diff mbox series

[v3,1/3] s390/cio: Don't pin vfio pages for empty transfers

Message ID 20190516161403.79053-2-farman@linux.ibm.com (mailing list archive)
State New, archived
Headers show
Series s390: vfio-ccw fixes | expand

Commit Message

Eric Farman May 16, 2019, 4:14 p.m. UTC
The skip flag of a CCW offers the possibility of data not being
transferred, but is only meaningful for certain commands.
Specifically, it is only applicable for a read, read backward, sense,
or sense ID CCW and will be ignored for any other command code
(SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).

(A sense ID is xE4, while a sense is x04 with possible modifiers in the
upper four bits.  So we will cover the whole "family" of sense CCWs.)

For those scenarios, since there is no requirement for the target
address to be valid, we should skip the call to vfio_pin_pages() and
rely on the IDAL address we have allocated/built for the channel
program.  The fact that the individual IDAWs within the IDAL are
invalid is fine, since they aren't actually checked in these cases.

Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
defined as the number of pages pinned and is used to determine
whether to call vfio_unpin_pages() upon cleanup.

As we do this, since the pfn_array_pin() routine returns the number of
pages pinned, and we might not be doing that, the logic for converting
a CCW from direct-addressed to IDAL needs to ensure there is room for
one IDAW in the IDAL being built since a zero-length IDAL isn't great.

Signed-off-by: Eric Farman <farman@linux.ibm.com>
---
 drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
 1 file changed, 50 insertions(+), 5 deletions(-)

Comments

Cornelia Huck May 17, 2019, 9:06 a.m. UTC | #1
On Thu, 16 May 2019 18:14:01 +0200
Eric Farman <farman@linux.ibm.com> wrote:

> The skip flag of a CCW offers the possibility of data not being
> transferred, but is only meaningful for certain commands.
> Specifically, it is only applicable for a read, read backward, sense,
> or sense ID CCW and will be ignored for any other command code
> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
> 
> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
> upper four bits.  So we will cover the whole "family" of sense CCWs.)
> 
> For those scenarios, since there is no requirement for the target
> address to be valid, we should skip the call to vfio_pin_pages() and
> rely on the IDAL address we have allocated/built for the channel
> program.  The fact that the individual IDAWs within the IDAL are
> invalid is fine, since they aren't actually checked in these cases.
> 
> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
> defined as the number of pages pinned and is used to determine
> whether to call vfio_unpin_pages() upon cleanup.
> 
> As we do this, since the pfn_array_pin() routine returns the number of
> pages pinned, and we might not be doing that, the logic for converting
> a CCW from direct-addressed to IDAL needs to ensure there is room for
> one IDAW in the IDAL being built since a zero-length IDAL isn't great.

I have now read this sentence several times and that this and that
confuses me :) What are we doing, and what is the thing that we might
not be doing?

> 
> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> ---
>  drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
>  1 file changed, 50 insertions(+), 5 deletions(-)
Eric Farman May 17, 2019, 12:57 p.m. UTC | #2
On 5/17/19 5:06 AM, Cornelia Huck wrote:
> On Thu, 16 May 2019 18:14:01 +0200
> Eric Farman <farman@linux.ibm.com> wrote:
> 
>> The skip flag of a CCW offers the possibility of data not being
>> transferred, but is only meaningful for certain commands.
>> Specifically, it is only applicable for a read, read backward, sense,
>> or sense ID CCW and will be ignored for any other command code
>> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
>>
>> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
>> upper four bits.  So we will cover the whole "family" of sense CCWs.)
>>
>> For those scenarios, since there is no requirement for the target
>> address to be valid, we should skip the call to vfio_pin_pages() and
>> rely on the IDAL address we have allocated/built for the channel
>> program.  The fact that the individual IDAWs within the IDAL are
>> invalid is fine, since they aren't actually checked in these cases.
>>
>> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
>> defined as the number of pages pinned and is used to determine
>> whether to call vfio_unpin_pages() upon cleanup.
>>
>> As we do this, since the pfn_array_pin() routine returns the number of
>> pages pinned, and we might not be doing that, the logic for converting
>> a CCW from direct-addressed to IDAL needs to ensure there is room for
>> one IDAW in the IDAL being built since a zero-length IDAL isn't great.
> 
> I have now read this sentence several times and that this and that
> confuses me :)

I have read this code for several months and I'm still confused.  :)

> What are we doing, and what is the thing that we might
> not be doing?

In the codepath that converts a direct-addressed CCW into an indirect
one, we currently rely on the returned value from pfn_array_pin() to
tell us how many pages were pinned, and thus how big of an IDAL to
allocate.  But since this patch causes us to skip the call to
pfn_array_pin() for certain CCWs, using that value would be zero
(leftover from pfn_array_alloc()) and thus would be weird to pass to the
kcalloc() for our IDAL.  We definitely want to allocate our own IDAL so
that CCW.CDA contains a valid address, regardless of whether the IDAWs
will be populated or not, so we calculate the number of pages ourselves
here.

(Sidebar, the above is not a concern for the IDAL-to-IDAL codepath,
since it has already calculated the size of the IDAL from the guest CCW
and is going page-by-page through it.)

pfn_array_pin() doesn't return "partial pin" counts.  If we ask for 10
pages to be pinned and it only does 5, we're going to get an error that
we have to clean up from, rather than carrying on as if "up to 10" pages
pinned was acceptable.  To say that another way, there's no SLI bit for
the vfio_pin_pages() call, so it's not necessary to rely on the count
being returned if we ourselves calculate it.

So, with that...  Maybe the paragraph in question should be something
like this?

---8<---
The pfn_array_pin() routine returns the number of pages that were
pinned, but now might be skipped for some CCWs.  Thus we need to
calculate the expected number of pages ourselves such that we are
guaranteed to allocate a reasonable number of IDAWs, which will
provide a valid address in CCW.CDA regardless of whether the IDAWs
are filled in with pinned/translated addresses or not.

> 
>>
>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>> ---
>>   drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
>>   1 file changed, 50 insertions(+), 5 deletions(-)
>
Cornelia Huck May 17, 2019, 2:06 p.m. UTC | #3
On Fri, 17 May 2019 08:57:10 -0400
Eric Farman <farman@linux.ibm.com> wrote:

> On 5/17/19 5:06 AM, Cornelia Huck wrote:
> > On Thu, 16 May 2019 18:14:01 +0200
> > Eric Farman <farman@linux.ibm.com> wrote:
> >   
> >> The skip flag of a CCW offers the possibility of data not being
> >> transferred, but is only meaningful for certain commands.
> >> Specifically, it is only applicable for a read, read backward, sense,
> >> or sense ID CCW and will be ignored for any other command code
> >> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
> >>
> >> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
> >> upper four bits.  So we will cover the whole "family" of sense CCWs.)
> >>
> >> For those scenarios, since there is no requirement for the target
> >> address to be valid, we should skip the call to vfio_pin_pages() and
> >> rely on the IDAL address we have allocated/built for the channel
> >> program.  The fact that the individual IDAWs within the IDAL are
> >> invalid is fine, since they aren't actually checked in these cases.
> >>
> >> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
> >> defined as the number of pages pinned and is used to determine
> >> whether to call vfio_unpin_pages() upon cleanup.
> >>
> >> As we do this, since the pfn_array_pin() routine returns the number of
> >> pages pinned, and we might not be doing that, the logic for converting
> >> a CCW from direct-addressed to IDAL needs to ensure there is room for
> >> one IDAW in the IDAL being built since a zero-length IDAL isn't great.  
> > 
> > I have now read this sentence several times and that this and that
> > confuses me :)  
> 
> I have read this code for several months and I'm still confused.  :)

Lol, I guess you are not alone :)

> 
> > What are we doing, and what is the thing that we might
> > not be doing?  
> 
> In the codepath that converts a direct-addressed CCW into an indirect
> one, we currently rely on the returned value from pfn_array_pin() to
> tell us how many pages were pinned, and thus how big of an IDAL to
> allocate.  But since this patch causes us to skip the call to
> pfn_array_pin() for certain CCWs, using that value would be zero
> (leftover from pfn_array_alloc()) and thus would be weird to pass to the
> kcalloc() for our IDAL.  We definitely want to allocate our own IDAL so
> that CCW.CDA contains a valid address, regardless of whether the IDAWs
> will be populated or not, so we calculate the number of pages ourselves
> here.
> 
> (Sidebar, the above is not a concern for the IDAL-to-IDAL codepath,
> since it has already calculated the size of the IDAL from the guest CCW
> and is going page-by-page through it.)
> 
> pfn_array_pin() doesn't return "partial pin" counts.  If we ask for 10
> pages to be pinned and it only does 5, we're going to get an error that
> we have to clean up from, rather than carrying on as if "up to 10" pages
> pinned was acceptable.  To say that another way, there's no SLI bit for
> the vfio_pin_pages() call, so it's not necessary to rely on the count
> being returned if we ourselves calculate it.
> 
> So, with that...  Maybe the paragraph in question should be something
> like this?
> 
> ---8<---
> The pfn_array_pin() routine returns the number of pages that were
> pinned, but now might be skipped for some CCWs.  Thus we need to
> calculate the expected number of pages ourselves such that we are
> guaranteed to allocate a reasonable number of IDAWs, which will
> provide a valid address in CCW.CDA regardless of whether the IDAWs
> are filled in with pinned/translated addresses or not.

Much better, thanks!

I can change the description when picking up, if no reason for a respin
comes up (series seems sane to me so far).

> 
> >   
> >>
> >> Signed-off-by: Eric Farman <farman@linux.ibm.com>
> >> ---
> >>   drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
> >>   1 file changed, 50 insertions(+), 5 deletions(-)  
> >
Eric Farman May 17, 2019, 2:20 p.m. UTC | #4
On 5/17/19 10:06 AM, Cornelia Huck wrote:
> On Fri, 17 May 2019 08:57:10 -0400
> Eric Farman <farman@linux.ibm.com> wrote:
> 
>> On 5/17/19 5:06 AM, Cornelia Huck wrote:
>>> On Thu, 16 May 2019 18:14:01 +0200
>>> Eric Farman <farman@linux.ibm.com> wrote:
>>>   
>>>> The skip flag of a CCW offers the possibility of data not being
>>>> transferred, but is only meaningful for certain commands.
>>>> Specifically, it is only applicable for a read, read backward, sense,
>>>> or sense ID CCW and will be ignored for any other command code
>>>> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
>>>>
>>>> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
>>>> upper four bits.  So we will cover the whole "family" of sense CCWs.)
>>>>
>>>> For those scenarios, since there is no requirement for the target
>>>> address to be valid, we should skip the call to vfio_pin_pages() and
>>>> rely on the IDAL address we have allocated/built for the channel
>>>> program.  The fact that the individual IDAWs within the IDAL are
>>>> invalid is fine, since they aren't actually checked in these cases.
>>>>
>>>> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
>>>> defined as the number of pages pinned and is used to determine
>>>> whether to call vfio_unpin_pages() upon cleanup.
>>>>
>>>> As we do this, since the pfn_array_pin() routine returns the number of
>>>> pages pinned, and we might not be doing that, the logic for converting
>>>> a CCW from direct-addressed to IDAL needs to ensure there is room for
>>>> one IDAW in the IDAL being built since a zero-length IDAL isn't great.  
>>>
>>> I have now read this sentence several times and that this and that
>>> confuses me :)  
>>
>> I have read this code for several months and I'm still confused.  :)
> 
> Lol, I guess you are not alone :)
> 
>>
>>> What are we doing, and what is the thing that we might
>>> not be doing?  
>>
>> In the codepath that converts a direct-addressed CCW into an indirect
>> one, we currently rely on the returned value from pfn_array_pin() to
>> tell us how many pages were pinned, and thus how big of an IDAL to
>> allocate.  But since this patch causes us to skip the call to
>> pfn_array_pin() for certain CCWs, using that value would be zero
>> (leftover from pfn_array_alloc()) and thus would be weird to pass to the
>> kcalloc() for our IDAL.  We definitely want to allocate our own IDAL so
>> that CCW.CDA contains a valid address, regardless of whether the IDAWs
>> will be populated or not, so we calculate the number of pages ourselves
>> here.
>>
>> (Sidebar, the above is not a concern for the IDAL-to-IDAL codepath,
>> since it has already calculated the size of the IDAL from the guest CCW
>> and is going page-by-page through it.)
>>
>> pfn_array_pin() doesn't return "partial pin" counts.  If we ask for 10
>> pages to be pinned and it only does 5, we're going to get an error that
>> we have to clean up from, rather than carrying on as if "up to 10" pages
>> pinned was acceptable.  To say that another way, there's no SLI bit for
>> the vfio_pin_pages() call, so it's not necessary to rely on the count
>> being returned if we ourselves calculate it.
>>
>> So, with that...  Maybe the paragraph in question should be something
>> like this?
>>
>> ---8<---
>> The pfn_array_pin() routine returns the number of pages that were
>> pinned, but now might be skipped for some CCWs.  Thus we need to
>> calculate the expected number of pages ourselves such that we are
>> guaranteed to allocate a reasonable number of IDAWs, which will
>> provide a valid address in CCW.CDA regardless of whether the IDAWs
>> are filled in with pinned/translated addresses or not.
> 
> Much better, thanks!
> 
> I can change the description when picking up, if no reason for a respin
> comes up (series seems sane to me so far).

