scsi: Enable context analysis for most drivers

index d31a8d107b1e..68166c9f8158 100644
@@ -611,7 +611,10 @@ static inline struct pci_dev *pci_physfn(struct pci_dev *dev)
 
 struct pci_dev *pci_alloc_dev(struct pci_bus *bus);
 
-#define	to_pci_dev(n) container_of(n, struct pci_dev, dev)
+static inline struct pci_dev *to_pci_dev(const struct device *dev)
+{
+	return container_of(dev, struct pci_dev, dev);
+}
 #define for_each_pci_dev(d) while ((d = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)
 #define for_each_pci_dev_reverse(d) \
 	while ((d = pci_get_device_reverse(PCI_ANY_ID, PCI_ANY_ID, d)) != NULL)

index 5408f002e6c0..714ae6f0cf18 100644
@@ -245,6 +245,7 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
 
 static int
 open_wait(Sg_device *sdp, int flags)
+	__must_hold(&sdp->open_rel_lock)
 {
 	int retval = 0;
 

index 1ca9753cb734..8827b487de9d 100644
@@ -3538,6 +3538,7 @@ static int partition_tape(struct scsi_tape *STp, int size)
 static long st_common_ioctl(struct scsi_tape *STp, struct st_modedef *STm,
 			    struct file *file, unsigned int cmd_in,
 			    unsigned long arg)
+	__releases(&STp->lock)
 {
 	int i, retval = 0;
 

index 27b446c0c5d0..75aaf35383a9 100644
@@ -276,8 +276,9 @@ static void blogic_create_addlccbs(struct blogic_adapter *adapter,
   Lock should already have been acquired by the caller.
 */
 
-static struct blogic_ccb *blogic_alloc_ccb(struct blogic_adapter *adapter)
+static struct blogic_ccb *blogic_alloc_ccb(struct Scsi_Host *host)
 {
+	struct blogic_adapter *adapter = (void *)host->hostdata;
 	static unsigned long serial;
 	struct blogic_ccb *ccb;
 	ccb = adapter->free_ccbs;

@@ -307,7 +308,8 @@ static struct blogic_ccb *blogic_alloc_ccb(struct blogic_adapter *adapter)
   caller.
 */
 
-static void blogic_dealloc_ccb(struct blogic_ccb *ccb, int dma_unmap)
+static void blogic_dealloc_ccb(struct Scsi_Host *host, struct blogic_ccb *ccb,
+			       int dma_unmap)
 {
 	struct blogic_adapter *adapter = ccb->adapter;
 

@@ -2596,8 +2598,10 @@ static void blogic_scan_inbox(struct blogic_adapter *adapter)
   should already have been acquired by the caller.
 */
 
-static void blogic_process_ccbs(struct blogic_adapter *adapter)
+static void blogic_process_ccbs(struct Scsi_Host *host)
 {
+	struct blogic_adapter *adapter = (void *)host->hostdata;
+
 	if (adapter->processing_ccbs)
 		return;
 	adapter->processing_ccbs = true;

@@ -2621,7 +2625,7 @@ static void blogic_process_ccbs(struct blogic_adapter *adapter)
 			/*
 			   Place CCB back on the Host Adapter's free list.
 			 */
-			blogic_dealloc_ccb(ccb, 1);
+			blogic_dealloc_ccb(host, ccb, 1);
 #if 0			/* this needs to be redone different for new EH */
 			/*
 			   Bus Device Reset CCBs have the command field

@@ -2650,7 +2654,7 @@ static void blogic_process_ccbs(struct blogic_adapter *adapter)
 				if (ccb->status == BLOGIC_CCB_RESET &&
 						ccb->tgt_id == tgt_id) {
 					command = ccb->command;
-					blogic_dealloc_ccb(ccb, 1);
+					blogic_dealloc_ccb(host, ccb, 1);
 					adapter->active_cmds[tgt_id]--;
 					command->result = DID_RESET << 16;
 					scsi_done(command);

@@ -2721,7 +2725,7 @@ static void blogic_process_ccbs(struct blogic_adapter *adapter)
 			/*
 			   Place CCB back on the Host Adapter's free list.
 			 */
-			blogic_dealloc_ccb(ccb, 1);
+			blogic_dealloc_ccb(host, ccb, 1);
 			/*
 			   Call the SCSI Command Completion Routine.
 			 */

@@ -2740,11 +2744,12 @@ static void blogic_process_ccbs(struct blogic_adapter *adapter)
 static irqreturn_t blogic_inthandler(int irq_ch, void *devid)
 {
 	struct blogic_adapter *adapter = (struct blogic_adapter *) devid;
+	struct Scsi_Host *host = adapter->scsi_host;
 	unsigned long processor_flag;
 	/*
 	   Acquire exclusive access to Host Adapter.
 	 */
-	spin_lock_irqsave(&adapter->scsi_host->host_lock, processor_flag);
+	spin_lock_irqsave(&host->host_lock, processor_flag);
 	/*
 	   Handle Interrupts appropriately for each Host Adapter type.
 	 */

@@ -2794,25 +2799,25 @@ static irqreturn_t blogic_inthandler(int irq_ch, void *devid)
 	   Process any completed CCBs.
 	 */
 	if (adapter->firstccb != NULL)
-		blogic_process_ccbs(adapter);
+		blogic_process_ccbs(host);
 	/*
 	   Reset the Host Adapter if requested.
 	 */
 	if (adapter->adapter_extreset) {
 		blogic_warn("Resetting %s due to External SCSI Bus Reset\n", adapter, adapter->full_model);
 		blogic_inc_count(&adapter->ext_resets);
-		blogic_resetadapter(adapter, false);
+		blogic_resetadapter(host, false);
 		adapter->adapter_extreset = false;
 	} else if (adapter->adapter_intern_err) {
 		blogic_warn("Resetting %s due to Host Adapter Internal Error\n", adapter, adapter->full_model);
 		blogic_inc_count(&adapter->adapter_intern_errors);
-		blogic_resetadapter(adapter, true);
+		blogic_resetadapter(host, true);
 		adapter->adapter_intern_err = false;
 	}
 	/*
 	   Release exclusive access to Host Adapter.
 	 */
-	spin_unlock_irqrestore(&adapter->scsi_host->host_lock, processor_flag);
+	spin_unlock_irqrestore(&host->host_lock, processor_flag);
 	return IRQ_HANDLED;
 }
 

@@ -2823,9 +2828,10 @@ static irqreturn_t blogic_inthandler(int irq_ch, void *devid)
   already have been acquired by the caller.
 */
 
-static bool blogic_write_outbox(struct blogic_adapter *adapter,
+static bool blogic_write_outbox(struct Scsi_Host *host,
 		enum blogic_action action, struct blogic_ccb *ccb)
 {
+	struct blogic_adapter *adapter = (void *)host->hostdata;
 	struct blogic_outbox *next_outbox;
 
 	next_outbox = adapter->next_outbox;

@@ -2859,17 +2865,16 @@ static int blogic_hostreset(struct scsi_cmnd *SCpnt)
 {
 	struct blogic_adapter *adapter =
 		(struct blogic_adapter *) SCpnt->device->host->hostdata;
-
+	struct Scsi_Host *shost = adapter->scsi_host;
 	unsigned int id = SCpnt->device->id;
 	struct blogic_tgt_stats *stats = &adapter->tgt_stats[id];
 	int rc;
 
-	spin_lock_irq(&SCpnt->device->host->host_lock);
-
+	spin_lock_irq(&shost->host_lock);
 	blogic_inc_count(&stats->adapter_reset_req);
+	rc = blogic_resetadapter(shost, false);
+	spin_unlock_irq(&shost->host_lock);
 
-	rc = blogic_resetadapter(adapter, false);
-	spin_unlock_irq(&SCpnt->device->host->host_lock);
 	return rc;
 }
 

@@ -2878,11 +2883,11 @@ static int blogic_hostreset(struct scsi_cmnd *SCpnt)
   Outgoing Mailbox for execution by the associated Host Adapter.
 */
 
-static enum scsi_qc_status blogic_qcmd_lck(struct scsi_cmnd *command)
+static enum scsi_qc_status blogic_qcmd_lck(struct Scsi_Host *shost, struct scsi_cmnd *command)
 {
 	void (*comp_cb)(struct scsi_cmnd *) = scsi_done;
 	struct blogic_adapter *adapter =
-		(struct blogic_adapter *) command->device->host->hostdata;
+		(struct blogic_adapter *) shost->hostdata;
 	struct blogic_tgt_flags *tgt_flags =
 		&adapter->tgt_flags[command->device->id];
 	struct blogic_tgt_stats *tgt_stats = adapter->tgt_stats;

@@ -2913,12 +2918,12 @@ static enum scsi_qc_status blogic_qcmd_lck(struct scsi_cmnd *command)
 	   probably hung so signal an error as a Host Adapter Hard Reset
 	   should be initiated soon.
 	 */
-	ccb = blogic_alloc_ccb(adapter);
+	ccb = blogic_alloc_ccb(shost);
 	if (ccb == NULL) {
-		spin_unlock_irq(&adapter->scsi_host->host_lock);
+		spin_unlock_irq(&shost->host_lock);
 		blogic_delay(1);
-		spin_lock_irq(&adapter->scsi_host->host_lock);
-		ccb = blogic_alloc_ccb(adapter);
+		spin_lock_irq(&shost->host_lock);
+		ccb = blogic_alloc_ccb(shost);
 		if (ccb == NULL) {
 			command->result = DID_ERROR << 16;
 			comp_cb(command);

@@ -3046,7 +3051,7 @@ static enum scsi_qc_status blogic_qcmd_lck(struct scsi_cmnd *command)
 	if (dma_mapping_error(&adapter->pci_device->dev, sense_buf)) {
 		blogic_err("DMA mapping for sense data buffer failed\n",
 				adapter);
-		blogic_dealloc_ccb(ccb, 0);
+		blogic_dealloc_ccb(shost, ccb, 0);
 		return SCSI_MLQUEUE_HOST_BUSY;
 	}
 	ccb->sensedata = sense_buf;

@@ -3061,15 +3066,15 @@ static enum scsi_qc_status blogic_qcmd_lck(struct scsi_cmnd *command)
 		   so signal an error as a Host Adapter Hard Reset should
 		   be initiated soon.
 		 */
-		if (!blogic_write_outbox(adapter, BLOGIC_MBOX_START, ccb)) {
-			spin_unlock_irq(&adapter->scsi_host->host_lock);
+		if (!blogic_write_outbox(shost, BLOGIC_MBOX_START, ccb)) {
+			spin_unlock_irq(&shost->host_lock);
 			blogic_warn("Unable to write Outgoing Mailbox - Pausing for 1 second\n", adapter);
 			blogic_delay(1);
-			spin_lock_irq(&adapter->scsi_host->host_lock);
-			if (!blogic_write_outbox(adapter, BLOGIC_MBOX_START,
+			spin_lock_irq(&shost->host_lock);
+			if (!blogic_write_outbox(shost, BLOGIC_MBOX_START,
 						ccb)) {
 				blogic_warn("Still unable to write Outgoing Mailbox - Host Adapter Dead?\n", adapter);
-				blogic_dealloc_ccb(ccb, 1);
+				blogic_dealloc_ccb(shost, ccb, 1);
 				command->result = DID_ERROR << 16;
 				scsi_done(command);
 			}

@@ -3089,12 +3094,20 @@ static enum scsi_qc_status blogic_qcmd_lck(struct scsi_cmnd *command)
 		   pending.
 		 */
 		if (ccb->status == BLOGIC_CCB_COMPLETE)
-			blogic_process_ccbs(adapter);
+			blogic_process_ccbs(shost);
 	}
 	return 0;
 }
 
-static DEF_SCSI_QCMD(blogic_qcmd)
+static enum scsi_qc_status blogic_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+{
+	enum scsi_qc_status rc;
+
+	spin_lock_irq(&shost->host_lock);
+	rc = blogic_qcmd_lck(shost, cmd);
+	spin_unlock_irq(&shost->host_lock);
+	return rc;
+}
 
 #if 0
 /*

@@ -3103,9 +3116,8 @@ static DEF_SCSI_QCMD(blogic_qcmd)
 
 static int blogic_abort(struct scsi_cmnd *command)
 {
-	struct blogic_adapter *adapter =
-		(struct blogic_adapter *) command->device->host->hostdata;
-
+	struct Scsi_Host *const shost = command->device->host;
+	struct blogic_adapter *adapter = (void *) shost->hostdata;
 	int tgt_id = command->device->id;
 	struct blogic_ccb *ccb;
 	blogic_inc_count(&adapter->tgt_stats[tgt_id].aborts_request);

@@ -3144,7 +3156,7 @@ static int blogic_abort(struct scsi_cmnd *command)
 				adapter->fw_ver[0] < '5') {
 			blogic_warn("Unable to Abort CCB #%ld to Target %d - Abort Tag Not Supported\n", adapter, ccb->serial, tgt_id);
 			return FAILURE;
-		} else if (blogic_write_outbox(adapter, BLOGIC_MBOX_ABORT,
+		} else if (blogic_write_outbox(shost, BLOGIC_MBOX_ABORT,
 					ccb)) {
 			blogic_warn("Aborting CCB #%ld to Target %d\n",
 					adapter, ccb->serial, tgt_id);

@@ -3169,7 +3181,7 @@ static int blogic_abort(struct scsi_cmnd *command)
 		   may still be pending.
 		 */
 		if (ccb->status == BLOGIC_CCB_COMPLETE)
-			blogic_process_ccbs(adapter);
+			blogic_process_ccbs(shost);
 		return SUCCESS;
 	}
 	return SUCCESS;

@@ -3181,8 +3193,9 @@ static int blogic_abort(struct scsi_cmnd *command)
   currently executing SCSI Commands as having been Reset.
 */
 
-static int blogic_resetadapter(struct blogic_adapter *adapter, bool hard_reset)
+static int blogic_resetadapter(struct Scsi_Host *host, bool hard_reset)
 {
+	struct blogic_adapter *adapter = (void *)host->hostdata;
 	struct blogic_ccb *ccb;
 	int tgt_id;
 

@@ -3203,7 +3216,7 @@ static int blogic_resetadapter(struct blogic_adapter *adapter, bool hard_reset)
 
 	for (ccb = adapter->all_ccbs; ccb != NULL; ccb = ccb->next_all)
 		if (ccb->status == BLOGIC_CCB_ACTIVE)
-			blogic_dealloc_ccb(ccb, 1);
+			blogic_dealloc_ccb(host, ccb, 1);
 	/*
 	 * Wait a few seconds between the Host Adapter Hard Reset which
 	 * initiates a SCSI Bus Reset and issuing any SCSI Commands.  Some

@@ -3212,9 +3225,9 @@ static int blogic_resetadapter(struct blogic_adapter *adapter, bool hard_reset)
 	 */
 
 	if (hard_reset) {
-		spin_unlock_irq(&adapter->scsi_host->host_lock);
+		spin_unlock_irq(&host->host_lock);
 		blogic_delay(adapter->bus_settle_time);
-		spin_lock_irq(&adapter->scsi_host->host_lock);
+		spin_lock_irq(&host->host_lock);
 	}
 
 	for (tgt_id = 0; tgt_id < adapter->maxdev; tgt_id++) {

index 24697a5bedc8..6ace3c307a90 100644
@@ -1279,7 +1279,7 @@ static int blogic_sdev_configure(struct scsi_device *,
 				 struct queue_limits *lim);
 static void blogic_qcompleted_ccb(struct blogic_ccb *);
 static irqreturn_t blogic_inthandler(int, void *);
-static int blogic_resetadapter(struct blogic_adapter *, bool hard_reset);
+static int blogic_resetadapter(struct Scsi_Host *host, bool hard_reset);
 static void blogic_msg(enum blogic_msglevel, char *, struct blogic_adapter *, ...);
 static int __init blogic_setup(char *);
 

index 75aaf35383a9..4179f29b3066 100644
@@ -277,6 +277,7 @@ static void blogic_create_addlccbs(struct blogic_adapter *adapter,
 */
 
 static struct blogic_ccb *blogic_alloc_ccb(struct Scsi_Host *host)
+	__must_hold(&host->host_lock)
 {
 	struct blogic_adapter *adapter = (void *)host->hostdata;
 	static unsigned long serial;

@@ -310,6 +311,7 @@ static struct blogic_ccb *blogic_alloc_ccb(struct Scsi_Host *host)
 
 static void blogic_dealloc_ccb(struct Scsi_Host *host, struct blogic_ccb *ccb,
 			       int dma_unmap)
+	__must_hold(&host->host_lock)
 {
 	struct blogic_adapter *adapter = ccb->adapter;
 

@@ -2599,6 +2601,7 @@ static void blogic_scan_inbox(struct blogic_adapter *adapter)
 */
 
 static void blogic_process_ccbs(struct Scsi_Host *host)
+	__must_hold(&host->host_lock)
 {
 	struct blogic_adapter *adapter = (void *)host->hostdata;
 

@@ -2830,6 +2833,7 @@ static irqreturn_t blogic_inthandler(int irq_ch, void *devid)
 
 static bool blogic_write_outbox(struct Scsi_Host *host,
 		enum blogic_action action, struct blogic_ccb *ccb)
+	__must_hold(&host->host_lock)
 {
 	struct blogic_adapter *adapter = (void *)host->hostdata;
 	struct blogic_outbox *next_outbox;

@@ -2884,6 +2888,7 @@ static int blogic_hostreset(struct scsi_cmnd *SCpnt)
 */
 
 static enum scsi_qc_status blogic_qcmd_lck(struct Scsi_Host *shost, struct scsi_cmnd *command)
+	__must_hold(&shost->host_lock)
 {
 	void (*comp_cb)(struct scsi_cmnd *) = scsi_done;
 	struct blogic_adapter *adapter =

@@ -3194,6 +3199,7 @@ static int blogic_abort(struct scsi_cmnd *command)
 */
 
 static int blogic_resetadapter(struct Scsi_Host *host, bool hard_reset)
+	__must_hold(&host->host_lock)
 {
 	struct blogic_adapter *adapter = (void *)host->hostdata;
 	struct blogic_ccb *ccb;

index 6ace3c307a90..455d442525f6 100644
@@ -1279,7 +1279,8 @@ static int blogic_sdev_configure(struct scsi_device *,
 				 struct queue_limits *lim);
 static void blogic_qcompleted_ccb(struct blogic_ccb *);
 static irqreturn_t blogic_inthandler(int, void *);
-static int blogic_resetadapter(struct Scsi_Host *host, bool hard_reset);
+static int blogic_resetadapter(struct Scsi_Host *host, bool hard_reset)
+	__must_hold(&host->host_lock);
 static void blogic_msg(enum blogic_msglevel, char *, struct blogic_adapter *, ...);
 static int __init blogic_setup(char *);
 

index 006dcf981218..6afbd5936892 100644
@@ -718,7 +718,7 @@ static void NCR5380_main(struct work_struct *work)
 			 * entire unit.
 			 */
 
-			if (!NCR5380_select(instance, cmd)) {
+			if (!NCR5380_select(hostdata, cmd)) {
 				dsprintk(NDEBUG_MAIN, instance, "main: select complete\n");
 			} else {
 				dsprintk(NDEBUG_MAIN | NDEBUG_QUEUES, instance,

@@ -728,7 +728,7 @@ static void NCR5380_main(struct work_struct *work)
 		}
 		if (hostdata->connected && !hostdata->dma_len) {
 			dsprintk(NDEBUG_MAIN, instance, "main: performing information transfer\n");
-			NCR5380_information_transfer(instance);
+			NCR5380_information_transfer(hostdata);
 			done = 0;
 		}
 		if (!hostdata->connected) {

@@ -937,7 +937,7 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
 
 /**
  * NCR5380_select - attempt arbitration and selection for a given command
- * @instance: the Scsi_Host instance
+ * @hostdata: host private data
  * @cmd: the scsi_cmnd to execute
  *
  * This routine establishes an I_T_L nexus for a SCSI command. This involves

@@ -960,10 +960,11 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
  * cmd->result host byte set to DID_BAD_TARGET.
  */
 
-static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+static bool NCR5380_select(struct NCR5380_hostdata *hostdata,
+			   struct scsi_cmnd *cmd)
 	__releases(&hostdata->lock) __acquires(&hostdata->lock)
 {
-	struct NCR5380_hostdata *hostdata = shost_priv(instance);
+	struct Scsi_Host *instance = hostdata->host;
 	unsigned char tmp[3], phase;
 	unsigned char *data;
 	int len;

@@ -1643,23 +1644,23 @@ static int NCR5380_transfer_dma(struct Scsi_Host *instance,
 }
 
 /*
- * Function : NCR5380_information_transfer (struct Scsi_Host *instance)
+ * Function : NCR5380_information_transfer(struct NCR5380_hostdata *hostdata)
  *
  * Purpose : run through the various SCSI phases and do as the target
  * directs us to.  Operates on the currently connected command,
  * instance->connected.
  *
- * Inputs : instance, instance for which we are doing commands
+ * Inputs : hostdata, the private host data
  *
  * Side effects : SCSI things happen, the disconnected queue will be
  * modified if a command disconnects, *instance->connected will
  * change.
  */
 
-static void NCR5380_information_transfer(struct Scsi_Host *instance)
+static void NCR5380_information_transfer(struct NCR5380_hostdata *hostdata)
 	__releases(&hostdata->lock) __acquires(&hostdata->lock)
 {
-	struct NCR5380_hostdata *hostdata = shost_priv(instance);
+	struct Scsi_Host *instance = hostdata->host;
 	unsigned char msgout = NOP;
 	int sink = 0;
 	int len;

index d402d4bffcb2..450b08da5858 100644
@@ -278,12 +278,13 @@ static void NCR5380_print(struct Scsi_Host *instance);
 static int NCR5380_init(struct Scsi_Host *instance, int flags);
 static int NCR5380_maybe_reset_bus(struct Scsi_Host *);
 static void NCR5380_exit(struct Scsi_Host *instance);
-static void NCR5380_information_transfer(struct Scsi_Host *instance);
+static void NCR5380_information_transfer(struct NCR5380_hostdata *hostdata);
 static irqreturn_t NCR5380_intr(int irq, void *dev_id);
 static void NCR5380_main(struct work_struct *work);
 static const char *NCR5380_info(struct Scsi_Host *instance);
 static void NCR5380_reselect(struct Scsi_Host *instance);
-static bool NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
+static bool NCR5380_select(struct NCR5380_hostdata *hostdata,
+			   struct scsi_cmnd *);
 static int NCR5380_transfer_dma(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
 static void NCR5380_transfer_pio(struct Scsi_Host *instance,
 				 unsigned char *phase, int *count,

index bd82aeb679ae..ac73c7b6d7be 100644
@@ -1043,6 +1043,7 @@ struct aac_reset_iop {
 };
 
 static int aac_send_reset_adapter(struct aac_dev *dev, void __user *arg)
+	__must_hold(&dev->ioctl_mutex)
 {
 	struct aac_reset_iop reset;
 	int retval;

index 347d480a39b0..0dba4406494a 100644
@@ -475,6 +475,7 @@ int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_fib * hw
 int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
 		int priority, int wait, int reply, fib_callback callback,
 		void *callback_data)
+	__context_unsafe(/*conditional locking*/)
 {
 	struct aac_dev * dev = fibptr->dev;
 	struct hw_fib * hw_fib = fibptr->hw_fib_va;

@@ -698,6 +699,7 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
 
 int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
 		void *callback_data)
+	__context_unsafe(/*conditional locking*/)
 {
 	struct aac_dev *dev = fibptr->dev;
 	int wait;

@@ -1466,6 +1468,7 @@ static void aac_schedule_bus_scan(struct aac_dev *aac)
 }
 
 static int _aac_reset_adapter(struct aac_dev *aac, int forced, u8 reset_type)
+	__context_unsafe(/*conditional locking*/)
 {
 	int index, quirks;
 	int retval;

index e3ccb6bb62c0..d751dc8093cc 100644
@@ -636,7 +636,7 @@ static struct {
 /* setup & interrupt */
 static irqreturn_t intr(int irq, void *dev_id);
 static void reset_ports(struct Scsi_Host *shpnt);
-static void aha152x_error(struct Scsi_Host *shpnt, char *msg);
+static void __noreturn aha152x_error(struct Scsi_Host *shpnt, char *msg);
 static void done(struct Scsi_Host *shpnt, unsigned char status_byte,
 		 unsigned char host_byte);
 

@@ -2441,7 +2441,7 @@ static void is_complete(struct Scsi_Host *shpnt)
 /*
  * Dump the current driver status and panic
  */
-static void aha152x_error(struct Scsi_Host *shpnt, char *msg)
+static void __noreturn aha152x_error(struct Scsi_Host *shpnt, char *msg)
 {
 	shost_printk(KERN_EMERG, shpnt, "%s\n", msg);
 	show_queues(shpnt);

index 793fe19993a9..c6eb2b97e929 100644
@@ -376,12 +376,14 @@ ahd_lockinit(struct ahd_softc *ahd)
 
 static inline void
 ahd_lock(struct ahd_softc *ahd, unsigned long *flags)
+	__acquires(&ahd->platform_data->spin_lock)
 {
 	spin_lock_irqsave(&ahd->platform_data->spin_lock, *flags);
 }
 
 static inline void
 ahd_unlock(struct ahd_softc *ahd, unsigned long *flags)
+	__releases(&ahd->platform_data->spin_lock)
 {
 	spin_unlock_irqrestore(&ahd->platform_data->spin_lock, *flags);
 }

index 51d9f4de0734..5e78fe7d3f32 100644
@@ -389,12 +389,14 @@ ahc_lockinit(struct ahc_softc *ahc)
 
 static inline void
 ahc_lock(struct ahc_softc *ahc, unsigned long *flags)
+	__acquires(&ahc->platform_data->spin_lock)
 {
 	spin_lock_irqsave(&ahc->platform_data->spin_lock, *flags);
 }
 
 static inline void
 ahc_unlock(struct ahc_softc *ahc, unsigned long *flags)
+	__releases(&ahc->platform_data->spin_lock)
 {
 	spin_unlock_irqrestore(&ahc->platform_data->spin_lock, *flags);
 }

index 12a2d12fef07..d8e732425e77 100644
@@ -604,7 +604,8 @@ static int iser_check_remote_inv(struct iser_conn *iser_conn, struct ib_wc *wc,
 			return -EPROTO;
 		}
 
-		task = iscsi_itt_to_ctask(iser_conn->iscsi_conn, hdr->itt);
+		task = iscsi_itt_to_ctask(iser_conn->iscsi_conn->session,
+					  iser_conn->iscsi_conn, hdr->itt);
 		if (likely(task)) {
 			struct iscsi_iser_task *iser_task = task->dd_data;
 			struct iser_fr_desc *desc;

index fd18d4d3d219..c8ee0473a1dd 100644
@@ -1178,7 +1178,7 @@ be_complete_io(struct beiscsi_conn *beiscsi_conn,
 		scsi_dma_unmap(io_task->scsi_cmnd);
 		io_task->scsi_cmnd = NULL;
 	}
-	iscsi_complete_scsi_task(task, exp_cmdsn, max_cmdsn);
+	iscsi_complete_scsi_task(conn->session, task, exp_cmdsn, max_cmdsn);
 }
 
 static void

@@ -1205,7 +1205,7 @@ be_complete_logout(struct beiscsi_conn *beiscsi_conn,
 	hdr->dlength[2] = 0;
 	hdr->hlength = 0;
 	hdr->itt = io_task->libiscsi_itt;
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
+	__iscsi_complete_pdu(conn->session, conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
 static void

@@ -1226,7 +1226,7 @@ be_complete_tmf(struct beiscsi_conn *beiscsi_conn,
 				     csol_cqe->cmd_wnd - 1);
 
 	hdr->itt = io_task->libiscsi_itt;
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
+	__iscsi_complete_pdu(conn->session, conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
 static void

@@ -1260,7 +1260,7 @@ hwi_complete_drvr_msgs(struct beiscsi_conn *beiscsi_conn,
 	spin_lock_bh(&session->back_lock);
 	task = pwrb_handle->pio_handle;
 	if (task)
-		__iscsi_put_task(task);
+		__iscsi_put_task(session, task);
 	spin_unlock_bh(&session->back_lock);
 }
 

@@ -1281,7 +1281,7 @@ be_complete_nopin_resp(struct beiscsi_conn *beiscsi_conn,
 
 	hdr->opcode = ISCSI_OP_NOOP_IN;
 	hdr->itt = io_task->libiscsi_itt;
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
+	__iscsi_complete_pdu(conn->session, conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
 static void adapter_get_sol_cqe(struct beiscsi_hba *phba,

@@ -1460,7 +1460,8 @@ beiscsi_complete_pdu(struct beiscsi_conn *beiscsi_conn,
 			    code);
 		return 1;
 	}
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)phdr, pdata, dlen);
+	__iscsi_complete_pdu(conn->session, conn, (struct iscsi_hdr *)phdr, pdata,
+			     dlen);
 	return 0;
 }
 

index d24cc2c795d6..4d4eca23d471 100644
@@ -383,6 +383,7 @@ int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
 			 struct iscsi_task *mtask)
 {
 	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_session *session = conn->session;
 	struct iscsi_tm *tmfabort_hdr;
 	struct scsi_cmnd *ref_sc;
 	struct iscsi_task *ctask;

@@ -404,7 +405,7 @@ int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
 	switch (tmfabort_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) {
 	case ISCSI_TM_FUNC_ABORT_TASK:
 	case ISCSI_TM_FUNC_TASK_REASSIGN:
-		ctask = iscsi_itt_to_task(conn, tmfabort_hdr->rtt);
+		ctask = iscsi_itt_to_task(session, conn, tmfabort_hdr->rtt);
 		if (!ctask || !ctask->sc)
 			/*
 			 * the iscsi layer must have completed the cmd while

@@ -1347,7 +1348,7 @@ int bnx2i_process_scsi_cmd_resp(struct iscsi_session *session,
 
 	resp_cqe = (struct bnx2i_cmd_response *)cqe;
 	spin_lock_bh(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 				 resp_cqe->itt & ISCSI_CMD_RESPONSE_INDEX);
 	if (!task)
 		goto fail;

@@ -1414,7 +1415,7 @@ int bnx2i_process_scsi_cmd_resp(struct iscsi_session *session,
 	}
 
 done:
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr,
 			     conn->data, datalen);
 fail:
 	spin_unlock_bh(&session->back_lock);

@@ -1443,7 +1444,7 @@ static int bnx2i_process_login_resp(struct iscsi_session *session,
 
 	login = (struct bnx2i_login_response *) cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 				 login->itt & ISCSI_LOGIN_RESPONSE_INDEX);
 	if (!task)
 		goto done;

@@ -1481,7 +1482,7 @@ static int bnx2i_process_login_resp(struct iscsi_session *session,
 		}
 	}
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr,
 		bnx2i_conn->gen_pdu.resp_buf,
 		bnx2i_conn->gen_pdu.resp_wr_ptr - bnx2i_conn->gen_pdu.resp_buf);
 done:

@@ -1511,7 +1512,8 @@ static int bnx2i_process_text_resp(struct iscsi_session *session,
 
 	text = (struct bnx2i_text_response *) cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn, text->itt & ISCSI_LOGIN_RESPONSE_INDEX);
+	task = iscsi_itt_to_task(session, conn,
+				 text->itt & ISCSI_LOGIN_RESPONSE_INDEX);
 	if (!task)
 		goto done;
 

@@ -1541,7 +1543,7 @@ static int bnx2i_process_text_resp(struct iscsi_session *session,
 			bnx2i_conn->gen_pdu.resp_wr_ptr++;
 		}
 	}
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr,
 			     bnx2i_conn->gen_pdu.resp_buf,
 			     bnx2i_conn->gen_pdu.resp_wr_ptr -
 			     bnx2i_conn->gen_pdu.resp_buf);

@@ -1570,7 +1572,7 @@ static int bnx2i_process_tmf_resp(struct iscsi_session *session,
 
 	tmf_cqe = (struct bnx2i_tmf_response *)cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 				 tmf_cqe->itt & ISCSI_TMF_RESPONSE_INDEX);
 	if (!task)
 		goto done;

@@ -1583,7 +1585,7 @@ static int bnx2i_process_tmf_resp(struct iscsi_session *session,
 	resp_hdr->itt = task->hdr->itt;
 	resp_hdr->response = tmf_cqe->response;
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
 done:
 	spin_unlock(&session->back_lock);
 	return 0;

@@ -1609,7 +1611,7 @@ static int bnx2i_process_logout_resp(struct iscsi_session *session,
 
 	logout = (struct bnx2i_logout_response *) cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 				 logout->itt & ISCSI_LOGOUT_RESPONSE_INDEX);
 	if (!task)
 		goto done;

@@ -1628,7 +1630,7 @@ static int bnx2i_process_logout_resp(struct iscsi_session *session,
 	resp_hdr->t2wait = cpu_to_be32(logout->time_to_wait);
 	resp_hdr->t2retain = cpu_to_be32(logout->time_to_retain);
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
 
 	bnx2i_conn->ep->state = EP_STATE_LOGOUT_RESP_RCVD;
 done:

@@ -1654,10 +1656,10 @@ static void bnx2i_process_nopin_local_cmpl(struct iscsi_session *session,
 
 	nop_in = (struct bnx2i_nop_in_msg *)cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 				 nop_in->itt & ISCSI_NOP_IN_MSG_INDEX);
 	if (task)
-		__iscsi_put_task(task);
+		__iscsi_put_task(session, task);
 	spin_unlock(&session->back_lock);
 }
 

@@ -1713,7 +1715,7 @@ static int bnx2i_process_nopin_mesg(struct iscsi_session *session,
 	}
 
 	/* this is a response to one of our nop-outs */
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 			 (itt_t) (nop_in->itt & ISCSI_NOP_IN_MSG_INDEX));
 	if (task) {
 		hdr->flags = ISCSI_FLAG_CMD_FINAL;

@@ -1722,7 +1724,7 @@ static int bnx2i_process_nopin_mesg(struct iscsi_session *session,
 		memcpy(&hdr->lun, nop_in->lun, 8);
 	}
 done:
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr, NULL, 0);
 	spin_unlock(&session->back_lock);
 
 	return tgt_async_nop;

@@ -1773,7 +1775,7 @@ static void bnx2i_process_async_mesg(struct iscsi_session *session,
 	resp_hdr->param2 = cpu_to_be16(async_cqe->param2);
 	resp_hdr->param3 = cpu_to_be16(async_cqe->param3);
 
-	__iscsi_complete_pdu(bnx2i_conn->cls_conn->dd_data,
+	__iscsi_complete_pdu(session, bnx2i_conn->cls_conn->dd_data,
 			     (struct iscsi_hdr *)resp_hdr, NULL, 0);
 	spin_unlock(&session->back_lock);
 }

@@ -1811,7 +1813,7 @@ static void bnx2i_process_reject_mesg(struct iscsi_session *session,
 	hdr->max_cmdsn = cpu_to_be32(reject->max_cmd_sn);
 	hdr->exp_cmdsn = cpu_to_be32(reject->exp_cmd_sn);
 	hdr->ffffffff = cpu_to_be32(RESERVED_ITT);
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, conn->data,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr, conn->data,
 			     reject->data_length);
 	spin_unlock(&session->back_lock);
 }

@@ -1834,7 +1836,7 @@ static void bnx2i_process_cmd_cleanup_resp(struct iscsi_session *session,
 
 	cmd_clean_rsp = (struct bnx2i_cleanup_response *)cqe;
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(conn,
+	task = iscsi_itt_to_task(session, conn,
 			cmd_clean_rsp->itt & ISCSI_CLEANUP_RESPONSE_INDEX);
 	if (!task)
 		printk(KERN_ALERT "bnx2i: cmd clean ITT %x not active\n",

@@ -1908,7 +1910,7 @@ static int bnx2i_queue_scsi_cmd_resp(struct iscsi_session *session,
 	int rc = 0;
 
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_task(bnx2i_conn->cls_conn->dd_data,
+	task = iscsi_itt_to_task(session, bnx2i_conn->cls_conn->dd_data,
 				 cqe->itt & ISCSI_CMD_RESPONSE_INDEX);
 	if (!task || !task->sc) {
 		spin_unlock(&session->back_lock);

index ea9631bfe2e2..d73a6578b461 100644
@@ -1537,9 +1537,11 @@ skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
 		 * for the last pdu of a sequence.
 		 */
 		itt_t itt = ((struct iscsi_data *)skb->data)->itt;
-		struct iscsi_task *task = iscsi_itt_to_ctask(conn, itt);
-		u32 data_sn = be32_to_cpu(((struct iscsi_data *)
-							skb->data)->datasn);
+		struct iscsi_task *task;
+		u32 data_sn;
+
+		task = iscsi_itt_to_ctask(conn->session, conn, itt);
+		data_sn = be32_to_cpu(((struct iscsi_data *)skb->data)->datasn);
 		if (task && task->sc) {
 			struct iscsi_tcp_task *tcp_task = task->dd_data;
 

714 lines not on this page · raw message

index 7223bb18b048..a9c092a80b81 100644
@@ -529,7 +529,7 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 	int rc;
 
 	spin_lock(&session->back_lock);
-	task = iscsi_itt_to_ctask(conn, hdr->itt);
+	task = iscsi_itt_to_ctask(session, conn, hdr->itt);
 	if (!task) {
 		spin_unlock(&session->back_lock);
 		return ISCSI_ERR_BAD_ITT;

@@ -677,6 +677,7 @@ iscsi_tcp_process_data_in(struct iscsi_tcp_conn *tcp_conn,
 static int
 iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 {
+	struct iscsi_session *session = conn->session;
 	int rc = 0, opcode, ahslen;
 	struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
 	struct iscsi_task *task;

@@ -706,14 +707,14 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 
 	switch(opcode) {
 	case ISCSI_OP_SCSI_DATA_IN:
-		spin_lock(&conn->session->back_lock);
-		task = iscsi_itt_to_ctask(conn, hdr->itt);
+		spin_lock(&session->back_lock);
+		task = iscsi_itt_to_ctask(session, conn, hdr->itt);
 		if (!task)
 			rc = ISCSI_ERR_BAD_ITT;
 		else
 			rc = iscsi_tcp_data_in(conn, task);
 		if (rc) {
-			spin_unlock(&conn->session->back_lock);
+			spin_unlock(&session->back_lock);
 			break;
 		}
 

@@ -731,7 +732,7 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 			 * update the digest per-entry.
 			 */
 			if (conn->datadgst_en &&
-			    !(conn->session->tt->caps & CAP_DIGEST_OFFLOAD))
+			    !(session->tt->caps & CAP_DIGEST_OFFLOAD))
 				rx_crcp = tcp_conn->rx_crcp;
 
 			ISCSI_DBG_TCP(conn, "iscsi_tcp_begin_data_in( "

@@ -746,11 +747,11 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 						   tcp_conn->in.datalen,
 						   iscsi_tcp_process_data_in,
 						   rx_crcp);
-			spin_unlock(&conn->session->back_lock);
+			spin_unlock(&session->back_lock);
 			return rc;
 		}
-		rc = __iscsi_complete_pdu(conn, hdr, NULL, 0);
-		spin_unlock(&conn->session->back_lock);
+		rc = __iscsi_complete_pdu(session, conn, hdr, NULL, 0);
+		spin_unlock(&session->back_lock);
 		break;
 	case ISCSI_OP_R2T:
 		if (ahslen) {

index 854efa4f61d8..37945f16811b 100644
@@ -73,7 +73,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
 	spin_unlock(&qedi_conn->list_lock);
 
 	cmd->state = RESPONSE_RECEIVED;
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
 
 	spin_unlock(&session->back_lock);
 }

@@ -138,7 +138,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
 
 	cmd->state = RESPONSE_RECEIVED;
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr_ptr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr_ptr,
 			     qedi_conn->gen_pdu.resp_buf,
 			     (qedi_conn->gen_pdu.resp_wr_ptr -
 			      qedi_conn->gen_pdu.resp_buf));

@@ -163,7 +163,8 @@ static void qedi_tmf_resp_work(struct work_struct *work)
 		goto exit_tmf_resp;
 
 	spin_lock(&session->back_lock);
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr_ptr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr_ptr, NULL,
+			     0);
 	spin_unlock(&session->back_lock);
 
 exit_tmf_resp:

@@ -247,7 +248,8 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi,
 	}
 	spin_unlock(&qedi_conn->tmf_work_lock);
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr_ptr, NULL, 0);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr_ptr, NULL,
+			     0);
 	kfree(resp_hdr_ptr);
 
 unblock_sess:

@@ -304,7 +306,7 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi,
 
 	memset(task_ctx, '\0', sizeof(*task_ctx));
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr_ptr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr_ptr,
 			     qedi_conn->gen_pdu.resp_buf,
 			     (qedi_conn->gen_pdu.resp_wr_ptr -
 			     qedi_conn->gen_pdu.resp_buf));

@@ -470,7 +472,8 @@ static int qedi_process_nopin_mesg(struct qedi_ctx *qedi,
 	}
 
 done:
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, bdq_data, pdu_len);
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr, bdq_data,
+			     pdu_len);
 
 	spin_unlock_bh(&session->back_lock);
 	return tgt_async_nop;

@@ -524,7 +527,7 @@ static void qedi_process_async_mesg(struct qedi_ctx *qedi,
 	resp_hdr->param2 = cpu_to_be16(cqe_async_msg->param2_rsrv);
 	resp_hdr->param3 = cpu_to_be16(cqe_async_msg->param3_rsrv);
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, bdq_data,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)resp_hdr, bdq_data,
 			     pdu_len);
 
 	spin_unlock_bh(&session->back_lock);

@@ -567,7 +570,7 @@ static void qedi_process_reject_mesg(struct qedi_ctx *qedi,
 	hdr->statsn = cpu_to_be32(cqe_reject->stat_sn);
 	hdr->ffffffff = cpu_to_be32(0xffffffff);
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr,
 			     conn->data, pld_len);
 	spin_unlock_bh(&session->back_lock);
 }

@@ -664,7 +667,7 @@ static void qedi_scsi_completion(struct qedi_ctx *qedi,
 	if (qedi_io_tracing)
 		qedi_trace_io(qedi, task, cmd->task_id, QEDI_IO_TRACE_RSP);
 
-	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr,
+	__iscsi_complete_pdu(session, conn, (struct iscsi_hdr *)hdr,
 			     conn->data, datalen);
 error:
 	spin_unlock_bh(&session->back_lock);

@@ -722,7 +725,7 @@ static void qedi_process_nopin_local_cmpl(struct qedi_ctx *qedi,
 	cmd->state = RESPONSE_RECEIVED;
 
 	spin_lock_bh(&session->back_lock);
-	__iscsi_put_task(task);
+	__iscsi_put_task(session, task);
 	spin_unlock_bh(&session->back_lock);
 }
 

@@ -1316,6 +1319,7 @@ static void qedi_abort_work(struct work_struct *work)
 	struct qedi_conn *qedi_conn = qedi_cmd->conn;
 	struct qedi_ctx *qedi = qedi_conn->qedi;
 	struct iscsi_conn *conn = qedi_conn->cls_conn->dd_data;
+	struct iscsi_session *session = conn->session;
 	struct qedi_work_map *list_work = NULL;
 	struct iscsi_task *mtask;
 	struct qedi_cmd *cmd;

@@ -1326,16 +1330,16 @@ static void qedi_abort_work(struct work_struct *work)
 	mtask = qedi_cmd->task;
 	tmf_hdr = (struct iscsi_tm *)mtask->hdr;
 
-	spin_lock_bh(&conn->session->back_lock);
-	ctask = iscsi_itt_to_ctask(conn, tmf_hdr->rtt);
+	spin_lock_bh(&session->back_lock);
+	ctask = iscsi_itt_to_ctask(session, conn, tmf_hdr->rtt);
 	if (!ctask) {
-		spin_unlock_bh(&conn->session->back_lock);
+		spin_unlock_bh(&session->back_lock);
 		QEDI_ERR(&qedi->dbg_ctx, "Invalid RTT. Letting abort timeout.\n");
 		goto clear_cleanup;
 	}
 
 	if (iscsi_task_is_completed(ctask)) {
-		spin_unlock_bh(&conn->session->back_lock);
+		spin_unlock_bh(&session->back_lock);
 		QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
 			  "Task already completed\n");
 		/*

@@ -1344,7 +1348,7 @@ static void qedi_abort_work(struct work_struct *work)
 		 */
 		goto send_tmf;
 	}
-	spin_unlock_bh(&conn->session->back_lock);
+	spin_unlock_bh(&session->back_lock);
 
 	cmd = (struct qedi_cmd *)ctask->dd_data;
 	QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,

index cf52258ecdde..81989c905c82 100644
@@ -367,6 +367,7 @@ static void qla4xxx_passthru_status_entry(struct scsi_qla_host *ha,
 	struct ddb_entry *ddb_entry;
 	struct ql4_task_data *task_data;
 	struct iscsi_cls_conn *cls_conn;
+	struct iscsi_session *session;
 	struct iscsi_conn *conn;
 	itt_t itt;
 	uint32_t fw_ddb_index;

@@ -384,9 +385,10 @@ static void qla4xxx_passthru_status_entry(struct scsi_qla_host *ha,
 
 	cls_conn = ddb_entry->conn;
 	conn = cls_conn->dd_data;
-	spin_lock(&conn->session->back_lock);
-	task = iscsi_itt_to_task(conn, itt);
-	spin_unlock(&conn->session->back_lock);
+	session = conn->session;
+	spin_lock(&session->back_lock);
+	task = iscsi_itt_to_task(session, conn, itt);
+	spin_unlock(&session->back_lock);
 
 	if (task == NULL) {
 		ql4_printk(KERN_ERR, ha, "%s: Task is NULL\n", __func__);

index 3d765c77bcd9..f79b46798edf 100644
@@ -474,17 +474,21 @@ extern int iscsi_conn_send_pdu(struct iscsi_cls_conn *, struct iscsi_hdr *,
 				char *, uint32_t);
 extern int iscsi_complete_pdu(struct iscsi_conn *, struct iscsi_hdr *,
 			      char *, int);
-extern int __iscsi_complete_pdu(struct iscsi_conn *, struct iscsi_hdr *,
+extern int __iscsi_complete_pdu(struct iscsi_session *session,
+				struct iscsi_conn *conn, struct iscsi_hdr *,
 				char *, int);
 extern int iscsi_verify_itt(struct iscsi_conn *, itt_t);
-extern struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_conn *, itt_t);
-extern struct iscsi_task *iscsi_itt_to_task(struct iscsi_conn *, itt_t);
+struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_session *session,
+				      struct iscsi_conn *, itt_t);
+struct iscsi_task *iscsi_itt_to_task(struct iscsi_session *session,
+				     struct iscsi_conn *, itt_t);
 extern void iscsi_requeue_task(struct iscsi_task *task);
 extern void iscsi_put_task(struct iscsi_task *task);
-extern void __iscsi_put_task(struct iscsi_task *task);
+void __iscsi_put_task(struct iscsi_session *session, struct iscsi_task *task);
 extern bool iscsi_get_task(struct iscsi_task *task);
-extern void iscsi_complete_scsi_task(struct iscsi_task *task,
-				     uint32_t exp_cmdsn, uint32_t max_cmdsn);
+void iscsi_complete_scsi_task(struct iscsi_session *session,
+			      struct iscsi_task *task,
+			      uint32_t exp_cmdsn, uint32_t max_cmdsn);
 
 /*
  * generic helpers

index 179de08ca515..34d4125417db 100644
@@ -454,6 +454,7 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
  */
 static void iscsi_free_task(struct iscsi_session *session,
 			    struct iscsi_task *task)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 	struct scsi_cmnd *sc = task->sc;

@@ -499,6 +500,7 @@ EXPORT_SYMBOL_GPL(iscsi_get_task);
  * The back_lock must be held when calling in case it frees the task.
  */
 void __iscsi_put_task(struct iscsi_session *session, struct iscsi_task *task)
+	__must_hold(&session->back_lock)
 {
 	if (refcount_dec_and_test(&task->refcount))
 		iscsi_free_task(session, task);

@@ -527,6 +529,7 @@ EXPORT_SYMBOL_GPL(iscsi_put_task);
  */
 static void iscsi_complete_task(struct iscsi_session *session,
 				struct iscsi_task *task, int state)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 

@@ -562,6 +565,7 @@ static void iscsi_complete_task(struct iscsi_session *session,
 void iscsi_complete_scsi_task(struct iscsi_session *session,
 			      struct iscsi_task *task,
 			      uint32_t exp_cmdsn, uint32_t max_cmdsn)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 

@@ -578,6 +582,8 @@ EXPORT_SYMBOL_GPL(iscsi_complete_scsi_task);
  */
 static bool cleanup_queued_task(struct iscsi_session *session,
 				struct iscsi_task *task)
+	__must_hold(&session->frwd_lock)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 	bool early_complete = false;

@@ -620,6 +626,8 @@ static bool cleanup_queued_task(struct iscsi_session *session,
  */
 static void __fail_scsi_task(struct iscsi_session *session,
 			     struct iscsi_task *task, int err)
+	__must_hold(&session->frwd_lock)
+	__must_hold(&session->back_lock)
 {
 	struct scsi_cmnd *sc;
 	int state;

@@ -648,6 +656,7 @@ static void __fail_scsi_task(struct iscsi_session *session,
 
 static void fail_scsi_task(struct iscsi_session *session,
 			   struct iscsi_task *task, int err)
+	__must_hold(&session->frwd_lock)
 {
 	spin_lock_bh(&session->back_lock);
 	__fail_scsi_task(session, task, err);

@@ -876,6 +885,7 @@ static void iscsi_scsi_cmd_rsp(struct iscsi_session *session,
 			       struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 			       struct iscsi_task *task, char *data,
 			       int datalen)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_scsi_rsp *rhdr = (struct iscsi_scsi_rsp *)hdr;
 	struct scsi_cmnd *sc = task->sc;

@@ -972,6 +982,7 @@ static void iscsi_scsi_cmd_rsp(struct iscsi_session *session,
 static void
 iscsi_data_in_rsp(struct iscsi_session *session, struct iscsi_conn *conn,
 		  struct iscsi_hdr *hdr, struct iscsi_task *task)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_data_rsp *rhdr = (struct iscsi_data_rsp *)hdr;
 	struct scsi_cmnd *sc = task->sc;

@@ -1078,6 +1089,7 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
 static int iscsi_nop_out_rsp(struct iscsi_session *session,
 			     struct iscsi_task *task,
 			     struct iscsi_nopin *nop, char *data, int datalen)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 	int rc = 0;

@@ -1099,6 +1111,7 @@ static int iscsi_nop_out_rsp(struct iscsi_session *session,
 static int iscsi_handle_reject(struct iscsi_session *session,
 			       struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 			       char *data, int datalen)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_reject *reject = (struct iscsi_reject *)hdr;
 	struct iscsi_hdr rejected_pdu;

@@ -1194,6 +1207,7 @@ static int iscsi_handle_reject(struct iscsi_session *session,
  */
 struct iscsi_task *iscsi_itt_to_task(struct iscsi_session *session,
 				     struct iscsi_conn *conn, itt_t itt)
+	__must_hold(&session->back_lock)
 {
 	int i;
 

@@ -1225,6 +1239,7 @@ EXPORT_SYMBOL_GPL(iscsi_itt_to_task);
  */
 int __iscsi_complete_pdu(struct iscsi_session *session, struct iscsi_conn *conn,
 			 struct iscsi_hdr *hdr, char *data, int datalen)
+	__must_hold(&session->back_lock)
 {
 	int opcode = hdr->opcode & ISCSI_OPCODE_MASK, rc = 0;
 	struct iscsi_task *task;

@@ -1420,6 +1435,7 @@ EXPORT_SYMBOL_GPL(iscsi_verify_itt);
  */
 struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_session *session,
 				      struct iscsi_conn *conn, itt_t itt)
+	__must_hold(&session->back_lock)
 {
 	struct iscsi_task *task;
 

@@ -1499,6 +1515,7 @@ EXPORT_SYMBOL_GPL(iscsi_conn_failure);
 
 static int iscsi_check_cmdsn_window_closed(struct iscsi_session *session,
 					   struct iscsi_conn *conn)
+	__must_hold(&session->frwd_lock)
 {
 	/*
 	 * Check for iSCSI window and take care of CmdSN wrap-around

@@ -1515,6 +1532,7 @@ static int iscsi_check_cmdsn_window_closed(struct iscsi_session *session,
 
 static int iscsi_xmit_task(struct iscsi_session *session, struct iscsi_conn *conn,
 			   struct iscsi_task *task, bool was_requeue)
+	__must_hold(&session->frwd_lock)
 {
 	int rc;
 

@@ -1932,6 +1950,7 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_session *session,
 				   struct iscsi_conn *conn,
 				   struct iscsi_tm *hdr, int age,
 				   int timeout)
+	__must_hold(&session->eh_mutex)
 	__must_hold(&session->frwd_lock)
 {
 	if (__iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0)) {

@@ -1978,6 +1997,7 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_session *session,
  */
 static void fail_scsi_tasks(struct iscsi_session *session, struct iscsi_conn *conn,
 			    u64 lun, int error)
+	__must_hold(&session->frwd_lock)
 {
 	struct iscsi_task *task;
 	int i;

@@ -3372,6 +3392,7 @@ EXPORT_SYMBOL_GPL(iscsi_conn_start);
 
 static void
 fail_mgmt_tasks(struct iscsi_session *session, struct iscsi_conn *conn)
+	__must_hold(&session->frwd_lock)
 {
 	struct iscsi_task *task;
 	int i, state;

index f79b46798edf..e4ac4ec0ac3e 100644
@@ -476,19 +476,24 @@ extern int iscsi_complete_pdu(struct iscsi_conn *, struct iscsi_hdr *,
 			      char *, int);
 extern int __iscsi_complete_pdu(struct iscsi_session *session,
 				struct iscsi_conn *conn, struct iscsi_hdr *,
-				char *, int);
+				char *, int)
+	__must_hold(&session->back_lock);
 extern int iscsi_verify_itt(struct iscsi_conn *, itt_t);
 struct iscsi_task *iscsi_itt_to_ctask(struct iscsi_session *session,
-				      struct iscsi_conn *, itt_t);
+				      struct iscsi_conn *conn, itt_t itt)
+	__must_hold(&session->back_lock);
 struct iscsi_task *iscsi_itt_to_task(struct iscsi_session *session,
-				     struct iscsi_conn *, itt_t);
+				     struct iscsi_conn *conn, itt_t itt)
+	__must_hold(&session->back_lock);
 extern void iscsi_requeue_task(struct iscsi_task *task);
 extern void iscsi_put_task(struct iscsi_task *task);
-void __iscsi_put_task(struct iscsi_session *session, struct iscsi_task *task);
+void __iscsi_put_task(struct iscsi_session *session, struct iscsi_task *task)
+	__must_hold(&session->back_lock);
 extern bool iscsi_get_task(struct iscsi_task *task);
 void iscsi_complete_scsi_task(struct iscsi_session *session,
 			      struct iscsi_task *task,
-			      uint32_t exp_cmdsn, uint32_t max_cmdsn);
+			      uint32_t exp_cmdsn, uint32_t max_cmdsn)
+	__must_hold(&session->back_lock);
 
 /*
  * generic helpers

index c8ee0473a1dd..356ab9c0fb7c 100644
@@ -1117,6 +1117,7 @@ static void
 be_complete_io(struct beiscsi_conn *beiscsi_conn,
 		struct iscsi_task *task,
 		struct common_sol_cqe *csol_cqe)
+	__must_hold(&beiscsi_conn->conn->session->back_lock)
 {
 	struct beiscsi_io_task *io_task = task->dd_data;
 	struct be_status_bhs *sts_bhs =

@@ -1185,6 +1186,7 @@ static void
 be_complete_logout(struct beiscsi_conn *beiscsi_conn,
 		    struct iscsi_task *task,
 		    struct common_sol_cqe *csol_cqe)
+	__must_hold(&beiscsi_conn->conn->session->back_lock)
 {
 	struct iscsi_logout_rsp *hdr;
 	struct beiscsi_io_task *io_task = task->dd_data;

@@ -1212,6 +1214,7 @@ static void
 be_complete_tmf(struct beiscsi_conn *beiscsi_conn,
 		 struct iscsi_task *task,
 		 struct common_sol_cqe *csol_cqe)
+	__must_hold(&beiscsi_conn->conn->session->back_lock)
 {
 	struct iscsi_tm_rsp *hdr;
 	struct iscsi_conn *conn = beiscsi_conn->conn;

@@ -1268,6 +1271,7 @@ static void
 be_complete_nopin_resp(struct beiscsi_conn *beiscsi_conn,
 			struct iscsi_task *task,
 			struct common_sol_cqe *csol_cqe)
+	__must_hold(&beiscsi_conn->conn->session->back_lock)
 {
 	struct iscsi_nopin *hdr;
 	struct iscsi_conn *conn = beiscsi_conn->conn;

@@ -1423,6 +1427,7 @@ static void hwi_complete_cmd(struct beiscsi_conn *beiscsi_conn,
 static unsigned int
 beiscsi_complete_pdu(struct beiscsi_conn *beiscsi_conn,
 		struct pdu_base *phdr, void *pdata, unsigned int dlen)
+	__must_hold(&beiscsi_conn->conn->session->back_lock)
 {
 	struct beiscsi_hba *phba = beiscsi_conn->phba;
 	struct iscsi_conn *conn = beiscsi_conn->conn;

index d73a6578b461..b0bffbc38183 100644
@@ -1540,6 +1540,11 @@ skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
 		struct iscsi_task *task;
 		u32 data_sn;
 
+		/*
+		 * TODO: hold session->back_lock around the iscsi_itt_to_task()
+		 * call below.
+		 */
+		__assume_ctx_lock(&conn->session->back_lock);
 		task = iscsi_itt_to_ctask(conn->session, conn, itt);
 		data_sn = be32_to_cpu(((struct iscsi_data *)skb->data)->datasn);
 		if (task && task->sc) {

index 8c8968ec8cb4..fde41224d31f 100644
@@ -423,7 +423,8 @@ struct bnx2fc_cmd {
 	struct scsi_cmnd *sc_cmd;
 	struct bnx2fc_cmd_mgr *cmd_mgr;
 	struct bnx2fc_mp_req mp_req;
-	void (*cb_func)(struct bnx2fc_els_cb_arg *cb_arg);
+	void (*cb_func)(struct bnx2fc_rport *tgt,
+			struct bnx2fc_els_cb_arg *cb_arg);
 	struct bnx2fc_els_cb_arg *cb_arg;
 	struct delayed_work timeout_work; /* timer for ULP timeouts */
 	struct completion abts_done;

@@ -592,7 +593,8 @@ int bnx2fc_send_stat_req(struct bnx2fc_hba *hba);
 int bnx2fc_post_io_req(struct bnx2fc_rport *tgt, struct bnx2fc_cmd *io_req);
 int bnx2fc_send_rec(struct bnx2fc_cmd *orig_io_req);
 int bnx2fc_send_srr(struct bnx2fc_cmd *orig_io_req, u32 offset, u8 r_ctl);
-void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_cmd *seq_clnup_req,
+void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_rport *tgt,
+				      struct bnx2fc_cmd *seq_clnp_req,
 				      struct fcoe_task_ctx_entry *task,
 				      u8 rx_state);
 int bnx2fc_initiate_seq_cleanup(struct bnx2fc_cmd *orig_io_req, u32 offset,

index 749e30aaf926..5191d87fb446 100644
@@ -22,10 +22,12 @@ static void bnx2fc_flogi_resp(struct fc_seq *seq, struct fc_frame *fp,
 			      void *arg);
 static int bnx2fc_initiate_els(struct bnx2fc_rport *tgt, unsigned int op,
 			void *data, u32 data_len,
-			void (*cb_func)(struct bnx2fc_els_cb_arg *cb_arg),
+			void (*cb_func)(struct bnx2fc_rport *tgt,
+					struct bnx2fc_els_cb_arg *cb_arg),
 			struct bnx2fc_els_cb_arg *cb_arg, u32 timer_msec);
 
-static void bnx2fc_rrq_compl(struct bnx2fc_els_cb_arg *cb_arg)
+static void bnx2fc_rrq_compl(struct bnx2fc_rport *tgt,
+			     struct bnx2fc_els_cb_arg *cb_arg)
 {
 	struct bnx2fc_cmd *orig_io_req;
 	struct bnx2fc_cmd *rrq_req;

@@ -119,10 +121,10 @@ int bnx2fc_send_rrq(struct bnx2fc_cmd *aborted_io_req)
 	return rc;
 }
 
-static void bnx2fc_l2_els_compl(struct bnx2fc_els_cb_arg *cb_arg)
+static void bnx2fc_l2_els_compl(struct bnx2fc_rport *tgt,
+				struct bnx2fc_els_cb_arg *cb_arg)
 {
 	struct bnx2fc_cmd *els_req;
-	struct bnx2fc_rport *tgt;
 	struct bnx2fc_mp_req *mp_req;
 	struct fc_frame_header *fc_hdr;
 	unsigned char *buf;

@@ -150,7 +152,6 @@ static void bnx2fc_l2_els_compl(struct bnx2fc_els_cb_arg *cb_arg)
 		goto free_arg;
 	}
 
-	tgt = els_req->tgt;
 	mp_req = &(els_req->mp_req);
 	fc_hdr = &(mp_req->resp_fc_hdr);
 	resp_len = mp_req->resp_len;

@@ -262,7 +263,8 @@ int bnx2fc_send_rls(struct bnx2fc_rport *tgt, struct fc_frame *fp)
 	return rc;
 }
 
-static void bnx2fc_srr_compl(struct bnx2fc_els_cb_arg *cb_arg)
+static void bnx2fc_srr_compl(struct bnx2fc_rport *tgt,
+			     struct bnx2fc_els_cb_arg *cb_arg)
 {
 	struct bnx2fc_mp_req *mp_req;
 	struct fc_frame_header *fc_hdr, *fh;

@@ -296,7 +298,6 @@ static void bnx2fc_srr_compl(struct bnx2fc_els_cb_arg *cb_arg)
 		}
 		orig_io_req->srr_retry++;
 		if (orig_io_req->srr_retry <= SRR_RETRY_COUNT) {
-			struct bnx2fc_rport *tgt = orig_io_req->tgt;
 			spin_unlock_bh(&tgt->tgt_lock);
 			rc = bnx2fc_send_srr(orig_io_req,
 					     orig_io_req->srr_offset,

@@ -372,7 +373,8 @@ static void bnx2fc_srr_compl(struct bnx2fc_els_cb_arg *cb_arg)
 	kref_put(&orig_io_req->refcount, bnx2fc_cmd_release);
 }
 
-static void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
+static void bnx2fc_rec_compl(struct bnx2fc_rport *tgt,
+			     struct bnx2fc_els_cb_arg *cb_arg)
 {
 	struct bnx2fc_cmd *orig_io_req, *new_io_req;
 	struct bnx2fc_cmd *rec_req;

@@ -380,7 +382,6 @@ static void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
 	struct fc_frame_header *fc_hdr, *fh;
 	struct fc_els_ls_rjt *rjt;
 	struct fc_els_rec_acc *acc;
-	struct bnx2fc_rport *tgt;
 	struct fcoe_err_report_entry *err_entry;
 	struct scsi_cmnd *sc_cmd;
 	enum fc_rctl r_ctl;

@@ -399,7 +400,6 @@ static void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
 	rec_req = cb_arg->io_req;
 	orig_io_req = cb_arg->aborted_io_req;
 	BNX2FC_IO_DBG(rec_req, "rec_compl: orig xid = 0x%x", orig_io_req->xid);
-	tgt = orig_io_req->tgt;
 
 	/* Handle REC timeout case */
 	if (test_and_clear_bit(BNX2FC_FLAG_ELS_TIMEOUT, &rec_req->req_flags)) {

@@ -669,7 +669,8 @@ int bnx2fc_send_srr(struct bnx2fc_cmd *orig_io_req, u32 offset, u8 r_ctl)
 
 static int bnx2fc_initiate_els(struct bnx2fc_rport *tgt, unsigned int op,
 			void *data, u32 data_len,
-			void (*cb_func)(struct bnx2fc_els_cb_arg *cb_arg),
+			void (*cb_func)(struct bnx2fc_rport *tgt,
+					struct bnx2fc_els_cb_arg *cb_arg),
 			struct bnx2fc_els_cb_arg *cb_arg, u32 timer_msec)
 {
 	struct fcoe_port *port = tgt->port;

@@ -847,7 +848,7 @@ void bnx2fc_process_els_compl(struct bnx2fc_cmd *els_req,
 
 	/* Parse ELS response */
 	if ((els_req->cb_func) && (els_req->cb_arg)) {
-		els_req->cb_func(els_req->cb_arg);
+		els_req->cb_func(els_req->tgt, els_req->cb_arg);
 		els_req->cb_arg = NULL;
 	}
 

index a5ecb87d5b2d..833ec0e35731 100644
@@ -943,7 +943,7 @@ void bnx2fc_process_cq_compl(struct bnx2fc_rport *tgt, u16 wqe,
 	case BNX2FC_SEQ_CLEANUP:
 		BNX2FC_IO_DBG(io_req, "cq_compl(0x%x) - seq cleanup resp\n",
 			      io_req->xid);
-		bnx2fc_process_seq_cleanup_compl(io_req, task, rx_state);
+		bnx2fc_process_seq_cleanup_compl(tgt, io_req, task, rx_state);
 		kref_put(&io_req->refcount, bnx2fc_cmd_release);
 		break;
 

index 9c7a541a4523..82d70ccfc59b 100644
@@ -142,7 +142,7 @@ static void bnx2fc_cmd_timeout(struct work_struct *work)
 			set_bit(BNX2FC_FLAG_ELS_TIMEOUT, &io_req->req_flags);
 
 			if ((io_req->cb_func) && (io_req->cb_arg)) {
-				io_req->cb_func(io_req->cb_arg);
+				io_req->cb_func(tgt, io_req->cb_arg);
 				io_req->cb_arg = NULL;
 			}
 		}

@@ -1079,10 +1079,10 @@ int bnx2fc_eh_device_reset(struct scsi_cmnd *sc_cmd)
 				   FCP_TMF_LUN_RESET);
 }
 
-static int bnx2fc_abts_cleanup(struct bnx2fc_cmd *io_req)
+static int bnx2fc_abts_cleanup(struct bnx2fc_rport *tgt,
+			       struct bnx2fc_cmd *io_req)
 	__must_hold(&tgt->tgt_lock)
 {
-	struct bnx2fc_rport *tgt = io_req->tgt;
 	unsigned int time_left;
 
 	init_completion(&io_req->cleanup_done);

@@ -1212,7 +1212,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
 		 * cleanup the command and return that I/O was successfully
 		 * aborted.
 		 */
-		bnx2fc_abts_cleanup(io_req);
+		bnx2fc_abts_cleanup(tgt, io_req);
 		/* This only occurs when an task abort was requested while ABTS
 		   is in progress.  Setting the IO_CLEANUP flag will skip the
 		   RRQ process in the case when the fw generated SCSI_CMD cmpl

@@ -1262,7 +1262,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
 		 * Cleanup firmware residuals before returning control back
 		 * to SCSI ML.
 		 */
-		rc = bnx2fc_abts_cleanup(io_req);
+		rc = bnx2fc_abts_cleanup(tgt, io_req);
 		goto done;
 	} else {
 		/*

@@ -1282,7 +1282,8 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
 	return rc;
 }
 
-void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_cmd *seq_clnp_req,
+void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_rport *tgt,
+				      struct bnx2fc_cmd *seq_clnp_req,
 				      struct fcoe_task_ctx_entry *task,
 				      u8 rx_state)
 {

@@ -1291,7 +1292,6 @@ void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_cmd *seq_clnp_req,
 	u32 offset = cb_arg->offset;
 	enum fc_rctl r_ctl = cb_arg->r_ctl;
 	int rc = 0;
-	struct bnx2fc_rport *tgt = orig_io_req->tgt;
 
 	BNX2FC_IO_DBG(orig_io_req, "Entered process_cleanup_compl xid = 0x%x"
 			      "cmd_type = %d\n",

index 77dcdfc412b1..e6942cb6cae6 100644
@@ -224,7 +224,7 @@ void bnx2fc_flush_active_ios(struct bnx2fc_rport *tgt)
 				 bnx2fc_cmd_release); /* drop timer hold */
 
 		if ((io_req->cb_func) && (io_req->cb_arg)) {
-			io_req->cb_func(io_req->cb_arg);
+			io_req->cb_func(tgt, io_req->cb_arg);
 			io_req->cb_arg = NULL;
 		}
 

index fde41224d31f..2fc80c607437 100644
@@ -596,7 +596,8 @@ int bnx2fc_send_srr(struct bnx2fc_cmd *orig_io_req, u32 offset, u8 r_ctl);
 void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_rport *tgt,
 				      struct bnx2fc_cmd *seq_clnp_req,
 				      struct fcoe_task_ctx_entry *task,
-				      u8 rx_state);
+				      u8 rx_state)
+	__must_hold(&tgt->tgt_lock);
 int bnx2fc_initiate_seq_cleanup(struct bnx2fc_cmd *orig_io_req, u32 offset,
 				enum fc_rctl r_ctl);
 

index 5191d87fb446..bca28acaa1a2 100644
@@ -265,6 +265,7 @@ int bnx2fc_send_rls(struct bnx2fc_rport *tgt, struct fc_frame *fp)
 
 static void bnx2fc_srr_compl(struct bnx2fc_rport *tgt,
 			     struct bnx2fc_els_cb_arg *cb_arg)
+	__must_hold(&tgt->tgt_lock)
 {
 	struct bnx2fc_mp_req *mp_req;
 	struct fc_frame_header *fc_hdr, *fh;

@@ -375,6 +376,7 @@ static void bnx2fc_srr_compl(struct bnx2fc_rport *tgt,
 
 static void bnx2fc_rec_compl(struct bnx2fc_rport *tgt,
 			     struct bnx2fc_els_cb_arg *cb_arg)
+	__must_hold(&tgt->tgt_lock)
 {
 	struct bnx2fc_cmd *orig_io_req, *new_io_req;
 	struct bnx2fc_cmd *rec_req;

index 82d70ccfc59b..60346d77cb6d 100644
@@ -1286,6 +1286,7 @@ void bnx2fc_process_seq_cleanup_compl(struct bnx2fc_rport *tgt,
 				      struct bnx2fc_cmd *seq_clnp_req,
 				      struct fcoe_task_ctx_entry *task,
 				      u8 rx_state)
+	__must_hold(&tgt->tgt_lock)
 {
 	struct bnx2fc_els_cb_arg *cb_arg = seq_clnp_req->cb_arg;
 	struct bnx2fc_cmd *orig_io_req = cb_arg->aborted_io_req;

index 4d4eca23d471..c22f1c981d02 100644
@@ -405,6 +405,11 @@ int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
 	switch (tmfabort_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) {
 	case ISCSI_TM_FUNC_ABORT_TASK:
 	case ISCSI_TM_FUNC_TASK_REASSIGN:
+		/*
+		 * TODO: hold session->back_lock around the iscsi_itt_to_task()
+		 * call below.
+		 */
+		__assume_ctx_lock(&session->back_lock);
 		ctask = iscsi_itt_to_task(session, conn, tmfabort_hdr->rtt);
 		if (!ctask || !ctask->sc)
 			/*

index 6c80e5b514fd..c868eada72c3 100644
@@ -1154,6 +1154,7 @@ static void bnx2i_cpy_scsi_cdb(struct scsi_cmnd *sc, struct bnx2i_cmd *cmd)
 }
 
 static void bnx2i_cleanup_task(struct iscsi_task *task)
+	__must_hold(&task->conn->session->back_lock)
 {
 	struct iscsi_conn *conn = task->conn;
 	struct bnx2i_conn *bnx2i_conn = conn->dd_data;

index 9f021a7f78bd..7fddb98e1024 100644
@@ -630,7 +630,7 @@ csio_vport_delete(struct fc_vport *fc_vport)
 	/* Quiesce ios and send remove event to lnode */
 	scsi_block_requests(shost);
 	spin_lock_irq(&hw->lock);
-	csio_scsim_cleanup_io_lnode(csio_hw_to_scsim(hw), ln);
+	csio_scsim_cleanup_io_lnode(hw, ln);
 	csio_lnode_close(ln);
 	spin_unlock_irq(&hw->lock);
 	scsi_unblock_requests(shost);

@@ -655,7 +655,7 @@ csio_vport_disable(struct fc_vport *fc_vport, bool disable)
 		/* Quiesce ios and send stop event to lnode */
 		scsi_block_requests(shost);
 		spin_lock_irq(&hw->lock);
-		csio_scsim_cleanup_io_lnode(csio_hw_to_scsim(hw), ln);
+		csio_scsim_cleanup_io_lnode(hw, ln);
 		csio_lnode_stop(ln);
 		spin_unlock_irq(&hw->lock);
 		scsi_unblock_requests(shost);

index df9f81f29950..d8ed326dc602 100644
@@ -92,7 +92,8 @@ static void csio_hw_mbm_cleanup(struct csio_hw *);
 static void csio_hws_uninit(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_configuring(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_initializing(struct csio_hw *, enum csio_hw_ev);
-static void csio_hws_ready(struct csio_hw *, enum csio_hw_ev);
+static void csio_hws_ready(struct csio_hw *, enum csio_hw_ev)
+	__must_hold(&hw->lock);
 static void csio_hws_quiescing(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_quiesced(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_resetting(struct csio_hw *, enum csio_hw_ev);

@@ -2879,6 +2880,7 @@ csio_hws_initializing(struct csio_hw *hw, enum csio_hw_ev evt)
  */
 static void
 csio_hws_ready(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	/* Remember the event */
 	hw->evtflag = evt;

@@ -2897,9 +2899,9 @@ csio_hws_ready(struct csio_hw *hw, enum csio_hw_ev evt)
 		/* cleanup all outstanding cmds */
 		if (evt == CSIO_HWE_HBA_RESET ||
 		    evt == CSIO_HWE_PCIERR_DETECTED)
-			csio_scsim_cleanup_io(csio_hw_to_scsim(hw), false);
+			csio_scsim_cleanup_io(hw, false);
 		else
-			csio_scsim_cleanup_io(csio_hw_to_scsim(hw), true);
+			csio_scsim_cleanup_io(hw, true);
 
 		csio_hw_intr_disable(hw);
 		csio_hw_mbm_cleanup(hw);

index 713e13adf4dc..46d82802a5d4 100644
@@ -586,8 +586,7 @@ __csio_unreg_rnode(struct csio_rnode *rn)
 
 	/* Cleanup I/Os that were waiting for rnode to unregister */
 	if (cmpl)
-		csio_scsi_cleanup_io_q(csio_hw_to_scsim(hw), &tmp_q);
-
+		csio_scsi_cleanup_io_q(hw, &tmp_q);
 }
 
 /*****************************************************************************/

index 0114e70e9884..b1473e1f514f 100644
@@ -1150,15 +1150,14 @@ csio_scsi_cmpl_handler(struct csio_hw *hw, void *wr, uint32_t len,
 
 /*
  * csio_scsi_cleanup_io_q - Cleanup the given queue.
- * @scm: SCSI module.
+ * @hw: HW module.
  * @q: Queue to be cleaned up.
  *
  * Called with lock held. Has to exit with lock held.
  */
-void
-csio_scsi_cleanup_io_q(struct csio_scsim *scm, struct list_head *q)
+void csio_scsi_cleanup_io_q(struct csio_hw *hw, struct list_head *q)
 {
-	struct csio_hw *hw = scm->hw;
+	struct csio_scsim *scm = csio_hw_to_scsim(hw);
 	struct csio_ioreq *ioreq;
 	struct list_head *tmp, *next;
 	struct scsi_cmnd *scmnd;

@@ -1215,7 +1214,7 @@ csio_abrt_cls(struct csio_ioreq *ioreq, struct scsi_cmnd *scmnd)
 
 /*
  * csio_scsi_abort_io_q - Abort all I/Os on given queue
- * @scm: SCSI module.
+ * @hw: HW module.
  * @q: Queue to abort.
  * @tmo: Timeout in ms
  *

@@ -1229,10 +1228,9 @@ csio_abrt_cls(struct csio_ioreq *ioreq, struct scsi_cmnd *scmnd)
  * of this function has to ensure that the number of I/os to be aborted
  * is finite enough to not cause lock-held-for-too-long issues.
  */
-static int
-csio_scsi_abort_io_q(struct csio_scsim *scm, struct list_head *q, uint32_t tmo)
+static int csio_scsi_abort_io_q(struct csio_hw *hw, struct list_head *q,
+				uint32_t tmo)
 {
-	struct csio_hw *hw = scm->hw;
 	struct list_head *tmp, *next;
 	int count = DIV_ROUND_UP(tmo, CSIO_SCSI_ABORT_Q_POLL_MS);
 	struct scsi_cmnd *scmnd;

@@ -1264,15 +1262,14 @@ csio_scsi_abort_io_q(struct csio_scsim *scm, struct list_head *q, uint32_t tmo)
 
 /*
  * csio_scsim_cleanup_io - Cleanup all I/Os in SCSI module.
- * @scm: SCSI module.
+ * @hw: HW module.
  * @abort: abort required.
  * Called with lock held, should exit with lock held.
  * Can sleep when waiting for I/Os to complete.
  */
-int
-csio_scsim_cleanup_io(struct csio_scsim *scm, bool abort)
+int csio_scsim_cleanup_io(struct csio_hw *hw, bool abort)
 {
-	struct csio_hw *hw = scm->hw;
+	struct csio_scsim *scm = csio_hw_to_scsim(hw);
 	int rv = 0;
 	int count = DIV_ROUND_UP(60 * 1000, CSIO_SCSI_ABORT_Q_POLL_MS);
 

@@ -1293,13 +1290,13 @@ csio_scsim_cleanup_io(struct csio_scsim *scm, bool abort)
 
 	/* Else abort */
 	if (abort) {
-		rv = csio_scsi_abort_io_q(scm, &scm->active_q, 30000);
+		rv = csio_scsi_abort_io_q(hw, &scm->active_q, 30000);
 		if (rv == 0)
 			return rv;
 		csio_dbg(hw, "Some I/O aborts timed out, cleaning up..\n");
 	}
 
-	csio_scsi_cleanup_io_q(scm, &scm->active_q);
+	csio_scsi_cleanup_io_q(hw, &scm->active_q);
 
 	CSIO_DB_ASSERT(list_empty(&scm->active_q));
 

@@ -1308,16 +1305,15 @@ csio_scsim_cleanup_io(struct csio_scsim *scm, bool abort)
 
 /*
  * csio_scsim_cleanup_io_lnode - Cleanup all I/Os of given lnode.
- * @scm: SCSI module.
+ * @hw: HW module
  * @lnode: lnode
  *
  * Called with lock held, should exit with lock held.
  * Can sleep (with dropped lock) when waiting for I/Os to complete.
  */
-int
-csio_scsim_cleanup_io_lnode(struct csio_scsim *scm, struct csio_lnode *ln)
+int csio_scsim_cleanup_io_lnode(struct csio_hw *hw, struct csio_lnode *ln)
 {
-	struct csio_hw *hw = scm->hw;
+	struct csio_scsim *scm = csio_hw_to_scsim(hw);
 	struct csio_scsi_level_data sld;
 	int rv;
 	int count = DIV_ROUND_UP(60 * 1000, CSIO_SCSI_ABORT_Q_POLL_MS);

@@ -1347,10 +1343,10 @@ csio_scsim_cleanup_io_lnode(struct csio_scsim *scm, struct csio_lnode *ln)
 	csio_dbg(hw, "Some I/Os pending on ln:%p, aborting them..\n", ln);
 
 	/* I/Os are pending, abort them */
-	rv = csio_scsi_abort_io_q(scm, &ln->cmpl_q, 30000);
+	rv = csio_scsi_abort_io_q(hw, &ln->cmpl_q, 30000);
 	if (rv != 0) {
 		csio_dbg(hw, "Some I/O aborts timed out, cleaning up..\n");
-		csio_scsi_cleanup_io_q(scm, &ln->cmpl_q);
+		csio_scsi_cleanup_io_q(hw, &ln->cmpl_q);
 	}
 
 	CSIO_DB_ASSERT(list_empty(&ln->cmpl_q));

@@ -2194,7 +2190,7 @@ csio_eh_lun_reset_handler(struct scsi_cmnd *cmnd)
 	spin_lock_irq(&hw->lock);
 	csio_scsi_gather_active_ios(scsim, &sld, &local_q);
 
-	retval = csio_scsi_abort_io_q(scsim, &local_q, 30000);
+	retval = csio_scsi_abort_io_q(hw, &local_q, 30000);
 	spin_unlock_irq(&hw->lock);
 
 	/* Aborts may have timed out */

index 39dda3c88f0d..610aae12be8a 100644
@@ -338,10 +338,9 @@ csio_scsi_close(struct csio_ioreq *ioreq)
 	return ioreq->drv_status;
 }
 
-void csio_scsi_cleanup_io_q(struct csio_scsim *, struct list_head *);
-int csio_scsim_cleanup_io(struct csio_scsim *, bool abort);
-int csio_scsim_cleanup_io_lnode(struct csio_scsim *,
-					  struct csio_lnode *);
+void csio_scsi_cleanup_io_q(struct csio_hw *, struct list_head *);
+int csio_scsim_cleanup_io(struct csio_hw *, bool abort);
+int csio_scsim_cleanup_io_lnode(struct csio_hw *, struct csio_lnode *);
 struct csio_ioreq *csio_scsi_cmpl_handler(struct csio_hw *, void *, uint32_t,
 					  struct csio_fl_dma_buf *,
 					  void *, uint8_t **);

index d8ed326dc602..b5a36615a22b 100644
@@ -92,7 +92,7 @@ static void csio_hw_mbm_cleanup(struct csio_hw *);
 static void csio_hws_uninit(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_configuring(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_initializing(struct csio_hw *, enum csio_hw_ev);
-static void csio_hws_ready(struct csio_hw *, enum csio_hw_ev)
+static void csio_hws_ready(struct csio_hw *hw, enum csio_hw_ev)
 	__must_hold(&hw->lock);
 static void csio_hws_quiescing(struct csio_hw *, enum csio_hw_ev);
 static void csio_hws_quiesced(struct csio_hw *, enum csio_hw_ev);

@@ -915,6 +915,7 @@ csio_hw_dev_ready(struct csio_hw *hw)
  */
 static int
 csio_do_hello(struct csio_hw *hw, enum csio_dev_state *state)
+	__must_hold(&hw->lock)
 {
 	struct csio_mb	*mbp;
 	int	rv = 0;

@@ -2051,6 +2052,7 @@ csio_hw_flash_config(struct csio_hw *hw, u32 *fw_cfg_param, char *path)
  */
 static int
 csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
+	__must_hold(&hw->lock)
 {
 	struct csio_mb	*mbp = NULL;
 	struct fw_caps_config_cmd *caps_cmd;

@@ -2476,6 +2478,7 @@ static int csio_hw_check_fwver(struct csio_hw *hw)
  */
 static void
 csio_hw_configure(struct csio_hw *hw)
+	__must_hold(&hw->lock)
 {
 	int reset = 1;
 	int rv;

@@ -2605,6 +2608,7 @@ csio_hw_configure(struct csio_hw *hw)
  */
 static void
 csio_hw_initialize(struct csio_hw *hw)
+	__must_hold(&hw->lock)
 {
 	struct csio_mb	*mbp;
 	enum fw_retval retval;

@@ -2779,6 +2783,7 @@ csio_hw_fatal_err(struct csio_hw *hw)
  */
 static void
 csio_hws_uninit(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	hw->prev_evt = hw->cur_evt;
 	hw->cur_evt = evt;

@@ -2804,6 +2809,7 @@ csio_hws_uninit(struct csio_hw *hw, enum csio_hw_ev evt)
  */
 static void
 csio_hws_configuring(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	hw->prev_evt = hw->cur_evt;
 	hw->cur_evt = evt;

@@ -2990,6 +2996,7 @@ csio_hws_quiescing(struct csio_hw *hw, enum csio_hw_ev evt)
  */
 static void
 csio_hws_quiesced(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	hw->prev_evt = hw->cur_evt;
 	hw->cur_evt = evt;

@@ -3015,6 +3022,7 @@ csio_hws_quiesced(struct csio_hw *hw, enum csio_hw_ev evt)
  */
 static void
 csio_hws_resetting(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	hw->prev_evt = hw->cur_evt;
 	hw->cur_evt = evt;

@@ -3076,6 +3084,7 @@ csio_hws_removing(struct csio_hw *hw, enum csio_hw_ev evt)
  */
 static void
 csio_hws_pcierr(struct csio_hw *hw, enum csio_hw_ev evt)
+	__must_hold(&hw->lock)
 {
 	hw->prev_evt = hw->cur_evt;
 	hw->cur_evt = evt;

@@ -3765,6 +3774,7 @@ csio_hw_mb_timer(struct timer_list *t)
  */
 static void
 csio_hw_mbm_cleanup(struct csio_hw *hw)
+	__must_hold(&hw->lock)
 {
 	LIST_HEAD(cbfn_q);
 

@@ -3885,6 +3895,7 @@ csio_free_evt(struct csio_hw *hw, struct csio_evt_msg *evt_entry)
 
 void
 csio_evtq_flush(struct csio_hw *hw)
+	__must_hold(&hw->lock)
 {
 	uint32_t count;
 	count = 30;

@@ -4144,6 +4155,7 @@ csio_mgmt_tmo_handler(struct timer_list *t)
 
 static void
 csio_mgmtm_cleanup(struct csio_mgmtm *mgmtm)
+	__must_hold(&mgmtm->hw->lock)
 {
 	struct csio_hw *hw = mgmtm->hw;
 	struct csio_ioreq *io_req;

index 78d5ecd14f65..161973957976 100644
@@ -872,6 +872,7 @@ csio_ln_read_fcf_entry(struct csio_lnode *ln,
 static void
 csio_handle_link_up(struct csio_hw *hw, uint8_t portid, uint32_t fcfi,
 		    uint32_t vnpi)
+	__must_hold(&hw->lock)
 {
 	struct csio_lnode *ln = NULL;
 

@@ -1165,6 +1166,7 @@ csio_lns_uninit(struct csio_lnode *ln, enum csio_ln_ev evt)
  */
 static void
 csio_lns_online(struct csio_lnode *ln, enum csio_ln_ev evt)
+	__must_hold(&csio_lnode_to_hw(ln)->lock)
 {
 	struct csio_hw *hw = csio_lnode_to_hw(ln);