linux-toradex.git/drivers/infiniband/ulp, branch v3.18.23

iser-target: remove command with state ISTATE_REMOVE

2015-10-28T02:12:54+00:00

[ Upstream commit a4c15cd957cbd728f685645de7a150df5912591a ]

As documented in iscsit_sequence_cmd:
/*
 * Existing callers for iscsit_sequence_cmd() will silently
 * ignore commands with CMDSN_LOWER_THAN_EXP, so force this
 * return for CMDSN_MAXCMDSN_OVERRUN as well..
 */

We need to silently finish a command when it's in ISTATE_REMOVE.
This fixes an teardown hang we were seeing where a mis-behaved
initiator (triggered by allocation error injections) sent us a
cmdsn which was lower than expected.

Signed-off-by: Jenny Derzhavetz 
Signed-off-by: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iser-target: Fix possible deadlock in RDMA_CM connection error

2015-08-04T18:34:34+00:00

[ Upstream commit 4a579da2586bd3b79b025947ea24ede2bbfede62 ]

Before we reach to connection established we may get an
error event. In this case the core won't teardown this
connection (never established it), so we take care of freeing
it ourselves.

Signed-off-by: Sagi Grimberg 
Cc:  # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iser-target: release stale iser connections

2015-07-03T16:34:50+00:00

[ Upstream commit 2f1b6b7d9a815f341b18dfd26a363f37d4d3c96a ]

When receiving a new iser connect request we serialize
the pending requests by adding the newly created iser connection
to the np accept list and let the login thread process the connect
request one by one (np_accept_wait).

In case we received a disconnect request before the iser_conn
has begun processing (still linked in np_accept_list) we should
detach it from the list and clean it up and not have the login
thread process a stale connection. We do it only when the connection
state is not already terminating (initiator driven disconnect) as
this might lead us to access np_accept_mutex after the np was released
in live shutdown scenarios.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Jenny Falkovich 
Cc: stable@vger.kernel.org # 3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iser-target: Fix variable-length response error completion

2015-07-02T01:44:05+00:00

[ Upstream commit 9253e667ab50fd4611a60e1cdd6a6e05a1d91cf1 ]

Since commit "2426bd456a6 target: Report correct response ..."
we might get a command with data_size that does not fit to
the number of allocated data sg elements. Given that we rely on
cmd t_data_nents which might be different than the data_size,
we sometimes receive local length error completion. The correct
approach would be to take the command data_size into account when
constructing the ib sg_list.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Jenny Falkovich 
Cc: stable@vger.kernel.org # 3.16+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

IB/iser: Fix wrong calculation of protection buffer length

2015-05-17T23:12:22+00:00

[ Upstream commit a065fe6aa25ba6ba93c02dc13486131bb3c64d5f ]

This length miss-calculation may cause a silent data corruption
in the DIX case and cause the device to reference unmapped area.

Fixes: d77e65350f2d ('libiscsi, iser: Adjust data_length to include protection information')
Signed-off-by: Sagi Grimberg 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

iser-target: Fix session hang in case of an rdma read DIF error

2015-05-17T23:12:13+00:00

[ Upstream commit 364189f0ada5478e4faf8a552d6071a650d757cd ]

This hang was a result of a missing command put when
a DIF error occurred during a rdma read (and we sent
an CHECK_CONDITION error without passing it to the
backend).

Signed-off-by: Sagi Grimberg 
Cc:  # v3.14+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

IB/iser: Use correct dma direction when unmapping SGs

2015-03-24T01:02:44+00:00

commit c6c95ef4cec680f7a10aa425a9970744b35b6489 upstream.

We always unmap SGs with the same direction instead of unmapping
with the direction the mapping was done, fix that.

Fixes: 9a8b08fad2ef ("IB/iser: Generalize iser_unmap_task_data and [...]")
Signed-off-by: Roi Dayan 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Signed-off-by: Sasha Levin

IB/iser: Fix memory regions possible leak

2015-03-24T01:02:44+00:00

commit 6606e6a2ff2710b473838b291dc533cd8fc1471f upstream.

When teardown process starts during live IO, we need to keep the
memory regions pool (frmr/fmr) until all in-flight tasks are properly
released, since each task may return a memory region to the pool. In
order to do this, we pass a destroy flag to iser_free_ib_conn_res to
indicate we can destroy the device and the memory regions
pool. iser_conn_release will pass it as true and also DEVICE_REMOVAL
event (we need to let the device to properly remove).

Also, Since we conditionally call iser_free_rx_descriptors,
remove the extra check on iser_conn->rx_descs.

Fixes: 5426b1711fd0 ("IB/iser: Collapse cleanup and disconnect handlers")
Reported-by: Or Gerlitz 
Signed-off-by: Sagi Grimberg 
Signed-off-by: Roland Dreier 
Signed-off-by: Sasha Levin

iscsi,iser-target: Expose supported protection ops according to t10_pi

2015-01-27T16:29:37+00:00

commit 23a548ee656c8ba6da8cb2412070edcd62e2ac5d upstream.

iSER will report supported protection operations based on
the tpg attribute t10_pi settings and HCA PI offload capabilities.
If the HCA does not support PI offload or tpg attribute t10_pi is
not set, we fall to SW PI mode.

In order to do that, we move iscsit_get_sup_prot_ops after connection
tpg assignment.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

iser-target: Fix NULL dereference in SW mode DIF

2015-01-27T16:29:37+00:00

commit 302cc7c3ca14d21ccdffdebdb61c4fe028f2d5ad upstream.

Fallback to software mode DIF if HCA does not support
PI (without crashing obviously). It is still possible to
run with backend protection and an unprotected frontend,
so looking at the command prot_op is not enough. Check
device PI capability on a per-IO basis (isert_prot_cmd
inline static) to determine if we need to handle protection
information.

Trace:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [] isert_reg_sig_mr+0x351/0x3b0 [ib_isert]
Call Trace:
 [] ? swiotlb_map_sg_attrs+0x7a/0x130
 [] isert_reg_rdma+0x2fd/0x370 [ib_isert]
 [] ? idle_balance+0x6c/0x2c0
 [] isert_put_datain+0x68/0x210 [ib_isert]
 [] lio_queue_data_in+0x2b/0x30 [iscsi_target_mod]
 [] target_complete_ok_work+0x21b/0x310 [target_core_mod]
 [] process_one_work+0x182/0x3b0
 [] worker_thread+0x120/0x3c0
 [] ? maybe_create_worker+0x190/0x190
 [] kthread+0xce/0xf0
 [] ? kthread_freezable_should_stop+0x70/0x70
 [] ret_from_fork+0x7c/0xb0
 [] ? kthread_freezable_should_stop+0x70/0x70

Reported-by: Slava Shwartsman 
Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman