summaryrefslogtreecommitdiff
path: root/drivers/block/cciss.c
AgeCommit message (Collapse)AuthorFilesLines
2008-12-29cciss: simplify parameters to deregister_disk functionStephen M. Cameron1-7/+9
Simplify parameters to deregister_disk function. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-12-29cciss: switch to using hlist for command list managementJens Axboe1-42/+30
This both cleans up the code and also helps detect the spurious case of a command attempted being removed from a queue it doesn't belong to. Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-12-19cciss: fix problem that deleting multiple logical drives could cause a panicStephen M. Cameron1-0/+5
Fix problem that deleting multiple logical drives could cause a panic. It fixes a panic which can be easily reproduced in the following way: Just create several "arrays," each with multiple logical drives via hpacucli, then delete the first array, and it will blow up in deregister_disk(), in the call to get_host() when it tries to dig the hba pointer out of a NULL queue pointer. The problem has been present since my code to make rebuild_lun_table behave better went in. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-11-20cciss: fix DEBUG printk formatsRandy Dunlap1-4/+5
Fix printk format warnings when CCISS_DEBUG is defined. drivers/block/cciss.c:2856: warning: format '%d' expects type 'int', but argument 2 has type 'long unsigned int' drivers/block/cciss.c:3205: warning: format '%x' expects type 'unsigned int', but argument 2 has type 'long unsigned int' drivers/block/cciss.c:3236: warning: format '%x' expects type 'unsigned int', but argument 2 has type '__u64' drivers/block/cciss.c:3246: warning: format '%x' expects type 'unsigned int', but argument 2 has type '__u64' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-07cciss: fix regression firmware not displayed in procfsMike Miller1-1/+22
This regression was introduced by commit 6ae5ce8e8d4de666f31286808d2285aa6a50fa40 ("cciss: remove redundant code"). This patch fixes a regression where the controller firmware version is not displayed in procfs. The previous patch would be called anytime something changed. This will get called only once for each controller. Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: <stable@kernel.org> [2.6.27.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-07cciss: fix sysfs broken symlink regressionMike Miller1-0/+1
Regression introduced by commit 6ae5ce8e8d4de666f31286808d2285aa6a50fa40 ("cciss: remove redundant code"). This patch fixes a broken symlink in sysfs that was introduced by the above commit. We broke it in 2.6.27-rc on or about 20080804. Some installers are broken if this symlink does not exist and they may not detect the logical drives configured on the controller. It does not require being backported into 2.6.26.x or earlier kernels. Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: <stable@kernel.org> [2.6.27.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-11-07cciss: new hardware supportMike Miller1-0/+4
Add support for 2 new SAS/SATA controllers. Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-21[PATCH] switch ccissAl Viro1-39/+39
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-10-21[PATCH] beginning of methods conversionAl Viro1-4/+4
To keep the size of changesets sane we split the switch by drivers; to keep the damn thing bisectable we do the following: 1) rename the affected methods, add ones with correct prototypes, make (few) callers handle both. That's this changeset. 2) for each driver convert to new methods. *ALL* drivers are converted in this series. 3) kill the old (renamed) methods. Note that it _is_ a flagday; all in-tree drivers are converted and by the end of this series no trace of old methods remain. The only reason why we do that this way is to keep the damn thing bisectable and allow per-driver debugging if anything goes wrong. New methods: open(bdev, mode) release(disk, mode) ioctl(bdev, mode, cmd, arg) /* Called without BKL */ compat_ioctl(bdev, mode, cmd, arg) locked_ioctl(bdev, mode, cmd, arg) /* Called with BKL, legacy */ Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-10-21[PATCH] switch scsi_cmd_ioctl() to passing fmode_tAl Viro1-1/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-10-09drivers/block: Use DIV_ROUND_UPJulia Lawall1-4/+4
The kernel.h macro DIV_ROUND_UP performs the computation (((n) + (d) - 1) / (d)) but is perhaps more readable. An extract of the semantic patch that makes this change is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @haskernel@ @@ #include <linux/kernel.h> @depends on haskernel@ expression n,d; @@ ( - (n + d - 1) / d + DIV_ROUND_UP(n,d) | - (n + (d - 1)) / d + DIV_ROUND_UP(n,d) ) @depends on haskernel@ expression n,d; @@ - DIV_ROUND_UP((n),d) + DIV_ROUND_UP(n,d) @depends on haskernel@ expression n,d; @@ - DIV_ROUND_UP(n,(d)) + DIV_ROUND_UP(n,d) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Cc: <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06cciss: fix bug if scsi tape support is disabledMike Miller1-0/+2
Bug fix. If SCSI tape support is turned off we get an implicit declaration of cciss_unregister_scsi error in cciss_remove_one. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06cciss: fix negative logical drive count in procfsMike Miller1-6/+9
This patch fixes a problem where the logical volume count may go negative. In some instances if several logical are configured on a controller and all of them are deleted using the online utilities the volume count in /proc may go negative with no way get it correct again. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06cciss: remove redundant codeMike Miller1-304/+169
This patch removes redundant code where ever logical volumes are added or removed. It adds 3 new functions that are called instead of having the same code spread throughout the driver. It also removes the cciss_getgeometry function. The patch is fairly complex but we haven't figured out how to make it any simpler and still do everything that needs to be done. Some of the complexity comes from having to special case booting from cciss. Otherwise the gendisk doesn't get added in time and the switchroot will fail. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06cciss: make rebuild_lun_table behave betterMike Miller1-122/+214
This patch makes the rebuild_lun_table smart enough to not rip a logical volume out from under the OS. Without this fix if a customer is running hpacucli to monitor their storage the driver will blindly remove and re-add the disks whenever the utility calls the CCISS_REGNEWD ioctl. Unfortunately, both hpacucli and ACUXE call the ioctl repeatedly. Customers have reported IO coming to a standstill. Calling the ioctl is the problem, this patch is the fix. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06cciss: return -EFAULT if copy_from_user() failsNikanth Karthikesan1-1/+1
Return -EFAULT instead of -ENOMEM if copy_from_user() fails. Signed-off-by: Nikanth Karthikesan <knikanth@suse.de> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-08-06block/cciss.c: remove pointless curr_queue calculationHannes Reinecke1-2/+0
curr_queue is a local variable in a for loop, and it's being initialized at the start of each loop. So any assignment at the end of the loop is pointless. Signed-off-by: Hannes Reinecke <hare@suse.de> Cc: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-07-04cciss: read config to obtain max outstanding commands per controllerMike Miller1-29/+37
This patch changes the way we determine the maximum number of outstanding commands for each controller. Most Smart Array controllers can support up to 1024 commands, the notable exceptions are the E200 and E200i. The next generation of controllers which were just added support a mode of operation called Zero Memory Raid (ZMR). In this mode they only support 64 outstanding commands. In Full Function Raid (FFR) mode they support 1024. We have been setting the queue depth by arbitrarily assigning some value for each controller. We needed a better way to set the queue depth to avoid lots of annoying "fifo full" messages. So we made the driver a little smarter. We now read the config table and subtract 4 from the returned value. The -4 is to allow some room for ioctl calls which are not tracked the same way as io commands are tracked. Please consider this for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-07-04cciss: fix regression that no device nodes are created if no logical drives ↵Stephen M. Cameron1-0/+4
are configured. Fix regression in cciss driver that if no logical drives are configured, no device nodes at all get created. Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-06-13cciss: add new hardware supportMike Miller1-5/+16
Add support for the next generation of HP Smart Array SAS/SATA controllers. Shipping date is late Fall 2008. Bump the driver version to 3.6.20 to reflect the new hardware support from patch 1 of this set. Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-05-01cciss: assign PDE->data before gluing PDE into /proc treeDenis V. Lunev1-6/+2
Simply replace proc_create and further data assigned with proc_create_data. Signed-off-by: Denis V. Lunev <den@openvz.org> Cc: Alexey Dobriyan <adobriyan@openvz.org> Cc: Eric W. Biederman <ebiederm@xmission.com> Acked-by: Mike Miller <mike.miller@hp.com> Cc: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-29proc: remove proc_root_driverAlexey Dobriyan1-2/+2
Use creation by full path: "driver/foo". Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-21cciss: Fix race between disk-adding code and interrupt handlerscameron@beardog.cca.cpqcorp.net1-1/+16
Fix race condition between cciss_init_one(), cciss_update_drive_info(), and cciss_check_queues(). Signed-off-by: Stephen M. Cameron <scameron@beardog.cca.cpqcorp.net> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-04-11cciss: error: implicit declaration of function 'sg_init_table'Mike Pagano1-0/+1
This patch adds the missing include directive <linux/scatterlist.h> to the cciss.c source file.   This was discovered by our release team when building the kernel for the Alpha architecture. Errors were found as references to functions 'sg_init_table' and 'sg_page' do not exist without the include for Alpha. Signed-off-by: Mike Pagano <mpagano@gentoo.org> Cc: Jens Axboe <jens.axboe@oracle.com> Cc: <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-03-04cciss: remove READ_AHEAD define and use block layer defaultsMike Miller1-3/+0
This patch removes the #define READ_AHEAD 1024 from the driver and uses the block layer defaults, instead. We have found that under certain workloads the setting can cause a disk connected to the e200 controller to go offline. If the disk hiccups the link may try to downshift but the controller is never notified that the link successfully completed the renegotiation. We've also found that performance using the block layer default of 32 pages was on par with the 1024 setting. We tried setting it to zero at one time based on info from our firmware guys but that killed performance. Turns out we were talking about 2 different read ahead settings. Please consider this for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-03-04resubmit: cciss: procfs updates to display info about manyMike Miller1-96/+157
volumes This patch allows us to display information about all of the logical volumes configured on a particular controller without stepping on memory even when there are many volumes (128 or more) configured. Please consider this for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-02-06cciss: use upper_32_bits() macro to eliminate warningsRandy Dunlap1-4/+6
Use upper_32_bits(x) macro to handle shifts that may be >= the width of the data type. drivers/block/cciss.c: In function 'do_cciss_request': drivers/block/cciss.c:2655: warning: right shift count >= width of type drivers/block/cciss.c:2656: warning: right shift count >= width of type drivers/block/cciss.c:2657: warning: right shift count >= width of type drivers/block/cciss.c:2658: warning: right shift count >= width of type Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-01-29cciss: fix bug in overriding ->data_len before completionJens Axboe1-1/+0
For BLOCK_PC requests, we need that length for completing the request. Andrew Vasquez <andrew.vasquez@qlogic.com> reported the following oops Hitting a consistent BUG() with recent Linus' linux-2.6.git: [ 12.941428] ------------[ cut here ]------------ [ 12.944874] kernel BUG at drivers/block/cciss.c:1260! [ 12.944874] invalid opcode: 0000 [1] SMP [ 12.944874] CPU 0 [ 12.944874] Modules linked in: [ 12.944874] Pid: 0, comm: swapper Not tainted 2.6.24 #43 [ 12.944874] RIP: 0010:[<ffffffff8039e43d>] [<ffffffff8039e43d>] cciss_softirq_done+0xbc/0x1bf [ 12.944874] RSP: 0018:ffffffff8063aed0 EFLAGS: 00010202 [ 12.944874] RAX: 0000000000000001 RBX: ffff8100cf800010 RCX: ffff81042f1253b0 [ 12.944874] RDX: ffff81042de398f0 RSI: ffff81042de398f0 RDI: 0000000000000001 [ 12.944874] RBP: ffff81042daa0000 R08: ffff81042f1253b0 R09: 0000000000000001 [ 12.944874] R10: 00000000000000fe R11: 0000000000000000 R12: 0000000000000002 [ 12.944874] R13: 0000000000000001 R14: ffff8100cf800000 R15: ffff81042de398f0 [ 12.944874] FS: 0000000000000000(0000) GS:ffffffff805bb000(0000) knlGS:0000000000000000 [ 12.944874] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b [ 12.944874] CR2: 00002afed7eea340 CR3: 000000042dbba000 CR4: 00000000000006e0 [ 12.944874] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.944874] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.944874] Process swapper (pid: 0, threadinfo ffffffff805f4000, task ffffffff805624a0) [ 12.944874] Stack: 0000000000000000 ffffffff8063af10 0000000000000001 ffffffff80632d60 [ 12.944874] 0000000000000000 000000000000000a ffffffff805bb900 ffffffff8032038f [ 12.944874] ffffffff8063af10 ffffffff8063af10 ffffffff805bb940 ffffffff802346b4 [ 12.944874] Call Trace: [ 12.944874] <IRQ> [<ffffffff8032038f>] blk_done_softirq+0x69/0x78 [ 12.944874] [<ffffffff802346b4>] __do_softirq+0x6f/0xd8 [ 12.944874] [<ffffffff8020c45c>] call_softirq+0x1c/0x30 [ 12.944874] [<ffffffff8020e347>] do_softirq+0x30/0x80 [ 12.944874] [<ffffffff8020e409>] do_IRQ+0x72/0xd9 [ 12.944874] [<ffffffff8020a50a>] mwait_idle+0x0/0x46 [ 12.944874] [<ffffffff8020a3da>] default_idle+0x0/0x3d [ 12.944874] [<ffffffff8020b7e1>] ret_from_intr+0x0/0xa [ 12.944874] <EOI> [<ffffffff8020a54c>] mwait_idle+0x42/0x46 [ 12.944874] [<ffffffff8020a481>] cpu_idle+0x6a/0xae [ 12.944874] [ 12.944874] [ 12.944874] Code: 0f 0b eb fe 48 8d 85 d8 c0 00 00 48 89 04 24 48 89 c7 e8 e5 [ 12.944874] RIP [<ffffffff8039e43d>] cciss_softirq_done+0xbc/0x1bf [ 12.944874] RSP <ffffffff8063aed0> [ 12.944903] ---[ end trace e9c631603f90d22f ]--- which is caused by blk_end_request() returning 'not done' for a request, since it gets asked to complete zero bytes. Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-01-28blk_end_request: changing cciss (take 4)Kiyoshi Ueda1-22/+3
This patch converts cciss to use blk_end_request interfaces. Related 'uptodate' arguments are converted to 'error'. cciss is a little bit different from "normal" drivers. cciss directly calls bio_endio() and disk_stat_add() when completing request. But those can be replaced with __end_that_request_first(). After the replacement, request completion procedures of those drivers become like the following: o end_that_request_first() o add_disk_randomness() o end_that_request_last() This can be converted to blk_end_request() by following the rule (a) mentioned in the patch subject "[PATCH 01/30] blk_end_request: add new request completion interface". Cc: Mike Miller <mike.miller@hp.com> Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com> Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-01-14cciss: section mismatchRandy Dunlap1-1/+1
Mark cciss_pci_init() as __devinit, to fix section mismatch warning. WARNING: vmlinux.o(.text+0x601fc9): Section mismatch: reference to .init.text: (between 'cciss_pci_init' and 'cciss_getgeometry') Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: <mike.miller@hp.com> Acked-by: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-29cciss: update copyright noticesMike Miller1-7/+7
This patch updates the copyright information for the cciss driver. It includes extending the year to 2007 (how timely) and some minor corrections deemed necessary by HP legal and the Open Source Review Board. Please consider this patch for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> -------------------------------------------------------------------------------- Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-22[SG] Update drivers to use sg helpersJens Axboe1-2/+2
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-17Merge branch 'for-linus' of git://git.kernel.dk/data/git/linux-2.6-blockLinus Torvalds1-3/+8
* 'for-linus' of git://git.kernel.dk/data/git/linux-2.6-block: [SCSI] Remove full sg table memset() [SCSI] ide-scsi: remove usage of sg_last() Fix loop terminating conditions in fill_sg(). [BLOCK] Clear sg entry before filling in blk_rq_map_sg() IA64: iommu uses sg_next with an invalid sg element cciss: disable DMA refetch on Smart Array P600 swiotlb: fix map_sg failure handling SPARC64: fix iommu sg chaining [SCSI] ide-scsi: use scsi_sg_count() instead of ->use_sg
2007-10-17drivers/block/cciss.c: fix check-after-useAdrian Bunk1-29/+27
The Coverity checker spotted that we have already oops'ed if "disk" was NULL. Since "disk" being NULL seems impossible at this point this patch removes the NULL check. Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17cciss: fix error reporting for SG_IOSteve Cameron1-18/+61
This fixes a problem with the way cciss was filling out the "errors" field of the request structure upon completion of requests. Previously, it just put a 1 or a 0 in there and used the negation of this as the uptodate parameter to one of the functions in the block layer, being a block device. For the SG_IO ioctl, this was not sufficient, and we noticed that, for example, sg_turs from sg3_utils did not correctly detect problems due to cciss having set rq->errors incorrectly. Signed-off-by: Stephen M. Cameron <steve.cameron@hp.com> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17cciss: disable DMA refetch on Smart Array P600Mike Miller (OS Dev)1-3/+8
This patch disables DMA refetch in the PCI bridge. We have disabled DMA prefetch for quite some time. Testing with XEN revealed another ASIC bug. If dom0 resides on a P600 the board can can an MCA bi accessing invalid memory addresses. Apparently, we need to disable both prefetch and refetch. My understanding is a refetch operation should not occur but it is a valid thing to do if prefetched data is no longer available for whatever reason. Please consider this patch for inclusion. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Alex Chiang <achiang@hp.com> -------------------------------------------------------------------------------- Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-16Merge branch 'sglist-arch' into for-linusJens Axboe1-0/+1
2007-10-16Panic in blk_rq_map_sg() from CCISS driverLee Schermerhorn1-0/+1
New scatter/gather list chaining [sg_next()] treats 'page' member of struct scatterlist with low bit set [0x01] as a chain pointer to another struct scatterlist [array]. The CCISS driver request function passes an uninitialized, temporary, on-stack scatterlist array to blk_rq_map_sq(). sg_next() interprets random data on the stack as a chain pointer and eventually tries to de-reference an invalid pointer, resulting in: [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170 PGD 6090c3067 PUD 0 Oops: 0000 [1] SMP last sysfs file: /block/cciss!c0d0/cciss!c0d0p1/dev CPU 6 Modules linked in: ehci_hcd ohci_hcd uhci_hcd Pid: 1, comm: init Not tainted 2.6.23-rc6-mm1 #3 RIP: 0010:[<ffffffff8031dd70>] [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170 RSP: 0018:ffff81060901f768 EFLAGS: 00010206 RAX: 000000040b161000 RBX: ffff81060901f7d8 RCX: 000000040b162c00 RDX: 0000000000000000 RSI: ffff81060b13a260 RDI: ffff81060b139600 RBP: 0000000000001400 R08: 00000000fffffffe R09: 0000000000000400 R10: 0000000000000000 R11: 000000040b163000 R12: ffff810102fe0000 R13: 0000000000000001 R14: 0000000000000001 R15: 00001e0000000000 FS: 00000000026108f0(0063) GS:ffff810409000b80(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000010000001e CR3: 00000006090c6000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process init (pid: 1, threadinfo ffff81060901e000, task ffff810409020800) last branch before last exception/interrupt from [<ffffffff8031de0a>] blk_rq_map_sg+0x10a/0x170 to [<ffffffff8031dd70>] blk_rq_map_sg+0x70/0x170 Stack: 000000018068ea00 ffff810102fe0000 0000000000000000 ffff810011400000 0000000000000002 0000000000000000 ffff81040b172000 ffffffff803acd3d 0000000000003ec1 ffff8106090d5000 ffff8106090d5000 ffff810102fe0000 Call Trace: [<ffffffff803acd3d>] do_cciss_request+0x15d/0x4c0 [<ffffffff80298968>] new_slab+0x1c8/0x270 [<ffffffff80298ffd>] __slab_alloc+0x22d/0x470 [<ffffffff8027327b>] mempool_alloc+0x4b/0x130 [<ffffffff8032b21e>] cfq_set_request+0xee/0x380 [<ffffffff8027327b>] mempool_alloc+0x4b/0x130 [<ffffffff8031ff98>] get_request+0x168/0x360 [<ffffffff80331b0d>] rb_insert_color+0x8d/0x110 [<ffffffff8031cfd8>] elv_rb_add+0x58/0x60 [<ffffffff8032a329>] cfq_add_rq_rb+0x69/0xa0 [<ffffffff8031c1ab>] elv_merged_request+0x5b/0x60 [<ffffffff803224fd>] __make_request+0x23d/0x650 [<ffffffff80298ffd>] __slab_alloc+0x22d/0x470 [<ffffffff80270000>] generic_write_checks+0x140/0x190 [<ffffffff8031f012>] generic_make_request+0x1c2/0x3a0 <etc> Kernel panic - not syncing: Attempted to kill init! This patch initializes the tmp_sg array to zeroes. Perhaps not the ultimate fix, but an effective work-around. I can now boot 23-rc6-mm1 on an HP Proliant x86_64 with CCISS boot disk. Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com> drivers/block/cciss.c | 1 + 1 file changed, 1 insertion(+) Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-16drivers/block/cpqarray,cciss: kill unused varJeff Garzik1-1/+0
The recent bio work and subsequent fixups created unused variables. Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-10-14more trivial signedness fixes in driversAl Viro1-1/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-10Drop 'size' argument from bio_endio and bi_end_ioNeilBrown1-1/+1
As bi_end_io is only called once when the reqeust is complete, the 'size' argument is now redundant. Remove it. Now there is no need for bio_endio to subtract the size completed from bi_size. So don't do that either. While we are at it, change bi_end_io to return void. Signed-off-by: Neil Brown <neilb@suse.de> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-08-12drivers/block/cciss.c: kmalloc + memset conversion to kzallocMariusz Kozlowski1-8/+8
drivers/block/cciss.c | 104285 -> 104168 (-117 bytes) drivers/block/cciss.o | 277400 -> 277124 (-276 bytes) Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-08-01cciss: fix memory leakJesper Juhl1-1/+4
There's a memory leak in the cciss driver. in alloc_cciss_hba() we may leak sizeof(ctlr_info_t) bytes if a call to alloc_disk(1 << NWD_SHIFT) fails. This patch should fix the issue. Spotted by the Coverity checker. Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-24[BLOCK] Get rid of request_queue_t typedefJens Axboe1-5/+5
Some of the code has been gradually transitioned to using the proper struct request_queue, but there's lots left. So do a full sweet of the kernel and get rid of this typedef and replace its uses with the proper type. Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-07-16Fix too few arguments to function `scsi_cmd_ioctl'S.Çağlar Onur1-1/+1
This corrects the following compile error introduced by the merge of the new bsg layer in commit e245befce7af0a1e1347079ed62695b059594bd4: caglar@zangetsu linux-2.6 $ make CHK include/linux/version.h CHK include/linux/utsrelease.h CALL scripts/checksyscalls.sh CHK include/linux/compile.h LD drivers/block/built-in.o CC [M] drivers/block/cciss.o drivers/block/cciss.c: In function `cciss_ioctl': drivers/block/cciss.c:1173: warning: passing arg 2 of `scsi_cmd_ioctl' from incompatible pointer type drivers/block/cciss.c:1173: warning: passing arg 3 of `scsi_cmd_ioctl' makes pointer from integer without a cast drivers/block/cciss.c:1173: warning: passing arg 4 of `scsi_cmd_ioctl' makes integer from pointer without a cast drivers/block/cciss.c:1173: error: too few arguments to function `scsi_cmd_ioctl' ... make[2]: *** [drivers/block/cciss.o] Hata 1 make[1]: *** [drivers/block] Hata 2 make: *** [drivers] Hata 2 Signed-off-by: S.Çağlar Onur <caglar@pardus.org.tr> Cc: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-10cciss: add new controller support for P700mMike Miller (OS Dev1-0/+2
This patch adds support for the Smart Array P700m SAS controller. This new controller will ship Fall 2007. Signed-off-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2007-05-19cciss: Fix pci_driver.shutdown while device is still activeGerald Britton1-15/+30
Fix an Oops in the cciss driver caused by system shutdown while a filesystem on a cciss device is still active. The cciss_remove_one function only properly removes the device if the device has been cleanly released by its users, which is not the case when the pci_driver.shutdown method is called. This patch adds a new cciss_shutdown function to better match the pattern used by various SCSI drivers: deactivate device interrupts and flush caches. It also alters the cciss_remove_one function to match and readds the __devexit annotation that was removed when cciss_remove_one was serving as the pci_driver.shutdown method. Signed-off-by: Gerald Britton <gbritton@alum.mit.edu> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-05-08cciss: include scsi/scsi.h unconditionallyStephen Cameron1-0/+1
Make cciss unconditionally include scsi/scsi.h, because of the use of SCSI_IOCTL_GET_IDLUN and SCSI_IOCTL_GET_BUS_NUMBER. Signed-off-by: Stephen M. Cameron <steve.cameron@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-05-08cciss: set rq->errors more correctly in driverMike Miller (OS Dev)1-21/+22
Set rq->errors more correctly in cciss driver. Previously we had set it synonymously with the meaning of the last parameter of end_that_last_request and complete_buffers (the "uptodate" parameter) and had gotten away with it for all this time because nobody ever looked at rq->errors. SCSI_IOCTL_SEND_COMMAND looks at rq->errors, so now it matters that it be right. Signed-off-by: Stephen M. Cameron <steve.cameron@hp.com> Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: James Bottomley <James.Bottomley@steeleye.com> Cc: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-05-08cciss: add SG_IO ioctl to ccissMike Miller (OS Dev)1-53/+111
For all of you that think cciss should be a scsi driver here is the patch that you have been waiting for all these years. This patch actually adds the SG_IO ioctl to cciss. The primary purpose is for clustering and high-availibilty. But now anyone can exploit this ioctl in any manner they wish. Note, SCSI_IOCTL_SEND_COMMAND doesn't work with this patch due to rq->errors being set incorrectly. Subsequent patch fixes that. Signed-off-by: Stephen M. Cameron <steve.cameron@hp.com> Signed-off-by: Mike Miller <mike.miller@hp.com> Cc: James Bottomley <James.Bottomley@steeleye.com> Cc: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>