block: fix discard-path hangs and bounds on the BLKDISCARD ioctl

The generic BLKDISCARD ioctl submits a BIO_DISCARD and waits on bio_wait().
Drivers that do not implement discard returned ENOTBLK from their bio_cmd
switch without completing the bio, so the wait hung.  Complete the bio with
error in the default case of nvme, ahci, ide and scsi so an unsupported
discard fails cleanly instead of hanging.

multiplex_strategy split a request larger than max_io_size by doing pointer
arithmetic on bio_data, which is nullptr for a discard (no data payload).
Forward discard bios whole and let the driver enforce its own size limit.

In virtio-blk, restrict the SEG_MAX segment-count check to READ/WRITE (the
only requests with a data payload) and complete the bio on failure so a
waiting caller is not left hung.  Reject a discard whose sector count would
overflow the u32 num_sectors field or exceed the advertised
max_discard_sectors, rather than truncating and discarding the wrong range.

Author: gburd

drivers/ahci.cc

@@ -299,6 +299,7 @@ int port::make_request(struct bio* bio)
             disk_flush(bio);
             break;
         default:
+            biodone(bio, false);
             return ENOTBLK;
         }
         return 0;

drivers/ide.cc

@@ -134,6 +134,7 @@ int ide_drive::make_request(struct bio* bio)
             }
             break;
         default:
+            biodone(bio, false);
             return ENOTBLK;
         }
 

drivers/nvme-queue.cc

@@ -313,6 +313,7 @@ int io_queue_pair::make_request(struct bio* bio, u32 nsid = 1)
 
     default:
         NVME_ERROR("Operation not implemented\n");
+        biodone(bio, false);
         return ENOTBLK;
     }
     return 0;

drivers/nvme.cc

@@ -432,6 +432,20 @@ int driver::identify_namespace(u32 nsid)
 
 int driver::make_request(bio* bio, u32 nsid)
 {
+    // Reject commands this driver does not implement (e.g. BIO_DISCARD) up
+    // front, before the block-alignment math and >> blockshift below run on a
+    // bio whose offset/bcount are not sector counts.  The per-queue path also
+    // rejects unknown commands, but doing it here avoids the misleading
+    // alignment error / debug-only assert on a discard request.
+    switch (bio->bio_cmd) {
+    case BIO_READ:
+    case BIO_WRITE:
+    case BIO_FLUSH:
+        break;
+    default:
+        biodone(bio, false);
+        return EOPNOTSUPP;
+    }
     if (bio->bio_bcount % _ns_data[nsid]->blocksize || bio->bio_offset % _ns_data[nsid]->blocksize) {
         NVME_ERROR("bio request not block-aligned length=%d, offset=%d blocksize=%d\n",bio->bio_bcount, bio->bio_offset, _ns_data[nsid]->blocksize);
         return EINVAL;

drivers/scsi-common.cc

@@ -310,6 +310,7 @@ int scsi_common::handle_bio(u16 target, u16 lun, struct bio *bio)
             exec_cmd(bio);
             break;
         default:
+            biodone(bio, false);
             return ENOTBLK;
         }
         return 0;

drivers/virtio-blk.cc

@@ -382,13 +382,6 @@ int blk::make_request(struct bio* bio)
 {
     if (!bio) return EIO;
 
-    if (get_guest_feature_bit(VIRTIO_BLK_F_SEG_MAX)) {
-        if (bio->bio_bcount/mmu::page_size + 1 > _config.seg_max) {
-            trace_virtio_blk_make_request_seg_max(bio->bio_bcount, _config.seg_max);
-            return EIO;
-        }
-    }
-
     /* Select a queue by CPU id so parallel CPUs use independent rings. */
     int qid = sched::cpu::current()->id % _num_queues;
 
@@ -425,12 +418,38 @@ int blk::make_request(struct bio* bio)
                 biodone(bio, false);
                 return EINVAL;
             }
+            // num_sectors is a u32 in the virtio descriptor and the device
+            // advertises an upper bound via max_discard_sectors.  Reject a
+            // range that would overflow the field or exceed the device limit
+            // rather than truncating it and discarding the wrong amount.
+            {
+                u64 nsectors = bio->bio_bcount / sector_size;
+                u32 max_sectors = _config.max_discard_sectors ?
+                    _config.max_discard_sectors : UINT32_MAX;
+                if (nsectors > max_sectors) {
+                    biodone(bio, false);
+                    return EINVAL;
+                }
+            }
             type = VIRTIO_BLK_T_DISCARD;
             break;
         default:
+            biodone(bio, false);
             return ENOTBLK;
         }
 
+        // SEG_MAX bounds the number of data segments a request may span, so it
+        // only applies to requests that carry a data payload (READ/WRITE).
+        // FLUSH and DISCARD add no data SG, so skip the check for them.
+        if ((type == VIRTIO_BLK_T_IN || type == VIRTIO_BLK_T_OUT) &&
+            get_guest_feature_bit(VIRTIO_BLK_F_SEG_MAX)) {
+            if (bio->bio_bcount/mmu::page_size + 1 > _config.seg_max) {
+                trace_virtio_blk_make_request_seg_max(bio->bio_bcount, _config.seg_max);
+                biodone(bio, false);
+                return EIO;
+            }
+        }
+
         auto* req = new blk_req(bio);
         blk_outhdr* hdr = &req->hdr;
         hdr->type = type;

fs/vfs/kern_physio.cc

@@ -107,7 +107,11 @@ void multiplex_strategy(struct bio *bio)
 
 	assert(strategy != nullptr);
 
-	if (len <= dev->max_io_size) {
+	// A discard request carries no data payload (bio_data is nullptr) even
+	// though bio_bcount is non-zero, so the max_io_size data-segment limit
+	// does not apply and splitting it would do pointer arithmetic on nullptr.
+	// Forward it whole; the driver enforces its own discard-size limit.
+	if (bio->bio_cmd == BIO_DISCARD || len <= dev->max_io_size) {
 		strategy(bio);
 		return;
 	}