1. 07 Feb, 2012 3 commits
    • Nicholas Bellinger's avatar
      target: Fix target_submit_cmd() exception handling · 735703ca
      Nicholas Bellinger authored
      This patch fixes a bug in target_submit_cmd() where the failure path
      for transport_generic_allocate_tasks() made a direct call to
      transport_send_check_condition_and_sense() and not calling the
      final target_put_sess_cmd() release callback.
      
      For transport_generic_allocate_tasks() failures, use the proper call to
      transport_generic_request_failure() to handle kref_put() along
      with potential internal queue full response processing.
      
      It also makes transport_lookup_cmd_lun() failures in
      target_submit_cmd() use transport_send_check_condition_and_sense() and
      target_put_sess_cmd() directly to avoid se_cmd->se_dev reference in
      transport_generic_request_failure() handling.
      
      Finally it drops the out_check_cond: label and use direct reference for
      allocate task failures, and per-se_device queue_full handling is
      currently not supported for transport_lookup_cmd_lun() failure
      descriptors due to se_device dependency.
      Reported-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: Roland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      735703ca
    • Andy Grover's avatar
      target: Change target_submit_cmd() to return void · 1edcdb49
      Andy Grover authored
      Retval not very useful, and may even be harmful. Once submitted, fabrics
      should expect a sense error if anything goes wrong. All fabrics checking
      of this retval are useless or broken:
      
      fc checks it just to emit more debug output.
      ib_srpt trickles retval up, then it is ignored.
      qla2xxx trickles it up, which then causes a bug because the abort goto
      in qla_target.c thinks cmd hasn't been sent to target.
      
      Just returning nothing is best.
      Signed-off-by: default avatarAndy Grover <agrover@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      1edcdb49
    • Sebastian Andrzej Siewior's avatar
      target: accept REQUEST_SENSE with 18bytes · 95fe1ee4
      Sebastian Andrzej Siewior authored
      WindowsXP+BOT issues a MODE_SENSE request with page 0x1c which is not
      suppoerted by target. Target rejects that command with
      TCM_INVALID_CDB_FIELD, so far so good. On BOT I can't send the SENSE
      response back, instead I can only reply that an error occured. The next
      thing happens is a REQUEST_SENSE request with 18 bytes length. Since the
      check here is more than 18 bytes I have to NACK that request as well.
      This is not really required: We check for some additional room, but we
      never use it. The additional length is set to 0xa so the total length is
      0xa + 8 = 18 which is fine with my 18 bytes.
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      95fe1ee4
  2. 18 Jan, 2012 17 commits
    • Roland Dreier's avatar
      target: Fail INQUIRY commands with EVPD==0 but PAGE CODE!=0 · bf005355
      Roland Dreier authored
      My draft of SPC-4 says:
      
          If the PAGE CODE field is not set to zero when the EVPD bit is set
          to zero, the command shall be terminated with CHECK CONDITION
          status, with the sense key set to ILLEGAL REQUEST, and the
          additional sense code set to INVALID FIELD IN CDB.
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      bf005355
    • Roland Dreier's avatar
      target: Return correct ASC for unimplemented VPD pages · bb1acb2e
      Roland Dreier authored
      My draft of SPC-4 says:
      
          If the device server does not implement the requested vital product
          data page, then the command shall be terminated with CHECK CONDITION
          status, with the sense key set to ILLEGAL REQUEST, and the
          additional sense code set to INVALID FIELD IN CDB.
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      bb1acb2e
    • Nicholas Bellinger's avatar
      iscsi-target: Fix discovery with INADDR_ANY and IN6ADDR_ANY_INIT · 2f9bc894
      Nicholas Bellinger authored
      This patch addresses a bug with sendtargets discovery where INADDR_ANY (0.0.0.0)
      + IN6ADDR_ANY_INIT ([0:0:0:0:0:0:0:0]) network portals where incorrectly being
      reported back to initiators instead of the address of the connecting interface.
      To address this, save local socket ->getname() output during iscsi login setup,
      and makes iscsit_build_sendtargets_response() return these TargetAddress keys
      when INADDR_ANY or IN6ADDR_ANY_INIT portals are in use.
      Reported-by: default avatarDax Kelson <dkelson@gurulabs.com>
      Reported-by: default avatarAndy Grover <agrover@redhat.com>
      Cc: David S. Miller <davem@davemloft.net>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      2f9bc894
    • Andy Grover's avatar
      target: Allow control CDBs with data > 1 page · 4949314c
      Andy Grover authored
      We need to handle >1 page control cdbs, so extend the code to do a vmap
      if bigger than 1 page. It seems like kmap() is still preferable if just
      a page, fewer TLB shootdowns(?), so keep using that when possible.
      
      Rename function pair for their new scope.
      Signed-off-by: default avatarAndy Grover <agrover@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      4949314c
    • Jesper Juhl's avatar
      iscsi-target: Fix up a few assignments · e8904dc5
      Jesper Juhl authored
      A statement such as
        struct iscsi_node_attrib *na = na = iscsit_tpg_get_node_attrib(sess);
      has undefined behaviour since there are two assignments to 'na', strictly
      speaking (the order in which side-effects from the assignments take place
      is undefined since there's no intervening sequence point), and it looks
      unintentional in any case.
      Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      e8904dc5
    • Dan Carpenter's avatar
      iscsi-target: make one-bit bitfields unsigned · f8d48ae5
      Dan Carpenter authored
      Signed bitfields are a problem because instead of being 1 or 0 like
      you'd expect they are 0 and -1.  It doesn't cause a problem in this case
      but sparse complains:
      
      drivers/target/iscsi/iscsi_target_core.h:564:56: error: dubious one-bit
      signed bitfield
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      f8d48ae5
    • Nicholas Bellinger's avatar
      iscsi-target: Fix double list_add with iscsit_alloc_buffs reject · cd931ee6
      Nicholas Bellinger authored
      This patch fixes a bug where the iscsit_add_reject_from_cmd() call
      from a failure to iscsit_alloc_buffs() was incorrectly passing
      add_to_conn=1 and causing a double list_add after iscsi_cmd->i_list
      had already been added in iscsit_handle_scsi_cmd().
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      cd931ee6
    • Nicholas Bellinger's avatar
      iscsi-target: Fix reject release handling in iscsit_free_cmd() · c1ce4bd5
      Nicholas Bellinger authored
      This patch addresses a bug where iscsit_free_cmd() was incorrectly calling
      iscsit_release_cmd() for ISCSI_OP_REJECT because iscsi_add_reject*() will
      overwrite the original iscsi_cmd->iscsi_opcode assignment.  This bug was
      introduced with the following commit:
      
      commit 0be67f2ed8f577d2c72d917928394c5885fa9134
      Author: Nicholas Bellinger <nab@linux-iscsi.org>
      Date:   Sun Oct 9 01:48:14 2011 -0700
      
          iscsi-target: Remove SCF_SE_LUN_CMD flag abuses
      
      and was manifesting itself as list corruption with the following:
      
      [  131.191092] ------------[ cut here ]------------
      [  131.191092] WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98()
      [  131.191092] Hardware name: VMware Virtual Platform
      [  131.191092] list_del corruption. prev->next should be ffff880022d3c100, but was 6b6b6b6b6b6b6b6b
      [  131.191092] Modules linked in: tcm_vhost ib_srpt ib_cm ib_sa ib_mad ib_core tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc crc32c iscsi_target_mod target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi sr_mod cdrom sd_mod e1000 ata_piix libata mptspi mptscsih mptbase [last unloaded: scsi_wait_scan]
      [  131.191092] Pid: 2250, comm: iscsi_ttx Tainted: G        W    3.2.0-rc4+ #42
      [  131.191092] Call Trace:
      [  131.191092]  [<ffffffff8103b553>] warn_slowpath_common+0x80/0x98
      [  131.191092]  [<ffffffff8103b5ff>] warn_slowpath_fmt+0x41/0x43
      [  131.191092]  [<ffffffff811d0279>] __list_del_entry+0x8d/0x98
      [  131.191092]  [<ffffffffa01395c9>] transport_lun_remove_cmd+0x9b/0xb7 [target_core_mod]
      [  131.191092]  [<ffffffffa013a55c>] transport_generic_free_cmd+0x5d/0x71 [target_core_mod]
      [  131.191092]  [<ffffffffa01a012b>] iscsit_free_cmd+0x1e/0x27 [iscsi_target_mod]
      [  131.191092]  [<ffffffffa01a13be>] iscsit_close_connection+0x14d/0x5b2 [iscsi_target_mod]
      [  131.191092]  [<ffffffffa0196a0c>] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod]
      [  131.191092]  [<ffffffffa01a55d4>] iscsi_target_tx_thread+0x15cb/0x1608 [iscsi_target_mod]
      [  131.191092]  [<ffffffff8103609a>] ? check_preempt_wakeup+0x121/0x185
      [  131.191092]  [<ffffffff81030801>] ? __dequeue_entity+0x2e/0x33
      [  131.191092]  [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
      [  131.191092]  [<ffffffffa01a4009>] ? iscsit_send_text_rsp+0x25f/0x25f [iscsi_target_mod]
      [  131.191092]  [<ffffffff8138f706>] ? schedule+0x55/0x57
      [  131.191092]  [<ffffffff81056c7d>] kthread+0x7d/0x85
      [  131.191092]  [<ffffffff81399534>] kernel_thread_helper+0x4/0x10
      [  131.191092]  [<ffffffff81056c00>] ? kthread_worker_fn+0x16d/0x16d
      [  131.191092]  [<ffffffff81399530>] ? gs_change+0x13/0x13
      
      Reported-by: <jrepac@yahoo.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      c1ce4bd5
    • Sebastian Andrzej Siewior's avatar
      target: fix return code of core_tpg_.*_lun · 8d9efe53
      Sebastian Andrzej Siewior authored
      - core_tpg_pre_addlun()
        returns always ERR_PTR() or the pointer, never NULL. The additional
        check for NULL in core_dev_add_lun() is not required.
      
      - core_tpg_pre_dellun()
        returns always ERR_PTR() or the pointer, never NULL. The check for NULL
        in core_dev_del_lun() is wrong. The third argument (int *) is never
        used, remove it.
      
      - core_dev_add_lun()
        returns always NULL or the pointer, never ERR_PTR. The check for
        IS_ERR() is not required.
      
      (nab: Convert core_dev_add_lun() use err.h macros for failure
      handling to be consistent with the rest of target_core_fabric_configfs.c
      callers)
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      8d9efe53
    • Sebastian Andrzej Siewior's avatar
      target: use save/restore lock primitive in core_dec_lacl_count() · 1dd0a067
      Sebastian Andrzej Siewior authored
      It may happen that uasp will free the request in irq conntext, the
      callchain:
      
       uasp_cmd_release() -> transport_generic_free_cmd() -> core_dec_lacl_count()
      
      where the last function enables the IRQ. Those irqs are re-disabled
      later (due to the spin.*irq_restore) but in between we could get hurt.
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      1dd0a067
    • Sebastian Andrzej Siewior's avatar
      target: avoid multiple outputs in scsi_dump_inquiry() · e59a41b6
      Sebastian Andrzej Siewior authored
      The multiple calls to pr_debug() each with one letter results in a new
      line. This patch merges the multiple requests into one call per line
      so we don't have the multiple line cuts.
      Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      e59a41b6
    • Nicholas Bellinger's avatar
      target: Add workaround for zero-length control CDB handling · 91ec1d35
      Nicholas Bellinger authored
      This patch adds a work-around for handling zero allocation length
      control CDBs (type SCF_SCSI_CONTROL_SG_IO_CDB) that was causing an
      OOPs with the following raw calls:
      
         # sg_raw -v /dev/sdd 3 0 0 0 0 0
         # sg_raw -v /dev/sdd 0x1a 0 1 0 0 0
      
      This patch will follow existing zero-length handling for data I/O
      and silently return with GOOD status.  This addresses the zero length
      issue, but the proper long-term resolution for handling arbitary
      allocation lengths will be to refactor out data-phase handling in
      individual CDB emulation logic within target_core_cdb.c
      Reported-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      91ec1d35
    • Roland Dreier's avatar
      target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB} · 9fbc8909
      Roland Dreier authored
      According to SPC-4, the sense key for commands that are failed with
      INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be
      ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh).  Without this
      patch, a tcm_loop LUN incorrectly gives:
      
          # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0
          Sense Information:
           Fixed format, current;  Sense key: Aborted Command
           Additional sense: Invalid field in cdb
           Raw sense data (in hex):
                  70 00 0b 00 00 00 00 0a  00 00 00 00 24 00 00 00
                  00 00
      
      While a real SCSI disk gives:
      
          Sense Information:
           Fixed format, current;  Sense key: Illegal Request
           Additional sense: Invalid field in cdb
           Raw sense data (in hex):
                  70 00 05 00 00 00 00 18  00 00 00 00 24 00 00 00
                  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
      
      with the main point being that the real disk gives a sense key of
      ILLEGAL REQUEST (5h).
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      9fbc8909
    • roland@purestorage.com's avatar
      target: Don't zero pages used for data buffers · 9db9da33
      roland@purestorage.com authored
      Doing alloc_page(GFP_KERNEL | __GFP_ZERO) to get pages used for data
      buffers wastes a lot of CPU clearing pages that will be quickly be
      overwritten by the actual data.  However, for emulated control
      commands such as INQUIRY and so on, the code does assume that the
      buffer is zeroed.
      
      To avoid this CPU overhead, skip the __GFP_ZERO for commands that are
      actually moving data, ie cmds that have SCF_SCSI_DATA_SG_IO_CDB set.
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      9db9da33
    • Marco Sanvido's avatar
      target: Allow PERSISTENT RESERVE IN for non-reservation holder · 6816966a
      Marco Sanvido authored
      Initiators that aren't the active reservation holder should be able to
      do a PERSISTENT RESERVE IN command in all cases, so add it to the list
      of allowed CDBs in core_scsi3_pr_seq_non_holder().
      Signed-off-by: default avatarMarco Sanvido <marco@purestorage.com>
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      6816966a
    • Marco Sanvido's avatar
      target: Use correct preempted registration sense code · 9e08e34e
      Marco Sanvido authored
      The comments quote the right parts of the spec:
      
         * d) Establish a unit attention condition for the
         *    initiator port associated with every I_T nexus
         *    that lost its registration other than the I_T
         *    nexus on which the PERSISTENT RESERVE OUT command
         *    was received, with the additional sense code set
         *    to REGISTRATIONS PREEMPTED.
      
      and
      
         * e) Establish a unit attention condition for the initiator
         *    port associated with every I_T nexus that lost its
         *    persistent reservation and/or registration, with the
         *    additional sense code set to REGISTRATIONS PREEMPTED;
      
      but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED
      instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED.  Fix this.
      Signed-off-by: default avatarMarco Sanvido <marco@purestorage.com>
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      9e08e34e
    • Christoph Hellwig's avatar
      target: don't allocate bio headroom in iblock · 48cfe37c
      Christoph Hellwig authored
      We never embedd the bio into a structure, so there is no need to allocate
      64 bytes of headroom per bio.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      48cfe37c
  3. 16 Dec, 2011 1 commit
    • Roland Dreier's avatar
      target: Set additional sense length field in sense data · 895f3022
      Roland Dreier authored
      The target code was not setting the additional sense length field in the
      sense data it returned, which meant that at least the Linux stack
      ignored the ASC/ASCQ fields.  For example, without this patch, on a
      tcm_loop device:
      
          # sg_raw -v /dev/sda 2 0 0 0 0 0
      
      gives
      
              cdb to send: 02 00 00 00 00 00
          SCSI Status: Check Condition
      
          Sense Information:
           Fixed format, current;  Sense key: Illegal Request
            Raw sense data (in hex):
                  70 00 05 00 00 00 00 00
      
      while after the patch we correctly get the following (which matches what
      a regular disk returns):
      
              cdb to send: 02 00 00 00 00 00
          SCSI Status: Check Condition
      
          Sense Information:
           Fixed format, current;  Sense key: Illegal Request
           Additional sense: Invalid command operation code
           Raw sense data (in hex):
                  70 00 05 00 00 00 00 0a  00 00 00 00 20 00 00 00
                  00 00
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      895f3022
  4. 14 Dec, 2011 19 commits