Commit 3f8ca2e1 authored by Bijan Mottahedeh's avatar Bijan Mottahedeh Committed by Michael S. Tsirkin

vhost/scsi: Extract common handling code from control queue handler

Prepare to change the request queue handler to use common handling
routines.
Signed-off-by: default avatarBijan Mottahedeh <bijan.mottahedeh@oracle.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 0d02dbd6
...@@ -203,6 +203,19 @@ struct vhost_scsi { ...@@ -203,6 +203,19 @@ struct vhost_scsi {
int vs_events_nr; /* num of pending events, protected by vq->mutex */ int vs_events_nr; /* num of pending events, protected by vq->mutex */
}; };
/*
* Context for processing request and control queue operations.
*/
struct vhost_scsi_ctx {
int head;
unsigned int out, in;
size_t req_size, rsp_size;
size_t out_size, in_size;
u8 *target, *lunp;
void *req;
struct iov_iter out_iter;
};
static struct workqueue_struct *vhost_scsi_workqueue; static struct workqueue_struct *vhost_scsi_workqueue;
/* Global spinlock to protect vhost_scsi TPG list for vhost IOCTL access */ /* Global spinlock to protect vhost_scsi TPG list for vhost IOCTL access */
...@@ -1050,10 +1063,107 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1050,10 +1063,107 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
mutex_unlock(&vq->mutex); mutex_unlock(&vq->mutex);
} }
static int
vhost_scsi_get_desc(struct vhost_scsi *vs, struct vhost_virtqueue *vq,
struct vhost_scsi_ctx *vc)
{
int ret = -ENXIO;
vc->head = vhost_get_vq_desc(vq, vq->iov,
ARRAY_SIZE(vq->iov), &vc->out, &vc->in,
NULL, NULL);
pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n",
vc->head, vc->out, vc->in);
/* On error, stop handling until the next kick. */
if (unlikely(vc->head < 0))
goto done;
/* Nothing new? Wait for eventfd to tell us they refilled. */
if (vc->head == vq->num) {
if (unlikely(vhost_enable_notify(&vs->dev, vq))) {
vhost_disable_notify(&vs->dev, vq);
ret = -EAGAIN;
}
goto done;
}
/*
* Get the size of request and response buffers.
*/
vc->out_size = iov_length(vq->iov, vc->out);
vc->in_size = iov_length(&vq->iov[vc->out], vc->in);
/*
* Copy over the virtio-scsi request header, which for a
* ANY_LAYOUT enabled guest may span multiple iovecs, or a
* single iovec may contain both the header + outgoing
* WRITE payloads.
*
* copy_from_iter() will advance out_iter, so that it will
* point at the start of the outgoing WRITE payload, if
* DMA_TO_DEVICE is set.
*/
iov_iter_init(&vc->out_iter, WRITE, vq->iov, vc->out, vc->out_size);
ret = 0;
done:
return ret;
}
static int
vhost_scsi_chk_size(struct vhost_virtqueue *vq, struct vhost_scsi_ctx *vc)
{
if (unlikely(vc->in_size < vc->rsp_size)) {
vq_err(vq,
"Response buf too small, need min %zu bytes got %zu",
vc->rsp_size, vc->in_size);
return -EINVAL;
} else if (unlikely(vc->out_size < vc->req_size)) {
vq_err(vq,
"Request buf too small, need min %zu bytes got %zu",
vc->req_size, vc->out_size);
return -EIO;
}
return 0;
}
static int
vhost_scsi_get_req(struct vhost_virtqueue *vq, struct vhost_scsi_ctx *vc,
struct vhost_scsi_tpg **tpgp)
{
int ret = -EIO;
if (unlikely(!copy_from_iter_full(vc->req, vc->req_size,
&vc->out_iter)))
vq_err(vq, "Faulted on copy_from_iter\n");
else if (unlikely(*vc->lunp != 1))
/* virtio-scsi spec requires byte 0 of the lun to be 1 */
vq_err(vq, "Illegal virtio-scsi lun: %u\n", *vc->lunp);
else {
struct vhost_scsi_tpg **vs_tpg, *tpg;
vs_tpg = vq->private_data; /* validated at handler entry */
tpg = READ_ONCE(vs_tpg[*vc->target]);
if (unlikely(!tpg))
vq_err(vq, "Target 0x%x does not exist\n", *vc->target);
else {
if (tpgp)
*tpgp = tpg;
ret = 0;
}
}
return ret;
}
static void static void
vhost_scsi_send_tmf_resp(struct vhost_scsi *vs, vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,
struct vhost_virtqueue *vq, struct vhost_virtqueue *vq,
int head, unsigned int out) struct vhost_scsi_ctx *vc)
{ {
struct virtio_scsi_ctrl_tmf_resp __user *resp; struct virtio_scsi_ctrl_tmf_resp __user *resp;
struct virtio_scsi_ctrl_tmf_resp rsp; struct virtio_scsi_ctrl_tmf_resp rsp;
...@@ -1062,18 +1172,18 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs, ...@@ -1062,18 +1172,18 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,
pr_debug("%s\n", __func__); pr_debug("%s\n", __func__);
memset(&rsp, 0, sizeof(rsp)); memset(&rsp, 0, sizeof(rsp));
rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
resp = vq->iov[out].iov_base; resp = vq->iov[vc->out].iov_base;
ret = __copy_to_user(resp, &rsp, sizeof(rsp)); ret = __copy_to_user(resp, &rsp, sizeof(rsp));
if (!ret) if (!ret)
vhost_add_used_and_signal(&vs->dev, vq, head, 0); vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
else else
pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n"); pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
} }
static void static void
vhost_scsi_send_an_resp(struct vhost_scsi *vs, vhost_scsi_send_an_resp(struct vhost_scsi *vs,
struct vhost_virtqueue *vq, struct vhost_virtqueue *vq,
int head, unsigned int out) struct vhost_scsi_ctx *vc)
{ {
struct virtio_scsi_ctrl_an_resp __user *resp; struct virtio_scsi_ctrl_an_resp __user *resp;
struct virtio_scsi_ctrl_an_resp rsp; struct virtio_scsi_ctrl_an_resp rsp;
...@@ -1082,10 +1192,10 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs, ...@@ -1082,10 +1192,10 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
pr_debug("%s\n", __func__); pr_debug("%s\n", __func__);
memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */ memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */
rsp.response = VIRTIO_SCSI_S_OK; rsp.response = VIRTIO_SCSI_S_OK;
resp = vq->iov[out].iov_base; resp = vq->iov[vc->out].iov_base;
ret = __copy_to_user(resp, &rsp, sizeof(rsp)); ret = __copy_to_user(resp, &rsp, sizeof(rsp));
if (!ret) if (!ret)
vhost_add_used_and_signal(&vs->dev, vq, head, 0); vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
else else
pr_err("Faulted on virtio_scsi_ctrl_an_resp\n"); pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
} }
...@@ -1098,13 +1208,9 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1098,13 +1208,9 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
struct virtio_scsi_ctrl_an_req an; struct virtio_scsi_ctrl_an_req an;
struct virtio_scsi_ctrl_tmf_req tmf; struct virtio_scsi_ctrl_tmf_req tmf;
} v_req; } v_req;
struct iov_iter out_iter; struct vhost_scsi_ctx vc;
unsigned int out = 0, in = 0; size_t typ_size;
int head; int ret;
size_t req_size, rsp_size, typ_size;
size_t out_size, in_size;
u8 *lunp;
void *req;
mutex_lock(&vq->mutex); mutex_lock(&vq->mutex);
/* /*
...@@ -1114,52 +1220,28 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1114,52 +1220,28 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
if (!vq->private_data) if (!vq->private_data)
goto out; goto out;
memset(&vc, 0, sizeof(vc));
vhost_disable_notify(&vs->dev, vq); vhost_disable_notify(&vs->dev, vq);
for (;;) { for (;;) {
head = vhost_get_vq_desc(vq, vq->iov, ret = vhost_scsi_get_desc(vs, vq, &vc);
ARRAY_SIZE(vq->iov), &out, &in, if (ret)
NULL, NULL); goto err;
pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n",
head, out, in);
/* On error, stop handling until the next kick. */
if (unlikely(head < 0))
break;
/* Nothing new? Wait for eventfd to tell us they refilled. */
if (head == vq->num) {
if (unlikely(vhost_enable_notify(&vs->dev, vq))) {
vhost_disable_notify(&vs->dev, vq);
continue;
}
break;
}
/* /*
* Get the size of request and response buffers. * Get the request type first in order to setup
* other parameters dependent on the type.
*/ */
out_size = iov_length(vq->iov, out); vc.req = &v_req.type;
in_size = iov_length(&vq->iov[out], in);
/*
* Copy over the virtio-scsi request header, which for a
* ANY_LAYOUT enabled guest may span multiple iovecs, or a
* single iovec may contain both the header + outgoing
* WRITE payloads.
*
* copy_from_iter() will advance out_iter, so that it will
* point at the start of the outgoing WRITE payload, if
* DMA_TO_DEVICE is set.
*/
iov_iter_init(&out_iter, WRITE, vq->iov, out, out_size);
req = &v_req.type;
typ_size = sizeof(v_req.type); typ_size = sizeof(v_req.type);
if (unlikely(!copy_from_iter_full(req, typ_size, &out_iter))) { if (unlikely(!copy_from_iter_full(vc.req, typ_size,
&vc.out_iter))) {
vq_err(vq, "Faulted on copy_from_iter tmf type\n"); vq_err(vq, "Faulted on copy_from_iter tmf type\n");
/* /*
* The size of the response buffer varies based on * The size of the response buffer depends on the
* the request type and must be validated against it. * request type and must be validated against it.
* Since the request type is not known, don't send * Since the request type is not known, don't send
* a response. * a response.
*/ */
...@@ -1168,17 +1250,19 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1168,17 +1250,19 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
switch (v_req.type) { switch (v_req.type) {
case VIRTIO_SCSI_T_TMF: case VIRTIO_SCSI_T_TMF:
req = &v_req.tmf; vc.req = &v_req.tmf;
lunp = &v_req.tmf.lun[0]; vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);
req_size = sizeof(struct virtio_scsi_ctrl_tmf_req); vc.rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);
rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp); vc.lunp = &v_req.tmf.lun[0];
vc.target = &v_req.tmf.lun[1];
break; break;
case VIRTIO_SCSI_T_AN_QUERY: case VIRTIO_SCSI_T_AN_QUERY:
case VIRTIO_SCSI_T_AN_SUBSCRIBE: case VIRTIO_SCSI_T_AN_SUBSCRIBE:
req = &v_req.an; vc.req = &v_req.an;
lunp = &v_req.an.lun[0]; vc.req_size = sizeof(struct virtio_scsi_ctrl_an_req);
req_size = sizeof(struct virtio_scsi_ctrl_an_req); vc.rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);
rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp); vc.lunp = &v_req.an.lun[0];
vc.target = NULL;
break; break;
default: default:
vq_err(vq, "Unknown control request %d", v_req.type); vq_err(vq, "Unknown control request %d", v_req.type);
...@@ -1186,50 +1270,39 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1186,50 +1270,39 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
} }
/* /*
* Check for a sane response buffer so we can report early * Validate the size of request and response buffers.
* errors back to the guest. * Check for a sane response buffer so we can report
* early errors back to the guest.
*/ */
if (unlikely(in_size < rsp_size)) { ret = vhost_scsi_chk_size(vq, &vc);
vq_err(vq, if (ret)
"Resp buf too small, need min %zu bytes got %zu", goto err;
rsp_size, in_size);
/*
* Notifications are disabled at this point;
* continue so they can be eventually enabled
* when processing terminates.
*/
continue;
}
if (unlikely(out_size < req_size)) { /*
vq_err(vq, * Get the rest of the request now that its size is known.
"Req buf too small, need min %zu bytes got %zu", */
req_size, out_size); vc.req += typ_size;
vhost_scsi_send_bad_target(vs, vq, head, out); vc.req_size -= typ_size;
continue;
}
req += typ_size;
req_size -= typ_size;
if (unlikely(!copy_from_iter_full(req, req_size, &out_iter))) {
vq_err(vq, "Faulted on copy_from_iter\n");
vhost_scsi_send_bad_target(vs, vq, head, out);
continue;
}
/* virtio-scsi spec requires byte 0 of the lun to be 1 */ ret = vhost_scsi_get_req(vq, &vc, NULL);
if (unlikely(*lunp != 1)) { if (ret)
vq_err(vq, "Illegal virtio-scsi lun: %u\n", *lunp); goto err;
vhost_scsi_send_bad_target(vs, vq, head, out);
continue;
}
if (v_req.type == VIRTIO_SCSI_T_TMF) { if (v_req.type == VIRTIO_SCSI_T_TMF)
pr_debug("%s tmf %d\n", __func__, v_req.tmf.subtype); vhost_scsi_send_tmf_resp(vs, vq, &vc);
vhost_scsi_send_tmf_resp(vs, vq, head, out); else
} else vhost_scsi_send_an_resp(vs, vq, &vc);
vhost_scsi_send_an_resp(vs, vq, head, out); err:
/*
* ENXIO: No more requests, or read error, wait for next kick
* EINVAL: Invalid response buffer, drop the request
* EIO: Respond with bad target
* EAGAIN: Pending request
*/
if (ret == -ENXIO)
break;
else if (ret == -EIO)
vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);
} }
out: out:
mutex_unlock(&vq->mutex); mutex_unlock(&vq->mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment