Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-06-24 10:04:02 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-06-24 10:12:05 +0200
commit9a507265a941f83084da2d7b859b557df4789ae8 (patch)
treec5d4311d478b7067d3bffc8cea70476fd6dd99eb
parent4e5afe9b835feac8545d943be9363a2eb08eaefd (diff)
parentdf28106c2c9c727c7c13faec38a714e4fcde3c67 (diff)
Merge branch 'SLE15' into SLE15-SP1
- Refresh patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table
-rw-r--r--patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error91
-rw-r--r--patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table37
-rw-r--r--patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event46
-rw-r--r--patches.fixes/s390-setup-fix-early-warning-messages104
-rw-r--r--patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully41
-rw-r--r--patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove33
-rw-r--r--patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host80
-rw-r--r--patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices92
-rw-r--r--patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs184
-rw-r--r--patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt56
-rw-r--r--series.conf10
11 files changed, 774 insertions, 0 deletions
diff --git a/patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error b/patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error
new file mode 100644
index 0000000000..1e59cbbdd7
--- /dev/null
+++ b/patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error
@@ -0,0 +1,91 @@
+From: Stefan Haberland <sth@linux.ibm.com>
+Date: Wed, 21 Nov 2018 12:39:47 +0100
+Subject: s390/dasd: fix using offset into zero size array error
+Git-commit: 4a8ef6999bce998fa5813023a9a6b56eea329dba
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+Dan Carpenter reported the following:
+
+The patch 52898025cf7d: "[S390] dasd: security and PSF update patch
+for EMC CKD ioctl" from Mar 8, 2010, leads to the following static
+checker warning:
+
+ drivers/s390/block/dasd_eckd.c:4486 dasd_symm_io()
+ error: using offset into zero size array 'psf_data[]'
+
+drivers/s390/block/dasd_eckd.c
+ 4458 /* Copy parms from caller */
+ 4459 rc = -EFAULT;
+ 4460 if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
+ ^^^^^^^
+The user can specify any "usrparm.psf_data_len". They choose zero by
+mistake.
+
+ 4461 goto out;
+ 4462 if (is_compat_task()) {
+ 4463 /* Make sure pointers are sane even on 31 bit. */
+ 4464 rc = -EINVAL;
+ 4465 if ((usrparm.psf_data >> 32) != 0)
+ 4466 goto out;
+ 4467 if ((usrparm.rssd_result >> 32) != 0)
+ 4468 goto out;
+ 4469 usrparm.psf_data &= 0x7fffffffULL;
+ 4470 usrparm.rssd_result &= 0x7fffffffULL;
+ 4471 }
+ 4472 /* alloc I/O data area */
+ 4473 psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL
+ | GFP_DMA);
+ 4474 rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL
+ | GFP_DMA);
+ 4475 if (!psf_data || !rssd_result) {
+
+kzalloc() returns a ZERO_SIZE_PTR (0x16).
+
+ 4476 rc = -ENOMEM;
+ 4477 goto out_free;
+ 4478 }
+ 4479
+ 4480 /* get syscall header from user space */
+ 4481 rc = -EFAULT;
+ 4482 if (copy_from_user(psf_data,
+ 4483 (void __user *)(unsigned long)
+ usrparm.psf_data,
+ 4484 usrparm.psf_data_len))
+
+That all works great.
+
+ 4485 goto out_free;
+ 4486 psf0 = psf_data[0];
+ 4487 psf1 = psf_data[1];
+
+But now we're assuming that "->psf_data_len" was at least 2 bytes.
+
+Fix this by checking the user specified length psf_data_len.
+
+Fixes: 52898025cf7d ("[S390] dasd: security and PSF update patch for EMC CKD ioctl")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/block/dasd_eckd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -4522,6 +4522,14 @@ static int dasd_symm_io(struct dasd_devi
+ usrparm.psf_data &= 0x7fffffffULL;
+ usrparm.rssd_result &= 0x7fffffffULL;
+ }
++ /* at least 2 bytes are accessed and should be allocated */
++ if (usrparm.psf_data_len < 2) {
++ DBF_DEV_EVENT(DBF_WARNING, device,
++ "Symmetrix ioctl invalid data length %d",
++ usrparm.psf_data_len);
++ rc = -EINVAL;
++ goto out;
++ }
+ /* alloc I/O data area */
+ psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
+ rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table b/patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table
new file mode 100644
index 0000000000..5605f68095
--- /dev/null
+++ b/patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table
@@ -0,0 +1,37 @@
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Mon, 18 Mar 2019 16:40:55 +0100
+Subject: s390/qeth: fix race when initializing the IP address table
+Git-commit: 7221b727f0079a32aca91f657141e1de564d4b97
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+The ucast IP table is utilized by some of the L3-specific sysfs attributes
+that qeth_l3_create_device_attributes() provides. So initialize the table
+_before_ registering the attributes.
