mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-24 05:04:00 +08:00
2f8f1336a4
In normal queue cleanup path, hctx is released after request queue is freed, see blk_mq_release(). However, in __blk_mq_update_nr_hw_queues(), hctx may be freed because of hw queues shrinking. This way is easy to cause use-after-free, because: one implicit rule is that it is safe to call almost all block layer APIs if the request queue is alive; and one hctx may be retrieved by one API, then the hctx can be freed by blk_mq_update_nr_hw_queues(); finally use-after-free is triggered. Fixes this issue by always freeing hctx after releasing request queue. If some hctxs are removed in blk_mq_update_nr_hw_queues(), introduce a per-queue list to hold them, then try to resuse these hctxs if numa node is matched. Cc: Dongli Zhang <dongli.zhang@oracle.com> Cc: James Smart <james.smart@broadcom.com> Cc: Bart Van Assche <bart.vanassche@wdc.com> Cc: linux-scsi@vger.kernel.org, Cc: Martin K . Petersen <martin.petersen@oracle.com>, Cc: Christoph Hellwig <hch@lst.de>, Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>, Reviewed-by: Hannes Reinecke <hare@suse.com> Tested-by: James Smart <james.smart@broadcom.com> Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
370 lines
11 KiB
C
370 lines
11 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef BLK_MQ_H
|
|
#define BLK_MQ_H
|
|
|
|
#include <linux/blkdev.h>
|
|
#include <linux/sbitmap.h>
|
|
#include <linux/srcu.h>
|
|
|
|
struct blk_mq_tags;
|
|
struct blk_flush_queue;
|
|
|
|
/**
|
|
* struct blk_mq_hw_ctx - State for a hardware queue facing the hardware block device
|
|
*/
|
|
struct blk_mq_hw_ctx {
|
|
struct {
|
|
spinlock_t lock;
|
|
struct list_head dispatch;
|
|
unsigned long state; /* BLK_MQ_S_* flags */
|
|
} ____cacheline_aligned_in_smp;
|
|
|
|
struct delayed_work run_work;
|
|
cpumask_var_t cpumask;
|
|
int next_cpu;
|
|
int next_cpu_batch;
|
|
|
|
unsigned long flags; /* BLK_MQ_F_* flags */
|
|
|
|
void *sched_data;
|
|
struct request_queue *queue;
|
|
struct blk_flush_queue *fq;
|
|
|
|
void *driver_data;
|
|
|
|
struct sbitmap ctx_map;
|
|
|
|
struct blk_mq_ctx *dispatch_from;
|
|
unsigned int dispatch_busy;
|
|
|
|
unsigned short type;
|
|
unsigned short nr_ctx;
|
|
struct blk_mq_ctx **ctxs;
|
|
|
|
spinlock_t dispatch_wait_lock;
|
|
wait_queue_entry_t dispatch_wait;
|
|
atomic_t wait_index;
|
|
|
|
struct blk_mq_tags *tags;
|
|
struct blk_mq_tags *sched_tags;
|
|
|
|
unsigned long queued;
|
|
unsigned long run;
|
|
#define BLK_MQ_MAX_DISPATCH_ORDER 7
|
|
unsigned long dispatched[BLK_MQ_MAX_DISPATCH_ORDER];
|
|
|
|
unsigned int numa_node;
|
|
unsigned int queue_num;
|
|
|
|
atomic_t nr_active;
|
|
|
|
struct hlist_node cpuhp_dead;
|
|
struct kobject kobj;
|
|
|
|
unsigned long poll_considered;
|
|
unsigned long poll_invoked;
|
|
unsigned long poll_success;
|
|
|
|
#ifdef CONFIG_BLK_DEBUG_FS
|
|
struct dentry *debugfs_dir;
|
|
struct dentry *sched_debugfs_dir;
|
|
#endif
|
|
|
|
struct list_head hctx_list;
|
|
|
|
/* Must be the last member - see also blk_mq_hw_ctx_size(). */
|
|
struct srcu_struct srcu[0];
|
|
};
|
|
|
|
struct blk_mq_queue_map {
|
|
unsigned int *mq_map;
|
|
unsigned int nr_queues;
|
|
unsigned int queue_offset;
|
|
};
|
|
|
|
enum hctx_type {
|
|
HCTX_TYPE_DEFAULT, /* all I/O not otherwise accounted for */
|
|
HCTX_TYPE_READ, /* just for READ I/O */
|
|
HCTX_TYPE_POLL, /* polled I/O of any kind */
|
|
|
|
HCTX_MAX_TYPES,
|
|
};
|
|
|
|
struct blk_mq_tag_set {
|
|
/*
|
|
* map[] holds ctx -> hctx mappings, one map exists for each type
|
|
* that the driver wishes to support. There are no restrictions
|
|
* on maps being of the same size, and it's perfectly legal to
|
|
* share maps between types.
