The original code would incorrectly hardcode ELS timeout values
rather than using the traditional '2 * r_a_tov' value.  In some
cases, the hardcoded values would be larger than the
mailbox-command-timeout and result in a needless BIG_HAMMER (ISP
reset), the typical recovery mechanism employed in such cases.

The second defect in the original code was in the assignment of
the default 'ha->r_a_tov' to twice the traditional value.
Correct this by setting the value to 10 seconds.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

For recent ISPs, software must detect OVERRUN conditions by
checking the SS_RESIDUAL_OVER bit during CS_COMPLETE handling.
Update the driver to perform this check, which is consistent with
what earlier firmwares did by explicitly cracking open the
FCP_RSP statuses and returning an CS_DATA_OVERRUN.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

There's no point in hitting the RISC with what will most
assuredly be an unsucessful reset of the RISC hardware if the
initial stop-firmware mailbox command fails with a time-out
status.  Instead, to avoid what could amount to a lengthy
stop-firmware/detect-failure/reset-risc loop, continue with
driver unloading and discard the stop-firmware requirement.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The fix up from Daniel Drake for replacing GFP_DMA with something
more sensible has gone in here:

commit 69e562c2
Author: Daniel Drake <dsd@gentoo.org>
Date:   Wed Feb 20 13:29:05 2008 +0000

    [SCSI] arcmsr: fix message allocation

add a change log and update the version for this.
Signed-off-by: NNick Cheng <nick.cheng@areca.com.tw>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

ps3rom does:

scsi_for_each_sg(cmd, sgpnt, scsi_sg_count(cmd), k) {
	kaddr = kmap_atomic(sg_page(sgpnt), KM_IRQ0);

We cannot do something like that with the clustering enabled (or we
can use scsi_kmap_atomic_sg).
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

sg driver rounds up the length in struct scatterlist to be a multiple
of 512 in some conditions. So LLDs can't use the data length in a sg
list to calculate residual. Instead, the length in struct scsi_cmnd
should be used.

[Geert: the variable buflen already contains scsi_bufflen(cmd)]
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: NGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The phy sas address is showing wrongly (wrong endianness).  Fix up the
endian transforms to make this correct.
Signed-off-by: NKe Wei <kewei@marvell.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The recent patch named:
  [SCSI] gdth: !use_sg cleanup and use of scsi accessors

has done a bad job in handling internal commands issued by gdth_execute().

Internal commands are issued with device gdth_cmd_str ready made directly
to the card, without any mapping or translations of scsi commands. So here
I added a gdth_cmd_str pointer to the gdth_cmndinfo private structure which
is then copied directly to host.

following this patch is a cleanup that removes the home cooked accessors
and reverts them to regular scsi_cmnd accessors. Since they are not used
anymore. After review maybe the 2 patches should be squashed together.

FIXME: There is still a problem with gdth_get_info(). as reported there
   is a WARN_ON trigerd in dma_free_coherent() when doing:
   $ cat /proc/sys/gdth/0
Signed-off-by: NBoaz Harrosh <bharrosh@panasas.com>
Tested-by: NJoerg Dorchain: <joerg@dorchain.net>
Tested-by: NStefan Priebe <s.priebe@allied-internet.ag>
Tested-by: NJon Chelton <jchelton@ffpglobal.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

gdth_exit would first remove all cards then stop the timer
and would not sync with the timer function. This caused a crash
in gdth_timer() when module was unloaded.
So del_timer_sync the timer before we delete the cards.

also the reboot notifier function would crash. So clean
that up and fix the crashes.
Signed-off-by: NBoaz Harrosh <bharrosh@panasas.com>
Tested-by: NJoerg Dorchain: <joerg@dorchain.net>
Tested-by: NStefan Priebe <s.priebe@allied-internet.ag>
Tested-by: NJon Chelton <jchelton@ffpglobal.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The old tools did not set max session cmds. This is a regression.
I removed the check when merging the power of 2 patch.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This is a particularly nasty bug.  The problem is that if any internal
ascb times out, currently we free it even though it's pending at the
sequencer.  This results in the sequencer getting terminally confused
and the error message:

BUG:sequencer:dl:no ascb

Being returned when it comes back.  The way to fix this is to manage
freeing the ascb from the tasklet completion routine, so that we only
free it when the sequencer actually returns it.  The code is also
altered to use on stack completions and transfer variables.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

- Correct one use after free of the sas task
- update the reset required path to move straight to LUN reset
- make the bigger hammer actually reset something instead of just trying
  to clear all the tasks.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Once the phy reset is plumbed in properly, SATA error handling fails
nastily because we change the port attached_sas_address using the WWN
field of the IDENTIFY message.  This is a nice thing to do in theory,
but it really destroys hotplug because any event on the port causes an
automatic mismatch between the sas_address the phy just picked up and
the one we propagate into the port.  However ugly they are, we have to
stick with the sas addresses made up by the phys and expanders.

