This patch changes iscsit_do_tx_data() to fail on short writes
when kernel_sendmsg() returns a value different than requested
transfer length, returning -EPIPE and thus causing a connection
reset to occur.

This avoids a potential bug in the original code where a short
write would result in kernel_sendmsg() being called again with
the original iovec base + length.

In practice this has not been an issue because iscsit_do_tx_data()
is only used for transferring 48 byte headers + 4 byte digests,
along with seldom used control payloads from NOPIN + TEXT_RSP +
REJECT with less than 32k of data.

So following Al's audit of iovec consumers, go ahead and fail
the connection on short writes for now, and remove the bogus
logic ahead of his proper upstream fix.
Reported-by: NAl Viro <viro@zeniv.linux.org.uk>
Cc: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

In case login sequence failed, make sure conn->sess is
NULL before calling wait_conn as some transports (iser)
may rely on that (waiting for session commands).
Signed-off-by: NSagi Grimberg <sagig@mellanox.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch fixes an issue with AllRegistrants reservations where
an unregister operation by the I_T nexus reservation holder would
incorrectly drop the reservation, instead of waiting until the
last active I_T nexus is unregistered as per SPC-4.

This includes updating __core_scsi3_complete_pro_release() to reset
dev->dev_pr_res_holder with another pr_reg for this special case,
as well as a new 'unreg' parameter to determine when the release
is occuring from an implicit unregister, vs. explicit RELEASE.

It also adds special handling in core_scsi3_free_pr_reg_from_nacl()
to release the left-over pr_res_holder, now that pr_reg is deleted
from pr_reg_list within __core_scsi3_complete_pro_release().
Reported-by: NIlias Tsitsimpis <i.tsitsimpis@gmail.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch fixes the usage of R_HOLDER bit for an All Registrants
reservation in READ_FULL_STATUS, where only the registration who
issued RESERVE was being reported as having an active reservation.

It changes core_scsi3_pri_read_full_status() to check ahead of the
list walk of active registrations to see if All Registrants is active,
and if so set R_HOLDER bit and scope/type fields for all active
registrations.
Reported-by: NIlias Tsitsimpis <i.tsitsimpis@gmail.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch drops the left-over iscsi_np->tpg_np pointer, now
that iser-target PI is able to dynamically allocate PI contexts
per I/O, instead of needing to determine support using a TPG
attribute with this bogus reference.

Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

iSER will report supported protection operations based on
the tpg attribute t10_pi settings and HCA PI offload capabilities.
If the HCA does not support PI offload or tpg attribute t10_pi is
not set, we fall to SW PI mode.

In order to do that, we move iscsit_get_sup_prot_ops after connection
tpg assignment.
Signed-off-by: NSagi Grimberg <sagig@mellanox.com>
Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Since commit 0fc4ea70 ("Target/iser: Don't put isert_conn inside
disconnected handler") we put the conn kref in isert_wait_conn, so we
need .wait_conn to be invoked also in the error path.

Introduce call to isert_conn_terminate (called under lock)
which transitions the connection state to TERMINATING and calls
rdma_disconnect. If the state is already teminating, just bail
out back (temination started).

Also, make sure to destroy the connection when getting a connect
error event if didn't get to connected (state UP). Same for the
handling of REJECTED and UNREACHABLE cma events.

Squashed:

iscsi-target: Add call to wait_conn in establishment error flow
Reported-by: NSlava Shwartsman <valyushash@gmail.com>
Signed-off-by: NSagi Grimberg <sagig@mellanox.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Delete a local array that is only used to be initialized by memset.

A semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier x;
type T;
@@

{
... when any
-T x[...];
<+... when != x
- memset(x,...);
...+>
}
// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

In iscsi_target_init_module() unwind transport protocol registration in case
that iscsit_load_discovery_tpg() failed.
Signed-off-by: NLino Sanfilippo <LinoSanfilippo@gmx.de>
Reviewed-by: NSagi Grimberg <sagig@mellanox.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

tcm_loop has the I_T nexus associated with the HBA. This causes
commands to become misdirected if the HBA has more than one
target portal group; any command is then being sent to the
first target portal group instead of the correct one.

The nexus needs to be associated with the target portal group
instead.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Cc: <stable@vger.kernel.org> # 3.0+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Now that PSCSI is only exposing four hw_* read-only device attributes,
go ahead and drop the left-over -> legacy PHBA_PDEV checks in various
se_dev_set_* code, since it's now only used by virtual devices.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Now that backend drivers are populating their own device attributes,
go ahead and remove left-over definitions + internal attribute list
of device attributes from target_core_configfs.c code

Also update TB_CIT_SETUP(dev_attrib,...) to signal ct_attr = NULL.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch converts PSCSI to use an external set of device attributes,
and utilizes target_core_backend_configfs.h macros to generate a default
set of configfs extended-attr handlers.

It calls target_core_setup_sub_cits() to setup the initial config_item_type
based on existing target_core_configfs.c defaults, and using configfs_attribute
for hw_pi_prot_type, hw_block_size, hw_max_sectors, hw_queue_depth populates
pscsi_backend_dev_attrs[]

Only these four hw_* read-only device attributes are exports for PSCSI.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch converts TCM-USER to use an external set of device attributes,
and utilizes target_core_backend_configfs.h macros to generate a default
set of configfs extended-attr handlers.

It calls target_core_setup_sub_cits() to setup the initial config_item_type
based on existing target_core_configfs.c defaults, and using configfs_attribute
generated by DEF_TB_DEFAULT_ATTRIBS(tcmu) populates tcmu_backend_dev_attrs[]

It introduces no function change for existing TCMU device attributes.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch converts RAMDISK to use an external set of device attributes,
and utilizes target_core_backend_configfs.h macros to generate a default
set of configfs extended-attr handlers.

It calls target_core_setup_sub_cits() to setup the initial config_item_type
based on existing target_core_configfs.c defaults, and using configfs_attribute
generated by DEF_TB_DEFAULT_ATTRIBS(rc_mcp) populates rd_mcp_backend_dev_attrs[]

It introduces no functional change for existing RD_MCP device attributes.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch converts FILEIO to use an external set of device attributes,
and utilizes target_core_backend_configfs.h macros to generate a default
set of configfs extended-attr handlers.

It calls target_core_setup_sub_cits() to setup the initial config_item_type
based on existing target_core_configfs.c defaults, and using configfs_attribute
generated by DEF_TB_DEFAULT_ATTRIBS(fileio) populates fileio_backend_dev_attrs[]

It introduces no functional change for existing FILEIO device attributes.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch converts IBLOCK to use an external set of device attributes,
and utilizes target_core_backend_configfs.h macros to generate a default
set of configfs extended-attr handlers.

It calls target_core_setup_sub_cits() to setup the initial config_item_type
based on existing target_core_configfs.c defaults, and using configfs_attribute
generated by DEF_TB_DEFAULT_ATTRIBS(iblock) populates iblock_backend_dev_attrs[]

It introduces no functional change for existing IBLOCK device attributes.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Now that target_core_backend_configfs.h macros will be using these
se_dev_set attribute functions externally to allow backend drivers
to populate different attributes, go ahead and add EXPORT_SYMBOL()
for the existing default set of 30 device attributes.

Also update target_core_backend.h with proper function prototypes.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds support for dev_stat_cit as an external config_item_type
using TB_CIT_SETUP() helper macro, and sets only ct_group_ops following
existing code.

It updates target_core_make_subdev() + target_core_setup_dev_attrib_cit() +
struct target_backend_cits, and drops left-over target_core_dev_stat_cit
from target_core_configfs.c code and update comments.

This patch introduces no functional change from existing code.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds support for dev_alua_tg_pt_gps_cit as an external config_item_type
using TB_CIT_SETUP() helper macro, and sets only ct_group_ops following
existing code.

It updates target_core_make_subdev() + target_core_setup_dev_attrib_cit() +
struct target_backend_cits, and drops left-over target_core_dev_alua_tg_pt_gps_cit
from target_core_configfs.c code and update comments.

This patch introduces no functional change from existing code.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds support for dev_wwn_cit as an external config_item_type
using TB_CIT_SETUP() helper macro, and sets both ct_item_ops + ct_attr
following existing code.

It updates target_core_make_subdev() + target_core_setup_dev_attrib_cit() +
struct target_backend_cits, and drops left-over target_core_dev_wwn_cit
from target_core_configfs.c code and update comments.

This patch introduces no functional change from existing code.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds support for dev_pr_cit as an external config_item_type
using TB_CIT_SETUP() helper macro, and sets both ct_item_ops + ct_attr
following existing code.

It updates target_core_make_subdev() + target_core_setup_dev_attrib_cit() +
struct target_backend_cits, and drops left-over target_core_dev_pr_cit
from target_core_configfs.c code and update comments.

This patch introduces no functional change from existing code.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds support for dev_attrib_cit as an external config_item_type
using TB_CIT_SETUP() helper macro, and sets both ct_item_ops + ct_attr
following existing code.

It updates target_core_make_subdev() + target_core_setup_dev_attrib_cit() +
struct target_backend_cits, and drops left-over target_core_dev_attrib_cit
from target_core_configfs.c code and update comments.

This patch introduces no functional change from existing code.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds initial support for dev_cit as external config_item_type.

This includes a new struct target_backend_cits to hold the external CITs
within struct se_subsystem_api, and target_core_setup_sub_cits() to be
used by backend drivers ahead of transport_subsystem_register().

It adds a TB_CIT_SETUP() helper following target_core_fabric_configfs.c
to perform the config_item_type assignments.

Also, drop left-over target_core_dev_cit from target_core_configfs.c code
and update comments.
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The module_put() function tests whether its argument is NULL and then
returns immediately. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

If we try to create a fabric directory in configfs for one of the
default hard-coded fabric modules (iscsi and loopback), and that
fabric is actually built into the kernel, then the operation will
spuriously fail because request_module() (for the code that's already
linked into the kernel) fails.

Fix this by running the autoprobing code only if an initial
target_core_get_fabric() fails.
Signed-off-by: NRoland Dreier <roland@purestorage.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

PREEMPT (and PREEMPT AND ABORT) should return CONFLICT iff a specified
SERVICE ACTION RESERVATION KEY is specified and matches no existing
persistent reservation.

Without this patch, a PREEMPT will return CONFLICT if either all
reservations are held by the initiator (self preemption) or there is
nothing to preempt. According to the spec, both of these cases should
succeed.
Signed-off-by: NSteven Allen <steven.allen@purestorage.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The fact that a target is published on the any address has no bearing on
which port(s) it is published. SendTargets should always send the
portal's port, not the port used for discovery.
Signed-off-by: NSteven Allen <steven.allen@purestorage.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
sets the transfer direction in the transport layer to indicate a
data-out phase, we still shouldn't try to transfer data.  At best it's
a NOP, and depending on the transport, we might crash on an
uninitialized sg list.
Reported-by: NCraig Watson <craig.watson@vanguard-rugged.com>
Signed-off-by: NRoland Dreier <roland@purestorage.com>
Cc: <stable@vger.kernel.org> # 3.1
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Both of the file target's calls to vfs_fsync_range() got the end offset
off by one.  The range is inclusive, not exclusive.  It would sync a bit
more data than was required.

The sync path already tested the length of the range and fell back to
LLONG_MAX so I copied that pattern in the rw path.

This is untested. I found the errors by inspection while following other
code.
Signed-off-by: NZach Brown <zab@zabbo.net>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch adds a force_pr_aptpl device attribute used to force SPC-3 PR
Activate Persistence across Target Power Loss (APTPL) operation.  This
makes PR metadata write-out occur during state change regardless if new
PERSISTENT_RESERVE_OUT CDBs have their APTPL feature bit set.

This is useful during H/A failover in active/passive setups where all PR
state is being re-created on a different node, driven by configfs backend
device + export layout and pre-loaded $DEV/pr/res_aptpl_metadata.

Cc: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch fixes a bug in handling of SPC-3 PR Activate Persistence
across Target Power Loss (APTPL) logic where re-creation of state for
MappedLUNs from dynamically generated NodeACLs did not occur during
I_T Nexus establishment.

It adds the missing core_scsi3_check_aptpl_registration() call during
core_tpg_check_initiator_node_acl() -> core_tpg_add_node_to_devs() in
order to replay any pre-loaded APTPL metadata state associated with
the newly connected SCSI Initiator Port.

Cc: Mike Christie <michaelc@cs.wisc.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

If more than one thread is waiting for command ring space that includes
a PAD, then if the first one finishes (inserts a PAD and a CMD at the
start of the cmd ring) then the second one will incorrectly think it still
needs to insert a PAD (i.e. cmdr_space_needed is now wrong.) This will
lead to it asking for more space than it actually needs, and then inserting
a PAD somewhere else than at the end -- not what we want.

This patch moves the pad calculation inside is_ring_space_available() so
in the above scenario the second thread would then ask for space not
including a PAD. The patch also inserts a PAD op based upon an up-to-date
cmd_head, instead of the potentially stale value.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The SCSI command tag is set to the tag assigned from the block
layer, not the SCSI-II tag message. So we need to convert
it into the correct SCSI-II tag message based on the
device flags, not the tag value itself.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Reviewed-by: NSagi Grimberg <sagig@mellanox.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch fixes up the following unused return smatch warnings:

  drivers/target/target_core_user.c:778 tcmu_netlink_event warn: unused return: ret = nla_put_string()
  drivers/target/target_core_user.c:780 tcmu_netlink_event warn: unused `return: ret = nla_put_u32()

(Fix up missing semicolon: grover)
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Add a LIO storage engine that presents commands to userspace for execution.
This would allow more complex backstores to be implemented out-of-kernel,
and also make experimentation a-la FUSE (but at the SCSI level -- "SUSE"?)
possible.

It uses a mmap()able UIO device per LUN to share a command ring and data
area. The commands are raw SCSI CDBs and iovs for in/out data. The command
ring is also reused for returning scsi command status and optional sense
data.

This implementation is based on Shaohua Li's earlier version but heavily
modified. Differences include:

* Shared memory allocated by kernel, not locked-down user pages
* Single ring for command request and response
* Offsets instead of embedded pointers
* Generic SCSI CDB passthrough instead of per-cmd specialization in ring
  format.
* Uses UIO device instead of anon_file passed in mailbox.
* Optional in-kernel handling of some commands.

The main reason for these differences is to permit greater resiliency
if the user process dies or hangs.

Things not yet implemented (on purpose):

* Zero copy. The data area is flexible enough to allow page flipping or
  backend-allocated pages to be used by fabrics, but it's not clear these
  are performance wins. Can come later.
* Out-of-order command completion by userspace. Possible to add by just
  allowing userspace to change cmd_id in rsp cmd entries, but currently
  not supported.
* No locks between kernel cmd submission and completion routines. Sounds
  like it's possible, but this can come later.
* Sparse allocation of mmaped area. Current code vmallocs the whole thing.
  If the mapped area was larger and not fully mapped then the driver would
  have more freedom to change cmd and data area sizes based on demand.

Current code open issues:

* The use of idrs may be overkill -- we maybe can replace them with a
  simple counter to generate cmd_ids, and a hash table to get a cmd_id's
  associated pointer.
* Use of a free-running counter for cmd ring instead of explicit modulo
  math. This would require power-of-2 cmd ring size.

(Add kconfig depends NET - Randy)
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The check of SCF_SCSI_DATA_CDB seems to be a remnant from before hch's
refactoring of this function. There are no places where that flag is set
that cmd->execute_cmd isn't also set.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

During temporary resource starvation at lower transport layer, command
is placed on queue full retry path, which expose this problem.  The TCM
queue full handling of SCF_TRANSPORT_TASK_SENSE currently sends the same
cmd twice to lower layer.  The 1st time led to cmd normal free path.
The 2nd time cause Null pointer access.

This regression bug was originally introduced v3.1-rc code in the
following commit:

commit e057f533
Author: Christoph Hellwig <hch@infradead.org>
Date:   Mon Oct 17 13:56:41 2011 -0400

    target: remove the transport_qf_callback se_cmd callback
Signed-off-by: NQuinn Tran <quinn.tran@qlogic.com>
Signed-off-by: NSaurav Kashyap <saurav.kashyap@qlogic.com>
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

list_for_each_entry_safe is necessary if list objects are deleted from
the list while traversing it.  Not the case here, so we can use the base
list_for_each_entry variant.
Signed-off-by: NJoern Engel <joern@logfs.org>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

The target code has a rather generous helping of smp_mb__after_atomic()
throughout the code base.  Most atomic operations were followed by one
and none were preceded by smp_mb__before_atomic(), nor accompanied by a
comment explaining the need for a barrier.

Instead of trying to prove for every case whether or not it is needed,
this patch introduces atomic_inc_mb() and atomic_dec_mb(), which
explicitly include the memory barriers before and after the atomic
operation.  For now they are defined in a target header, although they
could be of general use.

Most of the existing atomic/mb combinations were replaced by the new
helpers.  In a few cases the atomic was sandwiched in
spin_lock/spin_unlock and I simply removed the barrier.

I suspect that in most cases the correct conversion would have been to
drop the barrier.  I also suspect that a few cases exist where a) the
barrier was necessary and b) a second barrier before the atomic would
have been necessary and got added by this patch.
Signed-off-by: NJoern Engel <joern@logfs.org>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>