Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] bfa: declare MODULE_FIRMWARE
  [SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080
  [SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()
  [SCSI] Fix incorrect reporting of host protection capabilities
  [SCSI] pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type
  [SCSI] ipr: add workaround for MSI interrupts on P7
  [SCSI] scsi_transport_fc: Fix WARN message for FC passthru failure paths
  [SCSI] bfa: fix test in bfad_os_fc_host_init()

diff --git a/drivers/scsi/bfa/bfad_fwimg.c b/drivers/scsi/bfa/bfad_fwimg.c
index b2f6949bc8d33996c0cc294b2f4d98367f2257ec..bd34b0db2d6b3bdd29f1616687d94299ebc33a68 100644 (file)
--- a/drivers/scsi/bfa/bfad_fwimg.c
+++ b/drivers/scsi/bfa/bfad_fwimg.c
@@ -41,6 +41,8 @@ u32 *bfi_image_cb;
 
 #define        BFAD_FW_FILE_CT "ctfw.bin"
 #define        BFAD_FW_FILE_CB "cbfw.bin"
+MODULE_FIRMWARE(BFAD_FW_FILE_CT);
+MODULE_FIRMWARE(BFAD_FW_FILE_CB);
 
 u32 *
 bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image,

diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 158c99243c089f9fa104872d1eb2a8024e3cb6ba..55d012a9a6681d74203c09944840f32127411004 100644 (file)
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -948,7 +948,7 @@ bfad_os_fc_host_init(struct bfad_im_port_s *im_port)
        if (bfad_supported_fc4s & (BFA_PORT_ROLE_FCP_IM | BFA_PORT_ROLE_FCP_TM))
                /* For FCP type 0x08 */
                fc_host_supported_fc4s(host)[2] = 1;
-       if (bfad_supported_fc4s | BFA_PORT_ROLE_FCP_IPFC)
+       if (bfad_supported_fc4s & BFA_PORT_ROLE_FCP_IPFC)
                /* For LLC/SNAP type 0x05 */
                fc_host_supported_fc4s(host)[3] = 0x20;
        /* For fibre channel services type 0x20 */

diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 185e6bc4dd40076519dea524d9687fa8cc0f51f5..9e8fce0f0c1b3f1022b5658a2ad503fcc810abf6 100644 (file)
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr)
         eindex = handle;
     estr->event_source = 0;
 
-    if (eindex >= MAX_EVENTS) {
+    if (eindex < 0 || eindex >= MAX_EVENTS) {
         spin_unlock_irqrestore(&ha->smp_lock, flags);
         return eindex;
     }

diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 5f045505a1f4a48eb5f5a1d17ff61508f7cadf7e..76d294fc78461c13bdf6aae03dc6c2fc2273a0cf 100644 (file)
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4188,6 +4188,25 @@ static irqreturn_t ipr_handle_other_interrupt(struct ipr_ioa_cfg *ioa_cfg,
        return rc;
 }
 
+/**
+ * ipr_isr_eh - Interrupt service routine error handler
+ * @ioa_cfg:   ioa config struct
+ * @msg:       message to log
+ *
+ * Return value:
+ *     none
+ **/
+static void ipr_isr_eh(struct ipr_ioa_cfg *ioa_cfg, char *msg)
+{
+       ioa_cfg->errors_logged++;
+       dev_err(&ioa_cfg->pdev->dev, "%s\n", msg);
+
+       if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
+               ioa_cfg->sdt_state = GET_DUMP;
+
+       ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE);
+}
+
 /**
  * ipr_isr - Interrupt service routine
  * @irq:       irq number
@@ -4203,6 +4222,7 @@ static irqreturn_t ipr_isr(int irq, void *devp)
        volatile u32 int_reg, int_mask_reg;
        u32 ioasc;
        u16 cmd_index;
+       int num_hrrq = 0;
        struct ipr_cmnd *ipr_cmd;
        irqreturn_t rc = IRQ_NONE;
 
@@ -4233,13 +4253,7 @@ static irqreturn_t ipr_isr(int irq, void *devp)
                                     IPR_HRRQ_REQ_RESP_HANDLE_MASK) >> IPR_HRRQ_REQ_RESP_HANDLE_SHIFT;
 
                        if (unlikely(cmd_index >= IPR_NUM_CMD_BLKS)) {
-                               ioa_cfg->errors_logged++;
-                               dev_err(&ioa_cfg->pdev->dev, "Invalid response handle from IOA\n");
-
-                               if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
-                                       ioa_cfg->sdt_state = GET_DUMP;
-
-                               ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE);
+                               ipr_isr_eh(ioa_cfg, "Invalid response handle from IOA");
                                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                                return IRQ_HANDLED;
                        }
@@ -4266,8 +4280,18 @@ static irqreturn_t ipr_isr(int irq, void *devp)
 
                if (ipr_cmd != NULL) {
                        /* Clear the PCI interrupt */
-                       writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg);
-                       int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg;
+                       do {
+                               writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg);
+                               int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg;
+                       } while (int_reg & IPR_PCII_HRRQ_UPDATED &&
+                                       num_hrrq++ < IPR_MAX_HRRQ_RETRIES);
+
+                       if (int_reg & IPR_PCII_HRRQ_UPDATED) {
+                               ipr_isr_eh(ioa_cfg, "Error clearing HRRQ");
+                               spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                               return IRQ_HANDLED;
+                       }
+
                } else
                        break;
        }

diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index 163245a1c3e5a666b0d97cabbf5813eccb4a6dcb..19bbcf39f0c9fb759af60b670782e3c48dc12e01 100644 (file)
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -144,6 +144,7 @@
 #define IPR_IOA_MAX_SECTORS                            32767
 #define IPR_VSET_MAX_SECTORS                           512
 #define IPR_MAX_CDB_LEN                                        16
+#define IPR_MAX_HRRQ_RETRIES                           3
 
 #define IPR_DEFAULT_BUS_WIDTH                          16
 #define IPR_80MBs_SCSI_RATE            ((80 * 10) / (IPR_DEFAULT_BUS_WIDTH / 8))

diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index b3381959acce19ee167c183ccd7b2b9354203c1b..33cf988c8c8a2cd25548ce5be0f67d97ee58e997 100644 (file)
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -960,7 +960,6 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
 
                        }
                }
-               res = 0;
        }
 
        return res;

diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index f7c70e2a8224b442b827f255728a784ceaf0b0c5..0a97bc9074bb2676429a2d777d5597e2ec8645c3 100644 (file)
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1071,7 +1071,7 @@ static struct pmcraid_cmd *pmcraid_init_hcam
 
        ioarcb->data_transfer_length = cpu_to_le32(rcb_size);
 
-       ioadl[0].flags |= cpu_to_le32(IOADL_FLAGS_READ_LAST);
+       ioadl[0].flags |= IOADL_FLAGS_READ_LAST;
        ioadl[0].data_len = cpu_to_le32(rcb_size);
        ioadl[0].address = cpu_to_le32(dma);
 
@@ -2251,7 +2251,7 @@ static void pmcraid_request_sense(struct pmcraid_cmd *cmd)
 
        ioadl->address = cpu_to_le64(cmd->sense_buffer_dma);
        ioadl->data_len = cpu_to_le32(SCSI_SENSE_BUFFERSIZE);
-       ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+       ioadl->flags = IOADL_FLAGS_LAST_DESC;
 
        /* request sense might be called as part of error response processing
         * which runs in tasklets context. It is possible that mid-layer might
@@ -3017,7 +3017,7 @@ static int pmcraid_build_ioadl(
                ioadl[i].flags = 0;
        }
        /* setup last descriptor */
-       ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+       ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC;
 
        return 0;
 }
@@ -3387,7 +3387,7 @@ static int pmcraid_build_passthrough_ioadls(
        }
 
        /* setup the last descriptor */
-       ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+       ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC;
 
        return 0;
 }
@@ -5314,7 +5314,7 @@ static void pmcraid_querycfg(struct pmcraid_cmd *cmd)
                cpu_to_le32(sizeof(struct pmcraid_config_table));
 
        ioadl = &(ioarcb->add_data.u.ioadl[0]);
-       ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+       ioadl->flags = IOADL_FLAGS_LAST_DESC;
        ioadl->address = cpu_to_le64(pinstance->cfg_table_bus_addr);
        ioadl->data_len = cpu_to_le32(sizeof(struct pmcraid_config_table));
 

diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index a67fed10598acfc3dd00234d3f3222470d18a9f9..c6f70dae9b2eecdb5a602bc94520d3da032b346d 100644 (file)
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3656,6 +3656,7 @@ fc_bsg_host_dispatch(struct request_queue *q, struct Scsi_Host *shost,
 fail_host_msg:
        /* return the errno failure code as the only status */
        BUG_ON(job->reply_len < sizeof(uint32_t));
+       job->reply->reply_payload_rcv_len = 0;
        job->reply->result = ret;
        job->reply_len = sizeof(uint32_t);
        fc_bsg_jobdone(job);
@@ -3741,6 +3742,7 @@ check_bidi:
 fail_rport_msg:
        /* return the errno failure code as the only status */
        BUG_ON(job->reply_len < sizeof(uint32_t));
+       job->reply->reply_payload_rcv_len = 0;
        job->reply->result = ret;
        job->reply_len = sizeof(uint32_t);
        fc_bsg_jobdone(job);
@@ -3797,6 +3799,7 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost,
                /* check if we have the msgcode value at least */
                if (job->request_len < sizeof(uint32_t)) {
                        BUG_ON(job->reply_len < sizeof(uint32_t));
+                       job->reply->reply_payload_rcv_len = 0;
                        job->reply->result = -ENOMSG;
                        job->reply_len = sizeof(uint32_t);
                        fc_bsg_jobdone(job);

diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 6e728b176904664abb12f132fa63aaced2a4aa00..47941fc5aba753e2de036f8fb79f06588f73c9ff 100644 (file)
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -797,30 +797,23 @@ static inline unsigned int scsi_host_get_prot(struct Scsi_Host *shost)
 
 static inline unsigned int scsi_host_dif_capable(struct Scsi_Host *shost, unsigned int target_type)
 {
-       switch (target_type) {
-       case 1:
-               if (shost->prot_capabilities & SHOST_DIF_TYPE1_PROTECTION)
-                       return target_type;
-       case 2:
-               if (shost->prot_capabilities & SHOST_DIF_TYPE2_PROTECTION)
-                       return target_type;
-       case 3:
-               if (shost->prot_capabilities & SHOST_DIF_TYPE3_PROTECTION)
-                       return target_type;
-       }
+       static unsigned char cap[] = { 0,
+                                      SHOST_DIF_TYPE1_PROTECTION,
+                                      SHOST_DIF_TYPE2_PROTECTION,
+                                      SHOST_DIF_TYPE3_PROTECTION };
 
-       return 0;
+       return shost->prot_capabilities & cap[target_type] ? target_type : 0;
 }
 
 static inline unsigned int scsi_host_dix_capable(struct Scsi_Host *shost, unsigned int target_type)
 {
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
-       switch (target_type) {
-       case 0: return shost->prot_capabilities & SHOST_DIX_TYPE0_PROTECTION;
-       case 1: return shost->prot_capabilities & SHOST_DIX_TYPE1_PROTECTION;
-       case 2: return shost->prot_capabilities & SHOST_DIX_TYPE2_PROTECTION;
-       case 3: return shost->prot_capabilities & SHOST_DIX_TYPE3_PROTECTION;
-       }
+       static unsigned char cap[] = { SHOST_DIX_TYPE0_PROTECTION,
+                                      SHOST_DIX_TYPE1_PROTECTION,
+                                      SHOST_DIX_TYPE2_PROTECTION,
+                                      SHOST_DIX_TYPE3_PROTECTION };
+
+       return shost->prot_capabilities & cap[target_type];
 #endif
        return 0;
 }