1. 24 Feb, 2011 1 commit
  2. 11 Apr, 2010 1 commit
  3. 29 Dec, 2008 2 commits
  4. 12 Jul, 2008 2 commits
  5. 12 Jan, 2008 6 commits
  6. 14 Nov, 2007 1 commit
    • Tony Battersby's avatar
      [SCSI] iscsi_tcp: fix potential lockup with write commands · 505f76b3
      Tony Battersby authored
      There is a race condition in iscsi_tcp.c that may cause it to forget
      that it received a R2T from the target.  This race may cause a data-out
      command (such as a write) to lock up.  The race occurs here:
      
      static int
      iscsi_send_unsol_pdu(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
      {
      	struct iscsi_tcp_cmd_task *tcp_ctask = ctask->dd_data;
      	int rc;
      
      	if (tcp_ctask->xmstate & XMSTATE_UNS_HDR) {
      		BUG_ON(!ctask->unsol_count);
      		tcp_ctask->xmstate &= ~XMSTATE_UNS_HDR; <---- RACE
      		...
      
      static int
      iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
      {
      	...
      	tcp_ctask->xmstate |= XMSTATE_SOL_HDR_INIT; <---- RACE
      	...
      
      While iscsi_xmitworker() (called from scsi_queue_work()) is preparing to
      send unsolicited data, iscsi_tcp_data_recv() (called from
      tcp_read_sock()) interrupts it upon receipt of a R2T from the target.
      Both contexts do read-modify-write of tcp_ctask->xmstate.  Usually, gcc
      on x86 will make &= and |= atomic on UP (not guaranteed of course), but
      in this case iscsi_send_unsol_pdu() reads the value of xmstate before
      clearing the bit, which causes gcc to read xmstate into a CPU register,
      test it, clear the bit, and then store it back to memory.  If the recv
      interrupt happens during this sequence, then the XMSTATE_SOL_HDR_INIT
      bit set by the recv interrupt will be lost, and the R2T will be
      forgotten.
      
      The patch below (against 2.6.24-rc1) converts accesses of xmstate to use
      set_bit, clear_bit, and test_bit instead of |= and &=.  I have tested
      this patch and verified that it fixes the problem.  Another possible
      approach would be to hold a lock during most of the rx/tx setup and
      post-processing, and drop the lock only for the actual rx/tx.
      Signed-off-by: default avatarTony Battersby <tonyb@cybernetics.com>
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
      505f76b3
  7. 02 Jun, 2007 1 commit
  8. 01 Jun, 2007 2 commits
  9. 21 Sep, 2006 1 commit
  10. 02 Sep, 2006 3 commits
    • Mike Christie's avatar
      [SCSI] scsi_tcp: rm data rx and tx tfms · dd8c0d95
      Mike Christie authored
      We currently allocated seperate tfms for data and header digests. There
      is no reason for this since we can never calculate a rx header and
      digest at the same time. Same for sends. So this patch removes the data
      tfms and has the send and recv sides use the rx_tfm or tx_tfm.
      
      I also made the connection creation code preallocate the tfms because I
      thought I hit a bug where I changed the digests settings during a
      relogin but could not allocate the tfm and then we just failed.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      dd8c0d95
    • Mike Christie's avatar
      [SCSI] iscsi_tcp: fix padding, data digests, and IO at weird offsets · 62f38300
      Mike Christie authored
      iscsi_tcp calculates padding by using the expected transfer length. This
      has the problem where if we have immediate data = no and initial R2T =
      yes, and the transfer length ended up needing padding then we send:
      
      1. header
      2. padding which should have gone after data
      3. data
      
      Besides this bug, we also assume the target will always ask for nice
      transfer lengths and the first burst length will always be a nice value.
      As far as I can tell form the RFC this is not a requirement. It would be
      silly to do this, but if someone did it we will end doing bad things.
      
      Finally the last bug in that bit of code is in our handling of the
      recalculation of data digests when we do not send a whole iscsi_buf in
      one try. The bug here is that we call crypto_digest_final on a
      iscsi_sendpage error, then when we send the rest of the iscsi_buf, we
      doiscsi_data_digest_init and this causes the previous data digest to be
      lost.
      
      And to make matters worse, some of these bugs are replicated over and
      over and over again for immediate data, solicited data and unsolicited
      data. So the attached patch made over the iscsi git tree (see
      kernel.org/git for details) which I updated today to include the patches
      I said I merged, consolidates the sending of data, padding and digests
      and calculation of data digests and fixes the above bugs.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      62f38300
    • Mike Christie's avatar
      [SCSI] libiscsi, iscsi_tcp, iscsi_iser: check that burst lengths are valid. · ffd0436e
      Mike Christie authored
      iSCSI RFC states that the first burst length must be smaller than the
      max burst length. We currently assume targets will be good, but that may
      not be the case, so this patch adds a check.
      
      This patch also moves the unsol data out offset to the lib so the LLDs
      do not have to track it.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      ffd0436e
  11. 28 Jul, 2006 1 commit
    • Mike Christie's avatar
      [SCSI] iscsi bugfixes: reduce memory allocations · c8dc1e52
      Mike Christie authored
      We currently try to allocate a max_recv_data_segment_length
      which can be very large (default is 64K), and common uses
      are up to 1MB. It is very very difficult to allocte this
      much contiguous memory and it turns out we never even use it.
      We really only need a couple of pages, so this patch has us
      allocates just what we know what we need today.
      
      Later if vendors start adding vendor specific data and
      we need to handle large buffers we can do this, but for
      the last 4 years we have not seen anyone do this or request
      it.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      c8dc1e52
  12. 20 May, 2006 1 commit
  13. 14 Apr, 2006 2 commits
    • Mike Christie's avatar
      [SCSI] iscsi: convert iscsi tcp to libiscsi · 5bb0b55a
      Mike Christie authored
      This just converts iscsi_tcp to the lib
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      5bb0b55a
    • Mike Christie's avatar
      [SCSI] iscsi: fix up iscsi eh · 30a6c652
      Mike Christie authored
      The current iscsi_tcp eh is not nicely setup for dm-multipath
      and performs some extra task management functions when they
      are not needed.
      
      The attached patch:
      
      - Fixes the TMF issues. If a session is rebuilt
      then we do not send aborts.
      
      - Fixes the problem where if the host reset fired, we would
      return SUCCESS even though we had not really done anything
      yet. This ends up causing problem with scsi_error.c's TUR.
      
      - If someone has turned on the userspace nop daemon code to try
      and detect network problems before the scsi command timeout
      we can now drop and clean up the session before the scsi command
      timesout and fires the eh speeding up the time it takes for a
      command to go from one patch to another. For network problems
      we fail the command with DID_BUS_BUSY so if failfast is set
      scsi_decide_disposition fails the command up to dm for it to
      try on another path.
      
      - And we had to add some basic iscsi session block code. Previously
      if we were trying to repair a session we would retrun a MLQUEUE code
      in the queuecommand. This worked but it was not the most efficient
      or pretty thing to do since it would take a while to relogin
      to the target. For iscsi_tcp/open-iscsi a lot of the iscsi error handler
      is in userspace the block code is pretty bare. We will be
      adding to that for qla4xxx.
      Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
      Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
      30a6c652
  14. 04 Feb, 2006 2 commits
  15. 14 Jan, 2006 2 commits
  16. 12 Jan, 2006 1 commit
  17. 14 Dec, 2005 1 commit
  18. 06 Aug, 2005 1 commit