[PATCH v3 0/5] SCSI: fix transfer limits for SCSI passthrough

[PATCH v3 0/5] SCSI: fix transfer limits for SCSI passthrough

[Maxim Levitsky]

This patch series attempts to provide a solution to the problem of the transfer
limits of the raw file driver (host_device/file-posix), some of which I
already tried to fix in the past.

I included 2 patches from Tom Yan which fix two issues with reading the limits
correctly from the */dev/sg* character devices in the first place.

The only change to these patches is that I tweaked a bit the comments in the
source to better document the /dev/sg quirks.

The other two patches in this series split the max transfer limits that qemu
block devices expose in two:
One limit is for the regular IO, and another is for the SG_IO (aka bdrv_*_ioctl),
and the two device drivers (scsi-block and scsi-generic) that use the later
are switched to the new interface.

This should ensure that the raw driver can still advertise the unlimited
transfer  length, unless it is used for SG_IO, because that yields the highest
performance.

Also I include a somewhat unrelated fix to a bug I found in qemu's
SCSI passthrough while testing this:
When qemu emulates the VPD block limit page, for a SCSI device that doesn't
implement it, it doesn't really advertise the emulated page to the guest.

I tested this by doing both regular and SG_IO passthrough of my
USB SD card reader.

That device turned out to be a perfect device for the task, since it has max
transfer size of 1024 blocks (512K), and it enforces it.

Also it didn't implement the VPD block limits page,
(transfer size limit probably comes from something USB related) which triggered
the unrelated bug.

I was able to see IO errors without the patches, and the wrong max transfer
size in the guest, and with patches both issues were gone.

I also found an unrelated issue in /dev/sg passthrough in the kernel.
It turns out that in-kernel driver has a limitation of 16 requests in flight,
regardless of what underlying device supports.

With a large multi-threaded fio job  and a debug print in qemu, it is easy to
see it, although the errors don't do much harm to the guest as it retries the
IO, and eventually succeed.
It is an open question if this should be solved.

V2: fixed an issue in a patch from Tom Yan (thanks), and removed
refactoring from last patch according to Paulo's request.

V3: few cosmitic changes due to the review feedback.

Maxim Levitsky (3):
  block: add max_ioctl_transfer to BlockLimits
  block: use blk_get_max_ioctl_transfer for SCSI passthrough
  block/scsi: correctly emulate the VPD block limits page

Tom Yan (2):
  file-posix: split hdev_refresh_limits from raw_refresh_limits
  file-posix: add sg_get_max_segments that actually works with sg

 block/block-backend.c          | 12 ++++++
 block/file-posix.c             | 76 +++++++++++++++++++++++++++-------
 block/io.c                     |  2 +
 block/iscsi.c                  |  1 +
 hw/scsi/scsi-generic.c         | 13 ++++--
 include/block/block_int.h      |  4 ++
 include/sysemu/block-backend.h |  1 +
 7 files changed, 90 insertions(+), 19 deletions(-)

-- 
2.26.2

[PATCH v3 1/5] file-posix: split hdev_refresh_limits from raw_refresh_limits

[Maxim Levitsky]

From: Tom Yan <tom.ty89@gmail.com>

We can and should get max transfer length and max segments for all host
devices / cdroms (on Linux).

Also use MIN_NON_ZERO instead when we clamp max transfer length against
max segments.

Signed-off-by: Tom Yan <tom.ty89@gmail.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 block/file-posix.c | 57 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 41 insertions(+), 16 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 9804681d5c..cbf1271773 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1166,6 +1166,10 @@ static int sg_get_max_transfer_length(int fd)
     int max_bytes = 0;
 
     if (ioctl(fd, BLKSECTGET, &max_bytes) == 0) {
+        /*
+         * BLKSECTGET for /dev/sg* character devices incorrectly returns
+         * the max transfer size in bytes (rather than in blocks).
+         */
         return max_bytes;
     } else {
         return -errno;
@@ -1175,7 +1179,22 @@ static int sg_get_max_transfer_length(int fd)
 #endif
 }
 
-static int sg_get_max_segments(int fd)
+static int get_max_transfer_length(int fd)
+{
+#if defined(BLKSECTGET)
+    int sect = 0;
+
+    if (ioctl(fd, BLKSECTGET, &sect) == 0) {
+        return sect << 9;
+    } else {
+        return -errno;
+    }
+#else
+    return -ENOSYS;
+#endif
+}
+
+static int get_max_segments(int fd)
 {
 #ifdef CONFIG_LINUX
     char buf[32];
@@ -1230,23 +1249,29 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
 {
     BDRVRawState *s = bs->opaque;
 
