Infinite loop can occur if IOCStatus is not equal to
MPI2_IOCSTATUS_CONFIG_INVALID_PAGE value in the while loops in functions
_scsih_search_responding_sas_devices,
_scsih_search_responding_raid_devices and
_scsih_search_responding_expanders

So, Instead of checking for MPI2_IOCSTATUS_CONFIG_INVALID_PAGE value,
in this patch code is modified to check for IOCStatus not equals to
MPI2_IOCSTATUS_SUCCESS to break the while loop.
Signed-off-by: NSreekanth Reddy <Sreekanth.Reddy@lsi.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

[SCSI] mpt3sas: fix for kernel panic when driver loads with HBA conected to non LUN 0 configured expander

With some enclosures when LUN 0 is not created but LUN 1 or LUN X is created
then SCSI scan procedure calls target_alloc, slave_alloc call back functions
for LUN 0 and slave_destory() for same LUN 0.

In these kind of cases within slave_destroy, pointer to scsi_target in
_sas_device structure is set to NULL, following which when slave_alloc for LUN
1 is called then starget would not be set properly for this LUN.  So,
scsi_target pointer pointing to NULL value would lead to a crash later in the
discovery procedure.

To solve this issue set the sas_device's scsi_target pointer to scsi_device's
scsi_target if it is NULL earlier in slave_alloc callback function.
Signed-off-by: NSreekanth Reddy <Sreekanth.Reddy@lsi.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Hardware timing requirements is updated in order to comply with firmware
requirement.
Signed-off-by: NSreekanth Reddy <Sreekanth.Reddy@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The Copyright String in all mpt3sas files are changed to 2012-2013.
Signed-off-by: NSreekanth Reddy <Sreekanth.Reddy@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Avoid that the fcport structure gets leaked if
bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN, the fcport
allocation succeeds and the !vha->flags.online branch is taken.
This was detected by Coverity. However, Coverity does not recognize
that all qla2x00_process_els() callers specify either
FC_BSG_RPT_ELS or FC_BSG_HST_ELS_NOLOGIN in the field
bsg_job->request->msgcode and that the value of that field is not
modified inside that function. This results in a false positive
report about a possible memory leak in an error path for
bsg_job->request->msgcode values other than the two mentioned
values.  Make it easy for Coverity (and for humans) to recognize
that there is no fcport leak in the error path by changing the
bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN test into
bsg_job->request->msgcode != FC_BSG_RPT_ELS.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Change the 'rval' variable from QLA_FUNCTION_TIMEOUT into QLA_SUCCESS
before starting a loop that is only executed if rval is initialized
to QLA_SUCCESS. Coverity reported that loop as "dead code".
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Coverity reports "Overrunning struct type ct_sns_req of 1228 bytes
by passing it to a function which accesses it at byte offset 8207"
for each qla2x00_prep_ct_req(), qla2x00_prep_ct_fdmi_req() and
qla24xx_prep_ct_fm_req() call. Help Coverity to recognize that
these calls do not trigger a buffer overflow by making it explicit
that these three functions initializes both the request and reply
structures. This patch does not change any functionality.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The value of the pointer called "nxt" is not used after the
"nxt = qla24xx_copy_eft(ha, nxt)" statement. Hence keep the function
call but remove the assignment.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Since the value of cur_seg is not used and since scsi_prot_sglist()
has no side effects it is safe to remove the statement
"cur_seg = scsi_port_sglist(cmd)". Detected by Coverity.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Since ha->model_desc is an array comparing it against NULL is
superfluous. Hence remove these tests.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

At the end of qla2x00_configure_hba() we know that rval == QLA_SUCCESS.
Hence remove the dead code.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Remove dead code, simplify a pointer computation and move the
ql84_mgmt assignment to just before its first use.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Remove dead code and simplify a pointer computation.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

When we are intentionally generating a firmware dump by executing the
MBC_GEN_SYSTEM_ERROR command, the command actually times out. The normal
course of action when a mailbox command times out is to take a firmware dump.
However, in this special case we do not want to do this since the
MBA_SYSTEM_ERR AEN already generates a firmware dump.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

During a chip reset, the mailbox call to get FC statistics from the ISP will
not work resulting in needless mailbox accesses and errors printing out:

qla2xxx [0000:05:00.0]-00af:11: Performing ISP error recovery - ha=ffff881fad044800.
qla2xxx [0000:05:00.0]-1020:11: **** Failed mbx[0]=4001, mb[1]=4953, mb[2]=5020, mb[3]=b100, cmd=6d ****.
qla2xxx [0000:05:00.0]-1020:11: **** Failed mbx[0]=4001, mb[1]=4953, mb[2]=5020, mb[3]=b100, cmd=6d ****.
qla2xxx [0000:05:00.0]-1020:11: **** Failed mbx[0]=4001, mb[1]=4953, mb[2]=5020, mb[3]=b100, cmd=6d ****.
qla2xxx [0000:05:00.0]-1020:11: **** Failed mbx[0]=4001, mb[1]=4953, mb[2]=5020, mb[3]=b100, cmd=6d ****.
qla2xxx [0000:05:00.0]-1020:11: **** Failed mbx[0]=4001, mb[1]=4953, mb[2]=5020, mb[3]=b100, cmd=6d ****.

To prevent this, check for a chip reset when an application queries for FC
stats and return immediately if a chip reset is occurring.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

[SCSI] qla2xxx: Set the index in outstanding command array to NULL when cmd is aborted when the request timeout.

Call the generic BSG free routine to unmap the DMA buffers.
Signed-off-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Increase the value of STORVSC_MAX_IO_REQUESTS to 200 requests. The current
ringbuffer size can support this higher value.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Pci core has been saved pm cap register offset by pdev->pm_cap in
pci_pm_init() in init path. So we can use pdev->pm_cap instead of using
pci_find_capability(pdev, PCI_CAP_ID_PM) for better performance and simplified
code.
Tested-by: NLindar Liu <lindar_liu@usish.com>
Signed-off-by: NYijing Wang <wangyijing@huawei.com>
Acked-by: NLindar Liu <lindar_liu@usish.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

commit 98cb7e44 ([SCSI] megaraid_sas: Sanity check user
supplied length before passing it to dma_alloc_coherent())
introduced a memory leak.  Memory allocated for entries
following zero length SGL entries will not be freed.

Reference: http://bugs.debian.org/688198Signed-off-by: NBjørn Mork <bjorn@mork.no>
Cc: <stable@vger.kernel.org>
Acked-by: NAdam Radford <aradford@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

For the workqueue creation interfaces that do not expect format strings,
make sure they cannot accidently be parsed that way.  Additionally, clean
up calls made with a single parameter that would be handled as a format
string.  Many callers are passing potentially dynamic string content, so
use "%s" in those cases to avoid any potential accidents.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Calling dev_set_name with a single paramter causes it to be handled as a
format string.  Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents,
including wrappers like device_create*() and bdi_register().
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

This looks like a cut and paste typo to me. Both of the
megasas_read_fw_status_reg_* functions involved are identical though, so
there was no bad behaviour. I changed it for consistency and clarity.
Signed-off-by: NJames Georgas <soulpa7ch@gmail.com>
Acked-by: NSumit Saxena <sumit.saxena@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Changing the device coherent dma mask to the value that currently set
has no effect.
Signed-off-by: NAkinobu Mita <mita@fixstars.com>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

In UIC error interrupt handling, it checks if UIC data link layer error
code indicates PA_INIT_ERROR in order to determine whether a fatal error
handling is needed or not.

But the code tries to read UIC data link layer error code from wrong
REG_UIC_ERROR_CODE_PHY_ADAPTER_LAYER, it should be
REG_UIC_ERROR_CODE_DATA_LINK_LAYER.
Signed-off-by: NAkinobu Mita <mita@fixstars.com>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

of_match_table member in struct device_driver must be terminated by
empty slot as a sentinel.
Signed-off-by: NAkinobu Mita <mita@fixstars.com>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch replaces normal calls for resource allocation with devm_*()
derivative functions. It makes resource freeing simpler.
Signed-off-by: NSeungwon Jeon <tgih.jun@samsung.com>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The response UPIU length should be in DWORD and not in bytes.
Signed-off-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NSujit Reddy Thumma <sthumma@codeaurora.org>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Link start-up requires long time with multiphase handshakes
between UFS host and device. This affects driver's probe time.
This patch let link start-up run asynchronously. Link start-up
will be executed at the end of prove separately.
Along with this change, the following is worked.

Defined completion time of uic command to avoid a permanent wait.
Added mutex to guarantee of uic command at a time.
Adapted some sequence of controller initialization after link statup
according to HCI standard.
Signed-off-by: NSeungwon Jeon <tgih.jun@samsung.com>
Signed-off-by: NSujit Reddy Thumma <sthumma@codeaurora.org>
Tested-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

There is no need to check the version to clear
the interrupt status. And the order is changed
prior to actual handling.
Signed-off-by: NSeungwon Jeon <tgih.jun@samsung.com>
Tested-by: NMaya Erez <merez@codeaurora.org>
Signed-off-by: NSantosh Y <santoshsy@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>