Re: [PATCH 20/25] qla2xxx: Remove redundant code

[Tran, Quinn]

-Original Message-
From:  on behalf of Bart Van Assche 

Date: Monday, May 22, 2017 at 11:23 AM
To: Nicholas Bellinger 
Cc: "linux-scsi@vger.kernel.org" , 
"james.bottom...@hansenpartnership.com" 
, "Madhani, Himanshu" 
, "martin.peter...@oracle.com" 

Subject: Re: [PATCH 20/25] qla2xxx: Remove redundant code

On Sun, 2017-05-21 at 21:27 -0700, Nicholas A. Bellinger wrote:
> The three lists abort_cmd_for_tag() walks from __qlt_24xx_handle_abts()
> are used to track descriptors only before __qlt_do_work() is reached,
> and before a descriptor is submitted into tcm_qla2xxx code.
> 
> Or rather, the three lists in abort_cmd_for_tag() only contain
> qla_tgt_cmd or qla_tgt_sess_op descriptors that have not yet reached
> qla_tgt_func_tmpl->handle_cmd() code.
> 
> Both qlt_do_work() and qlt_create_sess_from_atio() drop their respective
> descriptors from ->cmd_list before dispatching into tcm_qla2xxx ->
> target-core, which means there is no way for a descriptor to be part of
> internal lists once __qlt_do_work() is called.
> 
> That said, the patch is correct and removes the redundant lookup.

I do not agree that this patch is makes ABTS handling fully robust. It seems
like you have not noticed that the following race can occur with or without
this patch applied: if abort_cmd_for_tag() and 
qlt_try_to_dequeue_unknown_atios()
are called concurrently, since the latter function calls list_del() after
qlt_send_term_exchange(), abort_cmd_for_tag() can return 1 and thereby 
trigger
a call to qlt_24xx_send_abts_resp() while qlt_try_to_dequeue_unknown_atios()
calls qlt_send_term_exchange() concurrently. 

QT:  “[PATCH 03/25] qla2xxx: Allow ABTS RX, RIDA on ATIOQ for ISP83XX/27XX” 
attempts to reduce the describe concurrency by moving the IOCB from the RSPQ 
thread to the ATIOQ thread.  This helps preserve the ordering between SCSI cmd 
& ABTS.

I think an initiator could get
really confused if it receives two responses for the same exchange.

QT:  I do see the window you’re describing in the 
qlt_try_to_dequeue_unknown_atios().  Will have to follow up with another patch. 
  This patch is not meant for this window you’ve just identify.


An existing issue that is not addressed by this patch is that if an ABTS is
received after qlt_do_work() has called list_del() and before 
__qlt_do_work()
triggers a call target_submit_cmd() that a command is not on any list and 
hence
that abort_cmd_for_tag() won't be able to find it anywhere.

QT:  Actually, we’re covered in this case.There 2 responds for 2 
IOCB/transactions.  1) The  abort_cmd_for_tag() finds the SCSI command on the 
qla_cmd_list and turns on the abort flag while cmd is in work queue & before 
__qlt_do_work is called.  When __qlt_do_work is call and sees the aborted flag, 
the thread will terminate/cleanup the SCSI command and will not submit to TCM.

As for the ABTS, the abort_cmd_for_tag() returns 1 after finding the command 
will trigger an ABTS respond.  

static void __qlt_do_work(struct qla_tgt_cmd *cmd)
{
   if (cmd->aborted) {
ql_dbg(ql_dbg_tgt_mgt, vha, 0xf082,
"cmd with tag %u is aborted\n",
cmd->atio.u.isp24.exchange_addr);
goto out_term;
}
}

Shouldn't these issues be addressed properly?

QT: Will follow up with another patch for the new problem. thanks for the extra 
eyes.

Bart.

[PATCH] qla2xxx: Remove an unused structure member

[Bart Van Assche]

qla_tgt_cmd.free_work is not used by the qla2xxx driver. Hence
remove that member of struct qla_tgt_cmd.

Signed-off-by: Bart Van Assche 
Acked-by: Himanshu Madhani 
Cc: Quinn Tran 
Cc: Hannes Reinecke 
Cc: Christoph Hellwig 
Cc: Andy Grover 
Cc: David Disseldorp 
---
 drivers/scsi/qla2xxx/qla_target.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.h 
b/drivers/scsi/qla2xxx/qla_target.h
index d64420251194..dae278859554 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -862,7 +862,6 @@ struct qla_tgt_cmd {
struct se_cmd se_cmd;
struct fc_port *sess;
int state;
-   struct work_struct free_work;
struct work_struct work;
/* Sense buffer that will be mapped into outgoing status */
unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
-- 
2.12.2

Re: work queue of scsi fc transports should be serialized

[Martin Wilck]

On Sat, 2017-05-20 at 08:25 +, Dashi DS1 Cao wrote:
> On Fri, 2017-05-19 at 09:36 +, Dashi DS1 Cao wrote:
> > It seems there is a race of multiple "fc_starget_delete" of the
> > same 
> > rport, thus of the same SCSI host. The race leads to the race of 
> > scsi_remove_target and it cannot be prevented by the code snippet 
> > alone, even of the most recent
> > version:
> > spin_lock_irqsave(shost->host_lock, flags);
> > list_for_each_entry(starget, >__targets, siblings) {
> > if (starget->state == STARGET_DEL ||
> > starget->state == STARGET_REMOVE)
> > continue;
> > If there is a possibility that the starget is under deletion(state
> > == 
> > STARGET_DEL), it should be possible that list_next_entry(starget, 
> > siblings) could cause a read access violation.
> > Hello Dashi,
> > Something else must be going on. From scsi_remove_target():
> > restart:
> > spin_lock_irqsave(shost->host_lock, flags);
> > list_for_each_entry(starget, >__targets, siblings) {
> > if (starget->state == STARGET_DEL ||
> > starget->state == STARGET_REMOVE)
> > continue;
> > if (starget->dev.parent == dev || >dev == dev)
> > {
> > kref_get(>reap_ref);
> > starget->state = STARGET_REMOVE;
> > spin_unlock_irqrestore(shost->host_lock,
> > flags);
> > __scsi_remove_target(starget);
> > scsi_target_reap(starget);
> > goto restart;
> > }
> > }
> > spin_unlock_irqrestore(shost->host_lock, flags);
> > In other words, before scsi_remove_target() decides to call
> > __scsi_remove_target(), it changes the target state into
> > STARGET_REMOVE while holding the host lock. 
> > This means that scsi_remove_target() won't
> > call __scsi_remove_target() twice and also that it won't invoke
> > list_next_entry(starget, siblings) after starget has been 
> > freed.
> > Bart.
> 
> In the crashes of Suse 12 sp1, the root cause is the deletion of a
> list node without holding the lock:
> spin_lock_irqsave(shost->host_lock, flags);
> list_for_each_entry_safe(starget, tmp, >__targets,
> siblings) {
> if (starget->state == STARGET_DEL)
> continue;
> if (starget->dev.parent == dev || >dev ==
> dev) {
> /* assuming new targets arrive at the end */
> kref_get(>reap_ref);
> spin_unlock_irqrestore(shost->host_lock,
> flags);
> 
> __scsi_remove_target(starget);
> list_move_tail(>siblings,
> _list);  --this deletion from shost->__targets list is done
> without the lock.
> spin_lock_irqsave(shost->host_lock, flags);
>  }
>   }
>   spin_unlock_irqrestore(shost->host_lock, flags);

I believe this is fixed in SLES12-SP1 kernel 3.12.53-60.30.1, with the
following patch:

* Mon Jan 18 2016 jthumsh...@suse.de
- scsi: restart list search after unlock in scsi_remove_target
  (bsc#944749, bsc#959257).
- Delete
  patches.fixes/0001-SCSI-Fix-hard-lockup-in-scsi_remove_target.patch.
- commit 2490876

Regards,
Martin

-- 
Dr. Martin Wilck , Tel. +49 (0)911 74053 2107
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)

Re: [PATCH 20/25] qla2xxx: Remove redundant code

[Bart Van Assche]

On Sun, 2017-05-21 at 21:27 -0700, Nicholas A. Bellinger wrote:
> The three lists abort_cmd_for_tag() walks from __qlt_24xx_handle_abts()
> are used to track descriptors only before __qlt_do_work() is reached,
> and before a descriptor is submitted into tcm_qla2xxx code.
> 
> Or rather, the three lists in abort_cmd_for_tag() only contain
> qla_tgt_cmd or qla_tgt_sess_op descriptors that have not yet reached
> qla_tgt_func_tmpl->handle_cmd() code.
> 
> Both qlt_do_work() and qlt_create_sess_from_atio() drop their respective
> descriptors from ->cmd_list before dispatching into tcm_qla2xxx ->
> target-core, which means there is no way for a descriptor to be part of
> internal lists once __qlt_do_work() is called.
> 
> That said, the patch is correct and removes the redundant lookup.

I do not agree that this patch is makes ABTS handling fully robust. It seems
like you have not noticed that the following race can occur with or without
this patch applied: if abort_cmd_for_tag() and 
qlt_try_to_dequeue_unknown_atios()
are called concurrently, since the latter function calls list_del() after
qlt_send_term_exchange(), abort_cmd_for_tag() can return 1 and thereby trigger
a call to qlt_24xx_send_abts_resp() while qlt_try_to_dequeue_unknown_atios()
calls qlt_send_term_exchange() concurrently. I think an initiator could get
really confused if it receives two responses for the same exchange.

An existing issue that is not addressed by this patch is that if an ABTS is
received after qlt_do_work() has called list_del() and before __qlt_do_work()
triggers a call target_submit_cmd() that a command is not on any list and hence
that abort_cmd_for_tag() won't be able to find it anywhere.

Shouldn't these issues be addressed properly?

Bart.

[PATCH] scsi: hisi_sas: add null check before indirect pointer dereference

[Gustavo A. R. Silva]

Add null check before indirectly dereferencing pointer task->lldd_task
in statement u32 tag = slot->idx;

Addresses-Coverity-ID: 1373843
Signed-off-by: Gustavo A. R. Silva 
---
 drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c 
b/drivers/scsi/hisi_sas/hisi_sas_main.c
index d622db5..f720d3c 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -963,7 +963,7 @@ static int hisi_sas_abort_task(struct sas_task *task)
 HISI_SAS_INT_ABT_DEV, 0);
rc = hisi_sas_softreset_ata_disk(device);
}
-   } else if (task->task_proto & SAS_PROTOCOL_SMP) {
+   } else if (task->lldd_task && task->task_proto & SAS_PROTOCOL_SMP) {
/* SMP */
struct hisi_sas_slot *slot = task->lldd_task;
u32 tag = slot->idx;
-- 
2.5.0

Re: [PATCH blktests v2 3/3] sg/001: add regression test for syzcaller generated GPF in sg_read path

[Omar Sandoval]

On Fri, May 19, 2017 at 03:55:31PM +0200, Johannes Thumshirn wrote:
> Add a regression test for commit 48ae8484e9fc ("scsi: sg: don't return
> bogus Sg_requests"). This is a general protection fault triggered by
> syzcaller via issuing bogus read(2)s on the /dev/sg devices.
> 
> Signed-off-by: Johannes Thumshirn 
> ---
>  tests/sg/001 | 47 +++
>  tests/sg/001.out |  2 ++
>  2 files changed, 49 insertions(+)
>  create mode 100755 tests/sg/001
>  create mode 100644 tests/sg/001.out
> 
> diff --git a/tests/sg/001 b/tests/sg/001
> new file mode 100755
> index ..86430409b6a3
> --- /dev/null
> +++ b/tests/sg/001
> @@ -0,0 +1,47 @@
> +#!/bin/bash
> +#
> +# Regression test for commit 48ae8484e9fc ("scsi: sg: don't return bogus
> +# Sg_requests")
> +#
> +# Copyright (C) 2017 Johannes Thumshirn 
> +#
> +# This program is free software: you can redistribute it and/or modify
> +# it under the terms of the GNU General Public License as published by
> +# the Free Software Foundation, either version 3 of the License, or
> +# (at your option) any later version.
> +#
> +# This program is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +# GNU General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program.  If not, see .
> +
> +. common/sg
> +. common/scsi_debug
> +
> +DESCRIPTION="try triggering a kernel GPF with 0 byte SG reads"
> +QUICK=1
> +
> +requires() {
> + _have_program src/sg-001 \
> + && _have_scsi_debug \
> + && _have_scsi_generic
> +}
> +
> +
> +test() {
> + echo "Running ${TEST_NAME}"
> +
> + if ! _get_scsi_debug_dev; then
> + return 1
> + fi
> +
> + SG_DEV=$(_get_sg_from_blockdev "$SCSI_DEBUG_NAME")
> + timeout -s INT 10s ./src/sg-001 "$SG_DEV"
> +
> + _put_scsi_debug_dev
> +
> + echo "Test complete"
> +}

This looks much better, thanks! One question for you: is there any value
in running this on specific test devices (i.e., changing test() to
test_device() and using "$TEST_DEV" instead of a scsi-debug device), or
would it be a waste of time since it's just exercising generic code?

Re: [PATCH 19/25] qla2xxx: Replace ql2xexchoffld & ql_dm_tgt_ex_pct parameter

[Madhani, Himanshu]

Hi Bart, 

> On May 19, 2017, at 4:27 PM, Bart Van Assche  
> wrote:
> 
> On Fri, 2017-05-19 at 14:53 -0700, Himanshu Madhani wrote:
>> [ ... ]
>> -int ql2xexchoffld = 0;
>> -module_param(ql2xexchoffld, uint, S_IRUGO|S_IWUSR);
>> -MODULE_PARM_DESC(ql2xexchoffld,
>> - "Number of exchanges to offload. "
>> - "0 (Default)- Disabled.");
>> +int ql2xtgtexchg = 1024;
>> +module_param(ql2xtgtexchg, uint, 0644);
>> +MODULE_PARM_DESC(ql2xtgtexchg,
>> +"Number of target exchanges.");
>> +
>> +int ql2xiniexchg = 1024;
>> +module_param(ql2xiniexchg, uint, 0644);
>> +MODULE_PARM_DESC(ql2xtgtexchg,
>> +"Number of initiator exchanges.");
>> 
> 
> [ ... ]
> 
>> -static int ql_dm_tgt_ex_pct = 50;
>> -module_param(ql_dm_tgt_ex_pct, int, S_IRUGO|S_IWUSR);
>> -MODULE_PARM_DESC(ql_dm_tgt_ex_pct,
>> -"For Dual Mode (qlini_mode=dual), this parameter determines "
>> -"the percentage of exchanges/cmds FW will allocate resources "
>> -"for Target mode.");
>> -
> 
> Hello Himanshu and Quinn,
> 
> Renaming internal variables is fine but renaming module parameters is not
> acceptable. Please don't do this.
> 
> Thanks,
> 
> Bart.

Will update patch to preserve module parameter. 

Thanks,
- Himanshu

Re: [PATCH 17/25] qla2xxx: Cleanup debug messager IDs.

[Madhani, Himanshu]

Hi Bart, 

> On May 19, 2017, at 4:23 PM, Bart Van Assche  
> wrote:
> 
> On Fri, 2017-05-19 at 14:53 -0700, Himanshu Madhani wrote:
>> diff --git a/drivers/scsi/qla2xxx/qla_attr.c 
>> b/drivers/scsi/qla2xxx/qla_attr.c
>> index 7c8d6c54ab70..a7ac81b473a4 100644
>> --- a/drivers/scsi/qla2xxx/qla_attr.c
>> +++ b/drivers/scsi/qla2xxx/qla_attr.c
>> @@ -44,7 +44,7 @@ qla2x00_sysfs_read_fw_dump(struct file *filp, struct 
>> kobject *kobj,
>>  MCTP_DUMP_SIZE);
>>  else if (ha->fw_dump_reading)
>>  return memory_read_from_buffer(buf, count, , ha->fw_dump,
>> -ha->fw_dump_len);
>> +ha->fw_dump_len);
>>  else
>>  return 0;
>> }
>> @@ -162,7 +162,7 @@ qla2x00_sysfs_read_nvram(struct file *filp, struct 
>> kobject *kobj,
>>  ha->isp_ops->read_optrom(vha, ha->nvram, ha->flt_region_nvram 
>> << 2,
>>  ha->nvram_size);
>>  return memory_read_from_buffer(buf, count, , ha->nvram,
>> -ha->nvram_size);
>> +ha->nvram_size);
>> }
>> 
>> static ssize_t
>> @@ -406,8 +406,8 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct 
>> kobject *kobj,
>>  start == (ha->flt_region_fw * 4))
>>  valid = 1;
>>  else if (IS_QLA24XX_TYPE(ha) || IS_QLA25XX(ha)
>> -|| IS_CNA_CAPABLE(ha) || IS_QLA2031(ha)
>> -|| IS_QLA27XX(ha))
>> +|| IS_CNA_CAPABLE(ha) || IS_QLA2031(ha)
>> +|| IS_QLA27XX(ha))
>>  valid = 1;
>>  if (!valid) {
>>  ql_log(ql_log_warn, vha, 0x7065,
> [ ... ]
>> @@ -1295,7 +1295,7 @@ qla24xx_84xx_fw_version_show(struct device *dev,
>> 
>>  if ((rval == QLA_SUCCESS) && (status[0] == 0))
>>  return scnprintf(buf, PAGE_SIZE, "%u\n",
>> -(uint32_t)ha->cs84xx->op_fw_version);
>> +(uint32_t)ha->cs84xx->op_fw_version);
>> 
>>  return scnprintf(buf, PAGE_SIZE, "\n");
>> }
>> @@ -1608,7 +1608,7 @@ static void
>> qla2x00_get_host_speed(struct Scsi_Host *shost)
>> {
>>  struct qla_hw_data *ha = ((struct scsi_qla_host *)
>> -(shost_priv(shost)))->hw;
>> +(shost_priv(shost)))->hw;
>>  u32 speed = FC_PORTSPEED_UNKNOWN;
>> 
>>  if (IS_QLAFX00(ha)) {
>> @@ -1853,7 +1853,7 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
>>  !ha->dpc_active) {
>>  /* Must be in a 'READY' state for statistics retrieval. */
>>  rval = qla2x00_get_link_status(base_vha, base_vha->loop_id,
>> -stats, stats_dma);
>> +stats, stats_dma);
>>  }
>> 
>>  if (rval != QLA_SUCCESS)
>> 
> [ ... ]
>> @@ -2147,7 +2147,7 @@ qla8044_serdes_op(struct bsg_job *bsg_job)
>>  bsg_job->reply_len = sizeof(struct fc_bsg_reply);
>>  bsg_reply->result = DID_OK << 16;
>>  bsg_job_done(bsg_job, bsg_reply->result,
>> -   bsg_reply->reply_payload_rcv_len);
>> +bsg_reply->reply_payload_rcv_len);
>>  return 0;
>> }
> [ ... ]
>>  "DMA allocation failed for %u\n",
>> - qla2x00_gid_list_size(ha));
>> +qla2x00_gid_list_size(ha));
>>  return 0;
>>  }
> [ ... ]
>> @@ -384,10 +384,10 @@ qla2x00_dfs_setup(scsi_qla_host_t *vha)
>>  }
>> 
>>  ha->tgt.dfs_tgt_sess = debugfs_create_file("tgt_sess",
>> -S_IRUSR, ha->dfs_dir, vha, _tgt_sess_ops);
>> +S_IRUSR, ha->dfs_dir, vha, _tgt_sess_ops);
>>  
> 
> Hello Himanshu and Quinn,
> 
> This kind of whitespace changes makes the code harder to read and is not 
> useful in
> any way. Please remove all whitespace changes from this patch.
> 
> Thanks,
> 
> Bart.

Sure. Will update patch. 

Thanks,
- Himanshu

Re: [PATCH 03/25] qla2xxx: Allow ABTS RX, RIDA on ATIOQ for ISP83XX/27XX

[Madhani, Himanshu]

Hi Bart, 

> On May 19, 2017, at 3:42 PM, Bart Van Assche  
> wrote:
> 
> On Fri, 2017-05-19 at 14:53 -0700, Himanshu Madhani wrote:
>> From: Quinn Tran 
>> 
>> Allow ABTS RX, RIDA to be moved to ATIO Queue only for
>> ISP83XX and ISP27XX.
> 
> Hello Himanshu,
> 
> Sorry but this description sounds rather mysterious to me?
> 
> Bart.

we had added module parameter “ ql2xmvasynctoatio” as part of the Improve RSCN 
handling patch 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/scsi/qla2xxx?id=41dc529a4602ac737020f423f84686a81de38e6d

At the time when we submitted patch, we were setting bit for all ISPs which is 
not correct. Only ISP83XX/27XX should be allowed to set this bit. 

Setting this Bit will allow firmware to post ABTS/PUREX/RIDA IOCB’s via ATIO 
queue only when target/dual mode is operational.

Thanks,
- Himanshu

Re: [PATCH 02/25] qla2xxx: Remove redundant fc_host_port_name call

[Madhani, Himanshu]

Hi Bart, 

> On May 19, 2017, at 3:37 PM, Bart Van Assche  
> wrote:
> 
> On Fri, 2017-05-19 at 14:53 -0700, Himanshu Madhani wrote:
>> From: Quinn Tran 
>> 
>> Remove redundant fc_host_port_name calls to prevent
>> early access of scsi_host->shost_data buffer. This
>> prevent null pointer access.
>> 
>> Cc: 
>> Signed-off-by: Quinn Tran 
>> Signed-off-by: Himanshu Madhani 
>> ---
>> drivers/scsi/qla2xxx/qla_mbx.c | 9 -
>> 1 file changed, 9 deletions(-)
>> 
>> diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
>> index a113ab3592a7..12fea77e31c6 100644
>> --- a/drivers/scsi/qla2xxx/qla_mbx.c
>> +++ b/drivers/scsi/qla2xxx/qla_mbx.c
>> @@ -3676,15 +3676,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
>>  qlt_update_host_map(vha, id);
>>  }
>> 
>> -fc_host_port_name(vha->host) =
>> -wwn_to_u64(vha->port_name);
>> -
>> -if (qla_ini_mode_enabled(vha))
>> -ql_dbg(ql_dbg_mbx, vha, 0x1018,
>> -"FA-WWN portname %016llx (%x)\n",
>> -fc_host_port_name(vha->host),
>> -rptid_entry->vp_status);
>> -
>>  set_bit(REGISTER_FC4_NEEDED, >dpc_flags);
>>  set_bit(REGISTER_FDMI_NEEDED, >dpc_flags);
>>  } else {
> 
> Hello Himanshu,
> 
> If the above host port name assignment is redundant, what is the host
> port name assignment it is redundant with?
> 

> Which of the removed statements could trigger a NULL pointer access, and
> from what context? Is there perhaps a call trace available of the NULL
> pointer access?
> 
> Thanks,
> 
> Bart.

We see following NULL pointer access on a faster systems. So far its has been 
only seen on
couple systems in our env. 

[  498.637517] BUG: unable to handle kernel NULL pointer dereference at 
0008
[  498.637572] IP: qla24xx_report_id_acquisition+0x22d/0x3a0 [qla2xxx]

GDB showed following lines were causing NULL pointer deference. 

(gdb) l *qla24xx_report_id_acquisition+0x22d
0x2012d is in qla24xx_report_id_acquisition 
(drivers/scsi/qla2xxx/qla_mbx.c:3679).
3674   }
3675   
3676   
qlt_update_host_map(vha, id);
3677   }
3678   
3679   
fc_host_port_name(vha->host) =
3680   
wwn_to_u64(vha->port_name);
3681   
3682   if 
(qla_ini_mode_enabled(vha))
3683   
ql_dbg(ql_dbg_mbx, vha, 0x1018,
(gdb) 

Thanks,
- Himanshu

Re: [PATCH 15/18] scsi: storvsc: Initialize driver-private command before using it

[Bart Van Assche]

On Sun, 2017-05-21 at 08:51 +0200, Christoph Hellwig wrote:
> On Fri, May 19, 2017 at 11:30:13AM -0700, Bart Van Assche wrote:
> > The storvsc driver is the only SCSI LLD that uses driver-private
> > command data and that does not zero-initialize that data before
> > reading it. Make this driver consistent with the other SCSI LLDs
> > that use driver-private command data.
> 
> Well.  Either we add zeroing to storvsc and remove it from common
> code, or we remove the zeroing from the drivers.
> 
> We shouldn't do both.  Given that we already zero the remaining
> command it seems to me like keeping the zeroing in common code
> would be preferred, but I'm open to discussion.

Hello Christoph,

I will remove the code that zeroes driver-private command data from the other
SCSI LLDs and add it to the scsi-sq request preparation code path.

Bart.

Re: [PATCH 14/18] scsi: Make scsi_initialize_rq() zero the entire struct scsi_cmnd

[Bart Van Assche]

On Sun, 2017-05-21 at 08:49 +0200, Christoph Hellwig wrote:
> On Fri, May 19, 2017 at 11:30:12AM -0700, Bart Van Assche wrote:
> > This simplifies the memset() call in scsi_initialize_rq() and avoids
> > that any stale data is left behind in struct scsi_request.
> > 
> > Signed-off-by: Bart Van Assche 
> > Cc: Christoph Hellwig 
> > Cc: Hannes Reinecke 
> > ---
> >  drivers/scsi/scsi_lib.c | 6 ++
> >  1 file changed, 2 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
> > index eeb668935836..791bae192bfb 100644
> > --- a/drivers/scsi/scsi_lib.c
> > +++ b/drivers/scsi/scsi_lib.c
> > @@ -1160,11 +1160,9 @@ static void scsi_initialize_rq(struct request *rq)
> > void *buf = cmd->sense_buffer;
> > void *prot = cmd->prot_sdb;
> >  
> > -   /* zero out the cmd, except for the embedded scsi_request */
> > -   memset((char *)cmd + sizeof(cmd->req), 0,
> > -   sizeof(*cmd) - sizeof(cmd->req) + dev->host->hostt->cmd_size);
> > +   memset(cmd, 0, blk_queue_cmd_size(rq->q));
> > scsi_req_init(>req);
> > -   cmd->req.sense = cmd->sense_buffer;
> > +   cmd->req.sense = buf;
> > cmd->device = dev;
> > cmd->sense_buffer = buf;
> 
> maybe move the two sense buffer initializations together?

Hello Christoph,

That sounds like a good idea to me. I will make that change.

Bart.

Re: [PATCH 07/18] block: Introduce request_queue.initialize_rq_fn()

[Bart Van Assche]

On Sun, 2017-05-21 at 08:34 +0200, Christoph Hellwig wrote:
> On Fri, May 19, 2017 at 11:30:05AM -0700, Bart Van Assche wrote:
> > Several block drivers need to initialize the driver-private data
> > after having called blk_get_request() and before .prep_rq_fn() is
> > called, e.g. when submitting a REQ_OP_SCSI_* request. Avoid that
> > that initialization code has to be repeated after every
> > blk_get_request() call by adding a new callback function to struct
> > request_queue.
> > 
> > Signed-off-by: Bart Van Assche 
> > Cc: Jens Axboe 
> > Cc: Christoph Hellwig 
> > Cc: Omar Sandoval 
> > Cc: Hannes Reinecke 
> > Cc: linux-bl...@vger.kernel.org
> > ---
> >  block/blk-core.c   | 3 +++
> >  block/blk-mq.c | 3 +++
> >  include/linux/blkdev.h | 4 
> >  3 files changed, 10 insertions(+)
> > 
> > diff --git a/block/blk-core.c b/block/blk-core.c
> > index a69d420b7ff0..f2540d164679 100644
> > --- a/block/blk-core.c
> > +++ b/block/blk-core.c
> > @@ -126,6 +126,9 @@ void blk_rq_init(struct request_queue *q, struct 
> > request *rq)
> > rq->start_time = jiffies;
> > set_start_time_ns(rq);
> > rq->part = NULL;
> > +
> > +   if (q->initialize_rq_fn)
> > +   q->initialize_rq_fn(rq);
> 
> Can we keep this out of the fast path and only do it from the
> blk_get_request / blk_mq_alloc_request path?  And while were at it
> I think those two should be merged as far as the public interface
> goes, that is we should also expose the flags argument for the
> legacy path.

Hello Christoph,

For blk-mq I could move the .initialize_rq_fn() call from
blk_mq_rq_ctx_init() into blk_mq_sched_get_request(). I can't move it
higher up in the request allocation call chain because otherwise
blk_mq_alloc_request_hctx() wouldn't call .initialize_rq_fn().

For blk-sq I'm not sure that the .initialize_rq_fn() call can be
moved because I'd like all blk_rq_init() callers to call
.initialize_rq_fn(), including ide_prep_sense().

Are you sure it would help to move the .initialize_rq_fn() calls?

Thanks,

Bart.

[PATCH v9 00/15] Replace PCI pool by DMA pool API

[Romain Perier]

The current PCI pool API are simple macro functions direct expanded to
the appropriate dma pool functions. The prototypes are almost the same
and semantically, they are very similar. I propose to use the DMA pool
API directly and get rid of the old API.

This set of patches, replaces the old API by the dma pool API
and remove the defines.

Changes in v9:
- Rebased series onto next-20170522
- I have fixed and improved the patch for lpfc driver

Changes in v8:
- Rebased series onto next-20170428

Changes in v7:
- Rebased series onto next-20170416
- Added Acked-by, Tested-by and Reviwed-by tags

Changes in v6:
- Fixed an issue reported by kbuild test robot about changes in DAC960
- Removed patches 15/19,16/19,17/19,18/19. They have been merged by Greg
- Added Acked-by Tags

Changes in v5:
- Re-worded the cover letter (remove sentence about checkpatch.pl)
- Rebased series onto next-20170308
- Fix typos in commit message
- Added Acked-by Tags

Changes in v4:
- Rebased series onto next-20170301
- Removed patch 20/20: checks done by checkpath.pl, no longer required.
  Thanks to Peter and Joe for their feedbacks.
- Added Reviewed-by tags

Changes in v3:
- Rebased series onto next-20170224
- Fix checkpath.pl reports for patch 11/20 and patch 12/20
- Remove prefix RFC
Changes in v2:
- Introduced patch 18/20
- Fixed cosmetic changes: spaces before brace, live over 80 characters
- Removed some of the check for NULL pointers before calling dma_pool_destroy
- Improved the regexp in checkpatch for pci_pool, thanks to Joe Perches
- Added Tested-by and Acked-by tags

Romain Perier (15):
  block: DAC960: Replace PCI pool old API
  dmaengine: pch_dma: Replace PCI pool old API
  IB/mthca: Replace PCI pool old API
  net: e100: Replace PCI pool old API
  mlx4: Replace PCI pool old API
  mlx5: Replace PCI pool old API
  wireless: ipw2200: Replace PCI pool old API
  scsi: be2iscsi: Replace PCI pool old API
  scsi: csiostor: Replace PCI pool old API
  scsi: lpfc: Replace PCI pool old API
  scsi: megaraid: Replace PCI pool old API
  scsi: mpt3sas: Replace PCI pool old API
  scsi: mvsas: Replace PCI pool old API
  scsi: pmcraid: Replace PCI pool old API
  PCI: Remove PCI pool macro functions

 drivers/block/DAC960.c| 38 ++-
 drivers/block/DAC960.h|  4 +-
 drivers/dma/pch_dma.c | 12 ++--
 drivers/infiniband/hw/mthca/mthca_av.c| 10 +--
 drivers/infiniband/hw/mthca/mthca_cmd.c   |  8 +--
 drivers/infiniband/hw/mthca/mthca_dev.h   |  4 +-
 drivers/net/ethernet/intel/e100.c | 12 ++--
 drivers/net/ethernet/mellanox/mlx4/cmd.c  | 10 +--
 drivers/net/ethernet/mellanox/mlx4/mlx4.h |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 11 ++--
 drivers/net/wireless/intel/ipw2x00/ipw2200.c  | 13 ++--
 drivers/scsi/be2iscsi/be_iscsi.c  |  6 +-
 drivers/scsi/be2iscsi/be_main.c   |  6 +-
 drivers/scsi/be2iscsi/be_main.h   |  2 +-
 drivers/scsi/csiostor/csio_hw.h   |  2 +-
 drivers/scsi/csiostor/csio_init.c | 11 ++--
 drivers/scsi/csiostor/csio_scsi.c |  6 +-
 drivers/scsi/lpfc/lpfc.h  | 16 ++---
 drivers/scsi/lpfc/lpfc_init.c | 16 ++---
 drivers/scsi/lpfc/lpfc_mem.c  | 90 +--
 drivers/scsi/lpfc/lpfc_nvme.c |  6 +-
 drivers/scsi/lpfc/lpfc_nvmet.c|  4 +-
 drivers/scsi/lpfc/lpfc_scsi.c | 12 ++--
 drivers/scsi/lpfc/lpfc_sli.c  |  6 +-
 drivers/scsi/megaraid/megaraid_mbox.c | 33 +-
 drivers/scsi/megaraid/megaraid_mm.c   | 32 +-
 drivers/scsi/megaraid/megaraid_sas_base.c | 29 +
 drivers/scsi/megaraid/megaraid_sas_fusion.c   | 66 +---
 drivers/scsi/mpt3sas/mpt3sas_base.c   | 73 ++
 drivers/scsi/mvsas/mv_init.c  |  6 +-
 drivers/scsi/mvsas/mv_sas.c   |  6 +-
 drivers/scsi/pmcraid.c| 10 +--
 drivers/scsi/pmcraid.h|  2 +-
 include/linux/mlx5/driver.h   |  2 +-
 include/linux/pci.h   |  9 ---
 35 files changed, 278 insertions(+), 297 deletions(-)

-- 
2.11.0

[PATCH v9 02/15] dmaengine: pch_dma: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
---
 drivers/dma/pch_dma.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
index f9028e9d0dfc..afd8f27bda96 100644
--- a/drivers/dma/pch_dma.c
+++ b/drivers/dma/pch_dma.c
@@ -123,7 +123,7 @@ struct pch_dma_chan {
 struct pch_dma {
struct dma_device   dma;
void __iomem *membase;
-   struct pci_pool *pool;
+   struct dma_pool *pool;
struct pch_dma_regs regs;
struct pch_dma_desc_regs ch_regs[MAX_CHAN_NR];
struct pch_dma_chan channels[MAX_CHAN_NR];
@@ -437,7 +437,7 @@ static struct pch_dma_desc *pdc_alloc_desc(struct dma_chan 
*chan, gfp_t flags)
struct pch_dma *pd = to_pd(chan->device);
dma_addr_t addr;
 
-   desc = pci_pool_zalloc(pd->pool, flags, );
+   desc = dma_pool_zalloc(pd->pool, flags, );
if (desc) {
INIT_LIST_HEAD(>tx_list);
dma_async_tx_descriptor_init(>txd, chan);
@@ -549,7 +549,7 @@ static void pd_free_chan_resources(struct dma_chan *chan)
spin_unlock_irq(_chan->lock);
 
list_for_each_entry_safe(desc, _d, _list, desc_node)
-   pci_pool_free(pd->pool, desc, desc->txd.phys);
+   dma_pool_free(pd->pool, desc, desc->txd.phys);
 
pdc_enable_irq(chan, 0);
 }
@@ -880,7 +880,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
goto err_iounmap;
}
 
-   pd->pool = pci_pool_create("pch_dma_desc_pool", pdev,
+   pd->pool = dma_pool_create("pch_dma_desc_pool", >dev,
   sizeof(struct pch_dma_desc), 4, 0);
if (!pd->pool) {
dev_err(>dev, "Failed to alloc DMA descriptors\n");
@@ -931,7 +931,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
return 0;
 
 err_free_pool:
-   pci_pool_destroy(pd->pool);
+   dma_pool_destroy(pd->pool);
 err_free_irq:
free_irq(pdev->irq, pd);
 err_iounmap:
@@ -963,7 +963,7 @@ static void pch_dma_remove(struct pci_dev *pdev)
tasklet_kill(_chan->tasklet);
}
 
-   pci_pool_destroy(pd->pool);
+   dma_pool_destroy(pd->pool);
pci_iounmap(pdev, pd->membase);
pci_release_regions(pdev);
pci_disable_device(pdev);
-- 
2.11.0

[PATCH v9 01/15] block: DAC960: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
---
 drivers/block/DAC960.c | 38 ++
 drivers/block/DAC960.h |  4 ++--
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 26a51be77227..a0883ad04ecf 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -268,17 +268,17 @@ static bool 
DAC960_CreateAuxiliaryStructures(DAC960_Controller_T *Controller)
   void *AllocationPointer = NULL;
   void *ScatterGatherCPU = NULL;
   dma_addr_t ScatterGatherDMA;
-  struct pci_pool *ScatterGatherPool;
+  struct dma_pool *ScatterGatherPool;
   void *RequestSenseCPU = NULL;
   dma_addr_t RequestSenseDMA;
-  struct pci_pool *RequestSensePool = NULL;
+  struct dma_pool *RequestSensePool = NULL;
 
   if (Controller->FirmwareType == DAC960_V1_Controller)
 {
   CommandAllocationLength = offsetof(DAC960_Command_T, V1.EndMarker);
   CommandAllocationGroupSize = DAC960_V1_CommandAllocationGroupSize;
-  ScatterGatherPool = pci_pool_create("DAC960_V1_ScatterGather",
-   Controller->PCIDevice,
+  ScatterGatherPool = dma_pool_create("DAC960_V1_ScatterGather",
+   >PCIDevice->dev,
DAC960_V1_ScatterGatherLimit * sizeof(DAC960_V1_ScatterGatherSegment_T),
sizeof(DAC960_V1_ScatterGatherSegment_T), 0);
   if (ScatterGatherPool == NULL)
@@ -290,18 +290,18 @@ static bool 
DAC960_CreateAuxiliaryStructures(DAC960_Controller_T *Controller)
 {
   CommandAllocationLength = offsetof(DAC960_Command_T, V2.EndMarker);
   CommandAllocationGroupSize = DAC960_V2_CommandAllocationGroupSize;
-  ScatterGatherPool = pci_pool_create("DAC960_V2_ScatterGather",
-   Controller->PCIDevice,
+  ScatterGatherPool = dma_pool_create("DAC960_V2_ScatterGather",
+   >PCIDevice->dev,
DAC960_V2_ScatterGatherLimit * sizeof(DAC960_V2_ScatterGatherSegment_T),
sizeof(DAC960_V2_ScatterGatherSegment_T), 0);
   if (ScatterGatherPool == NULL)
return DAC960_Failure(Controller,
"AUXILIARY STRUCTURE CREATION (SG)");
-  RequestSensePool = pci_pool_create("DAC960_V2_RequestSense",
-   Controller->PCIDevice, sizeof(DAC960_SCSI_RequestSense_T),
+  RequestSensePool = dma_pool_create("DAC960_V2_RequestSense",
+   >PCIDevice->dev, sizeof(DAC960_SCSI_RequestSense_T),
sizeof(int), 0);
   if (RequestSensePool == NULL) {
-   pci_pool_destroy(ScatterGatherPool);
+   dma_pool_destroy(ScatterGatherPool);
return DAC960_Failure(Controller,
"AUXILIARY STRUCTURE CREATION (SG)");
   }
@@ -335,16 +335,16 @@ static bool 
DAC960_CreateAuxiliaryStructures(DAC960_Controller_T *Controller)
   Command->Next = Controller->FreeCommands;
   Controller->FreeCommands = Command;
   Controller->Commands[CommandIdentifier-1] = Command;
-  ScatterGatherCPU = pci_pool_alloc(ScatterGatherPool, GFP_ATOMIC,
+  ScatterGatherCPU = dma_pool_alloc(ScatterGatherPool, GFP_ATOMIC,
);
   if (ScatterGatherCPU == NULL)
  return DAC960_Failure(Controller, "AUXILIARY STRUCTURE CREATION");
 
   if (RequestSensePool != NULL) {
- RequestSenseCPU = pci_pool_alloc(RequestSensePool, GFP_ATOMIC,
+ RequestSenseCPU = dma_pool_alloc(RequestSensePool, GFP_ATOMIC,
);
  if (RequestSenseCPU == NULL) {
-pci_pool_free(ScatterGatherPool, ScatterGatherCPU,
+dma_pool_free(ScatterGatherPool, ScatterGatherCPU,
 ScatterGatherDMA);
return DAC960_Failure(Controller,
"AUXILIARY STRUCTURE CREATION");
@@ -379,8 +379,8 @@ static bool 
DAC960_CreateAuxiliaryStructures(DAC960_Controller_T *Controller)
 static void DAC960_DestroyAuxiliaryStructures(DAC960_Controller_T *Controller)
 {
   int i;
-  struct pci_pool *ScatterGatherPool = Controller->ScatterGatherPool;
-  struct pci_pool *RequestSensePool = NULL;
+  struct dma_pool *ScatterGatherPool = Controller->ScatterGatherPool;
+  struct dma_pool *RequestSensePool = NULL;
   void *ScatterGatherCPU;
   dma_addr_t ScatterGatherDMA;
   void *RequestSenseCPU;
@@ -411,9 +411,9 @@ static void 
DAC960_DestroyAuxiliaryStructures(DAC960_Controller_T *Controller)
  RequestSenseDMA = Command->V2.RequestSenseDMA;
   }
   if (ScatterGatherCPU != NULL)
-  pci_pool_free(ScatterGatherPool, ScatterGatherCPU, ScatterGatherDMA);
+  dma_pool_free(ScatterGatherPool, ScatterGatherCPU, 

[PATCH v9 03/15] IB/mthca: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
Acked-by: Doug Ledford 
Tested-by: Doug Ledford 
---
 drivers/infiniband/hw/mthca/mthca_av.c  | 10 +-
 drivers/infiniband/hw/mthca/mthca_cmd.c |  8 
 drivers/infiniband/hw/mthca/mthca_dev.h |  4 ++--
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_av.c 
b/drivers/infiniband/hw/mthca/mthca_av.c
index 2aec9908c40a..e7f6223e9c60 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -186,7 +186,7 @@ int mthca_create_ah(struct mthca_dev *dev,
 
 on_hca_fail:
if (ah->type == MTHCA_AH_PCI_POOL) {
-   ah->av = pci_pool_zalloc(dev->av_table.pool,
+   ah->av = dma_pool_zalloc(dev->av_table.pool,
 GFP_ATOMIC, >avdma);
if (!ah->av)
return -ENOMEM;
@@ -250,7 +250,7 @@ int mthca_destroy_ah(struct mthca_dev *dev, struct mthca_ah 
*ah)
break;
 
case MTHCA_AH_PCI_POOL:
-   pci_pool_free(dev->av_table.pool, ah->av, ah->avdma);
+   dma_pool_free(dev->av_table.pool, ah->av, ah->avdma);
break;
 
case MTHCA_AH_KMALLOC:
@@ -340,7 +340,7 @@ int mthca_init_av_table(struct mthca_dev *dev)
if (err)
return err;
 
-   dev->av_table.pool = pci_pool_create("mthca_av", dev->pdev,
+   dev->av_table.pool = dma_pool_create("mthca_av", >pdev->dev,
 MTHCA_AV_SIZE,
 MTHCA_AV_SIZE, 0);
if (!dev->av_table.pool)
@@ -360,7 +360,7 @@ int mthca_init_av_table(struct mthca_dev *dev)
return 0;
 
  out_free_pool:
-   pci_pool_destroy(dev->av_table.pool);
+   dma_pool_destroy(dev->av_table.pool);
 
  out_free_alloc:
mthca_alloc_cleanup(>av_table.alloc);
@@ -374,6 +374,6 @@ void mthca_cleanup_av_table(struct mthca_dev *dev)
 
if (dev->av_table.av_map)
iounmap(dev->av_table.av_map);
-   pci_pool_destroy(dev->av_table.pool);
+   dma_pool_destroy(dev->av_table.pool);
mthca_alloc_cleanup(>av_table.alloc);
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c 
b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 9d83a53c0c67..0b03c09e637c 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -538,7 +538,7 @@ int mthca_cmd_init(struct mthca_dev *dev)
return -ENOMEM;
}
 
-   dev->cmd.pool = pci_pool_create("mthca_cmd", dev->pdev,
+   dev->cmd.pool = dma_pool_create("mthca_cmd", >pdev->dev,
MTHCA_MAILBOX_SIZE,
MTHCA_MAILBOX_SIZE, 0);
if (!dev->cmd.pool) {
@@ -551,7 +551,7 @@ int mthca_cmd_init(struct mthca_dev *dev)
 
 void mthca_cmd_cleanup(struct mthca_dev *dev)
 {
-   pci_pool_destroy(dev->cmd.pool);
+   dma_pool_destroy(dev->cmd.pool);
iounmap(dev->hcr);
if (dev->cmd.flags & MTHCA_CMD_POST_DOORBELLS)
iounmap(dev->cmd.dbell_map);
@@ -621,7 +621,7 @@ struct mthca_mailbox *mthca_alloc_mailbox(struct mthca_dev 
*dev,
if (!mailbox)
return ERR_PTR(-ENOMEM);
 
-   mailbox->buf = pci_pool_alloc(dev->cmd.pool, gfp_mask, >dma);
+   mailbox->buf = dma_pool_alloc(dev->cmd.pool, gfp_mask, >dma);
if (!mailbox->buf) {
kfree(mailbox);
return ERR_PTR(-ENOMEM);
@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct 
mthca_mailbox *mailbox)
if (!mailbox)
return;
 
-   pci_pool_free(dev->cmd.pool, mailbox->buf, mailbox->dma);
+   dma_pool_free(dev->cmd.pool, mailbox->buf, mailbox->dma);
kfree(mailbox);
 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h 
b/drivers/infiniband/hw/mthca/mthca_dev.h
index ec7da9a474cd..5508afbf1c67 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -118,7 +118,7 @@ enum {
 };
 
 struct mthca_cmd {
-   struct pci_pool  *pool;
+   struct dma_pool  *pool;
struct mutex  hcr_mutex;
struct semaphore  poll_sem;
struct semaphore  event_sem;
@@ -263,7 +263,7 @@ struct mthca_qp_table {
 };
 
 struct mthca_av_table {
-   struct pci_pool   *pool;
+   struct dma_pool   *pool;
intnum_ddr_avs;
u64ddr_av_base;
void __iomem  *av_map;
-- 
2.11.0

[PATCH v9 04/15] net: e100: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Acked-by: Jeff Kirsher 
Tested-by: Peter Senna Tschudin 
---
 drivers/net/ethernet/intel/e100.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c 
b/drivers/net/ethernet/intel/e100.c
index 2b7323d392dc..d1002c21ce8c 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -607,7 +607,7 @@ struct nic {
struct mem *mem;
dma_addr_t dma_addr;
 
-   struct pci_pool *cbs_pool;
+   struct dma_pool *cbs_pool;
dma_addr_t cbs_dma_addr;
u8 adaptive_ifs;
u8 tx_threshold;
@@ -1892,7 +1892,7 @@ static void e100_clean_cbs(struct nic *nic)
nic->cb_to_clean = nic->cb_to_clean->next;
nic->cbs_avail++;
}
-   pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
+   dma_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
nic->cbs = NULL;
nic->cbs_avail = 0;
}
@@ -1910,7 +1910,7 @@ static int e100_alloc_cbs(struct nic *nic)
nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
nic->cbs_avail = 0;
 
-   nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
+   nic->cbs = dma_pool_alloc(nic->cbs_pool, GFP_KERNEL,
  >cbs_dma_addr);
if (!nic->cbs)
return -ENOMEM;
@@ -2958,8 +2958,8 @@ static int e100_probe(struct pci_dev *pdev, const struct 
pci_device_id *ent)
netif_err(nic, probe, nic->netdev, "Cannot register net device, 
aborting\n");
goto err_out_free;
}
-   nic->cbs_pool = pci_pool_create(netdev->name,
-  nic->pdev,
+   nic->cbs_pool = dma_pool_create(netdev->name,
+  >pdev->dev,
   nic->params.cbs.max * sizeof(struct cb),
   sizeof(u32),
   0);
@@ -2999,7 +2999,7 @@ static void e100_remove(struct pci_dev *pdev)
unregister_netdev(netdev);
e100_free(nic);
pci_iounmap(pdev, nic->csr);
-   pci_pool_destroy(nic->cbs_pool);
+   dma_pool_destroy(nic->cbs_pool);
free_netdev(netdev);
pci_release_regions(pdev);
pci_disable_device(pdev);
-- 
2.11.0

[PATCH v9 09/15] scsi: csiostor: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API. It also updates
the name of some variables and the content of comments, accordingly.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 drivers/scsi/csiostor/csio_hw.h   |  2 +-
 drivers/scsi/csiostor/csio_init.c | 11 ++-
 drivers/scsi/csiostor/csio_scsi.c |  6 +++---
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/scsi/csiostor/csio_hw.h b/drivers/scsi/csiostor/csio_hw.h
index 62758e830d3b..61c09daabb20 100644
--- a/drivers/scsi/csiostor/csio_hw.h
+++ b/drivers/scsi/csiostor/csio_hw.h
@@ -464,7 +464,7 @@ struct csio_hw {
struct csio_pport   pport[CSIO_MAX_PPORTS]; /* Ports (XGMACs) */
struct csio_hw_params   params; /* Hw parameters */
 
