When managing shost->host_eh_scheduled libata assumes that there is a
1:1 shost-to-ata_port relationship.  libsas creates a 1:N relationship
so it needs to manage host_eh_scheduled cumulatively at the host level.
The sched_eh and end_eh port port ops allow libsas to track when domain
devices enter/leave the "eh-pending" state under ha->lock (previously
named ha->state_lock, but it is no longer just a lock for ha->state
changes).

Since host_eh_scheduled indicates eh without backing commands pinning
the device it can be deallocated at any time.  Move the taking of the
domain_device reference under the port_lock to guarantee that the
ata_port stays around for the duration of eh.
Reviewed-by: NJacek Danecki <jacek.danecki@intel.com>
Acked-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The following crash results from cases where the end_device has been
removed before scsi_sysfs_add_sdev has had a chance to run.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000098
 IP: [<ffffffff8115e100>] sysfs_create_dir+0x32/0xb6
 ...
 Call Trace:
  [<ffffffff8125e4a8>] kobject_add_internal+0x120/0x1e3
  [<ffffffff81075149>] ? trace_hardirqs_on+0xd/0xf
  [<ffffffff8125e641>] kobject_add_varg+0x41/0x50
  [<ffffffff8125e70b>] kobject_add+0x64/0x66
  [<ffffffff8131122b>] device_add+0x12d/0x63a
  [<ffffffff814b65ea>] ? _raw_spin_unlock_irqrestore+0x47/0x56
  [<ffffffff8107de15>] ? module_refcount+0x89/0xa0
  [<ffffffff8132f348>] scsi_sysfs_add_sdev+0x4e/0x28a
  [<ffffffff8132dcbb>] do_scan_async+0x9c/0x145

...teach scsi_sysfs_add_devices() to check for deleted devices() before
trying to add them, and teach scsi_remove_target() how to remove targets
that have not been added via device_add().

Cc: <stable@vger.kernel.org>
Reported-by: NDariusz Majchrzak <dariusz.majchrzak@intel.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This may not fix all endian issues in this driver, but it does get the
driver working on PowerPC for a PMC SRC card. So it should at least fix
all the problems in the core and in the SRC support.

[jejb: fix >> 32 breakage reported by Fengguang Wu]
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Acked-by: NAchim Leubner <Achim_Leubner@pmc-sierra.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The loop that waited for syncronous fib commands was causing a CPU stall
when a timeout actually occured.

1) Switch to using a more accurate timeout mechanism.
2) Do not pace the loop with udelay(). Use cpu_relax() to allow for
   scheduling to occur.
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Acked-by: NAchim Leubner <Achim_Leubner@pmc-sierra.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

When an error occured that would shut down the driver, some in-flight
events were getting caught up, deadlocking a CPU or two.
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Acked-by: NAchim Leubner <Achim_Leubner@pmc-sierra.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This also stops using the "legacy crap" in Scsi_Host (shost->base is an
unsigned long).

This affected 32-bit systems that have 64-bit resource sizes, causing the
IO address to be truncated.
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Acked-by: NAchim Leubner <Achim_Leubner@pmc-sierra.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Introduce scsi_dh_attached_handler_name() to retrieve the name of the
scsi_dh that is attached to the scsi_device associated with the provided
request queue.  Returns NULL if a scsi_dh is not attached.

Also, fix scsi_dh_{attach,detach} function header comments to document
@q rather than @sdev.
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Tested-by: NBabu Moger <babu.moger@netapp.com>
Reviewed-by: NChandra Seetharaman <sekharan@us.ibm.com>
Acked-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fixed the parentheses so the tcp push bit would be sent properly.
Signed-off-by: NKaren Xie <kxie@chelsio.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Avoid that the code for requeueing SCSI requests triggers a
crash by making sure that that code isn't scheduled anymore
after a device has been removed.

Also, source code inspection of __scsi_remove_device() revealed
a race condition in this function: no new SCSI requests must be
accepted for a SCSI device after device removal started.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Acked-by: NTejun Heo <tj@kernel.org>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The return value of scsi_queue_insert() is ignored by all its
callers, hence change the return type of this function into
void.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Reviewed-by: NTejun Heo <tj@kernel.org>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

When we call scsi_unprep_request() the command associated with the request
gets destroyed and therefore drops its reference on the device.  If this was
the only reference, the device may get released and we end up with a NULL
pointer deref when we call blk_requeue_request.
Reported-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Reviewed-by: NTejun Heo <tj@kernel.org>
Cc: <stable@kernel.org>
[jejb: enhance commend and add commit log for stable]
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Use blk_queue_dead() to test whether the queue is dead instead
of !sdev. Since scsi_prep_fn() may be invoked concurrently with
__scsi_remove_device(), keep the queuedata (sdev) pointer in
__scsi_remove_device(). This patch fixes a kernel oops that
can be triggered by USB device removal. See also
http://www.spinics.net/lists/linux-scsi/msg56254.html.

