linux-stable.git/include/target/target_core_base.h, branch linux-5.4.y

scsi: target: Fix ordered tag handling

2021-11-26T09:47:16+00:00

[ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ]

This patch fixes the following bugs:

1. If there are multiple ordered cmds queued and multiple simple cmds
   completing, target_restart_delayed_cmds() could be called on different
   CPUs and each instance could start a ordered cmd. They could then run in
   different orders than they were queued.

2. target_restart_delayed_cmds() and target_handle_task_attr() can race
   where:

   1. target_handle_task_attr() has passed the simple_cmds == 0 check.

   2. transport_complete_task_attr() then decrements simple_cmds to 0.

   3. transport_complete_task_attr() runs target_restart_delayed_cmds() and
      it does not see any cmds on the delayed_cmd_list.

   4. target_handle_task_attr() adds the cmd to the delayed_cmd_list.

   The cmd will then end up timing out.

3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute
   them out of order, because target_handle_task_attr() will hit that
   simple_cmds check first and return false for all ordered cmds sent.

4. We run target_restart_delayed_cmds() after every cmd completion, so if
   there is more than 1 simple cmd running, we start executing ordered cmds
   after that first cmd instead of waiting for all of them to complete.

5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older
   cmds have completed, and not just simple.

6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock
   for every cmd completion when ordered cmds are almost never used. Just
   replacing that lock with an atomic increases IOPs by up to 10% when
   completions are spread over multiple CPUs and there are multiple
   sessions/ mqs/thread accessing the same device.

This patch moves the queued delayed handling to a per device work to
serialze the cmd executions for each device and adds a new counter to track
HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to
determine when to run the work on the completion path.

Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com
Signed-off-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin

scsi: target/core: Rework the SPC-2 reservation handling code

2019-04-13T00:20:05+00:00

Instead of tracking the initiator that established an SPC-2 reservation,
track the session through which the SPC-2 reservation has been
established. This patch does not change any functionality.

Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Cc: Nicholas Bellinger 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Remove several state tests from the TMF code

2019-02-05T02:25:13+00:00

Whether or not a session is being torn down does not affect whether or not
SCSI commands are in the task set. Hence remove the "tearing down" checks
from the TMF code. The TRANSPORT_ISTATE_PROCESSING check is left out
because it is now safe to wait for a command that is in that state. The
CMD_T_PRE_EXECUTE is left out because abort processing is postponed until
after commands have left the pre-execute state since the patch that makes
TMF processing synchronous.

See also commit 1c21a48055a6 ("target: Avoid early CMD_T_PRE_EXECUTE
failures during ABORT_TASK").

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target: consistently null-terminate t10_wwn strings

2018-12-08T02:54:33+00:00

In preparation for supporting user provided vendor strings, add an extra
byte to the vendor, model and revision arrays in struct t10_wwn. This
ensures that the full INQUIRY data can be carried in the arrays along with
a null-terminator.

Change a number of array readers and writers so that they account for
explicit null-termination:

- The pscsi_set_inquiry_info() and emulate_model_alias_store() codepaths
  don't currently explicitly null-terminate; fix this.

- Existing t10_wwn field dumps use for-loops which step over
  null-terminators for right-padding.
  + Use printf with width specifiers instead.

Signed-off-by: David Disseldorp 
Reviewed-by: Roman Bolshakov 
Signed-off-by: Martin K. Petersen

scsi: target/core: Fix TAS handling for aborted commands

2018-12-08T02:22:15+00:00

The TASK ABORTED STATUS (TAS) bit is defined as follows in SAM:
"TASK_ABORTED: this status shall be returned if a command is aborted by a
command or task management function on another I_T nexus and the control
mode page TAS bit is set to one". TAS handling is spread over the target
core and the iSCSI target driver. If a LUN RESET is received, the target
core will send the TASK_ABORTED response for all commands for which such a
response has to be sent. If an ABORT TASK is received, only the iSCSI
target driver will send the TASK_ABORTED response for the commands for
which that response has to be sent.  That is a bug since all target drivers
have to honor the TAS bit. Fix this by moving the code that handles TAS
from the iSCSI target driver into the target core. Additionally, if a
command has been aborted, instead of sending the TASK_ABORTED status from
the context that processes the SCSI command send it from the context of the
ABORT TMF.  The core_tmr_abort_task() change in this patch causes the
CMD_T_TAS flag to be set if a TASK_ABORTED status has to be sent back to
the initiator that submitted the command. If that flag has been set
transport_cmd_finish_abort() will send the TASK_ABORTED response.

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Make it possible to wait from more than one context for command completion

2018-12-08T02:20:07+00:00

This patch does not change any functionality but makes the patch that makes
TMF handling synchronous easier to read.

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Use system workqueues for TMF

2018-12-08T02:20:07+00:00

A quote from SAM-5: "The order in which task management requests are
processed is not specified by the SCSI architecture model.  The SCSI
architecture model does not require in-order delivery of such task
management requests or processing by the task manager in the order
received. To guarantee the processing order of task management requests
referencing sent to a specific logical unit, an application client should
not have more than one such task management request pending to that logical
unit." This means that it is safe to use the system workqueues instead of
tmr_wq for processing TMFs. An intended side effect of this patch is that
it enables concurrent processing of TMFs.

Reviewed-by: Christoph Hellwig 
Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough

2018-12-08T02:20:07+00:00

A session must only be released after all code that accesses the session
structure has finished. Make sure that this is the case by introducing a
new command counter per session that is only decremented after the
.release_cmd() callback has finished. This patch fixes the following crash:

BUG: KASAN: use-after-free in do_raw_spin_lock+0x1c/0x130
Read of size 4 at addr ffff8801534b16e4 by task rmdir/14805
CPU: 16 PID: 14805 Comm: rmdir Not tainted 4.18.0-rc2-dbg+ #5
Call Trace:
dump_stack+0xa4/0xf5
print_address_description+0x6f/0x270
kasan_report+0x241/0x360
__asan_load4+0x78/0x80
do_raw_spin_lock+0x1c/0x130
_raw_spin_lock_irqsave+0x52/0x60
srpt_set_ch_state+0x27/0x70 [ib_srpt]
srpt_disconnect_ch+0x1b/0xc0 [ib_srpt]
srpt_close_session+0xa8/0x260 [ib_srpt]
target_shutdown_sessions+0x170/0x180 [target_core_mod]
core_tpg_del_initiator_node_acl+0xf3/0x200 [target_core_mod]
target_fabric_nacl_base_release+0x25/0x30 [target_core_mod]
config_item_release+0x9c/0x110 [configfs]
config_item_put+0x26/0x30 [configfs]
configfs_rmdir+0x3b8/0x510 [configfs]
vfs_rmdir+0xb3/0x1e0
do_rmdir+0x262/0x2c0
do_syscall_64+0x77/0x230
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target/core: Simplify transport_clear_lun_ref()

2018-12-08T02:20:07+00:00

Since transport_clear_lun_ref() already waits until the percpu-refcount
.release() method is called, it is not necessary to wait first until
percpu_ref_kill_and_confirm() has finished transitioning the refcount into
atomic mode. Remove the code that waits for percpu_ref_kill_and_confirm()
to complete and also the completion object that is used by that code.  This
patch does not change the behavior of the SCSI target code.

Cc: Nicholas Bellinger 
Cc: Mike Christie 
Cc: Christoph Hellwig 
Cc: David Disseldorp 
Cc: Hannes Reinecke 
Signed-off-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen

scsi: target: drop unused pi_prot_format attribute storage

2018-11-28T23:50:53+00:00

On write, the pi_prot_format configfs attribute invokes the device
format_prot() callback if present. Read dumps the contents of
se_dev_attrib.pi_prot_format which is always zero.  Make the configfs
attribute write-only, and drop the always zero se_dev_attrib.pi_prot_format
storage.

Signed-off-by: David Disseldorp 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen