From 6f06e3a7b2f2d840d42a0c2b9906f444e8f2eba6 Mon Sep 17 00:00:00 2001 From: Hillf Danton Date: Wed, 27 Jul 2011 15:10:34 -0700 Subject: [SCSI] libfc: release exchg cache If fail to create workqueue, the newly created cache for exchg has to be released. Signed-off-by: Hillf Danton Reviewed-by: Vasu Dev Signed-off-by: Robert Love Signed-off-by: James Bottomley --- drivers/scsi/libfc/fc_exch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/scsi/libfc/fc_exch.c') diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index f5a0665b677..7baf2239ce0 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -2465,8 +2465,11 @@ int fc_setup_exch_mgr(void) fc_exch_workqueue = create_singlethread_workqueue("fc_exch_workqueue"); if (!fc_exch_workqueue) - return -ENOMEM; + goto err; return 0; +err: + kmem_cache_destroy(fc_em_cachep); + return -ENOMEM; } /** -- cgit v1.2.3-70-g09d2 From 324f667833d7ddd9501ed8c0e3ec5754ddb1b695 Mon Sep 17 00:00:00 2001 From: Vasu Dev Date: Wed, 27 Jul 2011 15:10:39 -0700 Subject: [SCSI] libfc, fcoe: ignore rx frame with wrong xid info Drop the rx frame having xid with wrong cpu info or received with xid not matching to our xid. Not dropping such frame is causing panic as that causes accessing data struct beyond their bounds. Signed-off-by: Vasu Dev Tested-by: Ross Brattain Signed-off-by: Robert Love Signed-off-by: James Bottomley --- drivers/scsi/fcoe/fcoe.c | 4 ++++ drivers/scsi/libfc/fc_exch.c | 4 +--- 2 files changed, 5 insertions(+), 3 deletions(-) (limited to 'drivers/scsi/libfc/fc_exch.c') diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c index f7547fb000c..945df21ac01 100644 --- a/drivers/scsi/fcoe/fcoe.c +++ b/drivers/scsi/fcoe/fcoe.c @@ -1373,6 +1373,10 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *netdev, } else cpu = smp_processor_id(); } + + if (cpu >= nr_cpu_ids) + goto err; + fps = &per_cpu(fcoe_percpu, cpu); spin_lock_bh(&fps->fcoe_rx_list.lock); if (unlikely(!fps->thread)) { diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 7baf2239ce0..01ff082dc34 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -802,10 +802,8 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid) pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask); spin_lock_bh(&pool->lock); ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order); - if (ep) { + if (ep && ep->xid == xid) fc_exch_hold(ep); - WARN_ON(ep->xid != xid); - } spin_unlock_bh(&pool->lock); } return ep; -- cgit v1.2.3-70-g09d2 From 77a2b73a7805a3c6a473b6741aa514ef40295d26 Mon Sep 17 00:00:00 2001 From: Vasu Dev Date: Thu, 25 Aug 2011 12:40:52 -0700 Subject: [SCSI] libfc: fix fc_eh_host_reset Current fc_eh_host_reset leaves lport offline permanently due to FLOGI response getting handled by LOGO response from last reset as both had same exchange id. So fix this by having end to end exches clean-up using exchange abort along exches reset done from fc_eh_host_reset. This would avoid exchanges collision between the sessions across the reset. In this case implicit login should have done that but no aborting support for FIP frames, so just wait till lport->r_a_tov before restarting next flogi to ensure all exchanges are good to use again for next session. Below is the trace of LOGO from older session coming ahead of FLOGI response with same exche id 0x203:- 617 86.435165 4e.00.0b -> ff.ff.fc FC ELS LOGO 0x203 618 86.435195 4e.00.0b -> b6.02.00 FC ELS LOGO 0x213 619 86.435220 4e.00.0b -> 18.03.00 FC ELS LOGO 0x223 620 86.435244 4e.00.0b -> 18.02.00 FC ELS LOGO 0x233 621 86.435267 4e.00.0b -> 18.01.00 FC ELS LOGO 0x243 622 86.435349 00.00.00 -> ff.ff.fe FC ELS FLOGI 0x203 623 86.435549 ff.ff.fc -> 4e.00.0b FC ELS ACC (LOGO) 0x203 624 86.438721 ff.ff.fe -> 4e.00.0b FC ELS ACC (FLOGI) 0x203 625 86.442059 18.03.00 -> 4e.00.0b FC ELS ACC (LOGO) 0x223 626 86.443683 b6.02.00 -> 4e.00.0b FC ELS ACC (LOGO) 0x213 627 86.447693 18.01.00 -> 4e.00.0b FC ELS ACC (LOGO) 0x243 628 86.453499 18.02.00 -> 4e.00.0b FC ELS ACC (LOGO) 0x233 Signed-off-by: Vasu Dev Tested-by: Ross Brattain Reviewed-by: Yi Zou Signed-off-by: Robert Love Signed-off-by: James Bottomley --- drivers/scsi/libfc/fc_exch.c | 51 +++++++++++++++++++++++++++++-------------- drivers/scsi/libfc/fc_lport.c | 11 +++++++++- 2 files changed, 45 insertions(+), 17 deletions(-) (limited to 'drivers/scsi/libfc/fc_exch.c') diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 01ff082dc34..744fefe8134 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -494,6 +494,9 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp, */ error = lport->tt.frame_send(lport, fp); + if (fh->fh_type == FC_TYPE_BLS) + return error; + /* * Update the exchange and sequence flags, * assuming all frames for the sequence have been sent. @@ -575,42 +578,35 @@ static void fc_seq_set_resp(struct fc_seq *sp, } /** - * fc_seq_exch_abort() - Abort an exchange and sequence - * @req_sp: The sequence to be aborted + * fc_exch_abort_locked() - Abort an exchange + * @ep: The exchange to be aborted * @timer_msec: The period of time to wait before aborting * - * Generally called because of a timeout or an abort from the upper layer. + * Locking notes: Called with exch lock held + * + * Return value: 0 on success else error code */ -static int fc_seq_exch_abort(const struct fc_seq *req_sp, - unsigned int timer_msec) +static int fc_exch_abort_locked(struct fc_exch *ep, + unsigned int timer_msec) { struct fc_seq *sp; - struct fc_exch *ep; struct fc_frame *fp; int error; - ep = fc_seq_exch(req_sp); - - spin_lock_bh(&ep->ex_lock); if (ep->esb_stat & (ESB_ST_COMPLETE | ESB_ST_ABNORMAL) || - ep->state & (FC_EX_DONE | FC_EX_RST_CLEANUP)) { - spin_unlock_bh(&ep->ex_lock); + ep->state & (FC_EX_DONE | FC_EX_RST_CLEANUP)) return -ENXIO; - } /* * Send the abort on a new sequence if possible. */ sp = fc_seq_start_next_locked(&ep->seq); - if (!sp) { - spin_unlock_bh(&ep->ex_lock); + if (!sp) return -ENOMEM; - } ep->esb_stat |= ESB_ST_SEQ_INIT | ESB_ST_ABNORMAL; if (timer_msec) fc_exch_timer_set_locked(ep, timer_msec); - spin_unlock_bh(&ep->ex_lock); /* * If not logged into the fabric, don't send ABTS but leave @@ -632,6 +628,28 @@ static int fc_seq_exch_abort(const struct fc_seq *req_sp, return error; } +/** + * fc_seq_exch_abort() - Abort an exchange and sequence + * @req_sp: The sequence to be aborted + * @timer_msec: The period of time to wait before aborting + * + * Generally called because of a timeout or an abort from the upper layer. + * + * Return value: 0 on success else error code + */ +static int fc_seq_exch_abort(const struct fc_seq *req_sp, + unsigned int timer_msec) +{ + struct fc_exch *ep; + int error; + + ep = fc_seq_exch(req_sp); + spin_lock_bh(&ep->ex_lock); + error = fc_exch_abort_locked(ep, timer_msec); + spin_unlock_bh(&ep->ex_lock); + return error; +} + /** * fc_exch_timeout() - Handle exchange timer expiration * @work: The work_struct identifying the exchange that timed out @@ -1715,6 +1733,7 @@ static void fc_exch_reset(struct fc_exch *ep) int rc = 1; spin_lock_bh(&ep->ex_lock); + fc_exch_abort_locked(ep, 0); ep->state |= FC_EX_RST_CLEANUP; if (cancel_delayed_work(&ep->timeout_work)) atomic_dec(&ep->ex_refcnt); /* drop hold for timer */ diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c index e55ed9cf23f..628f347404f 100644 --- a/drivers/scsi/libfc/fc_lport.c +++ b/drivers/scsi/libfc/fc_lport.c @@ -88,6 +88,7 @@ */ #include +#include #include #include @@ -1029,8 +1030,16 @@ static void fc_lport_enter_reset(struct fc_lport *lport) FCH_EVT_LIPRESET, 0); fc_vports_linkchange(lport); fc_lport_reset_locked(lport); - if (lport->link_up) + if (lport->link_up) { + /* + * Wait upto resource allocation time out before + * doing re-login since incomplete FIP exchanged + * from last session may collide with exchanges + * in new session. + */ + msleep(lport->r_a_tov); fc_lport_enter_flogi(lport); + } } /** -- cgit v1.2.3-70-g09d2 From 3ee17f59c5378af8d245f82498e3919b7de2ab40 Mon Sep 17 00:00:00 2001 From: Yi Zou Date: Thu, 25 Aug 2011 12:41:03 -0700 Subject: [SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp() In commit 6a716a8, while releasing the DDP context in case frame_send() failed, the frame may already be freed, so we should store the pointer to fc_fcp_pkt and release the DDP context using the locally stored fsp instead of getting fsp from the fr_fsp(fp) on a frame. Signed-off-by: Yi Zou Reported-by: Bhanu Prakash Gollapudi Tested-by: Ross Brattain Signed-off-by: Robert Love Signed-off-by: James Bottomley --- drivers/scsi/libfc/fc_exch.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'drivers/scsi/libfc/fc_exch.c') diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 744fefe8134..d261e982a2f 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -1981,6 +1981,7 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport, struct fc_exch *ep; struct fc_seq *sp = NULL; struct fc_frame_header *fh; + struct fc_fcp_pkt *fsp = NULL; int rc = 1; ep = fc_exch_alloc(lport, fp); @@ -2003,8 +2004,10 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport, fc_exch_setup_hdr(ep, fp, ep->f_ctl); sp->cnt++; - if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD) + if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD) { + fsp = fr_fsp(fp); fc_fcp_ddp_setup(fr_fsp(fp), ep->xid); + } if (unlikely(lport->tt.frame_send(lport, fp))) goto err; @@ -2018,7 +2021,8 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport, spin_unlock_bh(&ep->ex_lock); return sp; err: - fc_fcp_ddp_done(fr_fsp(fp)); + if (fsp) + fc_fcp_ddp_done(fsp); rc = fc_exch_done_locked(ep); spin_unlock_bh(&ep->ex_lock); if (!rc) -- cgit v1.2.3-70-g09d2