This patch fixes an issue which causes the firmware to fail with a
'PRLI failed' status code (iop1 = 405). This status triggers the
driver to fall into an incorrect code-path which does not attempt
a login retry.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch fixes a regression introduced by commit
083a469d

qla2xxx_eh_wait_on_command() is waiting for an srb to
complete, which will never happen as the routine took
a reference to the srb previously and will only drop it
after this function. So every command abort will fail.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NGiridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch adds a shutdown handler to qla2xxx driver to make sure that all
DMA and firmware activities are stopped, and any associated driver resources
are released. The need for this handler arose when executing kexec in specific
environments caused the data of the 2nd kernel to be corrupted, due to DMA
activities.
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Commit feafb7b1 neglected to initialize
the spinlock.
Signed-off-by: NAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch cleans up any printk or debug tracing of the the
serial_number field in the qla2xxx driver.
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NHarish Zunjarrao <harish.zunjarrao@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Currently when we receive a CS_RESET as a response for a SCSI command the
driver will return DID_TRANSPORT_DISRUPTED back to the SCSI mid-layer.  There
are certain circumstances where this could cause the mid-layer to exhaust all of
its retries if the FC port goes away for a short time.  This will result in
commands being prematurly failed.  Moving the CS_RESET return code to be
grouped with other link level events will cause the FC transport layer to block
that target's queue thus preventing the premature exhaustion of retries.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Using del_timer_sync() in the qla2x00_ctx_sp_free() function may cause a kernel
panic as it is not interrupt context safe and qla2x00_ctx_sp_free() may be
called from a softirq context.  Changing the call from del_timer_sync() to
del_timer() will make the function interrupt context safe.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Add the module parameter ql2xgffidenable to disable/enable the use of the
GFF_ID name server command to prevent non FCP SCSI devices from being added to
the driver's internal fc_port database.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This patch removes the use of the port down retry counter as a mechanism to
update a fcport state. The internal driver counter is a residual carry-over
from pre-FC-transport aware driver inteaction. The ql2xport_down_retry module
parameter and NVRAM set ha->port_down_retry_count remain in order to seed the
fc-host's default dev-loss-tmo.
Signed-off-by: NChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

IRQs are already disabled here so we don't need to disable them again.
But more importantly, the spin_lock_irqsave() overwrites "flags" and
that breaks things when we want to re-enable the IRQs when we call
spin_unlock_irqrestore(&ha->hardware_lock, flags);
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NMadhuranath Iyengar <Madhu.Iyengar@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

An sr device that reports sense data with SK/ASC/ASCQ of 2/4/2 (Not ready,
Logical unit not ready, Initializing command required) will be handled
in sr_drive_status as (2/4/!1) and assumed to be a 'format in progress'
which returns CDS_DISC_OK.  The drive will not be made ready in this case.

Prior to 210ba1d1 sr_drive_status would
have returned CDS_TRAY_OPEN and this results in an START_STOP_UNIT to
close the tray, which resolves the initialization requirement.

This patch adds handling for SK/ASC/ASCQ of 2/4/2 where it will return
CDS_TRAY_OPEN as a means of triggering a START_STOP_UNIT.

This issue is seen on the IBM POWER platform when using a file-backed,
virtual optical device.  The device does not support media queries
through the Get Event Status Notification command which could otherwise
trigger a START_STOP_UNIT call to close an open tray.
Signed-off-by: NRobert Jennings <rcj@linux.vnet.ibm.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

A previous patch attempted to validate the destination
MAC address of a FCoE frame by checking that MAC
address against the received port's MAC address. The
implementation seems fine on the surface, but any
VN_Ports added using the NPIV feature will have their
own MAC addresses and these MACs were not being checked,
which prevented any NPIV VN_Ports from receiving frames.

In other words, the following patch has broken NPIV.

519e5135
 [SCSI] fcoe: adds src and dest mac address
              checking for fcoe frames

Part of the offending patch is correct, but the part
that broke NPIV was attempting to satisfy FC-BB-5
section D.5, 2.1-

(discard frames that) "contain a destination MAC
address/destination N_Port_ID pair that was not
assigned by an FCF to one of the VN_Ports on the ENode"

The language does _not_ say to compare the destination
FC-MAP/destination N_Port_ID, but instead to compare
the destination MAC address/destination N_Port_ID.

>From the FC-BB-5 specification,

"A properly formed FPMA is one in which the 24 most
significant bits equal the Fabric’s FC-MAP value and
the least significant 24 bits equal the N_Port_ID
assigned to the VN_Port by the FCF."

This means that we need to compare the FC Frame's
destination FCID against the embedded FCID in the
destination MAC address. This patch checks the lower
24 bits of the destination MAC address against
destination FCID in the Fibre Channel frame.