Other changes included in this patch:
- Swap the blk_cleanup_queue() and kfree() calls in
  scsi_host_dev_release() to make that code easier to grasp.
- Remove the queue dead check from scsi_run_queue() since the
  queue state can change anyway at any point in that function
  where the queue lock is not held.
- Remove the queue dead check from the start of scsi_request_fn()
  since it is redundant with the scsi_device_online() check.
Reported-by: NJun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Reviewed-by: NTejun Heo <tj@kernel.org>
Cc: <stable@kernel.org>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If the queue is dead blk_execute_rq_nowait() doesn't invoke the done()
callback function. That will result in blk_execute_rq() being stuck
in wait_for_completion(). Avoid this by initializing rq->end_io to the
done() callback before we check the queue state. Also, make sure the
queue lock is held around the invocation of the done() callback. Found
this through source code review.
Signed-off-by: NMuthukumar Ratty <muthur@gmail.com>
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: NTejun Heo <tj@kernel.org>
Acked-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

We took this lock with spin_lock() so we should unlock it with
spin_unlock() instead of spin_unlock_irq().  This was introduced in
f2c8dc40 "[SCSI] megaraid_mbox: remove scsi_assign_lock usage".
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NAdam Radford <aradford@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

On 64 bit systems the current code sets 32 bits of "seg" and leaves the
other 32 uninitialized.  It doesn't matter since the variable is never
used.  But it's still messy and we should fix it.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NAdam Radford <aradford@gmail.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If bfad_thread_workq(bfad) was not BFA_STATUS_OK then we freed "im"
and then dereferenced it.

I did a little clean up because it seemed nicer to return directly
instead of doing a superfluous goto.  I looked at other functions in
this file and it seems like returning directly is standard.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NKrishna Gudipati <kgudipat@brocade.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If mc == BFI_MC_MAX then we're reading past the end of the
mod->mbhdlr[] array.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NKrishna Gudipati <kgudipat@brocade.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Initialize atomic_t scsi_host_next_hn and ioerr_cntas per the guidelines
defined in Documentation/atomic_ops.txt
Signed-off-by: NJosh Hunt <johunt@akamai.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

A quote from SPC-4: "While in the unavailable primary target port
asymmetric access state, the device server shall support those of
the following commands that it supports while in the active/optimized
state: [ ... ] d) SET TARGET PORT GROUPS; [ ... ]". Hence re-enable
sending STPG to a target port group that is in the unavailable state.
Signed-off-by: NBart Van Assche <bvanassche@acm.org>
Reviewed-by: Babu Moger <babu.moger@netapp.com> 
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fix following message:-
drivers/scsi/qla4xxx/ql4_os.c:3266:5: error: symbol 'qla4xxx_post_aen_work' redeclared with different type (originally declared at drivers/scsi/qla4xxx/ql4_glbl.h:186) - incompatible argument 2 (different signedness)
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Allow multi-session to target (for flash ddbs) accesible via
multiple network portal
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Currently the backoff algorithm for when to retry alua rtpg
requests progresses geometrically as so:

2, 4, 8, 16, 32, 64... seconds.

This progression can lead to un-needed delay in retrying
alua rtpg requests when the rtpgs are delayed.  A less
aggressive backoff algorithm that is additive would not
lead to such large jumps when delays start getting long, but
would backoff linearly:

2, 4, 6, 8, 10... seconds.
Signed-off-by: NMartin George <marting@netapp.com>
Signed-off-by: NRob Evers <revers@redhat.com>
Reviewed-by: NBabu Moger <babu.moger@netapp.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Some storage arrays are known to return 'illegal request'
when an rtpg extended header request is made.  T10 says the
array should ignore the bit, and return the non-extended
rtpg as the array doesn't support the request.  Working
around this by retrying the rtpg request without the extended
header bit set when the extended rtpg request results in
illegal request.
Signed-off-by: NRob Evers <revers@redhat.com>
Reviewed-by: NBabu Moger <babu.moger@netapp.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

During alua transitions, an array can return transitioning
status in response to rtpg requests.  These requests get
retried for a maximum of 60 seconds by default before timing
out.  Sometimes this timeout isn't sufficient to allow the
array to complete the transition.  T10-spc4 addresses this
under 'Report Target Port Groups' command.

This update retrieves the timeout value from the storage
array if available and retries the transitioning rtpgs
for up to the 'implied transitioning timeout' value
Signed-off-by: NRob Evers <revers@redhat.com>
Reviewed-by: NBabu Moger <babu.moger@netapp.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

ARCMSR_ARC1880_DiagWrite_ENABLE is 0x00000080 so (x | 0x00000080) is
never zero.  The intent here was to test that loop until
ARCMSR_ARC1880_DiagWrite_ENABLE was turned on, but because the test was
wrong, we would do five loops regardless of whether it succeed or not.

Also I simplified the condition a little by removing the unused
assignement.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NNick Cheng <nick.cheng@areca.com.tw>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

As the limitation of RR312x's dma engine, the HBA can not access host memory
over 12GB.  This fixes

https://bugzilla.kernel.org/show_bug.cgi?id=14311

[alan: resurrected bug from 2009 and pushed upstream]
Reported-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NHighPoint Linux Team <linux@highpoint-tech.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fix System Panic During IO Test using Medusa tool
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fix fcp_imax module parameter to dynamically change FCP EQ delay multiplier
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fixed system held-up when performing resource provsion through same PCI
function
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fix system hang due to bad protection module parameters (CR: 130769)
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fixed debug helper routine failed to dump CQ and EQ entries in non-MSI-X mode
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch corrects the issue caught via Smatch and reported by Dan Carpenter:
http://marc.info/?l=linux-scsi&m=133693516103343

Resolve null pointer check ordering that were odd
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Incorporate patch originally supplied by Julia Lawall <Julia.Lawall@lip6.fr>
http://marc.info/?l=linux-scsi&m=133572879711140&w=2

"It appears that mempool_free should be performed on these failures as on
 the other exists from the containing functions."
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Acked-by: NAlex Iannicelli <alex.iannicelli@emulex.com>
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NBhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Use list_for_each_entry_safe() instead of explicit cast to avoid relying on
struct layout
Signed-off-by: NBhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>