scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN

Orabug: 27631736

pt2pt ndlp ref count prematurely goes to 0. There was reference removed
that should only be removed if connected to a switch, not if in
point-to-point mode.

Add a mode check before the reference remove.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit b7e50c536e8e4c6d4c74a1d54a0ce33edbf9dd0a)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Linux LPFC driver does not process all RSCNs

Orabug: 27631736

During RSCN storms, the driver does not rediscover some targets.  The
driver marks some RSCN as to be handled after the ones it's working
on. The driver missed processing some deferred RSCN.

Move where the driver checks for deferred RSCNs and initiate deferred
RSCN handling if the flag was set. Also revise nport state within the
RSCN confirm routine. Add some state data to a possible debug print to
aid future debugging.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 4938250ebdb89bd7ed9e4735ac705403fcd1e832)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Driver fails to detect direct attach storage array

Orabug: 27631736

The driver does not respond to PLOGI from the direct attach target.  The
driver uses incorrect S_ID in CONFIG_LINK, after FLOGI completion

Correct by issuing CONFIG_LINK with the correct S_ID after receiving the
PLOGI from the target

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit d33d0eb28b883b09a48a7d608640e9aeecd9edbf)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix crash after bad bar setup on driver attachment

Orabug: 27631736

In test cases where an instance of the driver is detached and
reattached, the driver will crash on reattachment. There is a compound
if statement that will skip over the bar setup if the pci_resource_start
call is not successful. The driver erroneously returns success to its
bar setup in this scenario even though the bars aren't properly
configured.

Rework the offending code segment for proper initialization steps.  If
the pci_resource_start call fails, -ENOMEM is now returned.

Sample stack:

rport-5:0-10: blocked FC remote port time out: removing rport
BUG: unable to handle kernel NULL pointer dereference at           (null)
... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc]
...
...  RIP: 0010:...  ... lpfc_sli4_wait_bmbx_ready+0x32/0x70 [lpfc]
 Call Trace:
  ... lpfc_sli4_post_sync_mbox+0x106/0x4d0 [lpfc]
  ... ? __alloc_pages_nodemask+0x176/0x420
  ... ? __kmalloc+0x2e/0x230
  ... lpfc_sli_issue_mbox_s4+0x533/0x720 [lpfc]
  ... ? mempool_alloc+0x69/0x170
  ... ? dma_generic_alloc_coherent+0x8f/0x140
  ... lpfc_sli_issue_mbox+0xf/0x20 [lpfc]
  ... lpfc_sli4_driver_resource_setup+0xa6f/0x1130 [lpfc]
  ... ? lpfc_pci_probe_one+0x23e/0x16f0 [lpfc]
  ... lpfc_pci_probe_one+0x445/0x16f0 [lpfc]
  ... local_pci_probe+0x45/0xa0
  ... work_for_cpu_fn+0x14/0x20
  ... process_one_work+0x17a/0x440

Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit e4b9794efdce13242f4af6682f3ed48ce3864a87)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix hard lock up NMI in els timeout handling.

Orabug: 27631736

System crashed due to a hard lockup at lpfc_els_timeout_handler+0x128.

The els ring's txcmplq list is corrupted: the last element in the list
does not point back the the head causing a loop. Issue is the els
processing path for sli4 hbas are using the hbalock instead of the
ring_lock for removing elements from the txcmplq list.

Use the adapter SLI_REV to determine which lock should be used for
removing iocbqs from the els rings txcmplq.

note: the future refactoring will address this so that we don't have
this ugly type-based lock code.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 341b2aa83368e6f23bf0cc3d04604896337ad7cb)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: change version to 11.4.0.4

Orabug: 27631736

Change version to 11.4.0.4

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit f6cab3452b8297cef628f2e9ecb4d0bd2b6b76dc)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Extend RDP support

Orabug: 27631736

Support RDP and Multiple Frames

If the remote Nport is not logged in, the driver would not populate all
the descriptors in the RDP response payload. Doing so would create a
payload length that requires multiple frames due to exceeding the
default rx buffer size without an explicit login. Currently FC-LS
explicitly states the RDP response must be a single frame sequence.
Thus we did not violate the standard.

Recently, a modification to FC-LS was accepted which allows multi-frame
sequences and all vendors have indicated they are interoperable with the
change. As such, extend RDP support with the additional fields and send
a multi-frame sequence.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 6ad8c07a2f54eb7b06789d65fe4c1f08849e0b36)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix secure firmware updates

Orabug: 27631736

Firmware update fails with: status x17 add_status x56 on the final write

If multiple DMA buffers are used for the download, some firmware revs
have difficulty with signatures and crcs split across the dma buffer
boundaries.  Resolve by making all writes be a single 4k page in length.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 184fc2b9a8bcbda9c14d0a1e7fbecfc028c7702e)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: PLOGI failures during NPIV testing

Orabug: 27631736

Local Reject/Invalid RPI errors seen during discovery.

Temporary RPI cleanup was occurring regardless of SLI rev. It's only
necessary on SLI-4.

Adjust the test for whether cleanup is necessary.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit e8bcf0ae4c0346fdc78ebefe0eefcaa6a6622d38)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix crash receiving ELS while detaching driver

Orabug: 27631736

The driver crashes when attempting to use a freed ndpl pointer.

The pci_remove_one handler runs on a separate kernel thread. The order
of the removal is starting by freeing all of the ndlps and then
disabling interrupts. In between these two events the driver can still
receive an ELS and process it. When it tries to use the ndlp pointer
will be NULL

Change the order of the pci_remove_one vs disable interrupts so that
interrupts are disabled before the ndlp's are freed.

Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 1234a6d54fed8a00091968c4eb2fb52e1cbb8e2e)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc_attr.c
the lpfc_phba_els_ring routine was put in with nvme,
i removed those references.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: fix pci hot plug crash in list_add call

Orabug: 27631736

During pci hot plug, the kernel crashes in a list_add_call

The lookup by tag function will return null if the IOCB is out of range
or does not have the on txcmplq flag set.

Fix: Check for null return from lookup by tag.

Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 401bb4169da655f3e5d28d0b208182e1ab60bf2a)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: fix pci hot plug crash in timer management routines

Orabug: 27631736

During pci hot plug, the kernel crashes in timer management code.

The sli4 remove_one handler is not stoping the timers as it starts to
remove the port so that it can be swapped.

Fix: Stop the timers early in the handler routine.

Note: Fix in SLI-4 only. SLI-3 already stopped the timers properly.

Cc: <stable@vger.kernel.org> # 4.12+
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 1901762f2ca2747ed269239ca5332a8023ce4e3d)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: remove redundant null check on eqe

Orabug: 27631736

The pointer eqe is always non-null inside the while loop, so the check
to see if eqe is NULL is redudant and hence can be removed.

Detected by CoverityScan CID#1248693 ("Logically Dead Code")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 858e51e8cbe11a8c59b24aaf4cb40f7f4e7a2feb)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc_sli.c
Base nvme patch
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: lpfc version bump 11.4.0.3

Orabug: 27631736

Update driver version to 11.4.0.3

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 610448367c8232b951df19136e439558c618fd41)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc_version.h
The last update I gave to UEK was 11.4.0.2 which was
equiv to 11.4.0.1, now the upstream version are sequential.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: fix "integer constant too large" error on 32bit archs

Orabug: 27631736

cc1: warnings being treated as errors
drivers/scsi/lpfc/lpfc_init.c: In function 'lpfc_get_wwpn':
drivers/scsi/lpfc/lpfc_init.c:3253: error: integer constant is too large for 'long' type

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 286871a6667c3d4d27a4cf1ee519e629527dfc9d)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc_init.c
base nvme changes included msi.h and caused patch to
not align.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Add Buffer to Buffer credit recovery support

Orabug: 27631736

Add Buffer to buffer credit recovery support to the driver.  This is a
negotiated feature with the peer that allows for both sides to detect
dropped RRDY's and FC Frames and recover credit.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 44fd7fe3dd2ce9dba873a0522e1eeab9ab5d5651)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc.h
drivers/scsi/lpfc/lpfc_attr.c
drivers/scsi/lpfc/lpfc_els.c
drivers/scsi/lpfc/lpfc_sli4.h
Without the base nvme patch these all had to be modifed.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Correct issues with FAWWN and FDISCs

Orabug: 27631736

When using fabric-assigned WWNs, the switch doesn't like copy of the
FLOGI payload, which includes valid VVL bits, to be used as the FDISC
payload.

Rather than wait for corrected switch firmware, ensure the VVL bits are
marked invalid on FDISCs.

[mkp: typo]

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 176de5bb20271089d2ab120bb7737b66acc3c000)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
 Conflicts:
drivers/scsi/lpfc/lpfc_els.c
The vendorVerison is defined in a union with some
nvme structs, I omitted taking the nvme code.
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix rediscovery on switch blade pull

Orabug: 27631736

When the switch blade is pulled out then plugged back in, the driver
does not issue a PLOGI to the target

When the switch blade is pulled out, it does not reset the link. The
driver ends up issuing a LOGO to the target, and finally sees devloss.
Since the driver believes that a LOGO is outstanding, it does not issue
a PLOGI to the target upon link up

Correct by placing the ndlp in UNUSED state When devloss happens in
LOGO_ISSUE state.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit d2aa48761e4f102b672e9ff1b6c8d26af782b286)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: remove useless code in lpfc_sli4_bsg_link_diag_test

Orabug: 27631736

Remove variable assignments. The value stored in local variable _rc_ is
overwritten at line 2448:rc = lpfc_sli4_bsg_set_link_diag_state(phba,
0); before it can be used.

Addresses-Coverity-ID: 1226935
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 44ed33e6c5d58342a9bc86172ad121c0687bb890)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

scsi: lpfc: Fix plogi collision that causes illegal state transition

Orabug: 27631736

Message "0271 Illegal State Transition: node" seen in logs, all luns are
unuseable for that target.

A window exists in the rcv_plogi path where if the state is plogi issue
but the driver has not issued a plogi, then two reglogins will be sent
for the same RPI. The first one to complete will advance the state to
prli issue the second one will be detected as an illegal state, and
leave the node in an unusable state.

Correct the completion routine for the PLOGI ACC that detects the state
change when the driver starts discovery on the node again and drop the
REGLOGIN mailbox command.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 1fe68477d235e42fb2613d01837d49545408c622)
Signed-off-by: Dick dkennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

lpfc: Fix Express lane queue creation

Orabug: 27631736

Message-id: <1494926876-21744-4-git-send-email-mlombard@redhat.com>
Patchwork-id: 178390
O-Subject: [RHEL7.4 e-stor PATCH 3/3] Fix Express lane queue creation.
Bugzilla: 1451022
RH-Acked-by: Tomas Henzl <thenzl@redhat.com>
RH-Acked-by: Ewan Milne <emilne@redhat.com>
From: James Smart <jsmart2021@gmail.com>

The older sli4 adapters only supported the 64 byte WQE entry size.
The new adapter (fw) support both 64 and 128 byte WQE entry sizies.
The Express lane WQ was not being created with the 128 byte WQE sizes
when it was supported.

Not having the right WQE size created for the express lane work queue
caused the the firmware to overwrite the lun indentifier in the FCP header.

This patch correctly creates the express lane work queue with the
supported size.

Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
(cherry picked from commit 7e04e21afa82ef024416f5413b5bdb66e0505bcd)
Signed-off-by: Rafael Aquini <aquini@redhat.com>
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Jack Vogel <jack.vogel@oracle.com>

Cosmetic updates to arch/x86/kernel/cpu/microcode/xen.c
to pass checkpatch.pl and match UEK5 code.

Orabug: 27640697

Signed-off-by: Aaron Young <aaron.young@oracle.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>

Incorporate arch/x86/kernel/cpu/microcode/xen.c into cpu microcode driver.

Update arch/x86/kernel/cpu/microcode/xen.c so it will compile including:
1. Use to use new/up-to-date HYPERVISOR_platform_op() and
   request_firmware_direct() interfaces.
2. Fix function parameters to match prototypes.

Orabug: 27640697

Signed-off-by: Aaron Young <aaron.young@oracle.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>

1. Move arch/x86/kernel/microcode_xen.c file to proper cpu microcode driver
   location and rename to arch/x86/kernel/cpu/microcode/xen.c.

2. Remove redundant/orphaned arch/x86/kernel/microcode_core.c file.

Orabug: 27640697

Signed-off-by: Aaron Young <aaron.young@oracle.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>

fork: fix incorrect fput of ->exe_file causing use-after-free

Commit 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for
write killable") made it possible to kill a forking task while it is
waiting to acquire its ->mmap_sem for write, in dup_mmap().

However, it was overlooked that this introduced an new error path before
a reference is taken on the mm_struct's ->exe_file.  Since the
->exe_file of the new mm_struct was already set to the old ->exe_file by
the memcpy() in dup_mm(), it was possible for the mmput() in the error
path of dup_mm() to drop a reference to ->exe_file which was never
taken.

This caused the struct file to later be freed prematurely.

Fix it by updating mm_init() to NULL out the ->exe_file, in the same
place it clears other things like the list of mmaps.

This bug was found by syzkaller.  It can be reproduced using the
following C program:

    #define _GNU_SOURCE
    #include <pthread.h>
    #include <stdlib.h>
    #include <sys/mman.h>
    #include <sys/syscall.h>
    #include <sys/wait.h>
    #include <unistd.h>

    static void *mmap_thread(void *_arg)
    {
        for (;;) {
            mmap(NULL, 0x1000000, PROT_READ,
                 MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
        }
    }

    static void *fork_thread(void *_arg)
    {
        usleep(rand() % 10000);
        fork();
    }

    int main(void)
    {
        fork();
        fork();
        fork();
        for (;;) {
            if (fork() == 0) {
                pthread_t t;

                pthread_create(&t, NULL, mmap_thread, NULL);
                pthread_create(&t, NULL, fork_thread, NULL);
                usleep(rand() % 10000);
                syscall(__NR_exit_group, 0);
            }
            wait(NULL);
        }
    }

No special kernel config options are needed.  It usually causes a NULL
pointer dereference in __remove_shared_vm_struct() during exit, or in
dup_mmap() (which is usually inlined into copy_process()) during fork.
Both are due to a vm_area_struct's ->vm_file being used after it's
already been freed.

Google Bug Id: 64772007

Link: http://lkml.kernel.org/r/20170823211408.31198-1-ebiggers3@gmail.com
Fixes: 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for write killable")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org> [v4.7+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 2b7e8665b4ff51c034c55df3cff76518d1a9ee3a)

Orabug: 27648200
CVE: CVE-2017-17052

Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
Reviewed-by: Tim Tianyang Chen <tianyang.chen@oracle.com>

scsi: megaraid_sas: Do not use 32-bit atomic request descriptor for Ventura controllers

Problem Statement: Sending I/O through 32 bit descriptors to Ventura series of
controller results in IO timeout on certain conditions.

This error only occurs on systems with high I/O activity on Ventura series
controllers.

Changes in this patch will prevent driver from using 32 bit descriptor and use
64 bit Descriptors.

Cc: <stable@vger.kernel.org>
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: NVMe passthrough command support

NVMe passthrough via MFI interface. Current MegaRAID product supports
different types of encapsulation via the MFI framework.

NVMe native command should be framed by application and it should be
embedded in MFI as payload. The driver will provide interface to send
the MFI frame along with the payload (in this case, payload is NVMe
native command) to the firmware. Driver already has an existing, similar
interface for SATA and SMP passthrough.

1. Driver will pass MFI command to the firmware if the latter supports
   NVMe encapsulated processing (not all SAS3.5 firmware supports this
   feature).

2. Driver exposes sysfs entry support_nvme_encapsulation. This is
   required for backward compatibility for applications using earlier
   driver versions that did not process IOCTL frames and could result in
   host hang.

   This is already fixed as part of commit 82add4e1b354 ("scsi:
   megaraid_sas: Incorrect processing of IOCTL frames for SMP/STP
   commands")

[mkp: clarified commit message]

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid: use ktime_get_real for firmware time

do_gettimeofday() overflows in 2038 on 32-bit architectures and is
deprecated, so convert this driver to call ktime_get_real()
directly. This also simplifies the calculation.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: driver version upgrade

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: re-work DCMD refire code

No functional changes.

This patch is a re-work of DCMD refire code to better manage all the
different cases to decide whether to REFIRE or SKIP or COMPLETE certain
DCMD.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Expose fw_cmds_outstanding through sysfs

Expose FW outstanding commands (fw_outstanding) through sysfs interface.
This helps in debugging certain performance issues in the field.

Signed-off-by: Sasikumar Chandrasekaran <sasikumar.pc@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Selectively apply stream detection based on IO type

Performance improvement:

Current driver calls stream detection unconditionally for all IOs.
Stream Detection logic is not required for most of the fast path IO. To
improve performance, avoid stream detection logic and do it only if
required.

Below are the cases where stream detection is required in driver:

1. All non-FastPath IOs (IOs going to FW)
2. Fast Path reads sent to ReadAhead capable VDs.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Update LD map after populating drv_map driver map copy

Issue – There may be some IO accessing incorrect raid map, but driver
has checks in IO path to handle those cases. It is always better to move
to new raid map only once raid map is populated and validated.  No
functional defect. Fix is provided as part of review.  Fix – Update
instance->map_id after driver has populated new driver raid map from
firmware raid map.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Use megasas_wait_for_adapter_operational to detect controller state in IOCTL path

In IOCTL path, re-use megasas_wait_for_adapter_operational API to detect
controller state. This will make driver to use this API uniformly in all
cases where we need to wait for adapter to become operational.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Avoid firing DCMDs while OCR is in progress

Driver needs to avoid PCI writes while OCR is in progress.  Use
reset_mutex to synchronize between firing DCMDs MR_DCMD_PD_GET_INFO and
MR_DCMD_DRV_GET_TARGET_PROP while OCR is triggered.  Without this fix,
if Device/VD add/creation is in progress and at the same time MR
Firmware is going through OCR, user may see OCR never completed and it
may need system reboot.  This scenario is rare to occur. Fix is provided
as part of review.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: unload flag should be set after scsi_remove_host is called

Issue - Driver returns DID_NO_CONNECT when unload is in progress,
indicated using instance->unload flag. In case of dynamic unload of
driver, this flag is set before calling scsi_remove_host(). While doing
manual driver unload, user will see lots of prints for Sync Cache
command with DID_NO_CONNECT status.

Fix - Set the instance->unload flag after scsi_remove_host(). Allow
device removal process to be completed and do not block any command
before that.  SCSI commands (like SYNC_CACHE) are received (as part of
scsi_remove_host) by driver during unload will be submitted further down
to the drives.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map

Currently driver does not validate ldcount provided by firmware.  If the
value is invalid, fail RAID map validation accordingly.  This issue is
rare to hit in field and is fixed as part of code review.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Reset ldio_outstanding in megasas_resume

Rebased patch for UEK kernel.

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Return the DCMD status from megasas_get_seq_num

In megasas_get_seq_num, the status of the DCMD fired to FW is not
returned, it always returns success.  We could end up registering AEN
request with incorrect sequence number if the DCMD failed.  Return the
DCMD status back to caller.  This was discovered during code review and
very rare to see issue in field to see AEN request failed bt FW.

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: memset IOC INIT frame using correct size

Commit b9637d14dc00 ("scsi: megaraid_sas: Resize MFA frame used for IOC
INIT to 4k") increased the size of IOC INIT frame to 4k.  Need to use
updated size when memsetting init_frame.

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: zero out IOC INIT and stream detection memory

Memory allocated for IOC_INIT command and stream detection array are not
zero'd before using. Use kzalloc instead of kmalloc to zero out the
memory allocated.

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: fix spelling mistake: "thershold" -> "threshold"

Trivial fix to spelling mistake in dev_info message

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid: Remove redundant code in megasas_alloc_cmds

megasas_alloc_cmds is to alloc cmd_list of instance instead of fusion,
and fusion is useless in this function. Just remove it.

Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.

By default all files without license information are under the default
license of the kernel, which is GPL version 2.

Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier.  The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.

This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.

How this work was done:

Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
 - file had no licensing information it it.
 - file was a */uapi/* one with no licensing information in it,
 - file was a */uapi/* one with existing licensing information,

Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.

The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne.  Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.

The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed.  Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.

Criteria used to select files for SPDX license identifier tagging was:
 - Files considered eligible had to be source code files.
 - Make and config files were included as candidates if they contained >5
   lines of source
 - File already had some variant of a license header in it (even if <5
   lines).

All documentation files were explicitly excluded.

The following heuristics were used to determine which SPDX license
identifiers to apply.

 - when both scanners couldn't find any license traces, file was
   considered to have no license information in it, and the top level
   COPYING file license applied.

   For non */uapi/* files that summary was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0                                              11139

   and resulted in the first patch in this series.

   If that file was a */uapi/* path one, it was "GPL-2.0 WITH
   Linux-syscall-note" otherwise it was "GPL-2.0".  Results of that was:

   SPDX license identifier                            # files
   ---------------------------------------------------|-------
   GPL-2.0 WITH Linux-syscall-note                        930

   and resulted in the second patch in this series.

 - if a file had some form of licensing information in it, and was one
   of the */uapi/* ones, it was denoted with the Linux-syscall-note if
   any GPL family license was found in the file or had no licensing in
   it (per prior point).  Results summary:

   SPDX license identifier                            # files
   ---------------------------------------------------|------
   GPL-2.0 WITH Linux-syscall-note                       270
   GPL-2.0+ WITH Linux-syscall-note                      169
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause)    21
   ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)    17
   LGPL-2.1+ WITH Linux-syscall-note                      15
   GPL-1.0+ WITH Linux-syscall-note                       14
   ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause)    5
   LGPL-2.0+ WITH Linux-syscall-note                       4
   LGPL-2.1 WITH Linux-syscall-note                        3
   ((GPL-2.0 WITH Linux-syscall-note) OR MIT)              3
   ((GPL-2.0 WITH Linux-syscall-note) AND MIT)             1

   and that resulted in the third patch in this series.

 - when the two scanners agreed on the detected license(s), that became
   the concluded license(s).

 - when there was disagreement between the two scanners (one detected a
   license but the other didn't, or they both detected different
   licenses) a manual inspection of the file occurred.

 - In most cases a manual inspection of the information in the file
   resulted in a clear resolution of the license that should apply (and
   which scanner probably needed to revisit its heuristics).

 - When it was not immediately clear, the license identifier was
   confirmed with lawyers working with the Linux Foundation.

 - If there was any question as to the appropriate license identifier,
   the file was flagged for further research and to be revisited later
   in time.

In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.

Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights.  The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.

Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.

In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.

Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
 - a full scancode scan run, collecting the matched texts, detected
   license ids and scores
 - reviewing anything where there was a license detected (about 500+
   files) to ensure that the applied SPDX license was correct
 - reviewing anything where there was no detection but the patch license
   was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
   SPDX license was correct

This produced a worksheet with 20 files needing minor correction.  This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.

These .csv files were then reviewed by Greg.  Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected.  This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.)  Finally Greg ran the script using the .csv files to
generate the patches.

Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: driver version upgrade

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Add support for 64bit consistent DMA

The latest MegaRAID Firmware (for Invader series) has support for 64bit
DMA for both streaming and consistent DMA buffers.  All Ventura series
controller FW always support 64 bit consistent DMA.  Also, on a few
architectures 32bit DMA is not supported.

Current driver always prefers 32bit for consistent DMA and 64bit for
streaming DMA.  This behavior was unintentional and carried forwarded
from legacy controller FW. Need to enhance the driver to support 64bit
consistent DMA buffers based on the firmware capability.

Below is the DMA setting strategy in driver with this patch.  For
Ventura series, always try to set 64bit DMA mask. If it fails fall back
to 32bit DMA mask.  For Invader series and earlier generation
controllers, first try to set to 32bit consistent DMA mask irrespective
of FW capability. This is needed to ensure firmware downgrades do not
break. If 32bit DMA setting fails, check FW capability and try seting to
64bit DMA mask.

There are certain restrictions in the hardware for having all sense
buffers and all reply descriptors to be in the same 4GB memory region.
This limitation is h/w dependent and can not be changed in firmware.
This limitation needs to be taken care in driver while allocating the
buffers.  There was a discussion regarding this - find details at below
link.  https://www.spinics.net/lists/linux-scsi/msg108251.html

Rebased this patch for UEK kernel.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Do not limit queue_depth to 1k in non-RDPQ mode

Driver load fails if memory allocation for request frame pool fails due
to the higher queue_depth requirement. The driver now allows dynamically
reducing queue_depth if memory allocations fail rather than failing
load.  With this, there is no need to limit queue_depth to 1K.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Retry with reduced queue depth when alloc fails for higher QD

In certain cases, the host memory is limited and with FW supporting
higher queue depths there are increasing chances of IO request frame
allocation failures that we are seeing. In case of request frame
allocation failures, retry allocation with reduced queue depth (in steps
of 64) to continue to configure the controller with a reduced
performance rather than failing load.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Incorrect processing of IOCTL frames for SMP/STP commands

cmd->frame->dcmd.opcode will be valid only for MFI_CMD_DCMD
IOCTL frames. Currently driver check for cmd->frame->dcmd.opcode without
checking cmd type. Ensure we check dcmd opcode only for MFI_CMD_DCMD
commands. Separate handling of MFI_CMD_SMP/STP commands from
MFI_CMD_DCMD in completion path.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Resize MFA frame used for IOC INIT to 4k

Older firmware version unconditionally pulls 4k frame for IOC INIT MFA
frame.  But driver allocates 1k or 4k max_chain_frame_sz based on FW
capability.  During boot time, this results in DMA read errors.
Workaround fix in driver by allocating separate ioc_init frame of 4k
size to support older firmware.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Update current host time to FW during IOC Init

Driver needs to send current host time to firmware during init.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Move controller memory allocations and DMA mask settings from probe to megasas_init_fw

Rebased patch for UEK kernel.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Move initialization of instance parameters inside newly created function megasas_init_ctrl_params

Code refactoring, no functional change. Create new function to
initialize all the controller parameters during load time.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: remove instance->ctrl_info

Re-use the pre-allocated ctrl_info DMA buffer.

Rebased patch for UEK kernel.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Pre-allocate frequently used DMA buffers

Pre-allocate few of the frequently used DMA buffers during load time.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Create separate functions for allocating and freeing controller DMA buffers

Code refactoring - create separate functions to allocate and free
controller DMA buffers.

Rebased for UEK kernel.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Create separate functions to allocate ctrl memory

No functional change. Code refactoring to improve readability.  Move the
code to allocate and free controller memory into separate functions.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: reduce size of fusion_context and use kmalloc for allocation

fusion_context structure is very large around 180kB and most of the size
is contributed by log_to_span array. Move log_to_span out of fusion
context and have separate allocation for log_to_span. And use kmalloc to
allocate fusion_context.  Currently kmemleak reports 1000s of false
positives for fusion->cmd_list[]. kmemleak does not track page
allocation for fusion_context. This change will also fix the false
positives reported by kmemleak.

Ref: https://marc.info/?l=linux-scsi&m=150545293900917

Rebased for UEK kernel.

Reported-by: Shu Wang <shuwang@redhat.com>
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: replace is_ventura with adapter_type checks

No functional change.

Rebased for UEK kernel.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Remove redundant checks for ctrl_context

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: replace instance->ctrl_context checks with instance->adapter_type

Increase code readability. No functional change.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Add support for Crusader controllers

Add support for PCI VID/DID 0x1000/0x0015 based MegaRAID controllers.
Since the DID 0x0015 conflicts with DELL PERC5 controllers,
add vendor ID based check specific for DELL PERC5.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: use adapter_type for all gen controllers

No functional change.
Refactor adapter_type to set for all generation controllers, not
just for fusion controllers.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: driver version upgrade

Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: call megasas_dump_frame with correct IO frame size

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: modified few prints in OCR and IOC INIT path

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: replace internal FALSE/TRUE definitions with false/true

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead

After a kill adapter, since the cmd_status is not set, the IOCTLs will
be hung in driver resulting in application hang.  Set cmd_status
MFI_STAT_WRONG_STATE when completing pended IOCTLs.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: use vmalloc for crash dump buffers and driver's local RAID map

Driver's local RAID map is accessed frequently. We will first try to get
memory from __get_free_pages. If this fails, fall back to using vmalloc.
For crash dump buffers always prefer vmalloc.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Use SMID for Task abort case only

In TM code, smid_task is valid only in case of task aborts.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Check valid aen class range to avoid kernel panic

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Fix endianness issues in DCMD handling

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Do not re-fire shutdown DCMD after OCR

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Call megasas_complete_cmd_dpc_fusion every 1 second while there are pending commands

megasas_wait_for_outstanding_fusion checks for pending commands every 1
second. But megasas_complete_cmd_dpc_fusion is only called every 5
seconds.  If the commands are already completed by firmware, there is an
additional delay of 5 seconds before driver will process completion for
these commands.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: Use synchronize_irq in target reset case

Similar to task abort case, use synchronize_irq API in target reset
case.  Also, remove redundant call to megasas_complete_cmd_dpc_fusion
after calling megasas_sync_irqs in task abort case.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: set minimum value of resetwaittime to be 1 secs

Setting resetwaittime to 0 during a FW fault will result in driver not
calling the OCR.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command

Driver allocated 256 byte MFI frames bytes but while sending MFI frame
(embedded inside chain frame of MPT frame) to firmware, driver sets the
length as 4k. This results in DMA read error messages during boot.

Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: fix error handle in megasas_probe_one

megasas_mgmt_info.max_index has increased by 1 before megasas_io_attach,
if megasas_io_attach return error, then goto fail_io_attach,
megasas_mgmt_info.instance has a wrong index here. So first reduce
max_index and then set that instance to NULL.

Signed-off-by: weiping zhang <zhangweiping@didichuxing.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: fix allocate instance->pd_info twice

fix allocate instance->pd_info twice which was introduced by 96188a89cc6d.

Signed-off-by: weiping zhang <zhangweiping@didichuxing.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: remove DRIVER_ATTR() usage

It's better to use the DRIVER_ATTR_RW() and DRIVER_ATTR_RO() macros to
explicitly show that this is a read/write or read/only sysfs file.  So
convert the remaining SCSI drivers that use the old style to use the
newer macros.

Bonus is that this removes some checkpatch.pl warnings :)

This is part of a series to drop DRIVER_ATTR() from the tree entirely.

Cc: "James E.J. Bottomley" <jejb@linux.vnet.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Kashyap Desai <kashyap.desai@broadcom.com>
Cc: Sumit Saxena <sumit.saxena@broadcom.com>
Cc: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Cc: Willem Riede <osst@riede.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid: Replace PCI pool old API

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier <romain.perier@collabora.com>
Reviewed-by: Peter Senna Tschudin <peter.senna@collabora.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid_sas: fix memleak in megasas_alloc_cmdlist_fusion

Found this issue by kmemleak, a few kb mem was leaked in
megasas_alloc_cmdlist_fusion when kzalloc failed for one
megasas_cmd_fusion allocation.

unreferenced object 0xffff88045dbd2000 (size 8192):
  comm "systemd-udevd", pid 323, jiffies 4294671759 (age 49.008s)
  backtrace:
    [<ffffffff8176166a>] kmemleak_alloc+0x4a/0xa0
    [<ffffffff812186a8>] __kmalloc+0xe8/0x220
    [<ffffffffc0060594>] megasas_alloc_cmdlist_fusion+0x34/0xe0 [megaraid_sas]
(gdb) list *megasas_alloc_cmdlist_fusion+0x34
0xd5c4 is in megasas_alloc_cmdlist_fusion
               (drivers/scsi/megaraid/megaraid_sas_fusion.c:443).
    [<ffffffffc0060ca5>] megasas_alloc_cmds_fusion+0x25/0x410 [megaraid_sas]
    [<ffffffffc0061edf>] megasas_init_adapter_fusion+0x21f/0x640 [megaraid_sas]
    [<ffffffffc005df17>] megasas_init_fw+0x357/0xd30 [megaraid_sas]
    [<ffffffffc005ef26>] megasas_probe_one.part.33+0x636/0x1100 [megaraid_sas]
    [<ffffffffc005fa36>] megasas_probe_one+0x46/0xc0 [megaraid_sas]
    [<ffffffff813d2ca5>] local_pci_probe+0x45/0xa0
    [<ffffffff813d4222>] pci_device_probe+0x192/0x1b0
    [<ffffffff814e3658>] driver_probe_device+0x2a8/0x460
    [<ffffffff814e38ed>] __driver_attach+0xdd/0xe0
    [<ffffffff814e124c>] bus_for_each_dev+0x6c/0xc0
    [<ffffffff814e2dde>] driver_attach+0x1e/0x20
    [<ffffffff814e2775>] bus_add_driver+0x45/0x270
    [<ffffffff814e4400>] driver_register+0x60/0xe0
unreferenced object 0xffff880454ce3600 (size 192):
  backtrace:
    [<ffffffff8176166a>] kmemleak_alloc+0x4a/0xa0
    [<ffffffff8121801a>] kmem_cache_alloc_trace+0xca/0x1d0
    [<ffffffffc00605d7>] megasas_alloc_cmdlist_fusion+0x77/0xe0 [megaraid_sas]
(gdb) list *megasas_alloc_cmdlist_fusion+0x77
0xd607 is in megasas_alloc_cmdlist_fusion
                (drivers/scsi/megaraid/megaraid_sas_fusion.c:450).
    [<ffffffffc0060ca5>] megasas_alloc_cmds_fusion+0x25/0x410 [megaraid_sas]
    [<ffffffffc0061edf>] megasas_init_adapter_fusion+0x21f/0x640 [megaraid_sas]
    [<ffffffffc005df17>] megasas_init_fw+0x357/0xd30 [megaraid_sas]
    [<ffffffffc005ef26>] megasas_probe_one.part.33+0x636/0x1100 [megaraid_sas]
    [<ffffffffc005fa36>] megasas_probe_one+0x46/0xc0 [megaraid_sas]
    [<ffffffff813d2ca5>] local_pci_probe+0x45/0xa0
    [<ffffffff813d4222>] pci_device_probe+0x192/0x1b0
    [<ffffffff814e3658>] driver_probe_device+0x2a8/0x460
    [<ffffffff814e38ed>] __driver_attach+0xdd/0xe0
    [<ffffffff814e124c>] bus_for_each_dev+0x6c/0xc0
    [<ffffffff814e2dde>] driver_attach+0x1e/0x20
    [<ffffffff814e2775>] bus_add_driver+0x45/0x270
    [<ffffffff814e4400>] driver_register+0x60/0xe0

Signed-off-by: Shu Wang <shuwang@redhat.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

scsi: megaraid: Fix a sleep-in-atomic bug

The driver may sleep under a spin lock, and the function call path is:
mraid_mm_attach_buf (acquire the lock by spin_lock_irqsave)
  pci_pool_alloc(GFP_KERNEL) --> may sleep

To fix it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".

[mkp: fixed whitespace]

Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

drivers/scsi/megaraid: remove expensive inline from megasas_return_cmd

Remove an inline from a fairly big function that is used often.  It's
unlikely that calling or not calling it makes a lot of difference.

Saves around 8k text in my kernel.

     text    data     bss     dec     hex filename
  9047801 5367568 11116544        25531913        1859609 vmlinux-before-megasas
  9039417 5367568 11116544        25523529        1857549 vmlinux-megasas

Link: http://lkml.kernel.org/r/20170315021431.13107-7-andi@firstfloor.org
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Cc: Kashyap Desai <kashyap.desai@avagotech.com>
Cc: Sumit Saxena <sumit.saxena@avagotech.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

megaraid_sas: remove redundant code initialzing *pDevHandle with MR_DEVHANDLE_INVALID

Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Orabug: 27625001
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

usb: usbtest: fix NULL pointer dereference

If the usbtest driver encounters a device with an IN bulk endpoint but
no OUT bulk endpoint, it will try to dereference a NULL pointer
(out->desc.bEndpointAddress).  The problem can be solved by adding a
missing test.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
(cherry picked from commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8)

Orabug: 27602322
CVE: CVE-2017-16532
Signed-off-by: Tim Tianyang Chen <tianyang.chen@oracle.com>
Reviewed-by: Ashok Vairavan <ashok.vairavan@oracle.com>

rds: Incorrect reference counting in TCP socket creation

Commit a670499f5a9a ("rds: tcp: use sock_create_lite() to create the
accept socket") has a reference counting issue in TCP socket creation
when accepting a new connection.  The code uses sock_create_lite() to
create a kernel socket.  But it does not do __module_get() on the
socket owner.  When the connection is shutdown and sock_release() is
called to free the socket, the owner's reference count is decremented
and becomes incorrect.  Note that this bug only shows up when IPv6 is
configured as a kernel module.

