Skip to content

Commit 61f06db

Browse files
torvaldstorvalds
committed
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley: "This is three logical fixes (as 5 patches). The 3ware class of drivers were causing an oops with multiqueue by tearing down the command mappings after completing the command (where the variables in the command used to tear down the mapping were no-longer valid). There's also a fix for the qnap iscsi target which was choking on us sending it commands that were too long and a fix for the reworked aha1542 allocating GFP_KERNEL under a lock" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: 3w-9xxx: fix command completion race 3w-xxxx: fix command completion race 3w-sas: fix command completion race aha1542: Allocate memory before taking a lock SCSI: add 1024 max sectors black list flag
2 parents 3333222 + 118c855 commit 61f06db

File tree

10 files changed

+48
-146
lines changed

10 files changed

+48
-146
lines changed

‎drivers/scsi/3w-9xxx.c

Lines changed: 13 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
149149
static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
150150
static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
151151
static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
152-
static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
153152

154153
/* Functions */
155154

@@ -1340,11 +1339,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
13401339
}
13411340

13421341
/* Now complete the io */
1342+
scsi_dma_unmap(cmd);
1343+
cmd->scsi_done(cmd);
13431344
tw_dev->state[request_id] = TW_S_COMPLETED;
13441345
twa_free_request_id(tw_dev, request_id);
13451346
tw_dev->posted_request_count--;
1346-
tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
1347-
twa_unmap_scsi_data(tw_dev, request_id);
13481347
}
13491348

13501349
/* Check for valid status after each drain */
@@ -1402,26 +1401,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
14021401
}
14031402
} /* End twa_load_sgl() */
14041403

1405-
/* This function will perform a pci-dma mapping for a scatter gather list */
1406-
static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
1407-
{
1408-
int use_sg;
1409-
struct scsi_cmnd *cmd = tw_dev->srb[request_id];
1410-
1411-
use_sg = scsi_dma_map(cmd);
1412-
if (!use_sg)
1413-
return 0;
1414-
else if (use_sg < 0) {
1415-
TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
1416-
return 0;
1417-
}
1418-
1419-
cmd->SCp.phase = TW_PHASE_SGLIST;
1420-
cmd->SCp.have_data_in = use_sg;
1421-
1422-
return use_sg;
1423-
} /* End twa_map_scsi_sg_data() */
1424-
14251404
/* This function will poll for a response interrupt of a request */
14261405
static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
14271406
{
@@ -1600,9 +1579,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
16001579
(tw_dev->state[i] != TW_S_INITIAL) &&
16011580
(tw_dev->state[i] != TW_S_COMPLETED)) {
16021581
if (tw_dev->srb[i]) {
1603-
tw_dev->srb[i]->result = (DID_RESET << 16);
1604-
tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
1605-
twa_unmap_scsi_data(tw_dev, i);
1582+
struct scsi_cmnd *cmd = tw_dev->srb[i];
1583+
1584+
cmd->result = (DID_RESET << 16);
1585+
scsi_dma_unmap(cmd);
1586+
cmd->scsi_done(cmd);
16061587
}
16071588
}
16081589
}
@@ -1781,21 +1762,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
17811762
/* Save the scsi command for use by the ISR */
17821763
tw_dev->srb[request_id] = SCpnt;
17831764

1784-
/* Initialize phase to zero */
1785-
SCpnt->SCp.phase = TW_PHASE_INITIAL;
1786-
17871765
retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
17881766
switch (retval) {
17891767
case SCSI_MLQUEUE_HOST_BUSY:
1768+
scsi_dma_unmap(SCpnt);
17901769
twa_free_request_id(tw_dev, request_id);
1791-
twa_unmap_scsi_data(tw_dev, request_id);
17921770
break;
17931771
case 1:
1794-
tw_dev->state[request_id] = TW_S_COMPLETED;
1795-
twa_free_request_id(tw_dev, request_id);
1796-
twa_unmap_scsi_data(tw_dev, request_id);
17971772
SCpnt->result = (DID_ERROR << 16);
1773+
scsi_dma_unmap(SCpnt);
17981774
done(SCpnt);
1775+
tw_dev->state[request_id] = TW_S_COMPLETED;
1776+
twa_free_request_id(tw_dev, request_id);
17991777
retval = 0;
18001778
}
18011779
out:
@@ -1863,8 +1841,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
18631841
command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
18641842
command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
18651843
} else {
1866-
sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
1867-
if (sg_count == 0)
1844+
sg_count = scsi_dma_map(srb);
1845+
if (sg_count < 0)
18681846
goto out;
18691847

