17 Sep, 2011

3 commits

  • This patch fixes a bug in the iscsit_fe_sendpage_sg() transmit codepath that
    was originally introduced with the v3.1 iscsi-target merge that incorrectly
    uses hardcoded cmd->iov_data_count values to determine cmd->iov_data[] offsets
    for extra outgoing padding and DataDigest payload vectors.

    This code is obviously incorrect for the DataDigest enabled case with sendpage
    offload, and this fix ensures correct operation for padding + DataDigest,
    padding only, and DataDigest only cases. The bug was introduced during a
    pre-merge change in iscsit_fe_sendpage_sg() to natively use struct scatterlist
    instead of the legacy v3.0 struct se_mem logic.

    Cc: Andy Grover
    Cc: Christoph Hellwig
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch makes iscsi-target explictly disable OFMarker=Yes and IFMarker=yes
    parameter key usage during iscsi login by setting IFMarkInt_Reject and
    OFMarkInt_Reject values in iscsi_enforce_integrity_rules() to effectively
    disable iscsi marker usage. With this patch, an initiator proposer asking
    to enable either marker parameter keys will be issued a 'No' response, and
    the target sets OFMarkInt + IFMarkInt parameter key response to 'Irrelevant'.

    With markers disabled during iscsi login, this patch removes the problematic
    on-stack local-scope array for marker intervals in iscsit_do_rx_data() +
    iscsit_do_tx_data(), and other related marker code in iscsi_target_util.c.
    This fixes a potentional stack smashing scenario with small range markers
    enabled and a large MRDSL as reported by DanC here:

    [bug report] target: stack can be smashed
    http://www.spinics.net/lists/target-devel/msg00453.html

    Reported-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds target_parse_naa_6h_vendor_specific() to address a bug where the
    conversion of PRODUCT SERIAL NUMBER to use hex2bin() in target_emulate_evpd_83()
    was not doing proper isxdigit() checking. This conversion of the vpd_unit_serial
    configifs attribute is done while generating a VPD=0x83 NAA IEEE Registered
    Extended DESIGNATOR format's 100 bits of unique VENDOR SPECIFIC IDENTIFIER +
    VENDOR SPECIFIC IDENTIFIER EXTENSION area.

    This patch allows vpd_unit_serial (VPD=0x80) and the T10 Vendor ID DESIGNATOR
    format (VPD=0x83) to continue to use free-form variable length ASCII values,
    and now skips any non hex characters for fixed length NAA IEEE Registered Extended
    DESIGNATOR format (VPD=0x83) requring the binary conversion.

    This was originally reported by Martin after the v3.1-rc1 change to use hex2bin()
    in commit 11650b859681e03fdbf26277fcfc5f1f62186703 where the use of non hex
    characters in vpd_unit_serial generated different values than the original
    v3.0 internal hex -> binary code. This v3.1 change caused a problem with
    filesystems who write a NAA DESIGNATOR onto it's ondisk metadata, and this patch
    will (again) change existing values to ensure that non hex characters are not
    included in the fixed length NAA DESIGNATOR.

    Note this patch still expects vpd_unit_serial to be set via existing userspace
    methods of uuid generation, and does not do strict formatting via configfs input.

    The original bug report and thread can be found here:

    NAA breakage
    http://www.spinics.net/lists/target-devel/msg00477.html

    The v3.1-rc1 formatting of VPD=0x83 w/o this patch:

    VPD INQUIRY: Device Identification page
    Designation descriptor number 1, descriptor length: 20
    designator_type: NAA, code_set: Binary
    associated with the addressed logical unit
    NAA 6, IEEE Company_id: 0x1405
    Vendor Specific Identifier: 0xffde35ebf
    Vendor Specific Identifier Extension: 0x3092f498ffa820f9
    [0x6001405ffde35ebf3092f498ffa820f9]
    Designation descriptor number 2, descriptor length: 56
    designator_type: T10 vendor identification, code_set: ASCII
    associated with the addressed logical unit
    vendor id: LIO-ORG
    vendor specific: IBLOCK:ffde35ec-3092-4980-a820-917636ca54f1

    The v3.1-final formatting of VPD=0x83 w/ this patch:

    VPD INQUIRY: Device Identification page
    Designation descriptor number 1, descriptor length: 20
    designator_type: NAA, code_set: Binary
    associated with the addressed logical unit
    NAA 6, IEEE Company_id: 0x1405
    Vendor Specific Identifier: 0xffde35ec3
    Vendor Specific Identifier Extension: 0x924980a82091763
    [0x6001405ffde35ec30924980a82091763]
    Designation descriptor number 2, descriptor length: 56
    designator_type: T10 vendor identification, code_set: ASCII
    associated with the addressed logical unit
    vendor id: LIO-ORG
    vendor specific: IBLOCK:ffde35ec-3092-4980-a820-917636ca54f1

    (v2: Fix parsing code to dereference + check for string terminator instead
    of null pointer to ensure a zeroed payload for vpd_unit_serial less
    than 100 bits of NAA DESIGNATOR VENDOR SPECIFIC area. Also, remove
    the unnecessary bitwise assignment)

    Reported-by: Martin Svec
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

16 Sep, 2011

3 commits

  • Problem: Changed from wake_up_interruptible -> wake_up_process and
    wait_event_interruptible-> schedule_timeout_interruptible broke the FCoE
    target. Earlier approach of wake_up_interruptible was also looking at
    'queue_cnt' which is not necessary, because it increment of 'queue_cnt'
    with wake_up_inetrriptible / waker_up_process introduces race condition.

    Fix: Instead of fixing the code which used wake_up_process and remove
    'queue_cnt', using work_queue based approach is cleaner and acheives
    same result. As well, work queue based approach has less programming
    overhead and OS manages threads which processes work queues.

    This patch is developed by Christoph Hellwig and reviwed+validated by
    Kiran Patil.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Kiran Patil
    Signed-off-by: Nicholas Bellinger

    Christoph Hellwig
     
  • Problem: HW DDP context wasn;t invalidated in case of ABORTS, etc...
    This leads to the problem where memory pages which are used for DDP
    as user descriptor could get reused for some other purpose (such as to
    satisfy new memory allocation request either by kernel or user mode threads)
    and since HW DDP context was not invalidated, HW continue to write to
    those pages, hence causing memory corruption.

    Fix: Either on incoming ABORTS or due to exchange time out, allowed the
    target to cleanup HW DDP context if it was setup for respective ft_cmd.
    Added new function to perform this cleanup, furthur it can be enhanced
    for other cleanup activity.

    Additinal Notes: To avoid calling ddp_done from multiple places, composed
    the functionality in helper function "ft_invl_hw_context" and it is being
    called from multiple places. Cleaned up code in function "ft_recv_write_data"
    w.r.t DDP.

    Signed-off-by: Kiran Patil
    Signed-off-by: Nicholas Bellinger

    Kiran Patil
     
  • When work is scheduled with schedule_work(), the work can end up
    running on multiple CPUs at the same time -- this happens if
    the work is already running on one CPU and schedule_work() is called
    on another CPU. This leads to list corruption with target_qf_do_work(),
    which is roughly doing:

    spin_lock(...);
    list_for_each_entry_safe(...) {
    list_del(...);
    spin_unlock(...);

    // do stuff

    spin_lock(...);
    }

    With multiple CPUs running this code, one CPU can end up deleting the
    list entry that the other CPU is about to work on.

    Fix this by splicing the list entries onto a local list and then
    operating on that in the work function. This way, each invocation of
    target_qf_do_work() operates on its own local list and so multiple
    invocations don't corrupt each other's list. This also avoids dropping
    and reacquiring the lock for each list entry.

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     

23 Aug, 2011

20 commits

  • With qla2xxx, acl_node_lock is taken inside qla2xxx's hardware_lock,
    which is taken in hardirq context. This means acl_node_lock must become
    an IRQ-disabling lock; in particular this fixes lockdep warnings along
    the lines of

    ======================================================
    [ INFO: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected ]

    (&(&se_tpg->acl_node_lock)->rlock){+.....}, at: [] transport_deregister_session+0x92/0x140 [target_core_mod]

    and this task is already holding:
    (&(&ha->hardware_lock)->rlock){-.-...}, at: [] qla_tgt_stop_phase1+0x57/0x2c0 [qla2xxx]
    which would create a new lock dependency:
    (&(&ha->hardware_lock)->rlock){-.-...} -> (&(&se_tpg->acl_node_lock)->rlock){+.....}

    but this new dependency connects a HARDIRQ-irq-safe lock:
    (&(&ha->hardware_lock)->rlock){-.-...}

    to a HARDIRQ-irq-unsafe lock:
    (&(&se_tpg->acl_node_lock)->rlock){+.....}

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • At least the tcm_qla2xxx fabric driver calls into transport_deregister_session()
    while holding an IRQ-disabled spinlock, so the inner locking needs to
    use spin_lock_irqsave() instead of spin_lock_bh().