-    if (bs->sg) {
-        int ret = sg_get_max_transfer_length(s->fd);
+    raw_probe_alignment(bs, s->fd, errp);
+    bs->bl.min_mem_alignment = s->buf_align;
+    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
+}
+
+static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
+{
+    BDRVRawState *s = bs->opaque;
+
+    int ret = bs->sg ? sg_get_max_transfer_length(s->fd) :
+                       get_max_transfer_length(s->fd);
 
-        if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
-            bs->bl.max_transfer = pow2floor(ret);
-        }
+    if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
+        bs->bl.max_transfer = pow2floor(ret);
+    }
 
-        ret = sg_get_max_segments(s->fd);
-        if (ret > 0) {
-            bs->bl.max_transfer = MIN(bs->bl.max_transfer,
-                                      ret * qemu_real_host_page_size);
-        }
+    ret = get_max_segments(s->fd);
+    if (ret > 0) {
+        bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
+                                           ret * qemu_real_host_page_size);
     }
 
-    raw_probe_alignment(bs, s->fd, errp);
-    bs->bl.min_mem_alignment = s->buf_align;
-    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
+    raw_refresh_limits(bs, errp);
 }
 
 static int check_for_dasd(int fd)
@@ -3600,7 +3625,7 @@ static BlockDriver bdrv_host_device = {
     .bdrv_co_pdiscard       = hdev_co_pdiscard,
     .bdrv_co_copy_range_from = raw_co_copy_range_from,
     .bdrv_co_copy_range_to  = raw_co_copy_range_to,
-    .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_refresh_limits = hdev_refresh_limits,
     .bdrv_io_plug = raw_aio_plug,
     .bdrv_io_unplug = raw_aio_unplug,
     .bdrv_attach_aio_context = raw_aio_attach_aio_context,
@@ -3724,7 +3749,7 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_co_preadv         = raw_co_preadv,
     .bdrv_co_pwritev        = raw_co_pwritev,
     .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
-    .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_refresh_limits = hdev_refresh_limits,
     .bdrv_io_plug = raw_aio_plug,
     .bdrv_io_unplug = raw_aio_unplug,
     .bdrv_attach_aio_context = raw_aio_attach_aio_context,
-- 
2.26.2

Re: [PATCH v3 1/5] file-posix: split hdev_refresh_limits from raw_refresh_limits

[Max Reitz]

On 17.12.20 17:56, Maxim Levitsky wrote:
> From: Tom Yan <tom.ty89@gmail.com>
> 
> We can and should get max transfer length and max segments for all host
> devices / cdroms (on Linux).
> 
> Also use MIN_NON_ZERO instead when we clamp max transfer length against
> max segments.
> 
> Signed-off-by: Tom Yan <tom.ty89@gmail.com>
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
>   block/file-posix.c | 57 +++++++++++++++++++++++++++++++++-------------
>   1 file changed, 41 insertions(+), 16 deletions(-)

I’m aware that most of my remarks below apply to the pre-patch state 
just as well, but I feel like now is a good time to raise them, so, here 
goes:

> diff --git a/block/file-posix.c b/block/file-posix.c
> index 9804681d5c..cbf1271773 100644
> --- a/block/file-posix.c
> +++ b/block/file-posix.c
> @@ -1166,6 +1166,10 @@ static int sg_get_max_transfer_length(int fd)
>       int max_bytes = 0;
>   
>       if (ioctl(fd, BLKSECTGET, &max_bytes) == 0) {
> +        /*
> +         * BLKSECTGET for /dev/sg* character devices incorrectly returns
> +         * the max transfer size in bytes (rather than in blocks).
> +         */
>           return max_bytes;
>       } else {
>           return -errno;
> @@ -1175,7 +1179,22 @@ static int sg_get_max_transfer_length(int fd)
>   #endif
>   }
>   
> -static int sg_get_max_segments(int fd)
> +static int get_max_transfer_length(int fd)
> +{
> +#if defined(BLKSECTGET)
> +    int sect = 0;
> +
> +    if (ioctl(fd, BLKSECTGET, &sect) == 0) {
> +        return sect << 9;

Can this overflow?

(I mean, technically it would still be safe, because either the limit is 
set too low or it isn’t set at all, which would be correct on overflow. 
  But still.)

> +    } else {
> +        return -errno;
> +    }
> +#else
> +    return -ENOSYS;
> +#endif
> +}
> +
> +static int get_max_segments(int fd)
>   {
>   #ifdef CONFIG_LINUX
>       char buf[32];

This function stores max_segments (a long) in ret (an int) and returns 
the latter.  Should we guard against overflows?

> @@ -1230,23 +1249,29 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
>   {
>       BDRVRawState *s = bs->opaque;
>   
> -    if (bs->sg) {
> -        int ret = sg_get_max_transfer_length(s->fd);
> +    raw_probe_alignment(bs, s->fd, errp);
> +    bs->bl.min_mem_alignment = s->buf_align;
> +    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
> +}
> +
> +static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
> +{
> +    BDRVRawState *s = bs->opaque;
> +
> +    int ret = bs->sg ? sg_get_max_transfer_length(s->fd) :
> +                       get_max_transfer_length(s->fd);
>   
> -        if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
> -            bs->bl.max_transfer = pow2floor(ret);
> -        }
> +    if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
> +        bs->bl.max_transfer = pow2floor(ret);
> +    }
>   
> -        ret = sg_get_max_segments(s->fd);
> -        if (ret > 0) {
> -            bs->bl.max_transfer = MIN(bs->bl.max_transfer,
> -                                      ret * qemu_real_host_page_size);

(1) Can this overflow?  (Which I suppose could result in a 
non-power-of-two result)

(2) Even disregarding overflows, is ret * qemu_real_host_page_size 
guaranteed to be a power of two?

Max

> -        }
> +    ret = get_max_segments(s->fd);
> +    if (ret > 0) {
> +        bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
> +                                           ret * qemu_real_host_page_size);
>       }
>   
> -    raw_probe_alignment(bs, s->fd, errp);
> -    bs->bl.min_mem_alignment = s->buf_align;
> -    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
> +    raw_refresh_limits(bs, errp);
>   }
>   
>   static int check_for_dasd(int fd)
> @@ -3600,7 +3625,7 @@ static BlockDriver bdrv_host_device = {
>       .bdrv_co_pdiscard       = hdev_co_pdiscard,
>       .bdrv_co_copy_range_from = raw_co_copy_range_from,
>       .bdrv_co_copy_range_to  = raw_co_copy_range_to,
> -    .bdrv_refresh_limits = raw_refresh_limits,
> +    .bdrv_refresh_limits = hdev_refresh_limits,
>       .bdrv_io_plug = raw_aio_plug,
>       .bdrv_io_unplug = raw_aio_unplug,
>       .bdrv_attach_aio_context = raw_aio_attach_aio_context,
> @@ -3724,7 +3749,7 @@ static BlockDriver bdrv_host_cdrom = {
>       .bdrv_co_preadv         = raw_co_preadv,
>       .bdrv_co_pwritev        = raw_co_pwritev,
>       .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
> -    .bdrv_refresh_limits = raw_refresh_limits,
> +    .bdrv_refresh_limits = hdev_refresh_limits,
>       .bdrv_io_plug = raw_aio_plug,
>       .bdrv_io_unplug = raw_aio_unplug,
>       .bdrv_attach_aio_context = raw_aio_attach_aio_context,
> 

[PATCH v3 2/5] file-posix: add sg_get_max_segments that actually works with sg

[Maxim Levitsky]

From: Tom Yan <tom.ty89@gmail.com>

sg devices have different major/minor than their corresponding
block devices. Using sysfs to get max segments never really worked
for them.

Fortunately the sg driver provides an ioctl to get sg_tablesize,
which is apparently equivalent to max segments.

Signed-off-by: Tom Yan <tom.ty89@gmail.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 block/file-posix.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index cbf1271773..2bf4d095a7 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1179,6 +1179,26 @@ static int sg_get_max_transfer_length(int fd)
 #endif
 }
 
+static int sg_get_max_segments(int fd)
+{
+    /*
+     * /dev/sg* character devices report 'max_segments' via
+     * SG_GET_SG_TABLESIZE ioctl
+     */
+
+#ifdef SG_GET_SG_TABLESIZE
+    long max_segments = 0;
+
+    if (ioctl(fd, SG_GET_SG_TABLESIZE, &max_segments) == 0) {
+        return max_segments;
+    } else {
+        return -errno;
+    }
+#else
+    return -ENOSYS;
+#endif
+}
+
 static int get_max_transfer_length(int fd)
 {
 #if defined(BLKSECTGET)
@@ -1265,7 +1285,7 @@ static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
         bs->bl.max_transfer = pow2floor(ret);
     }
 
-    ret = get_max_segments(s->fd);
+    ret = bs->sg ? sg_get_max_segments(s->fd) : get_max_segments(s->fd);
     if (ret > 0) {
         bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
                                            ret * qemu_real_host_page_size);
-- 
2.26.2

Re: [PATCH v3 2/5] file-posix: add sg_get_max_segments that actually works with sg

[Max Reitz]

On 17.12.20 17:56, Maxim Levitsky wrote:
> From: Tom Yan <tom.ty89@gmail.com>
> 
> sg devices have different major/minor than their corresponding
> block devices. Using sysfs to get max segments never really worked
> for them.
> 
> Fortunately the sg driver provides an ioctl to get sg_tablesize,
> which is apparently equivalent to max segments.
> 
> Signed-off-by: Tom Yan <tom.ty89@gmail.com>
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
>   block/file-posix.c | 22 +++++++++++++++++++++-
>   1 file changed, 21 insertions(+), 1 deletion(-)
> 
> diff --git a/block/file-posix.c b/block/file-posix.c
> index cbf1271773..2bf4d095a7 100644
> --- a/block/file-posix.c
> +++ b/block/file-posix.c
> @@ -1179,6 +1179,26 @@ static int sg_get_max_transfer_length(int fd)
>   #endif
>   }
>   
> +static int sg_get_max_segments(int fd)
> +{
> +    /*
> +     * /dev/sg* character devices report 'max_segments' via
> +     * SG_GET_SG_TABLESIZE ioctl
> +     */
> +
> +#ifdef SG_GET_SG_TABLESIZE
> +    long max_segments = 0;
> +
> +    if (ioctl(fd, SG_GET_SG_TABLESIZE, &max_segments) == 0) {

As far as I can tell from googling, SG_GET_SG_TABLESIZE takes an int 
pointer.

Apart from that, looks good.

Max

> +        return max_segments;
> +    } else {
> +        return -errno;
> +    }
> +#else
> +    return -ENOSYS;
> +#endif
> +}
> +
>   static int get_max_transfer_length(int fd)
>   {
>   #if defined(BLKSECTGET)
> @@ -1265,7 +1285,7 @@ static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
>           bs->bl.max_transfer = pow2floor(ret);
>       }
>   
> -    ret = get_max_segments(s->fd);
> +    ret = bs->sg ? sg_get_max_segments(s->fd) : get_max_segments(s->fd);
>       if (ret > 0) {
>           bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
>                                              ret * qemu_real_host_page_size);
> 

[PATCH v3 3/5] block: add max_ioctl_transfer to BlockLimits

[Maxim Levitsky]

Maximum transfer size when accessing a kernel block device is only relevant
when using SCSI passthrough (SG_IO ioctl) since only in this case the requests
are passed directly to underlying hardware with no pre-processing.
Same is true when using /dev/sg* character devices (which only support SG_IO)

Therefore split the block driver's advertized max transfer size by
the regular max transfer size, and the max transfer size for SCSI passthrough
(the new max_ioctl_transfer field)

In the next patch, the qemu block drivers that support SCSI passthrough
will set the max_ioctl_transfer field, and simultaneously, the block devices
that implement scsi passthrough will switch to 'blk_get_max_ioctl_transfer' to
query and to pass it to the guest.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 block/block-backend.c          | 12 ++++++++++++
 block/io.c                     |  2 ++
 include/block/block_int.h      |  4 ++++
 include/sysemu/block-backend.h |  1 +
 4 files changed, 19 insertions(+)

diff --git a/block/block-backend.c b/block/block-backend.c
index ce78d30794..c1d149a755 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -1938,6 +1938,18 @@ uint32_t blk_get_max_transfer(BlockBackend *blk)
     return MIN_NON_ZERO(max, INT_MAX);
 }
 
+/* Returns the maximum transfer length, for SCSI passthrough */
+uint32_t blk_get_max_ioctl_transfer(BlockBackend *blk)
+{
+    BlockDriverState *bs = blk_bs(blk);
+    uint32_t max = 0;
+
+    if (bs) {
+        max = bs->bl.max_ioctl_transfer;
+    }
+    return MIN_NON_ZERO(max, INT_MAX);
+}
+
 int blk_get_max_iov(BlockBackend *blk)
 {
     return blk->root->bs->bl.max_iov;
diff --git a/block/io.c b/block/io.c
index 24205f5168..ac5aea435e 100644
--- a/block/io.c
+++ b/block/io.c
@@ -126,6 +126,8 @@ static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
 {
     dst->opt_transfer = MAX(dst->opt_transfer, src->opt_transfer);
     dst->max_transfer = MIN_NON_ZERO(dst->max_transfer, src->max_transfer);
+    dst->max_ioctl_transfer = MIN_NON_ZERO(dst->max_ioctl_transfer,
+                                        src->max_ioctl_transfer);
     dst->opt_mem_alignment = MAX(dst->opt_mem_alignment,
                                  src->opt_mem_alignment);
     dst->min_mem_alignment = MAX(dst->min_mem_alignment,
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 1eeafc118c..c59b0aefc4 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -686,6 +686,10 @@ typedef struct BlockLimits {
      * clamped down. */
     uint32_t max_transfer;
 
+    /* Maximal transfer length for SCSI passthrough (ioctl interface) */
+    uint32_t max_ioctl_transfer;
+
+
     /* memory alignment, in bytes so that no bounce buffer is needed */
     size_t min_mem_alignment;
 
diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
index 8203d7f6f9..b019a37b7a 100644
--- a/include/sysemu/block-backend.h
+++ b/include/sysemu/block-backend.h
@@ -203,6 +203,7 @@ void blk_eject(BlockBackend *blk, bool eject_flag);
 int blk_get_flags(BlockBackend *blk);
 uint32_t blk_get_request_alignment(BlockBackend *blk);
 uint32_t blk_get_max_transfer(BlockBackend *blk);
+uint32_t blk_get_max_ioctl_transfer(BlockBackend *blk);
 int blk_get_max_iov(BlockBackend *blk);
 void blk_set_guest_block_size(BlockBackend *blk, int align);
 void *blk_try_blockalign(BlockBackend *blk, size_t size);
-- 
2.26.2

Re: [PATCH v3 3/5] block: add max_ioctl_transfer to BlockLimits

[Max Reitz]

On 17.12.20 17:56, Maxim Levitsky wrote:
> Maximum transfer size when accessing a kernel block device is only relevant
> when using SCSI passthrough (SG_IO ioctl) since only in this case the requests
> are passed directly to underlying hardware with no pre-processing.

So by “with no pre-processing” you mean in particular no pre-processing 
by the kernel?  I.e., that file-posix for non-SG devices actually has no 
max transfer limit, because the kernel will split overly long requests 
by itself?

> Same is true when using /dev/sg* character devices (which only support SG_IO)
> 
> Therefore split the block driver's advertized max transfer size by
> the regular max transfer size, and the max transfer size for SCSI passthrough
> (the new max_ioctl_transfer field)
> 
> In the next patch, the qemu block drivers that support SCSI passthrough
> will set the max_ioctl_transfer field, and simultaneously, the block devices
> that implement scsi passthrough will switch to 'blk_get_max_ioctl_transfer' to
> query and to pass it to the guest.
> 
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
>   block/block-backend.c          | 12 ++++++++++++
>   block/io.c                     |  2 ++
>   include/block/block_int.h      |  4 ++++
>   include/sysemu/block-backend.h |  1 +
>   4 files changed, 19 insertions(+)
> 
> diff --git a/block/block-backend.c b/block/block-backend.c
> index ce78d30794..c1d149a755 100644
> --- a/block/block-backend.c
> +++ b/block/block-backend.c
> @@ -1938,6 +1938,18 @@ uint32_t blk_get_max_transfer(BlockBackend *blk)
>       return MIN_NON_ZERO(max, INT_MAX);
>   }
>   
> +/* Returns the maximum transfer length, for SCSI passthrough */
> +uint32_t blk_get_max_ioctl_transfer(BlockBackend *blk)
> +{
> +    BlockDriverState *bs = blk_bs(blk);
> +    uint32_t max = 0;
> +
> +    if (bs) {
> +        max = bs->bl.max_ioctl_transfer;
> +    }
> +    return MIN_NON_ZERO(max, INT_MAX);
> +}
> +
>   int blk_get_max_iov(BlockBackend *blk)
>   {
>       return blk->root->bs->bl.max_iov;
> diff --git a/block/io.c b/block/io.c
> index 24205f5168..ac5aea435e 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -126,6 +126,8 @@ static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
>   {
>       dst->opt_transfer = MAX(dst->opt_transfer, src->opt_transfer);
>       dst->max_transfer = MIN_NON_ZERO(dst->max_transfer, src->max_transfer);
> +    dst->max_ioctl_transfer = MIN_NON_ZERO(dst->max_ioctl_transfer,
> +                                        src->max_ioctl_transfer);

I’d prefer this to be aligned to the opening parenthesis.

>       dst->opt_mem_alignment = MAX(dst->opt_mem_alignment,
>                                    src->opt_mem_alignment);
>       dst->min_mem_alignment = MAX(dst->min_mem_alignment,
> diff --git a/include/block/block_int.h b/include/block/block_int.h
> index 1eeafc118c..c59b0aefc4 100644
> --- a/include/block/block_int.h
> +++ b/include/block/block_int.h
> @@ -686,6 +686,10 @@ typedef struct BlockLimits {
>        * clamped down. */
>       uint32_t max_transfer;
>   
> +    /* Maximal transfer length for SCSI passthrough (ioctl interface) */
> +    uint32_t max_ioctl_transfer;
> +
> +

Is there a specific reason you added a double newline here?  (All other 
fields in this struct are separated by a single newline)

Max

>       /* memory alignment, in bytes so that no bounce buffer is needed */
>       size_t min_mem_alignment;
>   
> diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
> index 8203d7f6f9..b019a37b7a 100644
> --- a/include/sysemu/block-backend.h
> +++ b/include/sysemu/block-backend.h
> @@ -203,6 +203,7 @@ void blk_eject(BlockBackend *blk, bool eject_flag);
>   int blk_get_flags(BlockBackend *blk);
>   uint32_t blk_get_request_alignment(BlockBackend *blk);
>   uint32_t blk_get_max_transfer(BlockBackend *blk);
> +uint32_t blk_get_max_ioctl_transfer(BlockBackend *blk);
>   int blk_get_max_iov(BlockBackend *blk);
>   void blk_set_guest_block_size(BlockBackend *blk, int align);
>   void *blk_try_blockalign(BlockBackend *blk, size_t size);
> 

[PATCH v3 4/5] block: use blk_get_max_ioctl_transfer for SCSI passthrough

[Maxim Levitsky]

Switch file-posix to expose only the max_ioctl_transfer limit.

Let the iscsi driver work as it did before since it is bound by the transfer
limit in both regular read/write and in SCSI passthrough case.

Switch the scsi-disk and scsi-block drivers to read the SG max transfer limits
using the new blk_get_max_ioctl_transfer interface.


Fixes: 867eccfed8 ("file-posix: Use max transfer length/segment count only for SCSI passthrough")
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 block/file-posix.c     | 7 ++++---
 block/iscsi.c          | 1 +
 hw/scsi/scsi-generic.c | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 2bf4d095a7..c34a7a9599 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1282,13 +1282,14 @@ static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
                        get_max_transfer_length(s->fd);
 
     if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
-        bs->bl.max_transfer = pow2floor(ret);
+        bs->bl.max_ioctl_transfer = pow2floor(ret);
     }
 
     ret = bs->sg ? sg_get_max_segments(s->fd) : get_max_segments(s->fd);
     if (ret > 0) {
-        bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
-                                           ret * qemu_real_host_page_size);
+        bs->bl.max_ioctl_transfer =
+            MIN_NON_ZERO(bs->bl.max_ioctl_transfer,
+                         ret * qemu_real_host_page_size);
     }
 
     raw_refresh_limits(bs, errp);
diff --git a/block/iscsi.c b/block/iscsi.c
index 7d4b3b56d5..b74fdf149d 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -2063,6 +2063,7 @@ static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
 
     if (max_xfer_len * block_size < INT_MAX) {
         bs->bl.max_transfer = max_xfer_len * iscsilun->block_size;
+        bs->bl.max_ioctl_transfer = bs->bl.max_transfer;
     }
 
     if (iscsilun->lbp.lbpu) {
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 2cb23ca891..6df67bf889 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -167,7 +167,7 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s)
         page = r->req.cmd.buf[2];
         if (page == 0xb0) {
             uint32_t max_transfer =
-                blk_get_max_transfer(s->conf.blk) / s->blocksize;
+                blk_get_max_ioctl_transfer(s->conf.blk) / s->blocksize;
 
             assert(max_transfer);
             stl_be_p(&r->buf[8], max_transfer);
@@ -210,7 +210,7 @@ static int scsi_generic_emulate_block_limits(SCSIGenericReq *r, SCSIDevice *s)
     uint8_t buf[64];
 
     SCSIBlockLimits bl = {
-        .max_io_sectors = blk_get_max_transfer(s->conf.blk) / s->blocksize
+        .max_io_sectors = blk_get_max_ioctl_transfer(s->conf.blk) / s->blocksize
     };
 
     memset(r->buf, 0, r->buflen);
-- 
2.26.2

Re: [PATCH v3 4/5] block: use blk_get_max_ioctl_transfer for SCSI passthrough

[Max Reitz]

On 17.12.20 17:56, Maxim Levitsky wrote:
> Switch file-posix to expose only the max_ioctl_transfer limit.
> 
> Let the iscsi driver work as it did before since it is bound by the transfer
> limit in both regular read/write and in SCSI passthrough case.
> 
> Switch the scsi-disk and scsi-block drivers to read the SG max transfer limits
> using the new blk_get_max_ioctl_transfer interface.
> 
> 
> Fixes: 867eccfed8 ("file-posix: Use max transfer length/segment count only for SCSI passthrough")
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
>   block/file-posix.c     | 7 ++++---
>   block/iscsi.c          | 1 +
>   hw/scsi/scsi-generic.c | 4 ++--
>   3 files changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/block/file-posix.c b/block/file-posix.c
> index 2bf4d095a7..c34a7a9599 100644
> --- a/block/file-posix.c
> +++ b/block/file-posix.c
> @@ -1282,13 +1282,14 @@ static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
>                          get_max_transfer_length(s->fd);
>   
>       if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
> -        bs->bl.max_transfer = pow2floor(ret);
> +        bs->bl.max_ioctl_transfer = pow2floor(ret);
>       }
>   
>       ret = bs->sg ? sg_get_max_segments(s->fd) : get_max_segments(s->fd);
>       if (ret > 0) {
> -        bs->bl.max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
> -                                           ret * qemu_real_host_page_size);
> +        bs->bl.max_ioctl_transfer =
> +            MIN_NON_ZERO(bs->bl.max_ioctl_transfer,
> +                         ret * qemu_real_host_page_size);
>       }

Do non-SG devices even have a max transfer length then?  I would’ve 
thought max_ioctl_transfer simply doesn’t apply to them and so could be 
left 0.


(Rest looks good – from what I can tell...)

Max

>   
>       raw_refresh_limits(bs, errp);

[PATCH v3 5/5] block/scsi: correctly emulate the VPD block limits page

[Maxim Levitsky]

When the device doesn't support the VPD block limits page, we emulate it even
for SCSI passthrough.

As a part of the emulation we need to add it to the 'Supported VPD Pages'

The code that does this adds it to the page, but it doesn't increase the length
of the data to be copied to the guest, thus the guest never sees the VPD block
limits page as supported.

Bump the transfer size by 1 in this case.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
---
 hw/scsi/scsi-generic.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 6df67bf889..8f43979cbc 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -134,7 +134,7 @@ static int execute_command(BlockBackend *blk,
     return 0;
 }
 
-static void scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s)
+static int scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s, int len)
 {
     uint8_t page, page_idx;
 
@@ -200,8 +200,13 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s)
                 r->buf[page_idx] = 0xb0;
             }
             stw_be_p(r->buf + 2, lduw_be_p(r->buf + 2) + 1);
+
+            if (len < r->buflen) {
+                len++;
+            }
         }
     }
+    return len;
 }
 
 static int scsi_generic_emulate_block_limits(SCSIGenericReq *r, SCSIDevice *s)
@@ -316,7 +321,7 @@ static void scsi_read_complete(void * opaque, int ret)
         }
     }
     if (r->req.cmd.buf[0] == INQUIRY) {
-        scsi_handle_inquiry_reply(r, s);
+        len = scsi_handle_inquiry_reply(r, s, len);
     }
 
 req_complete:
-- 
2.26.2

Re: [PATCH v3 5/5] block/scsi: correctly emulate the VPD block limits page

[Max Reitz]

On 17.12.20 17:56, Maxim Levitsky wrote:
> When the device doesn't support the VPD block limits page, we emulate it even
> for SCSI passthrough.
> 
> As a part of the emulation we need to add it to the 'Supported VPD Pages'
> 
> The code that does this adds it to the page, but it doesn't increase the length
> of the data to be copied to the guest, thus the guest never sees the VPD block
> limits page as supported.

Isn’t the problem more generally that if there is a block limits page, 
the last supported page is cut off (which perhaps more likely than not 
is the block limits page (given that it’s 0xb0, which relatively high))?

> Bump the transfer size by 1 in this case.
> 
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
>   hw/scsi/scsi-generic.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)

Anyway, looks good to me, though I have a hard time following the code, 
which yields a rather weak:

Reviewed-by: Max Reitz <mreitz@redhat.com>

Re: [PATCH v3 0/5] SCSI: fix transfer limits for SCSI passthrough

[Maxim Levitsky]

On Thu, 2020-12-17 at 18:56 +0200, Maxim Levitsky wrote:
> This patch series attempts to provide a solution to the problem of the transfer
> limits of the raw file driver (host_device/file-posix), some of which I
> already tried to fix in the past.
> 
> I included 2 patches from Tom Yan which fix two issues with reading the limits
> correctly from the */dev/sg* character devices in the first place.
> 
> The only change to these patches is that I tweaked a bit the comments in the
> source to better document the /dev/sg quirks.
> 
> The other two patches in this series split the max transfer limits that qemu
> block devices expose in two:
> One limit is for the regular IO, and another is for the SG_IO (aka bdrv_*_ioctl),
> and the two device drivers (scsi-block and scsi-generic) that use the later
> are switched to the new interface.
> 
> This should ensure that the raw driver can still advertise the unlimited
> transfer  length, unless it is used for SG_IO, because that yields the highest
> performance.
> 
> Also I include a somewhat unrelated fix to a bug I found in qemu's
> SCSI passthrough while testing this:
> When qemu emulates the VPD block limit page, for a SCSI device that doesn't
> implement it, it doesn't really advertise the emulated page to the guest.
> 
> I tested this by doing both regular and SG_IO passthrough of my
> USB SD card reader.
> 
> That device turned out to be a perfect device for the task, since it has max
> transfer size of 1024 blocks (512K), and it enforces it.
> 
> Also it didn't implement the VPD block limits page,
> (transfer size limit probably comes from something USB related) which triggered
> the unrelated bug.
> 
> I was able to see IO errors without the patches, and the wrong max transfer
> size in the guest, and with patches both issues were gone.
> 
> I also found an unrelated issue in /dev/sg passthrough in the kernel.
> It turns out that in-kernel driver has a limitation of 16 requests in flight,
> regardless of what underlying device supports.
> 
> With a large multi-threaded fio job  and a debug print in qemu, it is easy to
> see it, although the errors don't do much harm to the guest as it retries the
> IO, and eventually succeed.
> It is an open question if this should be solved.
> 
> V2: fixed an issue in a patch from Tom Yan (thanks), and removed
> refactoring from last patch according to Paulo's request.
> 
> V3: few cosmitic changes due to the review feedback.
> 
> Maxim Levitsky (3):
>   block: add max_ioctl_transfer to BlockLimits
>   block: use blk_get_max_ioctl_transfer for SCSI passthrough
>   block/scsi: correctly emulate the VPD block limits page
> 
> Tom Yan (2):
>   file-posix: split hdev_refresh_limits from raw_refresh_limits
>   file-posix: add sg_get_max_segments that actually works with sg
> 
>  block/block-backend.c          | 12 ++++++
>  block/file-posix.c             | 76 +++++++++++++++++++++++++++-------
>  block/io.c                     |  2 +
>  block/iscsi.c                  |  1 +
>  hw/scsi/scsi-generic.c         | 13 ++++--
>  include/block/block_int.h      |  4 ++
>  include/sysemu/block-backend.h |  1 +
>  7 files changed, 90 insertions(+), 19 deletions(-)
> 
> -- 
> 2.26.2
> 
> 
> 
Any update on this?
Best regards,
	Maxim Levitsky