Also does a few cosmetic changes to the way port printing is done to
make it clearer how a port is formed.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Currently aic94xx has no exported I_T_nexus_reset function.  This is a
bit of a huge problem, since sas_ata relies on this function to
perform an ATA phy reset and also it means that if abort fails, we
really have no bigger hammer to hit everything with.

Plumb in the I_T_nexus_reset by quiescing the sequencer, sending the
correct phy reset (link for ATA and hard for SAS) and then carefully
resuming the sequencer again.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This is needed by the to be added I_T reset function in aic94xx.  It
needs to know the local phy so it can send a link or hard reset along
the path.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

mvsas.c picked up execute permissions.  Move it back to being a plane
old file.

James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

- Fix build 'make randconfig' build warning spotted by Toralf Foerster:

drivers/scsi/mvsas.c: In function 'mvs_hexdump':
drivers/scsi/mvsas.c:715: error: implicit declaration of function 'isalnum'

- Remove unneeded prototypes (spotted by hch)
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

During the last step of hibernation in the "platform" mode (with the
help of ACPI) we use the suspend code, including the devices'
->suspend() methods, to prepare the system for entering the ACPI S4
system sleep state.

But at least for some devices the operations performed by the
->suspend() callback in that case must be different from its operations
during regular suspend.

For this reason, introduce the new PM event type PM_EVENT_HIBERNATE and
pass it to the device drivers' ->suspend() methods during the last phase
of hibernation, so that they can distinguish this case and handle it as
appropriate.  Modify the drivers that handle PM_EVENT_SUSPEND in a
special way and need to handle PM_EVENT_HIBERNATE in the same way.

These changes are necessary to fix a hibernation regression related
to the i915 driver (ref. http://lkml.org/lkml/2008/2/22/488).
Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
Acked-by: NPavel Machek <pavel@ucw.cz>
Tested-by: NJeff Chua <jeff.chua.linux@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In current mainline, __devinit qpti_sbus_probe() still is calling __init
qpti_chain_add().  Change occurrences of __init to __devinit to fix.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Convert rough draft Marvell 6440 driver to a working driver.
Added support for SAS and SATA devices, hotplug, wide port, and expanders.
Signed-off-by: NKe Wei <kewei@marvell.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The current sas_scsi_clear_queue_lu() is wrongly checking for commands
which match the pointer to the one passed in.  It should be checking for
commands which are on the same logical unit as the one passed in.  Fix
this by checking target pointer and LUN for equality.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The clear nexus I_T and clear nexus I_T_L functions in the aic94xx
specify the SUSPEND_TX flag which causes the sequencer to be suspended
until it receives a RESUME_TX.  Unfortunately, nothing ever sends the
resume, so the sequencer on the link is stopped forever, leading to
eventual timeouts and I/O errors.

Since clear nexus commands are only executed as part of error recovery,
it's perfectly fine to keep the sequencer running on the link ... as
soon as the recovery function is completed, we'll send it the commands
to retry.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Remove the now useless counting of adjacent pages from the debugging code in
to make it compile when DEBUG is set non-zero.
Signed-off-by: NKai Makisara <kai.makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

stex_internal_copy copies an in-kernel buffer to a sg list by using
scsi_kmap_atomic_sg. Some functions calls stex_internal_copy with
sg_count in struct st_ccb, which is the value that dma_map_sg
returned. However it might be shorter than the actual number of sg
entries (if the IOMMU merged the sg entries).

scsi_kmap_atomic_sg doesn't see sg->dma_length so stex_internal_copy
should be called with the actual number of sg entries
(i.e. scsi_sg_count), because if the sg entries were merged,
stex_direct_copy wrongly think that the data length in the sg list is
shorter than the actual length.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NEd Lin <ed.lin@promise.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

stex_direct_copy copies an in-kernel buffer to a sg list in order to
spoof some SCSI commands. stex_direct_copy calls dma_map_sg and then
stex_internal_copy with the value that dma_map_sg returned. It calls
scsi_kmap_atomic_sg to copy data.

scsi_kmap_atomic_sg doesn't see sg->dma_length so if dma_map_sg merges
sg entries, stex_internal_copy gets the smaller number of sg entries
than the acutual number, which means it wrongly think that the data
length in the sg list is shorter than the actual length.

stex_direct_copy shouldn't call dma_map_sg and it doesn't need since
this code path doesn't involve dma transfers. This patch removes
stex_direct_copy and simply calls stex_internal_copy with the actual
number of sg entries.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NEd Lin <ed.lin@promise.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Commit 3163f725 introduced locking in
lpfc_sli_hbqbuf_fill_hbqs, but missed unlocking on one exit.
Reported-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NMatthew Wilcox <willy@linux.intel.com>
Acked-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

the check in the residual case has an incorrect test of scsi_status
(the logic is reversed, it should be scsi_status != 0 instead of
!scsi_status.  Since we checked a few lines above that scsi_status was
non-zero, just eliminate this test
Signed-off-by: NDavid C Somayajulu <david.somayajulu@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The libsas error handler has two fairly fatal bugs

1. scsi_sas_task_done calls scsi_eh_finish_cmd() too early.  This
   happens if the task completes after it has been aborted but before
   the error handler starts up.  Because scsi_eh_finish_cmd()
   decrements host_failed and adds the task to the done list, the
   error handler start check (host_failed == host_busy) never passes
   and the eh never starts.

2. The multiple task completion paths sas_scsi_clear_queue_... all
   simply delete the task from the error queue.  This causes it to
   disappear into the ether, since a command must be placed on the
   done queue to be finished off by the error handler.  This behaviour
   causes the HBA to hang on pending commands.

Fix 1. by moving the SAS_TASK_STATE_ABORTED check to an exit clause at
the top of the routine and calling ->scsi_done() unconditionally (it
is a nop if the timer has fired).  This keeps the task in the error
handling queue until the eh starts.

Fix 2. by making sure every task goes through task complete followed
by scsi_eh_finish_cmd().

Tested this by firing resets across a disk running a hammer test (now
it actually survives without hanging the system)
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

arcmsr_iop_message_xfer() is called from atomic context under the
queuecommand scsi_host_template handler. James Bottomley pointed out
that the current GFP_KERNEL|GFP_DMA flags are wrong: firstly we are in
atomic context, secondly this memory is not used for DMA.
Also removed some unneeded casts.
Signed-off-by: NDaniel Drake <dsd@gentoo.org>
Cc: Nick Cheng <nick.cheng@areca.com.tw>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch makes the following needlessly global functions static:
- __iscsi_unblock_session()
- iscsi_session_state_name()
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Acked-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This patch makes the needlessly global lpfc_disable_node() static.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Acked-by: NJames Smart <James.Smart@Emulex.Com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

This fixes a bug that can't handle a passthru command with more than
two sg entries.

Big thanks to Tim Pepper for debugging the problem.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NMark Salyzyn <Mark_Salyzyn@adaptec.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

that provided by the block layer

ATA requires that all DMA transfers begin and end on word boundaries.
Because of this, a large amount of machinery grew up in ide to adjust
scatterlists on this basis.  However, as of 2.5, the block layer has a
dma_alignment variable which ensures both the beginning and length of a
DMA transfer are aligned on the dma_alignment boundary.  Although the
block layer does adjust the beginning of the transfer to ensure this
happens, it doesn't actually adjust the length, it merely makes sure
that space is allocated for transfers beyond the declared length.  The
upshot of this is that scatterlists may be padded to any size between
the actual length and the length adjusted to the dma_alignment safely
knowing that memory is allocated in this region.

Right at the moment, SCSI takes the default dma_aligment which is on a
512 byte boundary.  Note that this aligment only applies to transfers
coming in from user space.  However, since all kernel allocations are
automatically aligned on a minimum of 32 byte boundaries, it is safe to
adjust them in this manner as well.

tj: * Adjusting sg after padding is done in block layer.  Make libata
      set queue alignment correctly for ATAPI devices and drop broken
      sg mangling from ata_sg_setup().
    * Use request->raw_data_len for ATAPI transfer chunk size.
    * Killed qc->raw_nbytes.
    * Separated out killing qc->n_iter.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

With padding and draining moved into it, block layer now may extend
requests as directed by queue parameters, so now a request has two
sizes - the original request size and the extended size which matches
the size of area pointed to by bios and later by sgs.  The latter size
is what lower layers are primarily interested in when allocating,
filling up DMA tables and setting up the controller.

Both padding and draining extend the data area to accomodate
controller characteristics.  As any controller which speaks SCSI can
handle underflows, feeding larger data area is safe.

So, this patch makes the primary data length field, request->data_len,
indicate the size of full data area and add a separate length field,
request->raw_data_len, for the unmodified request size.  The latter is
used to report to higher layer (userland) and where the original
request size should be fed to the controller or device.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

The spinlock is held over too large a region: pscratch is a permanent
address (it's allocated at boot time and never changes).  All you need
the smp lock for is mediating the scratch in use flag, so fix this by
moving the spinlock into the case where we set the pscratch_busy flag
to false.

Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

scsi/qla2xxx/qla_dfs.c: In function 'qla2x00_dfs_fce_show':
scsi/qla2xxx/qla_dfs.c:26: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type 'uint64_t'
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The panic occurs if we get a MSGIN or MSGOUT for an unidentified SCB
(meaning we didn't identify the outstanding command it was for).  For
MSGIN this is wrong because it could be an unsolicited negotiation
MSGIN from the target.

Still panic on unsolicited MSGOUT because this would represent a
mistake in the negotiation phases.  However, we should fix this as
well.  The specs say we should go to bus free for unexpected msgin.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

scsi_debug does at several places:

for_each_sg(sdb->table.sgl, sg, sdb->table.nents, k) {
	kaddr = (unsigned char *)
		kmap_atomic(sg_page(sg), KM_USER0);

We cannot do something like that with the clustering enabled (or we
can use scsi_kmap_atomic_sg).
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NDouglas Gilbert <dougg@torque.net>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Apparently the fix to [SCSI] fas216: Use scsi_eh API for REQUEST_SENSE
invocation didn't show up in the final version sent to linus.

Correct this omission.

Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>