[Devel] [PATCH hci-8.1 3/3] drivers/vhost/blk: take req->len from one side of the descriptor chain

[Alexander Ivanov]

req->len covered the whole descriptor chain, so both readable and
writable data buffers became the payload. A read wrote disk data into
device-readable buffers and reported them as used, a write sent the
guest's writable buffers to disk.

Take write data only from the readable part and the payload of other
requests only from the writable part, as QEMU does. Read the status
byte from the end of the writable part.

Complete a read or write with VIRTIO_BLK_S_IOERR if its payload is
empty, above ALIGN_DOWN(INT_MAX, SECTOR_SIZE) or, for a write, not a
multiple of SECTOR_SIZE. Such requests used to fail in bio setup or
hit a WARN_ONCE() and leave the guest request hanging. Drop the now
unreachable WARN_ONCE().

https://virtuozzo.atlassian.net/browse/VSTOR-142755
Fixes: 1629db092dd7 ("drivers/vhost: vhost-blk accelerator for virtio-blk guests")
Fixes: 02ce37f62707 ("vhost-blk: add bounce-buffer for non-aligned requests")
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/vhost/blk.c | 43 ++++++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index 94317a5f2cb6..3448910f9046 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -277,12 +277,6 @@ static int vhost_blk_bio_make(struct vhost_blk_req *req,
 	if (unlikely(req->bi_opf & REQ_PREFLUSH))
 		return vhost_blk_bio_make_simple(req, bdev);
 
-	if (req->bi_opf == REQ_OP_WRITE && !IS_ALIGNED(req->len, SECTOR_SIZE)) {
-		WARN_ONCE(1, "vhost-blk: write requests with unaligned len"
-			  " are not supported, len = %zu", req->len);
-		return -EINVAL;
-	}
-
 	/*
 	 * Requests with unaligned io vectors are not supported by underlined
 	 * block device, let's use an aligned intermediary "bounce buffer" to
@@ -450,10 +444,10 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 	struct vhost_blk *blk = container_of(vq->dev, struct vhost_blk, dev);
 	struct vhost_blk_vq *blk_vq = container_of(vq, struct vhost_blk_vq, vq);
 	struct vhost_blk_req *req;
-	u16 total_iov_nr = out + in;
+	struct iovec *data_iov, *st;
 	struct iov_iter iter;
 	size_t in_len;
-	int ret, len;
+	int ret, len, data_nr;
 	u32 type;
 	u8 status;
 
@@ -470,14 +464,37 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 	if (in_len < sizeof(status) || in_len > INT_MAX)
 		return -EINVAL;
 
-	req->len	= iov_length(vq->iov, total_iov_nr) - sizeof(status);
-	req->iov_nr	= move_iovec(vq->iov, req->iov, req->len, total_iov_nr,
+	/* The status is the last byte of the device-writable part */
+	for (st = vq->iov + out + in - 1; !st->iov_len; st--)
+		;
+	st->iov_len -= sizeof(status);
+	req->status[0].iov_base = st->iov_base + st->iov_len;
+	req->status[0].iov_len = sizeof(status);
+
+	if (type == VIRTIO_BLK_T_OUT) {
+		data_iov = vq->iov;
+		data_nr = out;
+	} else {
+		data_iov = vq->iov + out;
+		data_nr = in;
+	}
+
+	req->len = iov_length(data_iov, data_nr);
+
+	if ((type == VIRTIO_BLK_T_IN || type == VIRTIO_BLK_T_OUT) &&
+	    (!req->len || req->len > ALIGN_DOWN(INT_MAX, SECTOR_SIZE) ||
+	     (type == VIRTIO_BLK_T_OUT && !IS_ALIGNED(req->len, SECTOR_SIZE)))) {
+		ret = vhost_blk_set_status(req, VIRTIO_BLK_S_IOERR);
+		if (!ret)
+			vhost_add_used_and_signal(&blk->dev, vq, head, sizeof(status));
+		return ret;
+	}
+
+	req->iov_nr	= move_iovec(data_iov, req->iov, req->len, data_nr,
 				     ARRAY_SIZE(blk_vq->iov));
 	req->bb		= NULL;
 
-	ret = move_iovec(vq->iov, req->status, sizeof(status), total_iov_nr,
-			 ARRAY_SIZE(req->status));
-	if (ret < 0 || req->iov_nr < 0)
+	if (req->iov_nr < 0)
 		return -EINVAL;
 
 	switch (type) {
-- 
2.53.0