The ioc->pfacts member in the IOC structure is getting set to zero
following a call to _base_get_ioc_facts due to the memset in that routine.
So if the ioc->pfacts was read after a host reset, there would be a NULL
pointer dereference. The routine _base_get_ioc_facts is called from context
of host reset.  The problem in _base_get_ioc_facts  is the size of
Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
so there is a four byte overflow resulting from the memset.

Also, there is memset in _base_get_port_facts using the incorrect structure,
it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
CC: stable@vger.kernel.org
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fix several endian issues found by runing sparse.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Modified the source code as per the findings reported by the source
code analysis tool. Source code for the following functionalities
has been touched. None of the driver functionalities has changed.

- SMP Passthrough IOCTL
- Debug messages for MPT Replies (i.e. bit 9 of Logging Level)
- Task Management using sysfs
- Device removal, i.e. when a target device (including any PD within a volume)
  is removed, and Volume Deletion.
- Trace Buffer
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

[SCSI] mpt2sas: Improvement were made to better protect the sas_device, raid_device, and expander_device lists

There were possible race conditions surrounding reading an object
from the link list while from another context in the driver was
removing it. The nature of this enhancement is to rearrange locking
so the link lists are better protected.

Change set:
(1) numerous routines were rearranged so spin locks are held through
the entire time a link list object is being read from or written to.
(2) added new routines for object deletion from link list.  Thus ensuring
lock was held during the deletion of the link list object, then and memory
for object freed outside the lock. The memory was freed outside the lock
so driver had access to device object info which was required for
notifying the scsi mid layer that a device was getting deleted.
(3) added the ioc->blocking_handles parameter.  This is a bitmask used
to identify which devices need blocking when there is device loss.  This was
introduced so that lock can be held for the entire time traversing the link
list objects, and the bitmask was set to indicate which device handles need
blocking. Oustide the lock the ioc->blocking_handles bitmask is traversed,
with the respective device handle the scsi mid layer is called for moving
devices into blocking state.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

commit 44c10138 (PCI: Change all
drivers to use pci_device->revision) converted all drivers to use
pci_dev->revision.  Convert these three drivers which got missed.
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This fix ensures that the IOP_LOGINFO_CODE_TASK_TERMINATED
messages do not clutter the sas_log_info messages.

Bugzilla 42142 - mpt2sas: Number specified in wrong base
https://bugzilla.kernel.org/show_bug.cgi?id=42142Signed-off-by: NSathisha Nanjappa <sathisha.nanjappa@hp.com>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The old pci_remove_bus_device actually did stop and remove.

Make the name reflect that to reduce confusion.

This patch is done by sed scripts and changes back some incorrect
__pci_remove_bus_device changes.
Suggested-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NYinghai Lu <yinghai@kernel.org>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>

The __get_free_pages can fail, so the return value should be checked.
Spotted thanks to Stanislaw.
Signed-off-by: NTomas Henzl <thenzl@redhat.com>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If ioc->pci_error_recovery is set, goto out in mpt2sas_base_hard_reset_handler()
leads to unlock unheld ioc->reset_in_progress_mutex.

The patch fixes the issue by jumping afer mutex_unlock() call.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Removed redundant calling of _scsih_probe_devices() from _scsih_probe as
it is getting called from _scsih_scan_finished.

Also moved the function scsi_scan_host(shost) to get called after the
volumes on warp drive are reported to the OS. Otherwise by the time
the (ioc->hide_drives) flags is set, the volumes on warp drive
are reported to the OS already.

Also modified the initialization of reply queues only in case of driver load
time in the function _base_make_ioc_operational().
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Commit 921cd802 ("[SCSI] mpt2sas: New feature - Fast Load
Support") moved handling of the diag_buffer_enable module parameter
from mpt2sas_base.c to mpt2sas_scsih.c, but it left an old copy of the
parameter in mpt2sas_base.c.  Remove the unused stub.
Signed-off-by: NRoland Dreier <roland@purestorage.com>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

When computing reply_queue_count (the number of MSI-X vectors to use),
the driver does

	ioc->reply_queue_count = min_t(u8, ioc->cpu_count,
	    ioc->msix_vector_count);

However, on a big machine, ioc->cpu_count could be outside the range
that fits in a u8; eg a system with 256 CPUs will end up
reply_queue_count set to 0.

Fix this by calculating the minimum as ints and then letting the
assignment to reply_queue_count handle integer demotion.
Signed-off-by: NRoland Dreier <roland@purestorage.com>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Commit 911ae943 ("[SCSI] mpt2sas: Added NUNA IO support in driver
which uses multi-reply queue support of the HBA") added new
allocations to the beginning of mpt2sas_base_attach(), which means
directly returning an error on failure of mpt2sas_base_map_resources()
will leak those allocations.

Fix this by doing "goto out_free_resources" in this place too, as the
rest of the function does.
Signed-off-by: NRoland Dreier <roland@purestorage.com>
Acked-by: N"Nandigama, Nagalakshmi" <Nagalakshmi.Nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The amount of memory required for tracking chain buffers is rather
large, and when the host credit count is big, memory allocation
failure occurs inside __get_free_pages.

The fix is to limit the number of chains to 100,000.  In addition,
the number of host credits is limited to 30,000 IOs. However this
limitation can be overridden this using the command line option
max_queue_depth.  The algorithm for calculating the
reply_post_queue_depth is changed so that it is equal to
(reply_free_queue_depth + 16), previously it was (reply_free_queue_depth * 2).
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Cc: stable@kernel.org
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

[SCSI] mpt2sas: Rearrange the the code so that the completion queues are initialized prior to sending the request to controller firmware
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Detection of Dead IOC has been done in fault_reset_work thread.

If IOC Doorbell is 0xFFFFFFFF, it will be detected as non-operation/DEAD IOC.
When a DEAD IOC is detected, the code is modified to remove that IOC and
all its attached devices from OS.
The PCI layer API pci_remove_bus_device() is called to remove the dead IOC.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

New feature Fast Load Support.

(1)Asynchronous SCSI scanning: This will allow the drivers to scan
for devices in parallel while other device drivers are loading at
the same time. This will improve the amount of time it takes for the
OS to load.

(2) Reporting Devices while port enable is active: This feature will
allow devices to be reported to OS immediately while port enable is
active. The previous implementation waits for port enable to complete,
and then report devices. This feature is only enabled on IT firmware
configurations when there are no boot device configured in BIOS Configuration
Utility, else the driver will wait till port enable completes reporting
devices. For IR firmware, this feature is turned off. This feature is to
address large SAS topologies (>100 drives) when the boot OS is using onboard
SATA device, in other words, the boot devices is not
connected to our controller.

(3) Scanning for devices after diagnostic reset completes: A new routine
_scsih_scan_start is added. This will scan the expander pages, IR pages,
and sas device pages, then reporting new devices to SCSI Mid layer. It
seems the driver is not supporting adding devices while diagnostic reset
is active. Apparently this is due to the sanity checks on
ioc->shost_recovery flag throughout the context of kernel work thread FIFO,
and the mpt2sas_fw_work.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Support added for controllers capable of multi reply queues.

The following are the modifications to the driver to support NUMA.

1) Create the new structure adapter_reply_queue to contain the reply queue
   info for every msix vector.  This object will contain a
   reply_post_host_index, reply_post_free for each instance, msix_index, among
   other parameters.  We will track all the reply queues on a link list called
   ioc->reply_queue_list. Each reply queue is aligned with each IRQ, and is
   passed to the interrupt via the bus_id parameter.

(2) The driver will figure out the msix_vector_count from the PCIe MSIX
    capabilities register instead of the IOC Facts->MaxMSIxVectors. This is
    because the firmware is not filling in this field until the driver has
    already registered MSIX support.

(3) If the ioc_facts reports that the controller is MSIX compatible in the
    capabilities, then the driver will request for multiple irqs.  This count
    is calculated based on the minimum between the online cpus available and
    the ioc->msix_vector_count.  This count is reported to firmware in the
    ioc_init request.

(4) New routines were added _base_free_irq and _base_request_irq, so
    registering and freeing msix vectors were done thru simple function API.

(5) The new routine _base_assign_reply_queues was added to align the msix
    indexes across cpus. This will initialize the array called
    ioc->cpu_msix_table.  This array is looked up on every MPI request so the
    MSIxIndex is set appropriately.

(6) A new shost sysfs attribute was added to report the reply_queue_count.

(7) User needs to set the affinity cpu mask, so the interrupts occur on the
    same cpu that sent the original request.
Signed-off-by: NNagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

It was pointed out by 'make versioncheck' that some includes of
linux/version.h are not needed in drivers/scsi/.
This patch removes them.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch addresses many endian issues solved by runing sparse with the
option __CHECK_ENDIAN__ turned on.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch has Support for the new solid state device product SSS6200
from LSI and relavent features w.r.t SSS6200.

The major feature added in this driver is supporting Direct-I/O to the
SSS6200 storage.There are some additional changes done to avoid exposing
the RAID member disks to the OS and hiding/exposing drives based on the
OEM Specific Flag in Manufacturing Page10 (this is required to handle
specific changes in the SSS6200 firmware).

Each and every changes are listed below.
1. Hiding IR related messages.
For SSS6200, the driver is modified not to print IR related events.
Even if the debugging is enabled the IR related messages will not be displayed.
In some places if there is a need to display a message related to IR the
string "IR" is replaced with string "DD" and the string "volume" is replaced
with "direct drive". But the function names are not changed hence there are
some places where the reference to volume can be seen if debug level is set.

2. Removed RAID transport support
In Linux the user can retrieve RAID volume information from the sysfs directory.
This support is removed for SSS6200.

3. Direct I/O support.
The driver tries to enable direct I/O when a volume is reported to the driver
by the firmware through IRCC events and the driver does this just before
reporting to the OS, hence all the OS issued I/O can go through direct path
if they can, The first validation is to see whether the manufacturing page10
flag is set to expose all drives always. If that is set, the driver will not
enable direct I/O and displays the message "DDIO" is disabled globally as
drives are exposed. The driver checks whether there is more than one volume
in the controller, if so the direct I/O will be disabled globally for all
volumes in the controller and the message displayed will be "DDIO is disabled
globally as number of drives > 1.
If retrieving number of PD is failed the driver will not enable direct I/O
and displays the message Failure in computing number of drives DDIO disabled.
If memory allocation for RAIDVolumePage0 is failed, the driver will not enable
direct I/O and displays the message Memory allocation failure for
RVPG0 DDIO disabled.  If retrieving RAIDVolumePage0 is failed the driver will
not enable direct I/O and displays the message Failure in retrieving
RVPG0 DDIO disabled

If the number of PD in a volume is greater than 8, then the direct I/O will
be disabled.
If any of individual drives handle retrieval is failed then the DD-IO will
be disabled.
If the volume is not RAID0 or if the block size is not 512 then the DD-IO will
be disabled.
If the volume size is greater than 2TB then the DD-IO will be disabled.
If the driver is not able to find a valid stripe exponent using the configured
stripe size then the DD-IO will be disabled

When the DD-IO is enabled the driver will check every I/O request issued to
the storage and checks whether the request is either
READ6/WRITE6/READ10/WRITE10, if it is and if the complete I/O transfer
is within a stripe size then the I/O is redirected to
the drive directly instead of the volume.

On completion of every I/O, if the completion is failure means if the reply
is address reply with a reply frame associated with it, then the type of I/O
will be checked, if the I/O is direct then the I/O will be retried to
the volume once.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Reviewed-by: NEric Moore <eric.moore@lsi.com>
Reviewed-by: NSathya Prakash <sathya.prakash@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Fixes generated by 'codespell' and manually reviewed.
Signed-off-by: NLucas De Marchi <lucas.demarchi@profusion.mobi>

Added Vendor specific branding message support.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Basic Code Cleanup:
(1) _base_get_cb_idx and mpt2sas_base_free_smid were reorganized in
similar fashion so the order of obtaining the cbx and smid are
scsiio,
hi_priority, and internal.
(2) The hi_priority and internal request queue struct was made
smaller
by removing the scmd and chain_tracker, thus saving memory
allocation.
(3) For scsiio request, a new structure was created having the same
elements from the former request tracker struct.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Add support for Customer specific branding messages when device driver loads,
based on specific customer subsystem vendor and device Ids
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

There was a configuration page timing out during the initial port
enable at driver load time. The port enable would fail, and this would
result in the driver unloading itself, meanwhile the driver was accessing
freed memory in another context resulting in the panic.  The fix is to
prevent access to freed memory once the driver had issued the diag reset
which woke up the sleeping port enable process.  The routine
_base_reset_handler was reorganized so the last sleeping process woken up was
the port_enable.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Cc: stable@kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The ioc->hba_queue_depth is not properly resized when the controller
firmware reports that it supports more outstanding IO than what can be fit
inside the reply descriptor pool depth. This is reproduced by setting the
controller global credits larger than 30,000. The bug results in an
incorrect sizing of the queues. The fix is to resize the queue_size by
dividing queue_diff by two.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Cc: stable@kernel.org
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

remove support for MPI2_EVENT_TASK_SET_FULL
This event is obsoleted, so this processing of this event
needs to be removed from the driver.  The controller firmware is going
to handle TASK_SET_FULL, the driver doesn't need to do anything.
Even though we are removing the EVENT handling, the behavour has not
changed between driver versions becuase fimrware will still be handling
queue throttling, and retrying of commands when the target device queues
are full.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Create a pool of chain buffers, instead of dedicated per IO:
This enahancment is to address memory allocation failure when asking
for more than 2300 IOs per host.   There is just not enough contiquious
DMA physical memory to make one single allocation to hold both message
frames and chain buffers when asking for more than 2300 request. In order
to address this problem we will have to allocate memory for each chain
buffer in a seperate individual memory allocation, placing each chain
element of 128 bytes onto a pool of available chains, which can be
shared amoung all request.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Ability to override/set the ReportDeviceMissingDelay and
IODeviceMissingDelay from driver: Add new command line option missing_delay,
this is an array, where the first element is the device missing delay,
and the second element is io missing delay.  The driver will program
sas iounit page 1 with the new setting when the driver loads. This is
programmed to the current and persistent configuration page so this takes
immediately, as will be sticky across host reboots.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Sometime it is seen that controller
firmware returns an invalid system message id (smid).

the oops is occurring becuase mpt_callbacks pointer is referenced to
either null or invalid virtual address.  this is due to cb_idx set
incorrectly from routine _base_get_cb_idx.  the cb_idx was set incorrectly
becuase there is no check to make sure smid is less than maxiumum
anticapted smid.   to fix this issue, we add a check in
_base_get_cb_idx to make sure smid is not greater than
ioc->hba_queue_depth.   in addition, a similar check was added to make
sure the reply address was less than the largest anticapated address.

Newer firmware has sovled this issue, however it good to have this sanity
check.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Outdent the code following the if.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r disable braces4@
position p1,p2;
statement S1,S2;
@@

(
if (...) { ... }
|
if (...) S1@p1 S2@p2
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

if (p1[0].column == p2[0].column):
  cocci.print_main("branch",p1)
  cocci.print_secs("after",p2)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NNick Cheng <nick.cheng@areca.com.tw>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

fixes surrounding PCIe enhanced error handling:

(1) We need to reject all request generated internaly inside the driver as well
as request arriving from the scsi mid layer when PCIe EEH is active. The fix is
to add a per adapter flag called pci_error_recovery which is checked thru out
the driver when request are generated.

(2) We don't need to call the pci_driver->remove directly from the PCIe
callbacks becuase its already called from the PCIe EEH code. In its place we are
shutting down the watchdog timer, and flushing back all pending IO.

(3) We need to save and restore the pci state across PCIe EEH handling.
Signed-off-by: NEric Moore <eric.moore@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

(1) driver was not setting the sense data size prior to sending SCSI_IO,
resulting in the 0x31190000 loginfo
(2) The driver needs to copy the sense data to local buffer prior
to releasing the request message frame.  If not, the sense buffer gets
overwritten by the next SCSI_IO request.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

In the driver mpt2sas_base_attach subroutine, we need to add
support to return the proper error code when there are memory allocation
failures, e.g. returning -ENOMEM.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Actual problem :
Driver  may receiving the top level expander
removal event prior to all the individual PD removal events, hence the
driver is breaking down all the PDs in advanced to the actaul PD UNHIDE
event. Driver sends multiple
Target Resets to the same volume handle for each individual PD removal.

FIX DESCRIPTION:
To fix this issue, the entire PD device handshake protocal has to be
moved to interrupt context so the breakdown occurs immediately after the
actual UNHIDE event arrives.  The driver will only issue one Target Reset to
the volume handle, occurring after the FAILED or MISSING volume status
event arrives from interrupt context. For the PD UNHIDE event, the driver
will issue target resets to the PD handles, followed by OP_REMOVE.  The
driver will set the "deteleted" flag during interrupt context.  A "pd_handle"
bitmask was introduced so the driver has a list of known pds during entire
life of the PD; this replaces the "hidden_raid_component" flag handle in
the sas_device object.  Each bit in the bitmask represents a device handle.
The bit in the bitmask would be toggled ON/OFF when the HIDE/UNHIDE
events arrive; also this pd_handle bitmask would bould be refreshed
across host resets.

Here we kept older behavior of sending target reset to volume when there is
a single drive pull, wait for the reply, then send target resets
to the PDs.  We kept this behavior so the driver will
behave the same for older versions of firmware.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Converting print level from  MPT2SAS_DEBUG_FMT  to MPT2SAS_INFO_FMT.
Signed-off-by: NKashyap Desai <kashyap.desai@lsi.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>