android_kernel_xiaomi_sm8450/drivers/block/virtio_blk.c
Jens Reidel 3d6f8a6ec1
Merge tag 'ASB-2024-07-05_12-5.10' of https://android.googlesource.com/kernel/common into android13-5.10-waipio
https://source.android.com/docs/security/bulletin/2024-07-01
CVE-2024-26923

* tag 'ASB-2024-07-05_12-5.10' of https://android.googlesource.com/kernel/common:
  FROMLIST: binder_alloc: Replace kcalloc with kvcalloc to mitigate OOM issues
  ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
  UPSTREAM: af_unix: Fix garbage collector racing against connect()
  ANDROID: uid_sys_stats: Use llist for deferred work
  ANDROID: uid_sys_stats: Use a single work for deferred updates
  ANDROID: GKI: Add new ABI symbol list
  ANDROID: 16K: Only check basename of linker context
  UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
  ANDROID: cpufreq: brcmstb-avs-cpufreq: fix build error
  Revert "remoteproc: Add new get_loaded_rsc_table() to rproc_ops"
  Revert "remoteproc: stm32: Move resource table setup to rproc_ops"
  Revert "remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef"
  Revert "remoteproc: stm32: fix phys_addr_t format string"
  Revert "remoteproc: stm32: use correct format strings on 64-bit"
  Revert "remoteproc: stm32: Fix incorrect type in assignment for va"
  Revert "block: add a new set_read_only method"
  Revert "md: implement ->set_read_only to hook into BLKROSET processing"
  Revert "md: Don't clear MD_CLOSING when the raid is about to stop"
  Revert "bpf: Defer the free of inner map when necessary"
  Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
  Revert "regmap: allow to define reg_update_bits for no bus configuration"
  Revert "regmap: Add bulk read/write callbacks into regmap_config"
  Revert "serial: max310x: make accessing revision id interface-agnostic"
  Revert "serial: max310x: implement I2C support"
  Revert "serial: max310x: fix IO data corruption in batched operations"
  Revert "geneve: make sure to pull inner header in geneve_rx()"
  Revert "mptcp: fix lockless access in subflow ULP diag"
  Revert "net: dev: Convert sa_data to flexible array in struct sockaddr"
  Revert "arp: Prevent overflow in arp_req_get()."
  Revert "usb: roles: fix NULL pointer issue when put module's reference"
  Revert "usb: roles: don't get/set_role() when usb_role_switch is unregistered"
  Linux 5.10.214
  remoteproc: stm32: fix phys_addr_t format string
  regmap: Add missing map->bus check
  spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
  bpf: report RCU QS in cpumap kthread
  rcu: add a helper to report consolidated flavor QS
  netfilter: nf_tables: do not compare internal table flags on updates
  ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
  scsi: fc: Update formal FPIN descriptor definitions
  netfilter: nft_set_pipapo: release elements in clone only from destroy path
  octeontx2-af: Use separate handlers for interrupts
  net/bnx2x: Prevent access to a freed page in page_pool
  hsr: Handle failures in module init
  rds: introduce acquire/release ordering in acquire/release_in_xmit()
  wireguard: receive: annotate data-race around receiving_counter.counter
  net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
  packet: annotate data-races around ignore_outgoing
  hsr: Fix uninit-value access in hsr_get_node()
  soc: fsl: dpio: fix kcalloc() argument order
  s390/vtime: fix average steal time calculation
  octeontx2-af: Use matching wake_up API variant in CGX command interface
  io_uring: don't save/restore iowait state
  usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
  staging: greybus: fix get_channel_from_mode() failure path
  serial: 8250_exar: Don't remove GPIO device on suspend
  rtc: mt6397: select IRQ_DOMAIN instead of depending on it
  kconfig: fix infinite loop when expanding a macro at the end of file
  tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
  serial: max310x: fix syntax error in IRQ error message
  tty: vt: fix 20 vs 0x20 typo in EScsiignore
  remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
  remoteproc: stm32: Fix incorrect type in assignment for va
  remoteproc: stm32: use correct format strings on 64-bit
  remoteproc: stm32: Move resource table setup to rproc_ops
  remoteproc: Add new get_loaded_rsc_table() to rproc_ops
  remoteproc: stm32: Constify st_rproc_ops
  afs: Revert "afs: Hide silly-rename files from userspace"
  NFS: Fix an off by one in root_nfs_cat()
  watchdog: stm32_iwdg: initialize default timeout
  NFSv4.2: fix listxattr maximum XDR buffer size
  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
  net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
  scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
  RDMA/device: Fix a race between mad_client and cm_client init
  scsi: csiostor: Avoid function pointer casts
  f2fs: compress: fix to check unreleased compressed cluster
  RDMA/srpt: Do not register event handler until srpt device is fully setup
  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
  clk: Fix clk_core_get NULL dereference
  sparc32: Fix section mismatch in leon_pci_grpci
  backlight: lp8788: Fully initialize backlight_properties during probe
  backlight: lm3639: Fully initialize backlight_properties during probe
  backlight: da9052: Fully initialize backlight_properties during probe
  backlight: lm3630a: Don't set bl->props.brightness in get_brightness
  backlight: lm3630a: Initialize backlight_properties on init
  leds: sgm3140: Add missing timer cleanup and flash gpio control
  leds: aw2013: Unlock mutex before destroying it
  powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
  drm/msm/dpu: add division of drm_display_mode's hskew parameter
  powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
  media: ttpci: fix two memleaks in budget_av_attach
  media: go7007: fix a memleak in go7007_load_encoder
  media: dvb-frontends: avoid stack overflow warnings with clang
  media: pvrusb2: fix uaf in pvr2_context_set_notify
  drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
  ASoC: meson: axg-tdm-interface: add frame rate constraint
  ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
  mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
  mtd: maps: physmap-core: fix flash size larger than 32-bit
  drm/tidss: Fix initial plane zpos values
  crypto: arm/sha - fix function cast warnings
  mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
  mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
  drm/tegra: put drm_gem_object ref on error in tegra_fb_create
  clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
  PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
  drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
  clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
  media: pvrusb2: fix pvr2_stream_callback casts
  media: pvrusb2: remove redundant NULL check
  media: go7007: add check of return value of go7007_read_addr()
  media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
  media: sun8i-di: Fix chroma difference threshold
  media: sun8i-di: Fix power on/off sequences
  media: sun8i-di: Fix coefficient writes
  ASoC: meson: t9015: fix function pointer type mismatch
  ASoC: meson: aiu: fix function pointer type mismatch
  ASoC: meson: Use dev_err_probe() helper
  perf stat: Avoid metric-only segv
  ALSA: seq: fix function cast warnings
  drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
  perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
  crypto: xilinx - call finalize with bh disabled
  PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  quota: Fix rcu annotations of inode dquot pointers
  quota: Fix potential NULL pointer dereference
  quota: simplify drop_dquot_ref()
  clk: qcom: reset: Ensure write completion on reset de/assertion
  clk: qcom: reset: Commonize the de/assert functions
  pinctrl: mediatek: Drop bogus slew rate register range for MT8192
  media: edia: dvbdev: fix a use-after-free
  media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
  media: v4l2-tpg: fix some memleaks in tpg_alloc
  media: em28xx: annotate unchecked call to media_device_register()
  perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
  HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
  perf record: Fix possible incorrect free in record__switch_output()
  PCI/DPC: Print all TLP Prefixes, not just the first
  media: tc358743: register v4l2 async device only after successful setup
  dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
  drm/lima: fix a memleak in lima_heap_alloc
  drm/rockchip: lvds: do not print scary message when probing defer
  drm/rockchip: lvds: do not overwrite error code
  drm: Don't treat 0 as -1 in drm_fixp2int_ceil
  drm/rockchip: inno_hdmi: Fix video timing
  drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
  drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
  drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
  drm/tegra: dsi: Make use of the helper function dev_err_probe()
  drm/tegra: dsi: Add missing check for of_find_device_by_node
  dm: call the resume method on internal suspend
  dm raid: fix false positive for requeue needed during reshape
  nfp: flower: handle acti_netdevs allocation failure
  net/x25: fix incorrect parameter validation in the x25_getsockopt() function
  net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
  udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
  l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
  ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
  bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
  net/ipv4/ipv6: Replace one-element arraya with flexible-array members
  net/ipv4: Revert use of struct_size() helper
  net/ipv4: Replace one-element array with flexible-array member
  tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
  OPP: debugfs: Fix warning around icc_get_name()
  net: phy: dp83822: Fix RGMII TX delay configuration
  net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
  net: hns3: fix port duplex configure error in IMP reset
  net: phy: fix phy_get_internal_delay accessing an empty array
  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  ipv6: fib6_rules: flush route cache when rule is changed
  bpf: Fix stackmap overflow check on 32-bit arches
  bpf: Fix hashtab overflow check on 32-bit arches
  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  bpf: Eliminate rlimit-based memory accounting for devmap maps
  sr9800: Add check for usbnet_get_endpoints
  Bluetooth: hci_core: Fix possible buffer overflow
  Bluetooth: Remove superfluous call to hci_conn_check_pending()
  igb: Fix missing time sync events
  igb: move PEROUT and EXTTS isr logic to separate functions
  iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
  PCI: Make pci_dev_is_disconnected() helper public for other drivers
  wifi: rtw88: 8821c: Fix false alarm count
  mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
  SUNRPC: fix some memleaks in gssx_dec_option_array
  x86, relocs: Ignore relocations in .notes section
  ACPI: scan: Fix device check notification handling
  arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
  ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
  ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
  ARM: dts: imx6dl-yapp4: Move phy reset into switch node
  ARM: dts: arm: realview: Fix development chip ROM compatible value
  net: ena: Remove ena_select_queue
  wifi: brcmsmac: avoid function pointer casts
  iommu/amd: Mark interrupt as managed
  bus: tegra-aconnect: Update dependency to ARCH_TEGRA
  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
  wireless: Remove redundant 'flush_workqueue()' calls
  bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
  bpf: Factor out bpf_spin_lock into helpers.
  arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  net: blackhole_dev: fix build warning for ethh set but not used
  wifi: iwlwifi: fix EWRD table validity check
  wifi: iwlwifi: dbg-tlv: ensure NUL termination
  wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
  af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
  bpftool: Silence build warning about calloc()
  inet_diag: annotate data-races around inet_diag_table[]
  sock_diag: annotate data-races around sock_diag_handlers[family]
  cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
  wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
  wifi: wilc1000: fix multi-vif management when deleting a vif
  wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
  wifi: wilc1000: fix RCU usage in connect path
  wifi: wilc1000: fix declarations ordering
  wifi: b43: Disable QoS for bcm4331
  wifi: b43: Stop correct queue in DMA worker when QoS is disabled
  wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  timekeeping: Fix cross-timestamp interpolation for non-x86
  timekeeping: Fix cross-timestamp interpolation corner case decision
  timekeeping: Fix cross-timestamp interpolation on counter wrap
  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  md: Don't clear MD_CLOSING when the raid is about to stop
  md: implement ->set_read_only to hook into BLKROSET processing
  block: add a new set_read_only method
  fs/select: rework stack allocation hack for clang
  nbd: null check for nla_nest_start
  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  x86/paravirt: Fix build due to __text_gen_insn() backport
  ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
  ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
  ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
  Input: gpio_keys_polled - suppress deferred probe error for gpio
  ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
  firewire: core: use long bus reset on gap count error
  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  dm-verity, dm-crypt: align "struct bvec_iter" correctly
  block: sed-opal: handle empty atoms when parsing response
  parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
  net/iucv: fix the allocation size of iucv_path_table array
  x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
  x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
  RDMA/mlx5: Relax DEVX access upon modify commands
  RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  gen_compile_commands: fix invalid escape sequence warning
  HID: multitouch: Add required quirk for Synaptics 0xcddc device
  MIPS: Clear Cause.BD in instruction_pointer_set
  x86/xen: Add some null pointer checking to smp.c
  ASoC: rt5645: Make LattePanda board DMI match more precise
  selftests: tls: use exact comparison in recv_partial
  bpf: Defer the free of inner map when necessary
  rcu-tasks: Provide rcu_trace_implies_rcu_gp()
  io_uring: drop any code related to SCM_RIGHTS
  io_uring/unix: drop usage of io_uring socket
  Linux 5.10.213
  serial: max310x: fix IO data corruption in batched operations
  serial: max310x: implement I2C support
  serial: max310x: make accessing revision id interface-agnostic
  regmap: Add bulk read/write callbacks into regmap_config
  regmap: allow to define reg_update_bits for no bus configuration
  Drivers: hv: vmbus: Drop error message when 'No request id available'
  serial: max310x: Unprepare and disable clock in error path
  getrusage: use sig->stats_lock rather than lock_task_sighand()
  getrusage: use __for_each_thread()
  getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  getrusage: add the "signal_struct *sig" local variable
  mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
  mm/hugetlb: change hugetlb_reserve_pages() to type bool
  hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
  hv_netvsc: use netif_is_bond_master() instead of open code
  hv_netvsc: Make netvsc/VF binding check both MAC and serial number
  hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening
  Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening
  ext4: convert to exclusive lock while inserting delalloc extents
  ext4: refactor ext4_da_map_blocks()
  ext4: make ext4_es_insert_extent() return void
  lsm: fix default return value of the socket_getpeersec_*() hooks
  lsm: make security_socket_getpeersec_stream() sockptr_t safe
  bpf: net: Change sk_getsockopt() to take the sockptr_t argument
  net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
  serial: max310x: prevent infinite while() loop in port startup
  serial: max310x: use a separate regmap for each port
  serial: max310x: use regmap methods for SPI batch operations
  serial: max310x: Make use of device properties
  serial: max310x: fail probe if clock crystal is unstable
  serial: max310x: Try to get crystal clock rate from property
  serial: max310x: Use devm_clk_get_optional() to get the input clock
  xhci: handle isoc Babble and Buffer Overrun events properly
  xhci: process isoc TD properly when there was a transaction error mid TD.
  xhci: prevent double-fetch of transfer and transfer event TRBs
  xhci: remove extra loop in interrupt context
  um: allow not setting extra rpaths in the linux binary
  selftests: mm: fix map_hugetlb failure on 64K page size systems
  selftests/mm: switch to bash from sh
  netrom: Fix data-races around sysctl_net_busy_read
  netrom: Fix a data-race around sysctl_netrom_link_fails_count
  netrom: Fix a data-race around sysctl_netrom_routing_control
  netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
  netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
  netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
  netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
  netrom: Fix a data-race around sysctl_netrom_default_path_quality
  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  netfilter: nft_ct: fix l3num expectations with inet pseudo family
  net/rds: fix WARNING in rds_conn_connect_if_down
  cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  geneve: make sure to pull inner header in geneve_rx()
  tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
  i40e: disable NAPI right after disabling irqs when handling xsk_pool
  ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
  net: lan78xx: fix runtime PM count underflow on link stop
  lan78xx: Fix race conditions in suspend/resume handling
  lan78xx: Fix partial packet errors on suspend/resume
  lan78xx: Add missing return code checks
  lan78xx: Fix white space and style issues
  mmc: mmci: stm32: fix DMA API overlapping mappings warning
  mmc: mmci: stm32: use a buffer for unaligned DMA requests
  Linux 5.10.212
  mptcp: fix double-free on socket dismantle
  mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
  gpio: fix resource unwinding order in error path
  gpiolib: Fix the error path order in gpiochip_add_data_with_key()
  gpio: 74x164: Enable output pins after registers are reset
  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  cachefiles: fix memory leak in cachefiles_add_cache()
  ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
  mptcp: fix possible deadlock in subflow diag
  x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
  pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
  mmc: sdhci-xenon: fix PHY init clock stability
  mmc: sdhci-xenon: add timeout for PHY init complete
  mmc: core: Fix eMMC initialization with 1-bit bus connection
  dmaengine: fsl-qdma: init irq after reg initialization
  dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
  btrfs: dev-replace: properly validate device names
  wifi: nl80211: reject iftype change with mesh ID change
  gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  tomoyo: fix UAF write bug in tomoyo_write_control()
  riscv: Sparse-Memory/vmemmap out-of-bounds fix
  afs: Fix endless loop in directory parsing
  ALSA: Drop leftover snd-rtctimer stuff from Makefile
  power: supply: bq27xxx-i2c: Do not free non existing IRQ
  efi/capsule-loader: fix incorrect allocation size
  rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
  Bluetooth: Enforce validation on max value of connection interval
  Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
  Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
  Bluetooth: Avoid potential use-after-free in hci_error_reset
  net: usb: dm9601: fix wrong return value in dm9601_mdio_read
  lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  tun: Fix xdp_rxq_info's queue_index when detaching
  net: ip_tunnel: prevent perpetual headroom growth
  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  mtd: spinand: gigadevice: Fix the get ecc status issue
  mtd: spinand: gigadevice: Support GD5F1GQ5UExxG
  crypto: virtio/akcipher - Fix stack overflow on memcpy
  platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
  Linux 5.10.211
  ext4: regenerate buddy after block freeing failed if under fc replay
  arp: Prevent overflow in arp_req_get().
  fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  block: ataflop: more blk-mq refactoring fixes
  drm/amd/display: Fix memory leak in dm_sw_fini()
  drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
  drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
  netfilter: nf_tables: set dormant flag on hook register failure
  tls: stop recv() if initial process_rx_list gave us non-DATA
  tls: rx: drop pointless else after goto
  tls: rx: jump to a more appropriate label
  s390: use the correct count for __iowrite64_copy()
  net: dev: Convert sa_data to flexible array in struct sockaddr
  packet: move from strlcpy with unused retval to strscpy
  ipv6: sr: fix possible use-after-free and null-ptr-deref
  afs: Increase buffer size in afs_update_volume_status()
  ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
  ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
  nouveau: fix function cast warnings
  scsi: jazz_esp: Only build if SCSI core is builtin
  bpf, scripts: Correct GPL license name
  RDMA/srpt: fix function pointer cast warnings
  arm64: dts: rockchip: set num-cs property for spi on px30
  RDMA/qedr: Fix qedr_create_user_qp error flow
  RDMA/srpt: Support specifying the srpt_service_guid parameter
  RDMA/bnxt_re: Return error for SRQ resize
  IB/hfi1: Fix a memleak in init_credit_return
  mptcp: fix lockless access in subflow ULP diag
  usb: roles: don't get/set_role() when usb_role_switch is unregistered
  usb: roles: fix NULL pointer issue when put module's reference
  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  usb: cdns3: fix memory double free when handle zero packet
  usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
  x86/alternative: Make custom return thunk unconditional
  Revert "x86/alternative: Make custom return thunk unconditional"
  x86/returnthunk: Allow different return thunks
  x86/ftrace: Use alternative RET encoding
  x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
  x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
  Revert "x86/ftrace: Use alternative RET encoding"
  ARM: ep93xx: Add terminator to gpiod_lookup_table
  l2tp: pass correct message length to ip6_append_data
  PCI/MSI: Prevent MSI hardware interrupt number truncation
  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
  KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
  dm-crypt: don't modify the data when using authenticated encryption
  s390/cio: fix invalid -EBUSY on ccw_device_start
  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  erofs: fix lz4 inplace decompression
  x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
  jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
  jbd2: recheck chechpointing non-dirty buffer
  jbd2: remove redundant buffer io error checks
  iwlwifi: mvm: write queue_sync_state only for sync
  iwlwifi: mvm: do more useful queue sync accounting
  platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
  lan743x: fix for potential NULL pointer dereference with bare card
  btrfs: do not pin logs too early during renames
  btrfs: unify lookup return value when dir entry is missing
  btrfs: introduce btrfs_lookup_match_dir
  btrfs: tree-checker: check for overlapping extent items
  task_stack, x86/cea: Force-inline stack helpers
  ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
  ASoC: Intel: boards: get codec device with ACPI instead of bus search
  ASoC: Intel: boards: harden codec property handling
  mtd: spinand: macronix: Add support for MX35LFxGE4AD
  cifs: add a warning when the in-flight count goes negative
  powerpc/watchpoints: Annotate atomic context in more places
  powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions
  block: ataflop: fix breakage introduced at blk-mq refactoring
  seccomp: Invalidate seccomp mode to catch death failures
  x86/uaccess: Implement macros for CMPXCHG on user addresses
  hsr: Avoid double remove of a node.
  hvc/xen: prevent concurrent accesses to the shared ring
  media: av7110: prevent underflow in write_ts_to_decoder()
  ASoC: fsl_micfil: register platform component before registering cpu dai
  ARM: dts: imx: Set default tuning step for imx6sx usdhc
  irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
  ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
  pmdomain: renesas: r8a77980-sysc: CR7 must be always on
  virtio-blk: Ensure no requests in virtqueues before deleting vqs.
  firewire: core: send bus reset promptly on gap count error
  scsi: lpfc: Use unsigned type for num_sge
  hwmon: (coretemp) Enlarge per package core count limit
  efi: Don't add memblocks for soft-reserved memory
  efi: runtime: Fix potential overflow of soft-reserved region size
  Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
  ext4: correct the hole length returned by ext4_map_blocks()
  nvmet-fc: abort command when there is no binding
  nvmet-fc: release reference on target port
  nvmet-fcloop: swap the list_add_tail arguments
  nvme-fc: do not wait in vain when unloading module
  netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
  spi: sh-msiof: avoid integer overflow in constants
  ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
  nvmet-tcp: fix nvme tcp ida memory leak
  regulator: pwm-regulator: Add validity checks in continuous .get_voltage
  dmaengine: ti: edma: Add some null pointer checks to the edma_probe
  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  ahci: asm1166: correct count of reported ports
  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  fbdev: sis: Error out if pixclock equals zero
  fbdev: savage: Error out if pixclock equals zero
  wifi: mac80211: fix race condition on enabling fast-xmit
  wifi: cfg80211: fix missing interfaces when dumping
  dmaengine: fsl-qdma: increase size of 'irq_name'
  dmaengine: shdma: increase size of 'dev_id'
  scsi: target: core: Add TMF to tmr_list handling
  sched/rt: Disallow writing invalid values to sched_rt_period_us
  sched/rt: Fix sysctl_sched_rr_timeslice intial value
  zonefs: Improve error handling
  userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
  sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  smb: client: fix parsing of SMB3.1.1 POSIX create context
  smb: client: fix potential OOBs in smb2_parse_contexts()
  smb: client: fix OOB in receive_encrypted_standard()
  net/sched: Retire dsmark qdisc
  net/sched: Retire ATM qdisc
  net/sched: Retire CBQ qdisc

Change-Id: I27b365859804c2c84cb821e94fb84a971429c6d0
2024-07-23 09:40:40 +02:00

1074 lines
27 KiB
C

// SPDX-License-Identifier: GPL-2.0-only
//#define DEBUG
#include <linux/spinlock.h>
#include <linux/slab.h>
#include <linux/blkdev.h>
#include <linux/hdreg.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/interrupt.h>
#include <linux/virtio.h>
#include <linux/virtio_blk.h>
#include <linux/scatterlist.h>
#include <linux/string_helpers.h>
#include <linux/idr.h>
#include <linux/blk-mq.h>
#include <linux/blk-mq-virtio.h>
#include <linux/numa.h>
#include <uapi/linux/virtio_ring.h>
#ifdef CONFIG_GH_VIRTIO_DEBUG
#include <trace/events/gh_virtio_frontend.h>
#endif
#define PART_BITS 4
#define VQ_NAME_LEN 16
#define MAX_DISCARD_SEGMENTS 256u
static int major;
static DEFINE_IDA(vd_index_ida);
static struct workqueue_struct *virtblk_wq;
struct virtio_blk_vq {
struct virtqueue *vq;
spinlock_t lock;
char name[VQ_NAME_LEN];
} ____cacheline_aligned_in_smp;
struct virtio_blk {
/*
* This mutex must be held by anything that may run after
* virtblk_remove() sets vblk->vdev to NULL.
*
* blk-mq, virtqueue processing, and sysfs attribute code paths are
* shut down before vblk->vdev is set to NULL and therefore do not need
* to hold this mutex.
*/
struct mutex vdev_mutex;
struct virtio_device *vdev;
/* The disk structure for the kernel. */
struct gendisk *disk;
/* Block layer tags. */
struct blk_mq_tag_set tag_set;
/* Process context for config space updates */
struct work_struct config_work;
/*
* Tracks references from block_device_operations open/release and
* virtio_driver probe/remove so this object can be freed once no
* longer in use.
*/
refcount_t refs;
/* What host tells us, plus 2 for header & tailer. */
unsigned int sg_elems;
/* Ida index - used to track minor number allocations. */
int index;
/* num of vqs */
int num_vqs;
struct virtio_blk_vq *vqs;
};
struct virtblk_req {
struct virtio_blk_outhdr out_hdr;
u8 status;
struct scatterlist sg[];
};
static inline blk_status_t virtblk_result(struct virtblk_req *vbr)
{
switch (vbr->status) {
case VIRTIO_BLK_S_OK:
return BLK_STS_OK;
case VIRTIO_BLK_S_UNSUPP:
return BLK_STS_NOTSUPP;
default:
return BLK_STS_IOERR;
}
}
static int virtblk_add_req(struct virtqueue *vq, struct virtblk_req *vbr,
struct scatterlist *data_sg, bool have_data)
{
struct scatterlist hdr, status, *sgs[3];
unsigned int num_out = 0, num_in = 0;
sg_init_one(&hdr, &vbr->out_hdr, sizeof(vbr->out_hdr));
sgs[num_out++] = &hdr;
if (have_data) {
if (vbr->out_hdr.type & cpu_to_virtio32(vq->vdev, VIRTIO_BLK_T_OUT))
sgs[num_out++] = data_sg;
else
sgs[num_out + num_in++] = data_sg;
}
sg_init_one(&status, &vbr->status, sizeof(vbr->status));
sgs[num_out + num_in++] = &status;
return virtqueue_add_sgs(vq, sgs, num_out, num_in, vbr, GFP_ATOMIC);
}
static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap)
{
unsigned short segments = blk_rq_nr_discard_segments(req);
unsigned short n = 0;
struct virtio_blk_discard_write_zeroes *range;
struct bio *bio;
u32 flags = 0;
if (unmap)
flags |= VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP;
range = kmalloc_array(segments, sizeof(*range), GFP_ATOMIC);
if (!range)
return -ENOMEM;
/*
* Single max discard segment means multi-range discard isn't
* supported, and block layer only runs contiguity merge like
* normal RW request. So we can't reply on bio for retrieving
* each range info.
*/
if (queue_max_discard_segments(req->q) == 1) {
range[0].flags = cpu_to_le32(flags);
range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req));
range[0].sector = cpu_to_le64(blk_rq_pos(req));
n = 1;
} else {
__rq_for_each_bio(bio, req) {
u64 sector = bio->bi_iter.bi_sector;
u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT;
range[n].flags = cpu_to_le32(flags);
range[n].num_sectors = cpu_to_le32(num_sectors);
range[n].sector = cpu_to_le64(sector);
n++;
}
}
WARN_ON_ONCE(n != segments);
req->special_vec.bv_page = virt_to_page(range);
req->special_vec.bv_offset = offset_in_page(range);
req->special_vec.bv_len = sizeof(*range) * segments;
req->rq_flags |= RQF_SPECIAL_PAYLOAD;
return 0;
}
static inline void virtblk_request_done(struct request *req)
{
struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
if (req->rq_flags & RQF_SPECIAL_PAYLOAD) {
kfree(page_address(req->special_vec.bv_page) +
req->special_vec.bv_offset);
}
blk_mq_end_request(req, virtblk_result(vbr));
}
static void virtblk_done(struct virtqueue *vq)
{
struct virtio_blk *vblk = vq->vdev->priv;
bool req_done = false;
int qid = vq->index;
struct virtblk_req *vbr;
unsigned long flags;
unsigned int len;
spin_lock_irqsave(&vblk->vqs[qid].lock, flags);
do {
virtqueue_disable_cb(vq);
while ((vbr = virtqueue_get_buf(vblk->vqs[qid].vq, &len)) != NULL) {
struct request *req = blk_mq_rq_from_pdu(vbr);
if (likely(!blk_should_fake_timeout(req->q)))
blk_mq_complete_request(req);
#ifdef CONFIG_GH_VIRTIO_DEBUG
trace_virtio_block_done(vq->vdev->index, req_op(req), blk_rq_pos(req));
#endif
req_done = true;
}
if (unlikely(virtqueue_is_broken(vq)))
break;
} while (!virtqueue_enable_cb(vq));
/* In case queue is stopped waiting for more buffers. */
if (req_done)
blk_mq_start_stopped_hw_queues(vblk->disk->queue, true);
spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
}
static void virtio_commit_rqs(struct blk_mq_hw_ctx *hctx)
{
struct virtio_blk *vblk = hctx->queue->queuedata;
struct virtio_blk_vq *vq = &vblk->vqs[hctx->queue_num];
bool kick;
spin_lock_irq(&vq->lock);
kick = virtqueue_kick_prepare(vq->vq);
spin_unlock_irq(&vq->lock);
if (kick)
virtqueue_notify(vq->vq);
}
static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
const struct blk_mq_queue_data *bd)
{
struct virtio_blk *vblk = hctx->queue->queuedata;
struct request *req = bd->rq;
struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
unsigned long flags;
unsigned int num;
int qid = hctx->queue_num;
int err;
bool notify = false;
bool unmap = false;
u32 type;
switch (req_op(req)) {
case REQ_OP_READ:
case REQ_OP_WRITE:
type = 0;
break;
case REQ_OP_FLUSH:
type = VIRTIO_BLK_T_FLUSH;
break;
case REQ_OP_DISCARD:
type = VIRTIO_BLK_T_DISCARD;
break;
case REQ_OP_WRITE_ZEROES:
type = VIRTIO_BLK_T_WRITE_ZEROES;
unmap = !(req->cmd_flags & REQ_NOUNMAP);
break;
case REQ_OP_DRV_IN:
type = VIRTIO_BLK_T_GET_ID;
break;
default:
WARN_ON_ONCE(1);
return BLK_STS_IOERR;
}
BUG_ON(type != VIRTIO_BLK_T_DISCARD &&
type != VIRTIO_BLK_T_WRITE_ZEROES &&
(req->nr_phys_segments + 2 > vblk->sg_elems));
vbr->out_hdr.type = cpu_to_virtio32(vblk->vdev, type);
vbr->out_hdr.sector = type ?
0 : cpu_to_virtio64(vblk->vdev, blk_rq_pos(req));
vbr->out_hdr.ioprio = cpu_to_virtio32(vblk->vdev, req_get_ioprio(req));
blk_mq_start_request(req);
if (type == VIRTIO_BLK_T_DISCARD || type == VIRTIO_BLK_T_WRITE_ZEROES) {
err = virtblk_setup_discard_write_zeroes(req, unmap);
if (err)
return BLK_STS_RESOURCE;
}
num = blk_rq_map_sg(hctx->queue, req, vbr->sg);
if (num) {
if (rq_data_dir(req) == WRITE)
vbr->out_hdr.type |= cpu_to_virtio32(vblk->vdev, VIRTIO_BLK_T_OUT);
else
vbr->out_hdr.type |= cpu_to_virtio32(vblk->vdev, VIRTIO_BLK_T_IN);
}
spin_lock_irqsave(&vblk->vqs[qid].lock, flags);
err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num);
#ifdef CONFIG_GH_VIRTIO_DEBUG
trace_virtio_block_submit(vblk->vqs[qid].vq->vdev->index,
vbr->out_hdr.type, vbr->out_hdr.sector, vbr->out_hdr.ioprio, err, num);
#endif
if (err) {
virtqueue_kick(vblk->vqs[qid].vq);
/* Don't stop the queue if -ENOMEM: we may have failed to
* bounce the buffer due to global resource outage.
*/
if (err == -ENOSPC)
blk_mq_stop_hw_queue(hctx);
spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
switch (err) {
case -ENOSPC:
return BLK_STS_DEV_RESOURCE;
case -ENOMEM:
return BLK_STS_RESOURCE;
default:
return BLK_STS_IOERR;
}
}
if (bd->last && virtqueue_kick_prepare(vblk->vqs[qid].vq))
notify = true;
spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
if (notify)
virtqueue_notify(vblk->vqs[qid].vq);
return BLK_STS_OK;
}
/* return id (s/n) string for *disk to *id_str
*/
static int virtblk_get_id(struct gendisk *disk, char *id_str)
{
struct virtio_blk *vblk = disk->private_data;
struct request_queue *q = vblk->disk->queue;
struct request *req;
int err;
req = blk_get_request(q, REQ_OP_DRV_IN, 0);
if (IS_ERR(req))
return PTR_ERR(req);
err = blk_rq_map_kern(q, req, id_str, VIRTIO_BLK_ID_BYTES, GFP_KERNEL);
if (err)
goto out;
blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
err = blk_status_to_errno(virtblk_result(blk_mq_rq_to_pdu(req)));
out:
blk_put_request(req);
return err;
}
static void virtblk_get(struct virtio_blk *vblk)
{
refcount_inc(&vblk->refs);
}
static void virtblk_put(struct virtio_blk *vblk)
{
if (refcount_dec_and_test(&vblk->refs)) {
ida_simple_remove(&vd_index_ida, vblk->index);
mutex_destroy(&vblk->vdev_mutex);
kfree(vblk);
}
}
static int virtblk_open(struct block_device *bd, fmode_t mode)
{
struct virtio_blk *vblk = bd->bd_disk->private_data;
int ret = 0;
mutex_lock(&vblk->vdev_mutex);
if (vblk->vdev)
virtblk_get(vblk);
else
ret = -ENXIO;
mutex_unlock(&vblk->vdev_mutex);
return ret;
}
static void virtblk_release(struct gendisk *disk, fmode_t mode)
{
struct virtio_blk *vblk = disk->private_data;
virtblk_put(vblk);
}
/* We provide getgeo only to please some old bootloader/partitioning tools */
static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
{
struct virtio_blk *vblk = bd->bd_disk->private_data;
int ret = 0;
mutex_lock(&vblk->vdev_mutex);
if (!vblk->vdev) {
ret = -ENXIO;
goto out;
}
/* see if the host passed in geometry config */
if (virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_GEOMETRY)) {
virtio_cread(vblk->vdev, struct virtio_blk_config,
geometry.cylinders, &geo->cylinders);
virtio_cread(vblk->vdev, struct virtio_blk_config,
geometry.heads, &geo->heads);
virtio_cread(vblk->vdev, struct virtio_blk_config,
geometry.sectors, &geo->sectors);
} else {
/* some standard values, similar to sd */
geo->heads = 1 << 6;
geo->sectors = 1 << 5;
geo->cylinders = get_capacity(bd->bd_disk) >> 11;
}
out:
mutex_unlock(&vblk->vdev_mutex);
return ret;
}
static const struct block_device_operations virtblk_fops = {
.owner = THIS_MODULE,
.open = virtblk_open,
.release = virtblk_release,
.getgeo = virtblk_getgeo,
};
static int index_to_minor(int index)
{
return index << PART_BITS;
}
static int minor_to_index(int minor)
{
return minor >> PART_BITS;
}
static ssize_t serial_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct gendisk *disk = dev_to_disk(dev);
int err;
/* sysfs gives us a PAGE_SIZE buffer */
BUILD_BUG_ON(PAGE_SIZE < VIRTIO_BLK_ID_BYTES);
buf[VIRTIO_BLK_ID_BYTES] = '\0';
err = virtblk_get_id(disk, buf);
if (!err)
return strlen(buf);
if (err == -EIO) /* Unsupported? Make it empty. */
return 0;
return err;
}
static DEVICE_ATTR_RO(serial);
/* The queue's logical block size must be set before calling this */
static void virtblk_update_capacity(struct virtio_blk *vblk, bool resize)
{
struct virtio_device *vdev = vblk->vdev;
struct request_queue *q = vblk->disk->queue;
char cap_str_2[10], cap_str_10[10];
unsigned long long nblocks;
u64 capacity;
/* Host must always specify the capacity. */
virtio_cread(vdev, struct virtio_blk_config, capacity, &capacity);
/* If capacity is too big, truncate with warning. */
if ((sector_t)capacity != capacity) {
dev_warn(&vdev->dev, "Capacity %llu too large: truncating\n",
(unsigned long long)capacity);
capacity = (sector_t)-1;
}
nblocks = DIV_ROUND_UP_ULL(capacity, queue_logical_block_size(q) >> 9);
string_get_size(nblocks, queue_logical_block_size(q),
STRING_UNITS_2, cap_str_2, sizeof(cap_str_2));
string_get_size(nblocks, queue_logical_block_size(q),
STRING_UNITS_10, cap_str_10, sizeof(cap_str_10));
dev_notice(&vdev->dev,
"[%s] %s%llu %d-byte logical blocks (%s/%s)\n",
vblk->disk->disk_name,
resize ? "new size: " : "",
nblocks,
queue_logical_block_size(q),
cap_str_10,
cap_str_2);
set_capacity_revalidate_and_notify(vblk->disk, capacity, true);
}
static void virtblk_config_changed_work(struct work_struct *work)
{
struct virtio_blk *vblk =
container_of(work, struct virtio_blk, config_work);
virtblk_update_capacity(vblk, true);
}
static void virtblk_config_changed(struct virtio_device *vdev)
{
struct virtio_blk *vblk = vdev->priv;
queue_work(virtblk_wq, &vblk->config_work);
}
static int init_vq(struct virtio_blk *vblk)
{
int err;
int i;
vq_callback_t **callbacks;
const char **names;
struct virtqueue **vqs;
unsigned short num_vqs;
struct virtio_device *vdev = vblk->vdev;
struct irq_affinity desc = { 0, };
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_MQ,
struct virtio_blk_config, num_queues,
&num_vqs);
if (err)
num_vqs = 1;
num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
if (!vblk->vqs)
return -ENOMEM;
names = kmalloc_array(num_vqs, sizeof(*names), GFP_KERNEL);
callbacks = kmalloc_array(num_vqs, sizeof(*callbacks), GFP_KERNEL);
vqs = kmalloc_array(num_vqs, sizeof(*vqs), GFP_KERNEL);
if (!names || !callbacks || !vqs) {
err = -ENOMEM;
goto out;
}
for (i = 0; i < num_vqs; i++) {
callbacks[i] = virtblk_done;
snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%d", i);
names[i] = vblk->vqs[i].name;
}
/* Discover virtqueues and write information to configuration. */
err = virtio_find_vqs(vdev, num_vqs, vqs, callbacks, names, &desc);
if (err)
goto out;
for (i = 0; i < num_vqs; i++) {
spin_lock_init(&vblk->vqs[i].lock);
vblk->vqs[i].vq = vqs[i];
}
vblk->num_vqs = num_vqs;
out:
kfree(vqs);
kfree(callbacks);
kfree(names);
if (err)
kfree(vblk->vqs);
return err;
}
/*
* Legacy naming scheme used for virtio devices. We are stuck with it for
* virtio blk but don't ever use it for any new driver.
*/
static int virtblk_name_format(char *prefix, int index, char *buf, int buflen)
{
const int base = 'z' - 'a' + 1;
char *begin = buf + strlen(prefix);
char *end = buf + buflen;
char *p;
int unit;
p = end - 1;
*p = '\0';
unit = base;
do {
if (p == begin)
return -EINVAL;
*--p = 'a' + (index % unit);
index = (index / unit) - 1;
} while (index >= 0);
memmove(begin, p, end - p);
memcpy(buf, prefix, strlen(prefix));
return 0;
}
static int virtblk_get_cache_mode(struct virtio_device *vdev)
{
u8 writeback;
int err;
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_CONFIG_WCE,
struct virtio_blk_config, wce,
&writeback);
/*
* If WCE is not configurable and flush is not available,
* assume no writeback cache is in use.