-   struct pci_pool *scsi_pci_pool; /* PCI pool for SCSI */
+   struct dma_pool *scsi_dma_pool; /* DMA pool for SCSI */
mempool_t   *mb_mempool;/* Mailbox memory pool*/
mempool_t   *rnode_mempool; /* rnode memory pool */
 
diff --git a/drivers/scsi/csiostor/csio_init.c 
b/drivers/scsi/csiostor/csio_init.c
index ea0c31086cc6..d5fb016b5fc2 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -485,9 +485,10 @@ csio_resource_alloc(struct csio_hw *hw)
if (!hw->rnode_mempool)
goto err_free_mb_mempool;
 
-   hw->scsi_pci_pool = pci_pool_create("csio_scsi_pci_pool", hw->pdev,
-   CSIO_SCSI_RSP_LEN, 8, 0);
-   if (!hw->scsi_pci_pool)
+   hw->scsi_dma_pool = dma_pool_create("csio_scsi_dma_pool",
+   >pdev->dev, CSIO_SCSI_RSP_LEN,
+   8, 0);
+   if (!hw->scsi_dma_pool)
goto err_free_rn_pool;
 
return 0;
@@ -505,8 +506,8 @@ csio_resource_alloc(struct csio_hw *hw)
 static void
 csio_resource_free(struct csio_hw *hw)
 {
-   pci_pool_destroy(hw->scsi_pci_pool);
-   hw->scsi_pci_pool = NULL;
+   dma_pool_destroy(hw->scsi_dma_pool);
+   hw->scsi_dma_pool = NULL;
mempool_destroy(hw->rnode_mempool);
hw->rnode_mempool = NULL;
mempool_destroy(hw->mb_mempool);
diff --git a/drivers/scsi/csiostor/csio_scsi.c 
b/drivers/scsi/csiostor/csio_scsi.c
index a1ff75f1384f..dab0d3f9bee1 100644
--- a/drivers/scsi/csiostor/csio_scsi.c
+++ b/drivers/scsi/csiostor/csio_scsi.c
@@ -2445,7 +2445,7 @@ csio_scsim_init(struct csio_scsim *scm, struct csio_hw 
*hw)
 
/* Allocate Dma buffers for Response Payload */
dma_buf = >dma_buf;
-   dma_buf->vaddr = pci_pool_alloc(hw->scsi_pci_pool, GFP_KERNEL,
+   dma_buf->vaddr = dma_pool_alloc(hw->scsi_dma_pool, GFP_KERNEL,
_buf->paddr);
if (!dma_buf->vaddr) {
csio_err(hw,
@@ -2485,7 +2485,7 @@ csio_scsim_init(struct csio_scsim *scm, struct csio_hw 
*hw)
ioreq = (struct csio_ioreq *)tmp;
 
dma_buf = >dma_buf;
-   pci_pool_free(hw->scsi_pci_pool, dma_buf->vaddr,
+   dma_pool_free(hw->scsi_dma_pool, dma_buf->vaddr,
  dma_buf->paddr);
 
kfree(ioreq);
@@ -2516,7 +2516,7 @@ csio_scsim_exit(struct csio_scsim *scm)
ioreq = (struct csio_ioreq *)tmp;
 
dma_buf = >dma_buf;
-   pci_pool_free(scm->hw->scsi_pci_pool, dma_buf->vaddr,
+   dma_pool_free(scm->hw->scsi_dma_pool, dma_buf->vaddr,
  dma_buf->paddr);
 
kfree(ioreq);
-- 
2.11.0

[PATCH v9 07/15] wireless: ipw2200: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 drivers/net/wireless/intel/ipw2x00/ipw2200.c | 13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c 
b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index bbc579b647b6..0ca2e0464477 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -3211,7 +3211,7 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * 
data, size_t len)
struct fw_chunk *chunk;
int total_nr = 0;
int i;
-   struct pci_pool *pool;
+   struct dma_pool *pool;
void **virts;
dma_addr_t *phys;
 
@@ -3228,9 +3228,10 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * 
data, size_t len)
kfree(virts);
return -ENOMEM;
}
-   pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+   pool = dma_pool_create("ipw2200", >pci_dev->dev, CB_MAX_LENGTH, 0,
+  0);
if (!pool) {
-   IPW_ERROR("pci_pool_create failed\n");
+   IPW_ERROR("dma_pool_create failed\n");
kfree(phys);
kfree(virts);
return -ENOMEM;
@@ -3255,7 +3256,7 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * 
data, size_t len)
 
nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
for (i = 0; i < nr; i++) {
-   virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+   virts[total_nr] = dma_pool_alloc(pool, GFP_KERNEL,
 [total_nr]);
if (!virts[total_nr]) {
ret = -ENOMEM;
@@ -3299,9 +3300,9 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * 
data, size_t len)
}
  out:
for (i = 0; i < total_nr; i++)
-   pci_pool_free(pool, virts[i], phys[i]);
+   dma_pool_free(pool, virts[i], phys[i]);
 
-   pci_pool_destroy(pool);
+   dma_pool_destroy(pool);
kfree(phys);
kfree(virts);
 
-- 
2.11.0

[PATCH v9 08/15] scsi: be2iscsi: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
---
 drivers/scsi/be2iscsi/be_iscsi.c | 6 +++---
 drivers/scsi/be2iscsi/be_main.c  | 6 +++---
 drivers/scsi/be2iscsi/be_main.h  | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
index 97dca4681784..43a80ce5ce6a 100644
--- a/drivers/scsi/be2iscsi/be_iscsi.c
+++ b/drivers/scsi/be2iscsi/be_iscsi.c
@@ -82,8 +82,8 @@ struct iscsi_cls_session *beiscsi_session_create(struct 
iscsi_endpoint *ep,
return NULL;
sess = cls_session->dd_data;
beiscsi_sess = sess->dd_data;
-   beiscsi_sess->bhs_pool =  pci_pool_create("beiscsi_bhs_pool",
-  phba->pcidev,
+   beiscsi_sess->bhs_pool =  dma_pool_create("beiscsi_bhs_pool",
+  >pcidev->dev,
   sizeof(struct be_cmd_bhs),
   64, 0);
if (!beiscsi_sess->bhs_pool)
@@ -108,7 +108,7 @@ void beiscsi_session_destroy(struct iscsi_cls_session 
*cls_session)
struct beiscsi_session *beiscsi_sess = sess->dd_data;
 
printk(KERN_INFO "In beiscsi_session_destroy\n");
-   pci_pool_destroy(beiscsi_sess->bhs_pool);
+   dma_pool_destroy(beiscsi_sess->bhs_pool);
iscsi_session_teardown(cls_session);
 }
 
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index f862332261f8..b4542e7e2ad5 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -4257,7 +4257,7 @@ static void beiscsi_cleanup_task(struct iscsi_task *task)
pwrb_context = _ctrlr->wrb_context[cri_index];
 
if (io_task->cmd_bhs) {
-   pci_pool_free(beiscsi_sess->bhs_pool, io_task->cmd_bhs,
+   dma_pool_free(beiscsi_sess->bhs_pool, io_task->cmd_bhs,
  io_task->bhs_pa.u.a64.address);
io_task->cmd_bhs = NULL;
task->hdr = NULL;
@@ -4374,7 +4374,7 @@ static int beiscsi_alloc_pdu(struct iscsi_task *task, 
uint8_t opcode)
struct beiscsi_session *beiscsi_sess = beiscsi_conn->beiscsi_sess;
dma_addr_t paddr;
 
-   io_task->cmd_bhs = pci_pool_alloc(beiscsi_sess->bhs_pool,
+   io_task->cmd_bhs = dma_pool_alloc(beiscsi_sess->bhs_pool,
  GFP_ATOMIC, );
if (!io_task->cmd_bhs)
return -ENOMEM;
@@ -4501,7 +4501,7 @@ static int beiscsi_alloc_pdu(struct iscsi_task *task, 
uint8_t opcode)
if (io_task->pwrb_handle)
free_wrb_handle(phba, pwrb_context, io_task->pwrb_handle);
io_task->pwrb_handle = NULL;
-   pci_pool_free(beiscsi_sess->bhs_pool, io_task->cmd_bhs,
+   dma_pool_free(beiscsi_sess->bhs_pool, io_task->cmd_bhs,
  io_task->bhs_pa.u.a64.address);
io_task->cmd_bhs = NULL;
return -ENOMEM;
diff --git a/drivers/scsi/be2iscsi/be_main.h b/drivers/scsi/be2iscsi/be_main.h
index 338dbe0800c1..81ce3ffda968 100644
--- a/drivers/scsi/be2iscsi/be_main.h
+++ b/drivers/scsi/be2iscsi/be_main.h
@@ -438,7 +438,7 @@ struct beiscsi_hba {
 test_bit(BEISCSI_HBA_ONLINE, >state))
 
 struct beiscsi_session {
-   struct pci_pool *bhs_pool;
+   struct dma_pool *bhs_pool;
 };
 
 /**
-- 
2.11.0

[PATCH v9 11/15] scsi: megaraid: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
Acked-by: Sumit Saxena 
---
 drivers/scsi/megaraid/megaraid_mbox.c   | 33 +++
 drivers/scsi/megaraid/megaraid_mm.c | 32 +++---
 drivers/scsi/megaraid/megaraid_sas_base.c   | 29 +++--
 drivers/scsi/megaraid/megaraid_sas_fusion.c | 66 +
 4 files changed, 77 insertions(+), 83 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_mbox.c 
b/drivers/scsi/megaraid/megaraid_mbox.c
index f0987f22ea70..7dfc2e29edcc 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -1153,8 +1153,8 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 
 
// Allocate memory for 16-bytes aligned mailboxes
-   raid_dev->mbox_pool_handle = pci_pool_create("megaraid mbox pool",
-   adapter->pdev,
+   raid_dev->mbox_pool_handle = dma_pool_create("megaraid mbox pool",
+   >pdev->dev,
sizeof(mbox64_t) + 16,
16, 0);
 
@@ -1164,7 +1164,7 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 
mbox_pci_blk = raid_dev->mbox_pool;
for (i = 0; i < MBOX_MAX_SCSI_CMDS; i++) {
-   mbox_pci_blk[i].vaddr = pci_pool_alloc(
+   mbox_pci_blk[i].vaddr = dma_pool_alloc(
raid_dev->mbox_pool_handle,
GFP_KERNEL,
_pci_blk[i].dma_addr);
@@ -1181,8 +1181,8 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 * share common memory pool. Passthru structures piggyback on memory
 * allocted to extended passthru since passthru is smaller of the two
 */
-   raid_dev->epthru_pool_handle = pci_pool_create("megaraid mbox pthru",
-   adapter->pdev, sizeof(mraid_epassthru_t), 128, 0);
+   raid_dev->epthru_pool_handle = dma_pool_create("megaraid mbox pthru",
+   >pdev->dev, sizeof(mraid_epassthru_t), 128, 0);
 
if (raid_dev->epthru_pool_handle == NULL) {
goto fail_setup_dma_pool;
@@ -1190,7 +1190,7 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 
epthru_pci_blk = raid_dev->epthru_pool;
for (i = 0; i < MBOX_MAX_SCSI_CMDS; i++) {
-   epthru_pci_blk[i].vaddr = pci_pool_alloc(
+   epthru_pci_blk[i].vaddr = dma_pool_alloc(
raid_dev->epthru_pool_handle,
GFP_KERNEL,
_pci_blk[i].dma_addr);
@@ -1202,8 +1202,8 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 
// Allocate memory for each scatter-gather list. Request for 512 bytes
// alignment for each sg list
-   raid_dev->sg_pool_handle = pci_pool_create("megaraid mbox sg",
-   adapter->pdev,
+   raid_dev->sg_pool_handle = dma_pool_create("megaraid mbox sg",
+   >pdev->dev,
sizeof(mbox_sgl64) * MBOX_MAX_SG_SIZE,
512, 0);
 
