The Coverity checker noticed that we may overrun a statically allocated
array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find().
The case is this; In 'struct lpfc_hba' we have
#define LPFC_MAX_HBQS 4
...
struct lpfc_hba {
...
struct hbq_s hbqs[LPFC_MAX_HBQS];
...
};
But then in lpfc_sli_hbqbuf_find() we have this code
hbqno = tag >> 16;
if (hbqno > LPFC_MAX_HBQS)
return NULL;
if 'hbqno' ends up as exactely 4, then we won't return, and then this
list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {
will cause an overflow of the statically allocated array at index 4,
since the valid indices are only 0-3.
I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS'
into 'hbqno >= LPFC_MAX_HBQS' as a possible fix.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Smart <James.Smart@Emulex.Com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- remove the unnecessary map_single path.
- convert to use the new accessors for the sg lists and the
parameters.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The 700+-line comment at the top of the advansys driver fits more comfortably
in Documentation/scsi.
Delete the sections on:
- kernels supported
- other files modified (obsolete)
- source comments (obsolete)
- tests to run
- release history (that's what a VCS is for)
- contacting connectcom (the domain has expired and the phone number is
now in use by another organisation)
Known problems/fix list is moved down to the section where jejb put his FIXME.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Use memcpy to initialise eep_config instead of a loop. For
AdvInitFrom38C1600EEP where we need to modify the default EEPROM
configuration, do it after the loop, and do it using the structure
definition, not by finding the right byte. I think it was wrong for
big-endian machines.
Also delete some non-useful comments and prototypes.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The driver kept a copy of the PCI config address; refer to the pci_dev
associated with the card instead.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Convert adv_isr_callback, adv_async_callback and asc_isr_callback into
direct calls. Remove the unused asc_exe_callback.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The cfg structures are supposed to be disposable after initialisation;
with the 'dev' used for DMA mapping in there, that's not possible. Move
the dev to the board.
Also inline AscInitFromAscDvcVar into its only caller, remove some
unnecessary prototypes and sort out a few minor formatting issues.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
n_io_port isn't suitable for advansys because some of the boards have
more than 255 bytes of io port space. There's already a driver-private
replacement, asc_n_io_port, but for some reason the driver was still
setting and occasionally reporting n_io_port.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
At some point during Linux 2.1 development, ioremap() gained the ability
to handle addresses which weren't page-aligned. Also expand the CONFIG_PCI
range to encompass that entire section of wide board initialisation, since
all wide boards are PCI.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
By moving a test from AscGetChipBusType into its only caller, we can delete
the whole function
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Remove some useless forward declarations
Reformat some comments, debug messages, and the occasional piece of real code
Removal of unnecessary braces
Remove duplicate setting of shost->irq
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Use slave_configure() to do all the work that used to be done in
AscInquiryHandling and AdvInquiryHandling. Split slave_configure into
two functions, one for wide and one for narrow controllers.
Remove some unused definitions, duplicate definitions, unnecessary
declarations, and scsireqq, cap_info and inquiry from struct asc_board.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
According to the AdvanSys driver, this device has a problem with tagged
queueing.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
AscCompareString() is just another name for strncmp
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Remove wrappers around the PCI configuration space accessors
- Call pci_set_master() instead of poking at config space directly
- Move the latency setting into one function called for both narrow and
wide boards.
- Tidy up AdvInitGetConfig() a little.
- Delete a few unused prototypes and definitions.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Make sure the resources are reserved and released by all the callers of
advansys_board_found(). This eliminates the check_region-style race.
It also allows us to use the pci_request_regions() API.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Register two isa_drivers, one for ISA and one for VLB, in order to
preserve detection order. When deleting advansys_detect, we lose the
last vestiges of the code that limited IO port scanning. This code
has been effectively disabled for many years anyway; I'll restore it
in a module_param later. We also lose the code that placed all ISA PnP
cards into WaitForKey state -- drivers shouldn't be doing this anyway.
The asc_host array goes away too. Also remove some IOADR and other
definitions, such as ASC_NUM_BOARD_SUPPORTED.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Switch EISA probing to the driver model
- Remove some now-unused macros and functions
- Update the FIXME now that we use the correct driver model probing API
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Add a pci_driver interface for the PCI advansys devices (for
ISA/EISA/VLB devices, we still call advansys_detect).
- Many functions are converted from __init to __devinit to allow hotplug
PCI to work.
- Only keep devices found by advansys_detect in the asc_host list.
- Rename asc_board_count to asc_legacy_count. New asc_board_count is only
used to generate a unique name for each device.
- Remove some now-unused macros and struct definitions
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Switch from scsi_register/scsi_unregister to scsi_host_alloc,
scsi_add_host, scsi_scan_host and scsi_host_put.
- Rename the scsi_host_template to advansys_template
- Use module_init and module_exit instead of scsi_module.c
- Remove protection against advansys_detect being called twice
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
- Put all the error cleanup at the end of the function and goto the
appropriate label
- Split advansys_wide_init_chip out of advansys_board_found
- Split advansys_wide_free_mem out of advansys_board_found. Use it
from advansys_release
- Use GFP_KERNEL, not GFP_ATOMIC, when allocating memory during
initialisation
- Eliminate lots of PROC_FS ifdefs by removing the ifdefs around the prtbuf
struct member
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
The interrupt routines used to walk the list of Scsi_Hosts belonging to
this driver to make sure that the scsi_cmnd belonged to one of them.
This is a waste of time and gets in the way of later cleanups, so
delete it.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Pass the Scsi_Host to the interrupt handler, rather than polling all
hosts for each interrupt.
Return IRQ_NONE if we didn't handle this interrupt
Don't set the IRQF_DISABLED flag; this is not a fast-executing interrupt
handler.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Just use the Scsi_Host passed in, rather than looking through the driver's
own array of boards for one that matches it.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Update the version to 3.4
Add my copyright
Add myself to MAINTAINERS
Exercise my right to change the license from dual BSD/GPL to GPL
Don't force the definition of CONFIG_ISA on x86
Always include pci.h
Stop including stat.h
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
unsigned short is too small for sizeof(struct scatterlist) *
min(q->max_hw_segments, q->max_phys_segments).
This fixes memory leak with 4096 segments since 16 (likely sg size
with x86) * 4096 sets sglist_len to zero.
This might not happen without sg chaining support.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Stress-testing and some thought has revealed some places where
asynchronous scanning needs some more attention to locking.
- Since async_scan is a bit, we need to hold the host_lock while
modifying it to prevent races against other CPUs modifying the word
that bit is in. This is probably a theoretical race for the moment,
but other patches may change that.
- The async_scan bit means not only that this host is being scanned
asynchronously, but that all the devices attached to this host are not
yet added to sysfs. So we must ensure that this bit is always in sync.
I've chosen to do this with the scan_mutex since it's already acquired
in most of the right places.
- If the host changes state to deleted while we're in the middle of
a scan, we'll end up with some devices on the host's list which must
be deleted. Add a check to scsi_sysfs_add_devices() to ensure the
host is still running.
- To avoid the async_scan bit being protected by three locks, the
async_scan_lock now only protects the scanning_list.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
sg's may have setup a the buffer with a different length than
the transfer length so we should be using the bufflen passed
in as the request's data len.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ps3rom driver to use the new accessors for the sg lists
and the parameters.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
it's better to remove tgt dependencies in srp transport class since
most people want only initiator support.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ibmvstgt to use transport tsk_mgmt_response callback.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This moves tsk_mgmt_response callback in struct scsi_host_template to
struct scsi_transport_template since struct scsi_transport_template is
more suitable for the task management stuff.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts libsrp and ibmvstgt to use srp transport.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds minimum target driver support:
- srp_rport_{add,del} calls scsi_tgt_it_nexus_{create,destroy} for
target drivers.
- add a callback to notify target drivers of the nexus operation
results to srp_function_template.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
tgt uses scsi_host as I_T nexus. This works for ibmvstgt because it
creates one scsi_host for one initiator. However, other target drivers
don't work like that.
This adds I_T nexus support, which enable one scsi_host to handle
multiple initiators. New scsi_tgt_it_nexus_create/destroy functions
are expected be called transport classes. For example, ibmvstgt
creates an initiator remote port, then the srp transport calls
tgt_it_nexus_create. tgt doesn't manages I_T nexus, instead it tells
tgtd, user-space daemon, to create a new I_T nexus.
On the receiving the response from tgtd, tgt calls
shost->transportt->it_nexus_response. transports should notify a
lld. The srp transport uses it_nexus_response callback in
srp_function_template to do that.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds a 'roles' attribute to rport like transport_fc. The role can
be initiator or target. That is, the initiator driver creates target
remote ports and the target driver creates initiator remote ports.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ib_srp to use the srp transport class.
I don't have ib hardware so I've not tested this patch.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Roland Dreier <rolandd@cisco.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This converts ibmvscsi to use the srp transport class.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This adds srp transport class that works with ib_srp and ibmvscsi.
It creates only /sys/class/{srp_host,srp_remote_ports} and
srp_remote_ports has only "port_id" attribute.
viola:/sys/class/srp_remote_ports/port-0:1# ls
device port_id subsystem uevent
viola:/sys/class/srp_remote_ports/port-0:1# cat port_id
4c:49:4e:55:58:20:56:49:4f:00:00:00:00:00:00:00
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Original implementation manipulated the FC_GS values for
port-speed. Transition the codes to use the driver's own
internal representations as this makes for a reduction in
duplicate 'conversion' codes throughout the driver.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Transitioning link-state via NOS/OLS requires a relogin to a
fabric's Management Server. Request relogin when the firmware
issues a point-to-point asynchronous event (0x8030).
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Fix the data buffer accessor patch.
For request without a data buffer nothing was written into
a SBALE.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
[GFS2] Revert remounting w/o acl option leaves acls enabled
[GFS2] Fix setting of inherit jdata attr
[GFS2] Fix incorrect error path in prepare_write()
[GFS2] Fix incorrect return code in rgrp.c
[GFS2] soft lockup in rgblk_search
[GFS2] soft lockup detected in databuf_lo_before_commit
[DLM] fix basts for granted PR waiting CW
[DLM] More othercon fixes
[DLM] Fix memory leak in dlm_add_member() when dlm_node_weight() returns less than zero
[DLM] zero unused parts of sockaddr_storage
[DLM] fix NULL ls usage
[DLM] Clear othercon pointers when a connection is closed
