[PATCH for 3.6 0/3] urgent virtio-scsi fixes

[PATCH for 3.6 0/3] urgent virtio-scsi fixes

[Paolo Bonzini]

James,

here are three important bugfixes for virtio-scsi.  All three have been
on the list for a while, I'm grouping them in this post to ease your
processing.

Two of them are also marked for stable branches.

Paolo

Paolo Bonzini (1):
  virtio-scsi: fix LUNs greater than 255

Richard W.M. Jones (1):
  virtio-scsi: initialize scatterlist structure for events

Wang Sen (1):
  virtio-scsi: fix copying of sg_list in the presence of of HighMem pages

 drivers/scsi/virtio_scsi.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

[PATCH for 3.6 2/3] virtio-scsi: initialize scatterlist structure for events

[Paolo Bonzini]

From: Richard W.M. Jones <rjones@redhat.com>

The sg struct for events is used without being initialized.  This
triggers a BUG_ON if CONFIG_DEBUG_SG is defined.

This was reported at https://bugzilla.redhat.com/show_bug.cgi?id=847548.

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 drivers/scsi/virtio_scsi.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 3e79a2f..7554d78 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -219,7 +219,7 @@ static int virtscsi_kick_event(struct virtio_scsi *vscsi,
 	struct scatterlist sg;
 	unsigned long flags;
 
-	sg_set_buf(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
+	sg_init_one(&sg, &event_node->event, sizeof(struct virtio_scsi_event));
 
 	spin_lock_irqsave(&vscsi->event_vq.vq_lock, flags);
 
-- 
1.7.1

[PATCH for 3.6 1/3] virtio-scsi: fix copying of sg_list in the presence of of HighMem pages

[Paolo Bonzini]

From: Wang Sen <senwang@linux.vnet.ibm.com>

On a 32-bit guest with virtio-scsi devices and more than 1G physical memory,
QEMU may crash or Linux will fail to boot.

This bug happens when building the sg_list that is eventually put in the virtqueue.
Each buffer from the original sg_list is added with sg_set_buf, but this will
not work for HighMem pages in table->sgl.  In that case, the original sg_list
elements do not have a valid virtual address, but sg_set_buf will use sg_virt.

For now, virtio_ring does not care about the form of the scatterlist and
simply processes the first out_num + in_num consecutive elements of the sg[]
array.  However, it is better to create a well-formed scatterlist including
the termination marker.

http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html discusses
using value assignment vs. sg_set_page to copy the scatterlist.

With sg_set_page, the driver would need to drop the marker manually in case
it was left there by a previous request, and then use sg_mark_end to add the
marker to the last entry.

Value assignment instead will copy the last entry of the source sg_list
to the destination list.  The end marker that were set by blk_rq_map_sg()
is copied too when the last entry of the source sg_list is copied to
the the last entry in destination list.

Cc: Stable kernel <stable@vger.kernel.org> # 3.4: 4fe74b1: [SCSI] virtio-scsi: SCSI driver
Signed-off-by: Wang Sen <senwang@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 drivers/scsi/virtio_scsi.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index c7030fb..3e79a2f 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -331,7 +331,7 @@ static void virtscsi_map_sgl(struct scatterlist *sg, unsigned int *p_idx,
 	int i;
 
 	for_each_sg(table->sgl, sg_elem, table->nents, i)
-		sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
+		sg[idx++] = *sg_elem;
 
 	*p_idx = idx;
 }
-- 
1.7.1

[PATCH for 3.6 3/3] virtio-scsi: fix LUNs greater than 255

[Paolo Bonzini]

virtio-scsi needs to report LUNs greater than 256 using the "flat"
format.  Because the Linux SCSI layer just maps the SCSI LUN to
an u32, without any parsing, these end up in the range from 16640
to 32767.  Fix max_lun to account for the possibility that logical
unit numbers are encoded with the "flat" format.

Cc: Stable kernel <stable@vger.kernel.org> # 3.4: 4fe74b1: [SCSI] virtio-scsi: SCSI driver
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 drivers/scsi/virtio_scsi.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 7554d78..a7cf726 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -677,7 +677,11 @@ static int __devinit virtscsi_probe(struct virtio_device *vdev)
 	cmd_per_lun = virtscsi_config_get(vdev, cmd_per_lun) ?: 1;
 	shost->cmd_per_lun = min_t(u32, cmd_per_lun, shost->can_queue);
 	shost->max_sectors = virtscsi_config_get(vdev, max_sectors) ?: 0xFFFF;
-	shost->max_lun = virtscsi_config_get(vdev, max_lun) + 1;
+
+	/* LUNs > 256 are reported with format 1, so they go in the range
+	 * 16640-32767.
+	 */
+	shost->max_lun = virtscsi_config_get(vdev, max_lun) + 1 + 0x4000;
 	shost->max_id = num_targets;
 	shost->max_channel = 0;
 	shost->max_cmd_len = VIRTIO_SCSI_CDB_SIZE;
-- 
1.7.1