Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

During session recovery, the conn_stop call will trigger a flush
to all outstanding SCSI cmds in the xmit queue.  This will set
all outstanding task->sc to NULL prior to the session_teardown
call which frees the task memory.

In the bnx2i SCSI response processing path, only the task was being checked
for NULL under the session lock before the task->sc->request dereferencing.
If there are outstanding SCSI cmd responses pending for process, the
following kernel panic can be exposed where task->sc was found to be NULL.

 Call Trace:
[   69.720205]  [<ffffffffa040d0d0>] bnx2i_process_new_cqes+0x290/0x3c0 [bnx2i]
[   69.804289]  [<ffffffffa040d233>] bnx2i_fastpath_notification+0x33/0xa0 [bnx2
i]
[   69.891490]  [<ffffffffa040d37b>] bnx2i_indicate_kcqe+0xdb/0x330 [bnx2i]
[   69.971427]  [<ffffffffa03eac5e>] service_kcqes+0x16e/0x1d0 [cnic]
[   70.045132]  [<ffffffffa03eacea>] cnic_service_bnx2x_kcq+0x2a/0x50 [cnic]
[   70.126105]  [<ffffffffa03ead53>] cnic_service_bnx2x_bh+0x43/0x140 [cnic]
[   70.207081]  [<ffffffff81060676>] tasklet_action+0x66/0x110
[   70.273521]  [<ffffffff8106025f>] __do_softirq+0xef/0x220
[   70.337887]  [<ffffffff81447ebc>] call_softirq+0x1c/0x30

This patch adds the !task->sc check and also protects the sc dereferencing
under the session lock.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The iscsi_nopout task's TTT is defined as __be32 while the DMA
memory to the chip is CPU specific.  This creates a problem for
unsolicited NOP-In responses where the TTT is not the RESERVED
tag of 0xFFs.  This patch adds a call to be32_to_cpu for the TTT
specified.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The iscsi class currently does not support writable sysfs
attrs for LLD sysfs settings. This patch converts the
iscsi class and driver's host attrs to use the attribute
container sysfs group and the sysfs group's is_visible callout
to be able to support readable or writable sysfs attrs.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The iscsi class currently does not support writable sysfs
attrs for LLD sysfs settings. This patch converts the
iscsi class and driver's session attrs to use the attribute
container sysfs group and the sysfs group's is_visible callout
to be able to support readable or writable sysfs attrs.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The iscsi class currently does not support writable sysfs
attrs for LLD sysfs settings. This patch converts the
iscsi class and drivers to use the attribute container
sysfs group and the sysfs group's is_visible callout
to be able to support readable or writable sysfs attrs.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Moves the drivers for Broadcom devices into
drivers/net/ethernet/broadcom/ and the necessary Kconfig and Makefile
changes.

CC: Eilon Greenstein <eilong@broadcom.com>
CC: Michael Chan <mchan@broadcom.com>
CC: Matt Carlson <mcarlson@broadcom.com>
CC: Gary Zambrano <zambrano@broadcom.com>
CC: "Maciej W. Rozycki" <macro@linux-mips.org>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

struct scsi_lun is also just a struct with an array of 8 octets (64 bits)
but using it instead in iscsi structs lets us call scsilun_to_int
without a cast, and also lets us copy it using assignment, instead of
memcpy().
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch renames the following iscsi_proto.h structures to avoid
namespace issues with drivers/target/iscsi/iscsi_target_core.h:

*) struct iscsi_cmd -> struct iscsi_scsi_req
*) struct iscsi_cmd_rsp -> struct iscsi_scsi_rsp
*) struct iscsi_login -> struct iscsi_login_req

This patch includes useful ISCSI_FLAG_LOGIN_[CURRENT,NEXT]_STAGE*,
and ISCSI_FLAG_SNACK_TYPE_* definitions used by iscsi_target_mod, and
fixes the incorrect definition of struct iscsi_snack to following
RFC-3720 Section 10.16. SNACK Request.

Also, this patch updates libiscsi, iSER, be2iscsi, and bn2xi to
use the updated structure definitions in a handful of locations.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NNicholas A. Bellinger <nab@linux-iscsi.org>

A kernel panic was observed when passing the sc->request->cpu = -1 to
retrieve the per_cpu variable pointer:
 #0 [ffff880011203960] machine_kexec at ffffffff81022bc3
 #1 [ffff8800112039b0] crash_kexec at ffffffff81088630
 #2 [ffff880011203a80] __die at ffffffff8139ea20
 #3 [ffff880011203aa0] no_context at ffffffff8102f3a7
 #4 [ffff880011203ae0] __bad_area_nosemaphore at ffffffff8102f665
 #5 [ffff880011203ba0] retint_signal at ffffffff8139dd1f
 #6 [ffff880011203cc8] bnx2i_indicate_kcqe at ffffffffa03dc4f2
 #7 [ffff880011203da8] service_kcqes at ffffffffa03cb04f
 #8 [ffff880011203e68] cnic_service_bnx2x_kcq at ffffffffa03cb14a
 #9 [ffff880011203e88] cnic_service_bnx2x_bh at ffffffffa03cb1b3

The problem lies in the slow path sg_io (and perhaps sg_scsi_ioctl) call to
blk_get_request->get_request/wait->blk_alloc_request->blk_rq_init which
re-initializes the request->cpu to -1.  There is no assignment for cpu from
that to the request_fn call to low level drivers.

When this happens, the sc->request->cpu will be using the init value of
-1.  This will create a kernel panic when it hits bnx2i because the code
refers it to get the per_cpu variables ptr.

This change is to put in a guard against that and also for cases when
bio affinity/queue completion to the same cpu is not enabled.  In those
cases, the request->cpu will remain a -1 also.

This bug was created from commit:  b5cf6b63

For the case when the blk layer did not setup the request->cpu, bnx2i
will complete the sc with the current CPU of the thread.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The bnx2fc driver needs to handle netdev events on VLAN devices.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NBhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Bumped version from 2.6.2.3 to 2.7.0.3
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The init routine will now examine the cnic->max_iscsi_conn variable
before registering to CNIC during ulp_init.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Acked-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

This patch breaks the SCSI cmd completion into two parts:
1. The bh will allocate and queued work to the cmd specific CPU IO
completion kthread.  The CPU for the cmd is from the sc->request->cpu.

2. The CPU specific IO completion kthread will call the scsi_cmd_resp
routine to do the actual cmd completion.

In the normal case, these IO completion kthreads should complete before
the blk IO times out at 60s.  However, in the case when these kthreads
are blocked for whatever reason and exceeded the timeout, the call
to conn_destroy will have to iterate and exhaust all related work in the
percpu work list for all online CPUs.  This will guarantee the protection
of the work->session and conn pointers before they get freed.

Also modified the event coalescing formula to have at least the
event_coal_min outstanding cmds in the pipeline so the SCSI producer
would not get underrun.

Also changed the following SCSI parameters:
- can_queue from 1024 to 2048
- cmds_per_lun from 24 to 128
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Acked-by: NBenjamin Li <benli@broadcom.com>
Acked-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

struct scsi_lun is also just a struct with an array of 8 octets (64 bits)
but using it instead in iscsi structs lets us call scsilun_to_int
without a cast, and also lets us copy it using assignment, instead of
memcpy().
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

And change iSCSI RQ doorbell size from 16B to 64B to match new firmware.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

New FW/HSI (7.0):
 - Added support to 578xx chips
 - Improved HSI - much less driver's direct access to the FW internal
   memory needed.

New implementation of the HSI handling layer in the bnx2x (bnx2x_sp.c):
 - Introduced chip dependent objects that have chip independent interfaces
   for configuration of MACs, multicast addresses, Rx mode, indirection table,
   fast path queues and function initialization/cleanup.
 - Objects functionality is based on the private function pointers, which
   allows not only a per-chip but also PF/VF differentiation while still
   preserving the same interface towards the driver.
 - Objects interface is not influenced by the HSI changes which do not require
   providing new parameters keeping the code outside the bnx2x_sp.c invariant
   with regard to such HSI chnages.

Changes in a CNIC, bnx2fc and bnx2i modules due to the new HSI.
Signed-off-by: NVladislav Zolotarov <vladz@broadcom.com>
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NBhanu Prakash Gollapudi <bprakash@broadcom.com>
Signed-off-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@conan.davemloft.net>

Modified the event coalescing code for iSCSI offload to combat both
corner cases and optimize performance as follows:

1. Added mechanism to loop back a second time to process any leftover
CQEs that was generated by the hardware during the time the driver is
busy processing previous CQEs in the bh.  This not only helps the
performance but also fixes the corner case when no more CQEs are being
generated in the pipeline; so those leftover CQEs will get a a chance
to be processed.

2. Added ARM_CQE_FP to distinguish between fast path arming versus
slow path arming.  This change will guarantee that the CQEs will
always get a chance to be re-armed during fast path completions.

3. Removed the inline event coalescing division for perf optimization.
Also fixed a division-by-zero error when the event_coal_div module
param was set to 0.

4. Changed the default SQ WQEs size from 256 to 128 to match chip
default.

5. Changed the cmd_per_lun from 32 to 24.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <jbottomley@parallels.com>

Modified the 10s wait time for inflight offload connections to
advance to the next state to 2s based on test result.
Modified the 20s shutdown timeout to 30s based on test result.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Cc: stable@kernel.org
Signed-off-by: NJames Bottomley <jbottomley@parallels.com>

The number of chip's internal command cell, which is use to generate
SCSI cmd packets to the target, was not initialized correctly by
the driver when the sq_size is changed from the default 128.
This, in turn, will create a problem where the chip's transmit pipe
will erroneously reuse an old command cell that is no longer valid.
The fix is to correctly initialize the chip's command cell upon setup.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Cc: stable@kernel.org
Signed-off-by: NJames Bottomley <jbottomley@parallels.com>

Fixes generated by 'codespell' and manually reviewed.
Signed-off-by: NLucas De Marchi <lucas.demarchi@profusion.mobi>

bnx2i has some checks to try and make sure the ep
is not destroyed while the addr/port is getting
read. However, if after this check:

if (!(bnx2i_conn && bnx2i_conn->ep && bnx2i_conn->ep->hba))
	goto out;

bnx2i_conn->ep is cleared by ep_disconnect then we will
oops.

This patches fixes the problem by having the driver
use the get_ep_param callback instead of get_conn_param.
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

This is part of an effort to support send target discovery via
the iSCSI offload path.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

For scenarios where the shost is not being passed to bnx2i for the
iSCSI offload connection request, the code would consult the routing
table to select the CNIC device.
This code path will erroneously error out if the corresponding L2
interface's MTU has been setup to > 1500.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Moved all PCI_DEVICE_ID_NX2_57712(E) definitions to pci_ids.h
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Acked-by: NMichael Chan <mchan@broadcom.com>
Acked-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The hba will now be unregistered and freed when iSCSI offload
is not supported by the NIC.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Fixed a bug where the 64-bit LUN field for nopouts were 32-bit swapped.
This only pertains to 5771X devices.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Allow CNIC to go through the proper cleanup procedure for an endpoint
which failed to connect.  Proper cleanup is necessary for the chip
to reset back to the initial state for the offloaded endpoint.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The nopout's reserved field was not being initialized to zero
before being reused.  Stale CDB values from previous SCSI cmds
of the same BHS offset was the cause of the disconnection
initiated by the Lefthand target.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

1. Change first parameter from cnic_dev to ulp_handle which is the hba
pointer.  All other similar upcalls are using hba pointer.  The callee
can then directly reference the hba without conversion.

2. Change return value from void to int so that an error code can be
passed back.  This allows the operation to be retried.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Various error conditions inside ep_connect and ep_disconnect were
either not being handled or not being handled correctly.  This patch
fixes all those issues.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Acked-by: NAnil Veerabhadrappa <anilgv@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added the handling for cases when a chip request is made to the
CNIC module but the hardware is not ready to accept.  This would
lead to many unnecessary wait timeouts.
This code adds check in the connect establishment and destruction
path.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The stop path has been augmented to wait a max of 10s for all in
progress offload and destroy activities to complete before proceeding
to terminate all active connections (via iscsid or forcefully).

Note that any new offload and destroy requests are now blocked and
return to the caller immediately.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Acked-by: NAnil Veerabhadrappa <anilgv@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The code no longer needs to dynamically register and unregister
the CNIC device.  The CNIC device will be kept registered until
module unload.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Added net_dev mutex lock protection before accessing the csk
parameters.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NBenjamin Li <benli@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

In the situation where the connect completion response arrives after
the connect request has already timed out, the connection was not being
aborted but only the resource was being freed.  This creates a problem
for 5771X (10g) as the chip flags this with an assertion.

This change will properly aborts the connection before freeing the
resource.
Signed-off-by: NEddie Wai <eddie.wai@broadcom.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>