Commit 51ef4c26 authored by James Smart's avatar James Smart Committed by James Bottomley
Browse files

[SCSI] lpfc 8.2.2 : Miscellaneous Bug Fixes 



- Fix vport ndlp ref counting errors
- Fix use after free of ndlp structure
- Use the correct flag to check for LOADING setting.
- Fix driver unload bugs (related to shost references) after link down or rscn
- Fix up HBQ initialization
- Fix port_list locking around driver unload.
- Fix references to hostdata as a phba
- Fix GFFID type offset to work correctly with big endian structure.
- Only call pci_disable_msi if the pci_enable_msi succeeded
- Fix vport_delete wait/fail if in discovery
- Put a reference on the nameservers ndlp when performing CT traffic.
- Remove unbalanced hba unlock.
- Fix up HBQ processing
- Fix lpfc debugfs discovery trace output for ELS rsp cmpl
- Send ADISC when rpi is 0
- Stop FDISC retrying forever
- Unable to retrieve correct config parameter for vport
- Fix sli_validate_fcp_iocb, sli_sum_iocb, sli_abort_iocb to be vport-aware.
- Fix index-out-of-range error in iocb. Spotted by Coverity.

Signed-off-by: default avatarJames Smart <James.Smart@emulex.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 78b2d852

drivers/scsi/lpfc/lpfc.h

+22 −11
Original line number Diff line number Diff line
@@ -78,6 +78,7 @@ struct lpfc_dma_pool { 


struct hbq_dmabuf {

	struct lpfc_dmabuf dbuf;

	uint32_t size;

	uint32_t tag;

};
@@ -329,15 +330,7 @@ struct lpfc_vport { 
#define FC_LOADING		0x1	/* HBA in process of loading drvr */

#define FC_UNLOADING		0x2	/* HBA in process of unloading drvr */

	char  *vname;		        /* Application assigned name */

	struct fc_vport *fc_vport;



#ifdef CONFIG_LPFC_DEBUG_FS

	struct dentry *debug_disc_trc;

	struct dentry *debug_nodelist;

	struct dentry *vport_debugfs_root;

	struct lpfc_debugfs_trc *disc_trc;

	atomic_t disc_trc_cnt;

#endif

	/* Vport Config Parameters */

	uint32_t cfg_scan_down;

	uint32_t cfg_lun_queue_depth;
@@ -353,6 +346,16 @@ struct lpfc_vport { 
	uint32_t cfg_max_luns;



	uint32_t dev_loss_tmo_changed;



	struct fc_vport *fc_vport;



#ifdef CONFIG_LPFC_DEBUG_FS

	struct dentry *debug_disc_trc;

	struct dentry *debug_nodelist;

	struct dentry *vport_debugfs_root;

	struct lpfc_debugfs_trc *disc_trc;

	atomic_t disc_trc_cnt;

#endif

};



struct hbq_s {
@@ -360,11 +363,19 @@ struct hbq_s { 
	uint32_t next_hbqPutIdx;  /* Index to next HBQ slot to use */

	uint32_t hbqPutIdx;	  /* HBQ slot to use */

	uint32_t local_hbqGetIdx; /* Local copy of Get index from Port */

	void    *hbq_virt;	  /* Virtual ptr to this hbq */

	struct list_head hbq_buffer_list;  /* buffers assigned to this HBQ */

				  /* Callback for HBQ buffer allocation */

	struct hbq_dmabuf *(*hbq_alloc_buffer) (struct lpfc_hba *);

				  /* Callback for HBQ buffer free */

	void               (*hbq_free_buffer) (struct lpfc_hba *,

					       struct hbq_dmabuf *);

};



#define LPFC_MAX_HBQS  16

/* this matches the possition in the lpfc_hbq_defs array */

#define LPFC_MAX_HBQS  4

/* this matches the position in the lpfc_hbq_defs array */

#define LPFC_ELS_HBQ	0

#define LPFC_EXTRA_HBQ	1



struct lpfc_hba {

	struct lpfc_sli sli;
@@ -460,7 +471,6 @@ struct lpfc_hba { 
	wait_queue_head_t    *work_wait;

	struct task_struct   *worker_thread;



	struct list_head hbq_buffer_list;

	uint32_t hbq_count;	        /* Count of configured HBQs */

	struct hbq_s hbqs[LPFC_MAX_HBQS]; /* local copy of hbq indicies  */
@@ -529,6 +539,7 @@ struct lpfc_hba { 
	mempool_t *nlp_mem_pool;



	struct fc_host_statistics link_stats;

	uint8_t using_msi;



	struct list_head port_list;

	struct lpfc_vport *pport;	/* physical lpfc_vport pointer */

drivers/scsi/lpfc/lpfc_attr.c

+10 −19
Original line number Diff line number Diff line
@@ -1027,8 +1027,8 @@ static CLASS_DEVICE_ATTR(lpfc_soft_wwpn, S_IRUGO | S_IWUSR,\ 
static ssize_t

lpfc_soft_wwnn_show(struct class_device *cdev, char *buf)

{

	struct Scsi_Host *host = class_to_shost(cdev);

	struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;

	struct Scsi_Host *shost = class_to_shost(cdev);

	struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;

	return snprintf(buf, PAGE_SIZE, "0x%llx\n",

			(unsigned long long)phba->cfg_soft_wwnn);

}
@@ -1037,8 +1037,8 @@ lpfc_soft_wwnn_show(struct class_device *cdev, char *buf) 
static ssize_t

lpfc_soft_wwnn_store(struct class_device *cdev, const char *buf, size_t count)

{

	struct Scsi_Host *host = class_to_shost(cdev);

	struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;

	struct Scsi_Host *shost = class_to_shost(cdev);

	struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;

	unsigned int i, j, cnt=count;

	u8 wwnn[8];
@@ -1153,25 +1153,16 @@ lpfc_nodev_tmo_init(struct lpfc_vport *vport, int val) 
static void

lpfc_update_rport_devloss_tmo(struct lpfc_vport *vport)

{

	struct lpfc_vport **vports;

	struct Scsi_Host  *shost;

	struct lpfc_nodelist  *ndlp;

	int i;



	vports = lpfc_create_vport_work_array(vport->phba);

	if (vports != NULL)

		for(i = 0; i < LPFC_MAX_VPORTS && vports[i] != NULL; i++) {

			shost = lpfc_shost_from_vport(vports[i]);

	shost = lpfc_shost_from_vport(vport);

	spin_lock_irq(shost->host_lock);

			list_for_each_entry(ndlp, &vports[i]->fc_nodes,

					    nlp_listp)

	list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp)

		if (ndlp->rport)

				ndlp->rport->dev_loss_tmo =

						vport->cfg_devloss_tmo;

			ndlp->rport->dev_loss_tmo = vport->cfg_devloss_tmo;

	spin_unlock_irq(shost->host_lock);

}

	lpfc_destroy_vport_work_array(vports);

}



static int

lpfc_nodev_tmo_set(struct lpfc_vport *vport, int val)

drivers/scsi/lpfc/lpfc_crtn.h

+9 −9
Original line number Diff line number Diff line
@@ -102,7 +102,7 @@ int lpfc_issue_els_scr(struct lpfc_vport *, uint32_t, uint8_t); 
int lpfc_els_free_iocb(struct lpfc_hba *, struct lpfc_iocbq *);

int lpfc_ct_free_iocb(struct lpfc_hba *, struct lpfc_iocbq *);

int lpfc_els_rsp_acc(struct lpfc_vport *, uint32_t, struct lpfc_iocbq *,

		     struct lpfc_nodelist *, LPFC_MBOXQ_t *, uint8_t);

		     struct lpfc_nodelist *, LPFC_MBOXQ_t *);

int lpfc_els_rsp_reject(struct lpfc_vport *, uint32_t, struct lpfc_iocbq *,

			struct lpfc_nodelist *, LPFC_MBOXQ_t *);

int lpfc_els_rsp_adisc_acc(struct lpfc_vport *, struct lpfc_iocbq *,
@@ -163,9 +163,11 @@ LPFC_MBOXQ_t *lpfc_mbox_get(struct lpfc_hba *); 
void lpfc_mbox_cmpl_put(struct lpfc_hba *, LPFC_MBOXQ_t *);

int lpfc_mbox_tmo_val(struct lpfc_hba *, int);



void lpfc_config_hbq(struct lpfc_hba *, struct lpfc_hbq_init *, uint32_t ,

		     LPFC_MBOXQ_t *);

void lpfc_config_hbq(struct lpfc_hba *, uint32_t, struct lpfc_hbq_init *,

	uint32_t , LPFC_MBOXQ_t *);

struct lpfc_hbq_entry * lpfc_sli_next_hbq_slot(struct lpfc_hba *, uint32_t);

struct hbq_dmabuf *lpfc_els_hbq_alloc(struct lpfc_hba *);

void lpfc_els_hbq_free(struct lpfc_hba *, struct hbq_dmabuf *);



int lpfc_mem_alloc(struct lpfc_hba *);

void lpfc_mem_free(struct lpfc_hba *);
@@ -202,6 +204,7 @@ int lpfc_sli_ringpostbuf_put(struct lpfc_hba *, struct lpfc_sli_ring *, 
struct lpfc_dmabuf *lpfc_sli_ringpostbuf_get(struct lpfc_hba *,

					     struct lpfc_sli_ring *,

					     dma_addr_t);

int lpfc_sli_hbq_count(void);

int lpfc_sli_hbqbuf_init_hbqs(struct lpfc_hba *, uint32_t);

int lpfc_sli_hbqbuf_add_hbqs(struct lpfc_hba *, uint32_t);

void lpfc_sli_hbqbuf_free_all(struct lpfc_hba *);
@@ -209,10 +212,9 @@ struct hbq_dmabuf *lpfc_sli_hbqbuf_find(struct lpfc_hba *, uint32_t); 
int lpfc_sli_hbq_size(void);

int lpfc_sli_issue_abort_iotag(struct lpfc_hba *, struct lpfc_sli_ring *,

			       struct lpfc_iocbq *);

int lpfc_sli_sum_iocb(struct lpfc_hba *, struct lpfc_sli_ring *, uint16_t,

int lpfc_sli_sum_iocb(struct lpfc_vport *, uint16_t, uint64_t, lpfc_ctx_cmd);

int lpfc_sli_abort_iocb(struct lpfc_vport *, struct lpfc_sli_ring *, uint16_t,

			uint64_t, lpfc_ctx_cmd);

int lpfc_sli_abort_iocb(struct lpfc_hba *, struct lpfc_sli_ring *, uint16_t,

			uint64_t, uint32_t, lpfc_ctx_cmd);



void lpfc_mbox_timeout(unsigned long);

void lpfc_mbox_timeout_handler(struct lpfc_hba *);
@@ -236,8 +238,6 @@ void lpfc_sli_abort_fcp_cmpl(struct lpfc_hba * phba, 
			     struct lpfc_iocbq * cmdiocb,

			     struct lpfc_iocbq * rspiocb);



void *lpfc_hbq_alloc(struct lpfc_hba *, int, dma_addr_t *);

void lpfc_hbq_free(struct lpfc_hba *, void *, dma_addr_t);

void lpfc_sli_free_hbq(struct lpfc_hba *, struct hbq_dmabuf *);



void *lpfc_mbuf_alloc(struct lpfc_hba *, int, dma_addr_t *);

drivers/scsi/lpfc/lpfc_ct.c

+19 −0
Original line number Diff line number Diff line
@@ -257,6 +257,10 @@ lpfc_ct_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *ctiocb) 
{

	struct lpfc_dmabuf *buf_ptr;



	if (ctiocb->context_un.ndlp) {

		lpfc_nlp_put(ctiocb->context_un.ndlp);

		ctiocb->context_un.ndlp = NULL;

	}

	if (ctiocb->context1) {

		buf_ptr = (struct lpfc_dmabuf *) ctiocb->context1;

		lpfc_mbuf_free(phba, buf_ptr->virt, buf_ptr->phys);
@@ -314,6 +318,7 @@ lpfc_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp, 
	/* Save for completion so we can release these resources */

	geniocb->context1 = (uint8_t *) inp;

	geniocb->context2 = (uint8_t *) outp;

	geniocb->context_un.ndlp = ndlp;



	/* Fill in payload, bp points to frame payload */

	icmd->ulpCommand = CMD_GEN_REQUEST64_CR;
@@ -548,8 +553,12 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	struct lpfc_dmabuf *bmp;

	struct lpfc_dmabuf *outp;

	struct lpfc_sli_ct_request *CTrsp;

	struct lpfc_nodelist *ndlp;

	int rc;



	/* First save ndlp, before we overwrite it */

	ndlp = cmdiocb->context_un.ndlp;



	/* we pass cmdiocb to state machine which needs rspiocb as well */

	cmdiocb->context_un.rsp_iocb = rspiocb;
@@ -674,6 +683,7 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		lpfc_disc_start(vport);

	}

out:

	cmdiocb->context_un.ndlp = ndlp; /* Now restore ndlp for free */

	lpfc_ct_free_iocb(phba, cmdiocb);

	return;

}
@@ -776,10 +786,14 @@ lpfc_cmpl_ct_cmd_rft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	struct lpfc_dmabuf *outp;

	IOCB_t *irsp;

	struct lpfc_sli_ct_request *CTrsp;

	struct lpfc_nodelist *ndlp;

	int cmdcode, rc;

	uint8_t retry;

	uint32_t latt;



	/* First save ndlp, before we overwrite it */

	ndlp = cmdiocb->context_un.ndlp;



	/* we pass cmdiocb to state machine which needs rspiocb as well */

	cmdiocb->context_un.rsp_iocb = rspiocb;
@@ -828,6 +842,7 @@ lpfc_cmpl_ct_cmd_rft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	}



out:

	cmdiocb->context_un.ndlp = ndlp; /* Now restore ndlp for free */

	lpfc_ct_free_iocb(phba, cmdiocb);

	return;

}
@@ -1066,6 +1081,7 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, 
		cmpl = lpfc_cmpl_ct_cmd_rff_id;

		break;

	}

	lpfc_nlp_get(ndlp);



	if (!lpfc_ct_cmd(vport, mp, bmp, ndlp, cmpl, rsp_size, retry)) {

		/* On success, The cmpl function will free the buffers */
@@ -1076,6 +1092,7 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, 
	}



	rc=6;

	lpfc_nlp_put(ndlp);

	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);

ns_cmd_free_bmp:

	kfree(bmp);
@@ -1501,10 +1518,12 @@ lpfc_fdmi_cmd(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, int cmdcode) 
	bpl->tus.w = le32_to_cpu(bpl->tus.w);



	cmpl = lpfc_cmpl_ct_cmd_fdmi;

	lpfc_nlp_get(ndlp);



	if (!lpfc_ct_cmd(vport, mp, bmp, ndlp, cmpl, FC_MAX_NS_RSP, 0))

		return 0;



	lpfc_nlp_put(ndlp);

	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);

fdmi_cmd_free_bmp:

	kfree(bmp);

drivers/scsi/lpfc/lpfc_debugfs.c

+5 −6
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ 
 * lpfc_debugfs_mask_disc_trc=Y  Where Y is an event mask as defined in

 *                               lpfc_debugfs.h .

 */

static int lpfc_debugfs_enable = 0;

static int lpfc_debugfs_enable = 1;

module_param(lpfc_debugfs_enable, int, 0);

MODULE_PARM_DESC(lpfc_debugfs_enable, "Enable debugfs services");
@@ -113,7 +113,6 @@ struct lpfc_debug { 
};



extern struct lpfc_hbq_init *lpfc_hbq_defs[];

extern int lpfc_sli_hbq_count(void);



atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);

unsigned long lpfc_debugfs_start_time = 0L;
@@ -233,8 +232,9 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size) 


	len +=  snprintf(buf+len, size-len, "HBQ %d Info\n", i);



	hbqs =  &phba->hbqs[i];

	posted = 0;

	list_for_each_entry(d_buf, &phba->hbq_buffer_list, list)

	list_for_each_entry(d_buf, &hbqs->hbq_buffer_list, list)

		posted++;



	hip =  lpfc_hbq_defs[i];
@@ -243,7 +243,6 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size) 
		hip->hbq_index, hip->profile, hip->rn,

		hip->buffer_count, hip->init_count, hip->add_count, posted);



	hbqs =  &phba->hbqs[i];

	raw_index = phba->hbq_get[i];

	getidx = le32_to_cpu(raw_index);

	len +=  snprintf(buf+len, size-len,
@@ -251,7 +250,7 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size) 
		hbqs->entry_count, hbqs->hbqPutIdx, hbqs->next_hbqPutIdx,

		hbqs->local_hbqGetIdx, getidx);



	hbqe = (struct lpfc_hbq_entry *) phba->hbqslimp.virt;

	hbqe = (struct lpfc_hbq_entry *) phba->hbqs[i].hbq_virt;

	for (j=0; j<hbqs->entry_count; j++) {

		len +=  snprintf(buf+len, size-len,

			"%03d: %08x %04x %05x ", j,
@@ -277,7 +276,7 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size) 
		}



		/* Get the Buffer info for the posted buffer */

		list_for_each_entry(d_buf, &phba->hbq_buffer_list, list) {

		list_for_each_entry(d_buf, &hbqs->hbq_buffer_list, list) {

			hbq_buf = container_of(d_buf, struct hbq_dmabuf, dbuf);

			phys = ((uint64_t)hbq_buf->dbuf.phys & 0xffffffff);

			if (phys == hbqe->bde.addrLow) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE