Merge tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross: "Four fixes and a small cleanup patch: - two fixes by Dongli Zhang fixing races in the xenbus driver - two fixes by me fixing issues introduced in 5.6 - a small cleanup by Gustavo Silva replacing a zero-length array with a flexible-array" * tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/blkfront: fix ring info addressing xen/xenbus: fix locking xenbus: req->err should be updated before req->state xenbus: req->body should be updated before req->state xen: Replace zero-length array with flexible-array member

Linus Torvalds committed 6 years ago

Commit cbee7c82 parents fa883d6 4ab50af8 files · +64 −51Browse files

Unified · Split

8 files

drivers/block/xen-blkfront.c +42 −38
drivers/xen/xen-pciback/pciback.h +1 −1
drivers/xen/xenbus/xenbus_comms.c +4 −0
drivers/xen/xenbus/xenbus_probe.c +5 −5
drivers/xen/xenbus/xenbus_probe_backend.c +3 −2
drivers/xen/xenbus/xenbus_xs.c +6 −3
include/xen/interface/io/tpmif.h +1 −1
include/xen/xenbus.h +2 −1

drivers/block/xen-blkfront.c+42−38

 	struct blk_mq_tag_set tag_set;
 	struct blkfront_ring_info *rinfo;
 	unsigned int nr_rings;
+	unsigned int rinfo_size;
 	/* Save uncomplete reqs and bios for migration. */
 	struct list_head requests;
 	struct bio_list bio_list;
 static void blkfront_gather_backend_features(struct blkfront_info *info);
 static int negotiate_mq(struct blkfront_info *info);
+#define for_each_rinfo(info, ptr, idx)				\
+	for ((ptr) = (info)->rinfo, (idx) = 0;			\
+	     (idx) < (info)->nr_rings;				\
+	     (idx)++, (ptr) = (void *)(ptr) + (info)->rinfo_size)
+static inline struct blkfront_ring_info *
+get_rinfo(const struct blkfront_info *info, unsigned int i)
+{
+	BUG_ON(i >= info->nr_rings);
+	return (void *)info->rinfo + i * info->rinfo_size;
+}
 static int get_id_from_freelist(struct blkfront_ring_info *rinfo)
 {
 	unsigned long free = rinfo->shadow_free;
 	struct blkfront_info *info = hctx->queue->queuedata;
 	struct blkfront_ring_info *rinfo = NULL;
-	BUG_ON(info->nr_rings <= qid);
+	rinfo = get_rinfo(info, qid);
-	rinfo = &info->rinfo[qid];
 	blk_mq_start_request(qd->rq);
 	spin_lock_irqsave(&rinfo->ring_lock, flags);
 	if (RING_FULL(&rinfo->ring))
 static void xlvbd_release_gendisk(struct blkfront_info *info)
 {
 	unsigned int minor, nr_minors, i;
+	struct blkfront_ring_info *rinfo;
 	if (info->rq == NULL)
 		return;
 	/* No more blkif_request(). */
 	blk_mq_stop_hw_queues(info->rq);
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		struct blkfront_ring_info *rinfo = &info->rinfo[i];
 		/* No more gnttab callback work. */
 		gnttab_cancel_free_callback(&rinfo->callback);
 static void blkif_free(struct blkfront_info *info, int suspend)
 {
 	unsigned int i;
+	struct blkfront_ring_info *rinfo;
 	/* Prevent new requests being issued until we fix things up. */
 	info->connected = suspend ?
 	if (info->rq)
 		blk_mq_stop_hw_queues(info->rq);
-	for (i = 0; i < info->nr_rings; i++)
+	for_each_rinfo(info, rinfo, i)
-		blkif_free_ring(&info->rinfo[i]);
+		blkif_free_ring(rinfo);
 	kvfree(info->rinfo);
 	info->rinfo = NULL;
 	int err;
 	unsigned int i, max_page_order;
 	unsigned int ring_page_order;
+	struct blkfront_ring_info *rinfo;
 	if (!info)
 		return -ENODEV;
 	if (err)
 		goto destroy_blkring;
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		struct blkfront_ring_info *rinfo = &info->rinfo[i];
 		/* Create shared ring, alloc event channel. */
 		err = setup_blkring(dev, rinfo);
 		if (err)
 	/* We already got the number of queues/rings in _probe */
 	if (info->nr_rings == 1) {
-		err = write_per_ring_nodes(xbt, &info->rinfo[0], dev->nodename);
+		err = write_per_ring_nodes(xbt, info->rinfo, dev->nodename);
 		if (err)
 			goto destroy_blkring;
 	} else {
 			goto abort_transaction;
 		}
-		for (i = 0; i < info->nr_rings; i++) {
+		for_each_rinfo(info, rinfo, i) {
 			memset(path, 0, pathsize);
 			snprintf(path, pathsize, "%s/queue-%u", dev->nodename, i);
-			err = write_per_ring_nodes(xbt, &info->rinfo[i], path);
+			err = write_per_ring_nodes(xbt, rinfo, path);
 			if (err) {
 				kfree(path);
 				goto destroy_blkring;
 		goto destroy_blkring;
 	}
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
 		unsigned int j;
-		struct blkfront_ring_info *rinfo = &info->rinfo[i];
 		for (j = 0; j < BLK_RING_SIZE(info); j++)
 			rinfo->shadow[j].req.u.rw.id = j + 1;
 {
 	unsigned int backend_max_queues;
 	unsigned int i;
+	struct blkfront_ring_info *rinfo;
 	BUG_ON(info->nr_rings);
 	if (!info->nr_rings)
 		info->nr_rings = 1;
-	info->rinfo = kvcalloc(info->nr_rings,
+	info->rinfo_size = struct_size(info->rinfo, shadow,
-			       struct_size(info->rinfo, shadow,
+				       BLK_RING_SIZE(info));
-					   BLK_RING_SIZE(info)),
+	info->rinfo = kvcalloc(info->nr_rings, info->rinfo_size, GFP_KERNEL);
-			       GFP_KERNEL);
 	if (!info->rinfo) {
 		xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
 		info->nr_rings = 0;
 		return -ENOMEM;
 	}
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		struct blkfront_ring_info *rinfo;
-		rinfo = &info->rinfo[i];
 		INIT_LIST_HEAD(&rinfo->indirect_pages);
 		INIT_LIST_HEAD(&rinfo->grants);
 		rinfo->dev_info = info;
 	int rc;
 	struct bio *bio;
 	unsigned int segs;
+	struct blkfront_ring_info *rinfo;
 	blkfront_gather_backend_features(info);
 	/* Reset limits changed by blk_mq_update_nr_hw_queues(). */
 	segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
 	blk_queue_max_segments(info->rq, segs / GRANTS_PER_PSEG);
-	for (r_index = 0; r_index < info->nr_rings; r_index++) {
+	for_each_rinfo(info, rinfo, r_index) {
-		struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
 		rc = blkfront_setup_indirect(rinfo);
 		if (rc)
 			return rc;
 	/* Now safe for us to use the shared ring */
 	info->connected = BLKIF_STATE_CONNECTED;
-	for (r_index = 0; r_index < info->nr_rings; r_index++) {
+	for_each_rinfo(info, rinfo, r_index) {
-		struct blkfront_ring_info *rinfo;
-		rinfo = &info->rinfo[r_index];
 		/* Kick any other new requests queued since we resumed */
 		kick_pending_request_queues(rinfo);
 	}
 	struct blkfront_info *info = dev_get_drvdata(&dev->dev);
 	int err = 0;
 	unsigned int i, j;
+	struct blkfront_ring_info *rinfo;
 	dev_dbg(&dev->dev, "blkfront_resume: %s\n", dev->nodename);
 	bio_list_init(&info->bio_list);
 	INIT_LIST_HEAD(&info->requests);
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		struct blkfront_ring_info *rinfo = &info->rinfo[i];
 		struct bio_list merge_bio;
 		struct blk_shadow *shadow = rinfo->shadow;
 	unsigned int binfo;
 	char *envp[] = { "RESIZE=1", NULL };
 	int err, i;
+	struct blkfront_ring_info *rinfo;
 	switch (info->connected) {
 	case BLKIF_STATE_CONNECTED:
 						    "physical-sector-size",
 						    sector_size);
 	blkfront_gather_backend_features(info);
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		err = blkfront_setup_indirect(&info->rinfo[i]);
+		err = blkfront_setup_indirect(rinfo);
 		if (err) {
 			xenbus_dev_fatal(info->xbdev, err, "setup_indirect at %s",
 					 info->xbdev->otherend);
 	/* Kick pending requests. */
 	info->connected = BLKIF_STATE_CONNECTED;
-	for (i = 0; i < info->nr_rings; i++)
+	for_each_rinfo(info, rinfo, i)
-		kick_pending_request_queues(&info->rinfo[i]);
+		kick_pending_request_queues(rinfo);
 	device_add_disk(&info->xbdev->dev, info->gd, NULL);
 {
 	unsigned int i;
 	unsigned long flags;
+	struct blkfront_ring_info *rinfo;
-	for (i = 0; i < info->nr_rings; i++) {
+	for_each_rinfo(info, rinfo, i) {
-		struct blkfront_ring_info *rinfo = &info->rinfo[i];
 		struct grant *gnt_list_entry, *tmp;
 		spin_lock_irqsave(&rinfo->ring_lock, flags);

drivers/xen/xen-pciback/pciback.h+1−1

@@ -52,7 +52,7 @@ struct xen_pcibk_dev_data { · 51 unmodified lines
52	unsigned int ack_intr:1; /* .. and ACK-ing */	52	unsigned int ack_intr:1; /* .. and ACK-ing */
53	unsigned long handled;	53	unsigned long handled;
54	unsigned int irq; /* Saved in case device transitions to MSI/MSI-X */	54	unsigned int irq; /* Saved in case device transitions to MSI/MSI-X */
55	char irq_name[0]; /* xen-pcibk[000:04:00.0] */	55	char irq_name[]; /* xen-pcibk[000:04:00.0] */
56	};	56	};
57		57
58	/* Used by XenBus and xen_pcibk_ops.c */	58	/* Used by XenBus and xen_pcibk_ops.c */

drivers/xen/xenbus/xenbus_comms.c+4−0

 			req->msg.type = state.msg.type;
 			req->msg.len = state.msg.len;
 			req->body = state.body;
+			/* write body, then update state */
+			virt_wmb();
 			req->state = xb_req_state_got_reply;
 			req->cb(req);
 		} else
 	if (state.req->state == xb_req_state_aborted)
 		kfree(state.req);
 	else {
+		/* write err, then update state */
+		virt_wmb();
 		state.req->state = xb_req_state_got_reply;
 		wake_up(&state.req->wq);
 	}

drivers/xen/xenbus/xenbus_probe.c+5−5

@@ -239,9 +239,9 @@ int xenbus_dev_probe(struct device *_dev) · 238 unmodified lines
239	goto fail;	239	goto fail;
240	}	240	}
241		241
242	spin_lock(&dev->reclaim_lock);	242	down(&dev->reclaim_sem);
243	err = drv->probe(dev, id);	243	err = drv->probe(dev, id);
244	spin_unlock(&dev->reclaim_lock);	244	up(&dev->reclaim_sem);
245	if (err)	245	if (err)
246	goto fail_put;	246	goto fail_put;
247		247
@@ -271,9 +271,9 @@ int xenbus_dev_remove(struct device *_dev) · 23 unmodified lines
271	free_otherend_watch(dev);	271	free_otherend_watch(dev);
272		272
273	if (drv->remove) {	273	if (drv->remove) {
274	spin_lock(&dev->reclaim_lock);	274	down(&dev->reclaim_sem);
275	drv->remove(dev);	275	drv->remove(dev);
276	spin_unlock(&dev->reclaim_lock);	276	up(&dev->reclaim_sem);
277	}	277	}
278		278
279	module_put(drv->driver.owner);	279	module_put(drv->driver.owner);
@@ -473,7 +473,7 @@ int xenbus_probe_node(struct xen_bus_type *bus, · 193 unmodified lines
473	goto fail;	473	goto fail;
474		474
475	dev_set_name(&xendev->dev, "%s", devname);	475	dev_set_name(&xendev->dev, "%s", devname);
476	spin_lock_init(&xendev->reclaim_lock);	476	sema_init(&xendev->reclaim_sem, 1);
477		477
478	/* Register with generic device framework. */	478	/* Register with generic device framework. */
479	err = device_register(&xendev->dev);	479	err = device_register(&xendev->dev);

drivers/xen/xenbus/xenbus_probe_backend.c+3−2

 #include <linux/mm.h>
 #include <linux/notifier.h>
 #include <linux/export.h>
+#include <linux/semaphore.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 	drv = to_xenbus_driver(dev->driver);
 	if (drv && drv->reclaim_memory) {
 		xdev = to_xenbus_device(dev);
-		if (!spin_trylock(&xdev->reclaim_lock))
+		if (down_trylock(&xdev->reclaim_sem))
 			return 0;
 		drv->reclaim_memory(xdev);
-		spin_unlock(&xdev->reclaim_lock);
+		up(&xdev->reclaim_sem);
 	}
 	return 0;
 }

drivers/xen/xenbus/xenbus_xs.c+6−3

 static bool test_reply(struct xb_req_data *req)
 {
-	if (req->state == xb_req_state_got_reply || !xenbus_ok())
+	if (req->state == xb_req_state_got_reply || !xenbus_ok()) {
+		/* read req->state before all other fields */
+		virt_rmb();
 		return true;
+	}
 	/* Make sure to reread req->state each time. */
 	barrier();
 static void *read_reply(struct xb_req_data *req)
 {
-	while (req->state != xb_req_state_got_reply) {
+	do {
 		wait_event(req->wq, test_reply(req));
 		if (!xenbus_ok())
 		if (req->err)
 			return ERR_PTR(req->err);
-	}
+	} while (req->state != xb_req_state_got_reply);
 	return req->body;
 }

include/xen/interface/io/tpmif.h+1−1

@@ -46,7 +46,7 @@ struct vtpm_shared_page { · 45 unmodified lines
46	uint8_t pad;	46	uint8_t pad;
47		47
48	uint8_t nr_extra_pages; /* extra pages for long packets; may be zero */	48	uint8_t nr_extra_pages; /* extra pages for long packets; may be zero */
49	uint32_t extra_pages[0]; /* grant IDs; length in nr_extra_pages */	49	uint32_t extra_pages[]; /* grant IDs; length in nr_extra_pages */
50	};	50	};
51		51
52	#endif	52	#endif

include/xen/xenbus.h+2−1

 #include <linux/completion.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/semaphore.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/xenbus.h>
 	enum xenbus_state state;
 	struct completion down;
 	struct work_struct work;
-	spinlock_t reclaim_lock;
+	struct semaphore reclaim_sem;
 };
 static inline struct xenbus_device *to_xenbus_device(struct device *dev)

Merge tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code