scsi-storvsc-null-pointer-dereference-fix.patch new file mode 100644 index 00000000000..af9e8cafe9a --- /dev/null +++ b/queue-3.13/scsi-storvsc-null-pointer-dereference-fix.patch @@ -0,0 +1,51 @@ +From b12bb60d6c350b348a4e1460cd68f97ccae9822e Mon Sep 17 00:00:00 2001 +From: Ales Novak +Date: Thu, 27 Feb 2014 11:03:30 +0100 +Subject: SCSI: storvsc: NULL pointer dereference fix + +From: Ales Novak + +commit b12bb60d6c350b348a4e1460cd68f97ccae9822e upstream. + +If the initialization of storvsc fails, the storvsc_device_destroy() +causes NULL pointer dereference. + +storvsc_bus_scan() + scsi_scan_target() + __scsi_scan_target() + scsi_probe_and_add_lun(hostdata=NULL) + scsi_alloc_sdev(hostdata=NULL) + + sdev->hostdata = hostdata + + now the host allocation fails + + __scsi_remove_device(sdev) + + calls sdev->host->hostt->slave_destroy() == + storvsc_device_destroy(sdev) + access of sdev->hostdata->request_mempool + +Signed-off-by: Ales Novak +Signed-off-by: Thomas Abraham +Reviewed-by: Jiri Kosina +Acked-by: K. Y. Srinivasan +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/storvsc_drv.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struc + { + struct stor_mem_pools *memp = sdevice->hostdata; + ++ if (!memp) ++ return; ++ + mempool_destroy(memp->request_mempool); + kmem_cache_destroy(memp->request_pool); + kfree(memp); diff --git a/queue-3.13/series b/queue-3.13/series index d0470688de0..c7c261b8884 100644 --- a/queue-3.13/series +++ b/queue-3.13/series @@ -122,3 +122,14 @@ dm-cache-mq-fix-memory-allocation-failure-for-large-cache-devices.patch dm-space-map-metadata-fix-refcount-decrement-below-0-which-caused-corruption.patch dm-cache-fix-truncation-bug-when-copying-a-block-to-from-2tb-fast-device.patch dm-cache-fix-access-beyond-end-of-origin-device.patch +net-unix-socket-code-abuses-csum_partial.patch +can-flexcan-fix-shutdown-first-disable-chip-then-all-interrupts.patch +can-flexcan-flexcan_open-fix-error-path-if-flexcan_chip_start-fails.patch +can-flexcan-fix-transition-from-and-to-low-power-mode-in-chip_-en-dis-able.patch +can-flexcan-factor-out-transceiver-en-dis-able-into-seperate-functions.patch +can-flexcan-flexcan_remove-add-missing-netif_napi_del.patch +scsi-isci-fix-reset-timeout-handling.patch +scsi-isci-correct-erroneous-for_each_isci_host-macro.patch +scsi-qla2xxx-poll-during-initialization-for-isp25xx-and-isp83xx.patch +scsi-qla2xxx-fix-multiqueue-msi-x-registration.patch +scsi-storvsc-null-pointer-dereference-fix.patch -- 2.47.3