linux-toradex.git/drivers/scsi/virtio_scsi.c, branch v3.13.5

virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze

2014-02-06T19:34:10+00:00

commit f466f75385369a181409e46da272db3de6f5c5cb upstream.

vqs are freed in virtscsi_freeze but the hotcpu_notifier is not
unregistered. We will have a use-after-free usage when the notifier
callback is called after virtscsi_freeze.

Fixes: 285e71ea6f3583a85e27cb2b9a7d8c35d4c0d558
("virtio-scsi: reset virtqueue affinity when doing cpu hotplug")

Signed-off-by: Asias He 
Reviewed-by: Paolo Bonzini 
Signed-off-by: Jason Wang 
Signed-off-by: Rusty Russell 
Signed-off-by: Greg Kroah-Hartman

virtio_scsi: verify if queue is broken after virtqueue_get_buf()

2013-11-11T01:23:26+00:00

If virtqueue_get_buf() returned with a NULL pointer avoid a possibly
endless loop by checking for a broken virtqueue.

Signed-off-by: Heinz Graalfs 
Signed-off-by: Rusty Russell

virtio: use size-based config accessors.

2013-10-17T00:25:37+00:00

This lets the transport do endian conversion if necessary, and insulates
the drivers from the difference.

Most drivers can use the simple helpers virtio_cread() and virtio_cwrite().

Signed-off-by: Rusty Russell

virtio: pm: use CONFIG_PM_SLEEP instead of CONFIG_PM

2013-09-23T06:15:58+00:00

The freeze and restore functions defined in virtio drivers are used
for suspend and hibernate, so CONFIG_PM_SLEEP is more appropriate than
CONFIG_PM. This patch replace all CONFIG_PM with CONFIG_PM_SLEEP for
virtio drivers that implement freeze and restore callbacks.

Signed-off-by: Aaron Lu 
Reviewed-by: Amit Shah 
Signed-off-by: Rusty Russell

virtio-scsi: Fix virtqueue affinity setup

2013-08-01T02:07:19+00:00

vscsi->num_queues counts the number of request virtqueue which does not
include the control and event virtqueue. It is wrong to subtract
VIRTIO_SCSI_VQ_BASE from vscsi->num_queues.

This patch fixes the following panic.

(qemu) device_del scsi0

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
 IP: [] __virtscsi_set_affinity+0x6f/0x120
 PGD 0
 Oops: 0000 [#1] SMP
 Modules linked in:
 CPU: 0 PID: 659 Comm: kworker/0:1 Not tainted 3.11.0-rc2+ #1172
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 Workqueue: kacpi_hotplug _handle_hotplug_event_func
 task: ffff88007bee1cc0 ti: ffff88007bfe4000 task.ti: ffff88007bfe4000
 RIP: 0010:[]  [] __virtscsi_set_affinity+0x6f/0x120
 RSP: 0018:ffff88007bfe5a38  EFLAGS: 00010202
 RAX: 0000000000000010 RBX: ffff880077fd0d28 RCX: 0000000000000050
 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000000
 RBP: ffff88007bfe5a58 R08: ffff880077f6ff00 R09: 0000000000000001
 R10: ffffffff8143e673 R11: 0000000000000001 R12: 0000000000000001
 R13: ffff880077fd0800 R14: 0000000000000000 R15: ffff88007bf489b0
 FS:  0000000000000000(0000) GS:ffff88007ea00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000020 CR3: 0000000079f8b000 CR4: 00000000000006f0
 Stack:
  ffff880077fd0d28 0000000000000000 ffff880077fd0800 0000000000000008
  ffff88007bfe5a78 ffffffff8179b37d ffff88007bccc800 ffff88007bccc800
  ffff88007bfe5a98 ffffffff8179b3b6 ffff88007bccc800 ffff880077fd0d28
 Call Trace:
  [] virtscsi_set_affinity+0x2d/0x40
  [] virtscsi_remove_vqs+0x26/0x50
  [] virtscsi_remove+0x82/0xa0
  [] virtio_dev_remove+0x22/0x70
  [] __device_release_driver+0x69/0xd0
  [] device_release_driver+0x2d/0x40
  [] bus_remove_device+0x116/0x150
  [] device_del+0x126/0x1e0
  [] device_unregister+0x16/0x30
  [] unregister_virtio_device+0x19/0x30
  [] virtio_pci_remove+0x36/0x80
  [] pci_device_remove+0x37/0x70
  [] __device_release_driver+0x69/0xd0
  [] device_release_driver+0x2d/0x40
  [] bus_remove_device+0x116/0x150
  [] device_del+0x126/0x1e0
  [] pci_stop_bus_device+0x9c/0xb0
  [] pci_stop_and_remove_bus_device+0x16/0x30
  [] acpiphp_disable_slot+0x8e/0x150
  [] hotplug_event_func+0xba/0x1a0
  [] ? acpi_os_release_object+0xe/0x12
  [] _handle_hotplug_event_func+0x31/0x70
  [] process_one_work+0x183/0x500
  [] worker_thread+0x122/0x400
  [] ? manage_workers+0x2d0/0x2d0
  [] kthread+0xce/0xe0
  [] ? kthread_freezable_should_stop+0x70/0x70
  [] ret_from_fork+0x7c/0xb0
  [] ? kthread_freezable_should_stop+0x70/0x70
 Code: 01 00 00 00 74 59 45 31 e4 83 bb c8 01 00 00 02 74 46 66 2e 0f 1f 84 00 00 00 00 00 49 63 c4 48 c1 e0 04 48 8b bc 0
3 10 02 00 00 <48> 8b 47 20 48 8b 80 d0 01 00 00 48 8b 40 50 48 85 c0 74 07 be
 RIP  [] __virtscsi_set_affinity+0x6f/0x120
  RSP 
 CR2: 0000000000000020
 ---[ end trace 99679331a3775f48 ]---

CC: stable@vger.kernel.org
Signed-off-by: Asias He 
Reviewed-by: Wanlong Gao 
Signed-off-by: Rusty Russell

virtio-scsi: reset virtqueue affinity when doing cpu hotplug

2013-04-08T13:36:56+00:00

Add hot cpu notifier to reset the request virtqueue affinity
when doing cpu hotplug.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Signed-off-by: Rusty Russell

virtio-scsi: introduce multiqueue support

2013-04-08T13:36:55+00:00

This patch adds queue steering to virtio-scsi.  When a target is sent
multiple requests, we always drive them to the same queue so that FIFO
processing order is kept.  However, if a target was idle, we can choose
a queue arbitrarily.  In this case the queue is chosen according to the
current VCPU, so the driver expects the number of request queues to be
equal to the number of VCPUs.  This makes it easy and fast to select
the queue, and also lets the driver optimize the IRQ affinity for the
virtqueues (each virtqueue's affinity is set to the CPU that "owns"
the queue).

The speedup comes from improving cache locality and giving CPU affinity
to the virtqueues, which is why this scheme was selected.  Assuming that
the thread that is sending requests to the device is I/O-bound, it is
likely to be sleeping at the time the ISR is executed, and thus executing
the ISR on the same processor that sent the requests is cheap.

However, the kernel will not execute the ISR on the "best" processor
unless you explicitly set the affinity.  This is because in practice
you will have many such I/O-bound processes and thus many otherwise
idle processors.  Then the kernel will execute the ISR on a random
processor, rather than the one that is sending requests to the device.

The alternative to per-CPU virtqueues is per-target virtqueues.  To
achieve the same locality, we could dynamically choose the virtqueue's
affinity based on the CPU of the last task that sent a request.  This
is less appealing because we do not set the affinity directly---we only
provide a hint to the irqbalanced running in userspace.  Dynamically
changing the affinity only works if the userspace applies the hint
fast enough.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Tested-by: Venkatesh Srinivas 
Signed-off-by: Rusty Russell

virtio-scsi: push vq lock/unlock into virtscsi_vq_done

2013-04-08T13:36:53+00:00

Avoid duplicated code in all of the callers.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Signed-off-by: Rusty Russell

virtio-scsi: pass struct virtio_scsi to virtqueue completion function

2013-04-08T13:36:49+00:00

This will be needed soon in order to retrieve the per-target
struct.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Signed-off-by: Rusty Russell

virtio-scsi: redo allocation of target data

2013-04-08T13:36:47+00:00

virtio_scsi_target_state is now empty.  We will find new uses for it in
the next few patches, so this patch does not drop it completely.

And as James suggested, we use entries target_alloc and target_destroy
in the host template to allocate and destroy the virtio_scsi_target_state
of each target, attach this struct to scsi_target->hostdata. Now
we can get at it from the sdev with scsi_target(sdev)->hostdata.
No messing around with fixed size arrays and bulk memory allocation
and no need to pass in the maximum target size as a parameter because
everything should now happen dynamically.

Cc: James Bottomley 
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Signed-off-by: Rusty Russell