    This fixes warnings seen with tcm_qla2xxx like:

    WARNING: at kernel/softirq.c:159 local_bh_enable_ip+0x98/0xb0()
    Call Trace:
    [] warn_slowpath_common+0x7f/0xc0
    [] warn_slowpath_null+0x1a/0x20
    [] local_bh_enable_ip+0x98/0xb0
    [] _raw_spin_unlock_bh+0x14/0x20
    [] transport_deregister_session+0x96/0x180 [target_core_mod]
    [] tcm_qla2xxx_free_session+0xd1/0x170 [tcm_qla2xxx]
    [] qla_tgt_sess_put+0xc3/0x140 [qla2xxx]
    [] qla_tgt_stop_phase1+0x8f/0x2c0 [qla2xxx]
    [] tcm_qla2xxx_tpg_store_enable+0x6e/0xd0 [tcm_qla2xxx]
    [] target_fabric_tpg_attr_store+0x39/0x40 [target_core_mod]
    [] configfs_write_file+0xbd/0x120 [configfs]
    [] vfs_write+0xc6/0x180
    [] sys_write+0x51/0x90
    [] system_call_fastpath+0x16/0x1b

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • There's no need for the #ifdef protection when building into the kernel,
    and in fact we need the module_init() for the initialization function to
    be called.

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • Make a log message more useful by printing both the page and subpage
    that an initiator is requesting.

    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger

    Roland Dreier
     
  • This patch fixes two bugs in allocation failure handling in
    iscsit_allocate_se_cmd_for_tmr():

    This first reported by DanC is a free-after call to transport_free_se_cmd(), this
    patch drops the transport_free_se_cmd() call all together, as iscsit_release_cmd()
    will release existing allocations as expected.

    The second is a bug where iscsi_cmd_t was being leaked on a cmd->tmr_req allocation
    failure, so make this jump to iscsit_release_cmd() as well.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • The iSCSI target configfs code to print out an initiator's IPv6 address
    is not fully implemented. This patch uses snprintf() with the "%pI6c"
    format string to format the IPv6 address for display purposes.

    Signed-off-by: Chris Boot
    Signed-off-by: Nicholas Bellinger

    Chris Boot
     
  • This patch fixes two bugs associated with transport_do_task_sg_chain()
    operation where transport_allocate_data_tasks() was incorrectly setting
    task_padded_sg for all tasks, and causing bogus task->task_sg_nents
    assignments + OOPsen with fabrics depending upon this code. The first bit
    here adds a task_sg_nents_padded check in transport_allocate_data_tasks()
    to include an extra SGL vector when necessary for tasks that expect to
    be linked using sg_chain().

    The second change involves making transport_do_task_sg_chain() properly
    account for the extra SGL vector when task->task_padded_sg is set for
    the non trailing ->task_sg or single ->task_sg allocations. Note this
    patch also removes the BUG_ON(!task->task_padded_sg) check within
    transport_do_task_sg_chain() as we expect this to happen normally
    with the updated logic in transport_allocate_data_tasks(), along with
    being bogus for CONTROL_SG_IO_CDB type payloads.

    So far this bugfix has been tested with tcm_qla2xxx and iblock backends
    in (task_count > 1)( and (task_count == 1) operation.

    Reported-by: Kiran Patil
    Cc: Kiran Patil
    Cc: Andy Grover
    Cc: Christoph Hellwig
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch addresses recent breakage with multiple se_task (task_count > 1)
    operation following backend dev->se_sub_dev->se_dev_attrib.max_sectors in new
    transport_allocate_data_tasks() code. The initial bug here was a bogus
    task->task_sg_nents assignment in transport_allocate_data_tasks() based on
    the passed parameter, which now uses DIV_ROUND_UP(task_size, PAGE_SIZE) to
    determine the proper number of per task SGL entries for the (task_count > 1)
    case.

    This also means we now need to enforce a PAGE_SIZE aligned max_sector count
    value for this to work as expected without bringing back the pre v3.1
    transport_map_mem_to_sg() logic to handle SGL offsets across multiple tasks.
    So this patch adds se_dev_align_max_sectors() to round down max_sectors as
    necessary to ensure this alignment via se_dev_set_default_attribs() and
    se_dev_align_max_sectors() and keeps it simple for (task_count > 1)
    operation.

    So far this bugfix has been tested with (task_count > 1) operation
    using iscsi-target and iblock backends.

    Reported-by: Chris Boot
    Cc: Kiran Patil
    Cc: Andy Grover
    Cc: Christoph Hellwig
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds the missing transport_cmd_get_valid_sectors() check for
    SCF_SCSI_DATA_SG_IO_CDB type payloads to ensure that a received LBA + range
    does not exeed past the end of associated backend struct se_device.

    This patch also fixes a bug in the failure path of transport_new_cmd_obj()
    where this check can fail, so change to use a signed 'rc' and return '-EINVAL'
    to signal proper transport_generic_request_failure() handling.

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes a SYNCHRONIZE_CACHE CDB handling bug with IBLOCK/FILEIO
    backends where transport_cmd_get_valid_sectors() was incorrectly rejecting
    a zero LBA + range CDB from being processed, and returning CHECK_CONDITION.

    This includes changing transport_cmd_get_valid_sectors() to return '0' on
    success and '-EINVAL' on failure (this makes more sense than sectors),
    and to only check transport_cmd_get_valid_sectors() when a non zero LBA +
    range SYNCHRONIZE_CACHE operation has been receieved for the non passthrough
    case.

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch removes a duplicate set of transport_complete_task() calls in
    target_emulate_unmap() and target_emulate_write_same() as the completion
    call is already done within transport_emulate_control_cdb()

    This patch also adds a check in transport_emulate_control_cdb() for the
    existing SCF_EMULATE_CDB_ASYNC flag currently used by SYNCHRONIZE_CACHE
    in order to handle IMMEDIATE processing.

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • For all flavours of WRITE_SAME, we only expect to handle a single block
    of data-out buffer payload, regardless of the number of logical blocks
    presented in the CDB. This patch changes all flavours of WRITE_SAME in
    transport_generic_cmd_sequencer() to pass '1' into transport_get_size()
    instead of the extracted 'sectors' to properly handle the default usage
    of sg_write_same without the --xferlen parameter.

    Reported-by: Eric Seppanen
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch adds initial WRITE_SAME (10) w/ UNMAP=1 support following updates in
    sbcr26 to allow UNMAP=1 for the non 16 + 32 byte CDB case. It also refactors
    current pSCSI passthrough passthrough checks into target_check_write_same_discard()
    ahead of UNMAP=0 w/ write payload support into target_core_iblock.c.

    This includes the support for handling WRITE_SAME in transport_emulate_control_cdb(),
    and converts target_emulate_write_same to accept num_blocks directly for
    WRITE_SAME, WRITE_SAME_16 and WRITE_SAME_32.

    Reported-by: Eric Seppanen
    Cc: Roland Dreier
    Cc: Christoph Hellwig
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes a bug for fabrics using tfo->new_cmd_map() that
    are expect transport_generic_request_failure() to be calling
    transport_send_check_condition_and_sense() for both READ and WRITE,
    instead of only for READ exceptions.

    This was originally observed with a failed WRITE_SAME_16 w/ unmap=0
    using tcm_loop.

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes a forever loop bug in iscsit_attach_ooo_cmdsn()
    while walking sess->sess_ooo_cmdsn_list when the received
    CmdSN is less than the tail of the list.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • We returned on the line before already.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • Use BUG_ON(x) rather than if(x) BUG();

    The semantic patch that fixes this problem is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@ identifier x; @@
    -if (x) BUG();
    +BUG_ON(x);

    @@ identifier x; @@
    -if (!x) BUG();
    +BUG_ON(!x);
    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Nicholas Bellinger

    Julia Lawall
     
  • We leak memory if the allocations for 'new_param->name' or
    'new_param->value' fail in iscsi_target_parameters.c::iscsi_copy_param_list()

    We also do a lot of variable assignments that are completely pointless
    if the allocations fail.

    So, let's move the allocations before the assignments and also make
    sure that we free whatever was allocated to one if the allocation fail.

    There's also some small CodingStyle fixups in there (curly braces on
    both branches of if statement, only one variable per line) since I was
    in the area anyway. And finally, error messages in the function are
    put on a single line for easy grep'abillity.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Nicholas Bellinger

    Jesper Juhl
     
  • Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...))

    The semantic patch that makes this output is available
    in scripts/coccinelle/api/err_cast.cocci.

    More information about semantic patching is available at
    http://coccinelle.lip6.fr/

    Signed-off-by: Thomas Meyer
    Signed-off-by: Nicholas Bellinger

    Thomas Meyer
     
  • This patch changes target_emulate_inquiry_std() to set the 'not connected'
    (0x35) bit in standard INQUIRY response data when we are processing a
    request to a virtual LUN=0 mapping from struct se_device *g_lun0_dev that
    have been setup for us in transport_lookup_cmd_lun().

    This addresses an issue where qla2xxx FC clients need to be able
    to create demo-mode I_T FC Nexuses by default, but should not be
    exposing the default set of TPG LUNs to all FC clients. This includes
    adding an new optional target_core_fabric_ops->tpg_check_demo_mode_login_only()
    caller to allow demo_mode nexuses to skip the old default of bulding
    a demo-mode MappedLUNs list via core_tpg_add_node_to_devs().

    (roland: Add missing tpg_check_demo_mode_login_only check in core_dev_add_lun)

    Reported-by: Roland Dreier
    Cc: Andrew Vasquez
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

17 Aug, 2011

1 commit


04 Aug, 2011

1 commit

  • * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    tcm_fc: Handle DDP/SW fc_frame_payload_get failures in ft_recv_write_data
    target: Fix bug for transport_generic_wait_for_tasks with direct operation
    target: iscsi_target depends on NET
    target: Fix WRITE_SAME_16 lba assignment breakage
    MAINTAINERS: Add target-devel list for drivers/target/
    iscsi-target: Fix CONFIG_SMP=n and CONFIG_MODULES=n build failure
    iscsi-target: Fix snprintf usage with MAX_PORTAL_LEN
    iscsi-target: Fix uninitialized usage of cmd->pad_bytes
    iscsi-target: strlen() doesn't count the terminator
    iscsi-target: Fix NULL dereference on allocation failure

    Linus Torvalds
     

03 Aug, 2011

1 commit

  • Problem: HW DDP context was not invalidated in case of ABORTS, etc...
    This leads to the problem where memory pages which are used for DDP
    as user descriptor could get reused for some other purpose (such as to
    satisfy new memory allocation request either by kernel or user mode threads)
    and since HW DDP context was not invalidated, HW continue to write to
    those pages, hence causing memory corruption.

    Fix: Either on incoming ABORTS or due to exchange time out, allowed the
    target to cleanup HW DDP context if it was setup for respective ft_cmd.
    Added new function to perform this cleanup, furthur it can be enhanced
    for other cleanup activity. Fix ft_recv_write_data() to properly handle
    fc_frame_payload_get to return pointer to payload if it exist. If there is
    no payload which is most common case (+ve case in case if DDP is working
    as expected, it will return NULL. Yes, scope of buf is limited to printk.
    Invalidation of HW context (which is done inside ft_invl_hw_context() is
    necessary in SUCCESS and FAILURE case of DDP. Hence invalidation is DONE
    as long as there was DDP setup (whether it worked correctly or not,

    NOTE: For some reason, if there is any error w.r.t DDP such as out of
    order packet reception, HW simply post the full packet in rx queue.

    Signed-off-by: Kiran Patil
    Cc: Robert W Love
    Signed-off-by: Nicholas A. Bellinger

    Kiran Patil
     

30 Jul, 2011

1 commit

  • This patch fixes a bug in transport_handle_cdb_direct() usage with target_core
    where transport_generic_wait_for_tasks() was bypassing active I/O + usage of
    cmd->t_transport_stop_comp because cmd->t_transport_active=1 was not being set
    before dispatching with transport_generic_new_cmd(). The fix follows existing
    usage in transport_generic_handle_cdb*() -> transport_add_cmd_to_queue() and
    set these directly, as well as handle transport_generic_new_cmd() exceptions
    for QUEUE_FULL and CHECK_CONDITION instead of propigating up to RX context
    fabric code.

    The bug was manifesting itself with the following SLUB poison overwritten
    warnings with iscsi-target v4.1 LUNs using the new process context direct
    operation during session reinstatement with active I/O exception handling:

    [885410.498267] =============================================================================
    [885410.621622] BUG lio_cmd_cache: Poison overwritten
    [885410.621791] -----------------------------------------------------------------------------
    [885410.621792]
    [885410.623420] INFO: 0xffff880000cf3750-0xffff880000cf378d. First byte 0x6a instead of 0x6b
    [885410.626332] INFO: Allocated in iscsit_allocate_cmd+0x1c/0xd4 [iscsi_target_mod] age=345 cpu=1 pid=22554
    [885411.855189] INFO: Freed in iscsit_release_cmd+0x208/0x217 [iscsi_target_mod] age=1410 cpu=1 pid=22554
    [885411.856048] INFO: Slab 0xffffea000002d480 objects=22 used=0 fp=0xffff880000cf7300 flags=0x4080
    [885411.856368] INFO: Object 0xffff880000cf33c0 @offset=13248 fp=0xffff880000cf6780

    [885411.955678] Pid: 22554, comm: iscsi_trx Not tainted 3.0.0-rc7+ #30
    [885411.956040] Call Trace:
    [885411.957029] [] print_trailer+0x12e/0x137
    [885412.752879] [] check_bytes_and_report+0xb9/0xfd
    [885412.754933] [] check_object+0xb5/0x192
    [885412.755099] [] __free_slab+0x96/0x13a
    [885412.757008] [] discard_slab+0x41/0x43
    [885412.758171] [] __slab_free+0xf3/0xfe
    [885412.761027] [] ? iscsit_release_cmd+0x208/0x217 [iscsi_target_mod]
    [885412.761354] [] kmem_cache_free+0x6f/0xac
    [885412.761536] [] iscsit_release_cmd+0x208/0x217 [iscsi_target_mod]
    [885412.762056] [] ? iblock_free_task+0x34/0x39 [target_core_iblock]
    [885412.762368] [] lio_release_cmd+0x10/0x12 [iscsi_target_mod]
    [885412.764129] [] transport_release_cmd+0x2f/0x33 [target_core_mod]
    [885412.805024] [] transport_generic_remove+0xb6/0xc3 [target_core_mod]
    [885412.806424] [] ? try_to_wake_up+0x1bd/0x1bd
    [885412.809033] [] transport_generic_free_cmd+0x75/0x7d [target_core_mod]
    [885412.810066] [] transport_generic_wait_for_tasks+0x21c/0x22b [target_core_mod]
    [885412.811056] [] ? mutex_lock+0x11/0x32
    [885412.813059] [] ? mutex_lock+0x11/0x32
    [885412.813200] [] iscsit_close_connection+0x1d5/0x63a [iscsi_target_mod]
    [885412.813517] [] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod]
    [885412.813851] [] iscsi_target_rx_thread+0x11f6/0x1221 [iscsi_target_mod]
    [885412.829024] [] ? pick_next_task_fair+0xbe/0x10e
    [885412.831010] [] ? iscsit_handle_scsi_cmd+0x91d/0x91d [iscsi_target_mod]
    [885412.833011] [] ? iscsit_handle_scsi_cmd+0x91d/0x91d [iscsi_target_mod]
    [885412.835010] [] kthread+0x7d/0x85
    [885412.837022] [] kernel_thread_helper+0x4/0x10
    [885412.838008] [] ? kthread_worker_fn+0x145/0x145
    [885412.840047] [] ? gs_change+0x13/0x13
    [885412.842007] FIX lio_cmd_cache: Restoring 0xffff880000cf3750-0xffff880000cf378d=0x6

    Cc: Christoph Hellwig
    Cc: Andy Grover
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     

29 Jul, 2011

1 commit

  • iscsi target code uses lots on network interface functions, so it
    should depend on NET. Fixes many build errors when NET is not enabled:

    ERROR: "kernel_sendmsg" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "in_aton" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "sock_release" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "kernel_listen" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "kernel_setsockopt" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "kernel_recvmsg" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "kernel_accept" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "sock_create" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "kernel_bind" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!
    ERROR: "in6_pton" [drivers/target/iscsi/iscsi_target_mod.ko] undefined!

    Signed-off-by: Randy Dunlap
    Signed-off-by: Nicholas Bellinger

    Randy Dunlap
     

28 Jul, 2011

7 commits

  • This patch fixes a bug in WRITE_SAME_16 LBA assignment where get_unaligned_be16()
    is incorrectly being used instead of get_unaligned_be64() for a 64-bit LBA.

    This was introduced with:

    commit a1d8b49abd60ba5d09e7c968731abcb0f8f1cbf6
    Author: Andy Grover
    Date: Mon May 2 17:12:10 2011 -0700

    target: Updates from AGrover and HCH (round 3)

    (target: inline struct se_transport_task into struct se_cmd)

    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes the following CONFIG_SMP=n and CONFIG_MODULES=n build
    failure, because iscsit_thread_get_cpumask() is defined as a macro in
    iscsi_target.c, but needed by iscsi_target_login.c

    drivers/built-in.o: In function `iscsi_post_login_handler':
    iscsi_target_login.c:(.text+0x13a315): undefined reference to `iscsit_thread_get_cpumask'
    iscsi_target_login.c:(.text+0x13a4b4): undefined reference to `iscsit_thread_get_cpumask'
    make: *** [.tmp_vmlinux1] Error 1

    Reported-by: Randy Dunlap
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch makes lio_target_call_addnptotpg() use sprintf() with
    MAX_PORTAL_LEN + 1 to address the following smatch warning:

    drivers/target/iscsi/iscsi_target_configfs.c +184 lio_target_call_addnptotpg(21)
    error: snprintf() chops off the last chars of 'name': 257 vs 256

    Reported-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes an uninitialized usage of cmd->pad_bytes inside of
    iscsit_handle_text_cmd() introduced during a v4.1 change to use cmd
    members instead of local pad_bytes variables.

    Reported-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Nicholas Bellinger
     
  • This patch fixes an off by one check in iscsit_add_tiqn() because the
    NULL terminator isn't taken into consideration.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • This patch fixes a bug in iscsi_target_init_negotiation() where
    the "goto out" path dereferences "login" which is NULL upon a
    memory allocation failure.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Nicholas Bellinger

    Dan Carpenter
     
  • * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    target: Convert to DIV_ROUND_UP_SECTOR_T usage for sectors / dev_max_sectors
    kernel.h: Add DIV_ROUND_UP_ULL and DIV_ROUND_UP_SECTOR_T macro usage
    iscsi-target: Add iSCSI fabric support for target v4.1
    iscsi: Add Serial Number Arithmetic LT and GT into iscsi_proto.h
    iscsi: Use struct scsi_lun in iscsi structs instead of u8[8]
    iscsi: Resolve iscsi_proto.h naming conflicts with drivers/target/iscsi

    Linus Torvalds
     

26 Jul, 2011

2 commits

  • This patch adds the new macro usage of include/linux/kernel.h:DIV_ROUND_UP_SECTOR_T
    for the new DIV_ROUND_UP_ULL() usage for 32-bit architectures with unsigned long long
    sector_t division in transport_allocate_data_tasks() usage for target_core_mod v4.1

    Reported-by: Andrew Morton
    Signed-off-by: Nicholas A. Bellinger

    Nicholas Bellinger
     
  • The Linux-iSCSI.org target module is a full featured in-kernel
    software implementation of iSCSI target mode (RFC-3720) for the
    current WIP mainline target v4.1 infrastructure code for the v3.1
    kernel. More information can be found here:

    http://linux-iscsi.org/wiki/ISCSI

    This includes support for:

    * RFC-3720 defined request / response state machines and support for
    all defined iSCSI operation codes from Section 10.2.1.2 using libiscsi
    include/scsi/iscsi_proto.h PDU definitions
    * Target v4.1 compatible control plane using the generic layout in
    target_core_fabric_configfs.c and fabric dependent attributes
    within /sys/kernel/config/target/iscsi/ subdirectories.
    * Target v4.1 compatible iSCSI statistics based on RFC-4544 (iSCSI MIBS)
    * Support for IPv6 and IPv4 network portals in M:N mapping to TPGs
    * iSCSI Error Recovery Hierarchy support
    * Per iSCSI connection RX/TX thread pair scheduling affinity
    * crc32c + crc32c_intel SSEv4 instruction offload support using libcrypto
    * CHAP Authentication support using libcrypto
    * Conversion to use internal SGl allocation with iscsit_alloc_buffs() ->
    transport_generic_map_mem_to_cmd()

    (nab: Fix iscsi_proto.h struct scsi_lun usage from linux-next in commit:
    iscsi: Use struct scsi_lun in iscsi structs instead of u8[8])
    (nab: Fix 32-bit compile warnings)

    Reviewed-by: Christoph Hellwig
    Reviewed-by: Andy Grover
    Acked-by: Roland Dreier
    Signed-off-by: Nicholas A. Bellinger

    Nicholas Bellinger