[PATCH v2 0/7] qla2xxx driver update

[PATCH v2 0/7] qla2xxx driver update

[Nilesh Javali]

Martin,

Please apply the qla2xxx driver enhancement and bug fixes to
the scsi tree at your earliest convenience.

Thanks,
Nilesh

v2:
- Fix warnings reported by kernel robot.

Nilesh Javali (1):
  qla2xxx: Update version to 10.02.08.300-k

Quinn Tran (6):
  qla2xxx: Multi-que support for TMF
  qla2xxx: Fix task management cmd failure
  qla2xxx: Fix task management cmd fail due to unavailable resource
  qla2xxx: Fix hang in task management
  qla2xxx: Fix mem access after free
  qla2xxx: Wait for io return on terminate rport

 drivers/scsi/qla2xxx/qla_attr.c    |  13 ++
 drivers/scsi/qla2xxx/qla_def.h     |  21 +++
 drivers/scsi/qla2xxx/qla_gbl.h     |   2 +-
 drivers/scsi/qla2xxx/qla_init.c    | 256 ++++++++++++++++++++++++++---
 drivers/scsi/qla2xxx/qla_iocb.c    |  33 +++-
 drivers/scsi/qla2xxx/qla_isr.c     |  64 ++++++--
 drivers/scsi/qla2xxx/qla_os.c      | 130 ++++++++-------
 drivers/scsi/qla2xxx/qla_version.h |   4 +-
 8 files changed, 418 insertions(+), 105 deletions(-)


base-commit: c8e22b7a1694bb8d025ea636816472739d859145
-- 
2.23.1

[PATCH v2 1/7] qla2xxx: Multi-que support for TMF

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

Add queue flush for task management command, before
placing it on the wire.
Do IO flush for all Request Q's.

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304271702.GpIL391S-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
v2:
- Fix warning reported by kernel robot.

 drivers/scsi/qla2xxx/qla_def.h  |  8 ++++
 drivers/scsi/qla2xxx/qla_gbl.h  |  2 +-
 drivers/scsi/qla2xxx/qla_init.c | 69 ++++++++++++++++++++++++++-------
 drivers/scsi/qla2xxx/qla_iocb.c |  5 ++-
 4 files changed, 66 insertions(+), 18 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ec0e987b71fa..d59e94ae0db4 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -466,6 +466,14 @@ static inline be_id_t port_id_to_be_id(port_id_t port_id)
 	return res;
 }
 
+struct tmf_arg {
+	struct qla_qpair *qpair;
+	struct fc_port *fcport;
+	struct scsi_qla_host *vha;
+	u64 lun;
+	u32 flags;
+};
+
 struct els_logo_payload {
 	uint8_t opcode;
 	uint8_t rsvd[3];
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 9aba07c7bde4..ef11ce46381d 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -69,7 +69,7 @@ extern int qla2x00_async_logout(struct scsi_qla_host *, fc_port_t *);
 extern int qla2x00_async_prlo(struct scsi_qla_host *, fc_port_t *);
 extern int qla2x00_async_adisc(struct scsi_qla_host *, fc_port_t *,
     uint16_t *);
-extern int qla2x00_async_tm_cmd(fc_port_t *, uint32_t, uint32_t, uint32_t);
+extern int qla2x00_async_tm_cmd(fc_port_t *, uint32_t, uint64_t, uint32_t);
 struct qla_work_evt *qla2x00_alloc_work(struct scsi_qla_host *,
     enum qla_work_type);
 extern int qla24xx_async_gnl(struct scsi_qla_host *, fc_port_t *);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index ec0423ec6681..035d1984e2bd 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2020,17 +2020,19 @@ static void qla2x00_tmf_sp_done(srb_t *sp, int res)
 	complete(&tmf->u.tmf.comp);
 }
 
-int
-qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
-	uint32_t tag)
+static int
+__qla2x00_async_tm_cmd(struct tmf_arg *arg)
 {
-	struct scsi_qla_host *vha = fcport->vha;
+	struct scsi_qla_host *vha = arg->vha;
 	struct srb_iocb *tm_iocb;
 	srb_t *sp;
+	unsigned long flags;
 	int rval = QLA_FUNCTION_FAILED;
 
+	fc_port_t *fcport = arg->fcport;
+
 	/* ref: INIT */
-	sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
 	if (!sp)
 		goto done;
 
@@ -2043,15 +2045,15 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
 	tm_iocb = &sp->u.iocb_cmd;
 	init_completion(&tm_iocb->u.tmf.comp);
-	tm_iocb->u.tmf.flags = flags;
-	tm_iocb->u.tmf.lun = lun;
+	tm_iocb->u.tmf.flags = arg->flags;
+	tm_iocb->u.tmf.lun = arg->lun;
 
+	rval = qla2x00_start_sp(sp);
 	ql_dbg(ql_dbg_taskm, vha, 0x802f,
-	    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x.\n",
+	    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x ctrl=%x.\n",
 	    sp->handle, fcport->loop_id, fcport->d_id.b.domain,
-	    fcport->d_id.b.area, fcport->d_id.b.al_pa);
+	    fcport->d_id.b.area, fcport->d_id.b.al_pa, arg->flags);
 
-	rval = qla2x00_start_sp(sp);
 	if (rval != QLA_SUCCESS)
 		goto done_free_sp;
 	wait_for_completion(&tm_iocb->u.tmf.comp);
@@ -2065,12 +2067,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
 	if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw)) {
 		flags = tm_iocb->u.tmf.flags;
-		lun = (uint16_t)tm_iocb->u.tmf.lun;
+		if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET|
+			TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
+			flags = MK_SYNC_ID_LUN;
+		else
+			flags = MK_SYNC_ID;
 
-		/* Issue Marker IOCB */
-		qla2x00_marker(vha, vha->hw->base_qpair,
-		    fcport->loop_id, lun,
-		    flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
+		qla2x00_marker(vha, sp->qpair,
+		    sp->fcport->loop_id, arg->lun, flags);
 	}
 
 done_free_sp:
@@ -2080,6 +2084,41 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 	return rval;
 }
 
+int
+qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
+		     uint32_t tag)
+{
+	struct scsi_qla_host *vha = fcport->vha;
+	struct qla_qpair *qpair;
+	struct tmf_arg a;
+	struct completion comp;
+	int i, rval;
+
+	init_completion(&comp);
+	a.vha = fcport->vha;
+	a.fcport = fcport;
+	a.lun = lun;
+
+	if (vha->hw->mqenable) {
+		for (i = 0; i < vha->hw->num_qpairs; i++) {
+			qpair = vha->hw->queue_pair_map[i];
+			if (!qpair)
+				continue;
+			a.qpair = qpair;
+			a.flags = flags|TCF_NOTMCMD_TO_TARGET;
+			rval = __qla2x00_async_tm_cmd(&a);
+			if (rval)
+				break;
+		}
+	}
+
+	a.qpair = vha->hw->base_qpair;
+	a.flags = flags;
+	rval = __qla2x00_async_tm_cmd(&a);
+
+	return rval;
+}
+
 int
 qla24xx_async_abort_command(srb_t *sp)
 {
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index b9b3e6f80ea9..b02039601cc0 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2541,7 +2541,7 @@ qla24xx_tm_iocb(srb_t *sp, struct tsk_mgmt_entry *tsk)
 	scsi_qla_host_t *vha = fcport->vha;
 	struct qla_hw_data *ha = vha->hw;
 	struct srb_iocb *iocb = &sp->u.iocb_cmd;
-	struct req_que *req = vha->req;
+	struct req_que *req = sp->qpair->req;
 
 	flags = iocb->u.tmf.flags;
 	lun = iocb->u.tmf.lun;
@@ -2557,7 +2557,8 @@ qla24xx_tm_iocb(srb_t *sp, struct tsk_mgmt_entry *tsk)
 	tsk->port_id[2] = fcport->d_id.b.domain;
 	tsk->vp_index = fcport->vha->vp_idx;
 
-	if (flags == TCF_LUN_RESET) {
+	if (flags & (TCF_LUN_RESET | TCF_ABORT_TASK_SET|
+	    TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA)) {
 		int_to_scsilun(lun, &tsk->lun);
 		host_to_fcp_swap((uint8_t *)&tsk->lun,
 			sizeof(tsk->lun));
-- 
2.23.1

[PATCH v2 2/7] qla2xxx: Fix task management cmd failure

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

Task management cmd failed with status 30h which means
FW is not able to finish processing one task management
before another task management for the same lun.
Hence add wait for completion of marker to space it out.

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304271802.uCZfwQC1-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
v2:
- Fix warning reported by kernel robot.

 drivers/scsi/qla2xxx/qla_def.h  |   6 ++
 drivers/scsi/qla2xxx/qla_init.c | 102 +++++++++++++++++++++++++++-----
 drivers/scsi/qla2xxx/qla_iocb.c |  28 +++++++--
 drivers/scsi/qla2xxx/qla_isr.c  |  26 +++++++-
 4 files changed, 139 insertions(+), 23 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index d59e94ae0db4..0437e0150a50 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -472,6 +472,7 @@ struct tmf_arg {
 	struct scsi_qla_host *vha;
 	u64 lun;
 	u32 flags;
+	uint8_t modifier;
 };
 
 struct els_logo_payload {
@@ -553,6 +554,10 @@ struct srb_iocb {
 			uint32_t data;
 			struct completion comp;
 			__le16 comp_status;
+
+			uint8_t modifier;
+			uint8_t vp_index;
+			uint16_t loop_id;
 		} tmf;
 		struct {
 #define SRB_FXDISC_REQ_DMA_VALID	BIT_0
@@ -656,6 +661,7 @@ struct srb_iocb {
 #define SRB_SA_UPDATE	25
 #define SRB_ELS_CMD_HST_NOLOGIN 26
 #define SRB_SA_REPLACE	27
+#define SRB_MARKER	28
 
 struct qla_els_pt_arg {
 	u8 els_opcode;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 035d1984e2bd..2402b1402e0d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2013,6 +2013,80 @@ qla2x00_tmf_iocb_timeout(void *data)
 	}
 }
 
+static void qla_marker_sp_done(srb_t *sp, int res)
+{
+	struct srb_iocb *tmf = &sp->u.iocb_cmd;
+
+	if (res != QLA_SUCCESS)
+		ql_dbg(ql_dbg_taskm, sp->vha, 0x8004,
+		    "Async-marker fail hdl=%x portid=%06x ctrl=%x lun=%lld qp=%d.\n",
+		    sp->handle, sp->fcport->d_id.b24, sp->u.iocb_cmd.u.tmf.flags,
+		    sp->u.iocb_cmd.u.tmf.lun, sp->qpair->id);
+
+	complete(&tmf->u.tmf.comp);
+}
+
+#define  START_SP_W_RETRIES(_sp, _rval) \
+{\
+	int cnt = 5; \
+	do { \
+		_rval = qla2x00_start_sp(_sp); \
+		if (_rval == EAGAIN) \
+			msleep(1); \
+		else \
+			break; \
+		cnt--; \
+	} while (cnt); \
+}
+
+static int
+qla26xx_marker(struct tmf_arg *arg)
+{
+	struct scsi_qla_host *vha = arg->vha;
+	struct srb_iocb *tm_iocb;
+	srb_t *sp;
+	int rval = QLA_FUNCTION_FAILED;
+	fc_port_t *fcport = arg->fcport;
+
+	/* ref: INIT */
+	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
+	if (!sp)
+		goto done;
+
+	sp->type = SRB_MARKER;
+	sp->name = "marker";
+	qla2x00_init_async_sp(sp, qla2x00_get_async_timeout(vha), qla_marker_sp_done);
+	sp->u.iocb_cmd.timeout = qla2x00_tmf_iocb_timeout;
+
+	tm_iocb = &sp->u.iocb_cmd;
+	init_completion(&tm_iocb->u.tmf.comp);
+	tm_iocb->u.tmf.modifier = arg->modifier;
+	tm_iocb->u.tmf.lun = arg->lun;
+	tm_iocb->u.tmf.loop_id = fcport->loop_id;
+	tm_iocb->u.tmf.vp_index = vha->vp_idx;
+
+	START_SP_W_RETRIES(sp, rval);
+
+	ql_dbg(ql_dbg_taskm, vha, 0x8006,
+	    "Async-marker hdl=%x loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d rval %d.\n",
+	    sp->handle, fcport->loop_id, fcport->d_id.b24,
+	    arg->modifier, arg->lun, sp->qpair->id, rval);
+
+	if (rval != QLA_SUCCESS) {
+		ql_log(ql_log_warn, vha, 0x8031,
+		    "Marker IOCB failed (%x).\n", rval);
+		goto done_free_sp;
+	}
+
+	wait_for_completion(&tm_iocb->u.tmf.comp);
+
+done_free_sp:
+	/* ref: INIT */
+	kref_put(&sp->cmd_kref, qla2x00_sp_release);
+done:
+	return rval;
+}
+
 static void qla2x00_tmf_sp_done(srb_t *sp, int res)
 {
 	struct srb_iocb *tmf = &sp->u.iocb_cmd;
@@ -2026,7 +2100,6 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 	struct scsi_qla_host *vha = arg->vha;
 	struct srb_iocb *tm_iocb;
 	srb_t *sp;
-	unsigned long flags;
 	int rval = QLA_FUNCTION_FAILED;
 
 	fc_port_t *fcport = arg->fcport;
@@ -2048,11 +2121,12 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 	tm_iocb->u.tmf.flags = arg->flags;
 	tm_iocb->u.tmf.lun = arg->lun;
 
-	rval = qla2x00_start_sp(sp);
+	START_SP_W_RETRIES(sp, rval);
+
 	ql_dbg(ql_dbg_taskm, vha, 0x802f,
-	    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x ctrl=%x.\n",
-	    sp->handle, fcport->loop_id, fcport->d_id.b.domain,
-	    fcport->d_id.b.area, fcport->d_id.b.al_pa, arg->flags);
+	    "Async-tmf hdl=%x loop-id=%x portid=%06x ctrl=%x lun=%lld qp=%d rval=%x.\n",
+	    sp->handle, fcport->loop_id, fcport->d_id.b24,
+	    arg->flags, arg->lun, sp->qpair->id, rval);
 
 	if (rval != QLA_SUCCESS)
 		goto done_free_sp;
@@ -2065,17 +2139,8 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 		    "TM IOCB failed (%x).\n", rval);
 	}
 
-	if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw)) {
-		flags = tm_iocb->u.tmf.flags;
-		if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET|
-			TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
-			flags = MK_SYNC_ID_LUN;
-		else
-			flags = MK_SYNC_ID;
-
-		qla2x00_marker(vha, sp->qpair,
-		    sp->fcport->loop_id, arg->lun, flags);
-	}
+	if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw))
+		rval = qla26xx_marker(arg);
 
 done_free_sp:
 	/* ref: INIT */
@@ -2099,6 +2164,11 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 	a.fcport = fcport;
 	a.lun = lun;
 
+	if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
+		a.modifier = MK_SYNC_ID_LUN;
+	else
+		a.modifier = MK_SYNC_ID;
+
 	if (vha->hw->mqenable) {
 		for (i = 0; i < vha->hw->num_qpairs; i++) {
 			qpair = vha->hw->queue_pair_map[i];
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index b02039601cc0..6acfdcc48b16 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -522,21 +522,25 @@ __qla2x00_marker(struct scsi_qla_host *vha, struct qla_qpair *qpair,
 		return (QLA_FUNCTION_FAILED);
 	}
 
+	mrk24 = (struct mrk_entry_24xx *)mrk;
+
 	mrk->entry_type = MARKER_TYPE;
 	mrk->modifier = type;
 	if (type != MK_SYNC_ALL) {
 		if (IS_FWI2_CAPABLE(ha)) {
-			mrk24 = (struct mrk_entry_24xx *) mrk;
 			mrk24->nport_handle = cpu_to_le16(loop_id);
 			int_to_scsilun(lun, (struct scsi_lun *)&mrk24->lun);
 			host_to_fcp_swap(mrk24->lun, sizeof(mrk24->lun));
 			mrk24->vp_index = vha->vp_idx;
-			mrk24->handle = make_handle(req->id, mrk24->handle);
 		} else {
 			SET_TARGET_ID(ha, mrk->target, loop_id);
 			mrk->lun = cpu_to_le16((uint16_t)lun);
 		}
 	}
+
+	if (IS_FWI2_CAPABLE(ha))
+		mrk24->handle = QLA_SKIP_HANDLE;
+
 	wmb();
 
 	qla2x00_start_iocbs(vha, req);
@@ -3853,9 +3857,9 @@ static int qla_get_iocbs_resource(struct srb *sp)
 	case SRB_NACK_LOGO:
 	case SRB_LOGOUT_CMD:
 	case SRB_CTRL_VP:
-		push_it_through = true;
-		fallthrough;
+	case SRB_MARKER:
 	default:
+		push_it_through = true;
 		get_exch = false;
 	}
 
@@ -3871,6 +3875,19 @@ static int qla_get_iocbs_resource(struct srb *sp)
 	return qla_get_fw_resources(sp->qpair, &sp->iores);
 }
 
+static void
+qla_marker_iocb(srb_t *sp, struct mrk_entry_24xx *mrk)
+{
+	mrk->entry_type = MARKER_TYPE;
+	mrk->modifier = sp->u.iocb_cmd.u.tmf.modifier;
+	if (sp->u.iocb_cmd.u.tmf.modifier != MK_SYNC_ALL) {
+		mrk->nport_handle = cpu_to_le16(sp->u.iocb_cmd.u.tmf.loop_id);
+		int_to_scsilun(sp->u.iocb_cmd.u.tmf.lun, (struct scsi_lun *)&mrk->lun);
+		host_to_fcp_swap(mrk->lun, sizeof(mrk->lun));
+		mrk->vp_index = sp->u.iocb_cmd.u.tmf.vp_index;
+	}
+}
+
 int
 qla2x00_start_sp(srb_t *sp)
 {
@@ -3974,6 +3991,9 @@ qla2x00_start_sp(srb_t *sp)
 	case SRB_SA_REPLACE:
 		qla24xx_sa_replace_iocb(sp, pkt);
 		break;
+	case SRB_MARKER:
+		qla_marker_iocb(sp, pkt);
+		break;
 	default:
 		break;
 	}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 71feda2cdb63..f3107508cf12 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3750,6 +3750,28 @@ static int qla_chk_cont_iocb_avail(struct scsi_qla_host *vha,
 	return rc;
 }
 
+static void qla_marker_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
+	struct mrk_entry_24xx *pkt)
+{
+	const char func[] = "MRK-IOCB";
+	srb_t *sp;
+	int res = QLA_SUCCESS;
+
+	if (!IS_FWI2_CAPABLE(vha->hw))
+		return;
+
+	sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
+	if (!sp)
+		return;
+
+	if (pkt->entry_status) {
+		ql_dbg(ql_dbg_taskm, vha, 0x8025, "marker failure.\n");
+		res = QLA_COMMAND_ERROR;
+	}
+	sp->u.iocb_cmd.u.tmf.data = res;
+	sp->done(sp, res);
+}
+
 /**
  * qla24xx_process_response_queue() - Process response queue entries.
  * @vha: SCSI driver HA context
@@ -3863,9 +3885,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
 					(struct nack_to_isp *)pkt);
 			break;
 		case MARKER_TYPE:
-			/* Do nothing in this case, this check is to prevent it
-			 * from falling into default case
-			 */
+			qla_marker_iocb_entry(vha, rsp->req, (struct mrk_entry_24xx *)pkt);
 			break;
 		case ABORT_IOCB_TYPE:
 			qla24xx_abort_iocb_entry(vha, rsp->req,
-- 
2.23.1

[PATCH v2 3/7] qla2xxx: Fix task management cmd fail due to unavailable resource

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

Task management command failed with status 2Ch which is
a result of too many task management commands sent
to the same target. Hence limit task management commands
to 8 per target.

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304271952.NKNmoFzv-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
v2:
- Fix warning reported by kernel robot.

 drivers/scsi/qla2xxx/qla_def.h  |  3 ++
 drivers/scsi/qla2xxx/qla_init.c | 63 ++++++++++++++++++++++++++++++---
 2 files changed, 61 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 0437e0150a50..0971150953a9 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2543,6 +2543,7 @@ enum rscn_addr_format {
 typedef struct fc_port {
 	struct list_head list;
 	struct scsi_qla_host *vha;
+	struct list_head tmf_pending;
 
 	unsigned int conf_compl_supported:1;
 	unsigned int deleted:2;
@@ -2563,6 +2564,8 @@ typedef struct fc_port {
 	unsigned int do_prli_nvme:1;
 
 	uint8_t nvme_flag;
+	uint8_t active_tmf;
+#define MAX_ACTIVE_TMF 8
 
 	uint8_t node_name[WWN_SIZE];
 	uint8_t port_name[WWN_SIZE];
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2402b1402e0d..17649cf9c39d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2149,6 +2149,54 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 	return rval;
 }
 
+static void qla_put_tmf(fc_port_t *fcport)
+{
+	struct scsi_qla_host *vha = fcport->vha;
+	struct qla_hw_data *ha = vha->hw;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+	fcport->active_tmf--;
+	spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+}
+
+static
+int qla_get_tmf(fc_port_t *fcport)
+{
+	struct scsi_qla_host *vha = fcport->vha;
+	struct qla_hw_data *ha = vha->hw;
+	unsigned long flags;
+	int rc = 0;
+	LIST_HEAD(tmf_elem);
+
+	spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+	list_add_tail(&tmf_elem, &fcport->tmf_pending);
+
+	while (fcport->active_tmf >= MAX_ACTIVE_TMF) {
+		spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+
+		msleep(1);
+
+		spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+		if (fcport->deleted) {
+			rc = EIO;
+			break;
+		}
+		if (fcport->active_tmf < MAX_ACTIVE_TMF &&
+		    list_is_first(&tmf_elem, &fcport->tmf_pending))
+			break;
+	}
+
+	list_del(&tmf_elem);
+
+	if (!rc)
+		fcport->active_tmf++;
+
+	spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+
+	return rc;
+}
+
 int
 qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 		     uint32_t tag)
@@ -2156,18 +2204,19 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 	struct scsi_qla_host *vha = fcport->vha;
 	struct qla_qpair *qpair;
 	struct tmf_arg a;
-	struct completion comp;
 	int i, rval;
 
-	init_completion(&comp);
 	a.vha = fcport->vha;
 	a.fcport = fcport;
 	a.lun = lun;
-
-	if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
+	if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA)) {
 		a.modifier = MK_SYNC_ID_LUN;
-	else
+
+		if (qla_get_tmf(fcport))
+			return QLA_FUNCTION_FAILED;
+	} else {
 		a.modifier = MK_SYNC_ID;
+	}
 
 	if (vha->hw->mqenable) {
 		for (i = 0; i < vha->hw->num_qpairs; i++) {
@@ -2186,6 +2235,9 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 	a.flags = flags;
 	rval = __qla2x00_async_tm_cmd(&a);
 
+	if (a.modifier == MK_SYNC_ID_LUN)
+		qla_put_tmf(fcport);
+
 	return rval;
 }
 
@@ -5400,6 +5452,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
 	INIT_WORK(&fcport->reg_work, qla_register_fcport_fn);
 	INIT_LIST_HEAD(&fcport->gnl_entry);
 	INIT_LIST_HEAD(&fcport->list);
+	INIT_LIST_HEAD(&fcport->tmf_pending);
 
 	INIT_LIST_HEAD(&fcport->sess_cmd_list);
 	spin_lock_init(&fcport->sess_cmd_lock);
-- 
2.23.1

[PATCH v2 4/7] qla2xxx: Fix hang in task management

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

Task management command hangs where a side
band chip reset failed to nudge the TMF
from it's current send path.

Add additional error check to block TMF
from entering during chip reset and along
the TMF path to cause it to bail out, skip
over abort of marker.

Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
 drivers/scsi/qla2xxx/qla_def.h  |  4 +++
 drivers/scsi/qla2xxx/qla_init.c | 60 +++++++++++++++++++++++++++++++--
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 0971150953a9..3e0be0136cad 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -5516,4 +5516,8 @@ struct ql_vnd_tgt_stats_resp {
 	_fp->disc_state, _fp->scan_state, _fp->loop_id, _fp->deleted, \
 	_fp->flags
 
+#define TMF_NOT_READY(_fcport) \
+	(!_fcport || IS_SESSION_DELETED(_fcport) || atomic_read(&_fcport->state) != FCS_ONLINE || \
+	!_fcport->vha->hw->flags.fw_started)
+
 #endif
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 17649cf9c39d..b61597d6882c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1996,6 +1996,11 @@ qla2x00_tmf_iocb_timeout(void *data)
 	int rc, h;
 	unsigned long flags;
 
+	if (sp->type == SRB_MARKER) {
+		complete(&tmf->u.tmf.comp);
+		return;
+	}
+
 	rc = qla24xx_async_abort_cmd(sp, false);
 	if (rc) {
 		spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
@@ -2023,6 +2028,7 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 		    sp->handle, sp->fcport->d_id.b24, sp->u.iocb_cmd.u.tmf.flags,
 		    sp->u.iocb_cmd.u.tmf.lun, sp->qpair->id);
 
+	sp->u.iocb_cmd.u.tmf.data = res;
 	complete(&tmf->u.tmf.comp);
 }
 
@@ -2039,6 +2045,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 	} while (cnt); \
 }
 
+/**
+ * qla26xx_marker: send marker IOCB and wait for the completion of it.
+ * @arg: pointer to argument list.
+ *    It is assume caller will provide an fcport pointer and modifier
+ */
 static int
 qla26xx_marker(struct tmf_arg *arg)
 {
@@ -2048,6 +2059,14 @@ qla26xx_marker(struct tmf_arg *arg)
 	int rval = QLA_FUNCTION_FAILED;
 	fc_port_t *fcport = arg->fcport;
 
+	if (TMF_NOT_READY(arg->fcport)) {
+		ql_dbg(ql_dbg_taskm, vha, 0x8039,
+		    "FC port not ready for marker loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
+		    fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, arg->qpair->id);
+		return QLA_SUSPENDED;
+	}
+
 	/* ref: INIT */
 	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
 	if (!sp)
@@ -2074,11 +2093,19 @@ qla26xx_marker(struct tmf_arg *arg)
 
 	if (rval != QLA_SUCCESS) {
 		ql_log(ql_log_warn, vha, 0x8031,
-		    "Marker IOCB failed (%x).\n", rval);
+		    "Marker IOCB send failure (%x).\n", rval);
 		goto done_free_sp;
 	}
 
 	wait_for_completion(&tm_iocb->u.tmf.comp);
+	rval = tm_iocb->u.tmf.data;
+
+	if (rval != QLA_SUCCESS) {
+		ql_log(ql_log_warn, vha, 0x8019,
+		    "Marker failed hdl=%x loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d rval %d.\n",
+		    sp->handle, fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, sp->qpair->id, rval);
+	}
 
 done_free_sp:
 	/* ref: INIT */
@@ -2091,6 +2118,8 @@ static void qla2x00_tmf_sp_done(srb_t *sp, int res)
 {
 	struct srb_iocb *tmf = &sp->u.iocb_cmd;
 
+	if (res)
+		tmf->u.tmf.data = res;
 	complete(&tmf->u.tmf.comp);
 }
 
@@ -2104,6 +2133,14 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
 
 	fc_port_t *fcport = arg->fcport;
 
+	if (TMF_NOT_READY(arg->fcport)) {
+		ql_dbg(ql_dbg_taskm, vha, 0x8032,
+		    "FC port not ready for TM command loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
+		    fcport->loop_id, fcport->d_id.b24,
+		    arg->modifier, arg->lun, arg->qpair->id);
+		return QLA_SUSPENDED;
+	}
+
 	/* ref: INIT */
 	sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
 	if (!sp)
@@ -2178,7 +2215,9 @@ int qla_get_tmf(fc_port_t *fcport)
 		msleep(1);
 
 		spin_lock_irqsave(&ha->tgt.sess_lock, flags);
-		if (fcport->deleted) {
+		if (TMF_NOT_READY(fcport)) {
+			ql_log(ql_log_warn, vha, 0x802c,
+			    "Unable to acquire TM resource due to disruption.\n");
 			rc = EIO;
 			break;
 		}
@@ -2204,7 +2243,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 	struct scsi_qla_host *vha = fcport->vha;
 	struct qla_qpair *qpair;
 	struct tmf_arg a;
-	int i, rval;
+	int i, rval = QLA_SUCCESS;
+
+	if (TMF_NOT_READY(fcport))
+		return QLA_SUSPENDED;
 
 	a.vha = fcport->vha;
 	a.fcport = fcport;
@@ -2223,6 +2265,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 			qpair = vha->hw->queue_pair_map[i];
 			if (!qpair)
 				continue;
+
+			if (TMF_NOT_READY(fcport)) {
+				ql_log(ql_log_warn, vha, 0x8026,
+				    "Unable to send TM due to disruption.\n");
+				rval = QLA_SUSPENDED;
+				break;
+			}
+
 			a.qpair = qpair;
 			a.flags = flags|TCF_NOTMCMD_TO_TARGET;
 			rval = __qla2x00_async_tm_cmd(&a);
@@ -2231,10 +2281,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
 		}
 	}
 
+	if (rval)
+		goto bailout;
+
 	a.qpair = vha->hw->base_qpair;
 	a.flags = flags;
 	rval = __qla2x00_async_tm_cmd(&a);
 
+bailout:
 	if (a.modifier == MK_SYNC_ID_LUN)
 		qla_put_tmf(fcport);
 
-- 
2.23.1

[PATCH v2 5/7] qla2xxx: Fix mem access after free

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

System crash, where driver is accessing scsi layer's
memory (scsi_cmnd->device->host) to search for a well known internal
pointer (vha). The scsi_cmnd was released back to upper layer which
could be freed, but the driver is still accessing it.

7 [ffffa8e8d2c3f8d0] page_fault at ffffffff86c010fe
  [exception RIP: __qla2x00_eh_wait_for_pending_commands+240]
  RIP: ffffffffc0642350  RSP: ffffa8e8d2c3f988  RFLAGS: 00010286
  RAX: 0000000000000165  RBX: 0000000000000002  RCX: 00000000000036d8
  RDX: 0000000000000000  RSI: ffff9c5c56535188  RDI: 0000000000000286
  RBP: ffff9c5bf7aa4a58   R8: ffff9c589aecdb70   R9: 00000000000003d1
  R10: 0000000000000001  R11: 0000000000380000 R12: ffff9c5c5392bc78
  R13: ffff9c57044ff5c0 R14: ffff9c56b5a3aa00  R15: 00000000000006db
  ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
8 [ffffa8e8d2c3f9c8] qla2x00_eh_wait_for_pending_commands at ffffffffc0646dd5 [qla2xxx]
9 [ffffa8e8d2c3fa00] __qla2x00_async_tm_cmd at ffffffffc0658094 [qla2xxx]

Remove access of freed memory. Currently the driver was checking to see if
scsi_done was called by seeing if the sp->type has changed. Instead,
check to see if the command has left the  oustanding_cmds[] array as
sign of scsi_done was called.

Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
 drivers/scsi/qla2xxx/qla_isr.c |  38 ++++++++--
 drivers/scsi/qla2xxx/qla_os.c  | 130 ++++++++++++++++-----------------
 2 files changed, 95 insertions(+), 73 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index f3107508cf12..a07c010b0843 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1862,9 +1862,9 @@ qla2x00_process_completed_request(struct scsi_qla_host *vha,
 	}
 }
 
-srb_t *
-qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
-    struct req_que *req, void *iocb)
+static srb_t *
+qla_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
+		       struct req_que *req, void *iocb, u16 *ret_index)
 {
 	struct qla_hw_data *ha = vha->hw;
 	sts_entry_t *pkt = iocb;
@@ -1899,12 +1899,25 @@ qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
 		return NULL;
 	}
 
-	req->outstanding_cmds[index] = NULL;
-
+	*ret_index = index;
 	qla_put_fw_resources(sp->qpair, &sp->iores);
 	return sp;
 }
 
+srb_t *
+qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
+			   struct req_que *req, void *iocb)
+{
+	uint16_t index;
+	srb_t *sp;
+
+	sp = qla_get_sp_from_handle(vha, func, req, iocb, &index);
+	if (sp)
+		req->outstanding_cmds[index] = NULL;
+
+	return sp;
+}
+
 static void
 qla2x00_mbx_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
     struct mbx_entry *mbx)
@@ -3237,13 +3250,13 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 		return;
 	}
 
-	req->outstanding_cmds[handle] = NULL;
 	cp = GET_CMD_SP(sp);
 	if (cp == NULL) {
 		ql_dbg(ql_dbg_io, vha, 0x3018,
 		    "Command already returned (0x%x/%p).\n",
 		    sts->handle, sp);
 
+		req->outstanding_cmds[handle] = NULL;
 		return;
 	}
 
@@ -3514,6 +3527,9 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 
 	if (rsp->status_srb == NULL)
 		sp->done(sp, res);
+
+	/* for io's, clearing of outstanding_cmds[handle] means scsi_done was called */
+	req->outstanding_cmds[handle] = NULL;
 }
 
 /**
@@ -3590,6 +3606,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 	uint16_t que = MSW(pkt->handle);
 	struct req_que *req = NULL;
 	int res = DID_ERROR << 16;
+	u16 index;
 
 	ql_dbg(ql_dbg_async, vha, 0x502a,
 	    "iocb type %xh with error status %xh, handle %xh, rspq id %d\n",
@@ -3608,7 +3625,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 
 	switch (pkt->entry_type) {
 	case NOTIFY_ACK_TYPE:
-	case STATUS_TYPE:
 	case STATUS_CONT_TYPE:
 	case LOGINOUT_PORT_IOCB_TYPE:
 	case CT_IOCB_TYPE:
@@ -3628,6 +3644,14 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
 	case CTIO_TYPE7:
 	case CTIO_CRC2:
 		return 1;
+	case STATUS_TYPE:
+		sp = qla_get_sp_from_handle(vha, func, req, pkt, &index);
+		if (sp) {
+			sp->done(sp, res);
+			req->outstanding_cmds[index] = NULL;
+			return 0;
+		}
+		break;
 	}
 fatal:
 	ql_log(ql_log_warn, vha, 0x5030,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index d0cdbfe771a9..60734c569401 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1078,43 +1078,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
 	return 0;
 }
 
-/*
- * qla2x00_eh_wait_on_command
- *    Waits for the command to be returned by the Firmware for some
- *    max time.
- *
- * Input:
- *    cmd = Scsi Command to wait on.
- *
- * Return:
- *    Completed in time : QLA_SUCCESS
- *    Did not complete in time : QLA_FUNCTION_FAILED
- */
-static int
-qla2x00_eh_wait_on_command(struct scsi_cmnd *cmd)
-{
-#define ABORT_POLLING_PERIOD	1000
-#define ABORT_WAIT_ITER		((2 * 1000) / (ABORT_POLLING_PERIOD))
-	unsigned long wait_iter = ABORT_WAIT_ITER;
-	scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-	struct qla_hw_data *ha = vha->hw;
-	srb_t *sp = scsi_cmd_priv(cmd);
-	int ret = QLA_SUCCESS;
-
-	if (unlikely(pci_channel_offline(ha->pdev)) || ha->flags.eeh_busy) {
-		ql_dbg(ql_dbg_taskm, vha, 0x8005,
-		    "Return:eh_wait.\n");
-		return ret;
-	}
-
-	while (sp->type && wait_iter--)
-		msleep(ABORT_POLLING_PERIOD);
-	if (sp->type)
-		ret = QLA_FUNCTION_FAILED;
-
-	return ret;
-}
-
 /*
  * qla2x00_wait_for_hba_online
  *    Wait till the HBA is online after going through
@@ -1365,6 +1328,9 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 	return ret;
 }
 
+#define ABORT_POLLING_PERIOD	1000
+#define ABORT_WAIT_ITER		((2 * 1000) / (ABORT_POLLING_PERIOD))
+
 /*
  * Returns: QLA_SUCCESS or QLA_FUNCTION_FAILED.
  */
@@ -1378,41 +1344,73 @@ __qla2x00_eh_wait_for_pending_commands(struct qla_qpair *qpair, unsigned int t,
 	struct req_que *req = qpair->req;
 	srb_t *sp;
 	struct scsi_cmnd *cmd;
+	unsigned long wait_iter = ABORT_WAIT_ITER;
+	bool found;
+	struct qla_hw_data *ha = vha->hw;
 
 	status = QLA_SUCCESS;
 
-	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
-	for (cnt = 1; status == QLA_SUCCESS &&
-		cnt < req->num_outstanding_cmds; cnt++) {
-		sp = req->outstanding_cmds[cnt];
-		if (!sp)
-			continue;
-		if (sp->type != SRB_SCSI_CMD)
-			continue;
-		if (vha->vp_idx != sp->vha->vp_idx)
-			continue;
-		match = 0;
-		cmd = GET_CMD_SP(sp);
-		switch (type) {
-		case WAIT_HOST:
-			match = 1;
-			break;
-		case WAIT_TARGET:
-			match = cmd->device->id == t;
-			break;
-		case WAIT_LUN:
-			match = (cmd->device->id == t &&
-				cmd->device->lun == l);
-			break;
-		}
-		if (!match)
-			continue;
+	while (wait_iter--) {
+		found = false;
 
-		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
-		status = qla2x00_eh_wait_on_command(cmd);
 		spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+		for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
+			sp = req->outstanding_cmds[cnt];
+			if (!sp)
+				continue;
+			if (sp->type != SRB_SCSI_CMD)
+				continue;
+			if (vha->vp_idx != sp->vha->vp_idx)
+				continue;
+			match = 0;
+			cmd = GET_CMD_SP(sp);
+			switch (type) {
+			case WAIT_HOST:
+				match = 1;
+				break;
+			case WAIT_TARGET:
+				if (sp->fcport)
+					match = sp->fcport->d_id.b24 == t;
+				else
+					match = 0;
+				break;
+			case WAIT_LUN:
+				if (sp->fcport)
+					match = (sp->fcport->d_id.b24 == t &&
+						cmd->device->lun == l);
+				else
+					match = 0;
+				break;
+			}
+			if (!match)
+				continue;
+
+			spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+			if (unlikely(pci_channel_offline(ha->pdev)) ||
+			    ha->flags.eeh_busy) {
+				ql_dbg(ql_dbg_taskm, vha, 0x8005,
+				    "Return:eh_wait.\n");
+				return status;
+			}
+
+			/*
+			 * SRB_SCSI_CMD is still in the outstanding_cmds array.
+			 * it means scsi_done has not called. Wait for it to
+			 * clear from outstanding_cmds.
+			 */
+			msleep(ABORT_POLLING_PERIOD);
+			spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+			found = true;
+		}
+		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+		if (!found)
+			break;
 	}
-	spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+	if (!wait_iter && found)
+		status = QLA_FUNCTION_FAILED;
 
 	return status;
 }
-- 
2.23.1

[PATCH v2 6/7] qla2xxx: Wait for io return on terminate rport

[Nilesh Javali]

From: Quinn Tran <qutran@marvell.com>

System crash due to use after free.
Current code allows terminate_rport_io to exit before making
sure all IOs has returned. For FCP-2 device, IO's can hang
on in HW because driver has not tear down the session in FW at
first sign of cable pull. When dev_loss_tmo timer pops,
terminate_rport_io is called and upper layer is about to
free various resources. Terminate_rport_io trigger qla to do
the final cleanup, but the cleanup might not be fast enough where it
leave qla still holding on to the same resource.

Wait for IO's to return to upper layer before resources are freed.

Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
 drivers/scsi/qla2xxx/qla_attr.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 70cfc94c3d43..b00222459607 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2750,6 +2750,7 @@ static void
 qla2x00_terminate_rport_io(struct fc_rport *rport)
 {
 	fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
+	scsi_qla_host_t *vha;
 
 	if (!fcport)
 		return;
@@ -2759,9 +2760,12 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 
 	if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
 		return;
+	vha = fcport->vha;
 
 	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
 		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
+		qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
+			0, WAIT_TARGET);
 		return;
 	}
 	/*
@@ -2786,6 +2790,15 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 			qla2x00_port_logout(fcport->vha, fcport);
 		}
 	}
+
+	/* check for any straggling io left behind */
+	if (qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, 0, WAIT_TARGET)) {
+		ql_log(ql_log_warn, vha, 0x300b,
+		       "IO not return.  Resetting. \n");
+		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+		qla2xxx_wake_dpc(vha);
+		qla2x00_wait_for_chip_reset(vha);
+	}
 }
 
 static int
-- 
2.23.1

[PATCH v2 7/7] qla2xxx: Update version to 10.02.08.300-k

[Nilesh Javali]

Signed-off-by: Nilesh Javali <njavali@marvell.com>
---
 drivers/scsi/qla2xxx/qla_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 42d69d89834f..4d6f06fb156b 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -6,9 +6,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "10.02.08.200-k"
+#define QLA2XXX_VERSION      "10.02.08.300-k"
 
 #define QLA_DRIVER_MAJOR_VER	10
 #define QLA_DRIVER_MINOR_VER	2
 #define QLA_DRIVER_PATCH_VER	8
-#define QLA_DRIVER_BETA_VER	200
+#define QLA_DRIVER_BETA_VER	300
-- 
2.23.1

Re: [PATCH v2 1/7] qla2xxx: Multi-que support for TMF

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> Add queue flush for task management command, before
> placing it on the wire.
> Do IO flush for all Request Q's.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Link: https://lore.kernel.org/oe-kbuild-all/202304271702.GpIL391S-lkp@intel.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> v2:
> - Fix warning reported by kernel robot.
> 
> drivers/scsi/qla2xxx/qla_def.h  |  8 ++++
> drivers/scsi/qla2xxx/qla_gbl.h  |  2 +-
> drivers/scsi/qla2xxx/qla_init.c | 69 ++++++++++++++++++++++++++-------
> drivers/scsi/qla2xxx/qla_iocb.c |  5 ++-
> 4 files changed, 66 insertions(+), 18 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
> index ec0e987b71fa..d59e94ae0db4 100644
> --- a/drivers/scsi/qla2xxx/qla_def.h
> +++ b/drivers/scsi/qla2xxx/qla_def.h
> @@ -466,6 +466,14 @@ static inline be_id_t port_id_to_be_id(port_id_t port_id)
> return res;
> }
> 
> +struct tmf_arg {
> + struct qla_qpair *qpair;
> + struct fc_port *fcport;
> + struct scsi_qla_host *vha;
> + u64 lun;
> + u32 flags;
> +};
> +
> struct els_logo_payload {
> uint8_t opcode;
> uint8_t rsvd[3];
> diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
> index 9aba07c7bde4..ef11ce46381d 100644
> --- a/drivers/scsi/qla2xxx/qla_gbl.h
> +++ b/drivers/scsi/qla2xxx/qla_gbl.h
> @@ -69,7 +69,7 @@ extern int qla2x00_async_logout(struct scsi_qla_host *, fc_port_t *);
> extern int qla2x00_async_prlo(struct scsi_qla_host *, fc_port_t *);
> extern int qla2x00_async_adisc(struct scsi_qla_host *, fc_port_t *,
>     uint16_t *);
> -extern int qla2x00_async_tm_cmd(fc_port_t *, uint32_t, uint32_t, uint32_t);
> +extern int qla2x00_async_tm_cmd(fc_port_t *, uint32_t, uint64_t, uint32_t);
> struct qla_work_evt *qla2x00_alloc_work(struct scsi_qla_host *,
>     enum qla_work_type);
> extern int qla24xx_async_gnl(struct scsi_qla_host *, fc_port_t *);
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index ec0423ec6681..035d1984e2bd 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -2020,17 +2020,19 @@ static void qla2x00_tmf_sp_done(srb_t *sp, int res)
> complete(&tmf->u.tmf.comp);
> }
> 
> -int
> -qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
> - uint32_t tag)
> +static int
> +__qla2x00_async_tm_cmd(struct tmf_arg *arg)
> {
> - struct scsi_qla_host *vha = fcport->vha;
> + struct scsi_qla_host *vha = arg->vha;
> struct srb_iocb *tm_iocb;
> srb_t *sp;
> + unsigned long flags;
> int rval = QLA_FUNCTION_FAILED;
> 
> + fc_port_t *fcport = arg->fcport;
> +
> /* ref: INIT */
> - sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
> + sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
> if (!sp)
> goto done;
> 
> @@ -2043,15 +2045,15 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
> 
> tm_iocb = &sp->u.iocb_cmd;
> init_completion(&tm_iocb->u.tmf.comp);
> - tm_iocb->u.tmf.flags = flags;
> - tm_iocb->u.tmf.lun = lun;
> + tm_iocb->u.tmf.flags = arg->flags;
> + tm_iocb->u.tmf.lun = arg->lun;
> 
> + rval = qla2x00_start_sp(sp);
> ql_dbg(ql_dbg_taskm, vha, 0x802f,
> -    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x.\n",
> +    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x ctrl=%x.\n",
>    sp->handle, fcport->loop_id, fcport->d_id.b.domain,
> -    fcport->d_id.b.area, fcport->d_id.b.al_pa);
> +    fcport->d_id.b.area, fcport->d_id.b.al_pa, arg->flags);
> 
> - rval = qla2x00_start_sp(sp);
> if (rval != QLA_SUCCESS)
> goto done_free_sp;
> wait_for_completion(&tm_iocb->u.tmf.comp);
> @@ -2065,12 +2067,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
> 
> if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw)) {
> flags = tm_iocb->u.tmf.flags;
> - lun = (uint16_t)tm_iocb->u.tmf.lun;
> + if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET|
> + TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
> + flags = MK_SYNC_ID_LUN;
> + else
> + flags = MK_SYNC_ID;
> 
> - /* Issue Marker IOCB */
> - qla2x00_marker(vha, vha->hw->base_qpair,
> -    fcport->loop_id, lun,
> -    flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
> + qla2x00_marker(vha, sp->qpair,
> +    sp->fcport->loop_id, arg->lun, flags);
> }
> 
> done_free_sp:
> @@ -2080,6 +2084,41 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
> return rval;
> }
> 
> +int
> +qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> +     uint32_t tag)
> +{
> + struct scsi_qla_host *vha = fcport->vha;
> + struct qla_qpair *qpair;
> + struct tmf_arg a;
> + struct completion comp;
> + int i, rval;
> +
> + init_completion(&comp);
> + a.vha = fcport->vha;
> + a.fcport = fcport;
> + a.lun = lun;
> +
> + if (vha->hw->mqenable) {
> + for (i = 0; i < vha->hw->num_qpairs; i++) {
> + qpair = vha->hw->queue_pair_map[i];
> + if (!qpair)
> + continue;
> + a.qpair = qpair;
> + a.flags = flags|TCF_NOTMCMD_TO_TARGET;
> + rval = __qla2x00_async_tm_cmd(&a);
> + if (rval)
> + break;
> + }
> + }
> +
> + a.qpair = vha->hw->base_qpair;
> + a.flags = flags;
> + rval = __qla2x00_async_tm_cmd(&a);
> +
> + return rval;
> +}
> +
> int
> qla24xx_async_abort_command(srb_t *sp)
> {
> diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
> index b9b3e6f80ea9..b02039601cc0 100644
> --- a/drivers/scsi/qla2xxx/qla_iocb.c
> +++ b/drivers/scsi/qla2xxx/qla_iocb.c
> @@ -2541,7 +2541,7 @@ qla24xx_tm_iocb(srb_t *sp, struct tsk_mgmt_entry *tsk)
> scsi_qla_host_t *vha = fcport->vha;
> struct qla_hw_data *ha = vha->hw;
> struct srb_iocb *iocb = &sp->u.iocb_cmd;
> - struct req_que *req = vha->req;
> + struct req_que *req = sp->qpair->req;
> 
> flags = iocb->u.tmf.flags;
> lun = iocb->u.tmf.lun;
> @@ -2557,7 +2557,8 @@ qla24xx_tm_iocb(srb_t *sp, struct tsk_mgmt_entry *tsk)
> tsk->port_id[2] = fcport->d_id.b.domain;
> tsk->vp_index = fcport->vha->vp_idx;
> 
> - if (flags == TCF_LUN_RESET) {
> + if (flags & (TCF_LUN_RESET | TCF_ABORT_TASK_SET|
> +    TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA)) {
> int_to_scsilun(lun, &tsk->lun);
> host_to_fcp_swap((uint8_t *)&tsk->lun,
> sizeof(tsk->lun));
> -- 
> 2.23.1
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com <mailto:himanshu.madhani@oracle.com>>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 2/7] qla2xxx: Fix task management cmd failure

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> Task management cmd failed with status 30h which means
> FW is not able to finish processing one task management
> before another task management for the same lun.
> Hence add wait for completion of marker to space it out.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Link: https://lore.kernel.org/oe-kbuild-all/202304271802.uCZfwQC1-lkp@intel.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> v2:
> - Fix warning reported by kernel robot.
> 
> drivers/scsi/qla2xxx/qla_def.h  |   6 ++
> drivers/scsi/qla2xxx/qla_init.c | 102 +++++++++++++++++++++++++++-----
> drivers/scsi/qla2xxx/qla_iocb.c |  28 +++++++--
> drivers/scsi/qla2xxx/qla_isr.c  |  26 +++++++-
> 4 files changed, 139 insertions(+), 23 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
> index d59e94ae0db4..0437e0150a50 100644
> --- a/drivers/scsi/qla2xxx/qla_def.h
> +++ b/drivers/scsi/qla2xxx/qla_def.h
> @@ -472,6 +472,7 @@ struct tmf_arg {
> struct scsi_qla_host *vha;
> u64 lun;
> u32 flags;
> + uint8_t modifier;
> };
> 
> struct els_logo_payload {
> @@ -553,6 +554,10 @@ struct srb_iocb {
> uint32_t data;
> struct completion comp;
> __le16 comp_status;
> +
> + uint8_t modifier;
> + uint8_t vp_index;
> + uint16_t loop_id;
> } tmf;
> struct {
> #define SRB_FXDISC_REQ_DMA_VALID BIT_0
> @@ -656,6 +661,7 @@ struct srb_iocb {
> #define SRB_SA_UPDATE 25
> #define SRB_ELS_CMD_HST_NOLOGIN 26
> #define SRB_SA_REPLACE 27
> +#define SRB_MARKER 28
> 
> struct qla_els_pt_arg {
> u8 els_opcode;
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index 035d1984e2bd..2402b1402e0d 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -2013,6 +2013,80 @@ qla2x00_tmf_iocb_timeout(void *data)
> }
> }
> 
> +static void qla_marker_sp_done(srb_t *sp, int res)
> +{
> + struct srb_iocb *tmf = &sp->u.iocb_cmd;
> +
> + if (res != QLA_SUCCESS)
> + ql_dbg(ql_dbg_taskm, sp->vha, 0x8004,
> +    "Async-marker fail hdl=%x portid=%06x ctrl=%x lun=%lld qp=%d.\n",
> +    sp->handle, sp->fcport->d_id.b24, sp->u.iocb_cmd.u.tmf.flags,
> +    sp->u.iocb_cmd.u.tmf.lun, sp->qpair->id);
> +
> + complete(&tmf->u.tmf.comp);
> +}
> +
> +#define  START_SP_W_RETRIES(_sp, _rval) \
> +{\
> + int cnt = 5; \
> + do { \
> + _rval = qla2x00_start_sp(_sp); \
> + if (_rval == EAGAIN) \
> + msleep(1); \
> + else \
> + break; \
> + cnt--; \
> + } while (cnt); \
> +}
> +
> +static int
> +qla26xx_marker(struct tmf_arg *arg)
> +{
> + struct scsi_qla_host *vha = arg->vha;
> + struct srb_iocb *tm_iocb;
> + srb_t *sp;
> + int rval = QLA_FUNCTION_FAILED;
> + fc_port_t *fcport = arg->fcport;
> +
> + /* ref: INIT */
> + sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
> + if (!sp)
> + goto done;
> +
> + sp->type = SRB_MARKER;
> + sp->name = "marker";
> + qla2x00_init_async_sp(sp, qla2x00_get_async_timeout(vha), qla_marker_sp_done);
> + sp->u.iocb_cmd.timeout = qla2x00_tmf_iocb_timeout;
> +
> + tm_iocb = &sp->u.iocb_cmd;
> + init_completion(&tm_iocb->u.tmf.comp);
> + tm_iocb->u.tmf.modifier = arg->modifier;
> + tm_iocb->u.tmf.lun = arg->lun;
> + tm_iocb->u.tmf.loop_id = fcport->loop_id;
> + tm_iocb->u.tmf.vp_index = vha->vp_idx;
> +
> + START_SP_W_RETRIES(sp, rval);
> +
> + ql_dbg(ql_dbg_taskm, vha, 0x8006,
> +    "Async-marker hdl=%x loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d rval %d.\n",
> +    sp->handle, fcport->loop_id, fcport->d_id.b24,
> +    arg->modifier, arg->lun, sp->qpair->id, rval);
> +
> + if (rval != QLA_SUCCESS) {
> + ql_log(ql_log_warn, vha, 0x8031,
> +    "Marker IOCB failed (%x).\n", rval);
> + goto done_free_sp;
> + }
> +
> + wait_for_completion(&tm_iocb->u.tmf.comp);
> +
> +done_free_sp:
> + /* ref: INIT */
> + kref_put(&sp->cmd_kref, qla2x00_sp_release);
> +done:
> + return rval;
> +}
> +
> static void qla2x00_tmf_sp_done(srb_t *sp, int res)
> {
> struct srb_iocb *tmf = &sp->u.iocb_cmd;
> @@ -2026,7 +2100,6 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
> struct scsi_qla_host *vha = arg->vha;
> struct srb_iocb *tm_iocb;
> srb_t *sp;
> - unsigned long flags;
> int rval = QLA_FUNCTION_FAILED;
> 
> fc_port_t *fcport = arg->fcport;
> @@ -2048,11 +2121,12 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
> tm_iocb->u.tmf.flags = arg->flags;
> tm_iocb->u.tmf.lun = arg->lun;
> 
> - rval = qla2x00_start_sp(sp);
> + START_SP_W_RETRIES(sp, rval);
> +
> ql_dbg(ql_dbg_taskm, vha, 0x802f,
> -    "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x ctrl=%x.\n",
> -    sp->handle, fcport->loop_id, fcport->d_id.b.domain,
> -    fcport->d_id.b.area, fcport->d_id.b.al_pa, arg->flags);
> +    "Async-tmf hdl=%x loop-id=%x portid=%06x ctrl=%x lun=%lld qp=%d rval=%x.\n",
> +    sp->handle, fcport->loop_id, fcport->d_id.b24,
> +    arg->flags, arg->lun, sp->qpair->id, rval);
> 
> if (rval != QLA_SUCCESS)
> goto done_free_sp;
> @@ -2065,17 +2139,8 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
>    "TM IOCB failed (%x).\n", rval);
> }
> 
> - if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw)) {
> - flags = tm_iocb->u.tmf.flags;
> - if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET|
> - TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
> - flags = MK_SYNC_ID_LUN;
> - else
> - flags = MK_SYNC_ID;
> -
> - qla2x00_marker(vha, sp->qpair,
> -    sp->fcport->loop_id, arg->lun, flags);
> - }
> + if (!test_bit(UNLOADING, &vha->dpc_flags) && !IS_QLAFX00(vha->hw))
> + rval = qla26xx_marker(arg);
> 
> done_free_sp:
> /* ref: INIT */
> @@ -2099,6 +2164,11 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> a.fcport = fcport;
> a.lun = lun;
> 
> + if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
> + a.modifier = MK_SYNC_ID_LUN;
> + else
> + a.modifier = MK_SYNC_ID;
> +
> if (vha->hw->mqenable) {
> for (i = 0; i < vha->hw->num_qpairs; i++) {
> qpair = vha->hw->queue_pair_map[i];
> diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
> index b02039601cc0..6acfdcc48b16 100644
> --- a/drivers/scsi/qla2xxx/qla_iocb.c
> +++ b/drivers/scsi/qla2xxx/qla_iocb.c
> @@ -522,21 +522,25 @@ __qla2x00_marker(struct scsi_qla_host *vha, struct qla_qpair *qpair,
> return (QLA_FUNCTION_FAILED);
> }
> 
> + mrk24 = (struct mrk_entry_24xx *)mrk;
> +
> mrk->entry_type = MARKER_TYPE;
> mrk->modifier = type;
> if (type != MK_SYNC_ALL) {
> if (IS_FWI2_CAPABLE(ha)) {
> - mrk24 = (struct mrk_entry_24xx *) mrk;
> mrk24->nport_handle = cpu_to_le16(loop_id);
> int_to_scsilun(lun, (struct scsi_lun *)&mrk24->lun);
> host_to_fcp_swap(mrk24->lun, sizeof(mrk24->lun));
> mrk24->vp_index = vha->vp_idx;
> - mrk24->handle = make_handle(req->id, mrk24->handle);
> } else {
> SET_TARGET_ID(ha, mrk->target, loop_id);
> mrk->lun = cpu_to_le16((uint16_t)lun);
> }
> }
> +
> + if (IS_FWI2_CAPABLE(ha))
> + mrk24->handle = QLA_SKIP_HANDLE;
> +
> wmb();
> 
> qla2x00_start_iocbs(vha, req);
> @@ -3853,9 +3857,9 @@ static int qla_get_iocbs_resource(struct srb *sp)
> case SRB_NACK_LOGO:
> case SRB_LOGOUT_CMD:
> case SRB_CTRL_VP:
> - push_it_through = true;
> - fallthrough;
> + case SRB_MARKER:
> default:
> + push_it_through = true;
> get_exch = false;
> }
> 
> @@ -3871,6 +3875,19 @@ static int qla_get_iocbs_resource(struct srb *sp)
> return qla_get_fw_resources(sp->qpair, &sp->iores);
> }
> 
> +static void
> +qla_marker_iocb(srb_t *sp, struct mrk_entry_24xx *mrk)
> +{
> + mrk->entry_type = MARKER_TYPE;
> + mrk->modifier = sp->u.iocb_cmd.u.tmf.modifier;
> + if (sp->u.iocb_cmd.u.tmf.modifier != MK_SYNC_ALL) {
> + mrk->nport_handle = cpu_to_le16(sp->u.iocb_cmd.u.tmf.loop_id);
> + int_to_scsilun(sp->u.iocb_cmd.u.tmf.lun, (struct scsi_lun *)&mrk->lun);
> + host_to_fcp_swap(mrk->lun, sizeof(mrk->lun));
> + mrk->vp_index = sp->u.iocb_cmd.u.tmf.vp_index;
> + }
> +}
> +
> int
> qla2x00_start_sp(srb_t *sp)
> {
> @@ -3974,6 +3991,9 @@ qla2x00_start_sp(srb_t *sp)
> case SRB_SA_REPLACE:
> qla24xx_sa_replace_iocb(sp, pkt);
> break;
> + case SRB_MARKER:
> + qla_marker_iocb(sp, pkt);
> + break;
> default:
> break;
> }
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> index 71feda2cdb63..f3107508cf12 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -3750,6 +3750,28 @@ static int qla_chk_cont_iocb_avail(struct scsi_qla_host *vha,
> return rc;
> }
> 
> +static void qla_marker_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
> + struct mrk_entry_24xx *pkt)
> +{
> + const char func[] = "MRK-IOCB";
> + srb_t *sp;
> + int res = QLA_SUCCESS;
> +
> + if (!IS_FWI2_CAPABLE(vha->hw))
> + return;
> +
> + sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
> + if (!sp)
> + return;
> +
> + if (pkt->entry_status) {
> + ql_dbg(ql_dbg_taskm, vha, 0x8025, "marker failure.\n");
> + res = QLA_COMMAND_ERROR;
> + }
> + sp->u.iocb_cmd.u.tmf.data = res;
> + sp->done(sp, res);
> +}
> +
> /**
>  * qla24xx_process_response_queue() - Process response queue entries.
>  * @vha: SCSI driver HA context
> @@ -3863,9 +3885,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
> (struct nack_to_isp *)pkt);
> break;
> case MARKER_TYPE:
> - /* Do nothing in this case, this check is to prevent it
> - * from falling into default case
> - */
> + qla_marker_iocb_entry(vha, rsp->req, (struct mrk_entry_24xx *)pkt);
> break;
> case ABORT_IOCB_TYPE:
> qla24xx_abort_iocb_entry(vha, rsp->req,
> -- 
> 2.23.1
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com <mailto:himanshu.madhani@oracle.com>>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 3/7] qla2xxx: Fix task management cmd fail due to unavailable resource

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> Task management command failed with status 2Ch which is
> a result of too many task management commands sent
> to the same target. Hence limit task management commands
> to 8 per target.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Link: https://lore.kernel.org/oe-kbuild-all/202304271952.NKNmoFzv-lkp@intel.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> v2:
> - Fix warning reported by kernel robot.
> 
> drivers/scsi/qla2xxx/qla_def.h  |  3 ++
> drivers/scsi/qla2xxx/qla_init.c | 63 ++++++++++++++++++++++++++++++---
> 2 files changed, 61 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
> index 0437e0150a50..0971150953a9 100644
> --- a/drivers/scsi/qla2xxx/qla_def.h
> +++ b/drivers/scsi/qla2xxx/qla_def.h
> @@ -2543,6 +2543,7 @@ enum rscn_addr_format {
> typedef struct fc_port {
> struct list_head list;
> struct scsi_qla_host *vha;
> + struct list_head tmf_pending;
> 
> unsigned int conf_compl_supported:1;
> unsigned int deleted:2;
> @@ -2563,6 +2564,8 @@ typedef struct fc_port {
> unsigned int do_prli_nvme:1;
> 
> uint8_t nvme_flag;
> + uint8_t active_tmf;
> +#define MAX_ACTIVE_TMF 8
> 
> uint8_t node_name[WWN_SIZE];
> uint8_t port_name[WWN_SIZE];
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index 2402b1402e0d..17649cf9c39d 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -2149,6 +2149,54 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
> return rval;
> }
> 
> +static void qla_put_tmf(fc_port_t *fcport)
> +{
> + struct scsi_qla_host *vha = fcport->vha;
> + struct qla_hw_data *ha = vha->hw;
> + unsigned long flags;
> +
> + spin_lock_irqsave(&ha->tgt.sess_lock, flags);
> + fcport->active_tmf--;
> + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
> +}
> +
> +static
> +int qla_get_tmf(fc_port_t *fcport)
> +{
> + struct scsi_qla_host *vha = fcport->vha;
> + struct qla_hw_data *ha = vha->hw;
> + unsigned long flags;
> + int rc = 0;
> + LIST_HEAD(tmf_elem);
> +
> + spin_lock_irqsave(&ha->tgt.sess_lock, flags);
> + list_add_tail(&tmf_elem, &fcport->tmf_pending);
> +
> + while (fcport->active_tmf >= MAX_ACTIVE_TMF) {
> + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
> +
> + msleep(1);
> +
> + spin_lock_irqsave(&ha->tgt.sess_lock, flags);
> + if (fcport->deleted) {
> + rc = EIO;
> + break;
> + }
> + if (fcport->active_tmf < MAX_ACTIVE_TMF &&
> +    list_is_first(&tmf_elem, &fcport->tmf_pending))
> + break;
> + }
> +
> + list_del(&tmf_elem);
> +
> + if (!rc)
> + fcport->active_tmf++;
> +
> + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
> +
> + return rc;
> +}
> +
> int
> qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
>     uint32_t tag)
> @@ -2156,18 +2204,19 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> struct scsi_qla_host *vha = fcport->vha;
> struct qla_qpair *qpair;
> struct tmf_arg a;
> - struct completion comp;
> int i, rval;
> 
> - init_completion(&comp);
> a.vha = fcport->vha;
> a.fcport = fcport;
> a.lun = lun;
> -
> - if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA))
> + if (flags & (TCF_LUN_RESET|TCF_ABORT_TASK_SET| TCF_CLEAR_TASK_SET|TCF_CLEAR_ACA)) {
> a.modifier = MK_SYNC_ID_LUN;
> - else
> +
> + if (qla_get_tmf(fcport))
> + return QLA_FUNCTION_FAILED;
> + } else {
> a.modifier = MK_SYNC_ID;
> + }
> 
> if (vha->hw->mqenable) {
> for (i = 0; i < vha->hw->num_qpairs; i++) {
> @@ -2186,6 +2235,9 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> a.flags = flags;
> rval = __qla2x00_async_tm_cmd(&a);
> 
> + if (a.modifier == MK_SYNC_ID_LUN)
> + qla_put_tmf(fcport);
> +
> return rval;
> }
> 
> @@ -5400,6 +5452,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
> INIT_WORK(&fcport->reg_work, qla_register_fcport_fn);
> INIT_LIST_HEAD(&fcport->gnl_entry);
> INIT_LIST_HEAD(&fcport->list);
> + INIT_LIST_HEAD(&fcport->tmf_pending);
> 
> INIT_LIST_HEAD(&fcport->sess_cmd_list);
> spin_lock_init(&fcport->sess_cmd_lock);
> -- 
> 2.23.1
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 4/7] qla2xxx: Fix hang in task management

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> Task management command hangs where a side
> band chip reset failed to nudge the TMF
> from it's current send path.
> 
> Add additional error check to block TMF
> from entering during chip reset and along
> the TMF path to cause it to bail out, skip
> over abort of marker.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> drivers/scsi/qla2xxx/qla_def.h  |  4 +++
> drivers/scsi/qla2xxx/qla_init.c | 60 +++++++++++++++++++++++++++++++--
> 2 files changed, 61 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
> index 0971150953a9..3e0be0136cad 100644
> --- a/drivers/scsi/qla2xxx/qla_def.h
> +++ b/drivers/scsi/qla2xxx/qla_def.h
> @@ -5516,4 +5516,8 @@ struct ql_vnd_tgt_stats_resp {
> _fp->disc_state, _fp->scan_state, _fp->loop_id, _fp->deleted, \
> _fp->flags
> 
> +#define TMF_NOT_READY(_fcport) \
> + (!_fcport || IS_SESSION_DELETED(_fcport) || atomic_read(&_fcport->state) != FCS_ONLINE || \
> + !_fcport->vha->hw->flags.fw_started)
> +
> #endif
> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index 17649cf9c39d..b61597d6882c 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -1996,6 +1996,11 @@ qla2x00_tmf_iocb_timeout(void *data)
> int rc, h;
> unsigned long flags;
> 
> + if (sp->type == SRB_MARKER) {
> + complete(&tmf->u.tmf.comp);
> + return;
> + }
> +
> rc = qla24xx_async_abort_cmd(sp, false);
> if (rc) {
> spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
> @@ -2023,6 +2028,7 @@ static void qla_marker_sp_done(srb_t *sp, int res)
>    sp->handle, sp->fcport->d_id.b24, sp->u.iocb_cmd.u.tmf.flags,
>    sp->u.iocb_cmd.u.tmf.lun, sp->qpair->id);
> 
> + sp->u.iocb_cmd.u.tmf.data = res;
> complete(&tmf->u.tmf.comp);
> }
> 
> @@ -2039,6 +2045,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
> } while (cnt); \
> }
> 
> +/**
> + * qla26xx_marker: send marker IOCB and wait for the completion of it.
> + * @arg: pointer to argument list.
> + *    It is assume caller will provide an fcport pointer and modifier
> + */
> static int
> qla26xx_marker(struct tmf_arg *arg)
> {
> @@ -2048,6 +2059,14 @@ qla26xx_marker(struct tmf_arg *arg)
> int rval = QLA_FUNCTION_FAILED;
> fc_port_t *fcport = arg->fcport;
> 
> + if (TMF_NOT_READY(arg->fcport)) {
> + ql_dbg(ql_dbg_taskm, vha, 0x8039,
> +    "FC port not ready for marker loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
> +    fcport->loop_id, fcport->d_id.b24,
> +    arg->modifier, arg->lun, arg->qpair->id);
> + return QLA_SUSPENDED;
> + }
> +
> /* ref: INIT */
> sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
> if (!sp)
> @@ -2074,11 +2093,19 @@ qla26xx_marker(struct tmf_arg *arg)
> 
> if (rval != QLA_SUCCESS) {
> ql_log(ql_log_warn, vha, 0x8031,
> -    "Marker IOCB failed (%x).\n", rval);
> +    "Marker IOCB send failure (%x).\n", rval);
> goto done_free_sp;
> }
> 
> wait_for_completion(&tm_iocb->u.tmf.comp);
> + rval = tm_iocb->u.tmf.data;
> +
> + if (rval != QLA_SUCCESS) {
> + ql_log(ql_log_warn, vha, 0x8019,
> +    "Marker failed hdl=%x loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d rval %d.\n",
> +    sp->handle, fcport->loop_id, fcport->d_id.b24,
> +    arg->modifier, arg->lun, sp->qpair->id, rval);
> + }
> 
> done_free_sp:
> /* ref: INIT */
> @@ -2091,6 +2118,8 @@ static void qla2x00_tmf_sp_done(srb_t *sp, int res)
> {
> struct srb_iocb *tmf = &sp->u.iocb_cmd;
> 
> + if (res)
> + tmf->u.tmf.data = res;
> complete(&tmf->u.tmf.comp);
> }
> 
> @@ -2104,6 +2133,14 @@ __qla2x00_async_tm_cmd(struct tmf_arg *arg)
> 
> fc_port_t *fcport = arg->fcport;
> 
> + if (TMF_NOT_READY(arg->fcport)) {
> + ql_dbg(ql_dbg_taskm, vha, 0x8032,
> +    "FC port not ready for TM command loop-id=%x portid=%06x modifier=%x lun=%lld qp=%d.\n",
> +    fcport->loop_id, fcport->d_id.b24,
> +    arg->modifier, arg->lun, arg->qpair->id);
> + return QLA_SUSPENDED;
> + }
> +
> /* ref: INIT */
> sp = qla2xxx_get_qpair_sp(vha, arg->qpair, fcport, GFP_KERNEL);
> if (!sp)
> @@ -2178,7 +2215,9 @@ int qla_get_tmf(fc_port_t *fcport)
> msleep(1);
> 
> spin_lock_irqsave(&ha->tgt.sess_lock, flags);
> - if (fcport->deleted) {
> + if (TMF_NOT_READY(fcport)) {
> + ql_log(ql_log_warn, vha, 0x802c,
> +    "Unable to acquire TM resource due to disruption.\n");
> rc = EIO;
> break;
> }
> @@ -2204,7 +2243,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> struct scsi_qla_host *vha = fcport->vha;
> struct qla_qpair *qpair;
> struct tmf_arg a;
> - int i, rval;
> + int i, rval = QLA_SUCCESS;
> +
> + if (TMF_NOT_READY(fcport))
> + return QLA_SUSPENDED;
> 
> a.vha = fcport->vha;
> a.fcport = fcport;
> @@ -2223,6 +2265,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> qpair = vha->hw->queue_pair_map[i];
> if (!qpair)
> continue;
> +
> + if (TMF_NOT_READY(fcport)) {
> + ql_log(ql_log_warn, vha, 0x8026,
> +    "Unable to send TM due to disruption.\n");
> + rval = QLA_SUSPENDED;
> + break;
> + }
> +
> a.qpair = qpair;
> a.flags = flags|TCF_NOTMCMD_TO_TARGET;
> rval = __qla2x00_async_tm_cmd(&a);
> @@ -2231,10 +2281,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint64_t lun,
> }
> }
> 
> + if (rval)
> + goto bailout;
> +
> a.qpair = vha->hw->base_qpair;
> a.flags = flags;
> rval = __qla2x00_async_tm_cmd(&a);
> 
> +bailout:
> if (a.modifier == MK_SYNC_ID_LUN)
> qla_put_tmf(fcport);
> 
> -- 
> 2.23.1
> 

Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 5/7] qla2xxx: Fix mem access after free

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> System crash, where driver is accessing scsi layer's
> memory (scsi_cmnd->device->host) to search for a well known internal
> pointer (vha). The scsi_cmnd was released back to upper layer which
> could be freed, but the driver is still accessing it.
> 
> 7 [ffffa8e8d2c3f8d0] page_fault at ffffffff86c010fe
>  [exception RIP: __qla2x00_eh_wait_for_pending_commands+240]
>  RIP: ffffffffc0642350  RSP: ffffa8e8d2c3f988  RFLAGS: 00010286
>  RAX: 0000000000000165  RBX: 0000000000000002  RCX: 00000000000036d8
>  RDX: 0000000000000000  RSI: ffff9c5c56535188  RDI: 0000000000000286
>  RBP: ffff9c5bf7aa4a58   R8: ffff9c589aecdb70   R9: 00000000000003d1
>  R10: 0000000000000001  R11: 0000000000380000 R12: ffff9c5c5392bc78
>  R13: ffff9c57044ff5c0 R14: ffff9c56b5a3aa00  R15: 00000000000006db
>  ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
> 8 [ffffa8e8d2c3f9c8] qla2x00_eh_wait_for_pending_commands at ffffffffc0646dd5 [qla2xxx]
> 9 [ffffa8e8d2c3fa00] __qla2x00_async_tm_cmd at ffffffffc0658094 [qla2xxx]
> 
> Remove access of freed memory. Currently the driver was checking to see if
> scsi_done was called by seeing if the sp->type has changed. Instead,
> check to see if the command has left the  oustanding_cmds[] array as
> sign of scsi_done was called.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> drivers/scsi/qla2xxx/qla_isr.c |  38 ++++++++--
> drivers/scsi/qla2xxx/qla_os.c  | 130 ++++++++++++++++-----------------
> 2 files changed, 95 insertions(+), 73 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
> index f3107508cf12..a07c010b0843 100644
> --- a/drivers/scsi/qla2xxx/qla_isr.c
> +++ b/drivers/scsi/qla2xxx/qla_isr.c
> @@ -1862,9 +1862,9 @@ qla2x00_process_completed_request(struct scsi_qla_host *vha,
> }
> }
> 
> -srb_t *
> -qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
> -    struct req_que *req, void *iocb)
> +static srb_t *
> +qla_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
> +       struct req_que *req, void *iocb, u16 *ret_index)
> {
> struct qla_hw_data *ha = vha->hw;
> sts_entry_t *pkt = iocb;
> @@ -1899,12 +1899,25 @@ qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
> return NULL;
> }
> 
> - req->outstanding_cmds[index] = NULL;
> -
> + *ret_index = index;
> qla_put_fw_resources(sp->qpair, &sp->iores);
> return sp;
> }
> 
> +srb_t *
> +qla2x00_get_sp_from_handle(scsi_qla_host_t *vha, const char *func,
> +   struct req_que *req, void *iocb)
> +{
> + uint16_t index;
> + srb_t *sp;
> +
> + sp = qla_get_sp_from_handle(vha, func, req, iocb, &index);
> + if (sp)
> + req->outstanding_cmds[index] = NULL;
> +
> + return sp;
> +}
> +
> static void
> qla2x00_mbx_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
>     struct mbx_entry *mbx)
> @@ -3237,13 +3250,13 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
> return;
> }
> 
> - req->outstanding_cmds[handle] = NULL;
> cp = GET_CMD_SP(sp);
> if (cp == NULL) {
> ql_dbg(ql_dbg_io, vha, 0x3018,
>    "Command already returned (0x%x/%p).\n",
>    sts->handle, sp);
> 
> + req->outstanding_cmds[handle] = NULL;
> return;
> }
> 
> @@ -3514,6 +3527,9 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
> 
> if (rsp->status_srb == NULL)
> sp->done(sp, res);
> +
> + /* for io's, clearing of outstanding_cmds[handle] means scsi_done was called */
> + req->outstanding_cmds[handle] = NULL;
> }
> 
> /**
> @@ -3590,6 +3606,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
> uint16_t que = MSW(pkt->handle);
> struct req_que *req = NULL;
> int res = DID_ERROR << 16;
> + u16 index;
> 
> ql_dbg(ql_dbg_async, vha, 0x502a,
>    "iocb type %xh with error status %xh, handle %xh, rspq id %d\n",
> @@ -3608,7 +3625,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
> 
> switch (pkt->entry_type) {
> case NOTIFY_ACK_TYPE:
> - case STATUS_TYPE:
> case STATUS_CONT_TYPE:
> case LOGINOUT_PORT_IOCB_TYPE:
> case CT_IOCB_TYPE:
> @@ -3628,6 +3644,14 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
> case CTIO_TYPE7:
> case CTIO_CRC2:
> return 1;
> + case STATUS_TYPE:
> + sp = qla_get_sp_from_handle(vha, func, req, pkt, &index);
> + if (sp) {
> + sp->done(sp, res);
> + req->outstanding_cmds[index] = NULL;
> + return 0;
> + }
> + break;
> }
> fatal:
> ql_log(ql_log_warn, vha, 0x5030,
> diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
> index d0cdbfe771a9..60734c569401 100644
> --- a/drivers/scsi/qla2xxx/qla_os.c
> +++ b/drivers/scsi/qla2xxx/qla_os.c
> @@ -1078,43 +1078,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
> return 0;
> }
> 
> -/*
> - * qla2x00_eh_wait_on_command
> - *    Waits for the command to be returned by the Firmware for some
> - *    max time.
> - *
> - * Input:
> - *    cmd = Scsi Command to wait on.
> - *
> - * Return:
> - *    Completed in time : QLA_SUCCESS
> - *    Did not complete in time : QLA_FUNCTION_FAILED
> - */
> -static int
> -qla2x00_eh_wait_on_command(struct scsi_cmnd *cmd)
> -{
> -#define ABORT_POLLING_PERIOD 1000
> -#define ABORT_WAIT_ITER ((2 * 1000) / (ABORT_POLLING_PERIOD))
> - unsigned long wait_iter = ABORT_WAIT_ITER;
> - scsi_qla_host_t *vha = shost_priv(cmd->device->host);
> - struct qla_hw_data *ha = vha->hw;
> - srb_t *sp = scsi_cmd_priv(cmd);
> - int ret = QLA_SUCCESS;
> -
> - if (unlikely(pci_channel_offline(ha->pdev)) || ha->flags.eeh_busy) {
> - ql_dbg(ql_dbg_taskm, vha, 0x8005,
> -    "Return:eh_wait.\n");
> - return ret;
> - }
> -
> - while (sp->type && wait_iter--)
> - msleep(ABORT_POLLING_PERIOD);
> - if (sp->type)
> - ret = QLA_FUNCTION_FAILED;
> -
> - return ret;
> -}
> -
> /*
>  * qla2x00_wait_for_hba_online
>  *    Wait till the HBA is online after going through
> @@ -1365,6 +1328,9 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
> return ret;
> }
> 
> +#define ABORT_POLLING_PERIOD 1000
> +#define ABORT_WAIT_ITER ((2 * 1000) / (ABORT_POLLING_PERIOD))
> +
> /*
>  * Returns: QLA_SUCCESS or QLA_FUNCTION_FAILED.
>  */
> @@ -1378,41 +1344,73 @@ __qla2x00_eh_wait_for_pending_commands(struct qla_qpair *qpair, unsigned int t,
> struct req_que *req = qpair->req;
> srb_t *sp;
> struct scsi_cmnd *cmd;
> + unsigned long wait_iter = ABORT_WAIT_ITER;
> + bool found;
> + struct qla_hw_data *ha = vha->hw;
> 
> status = QLA_SUCCESS;
> 
> - spin_lock_irqsave(qpair->qp_lock_ptr, flags);
> - for (cnt = 1; status == QLA_SUCCESS &&
> - cnt < req->num_outstanding_cmds; cnt++) {
> - sp = req->outstanding_cmds[cnt];
> - if (!sp)
> - continue;
> - if (sp->type != SRB_SCSI_CMD)
> - continue;
> - if (vha->vp_idx != sp->vha->vp_idx)
> - continue;
> - match = 0;
> - cmd = GET_CMD_SP(sp);
> - switch (type) {
> - case WAIT_HOST:
> - match = 1;
> - break;
> - case WAIT_TARGET:
> - match = cmd->device->id == t;
> - break;
> - case WAIT_LUN:
> - match = (cmd->device->id == t &&
> - cmd->device->lun == l);
> - break;
> - }
> - if (!match)
> - continue;
> + while (wait_iter--) {
> + found = false;
> 
> - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
> - status = qla2x00_eh_wait_on_command(cmd);
> spin_lock_irqsave(qpair->qp_lock_ptr, flags);
> + for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
> + sp = req->outstanding_cmds[cnt];
> + if (!sp)
> + continue;
> + if (sp->type != SRB_SCSI_CMD)
> + continue;
> + if (vha->vp_idx != sp->vha->vp_idx)
> + continue;
> + match = 0;
> + cmd = GET_CMD_SP(sp);
> + switch (type) {
> + case WAIT_HOST:
> + match = 1;
> + break;
> + case WAIT_TARGET:
> + if (sp->fcport)
> + match = sp->fcport->d_id.b24 == t;
> + else
> + match = 0;
> + break;
> + case WAIT_LUN:
> + if (sp->fcport)
> + match = (sp->fcport->d_id.b24 == t &&
> + cmd->device->lun == l);
> + else
> + match = 0;
> + break;
> + }
> + if (!match)
> + continue;
> +
> + spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
> +
> + if (unlikely(pci_channel_offline(ha->pdev)) ||
> +    ha->flags.eeh_busy) {
> + ql_dbg(ql_dbg_taskm, vha, 0x8005,
> +    "Return:eh_wait.\n");
> + return status;
> + }
> +
> + /*
> + * SRB_SCSI_CMD is still in the outstanding_cmds array.
> + * it means scsi_done has not called. Wait for it to
> + * clear from outstanding_cmds.
> + */
> + msleep(ABORT_POLLING_PERIOD);
> + spin_lock_irqsave(qpair->qp_lock_ptr, flags);
> + found = true;
> + }
> + spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
> +
> + if (!found)
> + break;
> }
> - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
> +
> + if (!wait_iter && found)
> + status = QLA_FUNCTION_FAILED;
> 
> return status;
> }
> -- 
> 2.23.1
> 
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 6/7] qla2xxx: Wait for io return on terminate rport

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> From: Quinn Tran <qutran@marvell.com>
> 
> System crash due to use after free.
> Current code allows terminate_rport_io to exit before making
> sure all IOs has returned. For FCP-2 device, IO's can hang
> on in HW because driver has not tear down the session in FW at
> first sign of cable pull. When dev_loss_tmo timer pops,
> terminate_rport_io is called and upper layer is about to
> free various resources. Terminate_rport_io trigger qla to do
> the final cleanup, but the cleanup might not be fast enough where it
> leave qla still holding on to the same resource.
> 
> Wait for IO's to return to upper layer before resources are freed.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Quinn Tran <qutran@marvell.com>
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> drivers/scsi/qla2xxx/qla_attr.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
> index 70cfc94c3d43..b00222459607 100644
> --- a/drivers/scsi/qla2xxx/qla_attr.c
> +++ b/drivers/scsi/qla2xxx/qla_attr.c
> @@ -2750,6 +2750,7 @@ static void
> qla2x00_terminate_rport_io(struct fc_rport *rport)
> {
> fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
> + scsi_qla_host_t *vha;
> 
> if (!fcport)
> return;
> @@ -2759,9 +2760,12 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
> 
> if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
> return;
> + vha = fcport->vha;
> 
> if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
> qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
> + qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
> + 0, WAIT_TARGET);
> return;
> }
> /*
> @@ -2786,6 +2790,15 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
> qla2x00_port_logout(fcport->vha, fcport);
> }
> }
> +
> + /* check for any straggling io left behind */
> + if (qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, 0, WAIT_TARGET)) {
> + ql_log(ql_log_warn, vha, 0x300b,
> +       "IO not return.  Resetting. \n");
> + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
> + qla2xxx_wake_dpc(vha);
> + qla2x00_wait_for_chip_reset(vha);
> + }
> }
> 
> static int
> -- 
> 2.23.1
> 
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 7/7] qla2xxx: Update version to 10.02.08.300-k

[Himanshu Madhani]

> On Apr 28, 2023, at 12:53 AM, Nilesh Javali <njavali@marvell.com> wrote:
> 
> Signed-off-by: Nilesh Javali <njavali@marvell.com>
> ---
> drivers/scsi/qla2xxx/qla_version.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
> index 42d69d89834f..4d6f06fb156b 100644
> --- a/drivers/scsi/qla2xxx/qla_version.h
> +++ b/drivers/scsi/qla2xxx/qla_version.h
> @@ -6,9 +6,9 @@
> /*
>  * Driver version
>  */
> -#define QLA2XXX_VERSION      "10.02.08.200-k"
> +#define QLA2XXX_VERSION      "10.02.08.300-k"
> 
> #define QLA_DRIVER_MAJOR_VER 10
> #define QLA_DRIVER_MINOR_VER 2
> #define QLA_DRIVER_PATCH_VER 8
> -#define QLA_DRIVER_BETA_VER 200
> +#define QLA_DRIVER_BETA_VER 300
> -- 
> 2.23.1
> 
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>

-- 
Himanshu Madhani Oracle Linux Engineering

Re: [PATCH v2 0/7] qla2xxx driver update

[Martin K. Petersen]

Nilesh,

> Please apply the qla2xxx driver enhancement and bug fixes to the scsi
> tree at your earliest convenience.

Applied to 6.5/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering

Re: [PATCH v2 0/7] qla2xxx driver update

[Martin K. Petersen]

On Fri, 28 Apr 2023 00:53:32 -0700, Nilesh Javali wrote:

> Martin,
> 
> Please apply the qla2xxx driver enhancement and bug fixes to
> the scsi tree at your earliest convenience.
> 
> Thanks,
> Nilesh
> 
> [...]

Applied to 6.5/scsi-queue, thanks!

[1/7] qla2xxx: Multi-que support for TMF
      https://git.kernel.org/mkp/scsi/c/d90171dd0da5
[2/7] qla2xxx: Fix task management cmd failure
      https://git.kernel.org/mkp/scsi/c/9803fb5d2759
[3/7] qla2xxx: Fix task management cmd fail due to unavailable resource
      https://git.kernel.org/mkp/scsi/c/6a87679626b5
[4/7] qla2xxx: Fix hang in task management
      https://git.kernel.org/mkp/scsi/c/9ae615c5bfd3
[5/7] qla2xxx: Fix mem access after free
      https://git.kernel.org/mkp/scsi/c/b843adde8d49
[6/7] qla2xxx: Wait for io return on terminate rport
      https://git.kernel.org/mkp/scsi/c/fc0cba0c7be8
[7/7] qla2xxx: Update version to 10.02.08.300-k
      https://git.kernel.org/mkp/scsi/c/eb91eb809c8d

-- 
Martin K. Petersen	Oracle Linux Engineering