Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Here are remaining target-pending items for v3.9-rc7 code.
The tcm_vhost patches are more than I'd usually include in a -rc7
pull, but are changes required for v3.9 to work correctly with the
pending vhost-scsi-pci QEMU upstream series merge. (Paolo CC'ed)
Plus Asias's conversion to use vhost_virtqueue->private_data + RCU for
managing vhost-scsi endpoints has gotten alot of review + testing over
the past weeks, and MST has ACKed the full series.
Also, there is a target patch to fix a long-standing bug within
control CDB handling with Standby/Offline/Transition ALUA port access
states, that had been incorrectly rejecting the control CDBs required
for LUN scan to work during these port group states. CC'ing to
stable."
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs
tcm_vhost: Send bad target to guest when cmd fails
tcm_vhost: Add vhost_scsi_send_bad_target() helper
tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq
tcm_vhost: Remove double check of response
tcm_vhost: Initialize vq->last_used_idx when set endpoint
tcm_vhost: Use vq->private_data to indicate if the endpoint is setup
tcm_vhost: Use ACCESS_ONCE for vs->vs_tpg[target] access
+133
-68
+3
drivers/target/target_core_alua.c
+3
drivers/target/target_core_alua.c
···
409
409
case REPORT_LUNS:
410
410
case RECEIVE_DIAGNOSTIC:
411
411
case SEND_DIAGNOSTIC:
412
+
return 0;
412
413
case MAINTENANCE_IN:
413
414
switch (cdb[1] & 0x1f) {
414
415
case MI_REPORT_TARGET_PGS:
···
452
451
switch (cdb[0]) {
453
452
case INQUIRY:
454
453
case REPORT_LUNS:
454
+
return 0;
455
455
case MAINTENANCE_IN:
456
456
switch (cdb[1] & 0x1f) {
457
457
case MI_REPORT_TARGET_PGS:
···
493
491
switch (cdb[0]) {
494
492
case INQUIRY:
495
493
case REPORT_LUNS:
494
+
return 0;
496
495
case MAINTENANCE_IN:
497
496
switch (cdb[1] & 0x1f) {
498
497
case MI_REPORT_TARGET_PGS:
+130
-68
drivers/vhost/tcm_vhost.c
+130
-68
drivers/vhost/tcm_vhost.c
···
74
74
75
75
struct vhost_scsi {
76
76
/* Protected by vhost_scsi->dev.mutex */
77
-
struct tcm_vhost_tpg *vs_tpg[VHOST_SCSI_MAX_TARGET];
77
+
struct tcm_vhost_tpg **vs_tpg;
78
78
char vs_vhost_wwpn[TRANSPORT_IQN_LEN];
79
-
bool vs_endpoint;
80
79
81
80
struct vhost_dev dev;
82
81
struct vhost_virtqueue vqs[VHOST_SCSI_MAX_VQ];
···
578
579
}
579
580
}
580
581
582
+
static void vhost_scsi_send_bad_target(struct vhost_scsi *vs,
583
+
struct vhost_virtqueue *vq, int head, unsigned out)
584
+
{
585
+
struct virtio_scsi_cmd_resp __user *resp;
586
+
struct virtio_scsi_cmd_resp rsp;
587
+
int ret;
588
+
589
+
memset(&rsp, 0, sizeof(rsp));
590
+
rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
591
+
resp = vq->iov[out].iov_base;
592
+
ret = __copy_to_user(resp, &rsp, sizeof(rsp));
593
+
if (!ret)
594
+
vhost_add_used_and_signal(&vs->dev, vq, head, 0);
595
+
else
596
+
pr_err("Faulted on virtio_scsi_cmd_resp\n");
597
+
}
598
+
581
599
static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
582
600
struct vhost_virtqueue *vq)
583
601
{
602
+
struct tcm_vhost_tpg **vs_tpg;
584
603
struct virtio_scsi_cmd_req v_req;
585
604
struct tcm_vhost_tpg *tv_tpg;
586
605
struct tcm_vhost_cmd *tv_cmd;
···
607
590
int head, ret;
608
591
u8 target;
609
592
610
-
/* Must use ioctl VHOST_SCSI_SET_ENDPOINT */
611
-
if (unlikely(!vs->vs_endpoint))
593
+
/*
594
+
* We can handle the vq only after the endpoint is setup by calling the
595
+
* VHOST_SCSI_SET_ENDPOINT ioctl.
596
+
*
597
+
* TODO: Check that we are running from vhost_worker which acts
598
+
* as read-side critical section for vhost kind of RCU.
599
+
* See the comments in struct vhost_virtqueue in drivers/vhost/vhost.h
600
+
*/
601
+
vs_tpg = rcu_dereference_check(vq->private_data, 1);
602
+
if (!vs_tpg)
612
603
return;
613
604
614
605
mutex_lock(&vq->mutex);
···
686
661
687
662
/* Extract the tpgt */
688
663
target = v_req.lun[1];
689
-
tv_tpg = vs->vs_tpg[target];
664
+
tv_tpg = ACCESS_ONCE(vs_tpg[target]);
690
665
691
666
/* Target does not exist, fail the request */
692
667
if (unlikely(!tv_tpg)) {
693
-
struct virtio_scsi_cmd_resp __user *resp;
694
-
struct virtio_scsi_cmd_resp rsp;
695
-
696
-
memset(&rsp, 0, sizeof(rsp));
697
-
rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
698
-
resp = vq->iov[out].iov_base;
699
-
ret = __copy_to_user(resp, &rsp, sizeof(rsp));
700
-
if (!ret)
701
-
vhost_add_used_and_signal(&vs->dev,
702
-
vq, head, 0);
703
-
else
704
-
pr_err("Faulted on virtio_scsi_cmd_resp\n");
705
-
668
+
vhost_scsi_send_bad_target(vs, vq, head, out);
706
669
continue;
707
670
}
708
671
···
703
690
if (IS_ERR(tv_cmd)) {
704
691
vq_err(vq, "vhost_scsi_allocate_cmd failed %ld\n",
705
692
PTR_ERR(tv_cmd));
706
-
break;
693
+
goto err_cmd;
707
694
}
708
695
pr_debug("Allocated tv_cmd: %p exp_data_len: %d, data_direction"
709
696
": %d\n", tv_cmd, exp_data_len, data_direction);
710
697
711
698
tv_cmd->tvc_vhost = vs;
712
699
tv_cmd->tvc_vq = vq;
713
-
714
-
if (unlikely(vq->iov[out].iov_len !=
715
-
sizeof(struct virtio_scsi_cmd_resp))) {
716
-
vq_err(vq, "Expecting virtio_scsi_cmd_resp, got %zu"
717
-
" bytes, out: %d, in: %d\n",
718
-
vq->iov[out].iov_len, out, in);
719
-
break;
720
-
}
721
-
722
700
tv_cmd->tvc_resp = vq->iov[out].iov_base;
723
701
724
702
/*
···
729
725
" exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
730
726
scsi_command_size(tv_cmd->tvc_cdb),
731
727
TCM_VHOST_MAX_CDB_SIZE);
732
-
break; /* TODO */
728
+
goto err_free;
733
729
}
734
730
tv_cmd->tvc_lun = ((v_req.lun[2] << 8) | v_req.lun[3]) & 0x3FFF;
735
731
···
742
738
data_direction == DMA_TO_DEVICE);
743
739
if (unlikely(ret)) {
744
740
vq_err(vq, "Failed to map iov to sgl\n");
745
-
break; /* TODO */
741
+
goto err_free;
746
742
}
747
743
}
748
744
···
762
758
queue_work(tcm_vhost_workqueue, &tv_cmd->work);
763
759
}
764
760
761
+
mutex_unlock(&vq->mutex);
762
+
return;
763
+
764
+
err_free:
765
+
vhost_scsi_free_cmd(tv_cmd);
766
+
err_cmd:
767
+
vhost_scsi_send_bad_target(vs, vq, head, out);
765
768
mutex_unlock(&vq->mutex);
766
769
}
767
770
···
791
780
vhost_scsi_handle_vq(vs, vq);
792
781
}
793
782
783
+
static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
784
+
{
785
+
vhost_poll_flush(&vs->dev.vqs[index].poll);
786
+
}
787
+
788
+
static void vhost_scsi_flush(struct vhost_scsi *vs)
789
+
{
790
+
int i;
791
+
792
+
for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
793
+
vhost_scsi_flush_vq(vs, i);
794
+
vhost_work_flush(&vs->dev, &vs->vs_completion_work);
795
+
}
796
+
794
797
/*
795
798
* Called from vhost_scsi_ioctl() context to walk the list of available
796
799
* tcm_vhost_tpg with an active struct tcm_vhost_nexus
···
815
790
{
816
791
struct tcm_vhost_tport *tv_tport;
817
792
struct tcm_vhost_tpg *tv_tpg;
793
+
struct tcm_vhost_tpg **vs_tpg;
794
+
struct vhost_virtqueue *vq;
795
+
int index, ret, i, len;
818
796
bool match = false;
819
-
int index, ret;
820
797
821
798
mutex_lock(&vs->dev.mutex);
822
799
/* Verify that ring has been setup correctly. */
···
829
802
return -EFAULT;
830
803
}
831
804
}
805
+
806
+
len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
807
+
vs_tpg = kzalloc(len, GFP_KERNEL);
808
+
if (!vs_tpg) {
809
+
mutex_unlock(&vs->dev.mutex);
810
+
return -ENOMEM;
811
+
}
812
+
if (vs->vs_tpg)
813
+
memcpy(vs_tpg, vs->vs_tpg, len);
832
814
833
815
mutex_lock(&tcm_vhost_mutex);
834
816
list_for_each_entry(tv_tpg, &tcm_vhost_list, tv_tpg_list) {
···
853
817
tv_tport = tv_tpg->tport;
854
818
855
819
if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
856
-
if (vs->vs_tpg[tv_tpg->tport_tpgt]) {
820
+
if (vs->vs_tpg && vs->vs_tpg[tv_tpg->tport_tpgt]) {
857
821
mutex_unlock(&tv_tpg->tv_tpg_mutex);
858
822
mutex_unlock(&tcm_vhost_mutex);
859
823
mutex_unlock(&vs->dev.mutex);
824
+
kfree(vs_tpg);
860
825
return -EEXIST;
861
826
}
862
827
tv_tpg->tv_tpg_vhost_count++;
863
-
vs->vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
828
+
vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
864
829
smp_mb__after_atomic_inc();
865
830
match = true;
866
831
}
···
872
835
if (match) {
873
836
memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
874
837
sizeof(vs->vs_vhost_wwpn));
875
-
vs->vs_endpoint = true;
838
+
for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
839
+
vq = &vs->vqs[i];
840
+
/* Flushing the vhost_work acts as synchronize_rcu */
841
+
mutex_lock(&vq->mutex);
842
+
rcu_assign_pointer(vq->private_data, vs_tpg);
843
+
vhost_init_used(vq);
844
+
mutex_unlock(&vq->mutex);
845
+
}
876
846
ret = 0;
877
847
} else {
878
848
ret = -EEXIST;
879
849
}
850
+
851
+
/*
852
+
* Act as synchronize_rcu to make sure access to
853
+
* old vs->vs_tpg is finished.
854
+
*/
855
+
vhost_scsi_flush(vs);
856
+
kfree(vs->vs_tpg);
857
+
vs->vs_tpg = vs_tpg;
880
858
881
859
mutex_unlock(&vs->dev.mutex);
882
860
return ret;
···
903
851
{
904
852
struct tcm_vhost_tport *tv_tport;
905
853
struct tcm_vhost_tpg *tv_tpg;
854
+
struct vhost_virtqueue *vq;
855
+
bool match = false;
906
856
int index, ret, i;
907
857
u8 target;
908
858
···
916
862
goto err_dev;
917
863
}
918
864
}
865
+
866
+
if (!vs->vs_tpg) {
867
+
mutex_unlock(&vs->dev.mutex);
868
+
return 0;
869
+
}
870
+
919
871
for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
920
872
target = i;
921
-
922
873
tv_tpg = vs->vs_tpg[target];
923
874
if (!tv_tpg)
924
875
continue;
···
945
886
}
946
887
tv_tpg->tv_tpg_vhost_count--;
947
888
vs->vs_tpg[target] = NULL;
948
-
vs->vs_endpoint = false;
889
+
match = true;
949
890
mutex_unlock(&tv_tpg->tv_tpg_mutex);
950
891
}
892
+
if (match) {
893
+
for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
894
+
vq = &vs->vqs[i];
895
+
/* Flushing the vhost_work acts as synchronize_rcu */
896
+
mutex_lock(&vq->mutex);
897
+
rcu_assign_pointer(vq->private_data, NULL);
898
+
mutex_unlock(&vq->mutex);
899
+
}
900
+
}
901
+
/*
902
+
* Act as synchronize_rcu to make sure access to
903
+
* old vs->vs_tpg is finished.
904
+
*/
905
+
vhost_scsi_flush(vs);
906
+
kfree(vs->vs_tpg);
907
+
vs->vs_tpg = NULL;
951
908
mutex_unlock(&vs->dev.mutex);
909
+
952
910
return 0;
953
911
954
912
err_tpg:
···
973
897
err_dev:
974
898
mutex_unlock(&vs->dev.mutex);
975
899
return ret;
900
+
}
901
+
902
+
static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
903
+
{
904
+
if (features & ~VHOST_SCSI_FEATURES)
905
+
return -EOPNOTSUPP;
906
+
907
+
mutex_lock(&vs->dev.mutex);
908
+
if ((features & (1 << VHOST_F_LOG_ALL)) &&
909
+
!vhost_log_access_ok(&vs->dev)) {
910
+
mutex_unlock(&vs->dev.mutex);
911
+
return -EFAULT;
912
+
}
913
+
vs->dev.acked_features = features;
914
+
smp_wmb();
915
+
vhost_scsi_flush(vs);
916
+
mutex_unlock(&vs->dev.mutex);
917
+
return 0;
976
918
}
977
919
978
920
static int vhost_scsi_open(struct inode *inode, struct file *f)
···
1030
936
vhost_dev_stop(&s->dev);
1031
937
vhost_dev_cleanup(&s->dev, false);
1032
938
kfree(s);
1033
-
return 0;
1034
-
}
1035
-
1036
-
static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
1037
-
{
1038
-
vhost_poll_flush(&vs->dev.vqs[index].poll);
1039
-
}
1040
-
1041
-
static void vhost_scsi_flush(struct vhost_scsi *vs)
1042
-
{
1043
-
int i;
1044
-
1045
-
for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
1046
-
vhost_scsi_flush_vq(vs, i);
1047
-
vhost_work_flush(&vs->dev, &vs->vs_completion_work);
1048
-
}
1049
-
1050
-
static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
1051
-
{
1052
-
if (features & ~VHOST_SCSI_FEATURES)
1053
-
return -EOPNOTSUPP;
1054
-
1055
-
mutex_lock(&vs->dev.mutex);
1056
-
if ((features & (1 << VHOST_F_LOG_ALL)) &&
1057
-
!vhost_log_access_ok(&vs->dev)) {
1058
-
mutex_unlock(&vs->dev.mutex);
1059
-
return -EFAULT;
1060
-
}
1061
-
vs->dev.acked_features = features;
1062
-
smp_wmb();
1063
-
vhost_scsi_flush(vs);
1064
-
mutex_unlock(&vs->dev.mutex);
1065
939
return 0;
1066
940
}
1067
941