The Coverity checker noticed that we may overrun a statically allocated
array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find().
The case is this; In 'struct lpfc_hba' we have
#define LPFC_MAX_HBQS 4
...
struct lpfc_hba {
...
struct hbq_s hbqs[LPFC_MAX_HBQS];
...
};
But then in lpfc_sli_hbqbuf_find() we have this code
hbqno = tag >> 16;
if (hbqno > LPFC_MAX_HBQS)
return NULL;
if 'hbqno' ends up as exactely 4, then we won't return, and then this
list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {
will cause an overflow of the statically allocated array at index 4,
since the valid indices are only 0-3.
I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS'
into 'hbqno >= LPFC_MAX_HBQS' as a possible fix.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Smart <James.Smart@Emulex.Com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The 700+-line comment at the top of the advansys driver fits more comfortably
in Documentation/scsi.
Delete the sections on:
- kernels supported
- other files modified (obsolete)
- source comments (obsolete)
- tests to run
- release history (that's what a VCS is for)
- contacting connectcom (the domain has expired and the phone number is
now in use by another organisation)
Known problems/fix list is moved down to the section where jejb put his FIXME.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Use memcpy to initialise eep_config instead of a loop. For
AdvInitFrom38C1600EEP where we need to modify the default EEPROM
configuration, do it after the loop, and do it using the structure
definition, not by finding the right byte. I think it was wrong for
big-endian machines.
Also delete some non-useful comments and prototypes.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The driver kept a copy of the PCI config address; refer to the pci_dev
associated with the card instead.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Convert adv_isr_callback, adv_async_callback and asc_isr_callback into
direct calls. Remove the unused asc_exe_callback.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The cfg structures are supposed to be disposable after initialisation;
with the 'dev' used for DMA mapping in there, that's not possible. Move
the dev to the board.
Also inline AscInitFromAscDvcVar into its only caller, remove some
unnecessary prototypes and sort out a few minor formatting issues.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
n_io_port isn't suitable for advansys because some of the boards have
more than 255 bytes of io port space. There's already a driver-private
replacement, asc_n_io_port, but for some reason the driver was still
setting and occasionally reporting n_io_port.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
At some point during Linux 2.1 development, ioremap() gained the ability
to handle addresses which weren't page-aligned. Also expand the CONFIG_PCI
range to encompass that entire section of wide board initialisation, since
all wide boards are PCI.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
By moving a test from AscGetChipBusType into its only caller, we can delete
the whole function
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Remove some useless forward declarations
Reformat some comments, debug messages, and the occasional piece of real code
Removal of unnecessary braces
Remove duplicate setting of shost->irq
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Use slave_configure() to do all the work that used to be done in
AscInquiryHandling and AdvInquiryHandling. Split slave_configure into
two functions, one for wide and one for narrow controllers.
Remove some unused definitions, duplicate definitions, unnecessary
declarations, and scsireqq, cap_info and inquiry from struct asc_board.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
According to the AdvanSys driver, this device has a problem with tagged
queueing.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
AscCompareString() is just another name for strncmp
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Remove wrappers around the PCI configuration space accessors
- Call pci_set_master() instead of poking at config space directly
- Move the latency setting into one function called for both narrow and
wide boards.
- Tidy up AdvInitGetConfig() a little.
- Delete a few unused prototypes and definitions.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Make sure the resources are reserved and released by all the callers of
advansys_board_found(). This eliminates the check_region-style race.
It also allows us to use the pci_request_regions() API.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Register two isa_drivers, one for ISA and one for VLB, in order to
preserve detection order. When deleting advansys_detect, we lose the
last vestiges of the code that limited IO port scanning. This code
has been effectively disabled for many years anyway; I'll restore it
in a module_param later. We also lose the code that placed all ISA PnP
cards into WaitForKey state -- drivers shouldn't be doing this anyway.
The asc_host array goes away too. Also remove some IOADR and other
definitions, such as ASC_NUM_BOARD_SUPPORTED.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Switch EISA probing to the driver model
- Remove some now-unused macros and functions
- Update the FIXME now that we use the correct driver model probing API
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Add a pci_driver interface for the PCI advansys devices (for
ISA/EISA/VLB devices, we still call advansys_detect).
- Many functions are converted from __init to __devinit to allow hotplug
PCI to work.
- Only keep devices found by advansys_detect in the asc_host list.
- Rename asc_board_count to asc_legacy_count. New asc_board_count is only
used to generate a unique name for each device.
- Remove some now-unused macros and struct definitions
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Switch from scsi_register/scsi_unregister to scsi_host_alloc,
scsi_add_host, scsi_scan_host and scsi_host_put.
- Rename the scsi_host_template to advansys_template
- Use module_init and module_exit instead of scsi_module.c
- Remove protection against advansys_detect being called twice
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Put all the error cleanup at the end of the function and goto the
appropriate label
- Split advansys_wide_init_chip out of advansys_board_found
- Split advansys_wide_free_mem out of advansys_board_found. Use it
from advansys_release
- Use GFP_KERNEL, not GFP_ATOMIC, when allocating memory during
initialisation
- Eliminate lots of PROC_FS ifdefs by removing the ifdefs around the prtbuf
struct member
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The interrupt routines used to walk the list of Scsi_Hosts belonging to
this driver to make sure that the scsi_cmnd belonged to one of them.
This is a waste of time and gets in the way of later cleanups, so
delete it.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Pass the Scsi_Host to the interrupt handler, rather than polling all
hosts for each interrupt.
Return IRQ_NONE if we didn't handle this interrupt
Don't set the IRQF_DISABLED flag; this is not a fast-executing interrupt
handler.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Just use the Scsi_Host passed in, rather than looking through the driver's
own array of boards for one that matches it.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Update the version to 3.4
Add my copyright
Add myself to MAINTAINERS
Exercise my right to change the license from dual BSD/GPL to GPL
Don't force the definition of CONFIG_ISA on x86
Always include pci.h
Stop including stat.h
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
unsigned short is too small for sizeof(struct scatterlist) *
min(q->max_hw_segments, q->max_phys_segments).
This fixes memory leak with 4096 segments since 16 (likely sg size
with x86) * 4096 sets sglist_len to zero.
This might not happen without sg chaining support.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Stress-testing and some thought has revealed some places where
asynchronous scanning needs some more attention to locking.
- Since async_scan is a bit, we need to hold the host_lock while
modifying it to prevent races against other CPUs modifying the word
that bit is in. This is probably a theoretical race for the moment,
but other patches may change that.
- The async_scan bit means not only that this host is being scanned
asynchronously, but that all the devices attached to this host are not
yet added to sysfs. So we must ensure that this bit is always in sync.
I've chosen to do this with the scan_mutex since it's already acquired
in most of the right places.
- If the host changes state to deleted while we're in the middle of
a scan, we'll end up with some devices on the host's list which must
be deleted. Add a check to scsi_sysfs_add_devices() to ensure the
host is still running.
- To avoid the async_scan bit being protected by three locks, the
async_scan_lock now only protects the scanning_list.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
sg's may have setup a the buffer with a different length than
the transfer length so we should be using the bufflen passed
in as the request's data len.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ps3rom driver to use the new accessors for the sg lists
and the parameters.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
it's better to remove tgt dependencies in srp transport class since
most people want only initiator support.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ibmvstgt to use transport tsk_mgmt_response callback.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This moves tsk_mgmt_response callback in struct scsi_host_template to
struct scsi_transport_template since struct scsi_transport_template is
more suitable for the task management stuff.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts libsrp and ibmvstgt to use srp transport.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds minimum target driver support:
- srp_rport_{add,del} calls scsi_tgt_it_nexus_{create,destroy} for
target drivers.
- add a callback to notify target drivers of the nexus operation
results to srp_function_template.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
tgt uses scsi_host as I_T nexus. This works for ibmvstgt because it
creates one scsi_host for one initiator. However, other target drivers
don't work like that.
This adds I_T nexus support, which enable one scsi_host to handle
multiple initiators. New scsi_tgt_it_nexus_create/destroy functions
are expected be called transport classes. For example, ibmvstgt
creates an initiator remote port, then the srp transport calls
tgt_it_nexus_create. tgt doesn't manages I_T nexus, instead it tells
tgtd, user-space daemon, to create a new I_T nexus.
On the receiving the response from tgtd, tgt calls
shost->transportt->it_nexus_response. transports should notify a
lld. The srp transport uses it_nexus_response callback in
srp_function_template to do that.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds a 'roles' attribute to rport like transport_fc. The role can
be initiator or target. That is, the initiator driver creates target
remote ports and the target driver creates initiator remote ports.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ibmvscsi to use the srp transport class.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds srp transport class that works with ib_srp and ibmvscsi.
It creates only /sys/class/{srp_host,srp_remote_ports} and
srp_remote_ports has only "port_id" attribute.
viola:/sys/class/srp_remote_ports/port-0:1# ls
device port_id subsystem uevent
viola:/sys/class/srp_remote_ports/port-0:1# cat port_id
4c:49:4e:55:58:20:56:49:4f:00:00:00:00:00:00:00
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Original implementation manipulated the FC_GS values for
port-speed. Transition the codes to use the driver's own
internal representations as this makes for a reduction in
duplicate 'conversion' codes throughout the driver.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Transitioning link-state via NOS/OLS requires a relogin to a
fabric's Management Server. Request relogin when the firmware
issues a point-to-point asynchronous event (0x8030).
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
If the driver fails to allocate the contiguous (DMAable) memory for
system reasons, we fail to load the instance, but then we try to free
the <nul> allocation in the cleanup code and we get a panic in
pci_free_consistent(). This is reported against an older kernel, hope
this is relevant for latest/greatest.
Signed-off-by: Mark Salyzyn <aacraid@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
And finally this is the regular !use_sg cleanup
and use of data accessors.
Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
check_condition code-path was similar but more
complicated to Reset. It went like this:
1. extra space was allocated at aha152x_scdata for mirroring
scsi_cmnd members.
2. At aha152x_internal_queue() every not check_condition
(REQUEST_SENSE) command was copied to above members in
case of error.
3. At busfree_run() in the DONE_CS phase if a Status of
SAM_STAT_CHECK_CONDITION was detected. The command was
re-queued Internally using aha152x_internal_queue(,,check_condition,)
The old command members are over written with the
REQUEST_SENSE info.
4. At busfree_run() in the DONE_CS phase again. If it is a
check_condition command, info was restored from mirror
made at first call to aha152x_internal_queue() (see 2)
and the command is completed.
What I did is:
1. Allocate less space in aha152x_scdata only for the 16-byte
original command. (which is actually not needed by scsi-ml
anymore at this stage. But this is to much knowledge of scsi-ml)
2. If Status == SAM_STAT_CHECK_CONDITION, then like before
re-queue a REQUEST_SENSE command. But only now save original
command members. (Less of them)
3. In aha152x_internal_queue(), just like for Reset, use the
check_condition hint to set differently the working members.
execute the command.
4. At busfree_run() in the DONE_CS phase again. restore needed
members.
While at it. This patch fixes a BUG. Old code when sending
a REQUEST_SENSE for a failed command. Would than return with
cmd->resid == 0 which was the status of the REQUEST_SENSE.
The failing command resid was lost. And when would resid
be interesting if not on a failing command?
Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
What Reset code was doing: Save command's important/dangerous
Info on stack. NULL those members from scsi_cmnd.
Issue a Reset. wait for it to finish than restore members
and return.
What I do is save or NULL nothing. But use the "resetting"
hint in aha152x_internal_queue() to NULL out working members
and leave struct scsi_cmnd alone.
The indent here looks funny but it will change/drop in last
patch and it is clear this way what changed.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
hunk by hunk:
- CHECK_CONDITION is what happens to cmnd->status >> 1
or after status_byte() macro. But here it is used
directly on status which means 0x1 which is an undefined
bit in the standard. And is a status that will never
return from a target.
- in busfree_run at the DONE_SC phase we have 3 distinct
operation:
1-if(DONE_SC->SCp.phase & check_condition)
The REQUEST_SENSE command return.
- Restore original command
- Than continue to operation 3.
2-if(DONE_SC->SCp.Status==SAM_STAT_CHECK_CONDITION)
A regular command returned with a status.
- Internally re-Q a REQUEST_SENSE.
- Do not do operation 3.
3-
- Complete the command and return it to scsi-ml
So the 0x2 in both these operations (1,2) means the scsi
check-condition status, hence SAM_STAT_CHECK_CONDITION
- Here the code asks about !(DONE_SC->SCp.Status & not_issued)
but "not_issued" is an enum belonging to the "phase" member
and not to the Status returned from target. The reason this
works is because not_issued==1 and Also CHECK_CONDITION==1
(remember from hunk 1). So actually the code was asking
!(DONE_SC->SCp.Status & CHECK_CONDITION). Which means
"Has the status been read from target yet?"
Staus is read at status_run(). "not_issued" is
cleared in seldo_run() which is usually earlier than
status_run().
So this patch does nothing as far as assembly is concerned
but it does let the reader understand what is going on.
Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Cause highmem buffers to be bounced to low memory until this
driver supports highmem addresses. Otherwise it just oopses
on NULL buffer addresses.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Jesper Juhl