Fix (delete) empty kernel-doc lines/warnings:
Warning(drivers/message/fusion/mptbase.c:6916): bad line:
Warning(drivers/message/fusion/mptbase.c:7060): bad line:
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: Eric Moore <Eric.Moore@lsi.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Check return value of put_user() and return -EFAULT if it failed.
Original comment "We did a get user...so assuming mem is ok...is this
bad?" is incorrect because memory can be read only.
Signed-off-by: NKulikov Vasiliy <segooon@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If (len > reslen) we must not call copy_to_user() since kernel buffer is
smaller than we want to copy.  Similar code in this file is correct, so
this bug was a typo.
Signed-off-by: NKulikov Vasiliy <segooon@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add a mutex_unlock missing on the error path.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression E1;
@@

* mutex_lock(E1,...);
  <+... when != E1
  if (...) {
    ... when != E1
*   return ...;
  }
  ...+>
* mutex_unlock(E1,...);
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Convert everything except ->proc_info() stuff, it is done within separate
->proc_info path series.

Problem with ->read_proc et al is described here commit
786d7e16 "Fix rmmod/read/write races in
/proc entries"
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Cc: Eric Moore <Eric.Moore@lsi.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If the NULL test on dev->i2o_dev or i2o_dev is needed, then the dereference
should be after the NULL test.

A simplified version of the semantic match that detects this problem is as
follows (http://coccinelle.lip6.fr/):

// <smpl>
@match exists@
expression x, E;
identifier fld;
@@

* x->fld
  ... when != \(x = E\|&x\)
* x == NULL
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: James Bottomley <James.Bottomley@suse.de>
Cc: Kashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

No need to open code this!
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
Reviewed-by: NTakashi Iwai <tiwai@suse.de>

Indent the branch of an if.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r disable braces4@
position p1,p2;
statement S1,S2;
@@

(
if (...) { ... }
|
if (...) S1@p1 S2@p2
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

if (p1[0].column == p2[0].column):
  cocci.print_main("branch",p1)
  cocci.print_secs("after",p2)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This restores the changes from "scsi/i2o_block: cleanup ioctl
handling", which accidentally got reverted.

Origignal changelog:
      This fixes the ioctl function of the i2o_block driver, which
      has multiple problems:

      * The BLKI2OSRSTRAT and BLKI2OSWSTRAT commands always return
        -ENOTTY on success, where they should return 0.
      * Support for 32 bit compat is missing
      * The driver should use the .ioctl function and because
        .locked_ioctl is going away.

      The use of the big kernel lock remains for now, but gets
      made explictit in the ioctl function.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

The open and release block_device_operations are currently
called with the BKL held. In order to change that, we must
first make sure that all drivers that currently rely
on this have no regressions.

This blindly pushes the BKL into all .open and .release
operations for all block drivers to prepare for the
next step. The drivers can subsequently replace the BKL
with their own locks or remove it completely when it can
be shown that it is not needed.

The functions blkdev_get and blkdev_put are the only
remaining users of the big kernel lock in the block
layer, besides a few uses in the ioctl code, none
of which need to serialize with blkdev_{get,put}.

Most of these two functions is also under the protection
of bdev->bd_mutex, including the actual calls to
->open and ->release, and the common code does not
access any global data structures that need the BKL.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NChristoph Hellwig <hch@infradead.org>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

As a preparation for the removal of the big kernel
lock in the block layer, this removes the BKL
from the common ioctl handling code, moving it
into every single driver still using it.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NChristoph Hellwig <hch@infradead.org>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

This fixes the ioctl function of the i2o_block driver, which
has multiple problems:

* The BLKI2OSRSTRAT and BLKI2OSWSTRAT commands always return
  -ENOTTY on success, where they should return 0.
* Support for 32 bit compat is missing
* The driver should use the .ioctl function and because
  .locked_ioctl is going away.

The use of the big kernel lock remains for now, but gets
made explictit in the ioctl function.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

Remove all the trivial wrappers for the cmd_type and cmd_flags fields in
struct requests.  This allows much easier grepping for different request
types instead of unwinding through macros.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

We should release the resources in error return code path.
The requested pci bars should be released under an error condition,
when mpt_mapresources fails.
Signed-off-by: NTomas Henzl <thenzl@redhat.com>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Version upgrade patch.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Adding function name in original debug prints and few more debug prints are
added.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Issue description:
In multipath topology, when device deletion is in transient state,
multipath driver can call blk_flush_queue() as part of path failure.
Before device get deleted from OS, Device may go OFFLINE as part of error
handling kicked off triggered from multipathing driver. Above condition hits
more frequently if device missing delay timer (which is LSI specific firmware
parameter) is non zero value.

root cause of this issue is Error handling thread is getting kicked off for
device which is not really present(in transient state of deleting).

This patch has solution for this issue. driver is now using eh_timed_out
callback. See below.

mptsas_transport_template->eh_timed_out = mptsas_eh_timed_out

Using mptsas_eh_timed_out function, driver can decide weather vdevice is
under Device missing delay or deleting state.

for either of those cases, there is BLK_EH_RESET_TIMER return to scsi mid
and error handling thread will not be kicked off for that particular scsi
command.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Printing Doorbell register in a case of hard reset and timeout
should be useful for figuring out the state of the system.
Signed-off-by: NKei Tokunaga <tokunaga.keiich@jp.fujitsu.com>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch fixes mptsas disk hot-removal processing.  The
hot-removal processing doesn't complete because of this condition.

  drivers/message/fusion/mptsas.c:
  mptsas_taskmgmt_complete()

  if ((mptsas_find_vtarget(ioc, channel, id)) && !ioc->fw_events_off)
    mptsas_queue_device_delete(...);

mptsas_queue_device_delete(), which must be called for
hot-removal, never gets called because mptsas_find_vtarget()
always returns 0 here.  At that time, the vtarget has already
been freed in mptsas_target_destroy(), and also the scsi_device
has been marked as SDEV_DEL.

As a result of the issue, port deletion functions won't get
called and the device ends up being in an incomplete state.
(Some data structures and sysfs entries, which should be
removed in hot-removal, remain.)  One side effect of this is
that a hot-addition of the device (bringing the device back
on) fails.

This patch just removes mptsas_find_vtarget() from the if-state
condition.
Signed-off-by: NKei Tokunaga <tokunaga.keiich@jp.fujitsu.com>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

In mpt_detach, call to pci_set_drvdata is redundant because it
has already been called in mpt_adapter_disable. In mpt_attach,
ioc->pcidev is set to pdev two times.
Signed-off-by: NBandan Das <bandan.das@stratus.com>
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Upgrade driver version to 3.4.16
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added missing part which will reset ioc_reset_in_progress before returning from SoftResetHandler.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Issue: SATA hotplug does not work sometimes.
At the time of ADD device/ADD phys disk, drive may fail to add SATA device
due to temporary SAS Address for SATA device generated by firmware. Final
SAS address for SATA driver will be generated only after disk spinup is
done. This may take some times for slow spining SATA drives.

At phy link up driver gets attached device sas address and stores into
phyinfo. At the time of ADD event driver will read sas device page0 using
channel and FW ID provided in ADD Device event. Here in case of SATA drives,
driver will see miss match in phyinfo->sas_address and latest sas address
read from SAS DEVICE PAGE0 and eventually device won't be added to OS.

Fix:
When Driver read SAS DEVICE PAGE0, it can identify Device type looking at
device_info. If device is SATA drive and sas address mismatch happens,
Driver will do same stuffs which happened at the time of LINK UP to get
correct piece of information from Pages. ( Find parent device and refresh
parent device phys either HBA refresh/Exp refresh)
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Issue:
target reset will be queued to driver's internal queue to get schedule
later. When driver add target into internal target_reset queue we will block IOs
on those target using scsi midlayer API. Now due to some cause driver is not
executing those target_reset list and it is always in block state.

Changes:
now we are clearing target_reset queue from all other Callback context
instead of only DeviceReset context.Now wherever driver is clearing
taskmgmt_in_progress flag it is considering target_reset queue cleanup
also.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added sanity check before treating any device is a valid device.
It is possible that firmware can have device page0 in its table, but that
devicemay not be available in topology. Device will be available in topology
only if there is Bus Target mapping is done in firmware. Driver will always
check B_T mapping of firmware before reporting device to upper layer.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

device missing delay is 8 bit value in io unit pg1. Making correct variable
declaration for device_missing_delay.

