bsg.c 23.0 KB
Newer Older
1
/*
2
 * bsg.c - block layer implementation of the sg v4 interface
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
 *
 * Copyright (C) 2004 Jens Axboe <axboe@suse.de> SUSE Labs
 * Copyright (C) 2004 Peter M. Jones <pjones@redhat.com>
 *
 *  This file is subject to the terms and conditions of the GNU General Public
 *  License version 2.  See the file "COPYING" in the main directory of this
 *  archive for more details.
 *
 */
#include <linux/module.h>
#include <linux/init.h>
#include <linux/file.h>
#include <linux/blkdev.h>
#include <linux/poll.h>
#include <linux/cdev.h>
#include <linux/percpu.h>
#include <linux/uio.h>
20
#include <linux/idr.h>
21 22 23 24 25
#include <linux/bsg.h>

#include <scsi/scsi.h>
#include <scsi/scsi_ioctl.h>
#include <scsi/scsi_cmnd.h>
F
FUJITA Tomonori 已提交
26 27
#include <scsi/scsi_device.h>
#include <scsi/scsi_driver.h>
28 29
#include <scsi/sg.h>

F
FUJITA Tomonori 已提交
30 31
#define BSG_DESCRIPTION	"Block layer SCSI generic (bsg) driver"
#define BSG_VERSION	"0.4"
32 33

struct bsg_device {
34
	struct request_queue *queue;
35 36 37 38 39 40 41 42 43
	spinlock_t lock;
	struct list_head busy_list;
	struct list_head done_list;
	struct hlist_node dev_list;
	atomic_t ref_count;
	int queued_cmds;
	int done_cmds;
	wait_queue_head_t wq_done;
	wait_queue_head_t wq_free;
44
	char name[BUS_ID_SIZE];
45 46 47 48 49 50 51 52 53
	int max_queue;
	unsigned long flags;
};

enum {
	BSG_F_BLOCK		= 1,
	BSG_F_WRITE_PERM	= 2,
};

J
Jens Axboe 已提交
54
#define BSG_DEFAULT_CMDS	64
F
FUJITA Tomonori 已提交
55
#define BSG_MAX_DEVS		32768
56 57 58 59

#undef BSG_DEBUG

#ifdef BSG_DEBUG
60
#define dprintk(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ##args)
61 62 63 64 65
#else
#define dprintk(fmt, args...)
#endif

static DEFINE_MUTEX(bsg_mutex);
66
static DEFINE_IDR(bsg_minor_idr);
67

68 69
#define BSG_LIST_ARRAY_SIZE	8
static struct hlist_head bsg_device_list[BSG_LIST_ARRAY_SIZE];
70 71

static struct class *bsg_class;
J
Jens Axboe 已提交
72
static int bsg_major;
73

J
Jens Axboe 已提交
74 75
static struct kmem_cache *bsg_cmd_cachep;

76 77 78 79 80 81 82 83
/*
 * our internal command type
 */
struct bsg_command {
	struct bsg_device *bd;
	struct list_head list;
	struct request *rq;
	struct bio *bio;
F
FUJITA Tomonori 已提交
84
	struct bio *bidi_bio;
85
	int err;
F
FUJITA Tomonori 已提交
86
	struct sg_io_v4 hdr;
87 88 89 90 91 92 93 94
	char sense[SCSI_SENSE_BUFFERSIZE];
};

static void bsg_free_command(struct bsg_command *bc)
{
	struct bsg_device *bd = bc->bd;
	unsigned long flags;

J
Jens Axboe 已提交
95
	kmem_cache_free(bsg_cmd_cachep, bc);
96 97 98 99 100 101 102 103

	spin_lock_irqsave(&bd->lock, flags);
	bd->queued_cmds--;
	spin_unlock_irqrestore(&bd->lock, flags);

	wake_up(&bd->wq_free);
}

F
FUJITA Tomonori 已提交
104
static struct bsg_command *bsg_alloc_command(struct bsg_device *bd)
105
{
F
FUJITA Tomonori 已提交
106
	struct bsg_command *bc = ERR_PTR(-EINVAL);
107 108 109 110 111 112 113 114 115

	spin_lock_irq(&bd->lock);

	if (bd->queued_cmds >= bd->max_queue)
		goto out;

	bd->queued_cmds++;
	spin_unlock_irq(&bd->lock);

116
	bc = kmem_cache_zalloc(bsg_cmd_cachep, GFP_KERNEL);
J
Jens Axboe 已提交
117 118
	if (unlikely(!bc)) {
		spin_lock_irq(&bd->lock);
119
		bd->queued_cmds--;
F
FUJITA Tomonori 已提交
120
		bc = ERR_PTR(-ENOMEM);
121
		goto out;
J
Jens Axboe 已提交
122 123
	}

124 125
	bc->bd = bd;
	INIT_LIST_HEAD(&bc->list);
J
Jens Axboe 已提交
126
	dprintk("%s: returning free cmd %p\n", bd->name, bc);
127 128 129 130 131 132
	return bc;
out:
	spin_unlock_irq(&bd->lock);
	return bc;
}

F
FUJITA Tomonori 已提交
133
static inline struct hlist_head *bsg_dev_idx_hash(int index)
134
{
F
FUJITA Tomonori 已提交
135
	return &bsg_device_list[index & (BSG_LIST_ARRAY_SIZE - 1)];
136 137
}

138
static int bsg_io_schedule(struct bsg_device *bd)
139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162
{
	DEFINE_WAIT(wait);
	int ret = 0;

	spin_lock_irq(&bd->lock);

	BUG_ON(bd->done_cmds > bd->queued_cmds);

	/*
	 * -ENOSPC or -ENODATA?  I'm going for -ENODATA, meaning "I have no
	 * work to do", even though we return -ENOSPC after this same test
	 * during bsg_write() -- there, it means our buffer can't have more
	 * bsg_commands added to it, thus has no space left.
	 */
	if (bd->done_cmds == bd->queued_cmds) {
		ret = -ENODATA;
		goto unlock;
	}

	if (!test_bit(BSG_F_BLOCK, &bd->flags)) {
		ret = -EAGAIN;
		goto unlock;
	}

163
	prepare_to_wait(&bd->wq_done, &wait, TASK_UNINTERRUPTIBLE);
164 165 166 167 168 169 170 171 172 173
	spin_unlock_irq(&bd->lock);
	io_schedule();
	finish_wait(&bd->wq_done, &wait);

	return ret;
unlock:
	spin_unlock_irq(&bd->lock);
	return ret;
}

174
static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
F
FUJITA Tomonori 已提交
175 176
				struct sg_io_v4 *hdr, int has_write_perm)
{
177 178 179 180 181
	if (hdr->request_len > BLK_MAX_CDB) {
		rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
		if (!rq->cmd)
			return -ENOMEM;
	}
F
FUJITA Tomonori 已提交
182 183 184 185

	if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
			   hdr->request_len))
		return -EFAULT;
186 187 188 189 190

	if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
		if (blk_verify_command(rq->cmd, has_write_perm))
			return -EPERM;
	} else if (!capable(CAP_SYS_RAWIO))
F
FUJITA Tomonori 已提交
191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207
		return -EPERM;

	/*
	 * fill in request structure
	 */
	rq->cmd_len = hdr->request_len;
	rq->cmd_type = REQ_TYPE_BLOCK_PC;

	rq->timeout = (hdr->timeout * HZ) / 1000;
	if (!rq->timeout)
		rq->timeout = q->sg_timeout;
	if (!rq->timeout)
		rq->timeout = BLK_DEFAULT_SG_TIMEOUT;

	return 0;
}

208
/*
F
FUJITA Tomonori 已提交
209
 * Check if sg_io_v4 from user is allowed and valid
210 211
 */
static int
212
bsg_validate_sgv4_hdr(struct request_queue *q, struct sg_io_v4 *hdr, int *rw)
213
{
214 215
	int ret = 0;

F
FUJITA Tomonori 已提交
216
	if (hdr->guard != 'Q')
217
		return -EINVAL;
F
FUJITA Tomonori 已提交
218 219
	if (hdr->dout_xfer_len > (q->max_sectors << 9) ||
	    hdr->din_xfer_len > (q->max_sectors << 9))
220 221
		return -EIO;

222 223 224 225 226 227 228 229 230 231 232 233 234
	switch (hdr->protocol) {
	case BSG_PROTOCOL_SCSI:
		switch (hdr->subprotocol) {
		case BSG_SUB_PROTOCOL_SCSI_CMD:
		case BSG_SUB_PROTOCOL_SCSI_TRANSPORT:
			break;
		default:
			ret = -EINVAL;
		}
		break;
	default:
		ret = -EINVAL;
	}
F
FUJITA Tomonori 已提交
235 236

	*rw = hdr->dout_xfer_len ? WRITE : READ;
237
	return ret;
238 239 240
}

/*
F
FUJITA Tomonori 已提交
241
 * map sg_io_v4 to a request.
242 243
 */
static struct request *
F
FUJITA Tomonori 已提交
244
bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr)
245
{
246
	struct request_queue *q = bd->queue;
F
FUJITA Tomonori 已提交
247
	struct request *rq, *next_rq = NULL;
248
	int ret, rw;
F
FUJITA Tomonori 已提交
249 250
	unsigned int dxfer_len;
	void *dxferp = NULL;
251

F
FUJITA Tomonori 已提交
252 253 254
	dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp,
		hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp,
		hdr->din_xfer_len);
255

F
FUJITA Tomonori 已提交
256
	ret = bsg_validate_sgv4_hdr(q, hdr, &rw);
257 258 259 260 261 262 263
	if (ret)
		return ERR_PTR(ret);

	/*
	 * map scatter-gather elements seperately and string them to request
	 */
	rq = blk_get_request(q, rw, GFP_KERNEL);
F
FUJITA Tomonori 已提交
264 265
	if (!rq)
		return ERR_PTR(-ENOMEM);
F
FUJITA Tomonori 已提交
266 267
	ret = blk_fill_sgv4_hdr_rq(q, rq, hdr, test_bit(BSG_F_WRITE_PERM,
						       &bd->flags));
F
FUJITA Tomonori 已提交
268 269 270 271 272 273 274 275 276 277 278 279 280 281 282
	if (ret)
		goto out;

	if (rw == WRITE && hdr->din_xfer_len) {
		if (!test_bit(QUEUE_FLAG_BIDI, &q->queue_flags)) {
			ret = -EOPNOTSUPP;
			goto out;
		}

		next_rq = blk_get_request(q, READ, GFP_KERNEL);
		if (!next_rq) {
			ret = -ENOMEM;
			goto out;
		}
		rq->next_rq = next_rq;
283
		next_rq->cmd_type = rq->cmd_type;
F
FUJITA Tomonori 已提交
284 285 286 287 288

		dxferp = (void*)(unsigned long)hdr->din_xferp;
		ret =  blk_rq_map_user(q, next_rq, dxferp, hdr->din_xfer_len);
		if (ret)
			goto out;
289 290
	}

F
FUJITA Tomonori 已提交
291 292 293 294 295 296 297 298 299 300 301
	if (hdr->dout_xfer_len) {
		dxfer_len = hdr->dout_xfer_len;
		dxferp = (void*)(unsigned long)hdr->dout_xferp;
	} else if (hdr->din_xfer_len) {
		dxfer_len = hdr->din_xfer_len;
		dxferp = (void*)(unsigned long)hdr->din_xferp;
	} else
		dxfer_len = 0;

	if (dxfer_len) {
		ret = blk_rq_map_user(q, rq, dxferp, dxfer_len);
F
FUJITA Tomonori 已提交
302 303
		if (ret)
			goto out;
304 305
	}
	return rq;
F
FUJITA Tomonori 已提交
306
out:
307 308
	if (rq->cmd != rq->__cmd)
		kfree(rq->cmd);
F
FUJITA Tomonori 已提交
309 310 311 312 313 314
	blk_put_request(rq);
	if (next_rq) {
		blk_rq_unmap_user(next_rq->bio);
		blk_put_request(next_rq);
	}
	return ERR_PTR(ret);
315 316 317 318 319 320 321 322 323 324 325 326
}

/*
 * async completion call-back from the block layer, when scsi/ide/whatever
 * calls end_that_request_last() on a request
 */
static void bsg_rq_end_io(struct request *rq, int uptodate)
{
	struct bsg_command *bc = rq->end_io_data;
	struct bsg_device *bd = bc->bd;
	unsigned long flags;

J
Jens Axboe 已提交
327 328
	dprintk("%s: finished rq %p bc %p, bio %p stat %d\n",
		bd->name, rq, bc, bc->bio, uptodate);
329 330 331 332

	bc->hdr.duration = jiffies_to_msecs(jiffies - bc->hdr.duration);

	spin_lock_irqsave(&bd->lock, flags);
333 334
	list_move_tail(&bc->list, &bd->done_list);
	bd->done_cmds++;
335
	spin_unlock_irqrestore(&bd->lock, flags);
336 337

	wake_up(&bd->wq_done);
338 339 340 341 342 343
}

/*
 * do final setup of a 'bc' and submit the matching 'rq' to the block
 * layer for io
 */
344
static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
345 346 347 348 349 350 351 352 353 354
			    struct bsg_command *bc, struct request *rq)
{
	rq->sense = bc->sense;
	rq->sense_len = 0;

	/*
	 * add bc command to busy queue and submit rq for io
	 */
	bc->rq = rq;
	bc->bio = rq->bio;
F
FUJITA Tomonori 已提交
355 356
	if (rq->next_rq)
		bc->bidi_bio = rq->next_rq->bio;
357 358 359 360 361 362 363 364
	bc->hdr.duration = jiffies;
	spin_lock_irq(&bd->lock);
	list_add_tail(&bc->list, &bd->busy_list);
	spin_unlock_irq(&bd->lock);

	dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc);

	rq->end_io_data = bc;
365
	blk_execute_rq_nowait(q, NULL, rq, 1, bsg_rq_end_io);
366 367
}

368
static struct bsg_command *bsg_next_done_cmd(struct bsg_device *bd)
369 370 371 372 373
{
	struct bsg_command *bc = NULL;

	spin_lock_irq(&bd->lock);
	if (bd->done_cmds) {
374
		bc = list_first_entry(&bd->done_list, struct bsg_command, list);
375 376
		list_del(&bc->list);
		bd->done_cmds--;
377 378 379 380 381 382 383 384 385
	}
	spin_unlock_irq(&bd->lock);

	return bc;
}

/*
 * Get a finished command from the done list
 */
F
FUJITA Tomonori 已提交
386
static struct bsg_command *bsg_get_done_cmd(struct bsg_device *bd)
387 388 389 390 391 392 393 394 395
{
	struct bsg_command *bc;
	int ret;

	do {
		bc = bsg_next_done_cmd(bd);
		if (bc)
			break;

F
FUJITA Tomonori 已提交
396 397 398 399 400 401
		if (!test_bit(BSG_F_BLOCK, &bd->flags)) {
			bc = ERR_PTR(-EAGAIN);
			break;
		}

		ret = wait_event_interruptible(bd->wq_done, bd->done_cmds);
402
		if (ret) {
F
FUJITA Tomonori 已提交
403
			bc = ERR_PTR(-ERESTARTSYS);
404 405 406 407 408 409 410 411 412
			break;
		}
	} while (1);

	dprintk("%s: returning done %p\n", bd->name, bc);

	return bc;
}

F
FUJITA Tomonori 已提交
413
static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
F
FUJITA Tomonori 已提交
414
				    struct bio *bio, struct bio *bidi_bio)
F
FUJITA Tomonori 已提交
415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430
{
	int ret = 0;

	dprintk("rq %p bio %p %u\n", rq, bio, rq->errors);
	/*
	 * fill in all the output members
	 */
	hdr->device_status = status_byte(rq->errors);
	hdr->transport_status = host_byte(rq->errors);
	hdr->driver_status = driver_byte(rq->errors);
	hdr->info = 0;
	if (hdr->device_status || hdr->transport_status || hdr->driver_status)
		hdr->info |= SG_INFO_CHECK;
	hdr->response_len = 0;

	if (rq->sense_len && hdr->response) {
431 432
		int len = min_t(unsigned int, hdr->max_response_len,
					rq->sense_len);
F
FUJITA Tomonori 已提交
433 434 435 436 437 438 439 440 441

		ret = copy_to_user((void*)(unsigned long)hdr->response,
				   rq->sense, len);
		if (!ret)
			hdr->response_len = len;
		else
			ret = -EFAULT;
	}

F
FUJITA Tomonori 已提交
442
	if (rq->next_rq) {
443 444
		hdr->dout_resid = rq->data_len;
		hdr->din_resid = rq->next_rq->data_len;
F
FUJITA Tomonori 已提交
445 446
		blk_rq_unmap_user(bidi_bio);
		blk_put_request(rq->next_rq);
447
	} else if (rq_data_dir(rq) == READ)
448
		hdr->din_resid = rq->data_len;
449
	else
450
		hdr->dout_resid = rq->data_len;
F
FUJITA Tomonori 已提交
451

452 453 454 455 456 457 458 459 460
	/*
	 * If the request generated a negative error number, return it
	 * (providing we aren't already returning an error); if it's
	 * just a protocol response (i.e. non negative), that gets
	 * processed above.
	 */
	if (!ret && rq->errors < 0)
		ret = rq->errors;

F
FUJITA Tomonori 已提交
461
	blk_rq_unmap_user(bio);
462 463
	if (rq->cmd != rq->__cmd)
		kfree(rq->cmd);
F
FUJITA Tomonori 已提交
464 465 466 467 468
	blk_put_request(rq);

	return ret;
}

469 470 471 472 473 474 475 476 477 478 479 480
static int bsg_complete_all_commands(struct bsg_device *bd)
{
	struct bsg_command *bc;
	int ret, tret;

	dprintk("%s: entered\n", bd->name);

	/*
	 * wait for all commands to complete
	 */
	ret = 0;
	do {
481
		ret = bsg_io_schedule(bd);
482 483 484 485 486 487 488 489 490 491 492 493 494 495
		/*
		 * look for -ENODATA specifically -- we'll sometimes get
		 * -ERESTARTSYS when we've taken a signal, but we can't
		 * return until we're done freeing the queue, so ignore
		 * it.  The signal will get handled when we're done freeing
		 * the bsg_device.
		 */
	} while (ret != -ENODATA);

	/*
	 * discard done commands
	 */
	ret = 0;
	do {
F
FUJITA Tomonori 已提交
496 497 498
		spin_lock_irq(&bd->lock);
		if (!bd->queued_cmds) {
			spin_unlock_irq(&bd->lock);
499 500
			break;
		}
501
		spin_unlock_irq(&bd->lock);
502

F
FUJITA Tomonori 已提交
503 504 505 506
		bc = bsg_get_done_cmd(bd);
		if (IS_ERR(bc))
			break;

F
FUJITA Tomonori 已提交
507 508
		tret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio,
						bc->bidi_bio);
509 510 511 512 513 514 515 516 517
		if (!ret)
			ret = tret;

		bsg_free_command(bc);
	} while (1);

	return ret;
}

518
static int
F
FUJITA Tomonori 已提交
519 520
__bsg_read(char __user *buf, size_t count, struct bsg_device *bd,
	   const struct iovec *iov, ssize_t *bytes_read)
521 522 523 524
{
	struct bsg_command *bc;
	int nr_commands, ret;

F
FUJITA Tomonori 已提交
525
	if (count % sizeof(struct sg_io_v4))
526 527 528
		return -EINVAL;

	ret = 0;
F
FUJITA Tomonori 已提交
529
	nr_commands = count / sizeof(struct sg_io_v4);
530
	while (nr_commands) {
F
FUJITA Tomonori 已提交
531
		bc = bsg_get_done_cmd(bd);
532 533 534 535 536 537 538 539 540 541
		if (IS_ERR(bc)) {
			ret = PTR_ERR(bc);
			break;
		}

		/*
		 * this is the only case where we need to copy data back
		 * after completing the request. so do that here,
		 * bsg_complete_work() cannot do that for us
		 */
F
FUJITA Tomonori 已提交
542 543
		ret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio,
					       bc->bidi_bio);
544

545
		if (copy_to_user(buf, &bc->hdr, sizeof(bc->hdr)))
546 547 548 549 550 551 552
			ret = -EFAULT;

		bsg_free_command(bc);

		if (ret)
			break;

F
FUJITA Tomonori 已提交
553 554
		buf += sizeof(struct sg_io_v4);
		*bytes_read += sizeof(struct sg_io_v4);
555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576
		nr_commands--;
	}

	return ret;
}

static inline void bsg_set_block(struct bsg_device *bd, struct file *file)
{
	if (file->f_flags & O_NONBLOCK)
		clear_bit(BSG_F_BLOCK, &bd->flags);
	else
		set_bit(BSG_F_BLOCK, &bd->flags);
}

static inline void bsg_set_write_perm(struct bsg_device *bd, struct file *file)
{
	if (file->f_mode & FMODE_WRITE)
		set_bit(BSG_F_WRITE_PERM, &bd->flags);
	else
		clear_bit(BSG_F_WRITE_PERM, &bd->flags);
}

577 578 579
/*
 * Check if the error is a "real" error that we should return.
 */
580 581 582 583 584 585 586 587 588 589 590 591 592 593 594
static inline int err_block_err(int ret)
{
	if (ret && ret != -ENOSPC && ret != -ENODATA && ret != -EAGAIN)
		return 1;

	return 0;
}

static ssize_t
bsg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
{
	struct bsg_device *bd = file->private_data;
	int ret;
	ssize_t bytes_read;

F
FUJITA Tomonori 已提交
595
	dprintk("%s: read %Zd bytes\n", bd->name, count);
596 597 598

	bsg_set_block(bd, file);
	bytes_read = 0;
F
FUJITA Tomonori 已提交
599
	ret = __bsg_read(buf, count, bd, NULL, &bytes_read);
600 601 602 603 604 605 606 607
	*ppos = bytes_read;

	if (!bytes_read || (bytes_read && err_block_err(ret)))
		bytes_read = ret;

	return bytes_read;
}

608 609
static int __bsg_write(struct bsg_device *bd, const char __user *buf,
		       size_t count, ssize_t *bytes_written)
610 611 612 613 614
{
	struct bsg_command *bc;
	struct request *rq;
	int ret, nr_commands;

F
FUJITA Tomonori 已提交
615
	if (count % sizeof(struct sg_io_v4))
616 617
		return -EINVAL;

F
FUJITA Tomonori 已提交
618
	nr_commands = count / sizeof(struct sg_io_v4);
619 620 621 622
	rq = NULL;
	bc = NULL;
	ret = 0;
	while (nr_commands) {
623
		struct request_queue *q = bd->queue;
624

F
FUJITA Tomonori 已提交
625
		bc = bsg_alloc_command(bd);
626 627 628 629 630 631 632 633 634 635 636 637 638 639
		if (IS_ERR(bc)) {
			ret = PTR_ERR(bc);
			bc = NULL;
			break;
		}

		if (copy_from_user(&bc->hdr, buf, sizeof(bc->hdr))) {
			ret = -EFAULT;
			break;
		}

		/*
		 * get a request, fill in the blanks, and add to request queue
		 */
F
FUJITA Tomonori 已提交
640
		rq = bsg_map_hdr(bd, &bc->hdr);
641 642 643 644 645 646 647 648 649 650
		if (IS_ERR(rq)) {
			ret = PTR_ERR(rq);
			rq = NULL;
			break;
		}

		bsg_add_command(bd, q, bc, rq);
		bc = NULL;
		rq = NULL;
		nr_commands--;
F
FUJITA Tomonori 已提交
651
		buf += sizeof(struct sg_io_v4);
652
		*bytes_written += sizeof(struct sg_io_v4);
653 654 655 656 657 658 659 660 661 662 663 664
	}

	if (bc)
		bsg_free_command(bc);

	return ret;
}

static ssize_t
bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
{
	struct bsg_device *bd = file->private_data;
665
	ssize_t bytes_written;
666 667
	int ret;

F
FUJITA Tomonori 已提交
668
	dprintk("%s: write %Zd bytes\n", bd->name, count);
669 670 671 672

	bsg_set_block(bd, file);
	bsg_set_write_perm(bd, file);

673 674 675
	bytes_written = 0;
	ret = __bsg_write(bd, buf, count, &bytes_written);
	*ppos = bytes_written;
676 677 678 679

	/*
	 * return bytes written on non-fatal errors
	 */
680 681
	if (!bytes_written || (bytes_written && err_block_err(ret)))
		bytes_written = ret;
682

683 684
	dprintk("%s: returning %Zd\n", bd->name, bytes_written);
	return bytes_written;
685 686 687 688 689 690 691 692 693 694 695 696
}

static struct bsg_device *bsg_alloc_device(void)
{
	struct bsg_device *bd;

	bd = kzalloc(sizeof(struct bsg_device), GFP_KERNEL);
	if (unlikely(!bd))
		return NULL;

	spin_lock_init(&bd->lock);

