 @@ -1,14 +1,14 @@
-/*      $NetBSD: xbd_xenbus.c,v 1.84 2018/08/21 18:31:55 jdolecek Exp $      */
+/*      $NetBSD: xbd_xenbus.c,v 1.85 2018/08/21 18:45:16 jdolecek Exp $      */
 /*
  * Copyright (c) 2006 Manuel Bouyer.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
+ *
 @@ -40,27 +40,27 @@
  * - initiate request: xbdread/write/open/ioctl/..
  * - depending on operation, it is handled directly by disk(9) subsystem or
  *   goes through physio(9) first.
  * - the request is ultimately processed by xbd_diskstart() that prepares the
  *   xbd requests, post them in the ring I/O queue, then signal the backend.
+ *
  * When a response is available in the queue, the backend signals the frontend
  * via its event channel. This triggers xbd_handler(), which will link back
  * the response to its request through the request ID, and mark the I/O as
  * completed.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xbd_xenbus.c,v 1.84 2018/08/21 18:31:55 jdolecek Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xbd_xenbus.c,v 1.85 2018/08/21 18:45:16 jdolecek Exp $");
 #include "opt_xen.h"
 #include <sys/param.h>
 #include <sys/buf.h>
 #include <sys/bufq.h>
 #include <sys/device.h>
 #include <sys/disk.h>
 #include <sys/disklabel.h>
 #include <sys/conf.h>
 #include <sys/fcntl.h>
 #include <sys/kernel.h>
 @@ -651,56 +651,62 @@ xbd_handler(void *arg)
 	int more_to_do;
 	int seg;
 	DPRINTF(("xbd_handler(%s)\n", device_xname(sc->sc_dksc.sc_dev)));
 	if (__predict_false(sc->sc_backend_status != BLKIF_STATE_CONNECTED))
 		return 0;
 again:
 	resp_prod = sc->sc_ring.sring->rsp_prod;
 	xen_rmb(); /* ensure we see replies up to resp_prod */
 	for (i = sc->sc_ring.rsp_cons; i != resp_prod; i++) {
 		blkif_response_t *rep = RING_GET_RESPONSE(&sc->sc_ring, i);
 		struct xbd_req *xbdreq = &sc->sc_reqs[rep->id];
 		bp = xbdreq->req_bp;
 		DPRINTF(("xbd_handler(%p): b_bcount = %ld\n",
 		    xbdreq->req_bp, (long)bp->b_bcount));
 		if (rep->operation == BLKIF_OP_FLUSH_DISKCACHE) {
 			KASSERT(xbdreq->req_bp == NULL);
 			xbdreq->req_sync.s_error = rep->status;
 			xbdreq->req_sync.s_done = 1;
 			wakeup(xbdreq); /* XXXSMP */
 			/* caller will free the req */
 			continue;
+		}
 		if (rep->operation != BLKIF_OP_READ &&
 		    rep->operation != BLKIF_OP_WRITE) {
 			aprint_error_dev(sc->sc_dksc.sc_dev,
 			    "bad operation %d from backend\n", rep->operation);
 			continue;
+		}
 		for (seg = xbdreq->req_nr_segments - 1; seg >= 0; seg--) {
 			if (__predict_false(
 			    xengnt_status(xbdreq->req_gntref[seg]))) {
 				aprint_verbose_dev(sc->sc_dksc.sc_dev,
 					"grant still used by backend\n");
 				sc->sc_ring.rsp_cons = i;
 				xbdreq->req_nr_segments = seg + 1;
 				goto done;
+			}
 			xengnt_revoke_access(xbdreq->req_gntref[seg]);
 			xbdreq->req_nr_segments--;
+		}
-		if (rep->operation != BLKIF_OP_READ &&
+		KASSERT(xbdreq->req_nr_segments == 0);
 		    rep->operation != BLKIF_OP_WRITE) {
-			aprint_error_dev(sc->sc_dksc.sc_dev,
+		bp = xbdreq->req_bp;
-			    "bad operation %d from backend\n", rep->operation);
+		xbdreq->req_bp = NULL;
-			bp->b_error = EIO;
+		DPRINTF(("%s(%p): b_bcount = %ld\n", __func__,
-			bp->b_resid = bp->b_bcount;
+		    bp, (long)bp->b_bcount));
 			goto next;
 		if (rep->status != BLKIF_RSP_OKAY) {
 			bp->b_error = EIO;
 			bp->b_resid = bp->b_bcount;
 			goto next;
+		}
 		/* b_resid was set in dk_start */
 next:
 		dk_done(&sc->sc_dksc, bp);
 		SLIST_INSERT_HEAD(&sc->sc_xbdreq_head, xbdreq, req_next);
+	}
 done:
 	xen_rmb();