This patch corrects the lpfc tag handling issue identified by Hannes Reinecke
http://marc.info/?l=linux-scsi@m=119270235628850&w=2

The basis for this patch originated from Hajime Kai. Thank You Hajime.

Signed-off-by: hajime-kai@soft.fujitsu.com
Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (39 commits)
  [SCSI] qla2xxx: Update version number to 8.02.00-k5.
  [SCSI] qla2xxx: Correct display of ISP serial-number.
  [SCSI] qla2xxx: Correct residual-count handling discrepancies during UNDERRUN handling.
  [SCSI] qla2xxx: Make driver (mostly) legacy I/O port free.
  [SCSI] qla2xxx: Fix issue where final flash-segment updates were falling into the slow-path write handler.
  [SCSI] qla2xxx: Handle unaligned sector writes during NVRAM/VPD updates.
  [SCSI] qla2xxx: Defer explicit interrupt-polling processing to init-time scenarios.
  [SCSI] qla2xxx: Resync with latest HBA SSID specification -- 2.2u.
  [SCSI] sym53c8xx: Remove sym_xpt_async_sent_bdr
  [SCSI] sym53c8xx: Remove pci_dev pointer from sym_shcb
  [SCSI] sym53c8xx: Make interrupt handler capable of returning IRQ_NONE
  [SCSI] sym53c8xx: Get rid of IRQ_FMT and IRQ_PRM
  [SCSI] sym53c8xx: Use scmd_printk where appropriate
  [SCSI] sym53c8xx: Simplify DAC DMA handling
  [SCSI] sym53c8xx: Remove tag_ctrl module parameter
  [SCSI] sym53c8xx: Remove io_ws, mmio_ws and ram_ws elements
  [SCSI] sym53c8xx: Remove ->device_id
  [SCSI] sym53c8xx: Use pdev->revision
  [SCSI] sym53c8xx: PCI Error Recovery support
  [SCSI] sym53c8xx: Stop overriding scsi_done
  ...

Found these while looking at printk uses.

Add missing newlines to dev_<level> uses
Add missing KERN_<level> prefixes to multiline dev_<level>s
Fixed a wierd->weird spelling typo
Added a newline to a printk

Signed-off-by: Joe Perches <joe@perches.com>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Mark M. Hoffman <mhoffman@lightlink.com>
Cc: Roland Dreier <rolandd@cisco.com>
Cc: Tilman Schmidt <tilman@imap.cc>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Stephen Hemminger <shemminger@linux-foundation.org>
Cc: Greg KH <greg@kroah.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: David Brownell <david-b@pacbell.net>
Cc: James Smart <James.Smart@Emulex.Com>
Cc: Andrew Vasquez <andrew.vasquez@qlogic.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Jaroslav Kysela <perex@suse.cz>
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fixes a typo introduced by
commit bbfbbbc1182f8b44c8cc4c99f4a3f3a512149022.

It wasn't a compile error since CONFIG_LPFC_DEBUG_FS is not (yet?)
available as an option.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

This option is true if a low-level driver can support sg
chaining. This will be removed eventually when all the drivers are
converted to support sg chaining. q->max_phys_segments is set to
SCSI_MAX_SG_SEGMENTS if false.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

In NCR_D700, a4000t, aic7xxx_old, bvme6000, dpt_i2o, gdth, lpfc,
megaraid, mvme16x osst, pluto, qla2xxx, zorro7xx

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Smart <james.smart@emulex.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

The Coverity checker noticed that we may overrun a statically allocated
array in drivers/scsi/lpfc/lpfc_sli.c::lpfc_sli_hbqbuf_find().

The case is this; In 'struct lpfc_hba' we have

	#define LPFC_MAX_HBQS  4
	...
	struct lpfc_hba {
		...
		struct hbq_s hbqs[LPFC_MAX_HBQS];
		...
	};

But then in lpfc_sli_hbqbuf_find() we have this code

	hbqno = tag >> 16;
	if (hbqno > LPFC_MAX_HBQS)
		return NULL;

if 'hbqno' ends up as exactely 4, then we won't return, and then this

	list_for_each_entry(d_buf, &phba->hbqs[hbqno].hbq_buffer_list, list) {

will cause an overflow of the statically allocated array at index 4,
since the valid indices are only 0-3.

I propose this patch, that simply changes the 'hbqno > LPFC_MAX_HBQS'
into 'hbqno >= LPFC_MAX_HBQS' as a possible fix.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Smart <James.Smart@Emulex.Com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

It was pointed out by Boaz Harrosh <bharrosh@panasas.com> that our
8.2.2 lpfc patches revert a change to using SCSI command accessor
functions.

This patch, to be applied on top of the 8.2.2. patches, updates the
driver for the accessor functions.

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Signed-off-by: James Smart <James.Smart@emulex.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>