For MAC validation the first line of defense is the
hardware MAC filtering. Each VN_Port will have a
unicast MAC addresses added to the hardware's
filtering table. The Ethernet driver should drop any
MACs not destined for a programmed MAC. This patch
adds a second line of defense that very specfically
compares an element in the FC frame against an element
in the Ethernet header, which is appropriate for the
FCoE layer.

Many alternative approaches were considered, including
a LLD callback from libfc. The second most reasonable
approach seemed to be walking the list of NPIV ports
and check each of their MAC addresses against the
destination MAC address of the received frame. The
problem with this approach was that it is likely that
performance would suffer with the more NPIV ports added
to the system since every received frame would need to
walk this list, comparing each entry's MAC.
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Fix: When FIP frame is received, function fcoe_ctlr_vn_recv calls function
fcoe_ctlr_vn_parse which does memset for addr (&buf.rdata) which leads to
memory corruption. Code was trying to treat "buf" as struct but it was defined
as union. Fix is to change from union to struct for "buf" in function fcoe_ctlr_vn_recv.

Technical Details: N/A
Signed-off-by: NKiran Patil <kiran.patil@intel.com>
Acked-by: NJoe Eykholt <jeykholt@cisco.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

When number of NPIV ports created are greater than the xids
allocated per pool -- for eg., creating 255 NPIV ports on a
system with nr_cpu_ids of 32, with each pool containing 128
xids -- and then generating a link event - for eg.,
shutdown/no shutdown -- on the switch port causes the hang
with the following stack trace.

Call Trace:
schedule_timeout+0x19d/0x230
wait_for_common+0xc0/0x170
__cancel_work_timer+0xcf/0x1b0
fc_disc_stop+0x16/0x30 [libfc]
fc_lport_reset_locked+0x47/0x90 [libfc]
fc_lport_enter_reset+0x67/0xe0 [libfc]
fc_lport_disc_callback+0xbc/0xe0 [libfc]
fc_disc_done+0xa8/0xf0 [libfc]
fc_disc_timeout+0x29/0x40 [libfc]
run_workqueue+0xb8/0x140
worker_thread+0x96/0x110
kthread+0x96/0xa0
child_rip+0xa/0x20

Fix is to not cancel the disc_work if discovery is already
stopped, thus allowing lport state machine to restart and try
discovery again.
Signed-off-by: NBhanu Prakash Gollapudi <bprakash@broadcom.com>
Acked-by: NJoe Eykholt <jeykholt@cisco.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

It is unlikely but in case if it hits then it would cause panic
due to null cmd ptr, so far only one instance seen recently with
ESX though this was introduced long ago with this commit:-

commit c1ecb90a
Author: Chris Leech <christopher.leech@intel.com>
Date:   Thu Dec 10 09:59:26 2009 -0800
[SCSI] libfc: reduce hold time on SCSI host lock

Currently fsp->cmd is set to NULL w/o scsi_queue_lock before
dequeuing from scsi_pkt_queue and that could cause NULL
fsp->cmd in fc_fcp_cleanup_each_cmd for cmd completing
with fsp->cmd = NULL after fc_fcp_cleanup_each_cmd taken
reference. No need to set fsp->cmd to NULL as this is also
protected by fc_fcp_lock_pkt(), for above race the
fc_fcp_lock_pkt() in fc_fcp_cleanup_each_cmd() will fail
as that cmd is  already done.

Mike mentioned same issue at
http://www.open-fcoe.org/pipermail/devel/2010-September/010533.html

Similarly moved sc_cmd->SCp.ptr = NULL under scsi_queue_lock so
that scsi abort error handler won't abort on completed cmds.
Signed-off-by: NVasu Dev <vasu.dev@intel.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Since sometimes current FIP_MODE_AUTO mode falls back to non-FIP
mode while DCB link still getting ready in fabric mode with
its peer switch, it falls back after few libfc flogi retries
and that is not we want while working with FIP enabled
switches in FABRIC mode, therefore sets default as FIP_MODE_FABRIC
as discussed and agreed before in this mail thread
http://www.open-fcoe.org/pipermail/devel/2010-August/010511.htmlSigned-off-by: NVasu Dev <vasu.dev@intel.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Sometimes switch in NPV mode rejects flogi request with DID
zero and in that case flogi is not tried again and port
remains offline, so this patch validates DID for non zero
along with only ACC response to allow flogi retry
for RJT with DID=0 also succeed FLOGI in next try.
Signed-off-by: NVasu Dev <vasu.dev@intel.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This is per Mile Christie feedback since in this case IO
could get retried for tape devices and therefore DID_REQUEUE
cannot be used, more details in this thread.

http://marc.info/?l=linux-scsi&m=127970522630136&w=2Signed-off-by: NVasu Dev <vasu.dev@intel.com>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

There does not seem to be a reason why libfc adds a 5
second delay to the user requested value for the dev loss
tmo. There also does not seem to be a reason to allow
setting it to 0 (or really close).

