From: Stuart Hayes <Stuart_Hayes@dell.com>
The system can panic with a null pointer dereference using ide-scsi if
PIO is being done on scatter gather pages that are in high memory,
because page_address() returns 0. We are actually seeing this using a
tape drive. This patch will kmap_atomic() the pages before performing
PIO.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>
* add ide_bus_match() and export ide_bus_type
* split ide_remove_driver_from_hwgroup() out of ide_unregister()
* move device cleanup from ide_unregister() to drive_release_dev()
* convert ide_driver_t->name to driver->name
* convert ide_driver_t->{attach,cleanup} to driver->{probe,remove}
* remove ide_driver_t->busy as ide_bus_type->subsys.rwsem
protects against concurrent ->{probe,remove} calls
* make ide_{un}register_driver() void as it cannot fail now
* use driver_{un}register() directly, remove ide_{un}register_driver()
* use device_register() instead of ata_attach(), remove ata_attach()
* add proc_print_driver() and ide_drivers_show(), remove ide_drivers_op
* fix ide_replace_subdriver() and move it to ide-proc.c
* remove ide_driver_t->drives, ide_drives and drives_lock
* remove ide_driver_t->drivers, drivers and drivers_lock
* remove ide_drive_t->driver and DRIVER() macro
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>
When testing ATAPI PIO data transfer on the ppc64 platform, __atapi_pio_bytes() got zero when
sg_dma_len() is used. I checked the <asm-ppc64/scatterlish.h>, the struct scatterlist is defined as:
struct scatterlist {
struct page *page;
unsigned int offset;
unsigned int length;
/* For TCE support */
u32 dma_address;
u32 dma_length;
};
#define sg_dma_address(sg) ((sg)->dma_address)
#define sg_dma_len(sg) ((sg)->dma_length)
So, if the scatterlist is not DMA mapped, sg_dma_len() will return zero on ppc64.
The same problem should occur on the x86-64 platform.
On the i386 platform, sg_dma_len() returns sg->length, that's why the problem does not occur on an i386.
Changes:
- Use sg->length if the scatterlist is not DMA mapped (yet).
Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
Fix a c99ism.
Cc: James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
The new period/dt setting routines don't get the coupling of these
parameters correct. This means that Domain Validation never gets DT
set, and thus the drive gets restricted to U80.
Fix this by restoring the couplings in the set routines.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Tampering with the settings has to be done under the host lock ...
slave_alloc isn't called under any lock, so this has to be done
explicitly.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The allocation of all of our components should be done in slave alloc.
Currently it's rather fancifully refcounted in the queuecommand
callback. This patch moves allocation and destroy to their correct
places in slave_alloc/slave_destory. Now we can guarantee that
everywhere a device is requested, it's actually been allocated, so don't
check for this anymore.
Additionally, the per device busy timer was the only source of potential
use after free. It's been deleted because Linux does the correct thing
with busy returns, so there's no need to implement a separate timer in
the driver.
Finally, implement code that forces all the device parameters to zero
(i.e. async and narrow) in the slave alloc, inform the spi class of the
bios recorded maximums and wait until slave configure before trying
anything more adventurous.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This should finish the spurious queue removal from aic7xxx (there are
other queues that are probably unnecessary, but at least the major and
obviously unnecessary ones are done with).
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This was rendered obsolete by the busyq removal; remove some of the last
remnants of its presence.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
pci_alloc_consistent is under 4G by default. Also simplify the
definition of bus_dmamap_t.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
There's not much sense in sharing code anymore now that aic7xxx uses
various transport class facilities.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The aic7xxx driver has two spurious queues in it's linux glue code: the
busyq which queues incoming commands to the driver and the completeq
which queues finished commands before sending them back to the mid-layer
This patch just removes the busyq and makes the aic finally return the
correct status to get the mid-layer to manage its queueing, so a command
is either committed to the sequencer or returned to the midlayer for
requeue.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This is similar to the previous sym2 problem. For Domain Validation to
work we can't allow any period setting to turn wide on if it was
previously off.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
There's a basic need not to have parameters go under or over certain
values when doing domain validation. The basic ones are
max_offset, max_width and min_period
This patch makes the transport class take and enforce these three
limits. Currently they can be set by the user, although they could
obviously be read from the HBA's on-board NVRAM area during
slave_configure (if it has one).
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Updated patch to fix erroneous flush of COMRESET set and missing flush
of COMRESET clear. Created a new routine scr_write_flush() to try to
prevent this in the future. Also, this patch is based on libata-2.6
instead of the previous libata-dev-2.6 based patch.
Signed-off-by: Brett Russ <russb@emc.com>
Index: libata-2.6/drivers/scsi/libata-core.c
===================================================================
Problem:
During the libata CD-ROM stress test, sometimes the "BUG: timeout
without command" error is seen.
Root cause:
Unexpected interrupt occurs after the ata_qc_complete() is called,
but before the SCSI error handler. The interrupt handler is invoked
before the SCSI error handler, and it clears the command by calling
ata_qc_complete() again. Later when the SCSI error handler is run,
the ata_queued_cmd is already gone, causing the "BUG: timeout without
command" error.
Changes:
- Use the ATA_QCFLAG_ACTIVE flag to prevent the interrupt handler
from completing the command twice, before the scsi_error_handler.
Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
Avoid changing sdev->host->max_sectors because it can prevent use of
non-lba48 drives on other ports of the same adapter.
Signed-off-by: Stuart Hayes <stuart_hayes@Dell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
There's a slight bug in the routines in that if the period requires dt,
then the routine will unconditionally set it. DT may only be set if
Wide is also set, so this turns back on the wide bit.
For domain validation to work correctly, we need to observe the wide bit
absolutely.
Acked by: Matthew Wilcox <willy@debian.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The Coverity checker found that this for loop was wrong.
This patch changes it to what seems to be intended.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Cc: James Bottomley <James.Bottomley@steeleye.com>
Cc: Matthew Wilcox <willy@debian.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
The premise is that domain validation is likely to trigger errors which
it wants to know about, so the only time it should be retrying them is
when it gets a unit attention (likely as the result of a previous bus or
device reset). Ironically, the previous coding retried three times in
all cases except those of unit attention. The attached fixes this to do
the right thing.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Drivers that expect ISA DMA API are marked as such in Kconfig.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
scsi_dispatch_cmd currently calls scsi_done when the device is in the
SDEV_DEL state, but at this point the command has not had a timer added
to it (this is done a couple lines down) so scsi_done just returns and
the command is lost. The attached patch made against 2.6.12-rc3 calls
__scsi_done in this case so the comamnd will be returned upwards.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Another large rollup of various patches from Adrian which make things static
where they were needlessly exported.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Fix a typo.
James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This fixes an error on the device open code that allows a non-existent
device to be opened causing later panic problems.
Signed-off-by: Mark Haverkamp <markh@osdl.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Minor cleanups for sparc specific drivers (sunbmac, sunqe, sunlance,
sunhme, esp) so that they have a full module version definition that is
consistent with other upstream drivers.
Signed-off-by: Tom 'spot' Callaway <tcallawa@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Somebody forgot that | has higher priority than ?:. As the result,
allocation is done with bogus flags - instead of GFP_ATOMIC + possibly
GFP_DMA we always get GFP_DMA and no GFP_ATOMIC.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
I noticed a case in sr_ioctl.c's sr_get_mcn where a buffer is
allocated, but the pointer isn't checked for null.
Signed-off-by: Nate Dailey <nate.dailey@stratus.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Make transport-functions structure non-static. Replace #include of
scsi_transport.h with a forward declaration.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
My version of gcc doesn't warn about this error (declaration in the
middle of a set of statements).
The fix is simple (this also corrects return code; for init functions it
should be zero or error).
Now that we export all the parameters, this is easy to do.
It also means that we can dump about 2000 lines of code that
were dedicated to doing this internally.
Additionally, this removes all the aic7xxx driver abuse
of SCSI timers which were embedded in the DV routines.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This is just a simplistic patch to export all of the
aic7xxx internal transport parameters via the SPI
transport class. It doesn't actually alter the way the
driver works at all.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
CC [M] drivers/scsi/qla2xxx/qla_attr.o
drivers/scsi/qla2xxx/qla_attr.c: In function `qla2x00_sysfs_write_fw_dump':
drivers/scsi/qla2xxx/qla_attr.c:65: warning: implicit declaration of function `vfree'
drivers/scsi/qla2xxx/qla_attr.c:83: warning: implicit declaration of function `vmalloc'
drivers/scsi/qla2xxx/qla_attr.c:83: warning: cast to pointer from integer of different size
Also remove spurious inclusion of linux/version.h
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