@@ -1213,7 +1213,7 @@ megaraid_mbox_setup_dma_pools(adapter_t *adapter)
 
sg_pci_blk = raid_dev->sg_pool;
for (i = 0; i < MBOX_MAX_SCSI_CMDS; i++) {
-   sg_pci_blk[i].vaddr = pci_pool_alloc(
+   sg_pci_blk[i].vaddr = dma_pool_alloc(
raid_dev->sg_pool_handle,
GFP_KERNEL,
_pci_blk[i].dma_addr);
@@ -1249,29 +1249,26 @@ megaraid_mbox_teardown_dma_pools(adapter_t *adapter)
 
sg_pci_blk = raid_dev->sg_pool;
for (i = 0; i < MBOX_MAX_SCSI_CMDS && sg_pci_blk[i].vaddr; i++) {
-   pci_pool_free(raid_dev->sg_pool_handle, sg_pci_blk[i].vaddr,
+   dma_pool_free(raid_dev->sg_pool_handle, sg_pci_blk[i].vaddr,
sg_pci_blk[i].dma_addr);
}
-   if (raid_dev->sg_pool_handle)
-   pci_pool_destroy(raid_dev->sg_pool_handle);
+   dma_pool_destroy(raid_dev->sg_pool_handle);
 
 
epthru_pci_blk = raid_dev->epthru_pool;
for (i = 0; i < MBOX_MAX_SCSI_CMDS && epthru_pci_blk[i].vaddr; i++) {
-   pci_pool_free(raid_dev->epthru_pool_handle,
+   dma_pool_free(raid_dev->epthru_pool_handle,
epthru_pci_blk[i].vaddr, epthru_pci_blk[i].dma_addr);
}
-   if (raid_dev->epthru_pool_handle)
-

[PATCH v9 06/15] mlx5: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
Acked-by: Doug Ledford 
Tested-by: Doug Ledford 
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 11 ++-
 include/linux/mlx5/driver.h   |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c 
b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5bdaf3d545b2..aae7d9207ff3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1069,7 +1069,7 @@ static struct mlx5_cmd_mailbox *alloc_cmd_box(struct 
mlx5_core_dev *dev,
if (!mailbox)
return ERR_PTR(-ENOMEM);
 
-   mailbox->buf = pci_pool_zalloc(dev->cmd.pool, flags,
+   mailbox->buf = dma_pool_zalloc(dev->cmd.pool, flags,
   >dma);
if (!mailbox->buf) {
mlx5_core_dbg(dev, "failed allocation\n");
@@ -1084,7 +1084,7 @@ static struct mlx5_cmd_mailbox *alloc_cmd_box(struct 
mlx5_core_dev *dev,
 static void free_cmd_box(struct mlx5_core_dev *dev,
 struct mlx5_cmd_mailbox *mailbox)
 {
-   pci_pool_free(dev->cmd.pool, mailbox->buf, mailbox->dma);
+   dma_pool_free(dev->cmd.pool, mailbox->buf, mailbox->dma);
kfree(mailbox);
 }
 
@@ -1704,7 +1704,8 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
return -EINVAL;
}
 
-   cmd->pool = pci_pool_create("mlx5_cmd", dev->pdev, size, align, 0);
+   cmd->pool = dma_pool_create("mlx5_cmd", >pdev->dev, size, align,
+   0);
if (!cmd->pool)
return -ENOMEM;
 
@@ -1794,7 +1795,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
free_cmd_page(dev, cmd);
 
 err_free_pool:
-   pci_pool_destroy(cmd->pool);
+   dma_pool_destroy(cmd->pool);
 
return err;
 }
@@ -1808,6 +1809,6 @@ void mlx5_cmd_cleanup(struct mlx5_core_dev *dev)
destroy_workqueue(cmd->wq);
destroy_msg_cache(dev);
free_cmd_page(dev, cmd);
-   pci_pool_destroy(cmd->pool);
+   dma_pool_destroy(cmd->pool);
 }
 EXPORT_SYMBOL(mlx5_cmd_cleanup);
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index bcdf739ee41a..6b35111a74a1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -284,7 +284,7 @@ struct mlx5_cmd {
struct semaphore pages_sem;
int mode;
struct mlx5_cmd_work_ent *ent_arr[MLX5_MAX_COMMANDS];
-   struct pci_pool *pool;
+   struct dma_pool *pool;
struct mlx5_cmd_debug dbg;
struct cmd_msg_cache cache[MLX5_NUM_COMMAND_CACHES];
int checksum_disabled;
-- 
2.11.0

[PATCH v9 10/15] scsi: lpfc: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API. It also updates
some comments, accordingly.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 drivers/scsi/lpfc/lpfc.h   | 16 
 drivers/scsi/lpfc/lpfc_init.c  | 16 
 drivers/scsi/lpfc/lpfc_mem.c   | 90 +-
 drivers/scsi/lpfc/lpfc_nvme.c  |  6 +--
 drivers/scsi/lpfc/lpfc_nvmet.c |  4 +-
 drivers/scsi/lpfc/lpfc_scsi.c  | 12 +++---
 drivers/scsi/lpfc/lpfc_sli.c   |  6 +--
 7 files changed, 75 insertions(+), 75 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index f2c0ba6ced78..0c98f3feafa5 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -944,14 +944,14 @@ struct lpfc_hba {
struct list_head active_rrq_list;
spinlock_t hbalock;
 
-   /* pci_mem_pools */
-   struct pci_pool *lpfc_sg_dma_buf_pool;
-   struct pci_pool *lpfc_mbuf_pool;
-   struct pci_pool *lpfc_hrb_pool; /* header receive buffer pool */
-   struct pci_pool *lpfc_drb_pool; /* data receive buffer pool */
-   struct pci_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
-   struct pci_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
-   struct pci_pool *txrdy_payload_pool;
+   /* dma_mem_pools */
+   struct dma_pool *lpfc_sg_dma_buf_pool;
+   struct dma_pool *lpfc_mbuf_pool;
+   struct dma_pool *lpfc_hrb_pool; /* header receive buffer pool */
+   struct dma_pool *lpfc_drb_pool; /* data receive buffer pool */
+   struct dma_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
+   struct dma_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
+   struct dma_pool *txrdy_payload_pool;
struct lpfc_dma_pool lpfc_mbuf_safety_pool;
 
mempool_t *mbox_mem_pool;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 9add9473cae5..728d010ec2cc 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3184,7 +3184,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
list_for_each_entry_safe(sb, sb_next, >lpfc_scsi_buf_list_put,
 list) {
list_del(>list);
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool, sb->data,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool, sb->data,
  sb->dma_handle);
kfree(sb);
phba->total_scsi_bufs--;
@@ -3195,7 +3195,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
list_for_each_entry_safe(sb, sb_next, >lpfc_scsi_buf_list_get,
 list) {
list_del(>list);
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool, sb->data,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool, sb->data,
  sb->dma_handle);
kfree(sb);
phba->total_scsi_bufs--;
@@ -3226,7 +3226,7 @@ lpfc_nvme_free(struct lpfc_hba *phba)
list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
 >lpfc_nvme_buf_list_put, list) {
list_del(_ncmd->list);
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool, lpfc_ncmd->data,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool, lpfc_ncmd->data,
  lpfc_ncmd->dma_handle);
kfree(lpfc_ncmd);
phba->total_nvme_bufs--;
@@ -3237,7 +3237,7 @@ lpfc_nvme_free(struct lpfc_hba *phba)
list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
 >lpfc_nvme_buf_list_get, list) {
list_del(_ncmd->list);
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool, lpfc_ncmd->data,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool, lpfc_ncmd->data,
  lpfc_ncmd->dma_handle);
kfree(lpfc_ncmd);
phba->total_nvme_bufs--;
@@ -3550,7 +3550,7 @@ lpfc_sli4_scsi_sgl_update(struct lpfc_hba *phba)
list_remove_head(_sgl_list, psb,
 struct lpfc_scsi_buf, list);
if (psb) {
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool,
  psb->data, psb->dma_handle);
kfree(psb);
}
@@ -3692,7 +3692,7 @@ lpfc_sli4_nvme_sgl_update(struct lpfc_hba *phba)
list_remove_head(_sgl_list, lpfc_ncmd,
 struct lpfc_nvme_buf, list);
if (lpfc_ncmd) {
-   pci_pool_free(phba->lpfc_sg_dma_buf_pool,
+   dma_pool_free(phba->lpfc_sg_dma_buf_pool,
  

[PATCH v9 14/15] scsi: pmcraid: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
---
 drivers/scsi/pmcraid.c | 10 +-
 drivers/scsi/pmcraid.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 1cc814f1505a..1f8b1533d0c4 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -4655,13 +4655,13 @@ pmcraid_release_control_blocks(
return;
 
for (i = 0; i < max_index; i++) {
-   pci_pool_free(pinstance->control_pool,
+   dma_pool_free(pinstance->control_pool,
  pinstance->cmd_list[i]->ioa_cb,
  pinstance->cmd_list[i]->ioa_cb_bus_addr);
pinstance->cmd_list[i]->ioa_cb = NULL;
pinstance->cmd_list[i]->ioa_cb_bus_addr = 0;
}
-   pci_pool_destroy(pinstance->control_pool);
+   dma_pool_destroy(pinstance->control_pool);
pinstance->control_pool = NULL;
 }
 
@@ -4718,8 +4718,8 @@ static int pmcraid_allocate_control_blocks(struct 
pmcraid_instance *pinstance)
pinstance->host->unique_id);
 
pinstance->control_pool =
-   pci_pool_create(pinstance->ctl_pool_name,
-   pinstance->pdev,
+   dma_pool_create(pinstance->ctl_pool_name,
+   >pdev->dev,
sizeof(struct pmcraid_control_block),
PMCRAID_IOARCB_ALIGNMENT, 0);
 
@@ -4728,7 +4728,7 @@ static int pmcraid_allocate_control_blocks(struct 
pmcraid_instance *pinstance)
 
for (i = 0; i < PMCRAID_MAX_CMD; i++) {
pinstance->cmd_list[i]->ioa_cb =
-   pci_pool_alloc(
+   dma_pool_alloc(
pinstance->control_pool,
GFP_KERNEL,
&(pinstance->cmd_list[i]->ioa_cb_bus_addr));
diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
index 01eb2bc16dc1..8bfac72a242b 100644
--- a/drivers/scsi/pmcraid.h
+++ b/drivers/scsi/pmcraid.h
@@ -755,7 +755,7 @@ struct pmcraid_instance {
 
/* structures related to command blocks */
struct kmem_cache *cmd_cachep;  /* cache for cmd blocks */
-   struct pci_pool *control_pool;  /* pool for control blocks */
+   struct dma_pool *control_pool;  /* pool for control blocks */
char   cmd_pool_name[64];   /* name of cmd cache */
char   ctl_pool_name[64];   /* name of control cache */
 
-- 
2.11.0

[PATCH v9 13/15] scsi: mvsas: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 drivers/scsi/mvsas/mv_init.c | 6 +++---
 drivers/scsi/mvsas/mv_sas.c  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
index 4e047b5001a6..1d53410334cc 100644
--- a/drivers/scsi/mvsas/mv_init.c
+++ b/drivers/scsi/mvsas/mv_init.c
@@ -125,8 +125,7 @@ static void mvs_free(struct mvs_info *mvi)
else
slot_nr = MVS_CHIP_SLOT_SZ;
 
-   if (mvi->dma_pool)
-   pci_pool_destroy(mvi->dma_pool);
+   dma_pool_destroy(mvi->dma_pool);
 
if (mvi->tx)
dma_free_coherent(mvi->dev,
@@ -296,7 +295,8 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host 
*shost)
goto err_out;
 
sprintf(pool_name, "%s%d", "mvs_dma_pool", mvi->id);
-   mvi->dma_pool = pci_pool_create(pool_name, mvi->pdev, MVS_SLOT_BUF_SZ, 
16, 0);
+   mvi->dma_pool = dma_pool_create(pool_name, >pdev->dev,
+   MVS_SLOT_BUF_SZ, 16, 0);
if (!mvi->dma_pool) {
printk(KERN_DEBUG "failed to create dma pool %s.\n", 
pool_name);
goto err_out;
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index c7cc8035eacb..ee81d10252e0 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -790,7 +790,7 @@ static int mvs_task_prep(struct sas_task *task, struct 
mvs_info *mvi, int is_tmf
slot->n_elem = n_elem;
slot->slot_tag = tag;
 
-   slot->buf = pci_pool_alloc(mvi->dma_pool, GFP_ATOMIC, >buf_dma);
+   slot->buf = dma_pool_alloc(mvi->dma_pool, GFP_ATOMIC, >buf_dma);
if (!slot->buf) {
rc = -ENOMEM;
goto err_out_tag;
@@ -840,7 +840,7 @@ static int mvs_task_prep(struct sas_task *task, struct 
mvs_info *mvi, int is_tmf
return rc;
 
 err_out_slot_buf:
-   pci_pool_free(mvi->dma_pool, slot->buf, slot->buf_dma);
+   dma_pool_free(mvi->dma_pool, slot->buf, slot->buf_dma);
 err_out_tag:
mvs_tag_free(mvi, tag);
 err_out:
@@ -918,7 +918,7 @@ static void mvs_slot_task_free(struct mvs_info *mvi, struct 
sas_task *task,
}
 
if (slot->buf) {
-   pci_pool_free(mvi->dma_pool, slot->buf, slot->buf_dma);
+   dma_pool_free(mvi->dma_pool, slot->buf, slot->buf_dma);
slot->buf = NULL;
}
list_del_init(>entry);
-- 
2.11.0

[PATCH v9 12/15] scsi: mpt3sas: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 73 +
 1 file changed, 34 insertions(+), 39 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c 
b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 18039bba26c4..1a5b6e40fb5c 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3198,9 +3198,8 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
 
if (ioc->sense) {
-   pci_pool_free(ioc->sense_dma_pool, ioc->sense, ioc->sense_dma);
-   if (ioc->sense_dma_pool)
-   pci_pool_destroy(ioc->sense_dma_pool);
+   dma_pool_free(ioc->sense_dma_pool, ioc->sense, ioc->sense_dma);
+   dma_pool_destroy(ioc->sense_dma_pool);
dexitprintk(ioc, pr_info(MPT3SAS_FMT
"sense_pool(0x%p): free\n",
ioc->name, ioc->sense));
@@ -3208,9 +3207,8 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
 
if (ioc->reply) {
-   pci_pool_free(ioc->reply_dma_pool, ioc->reply, ioc->reply_dma);
-   if (ioc->reply_dma_pool)
-   pci_pool_destroy(ioc->reply_dma_pool);
+   dma_pool_free(ioc->reply_dma_pool, ioc->reply, ioc->reply_dma);
+   dma_pool_destroy(ioc->reply_dma_pool);
dexitprintk(ioc, pr_info(MPT3SAS_FMT
"reply_pool(0x%p): free\n",
ioc->name, ioc->reply));
@@ -3218,10 +3216,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
 
if (ioc->reply_free) {
-   pci_pool_free(ioc->reply_free_dma_pool, ioc->reply_free,
+   dma_pool_free(ioc->reply_free_dma_pool, ioc->reply_free,
ioc->reply_free_dma);
-   if (ioc->reply_free_dma_pool)
-   pci_pool_destroy(ioc->reply_free_dma_pool);
+   dma_pool_destroy(ioc->reply_free_dma_pool);
dexitprintk(ioc, pr_info(MPT3SAS_FMT
"reply_free_pool(0x%p): free\n",
ioc->name, ioc->reply_free));
@@ -3232,7 +3229,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
do {
rps = >reply_post[i];
if (rps->reply_post_free) {
-   pci_pool_free(
+   dma_pool_free(
ioc->reply_post_free_dma_pool,
rps->reply_post_free,
rps->reply_post_free_dma);
@@ -3244,8 +3241,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
} while (ioc->rdpq_array_enable &&
   (++i < ioc->reply_queue_count));
 
-   if (ioc->reply_post_free_dma_pool)
-   pci_pool_destroy(ioc->reply_post_free_dma_pool);
+   dma_pool_destroy(ioc->reply_post_free_dma_pool);
kfree(ioc->reply_post);
}
 
@@ -3266,12 +3262,11 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
if (ioc->chain_lookup) {
for (i = 0; i < ioc->chain_depth; i++) {
if (ioc->chain_lookup[i].chain_buffer)
-   pci_pool_free(ioc->chain_dma_pool,
+   dma_pool_free(ioc->chain_dma_pool,
ioc->chain_lookup[i].chain_buffer,
ioc->chain_lookup[i].chain_buffer_dma);
}
-   if (ioc->chain_dma_pool)
-   pci_pool_destroy(ioc->chain_dma_pool);
+   dma_pool_destroy(ioc->chain_dma_pool);
free_pages((ulong)ioc->chain_lookup, ioc->chain_pages);
ioc->chain_lookup = NULL;
}
@@ -3446,23 +3441,23 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc)
ioc->name);
goto out;
}
-   ioc->reply_post_free_dma_pool = pci_pool_create("reply_post_free pool",
-   ioc->pdev, sz, 16, 0);
+   ioc->reply_post_free_dma_pool = dma_pool_create("reply_post_free pool",
+   >pdev->dev, sz, 16, 0);
if (!ioc->reply_post_free_dma_pool) {
pr_err(MPT3SAS_FMT
-"reply_post_free pool: pci_pool_create failed\n",
+"reply_post_free pool: dma_pool_create failed\n",
 ioc->name);
goto out;
}
i = 0;
do {
ioc->reply_post[i].reply_post_free =
-   pci_pool_alloc(ioc->reply_post_free_dma_pool,
+   

[PATCH v9 15/15] PCI: Remove PCI pool macro functions

[Romain Perier]

Now that all the drivers use dma pool API, we can remove the macro
functions for PCI pool.

Signed-off-by: Romain Perier 
Reviewed-by: Peter Senna Tschudin 
---
 include/linux/pci.h | 9 -
 1 file changed, 9 deletions(-)

diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5026f2ae86db..413511feba61 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1281,15 +1281,6 @@ int pci_set_vga_state(struct pci_dev *pdev, bool decode,
 #include 
 #include 
 
-#definepci_pool dma_pool
-#define pci_pool_create(name, pdev, size, align, allocation) \
-   dma_pool_create(name, >dev, size, align, allocation)
-#definepci_pool_destroy(pool) dma_pool_destroy(pool)
-#definepci_pool_alloc(pool, flags, handle) dma_pool_alloc(pool, flags, 
handle)
-#definepci_pool_zalloc(pool, flags, handle) \
-   dma_pool_zalloc(pool, flags, handle)
-#definepci_pool_free(pool, vaddr, addr) dma_pool_free(pool, vaddr, 
addr)
-
 struct msix_entry {
u32 vector; /* kernel uses to write allocated vector */
u16 entry;  /* driver uses to specify entry, OS writes */
-- 
2.11.0

[PATCH v9 05/15] mlx4: Replace PCI pool old API

[Romain Perier]

The PCI pool API is deprecated. This commit replaces the PCI pool old
API by the appropriate function with the DMA pool API.

Signed-off-by: Romain Perier 
Acked-by: Peter Senna Tschudin 
Tested-by: Peter Senna Tschudin 
Reviewed-by: Leon Romanovsky 
Acked-by: Doug Ledford 
Tested-by: Doug Ledford 
---
 drivers/net/ethernet/mellanox/mlx4/cmd.c  | 10 +-
 drivers/net/ethernet/mellanox/mlx4/mlx4.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c 
b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index c1af47e45d3f..2a8cc5d8f8b6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2535,8 +2535,8 @@ int mlx4_cmd_init(struct mlx4_dev *dev)
}
 
if (!priv->cmd.pool) {
-   priv->cmd.pool = pci_pool_create("mlx4_cmd",
-dev->persist->pdev,
+   priv->cmd.pool = dma_pool_create("mlx4_cmd",
+>persist->pdev->dev,
 MLX4_MAILBOX_SIZE,
 MLX4_MAILBOX_SIZE, 0);
if (!priv->cmd.pool)
@@ -2607,7 +2607,7 @@ void mlx4_cmd_cleanup(struct mlx4_dev *dev, int 
cleanup_mask)
struct mlx4_priv *priv = mlx4_priv(dev);
 
if (priv->cmd.pool && (cleanup_mask & MLX4_CMD_CLEANUP_POOL)) {
-   pci_pool_destroy(priv->cmd.pool);
+   dma_pool_destroy(priv->cmd.pool);
priv->cmd.pool = NULL;
}
 
@@ -2699,7 +2699,7 @@ struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct 
mlx4_dev *dev)
if (!mailbox)
return ERR_PTR(-ENOMEM);
 
-   mailbox->buf = pci_pool_zalloc(mlx4_priv(dev)->cmd.pool, GFP_KERNEL,
+   mailbox->buf = dma_pool_zalloc(mlx4_priv(dev)->cmd.pool, GFP_KERNEL,
   >dma);
if (!mailbox->buf) {
kfree(mailbox);
@@ -2716,7 +2716,7 @@ void mlx4_free_cmd_mailbox(struct mlx4_dev *dev,
if (!mailbox)
return;
 
-   pci_pool_free(mlx4_priv(dev)->cmd.pool, mailbox->buf, mailbox->dma);
+   dma_pool_free(mlx4_priv(dev)->cmd.pool, mailbox->buf, mailbox->dma);
kfree(mailbox);
 }
 EXPORT_SYMBOL_GPL(mlx4_free_cmd_mailbox);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h 
b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index b4f1bc56cc68..69c8764734cb 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -628,7 +628,7 @@ struct mlx4_mgm {
 };
 
 struct mlx4_cmd {
-   struct pci_pool*pool;
+   struct dma_pool*pool;
void __iomem   *hcr;
struct mutexslave_cmd_mutex;
struct semaphorepoll_sem;
-- 
2.11.0

[PATCH] scsi: cxgbi: add null check before pointer dereference

[Gustavo A. R. Silva]

Add null check before dereferencing pointer _sg_ inside sg_next()

Addresses-Coverity-ID: 1364845
Signed-off-by: Gustavo A. R. Silva 
---
 drivers/scsi/cxgbi/libcxgbi.c | 19 +++
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index bd7d39e..6119ddf 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -1256,15 +1256,18 @@ void cxgbi_ddp_set_one_ppod(struct cxgbi_pagepod *ppod,
*sg_off = offset;
}
 
-   if (offset == len) {
-   offset = 0;
-   sg = sg_next(sg);
-   if (sg) {
-   addr = sg_dma_address(sg);
-   len = sg_dma_len(sg);
+   if (sg) {
+   if (offset == len) {
+   offset = 0;
+   sg = sg_next(sg);
+   if (sg) {
+   addr = sg_dma_address(sg);
+   len = sg_dma_len(sg);
+   }
}
-   }
-   ppod->addr[i] = sg ? cpu_to_be64(addr + offset) : 0ULL;
+   ppod->addr[i] = cpu_to_be64(addr + offset);
+   } else
+   ppod->addr[i] = 0ULL;
 }
 EXPORT_SYMBOL_GPL(cxgbi_ddp_set_one_ppod);
 
-- 
2.5.0

Re: [PATCH] csiostor: Avoid content leaks and casts

[Kees Cook]

On Mon, May 22, 2017 at 8:05 AM, Varun Prakash  wrote:
> On Tue, May 09, 2017 at 03:34:44PM -0700, Kees Cook wrote:
>> When copying attributes, the len argument was padded out and the resulting
>> memcpy() would copy beyond the end of the source buffer.  Avoid this,
>> and use size_t for val_len to avoid all the casts. Similarly, avoid source
>> buffer casts and use void *.
>>
>> Additionally enforces val_len can be represented by u16 and that
>> the DMA buffer was not overflowed. Fixes the size of mfa, which is not
>> FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN (but it will be padded up to 4). This
>> was noticed by the future CONFIG_FORTIFY_SOURCE checks.
>>
>> Cc: Daniel Micay 
>> Signed-off-by: Kees Cook 
>> ---
>>  drivers/scsi/csiostor/csio_lnode.c | 43 
>> +++---
>>  1 file changed, 26 insertions(+), 17 deletions(-)
>>
>> diff --git a/drivers/scsi/csiostor/csio_lnode.c 
>> b/drivers/scsi/csiostor/csio_lnode.c
>> index c00b2ff72b55..be5ee2d37815 100644
>> --- a/drivers/scsi/csiostor/csio_lnode.c
>> +++ b/drivers/scsi/csiostor/csio_lnode.c
>> @@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len)
>>  }
>>
>
>
>>
>>   csio_append_attrib(, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD,
>> -(uint8_t *),
>> -FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
>> +, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
>>   len = (uint32_t)(pld - (uint8_t *)cmd);
>>   numattrs++;
>>   attrib_blk->numattrs = htonl(numattrs);
>> @@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req,
>>   struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw);
>>   int rv;
>>
>> + BUG_ON(pld_len > pld->len);
>> +
>
> I think WARN_ON() is better than BUG_ON() in this case
>
> if (WARN_ON(pld_len > pld->len))
> return -EINVAL;
>
>>   io_req->io_cbfn = io_cbfn;  /* Upper layer callback handler */
>>   io_req->fw_handle = (uintptr_t) (io_req);
>>   io_req->eq_idx = mgmtm->eq_idx;

I chose BUG_ON here because the damage has already been done. If this
assertion is hit, the heap buffers have already been overrun. This
isn't a state we should only warn about...

-Kees

-- 
Kees Cook
Pixel Security

Re: [PATCH] csiostor: Avoid content leaks and casts

[Varun Prakash]

On Tue, May 09, 2017 at 03:34:44PM -0700, Kees Cook wrote:
> When copying attributes, the len argument was padded out and the resulting
> memcpy() would copy beyond the end of the source buffer.  Avoid this,
> and use size_t for val_len to avoid all the casts. Similarly, avoid source
> buffer casts and use void *.
> 
> Additionally enforces val_len can be represented by u16 and that
> the DMA buffer was not overflowed. Fixes the size of mfa, which is not
> FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN (but it will be padded up to 4). This
> was noticed by the future CONFIG_FORTIFY_SOURCE checks.
> 
> Cc: Daniel Micay 
> Signed-off-by: Kees Cook 
> ---
>  drivers/scsi/csiostor/csio_lnode.c | 43 
> +++---
>  1 file changed, 26 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/scsi/csiostor/csio_lnode.c 
> b/drivers/scsi/csiostor/csio_lnode.c
> index c00b2ff72b55..be5ee2d37815 100644
> --- a/drivers/scsi/csiostor/csio_lnode.c
> +++ b/drivers/scsi/csiostor/csio_lnode.c
> @@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len)
>  }
>  


>  
>   csio_append_attrib(, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD,
> -(uint8_t *),
> -FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
> +, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
>   len = (uint32_t)(pld - (uint8_t *)cmd);
>   numattrs++;
>   attrib_blk->numattrs = htonl(numattrs);
> @@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req,
>   struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw);
>   int rv;
>  
> + BUG_ON(pld_len > pld->len);
> +

I think WARN_ON() is better than BUG_ON() in this case

if (WARN_ON(pld_len > pld->len))
return -EINVAL;

>   io_req->io_cbfn = io_cbfn;  /* Upper layer callback handler */
>   io_req->fw_handle = (uintptr_t) (io_req);
>   io_req->eq_idx = mgmtm->eq_idx;

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[h...@lst.de]

On Mon, May 22, 2017 at 02:56:18PM +0200, Hannes Reinecke wrote:
> > No, we don't.  The driver simply sets a tag aside and doesn't expose
> > it to the block layer.  Similar to what smartpqi already does for LUN
> > resets and AENs, mpt3sas does for the ioctl tags and NVMe does for AERs.
> > Personally I feel a bit uncomfortable by setting aside just one tag for
> TMFs; this assumes we'll never be sending LUN resets to devices in parallel.
> 
> But maybe this is a discussion for another time, if and when we finally
> move to that.

For midlayer initiated EH that's the case - they are serialized by
being issued from the eh thread.  For the ioctl we have the
scsi_block_when_processing_errors / scsi_host_in_recovery magic,
although that hand crafted primitive is a bit of a mess, we'd
be much better off with a real EH mutex.

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[Hannes Reinecke]

On 05/22/2017 02:48 PM, h...@lst.de wrote:
> On Mon, May 22, 2017 at 10:46:10AM +0200, Hannes Reinecke wrote:
>>> That seems to be overkill to me for the few drivers.  And I suspect
>>> most of them would be better off now even using blk-mq private tags
>>> (which we'd have to implement for the legacy path first or just
>>> kill it off) but just not expose a tag per host to the scsi and block
>>> layers and set that aside.
>>>
>> IE not using blk-mq private tags for EH? Hmm.
>> But then we'd need a SCSI-internal mechanism to get one of them. I
>> really would want to avoid having each driver to implement it's own
>> mechanism on how to get a TMF tag; that sort of thing only leads to
>> copy-and-paste errors.
>> Ok; will be looking into it.
> 
> No, we don't.  The driver simply sets a tag aside and doesn't expose
> it to the block layer.  Similar to what smartpqi already does for LUN
> resets and AENs, mpt3sas does for the ioctl tags and NVMe does for AERs.
> Personally I feel a bit uncomfortable by setting aside just one tag for
TMFs; this assumes we'll never be sending LUN resets to devices in parallel.

But maybe this is a discussion for another time, if and when we finally
move to that.

Cheers,

Hannes
-- 
Dr. Hannes ReineckezSeries & Storage
h...@suse.com  +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)

Re: [PATCH] scsi: smartpqi: mark PM functions as __maybe_unused

[Arnd Bergmann]

On Fri, May 19, 2017 at 3:53 AM, Martin K. Petersen
 wrote:
>
> Arnd,
>
>> I notice that today's linux-next no longer contains the patch that
>> introduced the warning.
>
> I had tagged my 4.12 fixes branch with for-next. It should be back to
> 4.13 material shortly.

Ok, the patch is back now, so my fix is needed again. Let me know
in case you want me to resend.

Arnd

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[h...@lst.de]

On Mon, May 22, 2017 at 10:46:10AM +0200, Hannes Reinecke wrote:
> > That seems to be overkill to me for the few drivers.  And I suspect
> > most of them would be better off now even using blk-mq private tags
> > (which we'd have to implement for the legacy path first or just
> > kill it off) but just not expose a tag per host to the scsi and block
> > layers and set that aside.
> > 
> IE not using blk-mq private tags for EH? Hmm.
> But then we'd need a SCSI-internal mechanism to get one of them. I
> really would want to avoid having each driver to implement it's own
> mechanism on how to get a TMF tag; that sort of thing only leads to
> copy-and-paste errors.
> Ok; will be looking into it.

No, we don't.  The driver simply sets a tag aside and doesn't expose
it to the block layer.  Similar to what smartpqi already does for LUN
resets and AENs, mpt3sas does for the ioctl tags and NVMe does for AERs.

Re: [PATCH 1/2] libsas: Don't process sas events in static works

[John Garry]

On 22/05/2017 06:54, wangyijing wrote:

I also think for safety this should use a mempool that guarantees that
> events can continue to be processed under system memory pressure.

What I am worried about is it's would still fail if the mempool is used empty 
during memory pressure.


> Also, have you considered the case when a broken phy starts throwing a
> constant stream of events? Is there a point at which libsas should
> stop queuing events and disable the phy?

Not yet, I didn't find this issue in real case, but I agree, it's really a 
problem in some broken
hardware, I think it's not a easy problem, we could improve it step by step.

Thanks!
Yijing.



I have seen this scenario on our development board when we have a bad 
physical cable connection - the PHY continually goes up and down in a loop.


So, in this regard, it is worth safeguarding against this scenario.

John

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[Hannes Reinecke]

On 05/22/2017 09:54 AM, h...@lst.de wrote:
> On Mon, May 22, 2017 at 08:06:46AM +0200, Hannes Reinecke wrote:
>> Problem is that quite some LLDDs require a hardware tag for sending
>> TMFs, and currently the re-use the tag from the passed in scmd for that.
>> So first we need to move those to a sane interface, and having them
>> requesting a new tag for TMFs.
> 
> Some do indeed.  But these seems to be the exception and not the rule.
> 
Still need to be handled, though ...

>> Should be made easier with Christophs rework, but we still don't have
>> any defined way how TMFs should request their tag; should they use
>> private tags? Should they use 'normal' tags? Should the driver implement
>> their own tag pool, seeing that these commands will never ever making
>> use of the associated request?
> 
> I think the right way to go is that every driver that needs tags for
> TMFs should use private tags internally without the core knowing
> about it.
> 
That was my idea, too.

>> Hence I'm looking into implementing a REQ_RESET block request operation,
>> which then could be used to facilitate all of this (the request would be
>> allocated from the private tag pool if present).
> 
> That seems to be overkill to me for the few drivers.  And I suspect
> most of them would be better off now even using blk-mq private tags
> (which we'd have to implement for the legacy path first or just
> kill it off) but just not expose a tag per host to the scsi and block
> layers and set that aside.
> 
IE not using blk-mq private tags for EH? Hmm.
But then we'd need a SCSI-internal mechanism to get one of them. I
really would want to avoid having each driver to implement it's own
mechanism on how to get a TMF tag; that sort of thing only leads to
copy-and-paste errors.
Ok; will be looking into it.

>> It would also neatly solve the scsi_ioctl_reset() problem, as we then
>> could just issue a REQ_RESET and would avoid having to call into the
>> eh_* function directly.
> 
> I don't think calling the eh_* methods is a problem per see.  It's just
> their stupid calling conventions..
> 
I know. I've been working on a patchset to move at least eh_host_reset()
to take the scsi_host as argument. But even that requires some
preliminary patches to some LLDDs :-(

Right. Dusting off those patches, then.

Cheers,

Hannes
-- 
Dr. Hannes ReineckezSeries & Storage
h...@suse.com  +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[h...@lst.de]

On Mon, May 22, 2017 at 08:06:46AM +0200, Hannes Reinecke wrote:
> Problem is that quite some LLDDs require a hardware tag for sending
> TMFs, and currently the re-use the tag from the passed in scmd for that.
> So first we need to move those to a sane interface, and having them
> requesting a new tag for TMFs.

Some do indeed.  But these seems to be the exception and not the rule.

> Should be made easier with Christophs rework, but we still don't have
> any defined way how TMFs should request their tag; should they use
> private tags? Should they use 'normal' tags? Should the driver implement
> their own tag pool, seeing that these commands will never ever making
> use of the associated request?

I think the right way to go is that every driver that needs tags for
TMFs should use private tags internally without the core knowing
about it.

> Hence I'm looking into implementing a REQ_RESET block request operation,
> which then could be used to facilitate all of this (the request would be
> allocated from the private tag pool if present).

That seems to be overkill to me for the few drivers.  And I suspect
most of them would be better off now even using blk-mq private tags
(which we'd have to implement for the legacy path first or just
kill it off) but just not expose a tag per host to the scsi and block
layers and set that aside.

> It would also neatly solve the scsi_ioctl_reset() problem, as we then
> could just issue a REQ_RESET and would avoid having to call into the
> eh_* function directly.

I don't think calling the eh_* methods is a problem per see.  It's just
their stupid calling conventions..

Re: [PATCH 02/18] bsg: Check private request size before attaching to a queue

[h...@lst.de]

On Sun, May 21, 2017 at 02:33:05PM +, Bart Van Assche wrote:
> Thanks for the review comments. The cover letter should have made it to at
> least the linux-scsi mailing list since it shows up in at least one archive of
> that mailing list: https://www.spinics.net/lists/linux-scsi/msg108940.html.

Yes, I see it on the list now.  But it's missing various Cc that the
actual patches have, including that to me, which seems a bit broken.

Re: [PATCH 06/18] scsi: Make scsi_ioctl_reset() pass the request queue pointer to blk_rq_init()

[Hannes Reinecke]

On 05/21/2017 06:41 PM, Bart Van Assche wrote:
> On Sun, 2017-05-21 at 08:50 +0200, Christoph Hellwig wrote:
>> Although we really need to stop abusing requests/cmds for EH..
>> (Hannes, time to dust off your old patches!)
> 
> Hello Christoph and Hannes,
> 
> How about passing a struct scsi_device pointer to the eh_*_reset_handler
> callbacks instead of a struct scsi_cmnd pointer? Most SCSI LLD
> eh_*_reset_handler implementations don't do anything with the information
> passed through the struct scsi_cmnd pointer except reading the SCSI device
> pointer and logging the SCSI command CDB. Hannes, is this the same as your
> proposal? Do you want to work on this or do you perhaps expect me to prepare
> patches to implement that change?
> 
If it were so easy.

Problem is that quite some LLDDs require a hardware tag for sending
TMFs, and currently the re-use the tag from the passed in scmd for that.
So first we need to move those to a sane interface, and having them
requesting a new tag for TMFs.
Should be made easier with Christophs rework, but we still don't have
any defined way how TMFs should request their tag; should they use
private tags? Should they use 'normal' tags? Should the driver implement
their own tag pool, seeing that these commands will never ever making
use of the associated request?

Hence I'm looking into implementing a REQ_RESET block request operation,
which then could be used to facilitate all of this (the request would be
allocated from the private tag pool if present).
It would also neatly solve the scsi_ioctl_reset() problem, as we then
could just issue a REQ_RESET and would avoid having to call into the
eh_* function directly.

Cheers,

Hannes
-- 
Dr. Hannes ReineckezSeries & Storage
h...@suse.com  +49 911 74053 688
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: F. Imendörffer, J. Smithard, D. Upmanyu, G. Norton
HRB 21284 (AG Nürnberg)