Orabug: 27602824

Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>

enic: enable rq before updating rq descriptors

rq should be enabled before posting the buffers to rq desc. If not hw sees
stale value and casuses DMAR errors.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Orabug: 27587345
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: add sw timestamp support

Add ethtool ops to advertise sw timestamping.
Call skb_tx_timestamp() just before ringing the wq doorbell.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit fb7516d42478ebc8e2f00efb76ef96f7b68fd8d3)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: add wq clean up budget

In case of tx clean up, we set '-1' as budget. This means clean up until
wq is empty or till (1 << 32) pkts are cleaned. Under heavy load this
will run for long time and cause
"watchdog: BUG: soft lockup - CPU#25 stuck for 21s!" warning.

This patch sets wq clean up budget to 256.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit 18feb87105c3c16dc01e6981a6aafb175679b997)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: Add support for 'ethtool -g/-G'

Add support for displaying and modifying rx and tx ring sizes using
ethtool.

Also, increasing version to  2.3.0.45

Signed-off-by: Parvi Kaustubhi <pkaustub@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit ed519b7488a42ce549ef7eae8dd13e043dde10a4)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: reset fetch index

Since we are allowing rx ring size modification, reset fetch index
everytime. Otherwise it could have a stale value that can lead to a null
pointer dereference.

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: Parvi Kaustubhi <pkaustub@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit e6cdfcc581866625980a89391be4e6a8b379d0c5)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

drivers: net: enic: use setup_timer() helper.

Use setup_timer function instead of initializing timer with the
    function and data fields.

Signed-off-by: Allen Pais <allen.lkml@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit 570ba3e82befbba7649e459fedc4aab27510ef44)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

drivers: net: enic: use setup_timer() helper.

Use setup_timer function instead of initializing timer with the
    function and data fields.

Signed-off-by: Allen Pais <allen.lkml@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit 7afd516ff75e967873d7bdcb8f9b1180c2400b57)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: update enic maintainers

update enic maintainers

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit dd1ef79120e1600cb48320cf80a612ee6510110c)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

cisco: enic: Fic an error handling path in 'vnic_dev_init_devcmd2()'

if 'ioread32()' returns 0xFFFFFFF, we have to go through the error
handling path as done everywhere else in this function.

Move the 'err_free_wq' label to better match its name and its location
and add a new label 'err_disable_wq'.
Update the code accordingly.

Fixes: 373fb0873d43 ("enic: add devcmd2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit fdf99b3ffcdd8471ee3104512198a178b7351a02)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: Fix format truncation warning

With -Wformat-truncation, gcc throws the following warning.

Fix this by increasing the size of devname to accommodate 15 character
netdev interface name and description.

Remove length format precision for %s. We can fit entire name.

Also increment the version.

drivers/net/ethernet/cisco/enic/enic_main.c: In function ‘enic_open’:
drivers/net/ethernet/cisco/enic/enic_main.c:1740:15: warning: ‘%u’ directive output may be truncated writing between 1 and 2 bytes into a region of size between 1 and 12 [-Wformat-truncation=]
     "%.11s-rx-%u", netdev->name, i);
               ^~
drivers/net/ethernet/cisco/enic/enic_main.c:1740:5: note: directive argument in the range [0, 16]
     "%.11s-rx-%u", netdev->name, i);
     ^~~~~~~~~~~~~
drivers/net/ethernet/cisco/enic/enic_main.c:1738:4: note: ‘snprintf’ output between 6 and 18 bytes into a destination of size 16
    snprintf(enic->msix[intr].devname,
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     sizeof(enic->msix[intr].devname),
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     "%.11s-rx-%u", netdev->name, i);
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit 7044f429e70d987cdc780f26a9b9951970645966)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: add devcmds for vxlan offload

This patch adds devcmds needed for vxlan offload. Implement 3 new devcmd

overlay_offload_ctrl: enable/disable offload
overlay_offload_cfg: update offload udp port number
get_supported_feature_ver: get hw supported offload version. Each
   version has different bitmap for csum_ok/encap

Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ca0291798227a6da0f3ba6c2e3a43d94d5dcf591)

Orabug: 27587345
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

enic: increment devcmd2 result ring in case of timeout

Firmware posts the devcmd result in result ring. In case of timeout, driver
does not increment the current result pointer and firmware could post the
result after timeout has occurred. During next devcmd, driver would be
reading the result of previous devcmd.

Fix this by incrementing result even in case of timeout.

Fixes: 373fb0873d43 ("enic: add devcmd2")
Signed-off-by: Sandeep Pillai <sanpilla@cisco.com>
Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Orabug: 27587345
(cherry picked from commit ca7f41a4957b872577807169bd7464b36aae9b9c)
Conflict in enic.h - avoid reverting version number
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>

scsi: fnic: use kzalloc in fnic_fcoe_process_vlan_resp

This saves a little .text and gets rid of the unmotivated line break and
the sizeof(...) style inconsistency.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit dbc1ebe7b0fd43f7d74ba0e87b411eb48c9fdeb2)

Orabug: 27587343
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>