From b0991f6043ae1b064c862036de0ca603cc55091d Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sat, 11 May 2019 01:27:54 +0000
Subject: [PATCH 01/34] nightly build: Update kernel versions

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8361 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 nightly/conf/nightly.conf | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nightly/conf/nightly.conf b/nightly/conf/nightly.conf
index 01550c1c9..b8343f517 100644
--- a/nightly/conf/nightly.conf
+++ b/nightly/conf/nightly.conf
@@ -4,19 +4,19 @@ ABT_DETAILS="x86_64"
 ABT_JOBS=5
 ABT_KERNELS="  \
 5.1            \
-5.0.14-nc      \
+5.0.15-nc      \
 4.20.17-nc     \
-4.19.41-nc     \
+4.19.42-nc     \
 4.18.18-nc     \
 4.17.18-nc     \
 4.16.18-nc     \
 4.15.18-nc     \
-4.14.117-nc    \
+4.14.118-nc    \
 4.13.16-nc     \
 4.12.14-nc     \
 4.11.12-nc     \
 4.10.17-nc     \
-4.9.174-nc     \
+4.9.175-nc     \
 4.8.17-nc      \
 4.7.10-nc      \
 4.6.7-nc       \

From 86b2b49ade71b00ba349b025ea244a884bae6773 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Thu, 16 May 2019 16:30:08 +0000
Subject: [PATCH 02/34] scripts/kernel-functions: Fetch both Linus' tree and
 the stable tree

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8362 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 scripts/kernel-functions | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/kernel-functions b/scripts/kernel-functions
index de2be73e7..b9e1c7c0f 100644
--- a/scripts/kernel-functions
+++ b/scripts/kernel-functions
@@ -437,7 +437,8 @@ function download_and_extract_kernel_tree {
 	mkdir "linux-$1"
 	(
 	    cd "${kernel_tree}" &&
-		{ git tag -l "v$1" >/dev/null || git fetch stable; } &&
+		{ git tag -l "v$1" >/dev/null ||
+		    { git fetch; git fetch stable; }; } &&
 		git archive "v$1"
 	) | tar -C "linux-$1" -xf-
     else

From e2818b97f0adfa24c15322385e78a1dec29013f7 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Thu, 16 May 2019 16:30:48 +0000
Subject: [PATCH 03/34] scst/Makefile: Avoid that "nothing to do" is reported
 when running e.g. make 2perf

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8363 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 scst/Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scst/Makefile b/scst/Makefile
index 995767219..3c325f8c6 100644
--- a/scst/Makefile
+++ b/scst/Makefile
@@ -49,12 +49,15 @@ extraclean:
 
 2debug:
 	$(call set_var,build_mode,BUILD_MODE,)
+	@true
 
 2release:
 	$(call set_var,build_mode,BUILD_MODE,RELEASE)
+	@true
 
 2perf:
 	$(call set_var,build_mode,BUILD_MODE,PERF)
+	@true
 
 release-archive:
 	../scripts/generate-release-archive scst \

From 9f3248f22408e4c0a15e30e87801f672e6986315 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 26 May 2019 12:02:04 +0000
Subject: [PATCH 04/34] nightly build: Update kernel versions

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8364 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 nightly/conf/nightly.conf | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/nightly/conf/nightly.conf b/nightly/conf/nightly.conf
index b8343f517..a3a0cc2cc 100644
--- a/nightly/conf/nightly.conf
+++ b/nightly/conf/nightly.conf
@@ -3,25 +3,25 @@
 ABT_DETAILS="x86_64"
 ABT_JOBS=5
 ABT_KERNELS="  \
-5.1            \
-5.0.15-nc      \
+5.1.5          \
+5.0.19-nc      \
 4.20.17-nc     \
-4.19.42-nc     \
-4.18.18-nc     \
-4.17.18-nc     \
+4.19.46-nc     \
+4.18.20-nc     \
+4.17.19-nc     \
 4.16.18-nc     \
 4.15.18-nc     \
-4.14.118-nc    \
+4.14.122-nc    \
 4.13.16-nc     \
 4.12.14-nc     \
 4.11.12-nc     \
 4.10.17-nc     \
-4.9.175-nc     \
+4.9.179-nc     \
 4.8.17-nc      \
 4.7.10-nc      \
 4.6.7-nc       \
 4.5.7-nc       \
-4.4.179-nc     \
+4.4.180-nc     \
 4.3.6-nc       \
 4.2.8-nc       \
 4.1.52-nc      \

From dff864f63e3393d7b5264acae0a98fea2bfd94a3 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 26 May 2019 16:51:26 +0000
Subject: [PATCH 05/34] qla2x00t-32gbit: Add cleanup for PCI EEH recovery

During EEH error recovery testing it was discovered that driver's reset()
callback partially frees resources used by driver, leaving some stale
memory.  After reset() is done and when resume() callback in driver uses
old data which results into error leaving adapter disabled due to PCIe
error.

This patch does cleanup for EEH recovery code path and prevents adapter
from getting disabled.

Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[ bvanassche: Ported from upstream kernel to SCST ]



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8365 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_os.c | 221 +++++++++++++++------------------------
 1 file changed, 82 insertions(+), 139 deletions(-)

diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index 4b4f87e4f..ac4e478f8 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -6896,6 +6896,78 @@ qla2x00_release_firmware(void)
 	mutex_unlock(&qla_fw_lock);
 }
 
+static void qla_pci_error_cleanup(scsi_qla_host_t *vha)
+{
+	struct qla_hw_data *ha = vha->hw;
+	scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+	struct qla_qpair *qpair = NULL;
+	struct scsi_qla_host *vp;
+	fc_port_t *fcport;
+	int i;
+	unsigned long flags;
+
+	ha->chip_reset++;
+
+	ha->base_qpair->chip_reset = ha->chip_reset;
+	for (i = 0; i < ha->max_qpairs; i++) {
+		if (ha->queue_pair_map[i])
+			ha->queue_pair_map[i]->chip_reset =
+			    ha->base_qpair->chip_reset;
+	}
+
+	/* purge MBox commands */
+	if (atomic_read(&ha->num_pend_mbx_stage3)) {
+		clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
+		complete(&ha->mbx_intr_comp);
+	}
+
+	i = 0;
+
+	while (atomic_read(&ha->num_pend_mbx_stage3) ||
+	    atomic_read(&ha->num_pend_mbx_stage2) ||
+	    atomic_read(&ha->num_pend_mbx_stage1)) {
+		msleep(20);
+		i++;
+		if (i > 50)
+			break;
+	}
+
+	ha->flags.purge_mbox = 0;
+
+	mutex_lock(&ha->mq_lock);
+	list_for_each_entry(qpair, &base_vha->qp_list, qp_list_elem)
+		qpair->online = 0;
+	mutex_unlock(&ha->mq_lock);
+
+	qla2x00_mark_all_devices_lost(vha, 0);
+
+	spin_lock_irqsave(&ha->vport_slock, flags);
+	list_for_each_entry(vp, &ha->vp_list, list) {
+		atomic_inc(&vp->vref_count);
+		spin_unlock_irqrestore(&ha->vport_slock, flags);
+		qla2x00_mark_all_devices_lost(vp, 0);
+		spin_lock_irqsave(&ha->vport_slock, flags);
+		atomic_dec(&vp->vref_count);
+	}
+	spin_unlock_irqrestore(&ha->vport_slock, flags);
+
+	/* Clear all async request states across all VPs. */
+	list_for_each_entry(fcport, &vha->vp_fcports, list)
+		fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
+
+	spin_lock_irqsave(&ha->vport_slock, flags);
+	list_for_each_entry(vp, &ha->vp_list, list) {
+		atomic_inc(&vp->vref_count);
+		spin_unlock_irqrestore(&ha->vport_slock, flags);
+		list_for_each_entry(fcport, &vp->vp_fcports, list)
+			fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
+		spin_lock_irqsave(&ha->vport_slock, flags);
+		atomic_dec(&vp->vref_count);
+	}
+	spin_unlock_irqrestore(&ha->vport_slock, flags);
+}
+
+
 static pci_ers_result_t
 qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
 {
@@ -6921,20 +6993,7 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
 		return PCI_ERS_RESULT_CAN_RECOVER;
 	case pci_channel_io_frozen:
 		ha->flags.eeh_busy = 1;
-		/* For ISP82XX complete any pending mailbox cmd */
-		if (IS_QLA82XX(ha)) {
-			ha->flags.isp82xx_fw_hung = 1;
-			ql_dbg(ql_dbg_aer, vha, 0x9001, "Pci channel io frozen\n");
-			qla82xx_clear_pending_mbx(vha);
-		}
-		qla2x00_free_irqs(vha);
-		pci_disable_device(pdev);
-		/* Return back all IOs */
-		qla2x00_abort_all_cmds(vha, DID_RESET << 16);
-		if (ql2xmqsupport || ql2xnvmeenable) {
-			set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags);
-			qla2xxx_wake_dpc(vha);
-		}
+		qla_pci_error_cleanup(vha);
 		return PCI_ERS_RESULT_NEED_RESET;
 	case pci_channel_io_perm_failure:
 		ha->flags.pci_channel_io_perm_failure = 1;
@@ -6988,122 +7047,14 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev)
 		return PCI_ERS_RESULT_RECOVERED;
 }
 
