Commit 0251ddbf authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost 

Pull virtio fixes from Michael Tsirkin:
 "A small number of fixes:

   - virtgpu is exempt from reset shutdown fow now - a more complete fix
     is in the works

   - spec compliance fixes in:
       - virtio-pci cap commands
       - vhost_scsi_send_bad_target
       - virtio console resize

   - missing locking fix in vhost-scsi

   - virtio ring - a KCSAN false positive fix

   - VHOST_*_OWNER documentation fix"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  vhost-scsi: Fix vhost_scsi_send_status()
  vhost-scsi: Fix vhost_scsi_send_bad_target()
  vhost-scsi: protect vq->log_used with vq->mutex
  vhost_task: fix vhost_task_create() documentation
  virtio_console: fix order of fields cols and rows
  virtio_console: fix missing byte order handling for cols and rows
  virtgpu: don't reset on shutdown
  virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  vhost: fix VHOST_*_OWNER documentation
  virtio_pci: Use self group type for cap commands
parents bc337235 58465d86

drivers/char/virtio_console.c

+4 −3
Original line number Diff line number Diff line
@@ -1576,8 +1576,8 @@ static void handle_control_message(struct virtio_device *vdev, 
		break;

	case VIRTIO_CONSOLE_RESIZE: {

		struct {

			__u16 rows;

			__u16 cols;

			__virtio16 cols;

			__virtio16 rows;

		} size;



		if (!is_console_port(port))
@@ -1585,7 +1585,8 @@ static void handle_control_message(struct virtio_device *vdev, 


		memcpy(&size, buf->buf + buf->offset + sizeof(*cpkt),

		       sizeof(size));

		set_console_size(port, size.rows, size.cols);

		set_console_size(port, virtio16_to_cpu(vdev, size.rows),

				 virtio16_to_cpu(vdev, size.cols));



		port->cons.hvc->irq_requested = 1;

		resize_console(port);

drivers/gpu/drm/virtio/virtgpu_drv.c

+9 −0
Original line number Diff line number Diff line
@@ -128,6 +128,14 @@ static void virtio_gpu_remove(struct virtio_device *vdev) 
	drm_dev_put(dev);

}



static void virtio_gpu_shutdown(struct virtio_device *vdev)

{

	/*

	 * drm does its own synchronization on shutdown.

	 * Do nothing here, opt out of device reset.

	 */

}



static void virtio_gpu_config_changed(struct virtio_device *vdev)

{

	struct drm_device *dev = vdev->priv;
@@ -162,6 +170,7 @@ static struct virtio_driver virtio_gpu_driver = { 
	.id_table = id_table,

	.probe = virtio_gpu_probe,

	.remove = virtio_gpu_remove,

	.shutdown = virtio_gpu_shutdown,

	.config_changed = virtio_gpu_config_changed

};

drivers/vhost/scsi.c

+56 −18
Original line number Diff line number Diff line
@@ -627,6 +627,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) 
	int ret;



	llnode = llist_del_all(&svq->completion_list);



	mutex_lock(&svq->vq.mutex);



	llist_for_each_entry_safe(cmd, t, llnode, tvc_completion_list) {

		se_cmd = &cmd->tvc_se_cmd;
@@ -660,6 +663,8 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) 
		vhost_scsi_release_cmd_res(se_cmd);

	}



	mutex_unlock(&svq->vq.mutex);



	if (signal)

		vhost_signal(&svq->vs->dev, &svq->vq);

}
@@ -994,39 +999,66 @@ static void vhost_scsi_target_queue_cmd(struct vhost_scsi_nexus *nexus, 


static void

vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq,

		       int head, unsigned int out, u8 status)

		       struct vhost_scsi_ctx *vc, u8 status)

{

	struct virtio_scsi_cmd_resp __user *resp;

	struct virtio_scsi_cmd_resp rsp;

	struct iov_iter iov_iter;

	int ret;



	memset(&rsp, 0, sizeof(rsp));

	rsp.status = status;

	resp = vq->iov[out].iov_base;

	ret = __copy_to_user(resp, &rsp, sizeof(rsp));

	if (!ret)

		vhost_add_used_and_signal(&vs->dev, vq, head, 0);



	iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in,

		      sizeof(rsp));



	ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);



	if (likely(ret == sizeof(rsp)))

		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);

	else

		pr_err("Faulted on virtio_scsi_cmd_resp\n");

}



#define TYPE_IO_CMD    0

#define TYPE_CTRL_TMF  1

#define TYPE_CTRL_AN   2



static void

vhost_scsi_send_bad_target(struct vhost_scsi *vs,

			   struct vhost_virtqueue *vq,

			   int head, unsigned out)

			   struct vhost_scsi_ctx *vc, int type)

{

	struct virtio_scsi_cmd_resp __user *resp;

	struct virtio_scsi_cmd_resp rsp;

	union {

		struct virtio_scsi_cmd_resp cmd;

		struct virtio_scsi_ctrl_tmf_resp tmf;

		struct virtio_scsi_ctrl_an_resp an;

	} rsp;

	struct iov_iter iov_iter;

	size_t rsp_size;

	int ret;



	memset(&rsp, 0, sizeof(rsp));

	rsp.response = VIRTIO_SCSI_S_BAD_TARGET;

	resp = vq->iov[out].iov_base;

	ret = __copy_to_user(resp, &rsp, sizeof(rsp));

	if (!ret)

		vhost_add_used_and_signal(&vs->dev, vq, head, 0);



	if (type == TYPE_IO_CMD) {

		rsp_size = sizeof(struct virtio_scsi_cmd_resp);

		rsp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;

	} else if (type == TYPE_CTRL_TMF) {

		rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);

		rsp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;

	} else {

		rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);

		rsp.an.response = VIRTIO_SCSI_S_BAD_TARGET;

	}



	iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in,

		      rsp_size);



	ret = copy_to_iter(&rsp, rsp_size, &iov_iter);



	if (likely(ret == rsp_size))

		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);

	else

		pr_err("Faulted on virtio_scsi_cmd_resp\n");

		pr_err("Faulted on virtio scsi type=%d\n", type);

}



static int
@@ -1390,9 +1422,9 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) 
		if (ret == -ENXIO)

			break;

		else if (ret == -EIO)

			vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);

			vhost_scsi_send_bad_target(vs, vq, &vc, TYPE_IO_CMD);

		else if (ret == -ENOMEM)

			vhost_scsi_send_status(vs, vq, vc.head, vc.out,

			vhost_scsi_send_status(vs, vq, &vc,

					       SAM_STAT_TASK_SET_FULL);

	} while (likely(!vhost_exceeds_weight(vq, ++c, 0)));

out:
@@ -1432,8 +1464,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) 
	else

		resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED;



	mutex_lock(&tmf->svq->vq.mutex);

	vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs,

				 tmf->vq_desc, &tmf->resp_iov, resp_code);

	mutex_unlock(&tmf->svq->vq.mutex);



	vhost_scsi_release_tmf_res(tmf);

}
@@ -1623,7 +1658,10 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) 
		if (ret == -ENXIO)

			break;

		else if (ret == -EIO)

			vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);

			vhost_scsi_send_bad_target(vs, vq, &vc,

						   v_req.type == VIRTIO_SCSI_T_TMF ?

						   TYPE_CTRL_TMF :

						   TYPE_CTRL_AN);

	} while (likely(!vhost_exceeds_weight(vq, ++c, 0)));

out:

	mutex_unlock(&vq->mutex);

drivers/virtio/virtio.c

+6 −0
Original line number Diff line number Diff line
@@ -407,6 +407,12 @@ static void virtio_dev_shutdown(struct device *_d) 
	if (!drv)

		return;



	/* If the driver has its own shutdown method, use that. */

	if (drv->shutdown) {

		drv->shutdown(dev);

		return;

	}



	/*

	 * Some devices get wedged if you kick them after they are

	 * reset. Mark all vqs as broken to make sure we don't.

drivers/virtio/virtio_pci_modern.c

+2 −2
Original line number Diff line number Diff line
@@ -247,7 +247,7 @@ virtio_pci_admin_cmd_dev_parts_objects_enable(struct virtio_device *virtio_dev) 
	sg_init_one(&data_sg, get_data, sizeof(*get_data));

	sg_init_one(&result_sg, result, sizeof(*result));

	cmd.opcode = cpu_to_le16(VIRTIO_ADMIN_CMD_DEVICE_CAP_GET);

	cmd.group_type = cpu_to_le16(VIRTIO_ADMIN_GROUP_TYPE_SRIOV);

	cmd.group_type = cpu_to_le16(VIRTIO_ADMIN_GROUP_TYPE_SELF);

	cmd.data_sg = &data_sg;

	cmd.result_sg = &result_sg;

	ret = vp_modern_admin_cmd_exec(virtio_dev, &cmd);
@@ -305,7 +305,7 @@ static void virtio_pci_admin_cmd_cap_init(struct virtio_device *virtio_dev) 


	sg_init_one(&result_sg, data, sizeof(*data));

	cmd.opcode = cpu_to_le16(VIRTIO_ADMIN_CMD_CAP_ID_LIST_QUERY);

	cmd.group_type = cpu_to_le16(VIRTIO_ADMIN_GROUP_TYPE_SRIOV);

	cmd.group_type = cpu_to_le16(VIRTIO_ADMIN_GROUP_TYPE_SELF);

	cmd.result_sg = &result_sg;



	ret = vp_modern_admin_cmd_exec(virtio_dev, &cmd);