Nicholas A. Bellinger | 25 May 21:47 2016

[PATCH] target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP

From: Nicholas Bellinger <nab <at>>

During transport_generic_free_cmd() with a concurrent TMR
ABORT_TASK and shutdown CMD_T_FABRIC_STOP bit set, the
caller will be blocked on se_cmd->cmd_wait_stop completion
until the final kref_put() -> target_release_cmd_kref()
has been invoked to call complete().

However, when ABORT_TASK is completed with FUNCTION_COMPLETE
in core_tmr_abort_task(), the aborted se_cmd will have already
been removed from se_sess->sess_cmd_list via list_del_init().

This results in target_release_cmd_kref() hitting the
legacy list_empty() == true check, invoking ->release_cmd()
but skipping complete() to wakeup se_cmd->cmd_wait_stop
blocked earlier in transport_generic_free_cmd() code.

To address this bug, it's safe to go ahead and drop the
original list_empty() check so that fabric_stop invokes
the complete() as expected, since list_del_init() can
safely be used on a empty list.

Cc: Mike Christie <mchristi <at>>
Cc: Quinn Tran <quinn.tran <at>>
Cc: Himanshu Madhani <himanshu.madhani <at>>
Cc: Christoph Hellwig <hch <at>>
Cc: Hannes Reinecke <hare <at>>
Cc: stable <at> # 3.14+
Signed-off-by: Nicholas Bellinger <nab <at>>
(Continue reading)

Tejun Heo | 25 May 21:32 2016

Converting ipr to use ata_port_operations->error_handler

Hello, Brian.

So, of all the ata drivers, ipr seems to be the only driver which
doesn't implement ata_port_opeations->error_handler and thus depends
on the old error handling path. I'm wondering whether it'd be possible
to convert ipr to implement ->error_handler and drop the old path.
Would that be difficult?



To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo <at>
More majordomo info at

Joe Lawrence | 25 May 21:14 2016

[PATCH 0/2] _scsih_sas_host_add early exits can crash system

There are many error paths in _scsih_sas_host_add that lead to an early
exit and a few that leave IOC resources uninitialized, setting the stage
for a later crash.

This can be emulated using a systemtap script like:

  % stap -g -e \
  'probe module("mpt3sas").function("mpt3sas_config_get_sas_iounit_pg0").return { $return = -1 }'

to force early exit, while remove/re-adding an MPT3 adapter:

  % lspci -D | grep MPT
  0000:54:00.0 Mass storage controller: LSI Logic / Symbios Logic SAS3008 PCI-Express Fusion-MPT SAS-3
(rev 02)

  % SYSFS=$(find /sys/devices -name 0000:54:00.0)
  % SYSFS_PARENT=$(dirname $SYSFS)

  % echo 1 > $SYSFS/remove
  % sleep 1m
  % echo 1 > $SYSFS_PARENT/rescan

These two patches fix:
  1) referencing unallocated ioc->sas_hba.phy[] space
  2) passing a NULL ioc->sas_hba.parent_dev to the scsi_transport_sas

Note: these changes don't improve or retry adapter initialization, but
      only try to prevent the system from crashing

(Continue reading)

Petros Koutoupis | 25 May 17:02 2016

sd: ZBC Update Read/Write Commands to SCSI spec

This patch is based on: branch zbc.v6

According to the Zoned Block Commands (ZBC) Revision 5 SCSI specification,
a Host Managed and Host Aware device is limited to support at a minimum the
READ (16) and WRITE (16) read/write CDBs. This means that a drive manufacturer
is not obligated to support anything else. We shouldn't assume that we can
send other read/write commands and should instead limit sd to only the
mandatory list highlighted in the specification.

Note, I did not place the a check for zoned devices in the DIF-enabled
conditional above, under the assumption that if the media supports Type-2
then it should also support the 32-byte commands. Thoughts?

Signed-off-by: Petros Koutoupis <petros <at>>

--- scsi-devel/drivers/scsi/sd.c.orig	2016-05-12 23:21:04.314000000 -0500
+++ scsi-devel/drivers/scsi/sd.c	2016-05-25 08:55:21.715506056 -0500
 <at>  <at>  -1159,7 +1159,8  <at>  <at>  static int sd_setup_read_write_cmnd(stru
 		SCpnt->cmnd[29] = (unsigned char) (this_count >> 16) & 0xff;
 		SCpnt->cmnd[30] = (unsigned char) (this_count >> 8) & 0xff;
 		SCpnt->cmnd[31] = (unsigned char) this_count & 0xff;
-	} else if (sdp->use_16_for_rw || (this_count > 0xffff)) {
+	} else if (sdp->use_16_for_rw || (this_count > 0xffff) ||
+		   sdkp->zoned == 1 || sdp->type == TYPE_ZBC) {
 		SCpnt->cmnd[0] += READ_16 - READ_6;
 		SCpnt->cmnd[1] = protect | ((rq->cmd_flags & REQ_FUA) ? 0x8 : 0);
 		SCpnt->cmnd[2] = sizeof(block) > 4 ? (unsigned char) (block >> 56) & 0xff : 0;
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
(Continue reading)

