Andrew Vaszquez said:
> There's a problem that is causing commands returned by the LLD with
> a DID_RESET status to be reissued with cleared cmd->sdb data which
> in our tests are manifesting in firmware detected overruns.  Here's
> a snippet of a READ_10 scsi_cmnd upon completion by the storage

The problem is caused by:

commit b60af5b0
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Nov 3 15:56:47 2008 -0500

    [SCSI] simplify scsi_io_completion()

Because scsi_release_buffers() is called before commands that go
through the ACTION_RETRY and ACTION_DELAYED_RETRY legs are requeued.
However, they're not re-prepared, so nothing ever reallocates the
buffer resources to them.  Fix this by releasing the buffers only if
we're not going to go down these legs (but scsi_release_buffers() on
all legs including two in scsi_end_request(); this latter needs a
special version __scsi_release_buffers() because the final one can be
called after the request has been freed, so the bidi test in
scsi_release_buffers(), which touches the request has to be skipped).
Reported-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

When we reworked the transport for the rport lifetimes, in cases where the
rport was reused as a container for tgt id bindings, we inadvertantly
removed the callback to the driver indicating that dev_loss_tmo had fired.

This patch restores that functionality.
Signed-off-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

At some point since 2.6.22, the aha152x_cs driver stopped working and
started erring on load with the following messages:

kernel: pcmcia: request for exclusive IRQ could not be fulfilled.
kernel: pcmcia: the driver needs updating to supported shared IRQ lines.

With the following change, the driver works with shared IRQs.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@kernel.org>		[2.6.28], [2.6.27], [2.6.26]
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

DIF does not work with 6-byte commands so we previously ignored those
commands when preparing a request.  However, DIX does not need
RDPROTECT/WRPROTECT to be set and 6-byte commands are consequently
perfectly valid in host-only mode.

This patch fixes a problem where we would set the wrong DIX operation
when issuing commands to a legacy disk.
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: NMatthew Wilcox <willy@linux.intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Switch tag arrays to u8 to prevent problems on platforms with signed
char.
Reported-by: NTim LaBerge <tim.laberge@Quantum.Com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Add application tag to the output displayed on error.
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

patch

commit b60af5b0
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Nov 3 15:56:47 2008 -0500

    [SCSI] simplify scsi_io_completion()

broke DIX error handling.  Also, we are now using EILSEQ to indicate
integrity errors to the upper layers (as opposed to regular EIO
failures).  This allows filesystems to inspect buffers and decide
whether to retry the I/O.  Update scsi_io_completion() accordingly.
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

A bug was introduced by

commit b60af5b0
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Nov 3 15:56:47 2008 -0500

    [SCSI] simplify scsi_io_completion()
 
because the simplification uses scsi_queue_insert().  The problem with
this function is that it expects to be called from the completion path
while the command is still outstanding, so it decrements the device
and host busy counts to do the requeue.  The problem is that
scsi_io_completion() is a path executed well after these counts have
*already* been decremented, leading to a double decrement if the
command goes down any error path leading to ACTION_DELAYED_RETRY.

The fix is to allow a private function __scsi_queue_insert() with a
flag to say whether the busy counters should be decremented.  This is
made static to scsi_lib.c to discourage other use.
Reported-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

unsigned req->data_len cannot be negative, and fix =-/-= typo
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

warning: ignoring return value of 'request_irq', declared with attribute
warn_unused_result
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

If the NULL test is necessary, then the dereference should be moved below
the NULL test.

The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/).

// <smpl>
@disable is_null@
identifier f;
expression E;
identifier fld;
statement S;
@@

+ if (E == NULL) S
  f(...,E->fld,...);
- if (E == NULL) S

@@
identifier f;
expression E;
identifier fld;
statement S;
@@

+ if (!E) S
  f(...,E->fld,...);
- if (!E) S
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: N"Prakash, Sathya" <Sathya.Prakash@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

I increased the delay step by step until loading of mvsas
reliably detected the drive 200 times in sequence. A much better
approach would be to monitor the hardware for some flag which
indicates that port detection has finished, but I do not have any
hardware documentation.
Signed-off-by: NReinhard Nissl <rnissl@gmx.de>
Cc: Ke Wei <kewei@marvell.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Make enlarge_buffer() retry allocation if the previously chosen page
order was too small. Really limit the page order to 6. Return error if
the maximum order is not large enough for the request.
Signed-off-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This integrates st_scsi_kern_execute and st_do_scsi. IOW, it removes
st_scsi_kern_execute. Then st has a single function, st_do_scsi, to
perform SCSI commands.
Signed-off-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

frp_sg_current in struct st_buffer is always zero. We don't need it.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

orig_frp_segs in struct st_buffer is always zero. We don't need it.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

- remove the from_initialization argument, which is always 1. We
always need to use GFP_ATOMIC.

- 'got' valuable is initialized to zero and doesn't change. We don't
need it.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This removes the usage of struct scatterlist completely.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This removes struct st_buff_fragment and use reserved_pages array to
store fragment buffer.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This removes unused buf_to_sg() that the non-dio path used.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch converts the dio path (mmap) to use st_scsi_execute. IOW,
it removes scsi_execute_async in the non dio path.

scsi_execute_async has gone! This also remove unused st_sleep_done.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch converts the non-dio path (fragment buffer path) to use
st_scsi_execute. IOW, it removes scsi_execute_async in the non-dio
path.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

st_scsi_execute is a helper function to perform SCSI commands
involving data transfer between user and kernel space (st_read and
st_write).

It's the future plan to combine this with st_scsi_kern_execute helper
function.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This adds struct rq_map_data and the array of pointers to store
fragment buffers to struct st_buffer.

This patch doesn't remove st_buf_fragment but the latter patch does.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch simiplifies the fragment buffer management a bit, all the
buffers in the fragment list become the same size. This is necessary
to use the block layer API (sg driver was modified in the same way)
since the block layer API takes the same size page frames instead of
scatter gatter.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NKai Makisara <Kai.Makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The commit 81882766 (block: make
blk_rq_map_user take a NULL user-space buffer) extended
blk_rq_map_user to accept a NULL user-space buffer with a READ
command. It was necessary to convert sg to use the block layer mapping
API.

This patch extends blk_rq_map_user again for a WRITE command. It is
necessary to convert st and osst drivers to use the block layer
apping API.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This fixes bio_copy_user_iov to properly handle the partial mappings
with struct rq_map_data (which only sg uses for now but st and osst
will shortly). It adds the offset member to struct rq_map_data and
changes blk_rq_map_user to update it so that bio_copy_user_iov can add
an appropriate page frame via bio_add_pc_page().
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This fixes bio_add_page misuse in bio_copy_user_iov with rq_map_data,
which only sg uses now.

rq_map_data carries page frames for bio_add_pc_page. bio_copy_user_iov
uses bio_add_pc_page with a larger size than PAGE_SIZE. It's clearly
wrong.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

In a previous patch to fix an issue with error recovery,
the behavior of the max_requests module paramater was also
changed. If, for some reason, max_requests is set to one by
the user, we will end up with a negative number for can_queue.
Fix this by making max_requests not include the two event structs
needed to do error recovery.
Signed-off-by: NBrian King <brking@linux.vnet.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

In each case, if the NULL test is necessary, then the dereference should be
moved below the NULL test.

The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
type T;
expression E;
identifier i,fld;
statement S;
@@

- T i = E->fld;
+ T i;
  ... when != E
      when != i
  if (E == NULL) S
+ i = E->fld;
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NJames Smart <James.Smart@Emulex.Com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The remove() callback in platform drivers should return int in
accordance to the definition of the platform_driver structure.
However, the SGI-specific WD93 SCSI controller driver defines
the callback as a void function, which causes the following
compilation warning:

drivers/scsi/sgiwd93.c:314: warning: initialization from
incompatible pointer type

This patch fixes the warning by changing the return type of
the remove() callback to what the core driver code requires.
Signed-off-by: NDmitri Vorobiev <dmitri.vorobiev@movial.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

If a link down event is received, outstanding commands may get
returned to the ibmvfc driver with a "transaction cancelled implicit"
response. This is currently translated to DID_ABORT, which does
not get retried by SCSI core, but rather passes the failure up
the stack. This can result in I/O errors at the filesystem level.
Fix up this response a well as a few other error responses.
Signed-off-by: NBrian King <brking@linux.vnet.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch (as1191) adds a missing "default" case in
scsi_io_completion(), thereby fixing an "uninitialized variable"
error.  It also adds a missing newline to a log entry.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Make sure the control flow in scsi_times_out makes sense.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

[jejb: limit ioctl to returning 20 characters to avoid overrun
       on long device names and add a few more conversions]
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (34 commits)
  nfsd race fixes: jfs
  nfsd race fixes: reiserfs
  nfsd race fixes: ext4
  nfsd race fixes: ext3
  nfsd race fixes: ext2
  nfsd/create race fixes, infrastructure
  filesystem notification: create fs/notify to contain all fs notification
  fs/block_dev.c: __read_mostly improvement and sb_is_blkdev_sb utilization
  kill ->dir_notify()
  filp_cachep can be static in fs/file_table.c
  fix f_count description in Documentation/filesystems/files.txt
  make INIT_FS use the __RW_LOCK_UNLOCKED initialization
  take init_fs to saner place
  kill vfs_permission
  pass a struct path * to may_open
  kill walk_init_root
  remove incorrect comment in inode_permission
  expand some comments (d_path / seq_path)
  correct wrong function name of d_put in kernel document and source comment
  fix switch_names() breakage in short-to-short case
  ...

jfs version of Al Viro's nfsd race patches
Signed-off-by: NDave Kleikamp <shaggy@linux.vnet.ibm.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

... and the same for reiserfs.  The difference here is that we need
insert_inode_locked4() to match iget5_locked().
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>