*/
if (err)
writeback = virtio_has_feature(vdev, VIRTIO_BLK_F_FLUSH);
return writeback;
}
static void virtblk_update_cache_mode(struct virtio_device *vdev)
{
u8 writeback = virtblk_get_cache_mode(vdev);
struct virtio_blk *vblk = vdev->priv;
blk_queue_write_cache(vblk->disk->queue, writeback, false);
revalidate_disk_size(vblk->disk, true);
}
static const char *const virtblk_cache_types[] = {
"write through", "write back"
};
static ssize_t
cache_type_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
struct gendisk *disk = dev_to_disk(dev);
struct virtio_blk *vblk = disk->private_data;
struct virtio_device *vdev = vblk->vdev;
int i;
BUG_ON(!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_CONFIG_WCE));
i = sysfs_match_string(virtblk_cache_types, buf);
if (i < 0)
return i;
virtio_cwrite8(vdev, offsetof(struct virtio_blk_config, wce), i);
virtblk_update_cache_mode(vdev);
return count;
}
static ssize_t
cache_type_show(struct device *dev, struct device_attribute *attr, char *buf)
{
struct gendisk *disk = dev_to_disk(dev);
struct virtio_blk *vblk = disk->private_data;
u8 writeback = virtblk_get_cache_mode(vblk->vdev);
BUG_ON(writeback >= ARRAY_SIZE(virtblk_cache_types));
return snprintf(buf, 40, "%s\n", virtblk_cache_types[writeback]);
}
static DEVICE_ATTR_RW(cache_type);
static struct attribute *virtblk_attrs[] = {
&dev_attr_serial.attr,
&dev_attr_cache_type.attr,
NULL,
};
static umode_t virtblk_attrs_are_visible(struct kobject *kobj,
struct attribute *a, int n)
{
struct device *dev = kobj_to_dev(kobj);
struct gendisk *disk = dev_to_disk(dev);
struct virtio_blk *vblk = disk->private_data;
struct virtio_device *vdev = vblk->vdev;
if (a == &dev_attr_cache_type.attr &&
!virtio_has_feature(vdev, VIRTIO_BLK_F_CONFIG_WCE))
return S_IRUGO;
return a->mode;
}
static const struct attribute_group virtblk_attr_group = {
.attrs = virtblk_attrs,
.is_visible = virtblk_attrs_are_visible,
};
static const struct attribute_group *virtblk_attr_groups[] = {
&virtblk_attr_group,
NULL,
};
static int virtblk_init_request(struct blk_mq_tag_set *set, struct request *rq,
unsigned int hctx_idx, unsigned int numa_node)
{
struct virtio_blk *vblk = set->driver_data;
struct virtblk_req *vbr = blk_mq_rq_to_pdu(rq);
sg_init_table(vbr->sg, vblk->sg_elems);
return 0;
}
static int virtblk_map_queues(struct blk_mq_tag_set *set)
{
struct virtio_blk *vblk = set->driver_data;
return blk_mq_virtio_map_queues(&set->map[HCTX_TYPE_DEFAULT],
vblk->vdev, 0);
}
static const struct blk_mq_ops virtio_mq_ops = {
.queue_rq = virtio_queue_rq,
.commit_rqs = virtio_commit_rqs,
.complete = virtblk_request_done,
.init_request = virtblk_init_request,
.map_queues = virtblk_map_queues,
};
static unsigned int virtblk_queue_depth;
module_param_named(queue_depth, virtblk_queue_depth, uint, 0444);
static int virtblk_probe(struct virtio_device *vdev)
{
struct virtio_blk *vblk;
struct request_queue *q;
int err, index;
u32 v, blk_size, max_size, sg_elems, opt_io_size;
u16 min_io_size;
u8 physical_block_exp, alignment_offset;
if (!vdev->config->get) {
dev_err(&vdev->dev, "%s failure: config access disabled\n",
__func__);
return -EINVAL;
}
err = ida_simple_get(&vd_index_ida, 0, minor_to_index(1 << MINORBITS),
GFP_KERNEL);
if (err < 0)
goto out;
index = err;
/* We need to know how many segments before we allocate. */
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SEG_MAX,
struct virtio_blk_config, seg_max,
&sg_elems);
/* We need at least one SG element, whatever they say. */
if (err || !sg_elems)
sg_elems = 1;
/* We need an extra sg elements at head and tail. */
sg_elems += 2;
vdev->priv = vblk = kmalloc(sizeof(*vblk), GFP_KERNEL);
if (!vblk) {
err = -ENOMEM;
goto out_free_index;
}
/* This reference is dropped in virtblk_remove(). */
refcount_set(&vblk->refs, 1);
mutex_init(&vblk->vdev_mutex);
vblk->vdev = vdev;
vblk->sg_elems = sg_elems;
INIT_WORK(&vblk->config_work, virtblk_config_changed_work);
err = init_vq(vblk);
if (err)
goto out_free_vblk;
/* FIXME: How many partitions? How long is a piece of string? */
vblk->disk = alloc_disk(1 << PART_BITS);
if (!vblk->disk) {
err = -ENOMEM;
goto out_free_vq;
}
/* Default queue sizing is to fill the ring. */
if (!virtblk_queue_depth) {
virtblk_queue_depth = vblk->vqs[0].vq->num_free;
/* ... but without indirect descs, we use 2 descs per req */
if (!virtio_has_feature(vdev, VIRTIO_RING_F_INDIRECT_DESC))
virtblk_queue_depth /= 2;
}
memset(&vblk->tag_set, 0, sizeof(vblk->tag_set));
vblk->tag_set.ops = &virtio_mq_ops;
vblk->tag_set.queue_depth = virtblk_queue_depth;
vblk->tag_set.numa_node = NUMA_NO_NODE;
vblk->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
vblk->tag_set.cmd_size =
sizeof(struct virtblk_req) +
sizeof(struct scatterlist) * sg_elems;
vblk->tag_set.driver_data = vblk;
vblk->tag_set.nr_hw_queues = vblk->num_vqs;
err = blk_mq_alloc_tag_set(&vblk->tag_set);
if (err)
goto out_put_disk;
q = blk_mq_init_queue(&vblk->tag_set);
if (IS_ERR(q)) {
err = -ENOMEM;
goto out_free_tags;
}
vblk->disk->queue = q;
q->queuedata = vblk;
virtblk_name_format("vd", index, vblk->disk->disk_name, DISK_NAME_LEN);
vblk->disk->major = major;
vblk->disk->first_minor = index_to_minor(index);
vblk->disk->private_data = vblk;
vblk->disk->fops = &virtblk_fops;
vblk->disk->flags |= GENHD_FL_EXT_DEVT;
vblk->index = index;
/* configure queue flush support */
virtblk_update_cache_mode(vdev);
/* If disk is read-only in the host, the guest should obey */
if (virtio_has_feature(vdev, VIRTIO_BLK_F_RO))
set_disk_ro(vblk->disk, 1);
/* We can handle whatever the host told us to handle. */
blk_queue_max_segments(q, vblk->sg_elems-2);
/* No real sector limit. */
blk_queue_max_hw_sectors(q, -1U);
max_size = virtio_max_dma_size(vdev);
/* Host can optionally specify maximum segment size and number of
* segments. */
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX,
struct virtio_blk_config, size_max, &v);
if (!err)
max_size = min(max_size, v);
blk_queue_max_segment_size(q, max_size);
/* Host can optionally specify the block size of the device */
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE,
struct virtio_blk_config, blk_size,
&blk_size);
if (!err) {
err = blk_validate_block_size(blk_size);
if (err) {
dev_err(&vdev->dev,
"virtio_blk: invalid block size: 0x%x\n",
blk_size);
goto out_cleanup_disk;
}
blk_queue_logical_block_size(q, blk_size);
} else
blk_size = queue_logical_block_size(q);
/* Use topology information if available */
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY,
struct virtio_blk_config, physical_block_exp,
&physical_block_exp);
if (!err && physical_block_exp)
blk_queue_physical_block_size(q,
blk_size * (1 << physical_block_exp));
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY,
struct virtio_blk_config, alignment_offset,
&alignment_offset);
if (!err && alignment_offset)
blk_queue_alignment_offset(q, blk_size * alignment_offset);
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY,
struct virtio_blk_config, min_io_size,
&min_io_size);
if (!err && min_io_size)
blk_queue_io_min(q, blk_size * min_io_size);
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_TOPOLOGY,
struct virtio_blk_config, opt_io_size,
&opt_io_size);
if (!err && opt_io_size)
blk_queue_io_opt(q, blk_size * opt_io_size);
if (virtio_has_feature(vdev, VIRTIO_BLK_F_DISCARD)) {
virtio_cread(vdev, struct virtio_blk_config,
discard_sector_alignment, &v);
if (v)
q->limits.discard_granularity = v << SECTOR_SHIFT;
else
q->limits.discard_granularity = blk_size;
virtio_cread(vdev, struct virtio_blk_config,
max_discard_sectors, &v);
blk_queue_max_discard_sectors(q, v ? v : UINT_MAX);
virtio_cread(vdev, struct virtio_blk_config, max_discard_seg,
&v);
/*
* max_discard_seg == 0 is out of spec but we always
* handled it.
*/
if (!v)
v = sg_elems - 2;
blk_queue_max_discard_segments(q,
min(v, MAX_DISCARD_SEGMENTS));
blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
}
if (virtio_has_feature(vdev, VIRTIO_BLK_F_WRITE_ZEROES)) {
virtio_cread(vdev, struct virtio_blk_config,
max_write_zeroes_sectors, &v);
blk_queue_max_write_zeroes_sectors(q, v ? v : UINT_MAX);
}
virtblk_update_capacity(vblk, false);
virtio_device_ready(vdev);
device_add_disk(&vdev->dev, vblk->disk, virtblk_attr_groups);
return 0;
out_cleanup_disk:
blk_cleanup_queue(vblk->disk->queue);
out_free_tags:
blk_mq_free_tag_set(&vblk->tag_set);
out_put_disk:
put_disk(vblk->disk);
out_free_vq:
vdev->config->del_vqs(vdev);
kfree(vblk->vqs);
out_free_vblk:
kfree(vblk);
out_free_index:
ida_simple_remove(&vd_index_ida, index);
out:
return err;
}
static void virtblk_remove(struct virtio_device *vdev)
{
struct virtio_blk *vblk = vdev->priv;
/* Make sure no work handler is accessing the device. */
flush_work(&vblk->config_work);
del_gendisk(vblk->disk);
blk_cleanup_queue(vblk->disk->queue);
blk_mq_free_tag_set(&vblk->tag_set);
mutex_lock(&vblk->vdev_mutex);
/* Stop all the virtqueues. */
vdev->config->reset(vdev);
/* Virtqueues are stopped, nothing can use vblk->vdev anymore. */
vblk->vdev = NULL;
put_disk(vblk->disk);
vdev->config->del_vqs(vdev);
kfree(vblk->vqs);
mutex_unlock(&vblk->vdev_mutex);
virtblk_put(vblk);
}
#ifdef CONFIG_PM_SLEEP
static int virtblk_freeze(struct virtio_device *vdev)
{
struct virtio_blk *vblk = vdev->priv;
/* Ensure no requests in virtqueues before deleting vqs. */
blk_mq_freeze_queue(vblk->disk->queue);
/* Ensure we don't receive any more interrupts */
vdev->config->reset(vdev);
/* Make sure no work handler is accessing the device. */
flush_work(&vblk->config_work);
vdev->config->del_vqs(vdev);
kfree(vblk->vqs);
return 0;
}
static int virtblk_restore(struct virtio_device *vdev)
{
struct virtio_blk *vblk = vdev->priv;
int ret;
ret = init_vq(vdev->priv);
if (ret)
return ret;
virtio_device_ready(vdev);
blk_mq_unfreeze_queue(vblk->disk->queue);
return 0;
}
#endif
static const struct virtio_device_id id_table[] = {
{ VIRTIO_ID_BLOCK, VIRTIO_DEV_ANY_ID },
{ 0 },
};
static unsigned int features_legacy[] = {
VIRTIO_BLK_F_SEG_MAX, VIRTIO_BLK_F_SIZE_MAX, VIRTIO_BLK_F_GEOMETRY,
VIRTIO_BLK_F_RO, VIRTIO_BLK_F_BLK_SIZE,
VIRTIO_BLK_F_FLUSH, VIRTIO_BLK_F_TOPOLOGY, VIRTIO_BLK_F_CONFIG_WCE,
VIRTIO_BLK_F_MQ, VIRTIO_BLK_F_DISCARD, VIRTIO_BLK_F_WRITE_ZEROES,
}
;
static unsigned int features[] = {
VIRTIO_BLK_F_SEG_MAX, VIRTIO_BLK_F_SIZE_MAX, VIRTIO_BLK_F_GEOMETRY,
VIRTIO_BLK_F_RO, VIRTIO_BLK_F_BLK_SIZE,
VIRTIO_BLK_F_FLUSH, VIRTIO_BLK_F_TOPOLOGY, VIRTIO_BLK_F_CONFIG_WCE,
VIRTIO_BLK_F_MQ, VIRTIO_BLK_F_DISCARD, VIRTIO_BLK_F_WRITE_ZEROES,
};
static struct virtio_driver virtio_blk = {
.feature_table = features,
.feature_table_size = ARRAY_SIZE(features),
.feature_table_legacy = features_legacy,
.feature_table_size_legacy = ARRAY_SIZE(features_legacy),
.driver.name = KBUILD_MODNAME,
.driver.owner = THIS_MODULE,
.id_table = id_table,
.probe = virtblk_probe,
.remove = virtblk_remove,
.config_changed = virtblk_config_changed,
#ifdef CONFIG_PM_SLEEP
.freeze = virtblk_freeze,
.restore = virtblk_restore,
#endif
};
static int __init init(void)
{
int error;
virtblk_wq = alloc_workqueue("virtio-blk", 0, 0);
if (!virtblk_wq)
return -ENOMEM;
major = register_blkdev(0, "virtblk");
if (major < 0) {
error = major;
goto out_destroy_workqueue;
}
error = register_virtio_driver(&virtio_blk);
if (error)
goto out_unregister_blkdev;
return 0;
out_unregister_blkdev:
unregister_blkdev(major, "virtblk");
out_destroy_workqueue:
destroy_workqueue(virtblk_wq);
return error;
}
static void __exit fini(void)
{
unregister_virtio_driver(&virtio_blk);
unregister_blkdev(major, "virtblk");
destroy_workqueue(virtblk_wq);
}
module_init(init);
module_exit(fini);
MODULE_DEVICE_TABLE(virtio, id_table);
MODULE_DESCRIPTION("Virtio block driver");
MODULE_LICENSE("GPL");