From mboxrd@z Thu Jan  1 00:00:00 1970
From: James Bottomley <James.Bottomley@HansenPartnership.com>
Subject: Re: iommu_iova leak [inside 3w-9xxx]
Date: Sun, 18 Sep 2011 18:25:34 +0400
Message-ID: <1316355934.27722.6.camel@dabdike>
References: <4E734467.3040703@bootc.net>
	 <1316256305.24257.25.camel@shinybook.infradead.org>
	 <AD4B8103-C98F-4BC5-9F7F-496D220781F3@bootc.net>
	 <3A4FADE6-3653-46C5-B225-8200F9DCE35B@bootc.net>
	 <CAHtARFHfxpU1JKu4092ZshvhsrRY-hx_pfnL3_+T32B3ncgWvg@mail.gmail.com>
	 <B4A636AC-B127-42DD-BC8C-419D07A83FBD@bootc.net>
	 <1316353140.12001.15.camel@shinybook.infradead.org>
	 <1316354509.27722.1.camel@dabdike>
	 <B008530A-B1B1-49D2-A3B4-9CD929D948FB@bootc.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-scsi-owner@vger.kernel.org>
Received: from bedivere.hansenpartnership.com ([66.63.167.143]:40695 "EHLO
	bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1750780Ab1IROZj (ORCPT
	<rfc822;linux-scsi@vger.kernel.org>);
	Sun, 18 Sep 2011 10:25:39 -0400
In-Reply-To: <B008530A-B1B1-49D2-A3B4-9CD929D948FB@bootc.net>
Sender: linux-scsi-owner@vger.kernel.org
List-Id: linux-scsi@vger.kernel.org
To: Chris Boot <bootc@bootc.net>
Cc: "Woodhouse, David" <david.woodhouse@intel.com>, adam radford <aradford@gmail.com>, lkml <linux-kernel@vger.kernel.org>, Adam Radford <linuxraid@lsi.com>, "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>

On Sun, 2011-09-18 at 15:05 +0100, Chris Boot wrote: 
> > Hardly ... all it's saying is that twa_exit doesn't wait for pending I/O
> > to complete, so when you remove the module it tears down in the middle
> > of an I/O.  A bug, yes, but it's not indicative of any sort of leak in
> > the maps/unmaps.
> 
> 
> James,
> 
> I don't think that's the case - I had unmounted all filesystems, deactivated all volume groups, and performed a sync before waiting a few seconds and running rmmod. Next time I'll also 'echo 1 > /sys/block/sdX/device/delete' if that's helpful.

Actually, I take all that back: the driver has a bug in QUEUE_FULL
handling: twa_scsi_queue() calls twa_scsiop_execute_scsi(), which maps
the dma buffer, but if the card responds QUEUE_FULL it just returns
SCSI_MLQUEUE_HOST_BUSY without ever unmapping.  That leg in the code
frees the request but also doesn't unmap it.  In fact any error return
from twa_scsiop_execute_scsi() seems to have the same problem (but
QUEUE_FULL is the only silent one).

I trust Adam will fix this.

James