linux-toradex.git/drivers/scsi/virtio_scsi.c, branch v3.14.33

virtio-scsi: fix various bad behavior on aborted requests

2014-07-09T18:18:23+00:00

commit 8faeb529b2dabb9df691d614dda18910a43d05c9 upstream.

Even though the virtio-scsi spec guarantees that all requests related
to the TMF will have been completed by the time the TMF itself completes,
the request queue's callback might not have run yet.  This causes requests
to be completed more than once, and as a result triggers a variety of
BUGs or oopses.

Signed-off-by: Paolo Bonzini 
Reviewed-by: Venkatesh Srinivas 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

virtio-scsi: avoid cancelling uninitialized work items

2014-07-09T18:18:23+00:00

commit cdda0e5acbb78f7b777049f8c27899e5c5bb368f upstream.

Calling the workqueue interface on uninitialized work items isn't a
good idea even if they're zeroed. It's not failing catastrophically only
through happy accidents.

Signed-off-by: Paolo Bonzini 
Reviewed-by: Stefan Hajnoczi 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Greg Kroah-Hartman

virtio-scsi: Skip setting affinity on uninitialized vq

2014-05-13T11:32:48+00:00

commit 0c8482ac92db5ac15792caf23b7f7df9e4f48ae1 upstream.

virtscsi_init calls virtscsi_remove_vqs on err, even before initializing
the vqs. The latter calls virtscsi_set_affinity, so let's check the
pointer there before setting affinity on it.

This fixes a panic when setting device's num_queues=2 on RHEL 6.5:

qemu-system-x86_64 ... \
-device virtio-scsi-pci,id=scsi0,addr=0x13,...,num_queues=2 \
-drive file=/stor/vm/dummy.raw,id=drive-scsi-disk,... \
-device scsi-hd,drive=drive-scsi-disk,...

[    0.354734] scsi0 : Virtio SCSI HBA
[    0.379504] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
[    0.380141] IP: [] __virtscsi_set_affinity+0x4f/0x120
[    0.380141] PGD 0
[    0.380141] Oops: 0000 [#1] SMP
[    0.380141] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.14.0+ #5
[    0.380141] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
[    0.380141] task: ffff88003c9f0000 ti: ffff88003c9f8000 task.ti: ffff88003c9f8000
[    0.380141] RIP: 0010:[]  [] __virtscsi_set_affinity+0x4f/0x120
[    0.380141] RSP: 0000:ffff88003c9f9c08  EFLAGS: 00010256
[    0.380141] RAX: 0000000000000000 RBX: ffff88003c3a9d40 RCX: 0000000000001070
[    0.380141] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
[    0.380141] RBP: ffff88003c9f9c28 R08: 00000000000136c0 R09: ffff88003c801c00
[    0.380141] R10: ffffffff81475229 R11: 0000000000000008 R12: 0000000000000000
[    0.380141] R13: ffffffff81cc7ca8 R14: ffff88003cac3d40 R15: ffff88003cac37a0
[    0.380141] FS:  0000000000000000(0000) GS:ffff88003e400000(0000) knlGS:0000000000000000
[    0.380141] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    0.380141] CR2: 0000000000000020 CR3: 0000000001c0e000 CR4: 00000000000006f0
[    0.380141] Stack:
[    0.380141]  ffff88003c3a9d40 0000000000000000 ffff88003cac3d80 ffff88003cac3d40
[    0.380141]  ffff88003c9f9c48 ffffffff814742e8 ffff88003c26d000 ffff88003c26d000
[    0.380141]  ffff88003c9f9c68 ffffffff81474321 ffff88003c26d000 ffff88003c3a9d40
[    0.380141] Call Trace:
[    0.380141]  [] virtscsi_set_affinity+0x28/0x40
[    0.380141]  [] virtscsi_remove_vqs+0x21/0x50
[    0.380141]  [] virtscsi_init+0x91/0x240
[    0.380141]  [] ? vp_get+0x50/0x70
[    0.380141]  [] virtscsi_probe+0xf4/0x280
[    0.380141]  [] virtio_dev_probe+0xe5/0x140
[    0.380141]  [] driver_probe_device+0x89/0x230
[    0.380141]  [] __driver_attach+0x9b/0xa0
[    0.380141]  [] ? driver_probe_device+0x230/0x230
[    0.380141]  [] ? driver_probe_device+0x230/0x230
[    0.380141]  [] bus_for_each_dev+0x8c/0xb0
[    0.380141]  [] driver_attach+0x19/0x20
[    0.380141]  [] bus_add_driver+0x198/0x220
[    0.380141]  [] driver_register+0x5f/0xf0
[    0.380141]  [] ? spi_transport_init+0x79/0x79
[    0.380141]  [] register_virtio_driver+0x1b/0x30
[    0.380141]  [] init+0x88/0xd6
[    0.380141]  [] ? scsi_init_procfs+0x5b/0x5b
[    0.380141]  [] do_one_initcall+0x7f/0x10a
[    0.380141]  [] kernel_init_freeable+0x14a/0x1de
[    0.380141]  [] ? kernel_init_freeable+0x1de/0x1de
[    0.380141]  [] ? rest_init+0x80/0x80
[    0.380141]  [] kernel_init+0x9/0xf0
[    0.380141]  [] ret_from_fork+0x7c/0xb0
[    0.380141]  [] ? rest_init+0x80/0x80
[    0.380141] RIP  [] __virtscsi_set_affinity+0x4f/0x120
[    0.380141]  RSP 
[    0.380141] CR2: 0000000000000020
[    0.380141] ---[ end trace 8074b70c3d5e1d73 ]---
[    0.475018] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[    0.475018]
[    0.475068] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
[    0.475068] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009

