* [PATCH v14 0/2] zfcp: Use DMA streaming API to map I/O
@ 2026-10-28 5:14 M Nikhil
2026-10-28 5:14 ` [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure M Nikhil
2026-10-28 5:14 ` [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O M Nikhil
0 siblings, 2 replies; 5+ messages in thread
From: M Nikhil @ 2026-10-28 5:14 UTC (permalink / raw)
To: sashiko-reviews, linux-s390, linux-scsi; +Cc: niharp, pasic, bblock
In the existing zFCP driver, virtual addresses are translated directly
into bus (physical addresses) for DMA operations on all I/O buffers
passing from zFCP driver to the device.
Need for using DMA-API in zFCP driver:
In a Secure Execution environment, the host must ensure that device DMA
accesses are restricted to non-guest-private, page-sized memory blocks.
This prevents I/O failures that can occur when a device attempts to
access guest-private memory. Therefore, guest memory pages must be
prepared by the hypervisor before they become accessible to an I/O
device.
To support this requirement, the host Linux kernel must be reliably
informed whenever a memory region becomes eligible for device DMA access
and when that access must be revoked. This information must be
maintained correctly at least at page size granularity. To satisfy these
requirements, all I/O buffers used by the zFCP driver should be mapped
through the DMA API.
DMA API Integration in zFCP:
The zFCP driver is updated to use the DMA streaming API's to map all the
I/O buffers which will be passed to the device.
All zFCP I/O buffers (QTCB, SRB, CT/ELS and SCSI I/O) are represented as
scatter-gather lists and mapped through DMA API using dma_map_sgtable().
Once the DMA transfer is complete, the corresponding mappings are
released using dma_unmap_sgtable().
By routing all device-visible memory through the DMA mapping layer, the
driver ensures that:
1. DMA access is properly authorized before use.
2. DMA is revoked after use.
3. Secure Execution memory restrictions are honored.
M Nikhil (2):
zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure
zfcp: Use DMA streaming API to map I/O
drivers/s390/scsi/zfcp_aux.c | 15 ++
drivers/s390/scsi/zfcp_dbf.c | 16 +-
drivers/s390/scsi/zfcp_def.h | 4 +
drivers/s390/scsi/zfcp_ext.h | 12 +-
drivers/s390/scsi/zfcp_fc.c | 48 +++--
drivers/s390/scsi/zfcp_fsf.c | 325 +++++++++++++++++++++++++++++-----
drivers/s390/scsi/zfcp_fsf.h | 9 +-
drivers/s390/scsi/zfcp_qdio.c | 40 +++--
drivers/s390/scsi/zfcp_qdio.h | 27 +--
drivers/s390/scsi/zfcp_scsi.c | 205 ++++++++++++++++++++-
10 files changed, 595 insertions(+), 106 deletions(-)
--
2.53.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure
2026-10-28 5:14 [PATCH v14 0/2] zfcp: Use DMA streaming API to map I/O M Nikhil
@ 2026-10-28 5:14 ` M Nikhil
2026-10-28 5:20 ` sashiko-bot
2026-10-28 5:14 ` [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O M Nikhil
1 sibling, 1 reply; 5+ messages in thread
From: M Nikhil @ 2026-10-28 5:14 UTC (permalink / raw)
To: sashiko-reviews, linux-s390, linux-scsi; +Cc: niharp, pasic, bblock
The zfcp_fsf_ct_els data structure is updated to replace the sg_req and
sg_resp members, which are of type struct scatterlist, with request and
response sg_table instances.
These sg_table structure reference the corresponding scatterlists
(sg_req and sg_resp) maintained in struct zfcp_fc_req.
These changes allows to track the original and mapped scatterlist nents
once zfcp is converted to use DMA-API for mapping the sg lists.
Signed-off-by: M Nikhil <nikh1092@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Nihar Panda <niharp@linux.ibm.com>
---
drivers/s390/scsi/zfcp_dbf.c | 16 ++++++++--------
drivers/s390/scsi/zfcp_fc.c | 36 ++++++++++++++++++++++++------------
drivers/s390/scsi/zfcp_fsf.c | 6 ++++--
drivers/s390/scsi/zfcp_fsf.h | 9 +++++----
4 files changed, 41 insertions(+), 26 deletions(-)
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 81fb8af408e9..f7e737e076bf 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -617,9 +617,9 @@ void zfcp_dbf_san_req(char *tag, struct zfcp_fsf_req *fsf, u32 d_id)
if (unlikely(!debug_level_enabled(dbf->san, ZFCP_DBF_SAN_LEVEL)))
return;
- length = (u16)zfcp_qdio_real_bytes(ct_els->req);
- zfcp_dbf_san(tag, dbf, "san_req", ct_els->req, ZFCP_DBF_SAN_REQ,
- length, fsf->req_id, d_id, length);
+ length = (u16)zfcp_qdio_real_bytes(ct_els->sgt_req.sgl);
+ zfcp_dbf_san(tag, dbf, "san_req", ct_els->sgt_req.sgl,
+ ZFCP_DBF_SAN_REQ, length, fsf->req_id, d_id, length);
}
static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag,
@@ -627,9 +627,9 @@ static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag,
u16 len)
{
struct zfcp_fsf_ct_els *ct_els = fsf->data;
- struct fc_ct_hdr *reqh = sg_virt(ct_els->req);
+ struct fc_ct_hdr *reqh = sg_virt(ct_els->sgt_req.sgl);
struct fc_ns_gid_ft *reqn = (struct fc_ns_gid_ft *)(reqh + 1);
- struct scatterlist *resp_entry = ct_els->resp;
+ struct scatterlist *resp_entry = ct_els->sgt_resp.sgl;
struct fc_ct_hdr *resph;
struct fc_gpn_ft_resp *acc;
int max_entries, x, last = 0;
@@ -698,9 +698,9 @@ void zfcp_dbf_san_res(char *tag, struct zfcp_fsf_req *fsf)
if (unlikely(!debug_level_enabled(dbf->san, ZFCP_DBF_SAN_LEVEL)))
return;
- length = (u16)zfcp_qdio_real_bytes(ct_els->resp);
- zfcp_dbf_san(tag, dbf, "san_res", ct_els->resp, ZFCP_DBF_SAN_RES,
- length, fsf->req_id, ct_els->d_id,
+ length = (u16)zfcp_qdio_real_bytes(ct_els->sgt_resp.sgl);
+ zfcp_dbf_san(tag, dbf, "san_res", ct_els->sgt_resp.sgl,
+ ZFCP_DBF_SAN_RES, length, fsf->req_id, ct_els->d_id,
zfcp_dbf_san_res_cap_len_if_gpn_ft(tag, fsf, length));
}
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 05d081297879..1fb6f2c3b607 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -393,10 +393,12 @@ static int zfcp_fc_ns_gid_pn_request(struct zfcp_port *port,
fc_req->ct_els.port = port;
fc_req->ct_els.handler = zfcp_fc_complete;
fc_req->ct_els.handler_data = &completion;
- fc_req->ct_els.req = &fc_req->sg_req;
- fc_req->ct_els.resp = &fc_req->sg_rsp;
+ fc_req->ct_els.sgt_req.sgl = &fc_req->sg_req;
+ fc_req->ct_els.sgt_resp.sgl = &fc_req->sg_rsp;
sg_init_one(&fc_req->sg_req, gid_pn_req, sizeof(*gid_pn_req));
sg_init_one(&fc_req->sg_rsp, gid_pn_rsp, sizeof(*gid_pn_rsp));
+ fc_req->ct_els.sgt_req.orig_nents = sg_nents(&fc_req->sg_req);
+ fc_req->ct_els.sgt_resp.orig_nents = sg_nents(&fc_req->sg_rsp);
zfcp_fc_ct_ns_init(&gid_pn_req->ct_hdr,
FC_NS_GID_PN, ZFCP_FC_CT_SIZE_PAGE);
@@ -558,12 +560,14 @@ static int zfcp_fc_adisc(struct zfcp_port *port)
return -ENOMEM;
fc_req->ct_els.port = port;
- fc_req->ct_els.req = &fc_req->sg_req;
- fc_req->ct_els.resp = &fc_req->sg_rsp;
+ fc_req->ct_els.sgt_req.sgl = &fc_req->sg_req;
+ fc_req->ct_els.sgt_resp.sgl = &fc_req->sg_rsp;
sg_init_one(&fc_req->sg_req, &fc_req->u.adisc.req,
sizeof(struct fc_els_adisc));
sg_init_one(&fc_req->sg_rsp, &fc_req->u.adisc.rsp,
sizeof(struct fc_els_adisc));
+ fc_req->ct_els.sgt_req.orig_nents = sg_nents(&fc_req->sg_req);
+ fc_req->ct_els.sgt_resp.orig_nents = sg_nents(&fc_req->sg_rsp);
fc_req->ct_els.handler = zfcp_fc_adisc_handler;
fc_req->ct_els.handler_data = fc_req;
@@ -706,8 +710,10 @@ static int zfcp_fc_send_gpn_ft(struct zfcp_fc_req *fc_req,
ct_els->handler = zfcp_fc_complete;
ct_els->handler_data = &completion;
- ct_els->req = &fc_req->sg_req;
- ct_els->resp = &fc_req->sg_rsp;
+ ct_els->sgt_req.sgl = &fc_req->sg_req;
+ ct_els->sgt_resp.sgl = &fc_req->sg_rsp;
+ ct_els->sgt_req.orig_nents = sg_nents(&fc_req->sg_req);
+ ct_els->sgt_resp.orig_nents = sg_nents(&fc_req->sg_rsp);
ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct_els, NULL,
ZFCP_FC_CTELS_TMO);
@@ -865,8 +871,10 @@ static int zfcp_fc_gspn(struct zfcp_adapter *adapter,
ct_els->handler = zfcp_fc_complete;
ct_els->handler_data = &completion;
- ct_els->req = &fc_req->sg_req;
- ct_els->resp = &fc_req->sg_rsp;
+ ct_els->sgt_req.sgl = &fc_req->sg_req;
+ ct_els->sgt_resp.sgl = &fc_req->sg_rsp;
+ ct_els->sgt_req.orig_nents = sg_nents(&fc_req->sg_req);
+ ct_els->sgt_resp.orig_nents = sg_nents(&fc_req->sg_rsp);
ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct_els, NULL,
ZFCP_FC_CTELS_TMO);
@@ -924,8 +932,10 @@ static void zfcp_fc_rspn(struct zfcp_adapter *adapter,
ct_els->handler = zfcp_fc_complete;
ct_els->handler_data = &completion;
- ct_els->req = &fc_req->sg_req;
- ct_els->resp = &fc_req->sg_rsp;
+ ct_els->sgt_req.sgl = &fc_req->sg_req;
+ ct_els->sgt_resp.sgl = &fc_req->sg_rsp;
+ ct_els->sgt_req.orig_nents = sg_nents(&fc_req->sg_req);
+ ct_els->sgt_resp.orig_nents = sg_nents(&fc_req->sg_rsp);
ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct_els, NULL,
ZFCP_FC_CTELS_TMO);
@@ -1090,8 +1100,10 @@ int zfcp_fc_exec_bsg_job(struct bsg_job *job)
if (!(atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_OPEN))
return -EINVAL;
- ct_els->req = job->request_payload.sg_list;
- ct_els->resp = job->reply_payload.sg_list;
+ ct_els->sgt_req.sgl = job->request_payload.sg_list;
+ ct_els->sgt_resp.sgl = job->reply_payload.sg_list;
+ ct_els->sgt_req.orig_nents = sg_nents(ct_els->sgt_req.sgl);
+ ct_els->sgt_resp.orig_nents = sg_nents(ct_els->sgt_resp.sgl);
ct_els->handler_data = job;
switch (bsg_request->msgcode) {
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index d407f16e77ef..a3b99839da9e 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -1242,7 +1242,8 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
}
req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
- ret = zfcp_fsf_setup_ct_els(req, ct->req, ct->resp, timeout);
+ ret = zfcp_fsf_setup_ct_els(req, ct->sgt_req.sgl, ct->sgt_resp.sgl,
+ timeout);
if (ret)
goto failed_send;
@@ -1342,7 +1343,8 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
if (!zfcp_adapter_multi_buffer_active(adapter))