The driver is storing the calculated device missing delay in IOC structure
as a u8 instead of a u16. It needs to be a u16 if the delay is > 255.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Changed the return value for Nexus Loss IOs to be DID_TRANSPORT_DISRUPTED.
What this will allow is the multi-path driver to delay the fail over
process. They would like the path to keep up as long as the nexus loss
Loginfo is return from firmware. With DID_BUS_BUSY the path fails over
immediately.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

fw_events_off is flag checking for driver to do Event handling or not.
Normally it should be OFF at the time of initialization. Only enable it at
the time of INTR enable of device first time. This will always occur only
after resource allocation.

ioc->fw_events_off = 1 is set in mpt_attach()
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

I may have an explanation for the LSI 1068 HBA hangs provoked by ATA
pass-through commands, in particular by smartctl.

First, my version of the symptoms.  On an LSI SAS1068E B3 HBA running
01.29.00.00 firmware, with SATA disks, and with smartd running, I'm seeing
occasional task, bus, and host resets, some of which lead to hard faults of
the HBA requiring a reboot.  Abusively looping the smartctl command,

    # while true; do smartctl -a /dev/sdb > /dev/null; done

dramatically increases the frequency of these failures to nearly one per
minute.  A high IO load through the HBA while looping smartctl seems to
improve the chance of a full scsi host reset or a non-recoverable hang.

I reduced what smartctl was doing down to a simple test case which
causes the hang with a single IO when pointed at the sd interface.  See
the code at the bottom of this e-mail.  It uses an SG_IO ioctl to issue
a single pass-through ATA identify device command.  If the buffer
userspace gives for the read data has certain alignments, the task is
issued to the HBA but the HBA fails to respond.  If run against the sg
interface, neither the test code nor smartctl causes a hang.

sd and sg handle the SG_IO ioctl slightly differently.  Unless you
specifically set a flag to do direct IO, sg passes a buffer of its own,
which is page-aligned, to the block layer and later copies the result
into the userspace buffer regardless of its alignment.  sd, on the other
hand, always does direct IO unless the userspace buffer fails an
alignment test at block/blk-map.c line 57, in which case a page-aligned
buffer is created and used for the transfer.

The alignment test currently checks for word-alignment, the default
setup by scsi_lib.c; therefore, userspace buffers of almost any
alignment are given directly to the HBA as DMA targets.  The LSI 1068
hardware doesn't seem to like at least a couple of the alignments which
cross a page boundary (see the test code below).  Curiously, many
page-boundary-crossing alignments do work just fine.

So, either the hardware has an bug handling certain alignments or the
hardware has a stricter alignment requirement than the driver is
advertising.  If stricter alignment is required, then in no case should
misaligned buffers from userspace be allowed through without being
bounced or at least causing an error to be returned.

It seems the mptsas driver could use blk_queue_dma_alignment() to advertise
a stricter alignment requirement.  If it does, sd does the right thing and
bounces misaligned buffers (see block/blk-map.c line 57).  The following
patch to 2.6.34-rc5 makes my symptoms go away.  I'm sure this is the wrong
place for this code, but it gets my idea across.
Acked-by: N"Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use memdup_user when user data is immediately copied into the
allocated region.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

-  to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+  to = memdup_user(from,size);
   if (
-      to==NULL
+      IS_ERR(to)
                 || ...) {
   <+... when != goto l1;
-  -ENOMEM
+  PTR_ERR(to)
   ...+>
   }
-  if (copy_from_user(to, from, size) != 0) {
-    <+... when != goto l2;
-    -EFAULT
-    ...+>
-  }
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The function name must be followed by a space, hypen, space, and a
short description.
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: Eric Moore <Eric.Moore@lsi.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This is just a cleanup and doesn't change how the code works.

The original code had a mix of returns and gotos so I changed everything
to just return directly.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Reviewed-by: NChristoph Lameter <cl@linux-foundation.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Upgrade version from 3.04.14 to 3.04.15
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added proper error handling after mpt_config.
Now check of MPI_IOCSTATUS_CONFIG_INVALID_PAGE is added.
If error is MPI_IOCSTATUS_CONFIG_INVALID_PAGE, driver will return -ENODEV.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

event_data needs to be 4 byte aligned to makes sure there is no unaligned
memory access take place.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

1) Corrected name string as "MPT SAS HOST"
2) Added proper check conditions for MPT_MGMT_STATUS_COMMAND_GOOD.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

1) corrected return value as SUCCESS instead of 0.
2) Added check in mptscsih_abort.
mptfusion do not support task abort for Volumes.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added sanity checks before accessing vdevice and added vdevice->deleted
setting for mptfc.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Set factor, offset and width while target negotiation.

Added config timeout 60 seconds. It was missing for only
mptspi_read_spi_device_pg0
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>