|
|
*/
|
|
struct blk_mq_queue_map map[HCTX_MAX_TYPES];
|
|
unsigned int nr_maps; /* nr entries in map[] */
|
|
const struct blk_mq_ops *ops;
|
|
unsigned int nr_hw_queues; /* nr hw queues across maps */
|
|
unsigned int queue_depth; /* max hw supported */
|
|
unsigned int reserved_tags;
|
|
unsigned int cmd_size; /* per-request extra data */
|
|
int numa_node;
|
|
unsigned int timeout;
|
|
unsigned int flags; /* BLK_MQ_F_* */
|
|
void *driver_data;
|
|
|
|
struct blk_mq_tags **tags;
|
|
|
|
struct mutex tag_list_lock;
|
|
struct list_head tag_list;
|
|
};
|
|
|
|
struct blk_mq_queue_data {
|
|
struct request *rq;
|
|
bool last;
|
|
};
|
|
|
|
typedef blk_status_t (queue_rq_fn)(struct blk_mq_hw_ctx *,
|
|
const struct blk_mq_queue_data *);
|
|
typedef void (commit_rqs_fn)(struct blk_mq_hw_ctx *);
|
|
typedef bool (get_budget_fn)(struct blk_mq_hw_ctx *);
|
|
typedef void (put_budget_fn)(struct blk_mq_hw_ctx *);
|
|
typedef enum blk_eh_timer_return (timeout_fn)(struct request *, bool);
|
|
typedef int (init_hctx_fn)(struct blk_mq_hw_ctx *, void *, unsigned int);
|
|
typedef void (exit_hctx_fn)(struct blk_mq_hw_ctx *, unsigned int);
|
|
typedef int (init_request_fn)(struct blk_mq_tag_set *set, struct request *,
|
|
unsigned int, unsigned int);
|
|
typedef void (exit_request_fn)(struct blk_mq_tag_set *set, struct request *,
|
|
unsigned int);
|
|
|
|
typedef bool (busy_iter_fn)(struct blk_mq_hw_ctx *, struct request *, void *,
|
|
bool);
|
|
typedef bool (busy_tag_iter_fn)(struct request *, void *, bool);
|
|
typedef int (poll_fn)(struct blk_mq_hw_ctx *);
|
|
typedef int (map_queues_fn)(struct blk_mq_tag_set *set);
|
|
typedef bool (busy_fn)(struct request_queue *);
|
|
typedef void (complete_fn)(struct request *);
|
|
|
|
|
|
struct blk_mq_ops {
|
|
/*
|
|
* Queue request
|
|
*/
|
|
queue_rq_fn *queue_rq;
|
|
|
|
/*
|
|
* If a driver uses bd->last to judge when to submit requests to
|
|
* hardware, it must define this function. In case of errors that
|
|
* make us stop issuing further requests, this hook serves the
|
|
* purpose of kicking the hardware (which the last request otherwise
|
|
* would have done).
|
|
*/
|
|
commit_rqs_fn *commit_rqs;
|
|
|
|
/*
|
|
* Reserve budget before queue request, once .queue_rq is
|
|
* run, it is driver's responsibility to release the
|
|
* reserved budget. Also we have to handle failure case
|
|
* of .get_budget for avoiding I/O deadlock.
|
|
*/
|
|
get_budget_fn *get_budget;
|
|
put_budget_fn *put_budget;
|
|
|
|
/*
|
|
* Called on request timeout
|
|
*/
|
|
timeout_fn *timeout;
|
|
|
|
/*
|
|
* Called to poll for completion of a specific tag.
|
|
*/
|
|
poll_fn *poll;
|
|
|
|
complete_fn *complete;
|
|
|
|
/*
|
|
* Called when the block layer side of a hardware queue has been
|
|
* set up, allowing the driver to allocate/init matching structures.
|
|
* Ditto for exit/teardown.
