From a0c1c185fbe2cd6052059604380b26441e2f935f Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Wed, 30 May 2018 11:09:59 +0200 Subject: [PATCH 1/8] scsi: aacraid: remove bogus GFP_DMA32 specifies For one GFP_DMA32 does not actually work with kmalloc, as we only have GFP_DMA and GFP_KERNEL caches, but not GFP_DMA32. Second the memory is mapped using the proper DMA API anyway, which would include proper bounce buffering if needed by the device. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen --- drivers/scsi/aacraid/commctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c index a2b3430072c7..25f6600d6c09 100644 --- a/drivers/scsi/aacraid/commctrl.c +++ b/drivers/scsi/aacraid/commctrl.c @@ -845,7 +845,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) rcode = -EINVAL; goto cleanup; } - p = kmalloc(sg_count[i], GFP_KERNEL|GFP_DMA32); + p = kmalloc(sg_count[i], GFP_KERNEL); if (!p) { dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", sg_count[i], i, usg->count)); @@ -886,7 +886,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) rcode = -EINVAL; goto cleanup; } - p = kmalloc(sg_count[i], GFP_KERNEL|GFP_DMA32); + p = kmalloc(sg_count[i], GFP_KERNEL); if (!p) { dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", sg_count[i], i, upsg->count)); From 3aadbe2523cab462da24c62d9cac5e018a6e69d5 Mon Sep 17 00:00:00 2001 From: Damien Le Moal Date: Thu, 31 May 2018 17:42:40 +0900 Subject: [PATCH 2/8] scsi: sd_zbc: Fix sd_zbc_check_zone_size() error path If a drive with variable zone sizes or an invalid last zone size is detected, the local variable this_zone_blocks is set to 0 and early return from the function triggered, but this does not result in an error return. The local variable zone_blocks must be set to 0 for an error to be returned. [mkp: typo in commit description] Fixes: ccce20fc7968 ("scsi: sd_zbc: Avoid that resetting a zone fails sporadically") Signed-off-by: Damien Le Moal Cc: Bart Van Assche Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen --- drivers/scsi/sd_zbc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c index 210407cd2341..ff1ba996d87b 100644 --- a/drivers/scsi/sd_zbc.c +++ b/drivers/scsi/sd_zbc.c @@ -452,7 +452,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp) } else if (this_zone_blocks != zone_blocks && (block + this_zone_blocks < sdkp->capacity || this_zone_blocks > zone_blocks)) { - this_zone_blocks = 0; + zone_blocks = 0; goto out; } block += this_zone_blocks; From 0d98ba8d70b0070ac117452ea0b663e26bbf46bf Mon Sep 17 00:00:00 2001 From: Sinan Kaya Date: Sat, 2 Jun 2018 00:28:53 -0400 Subject: [PATCH 3/8] scsi: hpsa: disable device during shutdown 'Commit cc27b735ad3a ("PCI/portdrv: Turn off PCIe services during shutdown")' has been added to kernel to shutdown pending PCIe port service interrupts during reboot so that a newly started kexec kernel wouldn't observe pending interrupts. pcie_port_device_remove() is disabling the root port and switches by calling pci_disable_device() after all PCIe service drivers are shutdown. This has been found to cause crashes on HP DL360 Gen9 machines during reboot due to hpsa driver not clearing the bus master bit during the shutdown procedure by calling pci_disable_device(). Disable device as part of the shutdown sequence. Signed-off-by: Sinan Kaya Link: https://bugzilla.kernel.org/show_bug.cgi?id=199779 Fixes: cc27b735ad3a ("PCI/portdrv: Turn off PCIe services during shutdown") Cc: stable@vger.kernel.org Reported-by: Ryan Finnie Tested-by: Don Brace Acked-by: Don Brace Signed-off-by: Martin K. Petersen --- drivers/scsi/hpsa.