zfcp_qdio_sbal_limit(qdio, &req->qdio_req, 2);
- ret = zfcp_fsf_setup_ct_els(req, els->req, els->resp, timeout);
+ ret = zfcp_fsf_setup_ct_els(req, els->sgt_req.sgl, els->sgt_resp.sgl,
+ timeout);
if (ret)
goto failed_send;
diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
index 4b92e85ec71d..22e7fd933a78 100644
--- a/drivers/s390/scsi/zfcp_fsf.h
+++ b/drivers/s390/scsi/zfcp_fsf.h
@@ -487,8 +487,9 @@ struct zfcp_blk_drv_data {
/**
* struct zfcp_fsf_ct_els - zfcp data for ct or els request
- * @req: scatter-gather list for request, points to &zfcp_fc_req.sg_req or BSG
- * @resp: scatter-gather list for response, points to &zfcp_fc_req.sg_rsp or BSG
+ * @sgt_req: sg_table for request, its sgl points to &zfcp_fc_req.sg_req or BSG
+ * @sgt_resp: sg_table for response, its sgl points to &zfcp_fc_req.sg_resp
+ * or BSG
* @handler: handler function (called for response to the request)
* @handler_data: data passed to handler function
* @port: Optional pointer to port for zfcp internal ELS (only test link ADISC)
@@ -496,8 +497,8 @@ struct zfcp_blk_drv_data {
* @d_id: Destination ID of either open WKA port for CT or of D_ID for ELS
*/
struct zfcp_fsf_ct_els {
- struct scatterlist *req;
- struct scatterlist *resp;
+ struct sg_table sgt_req;
+ struct sg_table sgt_resp;
void (*handler)(void *);
void *handler_data;
struct zfcp_port *port;
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O
2026-10-28 5:14 [PATCH v14 0/2] zfcp: Use DMA streaming API to map I/O M Nikhil
2026-10-28 5:14 ` [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure M Nikhil
@ 2026-10-28 5:14 ` M Nikhil
2026-10-28 5:45 ` sashiko-bot
1 sibling, 1 reply; 5+ messages in thread
From: M Nikhil @ 2026-10-28 5:14 UTC (permalink / raw)
To: sashiko-reviews, linux-s390, linux-scsi; +Cc: niharp, pasic, bblock
In the existing zFCP driver, virtual addresses are translated directly
into bus (physical) addresses for DMA operations on all I/O buffers
passed from the zFCP driver to the device.
Need for DMA API:
In secure execution environment, the host must ensure that device DMA
addresses are restricted to non-guest-private, page-sized memory blocks.
This prevents I/O failures that can occur when a device attempts to
access guest-private memory. Therefore, guest memory pages must be
prepared by the hypervisor before they become accessible to an I/O
device.
To support this requirement, the host linux kernel must be reliably
informed whenever a memory region becomes eligible for device DMA access
and when that access must be revoked. This information must be
maintained correctly at least at page level granularity.
To satisfy these requirements, all I/O buffers used by the zFCP driver
should be mapped through the DMA API.
DMA streaming API usage in zFCP:
Changes in this patch-series converts all I/O buffer mappings in the
zFCP driver to use the DMA streaming API. Specifically,
`dma_map_sgtable()` and `dma_unmap_sgtable()` are used to map and unmap
the scatter-gather lists.
All zFCP I/O buffers (QTCB, SRB, CT/ELS and SCSI I/O) are represented
using scatter-gather lists. The `sg_table` structure, which encapsulates
the scatterlist together with the original and mapped entry counts, is
used to manage DMA mappings efficiently.
Use struct sg_table to manage scatter-gather lists for QTCB, SRB,
CT/ELS, and SCSI I/O buffers. Initialize single-entry scatterlists for
buffers that are not already represented by scatter-gather tables. For
SCSI I/O, reuse the tables provided by the SCSI midlayer and temporarily
adjust orig_nents when fewer entries are populated than allocated.
Map buffers after updating their contents. For SCSI I/O, synchronize
req->qtcb for device access in zfcp_fsf_fcp_cmnd() before submitting the
request to QDIO. DMA unmapping handles synchronization for CPU access on
the receive path.
Signed-off-by: M Nikhil <nikh1092@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Nihar Panda <niharp@linux.ibm.com>
---
v13 -> v14
- Fix NULL pointer dereference in DMA mapping if the scatterlist has
coalesced segments.
- Also handle dma unmap when scatterlist has coalesced segments.
- DMA sync with device for req->qtcb added inside zfcp_fsf_req_send()
before sending request. This is added to sync the dma address of
req->qtcb after parameters in qtcb are modified.
- Add zfcp_qdio_zero_sbals() whenever cleanup during the failure of
subsequent maps to cleanup the stale QDIO entries.
- Use the DMA mapped count for setting data division rather than
pre-mapped CPU segment count.
- Fix double unmaps, UAF and other DMA mapping leak during the SCSI
abort scenarios when the hardware is still using DMA mapped buffers.
- Use dma_set_mask instead of dma_set_mask_and_coherent to avoid
override of DMA mask set in CIO layer for 64 bit.
---
drivers/s390/scsi/zfcp_aux.c | 15 ++
drivers/s390/scsi/zfcp_def.h | 4 +
drivers/s390/scsi/zfcp_ext.h | 12 +-
drivers/s390/scsi/zfcp_fc.c | 12 ++
drivers/s390/scsi/zfcp_fsf.c | 325 +++++++++++++++++++++++++++++-----
drivers/s390/scsi/zfcp_qdio.c | 40 +++--
drivers/s390/scsi/zfcp_qdio.h | 27 +--
drivers/s390/scsi/zfcp_scsi.c | 205 ++++++++++++++++++++-
8 files changed, 557 insertions(+), 83 deletions(-)
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index fea573e00f9d..eb1f34133df4 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -329,6 +329,18 @@ static void zfcp_destroy_adapter_work_queue(struct zfcp_adapter *adapter)
}
+static int zfcp_set_dma_mask_for_adapter(struct zfcp_adapter *adapter)
+{
+ int ret;
+
+ ret = dma_set_mask(&adapter->ccw_device->dev, DMA_BIT_MASK(64));
+ if (ret)
+ dev_err(&adapter->ccw_device->dev,
+ "Setting the DMA mask failed for the FCP device.\n");
+
+ return ret;
+}
+
/**
* zfcp_adapter_enqueue - enqueue a new adapter to the list
* @ccw_device: pointer to the struct cc_device
@@ -404,6 +416,9 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
rwlock_init(&adapter->erp_lock);
rwlock_init(&adapter->abort_lock);
+ if (zfcp_set_dma_mask_for_adapter(adapter))
+ goto failed;
+
if (zfcp_erp_thread_setup(adapter))
goto failed;
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 6c761299a22f..5063921e8d93 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -322,6 +322,8 @@ static inline u64 zfcp_scsi_dev_lun(struct scsi_device *sdev)
* @pool: reference to memory pool if used for this request
* @issued: time when request was send (STCK)
* @handler: handler which should be called to process response
+ * @metadata_sgt: sg_table for metadata of a QTCB or SRB request
+ * @metadata_sg: scatterlist for metadata of a QTCB or SRB request
*/
struct zfcp_fsf_req {
struct list_head list;
@@ -337,6 +339,8 @@ struct zfcp_fsf_req {
mempool_t *pool;
unsigned long long issued;
void (*handler)(struct zfcp_fsf_req *);
+ struct sg_table metadata_sgt;
+ struct scatterlist metadata_sg;
};
static inline
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 0eb9bc9d03e4..046de5aac997 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -141,6 +141,7 @@ extern void zfcp_fsf_req_free(struct zfcp_fsf_req *);
extern void zfcp_fsf_fc_host_link_down(struct zfcp_adapter *adapter);
extern struct zfcp_fsf_req *zfcp_fsf_fcp_task_mgmt(struct scsi_device *sdev,
u8 tm_flags);
+void zfcp_fsf_fcp_task_mgmt_handler(struct zfcp_fsf_req *req);
extern struct zfcp_fsf_req *zfcp_fsf_abort_fcp_cmnd(struct scsi_cmnd *);
extern void zfcp_fsf_reqid_check(struct zfcp_qdio *, int);
enum zfcp_fsf_print_fmt {
@@ -150,6 +151,11 @@ enum zfcp_fsf_print_fmt {
extern ssize_t zfcp_fsf_scnprint_fc_security(char *buf, size_t size,
u32 fc_security,
enum zfcp_fsf_print_fmt fmt);
+int zfcp_fsf_req_map_sg(struct zfcp_fsf_req *req, struct sg_table *sgt,
+ enum dma_data_direction dma_dir);
+void zfcp_fsf_req_unmap_sg(struct device *dev,
+ struct sg_table *sgt,
+ enum dma_data_direction dma_dir);
/* zfcp_qdio.c */
extern int zfcp_qdio_setup(struct zfcp_adapter *);
@@ -157,13 +163,15 @@ extern void zfcp_qdio_destroy(struct zfcp_qdio *);
extern int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
__must_hold(qdio->req_q_lock);
extern int zfcp_qdio_send(struct zfcp_qdio *, struct zfcp_qdio_req *);
-extern int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *, struct zfcp_qdio_req *,
- struct scatterlist *);
+int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct sg_table *sgt,
+ struct zfcp_fsf_req *req,
+ enum dma_data_direction dma_dir);
extern void zfcp_qdio_shost_update(struct zfcp_adapter *const adapter,
const struct zfcp_qdio *const qdio);
extern int zfcp_qdio_open(struct zfcp_qdio *);
extern void zfcp_qdio_close(struct zfcp_qdio *);
extern void zfcp_qdio_siosl(struct zfcp_adapter *);
+void zfcp_qdio_zero_sbals(struct qdio_buffer *sbal[], int first, int cnt);
/* zfcp_scsi.c */
extern bool zfcp_experimental_dix;
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 1fb6f2c3b607..bc8dfdebe88f 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -1104,6 +1104,18 @@ int zfcp_fc_exec_bsg_job(struct bsg_job *job)
ct_els->sgt_resp.sgl = job->reply_payload.sg_list;
ct_els->sgt_req.orig_nents = sg_nents(ct_els->sgt_req.sgl);
ct_els->sgt_resp.orig_nents = sg_nents(ct_els->sgt_resp.sgl);
+ /*
+ * dd_data lives past the memset(job, 0, sizeof(*job)) boundary in
+ * bsg_transport_sg_io_fn() and is never zeroed by blk-mq on request
+ * reuse. A prior BSG command will have left sgt->nents set to the
+ * mapped entry count from dma_map_sgtable(). zfcp_fsf_req_map_sg()
+ * treats any non-zero nents as a SCSI-midlayer "populated < allocated"
+ * hint and clamps orig_nents to it, causing truncated DMA mappings for
+ * larger follow-on payloads. Reset nents so these sg_tables are
+ * handled like zFCP-internal ones (nents == 0 before mapping).
+ */
+ ct_els->sgt_req.nents = 0;
+ ct_els->sgt_resp.nents = 0;
ct_els->handler_data = job;
switch (bsg_request->msgcode) {
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index a3b99839da9e..7e7cc3ec2090 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -14,6 +14,7 @@
#include <linux/types.h>
#include <linux/slab.h>
#include <scsi/fc/fc_els.h>
+#include <linux/dma-mapping.h>
#include "zfcp_ext.h"
#include "zfcp_fc.h"
#include "zfcp_dbf.h"
@@ -84,6 +85,88 @@ static void zfcp_fsf_class_not_supp(struct zfcp_fsf_req *req)
req->status |= ZFCP_STATUS_FSFREQ_ERROR;
}
+/**
+ * zfcp_fsf_req_map_sg - map the scattergather list for DMA transfer
+ * @req: pointer to zfcp_fsf_req
+ * @sgt: pointer to scattergather list table
+ * @dma_dir: DMA data direction
+ * Returns: 0 on success, -EIO otherwise
+ */
+int zfcp_fsf_req_map_sg(struct zfcp_fsf_req *req, struct sg_table *sgt,
+ enum dma_data_direction dma_dir)
+{
+ unsigned int saved_orig_nents;
+ int ret;
+
+ if (!valid_dma_direction(dma_dir))
+ return sgt->orig_nents ? -EIO : 0;
+
+ if (!sgt->orig_nents)
+ return 0;
+
+ /*
+ * The SCSI midlayer sets orig_nents to the allocated SG capacity and
+ * nents to the actually populated entry count (nents <= orig_nents).
+ * dma_map_sgtable() and dma_unmap_sgtable() both use orig_nents, so
+ * clamp it to the populated count to avoid mapping trailing zero-length
+ * entries. Only clamp when nents has been explicitly set (nents > 0);
+ * zFCP-internal sg_tables leave nents = 0 before mapping, relying
+ * solely on orig_nents.
+ */
+ saved_orig_nents = sgt->orig_nents;
+ if (sgt->nents > 0 && sgt->nents < sgt->orig_nents)
+ sgt->orig_nents = sgt->nents;
+
+ ret = dma_map_sgtable(&req->adapter->ccw_device->dev, sgt, dma_dir, 0);
+
+ sgt->orig_nents = saved_orig_nents;
+
+ return ret;
+}
+
+/**
+ * zfcp_fsf_req_unmap_sg - unmap the scattergather list after DMA transfer
+ * @dev: pointer to the device used for DMA
+ * @sgt: pointer to scattergather list table
+ * @dma_dir: DMA direction of the sg
+ */
+void zfcp_fsf_req_unmap_sg(struct device *dev, struct sg_table *sgt,
+ enum dma_data_direction dma_dir)
+{
+ unsigned int saved_orig_nents;
+
+ /*
+ * We still need the check for mapped sg count here to not perform
+ * unmap for SCSI commands which have zero payload.
+ */
+ if (!sgt->nents)
+ return;
+
+ saved_orig_nents = sgt->orig_nents;
+ if (sgt->nents < sgt->orig_nents)
+ sgt->orig_nents = sgt->nents;
+
+ dma_unmap_sgtable(dev, sgt, dma_dir, 0);
+
+ sgt->orig_nents = saved_orig_nents;
+}
+
+/**
+ * zfcp_fsf_req_unmap_metadata - unmap the metadata associated with FSF req
+ * @req: pointer to zfcp_fsf_req
+ */
+static inline
+void zfcp_fsf_req_unmap_metadata(struct zfcp_fsf_req *const req)
+{
+ struct device *dev = &req->adapter->ccw_device->dev;
+
+ if (unlikely(zfcp_fsf_req_is_status_read_buffer(req)))
+ zfcp_fsf_req_unmap_sg(dev, &req->metadata_sgt, DMA_FROM_DEVICE);
+ else
+ zfcp_fsf_req_unmap_sg(dev, &req->metadata_sgt,
+ DMA_BIDIRECTIONAL);
+}
+
/**
* zfcp_fsf_req_free - free memory used by fsf request
* @req: pointer to struct zfcp_fsf_req
@@ -259,6 +342,8 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
struct zfcp_adapter *adapter = req->adapter;
struct fsf_status_read_buffer *sr_buf = req->data;
+ zfcp_fsf_req_unmap_metadata(req);
+
if (req->status & ZFCP_STATUS_FSFREQ_DISMISSED) {
zfcp_dbf_hba_fsf_uss("fssrh_1", req);
mempool_free(virt_to_page(sr_buf), adapter->pool.sr_data);
@@ -457,6 +542,7 @@ static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req)
return;
}
+ zfcp_fsf_req_unmap_metadata(req);
timer_delete_sync(&req->timer);
zfcp_fsf_protstatus_eval(req);
zfcp_fsf_fsfstatus_eval(req);
@@ -870,10 +956,27 @@ static struct zfcp_fsf_req *zfcp_fsf_req_create(struct zfcp_qdio *qdio,
req->qtcb->prefix.qtcb_version = FSF_QTCB_CURRENT_VERSION;
req->qtcb->header.req_handle = req->req_id;
req->qtcb->header.fsf_command = fsf_cmd;
- }
- zfcp_qdio_req_init(adapter->qdio, &req->qdio_req, req->req_id, sbtype,
- req->qtcb, sizeof(struct fsf_qtcb));
+ sg_init_one(&req->metadata_sg, req->qtcb,
+ sizeof(struct fsf_qtcb));
+ req->metadata_sgt.sgl = &req->metadata_sg;
+ req->metadata_sgt.orig_nents = 1;
+
+ if (zfcp_fsf_req_map_sg(req, &req->metadata_sgt,
+ DMA_BIDIRECTIONAL)) {
+ zfcp_fsf_req_free(req);
+ return ERR_PTR(-EIO);
+ }
+
+ zfcp_qdio_req_init(adapter->qdio, &req->qdio_req, req->req_id,
+ sbtype, true,
+ sg_dma_len(req->metadata_sgt.sgl),
+ sg_dma_address(req->metadata_sgt.sgl));
+ } else {
+ /* SRB */
+ zfcp_qdio_req_init(adapter->qdio, &req->qdio_req, req->req_id,
+ sbtype, false, 0, 0);
+ }
return req;
}
@@ -885,6 +988,15 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
struct zfcp_qdio *qdio = adapter->qdio;
u64 req_id = req->req_id;
+ /*
+ * Flush all CPU-side QTCB writes to the SWIOTLB bounce buffer now
+ * that the QTCB is fully populated. SRBs carry no outbound QTCB.
+ */
+ if (!is_srb)
+ dma_sync_sgtable_for_device(&adapter->ccw_device->dev,
+ &req->metadata_sgt,
+ DMA_BIDIRECTIONAL);
+
zfcp_reqlist_add(adapter->req_list, req);
req->qdio_req.qdio_outb_usage = atomic_read(&qdio->req_q_free);
@@ -954,7 +1066,17 @@ int zfcp_fsf_status_read(struct zfcp_qdio *qdio)
memset(sr_buf, 0, sizeof(*sr_buf));
req->data = sr_buf;
- zfcp_qdio_fill_next(qdio, &req->qdio_req, sr_buf, sizeof(*sr_buf));
+ sg_init_one(&req->metadata_sg, sr_buf, sizeof(*sr_buf));
+ req->metadata_sgt.sgl = &req->metadata_sg;
+ req->metadata_sgt.orig_nents = 1;
+
+ retval = zfcp_fsf_req_map_sg(req, &req->metadata_sgt, DMA_FROM_DEVICE);
+ if (unlikely(retval))
+ goto failed_dma_map;
+
+ zfcp_qdio_fill_next(qdio, &req->qdio_req,
+ sg_dma_address(req->metadata_sgt.sgl),
+ sg_dma_len(req->metadata_sgt.sgl));
zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
retval = zfcp_fsf_req_send(req);
@@ -965,6 +1087,8 @@ int zfcp_fsf_status_read(struct zfcp_qdio *qdio)
goto out;
failed_req_send:
+ zfcp_fsf_req_unmap_metadata(req);
+failed_dma_map:
req->data = NULL;
mempool_free(virt_to_page(sr_buf), adapter->pool.sr_data);
failed_buf:
@@ -1076,6 +1200,7 @@ struct zfcp_fsf_req *zfcp_fsf_abort_fcp_cmnd(struct scsi_cmnd *scmnd)
}
out_error_free:
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
req = NULL;
out:
@@ -1091,6 +1216,11 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
ct->status = -EINVAL;
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &ct->sgt_req, DMA_TO_DEVICE);
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &ct->sgt_resp, DMA_FROM_DEVICE);
+
if (req->status & ZFCP_STATUS_FSFREQ_ERROR)
goto skip_fsfstatus;
@@ -1130,19 +1260,42 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
ct->handler(ct->handler_data);
}
-static void zfcp_fsf_setup_ct_els_unchained(struct zfcp_qdio *qdio,
- struct zfcp_qdio_req *q_req,
- struct scatterlist *sg_req,
- struct scatterlist *sg_resp)
+static int zfcp_fsf_setup_ct_els_unchained(struct zfcp_fsf_req *req,
+ struct zfcp_qdio *qdio,
+ struct sg_table *sg_req_table,
+ struct sg_table *sg_resp_table)
{
- zfcp_qdio_fill_next(qdio, q_req, sg_virt(sg_req), sg_req->length);
- zfcp_qdio_fill_next(qdio, q_req, sg_virt(sg_resp), sg_resp->length);
- zfcp_qdio_set_sbale_last(qdio, q_req);
+ int retval = 0;
+
+ retval = zfcp_fsf_req_map_sg(req, sg_req_table, DMA_TO_DEVICE);
+ if (unlikely(retval))
+ goto err;
+
+ retval = zfcp_fsf_req_map_sg(req, sg_resp_table,
+ DMA_FROM_DEVICE);
+ if (unlikely(retval))
+ goto err_unmap;
+
+ zfcp_qdio_fill_next(qdio, &req->qdio_req,
+ sg_dma_address(sg_req_table->sgl),
+ sg_dma_len(sg_req_table->sgl));
+ zfcp_qdio_fill_next(qdio, &req->qdio_req,
+ sg_dma_address(sg_resp_table->sgl),
+ sg_dma_len(sg_resp_table->sgl));
+ zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
+
+ return 0;
+
+err_unmap:
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ sg_req_table, DMA_TO_DEVICE);
+err:
+ return retval;
}
static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
- struct scatterlist *sg_req,
- struct scatterlist *sg_resp)
+ struct sg_table *sgt_req,
+ struct sg_table *sgt_resp)
{
struct zfcp_adapter *adapter = req->adapter;
struct zfcp_qdio *qdio = adapter->qdio;
@@ -1150,57 +1303,73 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
u32 feat = adapter->adapter_features;
if (zfcp_adapter_multi_buffer_active(adapter)) {
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_req))
+ if (zfcp_qdio_sbals_from_sg(qdio, sgt_req, req, DMA_TO_DEVICE))
return -EIO;
+
qtcb->bottom.support.req_buf_length =
- zfcp_qdio_real_bytes(sg_req);
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_resp))
- return -EIO;
+ zfcp_qdio_real_bytes(sgt_req->sgl);
+
+ if (zfcp_qdio_sbals_from_sg(qdio, sgt_resp, req, DMA_FROM_DEVICE))
+ goto err_unmap;
+
qtcb->bottom.support.resp_buf_length =
- zfcp_qdio_real_bytes(sg_resp);
+ zfcp_qdio_real_bytes(sgt_resp->sgl);
- zfcp_qdio_set_data_div(qdio, &req->qdio_req, sg_nents(sg_req));
+ zfcp_qdio_set_data_div(qdio, &req->qdio_req,
+ sgt_req->nents);
zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
zfcp_qdio_set_scount(qdio, &req->qdio_req);
return 0;
}
/* use single, unchained SBAL if it can hold the request */
- if (zfcp_qdio_sg_one_sbale(sg_req) && zfcp_qdio_sg_one_sbale(sg_resp)) {
- zfcp_fsf_setup_ct_els_unchained(qdio, &req->qdio_req,
- sg_req, sg_resp);
+ if (zfcp_qdio_sg_one_sbale(sgt_req->sgl) &&
+ zfcp_qdio_sg_one_sbale(sgt_resp->sgl)) {
+ if (zfcp_fsf_setup_ct_els_unchained(req, qdio, sgt_req,
+ sgt_resp))
+ return -EIO;
+
return 0;
}
if (!(feat & FSF_FEATURE_ELS_CT_CHAINED_SBALS))
return -EOPNOTSUPP;
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_req))
+ if (zfcp_qdio_sbals_from_sg(qdio, sgt_req, req, DMA_TO_DEVICE))
return -EIO;
- qtcb->bottom.support.req_buf_length = zfcp_qdio_real_bytes(sg_req);
+ qtcb->bottom.support.req_buf_length =
+ zfcp_qdio_real_bytes(sgt_req->sgl);
zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
zfcp_qdio_skip_to_last_sbale(qdio, &req->qdio_req);
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_resp))
- return -EIO;
+ if (zfcp_qdio_sbals_from_sg(qdio, sgt_resp, req, DMA_FROM_DEVICE))
+ goto err_unmap;
- qtcb->bottom.support.resp_buf_length = zfcp_qdio_real_bytes(sg_resp);
+ qtcb->bottom.support.resp_buf_length =
+ zfcp_qdio_real_bytes(sgt_resp->sgl);
zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
return 0;
+
+err_unmap:
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ sgt_req, DMA_TO_DEVICE);
+ zfcp_qdio_zero_sbals(qdio->req_q, req->qdio_req.sbal_first,
+ req->qdio_req.sbal_number);
+ return -EIO;
}
static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
- struct scatterlist *sg_req,
- struct scatterlist *sg_resp,
+ struct sg_table *sgt_req,
+ struct sg_table *sgt_resp,
unsigned int timeout)
{
int ret;
- ret = zfcp_fsf_setup_ct_els_sbals(req, sg_req, sg_resp);
+ ret = zfcp_fsf_setup_ct_els_sbals(req, sgt_req, sgt_resp);
if (ret)
return ret;
@@ -1242,8 +1411,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
}
req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
- ret = zfcp_fsf_setup_ct_els(req, ct->sgt_req.sgl, ct->sgt_resp.sgl,
- timeout);
+ ret = zfcp_fsf_setup_ct_els(req, &ct->sgt_req, &ct->sgt_resp, timeout);
if (ret)
goto failed_send;
@@ -1256,12 +1424,21 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
ret = zfcp_fsf_req_send(req);
if (ret)
- goto failed_send;
+ goto err_unmap;
+
/* NOTE: DO NOT TOUCH req PAST THIS POINT! */
goto out;
+err_unmap:
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &ct->sgt_req, DMA_TO_DEVICE);
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &ct->sgt_resp, DMA_FROM_DEVICE);
failed_send:
+ zfcp_qdio_zero_sbals(qdio->req_q, req->qdio_req.sbal_first,
+ req->qdio_req.sbal_number);
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
out:
spin_unlock_irq(&qdio->req_q_lock);
@@ -1275,6 +1452,11 @@ static void zfcp_fsf_send_els_handler(struct zfcp_fsf_req *req)
send_els->status = -EINVAL;
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &send_els->sgt_req, DMA_TO_DEVICE);
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &send_els->sgt_resp, DMA_FROM_DEVICE);
+
if (req->status & ZFCP_STATUS_FSFREQ_ERROR)
goto skip_fsfstatus;
@@ -1343,9 +1525,8 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
if (!zfcp_adapter_multi_buffer_active(adapter))
zfcp_qdio_sbal_limit(qdio, &req->qdio_req, 2);
- ret = zfcp_fsf_setup_ct_els(req, els->sgt_req.sgl, els->sgt_resp.sgl,
+ ret = zfcp_fsf_setup_ct_els(req, &els->sgt_req, &els->sgt_resp,
timeout);
-
if (ret)
goto failed_send;
@@ -1358,12 +1539,21 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
ret = zfcp_fsf_req_send(req);
if (ret)
- goto failed_send;
+ goto err_unmap;
+
/* NOTE: DO NOT TOUCH req PAST THIS POINT! */
goto out;
+err_unmap:
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &els->sgt_req, DMA_TO_DEVICE);
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &els->sgt_resp, DMA_FROM_DEVICE);
failed_send:
+ zfcp_qdio_zero_sbals(qdio->req_q, req->qdio_req.sbal_first,
+ req->qdio_req.sbal_number);
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
out:
spin_unlock_irq(&qdio->req_q_lock);
@@ -1404,6 +1594,7 @@ int zfcp_fsf_exchange_config_data(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -1469,6 +1660,8 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_qdio *qdio,
retval = -EIO;
else if (req->status & ZFCP_STATUS_FSFREQ_XDATAINCOMPLETE)
retval = -EAGAIN;
+ } else {
+ zfcp_fsf_req_unmap_metadata(req);
}
zfcp_fsf_req_free(req);
@@ -1516,6 +1709,7 @@ int zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -1578,6 +1772,8 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_qdio *qdio,
retval = -EIO;
else if (req->status & ZFCP_STATUS_FSFREQ_XDATAINCOMPLETE)
retval = -EAGAIN;
+ } else {
+ zfcp_fsf_req_unmap_metadata(req);
}
zfcp_fsf_req_free(req);
@@ -1810,6 +2006,7 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
put_device(&port->dev);
@@ -1876,6 +2073,7 @@ int zfcp_fsf_close_port(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -1950,8 +2148,10 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
retval = zfcp_fsf_req_send(req);
- if (retval)
+ if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
+ }
/* NOTE: DO NOT TOUCH req PAST THIS POINT! */
out:
spin_unlock_irq(&qdio->req_q_lock);
@@ -2009,8 +2209,10 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
retval = zfcp_fsf_req_send(req);
- if (retval)
+ if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
+ }
/* NOTE: DO NOT TOUCH req PAST THIS POINT! */
out:
spin_unlock_irq(&qdio->req_q_lock);
@@ -2103,6 +2305,7 @@ int zfcp_fsf_close_physical_port(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -2227,6 +2430,7 @@ int zfcp_fsf_open_lun(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -2316,6 +2520,7 @@ int zfcp_fsf_close_lun(struct zfcp_erp_action *erp_action)
zfcp_fsf_start_erp_timer(req);
retval = zfcp_fsf_req_send(req);
if (retval) {
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
erp_action->fsf_req_id = 0;
}
@@ -2474,6 +2679,15 @@ static void zfcp_fsf_fcp_cmnd_handler(struct zfcp_fsf_req *req)
return;
}
+ if ((scsi_get_prot_op(scpnt) != SCSI_PROT_NORMAL) &&
+ scsi_prot_sg_count(scpnt))
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &scpnt->prot_sdb->table,
+ scpnt->sc_data_direction);
+
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &scpnt->sdb.table, scpnt->sc_data_direction);
+
zfcp_fsf_fcp_handler_common(req, scpnt->device);
if (unlikely(req->status & ZFCP_STATUS_FSFREQ_ERROR)) {
@@ -2617,20 +2831,22 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd)
if ((scsi_get_prot_op(scsi_cmnd) != SCSI_PROT_NORMAL) &&
scsi_prot_sg_count(scsi_cmnd)) {
- zfcp_qdio_set_data_div(qdio, &req->qdio_req,
- scsi_prot_sg_count(scsi_cmnd));
- retval = zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req,
- scsi_prot_sglist(scsi_cmnd));
+ retval = zfcp_qdio_sbals_from_sg(qdio,
+ &scsi_cmnd->prot_sdb->table,
+ req,
+ scsi_cmnd->sc_data_direction);
if (retval)
goto failed_scsi_cmnd;
+ zfcp_qdio_set_data_div(qdio, &req->qdio_req,
+ scsi_cmnd->prot_sdb->table.nents);
io->prot_data_length = zfcp_qdio_real_bytes(
scsi_prot_sglist(scsi_cmnd));
}
- retval = zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req,
- scsi_sglist(scsi_cmnd));
+ retval = zfcp_qdio_sbals_from_sg(qdio, &scsi_cmnd->sdb.table, req,
+ scsi_cmnd->sc_data_direction);
if (unlikely(retval))
- goto failed_scsi_cmnd;
+ goto failed_normal_scsi_map;
zfcp_qdio_set_sbale_last(adapter->qdio, &req->qdio_req);
if (zfcp_adapter_multi_buffer_active(adapter))
@@ -2638,12 +2854,26 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd)
retval = zfcp_fsf_req_send(req);
if (unlikely(retval))
- goto failed_scsi_cmnd;
+ goto failed_req_send;
+
/* NOTE: DO NOT TOUCH req PAST THIS POINT! */
goto out;
+failed_req_send:
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &scsi_cmnd->sdb.table,
+ scsi_cmnd->sc_data_direction);
+failed_normal_scsi_map:
+ if ((scsi_get_prot_op(scsi_cmnd) != SCSI_PROT_NORMAL) &&
+ scsi_prot_sg_count(scsi_cmnd))
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ &scsi_cmnd->prot_sdb->table,
+ scsi_cmnd->sc_data_direction);
failed_scsi_cmnd:
+ zfcp_qdio_zero_sbals(qdio->req_q, req->qdio_req.sbal_first,
+ req->qdio_req.sbal_number);
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
scsi_cmnd->host_scribble = NULL;
out:
@@ -2651,7 +2881,7 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd)
return retval;
}
-static void zfcp_fsf_fcp_task_mgmt_handler(struct zfcp_fsf_req *req)
+void zfcp_fsf_fcp_task_mgmt_handler(struct zfcp_fsf_req *req)
{
struct scsi_device *sdev = req->data;
struct fcp_resp_with_ext *fcp_rsp;
@@ -2719,6 +2949,7 @@ struct zfcp_fsf_req *zfcp_fsf_fcp_task_mgmt(struct scsi_device *sdev,
goto out;
}
+ zfcp_fsf_req_unmap_metadata(req);
zfcp_fsf_req_free(req);
req = NULL;
out:
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index bac8385e069f..83855d2dd94a 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -39,7 +39,7 @@ static void zfcp_qdio_handler_error(struct zfcp_qdio *qdio, char *dbftag,
ZFCP_STATUS_COMMON_ERP_FAILED, dbftag);
}
-static void zfcp_qdio_zero_sbals(struct qdio_buffer *sbal[], int first, int cnt)
+void zfcp_qdio_zero_sbals(struct qdio_buffer *sbal[], int first, int cnt)
{
int i, sbal_idx;
@@ -233,31 +233,41 @@ zfcp_qdio_sbale_next(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req)
}
/**
- * zfcp_qdio_sbals_from_sg - fill SBALs from scatter-gather list
+ * zfcp_qdio_sbals_from_sg - DMA map scatter-gather list and fill SBALs from it
* @qdio: pointer to struct zfcp_qdio
- * @q_req: pointer to struct zfcp_qdio_req
- * @sg: scatter-gather list
- * Returns: zero or -EINVAL on error
+ * @sgt: pointer to scattergather list table
+ * @req: pointer to zfcp_fsf_req
+ * @dma_dir: DMA direction of I/O
+ * Returns: zero on success, -EINVAL or -EIO otherwise
*/
-int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
- struct scatterlist *sg)
+int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct sg_table *sgt,
+ struct zfcp_fsf_req *req,
+ enum dma_data_direction dma_dir)
{
struct qdio_buffer_element *sbale;
+ int i;
+ struct scatterlist *sg_element;
+
+ if (zfcp_fsf_req_map_sg(req, sgt, dma_dir))
+ return -EIO;
/* set storage-block type for this request */
- sbale = zfcp_qdio_sbale_req(qdio, q_req);
- sbale->sflags |= q_req->sbtype;
+ sbale = zfcp_qdio_sbale_req(qdio, &req->qdio_req);
+ sbale->sflags |= req->qdio_req.sbtype;
- for (; sg; sg = sg_next(sg)) {
- sbale = zfcp_qdio_sbale_next(qdio, q_req);
+ for_each_sgtable_dma_sg(sgt, sg_element, i) {
+ sbale = zfcp_qdio_sbale_next(qdio, &req->qdio_req);
if (!sbale) {
atomic_inc(&qdio->req_q_full);
- zfcp_qdio_zero_sbals(qdio->req_q, q_req->sbal_first,
- q_req->sbal_number);
+ zfcp_qdio_zero_sbals(qdio->req_q,
+ req->qdio_req.sbal_first,
+ req->qdio_req.sbal_number);
+ zfcp_fsf_req_unmap_sg(&req->adapter->ccw_device->dev,
+ sgt, dma_dir);
return -EINVAL;
}
- sbale->addr = u64_to_dma64(sg_phys(sg));
- sbale->length = sg->length;
+ sbale->addr = u64_to_dma64(sg_dma_address(sg_element));
+ sbale->length = sg_dma_len(sg_element);
}
return 0;
}
diff --git a/drivers/s390/scsi/zfcp_qdio.h b/drivers/s390/scsi/zfcp_qdio.h
index 8f7d2ae94441..9f89f2975f6f 100644
--- a/drivers/s390/scsi/zfcp_qdio.h
+++ b/drivers/s390/scsi/zfcp_qdio.h
@@ -11,6 +11,7 @@
#define ZFCP_QDIO_H
#include <linux/interrupt.h>
+#include <linux/types.h>
#include <asm/qdio.h>
#define ZFCP_QDIO_SBALE_LEN PAGE_SIZE
@@ -106,16 +107,19 @@ zfcp_qdio_sbale_curr(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req)
* @q_req: the qdio request to start
* @req_id: The request id
* @sbtype: type flags to set for all sbals
- * @data: First data block
- * @len: Length of first data block
+ * @has_qtcb: FSF request has a QTCB
+ * @qtcb_len: Length of first data block QTCB, if any
+ * @qtcb_dma_handle: DMA handle of the QTCB, if any
*
* This is the start of putting the request into the queue, the last
* step is passing the request to zfcp_qdio_send. The request queue
* lock must be held during the whole process from init to send.
*/
static inline
-void zfcp_qdio_req_init(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
- u64 req_id, u8 sbtype, void *data, u32 len)
+void zfcp_qdio_req_init(struct zfcp_qdio *qdio,
+ struct zfcp_qdio_req *q_req, u64 req_id,
+ u8 sbtype, bool has_qtcb, u32 qtcb_len,
+ dma_addr_t qtcb_dma_handle)
{
struct qdio_buffer_element *sbale;
int count = min(atomic_read(&qdio->req_q_free),
@@ -133,33 +137,34 @@ void zfcp_qdio_req_init(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
sbale->eflags = 0;
sbale->sflags = SBAL_SFLAGS0_COMMAND | sbtype;
- if (unlikely(!data))
+ if (unlikely(!has_qtcb))
return;
sbale++;
- sbale->addr = virt_to_dma64(data);
- sbale->length = len;
+ sbale->addr = u64_to_dma64(qtcb_dma_handle);
+ sbale->length = qtcb_len;
}
/**
* zfcp_qdio_fill_next - Fill next sbale, only for single sbal requests
* @qdio: pointer to struct zfcp_qdio
* @q_req: pointer to struct zfcp_queue_req
- * @data: pointer to data
+ * @dma_handle: dma address
* @len: length of data
*
* This is only required for single sbal requests, calling it when
* wrapping around to the next sbal is a bug.
*/
static inline
-void zfcp_qdio_fill_next(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
- void *data, u32 len)
+void zfcp_qdio_fill_next(struct zfcp_qdio *qdio,
+ struct zfcp_qdio_req *q_req,
+ dma_addr_t dma_handle, u32 len)
{
struct qdio_buffer_element *sbale;
BUG_ON(q_req->sbale_curr == qdio->max_sbale_per_sbal - 1);
q_req->sbale_curr++;
sbale = zfcp_qdio_sbale_curr(qdio, q_req);
- sbale->addr = virt_to_dma64(data);
+ sbale->addr = u64_to_dma64(dma_handle);
sbale->length = len;
}
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 3590113c2b74..a0d0550a7f73 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -163,6 +163,70 @@ static int zfcp_scsi_sdev_init(struct scsi_device *sdev)
return 0;
}
+/**
+ * zfcp_scsi_unmap_cmnd() - Unmap the DMA mappings of a SCSI command.
+ * @adapter: Adapter whose device the command was mapped for.
+ * @scpnt: SCSI command whose data and protection SG tables are unmapped.
+ *
+ * Caller must guarantee that the hardware no longer uses the buffers and
+ * that nobody else unmaps the same command, otherwise the SG tables would
+ * be unmapped twice.
+ */
+static void zfcp_scsi_unmap_cmnd(struct zfcp_adapter *adapter,
+ struct scsi_cmnd *scpnt)
+{
+ if ((scsi_get_prot_op(scpnt) != SCSI_PROT_NORMAL) &&
+ scsi_prot_sg_count(scpnt))
+ zfcp_fsf_req_unmap_sg(&adapter->ccw_device->dev,
+ &scpnt->prot_sdb->table,
+ scpnt->sc_data_direction);
+
+ zfcp_fsf_req_unmap_sg(&adapter->ccw_device->dev,
+ &scpnt->sdb.table,
+ scpnt->sc_data_direction);
+}
+
+/**
+ * zfcp_scsi_abort_failed() - Settle DMA unmap ownership after a failed abort.
+ * @adapter: Adapter the aborted command was sent on.
+ * @scpnt: The command that could not be aborted successfully.
+ * @old_reqid: Request ID of the original FCP command, taken at handler entry.
+ *
+ * The abort handler cleared old_req->data at entry, so neither the
+ * completion handler nor zfcp_scsi_forget_cmnd() would unmap @scpnt.
+ * Decide, under abort_lock, who unmaps exactly once:
+ *
+ * - old_req is still on the request list: the hardware may still use the
+ * buffers. Restore old_req->data so that its completion, its dismissal
+ * by ERP or zfcp_scsi_forget_cmnds() unmaps @scpnt. Whichever comes
+ * first wins; zfcp_scsi_forget_cmnd() clears data again, so the others
+ * see NULL.
+ * - old_req is no longer on the list: it was either completed by the
+ * hardware or dismissed by ERP, which requires QDIO to be down. Either
+ * way the hardware is done with the buffers. Its completion handler
+ * skips @scpnt because data is NULL, so unmap here.
+ *
+ * Return: Always FAILED, so scsi_eh escalates.
+ */
+static int zfcp_scsi_abort_failed(struct zfcp_adapter *adapter,
+ struct scsi_cmnd *scpnt, u64 old_reqid)
+{
+ struct zfcp_fsf_req *old_req;
+ unsigned long flags;
+
+ write_lock_irqsave(&adapter->abort_lock, flags);
+ old_req = zfcp_reqlist_find(adapter->req_list, old_reqid);
+ if (old_req) {
+ old_req->data = scpnt;
+ write_unlock_irqrestore(&adapter->abort_lock, flags);
+ return FAILED;
+ }
+ write_unlock_irqrestore(&adapter->abort_lock, flags);
+
+ zfcp_scsi_unmap_cmnd(adapter, scpnt);
+ return FAILED;
+}
+
static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
{
struct Scsi_Host *scsi_host = scpnt->device->host;
@@ -179,11 +243,33 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
write_lock_irqsave(&adapter->abort_lock, flags);
old_req = zfcp_reqlist_find(adapter->req_list, old_reqid);
- if (!old_req) {
+ if (!old_req || !old_req->data) {
write_unlock_irqrestore(&adapter->abort_lock, flags);
zfcp_dbf_scsi_abort("abrt_or", scpnt, NULL);
return FAILED; /* completion could be in progress */
}
+
+ /*
+ * Suppress the normal completion handler's unmap by clearing
+ * req->data now, under the abort_lock write-side. The actual
+ * DMA unmap is deferred until the hardware has stopped using
+ * the buffers (after wait_for_completion or after ERP has
+ * quiesced the adapter), so that we never call dma_unmap_sgtable
+ * while the FCP channel may still be writing into the pages.
+ *
+ * On the success paths old_req->data stays NULL: scsi_eh may
+ * finish or requeue scpnt right after we return SUCCESS, so a late
+ * completion of old_req must not touch it.
+ *
+ * On the FAILED paths, zfcp_scsi_abort_failed() decides who unmaps.
+ * It restores old_req->data if old_req is still pending, because
+ * scsi_eh does not finish scpnt after a failed abort until a later
+ * reset succeeds, and that reset detaches and unmaps the command
+ * under abort_lock (zfcp_scsi_forget_cmnds() for LUN/target reset,
+ * zfcp_fsf_req_dismiss_all() for host reset). Without the restore
+ * those paths would see data == NULL and the DMA mappings of scpnt
+ * would be leaked or, on a retry, mapped a second time.
+ */
old_req->data = NULL;
/* don't access old fsf_req after releasing the abort_lock */
@@ -198,18 +284,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
zfcp_erp_wait(adapter);
ret = fc_block_scsi_eh(scpnt);
if (ret) {
+ /*
+ * fc_block_scsi_eh returned FAST_IO_FAIL because
+ * fast_io_fail_tmo fired. This may originate from a
+ * per-port reopen (fc_timeout_fail_rport_io ->
+ * zfcp_scsi_terminate_rport_io ->
+ * zfcp_erp_port_forced_reopen) that closes the port
+ * asynchronously without shutting QDIO down or
+ * calling zfcp_fsf_req_dismiss_all().
+ *
+ * Only unmap scpnt's DMA buffers if QDIO is already
+ * down. That is the exact precondition enforced by
+ * zfcp_fsf_req_dismiss_all() (BUG_ON QDIOUP) and
+ * guarantees the hardware is no longer using them.
+ *
+ * If QDIO is still up the hardware may still be
+ * writing into the buffers; we must not unmap now.
+ * Return FAILED so scsi_eh escalates instead of
+ * finishing scpnt. zfcp_scsi_abort_failed() hands
+ * the unmap back to the request's completion or
+ * dismissal, or to the TMF path (forget_cmnds), so
+ * the mapping is not leaked.
+ */
zfcp_dbf_scsi_abort("abrt_bl", scpnt, NULL);
- return ret;
+ if (atomic_read(&adapter->status) &
+ ZFCP_STATUS_ADAPTER_QDIOUP)
+ return zfcp_scsi_abort_failed(adapter, scpnt,
+ old_reqid);
+ retval = ret; /* FAST_IO_FAIL, QDIO is down */
+ goto out_unmap;
}
if (!(atomic_read(&adapter->status) &
ZFCP_STATUS_COMMON_RUNNING)) {
+ /*
+ * Adapter is gone; ERP shut down QDIO and dismissed
+ * all requests before clearing RUNNING. Safe to
+ * unmap now.
+ */
zfcp_dbf_scsi_abort("abrt_ru", scpnt, NULL);
- return SUCCESS;
+ retval = SUCCESS;
+ goto out_unmap;
}
}
if (!abrt_req) {
+ /*
+ * abrt_ar: all retries of zfcp_fsf_abort_fcp_cmnd() failed.
+ * The hardware may still be running the original I/O, so do
+ * not unmap unconditionally; let zfcp_scsi_abort_failed()
+ * decide whether we or the request's completion unmaps.
+ */
zfcp_dbf_scsi_abort("abrt_ar", scpnt, NULL);
- return FAILED;
+ return zfcp_scsi_abort_failed(adapter, scpnt, old_reqid);
}
wait_for_completion(&abrt_req->completion);
@@ -219,11 +344,45 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
else if (abrt_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED)
dbf_tag = "abrt_nn";
else {
- dbf_tag = "abrt_fa";
- retval = FAILED;
+ /*
+ * abrt_fa: the abort FSF request itself failed or was
+ * dismissed by ERP (neither ABORTSUCCEEDED nor ABORTNOTNEEDED
+ * is set). We do not know whether the hardware has stopped
+ * the original I/O, so do not unmap unconditionally. If ERP
+ * dismissed the abort it has dismissed old_req as well; that
+ * is detected in zfcp_scsi_abort_failed() because old_req is
+ * then no longer on the request list.
+ */
+ zfcp_dbf_scsi_abort("abrt_fa", scpnt, abrt_req);
+ zfcp_fsf_req_free(abrt_req);
+ return zfcp_scsi_abort_failed(adapter, scpnt, old_reqid);
}
zfcp_dbf_scsi_abort(dbf_tag, scpnt, abrt_req);
zfcp_fsf_req_free(abrt_req);
+
+out_unmap:
+ /*
+ * Every path that arrives here has confirmed the hardware is no
+ * longer using scpnt's DMA buffers:
+ *
+ * abrt_ok / abrt_nn: the adapter confirmed the abort FSF request;
+ * the FCP channel has stopped the original I/O.
+ * abrt_ru: adapter gone; ERP cleared RUNNING only after
+ * shutting QDIO down and calling
+ * zfcp_fsf_req_dismiss_all().
+ * abrt_bl (QDIO down): fast_io_fail_tmo fired after a full ERP
+ * cycle that already shut QDIO down; the QDIO-up
+ * case is handled by zfcp_scsi_abort_failed().
+ *
+ * Paths where the hardware may still be running (abrt_ar, abrt_fa,
+ * abrt_bl with QDIO still up) go through zfcp_scsi_abort_failed()
+ * and do not reach here. old_req->data was cleared at entry and is
+ * not restored on these success paths, so
+ * zfcp_fsf_fcp_cmnd_handler() will return early harmlessly if
+ * old_req completes or is dismissed after we return.
+ */
+ zfcp_scsi_unmap_cmnd(adapter, scpnt);
+
return retval;
}
@@ -237,13 +396,17 @@ static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
{
struct zfcp_scsi_req_filter *filter =
(struct zfcp_scsi_req_filter *)data;
+ struct scsi_cmnd *scpnt;
- /* already aborted - prevent side-effects - or not a SCSI command */
+ /* already aborted - prevent side-effects - or not a SCSI I/O command */
if (old_req->data == NULL ||
zfcp_fsf_req_is_status_read_buffer(old_req) ||
- old_req->qtcb->header.fsf_command != FSF_QTCB_FCP_CMND)
+ old_req->qtcb->header.fsf_command != FSF_QTCB_FCP_CMND ||
+ old_req->handler == zfcp_fsf_fcp_task_mgmt_handler)
return;
+ scpnt = old_req->data;
+
/* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */
if (old_req->qtcb->header.port_handle != filter->port_handle)
return;
@@ -253,6 +416,17 @@ static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
return;
zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req);
+
+ if ((scsi_get_prot_op(scpnt) != SCSI_PROT_NORMAL) &&
+ scsi_prot_sg_count(scpnt))
+ zfcp_fsf_req_unmap_sg(&old_req->adapter->ccw_device->dev,
+ &scpnt->prot_sdb->table,
+ scpnt->sc_data_direction);
+
+ zfcp_fsf_req_unmap_sg(&old_req->adapter->ccw_device->dev,
+ &scpnt->sdb.table,
+ scpnt->sc_data_direction);
+
old_req->data = NULL;
}
@@ -305,6 +479,21 @@ static int zfcp_scsi_task_mgmt_function(struct scsi_device *sdev, u8 tm_flags)
ret = fc_block_rport(rport);
if (ret) {
zfcp_dbf_scsi_devreset("fiof", sdev, tm_flags, NULL);
+ /*
+ * QDIO still up: the FCP channel may still be using
+ * the buffers of outstanding commands. Do not let
+ * scsi_eh finish them; escalate to host reset instead.
+ */
+ if (atomic_read(&adapter->status) &
+ ZFCP_STATUS_ADAPTER_QDIOUP)
+ return FAILED;
+ /*
+ * QDIO down: the hardware is done with the buffers.
+ * Detach and unmap the commands so that a later
+ * completion or dismissal of their requests cannot
+ * touch a finished scpnt.
+ */
+ zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure
2026-10-28 5:14 ` [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure M Nikhil
@ 2026-10-28 5:20 ` sashiko-bot
0 siblings, 0 replies; 5+ messages in thread
From: sashiko-bot @ 2026-10-28 5:20 UTC (permalink / raw)
To: M Nikhil, linux-s390
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev,
Christian Borntraeger
> The zfcp_fsf_ct_els data structure is updated to replace the sg_req and
> sg_resp members, which are of type struct scatterlist, with request and
> response sg_table instances.
>
> These sg_table structure reference the corresponding scatterlists
> (sg_req and sg_resp) maintained in struct zfcp_fc_req.
>
> These changes allows to track the original and mapped scatterlist nents
> once zfcp is converted to use DMA-API for mapping the sg lists.
>
> Signed-off-by: M Nikhil <nikh1092@linux.ibm.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261028051446.3163392-1-nikh1092@linux.ibm.com?part=1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O
2026-10-28 5:14 ` [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O M Nikhil
@ 2026-10-28 5:45 ` sashiko-bot
0 siblings, 0 replies; 5+ messages in thread
From: sashiko-bot @ 2026-10-28 5:45 UTC (permalink / raw)
To: M Nikhil, linux-s390, linux-scsi
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev,
Christian Borntraeger
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] scsi: zfcp: premature DMA unmap and UAF on adapter shutdown in SCSI EH
- [Critical] scsi: zfcp: use-after-free and DMA leak on host reset with ERP_FAILED
- [High] scsi: zfcp: stale QDIO SBALE DMA address on abort and status read error paths
- [High] scsi: zfcp: race between zfcp_fsf_reqid_check() and zfcp_scsi_forget_cmnds() on restored req->data
--
commit 62d32e0c324a9864b32b7819374bcb22949814d1
Author: M Nikhil <nikh1092@linux.ibm.com>
zfcp: Use DMA streaming API to map I/O
This commit converts zFCP I/O buffer mappings (QTCB, SRB, CT/ELS, and SCSI
I/O) from direct physical address translations to the DMA streaming API using
dma_map_sgtable() and dma_unmap_sgtable(). It also updates the SCSI error
handling and QDIO submission paths to manage DMA mapping lifetimes and SBAL
cleanup.
> diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
> index 12b3d2d0a2c87..05f3b226b1634 100644
> --- a/drivers/s390/scsi/zfcp_fsf.c
> +++ b/drivers/s390/scsi/zfcp_fsf.c
[ ... ]
> @@ -954,17 +1066,29 @@ int zfcp_fsf_status_read(struct zfcp_qdio *qdio)
> memset(sr_buf, 0, sizeof(*sr_buf));
> req->data = sr_buf;
>
> - zfcp_qdio_fill_next(qdio, &req->qdio_req, sr_buf, sizeof(*sr_buf));
> + sg_init_one(&req->metadata_sg, sr_buf, sizeof(*sr_buf));
> + req->metadata_sgt.sgl = &req->metadata_sg;
> + req->metadata_sgt.orig_nents = 1;
> +
> + retval = zfcp_fsf_req_map_sg(req, &req->metadata_sgt, DMA_FROM_DEVICE);
> + if (unlikely(retval))
> + goto failed_dma_map;
> +
> + zfcp_qdio_fill_next(qdio, &req->qdio_req,
> + sg_dma_address(req->metadata_sgt.sgl),
> + sg_dma_len(req->metadata_sgt.sgl));
> zfcp_qdio_set_sbale_last(qdio, &req->qdio_req);
>
> retval = zfcp_fsf_req_send(req);
> if (retval)
> goto failed_req_send;
> /* NOTE: DO NOT TOUCH req PAST THIS POINT! */
>
> goto out;
>
> failed_req_send:
> + zfcp_fsf_req_unmap_metadata(req);
> +failed_dma_map:
> req->data = NULL;
> mempool_free(virt_to_page(sr_buf), adapter->pool.sr_data);
> failed_buf:
> zfcp_dbf_hba_fsf_uss("fssr__1", req);
> zfcp_fsf_req_free(req);
> out:
> spin_unlock_irq(&qdio->req_q_lock);
> return retval;
> }
[ ... ]
> @@ -1076,6 +1200,7 @@ struct zfcp_fsf_req *zfcp_fsf_abort_fcp_cmnd(struct scsi_cmnd *scmnd)
> }
>
> out_error_free:
> + zfcp_fsf_req_unmap_metadata(req);
> zfcp_fsf_req_free(req);
> req = NULL;
> out:
[Severity: High]
Can the error paths in zfcp_fsf_abort_fcp_cmnd() and zfcp_fsf_status_read()
leave stale DMA addresses in the QDIO request queue SBALs?
In zfcp_fsf_abort_fcp_cmnd(), zfcp_fsf_req_create() allocates and maps
req->qtcb and calls zfcp_qdio_req_init() with has_qtcb = true, which writes
element[0] and element[1] (with qtcb_dma_handle and qtcb_len) of
qdio->req_q[qdio->req_q_idx]:
drivers/s390/scsi/zfcp_qdio.h:zfcp_qdio_req_init() {
...
q_req->sbale_curr = 1;
sbale->eflags = 0;
sbale->sflags = SBAL_SFLAGS0_COMMAND | sbtype;
if (unlikely(!has_qtcb))
return;
sbale++;
sbale->addr = u64_to_dma64(qtcb_dma_handle);
sbale->length = qtcb_len;
}
If the LUN is blocked (!(atomic_read(&zfcp_sdev->status) &
ZFCP_STATUS_COMMON_UNBLOCKED)), zfcp_fsf_abort_fcp_cmnd() jumps to
out_error_free and unmaps and frees req->qtcb without calling
zfcp_qdio_zero_sbals() and without advancing qdio->req_q_idx.
If the next caller to use qdio->req_q[qdio->req_q_idx] is
zfcp_fsf_status_read(), its zfcp_fsf_req_create() calls zfcp_qdio_req_init()
with has_qtcb = false, which sets q_req->sbale_curr = 1, initializes
element[0], and returns early without clearing element[1].
zfcp_fsf_status_read() then calls zfcp_qdio_fill_next(), which increments
q_req->sbale_curr to 2 and writes the status read buffer DMA address into
element[2]. The SRB SBAL is then submitted to the adapter with element[1]
still holding the unmapped and freed QTCB DMA address.
Similarly, in zfcp_fsf_status_read(), if mempool_alloc() (goto failed_buf) or
zfcp_fsf_req_map_sg() (goto failed_dma_map) fails after zfcp_fsf_req_create()
initialized element[0], zfcp_qdio_zero_sbals() is not called before freeing
req. Should both out_error_free in zfcp_fsf_abort_fcp_cmnd() and failed_buf
in zfcp_fsf_status_read() call zfcp_qdio_zero_sbals()?
> diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
> index ea4b968352f4d..99ea8c499bd1a 100644
> --- a/drivers/s390/scsi/zfcp_scsi.c
> +++ b/drivers/s390/scsi/zfcp_scsi.c
> @@ -163,6 +163,70 @@ static int zfcp_scsi_sdev_init(struct scsi_device *sdev)
[ ... ]
> +static int zfcp_scsi_abort_failed(struct zfcp_adapter *adapter,
> + struct scsi_cmnd *scpnt, u64 old_reqid)
> +{
> + struct zfcp_fsf_req *old_req;
> + unsigned long flags;
> +
> + write_lock_irqsave(&adapter->abort_lock, flags);
> + old_req = zfcp_reqlist_find(adapter->req_list, old_reqid);
> + if (old_req) {
> + old_req->data = scpnt;
> + write_unlock_irqrestore(&adapter->abort_lock, flags);
> + return FAILED;
> + }
> + write_unlock_irqrestore(&adapter->abort_lock, flags);
> +
> + zfcp_scsi_unmap_cmnd(adapter, scpnt);
> + return FAILED;
> +}
[Severity: High]
When zfcp_scsi_abort_failed() restores old_req->data = scpnt so that a later
LUN or target reset will unmap and detach scpnt in zfcp_scsi_forget_cmnds(),
can a concurrent completion in zfcp_fsf_reqid_check() race with
zfcp_scsi_forget_cmnds()?
On the QDIO completion path, zfcp_fsf_reqid_check() removes fsf_req from
adapter->req_list before acquiring adapter->abort_lock in
zfcp_fsf_fcp_cmnd_handler():
drivers/s390/scsi/zfcp_fsf.c:zfcp_fsf_reqid_check() {
...
fsf_req = zfcp_reqlist_find_rm(adapter->req_list, req_id);
...
zfcp_fsf_req_complete(fsf_req);
-> zfcp_fsf_fcp_cmnd_handler(fsf_req)
read_lock_irqsave(&req->adapter->abort_lock, flags);
}
If CPU1 removes old_req in zfcp_reqlist_find_rm() just before CPU2 runs
zfcp_scsi_forget_cmnds() at the end of zfcp_scsi_task_mgmt_function():
drivers/s390/scsi/zfcp_scsi.c:zfcp_scsi_forget_cmnds() {
...
write_lock_irqsave(&adapter->abort_lock, flags);
zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd,
&filter);
write_unlock_irqrestore(&adapter->abort_lock, flags);
}
CPU2 will not find old_req in adapter->req_list, so zfcp_scsi_forget_cmnd()
never unmaps scpnt or clears old_req->data. zfcp_scsi_task_mgmt_function()
then returns SUCCESS to scsi_eh, which either reuses scpnt for scsi_eh_tur()
(where scsi_eh_prep_cmnd() zeroes scpnt->sdb and sets scpnt->sc_data_direction
= DMA_NONE) or finishes and frees scpnt.
When CPU1 subsequently enters zfcp_fsf_fcp_cmnd_handler() and acquires
adapter->abort_lock, it sees req->data == scpnt still non-NULL, skips
unmapping the zeroed scpnt->sdb (leaking the DMA mapping), and calls
scsi_done(scpnt) on a command that is either mid-TUR or already finished.
> @@ -198,18 +284,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
> zfcp_erp_wait(adapter);
> ret = fc_block_scsi_eh(scpnt);
> if (ret) {
> + /*
> + * fc_block_scsi_eh returned FAST_IO_FAIL because
> + * fast_io_fail_tmo fired. This may originate from a
> + * per-port reopen (fc_timeout_fail_rport_io ->
> + * zfcp_scsi_terminate_rport_io ->
> + * zfcp_erp_port_forced_reopen) that closes the port
> + * asynchronously without shutting QDIO down or
> + * calling zfcp_fsf_req_dismiss_all().
> + *
> + * Only unmap scpnt's DMA buffers if QDIO is already
> + * down. That is the exact precondition enforced by
> + * zfcp_fsf_req_dismiss_all() (BUG_ON QDIOUP) and
> + * guarantees the hardware is no longer using them.
> + *
> + * If QDIO is still up the hardware may still be
> + * writing into the buffers; we must not unmap now.
> + * Return FAILED so scsi_eh escalates instead of
> + * finishing scpnt. zfcp_scsi_abort_failed() hands
> + * the unmap back to the request's completion or
> + * dismissal, or to the TMF path (forget_cmnds), so
> + * the mapping is not leaked.
> + */
> zfcp_dbf_scsi_abort("abrt_bl", scpnt, NULL);
> - return ret;
> + if (atomic_read(&adapter->status) &
> + ZFCP_STATUS_ADAPTER_QDIOUP)
> + return zfcp_scsi_abort_failed(adapter, scpnt,
> + old_reqid);
> + retval = ret; /* FAST_IO_FAIL, QDIO is down */
> + goto out_unmap;
> }
> if (!(atomic_read(&adapter->status) &
> ZFCP_STATUS_COMMON_RUNNING)) {
> + /*
> + * Adapter is gone; ERP shut down QDIO and dismissed
> + * all requests before clearing RUNNING. Safe to
> + * unmap now.
> + */
> zfcp_dbf_scsi_abort("abrt_ru", scpnt, NULL);
> - return SUCCESS;
> + retval = SUCCESS;
> + goto out_unmap;
> }
> }
[ ... ]
> @@ -305,6 +479,21 @@ static int zfcp_scsi_task_mgmt_function(struct scsi_device *sdev, u8 tm_flags)
> ret = fc_block_rport(rport);
> if (ret) {
> zfcp_dbf_scsi_devreset("fiof", sdev, tm_flags, NULL);
> + /*
> + * QDIO still up: the FCP channel may still be using
> + * the buffers of outstanding commands. Do not let
> + * scsi_eh finish them; escalate to host reset instead.
> + */
> + if (atomic_read(&adapter->status) &
> + ZFCP_STATUS_ADAPTER_QDIOUP)
> + return FAILED;
> + /*
> + * QDIO down: the hardware is done with the buffers.
> + * Detach and unmap the commands so that a later
> + * completion or dismissal of their requests cannot
> + * touch a finished scpnt.
> + */
> + zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
> return ret;
> }
>
> if (!(atomic_read(&adapter->status) &
> ZFCP_STATUS_COMMON_RUNNING)) {
> zfcp_dbf_scsi_devreset("nres", sdev, tm_flags, NULL);
> return SUCCESS;
> }
[Severity: Critical]
Is it safe to assume that QDIO has been shut down and all requests have been
dismissed whenever ZFCP_STATUS_COMMON_RUNNING is clear?
Looking at zfcp_erp_adapter_shutdown() -> zfcp_erp_adapter_reopen() in
drivers/s390/scsi/zfcp_erp.c:
drivers/s390/scsi/zfcp_erp.c:zfcp_erp_adapter_shutdown() {
int flags = ZFCP_STATUS_COMMON_RUNNING | ZFCP_STATUS_COMMON_ERP_FAILED;
zfcp_erp_adapter_reopen(adapter, clear | flags, dbftag);
-> zfcp_erp_adapter_block(adapter, clear | flags);
-> zfcp_scsi_schedule_rports_block(adapter);
-> write_lock_irqsave(&adapter->erp_lock, ...);
-> zfcp_erp_action_enqueue(..., ZFCP_ERP_ACTION_REOPEN_ADAPTER, ...);
}
zfcp_erp_adapter_block() clears ZFCP_STATUS_COMMON_RUNNING synchronously
before the ERP action is enqueued, while zfcp_qdio_close() and
zfcp_fsf_req_dismiss_all() run asynchronously later on the ERP thread in
zfcp_erp_adapter_strategy_close().
This appears to cause a few problems in the error handlers:
1. In zfcp_scsi_eh_abort_handler() (at "abrt_ru"), if
zfcp_erp_adapter_shutdown() runs concurrently (for example, between
zfcp_erp_adapter_block() and zfcp_erp_action_enqueue() so zfcp_erp_wait()
returns immediately, or right after zfcp_erp_wait() returns),
ZFCP_STATUS_COMMON_RUNNING is already clear while QDIO is still active.
Jumping to out_unmap will unmap scpnt's DMA buffers and return SUCCESS
while the FCP channel may still be performing DMA.
2. If zfcp_scsi_eh_abort_handler() fails and zfcp_scsi_abort_failed()
restores old_req->data = scpnt, scsi_eh escalates to
zfcp_scsi_task_mgmt_function(). At "nres", observing
!(atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_RUNNING) returns
SUCCESS without checking ZFCP_STATUS_ADAPTER_QDIOUP and without calling
zfcp_scsi_forget_cmnds(). scsi_eh then finishes scpnt while old_req is
still on adapter->req_list with old_req->data == scpnt. When
zfcp_fsf_req_dismiss_all() or normal completion later runs
zfcp_fsf_fcp_cmnd_handler(), it will unmap and call scsi_done() on the
already-finished scpnt.
3. In zfcp_qdio_close() in drivers/s390/scsi/zfcp_qdio.c,
ZFCP_STATUS_ADAPTER_QDIOUP is cleared before calling tasklet_disable(),
qdio_stop_irq(), and qdio_shutdown(). Can the lockless checks of
ZFCP_STATUS_ADAPTER_QDIOUP in "abrt_bl" and "fiof" observe QDIOUP cleared
and unmap scpnt before qdio_shutdown() has actually stopped hardware DMA?
[Severity: Critical]
In addition, when zfcp_scsi_eh_abort_handler() (at "abrt_bl" or "abrt_ar")
and zfcp_scsi_task_mgmt_function() (at "fiof" or "reqf") return FAILED
because ZFCP_STATUS_ADAPTER_QDIOUP is still set while old_req->data == scpnt
remains on adapter->req_list, what happens if scsi_eh escalates to
zfcp_scsi_eh_host_reset_handler() after a link-down event?
When a local link-down event occurs (zfcp_fsf_status_read_link_down() ->
zfcp_fsf_link_down_info_eval(), or FSF_PROT_LINK_DOWN in
zfcp_fsf_protstatus_eval()), zfcp_erp_set_adapter_status(adapter,
ZFCP_STATUS_COMMON_ERP_FAILED) sets ZFCP_STATUS_COMMON_ERP_FAILED on
adapter->status while leaving ZFCP_STATUS_ADAPTER_QDIOUP set.
When fast_io_fail_tmo fires on the blocked rport and both abort and
LUN/target reset return FAILED because QDIOUP is set, scsi_eh calls
zfcp_scsi_eh_host_reset_handler():
drivers/s390/scsi/zfcp_scsi.c:zfcp_scsi_eh_host_reset_handler() {
...
zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
zfcp_erp_wait(adapter);
fc_ret = fc_block_scsi_eh(scpnt);
if (fc_ret)
ret = fc_ret;
...
return ret;
}
Because zfcp_erp_adapter_reopen() is called with clear = 0,
zfcp_erp_action_enqueue() -> zfcp_erp_handle_failed() sees
ZFCP_STATUS_COMMON_ERP_FAILED still set on adapter->status and suppresses
ZFCP_ERP_ACTION_REOPEN_ADAPTER (need = 0). As a result, zfcp_qdio_close() and
zfcp_fsf_req_dismiss_all() are never executed, QDIO stays up, and old_req
remains in adapter->req_list with old_req->data == scpnt.
zfcp_scsi_eh_host_reset_handler() then returns FAST_IO_FAIL (or SUCCESS) to
scsi_eh_host_reset(), which finishes and frees scpnt. When the link later
comes back up (FSF_STATUS_READ_LINK_UP) or the adapter is shut down,
zfcp_fsf_req_dismiss_all() will invoke zfcp_fsf_fcp_cmnd_handler(old_req)
with req->data pointing to the freed scpnt, causing a use-after-free in
zfcp_fsf_req_unmap_sg() and scsi_done().
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261028051446.3163392-1-nikh1092@linux.ibm.com?part=2
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-28 5:45 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 5:14 [PATCH v14 0/2] zfcp: Use DMA streaming API to map I/O M Nikhil
2026-10-28 5:14 ` [PATCH v14 1/2] zfcp: Replace sg-list with sg_table in zfcp_fsf_ct_els structure M Nikhil
2026-10-28 5:20 ` sashiko-bot
2026-10-28 5:14 ` [PATCH v14 2/2] zfcp: Use DMA streaming API to map I/O M Nikhil
2026-10-28 5:45 ` sashiko-bot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.