Commit d51cf5bd authored by James Smart's avatar James Smart Committed by Martin K. Petersen
Browse files

scsi: lpfc: Fix field overload in lpfc_iocbq data structure 

The lpfc_iocbq data structure has void * pointers that are overloaded to be
as many as 8 different data types and the driver translates the void * by
casting.  This patch removes the void * pointers by declaring the specific
types needed by the driver.  It also expands the context_un to include more
seldom used pointer types to save structure bytes.  It also groups the u8
types together to pack the 8 bytes needed.  This work allows the lpfc_iocbq
data structure to be more strongly typed and keeps it from being allocated
from the 512 byte slab.

[mkp: rolled in zeroday fix]

Link: https://lore.kernel.org/r/20220412222008.126521-21-jsmart2021@gmail.com


Reported-by: default avatarkernel test robot <lkp@intel.com>
Co-developed-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJustin Tee <justin.tee@broadcom.com>
Signed-off-by: default avatarJames Smart <jsmart2021@gmail.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 1045592f

drivers/scsi/lpfc/lpfc_bsg.c

+38 −41
Original line number Diff line number Diff line
@@ -310,7 +310,7 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba, 
	int rc = 0;

	u32 ulp_status, ulp_word4, total_data_placed;



	dd_data = cmdiocbq->context1;

	dd_data = cmdiocbq->context_un.dd_data;



	/* Determine if job has been aborted */

	spin_lock_irqsave(&phba->ct_ev_lock, flags);
@@ -328,10 +328,10 @@ lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba, 
	spin_unlock_irqrestore(&phba->hbalock, flags);



	iocb = &dd_data->context_un.iocb;

	ndlp = iocb->cmdiocbq->context_un.ndlp;

	ndlp = iocb->cmdiocbq->ndlp;

	rmp = iocb->rmp;

	cmp = cmdiocbq->context2;

	bmp = cmdiocbq->context3;

	cmp = cmdiocbq->cmd_dmabuf;

	bmp = cmdiocbq->bpl_dmabuf;

	ulp_status = get_job_ulpstatus(phba, rspiocbq);

	ulp_word4 = get_job_word4(phba, rspiocbq);

	total_data_placed = get_job_data_placed(phba, rspiocbq);
@@ -470,14 +470,12 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *job) 


	cmdiocbq->num_bdes = num_entry;

	cmdiocbq->vport = phba->pport;

	cmdiocbq->context2 = cmp;

	cmdiocbq->context3 = bmp;

	cmdiocbq->cmd_dmabuf = cmp;

	cmdiocbq->bpl_dmabuf = bmp;

	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;



	cmdiocbq->cmd_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;

	cmdiocbq->context1 = dd_data;

	cmdiocbq->context2 = cmp;

	cmdiocbq->context3 = bmp;

	cmdiocbq->context_un.dd_data = dd_data;



	dd_data->type = TYPE_IOCB;

	dd_data->set_job = job;
@@ -495,8 +493,8 @@ lpfc_bsg_send_mgmt_cmd(struct bsg_job *job) 
		readl(phba->HCregaddr); /* flush */

	}



	cmdiocbq->context_un.ndlp = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->context_un.ndlp) {

	cmdiocbq->ndlp = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->ndlp) {

		rc = -ENODEV;

		goto free_rmp;

	}
@@ -573,9 +571,9 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba, 
	int rc = 0;

	u32 ulp_status, ulp_word4, total_data_placed;



	dd_data = cmdiocbq->context1;

	dd_data = cmdiocbq->context_un.dd_data;

	ndlp = dd_data->context_un.iocb.ndlp;

	cmdiocbq->context1 = ndlp;

	cmdiocbq->ndlp = ndlp;



	/* Determine if job has been aborted */

	spin_lock_irqsave(&phba->ct_ev_lock, flags);
@@ -595,7 +593,7 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba, 
	ulp_status = get_job_ulpstatus(phba, rspiocbq);

	ulp_word4 = get_job_word4(phba, rspiocbq);

	total_data_placed = get_job_data_placed(phba, rspiocbq);

	pcmd = (struct lpfc_dmabuf *)cmdiocbq->context2;

	pcmd = cmdiocbq->cmd_dmabuf;

	prsp = (struct lpfc_dmabuf *)pcmd->list.next;



	/* Copy the completed job data or determine the job status if job is
@@ -711,8 +709,8 @@ lpfc_bsg_rport_els(struct bsg_job *job) 
	/* Transfer the request payload to allocated command dma buffer */

	sg_copy_to_buffer(job->request_payload.sg_list,

			  job->request_payload.sg_cnt,

			  ((struct lpfc_dmabuf *)cmdiocbq->context2)->virt,

			  job->request_payload.payload_len);

			  cmdiocbq->cmd_dmabuf->virt,

			  cmdsize);



	rpi = ndlp->nlp_rpi;
@@ -722,8 +720,8 @@ lpfc_bsg_rport_els(struct bsg_job *job) 
	else

		cmdiocbq->iocb.ulpContext = rpi;

	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;

	cmdiocbq->context1 = dd_data;

	cmdiocbq->context_un.ndlp = ndlp;

	cmdiocbq->context_un.dd_data = dd_data;

	cmdiocbq->ndlp = ndlp;

	cmdiocbq->cmd_cmpl = lpfc_bsg_rport_els_cmp;

	dd_data->type = TYPE_IOCB;

	dd_data->set_job = job;
@@ -742,8 +740,8 @@ lpfc_bsg_rport_els(struct bsg_job *job) 
		readl(phba->HCregaddr); /* flush */

	}



	cmdiocbq->context1 = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->context1) {

	cmdiocbq->ndlp = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->ndlp) {

		rc = -EIO;

		goto linkdown_err;

	}
@@ -917,8 +915,8 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 
	struct ulp_bde64 *bde;

	dma_addr_t dma_addr;

	int i;

	struct lpfc_dmabuf *bdeBuf1 = piocbq->context2;

	struct lpfc_dmabuf *bdeBuf2 = piocbq->context3;

	struct lpfc_dmabuf *bdeBuf1 = piocbq->cmd_dmabuf;

	struct lpfc_dmabuf *bdeBuf2 = piocbq->bpl_dmabuf;

	struct lpfc_sli_ct_request *ct_req;

	struct bsg_job *job = NULL;

	struct fc_bsg_reply *bsg_reply;
@@ -985,9 +983,8 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 
		list_for_each_entry(iocbq, &head, list) {

			size = 0;

			if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {

				bdeBuf1 = iocbq->context2;

				bdeBuf2 = iocbq->context3;



				bdeBuf1 = iocbq->cmd_dmabuf;

				bdeBuf2 = iocbq->bpl_dmabuf;

			}

			if (phba->sli_rev == LPFC_SLI_REV4)

				bde_count = iocbq->wcqe_cmpl.word3;
@@ -1384,7 +1381,7 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba, 
	int rc = 0;

	u32 ulp_status, ulp_word4;



	dd_data = cmdiocbq->context1;

	dd_data = cmdiocbq->context_un.dd_data;



	/* Determine if job has been aborted */

	spin_lock_irqsave(&phba->ct_ev_lock, flags);
@@ -1401,8 +1398,8 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba, 
	spin_unlock_irqrestore(&phba->hbalock, flags);



	ndlp = dd_data->context_un.iocb.ndlp;

	cmp = cmdiocbq->context2;

	bmp = cmdiocbq->context3;

	cmp = cmdiocbq->cmd_dmabuf;

	bmp = cmdiocbq->bpl_dmabuf;



	ulp_status = get_job_ulpstatus(phba, rspiocbq);

	ulp_word4 = get_job_word4(phba, rspiocbq);
@@ -1529,10 +1526,10 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag, 


	ctiocb->cmd_flag |= LPFC_IO_LIBDFC;

	ctiocb->vport = phba->pport;

	ctiocb->context1 = dd_data;

	ctiocb->context2 = cmp;

	ctiocb->context3 = bmp;

	ctiocb->context_un.ndlp = ndlp;

	ctiocb->context_un.dd_data = dd_data;

	ctiocb->cmd_dmabuf = cmp;

	ctiocb->bpl_dmabuf = bmp;

	ctiocb->ndlp = ndlp;

	ctiocb->cmd_cmpl = lpfc_issue_ct_rsp_cmp;



	dd_data->type = TYPE_IOCB;
@@ -2671,7 +2668,7 @@ static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi, 
	ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;

	ctreq->CommandResponse.bits.Size = 0;



	cmdiocbq->context3 = dmabuf;

	cmdiocbq->bpl_dmabuf = dmabuf;

	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;

	cmdiocbq->vport = phba->pport;

	cmdiocbq->cmd_cmpl = NULL;
@@ -3231,7 +3228,7 @@ lpfc_bsg_diag_loopback_run(struct bsg_job *job) 
	cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK;

	cmdiocbq->vport = phba->pport;

	cmdiocbq->cmd_cmpl = NULL;

	cmdiocbq->context3 = txbmp;

	cmdiocbq->bpl_dmabuf = txbmp;



	if (phba->sli_rev < LPFC_SLI_REV4) {

		lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, txbmp, 0, txxri,
@@ -3384,7 +3381,7 @@ lpfc_bsg_get_dfc_rev(struct bsg_job *job) 
 * This is completion handler function for mailbox commands issued from

 * lpfc_bsg_issue_mbox function. This function is called by the

 * mailbox event handler function with no lock held. This function

 * will wake up thread waiting on the wait queue pointed by context1

 * will wake up thread waiting on the wait queue pointed by dd_data

 * of the mailbox.

 **/

static void
@@ -5034,9 +5031,9 @@ lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba, 
	unsigned int rsp_size;

	int rc = 0;



	dd_data = cmdiocbq->context1;

	cmp = cmdiocbq->context2;

	bmp = cmdiocbq->context3;

	dd_data = cmdiocbq->context_un.dd_data;

	cmp = cmdiocbq->cmd_dmabuf;

	bmp = cmdiocbq->bpl_dmabuf;

	menlo = &dd_data->context_un.menlo;

	rmp = menlo->rmp;

	rsp = &rspiocbq->iocb;
@@ -5233,9 +5230,9 @@ lpfc_menlo_cmd(struct bsg_job *job) 
	/* We want the firmware to timeout before we do */

	cmd->ulpTimeout = MENLO_TIMEOUT - 5;

	cmdiocbq->cmd_cmpl = lpfc_bsg_menlo_cmd_cmp;

	cmdiocbq->context1 = dd_data;

	cmdiocbq->context2 = cmp;

	cmdiocbq->context3 = bmp;

	cmdiocbq->context_un.dd_data = dd_data;

	cmdiocbq->cmd_dmabuf = cmp;

	cmdiocbq->bpl_dmabuf = bmp;

	if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {

		cmd->ulpCommand = CMD_GEN_REQUEST64_CR;

		cmd->ulpPU = MENLO_PU; /* 3 */

drivers/scsi/lpfc/lpfc_ct.c

+73 −75
Original line number Diff line number Diff line
@@ -118,22 +118,22 @@ lpfc_ct_unsol_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	struct lpfc_nodelist *ndlp;

	struct lpfc_dmabuf *mp, *bmp;



	ndlp = (struct lpfc_nodelist *)cmdiocb->context1;

	ndlp = cmdiocb->ndlp;

	if (ndlp)

		lpfc_nlp_put(ndlp);



	mp = cmdiocb->context2;

	bmp = cmdiocb->context3;

	mp = cmdiocb->rsp_dmabuf;

	bmp = cmdiocb->bpl_dmabuf;

	if (mp) {

		lpfc_mbuf_free(phba, mp->virt, mp->phys);

		kfree(mp);

		cmdiocb->context2 = NULL;

		cmdiocb->rsp_dmabuf = NULL;

	}



	if (bmp) {

		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);

		kfree(bmp);

		cmdiocb->context3 = NULL;

		cmdiocb->bpl_dmabuf = NULL;

	}



	lpfc_sli_release_iocbq(phba, cmdiocb);
@@ -232,18 +232,17 @@ lpfc_ct_reject_event(struct lpfc_nodelist *ndlp, 
	}



	/* Save for completion so we can release these resources */

	cmdiocbq->context2 = (uint8_t *)mp;

	cmdiocbq->context3 = (uint8_t *)bmp;

	cmdiocbq->rsp_dmabuf = mp;

	cmdiocbq->bpl_dmabuf = bmp;

	cmdiocbq->cmd_cmpl = lpfc_ct_unsol_cmpl;

	tmo = (3 * phba->fc_ratov);



	cmdiocbq->retry = 0;

	cmdiocbq->vport = vport;

	cmdiocbq->context_un.ndlp = NULL;

	cmdiocbq->drvrTimeout = tmo + LPFC_DRVR_TIMEOUT;



	cmdiocbq->context1 = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->context1)

	cmdiocbq->ndlp = lpfc_nlp_get(ndlp);

	if (!cmdiocbq->ndlp)

		goto ct_no_ndlp;



	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
@@ -310,8 +309,8 @@ lpfc_ct_handle_mibreq(struct lpfc_hba *phba, struct lpfc_iocbq *ctiocbq) 
		return;

	}



	ct_req = ((struct lpfc_sli_ct_request *)

		 (((struct lpfc_dmabuf *)ctiocbq->context2)->virt));

	ct_req = (struct lpfc_sli_ct_request *)ctiocbq->cmd_dmabuf->virt;



	mi_cmd = ct_req->CommandResponse.bits.CmdRsp;

	lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,

			 "6442 : MI Cmd : x%x Not Supported\n", mi_cmd);
@@ -347,14 +346,14 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 
	uint32_t size;

	struct list_head head;

	struct lpfc_sli_ct_request *ct_req;

	struct lpfc_dmabuf *bdeBuf1 = ctiocbq->context2;

	struct lpfc_dmabuf *bdeBuf2 = ctiocbq->context3;

	struct lpfc_dmabuf *bdeBuf1 = ctiocbq->cmd_dmabuf;

	struct lpfc_dmabuf *bdeBuf2 = ctiocbq->bpl_dmabuf;

	u32 status, parameter, bde_count = 0;

	struct lpfc_wcqe_complete *wcqe_cmpl = NULL;



	ctiocbq->context1 = NULL;

	ctiocbq->context2 = NULL;

	ctiocbq->context3 = NULL;

	ctiocbq->cmd_dmabuf = NULL;

	ctiocbq->rsp_dmabuf = NULL;

	ctiocbq->bpl_dmabuf = NULL;



	wcqe_cmpl = &ctiocbq->wcqe_cmpl;

	status = get_job_ulpstatus(phba, ctiocbq);
@@ -382,12 +381,11 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 
	if (bde_count == 0)

		return;



	ctiocbq->context2 = bdeBuf1;

	ctiocbq->cmd_dmabuf = bdeBuf1;

	if (bde_count == 2)

		ctiocbq->context3 = bdeBuf2;

		ctiocbq->bpl_dmabuf = bdeBuf2;



	ct_req = ((struct lpfc_sli_ct_request *)

		 (((struct lpfc_dmabuf *)ctiocbq->context2)->virt));

	ct_req = (struct lpfc_sli_ct_request *)ctiocbq->cmd_dmabuf->virt;



	if (ct_req->FsType == SLI_CT_MANAGEMENT_SERVICE &&

	    ct_req->FsSubType == SLI_CT_MIB_Subtypes) {
@@ -408,8 +406,8 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 


			if (!bde_count)

				continue;

			bdeBuf1 = iocb->context2;

			iocb->context2 = NULL;

			bdeBuf1 = iocb->cmd_dmabuf;

			iocb->cmd_dmabuf = NULL;

			if (phba->sli_rev == LPFC_SLI_REV4)

				size = iocb->wqe.gen_req.bde.tus.f.bdeSize;

			else
@@ -417,8 +415,8 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, 
			lpfc_ct_unsol_buffer(phba, ctiocbq, bdeBuf1, size);

			lpfc_in_buf_free(phba, bdeBuf1);

			if (bde_count == 2) {

				bdeBuf2 = iocb->context3;

				iocb->context3 = NULL;

				bdeBuf2 = iocb->bpl_dmabuf;

				iocb->bpl_dmabuf = NULL;

				if (phba->sli_rev == LPFC_SLI_REV4)

					size = iocb->unsol_rcv_len;

				else
@@ -549,24 +547,25 @@ lpfc_ct_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *ctiocb) 
{

	struct lpfc_dmabuf *buf_ptr;



	/* I/O job is complete so context is now invalid*/

	ctiocb->context_un.ndlp = NULL;

	if (ctiocb->context1) {

		buf_ptr = (struct lpfc_dmabuf *) ctiocb->context1;

	/* IOCBQ job structure gets cleaned during release.  Just release

	 * the dma buffers here.