This patch removes the extra 5 sec delay, and for 0 it
sets it to 1 like other fc drivers. We should actually
be able to set it to 0 since the queue_delayed_work API
will just call queue_work, but other drivers set it to 1 in
that case.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NRobert Love <robert.w.love@intel.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

gdth_ioctl_alloc() takes the size variable as an int.
copy_from_user() takes the size variable as an unsigned long.
gen.data_len and gen.sense_len are unsigned longs.
On x86_64 longs are 64 bit and ints are 32 bit.

We could pass in a very large number and the allocation would truncate
the size to 32 bits and allocate a small buffer.  Then when we do the
copy_from_user(), it would result in a memory corruption.

CC: stable@kernel.org
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Removing SCSI devices through
echo 1 > /sys/bus/scsi/devices/ ... /delete

while the FC transport class removes the SCSI target can lead to an
oops:

Unable to handle kernel pointer dereference at virtual kernel address 00000000b6815000
Oops: 0011 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: sunrpc qeth_l3 binfmt_misc dm_multipath scsi_dh dm_mod ipv6 qeth ccwgroup [last unloaded: scsi_wait_scan]
CPU: 1 Not tainted 2.6.35.5-45.x.20100924-s390xdefault #1
Process fc_wq_0 (pid: 861, task: 00000000b7331240, ksp: 00000000b735bac0)
Krnl PSW : 0704200180000000 00000000003ff6e4 (__scsi_remove_device+0x24/0xd0)
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3
Krnl GPRS: 0000000000000001 0000000000000000 00000000b6815000 00000000bc24a8c0
           00000000003ff7c8 000000000056dbb8 0000000000000002 0000000000835d80
           ffffffff00000000 0000000000001000 00000000b6815000 00000000bc24a7f0
           00000000b68151a0 00000000b6815000 00000000b735bc20 00000000b735bbf8
Krnl Code: 00000000003ff6d6: a7840001            brc 8,3ff6d8
           00000000003ff6da: a7fbffd8            aghi %r15,-40
           00000000003ff6de: e3e0f0980024        stg %r14,152(%r15)
          >00000000003ff6e4: e31021200004        lg %r1,288(%r2)
           00000000003ff6ea: a71f0000            cghi    %r1,0
           00000000003ff6ee: a7a40011            brc 10,3ff710
           00000000003ff6f2: a7390003            lghi    %r3,3
           00000000003ff6f6: c0e5ffffc8b1        brasl %r14,3f8858
Call Trace:
([<0000000000001000>] 0x1000)
 [<00000000003ff7d2>] scsi_remove_device+0x42/0x54
 [<00000000003ff8ba>] __scsi_remove_target+0xca/0xfc
 [<00000000003ff99a>] __remove_child+0x3a/0x48
 [<00000000003e3246>] device_for_each_child+0x72/0xbc
 [<00000000003ff93a>] scsi_remove_target+0x4e/0x74
 [<0000000000406586>] fc_rport_final_delete+0xb2/0x23c
 [<000000000015d080>] worker_thread+0x200/0x344
 [<000000000016330c>] kthread+0xa0/0xa8
 [<0000000000106c1a>] kernel_thread_starter+0x6/0xc
 [<0000000000106c14>] kernel_thread_starter+0x0/0xc
INFO: lockdep is turned off.
Last Breaking-Event-Address:
 [<00000000003ff7cc>] scsi_remove_device+0x3c/0x54

The function __scsi_remove_target iterates through the SCSI devices on
the host, but it drops the host_lock before calling
scsi_remove_device. When the SCSI device is deleted from another
thread, the pointer to the SCSI device in scsi_remove_device can
become invalid. Fix this by getting a reference to the SCSI device
before dropping the host_lock to keep the SCSI device alive for the
call to scsi_remove_device.
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Create a sysfs entry that reports the negotiated DIX/DIF protection mode
for a SCSI disk. This depends on the protection type the disk is
formatted with as well as the protection capabilities advertised by the
controller.
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

grab hardware_lock in eh_abort before accessing srb to avoid
race between command completion and get refcount on srb.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

* Cleanup qla4xxx_pci_mmio_enabled():
  don't want to return PCI_ERS_NEED_RESET if firmware hung.
  IDC will take care of it.
* Request irq after initialize_adapter() in qla82xx_error_recovery().
* Return all active commands from qla4xxx_pci_error_detected().
* Cleanup ql4_def.h
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

There is a possibility that the firmware dies while the rom
lock is held. The only way to recover from this condition is
to forcefully unlock.
Signed-off-by: NShyam Sundar <shyam.sundar@qlogic.com>
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Switching from doorbell mechanism to CRB register based
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NShyam Sundar <shyam.sundar@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NKaren Higgins <karen.higgins@qlogic.com>
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

AEN 8130 Corresponds to an event representing the insertion (detection)
of a transceiver. It also reports the type of the SFP+.
AEN 8131 corresponds to the removal of a transceiver.
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NShyam Sundar <shyam.sundar@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The seconds_since_last_heartbeat should be checked for consecutive
heartbeat checks. Currently it could happen that it gets set to
max (2 seconds) for non-consecutive heartbeat checks.
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NLalit Chandivade <lalit.chandivade@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NNilesh Javali <nilesh.javali@qlogic.com>
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Since interrupts are registered in start_firmware(load_risc) for 82xx,
free them if init_firmware fails.
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NKaren Higgins <karen.higgins@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

change data type of sense_len from uint8_t to uint16_t
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

remove "ha->retry_reset_ha_cnt" from wait_for_hba_online as its
initialize to zero at driver init time so it could always return
QLA_ERROR from wait_for_hba_online() without waiting for hba to
come online.
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

* cleanup function qla4xxx_recovery_timeout
	- No need to wakeup dpc thread from function
	qla4xxx_recovery_timeout() as we are not doing anything
	in do_dpc() thread when wakeup from
	qla4xxx_recovery_timeout()

* cleanup function qla4xxx_wait_for_hba_online
	- Remove hard coded value from qla4xxx_wait_for_hba_online().

* cleanup function qla4xxx_start_firmware_from_flash
	- display seconds

* cleanup function  qla4_8xxx_load_risc
	- Remove redundant code.

* cleanup function qla4xxx_get_firmware_status
	- update debug statement

* cleanup function qla4_8xxx_try_start_fw
	- update return status
Signed-off-by: NVikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NRavi Anand <ravi.anand@qlogic.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Deleting a SCSI device on a blocked fc_remote_port (before
fast_io_fail_tmo fires) results in a hanging thread:

  STACK:
  0 schedule+1108 [0x5cac48]
  1 schedule_timeout+528 [0x5cb7fc]
  2 wait_for_common+266 [0x5ca6be]
  3 blk_execute_rq+160 [0x354054]
  4 scsi_execute+324 [0x3b7ef4]
  5 scsi_execute_req+162 [0x3b80ca]
  6 sd_sync_cache+138 [0x3cf662]
  7 sd_shutdown+138 [0x3cf91a]
  8 sd_remove+112 [0x3cfe4c]
  9 __device_release_driver+124 [0x3a08b8]
10 device_release_driver+60 [0x3a0a5c]
11 bus_remove_device+266 [0x39fa76]
12 device_del+340 [0x39d818]
13 __scsi_remove_device+204 [0x3bcc48]
14 scsi_remove_device+66 [0x3bcc8e]
15 sysfs_schedule_callback_work+50 [0x260d66]
16 worker_thread+622 [0x162326]
17 kthread+160 [0x1680b0]
18 kernel_thread_starter+6 [0x10aaea]

During the delete, the SCSI device is in moved to SDEV_CANCEL.  When
the FC transport class later calls scsi_target_unblock, this has no
effect, since scsi_internal_device_unblock ignores SCSI devics in this
state.

It looks like all these are regressions caused by:
5c10e63c
[SCSI] limit state transitions in scsi_internal_device_unblock

Fix by rejecting offline and cancel in the state transition.
Signed-off-by: NChristof Schmitt <christof.schmitt@de.ibm.com>
[jejb: Original patch by Christof Schmitt, modified by Mike Christie]
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

I seem to have a knack for digging up buggy usb devices which don't work
with Linux, and I'm crazy enough to try to make them work.  So this time a
friend of mine asked me to get an mp4 player (an mp3 player which can play
videos on a small screen) to work with Linux.

It is based on the well known rockbox chipset for which we already have an
unusual devs entries to work around some of its bugs.  But this model
comes with an additional twist.

This model chokes on read_capacity_16 calls.  Now normally we don't make
those calls, but this model comes with an sdcard slot and when there is no
card in there (and shipped from the factory there is none), it reports a
size of 0.  However this time the programmers actually got the
read_capacity_10 response right!  So they substract one from the size as
stored internally in the mp3 player before reporting it back, resulting in
an answer of ...  0xffffffff sectors, causing sd.c to try a
read_capacity_16, on which the device crashes.

This patch adds a flag to scsi_device to indicate that a a device cannot
handle read_capacity_16, and when this flag is set if a device reports an
lba of 0xffffffff as answer to a read_capacity_10, assumes it tries to
report a size of 0.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>