diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-11-17 11:01:54 -0800 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-11-17 11:01:54 -0800 |
commit | 23f268fa2db4cbe6c4c668d6c277fae906f54922 (patch) | |
tree | 05e4baecce7415daedd591df0f3173872da53b07 /drivers | |
parent | ac50e950784cae1c26ad9e09ebd8f8c706131eb3 (diff) | |
parent | 1a0f437235ccb15361bfe0a37c7023f6234c2e9f (diff) |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
[SCSI] bfa: declare MODULE_FIRMWARE
[SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080
[SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()
[SCSI] Fix incorrect reporting of host protection capabilities
[SCSI] pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type
[SCSI] ipr: add workaround for MSI interrupts on P7
[SCSI] scsi_transport_fc: Fix WARN message for FC passthru failure paths
[SCSI] bfa: fix test in bfad_os_fc_host_init()
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/scsi/bfa/bfad_fwimg.c | 2 | ||||
-rw-r--r-- | drivers/scsi/bfa/bfad_im.c | 2 | ||||
-rw-r--r-- | drivers/scsi/gdth.c | 2 | ||||
-rw-r--r-- | drivers/scsi/ipr.c | 42 | ||||
-rw-r--r-- | drivers/scsi/ipr.h | 1 | ||||
-rw-r--r-- | drivers/scsi/libsas/sas_expander.c | 1 | ||||
-rw-r--r-- | drivers/scsi/pmcraid.c | 10 | ||||
-rw-r--r-- | drivers/scsi/scsi_transport_fc.c | 3 |
8 files changed, 46 insertions, 17 deletions
diff --git a/drivers/scsi/bfa/bfad_fwimg.c b/drivers/scsi/bfa/bfad_fwimg.c index b2f6949bc8d..bd34b0db2d6 100644 --- a/drivers/scsi/bfa/bfad_fwimg.c +++ b/drivers/scsi/bfa/bfad_fwimg.c @@ -41,6 +41,8 @@ u32 *bfi_image_cb; #define BFAD_FW_FILE_CT "ctfw.bin" #define BFAD_FW_FILE_CB "cbfw.bin" +MODULE_FIRMWARE(BFAD_FW_FILE_CT); +MODULE_FIRMWARE(BFAD_FW_FILE_CB); u32 * bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image, diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c index 158c99243c0..55d012a9a66 100644 --- a/drivers/scsi/bfa/bfad_im.c +++ b/drivers/scsi/bfa/bfad_im.c @@ -948,7 +948,7 @@ bfad_os_fc_host_init(struct bfad_im_port_s *im_port) if (bfad_supported_fc4s & (BFA_PORT_ROLE_FCP_IM | BFA_PORT_ROLE_FCP_TM)) /* For FCP type 0x08 */ fc_host_supported_fc4s(host)[2] = 1; - if (bfad_supported_fc4s | BFA_PORT_ROLE_FCP_IPFC) + if (bfad_supported_fc4s & BFA_PORT_ROLE_FCP_IPFC) /* For LLC/SNAP type 0x05 */ fc_host_supported_fc4s(host)[3] = 0x20; /* For fibre channel services type 0x20 */ diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c index 185e6bc4dd4..9e8fce0f0c1 100644 --- a/drivers/scsi/gdth.c +++ b/drivers/scsi/gdth.c @@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr) eindex = handle; estr->event_source = 0; - if (eindex >= MAX_EVENTS) { + if (eindex < 0 || eindex >= MAX_EVENTS) { spin_unlock_irqrestore(&ha->smp_lock, flags); return eindex; } diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c index 5f045505a1f..76d294fc784 100644 --- a/drivers/scsi/ipr.c +++ b/drivers/scsi/ipr.c @@ -4189,6 +4189,25 @@ static irqreturn_t ipr_handle_other_interrupt(struct ipr_ioa_cfg *ioa_cfg, } /** + * ipr_isr_eh - Interrupt service routine error handler + * @ioa_cfg: ioa config struct + * @msg: message to log + * + * Return value: + * none + **/ +static void ipr_isr_eh(struct ipr_ioa_cfg *ioa_cfg, char *msg) +{ + ioa_cfg->errors_logged++; + dev_err(&ioa_cfg->pdev->dev, "%s\n", msg); + + if (WAIT_FOR_DUMP == ioa_cfg->sdt_state) + ioa_cfg->sdt_state = GET_DUMP; + + ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE); +} + +/** * ipr_isr - Interrupt service routine * @irq: irq number * @devp: pointer to ioa config struct @@ -4203,6 +4222,7 @@ static irqreturn_t ipr_isr(int irq, void *devp) volatile u32 int_reg, int_mask_reg; u32 ioasc; u16 cmd_index; + int num_hrrq = 0; struct ipr_cmnd *ipr_cmd; irqreturn_t rc = IRQ_NONE; @@ -4233,13 +4253,7 @@ static irqreturn_t ipr_isr(int irq, void *devp) IPR_HRRQ_REQ_RESP_HANDLE_MASK) >> IPR_HRRQ_REQ_RESP_HANDLE_SHIFT; if (unlikely(cmd_index >= IPR_NUM_CMD_BLKS)) { - ioa_cfg->errors_logged++; - dev_err(&ioa_cfg->pdev->dev, "Invalid response handle from IOA\n"); - - if (WAIT_FOR_DUMP == ioa_cfg->sdt_state) - ioa_cfg->sdt_state = GET_DUMP; - - ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE); + ipr_isr_eh(ioa_cfg, "Invalid response handle from IOA"); spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags); return IRQ_HANDLED; } @@ -4266,8 +4280,18 @@ static irqreturn_t ipr_isr(int irq, void *devp) if (ipr_cmd != NULL) { /* Clear the PCI interrupt */ - writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg); - int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg; + do { + writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg); + int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg; + } while (int_reg & IPR_PCII_HRRQ_UPDATED && + num_hrrq++ < IPR_MAX_HRRQ_RETRIES); + + if (int_reg & IPR_PCII_HRRQ_UPDATED) { + ipr_isr_eh(ioa_cfg, "Error clearing HRRQ"); + spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags); + return IRQ_HANDLED; + } + } else break; } diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h index 163245a1c3e..19bbcf39f0c 100644 --- a/drivers/scsi/ipr.h +++ b/drivers/scsi/ipr.h @@ -144,6 +144,7 @@ #define IPR_IOA_MAX_SECTORS 32767 #define IPR_VSET_MAX_SECTORS 512 #define IPR_MAX_CDB_LEN 16 +#define IPR_MAX_HRRQ_RETRIES 3 #define IPR_DEFAULT_BUS_WIDTH 16 #define IPR_80MBs_SCSI_RATE ((80 * 10) / (IPR_DEFAULT_BUS_WIDTH / 8)) diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index b3381959acc..33cf988c8c8 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -960,7 +960,6 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id) } } - res = 0; } return res; diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c index f7c70e2a822..0a97bc9074b 100644 --- a/drivers/scsi/pmcraid.c +++ b/drivers/scsi/pmcraid.c @@ -1071,7 +1071,7 @@ static struct pmcraid_cmd *pmcraid_init_hcam ioarcb->data_transfer_length = cpu_to_le32(rcb_size); - ioadl[0].flags |= cpu_to_le32(IOADL_FLAGS_READ_LAST); + ioadl[0].flags |= IOADL_FLAGS_READ_LAST; ioadl[0].data_len = cpu_to_le32(rcb_size); ioadl[0].address = cpu_to_le32(dma); @@ -2251,7 +2251,7 @@ static void pmcraid_request_sense(struct pmcraid_cmd *cmd) ioadl->address = cpu_to_le64(cmd->sense_buffer_dma); ioadl->data_len = cpu_to_le32(SCSI_SENSE_BUFFERSIZE); - ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC); + ioadl->flags = IOADL_FLAGS_LAST_DESC; /* request sense might be called as part of error response processing * which runs in tasklets context. It is possible that mid-layer might @@ -3017,7 +3017,7 @@ static int pmcraid_build_ioadl( ioadl[i].flags = 0; } /* setup last descriptor */ - ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC); + ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC; return 0; } @@ -3387,7 +3387,7 @@ static int pmcraid_build_passthrough_ioadls( } /* setup the last descriptor */ - ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC); + ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC; return 0; } @@ -5314,7 +5314,7 @@ static void pmcraid_querycfg(struct pmcraid_cmd *cmd) cpu_to_le32(sizeof(struct pmcraid_config_table)); ioadl = &(ioarcb->add_data.u.ioadl[0]); - ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC); + ioadl->flags = IOADL_FLAGS_LAST_DESC; ioadl->address = cpu_to_le64(pinstance->cfg_table_bus_addr); ioadl->data_len = cpu_to_le32(sizeof(struct pmcraid_config_table)); diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c index a67fed10598..c6f70dae9b2 100644 --- a/drivers/scsi/scsi_transport_fc.c +++ b/drivers/scsi/scsi_transport_fc.c @@ -3656,6 +3656,7 @@ fc_bsg_host_dispatch(struct request_queue *q, struct Scsi_Host *shost, fail_host_msg: /* return the errno failure code as the only status */ BUG_ON(job->reply_len < sizeof(uint32_t)); + job->reply->reply_payload_rcv_len = 0; job->reply->result = ret; job->reply_len = sizeof(uint32_t); fc_bsg_jobdone(job); @@ -3741,6 +3742,7 @@ check_bidi: fail_rport_msg: /* return the errno failure code as the only status */ BUG_ON(job->reply_len < sizeof(uint32_t)); + job->reply->reply_payload_rcv_len = 0; job->reply->result = ret; job->reply_len = sizeof(uint32_t); fc_bsg_jobdone(job); @@ -3797,6 +3799,7 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost, /* check if we have the msgcode value at least */ if (job->request_len < sizeof(uint32_t)) { BUG_ON(job->reply_len < sizeof(uint32_t)); + job->reply->reply_payload_rcv_len = 0; job->reply->result = -ENOMSG; job->reply_len = sizeof(uint32_t); fc_bsg_jobdone(job); |