J
Jens Axboe 已提交
697
	bd->max_queue = BSG_DEFAULT_CMDS;
698 699 700 701 702 703 704 705 706 707

	INIT_LIST_HEAD(&bd->busy_list);
	INIT_LIST_HEAD(&bd->done_list);
	INIT_HLIST_NODE(&bd->dev_list);

	init_waitqueue_head(&bd->wq_free);
	init_waitqueue_head(&bd->wq_done);
	return bd;
}

708 709 710 711 712 713 714 715 716 717 718
static void bsg_kref_release_function(struct kref *kref)
{
	struct bsg_class_device *bcd =
		container_of(kref, struct bsg_class_device, ref);

	if (bcd->release)
		bcd->release(bcd->parent);

	put_device(bcd->parent);
}

719 720
static int bsg_put_device(struct bsg_device *bd)
{
721 722
	int ret = 0, do_free;
	struct request_queue *q = bd->queue;
723 724 725

	mutex_lock(&bsg_mutex);

726 727
	do_free = atomic_dec_and_test(&bd->ref_count);
	if (!do_free)
728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744
		goto out;

	dprintk("%s: tearing down\n", bd->name);

	/*
	 * close can always block
	 */
	set_bit(BSG_F_BLOCK, &bd->flags);

	/*
	 * correct error detection baddies here again. it's the responsibility
	 * of the app to properly reap commands before close() if it wants
	 * fool-proof error detection
	 */
	ret = bsg_complete_all_commands(bd);

	hlist_del(&bd->dev_list);
J
Jens Axboe 已提交
745
	kfree(bd);
746 747
out:
	mutex_unlock(&bsg_mutex);
748 749 750
	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
	if (do_free)
		blk_put_queue(q);
751 752 753 754
	return ret;
}

static struct bsg_device *bsg_add_device(struct inode *inode,
755
					 struct request_queue *rq,
756 757
					 struct file *file)
{
758
	struct bsg_device *bd;
759
	int ret;
760 761 762
#ifdef BSG_DEBUG
	unsigned char buf[32];
#endif
763 764 765
	ret = blk_get_queue(rq);
	if (ret)
		return ERR_PTR(-ENXIO);
766 767

	bd = bsg_alloc_device();
768 769
	if (!bd) {
		blk_put_queue(rq);
770
		return ERR_PTR(-ENOMEM);
771
	}
772

773
	bd->queue = rq;
774 775 776 777
	bsg_set_block(bd, file);

	atomic_set(&bd->ref_count, 1);
	mutex_lock(&bsg_mutex);
778
	hlist_add_head(&bd->dev_list, bsg_dev_idx_hash(iminor(inode)));
779

780
	strncpy(bd->name, rq->bsg_dev.class_dev->bus_id, sizeof(bd->name) - 1);
781
	dprintk("bound to <%s>, max queue %d\n",
F
FUJITA Tomonori 已提交
782
		format_dev_t(buf, inode->i_rdev), bd->max_queue);
783 784 785 786 787

	mutex_unlock(&bsg_mutex);
	return bd;
}

788
static struct bsg_device *__bsg_get_device(int minor, struct request_queue *q)
789
{
790
	struct bsg_device *bd;
791 792 793 794
	struct hlist_node *entry;

	mutex_lock(&bsg_mutex);

795
	hlist_for_each_entry(bd, entry, bsg_dev_idx_hash(minor), dev_list) {
796
		if (bd->queue == q) {
797
			atomic_inc(&bd->ref_count);
798
			goto found;
799 800
		}
	}
801 802
	bd = NULL;
found:
803 804 805 806 807 808
	mutex_unlock(&bsg_mutex);
	return bd;
}

static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
{
809 810
	struct bsg_device *bd;
	struct bsg_class_device *bcd;
811 812 813 814 815

	/*
	 * find the class device
	 */
	mutex_lock(&bsg_mutex);
816
	bcd = idr_find(&bsg_minor_idr, iminor(inode));
817
	if (bcd)
818
		kref_get(&bcd->ref);
819 820 821 822 823
	mutex_unlock(&bsg_mutex);

	if (!bcd)
		return ERR_PTR(-ENODEV);

824
	bd = __bsg_get_device(iminor(inode), bcd->queue);
825 826 827 828 829
	if (bd)
		return bd;

	bd = bsg_add_device(inode, bcd->queue, file);
	if (IS_ERR(bd))
830
		kref_put(&bcd->ref, bsg_kref_release_function);
831 832

	return bd;
833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871
}

static int bsg_open(struct inode *inode, struct file *file)
{
	struct bsg_device *bd = bsg_get_device(inode, file);

	if (IS_ERR(bd))
		return PTR_ERR(bd);

	file->private_data = bd;
	return 0;
}

static int bsg_release(struct inode *inode, struct file *file)
{
	struct bsg_device *bd = file->private_data;

	file->private_data = NULL;
	return bsg_put_device(bd);
}

static unsigned int bsg_poll(struct file *file, poll_table *wait)
{
	struct bsg_device *bd = file->private_data;
	unsigned int mask = 0;

	poll_wait(file, &bd->wq_done, wait);
	poll_wait(file, &bd->wq_free, wait);

	spin_lock_irq(&bd->lock);
	if (!list_empty(&bd->done_list))
		mask |= POLLIN | POLLRDNORM;
	if (bd->queued_cmds >= bd->max_queue)
		mask |= POLLOUT;
	spin_unlock_irq(&bd->lock);

	return mask;
}

872
static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
873 874 875
{
	struct bsg_device *bd = file->private_data;
	int __user *uarg = (int __user *) arg;
876
	int ret;
877 878 879 880 881 882 883

	switch (cmd) {
		/*
		 * our own ioctls
		 */
	case SG_GET_COMMAND_Q:
		return put_user(bd->max_queue, uarg);
J
Jens Axboe 已提交
884
	case SG_SET_COMMAND_Q: {
885 886 887 888
		int queue;

		if (get_user(queue, uarg))
			return -EFAULT;
J
Jens Axboe 已提交
889
		if (queue < 1)
890 891
			return -EINVAL;

J
Jens Axboe 已提交
892
		spin_lock_irq(&bd->lock);
893
		bd->max_queue = queue;
J
Jens Axboe 已提交
894
		spin_unlock_irq(&bd->lock);
895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910
		return 0;
	}

	/*
	 * SCSI/sg ioctls
	 */
	case SG_GET_VERSION_NUM:
	case SCSI_IOCTL_GET_IDLUN:
	case SCSI_IOCTL_GET_BUS_NUMBER:
	case SG_SET_TIMEOUT:
	case SG_GET_TIMEOUT:
	case SG_GET_RESERVED_SIZE:
	case SG_SET_RESERVED_SIZE:
	case SG_EMULATED_HOST:
	case SCSI_IOCTL_SEND_COMMAND: {
		void __user *uarg = (void __user *) arg;
911
		return scsi_cmd_ioctl(file, bd->queue, NULL, cmd, uarg);
912
	}
F
FUJITA Tomonori 已提交
913 914
	case SG_IO: {
		struct request *rq;
F
FUJITA Tomonori 已提交
915
		struct bio *bio, *bidi_bio = NULL;
F
FUJITA Tomonori 已提交
916 917 918 919 920 921 922 923 924 925
		struct sg_io_v4 hdr;

		if (copy_from_user(&hdr, uarg, sizeof(hdr)))
			return -EFAULT;

		rq = bsg_map_hdr(bd, &hdr);
		if (IS_ERR(rq))
			return PTR_ERR(rq);

		bio = rq->bio;
F
FUJITA Tomonori 已提交
926 927
		if (rq->next_rq)
			bidi_bio = rq->next_rq->bio;
928
		blk_execute_rq(bd->queue, NULL, rq, 0);
929
		ret = blk_complete_sgv4_hdr_rq(rq, &hdr, bio, bidi_bio);
F
FUJITA Tomonori 已提交
930 931 932

		if (copy_to_user(uarg, &hdr, sizeof(hdr)))
			return -EFAULT;
J
Jens Axboe 已提交
933

934
		return ret;
F
FUJITA Tomonori 已提交
935
	}
936 937 938 939 940 941 942 943 944 945 946 947
	/*
	 * block device ioctls
	 */
	default:
#if 0
		return ioctl_by_bdev(bd->bdev, cmd, arg);
#else
		return -ENOTTY;
#endif
	}
}

948
static const struct file_operations bsg_fops = {
949 950 951 952 953
	.read		=	bsg_read,
	.write		=	bsg_write,
	.poll		=	bsg_poll,
	.open		=	bsg_open,
	.release	=	bsg_release,
954
	.unlocked_ioctl	=	bsg_ioctl,
955 956 957
	.owner		=	THIS_MODULE,
};

958
void bsg_unregister_queue(struct request_queue *q)
959
{
960
	struct bsg_class_device *bcd = &q->bsg_dev;
961

962 963
	if (!bcd->class_dev)
		return;
964 965

	mutex_lock(&bsg_mutex);
966
	idr_remove(&bsg_minor_idr, bcd->minor);
967
	sysfs_remove_link(&q->kobj, "bsg");
968
	device_unregister(bcd->class_dev);
969
	bcd->class_dev = NULL;
970
	kref_put(&bcd->ref, bsg_kref_release_function);
971 972
	mutex_unlock(&bsg_mutex);
}
F
FUJITA Tomonori 已提交
973
EXPORT_SYMBOL_GPL(bsg_unregister_queue);
974

975 976
int bsg_register_queue(struct request_queue *q, struct device *parent,
		       const char *name, void (*release)(struct device *))
977
{
978
	struct bsg_class_device *bcd;
979
	dev_t dev;
980
	int ret, minor;
981
	struct device *class_dev = NULL;
982 983 984 985 986
	const char *devname;

	if (name)
		devname = name;
	else
987
		devname = parent->bus_id;
988 989 990 991 992 993 994

	/*
	 * we need a proper transport to send commands, not a stacked device
	 */
	if (!q->request_fn)
		return 0;

995
	bcd = &q->bsg_dev;
996 997 998
	memset(bcd, 0, sizeof(*bcd));

	mutex_lock(&bsg_mutex);
F
FUJITA Tomonori 已提交
999

1000 1001 1002 1003
	ret = idr_pre_get(&bsg_minor_idr, GFP_KERNEL);
	if (!ret) {
		ret = -ENOMEM;
		goto unlock;
F
FUJITA Tomonori 已提交
1004 1005
	}

1006 1007 1008
	ret = idr_get_new(&bsg_minor_idr, bcd, &minor);
	if (ret < 0)
		goto unlock;
F
FUJITA Tomonori 已提交
1009

1010 1011 1012 1013 1014 1015 1016
	if (minor >= BSG_MAX_DEVS) {
		printk(KERN_ERR "bsg: too many bsg devices\n");
		ret = -EINVAL;
		goto remove_idr;
	}

	bcd->minor = minor;
1017
	bcd->queue = q;
1018 1019 1020
	bcd->parent = get_device(parent);
	bcd->release = release;
	kref_init(&bcd->ref);
J
Jens Axboe 已提交
1021
	dev = MKDEV(bsg_major, bcd->minor);
1022
	class_dev = device_create(bsg_class, parent, dev, "%s", devname);
F
FUJITA Tomonori 已提交
1023 1024
	if (IS_ERR(class_dev)) {
		ret = PTR_ERR(class_dev);
1025
		goto put_dev;
F
FUJITA Tomonori 已提交
1026 1027 1028
	}
	bcd->class_dev = class_dev;

1029
	if (q->kobj.sd) {
F
FUJITA Tomonori 已提交
1030 1031
		ret = sysfs_create_link(&q->kobj, &bcd->class_dev->kobj, "bsg");
		if (ret)
1032
			goto unregister_class_dev;
F
FUJITA Tomonori 已提交
1033 1034
	}

1035 1036
	mutex_unlock(&bsg_mutex);
	return 0;
1037

1038
unregister_class_dev:
1039
	device_unregister(class_dev);
1040
put_dev:
1041
	put_device(parent);
1042 1043 1044
remove_idr:
	idr_remove(&bsg_minor_idr, minor);
unlock:
1045
	mutex_unlock(&bsg_mutex);
F
FUJITA Tomonori 已提交
1046 1047
	return ret;
}
F
FUJITA Tomonori 已提交
1048
EXPORT_SYMBOL_GPL(bsg_register_queue);
F
FUJITA Tomonori 已提交
1049

1050
static struct cdev bsg_cdev;
F
FUJITA Tomonori 已提交
1051

1052 1053 1054
static int __init bsg_init(void)
{
	int ret, i;
J
Jens Axboe 已提交
1055
	dev_t devid;
1056

J
Jens Axboe 已提交
1057
	bsg_cmd_cachep = kmem_cache_create("bsg_cmd",
1058
				sizeof(struct bsg_command), 0, 0, NULL);
J
Jens Axboe 已提交
1059 1060 1061 1062 1063
	if (!bsg_cmd_cachep) {
		printk(KERN_ERR "bsg: failed creating slab cache\n");
		return -ENOMEM;
	}

1064
	for (i = 0; i < BSG_LIST_ARRAY_SIZE; i++)
1065 1066 1067
		INIT_HLIST_HEAD(&bsg_device_list[i]);

	bsg_class = class_create(THIS_MODULE, "bsg");
J
Jens Axboe 已提交
1068
	if (IS_ERR(bsg_class)) {
1069 1070
		ret = PTR_ERR(bsg_class);
		goto destroy_kmemcache;
J
Jens Axboe 已提交
1071
	}
1072

J
Jens Axboe 已提交
1073
	ret = alloc_chrdev_region(&devid, 0, BSG_MAX_DEVS, "bsg");
1074 1075
	if (ret)
		goto destroy_bsg_class;
F
FUJITA Tomonori 已提交
1076

J
Jens Axboe 已提交
1077 1078
	bsg_major = MAJOR(devid);

F
FUJITA Tomonori 已提交
1079
	cdev_init(&bsg_cdev, &bsg_fops);
J
Jens Axboe 已提交
1080
	ret = cdev_add(&bsg_cdev, MKDEV(bsg_major, 0), BSG_MAX_DEVS);
1081 1082
	if (ret)
		goto unregister_chrdev;
1083

1084
	printk(KERN_INFO BSG_DESCRIPTION " version " BSG_VERSION
F
FUJITA Tomonori 已提交
1085
	       " loaded (major %d)\n", bsg_major);
1086
	return 0;
1087 1088 1089 1090 1091 1092 1093
unregister_chrdev:
	unregister_chrdev_region(MKDEV(bsg_major, 0), BSG_MAX_DEVS);
destroy_bsg_class:
	class_destroy(bsg_class);
destroy_kmemcache:
	kmem_cache_destroy(bsg_cmd_cachep);
	return ret;
1094 1095 1096
}

MODULE_AUTHOR("Jens Axboe");
F
FUJITA Tomonori 已提交
1097
MODULE_DESCRIPTION(BSG_DESCRIPTION);
1098 1099
MODULE_LICENSE("GPL");

F
FUJITA Tomonori 已提交
1100
device_initcall(bsg_init);