summaryrefslogtreecommitdiffstats
path: root/drivers/scsi
Commit message (Collapse)AuthorAgeFilesLines
* [SCSI] lpfc 8.2.3 : FC Discovery FixesJames Smart2008-01-117-204/+300
| | | | | | | | | | | | | FC Discovery Fixes: - Fix up lpfc_drop_node() vs lpfc_nlp_not_used() usage - Clear ADISC flag when unregistering RPI and REMOVE ndlps if in recovery. - Fix usage of UNUSED list and ndlps - Fix PLOGI race conditions - Reset link if NameServer PLOGI errors occur - Synchronize GID_FT queries with PLOGI receptions Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] lpfc 8.2.3 : Miscellaneous Small Fixes - part 1James Smart2008-01-1112-148/+372
| | | | | | | | | | | | | | | | | | | | | | | | | | | Miscellaneous Small Fixes - part 1 - Fix typo kmzlloc -> kzalloc - Fix discovery ndlp use after free panic - Fix link event causing flood of 0108 messages - Relieve some mbox congestion on link up with 100 vports - Fix broken vport parameters - Prevent lock recursion in logo_reglogin_issue - Split uses of error variable in lpfc_pci_probe_one into retval and error - Remove completion code related to dev_loss_tmo - Remove unused LPFC_MAX_HBQ #define - Don't compare pointers to 0 for sparse - Make 2 functions static for sparse - Fix default rpi cleanup code causing rogue ndlps to remain on the NPR list - Remove annoying ELS messages when driver is unloaded - Fix Cannot issue Register Fabric login problems on link up - Remove LPFC_EVT_DEV_LOSS_DELAY - Fix FC port swap test leads to device going offline - Fix vport CT flags to only be set when accepted - Add code to handle signals during vport_create - Fix too many retries in FC-AL mode - Pull lpfc_port_link_failure out of lpfc_linkdown_port Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] lpfc 8.2.3 : Remove flawed MBX_STOP_IOCB logicJames Smart2008-01-116-109/+27
| | | | | | | Remove flawed MBX_STOP_IOCB logic Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] lpfc 8.2.3 : NPIV bug fixesJames Smart2008-01-117-81/+127
| | | | | | | | | | | NPIV bug fixes: - Remove vport params on physical hba when npiv is disabled - Implement new DA_ID CT command to remove vport information from the switch after delete. Some switches didn't clean this up unless the physical link dropped. Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] lpfc 8.2.3 : Added support for ASICs that report temperatureJames Smart2008-01-119-2/+213
| | | | | | | | Added support for ASICs that report temperature. Temperature notices are reported as events and logged. Temperature can be read via sysfs. Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] ibmvscsi: Set default command timeoutBrian King2008-01-111-1/+3
| | | | | | | | | | Set the default command timeout for ibmvscsi disks to 60 seconds to ensure we don't prematurely timeout commands. This fixes a problem seen where the default 30 seconds was not long enough due to congestion on the server. Signed-off-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] 53c7xx: fix removal falloutAdrian Bunk2008-01-111-2/+0
| | | | | | | | This patch does some additional cleanups after the 53c7xx removal. Signed-off-by: Adrian Bunk <bunk@kernel.org> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] tgt: convert to use the data buffer accessorsFUJITA Tomonori2008-01-114-18/+20
| | | | | | | | - convert to use the new accessors for the sg lists and the parameters. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] aic94xx: update BIOS image from user space.Gilbert Wu2008-01-114-0/+697
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Create a file "update_bios" in sysfs to allow user to update bios from user space. 2. The BIOS image file can be downloaded from web site "http://www.adaptec.com/en-US/downloads/bios_fw/bios_fw_ver?productId=SAS-48300&dn=Adaptec+Serial+Attached+SCSI+48300" and copy the BIOS image into /lib/firmware folder. 3. The aic994xx will accept "update bios_file" and "verify bios_file" commands to perform update and verify BIOS image . For example: Type "echo "update asc483c01.ufi" > /sys/devices/.../update_bios" to update BIOS image from /lib/firmware/as483c01.ufi file into HBA's flash memory. Type "echo "verify asc483c01.ufi" > /sys/devices/.../update_bios" to verify BIOS image between /lib/firmware/asc48c01.ufi file and HBA's flash memory. 4. Type "cat /sys/devices/.../update_bios" to view the status or result of updating BIOS. Signed-off-by: Gilbert Wu <gilbert_wu@adaptec.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] sr,sd: send media state change modification eventsKay Sievers2008-01-113-12/+27
| | | | | | | | | | | | | | | | | | | | | | | This will send for a card reader slot (remove/add media): UEVENT[1187091572.155884] change /devices/pci0000:00/0000:00:1d.7/usb5/5-2/5-2:1.0/host7/target7:0:0/7:0:0:0 (scsi) UEVENT[1187091572.162314] remove /block/sdb/sdb1 (block) UEVENT[1187091572.172464] add /block/sdb/sdb1 (block) UEVENT[1187091572.175408] change /devices/pci0000:00/0000:00:1d.7/usb5/5-2/5-2:1.0/host7/target7:0:0/7:0:0:0 (scsi) and for a DVD drive (add/eject media): UEVENT[1187091590.189159] change /devices/pci0000:00/0000:00:1f.1/host4/target4:0:0/4:0:0:0 (scsi) UEVENT[1187091590.957124] add /module/isofs (module) UEVENT[1187091604.468207] change /devices/pci0000:00/0000:00:1f.1/host4/target4:0:0/4:0:0:0 (scsi) Userspace gets events, even for unpartitioned media. This unifies the event handling for asynchronoous events (AN) and events caused by perodical polling the device from userspace. Signed-off-by: Kay Sievers <kay.sievers@vrfy.org> [jejb: modified for new event API] Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* [SCSI] qla1280: fix 32 bit segment codeFUJITA Tomonori2008-01-091-1/+1
| | | | | | | | | | | | | | | | There's an error remaining in the 32 bit descriptor code after the conversion to dma accessors: req_cnt is left uninitialised. qla1280_32bit_start_scsi gives the following warnings: drivers/scsi/qla1280.c: In function 'qla1280_32bit_start_scsi': drivers/scsi/qla1280.c:3044: warning: unused variable 'dma_handle' drivers/scsi/qla1280.c: In function 'qla1280_queuecommand': drivers/scsi/qla1280.c:3060: warning: 'req_cnt' is used uninitialized in this function drivers/scsi/qla1280.c:3042: note: 'req_cnt' was declared here Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* Revert "scsi: revert "[SCSI] Get rid of scsi_cmnd->done""Linus Torvalds2008-01-066-43/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ac40532ef0b8649e6f7f83859ea0de1c4ed08a19, which gets us back the original cleanup of 6f5391c283d7fdcf24bf40786ea79061919d1e1d. It turns out that the bug that was triggered by that commit was apparently not actually triggered by that commit at all, and just the testing conditions had changed enough to make it appear to be due to it. The real problem seems to have been found by Peter Osterlund: "pktcdvd sets it [block device size] when opening the /dev/pktcdvd device, but when the drive is later opened as /dev/scd0, there is nothing that sets it back. (Btw, 40944 is possible if the disk is a CDRW that was formatted with "cdrwtool -m 10236".) The problem is that pktcdvd opens the cd device in non-blocking mode when pktsetup is run, and doesn't close it again until pktsetup -d is run. The effect is that if you meanwhile open the cd device, blkdev.c:do_open() doesn't call bd_set_size() because bdev->bd_openers is non-zero." In particular, to repeat the bug (regardless of whether commit 6f5391c283d7fdcf24bf40786ea79061919d1e1d is applied or not): " 1. Start with an empty drive. 2. pktsetup 0 /dev/scd0 3. Insert a CD containing an isofs filesystem. 4. mount /dev/pktcdvd/0 /mnt/tmp 5. umount /mnt/tmp 6. Press the eject button. 7. Insert a DVD containing a non-writable filesystem. 8. mount /dev/scd0 /mnt/tmp 9. find /mnt/tmp -type f -print0 | xargs -0 sha1sum >/dev/null 10. If the DVD contains data beyond the physical size of a CD, you get I/O errors in the terminal, and dmesg reports lots of "attempt to access beyond end of device" errors." which in turn is because the nested open after the media change won't cause the size to be set properly (because the original open still holds the block device, and we only do the bd_set_size() when we don't have other people holding the device open). The proper fix for that is probably to just do something like bdev->bd_inode->i_size = (loff_t)get_capacity(disk)<<9; in fs/block_dev.c:do_open() even for the cases where we're not the original opener (but *not* call bd_set_size(), since that will also change the block size of the device). Cc: Peter Osterlund <petero2@telia.com> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: Matthew Wilcox <matthew@wil.cx> Cc: Ingo Molnar <mingo@elte.hu> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* [SCSI] SRP transport: only remove our own entriesDave Dillow2008-01-041-1/+2
| | | | | | | | | | | | The SCSI SRP transport class currently iterates over all children devices of the host that is being removed in srp_remove_host(). However, not all of those children were created by the SRP transport, and removing them will cause corruption and an oops when their creator tries to remove them. Signed-off-by: David Dillow <dillowda@ornl.gov> Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds2008-01-033-1/+21
|\ | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] scsi_sysfs: restore prep_fn when ULD is removed
| * [SCSI] scsi_sysfs: restore prep_fn when ULD is removedJames Bottomley2008-01-023-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A recent bug report: http://bugzilla.kernel.org/show_bug.cgi?id=9674 Was caused because the ULDs now set their own prep functions, but don't necessarily reset the prep function back to the SCSI default when they are removed. This leads to panics if commands are sent to the device after the module is removed because the prep_fn is still pointing to the old module code. The fix for this is to implement a bus remove method that resets the prep_fn pointer correctly before calling the ULD specific driver remove method. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* | scsi: revert "[SCSI] Get rid of scsi_cmnd->done"Ingo Molnar2008-01-026-42/+43
|/ | | | | | | | | | | | | | | | | This reverts commit 6f5391c283d7fdcf24bf40786ea79061919d1e1d ("[SCSI] Get rid of scsi_cmnd->done") that was supposed to be a cleanup commit, but apparently it causes regressions: Bug 9370 - v2.6.24-rc2-409-g9418d5d: attempt to access beyond end of device http://bugzilla.kernel.org/show_bug.cgi?id=9370 this patch should be reintroduced in a more split-up form to make testing of it easier. Signed-off-by: Ingo Molnar <mingo@elte.hu> Acked-by: Matthew Wilcox <matthew@wil.cx> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds2007-12-195-4/+6
|\ | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] initio: bugfix for accessors patch [SCSI] st: fix kernel BUG at include/linux/scatterlist.h:59! [SCSI] initio: fix conflict when loading driver [SCSI] sym53c8xx: fix "irq X: nobody cared" regression [SCSI] dpt_i2o: driver is only 32 bit so don't set 64 bit DMA mask [SCSI] sym53c8xx: fix free_irq() regression
| * [SCSI] initio: bugfix for accessors patchBoaz Harrosh2007-12-181-0/+1
| | | | | | | | | | | | | | | | | | | | patch: [SCSI] initio: convert to use the data buffer accessors had a small but fatal bug in that it didn't increment the pointer into the initio scatterlist descriptors as it looped over the block generated ones. Fixed here. Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] st: fix kernel BUG at include/linux/scatterlist.h:59!FUJITA Tomonori2007-12-181-0/+1
| | | | | | | | | | | | | | | | | | This is caused by a missing scatterlist initialisation (it only shows up when sg list handling debugging is turned on). Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Kai Makisara <Kai.Makisara@kolumbus.fi> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] initio: fix conflict when loading driverAlan Cox2007-12-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | > I have a scanner connected to a Initio INI-950 SCSI card and I recently > upgraded from SuSE 10.2 to 10.3. The new kernel doesn't see any of my > devices. I get the following in /var/log/messages: > > ACPI: PCI Interrupt 0000:00:0a.0[A] -> GSI 17 (level, low) -> IRQ 16 > initio: I/O port range 0x0 is busy. > ACPI: PCI interrupt for device 0000:00:0a.0 disabled Humm not a collision - thats a bug in the driver updating. Looks like the changes I made and combined with Christoph's lost a line somewhere when I was merging it all. Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] sym53c8xx: fix "irq X: nobody cared" regressionTony Battersby2007-12-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch described by the following excerpt from ChangeLog-2.6.24-rc1 eventually causes a "irq X: nobody cared" error after a while: commit 99c9e0a1d6cfe1ba1169a7a81435ee85bc00e4a1 Author: Matthew Wilcox <matthew@wil.cx> Date: Fri Oct 5 15:55:12 2007 -0400 [SCSI] sym53c8xx: Make interrupt handler capable of returning IRQ_NONE After this happens, the kernel disables the IRQ, causing the SCSI card to stop working until the next reboot. The problem is caused by the interrupt handler returning IRQ_NONE instead of IRQ_HANDLED after handling an interrupt-on-the-fly (INTF) condition. The following patch fixes the problem. Signed-off-by: Tony Battersby <tonyb@cybernetics.com> Acked-by: Matthew Wilcox <willy@linux.intel.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] dpt_i2o: driver is only 32 bit so don't set 64 bit DMA maskJames Bottomley2007-12-181-2/+1
| | | | | | | | | | | | | | | | | | This fixes a potential corruption bug where the truncation would cause reading or writing to the wrong memory area on machines with >4GB of main memory. Cc: Stable Kernel Tree <stable@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] sym53c8xx: fix free_irq() regressionTony Battersby2007-12-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following commit changed the pointer passed to request_irq(), but failed to change the pointer passed to free_irq(): commit 99c9e0a1d6cfe1ba1169a7a81435ee85bc00e4a1 Author: Matthew Wilcox <matthew@wil.cx> Date: Fri Oct 5 15:55:12 2007 -0400 [SCSI] sym53c8xx: Make interrupt handler capable of returning IRQ_NONE ... The result is that free_irq() doesn't actually take any action. This patch fixes it. Signed-off-by: Tony Battersby <tonyb@cybernetics.com> Acked-by: Christoph Hellwig <hch@infradead.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* | ide-scsi: add ide_scsi_hex_dump() helperBartlomiej Zolnierkiewicz2007-12-121-8/+9
|/ | | | | | | Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Denis Cheng <crquan@gmail.com> Cc: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* esp_scsi: fix reset cleanup spinlock recursionMaciej W. Rozycki2007-12-102-4/+31
| | | | | | | | | | | | | | | | | | | | | | The esp_reset_cleanup() function is called with the host lock held and invokes starget_for_each_device() which wants to take it too. Here is a fix along the lines of shost_for_each_device()/__shost_for_each_device() adding a __starget_for_each_device() counterpart which assumes the lock has already been taken. Eventually, I think the driver should get modified so that more work is done as a softirq rather than in the interrupt context, but for now it fixes a bug that causes the spinlock debugger to fire. While at it, it fixes a small number of cosmetic problems with starget_for_each_device() too. Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org> Acked-by: David S. Miller <davem@davemloft.net> Cc: James Bottomley <James.Bottomley@steeleye.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* revert "dpt_i2o: convert to SCSI hotplug model"Andrew Morton2007-12-102-73/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | revert commit 55d9fcf57ba5ec427544fca7abc335cf3da78160 Author: Matthew Wilcox <matthew@wil.cx> Date: Mon Jul 30 15:19:18 2007 -0600 [SCSI] dpt_i2o: convert to SCSI hotplug model - Delete refereces to HOSTS_C - Switch to module_init/module_exit instead of detect/release - Don't pass around the host template and rename it to adpt_template - Switch from scsi_register/scsi_unregister to scsi_host_alloc, scsi_add_host, scsi_scan_host and scsi_host_put. Because it caused (for unknown reasons) Andres' all-data-reads-as-zeroes problem, reported at http://groups.google.com/group/fa.linux.kernel/msg/083a9acff0330234 Cc: Matthew Wilcox <matthew@wil.cx> Cc: "Salyzyn, Mark" <mark_salyzyn@adaptec.com> Cc: James Bottomley <James.Bottomley@SteelEye.com> Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Anders Henke <anders.henke@1und1.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds2007-12-0314-337/+283
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] NCR5380: Fix bugs and canonicalize irq handler usage [SCSI] zfcp: fix cleanup of dismissed error recovery actions [SCSI] zfcp: fix dismissal of error recovery actions [SCSI] qla1280: convert to use the data buffer accessors [SCSI] iscsi: return data transfer residual for data-out commands [SCSI] iscsi_tcp: fix potential lockup with write commands [SCSI] aacraid: fix security weakness [SCSI] aacraid: fix up le32 issues in BlinkLED [SCSI] aacraid: fix potential panic in thread stop [SCSI] aacraid: don't assign cpu_to_le32(constant) to u8
| * [SCSI] NCR5380: Fix bugs and canonicalize irq handler usageJeff Garzik2007-11-258-19/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Always pass the same value to free_irq() that we pass to request_irq(). This fixes several bugs. * Always call NCR5380_intr() with 'irq' and 'dev_id' arguments. Note, scsi_falcon_intr() is the only case now where dev_id is not the scsi_host. * Always pass Scsi_Host to request_irq(). For most cases, the drivers already did so, and I merely neated the source code line. In other cases, either NULL or a non-sensical value was passed, verified to be unused, then changed to be Scsi_Host in anticipation of the future. In addition to the bugs fixes, this change makes the interface usage consistent, which in turn enables the possibility of directly referencing Scsi_Host from all NCR5380_intr() invocations. Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] qla1280: convert to use the data buffer accessorsJes Sorensen2007-11-141-221/+166
| | | | | | | | | | | | | | | | | | | | | | | | | | - remove the unnecessary map_single path. - convert to use the new accessors for the sg lists and the parameters. Fixed to missing initialization of sg lists before calling for_each_sg() by Jes Sorensen - sg list needs to be initialized before trying to pull the elements out of it. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: Jes Sorensen <jes@sgi.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] iscsi: return data transfer residual for data-out commandsTony Battersby2007-11-141-3/+0
| | | | | | | | | | | | | | | | | | | | | | Currently, the iSCSI driver returns the data transfer residual for data-in commands (e.g. read) but not data-out commands (e.g. write). This patch makes it return the data transfer residual for both types of commands. Signed-off-by: Tony Battersby <tonyb@cybernetics.com> Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] iscsi_tcp: fix potential lockup with write commandsTony Battersby2007-11-142-87/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a race condition in iscsi_tcp.c that may cause it to forget that it received a R2T from the target. This race may cause a data-out command (such as a write) to lock up. The race occurs here: static int iscsi_send_unsol_pdu(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask) { struct iscsi_tcp_cmd_task *tcp_ctask = ctask->dd_data; int rc; if (tcp_ctask->xmstate & XMSTATE_UNS_HDR) { BUG_ON(!ctask->unsol_count); tcp_ctask->xmstate &= ~XMSTATE_UNS_HDR; <---- RACE ... static int iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask) { ... tcp_ctask->xmstate |= XMSTATE_SOL_HDR_INIT; <---- RACE ... While iscsi_xmitworker() (called from scsi_queue_work()) is preparing to send unsolicited data, iscsi_tcp_data_recv() (called from tcp_read_sock()) interrupts it upon receipt of a R2T from the target. Both contexts do read-modify-write of tcp_ctask->xmstate. Usually, gcc on x86 will make &= and |= atomic on UP (not guaranteed of course), but in this case iscsi_send_unsol_pdu() reads the value of xmstate before clearing the bit, which causes gcc to read xmstate into a CPU register, test it, clear the bit, and then store it back to memory. If the recv interrupt happens during this sequence, then the XMSTATE_SOL_HDR_INIT bit set by the recv interrupt will be lost, and the R2T will be forgotten. The patch below (against 2.6.24-rc1) converts accesses of xmstate to use set_bit, clear_bit, and test_bit instead of |= and &=. I have tested this patch and verified that it fixes the problem. Another possible approach would be to hold a lock during most of the rx/tx setup and post-processing, and drop the lock only for the actual rx/tx. Signed-off-by: Tony Battersby <tonyb@cybernetics.com> Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] aacraid: fix security weaknessAlan Cox2007-11-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Actually there are several but one is trivially fixed 1. FSACTL_GET_NEXT_ADAPTER_FIB ioctl does not lock dev->fib_list but needs to 2. Ditto for FSACTL_CLOSE_GET_ADAPTER_FIB 3. It is possible to construct an attack via the SRB ioctls where the user obtains assorted elevated privileges. Various approaches are possible, the trivial ones being things like writing to the raw media via scsi commands and the swap image of other executing programs with higher privileges. So the ioctls should be CAP_SYS_RAWIO - at least all the FIB manipulating ones. This is a bandaid fix for #3 but probably the ioctls should grow their own capable checks. The other two bugs need someone competent in that driver to fix them. Signed-off-by: Alan Cox <alan@redhat.com> Acked-by: Mark Salyzyn <mark_salyzyn@adaptec.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] aacraid: fix up le32 issues in BlinkLEDSalyzyn, Mark2007-11-071-1/+1
| | | | | | | | | | Signed-off-by: Mark Salyzyn <aacraid@adaptec.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] aacraid: fix potential panic in thread stopSalyzyn, Mark2007-11-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | Got a panic in the threading code on an older kernel when the Adapter failed to load properly and driver shut down apparently before any threading had started, can not dupe. Expect that this may be relevant in the latest kernel, but not sure. This patch does no harm, and should alleviate the possibility of this panic. Signed-off-by: Mark Salyzyn <aacraid@adaptec.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] aacraid: don't assign cpu_to_le32(constant) to u8Stephen Rothwell2007-11-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Noticed on PowerPC allmod config build: drivers/scsi/aacraid/commsup.c:1342: warning: large integer implicitly truncated to unsigned type drivers/scsi/aacraid/commsup.c:1343: warning: large integer implicitly truncated to unsigned type drivers/scsi/aacraid/commsup.c:1344: warning: large integer implicitly truncated to unsigned type Also fix some whitespace on the changed lines. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Acked-by: Mark Salyzyn <mark_salyzyn@adaptec.com> Signed-off-by: James <James.Bottomley@HansenPartnership.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* | m68k: zorro7xx needs <asm/amigahw.h>Geert Uytterhoeven2007-11-291-0/+3
| | | | | | | | | | | | | | | | | | | | m68k: zorro7xx needs <asm/amigahw.h> if !CONFIG_AMIGA_PCMCIA Reported by Ingo Juergensmann <ij@2007.bluespice.org> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | ide-scsi: use print_hex_dump from <linux/kernel.h>Denis Cheng2007-11-271-14/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | these utilities implemented in lib/hexdump.c are more handy, please use this. Bart: - s/KERN_DEBUG/KERN_CONT/ as pointed out by Randy - s/DUMP_PREFIX_OFFSET/DUMP_PREFIX_NONE/ - don't include ASCII dump - respect 80-columns limit Signed-off-by: Denis Cheng <crquan@gmail.com> Cc: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
* | aic94xx_sds: rename FLASH_SIZEAndrew Morton2007-11-141-2/+2
|/ | | | | | | | | | | | | | | | | | | | | | | arm: drivers/scsi/aic94xx/aic94xx_sds.c:381:1: warning: "FLASH_SIZE" redefined In file included from include/asm/arch/irqs.h:22, from include/asm/irq.h:4, from include/asm/hardirq.h:6, from include/linux/hardirq.h:7, from include/asm-generic/local.h:5, from include/asm/local.h:1, from include/linux/module.h:19, from include/linux/device.h:21, from include/linux/pci.h:52, from drivers/scsi/aic94xx/aic94xx_sds.c:28: include/asm/arch/platform.h:444:1: warning: this is the location of the previous definition Cc: Gilbert Wu <gilbert_wu@adaptec.com> Cc: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* PCI: Add Kconfig option to disable deprecated pci_find_* APIJeff Garzik2007-11-051-1/+1
| | | | | | Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Merge master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds2007-11-053-9/+21
|\ | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] ibmvscsi: Prevent IO during partner login [SCSI] lpfc : Correct queue tag handling [SCSI] Update MAINTAINER email address and trees [SCSI] osst: fix if (...) \n #if... cases missing semicolons when false
| * [SCSI] ibmvscsi: Prevent IO during partner loginRobert Jennings2007-11-031-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By setting the request_limit in send_srp_login to 1 we allowed login requests to be sent to the server adapter. If this was not an initial login, but was a login after a disconnect with the server, other I/O requests could attempt to be processed before the login occured. These I/O requests would fail, sometimes resulting in filesystems getting marked read-only. To address this we can set the request_limit to 0 while doing the login and add an exception where login requests, along with task management events, are always passed to the server. There is a case where the request_limit had already reached 0 would result in all events being sent rather than returning SCSI_MLQUEUE_HOST_BUSY; this has also been fixed by this patch. Signed-off-by: Robert Jennings <rcj@linux.vnet.ibm.com> Signed-off-by: Brian King <brking@linux.vnet.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] lpfc : Correct queue tag handlingJames Smart2007-11-031-2/+3
| | | | | | | | | | | | | | | | | | | | | | This patch corrects the lpfc tag handling issue identified by Hannes Reinecke http://marc.info/?l=linux-scsi@m=119270235628850&w=2 The basis for this patch originated from Hajime Kai. Thank You Hajime. Signed-off-by: hajime-kai@soft.fujitsu.com Signed-off-by: James Smart <James.Smart@emulex.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * [SCSI] osst: fix if (...) \n #if... cases missing semicolons when falseIlpo Järvinen2007-10-271-2/+4
| | | | | | | | | | | | | | Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Acked-by: Willem Riede <osst@riede.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
* | SCSI: add asynchronous event notification APIJeff Garzik2007-11-033-0/+186
| | | | | | | | | | | | | | Originally based on a patch by Kristen Carlson Accardi @ Intel. Copious input from James Bottomley. Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
* | [SG] Get rid of __sg_mark_end()Jens Axboe2007-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | sg_mark_end() overwrites the page_link information, but all users want __sg_mark_end() behaviour where we just set the end bit. That is the most natural way to use the sg list, since you'll fill it in and then mark the end point. So change sg_mark_end() to only set the termination bit. Add a sg_magic debug check as well, and clear a chain pointer if it is set. Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
* | [ARM] Fix an rpc_defconfig regressionRussell King2007-10-311-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix: CC drivers/scsi/arm/powertec.o In file included from drivers/scsi/arm/powertec.c:29: drivers/scsi/arm/scsi.h: In function 'next_SCp': drivers/scsi/arm/scsi.h:42: error: 'struct scatterlist' has no member named 'page' drivers/scsi/arm/scsi.h: In function 'init_SCp': drivers/scsi/arm/scsi.h:80: error: 'struct scatterlist' has no member named 'page' Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* | Kbuild/doc: fix links to Documentation filesDirk Hohndel2007-10-301-2/+2
| | | | | | | | | | | | | | Fix links to files in Documentation/* in various Kconfig files Signed-off-by: Dirk Hohndel <hohndel@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | Merge branch 'sg' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds2007-10-291-0/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'sg' of git://git.kernel.dk/linux-2.6-block: Correction of "Update drivers to use sg helpers" patch for IMXMMC driver sg_init_table() should use unsigned loop index variable sg_last() should use unsigned loop index variable Initialise scatter/gather list in sg driver Initialise scatter/gather list in ata_sg_setup x86: fix pci-gart failure handling SG: s390-scsi: missing size parameter in zfcp_address_to_sg() SG: clear termination bit in sg_chain()
| * | Initialise scatter/gather list in sg driverAnton Blanchard2007-10-291-0/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After turning on DEBUG_SG I hit a fail: kernel BUG at include/linux/scatterlist.h:50! sg_build_indirect sg_build_reserve sg_open chrdev_open __dentry_open do_filp_open do_sys_open We should initialise the sg list when we allocate it in sg_build_sgat. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
* | deal with resource allocation bugs in arcmsrAl Viro2007-10-292-12/+30
| | | | | | | | | | | | | | | | | | a) for type B we should _not_ iounmap() acb->pmu; it's not ioremapped. b) for type B we should iounmap() two regions we _do_ ioremap. c) if ioremap() fails, we need to bail out (and clean up). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
OpenPOWER on IntegriCloud