Commit 079587b4 authored Aug 26, 2011 by Kiran Patil Committed by Nicholas A. Bellinger Sep 16, 2011

tcm_fc: Invalidation of DDP context for FCoE target in error conditions



Problem: HW DDP context wasn;t invalidated in case of ABORTS, etc...
This leads to the problem where memory pages which are used for DDP
as user descriptor could get reused for some other purpose (such as to
satisfy new memory allocation request either by kernel or user mode threads)
and since HW DDP context was not invalidated, HW continue to write to
those pages, hence causing memory corruption.

Fix: Either on incoming ABORTS or due to exchange time out, allowed the
target to cleanup HW DDP context if it was setup for respective ft_cmd.
Added new function to perform this cleanup, furthur it can be enhanced
for other cleanup activity.

Additinal Notes: To avoid calling ddp_done from multiple places, composed
the functionality in helper function "ft_invl_hw_context" and it is being
called from multiple places. Cleaned up code in function "ft_recv_write_data"
w.r.t DDP.

Signed-off-by: Kiran Patil <kiran.patil@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

parent bcac364a

drivers/target/tcm_fc/tfc_io.c

+30 −32

Original line number	Diff line number	Diff line
		@@ -219,12 +219,9 @@ void ft_recv_write_data(struct ft_cmd cmd, struct fc_frame fp)
		if (cmd->was_ddp_setup) {
		BUG_ON(!ep);
		BUG_ON(!lport);
		}

		/*
		* Doesn't expect payload if DDP is setup. Payload
		* is expected to be copied directly to user buffers
		* due to DDP (Large Rx offload),
		* Since DDP (Large Rx offload) was setup for this request,
		* payload is expected to be copied directly to user buffers.
		*/
		buf = fc_frame_payload_get(fp, 1);
		if (buf)
		@@ -256,6 +253,7 @@ void ft_recv_write_data(struct ft_cmd cmd, struct fc_frame fp)
		goto last_frame;
		else
		goto drop;
		}

		rel_off = ntohl(fh->fh_parm_offset);
		frame_len = fr_len(fp);

Admin message