I appreciate that, thank you!  Looking forward to what others may say.

 - Eric

> 
>>
>>>   
>>>>
>>>> Signed-off-by: Eric Farman <farman@linux.ibm.com>
>>>> ---
>>>>   drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
>>>>   1 file changed, 50 insertions(+), 5 deletions(-)  
>>>   
>
Farhan Ali May 20, 2019, 8:35 p.m. UTC | #5
On 05/16/2019 12:14 PM, Eric Farman wrote:
> The skip flag of a CCW offers the possibility of data not being
> transferred, but is only meaningful for certain commands.
> Specifically, it is only applicable for a read, read backward, sense,
> or sense ID CCW and will be ignored for any other command code
> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
> 
> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
> upper four bits.  So we will cover the whole "family" of sense CCWs.)
> 
> For those scenarios, since there is no requirement for the target
> address to be valid, we should skip the call to vfio_pin_pages() and
> rely on the IDAL address we have allocated/built for the channel
> program.  The fact that the individual IDAWs within the IDAL are
> invalid is fine, since they aren't actually checked in these cases.
> 
> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
> defined as the number of pages pinned and is used to determine
> whether to call vfio_unpin_pages() upon cleanup.
> 
> As we do this, since the pfn_array_pin() routine returns the number of
> pages pinned, and we might not be doing that, the logic for converting
> a CCW from direct-addressed to IDAL needs to ensure there is room for
> one IDAW in the IDAL being built since a zero-length IDAL isn't great.
> 
> Signed-off-by: Eric Farman<farman@linux.ibm.com>
> ---
>   drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
>   1 file changed, 50 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index 086faf2dacd3..0467838aed23 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -294,6 +294,10 @@ static long copy_ccw_from_iova(struct channel_program *cp,
>   /*
>    * Helpers to operate ccwchain.
>    */
> +#define ccw_is_read(_ccw) (((_ccw)->cmd_code & 0x03) == 0x02)
> +#define ccw_is_read_backward(_ccw) (((_ccw)->cmd_code & 0x0F) == 0x0C)
> +#define ccw_is_sense(_ccw) (((_ccw)->cmd_code & 0x0F) == CCW_CMD_BASIC_SENSE)
> +
>   #define ccw_is_test(_ccw) (((_ccw)->cmd_code & 0x0F) == 0)
>   
>   #define ccw_is_noop(_ccw) ((_ccw)->cmd_code == CCW_CMD_NOOP)
> @@ -301,10 +305,39 @@ static long copy_ccw_from_iova(struct channel_program *cp,
>   #define ccw_is_tic(_ccw) ((_ccw)->cmd_code == CCW_CMD_TIC)
>   
>   #define ccw_is_idal(_ccw) ((_ccw)->flags & CCW_FLAG_IDA)
> -
> +#define ccw_is_skip(_ccw) ((_ccw)->flags & CCW_FLAG_SKIP)
>   
>   #define ccw_is_chain(_ccw) ((_ccw)->flags & (CCW_FLAG_CC | CCW_FLAG_DC))
>   
> +/*
> + * ccw_does_data_transfer()
> + *
> + * Determine whether a CCW will move any data, such that the guest pages
> + * would need to be pinned before performing the I/O.
> + *
> + * Returns 1 if yes, 0 if no.
> + */
> +static inline int ccw_does_data_transfer(struct ccw1 *ccw)
> +{
> +	/* If the skip flag is off, then data will be transferred */
> +	if (!ccw_is_skip(ccw))
> +		return 1;
> +
> +	/*
> +	 * If the skip flag is on, it is only meaningful if the command
> +	 * code is a read, read backward, sense, or sense ID.  In those
> +	 * cases, no data will be transferred.
> +	 */
> +	if (ccw_is_read(ccw) || ccw_is_read_backward(ccw))
> +		return 0;
> +
> +	if (ccw_is_sense(ccw))
> +		return 0;

Just out of curiosity, is there a reason we are checking ccw_is_sense in 
a separate if statement?

> +
> +	/* The skip flag is on, but it is ignored for this command code. */
> +	return 1;
> +}
Eric Farman May 21, 2019, 2:29 a.m. UTC | #6
On 5/20/19 4:35 PM, Farhan Ali wrote:
> 
> 
> On 05/16/2019 12:14 PM, Eric Farman wrote:
>> The skip flag of a CCW offers the possibility of data not being
>> transferred, but is only meaningful for certain commands.
>> Specifically, it is only applicable for a read, read backward, sense,
>> or sense ID CCW and will be ignored for any other command code
>> (SA22-7832-11 page 15-64, and figure 15-30 on page 15-75).
>>
>> (A sense ID is xE4, while a sense is x04 with possible modifiers in the
>> upper four bits.  So we will cover the whole "family" of sense CCWs.)
>>
>> For those scenarios, since there is no requirement for the target
>> address to be valid, we should skip the call to vfio_pin_pages() and
>> rely on the IDAL address we have allocated/built for the channel
>> program.  The fact that the individual IDAWs within the IDAL are
>> invalid is fine, since they aren't actually checked in these cases.
>>
>> Set pa_nr to zero when skipping the pfn_array_pin() call, since it is
>> defined as the number of pages pinned and is used to determine
>> whether to call vfio_unpin_pages() upon cleanup.
>>
>> As we do this, since the pfn_array_pin() routine returns the number of
>> pages pinned, and we might not be doing that, the logic for converting
>> a CCW from direct-addressed to IDAL needs to ensure there is room for
>> one IDAW in the IDAL being built since a zero-length IDAL isn't great.
>>
>> Signed-off-by: Eric Farman<farman@linux.ibm.com>
>> ---
>>   drivers/s390/cio/vfio_ccw_cp.c | 55 ++++++++++++++++++++++++++++++----
>>   1 file changed, 50 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/s390/cio/vfio_ccw_cp.c
>> b/drivers/s390/cio/vfio_ccw_cp.c
>> index 086faf2dacd3..0467838aed23 100644
>> --- a/drivers/s390/cio/vfio_ccw_cp.c
>> +++ b/drivers/s390/cio/vfio_ccw_cp.c
>> @@ -294,6 +294,10 @@ static long copy_ccw_from_iova(struct
>> channel_program *cp,
>>   /*
>>    * Helpers to operate ccwchain.
>>    */
>> +#define ccw_is_read(_ccw) (((_ccw)->cmd_code & 0x03) == 0x02)
>> +#define ccw_is_read_backward(_ccw) (((_ccw)->cmd_code & 0x0F) == 0x0C)
>> +#define ccw_is_sense(_ccw) (((_ccw)->cmd_code & 0x0F) ==
>> CCW_CMD_BASIC_SENSE)
>> +
>>   #define ccw_is_test(_ccw) (((_ccw)->cmd_code & 0x0F) == 0)
>>     #define ccw_is_noop(_ccw) ((_ccw)->cmd_code == CCW_CMD_NOOP)
>> @@ -301,10 +305,39 @@ static long copy_ccw_from_iova(struct
>> channel_program *cp,
>>   #define ccw_is_tic(_ccw) ((_ccw)->cmd_code == CCW_CMD_TIC)
>>     #define ccw_is_idal(_ccw) ((_ccw)->flags & CCW_FLAG_IDA)
>> -
>> +#define ccw_is_skip(_ccw) ((_ccw)->flags & CCW_FLAG_SKIP)
>>     #define ccw_is_chain(_ccw) ((_ccw)->flags & (CCW_FLAG_CC |
>> CCW_FLAG_DC))
>>   +/*
>> + * ccw_does_data_transfer()
>> + *
>> + * Determine whether a CCW will move any data, such that the guest pages
>> + * would need to be pinned before performing the I/O.
>> + *
>> + * Returns 1 if yes, 0 if no.
>> + */
>> +static inline int ccw_does_data_transfer(struct ccw1 *ccw)
>> +{
>> +    /* If the skip flag is off, then data will be transferred */
>> +    if (!ccw_is_skip(ccw))
>> +        return 1;
>> +
>> +    /*
>> +     * If the skip flag is on, it is only meaningful if the command
>> +     * code is a read, read backward, sense, or sense ID.  In those
>> +     * cases, no data will be transferred.
>> +     */
>> +    if (ccw_is_read(ccw) || ccw_is_read_backward(ccw))
>> +        return 0;
>> +
>> +    if (ccw_is_sense(ccw))
>> +        return 0;
> 
> Just out of curiosity, is there a reason we are checking ccw_is_sense in
> a separate if statement?

No reason besides I thought it read nicer this way, with read
forward/backward being grouped together and not needing to force
everything to fit in 80 columns.  Knowing another opcode (NOP) would be
added later made this layout seem logical too.

The generated assembly is identical regardless of how it's written,
which is not surprising based on the different masks that have to be
employed.

 - Eric

> 
>> +
>> +    /* The skip flag is on, but it is ignored for this command code. */
>> +    return 1;
>> +}
diff mbox series

Patch

diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 086faf2dacd3..0467838aed23 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -294,6 +294,10 @@  static long copy_ccw_from_iova(struct channel_program *cp,
 /*
  * Helpers to operate ccwchain.
  */
+#define ccw_is_read(_ccw) (((_ccw)->cmd_code & 0x03) == 0x02)
+#define ccw_is_read_backward(_ccw) (((_ccw)->cmd_code & 0x0F) == 0x0C)
+#define ccw_is_sense(_ccw) (((_ccw)->cmd_code & 0x0F) == CCW_CMD_BASIC_SENSE)
+
 #define ccw_is_test(_ccw) (((_ccw)->cmd_code & 0x0F) == 0)
 
 #define ccw_is_noop(_ccw) ((_ccw)->cmd_code == CCW_CMD_NOOP)
@@ -301,10 +305,39 @@  static long copy_ccw_from_iova(struct channel_program *cp,
 #define ccw_is_tic(_ccw) ((_ccw)->cmd_code == CCW_CMD_TIC)
 
 #define ccw_is_idal(_ccw) ((_ccw)->flags & CCW_FLAG_IDA)
-
+#define ccw_is_skip(_ccw) ((_ccw)->flags & CCW_FLAG_SKIP)
 
 #define ccw_is_chain(_ccw) ((_ccw)->flags & (CCW_FLAG_CC | CCW_FLAG_DC))
 
+/*
+ * ccw_does_data_transfer()
+ *
+ * Determine whether a CCW will move any data, such that the guest pages
+ * would need to be pinned before performing the I/O.
+ *
+ * Returns 1 if yes, 0 if no.
+ */
+static inline int ccw_does_data_transfer(struct ccw1 *ccw)
+{
+	/* If the skip flag is off, then data will be transferred */
+	if (!ccw_is_skip(ccw))
+		return 1;
+
+	/*
+	 * If the skip flag is on, it is only meaningful if the command
+	 * code is a read, read backward, sense, or sense ID.  In those
+	 * cases, no data will be transferred.
+	 */
+	if (ccw_is_read(ccw) || ccw_is_read_backward(ccw))
+		return 0;
+
+	if (ccw_is_sense(ccw))
+		return 0;
+
+	/* The skip flag is on, but it is ignored for this command code. */
+	return 1;
+}
+
 /*
  * is_cpa_within_range()
  *
@@ -559,6 +592,7 @@  static int ccwchain_fetch_direct(struct ccwchain *chain,
 	struct pfn_array_table *pat;
 	unsigned long *idaws;
 	int ret;
+	int idaw_nr = 1;
 
 	ccw = chain->ch_ccw + idx;
 
@@ -570,6 +604,8 @@  static int ccwchain_fetch_direct(struct ccwchain *chain,
 		 */
 		ccw->flags |= CCW_FLAG_IDA;
 		return 0;
+	} else {
+		idaw_nr = idal_nr_words((void *)(u64)ccw->cda, ccw->count);
 	}
 
 	/*
@@ -586,12 +622,16 @@  static int ccwchain_fetch_direct(struct ccwchain *chain,
 	if (ret < 0)
 		goto out_unpin;
 
-	ret = pfn_array_pin(pat->pat_pa, cp->mdev);
-	if (ret < 0)
-		goto out_unpin;
+	if (ccw_does_data_transfer(ccw)) {
+		ret = pfn_array_pin(pat->pat_pa, cp->mdev);
+		if (ret < 0)
+			goto out_unpin;
+	} else {
+		pat->pat_pa->pa_nr = 0;
+	}
 
 	/* Translate this direct ccw to a idal ccw. */
-	idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
+	idaws = kcalloc(idaw_nr, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
 	if (!idaws) {
 		ret = -ENOMEM;
 		goto out_unpin;
@@ -661,6 +701,11 @@  static int ccwchain_fetch_idal(struct ccwchain *chain,
 		if (ret < 0)
 			goto out_free_idaws;
 
+		if (!ccw_does_data_transfer(ccw)) {
+			pa->pa_nr = 0;
+			continue;
+		}
+
 		ret = pfn_array_pin(pa, cp->mdev);
 		if (ret < 0)
 			goto out_free_idaws;