Home Home > GIT Browse > vanilla
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-06-24 07:48:25 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-06-24 07:48:25 +0200
commitb7cfa788cb35cb325a28714a9dc1a7f3f7765a71 (patch)
tree6f5326ce11dff3d8f3859f9f70aa9fca2965bb94
parentaf9d258df45988246b72a8c377f4c6ad0e706311 (diff)
parent18db74f48605853302ac08cdd0971a72da467f39 (diff)
Merge branch 'SLE15-SP1' into SLE15-SP1_EMBARGO
-rw-r--r--patches.drivers/new-primitive-vmemdup_user78
-rw-r--r--patches.drivers/scsi-hpsa-bump-driver-version30
-rw-r--r--patches.drivers/scsi-hpsa-check-for-lv-removal49
-rw-r--r--patches.drivers/scsi-hpsa-clean-up-two-indentation-issues40
-rw-r--r--patches.drivers/scsi-hpsa-correct-device-id-issues46
-rw-r--r--patches.drivers/scsi-hpsa-correct-device-resets496
-rw-r--r--patches.drivers/scsi-hpsa-correct-ioaccel2-chaining62
-rw-r--r--patches.drivers/scsi-hpsa-correct-simple-mode90
-rw-r--r--patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs68
-rw-r--r--patches.drivers/scsi-hpsa-remove-timeout-from-turs36
-rw-r--r--patches.drivers/scsi-hpsa-switch-to-generic-dma-api439
-rw-r--r--patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code52
-rw-r--r--patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev34
-rw-r--r--series.conf13
14 files changed, 1533 insertions, 0 deletions
diff --git a/patches.drivers/new-primitive-vmemdup_user b/patches.drivers/new-primitive-vmemdup_user
new file mode 100644
index 0000000000..07f40b17d8
--- /dev/null
+++ b/patches.drivers/new-primitive-vmemdup_user
@@ -0,0 +1,78 @@
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 7 Jan 2018 13:06:15 -0500
+Subject: new primitive: vmemdup_user()
+Git-commit: 50fd2f298bef9d1f69ac755f1fdf70cd98746be2
+Patch-mainline: v4.16-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+similar to memdup_user(), but does *not* guarantee that result will
+be physically contiguous; use only in cases where that's not a requirement
+and free it with kvfree().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ include/linux/string.h | 1 +
+ mm/util.c | 29 ++++++++++++++++++++++++++++-
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/string.h b/include/linux/string.h
+index 410ecf17de3c..12d5429de0c8 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -11,6 +11,7 @@
+
+ extern char *strndup_user(const char __user *, long);
+ extern void *memdup_user(const void __user *, size_t);
++extern void *vmemdup_user(const void __user *, size_t);
+ extern void *memdup_user_nul(const void __user *, size_t);
+
+ /*
+diff --git a/mm/util.c b/mm/util.c
+index 4b93ffa6df96..c1250501364f 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -150,7 +150,8 @@ EXPORT_SYMBOL(kmemdup_nul);
+ * @src: source address in user space
+ * @len: number of bytes to copy
+ *
+- * Returns an ERR_PTR() on failure.
++ * Returns an ERR_PTR() on failure. Result is physically
++ * contiguous, to be freed by kfree().
+ */
+ void *memdup_user(const void __user *src, size_t len)
+ {
+@@ -169,6 +170,32 @@ void *memdup_user(const void __user *src, size_t len)
+ }
+ EXPORT_SYMBOL(memdup_user);
+
++/**
++ * vmemdup_user - duplicate memory region from user space
++ *
++ * @src: source address in user space
++ * @len: number of bytes to copy
++ *
++ * Returns an ERR_PTR() on failure. Result may be not
++ * physically contiguous. Use kvfree() to free.
++ */
++void *vmemdup_user(const void __user *src, size_t len)
++{
++ void *p;
++
++ p = kvmalloc(len, GFP_USER);
++ if (!p)
++ return ERR_PTR(-ENOMEM);
++
++ if (copy_from_user(p, src, len)) {
++ kvfree(p);
++ return ERR_PTR(-EFAULT);
++ }
++
++ return p;
++}
++EXPORT_SYMBOL(vmemdup_user);
++
+ /*
+ * strndup_user - duplicate an existing string from user space
+ * @s: The string to duplicate
+
diff --git a/patches.drivers/scsi-hpsa-bump-driver-version b/patches.drivers/scsi-hpsa-bump-driver-version
new file mode 100644
index 0000000000..88dca102ab
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-bump-driver-version
@@ -0,0 +1,30 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 12 Mar 2019 13:11:52 -0500
+Subject: scsi: hpsa: bump driver version
+Git-commit: c59c32cdb2abedb39d6ab8ac3be2efebf026aa41
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+Reviewed-by: Gerry Morong <gerry.morong@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index ff0e3cc33f65..1bef1da273c2 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -60,7 +60,7 @@
+ * HPSA_DRIVER_VERSION must be 3 byte values (0-255) separated by '.'
+ * with an optional trailing '-' followed by a byte value (0-255).
+ */
+-#define HPSA_DRIVER_VERSION "3.4.20-125"
++#define HPSA_DRIVER_VERSION "3.4.20-160"
+ #define DRIVER_NAME "HP HPSA Driver (v " HPSA_DRIVER_VERSION ")"
+ #define HPSA "hpsa"
+
+
diff --git a/patches.drivers/scsi-hpsa-check-for-lv-removal b/patches.drivers/scsi-hpsa-check-for-lv-removal
new file mode 100644
index 0000000000..0242f2aa4e
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-check-for-lv-removal
@@ -0,0 +1,49 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 12 Mar 2019 13:11:33 -0500
+Subject: scsi: hpsa: check for lv removal
+Git-commit: 49ea45cb1d97fd65090b00c887dcf7650ced8c1b
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+Multipath failures are normally detected at the frequency of the event
+thread. Detect LUN failures earlier by checking request completion status.
+
+Reviewed-by: Bader Ali-saleh <bader.ali-saleh@microsemi.com>
+Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Prasad Munirathnam <Prasad.Munirathnam@microsemi.com>
+Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index f044e7d10d63..f311ab259a02 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2647,9 +2647,20 @@ static void complete_scsi_command(struct CommandList *cp)
+ decode_sense_data(ei->SenseInfo, sense_data_size,
+ &sense_key, &asc, &ascq);
+ if (ei->ScsiStatus == SAM_STAT_CHECK_CONDITION) {
+- if (sense_key == ABORTED_COMMAND) {
++ switch (sense_key) {
++ case ABORTED_COMMAND:
+ cmd->result |= DID_SOFT_ERROR << 16;
+ break;
++ case UNIT_ATTENTION:
++ if (asc == 0x3F && ascq == 0x0E)
++ h->drv_req_rescan = 1;
++ break;
++ case ILLEGAL_REQUEST:
++ if (asc == 0x25 && ascq == 0x00) {
++ dev->removed = 1;
++ cmd->result = DID_NO_CONNECT << 16;
++ }
++ break;
+ }
+ break;
+ }
+
diff --git a/patches.drivers/scsi-hpsa-clean-up-two-indentation-issues b/patches.drivers/scsi-hpsa-clean-up-two-indentation-issues
new file mode 100644
index 0000000000..e09d213775
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-clean-up-two-indentation-issues
@@ -0,0 +1,40 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 22 Jan 2019 15:18:30 +0000
+Subject: scsi: hpsa: clean up two indentation issues
+Git-commit: b64ae4abbdc4a5d56de8c97095a43182c10aa726
+Patch-mainline: v5.1-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+There are two statements that are indented incorrectly. Fix these.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index ff67ef5d5347..5284444fdd10 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1327,7 +1327,7 @@ static int hpsa_scsi_add_entry(struct ctlr_info *h,
+ dev_warn(&h->pdev->dev, "physical device with no LUN=0,"
+ " suspect firmware bug or unsupported hardware "
+ "configuration.\n");
+- return -1;
++ return -1;
+ }
+
+ lun_assigned:
+@@ -4110,7 +4110,7 @@ static int hpsa_gather_lun_info(struct ctlr_info *h,
+ "maximum logical LUNs (%d) exceeded. "
+ "%d LUNs ignored.\n", HPSA_MAX_LUN,
+ *nlogicals - HPSA_MAX_LUN);
+- *nlogicals = HPSA_MAX_LUN;
++ *nlogicals = HPSA_MAX_LUN;
+ }
+ if (*nlogicals + *nphysicals > HPSA_MAX_PHYS_LUN) {
+ dev_warn(&h->pdev->dev,
+
diff --git a/patches.drivers/scsi-hpsa-correct-device-id-issues b/patches.drivers/scsi-hpsa-correct-device-id-issues
new file mode 100644
index 0000000000..e66fb53a93
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-correct-device-id-issues
@@ -0,0 +1,46 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 12 Mar 2019 13:11:39 -0500
+Subject: scsi: hpsa: correct device id issues
+Git-commit: a45bcc4e11b1ebc9a2301c457f7746a1309e8a94
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+Correct a 'rare' race condition where a disk is failed after a device list
+has been obtained from the controller and before attempting to get the
+device id.
+
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index f311ab259a02..bd98a9667ce4 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3967,14 +3967,18 @@ static int hpsa_update_device_info(struct ctlr_info *h,
+ memset(this_device->device_id, 0,
+ sizeof(this_device->device_id));
+ if (hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
+- sizeof(this_device->device_id)) < 0)
++ sizeof(this_device->device_id)) < 0) {
+ dev_err(&h->pdev->dev,
+- "hpsa%d: %s: can't get device id for host %d:C0:T%d:L%d\t%s\t%.16s\n",
++ "hpsa%d: %s: can't get device id for [%d:%d:%d:%d]\t%s\t%.16s\n",
+ h->ctlr, __func__,
+ h->scsi_host->host_no,
+- this_device->target, this_device->lun,
++ this_device->bus, this_device->target,
++ this_device->lun,
+ scsi_device_type(this_device->devtype),
+ this_device->model);
++ rc = HPSA_LV_FAILED;
++ goto bail_out;
++ }
+
+ if ((this_device->devtype == TYPE_DISK ||
+ this_device->devtype == TYPE_ZBC) &&
+
diff --git a/patches.drivers/scsi-hpsa-correct-device-resets b/patches.drivers/scsi-hpsa-correct-device-resets
new file mode 100644
index 0000000000..77df60d47a
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-correct-device-resets
@@ -0,0 +1,496 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 7 May 2019 13:32:33 -0500
+Subject: scsi: hpsa: correct device resets
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
+Git-commit: c5dfd106414f3e038fee5c6f0800fd55ed07b41d
+References: jsc#SLE-4712 bsc#1136156
+
+Correct a race condition that occurs between the reset handler and the
+completion handler. There are times when the wait_event condition is
+never met due to this race condition and the reset never completes.
+
+The reset_pending field is NULL initially.
+
+ t Reset Handler Thread Completion Thread
+ -- -------------------- -----------------
+ t1 if (c->reset_pending)
+ t2 c->reset_pending = dev; if (atomic_dev_and_test(counter))
+ t3 atomic_inc(counter) wait_up_all(event_sync_wait_queue)
+ t4
+ t5 wait_event(...counter == 0)
+
+Kernel.org Bugzilla:
+ https://bugzilla.kernel.org/show_bug.cgi?id=1994350
+ Bug 199435 - HPSA + P420i resetting logical Direct-Access
+ never complete
+
+Reviewed-by: Justin Lindley <justin.lindley@microsemi.com>
+Reviewed-by: David Carroll <david.carroll@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 173 +++++++++++++++++++++++-------------------------
+ drivers/scsi/hpsa.h | 3
+ drivers/scsi/hpsa_cmd.h | 2
+ 3 files changed, 88 insertions(+), 90 deletions(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -343,11 +343,6 @@ static inline bool hpsa_is_cmd_idle(stru
+ return c->scsi_cmd == SCSI_CMD_IDLE;
+ }
+
+-static inline bool hpsa_is_pending_event(struct CommandList *c)
+-{
+- return c->reset_pending;
+-}
+-
+ /* extract sense key, asc, and ascq from sense data. -1 means invalid. */
+ static void decode_sense_data(const u8 *sense_data, int sense_data_len,
+ u8 *sense_key, u8 *asc, u8 *ascq)
+@@ -1144,6 +1139,8 @@ static void __enqueue_cmd_and_start_io(s
+ {
+ dial_down_lockup_detection_during_fw_flash(h, c);
+ atomic_inc(&h->commands_outstanding);
++ if (c->device)
++ atomic_inc(&c->device->commands_outstanding);
+
+ reply_queue = h->reply_map[raw_smp_processor_id()];
+ switch (c->cmd_type) {
+@@ -1167,9 +1164,6 @@ static void __enqueue_cmd_and_start_io(s
+
+ static void enqueue_cmd_and_start_io(struct ctlr_info *h, struct CommandList *c)
+ {
+- if (unlikely(hpsa_is_pending_event(c)))
+- return finish_cmd(c);
+-
+ __enqueue_cmd_and_start_io(h, c, DEFAULT_REPLY_QUEUE);
+ }
+
+@@ -2412,13 +2406,16 @@ static int handle_ioaccel_mode2_error(st
+ break;
+ }
+
++ if (dev->in_reset)
++ retry = 0;
++
+ return retry; /* retry on raid path? */
+ }
+
+ static void hpsa_cmd_resolve_events(struct ctlr_info *h,
+ struct CommandList *c)
+ {
+- bool do_wake = false;
++ struct hpsa_scsi_dev_t *dev = c->device;
+
+ /*
+ * Reset c->scsi_cmd here so that the reset handler will know
+@@ -2427,25 +2424,12 @@ static void hpsa_cmd_resolve_events(stru
+ */
+ c->scsi_cmd = SCSI_CMD_IDLE;
+ mb(); /* Declare command idle before checking for pending events. */
+- if (c->reset_pending) {
+- unsigned long flags;
+- struct hpsa_scsi_dev_t *dev;
+-
+- /*
+- * There appears to be a reset pending; lock the lock and
+- * reconfirm. If so, then decrement the count of outstanding
+- * commands and wake the reset command if this is the last one.
+- */
+- spin_lock_irqsave(&h->lock, flags);
+- dev = c->reset_pending; /* Re-fetch under the lock. */
+- if (dev && atomic_dec_and_test(&dev->reset_cmds_out))
+- do_wake = true;
+- c->reset_pending = NULL;
+- spin_unlock_irqrestore(&h->lock, flags);
++ if (dev) {
++ atomic_dec(&dev->commands_outstanding);
++ if (dev->in_reset &&
++ atomic_read(&dev->commands_outstanding) <= 0)
++ wake_up_all(&h->event_sync_wait_queue);
+ }
+-
+- if (do_wake)
+- wake_up_all(&h->event_sync_wait_queue);
+ }
+
+ static void hpsa_cmd_resolve_and_free(struct ctlr_info *h,
+@@ -2494,6 +2478,11 @@ static void process_ioaccel2_completion(
+ dev->offload_to_be_enabled = 0;
+ }
+
++ if (dev->in_reset) {
++ cmd->result = DID_RESET << 16;
++ return hpsa_cmd_free_and_done(h, c, cmd);
++ }
++
+ return hpsa_retry_cmd(h, c);
+ }
+
+@@ -2593,10 +2582,6 @@ static void complete_scsi_command(struct
+ return hpsa_cmd_free_and_done(h, cp, cmd);
+ }
+
+- if ((unlikely(hpsa_is_pending_event(cp))))
+- if (cp->reset_pending)
+- return hpsa_cmd_free_and_done(h, cp, cmd);
+-
+ if (cp->cmd_type == CMD_IOACCEL2)
+ return process_ioaccel2_completion(h, cp, cmd, dev);
+
+@@ -3046,7 +3031,7 @@ out:
+ return rc;
+ }
+
+-static int hpsa_send_reset(struct ctlr_info *h, unsigned char *scsi3addr,
++static int hpsa_send_reset(struct ctlr_info *h, struct hpsa_scsi_dev_t *dev,
+ u8 reset_type, int reply_queue)
+ {
+ int rc = IO_OK;
+@@ -3054,11 +3039,10 @@ static int hpsa_send_reset(struct ctlr_i
+ struct ErrorInfo *ei;
+
+ c = cmd_alloc(h);
+-
++ c->device = dev;
+
+ /* fill_cmd can't fail here, no data buffer to map. */
+- (void) fill_cmd(c, reset_type, h, NULL, 0, 0,
+- scsi3addr, TYPE_MSG);
++ (void) fill_cmd(c, reset_type, h, NULL, 0, 0, dev->scsi3addr, TYPE_MSG);
+ rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
+ if (rc) {
+ dev_warn(&h->pdev->dev, "Failed to send reset command\n");
+@@ -3136,9 +3120,8 @@ static bool hpsa_cmd_dev_match(struct ct
+ }
+
+ static int hpsa_do_reset(struct ctlr_info *h, struct hpsa_scsi_dev_t *dev,
+- unsigned char *scsi3addr, u8 reset_type, int reply_queue)
++ u8 reset_type, int reply_queue)
+ {
+- int i;
+ int rc = 0;
+
+ /* We can really only handle one reset at a time */
+@@ -3147,38 +3130,14 @@ static int hpsa_do_reset(struct ctlr_inf
+ return -EINTR;
+ }
+
+- BUG_ON(atomic_read(&dev->reset_cmds_out) != 0);
+-
+- for (i = 0; i < h->nr_cmds; i++) {
+- struct CommandList *c = h->cmd_pool + i;
+- int refcount = atomic_inc_return(&c->refcount);
+-
+- if (refcount > 1 && hpsa_cmd_dev_match(h, c, dev, scsi3addr)) {
+- unsigned long flags;
+-
+- /*
+- * Mark the target command as having a reset pending,
+- * then lock a lock so that the command cannot complete
+- * while we're considering it. If the command is not
+- * idle then count it; otherwise revoke the event.
+- */
+- c->reset_pending = dev;
+- spin_lock_irqsave(&h->lock, flags); /* Implied MB */
+- if (!hpsa_is_cmd_idle(c))
+- atomic_inc(&dev->reset_cmds_out);
+- else
+- c->reset_pending = NULL;
+- spin_unlock_irqrestore(&h->lock, flags);
+- }
+-
+- cmd_free(h, c);
+- }
+-
+- rc = hpsa_send_reset(h, scsi3addr, reset_type, reply_queue);
+- if (!rc)
++ rc = hpsa_send_reset(h, dev, reset_type, reply_queue);
++ if (!rc) {
++ /* incremented by sending the reset request */
++ atomic_dec(&dev->commands_outstanding);
+ wait_event(h->event_sync_wait_queue,
+- atomic_read(&dev->reset_cmds_out) == 0 ||
++ atomic_read(&dev->commands_outstanding) <= 0 ||
+ lockup_detected(h));
++ }
+
+ if (unlikely(lockup_detected(h))) {
+ dev_warn(&h->pdev->dev,
+@@ -3186,10 +3145,8 @@ static int hpsa_do_reset(struct ctlr_inf
+ rc = -ENODEV;
+ }
+
+- if (unlikely(rc))
+- atomic_set(&dev->reset_cmds_out, 0);
+- else
+- rc = wait_for_device_to_become_ready(h, scsi3addr, 0);
++ if (!rc)
++ rc = wait_for_device_to_become_ready(h, dev->scsi3addr, 0);
+
+ mutex_unlock(&h->reset_mutex);
+ return rc;
+@@ -4818,6 +4775,9 @@ static int hpsa_scsi_ioaccel_direct_map(
+
+ c->phys_disk = dev;
+
++ if (dev->in_reset)
++ return -1;
++
+ return hpsa_scsi_ioaccel_queue_command(h, c, dev->ioaccel_handle,
+ cmd->cmnd, cmd->cmd_len, dev->scsi3addr, dev);
+ }
+@@ -5008,6 +4968,11 @@ static int hpsa_scsi_ioaccel2_queue_comm
+ } else
+ cp->sg_count = (u8) use_sg;
+
++ if (phys_disk->in_reset) {
++ cmd->result = DID_RESET << 16;
++ return -1;
++ }
++
+ enqueue_cmd_and_start_io(h, c);
+ return 0;
+ }
+@@ -5025,6 +4990,9 @@ static int hpsa_scsi_ioaccel_queue_comma
+ if (!c->scsi_cmd->device->hostdata)
+ return -1;
+
++ if (phys_disk->in_reset)
++ return -1;
++
+ /* Try to honor the device's queue depth */
+ if (atomic_inc_return(&phys_disk->ioaccel_cmds_out) >
+ phys_disk->queue_depth) {
+@@ -5108,6 +5076,9 @@ static int hpsa_scsi_ioaccel_raid_map(st
+ if (!dev)
+ return -1;
+
++ if (dev->in_reset)
++ return -1;
++
+ /* check for valid opcode, get LBA and block count */
+ switch (cmd->cmnd[0]) {
+ case WRITE_6:
+@@ -5412,13 +5383,13 @@ static int hpsa_scsi_ioaccel_raid_map(st
+ */
+ static int hpsa_ciss_submit(struct ctlr_info *h,
+ struct CommandList *c, struct scsi_cmnd *cmd,
+- unsigned char scsi3addr[])
++ struct hpsa_scsi_dev_t *dev)
+ {
+ cmd->host_scribble = (unsigned char *) c;
+ c->cmd_type = CMD_SCSI;
+ c->scsi_cmd = cmd;
+ c->Header.ReplyQueue = 0; /* unused in simple mode */
+- memcpy(&c->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
++ memcpy(&c->Header.LUN.LunAddrBytes[0], &dev->scsi3addr[0], 8);
+ c->Header.tag = cpu_to_le64((c->cmdindex << DIRECT_LOOKUP_SHIFT));
+
+ /* Fill in the request block... */
+@@ -5469,6 +5440,12 @@ static int hpsa_ciss_submit(struct ctlr_
+ hpsa_cmd_resolve_and_free(h, c);
+ return SCSI_MLQUEUE_HOST_BUSY;
+ }
++
++ if (dev->in_reset) {
++ hpsa_cmd_resolve_and_free(h, c);
++ return SCSI_MLQUEUE_HOST_BUSY;
++ }
++
+ enqueue_cmd_and_start_io(h, c);
+ /* the cmd'll come back via intr handler in complete_scsi_command() */
+ return 0;
+@@ -5520,8 +5497,7 @@ static inline void hpsa_cmd_partial_init
+ }
+
+ static int hpsa_ioaccel_submit(struct ctlr_info *h,
+- struct CommandList *c, struct scsi_cmnd *cmd,
+- unsigned char *scsi3addr)
++ struct CommandList *c, struct scsi_cmnd *cmd)
+ {
+ struct hpsa_scsi_dev_t *dev = cmd->device->hostdata;
+ int rc = IO_ACCEL_INELIGIBLE;
+@@ -5532,6 +5508,9 @@ static int hpsa_ioaccel_submit(struct ct
+ if (hpsa_simple_mode)
+ return IO_ACCEL_INELIGIBLE;
+
++ if (dev->in_reset)
++ return SCSI_MLQUEUE_HOST_BUSY;
++
+ cmd->host_scribble = (unsigned char *) c;
+
+ if (dev->offload_enabled) {
+@@ -5564,8 +5543,12 @@ static void hpsa_command_resubmit_worker
+ cmd->result = DID_NO_CONNECT << 16;
+ return hpsa_cmd_free_and_done(c->h, c, cmd);
+ }
+- if (c->reset_pending)
++
++ if (dev->in_reset) {
++ cmd->result = DID_RESET << 16;
+ return hpsa_cmd_free_and_done(c->h, c, cmd);
++ }
++
+ if (c->cmd_type == CMD_IOACCEL2) {
+ struct ctlr_info *h = c->h;
+ struct io_accel2_cmd *c2 = &h->ioaccel2_cmd_pool[c->cmdindex];
+@@ -5573,7 +5556,7 @@ static void hpsa_command_resubmit_worker
+
+ if (c2->error_data.serv_response ==
+ IOACCEL2_STATUS_SR_TASK_COMP_SET_FULL) {
+- rc = hpsa_ioaccel_submit(h, c, cmd, dev->scsi3addr);
++ rc = hpsa_ioaccel_submit(h, c, cmd);
+ if (rc == 0)
+ return;
+ if (rc == SCSI_MLQUEUE_HOST_BUSY) {
+@@ -5589,7 +5572,7 @@ static void hpsa_command_resubmit_worker
+ }
+ }
+ hpsa_cmd_partial_init(c->h, c->cmdindex, c);
+- if (hpsa_ciss_submit(c->h, c, cmd, dev->scsi3addr)) {
++ if (hpsa_ciss_submit(c->h, c, cmd, dev)) {
+ /*
+ * If we get here, it means dma mapping failed. Try
+ * again via scsi mid layer, which will then get
+@@ -5608,7 +5591,6 @@ static int hpsa_scsi_queue_command(struc
+ {
+ struct ctlr_info *h;
+ struct hpsa_scsi_dev_t *dev;
+- unsigned char scsi3addr[8];
+ struct CommandList *c;
+ int rc = 0;
+
+@@ -5630,13 +5612,15 @@ static int hpsa_scsi_queue_command(struc
+ return 0;
+ }
+
+- memcpy(scsi3addr, dev->scsi3addr, sizeof(scsi3addr));
+-
+ if (unlikely(lockup_detected(h))) {
+ cmd->result = DID_NO_CONNECT << 16;
+ cmd->scsi_done(cmd);
+ return 0;
+ }
++
++ if (dev->in_reset)
++ return SCSI_MLQUEUE_DEVICE_BUSY;
++
+ c = cmd_tagged_alloc(h, cmd);
+
+ /*
+@@ -5646,7 +5630,7 @@ static int hpsa_scsi_queue_command(struc
+ if (likely(cmd->retries == 0 &&
+ !blk_rq_is_passthrough(cmd->request) &&
+ h->acciopath_status)) {
+- rc = hpsa_ioaccel_submit(h, c, cmd, scsi3addr);
++ rc = hpsa_ioaccel_submit(h, c, cmd);
+ if (rc == 0)
+ return 0;
+ if (rc == SCSI_MLQUEUE_HOST_BUSY) {
+@@ -5654,7 +5638,7 @@ static int hpsa_scsi_queue_command(struc
+ return SCSI_MLQUEUE_HOST_BUSY;
+ }
+ }
+- return hpsa_ciss_submit(h, c, cmd, scsi3addr);
++ return hpsa_ciss_submit(h, c, cmd, dev);
+ }
+
+ static void hpsa_scan_complete(struct ctlr_info *h)
+@@ -5936,6 +5920,7 @@ static int wait_for_device_to_become_rea
+ static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
+ {
+ int rc = SUCCESS;
++ int i;
+ struct ctlr_info *h;
+ struct hpsa_scsi_dev_t *dev;
+ u8 reset_type;
+@@ -6003,9 +5988,19 @@ static int hpsa_eh_device_reset_handler(
+ reset_type == HPSA_DEVICE_RESET_MSG ? "logical " : "physical ");
+ hpsa_show_dev_msg(KERN_WARNING, h, dev, msg);
+
++ /*
++ * wait to see if any commands will complete before sending reset
++ */
++ dev->in_reset = true; /* block any new cmds from OS for this device */
++ for (i = 0; i < 10; i++) {
++ if (atomic_read(&dev->commands_outstanding) > 0)
++ msleep(1000);
++ else
++ break;
++ }
++
+ /* send a reset to the SCSI LUN which the command was sent to */
+- rc = hpsa_do_reset(h, dev, dev->scsi3addr, reset_type,
+- DEFAULT_REPLY_QUEUE);
++ rc = hpsa_do_reset(h, dev, reset_type, DEFAULT_REPLY_QUEUE);
+ if (rc == 0)
+ rc = SUCCESS;
+ else
+@@ -6019,6 +6014,8 @@ static int hpsa_eh_device_reset_handler(
+ return_reset_status:
+ spin_lock_irqsave(&h->reset_lock, flags);
+ h->reset_in_progress = 0;
++ if (dev)
++ dev->in_reset = false;
+ spin_unlock_irqrestore(&h->reset_lock, flags);
+ return rc;
+ }
+@@ -6127,6 +6124,7 @@ static struct CommandList *cmd_alloc(str
+ break; /* it's ours now. */
+ }
+ hpsa_cmd_partial_init(h, i, c);
++ c->device = NULL;
+ return c;
+ }
+
+@@ -6578,8 +6576,7 @@ static int hpsa_ioctl(struct scsi_device
+ }
+ }
+
+-static void hpsa_send_host_reset(struct ctlr_info *h, unsigned char *scsi3addr,
+- u8 reset_type)
++static void hpsa_send_host_reset(struct ctlr_info *h, u8 reset_type)
+ {
+ struct CommandList *c;
+
+@@ -8073,7 +8070,7 @@ static int hpsa_request_irqs(struct ctlr
+ static int hpsa_kdump_soft_reset(struct ctlr_info *h)
+ {
+ int rc;
+- hpsa_send_host_reset(h, RAID_CTLR_LUNID, HPSA_RESET_TYPE_CONTROLLER);
++ hpsa_send_host_reset(h, HPSA_RESET_TYPE_CONTROLLER);
+
+ dev_info(&h->pdev->dev, "Waiting for board to soft reset.\n");
+ rc = hpsa_wait_for_board_state(h->pdev, h->vaddr, BOARD_NOT_READY);
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -75,11 +75,12 @@ struct hpsa_scsi_dev_t {
+ unsigned char raid_level; /* from inquiry page 0xC1 */
+ unsigned char volume_offline; /* discovered via TUR or VPD */
+ u16 queue_depth; /* max queue_depth for this device */
+- atomic_t reset_cmds_out; /* Count of commands to-be affected */
++ atomic_t commands_outstanding; /* track commands sent to device */
+ atomic_t ioaccel_cmds_out; /* Only used for physical devices
+ * counts commands sent to physical
+ * device via "ioaccel" path.
+ */
++ bool in_reset;
+ u32 ioaccel_handle;
+ u8 active_path_index;
+ u8 path_map;
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -448,7 +448,7 @@ struct CommandList {
+ struct hpsa_scsi_dev_t *phys_disk;
+
+ int abort_pending;
+- struct hpsa_scsi_dev_t *reset_pending;
++ struct hpsa_scsi_dev_t *device;
+ atomic_t refcount; /* Must be last to avoid memset in hpsa_cmd_init() */
+ } __aligned(COMMANDLIST_ALIGNMENT);
+
diff --git a/patches.drivers/scsi-hpsa-correct-ioaccel2-chaining b/patches.drivers/scsi-hpsa-correct-ioaccel2-chaining
new file mode 100644
index 0000000000..f9d0726ee2
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-correct-ioaccel2-chaining
@@ -0,0 +1,62 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Mon, 3 Jun 2019 16:43:29 -0500
+Subject: scsi: hpsa: correct ioaccel2 chaining
+Patch-mainline: v5.2-rc5
+Git-commit: 625d7d3518875c4d303c652a198feaa13d9f52d9
+References: jsc#SLE-4712 bsc#1136156
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for
+ the last s/g element.
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when
+ chaining.
+
+Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Matt Perricone <matt.perricone@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 7 ++++++-
+ drivers/scsi/hpsa_cmd.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 1bef1da273c2..8068520cf89e 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4940,7 +4940,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg->reserved[0] = 0;
+ curr_sg->reserved[1] = 0;
+ curr_sg->reserved[2] = 0;
+- curr_sg->chain_indicator = 0x80;
++ curr_sg->chain_indicator = IOACCEL2_CHAIN;
+
+ curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex];
+ }
+@@ -4957,6 +4957,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg++;
+ }
+
++ /*
++ * Set the last s/g element bit
++ */
++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG;
++
+ switch (cmd->sc_data_direction) {
+ case DMA_TO_DEVICE:
+ cp->direction &= ~IOACCEL2_DIRECTION_MASK;
+diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
+index 21a726e2eec6..f6afca4b2319 100644
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -517,6 +517,7 @@ struct ioaccel2_sg_element {
+ u8 reserved[3];
+ u8 chain_indicator;
+ #define IOACCEL2_CHAIN 0x80
++#define IOACCEL2_LAST_SG 0x40
+ };
+
+ /*
+
diff --git a/patches.drivers/scsi-hpsa-correct-simple-mode b/patches.drivers/scsi-hpsa-correct-simple-mode
new file mode 100644
index 0000000000..ce784fc421
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-correct-simple-mode
@@ -0,0 +1,90 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 7 May 2019 13:32:00 -0500
+Subject: scsi: hpsa: correct simple mode
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
+Git-commit: a68fdb3aed541808ae6b1078ff840a4d9281731b
+References: jsc#SLE-4712 bsc#1136156
+
+Correct issue with hpsa_simple_mode module parameter. Driver was
+hanging due to incorrect interrupt setup.
+
+Reviewed-by: Justin Lindley <justin.lindley@microsemi.com>
+Reviewed-by: Dave Carroll <david.carroll@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 1bef1da273c2..54b0e3dc2861 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5526,6 +5526,9 @@ static int hpsa_ioaccel_submit(struct ctlr_info *h,
+ if (!dev)
+ return SCSI_MLQUEUE_HOST_BUSY;
+
++ if (hpsa_simple_mode)
++ return IO_ACCEL_INELIGIBLE;
++
+ cmd->host_scribble = (unsigned char *) c;
+
+ if (dev->offload_enabled) {
+@@ -7978,10 +7981,15 @@ static int hpsa_alloc_cmd_pool(struct ctlr_info *h)
+ static void hpsa_free_irqs(struct ctlr_info *h)
+ {
+ int i;
++ int irq_vector = 0;
++
++ if (hpsa_simple_mode)
++ irq_vector = h->intr_mode;
+
+ if (!h->msix_vectors || h->intr_mode != PERF_MODE_INT) {
+ /* Single reply queue, only one irq to free */
+- free_irq(pci_irq_vector(h->pdev, 0), &h->q[h->intr_mode]);
++ free_irq(pci_irq_vector(h->pdev, irq_vector),
++ &h->q[h->intr_mode]);
+ h->q[h->intr_mode] = 0;
+ return;
+ }
+@@ -8000,6 +8008,10 @@ static int hpsa_request_irqs(struct ctlr_info *h,
+ irqreturn_t (*intxhandler)(int, void *))
+ {
+ int rc, i;
++ int irq_vector = 0;
++
++ if (hpsa_simple_mode)
++ irq_vector = h->intr_mode;
+
+ /*
+ * initialize h->q[x] = x so that interrupt handlers know which
+@@ -8035,14 +8047,14 @@ static int hpsa_request_irqs(struct ctlr_info *h,
+ if (h->msix_vectors > 0 || h->pdev->msi_enabled) {
+ sprintf(h->intrname[0], "%s-msi%s", h->devname,
+ h->msix_vectors ? "x" : "");
+- rc = request_irq(pci_irq_vector(h->pdev, 0),
++ rc = request_irq(pci_irq_vector(h->pdev, irq_vector),
+ msixhandler, 0,
+ h->intrname[0],
+ &h->q[h->intr_mode]);
+ } else {
+ sprintf(h->intrname[h->intr_mode],
+ "%s-intx", h->devname);
+- rc = request_irq(pci_irq_vector(h->pdev, 0),
++ rc = request_irq(pci_irq_vector(h->pdev, irq_vector),
+ intxhandler, IRQF_SHARED,
+ h->intrname[0],
+ &h->q[h->intr_mode]);
+@@ -8050,7 +8062,7 @@ static int hpsa_request_irqs(struct ctlr_info *h,
+ }
+ if (rc) {
+ dev_err(&h->pdev->dev, "failed to get irq %d for %s\n",
+- pci_irq_vector(h->pdev, 0), h->devname);
++ pci_irq_vector(h->pdev, irq_vector), h->devname);
+ hpsa_free_irqs(h);
+ return -ENODEV;
+ }
+
diff --git a/patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs b/patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs
new file mode 100644
index 0000000000..65137dde8e
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs
@@ -0,0 +1,68 @@
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 27 Nov 2018 22:29:07 -0600
+Subject: scsi: hpsa: mark expected switch fall-throughs
+Git-commit: 5dfdb0893596a837a95fa4013c122ba32aae9946
+Patch-mainline: v5.0-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases where
+we are expecting to fall through.
+
+Addresses-Coverity-ID: 1195463 ("Missing break in switch")
+Addresses-Coverity-ID: 1195464 ("Missing break in switch")
+Addresses-Coverity-ID: 1195465 ("Missing break in switch")
+Addresses-Coverity-ID: 1195466 ("Missing break in switch")
+Addresses-Coverity-ID: 1357338 ("Missing break in switch")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index c9cccf35e9d7..bc64e8a0449d 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4663,6 +4663,7 @@ static int fixup_ioaccel_cdb(u8 *cdb, int *cdb_len)
+ case WRITE_6:
+ case WRITE_12:
+ is_write = 1;
++ /* fall through */
+ case READ_6:
+ case READ_12:
+ if (*cdb_len == 6) {
+@@ -5093,6 +5094,7 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ switch (cmd->cmnd[0]) {
+ case WRITE_6:
+ is_write = 1;
++ /* fall through */
+ case READ_6:
+ first_block = (((cmd->cmnd[1] & 0x1F) << 16) |
+ (cmd->cmnd[2] << 8) |
+@@ -5103,6 +5105,7 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ break;
+ case WRITE_10:
+ is_write = 1;
++ /* fall through */
+ case READ_10:
+ first_block =
+ (((u64) cmd->cmnd[2]) << 24) |
+@@ -5115,6 +5118,7 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ break;
+ case WRITE_12:
+ is_write = 1;
++ /* fall through */
+ case READ_12:
+ first_block =
+ (((u64) cmd->cmnd[2]) << 24) |
+@@ -5129,6 +5133,7 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ break;
+ case WRITE_16:
+ is_write = 1;
++ /* fall through */
+ case READ_16:
+ first_block =
+ (((u64) cmd->cmnd[2]) << 56) |
+
diff --git a/patches.drivers/scsi-hpsa-remove-timeout-from-turs b/patches.drivers/scsi-hpsa-remove-timeout-from-turs
new file mode 100644
index 0000000000..0fea7ad743
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-remove-timeout-from-turs
@@ -0,0 +1,36 @@
+From: Don Brace <don.brace@microsemi.com>
+Date: Tue, 12 Mar 2019 13:11:45 -0500
+Subject: scsi: hpsa: remove timeout from TURs
+Git-commit: 1edb69344c882bdf54cd7a448faf6d1fdf3e80bb
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+There are times when a TUR can take longer than the DEFAULT_TIMEOUT
+value. The timeout code is not correct as the function exits with an
+automatic as the completion variable...To be fixed later.
+
+Remove the TUR timeout.
+
+Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index bd98a9667ce4..ff0e3cc33f65 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5824,7 +5824,7 @@ static int hpsa_send_test_unit_ready(struct ctlr_info *h,
+ /* Send the Test Unit Ready, fill_cmd can't fail, no mapping */
+ (void) fill_cmd(c, TEST_UNIT_READY, h,
+ NULL, 0, 0, lunaddr, TYPE_CMD);
+- rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, DEFAULT_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
+ if (rc)
+ return rc;
+ /* no unmap needed here because no data xfer. */
+
diff --git a/patches.drivers/scsi-hpsa-switch-to-generic-dma-api b/patches.drivers/scsi-hpsa-switch-to-generic-dma-api
new file mode 100644
index 0000000000..f2964e5aeb
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-switch-to-generic-dma-api
@@ -0,0 +1,439 @@
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 10 Oct 2018 18:56:15 +0200
+Subject: scsi: hpsa: switch to generic DMA API
+Git-commit: 8bc8f47ea3964ef141e91ffff912538a66a55d5f
+Patch-mainline: v4.20-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+Switch from the legacy PCI DMA API to the generic DMA API.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Tested-by: Don Brace <don.brace@microchip.com>
+Acked-by: Don Brace <don.brace@microchip.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 136 ++++++++++++++++++++++++++--------------------------
+ 1 file changed, 69 insertions(+), 67 deletions(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2238,8 +2238,8 @@ static int hpsa_map_ioaccel2_sg_chain_bl
+
+ chain_block = h->ioaccel2_cmd_sg_list[c->cmdindex];
+ chain_size = le32_to_cpu(cp->sg[0].length);
+- temp64 = pci_map_single(h->pdev, chain_block, chain_size,
+- PCI_DMA_TODEVICE);
++ temp64 = dma_map_single(&h->pdev->dev, chain_block, chain_size,
++ DMA_TO_DEVICE);
+ if (dma_mapping_error(&h->pdev->dev, temp64)) {
+ /* prevent subsequent unmapping */
+ cp->sg->address = 0;
+@@ -2259,7 +2259,7 @@ static void hpsa_unmap_ioaccel2_sg_chain
+ chain_sg = cp->sg;
+ temp64 = le64_to_cpu(chain_sg->address);
+ chain_size = le32_to_cpu(cp->sg[0].length);
+- pci_unmap_single(h->pdev, temp64, chain_size, PCI_DMA_TODEVICE);
++ dma_unmap_single(&h->pdev->dev, temp64, chain_size, DMA_TO_DEVICE);
+ }
+
+ static int hpsa_map_sg_chain_block(struct ctlr_info *h,
+@@ -2275,8 +2275,8 @@ static int hpsa_map_sg_chain_block(struc
+ chain_len = sizeof(*chain_sg) *
+ (le16_to_cpu(c->Header.SGTotal) - h->max_cmd_sg_entries);
+ chain_sg->Len = cpu_to_le32(chain_len);
+- temp64 = pci_map_single(h->pdev, chain_block, chain_len,
+- PCI_DMA_TODEVICE);
++ temp64 = dma_map_single(&h->pdev->dev, chain_block, chain_len,
++ DMA_TO_DEVICE);
+ if (dma_mapping_error(&h->pdev->dev, temp64)) {
+ /* prevent subsequent unmapping */
+ chain_sg->Addr = cpu_to_le64(0);
+@@ -2295,8 +2295,8 @@ static void hpsa_unmap_sg_chain_block(st
+ return;
+
+ chain_sg = &c->SG[h->max_cmd_sg_entries - 1];
+- pci_unmap_single(h->pdev, le64_to_cpu(chain_sg->Addr),
+- le32_to_cpu(chain_sg->Len), PCI_DMA_TODEVICE);
++ dma_unmap_single(&h->pdev->dev, le64_to_cpu(chain_sg->Addr),
++ le32_to_cpu(chain_sg->Len), DMA_TO_DEVICE);
+ }
+
+
+@@ -2757,13 +2757,13 @@ static void complete_scsi_command(struct
+ return hpsa_cmd_free_and_done(h, cp, cmd);
+ }
+
+-static void hpsa_pci_unmap(struct pci_dev *pdev,
+- struct CommandList *c, int sg_used, int data_direction)
++static void hpsa_pci_unmap(struct pci_dev *pdev, struct CommandList *c,
++ int sg_used, enum dma_data_direction data_direction)
+ {
+ int i;
+
+ for (i = 0; i < sg_used; i++)
+- pci_unmap_single(pdev, (dma_addr_t) le64_to_cpu(c->SG[i].Addr),
++ dma_unmap_single(&pdev->dev, le64_to_cpu(c->SG[i].Addr),
+ le32_to_cpu(c->SG[i].Len),
+ data_direction);
+ }
+@@ -2772,17 +2772,17 @@ static int hpsa_map_one(struct pci_dev *
+ struct CommandList *cp,
+ unsigned char *buf,
+ size_t buflen,
+- int data_direction)
++ enum dma_data_direction data_direction)
+ {
+ u64 addr64;
+
+- if (buflen == 0 || data_direction == PCI_DMA_NONE) {
++ if (buflen == 0 || data_direction == DMA_NONE) {
+ cp->Header.SGList = 0;
+ cp->Header.SGTotal = cpu_to_le16(0);
+ return 0;
+ }
+
+- addr64 = pci_map_single(pdev, buf, buflen, data_direction);
++ addr64 = dma_map_single(&pdev->dev, buf, buflen, data_direction);
+ if (dma_mapping_error(&pdev->dev, addr64)) {
+ /* Prevent subsequent unmap of something never mapped */
+ cp->Header.SGList = 0;
+@@ -2843,7 +2843,8 @@ static u32 lockup_detected(struct ctlr_i
+
+ #define MAX_DRIVER_CMD_RETRIES 25
+ static int hpsa_scsi_do_simple_cmd_with_retry(struct ctlr_info *h,
+- struct CommandList *c, int data_direction, unsigned long timeout_msecs)
++ struct CommandList *c, enum dma_data_direction data_direction,
++ unsigned long timeout_msecs)
+ {
+ int backoff_time = 10, retry_count = 0;
+ int rc;
+@@ -2967,8 +2968,8 @@ static int hpsa_do_receive_diagnostic(st
+ rc = -1;
+ goto out;
+ }
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -3020,8 +3021,8 @@ static int hpsa_scsi_do_inquiry(struct c
+ rc = -1;
+ goto out;
+ }
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -3304,8 +3305,8 @@ static int hpsa_get_raid_map(struct ctlr
+ cmd_free(h, c);
+ return -1;
+ }
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -3347,8 +3348,8 @@ static int hpsa_bmic_sense_subsystem_inf
+ c->Request.CDB[2] = bmic_device_index & 0xff;
+ c->Request.CDB[9] = (bmic_device_index >> 8) & 0xff;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -3375,8 +3376,8 @@ static int hpsa_bmic_id_controller(struc
+ if (rc)
+ goto out;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -3406,7 +3407,7 @@ static int hpsa_bmic_id_physical_device(
+ c->Request.CDB[2] = bmic_device_index & 0xff;
+ c->Request.CDB[9] = (bmic_device_index >> 8) & 0xff;
+
+- hpsa_scsi_do_simple_cmd_with_retry(h, c, PCI_DMA_FROMDEVICE,
++ hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
+ NO_TIMEOUT);
+ ei = c->err_info;
+ if (ei->CommandStatus != 0 && ei->CommandStatus != CMD_DATA_UNDERRUN) {
+@@ -3482,7 +3483,7 @@ static void hpsa_get_enclosure_info(stru
+ else
+ c->Request.CDB[5] = 0;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, PCI_DMA_FROMDEVICE,
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
+ NO_TIMEOUT);
+ if (rc)
+ goto out;
+@@ -3729,8 +3730,8 @@ static int hpsa_scsi_do_report_luns(stru
+ }
+ if (extended_response)
+ c->Request.CDB[1] = extended_response;
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if (rc)
+ goto out;
+ ei = c->err_info;
+@@ -6318,8 +6319,8 @@ static int hpsa_passthru_ioctl(struct ct
+
+ /* Fill in the scatter gather information */
+ if (iocommand.buf_size > 0) {
+- temp64 = pci_map_single(h->pdev, buff,
+- iocommand.buf_size, PCI_DMA_BIDIRECTIONAL);
++ temp64 = dma_map_single(&h->pdev->dev, buff,
++ iocommand.buf_size, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(&h->pdev->dev, (dma_addr_t) temp64)) {
+ c->SG[0].Addr = cpu_to_le64(0);
+ c->SG[0].Len = cpu_to_le32(0);
+@@ -6333,7 +6334,7 @@ static int hpsa_passthru_ioctl(struct ct
+ rc = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE,
+ NO_TIMEOUT);
+ if (iocommand.buf_size > 0)
+- hpsa_pci_unmap(h->pdev, c, 1, PCI_DMA_BIDIRECTIONAL);
++ hpsa_pci_unmap(h->pdev, c, 1, DMA_BIDIRECTIONAL);
+ check_ioctl_unit_attention(h, c);
+ if (rc) {
+ rc = -EIO;
+@@ -6441,14 +6442,14 @@ static int hpsa_big_passthru_ioctl(struc
+ if (ioc->buf_size > 0) {
+ int i;
+ for (i = 0; i < sg_used; i++) {
+- temp64 = pci_map_single(h->pdev, buff[i],
+- buff_size[i], PCI_DMA_BIDIRECTIONAL);
++ temp64 = dma_map_single(&h->pdev->dev, buff[i],
++ buff_size[i], DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(&h->pdev->dev,
+ (dma_addr_t) temp64)) {
+ c->SG[i].Addr = cpu_to_le64(0);
+ c->SG[i].Len = cpu_to_le32(0);
+ hpsa_pci_unmap(h->pdev, c, i,
+- PCI_DMA_BIDIRECTIONAL);
++ DMA_BIDIRECTIONAL);
+ status = -ENOMEM;
+ goto cleanup0;
+ }
+@@ -6461,7 +6462,7 @@ static int hpsa_big_passthru_ioctl(struc
+ status = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE,
+ NO_TIMEOUT);
+ if (sg_used)
+- hpsa_pci_unmap(h->pdev, c, sg_used, PCI_DMA_BIDIRECTIONAL);
++ hpsa_pci_unmap(h->pdev, c, sg_used, DMA_BIDIRECTIONAL);
+ check_ioctl_unit_attention(h, c);
+ if (status) {
+ status = -EIO;
+@@ -6573,7 +6574,7 @@ static int fill_cmd(struct CommandList *
+ void *buff, size_t size, u16 page_code, unsigned char *scsi3addr,
+ int cmd_type)
+ {
+- int pci_dir = XFER_NONE;
++ enum dma_data_direction dir = DMA_NONE;
+
+ c->cmd_type = CMD_IOCTL_PEND;
+ c->scsi_cmd = SCSI_CMD_BUSY;
+@@ -6779,18 +6780,18 @@ static int fill_cmd(struct CommandList *
+
+ switch (GET_DIR(c->Request.type_attr_dir)) {
+ case XFER_READ:
+- pci_dir = PCI_DMA_FROMDEVICE;
++ dir = DMA_FROM_DEVICE;
+ break;
+ case XFER_WRITE:
+- pci_dir = PCI_DMA_TODEVICE;
++ dir = DMA_TO_DEVICE;
+ break;
+ case XFER_NONE:
+- pci_dir = PCI_DMA_NONE;
++ dir = DMA_NONE;
+ break;
+ default:
+- pci_dir = PCI_DMA_BIDIRECTIONAL;
++ dir = DMA_BIDIRECTIONAL;
+ }
+- if (hpsa_map_one(h->pdev, c, buff, size, pci_dir))
++ if (hpsa_map_one(h->pdev, c, buff, size, dir))
+ return -1;
+ return 0;
+ }
+@@ -6986,13 +6987,13 @@ static int hpsa_message(struct pci_dev *
+ * CCISS commands, so they must be allocated from the lower 4GiB of
+ * memory.
+ */
+- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
++ err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (err) {
+ iounmap(vaddr);
+ return err;
+ }
+
+- cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
++ cmd = dma_alloc_coherent(&pdev->dev, cmd_sz, &paddr64, GFP_KERNEL);
+ if (cmd == NULL) {
+ iounmap(vaddr);
+ return -ENOMEM;
+@@ -7041,7 +7042,7 @@ static int hpsa_message(struct pci_dev *
+ return -ETIMEDOUT;
+ }
+
+- pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
++ dma_free_coherent(&pdev->dev, cmd_sz, cmd, paddr64);
+
+ if (tag & HPSA_ERROR_BIT) {
+ dev_err(&pdev->dev, "controller message %02x:%02x failed\n",
+@@ -7908,7 +7909,7 @@ static void hpsa_free_cmd_pool(struct ct
+ kfree(h->cmd_pool_bits);
+ h->cmd_pool_bits = NULL;
+ if (h->cmd_pool) {
+- pci_free_consistent(h->pdev,
++ dma_free_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(struct CommandList),
+ h->cmd_pool,
+ h->cmd_pool_dhandle);
+@@ -7916,7 +7917,7 @@ static void hpsa_free_cmd_pool(struct ct
+ h->cmd_pool_dhandle = 0;
+ }
+ if (h->errinfo_pool) {
+- pci_free_consistent(h->pdev,
++ dma_free_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(struct ErrorInfo),
+ h->errinfo_pool,
+ h->errinfo_pool_dhandle);
+@@ -7930,12 +7931,12 @@ static int hpsa_alloc_cmd_pool(struct ct
+ h->cmd_pool_bits = kzalloc(
+ DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG) *
+ sizeof(unsigned long), GFP_KERNEL);
+- h->cmd_pool = pci_alloc_consistent(h->pdev,
++ h->cmd_pool = dma_alloc_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(*h->cmd_pool),
+- &(h->cmd_pool_dhandle));
+- h->errinfo_pool = pci_alloc_consistent(h->pdev,
++ &h->cmd_pool_dhandle, GFP_KERNEL);
++ h->errinfo_pool = dma_alloc_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(*h->errinfo_pool),
+- &(h->errinfo_pool_dhandle));
++ &h->errinfo_pool_dhandle, GFP_KERNEL);
+ if ((h->cmd_pool_bits == NULL)
+ || (h->cmd_pool == NULL)
+ || (h->errinfo_pool == NULL)) {
+@@ -8062,7 +8063,7 @@ static void hpsa_free_reply_queues(struc
+ for (i = 0; i < h->nreply_queues; i++) {
+ if (!h->reply_queue[i].head)
+ continue;
+- pci_free_consistent(h->pdev,
++ dma_free_coherent(&h->pdev->dev,
+ h->reply_queue_size,
+ h->reply_queue[i].head,
+ h->reply_queue[i].busaddr);
+@@ -8588,11 +8589,11 @@ reinit_after_soft_reset:
+ number_of_controllers++;
+
+ /* configure PCI DMA stuff */
+- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
++ rc = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
+ if (rc == 0) {
+ dac = 1;
+ } else {
+- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
++ rc = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (rc == 0) {
+ dac = 0;
+ } else {
+@@ -8791,8 +8792,8 @@ static void hpsa_flush_cache(struct ctlr
+ RAID_CTLR_LUNID, TYPE_CMD)) {
+ goto out;
+ }
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_TODEVICE, DEFAULT_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_TO_DEVICE,
++ DEFAULT_TIMEOUT);
+ if (rc)
+ goto out;
+ if (c->err_info->CommandStatus != 0)
+@@ -8827,8 +8828,8 @@ static void hpsa_disable_rld_caching(str
+ RAID_CTLR_LUNID, TYPE_CMD))
+ goto errout;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if ((rc != 0) || (c->err_info->CommandStatus != 0))
+ goto errout;
+
+@@ -8839,8 +8840,8 @@ static void hpsa_disable_rld_caching(str
+ RAID_CTLR_LUNID, TYPE_CMD))
+ goto errout;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_TODEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_TO_DEVICE,
++ NO_TIMEOUT);
+ if ((rc != 0) || (c->err_info->CommandStatus != 0))
+ goto errout;
+
+@@ -8849,8 +8850,8 @@ static void hpsa_disable_rld_caching(str
+ RAID_CTLR_LUNID, TYPE_CMD))
+ goto errout;
+
+- rc = hpsa_scsi_do_simple_cmd_with_retry(h, c,
+- PCI_DMA_FROMDEVICE, NO_TIMEOUT);
++ rc = hpsa_scsi_do_simple_cmd_with_retry(h, c, DMA_FROM_DEVICE,
++ NO_TIMEOUT);
+ if ((rc != 0) || (c->err_info->CommandStatus != 0))
+ goto errout;
+
+@@ -9222,9 +9223,9 @@ static int hpsa_alloc_ioaccel1_cmd_and_b
+ BUILD_BUG_ON(sizeof(struct io_accel1_cmd) %
+ IOACCEL1_COMMANDLIST_ALIGNMENT);
+ h->ioaccel_cmd_pool =
+- pci_alloc_consistent(h->pdev,
++ dma_alloc_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(*h->ioaccel_cmd_pool),
+- &(h->ioaccel_cmd_pool_dhandle));
++ &h->ioaccel_cmd_pool_dhandle, GFP_KERNEL);
+
+ h->ioaccel1_blockFetchTable =
+ kmalloc(((h->ioaccel_maxsg + 1) *
+@@ -9275,9 +9276,9 @@ static int hpsa_alloc_ioaccel2_cmd_and_b
+ BUILD_BUG_ON(sizeof(struct io_accel2_cmd) %
+ IOACCEL2_COMMANDLIST_ALIGNMENT);
+ h->ioaccel2_cmd_pool =
+- pci_alloc_consistent(h->pdev,
++ dma_alloc_coherent(&h->pdev->dev,
+ h->nr_cmds * sizeof(*h->ioaccel2_cmd_pool),
+- &(h->ioaccel2_cmd_pool_dhandle));
++ &h->ioaccel2_cmd_pool_dhandle, GFP_KERNEL);
+
+ h->ioaccel2_blockFetchTable =
+ kmalloc(((h->ioaccel_maxsg + 1) *
+@@ -9350,9 +9351,10 @@ static int hpsa_put_ctlr_into_performant
+ h->reply_queue_size = h->max_commands * sizeof(u64);
+
+ for (i = 0; i < h->nreply_queues; i++) {
+- h->reply_queue[i].head = pci_alloc_consistent(h->pdev,
++ h->reply_queue[i].head = dma_alloc_coherent(&h->pdev->dev,
+ h->reply_queue_size,
+- &(h->reply_queue[i].busaddr));
++ &h->reply_queue[i].busaddr,
++ GFP_KERNEL);
+ if (!h->reply_queue[i].head) {
+ rc = -ENOMEM;
+ goto clean1; /* rq, ioaccel */
diff --git a/patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code b/patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code
new file mode 100644
index 0000000000..7261ccdb71
--- /dev/null
+++ b/patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code
@@ -0,0 +1,52 @@
+From: zhong jiang <zhongjiang@huawei.com>
+Date: Tue, 18 Sep 2018 23:54:41 +0800
+Subject: scsi: hpsa: Use vmemdup_user to replace the open code
+Git-commit: 048a864e533039cc950b716e774c2c09af8fa1dd
+Patch-mainline: v4.20-rc1
+References: jsc#SLE-4712 bsc#1136156
+
+vmemdup_user is better than duplicating its implementation, So just replace
+the open code.
+
+The issue is detected with the help of Coccinelle.
+
+Tested-by: Don Brace <don.brace@microsemi.com>
+Acked-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 58bb70b886d7..666ba09e5f42 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -6381,13 +6381,9 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
+ return -EINVAL;
+ if (!capable(CAP_SYS_RAWIO))
+ return -EPERM;
+- ioc = kmalloc(sizeof(*ioc), GFP_KERNEL);
+- if (!ioc) {
+- status = -ENOMEM;
+- goto cleanup1;
+- }
+- if (copy_from_user(ioc, argp, sizeof(*ioc))) {
+- status = -EFAULT;
++ ioc = vmemdup_user(argp, sizeof(*ioc));
++ if (IS_ERR(ioc)) {
++ status = PTR_ERR(ioc);
+ goto cleanup1;
+ }
+ if ((ioc->buf_size < 1) &&
+@@ -6505,7 +6501,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
+ kfree(buff);
+ }
+ kfree(buff_size);
+- kfree(ioc);
++ kvfree(ioc);
+ return status;
+ }
+
+
diff --git a/patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev b/patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev
new file mode 100644
index 0000000000..2d9f198ab1
--- /dev/null
+++ b/patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev
@@ -0,0 +1,34 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 22 May 2019 09:39:03 +0100
+Subject: scsi: hpsa: fix an uninitialized read and dereference of pointer dev
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
+Git-commit: 36631157eb3ff8b0b359d574452ebb8f81370ec5
+References: jsc#SLE-4712 bsc#1136156
+
+Currently the check for a lockup_detected failure exits via the label
+return_reset_status that reads and dereferences an uninitialized pointer
+dev. Fix this by ensuring dev is inintialized to null.
+
+Addresses-Coverity: ("Uninitialized pointer read")
+Fixes: 14991a5bade5 ("scsi: hpsa: correct device resets")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Don Brace <don.brace@microsemi.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/hpsa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5920,7 +5920,7 @@ static int hpsa_eh_device_reset_handler(
+ int rc = SUCCESS;
+ int i;
+ struct ctlr_info *h;
+- struct hpsa_scsi_dev_t *dev;
++ struct hpsa_scsi_dev_t *dev = NULL;
+ u8 reset_type;
+ char msg[48];
+ unsigned long flags;
diff --git a/series.conf b/series.conf
index b3364849e7..4c29949aa9 100644
--- a/series.conf
+++ b/series.conf
@@ -19819,6 +19819,7 @@
patches.drivers/usx2y-don-t-bother-with-access_ok-in-dsp_load.patch
patches.drivers/snd_hwdep_dsp_load-don-t-bother-with-access_ok.patch
patches.drivers/usx2y-don-t-bother-with-memdup_user-for-16-byte-stru.patch
+ patches.drivers/new-primitive-vmemdup_user
patches.fixes/0006-jffs2-Fix-use-after-free-bug-in-jffs2_iget-s-error-h.patch
patches.fixes/0004-iomap-report-collisions-between-directio-and-buffere.patch
patches.fixes/xfs-call-xfs_qm_dqattach-before-performing-reflink-o.patch
@@ -41454,6 +41455,7 @@
patches.drivers/scsi-lpfc-update-driver-version-to-12.0.0.7.patch
patches.drivers/0001-scsi-sym53c8xx-fix-NULL-pointer-dereference-panic-in.patch
patches.drivers/scsi-lpfc-Remove-set-but-not-used-variable-sgl_size.patch
+ patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code
patches.drivers/scsi-megaraid-fix-spelling-mistake-maibox-mailbox.patch
patches.drivers/scsi-libsas-delete-dead-code-in-scsi_transport_sas.c.patch
patches.drivers/scsi-libsas-make-the-lldd_port_deformed-method-optio.patch
@@ -41502,6 +41504,7 @@
patches.drivers/scsi-cxgb4i-add-dcb-support-for-iscsi-connections
patches.fixes/scsi-ufs-Schedule-clk-gating-work-on-correct-queue.patch
patches.drivers/scsi-csiostor-switch-to-generic-dma-api.patch
+ patches.drivers/scsi-hpsa-switch-to-generic-dma-api
patches.drivers/scsi-megaraid_sas-switch-to-generic-DMA-API.patch
patches.drivers/scsi-mpt3sas-switch-to-generic-dma-api
patches.drivers/scsi-qedf-fully-convert-to-the-generic-dma-api.patch
@@ -44068,6 +44071,7 @@
patches.fixes/scsi-target-drop-unused-pi_prot_format-attribute-sto.patch
patches.drivers/scsi-mpt3sas-fix-spelling-mistake-manufaucturing-man.patch
patches.drivers/scsi-qla2xxx-Introduce-a-switch-case-statement-in-ql.patch
+ patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs
patches.drivers/scsi-megaraid-megaraid_sas_base-Mark-expected-switch.patch
patches.drivers/scsi-megaraid_sas_fusion-Mark-expected-switch-fall-t.patch
patches.fixes/scsi-target-tcmu-Fix-queue_cmd_ring-declaration.patch
@@ -45680,6 +45684,7 @@
patches.drivers/scsi-qla2xxx-Fix-DMA-error-when-the-DIF-sg-buffer-cr.patch
patches.drivers/scsi-libsas-support-sata-phy-connection-rate-unmatch-fixing-during-discovery
patches.drivers/scsi-qla2xxx-no-need-to-check-return-value-of-debugf.patch
+ patches.drivers/scsi-hpsa-clean-up-two-indentation-issues
patches.drivers/scsi-hisi_sas-remove-the-check-of-sas_dev-status-in-hisi_sas_i_t_nexus_reset
patches.fixes/scsi-hisi_sas-fix-to-only-call-scsi_get_prot_op-for-non-null-scsi_cmnd.patch
patches.drivers/scsi-qla2xxx-Add-new-FC-NVMe-enable-BIT-to-enable-FC.patch
@@ -46780,6 +46785,10 @@
patches.drivers/virtio_console-initialize-vtermno-value-for-ports.patch
patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
patches.suse/TTY-serial_core-add-install.patch
+ patches.drivers/scsi-hpsa-check-for-lv-removal
+ patches.drivers/scsi-hpsa-correct-device-id-issues
+ patches.drivers/scsi-hpsa-remove-timeout-from-turs
+ patches.drivers/scsi-hpsa-bump-driver-version
patches.drivers/scsi-smartpqi-increase-lun-reset-timeout
patches.drivers/scsi-smartpqi-add-h3c-controller-ids
patches.drivers/scsi-smartpqi-update-copyright
@@ -47190,6 +47199,7 @@
patches.drivers/ASoC-fsl_asrc-Fix-the-issue-about-unsupported-rate.patch
patches.drivers/ASoC-cs42xx8-Add-regcache-mask-dirty.patch
patches.drivers/Revert-ALSA-hda-realtek-Improve-the-headset-mic-for-.patch
+ patches.drivers/scsi-hpsa-correct-ioaccel2-chaining
patches.drm/drm-mediatek-fix-unbind-functions.patch
patches.drm/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
patches.drm/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
@@ -47256,6 +47266,9 @@
patches.drivers/RDMA-hns-Bugfix-for-posting-multiple-srq-work-reques.patch
# jejb/scsi for-next
+ patches.drivers/scsi-hpsa-correct-simple-mode
+ patches.drivers/scsi-hpsa-correct-device-resets
+ patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev
patches.drivers/scsi-mpt3sas_ctl-fix-double-fetch-bug-in-ctl_ioctl_main
# powerpc/linux next