dect
/
linux-2.6
Archived
13
0
Fork 0
This repository has been archived on 2022-02-17. You can view files and clone it, but cannot push or open issues or pull requests.
linux-2.6/drivers/scsi/libfc/fc_rport.c

1703 lines
45 KiB
C
Raw Normal View History

/*
* Copyright(c) 2007 - 2008 Intel Corporation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms and conditions of the GNU General Public License,
* version 2, as published by the Free Software Foundation.
*
* This program is distributed in the hope it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
* You should have received a copy of the GNU General Public License along with
* this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
*
* Maintained at www.Open-FCoE.org
*/
/*
* RPORT GENERAL INFO
*
* This file contains all processing regarding fc_rports. It contains the
* rport state machine and does all rport interaction with the transport class.
* There should be no other places in libfc that interact directly with the
* transport class in regards to adding and deleting rports.
*
* fc_rport's represent N_Port's within the fabric.
*/
/*
* RPORT LOCKING
*
* The rport should never hold the rport mutex and then attempt to acquire
* either the lport or disc mutexes. The rport's mutex is considered lesser
* than both the lport's mutex and the disc mutex. Refer to fc_lport.c for
* more comments on the heirarchy.
*
* The locking strategy is similar to the lport's strategy. The lock protects
* the rport's states and is held and released by the entry points to the rport
* block. All _enter_* functions correspond to rport states and expect the rport
* mutex to be locked before calling them. This means that rports only handle
* one request or response at a time, since they're not critical for the I/O
* path this potential over-use of the mutex is acceptable.
*/
#include <linux/kernel.h>
#include <linux/spinlock.h>
#include <linux/interrupt.h>
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h percpu.h is included by sched.h and module.h and thus ends up being included when building most .c files. percpu.h includes slab.h which in turn includes gfp.h making everything defined by the two files universally available and complicating inclusion dependencies. percpu.h -> slab.h dependency is about to be removed. Prepare for this change by updating users of gfp and slab facilities include those headers directly instead of assuming availability. As this conversion needs to touch large number of source files, the following script is used as the basis of conversion. http://userweb.kernel.org/~tj/misc/slabh-sweep.py The script does the followings. * Scan files for gfp and slab usages and update includes such that only the necessary includes are there. ie. if only gfp is used, gfp.h, if slab is used, slab.h. * When the script inserts a new include, it looks at the include blocks and try to put the new include such that its order conforms to its surrounding. It's put in the include block which contains core kernel includes, in the same order that the rest are ordered - alphabetical, Christmas tree, rev-Xmas-tree or at the end if there doesn't seem to be any matching order. * If the script can't find a place to put a new include (mostly because the file doesn't have fitting include block), it prints out an error message indicating which .h file needs to be added to the file. The conversion was done in the following steps. 1. The initial automatic conversion of all .c files updated slightly over 4000 files, deleting around 700 includes and adding ~480 gfp.h and ~3000 slab.h inclusions. The script emitted errors for ~400 files. 2. Each error was manually checked. Some didn't need the inclusion, some needed manual addition while adding it to implementation .h or embedding .c file was more appropriate for others. This step added inclusions to around 150 files. 3. The script was run again and the output was compared to the edits from #2 to make sure no file was left behind. 4. Several build tests were done and a couple of problems were fixed. e.g. lib/decompress_*.c used malloc/free() wrappers around slab APIs requiring slab.h to be added manually. 5. The script was run on all .h files but without automatically editing them as sprinkling gfp.h and slab.h inclusions around .h files could easily lead to inclusion dependency hell. Most gfp.h inclusion directives were ignored as stuff from gfp.h was usually wildly available and often used in preprocessor macros. Each slab.h inclusion directive was examined and added manually as necessary. 6. percpu.h was updated not to include slab.h. 7. Build test were done on the following configurations and failures were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my distributed build env didn't work with gcov compiles) and a few more options had to be turned off depending on archs to make things build (like ipr on powerpc/64 which failed due to missing writeq). * x86 and x86_64 UP and SMP allmodconfig and a custom test config. * powerpc and powerpc64 SMP allmodconfig * sparc and sparc64 SMP allmodconfig * ia64 SMP allmodconfig * s390 SMP allmodconfig * alpha SMP allmodconfig * um on x86_64 SMP allmodconfig 8. percpu.h modifications were reverted so that it could be applied as a separate patch and serve as bisection point. Given the fact that I had only a couple of failures from tests on step 6, I'm fairly confident about the coverage of this conversion patch. If there is a breakage, it's likely to be something in one of the arch headers which should be easily discoverable easily on most builds of the specific arch. Signed-off-by: Tejun Heo <tj@kernel.org> Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
#include <linux/slab.h>
#include <linux/rcupdate.h>
#include <linux/timer.h>
#include <linux/workqueue.h>
#include <asm/unaligned.h>
#include <scsi/libfc.h>
#include <scsi/fc_encode.h>
#include "fc_libfc.h"
struct workqueue_struct *rport_event_queue;
static void fc_rport_enter_plogi(struct fc_rport_priv *);
static void fc_rport_enter_prli(struct fc_rport_priv *);
static void fc_rport_enter_rtv(struct fc_rport_priv *);
static void fc_rport_enter_ready(struct fc_rport_priv *);
static void fc_rport_enter_logo(struct fc_rport_priv *);
static void fc_rport_enter_adisc(struct fc_rport_priv *);
static void fc_rport_recv_plogi_req(struct fc_lport *,
struct fc_seq *, struct fc_frame *);
static void fc_rport_recv_prli_req(struct fc_rport_priv *,
struct fc_seq *, struct fc_frame *);
static void fc_rport_recv_prlo_req(struct fc_rport_priv *,
struct fc_seq *, struct fc_frame *);
static void fc_rport_recv_logo_req(struct fc_lport *,
struct fc_seq *, struct fc_frame *);
static void fc_rport_timeout(struct work_struct *);
static void fc_rport_error(struct fc_rport_priv *, struct fc_frame *);
static void fc_rport_error_retry(struct fc_rport_priv *, struct fc_frame *);
static void fc_rport_work(struct work_struct *);
static const char *fc_rport_state_names[] = {
[RPORT_ST_INIT] = "Init",
[RPORT_ST_PLOGI] = "PLOGI",
[RPORT_ST_PRLI] = "PRLI",
[RPORT_ST_RTV] = "RTV",
[RPORT_ST_READY] = "Ready",
[RPORT_ST_LOGO] = "LOGO",
[RPORT_ST_ADISC] = "ADISC",
[RPORT_ST_DELETE] = "Delete",
[RPORT_ST_RESTART] = "Restart",
};
/**
* fc_rport_lookup() - Lookup a remote port by port_id
* @lport: The local port to lookup the remote port on
* @port_id: The remote port ID to look up
*/
static struct fc_rport_priv *fc_rport_lookup(const struct fc_lport *lport,
u32 port_id)
{
struct fc_rport_priv *rdata;
list_for_each_entry(rdata, &lport->disc.rports, peers)
if (rdata->ids.port_id == port_id)
return rdata;
return NULL;
}
/**
* fc_rport_create() - Create a new remote port
* @lport: The local port this remote port will be associated with
* @ids: The identifiers for the new remote port
*
* The remote port will start in the INIT state.
*
* Locking note: must be called with the disc_mutex held.
*/
static struct fc_rport_priv *fc_rport_create(struct fc_lport *lport,
u32 port_id)
{
struct fc_rport_priv *rdata;
rdata = lport->tt.rport_lookup(lport, port_id);
if (rdata)
return rdata;
rdata = kzalloc(sizeof(*rdata), GFP_KERNEL);
if (!rdata)
return NULL;
rdata->ids.node_name = -1;
rdata->ids.port_name = -1;
rdata->ids.port_id = port_id;
rdata->ids.roles = FC_RPORT_ROLE_UNKNOWN;
kref_init(&rdata->kref);
mutex_init(&rdata->rp_mutex);
rdata->local_port = lport;
rdata->rp_state = RPORT_ST_INIT;
rdata->event = RPORT_EV_NONE;
rdata->flags = FC_RP_FLAGS_REC_SUPPORTED;
rdata->e_d_tov = lport->e_d_tov;
rdata->r_a_tov = lport->r_a_tov;
rdata->maxframe_size = FC_MIN_MAX_PAYLOAD;
INIT_DELAYED_WORK(&rdata->retry_work, fc_rport_timeout);
INIT_WORK(&rdata->event_work, fc_rport_work);
if (port_id != FC_FID_DIR_SERV)
list_add(&rdata->peers, &lport->disc.rports);
return rdata;
}
/**
* fc_rport_destroy() - Free a remote port after last reference is released
* @kref: The remote port's kref
*/
static void fc_rport_destroy(struct kref *kref)
{
struct fc_rport_priv *rdata;
rdata = container_of(kref, struct fc_rport_priv, kref);
kfree(rdata);
}
/**
* fc_rport_state() - Return a string identifying the remote port's state
* @rdata: The remote port
*/
static const char *fc_rport_state(struct fc_rport_priv *rdata)
{
const char *cp;
cp = fc_rport_state_names[rdata->rp_state];
if (!cp)
cp = "Unknown";
return cp;
}
/**
* fc_set_rport_loss_tmo() - Set the remote port loss timeout
* @rport: The remote port that gets a new timeout value
* @timeout: The new timeout value (in seconds)
*/
void fc_set_rport_loss_tmo(struct fc_rport *rport, u32 timeout)
{
if (timeout)
rport->dev_loss_tmo = timeout + 5;
else
rport->dev_loss_tmo = 30;
}
EXPORT_SYMBOL(fc_set_rport_loss_tmo);
/**
* fc_plogi_get_maxframe() - Get the maximum payload from the common service
* parameters in a FLOGI frame
* @flp: The FLOGI payload
* @maxval: The maximum frame size upper limit; this may be less than what
* is in the service parameters
*/
static unsigned int fc_plogi_get_maxframe(struct fc_els_flogi *flp,
unsigned int maxval)
{
unsigned int mfs;
/*
* Get max payload from the common service parameters and the
* class 3 receive data field size.
*/
mfs = ntohs(flp->fl_csp.sp_bb_data) & FC_SP_BB_DATA_MASK;
if (mfs >= FC_SP_MIN_MAX_PAYLOAD && mfs < maxval)
maxval = mfs;
mfs = ntohs(flp->fl_cssp[3 - 1].cp_rdfs);
if (mfs >= FC_SP_MIN_MAX_PAYLOAD && mfs < maxval)
maxval = mfs;
return maxval;
}
/**
* fc_rport_state_enter() - Change the state of a remote port
* @rdata: The remote port whose state should change
* @new: The new state
*
* Locking Note: Called with the rport lock held
*/
static void fc_rport_state_enter(struct fc_rport_priv *rdata,
enum fc_rport_state new)
{
if (rdata->rp_state != new)
rdata->retries = 0;
rdata->rp_state = new;
}
/**
* fc_rport_work() - Handler for remote port events in the rport_event_queue
* @work: Handle to the remote port being dequeued
*/
static void fc_rport_work(struct work_struct *work)
{
u32 port_id;
struct fc_rport_priv *rdata =
container_of(work, struct fc_rport_priv, event_work);
struct fc_rport_libfc_priv *rpriv;
enum fc_rport_event event;
struct fc_lport *lport = rdata->local_port;
struct fc_rport_operations *rport_ops;
struct fc_rport_identifiers ids;
struct fc_rport *rport;
int restart = 0;
mutex_lock(&rdata->rp_mutex);
event = rdata->event;
rport_ops = rdata->ops;
rport = rdata->rport;
FC_RPORT_DBG(rdata, "work event %u\n", event);
switch (event) {
case RPORT_EV_READY:
ids = rdata->ids;
rdata->event = RPORT_EV_NONE;
kref_get(&rdata->kref);
mutex_unlock(&rdata->rp_mutex);
if (!rport)
rport = fc_remote_port_add(lport->host, 0, &ids);
if (!rport) {
FC_RPORT_DBG(rdata, "Failed to add the rport\n");
lport->tt.rport_logoff(rdata);
kref_put(&rdata->kref, lport->tt.rport_destroy);
return;
}
mutex_lock(&rdata->rp_mutex);
if (rdata->rport)
FC_RPORT_DBG(rdata, "rport already allocated\n");
rdata->rport = rport;
rport->maxframe_size = rdata->maxframe_size;
rport->supported_classes = rdata->supported_classes;
rpriv = rport->dd_data;
rpriv->local_port = lport;
rpriv->rp_state = rdata->rp_state;
rpriv->flags = rdata->flags;
rpriv->e_d_tov = rdata->e_d_tov;
rpriv->r_a_tov = rdata->r_a_tov;
mutex_unlock(&rdata->rp_mutex);
if (rport_ops && rport_ops->event_callback) {
FC_RPORT_DBG(rdata, "callback ev %d\n", event);
rport_ops->event_callback(lport, rdata, event);
}
kref_put(&rdata->kref, lport->tt.rport_destroy);
break;
case RPORT_EV_FAILED:
case RPORT_EV_LOGO:
case RPORT_EV_STOP:
port_id = rdata->ids.port_id;
mutex_unlock(&rdata->rp_mutex);
if (port_id != FC_FID_DIR_SERV) {
/*
* We must drop rp_mutex before taking disc_mutex.
* Re-evaluate state to allow for restart.
* A transition to RESTART state must only happen
* while disc_mutex is held and rdata is on the list.
*/
mutex_lock(&lport->disc.disc_mutex);
mutex_lock(&rdata->rp_mutex);
if (rdata->rp_state == RPORT_ST_RESTART)
restart = 1;
else
list_del(&rdata->peers);
[SCSI] libfc: remote port gets stuck in restart state without really restarting We ran into a scenario where a remote port goes into RESTART state, but never gets added to scsi transport. The running vmcore showed the following: a) Port was in RESTART state b) rdata->event was STOP c) no work gets scheduled for the remote work to fc_rport_work After this point, shut/no-shut of the remote port did not cause the port to get re-discovered. The port would move betwen DELETE and RESTART states, but the event would always be STOP, no work would get scheduled to fc_rport_work and the port would not get added to scsi_transport. The problem is that rdata->event is not set to NONE after a port is restarted. After this point, no more work gets scheduled for the remote port since new work is scheduled only if rdata->event is non-NONE. So, the event and state keep changing, but fc_rport_work does not get scheduled to actually handle the event. Here's a transition of states that explains the above observation: ) Port is first in READY State, event is NONE 2) RSCN on shut, port goes to DELETED, event is stop 3) Before fc_rport_work runs, RSCN on no-shut, port goes to RESTART, event is still STOP 4) fc_rport_work gets scheduled, removes the port from transport, sees state as RESTART, begins the PLOGI state machine, event remains as STOP (event NOT changed to NONE, this is the bug) 5) Plogi state machine completes, port state goes to READY, event goes to READY, but no work is scheduled since event was STOP (non-NONE) before. Fc_rport_work is not scheduled, port remains in READY state, but is not added to transport. Things are broken at this point. Libfc rport is ready, but no transport rport created. 6) now a shut causes port state to change to DELETE, event to change to STOP, no work gets scheduled 7) no-shut causes port state to change to RESTART, event remains at STOP, no work gets scheduled (6) and (7) now get repeated everytime we do shut/no-shut. No way to get out of this state. Fcc reset does not help too. Only way to get out is to load/unload module. Fix is to set rdata->event to NONE while processing the STOP/LOGO/FAILED events, inside the discovery and rport locks. Signed-off-by: Abhijeet Joglekar <abjoglek@cisco.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-12-10 17:59:20 +00:00
rdata->event = RPORT_EV_NONE;
mutex_unlock(&rdata->rp_mutex);
mutex_unlock(&lport->disc.disc_mutex);
}
if (rport_ops && rport_ops->event_callback) {
FC_RPORT_DBG(rdata, "callback ev %d\n", event);
rport_ops->event_callback(lport, rdata, event);
}
cancel_delayed_work_sync(&rdata->retry_work);
/*
* Reset any outstanding exchanges before freeing rport.
*/
lport->tt.exch_mgr_reset(lport, 0, port_id);
lport->tt.exch_mgr_reset(lport, port_id, 0);
if (rport) {
rpriv = rport->dd_data;
rpriv->rp_state = RPORT_ST_DELETE;
mutex_lock(&rdata->rp_mutex);
rdata->rport = NULL;
mutex_unlock(&rdata->rp_mutex);
fc_remote_port_delete(rport);
}
if (restart) {
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "work restart\n");
fc_rport_enter_plogi(rdata);
mutex_unlock(&rdata->rp_mutex);
} else
kref_put(&rdata->kref, lport->tt.rport_destroy);
break;
default:
mutex_unlock(&rdata->rp_mutex);
break;
}
}
/**
* fc_rport_login() - Start the remote port login state machine
* @rdata: The remote port to be logged in to
*
* Locking Note: Called without the rport lock held. This
* function will hold the rport lock, call an _enter_*
* function and then unlock the rport.
*
* This indicates the intent to be logged into the remote port.
* If it appears we are already logged in, ADISC is used to verify
* the setup.
*/
int fc_rport_login(struct fc_rport_priv *rdata)
{
mutex_lock(&rdata->rp_mutex);
switch (rdata->rp_state) {
case RPORT_ST_READY:
FC_RPORT_DBG(rdata, "ADISC port\n");
fc_rport_enter_adisc(rdata);
break;
case RPORT_ST_RESTART:
break;
case RPORT_ST_DELETE:
FC_RPORT_DBG(rdata, "Restart deleted port\n");
fc_rport_state_enter(rdata, RPORT_ST_RESTART);
break;
default:
FC_RPORT_DBG(rdata, "Login to port\n");
fc_rport_enter_plogi(rdata);
break;
}
mutex_unlock(&rdata->rp_mutex);
return 0;
}
/**
* fc_rport_enter_delete() - Schedule a remote port to be deleted
* @rdata: The remote port to be deleted
* @event: The event to report as the reason for deletion
*
* Locking Note: Called with the rport lock held.
*
* Allow state change into DELETE only once.
*
* Call queue_work only if there's no event already pending.
* Set the new event so that the old pending event will not occur.
* Since we have the mutex, even if fc_rport_work() is already started,
* it'll see the new event.
*/
static void fc_rport_enter_delete(struct fc_rport_priv *rdata,
enum fc_rport_event event)
{
if (rdata->rp_state == RPORT_ST_DELETE)
return;
FC_RPORT_DBG(rdata, "Delete port\n");
fc_rport_state_enter(rdata, RPORT_ST_DELETE);
if (rdata->event == RPORT_EV_NONE)
queue_work(rport_event_queue, &rdata->event_work);
rdata->event = event;
}
/**
* fc_rport_logoff() - Logoff and remove a remote port
* @rdata: The remote port to be logged off of
*
* Locking Note: Called without the rport lock held. This
* function will hold the rport lock, call an _enter_*
* function and then unlock the rport.
*/
int fc_rport_logoff(struct fc_rport_priv *rdata)
{
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Remove port\n");
if (rdata->rp_state == RPORT_ST_DELETE) {
FC_RPORT_DBG(rdata, "Port in Delete state, not removing\n");
[SCSI] libfc: Track rogue remote ports Rogue ports are currently not tracked on any list. The only reference to them is through any outstanding exchanges pending on the rogue ports. If the module is removed while a retry is set on a rogue port (say a Plogi retry for instance), this retry is not cancelled because there is no reference to the rogue port in the discovery rports list. Thus the local port can clean itself up, delete the exchange pool, and then the rogue port timeout can fire and try to start up another exchange. This patch tracks the rogue ports in a new list disc->rogue_rports. Creating a new list instead of using the disc->rports list keeps remote port code change to a minimum. 1) Whenever a rogue port is created, it is immediately added to the disc->rogue_rports list. 2) When the rogues port goes to ready, it is removed from the rogue list and the real remote port is added to the disc->rports list 3) The removal of the rogue from the disc->rogue_rports list is done in the context of the fc_rport_work() workQ thread in discovery callback. 4) Real rports are removed from the disc->rports list like before. Lookup is done only in the real rports list. This avoids making large changes to the remote port code. 5) In fc_disc_stop_rports, the rogues list is traversed in addition to the real list to stop the rogue ports and issue logoffs on them. This way, rogue ports get cleaned up when the local port goes away. 6) rogue remote ports are not removed from the list right away, but removed late in fc_rport_work() context, multiple threads can find the same remote port in the list and call rport_logoff(). Rport_logoff() only continues with the logoff if port is not in NONE state, thus preventing multiple logoffs and multiple list deletions. 7) Since the rport is removed from the disc list at a later stage (in the disc callback), incoming frames can find the rport even if rport_logoff() has been called on the rport. When rport_logoff() is called, the rport state is set to NONE, and we are trying to cancel all exchanges and retries on that port. While in this state, if an incoming Plogi/Prli/Logo or other frames match the rport, we should not reply because the rport is in the NONE state. Just drop the frame, since the rport will be deleted soon in the disc callback (fc_rport_work) 8) In fc_disc_single(), remove rport lookup and call to fc_disc_del_target. fc_disc_single() is called from recv_rscn_req() where rport lookup and rport_logoff is already done. Signed-off-by: Abhijeet Joglekar <abjoglek@cisco.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2009-04-21 23:27:04 +00:00
goto out;
}
if (rdata->rp_state == RPORT_ST_RESTART)
FC_RPORT_DBG(rdata, "Port in Restart state, deleting\n");
else
fc_rport_enter_logo(rdata);
/*
* Change the state to Delete so that we discard
* the response.
*/
fc_rport_enter_delete(rdata, RPORT_EV_STOP);
[SCSI] libfc: Track rogue remote ports Rogue ports are currently not tracked on any list. The only reference to them is through any outstanding exchanges pending on the rogue ports. If the module is removed while a retry is set on a rogue port (say a Plogi retry for instance), this retry is not cancelled because there is no reference to the rogue port in the discovery rports list. Thus the local port can clean itself up, delete the exchange pool, and then the rogue port timeout can fire and try to start up another exchange. This patch tracks the rogue ports in a new list disc->rogue_rports. Creating a new list instead of using the disc->rports list keeps remote port code change to a minimum. 1) Whenever a rogue port is created, it is immediately added to the disc->rogue_rports list. 2) When the rogues port goes to ready, it is removed from the rogue list and the real remote port is added to the disc->rports list 3) The removal of the rogue from the disc->rogue_rports list is done in the context of the fc_rport_work() workQ thread in discovery callback. 4) Real rports are removed from the disc->rports list like before. Lookup is done only in the real rports list. This avoids making large changes to the remote port code. 5) In fc_disc_stop_rports, the rogues list is traversed in addition to the real list to stop the rogue ports and issue logoffs on them. This way, rogue ports get cleaned up when the local port goes away. 6) rogue remote ports are not removed from the list right away, but removed late in fc_rport_work() context, multiple threads can find the same remote port in the list and call rport_logoff(). Rport_logoff() only continues with the logoff if port is not in NONE state, thus preventing multiple logoffs and multiple list deletions. 7) Since the rport is removed from the disc list at a later stage (in the disc callback), incoming frames can find the rport even if rport_logoff() has been called on the rport. When rport_logoff() is called, the rport state is set to NONE, and we are trying to cancel all exchanges and retries on that port. While in this state, if an incoming Plogi/Prli/Logo or other frames match the rport, we should not reply because the rport is in the NONE state. Just drop the frame, since the rport will be deleted soon in the disc callback (fc_rport_work) 8) In fc_disc_single(), remove rport lookup and call to fc_disc_del_target. fc_disc_single() is called from recv_rscn_req() where rport lookup and rport_logoff is already done. Signed-off-by: Abhijeet Joglekar <abjoglek@cisco.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2009-04-21 23:27:04 +00:00
out:
mutex_unlock(&rdata->rp_mutex);
return 0;
}
/**
* fc_rport_enter_ready() - Transition to the RPORT_ST_READY state
* @rdata: The remote port that is ready
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_ready(struct fc_rport_priv *rdata)
{
fc_rport_state_enter(rdata, RPORT_ST_READY);
FC_RPORT_DBG(rdata, "Port is Ready\n");
if (rdata->event == RPORT_EV_NONE)
queue_work(rport_event_queue, &rdata->event_work);
rdata->event = RPORT_EV_READY;
}
/**
* fc_rport_timeout() - Handler for the retry_work timer
* @work: Handle to the remote port that has timed out
*
* Locking Note: Called without the rport lock held. This
* function will hold the rport lock, call an _enter_*
* function and then unlock the rport.
*/
static void fc_rport_timeout(struct work_struct *work)
{
struct fc_rport_priv *rdata =
container_of(work, struct fc_rport_priv, retry_work.work);
mutex_lock(&rdata->rp_mutex);
switch (rdata->rp_state) {
case RPORT_ST_PLOGI:
fc_rport_enter_plogi(rdata);
break;
case RPORT_ST_PRLI:
fc_rport_enter_prli(rdata);
break;
case RPORT_ST_RTV:
fc_rport_enter_rtv(rdata);
break;
case RPORT_ST_LOGO:
fc_rport_enter_logo(rdata);
break;
case RPORT_ST_ADISC:
fc_rport_enter_adisc(rdata);
break;
case RPORT_ST_READY:
case RPORT_ST_INIT:
case RPORT_ST_DELETE:
case RPORT_ST_RESTART:
break;
}
mutex_unlock(&rdata->rp_mutex);
}
/**
* fc_rport_error() - Error handler, called once retries have been exhausted
* @rdata: The remote port the error is happened on
* @fp: The error code encapsulated in a frame pointer
*
* Locking Note: The rport lock is expected to be held before
* calling this routine
*/
static void fc_rport_error(struct fc_rport_priv *rdata, struct fc_frame *fp)
{
FC_RPORT_DBG(rdata, "Error %ld in state %s, retries %d\n",
IS_ERR(fp) ? -PTR_ERR(fp) : 0,
fc_rport_state(rdata), rdata->retries);
switch (rdata->rp_state) {
case RPORT_ST_PLOGI:
case RPORT_ST_LOGO:
fc_rport_enter_delete(rdata, RPORT_EV_FAILED);
break;
case RPORT_ST_RTV:
fc_rport_enter_ready(rdata);
break;
case RPORT_ST_PRLI:
case RPORT_ST_ADISC:
fc_rport_enter_logo(rdata);
break;
case RPORT_ST_DELETE:
case RPORT_ST_RESTART:
case RPORT_ST_READY:
case RPORT_ST_INIT:
break;
}
}
/**
* fc_rport_error_retry() - Handler for remote port state retries
* @rdata: The remote port whose state is to be retried
* @fp: The error code encapsulated in a frame pointer
*
* If the error was an exchange timeout retry immediately,
* otherwise wait for E_D_TOV.
*
* Locking Note: The rport lock is expected to be held before
* calling this routine
*/
static void fc_rport_error_retry(struct fc_rport_priv *rdata,
struct fc_frame *fp)
{
unsigned long delay = FC_DEF_E_D_TOV;
/* make sure this isn't an FC_EX_CLOSED error, never retry those */
if (PTR_ERR(fp) == -FC_EX_CLOSED)
return fc_rport_error(rdata, fp);
if (rdata->retries < rdata->local_port->max_rport_retry_count) {
FC_RPORT_DBG(rdata, "Error %ld in state %s, retrying\n",
PTR_ERR(fp), fc_rport_state(rdata));
rdata->retries++;
/* no additional delay on exchange timeouts */
if (PTR_ERR(fp) == -FC_EX_TIMEOUT)
delay = 0;
schedule_delayed_work(&rdata->retry_work, delay);
return;
}
return fc_rport_error(rdata, fp);
}
/**
* fc_rport_plogi_recv_resp() - Handler for ELS PLOGI responses
* @sp: The sequence the PLOGI is on
* @fp: The PLOGI response frame
* @rdata_arg: The remote port that sent the PLOGI response
*
* Locking Note: This function will be called without the rport lock
* held, but it will lock, call an _enter_* function or fc_rport_error
* and then unlock the rport.
*/
static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
void *rdata_arg)
{
struct fc_rport_priv *rdata = rdata_arg;
struct fc_lport *lport = rdata->local_port;
struct fc_els_flogi *plp = NULL;
unsigned int tov;
u16 csp_seq;
u16 cssp_seq;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a PLOGI %s\n", fc_els_resp_type(fp));
if (rdata->rp_state != RPORT_ST_PLOGI) {
FC_RPORT_DBG(rdata, "Received a PLOGI response, but in state "
"%s\n", fc_rport_state(rdata));
if (IS_ERR(fp))
goto err;
goto out;
}
if (IS_ERR(fp)) {
fc_rport_error_retry(rdata, fp);
goto err;
}
op = fc_frame_payload_op(fp);
if (op == ELS_LS_ACC &&
(plp = fc_frame_payload_get(fp, sizeof(*plp))) != NULL) {
rdata->ids.port_name = get_unaligned_be64(&plp->fl_wwpn);
rdata->ids.node_name = get_unaligned_be64(&plp->fl_wwnn);
tov = ntohl(plp->fl_csp.sp_e_d_tov);
if (ntohs(plp->fl_csp.sp_features) & FC_SP_FT_EDTR)
tov /= 1000000;
if (tov > rdata->e_d_tov)
rdata->e_d_tov = tov;
csp_seq = ntohs(plp->fl_csp.sp_tot_seq);
cssp_seq = ntohs(plp->fl_cssp[3 - 1].cp_con_seq);
if (cssp_seq < csp_seq)
csp_seq = cssp_seq;
rdata->max_seq = csp_seq;
rdata->maxframe_size = fc_plogi_get_maxframe(plp, lport->mfs);
fc_rport_enter_prli(rdata);
} else
fc_rport_error_retry(rdata, fp);
out:
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
/**
* fc_rport_enter_plogi() - Send Port Login (PLOGI) request
* @rdata: The remote port to send a PLOGI to
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_plogi(struct fc_rport_priv *rdata)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame *fp;
FC_RPORT_DBG(rdata, "Port entered PLOGI state from %s state\n",
fc_rport_state(rdata));
fc_rport_state_enter(rdata, RPORT_ST_PLOGI);
rdata->maxframe_size = FC_MIN_MAX_PAYLOAD;
fp = fc_frame_alloc(lport, sizeof(struct fc_els_flogi));
if (!fp) {
fc_rport_error_retry(rdata, fp);
return;
}
rdata->e_d_tov = lport->e_d_tov;
if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_PLOGI,
fc_rport_plogi_resp, rdata,
2 * lport->r_a_tov))
[SCSI] libfc: fix memory corruption caused by double frees and bad error handling I was running into several different panics under stress, which I traced down to a few different possible slab corruption issues in error handling paths. I have not yet looked into why these exchange sends fail, but with these fixes my test system is much more stable under stress than before. fc_elsct_send() could fail and either leave the passed in frame intact (failure in fc_ct/els_fill) or the frame could have been freed if the failure was is fc_exch_seq_send(). The caller had no way of knowing, and there was a potential double free in the error handling in fc_fcp_rec(). Make fc_elsct_send() always free the frame before returning, and remove the fc_frame_free() call in fc_fcp_rec(). While fc_exch_seq_send() did always consume the frame, there were double free bugs in the error handling of fc_fcp_cmd_send() and fc_fcp_srr() as well. Numerous calls to error handling routines (fc_disc_error(), fc_lport_error(), fc_rport_error_retry() ) were passing in a frame pointer that had already been freed in the case of an error. I have changed the call sites to pass in a NULL pointer, but there may be more appropriate error codes to use. Question: Why do these error routines take a frame pointer anyway? I understand passing in a pointer encoded error to the response handlers, but the error routines take no action on a valid pointer and should never be called that way. Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-10-21 23:28:09 +00:00
fc_rport_error_retry(rdata, NULL);
else
kref_get(&rdata->kref);
}
/**
* fc_rport_prli_resp() - Process Login (PRLI) response handler
* @sp: The sequence the PRLI response was on
* @fp: The PRLI response frame
* @rdata_arg: The remote port that sent the PRLI response
*
* Locking Note: This function will be called without the rport lock
* held, but it will lock, call an _enter_* function or fc_rport_error
* and then unlock the rport.
*/
static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
void *rdata_arg)
{
struct fc_rport_priv *rdata = rdata_arg;
struct {
struct fc_els_prli prli;
struct fc_els_spp spp;
} *pp;
u32 roles = FC_RPORT_ROLE_UNKNOWN;
u32 fcp_parm = 0;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a PRLI %s\n", fc_els_resp_type(fp));
if (rdata->rp_state != RPORT_ST_PRLI) {
FC_RPORT_DBG(rdata, "Received a PRLI response, but in state "
"%s\n", fc_rport_state(rdata));
if (IS_ERR(fp))
goto err;
goto out;
}
if (IS_ERR(fp)) {
fc_rport_error_retry(rdata, fp);
goto err;
}
/* reinitialize remote port roles */
rdata->ids.roles = FC_RPORT_ROLE_UNKNOWN;
op = fc_frame_payload_op(fp);
if (op == ELS_LS_ACC) {
pp = fc_frame_payload_get(fp, sizeof(*pp));
if (pp && pp->prli.prli_spp_len >= sizeof(pp->spp)) {
fcp_parm = ntohl(pp->spp.spp_params);
if (fcp_parm & FCP_SPPF_RETRY)
rdata->flags |= FC_RP_FLAGS_RETRY;
}
rdata->supported_classes = FC_COS_CLASS3;
if (fcp_parm & FCP_SPPF_INIT_FCN)
roles |= FC_RPORT_ROLE_FCP_INITIATOR;
if (fcp_parm & FCP_SPPF_TARG_FCN)
roles |= FC_RPORT_ROLE_FCP_TARGET;
rdata->ids.roles = roles;
fc_rport_enter_rtv(rdata);
} else {
FC_RPORT_DBG(rdata, "Bad ELS response for PRLI command\n");
fc_rport_error_retry(rdata, fp);
}
out:
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
/**
* fc_rport_logo_resp() - Handler for logout (LOGO) responses
* @sp: The sequence the LOGO was on
* @fp: The LOGO response frame
* @rdata_arg: The remote port that sent the LOGO response
*
* Locking Note: This function will be called without the rport lock
* held, but it will lock, call an _enter_* function or fc_rport_error
* and then unlock the rport.
*/
static void fc_rport_logo_resp(struct fc_seq *sp, struct fc_frame *fp,
void *rdata_arg)
{
struct fc_rport_priv *rdata = rdata_arg;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a LOGO %s\n", fc_els_resp_type(fp));
if (rdata->rp_state != RPORT_ST_LOGO) {
FC_RPORT_DBG(rdata, "Received a LOGO response, but in state "
"%s\n", fc_rport_state(rdata));
if (IS_ERR(fp))
goto err;
goto out;
}
if (IS_ERR(fp)) {
fc_rport_error_retry(rdata, fp);
goto err;
}
op = fc_frame_payload_op(fp);
if (op != ELS_LS_ACC)
FC_RPORT_DBG(rdata, "Bad ELS response op %x for LOGO command\n",
op);
fc_rport_enter_delete(rdata, RPORT_EV_LOGO);
out:
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
/**
* fc_rport_enter_prli() - Send Process Login (PRLI) request
* @rdata: The remote port to send the PRLI request to
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_prli(struct fc_rport_priv *rdata)
{
struct fc_lport *lport = rdata->local_port;
struct {
struct fc_els_prli prli;
struct fc_els_spp spp;
} *pp;
struct fc_frame *fp;
/*
* If the rport is one of the well known addresses
* we skip PRLI and RTV and go straight to READY.
*/
if (rdata->ids.port_id >= FC_FID_DOM_MGR) {
fc_rport_enter_ready(rdata);
return;
}
FC_RPORT_DBG(rdata, "Port entered PRLI state from %s state\n",
fc_rport_state(rdata));
fc_rport_state_enter(rdata, RPORT_ST_PRLI);
fp = fc_frame_alloc(lport, sizeof(*pp));
if (!fp) {
fc_rport_error_retry(rdata, fp);
return;
}
if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_PRLI,
fc_rport_prli_resp, rdata,
2 * lport->r_a_tov))
[SCSI] libfc: fix memory corruption caused by double frees and bad error handling I was running into several different panics under stress, which I traced down to a few different possible slab corruption issues in error handling paths. I have not yet looked into why these exchange sends fail, but with these fixes my test system is much more stable under stress than before. fc_elsct_send() could fail and either leave the passed in frame intact (failure in fc_ct/els_fill) or the frame could have been freed if the failure was is fc_exch_seq_send(). The caller had no way of knowing, and there was a potential double free in the error handling in fc_fcp_rec(). Make fc_elsct_send() always free the frame before returning, and remove the fc_frame_free() call in fc_fcp_rec(). While fc_exch_seq_send() did always consume the frame, there were double free bugs in the error handling of fc_fcp_cmd_send() and fc_fcp_srr() as well. Numerous calls to error handling routines (fc_disc_error(), fc_lport_error(), fc_rport_error_retry() ) were passing in a frame pointer that had already been freed in the case of an error. I have changed the call sites to pass in a NULL pointer, but there may be more appropriate error codes to use. Question: Why do these error routines take a frame pointer anyway? I understand passing in a pointer encoded error to the response handlers, but the error routines take no action on a valid pointer and should never be called that way. Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-10-21 23:28:09 +00:00
fc_rport_error_retry(rdata, NULL);
else
kref_get(&rdata->kref);
}
/**
* fc_rport_els_rtv_resp() - Handler for Request Timeout Value (RTV) responses
* @sp: The sequence the RTV was on
* @fp: The RTV response frame
* @rdata_arg: The remote port that sent the RTV response
*
* Many targets don't seem to support this.
*
* Locking Note: This function will be called without the rport lock
* held, but it will lock, call an _enter_* function or fc_rport_error
* and then unlock the rport.
*/
static void fc_rport_rtv_resp(struct fc_seq *sp, struct fc_frame *fp,
void *rdata_arg)
{
struct fc_rport_priv *rdata = rdata_arg;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a RTV %s\n", fc_els_resp_type(fp));
if (rdata->rp_state != RPORT_ST_RTV) {
FC_RPORT_DBG(rdata, "Received a RTV response, but in state "
"%s\n", fc_rport_state(rdata));
if (IS_ERR(fp))
goto err;
goto out;
}
if (IS_ERR(fp)) {
fc_rport_error(rdata, fp);
goto err;
}
op = fc_frame_payload_op(fp);
if (op == ELS_LS_ACC) {
struct fc_els_rtv_acc *rtv;
u32 toq;
u32 tov;
rtv = fc_frame_payload_get(fp, sizeof(*rtv));
if (rtv) {
toq = ntohl(rtv->rtv_toq);
tov = ntohl(rtv->rtv_r_a_tov);
if (tov == 0)
tov = 1;
rdata->r_a_tov = tov;
tov = ntohl(rtv->rtv_e_d_tov);
if (toq & FC_ELS_RTV_EDRES)
tov /= 1000000;
if (tov == 0)
tov = 1;
rdata->e_d_tov = tov;
}
}
fc_rport_enter_ready(rdata);
out:
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
/**
* fc_rport_enter_rtv() - Send Request Timeout Value (RTV) request
* @rdata: The remote port to send the RTV request to
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_rtv(struct fc_rport_priv *rdata)
{
struct fc_frame *fp;
struct fc_lport *lport = rdata->local_port;
FC_RPORT_DBG(rdata, "Port entered RTV state from %s state\n",
fc_rport_state(rdata));
fc_rport_state_enter(rdata, RPORT_ST_RTV);
fp = fc_frame_alloc(lport, sizeof(struct fc_els_rtv));
if (!fp) {
fc_rport_error_retry(rdata, fp);
return;
}
if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_RTV,
fc_rport_rtv_resp, rdata,
2 * lport->r_a_tov))
[SCSI] libfc: fix memory corruption caused by double frees and bad error handling I was running into several different panics under stress, which I traced down to a few different possible slab corruption issues in error handling paths. I have not yet looked into why these exchange sends fail, but with these fixes my test system is much more stable under stress than before. fc_elsct_send() could fail and either leave the passed in frame intact (failure in fc_ct/els_fill) or the frame could have been freed if the failure was is fc_exch_seq_send(). The caller had no way of knowing, and there was a potential double free in the error handling in fc_fcp_rec(). Make fc_elsct_send() always free the frame before returning, and remove the fc_frame_free() call in fc_fcp_rec(). While fc_exch_seq_send() did always consume the frame, there were double free bugs in the error handling of fc_fcp_cmd_send() and fc_fcp_srr() as well. Numerous calls to error handling routines (fc_disc_error(), fc_lport_error(), fc_rport_error_retry() ) were passing in a frame pointer that had already been freed in the case of an error. I have changed the call sites to pass in a NULL pointer, but there may be more appropriate error codes to use. Question: Why do these error routines take a frame pointer anyway? I understand passing in a pointer encoded error to the response handlers, but the error routines take no action on a valid pointer and should never be called that way. Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-10-21 23:28:09 +00:00
fc_rport_error_retry(rdata, NULL);
else
kref_get(&rdata->kref);
}
/**
* fc_rport_enter_logo() - Send a logout (LOGO) request
* @rdata: The remote port to send the LOGO request to
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_logo(struct fc_rport_priv *rdata)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame *fp;
FC_RPORT_DBG(rdata, "Port entered LOGO state from %s state\n",
fc_rport_state(rdata));
fc_rport_state_enter(rdata, RPORT_ST_LOGO);
fp = fc_frame_alloc(lport, sizeof(struct fc_els_logo));
if (!fp) {
fc_rport_error_retry(rdata, fp);
return;
}
if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_LOGO,
fc_rport_logo_resp, rdata,
2 * lport->r_a_tov))
[SCSI] libfc: fix memory corruption caused by double frees and bad error handling I was running into several different panics under stress, which I traced down to a few different possible slab corruption issues in error handling paths. I have not yet looked into why these exchange sends fail, but with these fixes my test system is much more stable under stress than before. fc_elsct_send() could fail and either leave the passed in frame intact (failure in fc_ct/els_fill) or the frame could have been freed if the failure was is fc_exch_seq_send(). The caller had no way of knowing, and there was a potential double free in the error handling in fc_fcp_rec(). Make fc_elsct_send() always free the frame before returning, and remove the fc_frame_free() call in fc_fcp_rec(). While fc_exch_seq_send() did always consume the frame, there were double free bugs in the error handling of fc_fcp_cmd_send() and fc_fcp_srr() as well. Numerous calls to error handling routines (fc_disc_error(), fc_lport_error(), fc_rport_error_retry() ) were passing in a frame pointer that had already been freed in the case of an error. I have changed the call sites to pass in a NULL pointer, but there may be more appropriate error codes to use. Question: Why do these error routines take a frame pointer anyway? I understand passing in a pointer encoded error to the response handlers, but the error routines take no action on a valid pointer and should never be called that way. Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-10-21 23:28:09 +00:00
fc_rport_error_retry(rdata, NULL);
else
kref_get(&rdata->kref);
}
/**
* fc_rport_els_adisc_resp() - Handler for Address Discovery (ADISC) responses
* @sp: The sequence the ADISC response was on
* @fp: The ADISC response frame
* @rdata_arg: The remote port that sent the ADISC response
*
* Locking Note: This function will be called without the rport lock
* held, but it will lock, call an _enter_* function or fc_rport_error
* and then unlock the rport.
*/
static void fc_rport_adisc_resp(struct fc_seq *sp, struct fc_frame *fp,
void *rdata_arg)
{
struct fc_rport_priv *rdata = rdata_arg;
struct fc_els_adisc *adisc;
u8 op;
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received a ADISC response\n");
if (rdata->rp_state != RPORT_ST_ADISC) {
FC_RPORT_DBG(rdata, "Received a ADISC resp but in state %s\n",
fc_rport_state(rdata));
if (IS_ERR(fp))
goto err;
goto out;
}
if (IS_ERR(fp)) {
fc_rport_error(rdata, fp);
goto err;
}
/*
* If address verification failed. Consider us logged out of the rport.
* Since the rport is still in discovery, we want to be
* logged in, so go to PLOGI state. Otherwise, go back to READY.
*/
op = fc_frame_payload_op(fp);
adisc = fc_frame_payload_get(fp, sizeof(*adisc));
if (op != ELS_LS_ACC || !adisc ||
ntoh24(adisc->adisc_port_id) != rdata->ids.port_id ||
get_unaligned_be64(&adisc->adisc_wwpn) != rdata->ids.port_name ||
get_unaligned_be64(&adisc->adisc_wwnn) != rdata->ids.node_name) {
FC_RPORT_DBG(rdata, "ADISC error or mismatch\n");
fc_rport_enter_plogi(rdata);
} else {
FC_RPORT_DBG(rdata, "ADISC OK\n");
fc_rport_enter_ready(rdata);
}
out:
fc_frame_free(fp);
err:
mutex_unlock(&rdata->rp_mutex);
kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
}
/**
* fc_rport_enter_adisc() - Send Address Discover (ADISC) request
* @rdata: The remote port to send the ADISC request to
*
* Locking Note: The rport lock is expected to be held before calling
* this routine.
*/
static void fc_rport_enter_adisc(struct fc_rport_priv *rdata)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame *fp;
FC_RPORT_DBG(rdata, "sending ADISC from %s state\n",
fc_rport_state(rdata));
fc_rport_state_enter(rdata, RPORT_ST_ADISC);
fp = fc_frame_alloc(lport, sizeof(struct fc_els_adisc));
if (!fp) {
fc_rport_error_retry(rdata, fp);
return;
}
if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_ADISC,
fc_rport_adisc_resp, rdata,
2 * lport->r_a_tov))
[SCSI] libfc: fix memory corruption caused by double frees and bad error handling I was running into several different panics under stress, which I traced down to a few different possible slab corruption issues in error handling paths. I have not yet looked into why these exchange sends fail, but with these fixes my test system is much more stable under stress than before. fc_elsct_send() could fail and either leave the passed in frame intact (failure in fc_ct/els_fill) or the frame could have been freed if the failure was is fc_exch_seq_send(). The caller had no way of knowing, and there was a potential double free in the error handling in fc_fcp_rec(). Make fc_elsct_send() always free the frame before returning, and remove the fc_frame_free() call in fc_fcp_rec(). While fc_exch_seq_send() did always consume the frame, there were double free bugs in the error handling of fc_fcp_cmd_send() and fc_fcp_srr() as well. Numerous calls to error handling routines (fc_disc_error(), fc_lport_error(), fc_rport_error_retry() ) were passing in a frame pointer that had already been freed in the case of an error. I have changed the call sites to pass in a NULL pointer, but there may be more appropriate error codes to use. Question: Why do these error routines take a frame pointer anyway? I understand passing in a pointer encoded error to the response handlers, but the error routines take no action on a valid pointer and should never be called that way. Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-10-21 23:28:09 +00:00
fc_rport_error_retry(rdata, NULL);
else
kref_get(&rdata->kref);
}
/**
* fc_rport_recv_adisc_req() - Handler for Address Discovery (ADISC) requests
* @rdata: The remote port that sent the ADISC request
* @sp: The sequence the ADISC request was on
* @in_fp: The ADISC request frame
*
* Locking Note: Called with the lport and rport locks held.
*/
static void fc_rport_recv_adisc_req(struct fc_rport_priv *rdata,
struct fc_seq *sp, struct fc_frame *in_fp)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame *fp;
struct fc_exch *ep = fc_seq_exch(sp);
struct fc_els_adisc *adisc;
struct fc_seq_els_data rjt_data;
u32 f_ctl;
FC_RPORT_DBG(rdata, "Received ADISC request\n");
adisc = fc_frame_payload_get(in_fp, sizeof(*adisc));
if (!adisc) {
rjt_data.fp = NULL;
rjt_data.reason = ELS_RJT_PROT;
rjt_data.explan = ELS_EXPL_INV_LEN;
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
goto drop;
}
fp = fc_frame_alloc(lport, sizeof(*adisc));
if (!fp)
goto drop;
fc_adisc_fill(lport, fp);
adisc = fc_frame_payload_get(fp, sizeof(*adisc));
adisc->adisc_cmd = ELS_LS_ACC;
sp = lport->tt.seq_start_next(sp);
f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT;
fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
FC_TYPE_ELS, f_ctl, 0);
lport->tt.seq_send(lport, sp, fp);
drop:
fc_frame_free(in_fp);
}
/**
* fc_rport_recv_rls_req() - Handle received Read Link Status request
* @rdata: The remote port that sent the RLS request
* @sp: The sequence that the RLS was on
* @rx_fp: The PRLI request frame
*
* Locking Note: The rport lock is expected to be held before calling
* this function.
*/
static void fc_rport_recv_rls_req(struct fc_rport_priv *rdata,
struct fc_seq *sp, struct fc_frame *rx_fp)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame *fp;
struct fc_exch *ep = fc_seq_exch(sp);
struct fc_els_rls *rls;
struct fc_els_rls_resp *rsp;
struct fc_els_lesb *lesb;
struct fc_seq_els_data rjt_data;
struct fc_host_statistics *hst;
u32 f_ctl;
FC_RPORT_DBG(rdata, "Received RLS request while in state %s\n",
fc_rport_state(rdata));
rls = fc_frame_payload_get(rx_fp, sizeof(*rls));
if (!rls) {
rjt_data.reason = ELS_RJT_PROT;
rjt_data.explan = ELS_EXPL_INV_LEN;
goto out_rjt;
}
fp = fc_frame_alloc(lport, sizeof(*rsp));
if (!fp) {
rjt_data.reason = ELS_RJT_UNAB;
rjt_data.explan = ELS_EXPL_INSUF_RES;
goto out_rjt;
}
rsp = fc_frame_payload_get(fp, sizeof(*rsp));
memset(rsp, 0, sizeof(*rsp));
rsp->rls_cmd = ELS_LS_ACC;
lesb = &rsp->rls_lesb;
if (lport->tt.get_lesb) {
/* get LESB from LLD if it supports it */
lport->tt.get_lesb(lport, lesb);
} else {
fc_get_host_stats(lport->host);
hst = &lport->host_stats;
lesb->lesb_link_fail = htonl(hst->link_failure_count);
lesb->lesb_sync_loss = htonl(hst->loss_of_sync_count);
lesb->lesb_sig_loss = htonl(hst->loss_of_signal_count);
lesb->lesb_prim_err = htonl(hst->prim_seq_protocol_err_count);
lesb->lesb_inv_word = htonl(hst->invalid_tx_word_count);
lesb->lesb_inv_crc = htonl(hst->invalid_crc_count);
}
sp = lport->tt.seq_start_next(sp);
f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ | FC_FC_END_SEQ;
fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
FC_TYPE_ELS, f_ctl, 0);
lport->tt.seq_send(lport, sp, fp);
goto out;
out_rjt:
rjt_data.fp = NULL;
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
out:
fc_frame_free(rx_fp);
}
/**
* fc_rport_recv_els_req() - Handler for validated ELS requests
* @lport: The local port that received the ELS request
* @sp: The sequence that the ELS request was on
* @fp: The ELS request frame
*
* Handle incoming ELS requests that require port login.
* The ELS opcode has already been validated by the caller.
*
* Locking Note: Called with the lport lock held.
*/
static void fc_rport_recv_els_req(struct fc_lport *lport,
struct fc_seq *sp, struct fc_frame *fp)
{
struct fc_rport_priv *rdata;
struct fc_frame_header *fh;
struct fc_seq_els_data els_data;
els_data.fp = NULL;
els_data.reason = ELS_RJT_UNAB;
els_data.explan = ELS_EXPL_PLOGI_REQD;
fh = fc_frame_header_get(fp);
mutex_lock(&lport->disc.disc_mutex);
rdata = lport->tt.rport_lookup(lport, ntoh24(fh->fh_s_id));
if (!rdata) {
mutex_unlock(&lport->disc.disc_mutex);
goto reject;
}
mutex_lock(&rdata->rp_mutex);
mutex_unlock(&lport->disc.disc_mutex);
switch (rdata->rp_state) {
case RPORT_ST_PRLI:
case RPORT_ST_RTV:
case RPORT_ST_READY:
case RPORT_ST_ADISC:
break;
default:
mutex_unlock(&rdata->rp_mutex);
goto reject;
}
switch (fc_frame_payload_op(fp)) {
case ELS_PRLI:
fc_rport_recv_prli_req(rdata, sp, fp);
break;
case ELS_PRLO:
fc_rport_recv_prlo_req(rdata, sp, fp);
break;
case ELS_ADISC:
fc_rport_recv_adisc_req(rdata, sp, fp);
break;
case ELS_RRQ:
els_data.fp = fp;
lport->tt.seq_els_rsp_send(sp, ELS_RRQ, &els_data);
break;
case ELS_REC:
els_data.fp = fp;
lport->tt.seq_els_rsp_send(sp, ELS_REC, &els_data);
break;
case ELS_RLS:
fc_rport_recv_rls_req(rdata, sp, fp);
break;
default:
fc_frame_free(fp); /* can't happen */
break;
}
mutex_unlock(&rdata->rp_mutex);
return;
reject:
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &els_data);
fc_frame_free(fp);
}
/**
* fc_rport_recv_req() - Handler for requests
* @sp: The sequence the request was on
* @fp: The request frame
* @lport: The local port that received the request
*
* Locking Note: Called with the lport lock held.
*/
void fc_rport_recv_req(struct fc_seq *sp, struct fc_frame *fp,
struct fc_lport *lport)
{
struct fc_seq_els_data els_data;
/*
* Handle PLOGI and LOGO requests separately, since they
* don't require prior login.
* Check for unsupported opcodes first and reject them.
* For some ops, it would be incorrect to reject with "PLOGI required".
*/
switch (fc_frame_payload_op(fp)) {
case ELS_PLOGI:
fc_rport_recv_plogi_req(lport, sp, fp);
break;
case ELS_LOGO:
fc_rport_recv_logo_req(lport, sp, fp);
break;
case ELS_PRLI:
case ELS_PRLO:
case ELS_ADISC:
case ELS_RRQ:
case ELS_REC:
case ELS_RLS:
fc_rport_recv_els_req(lport, sp, fp);
break;
default:
fc_frame_free(fp);
els_data.fp = NULL;
els_data.reason = ELS_RJT_UNSUP;
els_data.explan = ELS_EXPL_NONE;
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &els_data);
break;
}
}
/**
* fc_rport_recv_plogi_req() - Handler for Port Login (PLOGI) requests
* @lport: The local port that received the PLOGI request
* @sp: The sequence that the PLOGI request was on
* @rx_fp: The PLOGI request frame
*
* Locking Note: The rport lock is held before calling this function.
*/
static void fc_rport_recv_plogi_req(struct fc_lport *lport,
struct fc_seq *sp, struct fc_frame *rx_fp)
{
struct fc_disc *disc;
struct fc_rport_priv *rdata;
struct fc_frame *fp = rx_fp;
struct fc_exch *ep;
struct fc_frame_header *fh;
struct fc_els_flogi *pl;
struct fc_seq_els_data rjt_data;
u32 sid, f_ctl;
rjt_data.fp = NULL;
fh = fc_frame_header_get(fp);
sid = ntoh24(fh->fh_s_id);
FC_RPORT_ID_DBG(lport, sid, "Received PLOGI request\n");
pl = fc_frame_payload_get(fp, sizeof(*pl));
if (!pl) {
FC_RPORT_ID_DBG(lport, sid, "Received PLOGI too short\n");
rjt_data.reason = ELS_RJT_PROT;
rjt_data.explan = ELS_EXPL_INV_LEN;
goto reject;
}
disc = &lport->disc;
mutex_lock(&disc->disc_mutex);
rdata = lport->tt.rport_create(lport, sid);
if (!rdata) {
mutex_unlock(&disc->disc_mutex);
rjt_data.reason = ELS_RJT_UNAB;
rjt_data.explan = ELS_EXPL_INSUF_RES;
goto reject;
}
mutex_lock(&rdata->rp_mutex);
mutex_unlock(&disc->disc_mutex);
rdata->ids.port_name = get_unaligned_be64(&pl->fl_wwpn);
rdata->ids.node_name = get_unaligned_be64(&pl->fl_wwnn);
/*
* If the rport was just created, possibly due to the incoming PLOGI,
* set the state appropriately and accept the PLOGI.
*
* If we had also sent a PLOGI, and if the received PLOGI is from a
* higher WWPN, we accept it, otherwise an LS_RJT is sent with reason
* "command already in progress".
*
* XXX TBD: If the session was ready before, the PLOGI should result in
* all outstanding exchanges being reset.
*/
switch (rdata->rp_state) {
case RPORT_ST_INIT:
FC_RPORT_DBG(rdata, "Received PLOGI in INIT state\n");
break;
case RPORT_ST_PLOGI:
FC_RPORT_DBG(rdata, "Received PLOGI in PLOGI state\n");
if (rdata->ids.port_name < lport->wwpn) {
mutex_unlock(&rdata->rp_mutex);
rjt_data.reason = ELS_RJT_INPROG;
rjt_data.explan = ELS_EXPL_NONE;
goto reject;
}
break;
case RPORT_ST_PRLI:
case RPORT_ST_RTV:
case RPORT_ST_READY:
case RPORT_ST_ADISC:
FC_RPORT_DBG(rdata, "Received PLOGI in logged-in state %d "
"- ignored for now\n", rdata->rp_state);
/* XXX TBD - should reset */
break;
case RPORT_ST_DELETE:
case RPORT_ST_LOGO:
case RPORT_ST_RESTART:
FC_RPORT_DBG(rdata, "Received PLOGI in state %s - send busy\n",
fc_rport_state(rdata));
mutex_unlock(&rdata->rp_mutex);
rjt_data.reason = ELS_RJT_BUSY;
rjt_data.explan = ELS_EXPL_NONE;
goto reject;
}
/*
* Get session payload size from incoming PLOGI.
*/
rdata->maxframe_size = fc_plogi_get_maxframe(pl, lport->mfs);
fc_frame_free(rx_fp);
/*
* Send LS_ACC. If this fails, the originator should retry.
*/
sp = lport->tt.seq_start_next(sp);
if (!sp)
goto out;
fp = fc_frame_alloc(lport, sizeof(*pl));
if (!fp)
goto out;
fc_plogi_fill(lport, fp, ELS_LS_ACC);
f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT;
ep = fc_seq_exch(sp);
fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
FC_TYPE_ELS, f_ctl, 0);
lport->tt.seq_send(lport, sp, fp);
fc_rport_enter_prli(rdata);
out:
mutex_unlock(&rdata->rp_mutex);
return;
reject:
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
fc_frame_free(fp);
}
/**
* fc_rport_recv_prli_req() - Handler for process login (PRLI) requests
* @rdata: The remote port that sent the PRLI request
* @sp: The sequence that the PRLI was on
* @rx_fp: The PRLI request frame
*
* Locking Note: The rport lock is exected to be held before calling
* this function.