Johannes Thumshirn | 25 May 11:18 2016

mpt3sas: memory allocation for firmware upgrade DMA memory question

Hi Chaitra and Suganath,

I've got a question regarding mpt3sas' memory allocation used when doing a
firmware upgrade. Currently you're doing a pci_alloc_consitent() which tries
to allocate memory via GFP_ATOMIC. This memory then is passed as a single
element on a sg_list.

Jeff reported it returned -ENOMEM on his Server due to highly fragmented

Is it required to have the memory for the DMA operation contiguous, or can I
just allocate several non-contiguous junks of memory and map it to a sg_list?

If not, is GFP_ATMOIC really needed? I've converted the driver to use
GFP_KERNEL but I'm a bit reluctant to test below patch on real hardware to not
brick the HBA.


RFC patch for GFP_KERNEL allocation, though splitting into multiple sg mapped
elements is the preferred fix here:

From 06e63654d887df7f740dc5abcb40d441a8da7fa5 Mon Sep 17 00:00:00 2001
From: Johannes Thumshirn <jthumshirn <at>>
Date: Tue, 24 May 2016 17:25:59 +0200
Subject: [RFC PATCH] mpt3sas: Don't do atomic memory allocations for firmware
 update DMA

Currently mpt3sas uses pci_alloc_consistent() to allocate memory for the DMA
(Continue reading)

Thomas Huth | 24 May 12:27 2016

[PATCH] scsi/qla2xxx: Remove erroneous macro qla82xx_get_temp_val1()

That macros uses logical "&&" instead of bit-wise "&" which is
apparently wrong. Since the macro is completely unused, simply
remove it, so that nobody can accidentially use it anymore.

Signed-off-by: Thomas Huth <thuth <at>>
 drivers/scsi/qla2xxx/qla_nx.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_nx.h b/drivers/scsi/qla2xxx/qla_nx.h
index 59c4778..6201dce 100644
--- a/drivers/scsi/qla2xxx/qla_nx.h
+++ b/drivers/scsi/qla2xxx/qla_nx.h
 <at>  <at>  -1183,7 +1183,6  <at>  <at>  static const int MD_MIU_TEST_AGT_RDDATA[] = { 0x410000A8, 0x410000AC,
 #define CRB_NIU_XG_PAUSE_CTL_P1        0x8

 #define qla82xx_get_temp_val(x)          ((x) >> 16)
-#define qla82xx_get_temp_val1(x)          ((x) && 0x0000FFFF)
 #define qla82xx_get_temp_state(x)        ((x) & 0xffff)
 #define qla82xx_encode_temp(val, state)  (((val) << 16) | (state))



To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo <at>
More majordomo info at

(Continue reading)

Hannes Reinecke | 24 May 08:11 2016

[PATCHv2] libfc: Update rport reference counting

Originally libfc would just be initializing the refcount to '1',
and using the disc_mutex to synchronize if and when the final put
should be happening.
This has a race condition as the mutex might be delayed, causing
other threads to access an invalid structure.
This patch updates the rport reference counting to increase the
reference every time 'rport_lookup' is called, and decreases
the reference correspondingly.
This removes the need to hold 'disc_mutex' when removing the
structure, and avoids the above race condition.

Signed-off-by: Hannes Reinecke <hare <at>>
 drivers/scsi/fcoe/fcoe_ctlr.c |  7 +------
 drivers/scsi/libfc/fc_lport.c | 19 ++++++++++-------
 drivers/scsi/libfc/fc_rport.c | 49 ++++++++++++++++++++++---------------------
 3 files changed, 38 insertions(+), 37 deletions(-)

diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 3e83d48..ada4bde 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
 <at>  <at>  -2496,14 +2496,13  <at>  <at>  static int fcoe_ctlr_vn_lookup(struct fcoe_ctlr *fip, u32 port_id, u8 *mac)
 	struct fcoe_rport *frport;
 	int ret = -1;

-	rcu_read_lock();
 	rdata = lport->tt.rport_lookup(lport, port_id);
 	if (rdata) {
 		frport = fcoe_ctlr_rport(rdata);
(Continue reading)

Bert | 23 May 21:16 2016


isem zastupujicí investicní zajem ze strany Dubaji, pro ktere hledáme vasi
ucast. Odpoved na e-mailu nize v pripade zajmu.

E-mail: pbrtt80 <at>

To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo <at>
More majordomo info at

Robert LeBlanc | 24 May 01:05 2016

Follow up on iSCSI and MQ/MCS discussion

On 01/07/2015 a discussion titled "[LSF/MM TOPIC] iSCSI MQ adoption
via MCS discussion"[0] had some good participation, but I can't seem
to find anything resulting from a LSF discussion or patches
implementing anything discussed in the thread. Can we get an update on
where things sit? With the 4.4 kernel, I think I'm still seeing the
"old" behavior.

Please include me in the reply as I'm not subscribed to the list.


Robert LeBlanc
PGP Fingerprint 79A2 9CA4 6CC4 45DD A904  C70E E654 3BB2 FA62 B9F1
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo <at>
More majordomo info at

Dāvis Mosāns | 23 May 20:53 2016

Improve device reset for failed HDD


I've a Seagate Barracuda 7200.14 (ST2000DM001-9YN164) 2TB HDD
with some bad sectors and when they're accessed it causes device to fail.
It's attached to HighPoint RocketRAID 2760 HBA (mvsas) and kernel 4.6

when accesing bad sector in log can see:

kernel: /mnt/Linux/linux/drivers/scsi/mvsas/mv_sas.c 1771:port 2 slot
0 rx_desc 30000 has error info0000000001000000.
kernel: sas: Enter sas_scsi_recover_host busy: 1 failed: 1
kernel: sas: ata21: end_device-7:2: cmd error handler
kernel: sas: ata7: end_device-7:0: dev error handler
kernel: sas: ata8: end_device-7:1: dev error handler
kernel: sas: ata21: end_device-7:2: dev error handler
kernel: ata21.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
kernel: sas: ata10: end_device-7:3: dev error handler
kernel: sas: ata11: end_device-7:4: dev error handler
kernel: ata21.00: failed command: READ SECTOR(S) EXT
kernel: ata21.00: cmd 24/00:01:69:86:7a/00:00:9d:00:00/e0 tag 17 pio 512 in
51/40:00:69:86:7a/00:00:9d:00:00/00 Emask 0x9 (media error)
kernel: sas: ata12: end_device-7:5: dev error handler
kernel: sas: ata13: end_device-7:6: dev error handler
kernel: ata21.00: status: { DRDY ERR }
kernel: sas: ata14: end_device-7:7: dev error handler
kernel: ata21.00: error: { UNC }
kernel: ata21.00: failed to IDENTIFY (I/O error, err_mask=0x1)
kernel: ata21.00: revalidation failed (errno=-5)
kernel: ata21: hard resetting link
(Continue reading)

Joao Pinto | 23 May 11:18 2016

[PATCH] ufs: Adding license info do tc-dwc-g210 and ufshcd-dwc to enable loadable modules

This patch adds license info to the tc-dwc-g210 and ufshcd-dwc files in
order for them to have access to some ufshcd symbols when all are built
as modules.

Signed-off-by: Joao Pinto <jpinto <at>>
 drivers/scsi/ufs/tc-dwc-g210.c | 4 ++++
 drivers/scsi/ufs/ufshcd-dwc.c  | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/scsi/ufs/tc-dwc-g210.c b/drivers/scsi/ufs/tc-dwc-g210.c
index 181f208..d6c5388 100644
--- a/drivers/scsi/ufs/tc-dwc-g210.c
+++ b/drivers/scsi/ufs/tc-dwc-g210.c
 <at>  <at>  -313,3 +313,7  <at>  <at>  out:
 	return ret;
+MODULE_AUTHOR("Joao Pinto <Joao.Pinto <at>>");
+MODULE_DESCRIPTION("Synopsys G210 Test Chip driver");
diff --git a/drivers/scsi/ufs/ufshcd-dwc.c b/drivers/scsi/ufs/ufshcd-dwc.c
index 9b3ca7f..5fd16c7 100644
--- a/drivers/scsi/ufs/ufshcd-dwc.c
+++ b/drivers/scsi/ufs/ufshcd-dwc.c
 <at>  <at>  -148,3 +148,7  <at>  <at>  out:
 	return err;
(Continue reading)