	 */

	if (ctiocb->cmd_dmabuf) {

		buf_ptr = ctiocb->cmd_dmabuf;

		lpfc_mbuf_free(phba, buf_ptr->virt, buf_ptr->phys);

		kfree(buf_ptr);

		ctiocb->context1 = NULL;

		ctiocb->cmd_dmabuf = NULL;

	}

	if (ctiocb->context2) {

		lpfc_free_ct_rsp(phba, (struct lpfc_dmabuf *) ctiocb->context2);

		ctiocb->context2 = NULL;

	if (ctiocb->rsp_dmabuf) {

		lpfc_free_ct_rsp(phba, ctiocb->rsp_dmabuf);

		ctiocb->rsp_dmabuf = NULL;

	}



	if (ctiocb->context3) {

		buf_ptr = (struct lpfc_dmabuf *) ctiocb->context3;

	if (ctiocb->bpl_dmabuf) {

		buf_ptr = ctiocb->bpl_dmabuf;

		lpfc_mbuf_free(phba, buf_ptr->virt, buf_ptr->phys);

		kfree(buf_ptr);

		ctiocb->context3 = NULL;

		ctiocb->bpl_dmabuf = NULL;

	}

	lpfc_sli_release_iocbq(phba, ctiocb);

	return 0;
@@ -605,11 +604,11 @@ lpfc_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp, 
	/* Update the num_entry bde count */

	geniocb->num_bdes = num_entry;



	geniocb->context3 = (uint8_t *) bmp;

	geniocb->bpl_dmabuf = bmp;



	/* Save for completion so we can release these resources */

	geniocb->context1 = (uint8_t *) inp;

	geniocb->context2 = (uint8_t *) outp;

	geniocb->cmd_dmabuf = inp;

	geniocb->rsp_dmabuf = outp;



	geniocb->event_tag = event_tag;
@@ -635,8 +634,8 @@ lpfc_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp, 
	geniocb->drvrTimeout = tmo + LPFC_DRVR_TIMEOUT;

	geniocb->vport = vport;

	geniocb->retry = retry;

	geniocb->context_un.ndlp = lpfc_nlp_get(ndlp);

	if (!geniocb->context_un.ndlp)

	geniocb->ndlp = lpfc_nlp_get(ndlp);

	if (!geniocb->ndlp)

		goto out;



	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, geniocb, 0);
@@ -926,13 +925,12 @@ lpfc_cmpl_ct_cmd_gid_ft(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	int rc, type;



	/* First save ndlp, before we overwrite it */

	ndlp = cmdiocb->context_un.ndlp;

	ndlp = cmdiocb->ndlp;



	/* we pass cmdiocb to state machine which needs rspiocb as well */

	cmdiocb->context_un.rsp_iocb = rspiocb;



	inp = (struct lpfc_dmabuf *) cmdiocb->context1;

	outp = (struct lpfc_dmabuf *) cmdiocb->context2;

	cmdiocb->rsp_iocb = rspiocb;

	inp = cmdiocb->cmd_dmabuf;

	outp = cmdiocb->rsp_dmabuf;



	lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT,

		 "GID_FT cmpl:     status:x%x/x%x rtry:%d",
@@ -1143,12 +1141,12 @@ lpfc_cmpl_ct_cmd_gid_pt(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	int rc;



	/* First save ndlp, before we overwrite it */

	ndlp = cmdiocb->context_un.ndlp;

	ndlp = cmdiocb->ndlp;