[jejb: checkpatch fixes]
Signed-off-by: Fam Zheng 
Acked-by: Paolo Bonzini 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze

2014-01-15T23:52:27+00:00

vqs are freed in virtscsi_freeze but the hotcpu_notifier is not
unregistered. We will have a use-after-free usage when the notifier
callback is called after virtscsi_freeze.

Fixes: 285e71ea6f3583a85e27cb2b9a7d8c35d4c0d558
("virtio-scsi: reset virtqueue affinity when doing cpu hotplug")

Cc: stable@vger.kernel.org
Signed-off-by: Asias He 
Reviewed-by: Paolo Bonzini 
Signed-off-by: Jason Wang 
Signed-off-by: Rusty Russell

virtio_scsi: verify if queue is broken after virtqueue_get_buf()

2013-11-11T01:23:26+00:00

If virtqueue_get_buf() returned with a NULL pointer avoid a possibly
endless loop by checking for a broken virtqueue.

Signed-off-by: Heinz Graalfs 
Signed-off-by: Rusty Russell

virtio: use size-based config accessors.

2013-10-17T00:25:37+00:00

This lets the transport do endian conversion if necessary, and insulates
the drivers from the difference.

Most drivers can use the simple helpers virtio_cread() and virtio_cwrite().

Signed-off-by: Rusty Russell

virtio: pm: use CONFIG_PM_SLEEP instead of CONFIG_PM

2013-09-23T06:15:58+00:00

The freeze and restore functions defined in virtio drivers are used
for suspend and hibernate, so CONFIG_PM_SLEEP is more appropriate than
CONFIG_PM. This patch replace all CONFIG_PM with CONFIG_PM_SLEEP for
virtio drivers that implement freeze and restore callbacks.

Signed-off-by: Aaron Lu 
Reviewed-by: Amit Shah 
Signed-off-by: Rusty Russell

virtio-scsi: Fix virtqueue affinity setup

2013-08-01T02:07:19+00:00

vscsi->num_queues counts the number of request virtqueue which does not
include the control and event virtqueue. It is wrong to subtract
VIRTIO_SCSI_VQ_BASE from vscsi->num_queues.

This patch fixes the following panic.

(qemu) device_del scsi0

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
 IP: [] __virtscsi_set_affinity+0x6f/0x120
 PGD 0
 Oops: 0000 [#1] SMP
 Modules linked in:
 CPU: 0 PID: 659 Comm: kworker/0:1 Not tainted 3.11.0-rc2+ #1172
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 Workqueue: kacpi_hotplug _handle_hotplug_event_func
 task: ffff88007bee1cc0 ti: ffff88007bfe4000 task.ti: ffff88007bfe4000
 RIP: 0010:[]  [] __virtscsi_set_affinity+0x6f/0x120
 RSP: 0018:ffff88007bfe5a38  EFLAGS: 00010202
 RAX: 0000000000000010 RBX: ffff880077fd0d28 RCX: 0000000000000050
 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000000
 RBP: ffff88007bfe5a58 R08: ffff880077f6ff00 R09: 0000000000000001
 R10: ffffffff8143e673 R11: 0000000000000001 R12: 0000000000000001
 R13: ffff880077fd0800 R14: 0000000000000000 R15: ffff88007bf489b0
 FS:  0000000000000000(0000) GS:ffff88007ea00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000020 CR3: 0000000079f8b000 CR4: 00000000000006f0
 Stack:
  ffff880077fd0d28 0000000000000000 ffff880077fd0800 0000000000000008
  ffff88007bfe5a78 ffffffff8179b37d ffff88007bccc800 ffff88007bccc800
  ffff88007bfe5a98 ffffffff8179b3b6 ffff88007bccc800 ffff880077fd0d28
 Call Trace:
  [] virtscsi_set_affinity+0x2d/0x40
  [] virtscsi_remove_vqs+0x26/0x50
  [] virtscsi_remove+0x82/0xa0
  [] virtio_dev_remove+0x22/0x70
  [] __device_release_driver+0x69/0xd0
  [] device_release_driver+0x2d/0x40
  [] bus_remove_device+0x116/0x150
  [] device_del+0x126/0x1e0
  [] device_unregister+0x16/0x30
  [] unregister_virtio_device+0x19/0x30
  [] virtio_pci_remove+0x36/0x80
  [] pci_device_remove+0x37/0x70
  [] __device_release_driver+0x69/0xd0
  [] device_release_driver+0x2d/0x40
  [] bus_remove_device+0x116/0x150
  [] device_del+0x126/0x1e0
  [] pci_stop_bus_device+0x9c/0xb0
  [] pci_stop_and_remove_bus_device+0x16/0x30
  [] acpiphp_disable_slot+0x8e/0x150
  [] hotplug_event_func+0xba/0x1a0
  [] ? acpi_os_release_object+0xe/0x12
  [] _handle_hotplug_event_func+0x31/0x70
  [] process_one_work+0x183/0x500
  [] worker_thread+0x122/0x400
  [] ? manage_workers+0x2d0/0x2d0
  [] kthread+0xce/0xe0
  [] ? kthread_freezable_should_stop+0x70/0x70
  [] ret_from_fork+0x7c/0xb0
  [] ? kthread_freezable_should_stop+0x70/0x70
 Code: 01 00 00 00 74 59 45 31 e4 83 bb c8 01 00 00 02 74 46 66 2e 0f 1f 84 00 00 00 00 00 49 63 c4 48 c1 e0 04 48 8b bc 0
3 10 02 00 00 <48> 8b 47 20 48 8b 80 d0 01 00 00 48 8b 40 50 48 85 c0 74 07 be
 RIP  [] __virtscsi_set_affinity+0x6f/0x120
  RSP 
 CR2: 0000000000000020
 ---[ end trace 99679331a3775f48 ]---

CC: stable@vger.kernel.org
Signed-off-by: Asias He 
Reviewed-by: Wanlong Gao 
Signed-off-by: Rusty Russell

virtio-scsi: reset virtqueue affinity when doing cpu hotplug

2013-04-08T13:36:56+00:00

Add hot cpu notifier to reset the request virtqueue affinity
when doing cpu hotplug.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Signed-off-by: Rusty Russell

virtio-scsi: introduce multiqueue support

2013-04-08T13:36:55+00:00

This patch adds queue steering to virtio-scsi.  When a target is sent
multiple requests, we always drive them to the same queue so that FIFO
processing order is kept.  However, if a target was idle, we can choose
a queue arbitrarily.  In this case the queue is chosen according to the
current VCPU, so the driver expects the number of request queues to be
equal to the number of VCPUs.  This makes it easy and fast to select
the queue, and also lets the driver optimize the IRQ affinity for the
virtqueues (each virtqueue's affinity is set to the CPU that "owns"
the queue).

The speedup comes from improving cache locality and giving CPU affinity
to the virtqueues, which is why this scheme was selected.  Assuming that
the thread that is sending requests to the device is I/O-bound, it is
likely to be sleeping at the time the ISR is executed, and thus executing
the ISR on the same processor that sent the requests is cheap.

However, the kernel will not execute the ISR on the "best" processor
unless you explicitly set the affinity.  This is because in practice
you will have many such I/O-bound processes and thus many otherwise
idle processors.  Then the kernel will execute the ISR on a random
processor, rather than the one that is sending requests to the device.

The alternative to per-CPU virtqueues is per-target virtqueues.  To
achieve the same locality, we could dynamically choose the virtqueue's
affinity based on the CPU of the last task that sent a request.  This
is less appealing because we do not set the affinity directly---we only
provide a hint to the irqbalanced running in userspace.  Dynamically
changing the affinity only works if the userspace applies the hint
fast enough.

Cc: linux-scsi@vger.kernel.org
Signed-off-by: Paolo Bonzini 
Signed-off-by: Wanlong Gao 
Reviewed-by: Asias He 
Tested-by: Venkatesh Srinivas 
Signed-off-by: Rusty Russell