This issue was reported by coccicheck using the semantic patch
at scripts/coccinelle/api/memdup.cocci
Signed-off-by: Benoit Taine <benoit.taine@lip6.fr>
Acked-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

This issue was reported by coccicheck using the semantic patch
at scripts/coccinelle/api/memdup.cocci
Signed-off-by: Benoit Taine <benoit.taine@lip6.fr>
Acked-by: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

There are missing curly braces here so it prints that the recovery
failed even when it succeeded.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Acked-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 Bumping the driver version.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 During heavy IO in multipath environment with many active sessions
 and port-bouncing happening, there is a race condition because of
 which beiscsi_prcess_cqe() gets called for a connection whose
 endpoint is freed.

 Checking endpoint reference for a connection before processing in
 beiscsi_process_cq().
Signed-off-by: Minh Tran <minhduc.tran@emulex.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 EQ teardown should happen only after all CQ are destroyed.
 In some FW config, adapter goes into a freeze state. This
 fix moves teardown of MCC-Q before the EQ teardown happens.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 From: Dan Carpenter [mailto:dan.carpenter@oracle.com]
 Sent: Friday, March 28, 2014 1:42 AM
 Subject: re: [SCSI] be2iscsi: Fix handling timed out MBX completion from FW

 Hello Jayamohan Kallickal,

 The patch 1957aa7f: "[SCSI] be2iscsi: Fix handling timed out MBX completion from FW" from Jan 29, 2014, leads to the following static checker warning:

 drivers/scsi/be2iscsi/be_main.c:5581 beiscsi_dev_probe()
 error: memset() '&phba->ctrl.ptag_state[i]->tag_mem_state' too small (24 vs 32)

 drivers/scsi/be2iscsi/be_main.c
 5576          for (i = 0; i < MAX_MCC_CMD; i++) {
 5577                  init_waitqueue_head(&phba->ctrl.mcc_wait[i + 1]);
 5578                  phba->ctrl.mcc_tag[i] = i + 1;
 5579                  phba->ctrl.mcc_numtag[i + 1] = 0;
 5580                  phba->ctrl.mcc_tag_available++;
 5581                  memset(&phba->ctrl.ptag_state[i].tag_mem_state, 0,
 5582                         sizeof(struct beiscsi_mcc_tag_state));
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 Probably this this be change to sizeof(struct be_dma_mem struct)?  It looks like we are corrupting memory a bit here.

 5583          }

 regards,
 dan carpenter
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 SKH-R adapter, TCP Window Size/Scale parameters are passed
 in TCP Connection Offload Mbx Command.
Signed-off-by: Minh Tran <minhduc.tran@emulex.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Signed-off-by: Minh Tran <minhduc.tran@emulex.com>
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 Before probe for function was completed, iSCSI Daemon had initiated login
 to target while OS was coming up. The targets which had node.startup=automatic,
 login process was initiated.Since function specific initialization was still in
 progress this lead to kernel panic.

 Fixed the issue by moving iscsi_host_add() call after adapter initialization
 is done.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

 Getting WRB for MCCQ posting was done before looking if tag is
 available or not. This lead to increase phba->ctrl.mcc_obj.q.used
 variable and the WARN_ON message was coming from wrb_from_mccq().
 Moved getting wrb from mccq after checking for the tag.

 In wrb_from_mccq(), memset is done before returning wrb ptr.
 Removed memset of mccq wrb from all other functions.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Signed-off-by: Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Error handling in UFS driver is broken and resets the host controller
for fatal errors without re-initialization. Correct the fatal error
handling sequence according to UFS Host Controller Interface (HCI)
v1.1 specification.

o Processed requests which are completed w/wo error are reported to
  SCSI layer and any pending commands that are not started are aborted
  in the controller and re-queued into scsi mid-layer queue.

o Upon determining fatal error condition the host controller may hang
  forever until a reset is applied. Block SCSI layer for sending new
  requests and apply reset in a separate error handling work.

o SCSI is informed about the expected Unit-Attention exception from the
  device for the immediate command after a reset so that the SCSI layer
  take necessary steps to establish communication with the device.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Reviewed-by: Yaniv Gardi <ygardi@codeaurora.org>
Tested-by: Dolev Raviv <draviv@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

As of now SCSI initiated error handling is broken because,
the reset APIs don't try to bring back the device initialized and
ready for further transfers.

In case of timeouts, the scsi error handler takes care of handling aborts
and resets. Improve the error handling in such scenario by resetting the
device and host and re-initializing them in proper manner.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Reviewed-by: Yaniv Gardi <ygardi@codeaurora.org>
Tested-by: Dolev Raviv <draviv@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

There is a possible race condition in the hardware when the abort
command is issued to terminate the ongoing SCSI command as described
below:

- A bit in the door-bell register is set in the controller for a
  new SCSI command.
- In some rare situations, before controller get a chance to issue
  the command to the device, the software issued an abort command.
- If the device recieves abort command first then it returns success
  because the command itself is not present.
- Now if the controller commits the command to device it will be
  processed.
- Software thinks that command is aborted and proceed while still
  the device is processing it.
- The software, controller and device may go out of sync because of
  this race condition.

To avoid this, query task presence in the device before sending abort
task command so that after the abort operation, the command is guaranteed
to be non-existent in both controller and the device.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Reviewed-by: Yaniv Gardi <ygardi@codeaurora.org>
Tested-by: Dolev Raviv <draviv@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Currently, sending Task Management (TM) command to the card might
be broken in some scenarios as listed below:

Problem: If there are more than 8 TM commands the implementation
         returns error to the caller.
Fix:     Wait for one of the slots to be emptied and send the command.

Problem: Sometimes it is necessary for the caller to know the TM service
         response code to determine the task status.
Fix:     Propogate the service response to the caller.

Problem: If the TM command times out no proper error recovery is
         implemented.
Fix:     Clear the command in the controller door-bell register, so that
         further commands for the same slot don't fail.

Problem: While preparing the TM command descriptor, the task tag used
         should be unique across SCSI/NOP/QUERY/TM commands and not the
	 task tag of the command which the TM command is trying to manage.
Fix:     Use a unique task tag instead of task tag of SCSI command.

Problem: Since the TM command involves H/W communication, abruptly ending
         the request on kill interrupt signal might cause h/w malfunction.
Fix:     Wait for hardware completion interrupt with TASK_UNINTERRUPTIBLE
         set.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Reviewed-by: Yaniv Gardi <ygardi@codeaurora.org>
Tested-by: Dolev Raviv <draviv@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Make undeclared functions static and declare exported symbols
to suppress warnings from sparse tool.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Fix many warnings with incorrect endian assumptions
which makes the code unportable to new architectures.

The UFS specification defines the byte order as big-endian
for UPIU structure and little-endian for the host controller
transfer/task management descriptors.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Acked-by: Vinayak Holikatti <vinholikatti@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

rescan_hba_mode was defined as a u8 so could never be less than zero:

        rescan_hba_mode = hpsa_hba_mode_enabled(h);
        if (rescan_hba_mode < 0)
                goto out;
Signed-off-by: Joe Handzik <joseph.t.handzik@hp.com>
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

The sun3 drivers suffer from a whole bunch of duplicated code. Fix this
by following the g_NCR5380_mmio example. (Notionally, sun3_scsi relates to
sun3_scsi_vme in the same way that g_NCR5380 relates to g_NCR5380_mmio.)

Dead code is also removed: we now have working debug macros so
SUN3_SCSI_DEBUG is undesirable. Dead code within #ifdef OLD_DMA is also
dropped, consistent with sun3_scsi_vme.c.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Move the #include "NCR5380.h" out of the sun3_scsi.h header file and into
the driver .c files, like all the other NCR5380 drivers in the tree.

This improves uniformity and reduces the depth of nested includes. The
sequence of #include's, #define's and #if's no longer does my head in.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Remove the unused (and divergent) debugging macro definitions from
the sun3_NCR5380 and atari_NCR5380 drivers. These drivers have been
converted to use the common macros in NCR5380.h.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Acked-by: Michael Schmitz <schmitz@debian.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>

All three NCR5380 core driver implementations share the same NCR5380.h
header file so they need to agree on certain macro definitions.

The flag bit used by the NDEBUG_MERGING macro in atari_NCR5380 and
sun3_NCR5380 collides with the bit used by NDEBUG_LISTS.

Moreover, NDEBUG_ABORT appears in NCR5380.c so it should be defined in
NCR5380.h rather than in each of the many drivers using that core.

An undefined NDEBUG_ABORT macro caused compiler errors and led to dodgy
workarounds in the core driver that can now be removed.
(See commits f566a576 and
185a7a1c.)

Move all of the NDEBUG_ABORT, NDEBUG_TAGS and NDEBUG_MERGING macro
definitions into NCR5380.h where all the other NDEBUG macros live.

Also, incorrect "#ifdef NDEBUG" becomes "#if NDEBUG" to fix the warning:
drivers/scsi/mac_scsi.c: At top level:
drivers/scsi/NCR5380.c:418: warning: 'NCR5380_print' defined but not used
drivers/scsi/NCR5380.c:459: warning: 'NCR5380_print_phase' defined but not used

The debugging code is now enabled when NDEBUG != 0.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

All NCR5380 drivers already include the NCR5380.h header. Better to
adopt those macros rather than have three variations on them.

Moreover, the macros in NCR5380.h are preferable because the atari_NCR5380
and sun3_NCR5380 versions are inflexible. For example, they can't accomodate
dprintk(NDEBUG_MAIN | NDEBUG_QUEUES, ...)

Replace the *_PRINTK macros from atari_NCR5380.h and sun3_NCR5380.h with
the equivalent macros from NCR5380.h.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Acked-by: Michael Schmitz <schmitz@debian.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>

All NCR5380 drivers already include the NCR5380.h header. Better to
adopt those macros rather than have three variations on them.

Moreover, the macros in NCR5380.h are preferable anyway: the atari_NCR5380
and sun3_NCR5380 versions are inflexible. For example, they can't accomodate
NCR5380_dprint(NDEBUG_MAIN | NDEBUG_QUEUES, ...)

Replace the NCR_PRINT* macros from atari_NCR5380.h and sun3_NCR5380.h with
the equivalent macros from NCR5380.h.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Acked-by: Michael Schmitz <schmitz@debian.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>

There are three implementations of the core NCR5380 driver and three sets
of debugging macro definitions. And all three implementations use the
NCR5380.h header as well.

Two of the definitions of the dprintk macro accept a variable argument list
whereas the third does not. Standardize on the variable argument list.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

The change from cmd->target to cmd->device->id was apparently the purpose of
commit a7f25122 in
kernel/git/tglx/history.git but some instances have been missed.

Also fix the "NDEBUG_LAST_WRITE_SENT" and "NDEBUG_ALL" typo's.

Also fix some format strings (%ul becomes %lu) that caused compiler warnings.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Only the NCR5380_dprint() macro should invoke the NCR5380_print() function.
That's why NCR5380.c only defines the function #if NDEBUG. Use the standard
macro.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

HOSTS_C is always undefined. There is no hosts.c anymore.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

BOARD_NORMAL is completely unused and BOARD_NCR53C400 is used only by
g_NCR5380 internally. Remove the unused definitions.
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Acked-by: Sam Creasey <sammy@sammy.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Add an option to only transfer half the data for every n-th command.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Nicholas Bellinger <nab@linux-iscsi.org>

Taken almost entirely from Nicholas Bellinger's scsi-mq conversion.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Nicholas Bellinger <nab@linux-iscsi.org>

In case of error, the bnx2fc_allocate_hash_table() didn't free
all the memory it allocated.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Acked-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

If bnx2fc_allocate_hash_table() for some reasons fails, it is possible that the
hash_tbl_segments or the hash_tbl_pbl pointers are NULL.
In this case bnx2fc_free_hash_table() will panic the system.

this patch also fixes a memory leak, the hash_tbl_segments pointer was never
freed.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Acked-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

hash_table_size is not used by the bnx2fc_free_hash_table() function.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Acked-by: Eddie Wai <eddie.wai@broadcom.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Signed-off-by: Joe Handzik <joseph.t.handzik@hp.com>
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

And while we're at it fix a magic number
Signed-off-by: Joe Handzik <joseph.t.handzik@hp.com>
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Signed-off-by: Scott Teel <scott.teel@hp.com>
Signed-off-by: Joe Handzik <joseph.t.handzik@hp.com>
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Hellwig <hch@lst.de>

Checking for a NULL return from a kzalloc call in hpsa_get_pdisk_of_ioaccel2.
Signed-off-by: Scott Teel <scott.teel@hp.com>
Signed-off-by: Joe Handzik <joseph.t.handzik@hp.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Checking return value for the memory allocattion and freeing it
while exiting the function
Signed-off-by: Viswas G <Viswas.G@pmcs.com>
Signed-off-by: Suresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Acked-by: Jack Wang <xjtuwjp@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>