1. 20 Jul, 2016 1 commit
  2. 10 May, 2016 2 commits
  3. 10 Mar, 2016 1 commit
  4. 06 Mar, 2016 1 commit
  5. 11 Feb, 2016 1 commit
  6. 06 Feb, 2016 1 commit
  7. 05 Feb, 2016 1 commit
    • Nicholas Bellinger's avatar
      target: Fix remote-port TMR ABORT + se_cmd fabric stop · 0f4a9431
      Nicholas Bellinger authored
      To address the bug where fabric driver level shutdown
      of se_cmd occurs at the same time when TMR CMD_T_ABORTED
      is happening resulting in a -1 ->cmd_kref, this patch
      adds a CMD_T_FABRIC_STOP bit that is used to determine
      when TMR + driver I_T nexus shutdown is happening
      concurrently.
      
      It changes target_sess_cmd_list_set_waiting() to obtain
      se_cmd->cmd_kref + set CMD_T_FABRIC_STOP, and drop local
      reference in target_wait_for_sess_cmds() and invoke extra
      target_put_sess_cmd() during Task Aborted Status (TAS)
      when necessary.
      
      Also, it adds a new target_wait_free_cmd() wrapper around
      transport_wait_for_tasks() for the special case within
      transport_generic_free_cmd() to set CMD_T_FABRIC_STOP,
      and is now aware of CMD_T_ABORTED + CMD_T_TAS status
      bits to know when an extra transport_put_cmd() during
      TAS is required.
      
      Note transport_generic_free_cmd() is expected to block on
      cmd->cmd_wait_comp in order to follow what iscsi-target
      expects during iscsi_conn context se_cmd shutdown.
      
      Cc: Quinn Tran <quinn.tran@qlogic.com>
      Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Andy Grover <agrover@redhat.com>
      Cc: Mike Christie <mchristi@redhat.com>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: default avatarNicholas Bellinger <nab@daterainc.com>
      0f4a9431
  8. 03 Feb, 2016 1 commit
    • Nicholas Bellinger's avatar
      target: Fix LUN_RESET active I/O handling for ACK_KREF · febe562c
      Nicholas Bellinger authored
      This patch fixes a NULL pointer se_cmd->cmd_kref < 0
      refcount bug during TMR LUN_RESET with active se_cmd
      I/O, that can be triggered during se_cmd descriptor
      shutdown + release via core_tmr_drain_state_list() code.
      
      To address this bug, add common __target_check_io_state()
      helper for ABORT_TASK + LUN_RESET w/ CMD_T_COMPLETE
      checking, and set CMD_T_ABORTED + obtain ->cmd_kref for
      both cases ahead of last target_put_sess_cmd() after
      TFO->aborted_task() -> transport_cmd_finish_abort()
      callback has completed.
      
      It also introduces SCF_ACK_KREF to determine when
      transport_cmd_finish_abort() needs to drop the second
      extra reference, ahead of calling target_put_sess_cmd()
      for the final kref_put(&se_cmd->cmd_kref).
      
      It also updates transport_cmd_check_stop() to avoid
      holding se_cmd->t_state_lock while dropping se_cmd
      device state via target_remove_from_state_list(), now
      that core_tmr_drain_state_list() is holding the
      se_device lock while checking se_cmd state from
      within TMR logic.
      
      Finally, move transport_put_cmd() release of SGL +
      TMR + extended CDB memory into target_free_cmd_mem()
      in order to avoid potential resource leaks in TMR
      ABORT_TASK + LUN_RESET code-paths.  Also update
      target_release_cmd_kref() accordingly.
      Reviewed-by: default avatarQuinn Tran <quinn.tran@qlogic.com>
      Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Hannes Reinecke <hare@suse.de>
      Cc: Andy Grover <agrover@redhat.com>
      Cc: Mike Christie <mchristi@redhat.com>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      febe562c
  9. 07 Jan, 2016 2 commits
  10. 06 Jan, 2016 1 commit
  11. 28 Nov, 2015 1 commit
    • Nicholas Bellinger's avatar
      target: Fix race for SCF_COMPARE_AND_WRITE_POST checking · 057085e5
      Nicholas Bellinger authored
      This patch addresses a race + use after free where the first
      stage of COMPARE_AND_WRITE in compare_and_write_callback()
      is rescheduled after the backend sends the secondary WRITE,
      resulting in second stage compare_and_write_post() callback
      completing in target_complete_ok_work() before the first
      can return.
      
      Because current code depends on checking se_cmd->se_cmd_flags
      after return from se_cmd->transport_complete_callback(),
      this results in first stage having SCF_COMPARE_AND_WRITE_POST
      set, which incorrectly falls through into second stage CAW
      processing code, eventually triggering a NULL pointer
      dereference due to use after free.
      
      To address this bug, pass in a new *post_ret parameter into
      se_cmd->transport_complete_callback(), and depend upon this
      value instead of ->se_cmd_flags to determine when to return
      or fall through into ->queue_status() code for CAW.
      
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: <stable@vger.kernel.org> # v3.12+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      057085e5
  12. 13 Oct, 2015 1 commit
  13. 25 Sep, 2015 1 commit
  14. 31 Jul, 2015 2 commits
  15. 30 Jul, 2015 2 commits
  16. 06 Jul, 2015 1 commit
  17. 23 Jun, 2015 3 commits
  18. 16 Jun, 2015 3 commits
  19. 02 Jun, 2015 2 commits
    • Bart Van Assche's avatar
      target: Minimize SCSI header #include directives · ba929992
      Bart Van Assche authored
      Only include SCSI initiator header files in target code that needs
      these header files, namely the SCSI pass-through code and the tcm_loop
      driver. Change SCSI_SENSE_BUFFERSIZE into TRANSPORT_SENSE_BUFFER in
      target code because the former is intended for initiator code and the
      latter for target code. With this patch the only initiator include
      directives in target code that remain are as follows:
      
      $ git grep -nHE 'include .scsi/(scsi.h|scsi_host.h|scsi_device.h|scsi_cmnd.h)' drivers/target drivers/infiniband/ulp/{isert,srpt} drivers/usb/gadget/legacy/tcm_*.[ch] drivers/{vhost,xen} include/{target,trace/events/target.h}
      drivers/target/loopback/tcm_loop.c:29:#include <scsi/scsi.h>
      drivers/target/loopback/tcm_loop.c:31:#include <scsi/scsi_host.h>
      drivers/target/loopback/tcm_loop.c:32:#include <scsi/scsi_device.h>
      drivers/target/loopback/tcm_loop.c:33:#include <scsi/scsi_cmnd.h>
      drivers/target/target_core_pscsi.c:39:#include <scsi/scsi_device.h>
      drivers/target/target_core_pscsi.c:40:#include <scsi/scsi_host.h>
      drivers/xen/xen-scsiback.c:52:#include <scsi/scsi_host.h> /* SG_ALL */
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
      ba929992
    • Bart Van Assche's avatar
      target: Correct a comment · 8d3a8248
      Bart Van Assche authored
      Correct the comment above the definition of TCM_MAX_COMMAND_SIZE.
      A quote from Christoph:
      
          There aren't any legacy issues, we just decided to handle >
          16 byte CDBs in the slow path.
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarJames Bottomley <JBottomley@Odin.com>
      8d3a8248
  20. 01 Jun, 2015 12 commits
    • Nicholas Bellinger's avatar
      target: Drop se_lun->lun_active for existing percpu lun_ref · 9e37d042
      Nicholas Bellinger authored
      With se_port_t and t10_alua_tg_pt_gp_member being absored into se_lun,
      there is no need for an extra atomic_t based reference count for PR
      ALL_TG_PT=1 and ALUA access state transition.
      
      Go ahead and use the existing percpu se_lun->lun_ref instead, and
      convert the two special cases to percpu_ref_tryget_live() to avoid
      se_lun if transport_clear_lun_ref() has already been invoked to
      shutdown the se_lun.
      
      Cc: Christoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      9e37d042
    • Nicholas Bellinger's avatar
      target: Drop lun_sep_lock for se_lun->lun_se_dev RCU usage · 4cc987ea
      Nicholas Bellinger authored
      With se_port and t10_alua_tg_pt_gp_member being absored into se_lun,
      there is no need for an extra lock to protect se_lun->lun_se_dev
      assignment.
      
      This patch also converts backend drivers to use call_rcu() release
      to allow any se_device readers to complete.  The call_rcu() instead
      of kfree_rcu() is required here because se_device is embedded into
      the backend driver specific structure.
      
      Also, convert se_lun->lun_stats to use atomic_long_t within the
      target_complete_ok_work() completion callback, and add FIXME for
      transport_lookup_tmr_lun() with se_lun->lun_ref.
      
      Finally, update sbp_update_unit_directory() special case usage with
      proper rcu_dereference_raw() and configfs symlink comment.
      Reported-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Chris Boot <bootc@bootc.net>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      4cc987ea
    • Christoph Hellwig's avatar
      target: Subsume se_port + t10_alua_tg_pt_gp_member into se_lun · adf653f9
      Christoph Hellwig authored
      This patch eliminates all se_port + t10_alua_tg_pt_gp_member usage,
      and converts current users to direct se_lun pointer dereference.
      
      This includes the removal of core_export_port(), core_release_port()
      core_dev_export() and core_dev_unexport().  Along with conversion
      of special case se_lun pointer dereference within PR ALL_TG_PT=1
      and ALUA access state transition UNIT_ATTENTION handling.
      
      Also, update core_enable_device_list_for_node() to reference the
      new per se_lun->lun_deve_list when creating a new entry, or
      replacing an existing one via RCU.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      adf653f9
    • Bart Van Assche's avatar
      target: Simplify LUN shutdown code · b3eeea66
      Bart Van Assche authored
      Instead of starting a thread from transport_clear_lun_ref() that
      waits for LUN shutdown, wait in that function for LUN shutdown
      to finish. Additionally, change the return type of
      transport_clear_lun_ref() from int to void.
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      b3eeea66
    • Christoph Hellwig's avatar
      target: simplify backend driver registration · 0a06d430
      Christoph Hellwig authored
      Rewrite the backend driver registration based on what we did to the fabric
      drivers:  introduce a read-only struct target_bakckend_ops that the driver
      registers, which is then instanciate as a struct target_backend by the
      core.  This allows the ops vector to be smaller and allows us to mark it
      const.  At the same time the registration function can set up the
      configfs attributes, avoiding the need to add additional boilerplate code
      for that to the drivers.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      0a06d430
    • Nicholas Bellinger's avatar
      target: Drop left-over se_lun->lun_status · 46247737
      Nicholas Bellinger authored
      Now that se_portal_group->tpg_lun_hlist is a RCU protected hlist,
      go ahead and drop the left-over lun->lun_status usage.
      Reported-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      46247737
    • Nicholas Bellinger's avatar
      target: Drop unused se_lun->lun_acl_list · 84786546
      Nicholas Bellinger authored
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      84786546
    • Nicholas Bellinger's avatar
      target: Convert se_tpg->acl_node_lock to ->acl_node_mutex · 403edd78
      Nicholas Bellinger authored
      This patch converts se_tpg->acl_node_lock to struct mutex, so that
      ->acl_node_acl walkers in core_clear_lun_from_tpg() can block when
      calling core_disable_device_list_for_node().
      
      It also updates core_dev_add_lun() to hold ->acl_node_mutex when
      calling core_tpg_add_node_to_devs() to build ->lun_entry_hlist
      for dynamically generated se_node_acl.
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      403edd78
    • Nicholas Bellinger's avatar
      target: Convert se_portal_group->tpg_lun_list[] to RCU hlist · 6bb82612
      Nicholas Bellinger authored
      This patch converts the fixed size se_portal_group->tpg_lun_list[]
      to use modern RCU with hlist_head in order to support an arbitary
      number of se_lun ports per target endpoint.
      
      It includes dropping core_tpg_alloc_lun() from core_dev_add_lun(),
      and calling it directly from target_fabric_make_lun() to allocate
      a new se_lun.  And add a new target_fabric_port_release() configfs
      item callback to invoke kfree_rcu() to release memory during
      se_lun->lun_group shutdown.
      
      Also now that se_node_acl->lun_entry_hlist is using RCU, convert
      existing tpg_lun_lock to struct mutex so core_tpg_add_node_to_devs()
      can perform RCU updater logic without releasing ->tpg_lun_mutex.
      
      Also, drop core_tpg_clear_object_luns() and it's single consumer
      in iscsi-target, which is duplicating TPG LUN shutdown logic and
      is current code results in a NOP.
      
      Finally, sbp-target and xen-scsiback fabric driver conversions are
      included, which are required due to the non-standard way they use
      ->tpg_lun_hlist.
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Chris Boot <bootc@bootc.net>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      6bb82612
    • Nicholas Bellinger's avatar
      target/pr: Change alloc_registration to avoid pr_reg_tg_pt_lun · 79dc9c9e
      Nicholas Bellinger authored
      This patch changes __core_scsi3_do_alloc_registration() code to
      drop pr_reg->pr_reg_tg_pt_lun pointer usage in favor of a new
      pr_reg RPTI + existing pr_reg->pr_aptpl_target_lun used by
      APTPL metadata logic.
      
      It also includes changes to REGISTER, REGISTER_AND_MOVE and APTPL
      feature bit codepaths to use rcu_dereference_check() with the
      expected non-zero se_dev_entry->pr_kref reference held.
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      79dc9c9e
    • Nicholas Bellinger's avatar
      target/pr: Use atomic bitop for se_dev_entry->deve_flags reservation check · 80bfdfa9
      Nicholas Bellinger authored
      This patch converts the core_scsi3_pr_seq_non_holder() check for non
      reservation holding registrations to use an atomic bitop in ->deve_flags
      to determine if a registration is currently active.
      
      It also includes associated a set_bit() in __core_scsi3_add_registration()
      and clear_bit() in __core_scsi3_free_registration(), if se_dev_entry still
      exists, and has not already been released via se_dev_entry shutdown path
      in core_disable_device_list_for_node().
      
      Also, clear_bit in core_disable_device_list_for_node as well to ensure
      the read-critical path in core_scsi3_pr_seq_non_holder() picks up the
      new state, preceeding the final kfree_rcu() call.
      Reported-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      80bfdfa9
    • Nicholas Bellinger's avatar
      target: Convert se_node_acl->device_list[] to RCU hlist · 29a05dee
      Nicholas Bellinger authored
      This patch converts se_node_acl->device_list[] table for mappedluns
      to modern RCU hlist_head usage in order to support an arbitrary number
      of node_acl lun mappings.
      
      It converts transport_lookup_*_lun() fast-path code to use RCU read path
      primitives when looking up se_dev_entry.  It adds a new hlist_head at
      se_node_acl->lun_entry_hlist for this purpose.
      
      For transport_lookup_cmd_lun() code, it works with existing per-cpu
      se_lun->lun_ref when associating se_cmd with se_lun + se_device.
      Also, go ahead and update core_create_device_list_for_node() +
      core_free_device_list_for_node() to use ->lun_entry_hlist.
      
      It also converts se_dev_entry->pr_ref_count access to use modern
      struct kref counting, and updates core_disable_device_list_for_node()
      to kref_put() and block on se_deve->pr_comp waiting for outstanding PR
      special-case PR references to drop, then invoke kfree_rcu() to wait
      for the RCU grace period to complete before releasing memory.
      
      So now that se_node_acl->lun_entry_hlist fast path access uses RCU
      protected pointers, go ahead and convert remaining non-fast path
      RCU updater code using ->lun_entry_lock to struct mutex to allow
      callers to block while walking se_node_acl->lun_entry_hlist.
      
      Finally drop the left-over core_clear_initiator_node_from_tpg() that
      originally cleared lun_access during se_node_acl shutdown, as post
      RCU conversion it now becomes duplicated logic.
      Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Sagi Grimberg <sagig@mellanox.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      29a05dee