12 Jun, 2014
8 commits
-
In various areas of the code, it is assumed that
se_cmd->data_length describes pure data. In case
that protection information exists over the wire
(protect bits is are on) the target core re-calculates
the data length from the CDB and the backed device
block size (instead of each transport peeking in the cdb).Modify loopback device to include protection information
in the transferred data length (like other scsi transports).Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.15+
Signed-off-by: Nicholas Bellinger -
In case protection information exists over the wire
iscsi header data length is required to include it.
Use protection information aware scsi helpers to set
the correct transfer length.In order to avoid breakage, remove iser transfer length
checks for each task as they are not always true and
somewhat redundant anyway.Signed-off-by: Sagi Grimberg
Reviewed-by: Mike Christie
Acked-by: Mike Christie
Cc: stable@vger.kernel.org # 3.15+
Signed-off-by: Nicholas Bellinger -
In case protection information exists on the wire
scsi transports should include it in the transfer
byte count (even if protection information does not
exist in the host memory space). This helper will
compute the total transfer length from the scsi
command data length and protection attributes.Signed-off-by: Sagi Grimberg
Signed-off-by: Martin K. Petersen
Cc: stable@vger.kernel.org # 3.15+
Signed-off-by: Nicholas Bellinger -
When an initiator sends an allocation length bigger than what its
command consumes, the target should only return the actual response data
and set the residual length to the unused part of the allocation length.Add a helper function that command handlers (INQUIRY, READ CAPACITY,
etc) can use to do this correctly, and use this code to get the correct
residual for commands that don't use the full initiator allocation in the
handlers for READ CAPACITY, READ CAPACITY(16), INQUIRY, MODE SENSE and
REPORT LUNS.This addresses a handful of failures as reported by Christophe with
the Windows Certification Kit:http://permalink.gmane.org/gmane.linux.scsi.target.devel/6515
Signed-off-by: Roland Dreier
Tested-by: Christophe Vu-Brugier
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
This patch extracts LBA + sectors for VERIFY, and adds a goto check_lba
to perform the end-of-device checking.(Update patch to drop lba_check usage - nab)
Signed-off-by: Christophe Vu-Brugier
Signed-off-by: Nicholas Bellinger -
A similar check is performed at the end of sbc_parse_cdb() and is now
enforced if the SYNCHRONIZE CACHE command's backend supports
->execute_sync_cache().(Add check_lba goto to avoid *_max_sectors checks - nab)
Signed-off-by: Christophe Vu-Brugier
Signed-off-by: Nicholas Bellinger -
In case the transport is iser we should not include the
iscsi target info in the sendtargets text response pdu.
This causes sendtargets response to include the target
info twice.Modify iscsit_build_sendtargets_response to filter
transport types that don't match.Signed-off-by: Sagi Grimberg
Reported-by: Slava Shwartsman
Cc: stable@vger.kernel.org # 3.11+
Signed-off-by: Nicholas Bellinger -
In case the discovery session is carried over iser, we can't
access the assumed network portal since the default portal is
used. In this case we don't really need to allocate the fastreg
pool, just prepare to the text pdu that will follow.Signed-off-by: Sagi Grimberg
Reported-by: Alex Tabachnik
Cc: stable@vger.kernel.org # 3.15+
Signed-off-by: Nicholas Bellinger
10 Jun, 2014
3 commits
-
This patch fixes a iscsi_queue_req memory leak when ABORT_TASK response
has been queued by TFO->queue_tm_rsp() -> lio_queue_tm_rsp() after a
long standing I/O completes, but the connection has already reset and
waiting for cleanup to complete in iscsit_release_commands_from_conn()
-> transport_generic_free_cmd() -> transport_wait_for_tasks() code.It moves iscsit_free_queue_reqs_for_conn() after the per-connection command
list has been released, so that the associated se_cmd tag can be completed +
released by target-core before freeing any remaining iscsi_queue_req memory
for the connection generated by lio_queue_tm_rsp().Cc: Thomas Glanzmann
Cc: Charalampos Pournaris
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
This patch fixes a bug where multiple waiters on ->t_transport_stop_comp
occurs due to a concurrent ABORT_TASK and session reset both invoking
transport_wait_for_tasks(), while waiting for the associated se_cmd
descriptor backend processing to complete.For this case, complete_all() should be invoked in order to wake up
both waiters in core_tmr_abort_task() + transport_generic_free_cmd()
process contexts.Cc: Thomas Glanzmann
Cc: Charalampos Pournaris
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
This patch fixes a bug where se_cmd descriptors associated with a
Task Management Request (TMR) where not setting CMD_T_ACTIVE before
being dispatched into target_tmr_work() process context.This is required in order for transport_generic_free_cmd() ->
transport_wait_for_tasks() to wait on se_cmd->t_transport_stop_comp
if a session reset event occurs while an ABORT_TASK is outstanding
waiting for another I/O to complete.Cc: Thomas Glanzmann
Cc: Charalampos Pournaris
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger
07 Jun, 2014
4 commits
-
Convert "x == true" to "x" and "x == false" to "!x".
Signed-off-by: Christophe Vu-Brugier
Signed-off-by: Nicholas Bellinger -
Signed-off-by: Christophe Vu-Brugier
Signed-off-by: Nicholas Bellinger -
This patch changes ft_queue_status() to set SAM_STAT_TASK_SET_FULL
status upon lport->tt.seq_send( failure, and return -EAGAIN to notify
target-core to attempt to requeue the response.It also does the same for a fc_frame_alloc() failures, in order to
signal the initiator that it should try to reduce it's current
queue_depth, to lower the number of outstanding I/Os on the wire.Reported-by: Vasu Dev
Reviewed-by: Vasu Dev
Cc: Jun Wu
Signed-off-by: Nicholas Bellinger -
This patch changes ft_queue_data_in() to set SAM_STAT_TASK_SET_FULL
status upon a lport->tt.seq_send() failure, where it will now stop
sending subsequent DataIN, and immediately attempt to send the
response with exception status.Sending a response with SAM_STAT_TASK_SET_FULL status is useful in
order to signal the initiator that it should try to reduce it's
current queue_depth, to lower the number of outstanding I/Os on
the wire.Also, add a check to skip sending DataIN if TASK_SET_FULL status
has already been set due to a response lport->tt.seq_send()
failure, that has asked target-core to requeue a response.Reported-by: Vasu Dev
Reviewed-by: Vasu Dev
Cc: Jun Wu
Signed-off-by: Nicholas Bellinger
06 Jun, 2014
3 commits
-
This patch adds an explicit check in chap_server_compute_md5() to ensure
the CHAP_C value received from the initiator during mutual authentication
does not match the original CHAP_C provided by the target.This is in line with RFC-3720, section 8.2.1:
Originators MUST NOT reuse the CHAP challenge sent by the Responder
for the other direction of a bidirectional authentication.
Responders MUST check for this condition and close the iSCSI TCP
connection if it occurs.Reported-by: Tejas Vaykole
Cc: stable@vger.kernel.org # 3.1+
Signed-off-by: Nicholas Bellinger -
This patch removes a no-op iscsit_clear_tpg_np_login_threads() call
in iscsit_tpg_del_portal_group(), which is unnecessary because
iscsit_tpg_del_portal_group() can only ever be removed from configfs
once all of the child network portals have been released.Also, go ahed and make iscsit_clear_tpg_np_login_threads() declared
as static.Signed-off-by: Nicholas Bellinger
-
The target is failing to handle list of CHAP_A key-value pair form
initiator.The target is expecting CHAP_A=5 always. In other cases,
where initiator sends list (for example) CHAP_A=6,5 target is failing
the security negotiation. Which is incorrect.This patch handles the case (RFC 3720 section 11.1.4).
where in the initiator may send list of CHAP_A values and target replies
with appropriate CHAP_A value in response(Drop whitespaces + rename to chap_check_algorithm + save original
pointer + add explicit check for CHAP_A key - nab)Signed-off-by: Tejas Vaykole
Signed-off-by: Nicholas Bellinger
04 Jun, 2014
3 commits
-
If the message "Unable to allocate…" pops up, it's useful to know
whether the problem is that the system is genuinely out of memory, or
that some bug has led to a crazy allocation length.In particular this helped debug a corruption of login headers in
iscsi_login_non_zero_tsih_s1().Signed-off-by: Roland Dreier
Signed-off-by: Nicholas Bellinger -
This patch changes iscsi_target_handle_csg_zero() to explicitly
reject login requests in SecurityNegotiation with a zero-length
payload, following the language in RFC-3720 Section 8.2:Whenever an iSCSI target gets a response whose keys, or their
values, are not according to the step definition, it MUST answer
with a Login reject with the "Initiator Error" or "Missing Parameter"
status.Previously when a zero-length login request in CSG=0 was received,
the target would send a login response with CSG=0 + T_BIT=0 asking
the initiator to complete authentication, and not fail the login
until MAX_LOGIN_PDUS was reached. This change will now immediately
fail the login attempt with ISCSI_STATUS_CLS_INITIATOR_ERR status.Reported-by: Tejas Vaykole
Signed-off-by: Nicholas Bellinger -
This patch converts qla2xxx target code to use generic percpu_ida
tag allocation provided by target-core, thus removing the original
kmem_cache_zalloc() for each struct qla_tgt_cmd descriptor in the
incoming ATIO packet fast-path.This includes the conversion of qlt_handle_cmd_for_atio() to perform
qla_tgt_sess lookup before dispatching a command descriptor into
qla_tgt_wq process context, along with handling the case where no
active session exists, and subsequently kicking off a seperate
process context for qlt_create_sess_from_atio() to create a new one.It also includes moving tag allocation into generic code within
qlt_get_tag(), so that the same logic can be shared between
qlt_handle_cmd_for_atio() + qlt_create_sess_from_atio() contexts.
Also, __qlt_do_work() has been made generic between both normal
process context in qlt_do_work() + qlt_create_sess_from_atio().Next, update qlt_free_cmd() to release the percpu-ida tags, and
drop the now-unused global qla_tgt_cmd_cachep.Finally in tcm_qla2xxx code, tcm_qla2xxx_check_initiator_node_acl()
has been updated to use transport_init_session_tags() along with a
hardcoded TCM_QLA2XXX_DEFAULT_TAGS=2088 as the number of qla_tgt_cmd
descriptors to pre-allocate per qla_tgt_sess instance.(Use ha->fw_xcb_count if available to calculate num_tags, and
also factor in extra pad tags - Quinn)Cc: Saurav Kashyap
Cc: Quinn Tran
Cc: Giridhar Malavali
Cc: Chad Dupuis
Cc: Roland Dreier
Cc: Christoph Hellwig
Signed-off-by: Nicholas Bellinger
03 Jun, 2014
6 commits
-
This patch updates virtscsi_probe() to setup necessary Scsi_Host
level protection resources. (currently hardcoded to 1)It changes virtscsi_add_cmd() to attach outgoing / incoming
protection SGLs preceeding the data payload, and is using the
new virtio_scsi_cmd_req_pi->pi_bytes[out,in] field to signal
to signal to vhost/scsi bytes to expect for protection data.(Add missing #include for blk_integrity - sfr + nab)
Acked-by: Paolo Bonzini
Cc: Michael S. Tsirkin
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Cc: Sagi Grimberg
Cc: H. Peter Anvin
Signed-off-by: Nicholas Bellinger -
This patch updates vhost_scsi_handle_vq() to check for the existance
of virtio_scsi_cmd_req_pi comparing vq->iov[0].iov_len in order to
calculate seperate data + protection SGLs from data_num.Also update tcm_vhost_submission_work() to pass the pre-allocated
cmd->tvc_prot_sgl[] memory into target_submit_cmd_map_sgls(), and
update vhost_scsi_get_tag() parameters to accept scsi_tag, lun, and
task_attr.Cc: Michael S. Tsirkin
Cc: Paolo Bonzini
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Cc: Sagi Grimberg
Cc: H. Peter Anvin
Acked-by: Michael S. Tsirkin
Signed-off-by: Nicholas Bellinger -
This patch adds vhost_scsi_map_iov_to_prot() to perform the mapping of
T10 data integrity memory between virtio iov + struct scatterlist using
get_user_pages_fast() following existing code.As with vhost_scsi_map_iov_to_sgl(), this does sanity checks against the
total prot_sgl_count vs. pre-allocated SGLs, and loops across protection
iovs using vhost_scsi_map_to_sgl() to perform the actual memory mapping.Also update tcm_vhost_release_cmd() to release associated tvc_prot_sgl[]
struct page.Cc: Michael S. Tsirkin
Cc: Paolo Bonzini
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Cc: Sagi Grimberg
Cc: H. Peter Anvin
Acked-by: Michael S. Tsirkin
Signed-off-by: Nicholas Bellinger -
This patch updates tcm_vhost_make_nexus() to pre-allocate per descriptor
tcm_vhost_cmd->tvc_prot_sgl[] used to expose protection SGLs from within
virtio-scsi guest memory to vhost-scsi.Cc: Michael S. Tsirkin
Cc: Paolo Bonzini
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Acked-by: Michael S. Tsirkin
Signed-off-by: Nicholas Bellinger -
Move the overflow check for sgl_count > TCM_VHOST_PREALLOC_SGLS into
vhost_scsi_map_iov_to_sgl() so that it's based on the total number
of SGLs for all IOVs, instead of single IOVs.Also, rename TCM_VHOST_PREALLOC_PAGES -> TCM_VHOST_PREALLOC_UPAGES
to better describe pointers to user-space pages.Cc: Michael S. Tsirkin
Cc: Paolo Bonzini
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Acked-by: Michael S. Tsirkin
Signed-off-by: Nicholas Bellinger -
This patch adds a virtio_scsi_cmd_req_pi header as recommened by
Paolo that contains pi_bytesout + pi_bytesin elements used for
signaling when protection information buffers (in bytes) are
expected to preceed the data payload buffers.Also add new VIRTIO_SCSI_F_T10_PI feature bit to be used to signal
host support.Cc: Paolo Bonzini
Cc: Martin K. Petersen
Cc: Christoph Hellwig
Cc: Hannes Reinecke
Cc: Sagi Grimberg
Cc: H. Peter Anvin
Acked-by: Rusty Russell
Acked-by: Michael S. Tsirkin
Signed-off-by: Nicholas Bellinger
21 May, 2014
3 commits
-
In case user chose to set T10-PI enable on the target while
the IB device does not support it, gracefully reject the request.Reported-by: Slava Shwartsman
Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.15+
Signed-off-by: Nicholas Bellinger -
disconnected_handler works are scheduled on system_wq.
When attempting to unload, first make sure all works
have cleaned up.Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
There are 4 RDMA_CM events that all basically mean that
the user should teardown the IB connection:
- DISCONNECTED
- ADDR_CHANGE
- DEVICE_REMOVAL
- TIMEWAIT_EXITOnly in DISCONNECTED/ADDR_CHANGE it makes sense to
call rdma_disconnect (send DREQ/DREP to our initiator).
So we keep the same teardown handler for all of them
but only indicate calling rdma_disconnect for the relevant
events.This patch also removes redundant debug prints for each single
event.v2 changes:
- Call isert_disconnected_handler() for DEVICE_REMOVAL (Or + Sag)Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger
20 May, 2014
2 commits
-
In ungraceful teardowns isert close flows seem racy such that
isert_wait_conn hangs as RDMA_CM_EVENT_DISCONNECTED never
gets invoked (no one called rdma_disconnect).Both graceful and ungraceful teardowns will have rx flush errors
(isert posts a batch once connection is established). Once all
flush errors are consumed we invoke isert_wait_conn and it will
be responsible for calling rdma_disconnect. This way it can be
sure that rdma_disconnect was called and it won't wait forever.This patch also removes the logout_posted indicator. either the
logout completion was consumed and no problem decrementing the
post_send_buf_count, or it was consumed as a flush error. no point
of keeping it for isert_wait_conn as there is no danger that
isert_conn will be accidentally removed while it is running.(Drop unnecessary sleep_on_conn_wait_comp check in
isert_cq_rx_comp_err - nab)Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
In case np_thread state is in RESET/SHUTDOWN/EXIT states,
no point for isert to stall there as we may get a hang in
case no one will wake it up later.Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger
18 May, 2014
1 commit
-
On each processed XCOPY command, two "kmalloc-512" memory objects are
leaked. These represent two allocations of struct xcopy_pt_cmd in
target_core_xcopy.c.The reason for the memory leak is that the cmd_kref field is not
initialized (thus, it is zero because the allocations were done with
kzalloc). When we decrement zero kref in target_put_sess_cmd, the result
is not zero, thus target_release_cmd_kref is not called.This patch fixes the bug by moving kref initialization from
target_get_sess_cmd to transport_init_se_cmd (this function is called from
target_core_xcopy.c, so it will correctly initialize cmd_kref). It can be
easily verified that all code that calls target_get_sess_cmd also calls
transport_init_se_cmd earlier, thus moving kref_init shouldn't introduce
any new problems.Signed-off-by: Mikulas Patocka
Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Nicholas Bellinger
16 May, 2014
7 commits
-
Just like for pSCSI, if the transport sets get_write_cache, then it is
not valid to enable write cache emulation for it. Return an error.see https://bugzilla.redhat.com/show_bug.cgi?id=1082675
Reviewed-by: Chris Leech
Signed-off-by: Andy Grover
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
This patch explicitly disables Immediate + Unsolicited Data for ISER
connections during login in iscsi_login_zero_tsih_s2() when protection
has been enabled for the session by the underlying hardware.This is currently required because protection / signature memory regions
(MRs) expect T10 PI to occur on RDMA READs + RDMA WRITEs transfers, and
not on a immediate data payload associated with ISCSI_OP_SCSI_CMD, or
unsolicited data-out associated with a ISCSI_OP_SCSI_DATA_OUT.v2 changes:
- Add TARGET_PROT_DOUT_INSERT check (Sagi)
- Add pr_debug noisemaker (Sagi)
- Add goto to avoid early return from MRDSL check (nab)Cc: Sagi Grimberg
Cc: Or Gerlitz
Signed-off-by: Nicholas Bellinger -
This patch fixes a free-after-use regression in ft_free_cmd(), where
ft_sess_put() is called with cmd->sess after percpu_ida_free() has
already released the tag.Fix this bug by saving the ft_sess pointer ahead of percpu_ida_free(),
and pass it directly to ft_sess_put().The regression was originally introduced in v3.13-rc1 commit:
commit 5f544cfac956971099e906f94568bc3fd1a7108a
Author: Nicholas Bellinger
Date: Mon Sep 23 12:12:42 2013 -0700tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmd
Reported-by: Jun Wu
Cc: Mark Rustad
Cc: Robert Love
Cc: #3.13+
Signed-off-by: Nicholas Bellinger -
This patch changes an incorrect use of BUG_ON to instead generate a
REJECT + PROTOCOL_ERROR in iscsit_process_nop_out() code. This case
can occur with traditional TCP where a flood of zeros in the data
stream can reach this block for what is presumed to be a NOP-OUT with
a solicited reply, but without a valid iscsi_cmd pointer.This incorrect BUG_ON was introduced during the v3.11-rc timeframe
with the following commit:commit 778de368964c5b7e8100cde9f549992d521e9c89
Author: Nicholas Bellinger
Date: Fri Jun 14 16:07:47 2013 -0700iscsi/isert-target: Refactor ISCSI_OP_NOOP RX handling
Reported-by: Arshad Hussain
Cc: stable@vger.kernel.org # 3.11+
Signed-off-by: Nicholas Bellinger -
When the target is in stop stage, iSER transport initiates RDMA disconnects.
The iSER initiator may wish to establish a new connection over the
still existing network portal. In this case iSER transport should not
accept and resume new RDMA connections. In order to learn that, iscsi_np
is added with enabled flag so the iSER transport can check when deciding
weather to accept and resume a new connection request.The iscsi_np is enabled after successful transport setup, and disabled
before iscsi_np login threads are cleaned up.Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
RDMA CM and iSCSI target flows are asynchronous and completely
uncorrelated. Relying on the fact that iscsi_accept_np will be called
after CM connection request event and will wait for it is a mistake.When attempting to login to a few targets this flow is racy and
unpredictable, but for parallel login to dozens of targets will
race and hang every time.The correct synchronizing mechanism in this case is pending on
a semaphore rather than a wait_for_event. We keep the pending
interruptible for iscsi_np cleanup stage.(Squash patch to remove dead code into parent - nab)
Reported-by: Slava Shwartsman
Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger -
Should be adding list_add_tail($new, $head) and not
the other way around.Signed-off-by: Sagi Grimberg
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger