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c index 3a9eca163db8..b92f86acb8bb 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -8869,7 +8869,7 @@ static void hpsa_disable_rld_caching(struct ctlr_info *h) kfree(options); } -static void hpsa_shutdown(struct pci_dev *pdev) +static void __hpsa_shutdown(struct pci_dev *pdev) { struct ctlr_info *h; @@ -8884,6 +8884,12 @@ static void hpsa_shutdown(struct pci_dev *pdev) hpsa_disable_interrupt_mode(h); /* pci_init 2 */ } +static void hpsa_shutdown(struct pci_dev *pdev) +{ + __hpsa_shutdown(pdev); + pci_disable_device(pdev); +} + static void hpsa_free_device_info(struct ctlr_info *h) { int i; @@ -8927,7 +8933,7 @@ static void hpsa_remove_one(struct pci_dev *pdev) scsi_remove_host(h->scsi_host); /* init_one 8 */ /* includes hpsa_free_irqs - init_one 4 */ /* includes hpsa_disable_interrupt_mode - pci_init 2 */ - hpsa_shutdown(pdev); + __hpsa_shutdown(pdev); hpsa_free_device_info(h); /* scan */ From 413c2f33489b134e3cc65d9c3ff7861e8fdfe899 Mon Sep 17 00:00:00 2001 From: Himanshu Madhani Date: Sun, 3 Jun 2018 22:09:53 -0700 Subject: [PATCH 4/8] scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails This patch prevents driver from setting lower default speed of 1 GB/sec, if the switch does not support Get Port Speed Capabilities (GPSC) command. Setting this default speed results into much lower write performance for large sequential WRITE. This patch modifies driver to check for gpsc_supported flags and prevents driver from issuing MBC_SET_PORT_PARAM (001Ah) to set default speed of 1 GB/sec. If driver does not send this mailbox command, firmware assumes maximum supported link speed and will operate at the max speed. Cc: stable@vger.kernel.org Signed-off-by: Himanshu Madhani Reported-by: Eda Zhou Reviewed-by: Ewan D. Milne Tested-by: Ewan D. Milne Signed-off-by: Martin K. Petersen --- drivers/scsi/qla2xxx/qla_init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 8f55dd44adae..636960ad029a 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -5037,7 +5037,8 @@ qla2x00_iidma_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) return; if (fcport->fp_speed == PORT_SPEED_UNKNOWN || - fcport->fp_speed > ha->link_data_rate) + fcport->fp_speed > ha->link_data_rate || + !ha->flags.gpsc_supported) return; rval = qla2x00_set_idma_speed(vha, fcport->loop_id, fcport->fp_speed, From 10ee1f2206a3f5aa869bede4b7505b24203a7715 Mon Sep 17 00:00:00 2001 From: Tomas Henzl Date: Thu, 24 May 2018 17:12:46 +0200 Subject: [PATCH 5/8] scsi: mpt3sas: Add an I/O barrier A barrier should be added to ensure proper ordering of memory mapped writes. Signed-off-by: Tomas Henzl Acked-by: Chaitra P B Signed-off-by: Martin K. Petersen --- drivers/scsi/mpt3sas/mpt3sas_base.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 61f93a134956..293f04119eba 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -3344,6 +3344,7 @@ _base_mpi_ep_writeq(__u64 b, volatile void __iomem *addr, spin_lock_irqsave(writeq_lock, flags); writel((u32)(data_out), addr); writel((u32)(data_out >> 32), (addr + 4)); + mmiowb(); spin_unlock_irqrestore(writeq_lock, flags); } From e73c864ba3b57cc3c5cc6b328b9da1b48637a6df Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Thu, 31 May 2018 13:31:17 +0100 Subject: [PATCH 6/8] scsi: aic7xxx: aic79xx: fix potential null pointer dereference on ahd If AHD_DEBUG is enabled and ahd_platform_alloc fails then ahd is set to null and the debug printk dereferences ahd when passing it to ahd_name. Fix this by moving the debug printk to before the call to ahd_platform_alloc where ahd is not null at that point. Detected by CoverityScan, CID#100296 ("Explicit null dereference") Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen --- drivers/scsi/aic7xxx/aic79xx_core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c index 034f4eebb160..3efd4cdc40a0 100644 --- a/drivers/scsi/aic7xxx/aic79xx_core.c +++ b/drivers/scsi/aic7xxx/aic79xx_core.c @@ -6112,10 +6112,6 @@ ahd_alloc(void *platform_arg, char *name) ahd->int_coalescing_stop_threshold = AHD_INT_COALESCING_STOP_THRESHOLD_DEFAULT; - if (ahd_platform_alloc(ahd, platform_arg) != 0) { - ahd_free(ahd); - ahd = NULL; - } #ifdef AHD_DEBUG if ((ahd_debug & AHD_SHOW_MEMORY) != 0) { printk("%s: scb size = 0x%x, hscb size = 0x%x\n", @@ -6123,6 +6119,10 @@ ahd_alloc(void *platform_arg, char *name) (u_int)sizeof(struct hardware_scb)); } #endif + if (ahd_platform_alloc(ahd, platform_arg) != 0) { + ahd_free(ahd); + ahd = NULL; + } return (ahd); } From 3cb182b3fa8b7a61f05c671525494697cba39c6a Mon Sep 17 00:00:00 2001 From: "Rodrigo R. Galvao" Date: Mon, 28 May 2018 14:58:44 -0300 Subject: [PATCH 7/8] scsi: qla2xxx: Fix crash on qla2x00_mailbox_command This patch fixes a crash on qla2x00_mailbox_command caused when the driver is on UNLOADING state and tries to call qla2x00_poll, which triggers a NULL pointer dereference. Signed-off-by: Rodrigo R. Galvao Signed-off-by: Mauro S. M. Rodrigues Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen --- drivers/scsi/qla2xxx/qla_mbx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c index d8a36c13aeda..7e875f575229 100644 --- a/drivers/scsi/qla2xxx/qla_mbx.c +++ b/drivers/scsi/qla2xxx/qla_mbx.c @@ -292,6 +292,14 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) if (time_after(jiffies, wait_time)) break; + /* + * Check if it's UNLOADING, cause we cannot poll in + * this case, or else a NULL pointer dereference + * is triggered. + */ + if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) + return QLA_FUNCTION_TIMEOUT; + /* Check for pending interrupts. */ qla2x00_poll(ha->rsp_q_map[0]); From 3cedc8797b9c0f2222fd45a01f849c57c088828b Mon Sep 17 00:00:00 2001 From: Anil Gurumurthy Date: Wed, 6 Jun 2018 08:41:42 -0700 Subject: [PATCH 8/8] scsi: qla2xxx: Mask off Scope bits in retry delay Some newer target uses "Status Qualifier" response in a returned "Busy Status". This new response code of 0x4001, which is "Scope" bits, translates to "Affects all units accessible by target". Due to this new value returned in the Scope bits, driver was using that value as timeout value which resulted into driver waiting for 27min timeout. This patch masks off this Scope bits so that driver does not use this value as retry delay time. Cc: Signed-off-by: Anil Gurumurthy Signed-off-by: Giridhar Malavali Signed-off-by: Himanshu Madhani Reviewed-by: Ewan D. Milne Reviewed-by: Martin Wilck Signed-off-by: Martin K. Petersen --- drivers/scsi/qla2xxx/qla_isr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index a3dc83f9444d..68560a097ae1 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -2494,8 +2494,12 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) ox_id = le16_to_cpu(sts24->ox_id); par_sense_len = sizeof(sts24->data); /* Valid values of the retry delay timer are 0x1-0xffef */ - if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) - retry_delay = sts24->retry_delay; + if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) { + retry_delay = sts24->retry_delay & 0x3fff; + ql_dbg(ql_dbg_io, sp->vha, 0x3033, + "%s: scope=%#x retry_delay=%#x\n", __func__, + sts24->retry_delay >> 14, retry_delay); + } } else { if (scsi_status & SS_SENSE_LEN_VALID) sense_len = le16_to_cpu(sts->req_sense_length);