+
+Fixes: ebccc7397e4a ("s390/qeth: add missing hash table initializations")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/qeth_l3_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3002,12 +3002,14 @@ static int qeth_l3_probe_device(struct c
+ struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
+
++ hash_init(card->ip_htable);
++
+ if (gdev->dev.type == &qeth_generic_devtype) {
+ rc = qeth_l3_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
+ }
+- hash_init(card->ip_htable);
++
+ hash_init(card->ip_mc_htable);
+ card->info.hwtrap = 0;
+ return 0;
diff --git a/patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event b/patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event
new file mode 100644
index 0000000000..0d2c825761
--- /dev/null
+++ b/patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event
@@ -0,0 +1,46 @@
+From: Alexandra Winter <wintera@linux.ibm.com>
+Date: Wed, 5 Jun 2019 13:48:50 +0200
+Subject: s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
+Git-commit: 335726195e460cb6b3f795b695bfd31f0ea70ef0
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Enabling sysfs attribute bridge_hostnotify triggers a series of udev events
+for the MAC addresses of all currently connected peers. In case no VLAN is
+set for a peer, the device reports the corresponding MAC addresses with
+VLAN ID 4096. This currently results in attribute VLAN=4096 for all
+non-VLAN interfaces in the initial series of events after host-notify is
+enabled.
+
+Instead, no VLAN attribute should be reported in the udev event for
+non-VLAN interfaces.
+
+Only the initial events face this issue. For dynamic changes that are
+reported later, the device uses a validity flag.
+
+This also changes the code so that it now sets the VLAN attribute for
+MAC addresses with VID 0. On Linux, no qeth interface will ever be
+registered with VID 0: Linux kernel registers VID 0 on all network
+interfaces initially, but qeth will drop .ndo_vlan_rx_add_vid for VID 0.
+Peers with other OSs could register MACs with VID 0.
+
+Fixes: 9f48b9db9a22 ("qeth: bridgeport support - address notifications")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/qeth_l2_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2053,7 +2053,7 @@ static void qeth_bridgeport_an_set_cb(vo
+
+ l2entry = (struct qdio_brinfo_entry_l2 *)entry;
+ code = IPA_ADDR_CHANGE_CODE_MACADDR;
+- if (l2entry->addr_lnid.lnid)
++ if (l2entry->addr_lnid.lnid < VLAN_N_VID)
+ code |= IPA_ADDR_CHANGE_CODE_VLANID;
+ qeth_bridge_emit_host_event(card, anev_reg_unreg, code,
+ (struct net_if_token *)&l2entry->nit,
diff --git a/patches.fixes/s390-setup-fix-early-warning-messages b/patches.fixes/s390-setup-fix-early-warning-messages
new file mode 100644
index 0000000000..c75b1b3bb9
--- /dev/null
+++ b/patches.fixes/s390-setup-fix-early-warning-messages
@@ -0,0 +1,104 @@
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Thu, 14 Feb 2019 15:40:56 +0100
+Subject: s390/setup: fix early warning messages
+Git-commit: 8727638426b0aea59d7f904ad8ddf483f9234f88
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+The setup_lowcore() function creates a new prefix page for the boot CPU.
+The PSW mask for the system_call, external interrupt, i/o interrupt and
+the program check handler have the DAT bit set in this new prefix page.
+
+At the time setup_lowcore is called the system still runs without virtual
+address translation, the paging_init() function creates the kernel page
+table and loads the CR13 with the kernel ASCE.
+
+Any code between setup_lowcore() and the end of paging_init() that has
+a BUG or WARN statement will create a program check that can not be
+handled correctly as there is no kernel page table yet.
+
+To allow early WARN statements initially setup the lowcore with DAT off
+and set the DAT bit only after paging_init() has completed.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/setup.c | 32 +++++++++++++++++++++++---------
+ 1 file changed, 23 insertions(+), 9 deletions(-)
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -300,7 +300,7 @@ early_param("vmalloc", parse_vmalloc);
+
+ void *restart_stack __section(.data);
+
+-static void __init setup_lowcore(void)
++static void __init setup_lowcore_dat_off(void)
+ {
+ struct lowcore *lc;
+
+@@ -311,19 +311,16 @@ static void __init setup_lowcore(void)
+ lc = memblock_virt_alloc_low(sizeof(*lc), sizeof(*lc));
+ lc->restart_psw.mask = PSW_KERNEL_BITS;
+ lc->restart_psw.addr = (unsigned long) restart_int_handler;
+- lc->external_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->external_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->external_new_psw.addr = (unsigned long) ext_int_handler;
+ lc->svc_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK;
++ PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK;
+ lc->svc_new_psw.addr = (unsigned long) system_call;
+- lc->program_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->program_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->program_new_psw.addr = (unsigned long) pgm_check_handler;
+ lc->mcck_new_psw.mask = PSW_KERNEL_BITS;
+ lc->mcck_new_psw.addr = (unsigned long) mcck_int_handler;
+- lc->io_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->io_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->io_new_psw.addr = (unsigned long) io_int_handler;
+ lc->clock_comparator = -1ULL;
+ lc->kernel_stack = ((unsigned long) &init_thread_union)
+@@ -391,6 +388,17 @@ static void __init setup_lowcore(void)
+ lowcore_ptr[0] = lc;
+ }
+
++static void __init setup_lowcore_dat_on(void)
++{
++ struct lowcore *lc;
++
++ lc = lowcore_ptr[0];
++ lc->external_new_psw.mask |= PSW_MASK_DAT;
++ lc->svc_new_psw.mask |= PSW_MASK_DAT;
++ lc->program_new_psw.mask |= PSW_MASK_DAT;
++ lc->io_new_psw.mask |= PSW_MASK_DAT;
++}
++
+ static struct resource code_resource = {
+ .name = "Kernel code",
+ .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM,
+@@ -945,7 +953,7 @@ void __init setup_arch(char **cmdline_p)
+ #endif
+
+ setup_resources();
+- setup_lowcore();
++ setup_lowcore_dat_off();
+ smp_fill_possible_mask();
+ cpu_detect_mhz_feature();
+ cpu_init();
+@@ -958,6 +966,12 @@ void __init setup_arch(char **cmdline_p)
+ */
+ paging_init();
+
++ /*
++ * After paging_init created the kernel page table, the new PSWs
++ * in lowcore can now run with DAT enabled.
++ */
++ setup_lowcore_dat_on();
++
+ /* Setup default console */
+ conmode_default();
+ set_preferred_console();
diff --git a/patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully b/patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully
new file mode 100644
index 0000000000..61c492a991
--- /dev/null
+++ b/patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully
@@ -0,0 +1,41 @@
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Mon, 21 Jan 2019 13:19:43 +0100
+Subject: s390/virtio: handle find on invalid queue gracefully
+Git-commit: 3438b2c039b4bf26881786a1f3450f016d66ad11
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+A queue with a capacity of zero is clearly not a valid virtio queue.
+Some emulators report zero queue size if queried with an invalid queue
+index. Instead of crashing in this case let us just return -ENOENT. To
+make that work properly, let us fix the notifier cleanup logic as well.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/virtio/virtio_ccw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -275,6 +275,8 @@ static void virtio_ccw_drop_indicators(s
+ {
+ struct virtio_ccw_vq_info *info;
+
++ if (!vcdev->airq_info)
++ return;
+ list_for_each_entry(info, &vcdev->virtqueues, node)
+ drop_airq_indicator(info->vq, vcdev->airq_info);
+ }
+@@ -416,7 +418,7 @@ static int virtio_ccw_read_vq_conf(struc
+ ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF);
+ if (ret)
+ return ret;
+- return vcdev->config_block->num;
++ return vcdev->config_block->num ?: -ENOENT;
+ }
+
+ static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw)
diff --git a/patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove b/patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove
new file mode 100644
index 0000000000..5ab2d2ec28
--- /dev/null
+++ b/patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove
@@ -0,0 +1,33 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Thu, 23 May 2019 15:23:45 +0200
+Subject: scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from
+ port_remove
+Git-commit: d27e5e07f9c49bf2a6a4ef254ce531c1b4fb5a38
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+With this early return due to zfcp_unit child(ren), we don't use the
+zfcp_port reference from the earlier zfcp_get_port_by_wwpn() anymore and
+need to put it.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: d99b601b6338 ("[SCSI] zfcp: restore refcount check on port_remove")
+Cc: <stable@vger.kernel.org> #3.7+
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/scsi/zfcp_sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/s390/scsi/zfcp_sysfs.c
++++ b/drivers/s390/scsi/zfcp_sysfs.c
+@@ -263,6 +263,7 @@ static ssize_t zfcp_sysfs_port_remove_st
+ if (atomic_read(&port->units) > 0) {
+ retval = -EBUSY;
+ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */
+ goto out;
+ }
+ /* port is about to be removed, so no more unit_add */
diff --git a/patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host b/patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host
new file mode 100644
index 0000000000..4df9fc3f92
--- /dev/null
+++ b/patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host
@@ -0,0 +1,80 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Tue, 26 Mar 2019 14:36:58 +0100
+Subject: scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
+Git-commit: fe67888fc007a76b81e37da23ce5bd8fb95890b0
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+An already deleted SCSI device can exist on the Scsi_Host and remain there
+because something still holds a reference. A new SCSI device with the same
+H:C:T:L and FCP device, target port WWPN, and FCP LUN can be created. When
+we try to unblock an rport, we still find the deleted SCSI device and
+return early because the zfcp_scsi_dev of that SCSI device is not
+ZFCP_STATUS_COMMON_UNBLOCKED. Hence we miss to unblock the rport, even if
+the new proper SCSI device would be in good state.
+
+Therefore, skip deleted SCSI devices when iterating the sdevs of the shost.
+[cf. __scsi_device_lookup{_by_target}() or scsi_device_get()]
+
+The following abbreviated trace sequence can indicate such problem:
+
+Area : REC
+Tag : ersfs_3
+LUN : 0x4045400300000000
+WWPN : 0x50050763031bd327
+LUN status : 0x40000000 not ZFCP_STATUS_COMMON_UNBLOCKED
+Ready count : n not incremented yet
+Running count : 0x00000000
+ERP want : 0x01
+ERP need : 0xc1 ZFCP_ERP_ACTION_NONE
+
+Area : REC
+Tag : ersfs_3
+LUN : 0x4045400300000000
+WWPN : 0x50050763031bd327
+LUN status : 0x41000000
+Ready count : n+1
+Running count : 0x00000000
+ERP want : 0x01
+ERP need : 0x01
+
+...
+
+Area : REC
+Level : 4 only with increased trace level
+Tag : ertru_l
+LUN : 0x4045400300000000
+WWPN : 0x50050763031bd327
+LUN status : 0x40000000
+Request ID : 0x0000000000000000
+ERP status : 0x01800000
+ERP step : 0x1000
+ERP action : 0x01
+ERP count : 0x00
+
+NOT followed by a trace record with tag "scpaddy"
+for WWPN 0x50050763031bd327.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: 6f2ce1c6af37 ("scsi: zfcp: fix rport unblock race with LUN recovery")
+Cc: <stable@vger.kernel.org> #2.6.32+
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/scsi/zfcp_erp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -1306,6 +1306,9 @@ static void zfcp_erp_try_rport_unblock(s
+ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+ int lun_status;
+
++ if (sdev->sdev_state == SDEV_DEL ||
++ sdev->sdev_state == SDEV_CANCEL)
++ continue;
+ if (zsdev->port != port)
+ continue;
+ /* LUN under port of interest */
diff --git a/patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices b/patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices
new file mode 100644
index 0000000000..2a855c2e34
--- /dev/null
+++ b/patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices
@@ -0,0 +1,92 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Tue, 26 Mar 2019 14:36:59 +0100
+Subject: scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV
+ FCP devices
+Git-commit: 242ec1455151267fe35a0834aa9038e4c4670884
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+Suppose more than one non-NPIV FCP device is active on the same channel.
+Send I/O to storage and have some of the pending I/O run into a SCSI
+command timeout, e.g. due to bit errors on the fibre. Now the error
+situation stops. However, we saw FCP requests continue to timeout in the
+channel. The abort will be successful, but the subsequent TUR fails.
+Scsi_eh starts. The LUN reset fails. The target reset fails. The host
+reset only did an FCP device recovery. However, for non-NPIV FCP devices,
+this does not close and reopen ports on the SAN-side if other non-NPIV FCP
+device(s) share the same open ports.
+
+In order to resolve the continuing FCP request timeouts, we need to
+explicitly close and reopen ports on the SAN-side.
+
+This was missing since the beginning of zfcp in v2.6.0 history commit
+ea127f975424 ("[PATCH] s390 (7/7): zfcp host adapter.").
+
+Note: The FSF requests for forced port reopen could run into FSF request
+timeouts due to other reasons. This would trigger an internal FCP device
+recovery. Pending forced port reopen recoveries would get dismissed. So
+some ports might not get fully reopened during this host reset handler.
+However, subsequent I/O would trigger the above described escalation and
+eventually all ports would be forced reopen to resolve any continuing FCP
+request timeouts due to earlier bit errors.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: <stable@vger.kernel.org> #3.0+
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/scsi/zfcp_erp.c | 14 ++++++++++++++
+ drivers/s390/scsi/zfcp_ext.h | 2 ++
+ drivers/s390/scsi/zfcp_scsi.c | 4 ++++
+ 3 files changed, 20 insertions(+)
+
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(st
+ add_timer(&erp_action->timer);
+ }
+
++void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag)
++{
++ unsigned long flags;
++ struct zfcp_port *port;
++
++ write_lock_irqsave(&adapter->erp_lock, flags);
++ read_lock(&adapter->port_list_lock);
++ list_for_each_entry(port, &adapter->port_list, list)
++ _zfcp_erp_port_forced_reopen(port, clear, dbftag);
++ read_unlock(&adapter->port_list_lock);
++ write_unlock_irqrestore(&adapter->erp_lock, flags);
++}
++
+ static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
+ int clear, char *id)
+ {
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(s
+ extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *);
+ extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *);
+ extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *);
++extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag);
+ extern void zfcp_erp_set_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *);
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handl
+ struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
+ int ret = SUCCESS, fc_ret;
+
++ if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) {
++ zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p");
++ zfcp_erp_wait(adapter);
++ }
+ zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
+ zfcp_erp_wait(adapter);
+ fc_ret = fc_block_scsi_eh(scpnt);
diff --git a/patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs b/patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs
new file mode 100644
index 0000000000..1ee44c3892
--- /dev/null
+++ b/patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs
@@ -0,0 +1,184 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Thu, 23 May 2019 15:23:46 +0200
+Subject: scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only
+ sdevs)
+Git-commit: ef4021fe5fd77ced0323cede27979d80a56211ca
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When the user tries to remove a zfcp port via sysfs, we only rejected it if
+there are zfcp unit children under the port. With purely automatically
+scanned LUNs there are no zfcp units but only SCSI devices. In such cases,
+the port_remove erroneously continued. We close the port and this
+implicitly closes all LUNs under the port. The SCSI devices survive with
+their private zfcp_scsi_dev still holding a reference to the "removed"
+zfcp_port (still allocated but invisible in sysfs) [zfcp_get_port_by_wwpn
+in zfcp_scsi_slave_alloc]. This is not a problem as long as the fc_rport
+stays blocked. Once (auto) port scan brings back the removed port, we
+unblock its fc_rport again by design. However, there is no mechanism that
+would recover (open) the LUNs under the port (no "ersfs_3" without
+zfcp_unit [zfcp_erp_strategy_followup_success]). Any pending or new I/O to
+such LUN leads to repeated:
+
+ Done: NEEDS_RETRY Result: hostbyte=DID_IMM_RETRY driverbyte=DRIVER_OK
+
+See also v4.10 commit 6f2ce1c6af37 ("scsi: zfcp: fix rport unblock race
+with LUN recovery"). Even a manual LUN recovery
+(echo 0 > /sys/bus/scsi/devices/H:C:T:L/zfcp_failed)
+does not help, as the LUN links to the old "removed" port which remains
+to lack ZFCP_STATUS_COMMON_RUNNING [zfcp_erp_required_act].
+The only workaround is to first ensure that the fc_rport is blocked
+(e.g. port_remove again in case it was re-discovered by (auto) port scan),
+then delete the SCSI devices, and finally re-discover by (auto) port scan.
+The port scan includes an fc_rport unblock, which in turn triggers
+a new scan on the scsi target to freshly get new pure auto scan LUNs.
+
+Fix this by rejecting port_remove also if there are SCSI devices
+(even without any zfcp_unit) under this port. Re-use mechanics from v3.7
+commit d99b601b6338 ("[SCSI] zfcp: restore refcount check on port_remove").
+However, we have to give up zfcp_sysfs_port_units_mutex earlier in unit_add
+to prevent a deadlock with scsi_host scan taking shost->scan_mutex first
+and then zfcp_sysfs_port_units_mutex now in our zfcp_scsi_slave_alloc().
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: b62a8d9b45b9 ("[SCSI] zfcp: Use SCSI device data zfcp scsi dev instead of zfcp unit")
+Fixes: f8210e34887e ("[SCSI] zfcp: Allow midlayer to scan for LUNs when running in NPIV mode")
+Cc: <stable@vger.kernel.org> #2.6.37+
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/scsi/zfcp_ext.h | 1
+ drivers/s390/scsi/zfcp_scsi.c | 9 ++++++
+ drivers/s390/scsi/zfcp_sysfs.c | 54 ++++++++++++++++++++++++++++++++++++-----
+ drivers/s390/scsi/zfcp_unit.c | 8 +++++-
+ 4 files changed, 65 insertions(+), 7 deletions(-)
+
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -161,6 +161,7 @@ extern const struct attribute_group *zfc
+ extern struct mutex zfcp_sysfs_port_units_mutex;
+ extern struct device_attribute *zfcp_sysfs_sdev_attrs[];
+ extern struct device_attribute *zfcp_sysfs_shost_attrs[];
++bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port);
+
+ /* zfcp_unit.c */
+ extern int zfcp_unit_add(struct zfcp_port *, u64);
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -124,6 +124,15 @@ static int zfcp_scsi_slave_alloc(struct
+
+ zfcp_sdev->erp_action.port = port;
+
++ mutex_lock(&zfcp_sysfs_port_units_mutex);
++ if (zfcp_sysfs_port_is_removing(port)) {
++ /* port is already gone */
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */
++ return -ENXIO;
++ }
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++
+ unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev));
+ if (unit)
+ put_device(&unit->dev);
+--- a/drivers/s390/scsi/zfcp_sysfs.c
++++ b/drivers/s390/scsi/zfcp_sysfs.c
+@@ -237,6 +237,53 @@ static ZFCP_DEV_ATTR(adapter, port_resca
+
+ DEFINE_MUTEX(zfcp_sysfs_port_units_mutex);
+
++static void zfcp_sysfs_port_set_removing(struct zfcp_port *const port)
++{
++ lockdep_assert_held(&zfcp_sysfs_port_units_mutex);
++ atomic_set(&port->units, -1);
++}
++
++bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port)
++{
++ lockdep_assert_held(&zfcp_sysfs_port_units_mutex);
++ return atomic_read(&port->units) == -1;
++}
++
++static bool zfcp_sysfs_port_in_use(struct zfcp_port *const port)
++{
++ struct zfcp_adapter *const adapter = port->adapter;
++ unsigned long flags;
++ struct scsi_device *sdev;
++ bool in_use = true;
++
++ mutex_lock(&zfcp_sysfs_port_units_mutex);
++ if (atomic_read(&port->units) > 0)
++ goto unlock_port_units_mutex; /* zfcp_unit(s) under port */
++
++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, adapter->scsi_host) {
++ const struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
++
++ if (sdev->sdev_state == SDEV_DEL ||
++ sdev->sdev_state == SDEV_CANCEL)
++ continue;
++ if (zsdev->port != port)
++ continue;
++ /* alive scsi_device under port of interest */
++ goto unlock_host_lock;
++ }
++
++ /* port is about to be removed, so no more unit_add or slave_alloc */
++ zfcp_sysfs_port_set_removing(port);
++ in_use = false;
++
++unlock_host_lock:
++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
++unlock_port_units_mutex:
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ return in_use;
++}
++
+ static ssize_t zfcp_sysfs_port_remove_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+@@ -259,16 +306,11 @@ static ssize_t zfcp_sysfs_port_remove_st
+ else
+ retval = 0;
+
+- mutex_lock(&zfcp_sysfs_port_units_mutex);
+- if (atomic_read(&port->units) > 0) {
++ if (zfcp_sysfs_port_in_use(port)) {
+ retval = -EBUSY;
+- mutex_unlock(&zfcp_sysfs_port_units_mutex);
+ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */
+ goto out;
+ }
+- /* port is about to be removed, so no more unit_add */
+- atomic_set(&port->units, -1);
+- mutex_unlock(&zfcp_sysfs_port_units_mutex);
+
+ write_lock_irq(&adapter->port_list_lock);
+ list_del(&port->list);
+--- a/drivers/s390/scsi/zfcp_unit.c
++++ b/drivers/s390/scsi/zfcp_unit.c
+@@ -123,7 +123,7 @@ int zfcp_unit_add(struct zfcp_port *port
+ int retval = 0;
+
+ mutex_lock(&zfcp_sysfs_port_units_mutex);
+- if (atomic_read(&port->units) == -1) {
++ if (zfcp_sysfs_port_is_removing(port)) {
+ /* port is already gone */
+ retval = -ENODEV;
+ goto out;
+@@ -167,8 +167,14 @@ int zfcp_unit_add(struct zfcp_port *port
+ write_lock_irq(&port->unit_list_lock);
+ list_add_tail(&unit->list, &port->unit_list);
+ write_unlock_irq(&port->unit_list_lock);
++ /*
++ * lock order: shost->scan_mutex before zfcp_sysfs_port_units_mutex
++ * due to zfcp_unit_scsi_scan() => zfcp_scsi_slave_alloc()
++ */
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
+
+ zfcp_unit_scsi_scan(unit);
++ return retval;
+
+ out:
+ mutex_unlock(&zfcp_sysfs_port_units_mutex);
diff --git a/patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt b/patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt
new file mode 100644
index 0000000000..8c109ab987
--- /dev/null
+++ b/patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt
@@ -0,0 +1,56 @@
+From: Cornelia Huck <cohuck@redhat.com>
+Date: Mon, 11 Mar 2019 10:59:53 +0100
+Subject: vfio: ccw: only free cp on final interrupt
+Git-commit: 50b7f1b7236bab08ebbbecf90521e84b068d7a17
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+When we get an interrupt for a channel program, it is not
+necessarily the final interrupt; for example, the issuing
+guest may request an intermediate interrupt by specifying
+the program-controlled-interrupt flag on a ccw.
+
+We must not switch the state to idle if the interrupt is not
+yet final; even more importantly, we must not free the translated
+channel program if the interrupt is not yet final, or the host
+can crash during cp rewind.
+
+Fixes: e5f84dbaea59 ("vfio: ccw: return I/O results asynchronously")
+Cc: stable@vger.kernel.org # v4.12+
+Reviewed-by: Eric Farman <farman@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/cio/vfio_ccw_drv.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -71,21 +71,25 @@ static void vfio_ccw_sch_io_todo(struct
+ struct vfio_ccw_private *private;
+ struct subchannel *sch;
+ struct irb *irb;
++ bool is_final;
+
+ private = container_of(work, struct vfio_ccw_private, io_work);
+ irb = &private->irb;
+ sch = private->sch;
+
++ is_final = !(scsw_actl(&irb->scsw) &
++ (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
+ if (scsw_is_solicited(&irb->scsw)) {
+ cp_update_scsw(&private->cp, &irb->scsw);
+- cp_free(&private->cp);
++ if (is_final)
++ cp_free(&private->cp);
+ }
+ memcpy(private->io_region.irb_area, irb, sizeof(*irb));
+
+ if (private->io_trigger)
+ eventfd_signal(private->io_trigger, 1);
+
+- if (private->mdev)
++ if (private->mdev && is_final)
+ private->state = VFIO_CCW_STATE_IDLE;
+ }
+
diff --git a/series.conf b/series.conf
index 3a55971dc6..5b954a9717 100644
--- a/series.conf
+++ b/series.conf
@@ -44892,6 +44892,7 @@
patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch
patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch
patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch
+ patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error
patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
patches.drivers/ALSA-hda-Add-quirk-for-HP-EliteBook-840-G5.patch
patches.drivers/ALSA-usb-audio-Fix-implicit-fb-endpoint-setup-by-qui.patch
@@ -45368,6 +45369,7 @@
patches.arch/s390-pci-improve-bar-check
patches.arch/s390-pci-map-iov-resources
patches.arch/s390-jump_label-Use-jdd-constraint-on-gcc9.patch
+ patches.fixes/s390-setup-fix-early-warning-messages
patches.arch/s390-ism-ignore-some-errors-during-deregistration
patches.fixes/0001-s390-vfio_ap-link-the-vfio_ap-devices-to-the-vfio_ap.patch
patches.drivers/clocksource-drivers-sun5i-Fail-gracefully-when-clock.patch
@@ -45759,6 +45761,7 @@
patches.arch/0003-dma-introduce-dma_max_mapping_size
patches.arch/0004-virtio-introduce-virtio_max_dma_size
patches.arch/0005-virtio-blk-consider-virtio_max_dma_size-for-maximum-segment-size
+ patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully
patches.drivers/platform-x86-mlx-platform-Add-support-for-fan-direct.patch
patches.drivers/platform_data-mlxreg-Document-fixes-for-core-platfor.patch
patches.drivers/platform_data-mlxreg-Add-capability-field-to-core-pl.patch
@@ -46024,6 +46027,7 @@
patches.suse/packets-Always-register-packet-sk-in-the-same-order.patch
patches.suse/sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch
patches.drivers/mISDN-hfcpci-Test-both-vendor-device-ID-for-Digium-H.patch
+ patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table
patches.suse/net-stmmac-fix-memory-corruption-with-large-MTUs.patch
patches.suse/tcp-do-not-use-ipv6-header-for-ipv4-flow.patch
patches.suse/dccp-do-not-use-ipv6-header-for-ipv4-flow.patch
@@ -46038,6 +46042,7 @@
patches.drivers/net-phy-don-t-clear-BMCR-in-genphy_soft_reset.patch
patches.drivers/chelsio-use-BUG-instead-of-BUG_ON-1.patch
patches.arch/ARM-imx6q-cpuidle-fix-bug-that-CPU-might-not-wake-up.patch
+ patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt
patches.drm/drm-tegra-hub-Fix-dereference-before-check.patch
patches.drm/drm-vgem-fix-use-after-free-when-drm_gem_handle_crea.patch
patches.drm/drm-vkms-fix-use-after-free-when-drm_gem_handle_crea.patch
@@ -46068,6 +46073,8 @@
patches.drivers/ALSA-pcm-Don-t-suspend-stream-in-unrecoverable-PCM-s.patch
patches.drivers/ALSA-hda-realtek-Fix-speakers-on-Acer-Predator-Helio.patch
patches.drivers/i2c-i801-Add-support-for-Intel-Comet-Lake.patch
+ patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host
+ patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices
patches.drivers/iommu-don-t-print-warning-when-iommu-driver-only-supports-unmanaged-domains
patches.drivers/iommu-amd-reserve-exclusion-range-in-iova-domain
patches.fixes/mm-Fix-modifying-of-page-protection-by-insert_pfn.patch
@@ -47175,6 +47182,8 @@
patches.arch/s390-pci-fix-assignment-of-bus-resources
patches.suse/memcg-make-it-work-on-sparse-non-0-node-systems.patch
patches.suse/kernel-signal.c-trace_signal_deliver-when-signal_gro.patch
+ patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove
+ patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs
patches.drivers/leds-avoid-flush_work-in-atomic-context.patch
patches.drivers/i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch
patches.drivers/i2c-synquacer-fix-synquacer_i2c_doxfer-return-value.patch
@@ -47183,6 +47192,7 @@
patches.fixes/efi-x86-Add-missing-error-handling-to-old_memmap-1-1.patch
patches.arch/x86-cpu-amd-don-t-force-the-cpb-cap-when-running-under-a-hypervisor.patch
patches.fixes/fuse-fallocate-fix-return-with-locked-inode.patch
+ patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event
patches.drivers/hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch
patches.drivers/hwmon-pmbus-core-Treat-parameters-as-paged-if-on-mul.patch
patches.drm/drm-i915-gvt-Initialize-intel_gvt_gtt_entry-in-stack.patch