|
|
*/
|
|
init_hctx_fn *init_hctx;
|
|
exit_hctx_fn *exit_hctx;
|
|
|
|
/*
|
|
* Called for every command allocated by the block layer to allow
|
|
* the driver to set up driver specific data.
|
|
*
|
|
* Tag greater than or equal to queue_depth is for setting up
|
|
* flush request.
|
|
*
|
|
* Ditto for exit/teardown.
|
|
*/
|
|
init_request_fn *init_request;
|
|
exit_request_fn *exit_request;
|
|
/* Called from inside blk_get_request() */
|
|
void (*initialize_rq_fn)(struct request *rq);
|
|
|
|
/*
|
|
* If set, returns whether or not this queue currently is busy
|
|
*/
|
|
busy_fn *busy;
|
|
|
|
map_queues_fn *map_queues;
|
|
|
|
#ifdef CONFIG_BLK_DEBUG_FS
|
|
/*
|
|
* Used by the debugfs implementation to show driver-specific
|
|
* information about a request.
|
|
*/
|
|
void (*show_rq)(struct seq_file *m, struct request *rq);
|
|
#endif
|
|
};
|
|
|
|
enum {
|
|
BLK_MQ_F_SHOULD_MERGE = 1 << 0,
|
|
BLK_MQ_F_TAG_SHARED = 1 << 1,
|
|
BLK_MQ_F_BLOCKING = 1 << 5,
|
|
BLK_MQ_F_NO_SCHED = 1 << 6,
|
|
BLK_MQ_F_ALLOC_POLICY_START_BIT = 8,
|
|
BLK_MQ_F_ALLOC_POLICY_BITS = 1,
|
|
|
|
BLK_MQ_S_STOPPED = 0,
|
|
BLK_MQ_S_TAG_ACTIVE = 1,
|
|
BLK_MQ_S_SCHED_RESTART = 2,
|
|
|
|
BLK_MQ_MAX_DEPTH = 10240,
|
|
|
|
BLK_MQ_CPU_WORK_BATCH = 8,
|
|
};
|
|
#define BLK_MQ_FLAG_TO_ALLOC_POLICY(flags) \
|
|
((flags >> BLK_MQ_F_ALLOC_POLICY_START_BIT) & \
|
|
((1 << BLK_MQ_F_ALLOC_POLICY_BITS) - 1))
|
|
#define BLK_ALLOC_POLICY_TO_MQ_FLAG(policy) \
|
|
((policy & ((1 << BLK_MQ_F_ALLOC_POLICY_BITS) - 1)) \
|
|
<< BLK_MQ_F_ALLOC_POLICY_START_BIT)
|
|
|
|
struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *);
|
|
struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
|
|
struct request_queue *q);
|
|
struct request_queue *blk_mq_init_sq_queue(struct blk_mq_tag_set *set,
|
|
const struct blk_mq_ops *ops,
|
|
unsigned int queue_depth,
|
|
unsigned int set_flags);
|
|
int blk_mq_register_dev(struct device *, struct request_queue *);
|
|
void blk_mq_unregister_dev(struct device *, struct request_queue *);
|
|
|
|
int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set);
|
|
void blk_mq_free_tag_set(struct blk_mq_tag_set *set);
|
|
|
|
void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule);
|
|
|
|
void blk_mq_free_request(struct request *rq);
|
|
bool blk_mq_can_queue(struct blk_mq_hw_ctx *);
|
|
|
|
bool blk_mq_queue_inflight(struct request_queue *q);
|
|
|
|
enum {
|
|
/* return when out of requests */
|
|
BLK_MQ_REQ_NOWAIT = (__force blk_mq_req_flags_t)(1 << 0),
|
|
/* allocate from reserved pool */
|
|
BLK_MQ_REQ_RESERVED = (__force blk_mq_req_flags_t)(1 << 1),
|
|
/* allocate internal/sched tag */
|
|
BLK_MQ_REQ_INTERNAL = (__force blk_mq_req_flags_t)(1 << 2),
|
|
/* set RQF_PREEMPT */
|
|
BLK_MQ_REQ_PREEMPT = (__force blk_mq_req_flags_t)(1 << 3),
|
|
};
|
|
|
|
struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
|
|
blk_mq_req_flags_t flags);
|
|
struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
|
|
unsigned int op, blk_mq_req_flags_t flags,
|
|
unsigned int hctx_idx);
|
|
struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag);
|
|
|
|
enum {
|
|
BLK_MQ_UNIQUE_TAG_BITS = 16,
|
|
BLK_MQ_UNIQUE_TAG_MASK = (1 << BLK_MQ_UNIQUE_TAG_BITS) - 1,
|
|
};
|
|
|
|
u32 blk_mq_unique_tag(struct request *rq);
|
|
|
|
static inline u16 blk_mq_unique_tag_to_hwq(u32 unique_tag)
|
|
{
|
|
return unique_tag >> BLK_MQ_UNIQUE_TAG_BITS;
|
|
}
|
|
|
|
static inline u16 blk_mq_unique_tag_to_tag(u32 unique_tag)
|
|
{
|
|
return unique_tag & BLK_MQ_UNIQUE_TAG_MASK;
|
|
}
|
|
|
|
|
|
int blk_mq_request_started(struct request *rq);
|
|
void blk_mq_start_request(struct request *rq);
|
|
void blk_mq_end_request(struct request *rq, blk_status_t error);
|
|
void __blk_mq_end_request(struct request *rq, blk_status_t error);
|
|
|
|
void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list);
|
|
void blk_mq_kick_requeue_list(struct request_queue *q);
|
|
void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
|
|
bool blk_mq_complete_request(struct request *rq);
|
|
void blk_mq_complete_request_sync(struct request *rq);
|
|
bool blk_mq_bio_list_merge(struct request_queue *q, struct list_head *list,
|
|
struct bio *bio);
|
|
bool blk_mq_queue_stopped(struct request_queue *q);
|
|
void blk_mq_stop_hw_queue(struct blk_mq_hw_ctx *hctx);
|
|
void blk_mq_start_hw_queue(struct blk_mq_hw_ctx *hctx);
|
|
void blk_mq_stop_hw_queues(struct request_queue *q);
|
|
void blk_mq_start_hw_queues(struct request_queue *q);
|
|
void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
|
|
void blk_mq_start_stopped_hw_queues(struct request_queue *q, bool async);
|
|
void blk_mq_quiesce_queue(struct request_queue *q);
|
|
void blk_mq_unquiesce_queue(struct request_queue *q);
|
|
void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
|
|
bool blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
|
|
void blk_mq_run_hw_queues(struct request_queue *q, bool async);
|
|
void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset,
|
|
busy_tag_iter_fn *fn, void *priv);
|
|
void blk_mq_freeze_queue(struct request_queue *q);
|
|
void blk_mq_unfreeze_queue(struct request_queue *q);
|
|
void blk_freeze_queue_start(struct request_queue *q);
|
|
void blk_mq_freeze_queue_wait(struct request_queue *q);
|
|
int blk_mq_freeze_queue_wait_timeout(struct request_queue *q,
|
|
unsigned long timeout);
|
|
|
|
int blk_mq_map_queues(struct blk_mq_queue_map *qmap);
|
|
void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues);
|
|
|
|
void blk_mq_quiesce_queue_nowait(struct request_queue *q);
|
|
|
|
unsigned int blk_mq_rq_cpu(struct request *rq);
|
|
|
|
/*
|
|
* Driver command data is immediately after the request. So subtract request
|
|
* size to get back to the original request, add request size to get the PDU.
|
|
*/
|
|
static inline struct request *blk_mq_rq_from_pdu(void *pdu)
|
|
{
|
|
return pdu - sizeof(struct request);
|
|
}
|
|
static inline void *blk_mq_rq_to_pdu(struct request *rq)
|
|
{
|
|
return rq + 1;
|
|
}
|
|
|
|
#define queue_for_each_hw_ctx(q, hctx, i) \
|
|
for ((i) = 0; (i) < (q)->nr_hw_queues && \
|
|
({ hctx = (q)->queue_hw_ctx[i]; 1; }); (i)++)
|
|
|
|
#define hctx_for_each_ctx(hctx, ctx, i) \
|
|
for ((i) = 0; (i) < (hctx)->nr_ctx && \
|
|
({ ctx = (hctx)->ctxs[(i)]; 1; }); (i)++)
|
|
|
|
static inline blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx,
|
|
struct request *rq)
|
|
{
|
|
if (rq->tag != -1)
|
|
return rq->tag | (hctx->queue_num << BLK_QC_T_SHIFT);
|
|
|
|
return rq->internal_tag | (hctx->queue_num << BLK_QC_T_SHIFT) |
|
|
BLK_QC_T_INTERNAL;
|
|
}
|
|
|
|
#endif
|