*/
static void fc_rport_recv_prli_req(struct fc_rport_priv *rdata,
struct fc_seq *sp, struct fc_frame *rx_fp)
{
struct fc_lport *lport = rdata->local_port;
struct fc_exch *ep;
struct fc_frame *fp;
struct fc_frame_header *fh;
struct {
struct fc_els_prli prli;
struct fc_els_spp spp;
} *pp;
struct fc_els_spp *rspp; /* request service param page */
struct fc_els_spp *spp; /* response spp */
unsigned int len;
unsigned int plen;
enum fc_els_spp_resp resp;
struct fc_seq_els_data rjt_data;
u32 f_ctl;
u32 fcp_parm;
u32 roles = FC_RPORT_ROLE_UNKNOWN;
rjt_data.fp = NULL;
fh = fc_frame_header_get(rx_fp);
FC_RPORT_DBG(rdata, "Received PRLI request while in state %s\n",
fc_rport_state(rdata));
len = fr_len(rx_fp) - sizeof(*fh);
pp = fc_frame_payload_get(rx_fp, sizeof(*pp));
if (!pp)
goto reject_len;
plen = ntohs(pp->prli.prli_len);
if ((plen % 4) != 0 || plen > len || plen < 16)
goto reject_len;
if (plen < len)
len = plen;
plen = pp->prli.prli_spp_len;
if ((plen % 4) != 0 || plen < sizeof(*spp) ||
plen > len || len < sizeof(*pp) || plen < 12)
goto reject_len;
rspp = &pp->spp;
fp = fc_frame_alloc(lport, len);
if (!fp) {
rjt_data.reason = ELS_RJT_UNAB;
rjt_data.explan = ELS_EXPL_INSUF_RES;
goto reject;
}
sp = lport->tt.seq_start_next(sp);
WARN_ON(!sp);
pp = fc_frame_payload_get(fp, len);
WARN_ON(!pp);
memset(pp, 0, len);
pp->prli.prli_cmd = ELS_LS_ACC;
pp->prli.prli_spp_len = plen;
pp->prli.prli_len = htons(len);
len -= sizeof(struct fc_els_prli);
/* reinitialize remote port roles */
rdata->ids.roles = FC_RPORT_ROLE_UNKNOWN;
/*
* Go through all the service parameter pages and build
* response. If plen indicates longer SPP than standard,
* use that. The entire response has been pre-cleared above.
*/
spp = &pp->spp;
while (len >= plen) {
spp->spp_type = rspp->spp_type;
spp->spp_type_ext = rspp->spp_type_ext;
spp->spp_flags = rspp->spp_flags & FC_SPP_EST_IMG_PAIR;
resp = FC_SPP_RESP_ACK;
switch (rspp->spp_type) {
case 0: /* common to all FC-4 types */
break;
case FC_TYPE_FCP:
fcp_parm = ntohl(rspp->spp_params);
if (fcp_parm & FCP_SPPF_RETRY)
rdata->flags |= FC_RP_FLAGS_RETRY;
rdata->supported_classes = FC_COS_CLASS3;
if (fcp_parm & FCP_SPPF_INIT_FCN)
roles |= FC_RPORT_ROLE_FCP_INITIATOR;
if (fcp_parm & FCP_SPPF_TARG_FCN)
roles |= FC_RPORT_ROLE_FCP_TARGET;
rdata->ids.roles = roles;
spp->spp_params = htonl(lport->service_params);
break;
default:
resp = FC_SPP_RESP_INVL;
break;
}
spp->spp_flags |= resp;
len -= plen;
rspp = (struct fc_els_spp *)((char *)rspp + plen);
spp = (struct fc_els_spp *)((char *)spp + plen);
}
/*
* Send LS_ACC. If this fails, the originator should retry.
*/
f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ;
f_ctl |= FC_FC_END_SEQ | FC_FC_SEQ_INIT;
ep = fc_seq_exch(sp);
fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
FC_TYPE_ELS, f_ctl, 0);
lport->tt.seq_send(lport, sp, fp);
switch (rdata->rp_state) {
case RPORT_ST_PRLI:
fc_rport_enter_ready(rdata);
break;
default:
break;
}
goto drop;
reject_len:
rjt_data.reason = ELS_RJT_PROT;
rjt_data.explan = ELS_EXPL_INV_LEN;
reject:
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
drop:
fc_frame_free(rx_fp);
}
/**
* fc_rport_recv_prlo_req() - Handler for process logout (PRLO) requests
* @rdata: The remote port that sent the PRLO request
* @sp: The sequence that the PRLO was on
* @fp: The PRLO request frame
*
* Locking Note: The rport lock is exected to be held before calling
* this function.
*/
static void fc_rport_recv_prlo_req(struct fc_rport_priv *rdata,
struct fc_seq *sp,
struct fc_frame *fp)
{
struct fc_lport *lport = rdata->local_port;
struct fc_frame_header *fh;
struct fc_seq_els_data rjt_data;
fh = fc_frame_header_get(fp);
FC_RPORT_DBG(rdata, "Received PRLO request while in state %s\n",
fc_rport_state(rdata));
rjt_data.fp = NULL;
rjt_data.reason = ELS_RJT_UNAB;
rjt_data.explan = ELS_EXPL_NONE;
lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
fc_frame_free(fp);
}
/**
* fc_rport_recv_logo_req() - Handler for logout (LOGO) requests
* @lport: The local port that received the LOGO request
* @sp: The sequence that the LOGO request was on
* @fp: The LOGO request frame
*
* Locking Note: The rport lock is exected to be held before calling
* this function.
*/
static void fc_rport_recv_logo_req(struct fc_lport *lport,
struct fc_seq *sp,
struct fc_frame *fp)
{
struct fc_frame_header *fh;
struct fc_rport_priv *rdata;
u32 sid;
lport->tt.seq_els_rsp_send(sp, ELS_LS_ACC, NULL);
fh = fc_frame_header_get(fp);
sid = ntoh24(fh->fh_s_id);
mutex_lock(&lport->disc.disc_mutex);
rdata = lport->tt.rport_lookup(lport, sid);
if (rdata) {
mutex_lock(&rdata->rp_mutex);
FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
fc_rport_state(rdata));
fc_rport_enter_delete(rdata, RPORT_EV_LOGO);
/*
* If the remote port was created due to discovery, set state
* to log back in. It may have seen a stale RSCN about us.
*/
if (rdata->disc_id)
fc_rport_state_enter(rdata, RPORT_ST_RESTART);
mutex_unlock(&rdata->rp_mutex);
} else
FC_RPORT_ID_DBG(lport, sid,
"Received LOGO from non-logged-in port\n");
mutex_unlock(&lport->disc.disc_mutex);
fc_frame_free(fp);
}
/**
* fc_rport_flush_queue() - Flush the rport_event_queue
*/
static void fc_rport_flush_queue(void)
{
flush_workqueue(rport_event_queue);
}
/**
* fc_rport_init() - Initialize the remote port layer for a local port
* @lport: The local port to initialize the remote port layer for
*/
int fc_rport_init(struct fc_lport *lport)
{
if (!lport->tt.rport_lookup)
lport->tt.rport_lookup = fc_rport_lookup;
if (!lport->tt.rport_create)
lport->tt.rport_create = fc_rport_create;
if (!lport->tt.rport_login)
lport->tt.rport_login = fc_rport_login;
if (!lport->tt.rport_logoff)
lport->tt.rport_logoff = fc_rport_logoff;
if (!lport->tt.rport_recv_req)
lport->tt.rport_recv_req = fc_rport_recv_req;
if (!lport->tt.rport_flush_queue)
lport->tt.rport_flush_queue = fc_rport_flush_queue;
if (!lport->tt.rport_destroy)
lport->tt.rport_destroy = fc_rport_destroy;
return 0;
}
EXPORT_SYMBOL(fc_rport_init);
/**
* fc_setup_rport() - Initialize the rport_event_queue
*/
int fc_setup_rport()
{
rport_event_queue = create_singlethread_workqueue("fc_rport_eq");
if (!rport_event_queue)
return -ENOMEM;
return 0;
}
/**
* fc_destroy_rport() - Destroy the rport_event_queue
*/
void fc_destroy_rport()
{
destroy_workqueue(rport_event_queue);
}
/**
* fc_rport_terminate_io() - Stop all outstanding I/O on a remote port
* @rport: The remote port whose I/O should be terminated
*/
void fc_rport_terminate_io(struct fc_rport *rport)
{
struct fc_rport_libfc_priv *rpriv = rport->dd_data;
struct fc_lport *lport = rpriv->local_port;
lport->tt.exch_mgr_reset(lport, 0, rport->port_id);
lport->tt.exch_mgr_reset(lport, rport->port_id, 0);
}
EXPORT_SYMBOL(fc_rport_terminate_io);