	/* we pass cmdiocb to state machine which needs rspiocb as well */

	cmdiocb->context_un.rsp_iocb = rspiocb;

	inp = (struct lpfc_dmabuf *)cmdiocb->context1;

	outp = (struct lpfc_dmabuf *)cmdiocb->context2;

	cmdiocb->rsp_iocb = rspiocb;

	inp = cmdiocb->cmd_dmabuf;

	outp = cmdiocb->rsp_dmabuf;



	lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_CT,

			      "GID_PT cmpl:     status:x%x/x%x rtry:%d",
@@ -1346,8 +1344,8 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
{

	struct lpfc_vport *vport = cmdiocb->vport;

	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);

	struct lpfc_dmabuf *inp = (struct lpfc_dmabuf *) cmdiocb->context1;

	struct lpfc_dmabuf *outp = (struct lpfc_dmabuf *) cmdiocb->context2;

	struct lpfc_dmabuf *inp = cmdiocb->cmd_dmabuf;

	struct lpfc_dmabuf *outp = cmdiocb->rsp_dmabuf;

	struct lpfc_sli_ct_request *CTrsp;

	int did, rc, retry;

	uint8_t fbits;
@@ -1426,7 +1424,7 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
					 cmdiocb->retry, did);

				if (rc == 0) {

					/* success */

					free_ndlp = cmdiocb->context_un.ndlp;

					free_ndlp = cmdiocb->ndlp;

					lpfc_ct_free_iocb(phba, cmdiocb);

					lpfc_nlp_put(free_ndlp);

					return;
@@ -1483,7 +1481,7 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	}



iocb_free:

	free_ndlp = cmdiocb->context_un.ndlp;

	free_ndlp = cmdiocb->ndlp;

	lpfc_ct_free_iocb(phba, cmdiocb);

	lpfc_nlp_put(free_ndlp);

	return;
@@ -1494,8 +1492,8 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
			struct lpfc_iocbq *rspiocb)

{

	struct lpfc_vport *vport = cmdiocb->vport;

	struct lpfc_dmabuf *inp = (struct lpfc_dmabuf *)cmdiocb->context1;

	struct lpfc_dmabuf *outp = (struct lpfc_dmabuf *)cmdiocb->context2;

	struct lpfc_dmabuf *inp = cmdiocb->cmd_dmabuf;

	struct lpfc_dmabuf *outp = cmdiocb->rsp_dmabuf;

	struct lpfc_sli_ct_request *CTrsp;

	int did;

	struct lpfc_nodelist *ndlp = NULL;
@@ -1519,7 +1517,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	}



	/* Preserve the nameserver node to release the reference. */

	ns_ndlp = cmdiocb->context_un.ndlp;

	ns_ndlp = cmdiocb->ndlp;



	if (ulp_status == IOSTAT_SUCCESS) {

		/* Good status, continue checking */
@@ -1605,13 +1603,13 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
	u32 ulp_word4 = get_job_word4(phba, rspiocb);



	/* First save ndlp, before we overwrite it */

	ndlp = cmdiocb->context_un.ndlp;

	ndlp = cmdiocb->ndlp;



	/* we pass cmdiocb to state machine which needs rspiocb as well */

	cmdiocb->context_un.rsp_iocb = rspiocb;

	cmdiocb->rsp_iocb = rspiocb;



	inp = (struct lpfc_dmabuf *) cmdiocb->context1;

	outp = (struct lpfc_dmabuf *) cmdiocb->context2;

	inp = cmdiocb->cmd_dmabuf;

	outp = cmdiocb->rsp_dmabuf;



	cmdcode = be16_to_cpu(((struct lpfc_sli_ct_request *) inp->virt)->

					CommandResponse.bits.CmdRsp);
@@ -1672,7 +1670,7 @@ lpfc_cmpl_ct_cmd_rft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		struct lpfc_dmabuf *outp;

		struct lpfc_sli_ct_request *CTrsp;



		outp = (struct lpfc_dmabuf *) cmdiocb->context2;

		outp = cmdiocb->rsp_dmabuf;

		CTrsp = (struct lpfc_sli_ct_request *)outp->virt;

		if (CTrsp->CommandResponse.bits.CmdRsp ==

		    be16_to_cpu(SLI_CT_RESPONSE_FS_ACC))
@@ -1693,7 +1691,7 @@ lpfc_cmpl_ct_cmd_rnn_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		struct lpfc_dmabuf *outp;

		struct lpfc_sli_ct_request *CTrsp;



		outp = (struct lpfc_dmabuf *) cmdiocb->context2;

		outp = cmdiocb->rsp_dmabuf;

		CTrsp = (struct lpfc_sli_ct_request *) outp->virt;

		if (CTrsp->CommandResponse.bits.CmdRsp ==

		    be16_to_cpu(SLI_CT_RESPONSE_FS_ACC))
@@ -1714,7 +1712,7 @@ lpfc_cmpl_ct_cmd_rspn_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		struct lpfc_dmabuf *outp;

		struct lpfc_sli_ct_request *CTrsp;



		outp = (struct lpfc_dmabuf *) cmdiocb->context2;

		outp = cmdiocb->rsp_dmabuf;

		CTrsp = (struct lpfc_sli_ct_request *)outp->virt;

		if (CTrsp->CommandResponse.bits.CmdRsp ==

		    be16_to_cpu(SLI_CT_RESPONSE_FS_ACC))
@@ -1735,7 +1733,7 @@ lpfc_cmpl_ct_cmd_rsnn_nn(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		struct lpfc_dmabuf *outp;

		struct lpfc_sli_ct_request *CTrsp;



		outp = (struct lpfc_dmabuf *) cmdiocb->context2;

		outp = cmdiocb->rsp_dmabuf;

		CTrsp = (struct lpfc_sli_ct_request *) outp->virt;

		if (CTrsp->CommandResponse.bits.CmdRsp ==

		    be16_to_cpu(SLI_CT_RESPONSE_FS_ACC))
@@ -1768,7 +1766,7 @@ lpfc_cmpl_ct_cmd_rff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		struct lpfc_dmabuf *outp;

		struct lpfc_sli_ct_request *CTrsp;



		outp = (struct lpfc_dmabuf *) cmdiocb->context2;

		outp = cmdiocb->rsp_dmabuf;

		CTrsp = (struct lpfc_sli_ct_request *)outp->virt;

		if (CTrsp->CommandResponse.bits.CmdRsp ==

		    be16_to_cpu(SLI_CT_RESPONSE_FS_ACC))
@@ -1865,7 +1863,7 @@ lpfc_get_gidft_type(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb) 
	struct lpfc_dmabuf *mp;

	uint32_t type;



	mp = cmdiocb->context1;

	mp = cmdiocb->cmd_dmabuf;

	if (mp == NULL)

		return 0;

	CtReq = (struct lpfc_sli_ct_request *)mp->virt;
@@ -2171,8 +2169,8 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		       struct lpfc_iocbq *rspiocb)

{

	struct lpfc_vport *vport = cmdiocb->vport;

	struct lpfc_dmabuf *inp = cmdiocb->context1;

	struct lpfc_dmabuf *outp = cmdiocb->context2;

	struct lpfc_dmabuf *inp = cmdiocb->cmd_dmabuf;

	struct lpfc_dmabuf *outp = cmdiocb->rsp_dmabuf;

	struct lpfc_sli_ct_request *CTcmd = inp->virt;

	struct lpfc_sli_ct_request *CTrsp = outp->virt;

	uint16_t fdmi_cmd = CTcmd->CommandResponse.bits.CmdRsp;
@@ -2226,7 +2224,7 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
				 ulp_word4);

	}



	free_ndlp = cmdiocb->context_un.ndlp;

	free_ndlp = cmdiocb->ndlp;

	lpfc_ct_free_iocb(phba, cmdiocb);

	lpfc_nlp_put(free_ndlp);
@@ -3812,8 +3810,8 @@ lpfc_cmpl_ct_cmd_vmid(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, 
		      struct lpfc_iocbq *rspiocb)

{

	struct lpfc_vport *vport = cmdiocb->vport;

	struct lpfc_dmabuf *inp = cmdiocb->context1;

	struct lpfc_dmabuf *outp = cmdiocb->context2;

	struct lpfc_dmabuf *inp = cmdiocb->cmd_dmabuf;

	struct lpfc_dmabuf *outp = cmdiocb->rsp_dmabuf;

	struct lpfc_sli_ct_request *ctcmd = inp->virt;

	struct lpfc_sli_ct_request *ctrsp = outp->virt;

	u16 rsp = ctrsp->CommandResponse.bits.CmdRsp;

drivers/scsi/lpfc/lpfc_els.c

+220 −223

File changed.

Preview size limit exceeded, changes collapsed.

drivers/scsi/lpfc/lpfc_hbadisc.c

+4 −4
Original line number Diff line number Diff line
@@ -5156,7 +5156,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba, 
	if (pring->ringno == LPFC_ELS_RING) {

		switch (ulp_command) {

		case CMD_GEN_REQUEST64_CR:

			if (iocb->context_un.ndlp == ndlp)

			if (iocb->ndlp == ndlp)

				return 1;

			fallthrough;

		case CMD_ELS_REQUEST64_CR:
@@ -5164,7 +5164,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba, 
				return 1;

			fallthrough;

		case CMD_XMIT_ELS_RSP64_CX:

			if (iocb->context1 == (uint8_t *) ndlp)

			if (iocb->ndlp == ndlp)

				return 1;

		}

	} else if (pring->ringno == LPFC_FCP_RING) {
@@ -6099,7 +6099,7 @@ lpfc_free_tx(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp) 
	 */

	spin_lock_irq(&phba->hbalock);

	list_for_each_entry_safe(iocb, next_iocb, &pring->txq, list) {

		if (iocb->context1 != ndlp)

		if (iocb->ndlp != ndlp)

			continue;



		ulp_command = get_job_cmnd(phba, iocb);
@@ -6113,7 +6113,7 @@ lpfc_free_tx(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp) 


	/* Next check the txcmplq */

	list_for_each_entry_safe(iocb, next_iocb, &pring->txcmplq, list) {

		if (iocb->context1 != ndlp)

		if (iocb->ndlp != ndlp)

			continue;



		ulp_command = get_job_cmnd(phba, iocb);

drivers/scsi/lpfc/lpfc_init.c

+7 −5
Original line number Diff line number Diff line
@@ -4323,9 +4323,10 @@ lpfc_sli4_io_sgl_update(struct lpfc_hba *phba) 


	lpfc_printf_log(phba, KERN_INFO, LOG_SLI,

			"6074 Current allocated XRI sgl count:%d, "

			"maximum XRI count:%d\n",

			"maximum XRI count:%d els_xri_cnt:%d\n\n",

			phba->sli4_hba.io_xri_cnt,

			phba->sli4_hba.io_xri_max);

			phba->sli4_hba.io_xri_max,

			els_xri_cnt);



	cnt = lpfc_io_buf_flush(phba, &io_sgl_list);
@@ -4464,12 +4465,11 @@ lpfc_new_io_buf(struct lpfc_hba *phba, int num_to_alloc) 
		}

		pwqeq->sli4_lxritag = lxri;

		pwqeq->sli4_xritag = phba->sli4_hba.xri_ids[lxri];

		pwqeq->context1 = lpfc_ncmd;



		/* Initialize local short-hand pointers. */

		lpfc_ncmd->dma_sgl = lpfc_ncmd->data;

		lpfc_ncmd->dma_phys_sgl = lpfc_ncmd->dma_handle;

		lpfc_ncmd->cur_iocbq.context1 = lpfc_ncmd;

		lpfc_ncmd->cur_iocbq.io_buf = lpfc_ncmd;

		spin_lock_init(&lpfc_ncmd->buf_lock);



		/* add the nvme buffer to a post list */
@@ -4478,7 +4478,9 @@ lpfc_new_io_buf(struct lpfc_hba *phba, int num_to_alloc) 
	}

	lpfc_printf_log(phba, KERN_INFO, LOG_NVME,

			"6114 Allocate %d out of %d requested new NVME "

			"buffers\n", bcnt, num_to_alloc);

			"buffers of size x%zu bytes\n", bcnt, num_to_alloc,

			sizeof(*lpfc_ncmd));





	/* post the list of nvme buffer sgls to port if available */

	if (!list_empty(&post_nblist))