Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Here are the outstanding target pending fixes for v3.12-rc7.
This includes a number of EXTENDED_COPY related fixes as a result of
Thomas and Doug's continuing testing and feedback.
Also included is an important vhost/scsi fix that addresses a long
standing issue where the 'write' parameter for get_user_pages_fast()
was incorrectly set for virtio-scsi WRITEs -> DMA_TO_DEVICE, and not
for virtio-scsi READs -> DMA_FROM_DEVICE.
This resulted in random userspace segfaults and other unpleasantness
on KVM host, and unfortunately has been an issue since the initial
merge of vhost/scsi in v3.6. This patch is CC'ed to stable, along
with two other less critical items"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter
target/pscsi: fix return value check
target: Fail XCOPY for non matching source + destination block_size
target: Generate failure for XCOPY I/O with non-zero scsi_status
target: Add missing XCOPY I/O operation sense_buffer
iser-target: check device before dereferencing its variable
target: Return an error for WRITE SAME with ANCHOR==1
target: Fix assignment of LUN in tracepoints
target: Reject EXTENDED_COPY when emulate_3pc is disabled
target: Allow non zero ListID in EXTENDED_COPY parameter list
target: Make target_do_xcopy failures return INVALID_PARAMETER_LIST
+50
-24
+1
-1
drivers/infiniband/ulp/isert/ib_isert.c
+1
-1
drivers/infiniband/ulp/isert/ib_isert.c
+4
-4
drivers/target/target_core_pscsi.c
+4
-4
drivers/target/target_core_pscsi.c
···
134
134
* pSCSI Host ID and enable for phba mode
135
135
*/
136
136
sh = scsi_host_lookup(phv->phv_host_id);
137
-
if (IS_ERR(sh)) {
137
+
if (!sh) {
138
138
pr_err("pSCSI: Unable to locate SCSI Host for"
139
139
" phv_host_id: %d\n", phv->phv_host_id);
140
-
return PTR_ERR(sh);
140
+
return -EINVAL;
141
141
}
142
142
143
143
phv->phv_lld_host = sh;
···
515
515
sh = phv->phv_lld_host;
516
516
} else {
517
517
sh = scsi_host_lookup(pdv->pdv_host_id);
518
-
if (IS_ERR(sh)) {
518
+
if (!sh) {
519
519
pr_err("pSCSI: Unable to locate"
520
520
" pdv_host_id: %d\n", pdv->pdv_host_id);
521
-
return PTR_ERR(sh);
521
+
return -EINVAL;
522
522
}
523
523
}
524
524
} else {
+5
drivers/target/target_core_sbc.c
+5
drivers/target/target_core_sbc.c
···
263
263
sectors, cmd->se_dev->dev_attrib.max_write_same_len);
264
264
return TCM_INVALID_CDB_FIELD;
265
265
}
266
+
/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
267
+
if (flags[0] & 0x10) {
268
+
pr_warn("WRITE SAME with ANCHOR not supported\n");
269
+
return TCM_INVALID_CDB_FIELD;
270
+
}
266
271
/*
267
272
* Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
268
273
* translated into block discard requests within backend code.
+37
-16
drivers/target/target_core_xcopy.c
+37
-16
drivers/target/target_core_xcopy.c
···
82
82
mutex_lock(&g_device_mutex);
83
83
list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
84
84
85
+
if (!se_dev->dev_attrib.emulate_3pc)
86
+
continue;
87
+
85
88
memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
86
89
target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
87
90
···
360
357
struct se_cmd se_cmd;
361
358
struct xcopy_op *xcopy_op;
362
359
struct completion xpt_passthrough_sem;
360
+
unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
363
361
};
364
362
365
363
static struct se_port xcopy_pt_port;
···
679
675
680
676
pr_debug("target_xcopy_issue_pt_cmd(): SCSI status: 0x%02x\n",
681
677
se_cmd->scsi_status);
682
-
return 0;
678
+
679
+
return (se_cmd->scsi_status) ? -EINVAL : 0;
683
680
}
684
681
685
682
static int target_xcopy_read_source(
···
713
708
(unsigned long long)src_lba, src_sectors, length);
714
709
715
710
transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
716
-
DMA_FROM_DEVICE, 0, NULL);
711
+
DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
717
712
xop->src_pt_cmd = xpt_cmd;
718
713
719
714
rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
···
773
768
(unsigned long long)dst_lba, dst_sectors, length);
774
769
775
770
transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
776
-
DMA_TO_DEVICE, 0, NULL);
771
+
DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
777
772
xop->dst_pt_cmd = xpt_cmd;
778
773
779
774
rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, dst_dev, &cdb[0],
···
889
884
890
885
sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
891
886
{
887
+
struct se_device *dev = se_cmd->se_dev;
892
888
struct xcopy_op *xop = NULL;
893
889
unsigned char *p = NULL, *seg_desc;
894
890
unsigned int list_id, list_id_usage, sdll, inline_dl, sa;
891
+
sense_reason_t ret = TCM_INVALID_PARAMETER_LIST;
895
892
int rc;
896
893
unsigned short tdll;
894
+
895
+
if (!dev->dev_attrib.emulate_3pc) {
896
+
pr_err("EXTENDED_COPY operation explicitly disabled\n");
897
+
return TCM_UNSUPPORTED_SCSI_OPCODE;
898
+
}
897
899
898
900
sa = se_cmd->t_task_cdb[1] & 0x1f;
899
901
if (sa != 0x00) {
···
908
896
return TCM_UNSUPPORTED_SCSI_OPCODE;
909
897
}
910
898
899
+
xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
900
+
if (!xop) {
901
+
pr_err("Unable to allocate xcopy_op\n");
902
+
return TCM_OUT_OF_RESOURCES;
903
+
}
904
+
xop->xop_se_cmd = se_cmd;
905
+
911
906
p = transport_kmap_data_sg(se_cmd);
912
907
if (!p) {
913
908
pr_err("transport_kmap_data_sg() failed in target_do_xcopy\n");
909
+
kfree(xop);
914
910
return TCM_OUT_OF_RESOURCES;
915
911
}
916
912
917
913
list_id = p[0];
918
-
if (list_id != 0x00) {
919
-
pr_err("XCOPY with non zero list_id: 0x%02x\n", list_id);
920
-
goto out;
921
-
}
922
-
list_id_usage = (p[1] & 0x18);
914
+
list_id_usage = (p[1] & 0x18) >> 3;
915
+
923
916
/*
924
917
* Determine TARGET DESCRIPTOR LIST LENGTH + SEGMENT DESCRIPTOR LIST LENGTH
925
918
*/
···
937
920
goto out;
938
921
}
939
922
940
-
xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
941
-
if (!xop) {
942
-
pr_err("Unable to allocate xcopy_op\n");
943
-
goto out;
944
-
}
945
-
xop->xop_se_cmd = se_cmd;
946
-
947
923
pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
948
924
" tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
949
925
tdll, sdll, inline_dl);
···
944
934
rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll);
945
935
if (rc <= 0)
946
936
goto out;
937
+
938
+
if (xop->src_dev->dev_attrib.block_size !=
939
+
xop->dst_dev->dev_attrib.block_size) {
940
+
pr_err("XCOPY: Non matching src_dev block_size: %u + dst_dev"
941
+
" block_size: %u currently unsupported\n",
942
+
xop->src_dev->dev_attrib.block_size,
943
+
xop->dst_dev->dev_attrib.block_size);
944
+
xcopy_pt_undepend_remotedev(xop);
945
+
ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
946
+
goto out;
947
+
}
947
948
948
949
pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
949
950
rc * XCOPY_TARGET_DESC_LEN);
···
978
957
if (p)
979
958
transport_kunmap_data_sg(se_cmd);
980
959
kfree(xop);
981
-
return TCM_INVALID_CDB_FIELD;
960
+
return ret;
982
961
}
983
962
984
963
static sense_reason_t target_rcr_operating_parameters(struct se_cmd *se_cmd)
+1
-1
drivers/vhost/scsi.c
+1
-1
drivers/vhost/scsi.c
···
1056
1056
if (data_direction != DMA_NONE) {
1057
1057
ret = vhost_scsi_map_iov_to_sgl(cmd,
1058
1058
&vq->iov[data_first], data_num,
1059
-
data_direction == DMA_TO_DEVICE);
1059
+
data_direction == DMA_FROM_DEVICE);
1060
1060
if (unlikely(ret)) {
1061
1061
vq_err(vq, "Failed to map iov to sgl\n");
1062
1062
goto err_free;
+2
-2
include/trace/events/target.h
+2
-2
include/trace/events/target.h
···
144
144
),
145
145
146
146
TP_fast_assign(
147
-
__entry->unpacked_lun = cmd->se_lun->unpacked_lun;
147
+
__entry->unpacked_lun = cmd->orig_fe_lun;
148
148
__entry->opcode = cmd->t_task_cdb[0];
149
149
__entry->data_length = cmd->data_length;
150
150
__entry->task_attribute = cmd->sam_task_attr;
···
182
182
),
183
183
184
184
TP_fast_assign(
185
-
__entry->unpacked_lun = cmd->se_lun->unpacked_lun;
185
+
__entry->unpacked_lun = cmd->orig_fe_lun;
186
186
__entry->opcode = cmd->t_task_cdb[0];
187
187
__entry->data_length = cmd->data_length;
188
188
__entry->task_attribute = cmd->sam_task_attr;