18701848
scsi_for_each_sg(srb, sg, sg_count, i) {
@@ -1979,15 +1957,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
19791957
return(table[index].text);
19801958
} /* End twa_string_lookup() */
19811959

1982-
/* This function will perform a pci-dma unmap */
1983-
static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
1984-
{
1985-
struct scsi_cmnd *cmd = tw_dev->srb[request_id];
1986-
1987-
if (cmd->SCp.phase == TW_PHASE_SGLIST)
1988-
scsi_dma_unmap(cmd);
1989-
} /* End twa_unmap_scsi_data() */
1990-
19911960
/* This function gets called when a disk is coming on-line */
19921961
static int twa_slave_configure(struct scsi_device *sdev)
19931962
{

‎drivers/scsi/3w-9xxx.h

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
324324
#define TW_CURRENT_DRIVER_BUILD 0
325325
#define TW_CURRENT_DRIVER_BRANCH 0
326326

327-
/* Phase defines */
328-
#define TW_PHASE_INITIAL 0
329-
#define TW_PHASE_SINGLE 1
330-
#define TW_PHASE_SGLIST 2
331-
332327
/* Misc defines */
333328
#define TW_9550SX_DRAIN_COMPLETED 0xFFFF
334329
#define TW_SECTOR_SIZE 512

‎drivers/scsi/3w-sas.c

Lines changed: 10 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -290,26 +290,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
290290
return 0;
291291
} /* End twl_post_command_packet() */
292292

293-
/* This function will perform a pci-dma mapping for a scatter gather list */
294-
static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
295-
{
296-
int use_sg;
297-
struct scsi_cmnd *cmd = tw_dev->srb[request_id];
298-
299-
use_sg = scsi_dma_map(cmd);
300-
if (!use_sg)
301-
return 0;
302-
else if (use_sg < 0) {
303-
TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
304-
return 0;
305-
}
306-
307-
cmd->SCp.phase = TW_PHASE_SGLIST;
308-
cmd->SCp.have_data_in = use_sg;
309-
310-
return use_sg;
311-
} /* End twl_map_scsi_sg_data() */
312-
313293
/* This function hands scsi cdb's to the firmware */
314294
static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
315295
{
@@ -357,8 +337,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
357337
if (!sglistarg) {
358338
/* Map sglist from scsi layer to cmd packet */
359339
if (scsi_sg_count(srb)) {
360-
sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
361-
if (sg_count == 0)
340+
sg_count = scsi_dma_map(srb);
341+
if (sg_count <= 0)
362342
goto out;
363343

364344
scsi_for_each_sg(srb, sg, sg_count, i) {
@@ -1102,15 +1082,6 @@ static int twl_initialize_device_extension(TW_Device_Extension *tw_dev)
11021082
return retval;
11031083
} /* End twl_initialize_device_extension() */
11041084

1105-
/* This function will perform a pci-dma unmap */
1106-
static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
1107-
{
1108-
struct scsi_cmnd *cmd = tw_dev->srb[request_id];
1109-
1110-
if (cmd->SCp.phase == TW_PHASE_SGLIST)
1111-
scsi_dma_unmap(cmd);
1112-
} /* End twl_unmap_scsi_data() */
1113-
11141085
/* This function will handle attention interrupts */
11151086
static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
11161087
{
@@ -1251,11 +1222,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
12511222
}
12521223

12531224
/* Now complete the io */
1225+
scsi_dma_unmap(cmd);
1226+
cmd->scsi_done(cmd);
12541227
tw_dev->state[request_id] = TW_S_COMPLETED;
12551228
twl_free_request_id(tw_dev, request_id);
12561229
tw_dev->posted_request_count--;
1257-
tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
1258-
twl_unmap_scsi_data(tw_dev, request_id);
12591230
}
12601231

12611232
/* Check for another response interrupt */
@@ -1400,10 +1371,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
14001371
if ((tw_dev->state[i] != TW_S_FINISHED) &&
14011372
(tw_dev->state[i] != TW_S_INITIAL) &&
14021373
(tw_dev->state[i] != TW_S_COMPLETED)) {
1403-
if (tw_dev->srb[i]) {
1404-
tw_dev->srb[i]->result = (DID_RESET << 16);
1405-
tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
1406-
twl_unmap_scsi_data(tw_dev, i);
1374+
struct scsi_cmnd *cmd = tw_dev->srb[i];
1375+
1376+
if (cmd) {
1377+
cmd->result = (DID_RESET << 16);
1378+
scsi_dma_unmap(cmd);
1379+
cmd->scsi_done(cmd);
14071380
}
14081381
}
14091382
}
@@ -1507,9 +1480,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
15071480
/* Save the scsi command for use by the ISR */
15081481
tw_dev->srb[request_id] = SCpnt;
15091482

1510-
/* Initialize phase to zero */
1511-
SCpnt->SCp.phase = TW_PHASE_INITIAL;
1512-
15131483
retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
15141484
if (retval) {
15151485
tw_dev->state[request_id] = TW_S_COMPLETED;

‎drivers/scsi/3w-sas.h

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
103103
#define TW_CURRENT_DRIVER_BUILD 0
104104
#define TW_CURRENT_DRIVER_BRANCH 0
105105

106-
/* Phase defines */
107-
#define TW_PHASE_INITIAL 0
108-
#define TW_PHASE_SGLIST 2
109-
110106
/* Misc defines */
111107
#define TW_SECTOR_SIZE 512
112108
#define TW_MAX_UNITS 32

‎drivers/scsi/3w-xxxx.c

Lines changed: 6 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1271,32 +1271,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
12711271
return 0;
12721272
} /* End tw_initialize_device_extension() */
12731273

1274-
static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
1275-
{
1276-
int use_sg;
1277-
1278-
dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
1279-
1280-
use_sg = scsi_dma_map(cmd);
1281-
if (use_sg < 0) {
1282-
printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
1283-
return 0;
1284-
}
1285-
1286-
cmd->SCp.phase = TW_PHASE_SGLIST;
1287-
cmd->SCp.have_data_in = use_sg;
1288-
1289-
return use_sg;
1290-
} /* End tw_map_scsi_sg_data() */
1291-
1292-
static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
1293-
{
1294-
dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
1295-
1296-
if (cmd->SCp.phase == TW_PHASE_SGLIST)
1297-
scsi_dma_unmap(cmd);
1298-
} /* End tw_unmap_scsi_data() */
1299-
13001274
/* This function will reset a device extension */
13011275
static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
13021276
{
@@ -1319,8 +1293,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
13191293
srb = tw_dev->srb[i];
13201294
if (srb != NULL) {
13211295
srb->result = (DID_RESET << 16);
1322-
tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
1323-
tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
1296+
scsi_dma_unmap(srb);
1297+
srb->scsi_done(srb);
13241298
}
13251299
}
13261300
}
@@ -1767,8 +1741,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
17671741
command_packet->byte8.io.lba = lba;
17681742
command_packet->byte6.block_count = num_sectors;
17691743

1770-
use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
1771-
if (!use_sg)
1744+
use_sg = scsi_dma_map(srb);
1745+
if (use_sg <= 0)
17721746
return 1;
17731747

17741748
scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
@@ -1955,9 +1929,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
19551929
/* Save the scsi command for use by the ISR */
19561930
tw_dev->srb[request_id] = SCpnt;
19571931

1958-
/* Initialize phase to zero */
1959-
SCpnt->SCp.phase = TW_PHASE_INITIAL;
1960-
19611932
switch (*command) {
19621933
case READ_10:
19631934
case READ_6:
@@ -2185,12 +2156,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
21852156

21862157
/* Now complete the io */
21872158
if ((error != TW_ISR_DONT_COMPLETE)) {
2159+
scsi_dma_unmap(tw_dev->srb[request_id]);
2160+
tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
21882161
tw_dev->state[request_id] = TW_S_COMPLETED;
21892162
tw_state_request_finish(tw_dev, request_id);
21902163
tw_dev->posted_request_count--;
2191-
tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
2192-
2193-
tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
21942164
}
21952165
}
21962166

‎drivers/scsi/3w-xxxx.h

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
195195
#define TW_AEN_SMART_FAIL 0x000F
196196
#define TW_AEN_SBUF_FAIL 0x0024
197197

198-
/* Phase defines */
199-
#define TW_PHASE_INITIAL 0
200-
#define TW_PHASE_SINGLE 1
201-
#define TW_PHASE_SGLIST 2
202-
203198
/* Misc defines */
204199
#define TW_ALIGNMENT_6000 64 /* 64 bytes */
205200
#define TW_ALIGNMENT_7000 4 /* 4 bytes */

‎drivers/scsi/aha1542.c

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -375,9 +375,10 @@ static int aha1542_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
375375
u8 lun = cmd->device->lun;
376376
unsigned long flags;
377377
int bufflen = scsi_bufflen(cmd);
378-
int mbo;
378+
int mbo, sg_count;
379379
struct mailbox *mb = aha1542->mb;
380380
struct ccb *ccb = aha1542->ccb;
381+
struct chain *cptr;
381382

382383
if (*cmd->cmnd == REQUEST_SENSE) {
383384
/* Don't do the command - we have the sense data already */
@@ -397,6 +398,13 @@ static int aha1542_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
397398
print_hex_dump_bytes("command: ", DUMP_PREFIX_NONE, cmd->cmnd, cmd->cmd_len);
398399
}
399400
#endif
401+
if (bufflen) { /* allocate memory before taking host_lock */
402+
sg_count = scsi_sg_count(cmd);
403+
cptr = kmalloc(sizeof(*cptr) * sg_count, GFP_KERNEL | GFP_DMA);
404+
if (!cptr)
405+
return SCSI_MLQUEUE_HOST_BUSY;
406+
}
407+
400408
/* Use the outgoing mailboxes in a round-robin fashion, because this
401409
is how the host adapter will scan for them */
402410

@@ -441,19 +449,10 @@ static int aha1542_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
441449

442450
if (bufflen) {
443451
struct scatterlist *sg;
444-
struct chain *cptr;
445-
int i, sg_count = scsi_sg_count(cmd);
452+
int i;
446453

447454
ccb[mbo].op = 2; /* SCSI Initiator Command w/scatter-gather */
448-
cmd->host_scribble = kmalloc(sizeof(*cptr)*sg_count,
449-
GFP_KERNEL | GFP_DMA);
450-
cptr = (struct chain *) cmd->host_scribble;
451-
if (cptr == NULL) {
452-
/* free the claimed mailbox slot */
453-
aha1542->int_cmds[mbo] = NULL;
454-
spin_unlock_irqrestore(sh->host_lock, flags);
455-
return SCSI_MLQUEUE_HOST_BUSY;
456-
}
455+
cmd->host_scribble = (void *)cptr;
457456
scsi_for_each_sg(cmd, sg, sg_count, i) {
458457
any2scsi(cptr[i].dataptr, isa_page_to_bus(sg_page(sg))
459458
+ sg->offset);

‎drivers/scsi/scsi_devinfo.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,7 @@ static struct {
226226
{"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
227227
{"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
228228
{"Promise", "", NULL, BLIST_SPARSELUN},
229+
{"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
229230
{"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
230231
{"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
231232
{"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN},

‎drivers/scsi/scsi_scan.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -897,6 +897,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
897897
*/
898898
if (*bflags & BLIST_MAX_512)
899899
blk_queue_max_hw_sectors(sdev->request_queue, 512);
900+
/*
901+
* Max 1024 sector transfer length for targets that report incorrect
902+
* max/optimal lengths and relied on the old block layer safe default
903+
*/
904+
else if (*bflags & BLIST_MAX_1024)
905+
blk_queue_max_hw_sectors(sdev->request_queue, 1024);
900906

901907
/*
902908
* Some devices may not want to have a start command automatically

0 commit comments

Comments
 (0)