]> www.infradead.org Git - users/jedix/linux-maple.git/log
users/jedix/linux-maple.git
7 years agonet: convert packet_fanout.sk_ref from atomic_t to refcount_t
Reshetova, Elena [Fri, 30 Jun 2017 10:08:10 +0000 (13:08 +0300)]
net: convert packet_fanout.sk_ref from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit fb5c2c17a556d9b00798d6a6b9e624281ee2eb28)

Orabug: 27050772
CVE: CVE-2017-15649

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
 Conflicts:
net/packet/af_packet.c

7 years agopacket: fix races in fanout_add()
Eric Dumazet [Tue, 14 Feb 2017 17:03:51 +0000 (09:03 -0800)]
packet: fix races in fanout_add()

Multiple threads can call fanout_add() at the same time.

We need to grab fanout_mutex earlier to avoid races that could
lead to one thread freeing po->rollover that was set by another thread.

Do the same in fanout_release(), for peace of mind, and to help us
finding lockdep issues earlier.

Fixes: dc99f600698d ("packet: Add fanout support.")
Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit d199fab63c11998a602205f7ee7ff7c05c97164b)

Orabug: 27050772
CVE: CVE-2017-15649

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
 Conflicts:
net/packet/af_packet.c

Left out the changes related to rollover

7 years agorefcount_t: Introduce a special purpose refcount type
Peter Zijlstra [Mon, 14 Nov 2016 17:06:19 +0000 (18:06 +0100)]
refcount_t: Introduce a special purpose refcount type

Provide refcount_t, an atomic_t like primitive built just for
refcounting.

It provides saturation semantics such that overflow becomes impossible
and thereby 'spurious' use-after-free is avoided.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
(cherry picked from commit f405df5de3170c00e5c54f8b7cf4766044a032ba)

Orabug: 27050772
CVE: CVE-2017-15649

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agolocking/atomics: Add _{acquire|release|relaxed}() variants of some atomic operations
Will Deacon [Thu, 6 Aug 2015 16:54:37 +0000 (17:54 +0100)]
locking/atomics: Add _{acquire|release|relaxed}() variants of some atomic operations

Whilst porting the generic qrwlock code over to arm64, it became
apparent that any portable locking code needs finer-grained control of
the memory-ordering guarantees provided by our atomic routines.

In particular: xchg, cmpxchg, {add,sub}_return are often used in
situations where full barrier semantics (currently the only option
available) are not required. For example, when a reader increments a
reader count to obtain a lock, checking the old value to see if a writer
was present, only acquire semantics are strictly needed.

This patch introduces three new ordering semantics for these operations:

  - *_relaxed: No ordering guarantees. This is similar to what we have
               already for the non-return atomics (e.g. atomic_add).

  - *_acquire: ACQUIRE semantics, similar to smp_load_acquire.

  - *_release: RELEASE semantics, similar to smp_store_release.

In memory-ordering speak, this means that the acquire/release semantics
are RCpc as opposed to RCsc. Consequently a RELEASE followed by an
ACQUIRE does not imply a full barrier, as already documented in
memory-barriers.txt.

Currently, all the new macros are conditionally mapped to the full-mb
variants, however if the *_relaxed version is provided by the
architecture, then the acquire/release variants are constructed by
supplementing the relaxed routine with an explicit barrier.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Waiman.Long@hp.com
Cc: paulmck@linux.vnet.ibm.com
Link: http://lkml.kernel.org/r/1438880084-18856-2-git-send-email-will.deacon@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
(cherry picked from commit 654672d4ba1a6001c365833be895f9477c4d5eab)

Orabug: 27050772
CVE: CVE-2017-15649

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoxen-netback: enable skip_guestrx_thread by default
Joao Martins [Thu, 16 Nov 2017 11:44:32 +0000 (11:44 +0000)]
xen-netback: enable skip_guestrx_thread by default

Given that there's almost no grant ops being done, there's no need to
amortize grant hypercall cost through the guestrx kthread. This option
then skips it enterily (only with staging grants) and gets to remove the
contention on queue->wq and queue->rx_lock.

Exadata chatty select tests show an improvement of 14% as depicted in
the bug.

Orabug: 27125766
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agonet:xen-netback - Change 1 to true for bool type variable.
Shailendra Verma [Mon, 25 May 2015 17:49:31 +0000 (23:19 +0530)]
net:xen-netback - Change 1 to true for bool type variable.

The variable separate_tx_rx_irq is bool type so assigning true
instead of 1.

Signed-off-by: Shailendra Verma <shailendra.capricorn@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit c489dbb1892ed02fa01e1423968f7dfea462a486)
Orabug: 27125766
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
7 years agoxen-netfront: Improve error handling during initialization
Ross Lagerwall [Wed, 8 Feb 2017 10:57:37 +0000 (10:57 +0000)]
xen-netfront: Improve error handling during initialization

This fixes a crash when running out of grant refs when creating many
queues across many netdevs.

* If creating queues fails (i.e. there are no grant refs available),
call xenbus_dev_fatal() to ensure that the xenbus device is set to the
closed state.
* If no queues are created, don't call xennet_disconnect_backend as
netdev->real_num_tx_queues will not have been set correctly.
* If setup_netfront() fails, ensure that all the queues created are
cleaned up, not just those that have been set up.
* If any queues were set up and an error occurs, call
xennet_destroy_queues() to clean up the napi context.
* If any fatal error occurs, unregister and destroy the netdev to avoid
leaving around a half setup network device.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit e2e004acc7cbe3c531e752a270a74e95cde3ea48)

Conflicts:
drivers/net/xen-netfront.c

We have a additional feature that is probed (feature_staging_gnts), hence
it couldn't directly apply the chunk. But the chunks added/modified are
still the same as the backport.

Orabug: 22817043
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agolib/vsprintf.c: warn about too large precisions and field widths
Rasmus Villemoes [Sat, 16 Jan 2016 00:58:44 +0000 (16:58 -0800)]
lib/vsprintf.c: warn about too large precisions and field widths

The field width is overloaded to pass some extra information for some %p
extensions (e.g.  #bits for %pb).  But we might silently truncate the
passed value when we stash it in struct printf_spec (see e.g.
"lib/vsprintf.c: expand field_width to 24 bits").  Hopefully 23 value
bits should now be enough for everybody, but if not, let's make some
noise.

Do the same for the precision.  In both cases, clamping seems more
sensible than truncating.  While, according to POSIX, "A negative
precision is taken as if the precision were omitted.", the kernel's
printf has always treated that case as if the precision was 0, so we use
that as lower bound.  For the field width, the smallest representable
value is actually -(1<<23), but a negative field width means 'set the
LEFT flag and use the absolute value', so we want the absolute value to
fit.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Joe Perches <joe@perches.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Maurizio Lombardi <mlombard@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 4d72ba014b4b0913f448ccaaaa2e8b39c54e3738)

Orabug: 26178769

Signed-off-by: Maran Wilson <maran.wilson@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
7 years agolib/vsprintf.c: help gcc make number() smaller
Rasmus Villemoes [Sat, 16 Jan 2016 00:58:41 +0000 (16:58 -0800)]
lib/vsprintf.c: help gcc make number() smaller

One consequence of the reorganization of struct printf_spec to make
field_width 24 bits was that number() gained about 180 bytes.  Since
spec is never passed to other functions, we can help gcc make number()
lose most of that extra weight by using local variables for the field
width and precision.

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Joe Perches <joe@perches.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Maurizio Lombardi <mlombard@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 1c7a8e622e84c9164dd665f5ad4879eac71bdc1e)

Orabug: 26178769

Signed-off-by: Maran Wilson <maran.wilson@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
7 years agolib/vsprintf.c: expand field_width to 24 bits
Rasmus Villemoes [Sat, 16 Jan 2016 00:58:37 +0000 (16:58 -0800)]
lib/vsprintf.c: expand field_width to 24 bits

Maurizio Lombardi reported a problem [1] with the %pb extension: It
doesn't work for sufficiently large bitmaps, since the size is stashed
in the field_width field of the struct printf_spec, which is currently
an s16.  Concretely, this manifested itself in
/sys/bus/pseudo/drivers/scsi_debug/map being empty, since the bitmap
printer got a size of 0, which is the 16 bit truncation of the actual
bitmap size.

We do want to keep struct printf_spec at 8 bytes so that it can cheaply
be passed by value.  The qualifier field is only used for internal
bookkeeping in format_decode, so we might as well use a local variable
for that.  This gives us an additional 8 bits, which we can then use for
the field width.

To stay in 8 bytes, we need to do a little rearranging and make the type
member a bitfield as well.  For consistency, change all the members to
bit fields.  gcc doesn't generate much worse code with these changes (in
fact, bloat-o-meter says we save 300 bytes - which I think is a little
surprising).

I didn't find a BUILD_BUG/compiletime_assertion/... which would work
outside function context, so for now I just open-coded it.

[1] http://thread.gmane.org/gmane.linux.kernel/2034835

[akpm@linux-foundation.org: avoid open-coded BUILD_BUG_ON]
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reported-by: Maurizio Lombardi <mlombard@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Joe Perches <joe@perches.com>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit d048419311ff16ba420f4b1bdf93a3d74057b53a)

Orabug: 26178769

Signed-off-by: Maran Wilson <maran.wilson@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
7 years agoocfs2: code clean up for direct io
Ryan Ding [Wed, 8 Nov 2017 23:01:25 +0000 (15:01 -0800)]
ocfs2: code clean up for direct io

orabug: 26545553
backport: upstream f1f973ffce96a47c2b3f142e91eccef5bf22f699
# slight confict on all files.

Clean up ocfs2_file_write_iter & ocfs2_prepare_inode_for_write:
 * remove append dio check: it will be checked in ocfs2_direct_IO()
 * remove file hole check: file hole is supported for now
 * remove inline data check: it will be checked in ocfs2_direct_IO()
 * remove the full_coherence check when append dio: we will get the
   inode_lock in ocfs2_dio_get_block, there is no need to fall back to
   buffer io to ensure the coherence semantics.

Now the drop dio procedure is gone.  :)

[akpm@linux-foundation.org: remove unused label]
Signed-off-by: Ryan Ding <ryan.ding@oracle.com>
Reviewed-by: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <joseph.qi@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonet/rds: use multiple sge than buddy allocation in congestion code
Wei Lin Guay [Wed, 4 Oct 2017 09:45:19 +0000 (11:45 +0200)]
net/rds: use multiple sge than buddy allocation in congestion code

When commit ea6e04f14569 ("RDS: make congestion code independent of
PAGE_SIZE") was introduced, it used the buddy allocation with one
sge. Thus, this commit uses multiple sge to make congestion code
independent of PAGE_SIZE.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agoRevert "RDS: fix the sg allocation based on actual message size"
Wei Lin Guay [Thu, 31 Aug 2017 19:52:27 +0000 (21:52 +0200)]
Revert "RDS: fix the sg allocation based on actual message size"

This reverts commit 23f90cccfba4 ("RDS: fix the sg allocation based on
actual message size") because RDS has implemented N sge to support large
fragment size, with each sge of PAGE_SIZE.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agoRevert "RDS: avoid large pages for sg allocation for TCP transport"
Wei Lin Guay [Thu, 31 Aug 2017 19:26:13 +0000 (21:26 +0200)]
Revert "RDS: avoid large pages for sg allocation for TCP transport"

This reverts commit 2d80dcbe382c ("RDS: avoid large pages for sg allocation
for TCP transport") because RDS has implemented N sge to support large
fragment size, with each sge of PAGE_SIZE.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agoRevert "net/rds: Reduce memory footprint in rds_sendmsg"
Wei Lin Guay [Thu, 31 Aug 2017 13:36:51 +0000 (15:36 +0200)]
Revert "net/rds: Reduce memory footprint in rds_sendmsg"

This reverts commit d7e95bf4ed7e ("net/rds: Reduce memory footprint in
rds_sendmsg") because RDS has implemented N sge to support large fragment
size, with each sge of PAGE_SIZE.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonet/rds: reduce memory footprint during ib_post_recv in IB transport
Wei Lin Guay [Thu, 6 Jul 2017 08:12:48 +0000 (10:12 +0200)]
net/rds: reduce memory footprint during ib_post_recv in IB transport

The RDS IB large fragment size feature requires order 2 memory allocations
and it introduces memory pressure in the allocation system. Thus, this
patch implements large fragment size support in ib_post_recv with N sge. As
of today, RDS has an assumption that each IB received work request has only
two SGEs. This patch removes this assumption and uses various SGE to
support large fragment size.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonet/rds: reduce memory footprint during rds_sendmsg with IB transport
Wei Lin Guay [Thu, 22 Jun 2017 19:52:35 +0000 (21:52 +0200)]
net/rds: reduce memory footprint during rds_sendmsg with IB transport

The RDS IB large fragment size feature requires order 2 memory allocations
and it introduces memory pressure in the allocation system.  Thus, this
patch removes this dependency and uses multiple sge in the IB work requests
to support large fragment size.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonet/rds: set the rds_ib_init_frag based on supported sge
Wei Lin Guay [Tue, 10 Oct 2017 07:19:03 +0000 (09:19 +0200)]
net/rds: set the rds_ib_init_frag based on supported sge

The large fragment size requires the underlying HCA to support N sge. Thus,
this patch sets the rds_ib_init_frag based on the minimal of
(rds_ibdev->max_sge - 1) * PAGE_SIZE and the rds_ib_max_frag module_param.

Orabug: 26770234

Signed-off-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Tested-by: Shih-Yu Huang <shih-yu.huang@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years ago scsi: Don't abort scsi_scan due to unexpected response
John Sobecki [Tue, 7 Nov 2017 23:27:30 +0000 (16:27 -0700)]
scsi: Don't abort scsi_scan due to unexpected response

    Orabug: 27072286

    During a scan for new LUNs, if an array misconfiguration results in
    an error (non-configured LUNs exist in the middle), this terminates the
    scsi scan:

     sd 12:0:0:0: Unexpected response from lun 1 while scanning, scan aborted

    This patch allows the scsi scan to continue, and prints this warning:

     sd 12:0:0:0: Unexpected response from lun 1 while scanning,
                   ignoring device

    Related bugs: 1827107017500570

Signed-off-by: John Sobecki <john.sobecki@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agords: Fix inaccurate accounting of unsignaled wrs in rds_ib_xmit_rdma
Håkon Bugge [Fri, 10 Nov 2017 11:42:18 +0000 (12:42 +0100)]
rds: Fix inaccurate accounting of unsignaled wrs in rds_ib_xmit_rdma

The number of unsignaled work-requests posted to the IB send queue is
tracked by a counter in the rds_ib_connection struct. When it reaches
zero, or the caller explicitly asks for it, the send-signaled bit is
set in send_flags and the counter is reset. This is performed by the
rds_ib_set_wr_signal_state() function.

However, this function is not used in rds_ib_xmit_rdma(), which yields
inaccurate accounting. This commit fixes this.

Orabug: 27090772

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reviewed-by: Knut Omang <knut.omang@oracle.com>
Reviewed-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Avinash Repaka <avinash.repaka@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agords: Fix inaccurate accounting of unsignaled wrs
Håkon Bugge [Tue, 24 Oct 2017 14:16:28 +0000 (16:16 +0200)]
rds: Fix inaccurate accounting of unsignaled wrs

The number of unsignaled work-requests posted to the IB send queue is
tracked by a counter in the rds_ib_connection struct. When it reaches
zero, or the caller explicitly asks for it, the send-signaled bit is
set in send_flags and the counter is reset. This is performed by the
rds_ib_set_wr_signal_state() function.

However, this function is not always used which yields inaccurate
accounting. This commit fixes this, re-factors a code bloat related to
the matter, and makes the actual parameter type to the function
consistent.

Orabug: 27090772

Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry-picked from upstream a0c0865fa0abcbc142c11fabec3a2bffc1a4229d)

Conflicts:
net/rds/ib_send.c

Reviewed-by: Knut Omang <knut.omang@oracle.com>
Reviewed-by: Wei Lin Guay <wei.lin.guay@oracle.com>
Reviewed-by: Avinash Repaka <avinash.repaka@oracle.com>
--
changes from v1:
- Inclusion of upstream cherry-picked SHA

Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agoocfs2: fstrim: Fix start offset of first cluster group during fstrim
Ashish Samant [Thu, 2 Nov 2017 22:59:37 +0000 (15:59 -0700)]
ocfs2: fstrim: Fix start offset of first cluster group during fstrim

From: Ashish Samant <ashish.samant@oracle.com>

Orabug: 27111255

The first cluster group descriptor is not stored at the start of the
group but at an offset from the start.  We need to take this into
account while doing fstrim on the first cluster group.  Otherwise we
will wrongly start fstrim a few blocks after the desired start block and
the range can cross over into the next cluster group and zero out the
group descriptor there.  This can cause filesytem corruption that cannot
be fixed by fsck.

Link: http://lkml.kernel.org/r/1507835579-7308-1-git-send-email-ashish.samant@oracle.com
Signed-off-by: Ashish Samant <ashish.samant@oracle.com>
Reviewed-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
Cc: Mark Fasheh <mfasheh@versity.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherrypicked from commit 105ddc93f06ebe3e553f58563d11ed63dbcd59f0)
Signed-off-by: Ashish Samant <ashish.samant@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agortc: cmos: century support
Sylvain Chouleur [Mon, 8 Jun 2015 09:45:19 +0000 (11:45 +0200)]
rtc: cmos: century support

If century field is supported by the RTC CMOS device, then we should use
it and then do not consider years greater that 169 as an error.

For information, the year field of the rtc_time structure contains the
value to add to 1970 to obtain the current year.

This was a hack to be able to support years for 1970 to 2069.
This patch remains compatible with this implementation.

Signed-off-by: Sylvain Chouleur <sylvain.chouleur@intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
(cherry picked from commit 3c217e51d8a272b9301058fe845d6c69cc0651cb)

Orabug: 27111144

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoxfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff()
Jan Kara [Thu, 18 May 2017 23:36:23 +0000 (16:36 -0700)]
xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff()

There is an off-by-one error in loop termination conditions in
xfs_find_get_desired_pgoff() since 'end' may index a page beyond end of
desired range if 'endoff' is page aligned. It doesn't have any visible
effects but still it is good to fix it.

Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Orabug: 27093425

(backport upstream commit d7fd24257aa60316bf81093f7f909dc9475ae974)

Signed-off-by: Shan Hai <shan.hai@oracle.com>
7 years agoxfs: Fix missed holes in SEEK_HOLE implementation
Jan Kara [Thu, 18 May 2017 23:36:22 +0000 (16:36 -0700)]
xfs: Fix missed holes in SEEK_HOLE implementation

XFS SEEK_HOLE implementation could miss a hole in an unwritten extent as
can be seen by the following command:

xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k"
       -c "seek -h 0" file
wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (49.312 MiB/sec and 12623.9856 ops/sec)
wrote 8192/8192 bytes at offset 131072
8 KiB, 2 ops; 0.0000 sec (70.383 MiB/sec and 18018.0180 ops/sec)
Whence Result
HOLE 139264

Where we can see that hole at offset 56k was just ignored by SEEK_HOLE
implementation. The bug is in xfs_find_get_desired_pgoff() which does
not properly detect the case when pages are not contiguous.

Fix the problem by properly detecting when found page has larger offset
than expected.

CC: stable@vger.kernel.org
Fixes: d126d43f631f996daeee5006714fed914be32368
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Orabug: 27093425

(backport upstream commit 5375023ae1266553a7baa0845e82917d8803f48c)

Signed-off-by: Shan Hai <shan.hai@oracle.com>
7 years agoext4: fix off-by-in in loop termination in ext4_find_unwritten_pgoff()
Jan Kara [Mon, 22 May 2017 02:34:23 +0000 (22:34 -0400)]
ext4: fix off-by-in in loop termination in ext4_find_unwritten_pgoff()

There is an off-by-one error in loop termination conditions in
ext4_find_unwritten_pgoff() since 'end' may index a page beyond end of
desired range if 'endoff' is page aligned. It doesn't have any visible
effects but still it is good to fix it.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Orabug: 27093425

(backport upstream commit 3f1d5bad3fae983da07be01cff2fde13293bb7b9)

Signed-off-by: Shan Hai <shan.hai@oracle.com>
7 years agoext4: fix SEEK_HOLE
Jan Kara [Mon, 22 May 2017 02:33:23 +0000 (22:33 -0400)]
ext4: fix SEEK_HOLE

Currently, SEEK_HOLE implementation in ext4 may both return that there's
a hole at some offset although that offset already has data and skip
some holes during a search for the next hole. The first problem is
demostrated by:

xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "seek -h 0" file
wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (2.054 GiB/sec and 538461.5385 ops/sec)
Whence Result
HOLE 0

Where we can see that SEEK_HOLE wrongly returned offset 0 as containing
a hole although we have written data there. The second problem can be
demonstrated by:

xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k"
       -c "seek -h 0" file

wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (1.978 GiB/sec and 518518.5185 ops/sec)
wrote 8192/8192 bytes at offset 131072
8 KiB, 2 ops; 0.0000 sec (2 GiB/sec and 500000.0000 ops/sec)
Whence Result
HOLE 139264

Where we can see that hole at offsets 56k..128k has been ignored by the
SEEK_HOLE call.

The underlying problem is in the ext4_find_unwritten_pgoff() which is
just buggy. In some cases it fails to update returned offset when it
finds a hole (when no pages are found or when the first found page has
higher index than expected), in some cases conditions for detecting hole
are just missing (we fail to detect a situation where indices of
returned pages are not contiguous).

Fix ext4_find_unwritten_pgoff() to properly detect non-contiguous page
indices and also handle all cases where we got less pages then expected
in one place and handle it properly there.

CC: stable@vger.kernel.org
Fixes: c8c0df241cc2719b1262e627f999638411934f60
CC: Zheng Liu <wenqing.lz@taobao.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
(cherry picked from commit 7d95eddf313c88b24f99d4ca9c2411a4b82fef33)

Orabug: 27093425

Signed-off-by: Shan Hai <shan.hai@oracle.com>
7 years agouek-rpm: Add more missing modules to OL7 ueknano
Somasundaram Krishnasamy [Tue, 7 Nov 2017 23:20:42 +0000 (15:20 -0800)]
uek-rpm: Add more missing modules to OL7 ueknano

Orabug: 27092501

List of configs enabled to build vmlinux for both OL6 QU5 nano and OL7
QU6 nano are compared. Few of the configs built in vmlinux is moved to
build as modules in OL7 and those modules are missing in ueknano. This
commit adds them to nano_modules.list

Signed-off-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Reviewed-by: Ashok Vairavan <ashok.vairavan@oracle.com>
7 years agofix unbalanced page refcounting in bio_map_user_iov
Vitaly Mayatskikh [Fri, 22 Sep 2017 05:18:39 +0000 (01:18 -0400)]
fix unbalanced page refcounting in bio_map_user_iov

bio_map_user_iov and bio_unmap_user do unbalanced pages refcounting if
IO vector has small consecutive buffers belonging to the same page.
bio_add_pc_page merges them into one, but the page reference is never
dropped.

Cc: stable@vger.kernel.org
Signed-off-by: Vitaly Mayatskikh <v.mayatskih@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit 95d78c28b5a85bacbc29b8dba7c04babb9b0d467)

Orabug: 27062562
CVE: CVE-2017-12190

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Ethan Zhao <ethan.zhao@oracle.com>
7 years agomore bio_map_user_iov() leak fixes
Al Viro [Sat, 23 Sep 2017 19:51:23 +0000 (15:51 -0400)]
more bio_map_user_iov() leak fixes

we need to take care of failure exit as well - pages already
in bio should be dropped by analogue of bio_unmap_pages(),
since their refcounts had been bumped only once per reference
in bio.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
(cherry picked from commit 2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058)

Orabug: 27062562
CVE: CVE-2017-12190

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Acked-by: Ethan Zhao <ethan.zhao@oracle.com>
Reviewed-by: Shan Hai <shan.hai@oracle.com>
 Conflicts:
block/bio.c

7 years agovirtio-pci: alloc only resources actually used.
Gerd Hoffmann [Wed, 24 Jun 2015 05:54:15 +0000 (07:54 +0200)]
virtio-pci: alloc only resources actually used.

Move resource allocation from common code to legacy and modern code.
Only request resources actually used, i.e. bar0 in legacy mode and
the bar(s) specified by capabilities in modern mode.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 59a5b0f7bf74f88da6670bcbf924d8cc1e75b1ee)

Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Signed-off-by: Jim Quigley <Jim.Quigley@oracle.com>
Orabug: 27054871

Conflicts:
drivers/virtio/virtio_pci_legacy.c

This was a minor contextual change introduced because upstream
applied the following patches in the order :-

vring: Use the DMA API on Xen (Andy Lutomirski)  [Orabug: 26388044]
virtio_pci: Use the DMA API if enabled (Andy Lutomirski)  [Orabug: 26388044]
virtio_mmio: Use the DMA API if enabled (Andy Lutomirski)  [Orabug: 26388044]
virtio: Add improved queue allocation API (Andy Lutomirski)  [Orabug: 26388044]
virtio_ring: Support DMA APIs (Andy Lutomirski)  [Orabug: 26388044]
vring: Introduce vring_use_dma_api() (Andy Lutomirski) Orabug: 26388044]
virtio-pci: alloc only resources actually used.

and we are now applying them as :-

virtio-pci: alloc only resources actually used.
vring: Use the DMA API on Xen (Andy Lutomirski)  [Orabug: 26388044]
virtio_pci: Use the DMA API if enabled (Andy Lutomirski)  [Orabug: 26388044]
....

7 years agousb: Quiet down false peer failure messages
Don Zickus [Thu, 3 Dec 2015 22:26:27 +0000 (17:26 -0500)]
usb: Quiet down false peer failure messages

My recent Intel box is spewing these messages:

xhci_hcd 0000:00:14.0: xHCI Host Controller
xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: xHCI Host Controller
usb usb2: Manufacturer: Linux 4.3.0+ xhci-hcd
usb usb2: SerialNumber: 0000:00:14.0
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 6 ports detected
usb: failed to peer usb2-port2 and usb1-port1 by location (usb2-port2:none) (usb1-port1:usb2-port1)
usb usb2-port2: failed to peer to usb1-port1 (-16)
usb: port power management may be unreliable
usb: failed to peer usb2-port3 and usb1-port1 by location (usb2-port3:none) (usb1-port1:usb2-port1)
usb usb2-port3: failed to peer to usb1-port1 (-16)
usb: failed to peer usb2-port5 and usb1-port1 by location (usb2-port5:none) (usb1-port1:usb2-port1)
usb usb2-port5: failed to peer to usb1-port1 (-16)
usb: failed to peer usb2-port6 and usb1-port1 by location (usb2-port6:none) (usb1-port1:usb2-port1)
usb usb2-port6: failed to peer to usb1-port1 (-16)

Diving into the acpi tables, I noticed the EHCI hub has 12 ports while the XHCI
hub has 8 ports.  Most of those ports are of connect type USB_PORT_NOT_USED
(including port 1 of the EHCI hub).

Further the unused ports have location data initialized to 0x80000000.

Now each unused port on the xhci hub walks the port list and finds a matching
peer with port1 of the EHCI hub because the zero'd out group id bits falsely match.
After port1 of the XHCI hub, each following matching peer will generate the
above warning.

These warnings seem to be harmless for this scenario as I don't think it
matters that unused ports could not create a peer link.

The attached patch utilizes that assumption and just turns the pr_warn into
pr_debug to quiet things down.

Tested on my Intel box.

Signed-off-by: Don Zickus <dzickus@redhat.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6406eeb3f5bb376c7d9674e61f8da34ce7f05e8d)

Orabug: 27080216

Signed-off-by: Shan Hai <shan.hai@oracle.com>
Reviewed-by: Ethan Zhao <ethan.zhao@oracle.com>
7 years agoxscore: add dma address check
Zhu Yanjun [Mon, 23 Oct 2017 06:50:22 +0000 (02:50 -0400)]
xscore: add dma address check

When "swiotlb buffer is full" error occurs, the DMA allocation
will fail. The data conn and control conn are disconnected. Then
xscore will make error handling. In this error handling, the
unallocated DMA address is unmapped. This will result in the crash.
To avoid crash, the dma address check is added.

Orabug: 27074085

Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetlink: allow to listen "all" netns
Nicolas Dichtel [Thu, 7 May 2015 09:02:53 +0000 (11:02 +0200)]
netlink: allow to listen "all" netns

More accurately, listen all netns that have a nsid assigned into the netns
where the netlink socket is opened.
For this purpose, a netlink socket option is added:
NETLINK_LISTEN_ALL_NSID. When this option is set on a netlink socket, this
socket will receive netlink notifications from all netns that have a nsid
assigned into the netns where the socket has been opened. The nsid is sent
to userland via an anscillary data.

With this patch, a daemon needs only one socket to listen many netns. This
is useful when the number of netns is high.

Because 0 is a valid value for a nsid, the field nsid_is_set indicates if
the field nsid is valid or not. skb->cb is initialized to 0 on skb
allocation, thus we are sure that we will never send a nsid 0 by error to
the userland.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit 59324cf35aba5336b611074028777838a963d03b)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetlink: rename private flags and states
Nicolas Dichtel [Thu, 7 May 2015 09:02:52 +0000 (11:02 +0200)]
netlink: rename private flags and states

These flags and states have the same prefix (NETLINK_) that netlink socket
options. To avoid confusion and to be able to name a flag like a socket
option, let's use an other prefix: NETLINK_[S|F]_.

Note: a comment has been fixed, it was talking about
NETLINK_RECV_NO_ENOBUFS socket option instead of NETLINK_NO_ENOBUFS.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit cc3a572fe6cf586f478546215bc5d3694357d71e)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetns: use a spin_lock to protect nsid management
Nicolas Dichtel [Thu, 7 May 2015 09:02:51 +0000 (11:02 +0200)]
netns: use a spin_lock to protect nsid management

Before this patch, nsid were protected by the rtnl lock. The goal of this
patch is to be able to find a nsid without needing to hold the rtnl lock.

The next patch will introduce a netlink socket option to listen to all
netns that have a nsid assigned into the netns where the socket is opened.
Thus, it's important to call rtnl_net_notifyid() outside the spinlock, to
avoid a recursive lock (nsid are notified via rtnl). This was the main
reason of the previous patch.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit 95f38411df055a0ecefe3a3d119d98241087d5ca)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetns: notify new nsid outside __peernet2id()
Nicolas Dichtel [Thu, 7 May 2015 09:02:50 +0000 (11:02 +0200)]
netns: notify new nsid outside __peernet2id()

There is no functional change with this patch. It will ease the refactoring
of the locking system that protects nsids and the support of the netlink
socket option NETLINK_LISTEN_ALL_NSID.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit 3138dbf881274cb20d9aa1b307861f689e820fbe)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetns: rename peernet2id() to peernet2id_alloc()
Nicolas Dichtel [Thu, 7 May 2015 09:02:49 +0000 (11:02 +0200)]
netns: rename peernet2id() to peernet2id_alloc()

In a following commit, a new function will be introduced to only lookup for
a nsid (no allocation if the nsid doesn't exist). To avoid confusion, the
existing function is renamed.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit 7a0877d4b438886b72be61632eaa774d13262f70)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetns: always provide the id to rtnl_net_fill()
Nicolas Dichtel [Thu, 7 May 2015 09:02:48 +0000 (11:02 +0200)]
netns: always provide the id to rtnl_net_fill()

The goal of this commit is to prepare the rework of the locking of nsnid
protection.
After this patch, rtnl_net_notifyid() will not call anymore __peernet2id(),
ie no idr_* operation into this function.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit cab3c8ec8d57ef48ed754ee7acf2b9bdce80fa5f)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agonetns: returns always an id in __peernet2id()
Nicolas Dichtel [Thu, 7 May 2015 09:02:47 +0000 (11:02 +0200)]
netns: returns always an id in __peernet2id()

All callers of this function expect a nsid, not an error.
Thus, returns NETNSA_NSID_NOT_ASSIGNED in case of error so that callers
don't have to convert the error to NETNSA_NSID_NOT_ASSIGNED.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 23634951
(cherry picked from commit 109582af18b9aade9385ea6609a792f80a7d70ca)
Signed-off-by: Cathy Zhou <Cathy.Zhou@Oracle.COM>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
7 years agouek-rpm: add update-el-x86; fix-up ol6/update-el
Chuck Anderson [Wed, 1 Nov 2017 19:17:51 +0000 (12:17 -0700)]
uek-rpm: add update-el-x86; fix-up ol6/update-el

The build env will start looking for uek-rpm/ol?/update-el-<arch>.
Add uek-rpm/ol6/update-el-x86, specifying 6.7.
Add uek-rpm/ol7/update-el-x86, specifying 7.3.

For now, leave uek-rpm/ol?/update-el.  Remove them later after we know
that there are no issues with using uek-rpm/ol?/update-el-x86.

Set uek-rpm/ol6/update-el to 6.7 which is the current UEK4 build env.
It was set previously to 6.6 but has been overridden by the build env.
The build env is about to be changed so that it will no longer override it.
uek-rpm/ol7/update-el has the correct value, 7.3, so no change is needed.

Delete the unused uek-rpm/ol6/update-el-ol6 and uek-rpm/ol7/update-el-ol7.

Orabug: 27004340
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
7 years agouek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED
Fred Herard [Thu, 2 Nov 2017 17:14:53 +0000 (10:14 -0700)]
uek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED

Orabug: 26798697

This commit disables automatic NUMA balancing by default.
Numerous customers have experienced high iowait due to
oracle db processes sitting in D state on wait_on_page_bit()
because memory pages containing data segment of the oracle
db processes are migrated aggressively across NUMA nodes.

The solution is to disable automatic NUMA balancing by
default until NUMA balancing algorithm is modified to
address this issue.  Note that NUMA balancing may
still be enabled with this change by setting
kernel.numa_balancing=1 (e.g. via sysctl).

Signed-off-by: Fred Herard <fred.herard@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
7 years agoqla2xxx: Update driver version to 9.00.00.00.40.0-k
Quinn Tran [Wed, 13 Sep 2017 19:05:50 +0000 (00:35 +0530)]
qla2xxx: Update driver version to 9.00.00.00.40.0-k

Orabug: 2684419726923029

Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix delayed response to command for loop mode/direct connect.
Quinn Tran [Wed, 13 Sep 2017 19:02:20 +0000 (00:32 +0530)]
qla2xxx: Fix delayed response to command for loop mode/direct connect.

Orabug: 2684419726923029

Current driver wait for FW to be in the ready state before
processing in-coming commands. For Arbitrated Loop or
Point-to- Point (not switch), FW Ready state can take a while.
FW will transition to ready state after all Nports have been
logged in. In the mean time, certain initiators have completed
the login and starts IO. Driver needs to start processing all
queues if FW is already started.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Use IOCB interface to submit non-critical MBX.
Quinn Tran [Wed, 13 Sep 2017 18:44:43 +0000 (00:14 +0530)]
qla2xxx: Use IOCB interface to submit non-critical MBX.

Orabug: 2684419726923029

The Mailbox interface is currently over subscribed. We like
to reserve the Mailbox interface for the chip managment and
link initialization. Any non essential Mailbox command will
be routed through the IOCB interface. The IOCB interface is
able to absorb more commands.

Following commands are being routed through IOCB interface

 - Get ID List (007Ch)
 - Get Port DB (0064h)
 - Get Link Priv Stats (006Dh)

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Add async new target notification
Quinn Tran [Wed, 13 Sep 2017 15:35:42 +0000 (21:05 +0530)]
qla2xxx: Add async new target notification

Orabug: 2684419726923029

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Allow relogin to proceed if remote login did not finish
Quinn Tran [Wed, 13 Sep 2017 15:30:51 +0000 (21:00 +0530)]
qla2xxx: Allow relogin to proceed if remote login did not finish

Orabug: 2684419726923029

If the remote port have started the login process, then the
PLOGI and PRLI should be back to back. Driver will allow
the remote port to complete the process. For the case where
the remote port decide to back off from sending PRLI, this
local port sets an expiration timer for the PRLI. Once the
expiration time passes, the relogin retry logic is allowed
to go through and perform login with the remote port.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix sess_lock & hardware_lock lock order problem.
Quinn Tran [Wed, 15 Mar 2017 16:48:47 +0000 (09:48 -0700)]
qla2xxx: Fix sess_lock & hardware_lock lock order problem.

Orabug: 2684419726923029

The main lock that needs to be held for CMD or TMR submission
to upper layer is the sess_lock. The sess_lock is used to
serialize cmd submission and session deletion. The addition
of hardware_lock being held is not necessary. This patch removes
hardware_lock dependency from CMD/TMR submission.

Use hardware_lock only for error response in this case.

Path1
       CPU0                    CPU1
       ----                    ----
  lock(&(&ha->tgt.sess_lock)->rlock);
                               lock(&(&ha->hardware_lock)->rlock);
                               lock(&(&ha->tgt.sess_lock)->rlock);
  lock(&(&ha->hardware_lock)->rlock);

Path2/deadlock
*** DEADLOCK ***
Call Trace:
dump_stack+0x85/0xc2
print_circular_bug+0x1e3/0x250
__lock_acquire+0x1425/0x1620
lock_acquire+0xbf/0x210
_raw_spin_lock_irqsave+0x53/0x70
qlt_sess_work_fn+0x21d/0x480 [qla2xxx]
process_one_work+0x1f4/0x6e0

Cc: <stable@vger.kernel.org>
Cc: Bart Van Assche <Bart.VanAssche@sandisk.com>
Reported-by: Bart Van Assche <Bart.VanAssche@sandisk.com>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix inadequate lock protection for ABTS.
Quinn Tran [Wed, 15 Mar 2017 16:48:46 +0000 (09:48 -0700)]
qla2xxx: Fix inadequate lock protection for ABTS.

Orabug: 2684419726923029

Normally, ABTS is sent to Target Core as Task MGMT command.
In the case of error, qla2xxx needs to send response, hardware_lock
is required to prevent request queue corruption.

Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix request queue corruption.
Quinn Tran [Wed, 15 Mar 2017 16:48:45 +0000 (09:48 -0700)]
qla2xxx: Fix request queue corruption.

Orabug: 2684419726923029

When FW notify driver or driver detects low FW resource,
driver tries to send out Busy SCSI Status to tell Initiator
side to back off. During the send process, the lock was not held.

Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix memory leak for abts processing
Quinn Tran [Wed, 15 Mar 2017 16:48:44 +0000 (09:48 -0700)]
qla2xxx: Fix memory leak for abts processing

Orabug: 2684419726923029

Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoscsi: qla2xxx: Fix ql_dump_buffer
Joe Perches [Fri, 3 Mar 2017 01:14:47 +0000 (17:14 -0800)]
scsi: qla2xxx: Fix ql_dump_buffer

Orabug: 2684419726923029

Recent printk changes for KERN_CONT cause this logging to be defectively
emitted on multiple lines.  Fix it.

Also reduces object size a trivial amount.

$ size drivers/scsi/qla2xxx/qla_dbg.o*
   text    data     bss     dec     hex filename
  39125       0       0   39125    98d5 drivers/scsi/qla2xxx/qla_dbg.o.new
  39164       0       0   39164    98fc drivers/scsi/qla2xxx/qla_dbg.o.old

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoscsi: qla2xxx: Fix response queue count for Target mode.
Michael Hernandez [Wed, 15 Feb 2017 23:37:20 +0000 (15:37 -0800)]
scsi: qla2xxx: Fix response queue count for Target mode.

Orabug: 2684419726923029

Target mode initialization was not calculating response queue values
correctly resulting into one less MSI-X vector.

[mkp: fixed Fixes: hash]

Cc: <stable@vger.kernel.org>
Fixes: 093df73771ba ("scsi: qla2xxx: Fix Target mode handling with Multiqueue changes.")
Signed-off-by: Michael Hernandez <michael.hernandez@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoscsi: qla2xxx: Cleaned up queue configuration code.
Michael Hernandez [Wed, 15 Feb 2017 23:37:19 +0000 (15:37 -0800)]
scsi: qla2xxx: Cleaned up queue configuration code.

Orabug: 2684419726923029

This patch cleaned up queue configuration code, such that once
initialized, we should not touch msix_count value.  This will prevent
incorrect numbers of MSI-X vectors requested while performing target
mode configuration.

[mkp: fixed Fixes: hash]

Cc: <stable@vger.kernel.org>
Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.")
Signed-off-by: Michael Hernandez <michael.hernandez@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix a warning reported by the "smatch" static checker
Quinn Tran [Mon, 13 Feb 2017 20:18:29 +0000 (12:18 -0800)]
qla2xxx: Fix a warning reported by the "smatch" static checker

Orabug: 2684419726923029

Fix the following warning reported by the "smatch" static checker:

drivers/scsi/qla2xxx/qla_init.c:3910 qla2x00_alloc_fcport()
warn: use 'flags' here instead of GFP_XXX?

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Simplify usage of SRB structure in driver
Bart Van Assche [Wed, 13 Sep 2017 15:13:37 +0000 (20:43 +0530)]
qla2xxx: Simplify usage of SRB structure in driver

Orabug: 2684419726923029

This patch simplifies SRB structure usage in driver.

- Simplify sp->done() and sp->free() interfaces.
- Remove sp->fcport->vha to use vha pointer from sp.
- Use sp->vha context in qla2x00_rel_sp().

Signed-off-by: Joe Carnuccio <joe.carnuccio@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Simplify usage of SRB structure in driver
Joe Carnuccio [Wed, 13 Sep 2017 15:10:34 +0000 (20:40 +0530)]
qla2xxx: Simplify usage of SRB structure in driver

Orabug: 2684419726923029

This patch simplifies SRB structure usage in driver.

- Simplify sp->done() and sp->free() interfaces.
- Remove sp->fcport->vha to use vha pointer from sp.
- Use sp->vha context in qla2x00_rel_sp().

Signed-off-by: Joe Carnuccio <joe.carnuccio@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Improve RSCN handling in driver
Quinn Tran [Wed, 13 Sep 2017 14:51:46 +0000 (20:21 +0530)]
qla2xxx: Improve RSCN handling in driver

Orabug: 2684419726923029

Current code blindly does State Change Registration when
the link is up. Move SCR behind fabric scan, so that arbitrated
loop scan would not get erroneous error message.

Some of the other improvements are as follows

- Add session deletion for TPRLO and send acknowledgment for TPRLO.
- Enable FW option to move ABTS, RIDA & PUREX from RSPQ to ATIOQ.
- Save NPort ID early in link init.
- Move ABTS & RIDA to ATIOQ helps in keeping command ordering and
  link up sequence ordering.
- Save Nport ID and update VP map so that SCSI CMD/ATIO won't be dropped.
- fcport alloc does the initializes memory to zero. Remove memset to
  zero since It might corrupt link list.
- Turn off Registration for State Change MB in loop mode.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Add framework for async fabric discovery
Quinn Tran [Wed, 13 Sep 2017 14:12:24 +0000 (19:42 +0530)]
qla2xxx: Add framework for async fabric discovery

Orabug: 2684419726923029

Currently code performs a full scan of the fabric for
every RSCN. Its an expensive process in a noisy large SAN.

This patch optimizes expensive fabric discovery process by
scanning switch for the affected port when RSCN is received.

Currently Initiator Mode code makes login/logout decision without
knowledge of target mode. This causes driver and firmware to go
out-of-sync. This framework synchronizes both initiator mode
personality and target mode personality in making login/logout
decision.

This patch adds following capabilities in the driver

- Send Notification Acknowledgement asynchronously.
- Update session/fcport state asynchronously.
- Create a session or fcport struct asynchronously.
- Send GNL asynchronously. The command will ask FW to
  provide a list of FC Port entries FW knows about.
- Send GPDB asynchronously. The command will ask FW to
  provide detail data of an FC Port FW knows about or
  perform ADISC to verify the state of the session.
- Send GPNID asynchronously. The command will ask switch
  to provide WWPN for provided NPort ID.
- Send GPSC asynchronously. The command will ask switch
  to provide registered port speed for provided WWPN.
- Send GIDPN asynchronously. The command will ask the
  switch to provide Nport ID for provided WWPN.
- In driver unload path, schedule all session for deletion
  and wait for deletion to complete before allowing driver
  unload to proceed.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
[ bvanassche: fixed spelling in patch description ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Track I-T nexus as single fc_port struct
Quinn Tran [Wed, 13 Sep 2017 13:16:25 +0000 (18:46 +0530)]
qla2xxx: Track I-T nexus as single fc_port struct

Orabug: 2684419726923029

Current code merges qla_tgt_sess and fc_port structure
into single fc_port structure representing same I-T nexus.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
[ bvanassche: fixed spelling of patch description ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: introduce a private sess_kref
Christoph Hellwig [Wed, 13 Sep 2017 13:01:03 +0000 (18:31 +0530)]
qla2xxx: introduce a private sess_kref

Orabug: 2684419726923029

This stops abusing the common sess_kref to overload it for private
usage, which allows removing the shutdown_session method as well.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Use d_id instead of s_id for more clarity
Quinn Tran [Wed, 13 Sep 2017 12:05:18 +0000 (17:35 +0530)]
qla2xxx: Use d_id instead of s_id for more clarity

Orabug: 2684419726923029

Updated code with d_id from s_id for better readability and
clarity.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ bvanassche: fixed spelling of patch description ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix wrong argument in sp done callback
Quinn Tran [Fri, 20 Jan 2017 06:27:57 +0000 (22:27 -0800)]
qla2xxx: Fix wrong argument in sp done callback

Orabug: 2684419726923029

Callback for sp->done expects scsi_qla_host is passed in as argument,
Instead qla_hw_data is passed in.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Remove SRR code
Himanshu Madhani [Wed, 13 Sep 2017 12:01:17 +0000 (17:31 +0530)]
qla2xxx: Remove SRR code

Orabug: 2684419726923029

During initial implementation, tape support was included but not
enabled by default on target. So far, we don't see any target
customer requesting this support. Since this code is not being
used actively, we want to remove it and we will add back if there
are any request in future for SRR support.

Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Cleanup TMF code translation from qla_target
Quinn Tran [Fri, 20 Jan 2017 06:27:54 +0000 (22:27 -0800)]
qla2xxx: Cleanup TMF code translation from qla_target

Orabug: 2684419726923029

Move code code which converts Task Mgmt Command flags for
ATIO to TCM #defines, from qla2xxx driver to tcm_qla2xxx
driver.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Disable out-of-order processing by default in firmware
Quinn Tran [Sat, 24 Dec 2016 02:06:14 +0000 (18:06 -0800)]
qla2xxx: Disable out-of-order processing by default in firmware

Orabug: 2684419726923029

Out of order(OOO) processing requires initiator, switch
and target to support OOO. In today's environment, none
of the switches support OOO. OOO requires extra buffer
space which affect performance. By turning ON this feature
in QLogic's FW, it delays error recovery because dropped
frame is treated as out of order frame. We're turning OFF
this option of speed up error recovery.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ bvanassche: Fixed spelling in patch description ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix erroneous invalid handle message
Quinn Tran [Sat, 24 Dec 2016 02:06:13 +0000 (18:06 -0800)]
qla2xxx: Fix erroneous invalid handle message

Orabug: 2684419726923029

Termination of Immediate Notify IOCB was using wrong
IOCB handle. IOCB completion code was unable to find
appropriate code path due to wrong handle.

Following message is seen in the logs.

"Error entry - invalid handle/queue (ffff)."

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ bvanassche: Fixed word order in patch title ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Reduce exess wait during chip reset
Quinn Tran [Sat, 24 Dec 2016 02:06:12 +0000 (18:06 -0800)]
qla2xxx: Reduce exess wait during chip reset

Orabug: 2684419726923029

Soft reset and Risc reset should take 100uS to complete.
This change pad the timeout up to 400uS, which should be
plenty.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Terminate exchange if corrupted
Quinn Tran [Sat, 24 Dec 2016 02:06:11 +0000 (18:06 -0800)]
qla2xxx: Terminate exchange if corrupted

Orabug: 2684419726923029

Corrupted ATIO is defined as length of fcp_header & fcp_cmd
payload is less than 0x38. It's the minimum size for a frame to
carry 8..16 bytes SCSI CDB. The exchange will be dropped or
terminated if corrupted.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ bvanassche: Fixed spelling in patch title ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix crash due to null pointer access
Quinn Tran [Sat, 24 Dec 2016 02:06:10 +0000 (18:06 -0800)]
qla2xxx: Fix crash due to null pointer access

Orabug: 2684419726923029

During code inspection, while investigating following stack trace
seen on one of the test setup, we found out there was possibility
of memory leak becuase driver was not unwinding the stack properly.

This issue has not been reproduced in a test environment or on a
customer setup.

Here's stack trace that was seen.

[1469877.797315] Call Trace:
[1469877.799940]  [<ffffffffa03ab6e9>] qla2x00_mem_alloc+0xb09/0x10c0 [qla2xxx]
[1469877.806980]  [<ffffffffa03ac50a>] qla2x00_probe_one+0x86a/0x1b50 [qla2xxx]
[1469877.814013]  [<ffffffff813b6d01>] ? __pm_runtime_resume+0x51/0xa0
[1469877.820265]  [<ffffffff8157c1f5>] ? _raw_spin_lock_irqsave+0x25/0x90
[1469877.826776]  [<ffffffff8157cd2d>] ? _raw_spin_unlock_irqrestore+0x6d/0x80
[1469877.833720]  [<ffffffff810741d1>] ? preempt_count_sub+0xb1/0x100
[1469877.839885]  [<ffffffff8157cd0c>] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[1469877.846830]  [<ffffffff81319b9c>] local_pci_probe+0x4c/0xb0
[1469877.852562]  [<ffffffff810741d1>] ? preempt_count_sub+0xb1/0x100
[1469877.858727]  [<ffffffff81319c89>] pci_call_probe+0x89/0xb0

Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[ bvanassche: Fixed spelling in patch description ]
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Collect additional information to debug fw dump
Quinn Tran [Sat, 24 Dec 2016 02:06:09 +0000 (18:06 -0800)]
qla2xxx: Collect additional information to debug fw dump

Orabug: 2684419726923029

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Reset reserved field in firmware options to 0
Himanshu Madhani [Wed, 13 Sep 2017 11:05:26 +0000 (16:35 +0530)]
qla2xxx: Reset reserved field in firmware options to 0

Orabug: 2684419726923029

During NVRAM initialization in target mode, reset reserved
fields in firmware options to Zero (BIT 15)

Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Include ATIO queue in firmware dump when in target mode
Himanshu Madhani [Sat, 24 Dec 2016 02:06:06 +0000 (18:06 -0800)]
qla2xxx: Include ATIO queue in firmware dump when in target mode

Orabug: 2684419726923029

Include ATIO queue for ISP27XX when firmware dump is collected
for target mode.

Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix wrong IOCB type assumption
Quinn Tran [Sat, 24 Dec 2016 02:06:05 +0000 (18:06 -0800)]
qla2xxx: Fix wrong IOCB type assumption

Orabug: 2684419726923029

qlt_reset is called with Immedidate Notify IOCB only.
Current code wrongly cast it as ATIO IOCB.

Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Add DebugFS node for target sess list.
Quinn Tran [Thu, 4 Feb 2016 16:45:18 +0000 (11:45 -0500)]
qla2xxx: Add DebugFS node for target sess list.

Orabug: 2684419726923029

#cat  /sys/kernel/debug/qla2xxx/qla2xxx_31/tgt_sess
qla2xxx_31
Port ID   Port Name                Handle
ff:fc:01  21:fd:00:05:33:c7:ec:16  0
01:0e:00  21:00:00:24:ff:7b:8a:e4  1
01:0f:00  21:00:00:24:ff:7b:8a:e5  2
....

(Drop ->check_initiator_node_acl() parameter usage - nab)

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agotcm_qla2xxx: Convert to target_alloc_session usage
Nicholas Bellinger [Sat, 9 Jan 2016 14:47:58 +0000 (06:47 -0800)]
tcm_qla2xxx: Convert to target_alloc_session usage

Orabug: 2684419726923029

This patch converts existing qla2xxx target mode assignment
of struct qla_tgt_sess related sid + loop_id values to use
a callback via the new target_alloc_session API caller.

Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Use ATIO type to send correct tmr response
Swapnil Nagle [Thu, 4 Feb 2016 16:45:17 +0000 (11:45 -0500)]
qla2xxx: Use ATIO type to send correct tmr response

Orabug: 2684419726923029

The function value inside se_cmd can change if the TMR is cancelled.
Use original ATIO Type to correctly determine CTIO response.

Signed-off-by: Swapnil Nagle <swapnil.nagle@purestroage.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Fix TMR ABORT interaction issue between qla2xxx and TCM
Quinn Tran [Wed, 13 Sep 2017 11:28:12 +0000 (16:58 +0530)]
qla2xxx: Fix TMR ABORT interaction issue between qla2xxx and TCM

Orabug: 2684419726923029

During lun reset, TMR thread from TCM would issue abort
to qla driver.  At abort time, each command is in different
state.  Depending on the state, qla will use the TMR thread
to trigger a command free(cmd_kref--) if command is not
down at firmware.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Move atioq to a different lock to reduce lock contention
Quinn Tran [Wed, 13 Sep 2017 09:39:38 +0000 (15:09 +0530)]
qla2xxx: Move atioq to a different lock to reduce lock contention

Orabug: 2684419726923029

 99% of the time the ATIOQ has SCSI command.  The other 1% of time
 is something else.  Most of the time this interrupt does not need
 to hold the hardware_lock.  We're moving the ATIO interrupt thread
 to a different lock to reduce lock contention.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Remove dependency on hardware_lock to reduce lock contention.
Quinn Tran [Wed, 13 Sep 2017 09:22:40 +0000 (14:52 +0530)]
qla2xxx: Remove dependency on hardware_lock to reduce lock contention.

Orabug: 2684419726923029

 Sessions management (add, deleted, modify) currently are serialized
 through the hardware_lock.  Hardware_lock is a high traffic lock.
 This lock is accessed by both the transmit & receive sides.

 Sessions management is now moved off to another lock call sess_lock.
 This is done to reduce lock contention and increase traffic throughput.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Replace QLA_TGT_STATE_ABORTED with a bit.
Quinn Tran [Wed, 13 Sep 2017 09:15:40 +0000 (14:45 +0530)]
qla2xxx: Replace QLA_TGT_STATE_ABORTED with a bit.

Orabug: 2684419726923029

Replace QLA_TGT_STATE_ABORTED state with a bit because
the current state of the command is lost when an abort
is requested by upper layer.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Wait for all conflicts before ack'ing PLOGI
Alexei Potashnik [Wed, 13 Sep 2017 09:09:48 +0000 (14:39 +0530)]
qla2xxx: Wait for all conflicts before ack'ing PLOGI

Orabug: 2684419726923029

Until now ack'ing of a new PLOGI has only been delayed if there
was an existing session for the same WWN. Ack was released when
the session deletion completed.

If there was another WWN session with the same fc_id/loop_id pair
(aka "conflicting session"), PLOGI was still ack'ed immediately.
This potentially caused a problem when old session deletion logged
fc_id/loop_id out of FW after new session has been established.

Two work-arounds were attempted before:
1. Dropping PLOGIs until conflicting session goes away.
2. Detecting initiator being logged out of FW and issuing LOGO
to force re-login.

This patch introduces proper solution to the problem where PLOGI
is held until either existing session with same WWN or any
conflicting session goes away. Mechanism supports one session holding
two PLOGI acks as well as one PLOGI ack being held by many sessions.

Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Delete session if initiator is gone from FW
Alexei Potashnik [Wed, 13 Sep 2017 08:57:31 +0000 (14:27 +0530)]
qla2xxx: Delete session if initiator is gone from FW

Orabug: 2684419726923029

1. Initiator A is logged in with fc_id(1)/loop_id(1)
2. Initiator A re-logs in with fc_id(2)/loop_id(2)
3. Part of old session deletion async logoout for 1/1 is queued
4. Initiator B logs in with fc_id(1)/loop_id(1), starts
   passing data and creates session.
   5. Async logo from 3 is processed by DPC and sent to FW

   Now initiator B has the session but is logged out from FW.

   This condition is detected first with CTIO error 29 at which
   point we should delete current session. During session
   deletion we will send LOGO to initiator to force re-login.

   Under rare circumstances initiator might be logged out of FW,
   not have driver session, but still think it's logged in.
   E.g. the above sequence plus session deletion due to re-config.
   Incoming commands will fail to create local session because
   initiator is not found in FW. In this case we also issue LOGO
   to initiator to force him re-login.

   Finally this patch fixes exchange leak when commands where
   received in logged out state. In this case loop_id must be
   set to FFFF when corresponding exchange is terminated. The
   patch modifies exchange termination to always use FFFF,
   since in certain scenarios it's impossible to tell whether
   command was received in logged in or logged out state.

Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Added interface to send explicit LOGO.
Himanshu Madhani [Wed, 13 Sep 2017 08:52:04 +0000 (14:22 +0530)]
qla2xxx: Added interface to send explicit LOGO.

Orabug: 2684419726923029

This patch adds interface to send explicit LOGO
explicit LOGO using using ELS commands from driver.

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Add FW resource count in DebugFS.
Quinn Tran [Wed, 13 Sep 2017 08:49:03 +0000 (14:19 +0530)]
qla2xxx: Add FW resource count in DebugFS.

Orabug: 2684419726923029

DebugFS now will show fw_resource_count node.

FW Resource count

Original TGT exchg count[0]
current TGT exchg count[0]
original Initiator Exchange count[2048]
Current Initiator Exchange count[2048]
Original IOCB count[2078]
Current IOCB count[2067]
MAX VP count[254]
MAX FCF count[0]

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Enable Target counters in DebugFS.
Himanshu Madhani [Wed, 13 Sep 2017 08:44:19 +0000 (14:14 +0530)]
qla2xxx: Enable Target counters in DebugFS.

Orabug: 2684419726923029

Following counters are added in target mode to help debugging efforts.

Target Counters

qla_core_sbt_cmd = 0
qla_core_ret_sta_ctio = 0
qla_core_ret_ctio = 0
core_qla_que_buf = 0
core_qla_snd_status = 0
core_qla_free_cmd = 0
num alloc iocb failed = 0
num term exchange sent = 0
num Q full sent = 0

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: terminate exchange when command is aborted by LIO
Alexei Potashnik [Wed, 13 Sep 2017 08:26:25 +0000 (13:56 +0530)]
qla2xxx: terminate exchange when command is aborted by LIO

Orabug: 2684419726923029

The newly introduced aborted_task TFO callback has to terminate
exchange with QLogic driver, since command is being deleted and
no status will be queued to the driver at a later point.

This patch also moves the burden of releasing one cmd refcount to
the aborted_task handler.

Changed iSCSI aborted_task logic to satisfy the above requirement.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: drop cmds/tmrs arrived while session is being deleted
Alexei Potashnik [Tue, 14 Jul 2015 20:00:48 +0000 (16:00 -0400)]
qla2xxx: drop cmds/tmrs arrived while session is being deleted

Orabug: 2684419726923029

If a new initiator (different WWN) shows up on the same fcport, old
initiator's session is scheduled for deletion. But there is a small
window between it being marked with QLA_SESS_DELETION_IN_PROGRESS
and qlt_unret_sess getting called when new session's commands will
keep finding old session in the fcport map.

This patch drops cmds/tmrs if they find session in the progress of
being deleted.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: disable scsi_transport_fc registration in target mode
Alexei Potashnik [Tue, 14 Jul 2015 20:00:47 +0000 (16:00 -0400)]
qla2xxx: disable scsi_transport_fc registration in target mode

Orabug: 2684419726923029

There are multiple reasons for disabling this:

1. It provides no functional benefit. We pretty much only get a few more
sysfs entries for each port, but all that information is already
available from /sys/kernel/debug/target/qla-session-X

2. It already only works in private-loop mode. By disabling we'll be
getting more uniform behavior with fabric mode.

3. It creates complications for the new PLOGI handling mechanism:
scsi_transport_fc port deletion timer could race with new session
from initiator and cause logout after successful login.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: added sess generations to detect RSCN update races
Alexei Potashnik [Tue, 14 Jul 2015 20:00:46 +0000 (16:00 -0400)]
qla2xxx: added sess generations to detect RSCN update races

Orabug: 2684419726923029

RSCN processing in qla2xxx driver can run in parallel with ELS/IO
processing. As such the decision to remove disappeared fc port's
session could be stale, because a new login sequence has occurred
since and created a brand new session.

Previous mechanism of dealing with this by delaying deletion request
was prone to erroneous deletions if the event that was supposed to
cancel the deletion never arrived or has been delayed in processing.

New mechanism relies on a time-like generation counter to serialize
RSCN updates relative to ELS/IO updates.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Abort stale cmds on qla_tgt_wq when plogi arrives
Alexei Potashnik [Tue, 14 Jul 2015 20:00:45 +0000 (16:00 -0400)]
qla2xxx: Abort stale cmds on qla_tgt_wq when plogi arrives

Orabug: 2684419726923029

cancel any commands from initiator's s_id that are still waiting
on qla_tgt_wq when PLOGI arrives.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: delay plogi/prli ack until existing sessions are deleted
Alexei Potashnik [Tue, 14 Jul 2015 20:00:44 +0000 (16:00 -0400)]
qla2xxx: delay plogi/prli ack until existing sessions are deleted

Orabug: 2684419726923029

- keep qla_tgt_sess object on the session list until it's freed

- modify use of sess->deleted flag to differentiate delayed
  session deletion that can be cancelled from irreversible one:
  QLA_SESS_DELETION_PENDING vs QLA_SESS_DELETION_IN_PROGRESS

- during IN_PROGRESS deletion all newly arrived commands and TMRs will
  be rejected, existing commands and TMRs will be terminated when
  given by the core to the fabric or simply dropped if session logout
  has already happened (logout terminates all existing exchanges)

- new PLOGI will initiate deletion of the following sessions
  (unless deletion is already IN_PROGRESS):
  - with the same port_name (with logout)
  - different port_name, different loop_id but the same port_id
    (with logout)
  - different port_name, different port_id, but the same loop_id
    (without logout)

- additionally each new PLOGI will store imm notify iocb in the
  same port_name session being deleted. When deletion process
  completes this iocb will be acked. Only the most recent PLOGI
  iocb is stored. The older ones will be terminated when replaced.

- new PRLI will initiate deletion of the following sessions
  (unless deletion is already IN_PROGRESS):
  - different port_name, different port_id, but the same loop_id
   (without logout)

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: cleanup cmd in qla workqueue before processing TMR
Swapnil Nagle [Wed, 13 Sep 2017 08:02:42 +0000 (13:32 +0530)]
qla2xxx: cleanup cmd in qla workqueue before processing TMR

Orabug: 2684419726923029

Since cmds go into qla_tgt_wq and TMRs don't, it's possible that TMR
like TASK_ABORT can be queued over the cmd for which it was meant.
To avoid this race, use a per-port list to keep track of cmds that
are enqueued to qla_tgt_wq but not yet processed. When a TMR arrives,
iterate through this list and remove any cmds that match the TMR.
This patch supports TASK_ABORT and LUN_RESET.

Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Swapnil Nagle <swapnil.nagle@purestorage.com>
Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
Acked-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Add flush after updating ATIOQ consumer index.
Quinn Tran [Wed, 10 Jun 2015 15:05:19 +0000 (11:05 -0400)]
qla2xxx: Add flush after updating ATIOQ consumer index.

Orabug: 2684419726923029

After updating the consumer index of ATIO Q, a read is
required to flush the write to the adapter register.

Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Reviewed-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoqla2xxx: Enable target mode for ISP27XX
Himanshu Madhani [Wed, 10 Jun 2015 15:05:18 +0000 (11:05 -0400)]
qla2xxx: Enable target mode for ISP27XX

Orabug: 2684419726923029

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Reviewed-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>
7 years agoKVM: nVMX: Fix loss of L2's NMI blocking state
Wanpeng Li [Tue, 25 Jul 2017 10:40:46 +0000 (03:40 -0700)]
KVM: nVMX: Fix loss of L2's NMI blocking state

Run kvm-unit-tests/eventinj.flat in L1 w/ ept=0 on both L0 and L1:

Before NMI IRET test
Sending NMI to self
NMI isr running stack 0x461000
Sending nested NMI to self
After nested NMI to self
Nested NMI isr running rip=40038e
After iret
After NMI to self
FAIL: NMI

Commit 4c4a6f790ee862 ("KVM: nVMX: track NMI blocking state separately
for each VMCS") tracks NMI blocking state separately for vmcs01 and
vmcs02. However it is not enough:

 - The L2 (kvm-unit-tests/eventinj.flat) generates NMI that will fault
   on IRET, so the L2 can generate #PF which can be intercepted by L0.
 - L0 walks L1's guest page table and sees the mapping is invalid, it
   resumes the L1 guest and injects the #PF into L1.  At this point the
   vmcs02 has nmi_known_unmasked=true.
 - L1 sets set bit 3 (blocking by NMI) in the interruptibility-state field
   of vmcs12 (and fixes the shadow page table) before resuming L2 guest.
 - L1 executes VMRESUME to resume L2, causing a vmexit to L0
 - during VMRESUME emulation, prepare_vmcs02 sets bit 3 in the
   interruptibility-state field of vmcs02, but nmi_known_unmasked is
   still true.
 - L2 immediately exits to L0 with another page fault, because L0 still has
   not updated the NGVA->HPA page tables.  However, nmi_known_unmasked is
   true so vmx_recover_nmi_blocking does not do anything.

The fix is to update nmi_known_unmasked when preparing vmcs02 from vmcs12.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 2d6144e366fb39609aecf7a658e2e10af37627e9)
OraBug: 27031246 nested virt: L2 windows guest reboot hangs with L1 KVM hypervisor
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Tested-by: Xuan Bai <xuan.bai@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agoKVM: nVMX: track NMI blocking state separately for each VMCS
Paolo Bonzini [Fri, 14 Jul 2017 11:36:11 +0000 (13:36 +0200)]
KVM: nVMX: track NMI blocking state separately for each VMCS

vmx_recover_nmi_blocking is using a cached value of the guest
interruptibility info, which is stored in vmx->nmi_known_unmasked.
vmx_recover_nmi_blocking is run for both normal and nested guests,
so the cached value must be per-VMCS.

This fixes eventinj.flat in a nested non-EPT environment.  With EPT it
works, because the EPT violation handler doesn't have the
vmx->nmi_known_unmasked optimization (it is unnecessary because, unlike
vmx_recover_nmi_blocking, it can just look at the exit qualification).

Thanks to Wanpeng Li for debugging the testcase and providing an initial
patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
(cherry picked from commit 4c4a6f790ee862ee9f0dc8b35c71f55bcf792b71)
OraBug: 27031246 nested virt: L2 windows guest reboot hangs with L1 KVM hypervisor
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Tested-by: Xuan Bai <xuan.bai@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agoKVM: VMX: require virtual NMI support
Paolo Bonzini [Mon, 27 Mar 2017 12:37:28 +0000 (14:37 +0200)]
KVM: VMX: require virtual NMI support

Virtual NMIs are only missing in Prescott and Yonah chips.  Both are obsolete
for virtualization usage---Yonah is 32-bit only even---so drop vNMI emulation.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 2c82878b0cb38fd516fd612c67852a6bbf282003. It is a
partical cherry-pick in that PIN_BASED_VMX_PREEMPTION_TIMER in
setup_vmcs_config in file arch/x86/kvm/vmx.c has been omitted due to two things:
 - it being not required in the fix for bug 27031246 (which is about NMIs)
 - no need as we do not have commit 64672c95ea4c2f7096e519e826076867e8ef0938
   (kvm: vmx: hook preemption timer support) backported in UEK4.)
OraBug: 27031246 nested virt: L2 windows guest reboot hangs with L1 KVM hypervisor
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Tested-by: Xuan Bai <xuan.bai@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agoKVM: nVMX: Fix the NMI IDT-vectoring handling
Wanpeng Li [Thu, 22 Sep 2016 09:55:54 +0000 (17:55 +0800)]
KVM: nVMX: Fix the NMI IDT-vectoring handling

Run kvm-unit-tests/eventinj.flat in L1:

Sending NMI to self
After NMI to self
FAIL: NMI

This test scenario is to test whether VMM can handle NMI IDT-vectoring info correctly.

At the beginning, L2 writes LAPIC to send a self NMI, the EPT page tables on both L1
and L0 are empty so:

- The L2 accesses memory can generate EPT violation which can be intercepted by L0.

  The EPT violation vmexit occurred during delivery of this NMI, and the NMI info is
  recorded in vmcs02's IDT-vectoring info.

- L0 walks L1's EPT12 and L0 sees the mapping is invalid, it injects the EPT violation into L1.

  The vmcs02's IDT-vectoring info is reflected to vmcs12's IDT-vectoring info since
  it is a nested vmexit.

- L1 receives the EPT violation, then fixes its EPT12.
- L1 executes VMRESUME to resume L2 which generates vmexit and causes L1 exits to L0.
- L0 emulates VMRESUME which is called from L1, then return to L2.

  L0 merges the requirement of vmcs12's IDT-vectoring info and injects it to L2 through
  vmcs02.

- The L2 re-executes the fault instruction and cause EPT violation again.
- Since the L1's EPT12 is valid, L0 can fix its EPT02
- L0 resume L2

  The EPT violation vmexit occurred during delivery of this NMI again, and the NMI info
  is recorded in vmcs02's IDT-vectoring info. L0 should inject the NMI through vmentry
  event injection since it is caused by EPT02's EPT violation.

However, vmx_inject_nmi() refuses to inject NMI from IDT-vectoring info if vCPU is in
guest mode, this patch fix it by permitting to inject NMI from IDT-vectoring if it is
the L0's responsibility to inject NMI from IDT-vectoring info to L2.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Bandan Das <bsd@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
(cherry picked from commit c5a6d5f7faad8549bb5ff7e3e5792e33933c5b9f)
OraBug: 27031246 nested virt: L2 windows guest reboot hangs with L1 KVM hypervisor
Signed-off-by: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Tested-by: Xuan Bai <xuan.bai@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
7 years agoNFS: Add static NFS I/O tracepoints
Chuck Lever [Mon, 21 Aug 2017 19:00:49 +0000 (15:00 -0400)]
NFS: Add static NFS I/O tracepoints

Tools like tcpdump and rpcdebug can be very useful. But there are
plenty of environments where they are difficult or impossible to
use. For example, we've had customers report I/O failures during
workloads so heavy that collecting network traffic or enabling
RPC debugging are themselves onerous.

The kernel's static tracepoints are lightweight (less likely to
introduce timing changes) and efficient (the trace data is compact).
They also work in scenarios where capturing network traffic is not
possible due to lack of hardware support (some InfiniBand HCAs) or
where data or network privacy is a concern.

Introduce tracepoints that show when an NFS READ, WRITE, or COMMIT
is initiated, and when it completes. Record the arguments and
results of each operation, which are not shown by existing sunrpc
module's tracepoints.

For instance, the recorded offset and count can be used to match an
"initiate" event to a "done" event. If an NFS READ result returns
fewer bytes than requested or zero, seeing the EOF flag can be
probative. Seeing an NFS4ERR_BAD_STATEID result is also indication
of a particular class of problems. The timing information attached
to each event record can often be useful as well.

Usage example:

[root@manet tmp]# trace-cmd record -e nfs:*initiate* -e nfs:*done
/sys/kernel/debug/tracing/events/nfs/*initiate*/filter
/sys/kernel/debug/tracing/events/nfs/*done/filter
Hit Ctrl^C to stop recording
^CKernel buffer statistics:
  Note: "entries" are the entries left in the kernel ring buffer and are not
        recorded in the trace data. They should all be zero.

CPU: 0
entries: 0
overrun: 0
commit overrun: 0
bytes: 3680
oldest event ts:    78.367422
now ts:   100.124419
dropped events: 0
read events: 74

... and so on.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
(cherry picked from commit 8224b2734ab1da4996b851e1e5d3047e7a0df499)

orabug: 26923332
Signed-off-by: Manjunath Patil <manjunath.b.patil@oracle.com>
Reviewed-by: John Sobecki <john.sobecki@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>