vhost/scsi: Extract common handling code from control queue handler (3f8ca2e1) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/vhost/scsi.c

+172 −99

Original line number	Original line	Diff line number	Diff line
	@@ -203,6 +203,19 @@ struct vhost_scsi {
	int vs_events_nr; /* num of pending events, protected by vq->mutex */		int vs_events_nr; /* num of pending events, protected by vq->mutex */
	};		};

			/*
			* Context for processing request and control queue operations.
			*/
			struct vhost_scsi_ctx {
			int head;
			unsigned int out, in;
			size_t req_size, rsp_size;
			size_t out_size, in_size;
			u8 target, lunp;
			void *req;
			struct iov_iter out_iter;
			};

	static struct workqueue_struct *vhost_scsi_workqueue;		static struct workqueue_struct *vhost_scsi_workqueue;

	/* Global spinlock to protect vhost_scsi TPG list for vhost IOCTL access */		/* Global spinlock to protect vhost_scsi TPG list for vhost IOCTL access */
	@@ -1050,10 +1063,107 @@ vhost_scsi_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)
	mutex_unlock(&vq->mutex);		mutex_unlock(&vq->mutex);
	}		}

			static int
			vhost_scsi_get_desc(struct vhost_scsi vs, struct vhost_virtqueue vq,
			struct vhost_scsi_ctx *vc)
			{
			int ret = -ENXIO;

			vc->head = vhost_get_vq_desc(vq, vq->iov,
			ARRAY_SIZE(vq->iov), &vc->out, &vc->in,
			NULL, NULL);

			pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n",
			vc->head, vc->out, vc->in);

			/* On error, stop handling until the next kick. */
			if (unlikely(vc->head < 0))
			goto done;

			/* Nothing new? Wait for eventfd to tell us they refilled. */
			if (vc->head == vq->num) {
			if (unlikely(vhost_enable_notify(&vs->dev, vq))) {
			vhost_disable_notify(&vs->dev, vq);
			ret = -EAGAIN;
			}
			goto done;
			}

			/*
			* Get the size of request and response buffers.
			*/
			vc->out_size = iov_length(vq->iov, vc->out);
			vc->in_size = iov_length(&vq->iov[vc->out], vc->in);

			/*
			* Copy over the virtio-scsi request header, which for a
			* ANY_LAYOUT enabled guest may span multiple iovecs, or a
			* single iovec may contain both the header + outgoing
			* WRITE payloads.
			*
			* copy_from_iter() will advance out_iter, so that it will
			* point at the start of the outgoing WRITE payload, if
			* DMA_TO_DEVICE is set.
			*/
			iov_iter_init(&vc->out_iter, WRITE, vq->iov, vc->out, vc->out_size);
			ret = 0;

			done:
			return ret;
			}

			static int
			vhost_scsi_chk_size(struct vhost_virtqueue vq, struct vhost_scsi_ctx vc)
			{
			if (unlikely(vc->in_size < vc->rsp_size)) {
			vq_err(vq,
			"Response buf too small, need min %zu bytes got %zu",
			vc->rsp_size, vc->in_size);
			return -EINVAL;
			} else if (unlikely(vc->out_size < vc->req_size)) {
			vq_err(vq,
			"Request buf too small, need min %zu bytes got %zu",
			vc->req_size, vc->out_size);
			return -EIO;
			}

			return 0;
			}

			static int
			vhost_scsi_get_req(struct vhost_virtqueue vq, struct vhost_scsi_ctx vc,
			struct vhost_scsi_tpg **tpgp)
			{
			int ret = -EIO;

			if (unlikely(!copy_from_iter_full(vc->req, vc->req_size,
			&vc->out_iter)))
			vq_err(vq, "Faulted on copy_from_iter\n");
			else if (unlikely(*vc->lunp != 1))
			/* virtio-scsi spec requires byte 0 of the lun to be 1 */
			vq_err(vq, "Illegal virtio-scsi lun: %u\n", *vc->lunp);
			else {
			struct vhost_scsi_tpg *vs_tpg, tpg;

			vs_tpg = vq->private_data; /* validated at handler entry */

			tpg = READ_ONCE(vs_tpg[*vc->target]);
			if (unlikely(!tpg))
			vq_err(vq, "Target 0x%x does not exist\n", *vc->target);
			else {
			if (tpgp)
			*tpgp = tpg;
			ret = 0;
			}
			}

			return ret;
			}

	static void		static void
	vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,		vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,
	struct vhost_virtqueue *vq,		struct vhost_virtqueue *vq,
	int head, unsigned int out)		struct vhost_scsi_ctx *vc)
	{		{
	struct virtio_scsi_ctrl_tmf_resp __user *resp;		struct virtio_scsi_ctrl_tmf_resp __user *resp;
	struct virtio_scsi_ctrl_tmf_resp rsp;		struct virtio_scsi_ctrl_tmf_resp rsp;
	@@ -1062,10 +1172,10 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,
	pr_debug("%s\n", __func__);		pr_debug("%s\n", __func__);
	memset(&rsp, 0, sizeof(rsp));		memset(&rsp, 0, sizeof(rsp));
	rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;		rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
	resp = vq->iov[out].iov_base;		resp = vq->iov[vc->out].iov_base;
	ret = __copy_to_user(resp, &rsp, sizeof(rsp));		ret = __copy_to_user(resp, &rsp, sizeof(rsp));
	if (!ret)		if (!ret)
	vhost_add_used_and_signal(&vs->dev, vq, head, 0);		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
	else		else
	pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");		pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
	}		}
	@@ -1073,7 +1183,7 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs,
	static void		static void
	vhost_scsi_send_an_resp(struct vhost_scsi *vs,		vhost_scsi_send_an_resp(struct vhost_scsi *vs,
	struct vhost_virtqueue *vq,		struct vhost_virtqueue *vq,
	int head, unsigned int out)		struct vhost_scsi_ctx *vc)
	{		{
	struct virtio_scsi_ctrl_an_resp __user *resp;		struct virtio_scsi_ctrl_an_resp __user *resp;
	struct virtio_scsi_ctrl_an_resp rsp;		struct virtio_scsi_ctrl_an_resp rsp;
	@@ -1082,10 +1192,10 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
	pr_debug("%s\n", __func__);		pr_debug("%s\n", __func__);
	memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */		memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */
	rsp.response = VIRTIO_SCSI_S_OK;		rsp.response = VIRTIO_SCSI_S_OK;
	resp = vq->iov[out].iov_base;		resp = vq->iov[vc->out].iov_base;
	ret = __copy_to_user(resp, &rsp, sizeof(rsp));		ret = __copy_to_user(resp, &rsp, sizeof(rsp));
	if (!ret)		if (!ret)
	vhost_add_used_and_signal(&vs->dev, vq, head, 0);		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
	else		else
	pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");		pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
	}		}
	@@ -1098,13 +1208,9 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)
	struct virtio_scsi_ctrl_an_req an;		struct virtio_scsi_ctrl_an_req an;
	struct virtio_scsi_ctrl_tmf_req tmf;		struct virtio_scsi_ctrl_tmf_req tmf;
	} v_req;		} v_req;
	struct iov_iter out_iter;		struct vhost_scsi_ctx vc;
	unsigned int out = 0, in = 0;		size_t typ_size;
	int head;		int ret;
	size_t req_size, rsp_size, typ_size;
	size_t out_size, in_size;
	u8 *lunp;
	void *req;

	mutex_lock(&vq->mutex);		mutex_lock(&vq->mutex);
	/*		/*
	@@ -1114,52 +1220,28 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)
	if (!vq->private_data)		if (!vq->private_data)
	goto out;		goto out;

			memset(&vc, 0, sizeof(vc));

	vhost_disable_notify(&vs->dev, vq);		vhost_disable_notify(&vs->dev, vq);

	for (;;) {		for (;;) {
	head = vhost_get_vq_desc(vq, vq->iov,		ret = vhost_scsi_get_desc(vs, vq, &vc);
	ARRAY_SIZE(vq->iov), &out, &in,		if (ret)
	NULL, NULL);		goto err;
	pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n",
	head, out, in);
	/* On error, stop handling until the next kick. */
	if (unlikely(head < 0))
	break;
	/* Nothing new? Wait for eventfd to tell us they refilled. */
	if (head == vq->num) {
	if (unlikely(vhost_enable_notify(&vs->dev, vq))) {
	vhost_disable_notify(&vs->dev, vq);
	continue;
	}
	break;
	}

	/*		/*
	* Get the size of request and response buffers.		* Get the request type first in order to setup
			* other parameters dependent on the type.
	*/		*/
	out_size = iov_length(vq->iov, out);		vc.req = &v_req.type;
	in_size = iov_length(&vq->iov[out], in);

	/*
	* Copy over the virtio-scsi request header, which for a
	* ANY_LAYOUT enabled guest may span multiple iovecs, or a
	* single iovec may contain both the header + outgoing
	* WRITE payloads.
	*
	* copy_from_iter() will advance out_iter, so that it will
	* point at the start of the outgoing WRITE payload, if
	* DMA_TO_DEVICE is set.
	*/
	iov_iter_init(&out_iter, WRITE, vq->iov, out, out_size);

	req = &v_req.type;
	typ_size = sizeof(v_req.type);		typ_size = sizeof(v_req.type);

	if (unlikely(!copy_from_iter_full(req, typ_size, &out_iter))) {		if (unlikely(!copy_from_iter_full(vc.req, typ_size,
			&vc.out_iter))) {
	vq_err(vq, "Faulted on copy_from_iter tmf type\n");		vq_err(vq, "Faulted on copy_from_iter tmf type\n");
	/*		/*
	* The size of the response buffer varies based on		* The size of the response buffer depends on the
	* the request type and must be validated against it.		* request type and must be validated against it.
	* Since the request type is not known, don't send		* Since the request type is not known, don't send
	* a response.		* a response.
	*/		*/
	@@ -1168,17 +1250,19 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)

	switch (v_req.type) {		switch (v_req.type) {
	case VIRTIO_SCSI_T_TMF:		case VIRTIO_SCSI_T_TMF:
	req = &v_req.tmf;		vc.req = &v_req.tmf;
	lunp = &v_req.tmf.lun[0];		vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);
	req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);		vc.rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);
	rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);		vc.lunp = &v_req.tmf.lun[0];
			vc.target = &v_req.tmf.lun[1];
	break;		break;
	case VIRTIO_SCSI_T_AN_QUERY:		case VIRTIO_SCSI_T_AN_QUERY:
	case VIRTIO_SCSI_T_AN_SUBSCRIBE:		case VIRTIO_SCSI_T_AN_SUBSCRIBE:
	req = &v_req.an;		vc.req = &v_req.an;
	lunp = &v_req.an.lun[0];		vc.req_size = sizeof(struct virtio_scsi_ctrl_an_req);
	req_size = sizeof(struct virtio_scsi_ctrl_an_req);		vc.rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);
	rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);		vc.lunp = &v_req.an.lun[0];
			vc.target = NULL;
	break;		break;
	default:		default:
	vq_err(vq, "Unknown control request %d", v_req.type);		vq_err(vq, "Unknown control request %d", v_req.type);
	@@ -1186,50 +1270,39 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)
	}		}

	/*		/*
	* Check for a sane response buffer so we can report early		* Validate the size of request and response buffers.
	* errors back to the guest.		* Check for a sane response buffer so we can report
			* early errors back to the guest.
	*/		*/
	if (unlikely(in_size < rsp_size)) {		ret = vhost_scsi_chk_size(vq, &vc);
	vq_err(vq,		if (ret)
	"Resp buf too small, need min %zu bytes got %zu",		goto err;
	rsp_size, in_size);
	/*		/*
	* Notifications are disabled at this point;		* Get the rest of the request now that its size is known.
	* continue so they can be eventually enabled
	* when processing terminates.
	*/		*/
	continue;		vc.req += typ_size;
	}		vc.req_size -= typ_size;

	if (unlikely(out_size < req_size)) {
	vq_err(vq,
	"Req buf too small, need min %zu bytes got %zu",
	req_size, out_size);
	vhost_scsi_send_bad_target(vs, vq, head, out);
	continue;
	}

	req += typ_size;
	req_size -= typ_size;

	if (unlikely(!copy_from_iter_full(req, req_size, &out_iter))) {		ret = vhost_scsi_get_req(vq, &vc, NULL);
	vq_err(vq, "Faulted on copy_from_iter\n");		if (ret)
	vhost_scsi_send_bad_target(vs, vq, head, out);		goto err;
	continue;
	}

	/* virtio-scsi spec requires byte 0 of the lun to be 1 */		if (v_req.type == VIRTIO_SCSI_T_TMF)
	if (unlikely(*lunp != 1)) {		vhost_scsi_send_tmf_resp(vs, vq, &vc);
	vq_err(vq, "Illegal virtio-scsi lun: %u\n", *lunp);		else
	vhost_scsi_send_bad_target(vs, vq, head, out);		vhost_scsi_send_an_resp(vs, vq, &vc);
	continue;		err:
	}		/*
			* ENXIO: No more requests, or read error, wait for next kick
	if (v_req.type == VIRTIO_SCSI_T_TMF) {		* EINVAL: Invalid response buffer, drop the request
	pr_debug("%s tmf %d\n", __func__, v_req.tmf.subtype);		* EIO: Respond with bad target
	vhost_scsi_send_tmf_resp(vs, vq, head, out);		* EAGAIN: Pending request
	} else		*/
	vhost_scsi_send_an_resp(vs, vq, head, out);		if (ret == -ENXIO)
			break;
			else if (ret == -EIO)
			vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);
	}		}
	out:		out:
	mutex_unlock(&vq->mutex);		mutex_unlock(&vq->mutex);