-static uint32_t
-qla82xx_error_recovery(scsi_qla_host_t *base_vha)
-{
-	uint32_t rval = QLA_FUNCTION_FAILED;
-	uint32_t drv_active = 0;
-	struct qla_hw_data *ha = base_vha->hw;
-	int fn;
-	struct pci_dev *other_pdev = NULL;
-
-	ql_dbg(ql_dbg_aer, base_vha, 0x9006,
-	    "Entered %s.\n", __func__);
-
-	set_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
-
-	if (base_vha->flags.online) {
-		/* Abort all outstanding commands,
-		 * so as to be requeued later */
-		qla2x00_abort_isp_cleanup(base_vha);
-	}
-
-
-	fn = PCI_FUNC(ha->pdev->devfn);
-	while (fn > 0) {
-		fn--;
-		ql_dbg(ql_dbg_aer, base_vha, 0x9007,
-		    "Finding pci device at function = 0x%x.\n", fn);
-		other_pdev =
-		    pci_get_domain_bus_and_slot(pci_domain_nr(ha->pdev->bus),
-		    ha->pdev->bus->number, PCI_DEVFN(PCI_SLOT(ha->pdev->devfn),
-		    fn));
-
-		if (!other_pdev)
-			continue;
-		if (atomic_read(&other_pdev->enable_cnt)) {
-			ql_dbg(ql_dbg_aer, base_vha, 0x9008,
-			    "Found PCI func available and enable at 0x%x.\n",
-			    fn);
-			pci_dev_put(other_pdev);
-			break;
-		}
-		pci_dev_put(other_pdev);
-	}
-
-	if (!fn) {
-		/* Reset owner */
-		ql_dbg(ql_dbg_aer, base_vha, 0x9009,
-		    "This devfn is reset owner = 0x%x.\n",
-		    ha->pdev->devfn);
-		qla82xx_idc_lock(ha);
-
-		qla82xx_wr_32(ha, QLA82XX_CRB_DEV_STATE,
-		    QLA8XXX_DEV_INITIALIZING);
-
-		qla82xx_wr_32(ha, QLA82XX_CRB_DRV_IDC_VERSION,
-		    QLA82XX_IDC_VERSION);
-
-		drv_active = qla82xx_rd_32(ha, QLA82XX_CRB_DRV_ACTIVE);
-		ql_dbg(ql_dbg_aer, base_vha, 0x900a,
-		    "drv_active = 0x%x.\n", drv_active);
-
-		qla82xx_idc_unlock(ha);
-		/* Reset if device is not already reset
-		 * drv_active would be 0 if a reset has already been done
-		 */
-		if (drv_active)
-			rval = qla82xx_start_firmware(base_vha);
-		else
-			rval = QLA_SUCCESS;
-		qla82xx_idc_lock(ha);
-
-		if (rval != QLA_SUCCESS) {
-			ql_log(ql_log_info, base_vha, 0x900b,
-			    "HW State: FAILED.\n");
-			qla82xx_clear_drv_active(ha);
-			qla82xx_wr_32(ha, QLA82XX_CRB_DEV_STATE,
-			    QLA8XXX_DEV_FAILED);
-		} else {
-			ql_log(ql_log_info, base_vha, 0x900c,
-			    "HW State: READY.\n");
-			qla82xx_wr_32(ha, QLA82XX_CRB_DEV_STATE,
-			    QLA8XXX_DEV_READY);
-			qla82xx_idc_unlock(ha);
-			ha->flags.isp82xx_fw_hung = 0;
-			rval = qla82xx_restart_isp(base_vha);
-			qla82xx_idc_lock(ha);
-			/* Clear driver state register */
-			qla82xx_wr_32(ha, QLA82XX_CRB_DRV_STATE, 0);
-			qla82xx_set_drv_active(base_vha);
-		}
-		qla82xx_idc_unlock(ha);
-	} else {
-		ql_dbg(ql_dbg_aer, base_vha, 0x900d,
-		    "This devfn is not reset owner = 0x%x.\n",
-		    ha->pdev->devfn);
-		if ((qla82xx_rd_32(ha, QLA82XX_CRB_DEV_STATE) ==
-		    QLA8XXX_DEV_READY)) {
-			ha->flags.isp82xx_fw_hung = 0;
-			rval = qla82xx_restart_isp(base_vha);
-			qla82xx_idc_lock(ha);
-			qla82xx_set_drv_active(base_vha);
-			qla82xx_idc_unlock(ha);
-		}
-	}
-	clear_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
-
-	return rval;
-}
-
 static pci_ers_result_t
 qla2xxx_pci_slot_reset(struct pci_dev *pdev)
 {
 	pci_ers_result_t ret = PCI_ERS_RESULT_DISCONNECT;
 	scsi_qla_host_t *base_vha = pci_get_drvdata(pdev);
 	struct qla_hw_data *ha = base_vha->hw;
-	struct rsp_que *rsp;
-	int rc, retries = 10;
+	int rc;
+	struct qla_qpair *qpair = NULL;
 
 	ql_dbg(ql_dbg_aer, base_vha, 0x9004,
 	    "Slot Reset.\n");
@@ -7132,24 +7083,16 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
 		goto exit_slot_reset;
 	}
 
-	rsp = ha->rsp_q_map[0];
-	if (qla2x00_request_irqs(ha, rsp))
-		goto exit_slot_reset;
 
 	if (ha->isp_ops->pci_config(base_vha))
 		goto exit_slot_reset;
 
-	if (IS_QLA82XX(ha)) {
-		if (qla82xx_error_recovery(base_vha) == QLA_SUCCESS) {
-			ret = PCI_ERS_RESULT_RECOVERED;
-			goto exit_slot_reset;
-		} else
-			goto exit_slot_reset;
-	}
-
-	while (ha->flags.mbox_busy && retries--)
-		msleep(1000);
+	mutex_lock(&ha->mq_lock);
+	list_for_each_entry(qpair, &base_vha->qp_list, qp_list_elem)
+		qpair->online = 1;
+	mutex_unlock(&ha->mq_lock);
 
+	base_vha->flags.online = 1;
 	set_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
 	if (ha->isp_ops->abort_isp(base_vha) == QLA_SUCCESS)
 		ret =  PCI_ERS_RESULT_RECOVERED;
@@ -7173,13 +7116,13 @@ qla2xxx_pci_resume(struct pci_dev *pdev)
 	ql_dbg(ql_dbg_aer, base_vha, 0x900f,
 	    "pci_resume.\n");
 
+	ha->flags.eeh_busy = 0;
+
 	ret = qla2x00_wait_for_hba_online(base_vha);
 	if (ret != QLA_SUCCESS) {
 		ql_log(ql_log_fatal, base_vha, 0x9002,
 		    "The device failed to resume I/O from slot/link_reset.\n");
 	}
-
-	ha->flags.eeh_busy = 0;
 }
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)

From ed72c3743739b6b9bbf9121f122302f0f48db8a9 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 26 May 2019 16:57:59 +0000
Subject: [PATCH 06/34] qla2x00t-32gbit: Use strlcpy() instead of strncpy()

This patch avoids that gcc complains that the output may be truncated.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8366 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_mr.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/qla2x00t-32gbit/qla_mr.c b/qla2x00t-32gbit/qla_mr.c
index b0e03032e..9eb86fd39 100644
--- a/qla2x00t-32gbit/qla_mr.c
+++ b/qla2x00t-32gbit/qla_mr.c
@@ -1890,21 +1890,21 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)
 			phost_info = &preg_hsi->hsi;
 			memset(preg_hsi, 0, sizeof(struct register_host_info));
 			phost_info->os_type = OS_TYPE_LINUX;
-			strncpy(phost_info->sysname,
+			strlcpy(phost_info->sysname,
 			    p_sysid->sysname, SYSNAME_LENGTH);
-			strncpy(phost_info->nodename,
+			strlcpy(phost_info->nodename,
 			    p_sysid->nodename, NODENAME_LENGTH);
 			if (!strcmp(phost_info->nodename, "(none)"))
 				ha->mr.host_info_resend = true;
-			strncpy(phost_info->release,
+			strlcpy(phost_info->release,
 			    p_sysid->release, RELEASE_LENGTH);
-			strncpy(phost_info->version,
+			strlcpy(phost_info->version,
 			    p_sysid->version, VERSION_LENGTH);
-			strncpy(phost_info->machine,
+			strlcpy(phost_info->machine,
 			    p_sysid->machine, MACHINE_LENGTH);
-			strncpy(phost_info->domainname,
+			strlcpy(phost_info->domainname,
 			    p_sysid->domainname, DOMNAME_LENGTH);
-			strncpy(phost_info->hostdriver,
+			strlcpy(phost_info->hostdriver,
 			    QLA2XXX_VERSION, VERSION_LENGTH);
 			preg_hsi->utc = (uint64_t)ktime_get_real_seconds();
 			ql_dbg(ql_dbg_init, vha, 0x0149,

From dc78c5025e314571e344a608a617e3ac6e715e23 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:27:47 +0000
Subject: [PATCH 07/34] qla2x00t-32gbit: Declare local symbols 'static'

This patch avoids that sparse complains about local symbols not having been
declared 'static'.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8367 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c b/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
index 18a1e2c06..b9596a661 100644
--- a/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
+++ b/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
@@ -73,7 +73,7 @@
 #endif
 #endif
 
-LIST_HEAD(sqa_tgt_glist);
+static LIST_HEAD(sqa_tgt_glist);
 
 /* Function definitions for callbacks from the SCST target core. */
 
@@ -101,7 +101,7 @@ static int sqa_parse_wwn(const char *ns, u64 *nm);
 static ssize_t sqa_version_show(struct kobject *kobj,
 				struct kobj_attribute *attr, char *buf);
 
-struct kobj_attribute sqa_version_attr =
+static struct kobj_attribute sqa_version_attr =
 	__ATTR(version, S_IRUGO, sqa_version_show, NULL);
 
 static const struct attribute *sqa_attrs[] = {
@@ -116,7 +116,7 @@ static ssize_t sqa_store_expl_conf_enabled(struct kobject *kobj,
 					   struct kobj_attribute *attr,
 					   const char *buffer, size_t size);
 
-struct kobj_attribute sqa_expl_conf_attr =
+static struct kobj_attribute sqa_expl_conf_attr =
 	__ATTR(explicit_confirmation, S_IRUGO|S_IWUSR,
 	       sqa_show_expl_conf_enabled, sqa_store_expl_conf_enabled);
 
@@ -124,7 +124,7 @@ static ssize_t sqa_abort_isp_store(struct kobject *kobj,
 				   struct kobj_attribute *attr,
 				   const char *buffer, size_t size);
 
-struct kobj_attribute sqa_abort_isp_attr =
+static struct kobj_attribute sqa_abort_isp_attr =
 	__ATTR(abort_isp, S_IWUSR, NULL, sqa_abort_isp_store);
 
 static ssize_t sqa_hw_target_show(struct kobject *kobj,
@@ -179,7 +179,7 @@ static enum scst_exec_context scst_work_context = SCST_CONTEXT_TASKLET;
 #endif
 
 
-struct cmd_state_name {
+static struct cmd_state_name {
 	uint8_t state;
 	char *str;
 } cmd_str[] = {

From c5d4686660724b3cd0965a1753b44a7820c49def Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:28:50 +0000
Subject: [PATCH 08/34] scst_lib: Add a scst_put_buf_full() call in
 scst_block_generic_dev_done()

Avoid that Coverity complains (incorrectly) that there is a memory leak
in an error path in scst_block_generic_dev_done().


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8368 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 scst/src/scst_lib.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c
index b472bca5e..ed2a25e90 100644
--- a/scst/src/scst_lib.c
+++ b/scst/src/scst_lib.c
@@ -12487,8 +12487,10 @@ int scst_block_generic_dev_done(struct scst_cmd *cmd,
 
 			buffer_size = scst_get_buf_full(cmd, &buffer);
 			sect_sz_off = opcode == READ_CAPACITY ? 4 : 8;
-			if (buffer_size < sect_sz_off + 4)
+			if (buffer_size < sect_sz_off + 4) {
+				scst_put_buf_full(cmd, buffer);
 				goto out;
+			}
 			sector_size = get_unaligned_be32(&buffer[sect_sz_off]);
 			scst_put_buf_full(cmd, buffer);
 			if (sector_size != 0) {

From 81bc0e717ad566adfdbfc1aa425c69ecb047a903 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:31:40 +0000
Subject: [PATCH 09/34] iscsi-scst: Suppress a false positive Coverity
 complaint

Avoid that Coverity complains about using a scalar as an array.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8369 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 iscsi-scst/kernel/iscsi.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/iscsi-scst/kernel/iscsi.c b/iscsi-scst/kernel/iscsi.c
index 3afad2ed4..200ffc9c2 100644
--- a/iscsi-scst/kernel/iscsi.c
+++ b/iscsi-scst/kernel/iscsi.c
@@ -54,7 +54,7 @@ struct kmem_cache *iscsi_conn_cache;
 struct kmem_cache *iscsi_sess_cache;
 
 static struct page *dummy_page;
-static struct scatterlist dummy_sg;
+static struct scatterlist dummy_sg[1];
 
 static void cmnd_remove_data_wait_hash(struct iscsi_cmnd *cmnd);
 static void iscsi_send_task_mgmt_resp(struct iscsi_cmnd *req, int status,
@@ -490,7 +490,7 @@ void cmnd_done(struct iscsi_cmnd *cmnd)
 
 		if (cmnd->own_sg) {
 			TRACE_DBG("own_sg for req %p", cmnd);
-			if (cmnd->sg != &dummy_sg)
+			if (cmnd->sg != &dummy_sg[0])
 				scst_free_sg(cmnd->sg, cmnd->sg_cnt);
 #ifdef CONFIG_SCST_DEBUG
 			/*
@@ -519,7 +519,8 @@ void cmnd_done(struct iscsi_cmnd *cmnd)
 
 		if (cmnd->own_sg) {
 			TRACE_DBG("own_sg for rsp %p", cmnd);
-			if (cmnd->sg != &dummy_sg && cmnd->sg != cmnd->rsp_sg)
+			if (cmnd->sg != &dummy_sg[0] &&
+			    cmnd->sg != cmnd->rsp_sg)
 				scst_free_sg(cmnd->sg, cmnd->sg_cnt);
 #ifdef CONFIG_SCST_DEBUG
 			cmnd->own_sg = 0;
@@ -1488,7 +1489,7 @@ static void cmnd_prepare_get_rejected_immed_data(struct iscsi_cmnd *cmnd)
 	 * accesses to dummy_page in dummy_sg, since data only
 	 * will be read and then discarded.
 	 */
-	sg = &dummy_sg;
+	sg = &dummy_sg[0];
 	if (cmnd->sg == NULL) {
 		/* just in case */
 		cmnd->sg = sg;
@@ -1618,7 +1619,7 @@ static int cmnd_prepare_recv_pdu(struct iscsi_conn *conn,
 			TRACE_DBG("Residual overflow (cmd %p, buff_offs %d, bufflen %d)",
 				  cmd, buff_offs, bufflen);
 			idx = 0;
-			sg = &dummy_sg;
+			sg = &dummy_sg[0];
 			offset = 0;
 		}
 
@@ -4300,8 +4301,8 @@ static int __init iscsi_init(void)
 		goto out;
 	}
 
-	sg_init_table(&dummy_sg, 1);
-	sg_set_page(&dummy_sg, dummy_page, PAGE_SIZE, 0);
+	sg_init_table(&dummy_sg[0], ARRAY_SIZE(dummy_sg));
+	sg_set_page(&dummy_sg[0], dummy_page, PAGE_SIZE, 0);
 
 	iscsi_cmnd_abort_mempool = mempool_create_kmalloc_pool(2500,
 		sizeof(struct iscsi_cmnd_abort_params));

From 3560f6650aafd4d933e4c791db25f49502881ea7 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:33:20 +0000
Subject: [PATCH 10/34] qla2x00t-32gbit: Change data_dsd into an array

This patch avoids that Coverity complains about using a scalar as an array.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8370 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_def.h    | 4 ++--
 qla2x00t-32gbit/qla_iocb.c   | 4 ++--
 qla2x00t-32gbit/qla_target.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index 94ac0a0af..f3dd9a817 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -1925,7 +1925,7 @@ struct crc_context {
 			uint16_t	reserved_2;
 			uint16_t	reserved_3;
 			uint32_t	reserved_4;
-			struct dsd64	data_dsd;
+			struct dsd64	data_dsd[1];
 			uint32_t	reserved_5[2];
 			uint32_t	reserved_6;
 		} nobundling;
@@ -1935,7 +1935,7 @@ struct crc_context {
 			uint16_t	reserved_1;
 			__le16	dseg_count;	/* Data segment count */
 			uint32_t	reserved_2;
-			struct dsd64	data_dsd;
+			struct dsd64	data_dsd[1];
 			struct dsd64	dif_dsd;
 		} bundling;
 	} u;
diff --git a/qla2x00t-32gbit/qla_iocb.c b/qla2x00t-32gbit/qla_iocb.c
index c2d9aea6c..3e4a55bef 100644
--- a/qla2x00t-32gbit/qla_iocb.c
+++ b/qla2x00t-32gbit/qla_iocb.c
@@ -1518,7 +1518,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
 	}
 
 	if (!bundling) {
-		cur_dsd = &crc_ctx_pkt->u.nobundling.data_dsd;
+		cur_dsd = &crc_ctx_pkt->u.nobundling.data_dsd[0];
 	} else {
 		/*
 		 * Configure Bundling if we need to fetch interlaving
@@ -1528,7 +1528,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
 		crc_ctx_pkt->u.bundling.dif_byte_count = cpu_to_le32(dif_bytes);
 		crc_ctx_pkt->u.bundling.dseg_count = cpu_to_le16(tot_dsds -
 							tot_prot_dsds);
-		cur_dsd = &crc_ctx_pkt->u.bundling.data_dsd;
+		cur_dsd = &crc_ctx_pkt->u.bundling.data_dsd[0];
 	}
 
 	/* Finish the common fields of CRC pkt */
diff --git a/qla2x00t-32gbit/qla_target.c b/qla2x00t-32gbit/qla_target.c
index cdcfd1871..2cc80b135 100644
--- a/qla2x00t-32gbit/qla_target.c
+++ b/qla2x00t-32gbit/qla_target.c
@@ -3167,7 +3167,7 @@ qlt_build_ctio_crc2_pkt(struct qla_qpair *qpair, struct qla_tgt_prm *prm)
 	pkt->crc_context_len = CRC_CONTEXT_LEN_FW;
 
 	if (!bundling) {
-		cur_dsd = &crc_ctx_pkt->u.nobundling.data_dsd;
+		cur_dsd = &crc_ctx_pkt->u.nobundling.data_dsd[0];
 	} else {
 		/*
 		 * Configure Bundling if we need to fetch interlaving
@@ -3177,7 +3177,7 @@ qlt_build_ctio_crc2_pkt(struct qla_qpair *qpair, struct qla_tgt_prm *prm)
 		crc_ctx_pkt->u.bundling.dif_byte_count = cpu_to_le32(dif_bytes);
 		crc_ctx_pkt->u.bundling.dseg_count =
 			cpu_to_le16(prm->tot_dsds - prm->prot_seg_cnt);
-		cur_dsd = &crc_ctx_pkt->u.bundling.data_dsd;
+		cur_dsd = &crc_ctx_pkt->u.bundling.data_dsd[0];
 	}
 
 	/* Finish the common fields of CRC pkt */

From 29bc124020435fb77a853ded57451e2267a829dc Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:34:47 +0000
Subject: [PATCH 11/34] qla2x00t-32gbit: Remove two superfluous if-tests

This patch avoids that Coverity reports the following:

Null-checking sp->u.iocb_cmd.u.ctarg.rsp suggests that it may be null, but
it has already been dereferenced on all paths leading to the check.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8371 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_gs.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/qla2x00t-32gbit/qla_gs.c b/qla2x00t-32gbit/qla_gs.c
index 109d22202..257c982cd 100644
--- a/qla2x00t-32gbit/qla_gs.c
+++ b/qla2x00t-32gbit/qla_gs.c
@@ -3339,20 +3339,17 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res)
 	e = qla2x00_alloc_work(vha, QLA_EVT_UNMAP);
 	if (!e) {
 		/* please ignore kernel warning. otherwise, we have mem leak. */
-		if (sp->u.iocb_cmd.u.ctarg.req) {
-			dma_free_coherent(&vha->hw->pdev->dev,
-				sp->u.iocb_cmd.u.ctarg.req_allocated_size,
-				sp->u.iocb_cmd.u.ctarg.req,
-				sp->u.iocb_cmd.u.ctarg.req_dma);
-			sp->u.iocb_cmd.u.ctarg.req = NULL;
-		}
-		if (sp->u.iocb_cmd.u.ctarg.rsp) {
-			dma_free_coherent(&vha->hw->pdev->dev,
-				sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
-				sp->u.iocb_cmd.u.ctarg.rsp,
-				sp->u.iocb_cmd.u.ctarg.rsp_dma);
-			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
-		}
+		dma_free_coherent(&vha->hw->pdev->dev,
+				  sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+				  sp->u.iocb_cmd.u.ctarg.req,
+				  sp->u.iocb_cmd.u.ctarg.req_dma);
+		sp->u.iocb_cmd.u.ctarg.req = NULL;
+
+		dma_free_coherent(&vha->hw->pdev->dev,
+				  sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+				  sp->u.iocb_cmd.u.ctarg.rsp,
+				  sp->u.iocb_cmd.u.ctarg.rsp_dma);
+		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
 
 		sp->free(sp);
 		return;

From 3a3de2bc201c302d44d2a71da1bd6a4cc4083748 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:36:17 +0000
Subject: [PATCH 12/34] qla2x00t-32gbit: Complain if a mailbox command times
 out

This patch avoids that Coverity reports the following:

Unchecked return value (CHECKED_RETURN)16. check_return: Calling
wait_for_completion_timeout without checking return value (as is done
elsewhere 14 out of 17 times).


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8372 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_mr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_mr.c b/qla2x00t-32gbit/qla_mr.c
index 9eb86fd39..98f56cf51 100644
--- a/qla2x00t-32gbit/qla_mr.c
+++ b/qla2x00t-32gbit/qla_mr.c
@@ -148,7 +148,8 @@ qlafx00_mailbox_command(scsi_qla_host_t *vha, struct mbx_cmd_32 *mcp)
 		QLAFX00_SET_HST_INTR(ha, ha->mbx_intr_code);
 		spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
-		wait_for_completion_timeout(&ha->mbx_intr_comp, mcp->tov * HZ);
+		WARN_ON_ONCE(wait_for_completion_timeout(&ha->mbx_intr_comp,
+							 mcp->tov * HZ) != 0);
 	} else {
 		ql_dbg(ql_dbg_mbx, vha, 0x112c,
 		    "Cmd=%x Polling Mode.\n", command);

From 6968c63610172a89076cd48fd21c1aa77483c0ac Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:37:47 +0000
Subject: [PATCH 13/34] qla2x00t-32gbit: Complain loudly if parsing the version
 string fails

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8373 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_tmpl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/qla2x00t-32gbit/qla_tmpl.c b/qla2x00t-32gbit/qla_tmpl.c
index de696a075..7ed481dd8 100644
--- a/qla2x00t-32gbit/qla_tmpl.c
+++ b/qla2x00t-32gbit/qla_tmpl.c
@@ -860,8 +860,9 @@ qla27xx_driver_info(struct qla27xx_fwdt_template *tmp)
 {
 	uint8_t v[] = { 0, 0, 0, 0, 0, 0 };
 
-	sscanf(qla2x00_version_str, "%hhu.%hhu.%hhu.%hhu.%hhu.%hhu",
-	    v+0, v+1, v+2, v+3, v+4, v+5);
+	WARN_ON_ONCE(sscanf(qla2x00_version_str,
+			    "%hhu.%hhu.%hhu.%hhu.%hhu.%hhu",
+			    v+0, v+1, v+2, v+3, v+4, v+5) != 6);
 
 	tmp->driver_info[0] = v[3] << 24 | v[2] << 16 | v[1] << 8 | v[0];
 	tmp->driver_info[1] = v[5] << 8 | v[4];

From a337199f8e705c7162e2e2583899ed9d433fcb5a Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:38:21 +0000
Subject: [PATCH 14/34] qla2x00t-32gbit: Remove a superfluous pointer check

Checking a pointer after it has been dereferenced is not useful. This was
detected by Coverity.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8374 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_nvme.c b/qla2x00t-32gbit/qla_nvme.c
index cd225b17c..65d8be906 100644
--- a/qla2x00t-32gbit/qla_nvme.c
+++ b/qla2x00t-32gbit/qla_nvme.c
@@ -199,7 +199,7 @@ static void qla_nvme_abort_work(struct work_struct *work)
 	       "%s called for sp=%p, hndl=%x on fcport=%p deleted=%d\n",
 	       __func__, sp, sp->handle, fcport, fcport->deleted);
 
-	if (!ha->flags.fw_started && (fcport && fcport->deleted))
+	if (!ha->flags.fw_started && fcport->deleted)
 		return;
 
 	if (ha->flags.host_shutting_down) {

From 5e5e99a67a86d50c2d5697ed24a86524fc693377 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:40:38 +0000
Subject: [PATCH 15/34] qla2x00t-32gbit: Remove dead code

Since sess == NULL before 'goto out_term2' is executed, the code under
'if (sess)' cannot be reached. Hence remove that code. This was detected
by Coverity.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8375 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_target.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/qla2x00t-32gbit/qla_target.c b/qla2x00t-32gbit/qla_target.c
index 2cc80b135..195851d68 100644
--- a/qla2x00t-32gbit/qla_target.c
+++ b/qla2x00t-32gbit/qla_target.c
@@ -6270,9 +6270,6 @@ static void qlt_abort_work(struct qla_tgt *tgt,
 out_term2:
 	spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
 
-	if (sess)
-		ha->tgt.tgt_ops->put_sess(sess);
-
 out_term:
 	spin_lock_irqsave(&ha->hardware_lock, flags);
 	qlt_24xx_send_abts_resp(ha->base_qpair, &prm->abts,

From 74ab26b723dc473ff0c75654ab34252efd1cdb73 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:42:22 +0000
Subject: [PATCH 16/34] qla2x00t-32gbit: Simplify a debug statement

This patch avoids that Coverity reports the following:

Unchecked return value (CHECKED_RETURN)34. check_return: Calling
atomic_read without checking return value (as is done elsewhere 80 out
of 92 times).



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8376 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_isr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_isr.c b/qla2x00t-32gbit/qla_isr.c
index fee79e4c5..5d82d4433 100644
--- a/qla2x00t-32gbit/qla_isr.c
+++ b/qla2x00t-32gbit/qla_isr.c
@@ -2751,7 +2751,7 @@ check_scsi_status:
 				"Port to be marked lost on fcport=%02x%02x%02x, current "
 				"port state= %s comp_status %x.\n", fcport->d_id.b.domain,
 				fcport->d_id.b.area, fcport->d_id.b.al_pa,
-				port_state_str[atomic_read(&fcport->state)],
+				port_state_str[FCS_ONLINE],
 				comp_status);
 
 			qla2x00_mark_device_lost(fcport->vha, fcport, 1, 1);

From 6ab230ed4a167118a637dce58a263aeac04c01a3 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:43:52 +0000
Subject: [PATCH 17/34] qla2x00t-32gbit: Fix qla24xx_process_bidir_cmd()

Set the r??_data_len variables before using these instead of after.

This patch avoids that Coverity reports the following:

const: At condition req_data_len != rsp_data_len, the value of req_data_len must be equal to 0.
const: At condition req_data_len != rsp_data_len, the value of rsp_data_len must be equal to 0.
dead_error_condition: The condition req_data_len != rsp_data_len cannot be true.



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8377 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_bsg.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/qla2x00t-32gbit/qla_bsg.c b/qla2x00t-32gbit/qla_bsg.c
index 3ac82385c..7455b7a9d 100644
--- a/qla2x00t-32gbit/qla_bsg.c
+++ b/qla2x00t-32gbit/qla_bsg.c
@@ -1859,8 +1859,8 @@ static int qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
 	uint16_t nextlid = 0;
 	uint32_t tot_dsds;
 	srb_t *sp = NULL;
-	uint32_t req_data_len = 0;
-	uint32_t rsp_data_len = 0;
+	uint32_t req_data_len;
+	uint32_t rsp_data_len;
 
 	/* Check the type of the adapter */
 	if (!IS_BIDI_CAPABLE(ha)) {
@@ -1965,6 +1965,9 @@ static int qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
 		goto done_unmap_sg;
 	}
 
+	req_data_len = bsg_job->request_payload.payload_len;
+	rsp_data_len = bsg_job->reply_payload.payload_len;
+
 	if (req_data_len != rsp_data_len) {
 		rval = EXT_STATUS_BUSY;
 		ql_log(ql_log_warn, vha, 0x70aa,
@@ -1972,10 +1975,6 @@ static int qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
 		goto done_unmap_sg;
 	}
 
-	req_data_len = bsg_job->request_payload.payload_len;
-	rsp_data_len = bsg_job->reply_payload.payload_len;
-
-
 	/* Alloc SRB structure */
 	sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL);
 	if (!sp) {

From 1b4af79f2883356ad952201eab570980c77f8432 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:44:39 +0000
Subject: [PATCH 18/34] qla2x00t-32gbit: Remove unreachable code from
 qla83xx_idc_lock()

This was detected by Coverity.



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8378 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_os.c | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index ac4e478f8..a4a52df44 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -5750,7 +5750,6 @@ exit:
 void
 qla83xx_idc_lock(scsi_qla_host_t *base_vha, uint16_t requester_id)
 {
-	uint16_t options = (requester_id << 15) | BIT_6;
 	uint32_t data;
 	uint32_t lock_owner;
 	struct qla_hw_data *ha = base_vha->hw;
@@ -5783,22 +5782,6 @@ retry_lock:
 	}
 
 	return;
-
-	/* XXX: IDC-lock implementation using access-control mbx */
-retry_lock2:
-	if (qla83xx_access_control(base_vha, options, 0, 0, NULL)) {
-		ql_dbg(ql_dbg_p3p, base_vha, 0xb072,
-		    "Failed to acquire IDC lock. retrying...\n");
-		/* Retry/Perform IDC-Lock recovery */
-		if (qla83xx_idc_lock_recovery(base_vha) == QLA_SUCCESS) {
-			qla83xx_wait_logic();
-			goto retry_lock2;
-		} else
-			ql_log(ql_log_warn, base_vha, 0xb076,
-			    "IDC Lock recovery FAILED.\n");
-	}
-
-	return;
 }
 
 void

From 6cd0355c1d145303ab0a7caee2469a9e1da4b6e7 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 17:47:16 +0000
Subject: [PATCH 19/34] qla2x00t-32gbit: Suppress a Coverity complaint about
 integer overflow

This patch avoids that Coverity reports the following:

Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
overflow_before_widen: Potentially overflowing expression dma_eng_num *
65536U with type unsigned int (32 bits, unsigned) is evaluated using 32-bit
arithmetic, and then used in a context that expects an expression of type
uint64_t (64 bits, unsigned).



git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8379 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_nx2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_nx2.c b/qla2x00t-32gbit/qla_nx2.c
index 369ac04d0..c056f466f 100644
--- a/qla2x00t-32gbit/qla_nx2.c
+++ b/qla2x00t-32gbit/qla_nx2.c
@@ -2810,7 +2810,7 @@ error:
 
 #define ISP8044_PEX_DMA_ENGINE_INDEX		8
 #define ISP8044_PEX_DMA_BASE_ADDRESS		0x77320000
-#define ISP8044_PEX_DMA_NUM_OFFSET		0x10000
+#define ISP8044_PEX_DMA_NUM_OFFSET		0x10000UL
 #define ISP8044_PEX_DMA_CMD_ADDR_LOW		0x0
 #define ISP8044_PEX_DMA_CMD_ADDR_HIGH		0x04
 #define ISP8044_PEX_DMA_CMD_STS_AND_CNTRL	0x08

From 9a9acef6762e61127632287baf8c218aedcdc6f5 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:07:32 +0000
Subject: [PATCH 20/34] qla2x00t-32gbit: Suppress multiple Coverity complaint
 about out-of-bounds accesses

This patch does not change any functionality.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8380 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_gs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/qla2x00t-32gbit/qla_gs.c b/qla2x00t-32gbit/qla_gs.c
index 257c982cd..78349b2a6 100644
--- a/qla2x00t-32gbit/qla_gs.c
+++ b/qla2x00t-32gbit/qla_gs.c
@@ -1557,7 +1557,7 @@ qla2x00_fdmi_rhba(scsi_qla_host_t *vha)
 	/* Attributes */
 	ct_req->req.rhba.attrs.count =
 	    cpu_to_be32(FDMI_HBA_ATTR_COUNT);
-	entries = ct_req->req.rhba.hba_identifier;
+	entries = &ct_req->req;
 
 	/* Nodename. */
 	eiter = entries + size;
@@ -1766,7 +1766,7 @@ qla2x00_fdmi_rpa(scsi_qla_host_t *vha)
 
 	/* Attributes */
 	ct_req->req.rpa.attrs.count = cpu_to_be32(FDMI_PORT_ATTR_COUNT);
-	entries = ct_req->req.rpa.port_name;
+	entries = &ct_req->req;
 
 	/* FC4 types. */
 	eiter = entries + size;
@@ -1979,7 +1979,7 @@ qla2x00_fdmiv2_rhba(scsi_qla_host_t *vha)
 
 	/* Attributes */
 	ct_req->req.rhba2.attrs.count = cpu_to_be32(FDMIV2_HBA_ATTR_COUNT);
-	entries = ct_req->req.rhba2.hba_identifier;
+	entries = &ct_req->req;
 
 	/* Nodename. */
 	eiter = entries + size;
@@ -2338,7 +2338,7 @@ qla2x00_fdmiv2_rpa(scsi_qla_host_t *vha)
 
 	/* Attributes */
 	ct_req->req.rpa2.attrs.count = cpu_to_be32(FDMIV2_PORT_ATTR_COUNT);
-	entries = ct_req->req.rpa2.port_name;
+	entries = &ct_req->req;
 
 	/* FC4 types. */
 	eiter = entries + size;

From 6ab417a5ef0561963c4abf1ab42ba176d612d1f9 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:08:26 +0000
Subject: [PATCH 21/34] qla2x00t-32gbit: Always check the
 qla2x00_wait_for_hba_online() return value

This patch avoids that Coverity complains that the return value of
qla2x00_wait_for_hba_online() is not always checked.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8381 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c | 2 +-
 qla2x00t-32gbit/qla_attr.c                    | 3 ++-
 qla2x00t-32gbit/qla_target.c                  | 5 +++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c b/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
index b9596a661..f2de74030 100644
--- a/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
+++ b/qla2x00t-32gbit/qla2x00-target/scst_qla2xxx.c
@@ -1170,7 +1170,7 @@ static ssize_t sqa_abort_isp_store(struct kobject *kobj,
 		   tgt->vha->vp_idx);
 
 	set_bit(ISP_ABORT_NEEDED, &tgt->vha->dpc_flags);
-	qla2x00_wait_for_hba_online(tgt->vha);
+	WARN_ON_ONCE(qla2x00_wait_for_hba_online(tgt->vha) != QLA_SUCCESS);
 
 	return size;
 #endif
diff --git a/qla2x00t-32gbit/qla_attr.c b/qla2x00t-32gbit/qla_attr.c
index 8d560c562..2e30d80ec 100644
--- a/qla2x00t-32gbit/qla_attr.c
+++ b/qla2x00t-32gbit/qla_attr.c
@@ -726,7 +726,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
 			break;
 		} else {
 			/* Make sure FC side is not in reset */
-			qla2x00_wait_for_hba_online(vha);
+			WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) !=
+				     QLA_SUCCESS);
 
 			/* Issue MPI reset */
 			scsi_block_requests(vha->host);
diff --git a/qla2x00t-32gbit/qla_target.c b/qla2x00t-32gbit/qla_target.c
index 195851d68..117c34850 100644
--- a/qla2x00t-32gbit/qla_target.c
+++ b/qla2x00t-32gbit/qla_target.c
@@ -6692,7 +6692,8 @@ qlt_enable_vha(struct scsi_qla_host *vha)
 	} else {
 		set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
 		qla2xxx_wake_dpc(base_vha);
-		qla2x00_wait_for_hba_online(base_vha);
+		WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) !=
+			     QLA_SUCCESS);
 	}
 	mutex_unlock(&ha->optrom_mutex);
 }
@@ -6723,7 +6724,7 @@ static void qlt_disable_vha(struct scsi_qla_host *vha)
 
 	set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 	qla2xxx_wake_dpc(vha);
-	qla2x00_wait_for_hba_online(vha);
+	WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS);
 }
 
 /*

From bd051656d025edcba4d29b4dace2cdfa06471daa Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:09:07 +0000
Subject: [PATCH 22/34] qla2x00t: Declare fourth qla2x00_set_model_info()
 argument const

This patch does not change any functionality.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8382 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t/qla_gbl.h  | 4 ++--
 qla2x00t/qla_init.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/qla2x00t/qla_gbl.h b/qla2x00t/qla_gbl.h
index 27e3fe356..7b94d6093 100644
--- a/qla2x00t/qla_gbl.h
+++ b/qla2x00t/qla_gbl.h
@@ -548,8 +548,8 @@ extern void qla82xx_reset_chip(struct scsi_qla_host *);
 extern void qla82xx_config_rings(struct scsi_qla_host *);
 extern void qla82xx_watchdog(scsi_qla_host_t *);
 extern int qla82xx_start_firmware(scsi_qla_host_t *);
-extern void qla2x00_set_model_info(scsi_qla_host_t *, uint8_t *,
-    size_t, char *);
+extern void qla2x00_set_model_info(scsi_qla_host_t *, uint8_t *, size_t,
+				   const char *);
 
 /* Firmware and flash related functions */
 extern int qla82xx_load_risc(scsi_qla_host_t *, uint32_t *);
diff --git a/qla2x00t/qla_init.c b/qla2x00t/qla_init.c
index 6ca8ab051..1c75897d4 100644
--- a/qla2x00t/qla_init.c
+++ b/qla2x00t/qla_init.c
@@ -2153,7 +2153,7 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
 
 inline void
 qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
-	char *def)
+		       const char *def)
 {
 	char *st, *en;
 	uint16_t index;

From 0d173dbca4c46c40e597b00df694edb551901502 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:12:29 +0000
Subject: [PATCH 23/34] qla2x00t-32gbit: Declare fourth
 qla2x00_set_model_info() argument const

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8383 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_gbl.h  | 4 ++--
 qla2x00t-32gbit/qla_init.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/qla2x00t-32gbit/qla_gbl.h b/qla2x00t-32gbit/qla_gbl.h
index b58428f16..0dab0cbc2 100644
--- a/qla2x00t-32gbit/qla_gbl.h
+++ b/qla2x00t-32gbit/qla_gbl.h
@@ -826,8 +826,8 @@ extern int qla82xx_device_state_handler(scsi_qla_host_t *);
 extern void qla8xxx_dev_failed_handler(scsi_qla_host_t *);
 extern void qla82xx_clear_qsnt_ready(scsi_qla_host_t *);
 
-extern void qla2x00_set_model_info(scsi_qla_host_t *, uint8_t *,
-				   size_t, char *);
+extern void qla2x00_set_model_info(scsi_qla_host_t *, uint8_t *, size_t,
+				   const char *);
 extern int qla82xx_mbx_intr_enable(scsi_qla_host_t *);
 extern int qla82xx_mbx_intr_disable(scsi_qla_host_t *);
 extern void qla82xx_start_iocbs(scsi_qla_host_t *);
diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index 1f10663ee..d686adc18 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -4393,7 +4393,7 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
 
 inline void
 qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
-	char *def)
+		       const char *def)
 {
 	char *st, *en;
 	uint16_t index;

From 1119dc47363f6cf42bb93a2a16e9df224420b474 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:13:05 +0000
Subject: [PATCH 24/34] qla2x00t-32gbit: Respect ha->model_number buffer size
 in qla2x00_set_model_info()

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8384 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index d686adc18..d127bee73 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -4432,7 +4432,8 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
 			    qla2x00_model_name[index * 2 + 1],
 			    sizeof(ha->model_desc) - 1);
 		} else {
-			strcpy(ha->model_number, def);
+			strlcpy(ha->model_number, def,
+				sizeof(ha->model_number));
 		}
 	}
 	if (IS_FWI2_CAPABLE(ha))

From 3eedf81cdbcd29f71b11d1d003ecd9a69597e1e3 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:13:35 +0000
Subject: [PATCH 25/34] qla2x00t: Always check the return value of
 qla2x00_eh_wait_for_pending_commands()

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8385 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t/qla_init.c | 3 ++-
 qla2x00t/qla_nx.c   | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/qla2x00t/qla_init.c b/qla2x00t/qla_init.c
index 1c75897d4..7dd610a50 100644
--- a/qla2x00t/qla_init.c
+++ b/qla2x00t/qla_init.c
@@ -3969,7 +3969,8 @@ qla82xx_quiescent_state_cleanup(scsi_qla_host_t *vha)
 					LOOP_DOWN_TIME);
 	}
 	/* Wait for pending cmds to complete */
-	qla2x00_eh_wait_for_pending_commands(vha, 0, 0, WAIT_HOST);
+	WARN_ON_ONCE(qla2x00_eh_wait_for_pending_commands(vha, 0, 0, WAIT_HOST)
+		     != QLA_SUCCESS);
 }
 
 void
diff --git a/qla2x00t/qla_nx.c b/qla2x00t/qla_nx.c
index 5b5a0fb27..d6a00fc25 100644
--- a/qla2x00t/qla_nx.c
+++ b/qla2x00t/qla_nx.c
@@ -3642,11 +3642,13 @@ qla82xx_chip_reset_cleanup(scsi_qla_host_t *vha)
 		spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
 		/* Wait for pending cmds (physical and virtual) to complete */
-		if (!qla2x00_eh_wait_for_pending_commands(vha, 0, 0,
+		if (qla2x00_eh_wait_for_pending_commands(vha, 0, 0,
 		    WAIT_HOST) == QLA_SUCCESS) {
 			ql_dbg(ql_dbg_init, vha, 0x00b3,
 			    "Done wait for "
 			    "pending commands.\n");
+		} else {
+			WARN_ON_ONCE(true);
 		}
 	}
 }

From cf5c7c4093e874f9be4016448bcaf7105f6189e9 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:13:59 +0000
Subject: [PATCH 26/34] qla2x00t-32gbit: Always check the return value of
 qla2x00_eh_wait_for_pending_commands()

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8386 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_init.c | 3 ++-
 qla2x00t-32gbit/qla_nx.c   | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index d127bee73..f9f4ae02c 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -6597,7 +6597,8 @@ qla2x00_quiesce_io(scsi_qla_host_t *vha)
 					LOOP_DOWN_TIME);
 	}
 	/* Wait for pending cmds to complete */
-	qla2x00_eh_wait_for_pending_commands(vha, 0, 0, WAIT_HOST);
+	WARN_ON_ONCE(qla2x00_eh_wait_for_pending_commands(vha, 0, 0, WAIT_HOST)
+		     != QLA_SUCCESS);
 }
 
 void
diff --git a/qla2x00t-32gbit/qla_nx.c b/qla2x00t-32gbit/qla_nx.c
index f72d25be4..b7aae5ca2 100644
--- a/qla2x00t-32gbit/qla_nx.c
+++ b/qla2x00t-32gbit/qla_nx.c
@@ -3709,10 +3709,12 @@ qla82xx_chip_reset_cleanup(scsi_qla_host_t *vha)
 
 		/* Wait for pending cmds (physical and virtual) to complete */
 		if (qla2x00_eh_wait_for_pending_commands(vha, 0, 0,
-		    WAIT_HOST)) {
+		    WAIT_HOST) == QLA_SUCCESS) {
 			ql_dbg(ql_dbg_init, vha, 0x00b3,
 			    "Done wait for "
 			    "pending commands.\n");
+		} else {
+			WARN_ON_ONCE(true);
 		}
 	}
 }

From 5c2147135cf8a60555758ed3c5edbe9cbaabd2dd Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:17:08 +0000
Subject: [PATCH 27/34] qla2x00t: Use strlcpy() and snprintf() instead of
 strncpy()

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8387 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t/qla_init.c |  8 ++++----
 qla2x00t/qla_os.c   | 36 +++++++++++++-----------------------
 2 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/qla2x00t/qla_init.c b/qla2x00t/qla_init.c
index 7dd610a50..4e2b6f5a1 100644
--- a/qla2x00t/qla_init.c
+++ b/qla2x00t/qla_init.c
@@ -2175,9 +2175,9 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
 		if (use_tbl &&
 		    ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&
 		    index < QLA_MODEL_NAMES)
-			strncpy(ha->model_desc,
+			strlcpy(ha->model_desc,
 			    qla2x00_model_name[index * 2 + 1],
-			    sizeof(ha->model_desc) - 1);
+			    sizeof(ha->model_desc));
 	} else {
 		index = (ha->pdev->subsystem_device & 0xff);
 		if (use_tbl &&
@@ -2186,9 +2186,9 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
 			strlcpy(ha->model_number,
 				qla2x00_model_name[index * 2],
 				sizeof(ha->model_number));
-			strncpy(ha->model_desc,
+			strlcpy(ha->model_desc,
 			    qla2x00_model_name[index * 2 + 1],
-			    sizeof(ha->model_desc) - 1);
+			    sizeof(ha->model_desc));
 		} else {
 			strlcpy(ha->model_number, def,
 				sizeof(ha->model_number));
diff --git a/qla2x00t/qla_os.c b/qla2x00t/qla_os.c
index 6465fdb59..fc0042d3e 100644
--- a/qla2x00t/qla_os.c
+++ b/qla2x00t/qla_os.c
@@ -526,15 +526,15 @@ qla2x00_pci_info_str(struct scsi_qla_host *vha, char *str, int str_len)
 static char *
 qla24xx_pci_info_str(struct scsi_qla_host *vha, char *str, int str_len)
 {
-	static char *pci_bus_modes[] = { "33", "66", "100", "133", };
+	static const char *pci_bus_modes[] = { "33", "66", "100", "133", };
 	struct qla_hw_data *ha = vha->hw;
 	uint32_t pci_bus;
 	int pcie_reg;
 
 	pcie_reg = pci_find_capability(ha->pdev, PCI_CAP_ID_EXP);
 	if (pcie_reg) {
-		char lwstr[6];
 		uint16_t pcie_lstat, lspeed, lwidth;
+		const char *speed_str;
 
 		pcie_reg += 0x12;
 		pci_read_config_word(ha->pdev, pcie_reg, &pcie_lstat);
@@ -542,34 +542,24 @@ qla24xx_pci_info_str(struct scsi_qla_host *vha, char *str, int str_len)
 		lwidth = (pcie_lstat &
 		    (BIT_4 | BIT_5 | BIT_6 | BIT_7 | BIT_8 | BIT_9)) >> 4;
 
-		strlcpy(str, "PCIe (", str_len);
 		if (lspeed == 1)
-			strncat(str, "2.5GT/s ", str_len - (strlen(str)+1));
+			speed_str = "2.5GT/s";
 		else if (lspeed == 2)
-			strncat(str, "5.0GT/s ", str_len - (strlen(str)+1));
+			speed_str = "5.0GT/s";
 		else
-			strncat(str, "<unknown> ", str_len - (strlen(str)+1));
-		snprintf(lwstr, sizeof(lwstr), "x%d)", lwidth);
-		strncat(str, lwstr, str_len - (strlen(str)+1));
-
+			speed_str = "<unknown>";
+		snprintf(str, str_len, "PCIe (%s x%d)", speed_str, lwidth);
 		return str;
 	}
 
-	strncpy(str, "PCI", str_len);
 	pci_bus = (ha->pci_attr & CSRX_PCIX_BUS_MODE_MASK) >> 8;
-	if (pci_bus == 0 || pci_bus == 8) {
-		strncat(str, " (", str_len - (strlen(str)+1));
-		strncat(str, pci_bus_modes[pci_bus >> 3], str_len - (strlen(str)+1));
-	} else {
-		strncat(str, "-X ", str_len - (strlen(str)+1));
-		if (pci_bus & BIT_2)
-			strncat(str, "Mode 2", str_len - (strlen(str)+1));
-		else
-			strncat(str, "Mode 1", str_len - (strlen(str)+1));
-		strncat(str, " (", str_len - (strlen(str)+1));
-		strncat(str, pci_bus_modes[pci_bus & ~BIT_2], str_len - (strlen(str)+1));
-	}
-	strncat(str, " MHz)", str_len - (strlen(str)+1));
+	if (pci_bus == 0 || pci_bus == 8)
+		snprintf(str, str_len, "PCI (%s MHz)",
+			 pci_bus_modes[pci_bus >> 3]);
+	else
+		snprintf(str, str_len, "PCI-X Mode %d (%s MHz)",
+			 pci_bus & 4 ? 2 : 1,
+			 pci_bus_modes[pci_bus & 3]);
 
 	return str;
 }

From 3c4662cb5749affcb7ece91f39a863b9b5a540ce Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:37:30 +0000
Subject: [PATCH 28/34] qla2x00t-32gbit: Check output buffer size while
 generating the PCI info string

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8388 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_attr.c |  3 +-
 qla2x00t-32gbit/qla_def.h  |  2 +-
 qla2x00t-32gbit/qla_gbl.h  |  2 +-
 qla2x00t-32gbit/qla_mr.c   |  8 ++----
 qla2x00t-32gbit/qla_os.c   | 57 +++++++++++++++-----------------------
 5 files changed, 30 insertions(+), 42 deletions(-)

diff --git a/qla2x00t-32gbit/qla_attr.c b/qla2x00t-32gbit/qla_attr.c
index 2e30d80ec..dec2699a1 100644
--- a/qla2x00t-32gbit/qla_attr.c
+++ b/qla2x00t-32gbit/qla_attr.c
@@ -1127,7 +1127,8 @@ qla2x00_pci_info_show(struct device *dev, struct device_attribute *attr,
 	char pci_info[30];
 
 	return scnprintf(buf, PAGE_SIZE, "%s\n",
-	    vha->hw->isp_ops->pci_info_str(vha, pci_info));
+			 vha->hw->isp_ops->pci_info_str(vha, pci_info,
+							sizeof(pci_info)));
 }
 
 static ssize_t
diff --git a/qla2x00t-32gbit/qla_def.h b/qla2x00t-32gbit/qla_def.h
index f3dd9a817..3354b842e 100644
--- a/qla2x00t-32gbit/qla_def.h
+++ b/qla2x00t-32gbit/qla_def.h
@@ -3187,7 +3187,7 @@ struct isp_operations {
 	void (*update_fw_options) (struct scsi_qla_host *);
 	int (*load_risc) (struct scsi_qla_host *, uint32_t *);
 
-	char * (*pci_info_str) (struct scsi_qla_host *, char *);
+	char * (*pci_info_str)(struct scsi_qla_host *, char *, size_t);
 	char * (*fw_version_str)(struct scsi_qla_host *, char *, size_t);
 
 	irq_handler_t intr_handler;
diff --git a/qla2x00t-32gbit/qla_gbl.h b/qla2x00t-32gbit/qla_gbl.h
index 0dab0cbc2..3ae2b26e8 100644
--- a/qla2x00t-32gbit/qla_gbl.h
+++ b/qla2x00t-32gbit/qla_gbl.h
@@ -736,7 +736,7 @@ extern int qlafx00_initialize_adapter(struct scsi_qla_host *);
 extern int qlafx00_soft_reset(scsi_qla_host_t *);
 extern int qlafx00_chip_diag(scsi_qla_host_t *);
 extern void qlafx00_config_rings(struct scsi_qla_host *);
-extern char *qlafx00_pci_info_str(struct scsi_qla_host *, char *);
+extern char *qlafx00_pci_info_str(struct scsi_qla_host *, char *, size_t);
 extern char *qlafx00_fw_version_str(struct scsi_qla_host *, char *, size_t);
 extern irqreturn_t qlafx00_intr_handler(int, void *);
 extern void qlafx00_enable_intrs(struct qla_hw_data *);
diff --git a/qla2x00t-32gbit/qla_mr.c b/qla2x00t-32gbit/qla_mr.c
index 98f56cf51..bf97577e7 100644
--- a/qla2x00t-32gbit/qla_mr.c
+++ b/qla2x00t-32gbit/qla_mr.c
@@ -688,14 +688,12 @@ qlafx00_config_rings(struct scsi_qla_host *vha)
 }
 
 char *
-qlafx00_pci_info_str(struct scsi_qla_host *vha, char *str)
+qlafx00_pci_info_str(struct scsi_qla_host *vha, char *str, size_t str_len)
 {
 	struct qla_hw_data *ha = vha->hw;
 
-	if (pci_is_pcie(ha->pdev)) {
-		strcpy(str, "PCIe iSA");
-		return str;
-	}
+	if (pci_is_pcie(ha->pdev))
+		strlcpy(str, "PCIe iSA", str_len);
 	return str;
 }
 
diff --git a/qla2x00t-32gbit/qla_os.c b/qla2x00t-32gbit/qla_os.c
index a4a52df44..9ba584720 100644
--- a/qla2x00t-32gbit/qla_os.c
+++ b/qla2x00t-32gbit/qla_os.c
@@ -556,80 +556,68 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
 }
 
 static char *
-qla2x00_pci_info_str(struct scsi_qla_host *vha, char *str)
+qla2x00_pci_info_str(struct scsi_qla_host *vha, char *str, size_t str_len)
 {
 	struct qla_hw_data *ha = vha->hw;
-	static char *pci_bus_modes[] = {
+	static const char *pci_bus_modes[] = {
 		"33", "66", "100", "133",
 	};
 	uint16_t pci_bus;
 
-	strcpy(str, "PCI");
 	pci_bus = (ha->pci_attr & (BIT_9 | BIT_10)) >> 9;
 	if (pci_bus) {
-		strcat(str, "-X (");
-		strcat(str, pci_bus_modes[pci_bus]);
+		snprintf(str, str_len, "PCI-X (%s MHz)",
+			 pci_bus_modes[pci_bus]);
 	} else {
 		pci_bus = (ha->pci_attr & BIT_8) >> 8;
-		strcat(str, " (");
-		strcat(str, pci_bus_modes[pci_bus]);
+		snprintf(str, str_len, "PCI (%s MHz)", pci_bus_modes[pci_bus]);
 	}
-	strcat(str, " MHz)");
 
-	return (str);
+	return str;
 }
 
 static char *
-qla24xx_pci_info_str(struct scsi_qla_host *vha, char *str)
+qla24xx_pci_info_str(struct scsi_qla_host *vha, char *str, size_t str_len)
 {
-	static char *pci_bus_modes[] = { "33", "66", "100", "133", };
+	static const char *pci_bus_modes[] = { "33", "66", "100", "133", };
 	struct qla_hw_data *ha = vha->hw;
 	uint32_t pci_bus;
 
 	if (pci_is_pcie(ha->pdev)) {
-		char lwstr[6];
 		uint32_t lstat, lspeed, lwidth;
+		const char *speed_str;
 
 		pcie_capability_read_dword(ha->pdev, PCI_EXP_LNKCAP, &lstat);
 		lspeed = lstat & PCI_EXP_LNKCAP_SLS;
 		lwidth = (lstat & PCI_EXP_LNKCAP_MLW) >> 4;
 
-		strcpy(str, "PCIe (");
 		switch (lspeed) {
 		case 1:
-			strcat(str, "2.5GT/s ");
+			speed_str = "2.5GT/s";
 			break;
 		case 2:
-			strcat(str, "5.0GT/s ");
+			speed_str = "5.0GT/s";
 			break;
 		case 3:
-			strcat(str, "8.0GT/s ");
+			speed_str = "8.0GT/s";
 			break;
 		default:
-			strcat(str, "<unknown> ");
+			speed_str = "<unknown>";
 			break;
 		}
-		snprintf(lwstr, sizeof(lwstr), "x%d)", lwidth);
-		strcat(str, lwstr);
+		snprintf(str, str_len, "PCIe (%s x%d)", speed_str, lwidth);
 
 		return str;
 	}
 
-	strcpy(str, "PCI");
 	pci_bus = (ha->pci_attr & CSRX_PCIX_BUS_MODE_MASK) >> 8;
-	if (pci_bus == 0 || pci_bus == 8) {
-		strcat(str, " (");
-		strcat(str, pci_bus_modes[pci_bus >> 3]);
-	} else {
-		strcat(str, "-X ");
-		if (pci_bus & BIT_2)
-			strcat(str, "Mode 2");
-		else
-			strcat(str, "Mode 1");
-		strcat(str, " (");
-		strcat(str, pci_bus_modes[pci_bus & ~BIT_2]);
-	}
-	strcat(str, " MHz)");
+	if (pci_bus == 0 || pci_bus == 8)
+		snprintf(str, str_len, "PCI (%s MHz)",
+			 pci_bus_modes[pci_bus >> 3]);
+	else
+		snprintf(str, str_len, "PCI-X Mode %d (%s MHz)",
+			 pci_bus & 4 ? 2 : 1,
+			 pci_bus_modes[pci_bus & 3]);
 
 	return str;
 }
@@ -3482,7 +3470,8 @@ skip_dpc:
 	    "QLogic %s - %s.\n", ha->model_number, ha->model_desc);
 	ql_log(ql_log_info, base_vha, 0x00fc,
 	    "ISP%04X: %s @ %s hdma%c host#=%ld fw=%s.\n",
-	    pdev->device, ha->isp_ops->pci_info_str(base_vha, pci_info),
+	    pdev->device, ha->isp_ops->pci_info_str(base_vha, pci_info,
+						       sizeof(pci_info)),
 	    pci_name(pdev), ha->flags.enable_64bit_addressing ? '+' : '-',
 	    base_vha->host_no,
 	    ha->isp_ops->fw_version_str(base_vha, fw_str, sizeof(fw_str)));

From 96214a8a1fdaed4324bc887d4456907bcc0295a1 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:38:25 +0000
Subject: [PATCH 29/34] qla2x00t-32gbit: Use memcpy(), strlcpy() and snprintf()
 instead of strncpy()

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8389 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_init.c | 15 ++++++++-------
 qla2x00t-32gbit/qla_mr.c   |  6 ++++--
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index f9f4ae02c..c0a760ab5 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -4405,7 +4405,7 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
 	if (len > sizeof(zero))
 		len = sizeof(zero);
 	if (memcmp(model, &zero, len) != 0) {
-		strncpy(ha->model_number, model, len);
+		memcpy(ha->model_number, model, len);
 		st = en = ha->model_number;
 		en += len - 1;
 		while (en > st) {
@@ -4418,19 +4418,20 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,
 		if (use_tbl &&
 		    ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&
 		    index < QLA_MODEL_NAMES)
-			strncpy(ha->model_desc,
+			strlcpy(ha->model_desc,
 			    qla2x00_model_name[index * 2 + 1],
-			    sizeof(ha->model_desc) - 1);
+			    sizeof(ha->model_desc));
 	} else {
 		index = (ha->pdev->subsystem_device & 0xff);
 		if (use_tbl &&
 		    ha->pdev->subsystem_vendor == PCI_VENDOR_ID_QLOGIC &&
 		    index < QLA_MODEL_NAMES) {
-			strcpy(ha->model_number,
-			    qla2x00_model_name[index * 2]);
-			strncpy(ha->model_desc,
+			strlcpy(ha->model_number,
+				qla2x00_model_name[index * 2],
+				sizeof(ha->model_number));
+			strlcpy(ha->model_desc,
 			    qla2x00_model_name[index * 2 + 1],
-			    sizeof(ha->model_desc) - 1);
+			    sizeof(ha->model_desc));
 		} else {
 			strlcpy(ha->model_number, def,
 				sizeof(ha->model_number));
diff --git a/qla2x00t-32gbit/qla_mr.c b/qla2x00t-32gbit/qla_mr.c
index bf97577e7..3dde54c16 100644
--- a/qla2x00t-32gbit/qla_mr.c
+++ b/qla2x00t-32gbit/qla_mr.c
@@ -1949,8 +1949,10 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)
 	if (fx_type == FXDISC_GET_CONFIG_INFO) {
 		struct config_info_data *pinfo =
 		    (struct config_info_data *) fdisc->u.fxiocb.rsp_addr;
-		strcpy(vha->hw->model_number, pinfo->model_num);
-		strcpy(vha->hw->model_desc, pinfo->model_description);
+		strlcpy(vha->hw->model_number, pinfo->model_num,
+			ARRAY_SIZE(vha->hw->model_number));
+		strlcpy(vha->hw->model_desc, pinfo->model_description,
+			ARRAY_SIZE(vha->hw->model_desc));
 		memcpy(&vha->hw->mr.symbolic_name, pinfo->symbolic_name,
 		    sizeof(vha->hw->mr.symbolic_name));
 		memcpy(&vha->hw->mr.serial_num, pinfo->serial_num,

From 16dab8778367f6c31732fedf7b29eb2e603a14ab Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:39:03 +0000
Subject: [PATCH 30/34] qla2x00t-32gbit: Always check qla24xx_soft_reset()
 return value

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8390 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_tmpl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qla2x00t-32gbit/qla_tmpl.c b/qla2x00t-32gbit/qla_tmpl.c
index 7ed481dd8..294d77c02 100644
--- a/qla2x00t-32gbit/qla_tmpl.c
+++ b/qla2x00t-32gbit/qla_tmpl.c
@@ -429,7 +429,7 @@ qla27xx_fwdt_entry_t266(struct scsi_qla_host *vha,
 	ql_dbg(ql_dbg_misc, vha, 0xd20a,
 	    "%s: reset risc [%lx]\n", __func__, *len);
 	if (buf)
-		qla24xx_soft_reset(vha->hw);
+		WARN_ON_ONCE(qla24xx_soft_reset(vha->hw) != QLA_SUCCESS);
 
 	return qla27xx_next_entry(ent);
 }

From 8e4c0dfb6b19dc0c2e4d23cf16b7a30f56eb114e Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:39:36 +0000
Subject: [PATCH 31/34] qla2x00t-32gbit: Change the return type of
 qla24xx_read_flash_dword()

Return a QLA_* status code instead of returning a pointer. This patch does
not change any functionality.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8391 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_gbl.h | 2 +-
 qla2x00t-32gbit/qla_sup.c | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/qla2x00t-32gbit/qla_gbl.h b/qla2x00t-32gbit/qla_gbl.h
index 3ae2b26e8..9db057b9e 100644
--- a/qla2x00t-32gbit/qla_gbl.h
+++ b/qla2x00t-32gbit/qla_gbl.h
@@ -558,7 +558,7 @@ fc_port_t *qla2x00_find_fcport_by_nportid(scsi_qla_host_t *, port_id_t *, u8);
  * Global Function Prototypes in qla_sup.c source file.
  */
 extern void qla2x00_release_nvram_protection(scsi_qla_host_t *);
-extern uint32_t *qla24xx_read_flash_data(scsi_qla_host_t *, uint32_t *,
+extern int qla24xx_read_flash_data(scsi_qla_host_t *, uint32_t *,
     uint32_t, uint32_t);
 extern uint8_t *qla2x00_read_nvram_data(scsi_qla_host_t *, void *, uint32_t,
     uint32_t);
diff --git a/qla2x00t-32gbit/qla_sup.c b/qla2x00t-32gbit/qla_sup.c
index 1eb82384d..764e1bb0f 100644
--- a/qla2x00t-32gbit/qla_sup.c
+++ b/qla2x00t-32gbit/qla_sup.c
@@ -473,22 +473,24 @@ qla24xx_read_flash_dword(struct qla_hw_data *ha, uint32_t addr, uint32_t *data)
 	return QLA_FUNCTION_TIMEOUT;
 }
 
-uint32_t *
+int
 qla24xx_read_flash_data(scsi_qla_host_t *vha, uint32_t *dwptr, uint32_t faddr,
     uint32_t dwords)
 {
 	ulong i;
+	int ret = QLA_SUCCESS;
 	struct qla_hw_data *ha = vha->hw;
 
 	/* Dword reads to flash. */
 	faddr =  flash_data_addr(ha, faddr);
 	for (i = 0; i < dwords; i++, faddr++, dwptr++) {
-		if (qla24xx_read_flash_dword(ha, faddr, dwptr))
+		ret = qla24xx_read_flash_dword(ha, faddr, dwptr);
+		if (ret != QLA_SUCCESS)
 			break;
 		cpu_to_le32s(dwptr);
 	}
 
-	return dwptr;
+	return ret;
 }
 
 static int

From fc878306ad39b8196a156cd986aa6798413ea3f8 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:40:00 +0000
Subject: [PATCH 32/34] qla27xx_get_active_image(): Check secondary image if
 reading primary image fails

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8392 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_init.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/qla2x00t-32gbit/qla_init.c b/qla2x00t-32gbit/qla_init.c
index c0a760ab5..2fc011fbf 100644
--- a/qla2x00t-32gbit/qla_init.c
+++ b/qla2x00t-32gbit/qla_init.c
@@ -7522,8 +7522,12 @@ qla27xx_get_active_image(struct scsi_qla_host *vha,
 		goto check_sec_image;
 	}
 
-	qla24xx_read_flash_data(vha, (void *)(&pri_image_status),
-	    ha->flt_region_img_status_pri, sizeof(pri_image_status) >> 2);
+	if (qla24xx_read_flash_data(vha, (void *)(&pri_image_status),
+	    ha->flt_region_img_status_pri, sizeof(pri_image_status) >> 2) !=
+	    QLA_SUCCESS) {
+		WARN_ON_ONCE(true);
+		goto check_sec_image;
+	}
 	qla27xx_print_image(vha, "Primary image", &pri_image_status);
 
 	if (qla27xx_check_image_status_signature(&pri_image_status)) {

From 7b3518ec10cbe0ad716c1af9c5cb4bc241235a00 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:40:25 +0000
Subject: [PATCH 33/34] qla2x00t-32gbit: Change the return type of
 qla2x00_update_ms_fdmi_iocb() into void

git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8393 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_gs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/qla2x00t-32gbit/qla_gs.c b/qla2x00t-32gbit/qla_gs.c
index 78349b2a6..cc68f1bbc 100644
--- a/qla2x00t-32gbit/qla_gs.c
+++ b/qla2x00t-32gbit/qla_gs.c
@@ -1479,7 +1479,7 @@ qla24xx_prep_ms_fdmi_iocb(scsi_qla_host_t *vha, uint32_t req_size,
 	return ct_pkt;
 }
 
-static inline ms_iocb_entry_t *
+static void
 qla2x00_update_ms_fdmi_iocb(scsi_qla_host_t *vha, uint32_t req_size)
 {
 	struct qla_hw_data *ha = vha->hw;
@@ -1493,8 +1493,6 @@ qla2x00_update_ms_fdmi_iocb(scsi_qla_host_t *vha, uint32_t req_size)
 		ms_pkt->req_bytecount = cpu_to_le32(req_size);
 		ms_pkt->req_dsd.length = ms_pkt->req_bytecount;
 	}
-
-	return ms_pkt;
 }
 
 /**

From 4cce3cad73da7f9878126947f780ae2583e71746 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 27 May 2019 22:41:01 +0000
Subject: [PATCH 34/34] qla2x00t-32gbit: Remove two superfluous tests

Since qlt_remove_target() only calls qlt_release() if
vha->vha_tgt.qla_tgt != NULL, checking that pointer inside qlt_release()
is not necessary. This patch avoids that Coverity reports the following:

CID 188348 (#1 of 1): Dereference after null check (FORWARD_NULL)
var_deref_model: Passing null pointer &vha->vha_tgt.qla_tgt->tgt_list_entry
to list_del, which dereferences it.


git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8394 d57e44dd-8a1f-0410-8b47-8ef2f437770f
---
 qla2x00t-32gbit/qla_target.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/qla2x00t-32gbit/qla_target.c b/qla2x00t-32gbit/qla_target.c
index 117c34850..56385fd8d 100644
--- a/qla2x00t-32gbit/qla_target.c
+++ b/qla2x00t-32gbit/qla_target.c
@@ -1596,11 +1596,10 @@ static void qlt_release(struct qla_tgt *tgt)
 	struct qla_qpair_hint *h;
 	struct qla_hw_data *ha = vha->hw;
 
-	if ((vha->vha_tgt.qla_tgt != NULL) && !tgt->tgt_stop &&
-	    !tgt->tgt_stopped)
+	if (!tgt->tgt_stop && !tgt->tgt_stopped)
 		qlt_stop_phase1(tgt);
 
-	if ((vha->vha_tgt.qla_tgt != NULL) && !tgt->tgt_stopped)
+	if (!tgt->tgt_stopped)
 		qlt_stop_phase2(tgt);
 
 	for (i = 0; i < vha->hw->max_qpairs + 1; i++) {