From 4a28a3fa8c37193b105807193b3695048f0050a4 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 27 Jul 2011 12:58:17 +0300 Subject: iscsi-target: Fix NULL dereference on allocation failure This patch fixes a bug in iscsi_target_init_negotiation() where the "goto out" path dereferences "login" which is NULL upon a memory allocation failure. Signed-off-by: Dan Carpenter Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/iscsi_target_nego.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c index 713a4d23557a..4d087ac11067 100644 --- a/drivers/target/iscsi/iscsi_target_nego.c +++ b/drivers/target/iscsi/iscsi_target_nego.c @@ -978,7 +978,7 @@ struct iscsi_login *iscsi_target_init_negotiation( pr_err("Unable to allocate memory for struct iscsi_login.\n"); iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, ISCSI_LOGIN_STATUS_NO_RESOURCES); - goto out; + return NULL; } login->req = kzalloc(ISCSI_HDR_LEN, GFP_KERNEL); -- cgit v1.2.3 From 8f50c7f5d63b0e4a29f6f96e8cfaca782e0c458d Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 27 Jul 2011 14:11:43 +0300 Subject: iscsi-target: strlen() doesn't count the terminator This patch fixes an off by one check in iscsit_add_tiqn() because the NULL terminator isn't taken into consideration. Signed-off-by: Dan Carpenter Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/iscsi_target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 14c81c4265bd..396c79d8569c 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -120,7 +120,7 @@ struct iscsi_tiqn *iscsit_add_tiqn(unsigned char *buf) struct iscsi_tiqn *tiqn = NULL; int ret; - if (strlen(buf) > ISCSI_IQN_LEN) { + if (strlen(buf) >= ISCSI_IQN_LEN) { pr_err("Target IQN exceeds %d bytes\n", ISCSI_IQN_LEN); return ERR_PTR(-EINVAL); -- cgit v1.2.3 From 76f1928e8831961a692459924cfac0ca1b0d303a Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Wed, 27 Jul 2011 12:16:22 -0700 Subject: iscsi-target: Fix uninitialized usage of cmd->pad_bytes This patch fixes an uninitialized usage of cmd->pad_bytes inside of iscsit_handle_text_cmd() introduced during a v4.1 change to use cmd members instead of local pad_bytes variables. Reported-by: Dan Carpenter Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/iscsi_target.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 396c79d8569c..3ab8abca29c3 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -1857,7 +1857,7 @@ static int iscsit_handle_text_cmd( char *text_ptr, *text_in; int cmdsn_ret, niov = 0, rx_got, rx_size; u32 checksum = 0, data_crc = 0, payload_length; - u32 padding = 0, text_length = 0; + u32 padding = 0, pad_bytes = 0, text_length = 0; struct iscsi_cmd *cmd; struct kvec iov[3]; struct iscsi_text *hdr; @@ -1896,7 +1896,7 @@ static int iscsit_handle_text_cmd( padding = ((-payload_length) & 3); if (padding != 0) { - iov[niov].iov_base = cmd->pad_bytes; + iov[niov].iov_base = &pad_bytes; iov[niov++].iov_len = padding; rx_size += padding; pr_debug("Receiving %u additional bytes" @@ -1917,7 +1917,7 @@ static int iscsit_handle_text_cmd( if (conn->conn_ops->DataDigest) { iscsit_do_crypto_hash_buf(&conn->conn_rx_hash, text_in, text_length, - padding, cmd->pad_bytes, + padding, (u8 *)&pad_bytes, (u8 *)&data_crc); if (checksum != data_crc) { -- cgit v1.2.3 From 7bbb654e9c77a8692425dbd2c704ad245b86ec8a Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Wed, 27 Jul 2011 12:37:03 -0700 Subject: iscsi-target: Fix snprintf usage with MAX_PORTAL_LEN This patch makes lio_target_call_addnptotpg() use sprintf() with MAX_PORTAL_LEN + 1 to address the following smatch warning: drivers/target/iscsi/iscsi_target_configfs.c +184 lio_target_call_addnptotpg(21) error: snprintf() chops off the last chars of 'name': 257 vs 256 Reported-by: Dan Carpenter Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/iscsi_target_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index 32bb92c44450..f095e65b1ccf 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -181,7 +181,7 @@ struct se_tpg_np *lio_target_call_addnptotpg( return ERR_PTR(-EOVERFLOW); } memset(buf, 0, MAX_PORTAL_LEN + 1); - snprintf(buf, MAX_PORTAL_LEN, "%s", name); + snprintf(buf, MAX_PORTAL_LEN + 1, "%s", name); memset(&sockaddr, 0, sizeof(struct __kernel_sockaddr_storage)); -- cgit v1.2.3 From aadcec010127a20599500c7007fbe9998744be41 Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Wed, 27 Jul 2011 20:13:22 +0000 Subject: iscsi-target: Fix CONFIG_SMP=n and CONFIG_MODULES=n build failure This patch fixes the following CONFIG_SMP=n and CONFIG_MODULES=n build failure, because iscsit_thread_get_cpumask() is defined as a macro in iscsi_target.c, but needed by iscsi_target_login.c drivers/built-in.o: In function `iscsi_post_login_handler': iscsi_target_login.c:(.text+0x13a315): undefined reference to `iscsit_thread_get_cpumask' iscsi_target_login.c:(.text+0x13a4b4): undefined reference to `iscsit_thread_get_cpumask' make: *** [.tmp_vmlinux1] Error 1 Reported-by: Randy Dunlap Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/iscsi_target.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 3ab8abca29c3..c24fb10de60b 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -3468,7 +3468,12 @@ static inline void iscsit_thread_check_cpumask( } #else -#define iscsit_thread_get_cpumask(X) ({}) + +void iscsit_thread_get_cpumask(struct iscsi_conn *conn) +{ + return; +} + #define iscsit_thread_check_cpumask(X, Y, Z) ({}) #endif /* CONFIG_SMP */ -- cgit v1.2.3 From b9f5edc25036779bbff1272f8f94860d2d7a483b Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Wed, 27 Jul 2011 20:21:15 +0000 Subject: MAINTAINERS: Add target-devel list for drivers/target/ Reported-by: Randy Dunlap Signed-off-by: Nicholas Bellinger --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 41ec646d8a98..fcd29e36b84d 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6109,6 +6109,7 @@ F: include/linux/sysv_fs.h TARGET SUBSYSTEM M: Nicholas A. Bellinger L: linux-scsi@vger.kernel.org +L: target-devel@vger.kernel.org L: http://groups.google.com/group/linux-iscsi-target-dev W: http://www.linux-iscsi.org T: git git://git.kernel.org/pub/scm/linux/kernel/git/nab/lio-core-2.6.git master -- cgit v1.2.3 From 5db0753ba5aabcd9fa298029f03b32b3c96b5a39 Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Wed, 27 Jul 2011 22:18:52 -0700 Subject: target: Fix WRITE_SAME_16 lba assignment breakage This patch fixes a bug in WRITE_SAME_16 LBA assignment where get_unaligned_be16() is incorrectly being used instead of get_unaligned_be64() for a 64-bit LBA. This was introduced with: commit a1d8b49abd60ba5d09e7c968731abcb0f8f1cbf6 Author: Andy Grover Date: Mon May 2 17:12:10 2011 -0700 target: Updates from AGrover and HCH (round 3) (target: inline struct se_transport_task into struct se_cmd) Signed-off-by: Nicholas Bellinger --- drivers/target/target_core_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index c75a01a1c475..ff7fcf8366a0 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -3324,7 +3324,7 @@ static int transport_generic_cmd_sequencer( goto out_invalid_cdb_field; } - cmd->t_task_lba = get_unaligned_be16(&cdb[2]); + cmd->t_task_lba = get_unaligned_be64(&cdb[2]); passthrough = (dev->transport->transport_type == TRANSPORT_PLUGIN_PHBA_PDEV); /* -- cgit v1.2.3 From d52a10d003694e48d28cf0218db16372ed61f1bd Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 28 Jul 2011 09:48:19 -0700 Subject: target: iscsi_target depends on NET iscsi target code uses lots on network interface functions, so it should depend on NET. Fixes many build errors when NET is not enabled: ERROR: "kernel_sendmsg" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "in_aton" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "sock_release" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "kernel_listen" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "kernel_setsockopt" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "kernel_recvmsg" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "kernel_accept" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "sock_create" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "kernel_bind" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! ERROR: "in6_pton" [drivers/target/iscsi/iscsi_target_mod.ko] undefined! Signed-off-by: Randy Dunlap Signed-off-by: Nicholas Bellinger --- drivers/target/iscsi/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/target/iscsi/Kconfig b/drivers/target/iscsi/Kconfig index 564ff4e0dbc4..8345fb457a40 100644 --- a/drivers/target/iscsi/Kconfig +++ b/drivers/target/iscsi/Kconfig @@ -1,5 +1,6 @@ config ISCSI_TARGET tristate "Linux-iSCSI.org iSCSI Target Mode Stack" + depends on NET select CRYPTO select CRYPTO_CRC32C select CRYPTO_CRC32C_INTEL if X86 -- cgit v1.2.3 From dd8ae59d48790d5c25f47ebbe502c8ca379fdde0 Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Sat, 30 Jul 2011 05:03:58 -0700 Subject: target: Fix bug for transport_generic_wait_for_tasks with direct operation This patch fixes a bug in transport_handle_cdb_direct() usage with target_core where transport_generic_wait_for_tasks() was bypassing active I/O + usage of cmd->t_transport_stop_comp because cmd->t_transport_active=1 was not being set before dispatching with transport_generic_new_cmd(). The fix follows existing usage in transport_generic_handle_cdb*() -> transport_add_cmd_to_queue() and set these directly, as well as handle transport_generic_new_cmd() exceptions for QUEUE_FULL and CHECK_CONDITION instead of propigating up to RX context fabric code. The bug was manifesting itself with the following SLUB poison overwritten warnings with iscsi-target v4.1 LUNs using the new process context direct operation during session reinstatement with active I/O exception handling: [885410.498267] ============================================================================= [885410.621622] BUG lio_cmd_cache: Poison overwritten [885410.621791] ----------------------------------------------------------------------------- [885410.621792] [885410.623420] INFO: 0xffff880000cf3750-0xffff880000cf378d. First byte 0x6a instead of 0x6b [885410.626332] INFO: Allocated in iscsit_allocate_cmd+0x1c/0xd4 [iscsi_target_mod] age=345 cpu=1 pid=22554 [885411.855189] INFO: Freed in iscsit_release_cmd+0x208/0x217 [iscsi_target_mod] age=1410 cpu=1 pid=22554 [885411.856048] INFO: Slab 0xffffea000002d480 objects=22 used=0 fp=0xffff880000cf7300 flags=0x4080 [885411.856368] INFO: Object 0xffff880000cf33c0 @offset=13248 fp=0xffff880000cf6780 [885411.955678] Pid: 22554, comm: iscsi_trx Not tainted 3.0.0-rc7+ #30 [885411.956040] Call Trace: [885411.957029] [] print_trailer+0x12e/0x137 [885412.752879] [] check_bytes_and_report+0xb9/0xfd [885412.754933] [] check_object+0xb5/0x192 [885412.755099] [] __free_slab+0x96/0x13a [885412.757008] [] discard_slab+0x41/0x43 [885412.758171] [] __slab_free+0xf3/0xfe [885412.761027] [] ? iscsit_release_cmd+0x208/0x217 [iscsi_target_mod] [885412.761354] [] kmem_cache_free+0x6f/0xac [885412.761536] [] iscsit_release_cmd+0x208/0x217 [iscsi_target_mod] [885412.762056] [] ? iblock_free_task+0x34/0x39 [target_core_iblock] [885412.762368] [] lio_release_cmd+0x10/0x12 [iscsi_target_mod] [885412.764129] [] transport_release_cmd+0x2f/0x33 [target_core_mod] [885412.805024] [] transport_generic_remove+0xb6/0xc3 [target_core_mod] [885412.806424] [] ? try_to_wake_up+0x1bd/0x1bd [885412.809033] [] transport_generic_free_cmd+0x75/0x7d [target_core_mod] [885412.810066] [] transport_generic_wait_for_tasks+0x21c/0x22b [target_core_mod] [885412.811056] [] ? mutex_lock+0x11/0x32 [885412.813059] [] ? mutex_lock+0x11/0x32 [885412.813200] [] iscsit_close_connection+0x1d5/0x63a [iscsi_target_mod] [885412.813517] [] iscsit_take_action_for_connection_exit+0xdb/0xe0 [iscsi_target_mod] [885412.813851] [] iscsi_target_rx_thread+0x11f6/0x1221 [iscsi_target_mod] [885412.829024] [] ? pick_next_task_fair+0xbe/0x10e [885412.831010] [] ? iscsit_handle_scsi_cmd+0x91d/0x91d [iscsi_target_mod] [885412.833011] [] ? iscsit_handle_scsi_cmd+0x91d/0x91d [iscsi_target_mod] [885412.835010] [] kthread+0x7d/0x85 [885412.837022] [] kernel_thread_helper+0x4/0x10 [885412.838008] [] ? kthread_worker_fn+0x145/0x145 [885412.840047] [] ? gs_change+0x13/0x13 [885412.842007] FIX lio_cmd_cache: Restoring 0xffff880000cf3750-0xffff880000cf378d=0x6 Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger --- drivers/target/target_core_transport.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c index ff7fcf8366a0..89760329d5d0 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1747,6 +1747,8 @@ int transport_generic_handle_cdb( } EXPORT_SYMBOL(transport_generic_handle_cdb); +static void transport_generic_request_failure(struct se_cmd *, + struct se_device *, int, int); /* * Used by fabric module frontends to queue tasks directly. * Many only be used from process context only @@ -1754,6 +1756,8 @@ EXPORT_SYMBOL(transport_generic_handle_cdb); int transport_handle_cdb_direct( struct se_cmd *cmd) { + int ret; + if (!cmd->se_lun) { dump_stack(); pr_err("cmd->se_lun is NULL\n"); @@ -1765,8 +1769,31 @@ int transport_handle_cdb_direct( " from interrupt context\n"); return -EINVAL; } - - return transport_generic_new_cmd(cmd); + /* + * Set TRANSPORT_NEW_CMD state and cmd->t_transport_active=1 following + * transport_generic_handle_cdb*() -> transport_add_cmd_to_queue() + * in existing usage to ensure that outstanding descriptors are handled + * correctly during shutdown via transport_generic_wait_for_tasks() + * + * Also, we don't take cmd->t_state_lock here as we only expect + * this to be called for initial descriptor submission. + */ + cmd->t_state = TRANSPORT_NEW_CMD; + atomic_set(&cmd->t_transport_active, 1); + /* + * transport_generic_new_cmd() is already handling QUEUE_FULL, + * so follow TRANSPORT_NEW_CMD processing thread context usage + * and call transport_generic_request_failure() if necessary.. + */ + ret = transport_generic_new_cmd(cmd); + if (ret == -EAGAIN) + return 0; + else if (ret < 0) { + cmd->transport_error_status = ret; + transport_generic_request_failure(cmd, NULL, 0, + (cmd->data_direction != DMA_TO_DEVICE)); + } + return 0; } EXPORT_SYMBOL(transport_handle_cdb_direct); -- cgit v1.2.3 From dcd998ccdbf74a7d8fe0f0a44e85da1ed5975946 Mon Sep 17 00:00:00 2001 From: Kiran Patil Date: Wed, 3 Aug 2011 09:20:01 +0000 Subject: tcm_fc: Handle DDP/SW fc_frame_payload_get failures in ft_recv_write_data Problem: HW DDP context was not invalidated in case of ABORTS, etc... This leads to the problem where memory pages which are used for DDP as user descriptor could get reused for some other purpose (such as to satisfy new memory allocation request either by kernel or user mode threads) and since HW DDP context was not invalidated, HW continue to write to those pages, hence causing memory corruption. Fix: Either on incoming ABORTS or due to exchange time out, allowed the target to cleanup HW DDP context if it was setup for respective ft_cmd. Added new function to perform this cleanup, furthur it can be enhanced for other cleanup activity. Fix ft_recv_write_data() to properly handle fc_frame_payload_get to return pointer to payload if it exist. If there is no payload which is most common case (+ve case in case if DDP is working as expected, it will return NULL. Yes, scope of buf is limited to printk. Invalidation of HW context (which is done inside ft_invl_hw_context() is necessary in SUCCESS and FAILURE case of DDP. Hence invalidation is DONE as long as there was DDP setup (whether it worked correctly or not, NOTE: For some reason, if there is any error w.r.t DDP such as out of order packet reception, HW simply post the full packet in rx queue. Signed-off-by: Kiran Patil Cc: Robert W Love Signed-off-by: Nicholas A. Bellinger --- drivers/target/tcm_fc/tcm_fc.h | 5 ++ drivers/target/tcm_fc/tfc_cmd.c | 1 + drivers/target/tcm_fc/tfc_io.c | 121 ++++++++++++++++++++++++---------------- 3 files changed, 78 insertions(+), 49 deletions(-) diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h index f7fff7ed63c3..bd4fe21a23b8 100644 --- a/drivers/target/tcm_fc/tcm_fc.h +++ b/drivers/target/tcm_fc/tcm_fc.h @@ -187,4 +187,9 @@ void ft_dump_cmd(struct ft_cmd *, const char *caller); ssize_t ft_format_wwn(char *, size_t, u64); +/* + * Underlying HW specific helper function + */ +void ft_invl_hw_context(struct ft_cmd *); + #endif /* __TCM_FC_H__ */ diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c index a9e9a31da11d..03977e8996d8 100644 --- a/drivers/target/tcm_fc/tfc_cmd.c +++ b/drivers/target/tcm_fc/tfc_cmd.c @@ -320,6 +320,7 @@ static void ft_recv_seq(struct fc_seq *sp, struct fc_frame *fp, void *arg) default: pr_debug("%s: unhandled frame r_ctl %x\n", __func__, fh->fh_r_ctl); + ft_invl_hw_context(cmd); fc_frame_free(fp); transport_generic_free_cmd(&cmd->se_cmd, 0, 0); break; diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c index 11e6483fc127..06943eeb3c84 100644 --- a/drivers/target/tcm_fc/tfc_io.c +++ b/drivers/target/tcm_fc/tfc_io.c @@ -214,62 +214,49 @@ void ft_recv_write_data(struct ft_cmd *cmd, struct fc_frame *fp) if (!(ntoh24(fh->fh_f_ctl) & FC_FC_REL_OFF)) goto drop; + f_ctl = ntoh24(fh->fh_f_ctl); + ep = fc_seq_exch(seq); + lport = ep->lp; + if (cmd->was_ddp_setup) { + BUG_ON(!ep); + BUG_ON(!lport); + } + /* - * Doesn't expect even single byte of payload. Payload + * Doesn't expect payload if DDP is setup. Payload * is expected to be copied directly to user buffers - * due to DDP (Large Rx offload) feature, hence - * BUG_ON if BUF is non-NULL + * due to DDP (Large Rx offload), */ buf = fc_frame_payload_get(fp, 1); - if (cmd->was_ddp_setup && buf) { - pr_debug("%s: When DDP was setup, not expected to" - "receive frame with payload, Payload shall be" - "copied directly to buffer instead of coming " - "via. legacy receive queues\n", __func__); - BUG_ON(buf); - } + if (buf) + pr_err("%s: xid 0x%x, f_ctl 0x%x, cmd->sg %p, " + "cmd->sg_cnt 0x%x. DDP was setup" + " hence not expected to receive frame with " + "payload, Frame will be dropped if " + "'Sequence Initiative' bit in f_ctl is " + "not set\n", __func__, ep->xid, f_ctl, + cmd->sg, cmd->sg_cnt); + /* + * Invalidate HW DDP context if it was setup for respective + * command. Invalidation of HW DDP context is requited in both + * situation (success and error). + */ + ft_invl_hw_context(cmd); /* - * If ft_cmd indicated 'ddp_setup', in that case only the last frame - * should come with 'TSI bit being set'. If 'TSI bit is not set and if - * data frame appears here, means error condition. In both the cases - * release the DDP context (ddp_put) and in error case, as well - * initiate error recovery mechanism. + * If "Sequence Initiative (TSI)" bit set in f_ctl, means last + * write data frame is received successfully where payload is + * posted directly to user buffer and only the last frame's + * header is posted in receive queue. + * + * If "Sequence Initiative (TSI)" bit is not set, means error + * condition w.r.t. DDP, hence drop the packet and let explict + * ABORTS from other end of exchange timer trigger the recovery. */ - ep = fc_seq_exch(seq); - if (cmd->was_ddp_setup) { - BUG_ON(!ep); - lport = ep->lp; - BUG_ON(!lport); - } - if (cmd->was_ddp_setup && ep->xid != FC_XID_UNKNOWN) { - f_ctl = ntoh24(fh->fh_f_ctl); - /* - * If TSI bit set in f_ctl, means last write data frame is - * received successfully where payload is posted directly - * to user buffer and only the last frame's header is posted - * in legacy receive queue - */ - if (f_ctl & FC_FC_SEQ_INIT) { /* TSI bit set in FC frame */ - cmd->write_data_len = lport->tt.ddp_done(lport, - ep->xid); - goto last_frame; - } else { - /* - * Updating the write_data_len may be meaningless at - * this point, but just in case if required in future - * for debugging or any other purpose - */ - pr_err("%s: Received frame with TSI bit not" - " being SET, dropping the frame, " - "cmd->sg <%p>, cmd->sg_cnt <0x%x>\n", - __func__, cmd->sg, cmd->sg_cnt); - cmd->write_data_len = lport->tt.ddp_done(lport, - ep->xid); - lport->tt.seq_exch_abort(cmd->seq, 0); - goto drop; - } - } + if (f_ctl & FC_FC_SEQ_INIT) + goto last_frame; + else + goto drop; rel_off = ntohl(fh->fh_parm_offset); frame_len = fr_len(fp); @@ -332,3 +319,39 @@ last_frame: drop: fc_frame_free(fp); } + +/* + * Handle and cleanup any HW specific resources if + * received ABORTS, errors, timeouts. + */ +void ft_invl_hw_context(struct ft_cmd *cmd) +{ + struct fc_seq *seq = cmd->seq; + struct fc_exch *ep = NULL; + struct fc_lport *lport = NULL; + + BUG_ON(!cmd); + + /* Cleanup the DDP context in HW if DDP was setup */ + if (cmd->was_ddp_setup && seq) { + ep = fc_seq_exch(seq); + if (ep) { + lport = ep->lp; + if (lport && (ep->xid <= lport->lro_xid)) + /* + * "ddp_done" trigger invalidation of HW + * specific DDP context + */ + cmd->write_data_len = lport->tt.ddp_done(lport, + ep->xid); + + /* + * Resetting same variable to indicate HW's + * DDP context has been invalidated to avoid + * re_invalidation of same context (context is + * identified using ep->xid) + */ + cmd->was_ddp_setup = 0; + } + } +} -- cgit v1.2.3