Back to home page

LXR

 
 

    


0001 /*
0002  * bsg.c - block layer implementation of the sg v4 interface
0003  *
0004  * Copyright (C) 2004 Jens Axboe <axboe@suse.de> SUSE Labs
0005  * Copyright (C) 2004 Peter M. Jones <pjones@redhat.com>
0006  *
0007  *  This file is subject to the terms and conditions of the GNU General Public
0008  *  License version 2.  See the file "COPYING" in the main directory of this
0009  *  archive for more details.
0010  *
0011  */
0012 #include <linux/module.h>
0013 #include <linux/init.h>
0014 #include <linux/file.h>
0015 #include <linux/blkdev.h>
0016 #include <linux/poll.h>
0017 #include <linux/cdev.h>
0018 #include <linux/jiffies.h>
0019 #include <linux/percpu.h>
0020 #include <linux/uio.h>
0021 #include <linux/idr.h>
0022 #include <linux/bsg.h>
0023 #include <linux/slab.h>
0024 
0025 #include <scsi/scsi.h>
0026 #include <scsi/scsi_ioctl.h>
0027 #include <scsi/scsi_cmnd.h>
0028 #include <scsi/scsi_device.h>
0029 #include <scsi/scsi_driver.h>
0030 #include <scsi/sg.h>
0031 
0032 #define BSG_DESCRIPTION "Block layer SCSI generic (bsg) driver"
0033 #define BSG_VERSION "0.4"
0034 
0035 struct bsg_device {
0036     struct request_queue *queue;
0037     spinlock_t lock;
0038     struct list_head busy_list;
0039     struct list_head done_list;
0040     struct hlist_node dev_list;
0041     atomic_t ref_count;
0042     int queued_cmds;
0043     int done_cmds;
0044     wait_queue_head_t wq_done;
0045     wait_queue_head_t wq_free;
0046     char name[20];
0047     int max_queue;
0048     unsigned long flags;
0049 };
0050 
0051 enum {
0052     BSG_F_BLOCK     = 1,
0053 };
0054 
0055 #define BSG_DEFAULT_CMDS    64
0056 #define BSG_MAX_DEVS        32768
0057 
0058 #undef BSG_DEBUG
0059 
0060 #ifdef BSG_DEBUG
0061 #define dprintk(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ##args)
0062 #else
0063 #define dprintk(fmt, args...)
0064 #endif
0065 
0066 static DEFINE_MUTEX(bsg_mutex);
0067 static DEFINE_IDR(bsg_minor_idr);
0068 
0069 #define BSG_LIST_ARRAY_SIZE 8
0070 static struct hlist_head bsg_device_list[BSG_LIST_ARRAY_SIZE];
0071 
0072 static struct class *bsg_class;
0073 static int bsg_major;
0074 
0075 static struct kmem_cache *bsg_cmd_cachep;
0076 
0077 /*
0078  * our internal command type
0079  */
0080 struct bsg_command {
0081     struct bsg_device *bd;
0082     struct list_head list;
0083     struct request *rq;
0084     struct bio *bio;
0085     struct bio *bidi_bio;
0086     int err;
0087     struct sg_io_v4 hdr;
0088     char sense[SCSI_SENSE_BUFFERSIZE];
0089 };
0090 
0091 static void bsg_free_command(struct bsg_command *bc)
0092 {
0093     struct bsg_device *bd = bc->bd;
0094     unsigned long flags;
0095 
0096     kmem_cache_free(bsg_cmd_cachep, bc);
0097 
0098     spin_lock_irqsave(&bd->lock, flags);
0099     bd->queued_cmds--;
0100     spin_unlock_irqrestore(&bd->lock, flags);
0101 
0102     wake_up(&bd->wq_free);
0103 }
0104 
0105 static struct bsg_command *bsg_alloc_command(struct bsg_device *bd)
0106 {
0107     struct bsg_command *bc = ERR_PTR(-EINVAL);
0108 
0109     spin_lock_irq(&bd->lock);
0110 
0111     if (bd->queued_cmds >= bd->max_queue)
0112         goto out;
0113 
0114     bd->queued_cmds++;
0115     spin_unlock_irq(&bd->lock);
0116 
0117     bc = kmem_cache_zalloc(bsg_cmd_cachep, GFP_KERNEL);
0118     if (unlikely(!bc)) {
0119         spin_lock_irq(&bd->lock);
0120         bd->queued_cmds--;
0121         bc = ERR_PTR(-ENOMEM);
0122         goto out;
0123     }
0124 
0125     bc->bd = bd;
0126     INIT_LIST_HEAD(&bc->list);
0127     dprintk("%s: returning free cmd %p\n", bd->name, bc);
0128     return bc;
0129 out:
0130     spin_unlock_irq(&bd->lock);
0131     return bc;
0132 }
0133 
0134 static inline struct hlist_head *bsg_dev_idx_hash(int index)
0135 {
0136     return &bsg_device_list[index & (BSG_LIST_ARRAY_SIZE - 1)];
0137 }
0138 
0139 static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
0140                 struct sg_io_v4 *hdr, struct bsg_device *bd,
0141                 fmode_t has_write_perm)
0142 {
0143     if (hdr->request_len > BLK_MAX_CDB) {
0144         rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
0145         if (!rq->cmd)
0146             return -ENOMEM;
0147     }
0148 
0149     if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
0150                hdr->request_len))
0151         return -EFAULT;
0152 
0153     if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
0154         if (blk_verify_command(rq->cmd, has_write_perm))
0155             return -EPERM;
0156     } else if (!capable(CAP_SYS_RAWIO))
0157         return -EPERM;
0158 
0159     /*
0160      * fill in request structure
0161      */
0162     rq->cmd_len = hdr->request_len;
0163 
0164     rq->timeout = msecs_to_jiffies(hdr->timeout);
0165     if (!rq->timeout)
0166         rq->timeout = q->sg_timeout;
0167     if (!rq->timeout)
0168         rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
0169     if (rq->timeout < BLK_MIN_SG_TIMEOUT)
0170         rq->timeout = BLK_MIN_SG_TIMEOUT;
0171 
0172     return 0;
0173 }
0174 
0175 /*
0176  * Check if sg_io_v4 from user is allowed and valid
0177  */
0178 static int
0179 bsg_validate_sgv4_hdr(struct sg_io_v4 *hdr, int *rw)
0180 {
0181     int ret = 0;
0182 
0183     if (hdr->guard != 'Q')
0184         return -EINVAL;
0185 
0186     switch (hdr->protocol) {
0187     case BSG_PROTOCOL_SCSI:
0188         switch (hdr->subprotocol) {
0189         case BSG_SUB_PROTOCOL_SCSI_CMD:
0190         case BSG_SUB_PROTOCOL_SCSI_TRANSPORT:
0191             break;
0192         default:
0193             ret = -EINVAL;
0194         }
0195         break;
0196     default:
0197         ret = -EINVAL;
0198     }
0199 
0200     *rw = hdr->dout_xfer_len ? WRITE : READ;
0201     return ret;
0202 }
0203 
0204 /*
0205  * map sg_io_v4 to a request.
0206  */
0207 static struct request *
0208 bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
0209         u8 *sense)
0210 {
0211     struct request_queue *q = bd->queue;
0212     struct request *rq, *next_rq = NULL;
0213     int ret, rw;
0214     unsigned int dxfer_len;
0215     void __user *dxferp = NULL;
0216     struct bsg_class_device *bcd = &q->bsg_dev;
0217 
0218     /* if the LLD has been removed then the bsg_unregister_queue will
0219      * eventually be called and the class_dev was freed, so we can no
0220      * longer use this request_queue. Return no such address.
0221      */
0222     if (!bcd->class_dev)
0223         return ERR_PTR(-ENXIO);
0224 
0225     dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp,
0226         hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp,
0227         hdr->din_xfer_len);
0228 
0229     ret = bsg_validate_sgv4_hdr(hdr, &rw);
0230     if (ret)
0231         return ERR_PTR(ret);
0232 
0233     /*
0234      * map scatter-gather elements separately and string them to request
0235      */
0236     rq = blk_get_request(q, rw, GFP_KERNEL);
0237     if (IS_ERR(rq))
0238         return rq;
0239     blk_rq_set_block_pc(rq);
0240 
0241     ret = blk_fill_sgv4_hdr_rq(q, rq, hdr, bd, has_write_perm);
0242     if (ret)
0243         goto out;
0244 
0245     if (rw == WRITE && hdr->din_xfer_len) {
0246         if (!test_bit(QUEUE_FLAG_BIDI, &q->queue_flags)) {
0247             ret = -EOPNOTSUPP;
0248             goto out;
0249         }
0250 
0251         next_rq = blk_get_request(q, READ, GFP_KERNEL);
0252         if (IS_ERR(next_rq)) {
0253             ret = PTR_ERR(next_rq);
0254             next_rq = NULL;
0255             goto out;
0256         }
0257         rq->next_rq = next_rq;
0258         next_rq->cmd_type = rq->cmd_type;
0259 
0260         dxferp = (void __user *)(unsigned long)hdr->din_xferp;
0261         ret =  blk_rq_map_user(q, next_rq, NULL, dxferp,
0262                        hdr->din_xfer_len, GFP_KERNEL);
0263         if (ret)
0264             goto out;
0265     }
0266 
0267     if (hdr->dout_xfer_len) {
0268         dxfer_len = hdr->dout_xfer_len;
0269         dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
0270     } else if (hdr->din_xfer_len) {
0271         dxfer_len = hdr->din_xfer_len;
0272         dxferp = (void __user *)(unsigned long)hdr->din_xferp;
0273     } else
0274         dxfer_len = 0;
0275 
0276     if (dxfer_len) {
0277         ret = blk_rq_map_user(q, rq, NULL, dxferp, dxfer_len,
0278                       GFP_KERNEL);
0279         if (ret)
0280             goto out;
0281     }
0282 
0283     rq->sense = sense;
0284     rq->sense_len = 0;
0285 
0286     return rq;
0287 out:
0288     if (rq->cmd != rq->__cmd)
0289         kfree(rq->cmd);
0290     blk_put_request(rq);
0291     if (next_rq) {
0292         blk_rq_unmap_user(next_rq->bio);
0293         blk_put_request(next_rq);
0294     }
0295     return ERR_PTR(ret);
0296 }
0297 
0298 /*
0299  * async completion call-back from the block layer, when scsi/ide/whatever
0300  * calls end_that_request_last() on a request
0301  */
0302 static void bsg_rq_end_io(struct request *rq, int uptodate)
0303 {
0304     struct bsg_command *bc = rq->end_io_data;
0305     struct bsg_device *bd = bc->bd;
0306     unsigned long flags;
0307 
0308     dprintk("%s: finished rq %p bc %p, bio %p stat %d\n",
0309         bd->name, rq, bc, bc->bio, uptodate);
0310 
0311     bc->hdr.duration = jiffies_to_msecs(jiffies - bc->hdr.duration);
0312 
0313     spin_lock_irqsave(&bd->lock, flags);
0314     list_move_tail(&bc->list, &bd->done_list);
0315     bd->done_cmds++;
0316     spin_unlock_irqrestore(&bd->lock, flags);
0317 
0318     wake_up(&bd->wq_done);
0319 }
0320 
0321 /*
0322  * do final setup of a 'bc' and submit the matching 'rq' to the block
0323  * layer for io
0324  */
0325 static void bsg_add_command(struct bsg_device *bd, struct request_queue *q,
0326                 struct bsg_command *bc, struct request *rq)
0327 {
0328     int at_head = (0 == (bc->hdr.flags & BSG_FLAG_Q_AT_TAIL));
0329 
0330     /*
0331      * add bc command to busy queue and submit rq for io
0332      */
0333     bc->rq = rq;
0334     bc->bio = rq->bio;
0335     if (rq->next_rq)
0336         bc->bidi_bio = rq->next_rq->bio;
0337     bc->hdr.duration = jiffies;
0338     spin_lock_irq(&bd->lock);
0339     list_add_tail(&bc->list, &bd->busy_list);
0340     spin_unlock_irq(&bd->lock);
0341 
0342     dprintk("%s: queueing rq %p, bc %p\n", bd->name, rq, bc);
0343 
0344     rq->end_io_data = bc;
0345     blk_execute_rq_nowait(q, NULL, rq, at_head, bsg_rq_end_io);
0346 }
0347 
0348 static struct bsg_command *bsg_next_done_cmd(struct bsg_device *bd)
0349 {
0350     struct bsg_command *bc = NULL;
0351 
0352     spin_lock_irq(&bd->lock);
0353     if (bd->done_cmds) {
0354         bc = list_first_entry(&bd->done_list, struct bsg_command, list);
0355         list_del(&bc->list);
0356         bd->done_cmds--;
0357     }
0358     spin_unlock_irq(&bd->lock);
0359 
0360     return bc;
0361 }
0362 
0363 /*
0364  * Get a finished command from the done list
0365  */
0366 static struct bsg_command *bsg_get_done_cmd(struct bsg_device *bd)
0367 {
0368     struct bsg_command *bc;
0369     int ret;
0370 
0371     do {
0372         bc = bsg_next_done_cmd(bd);
0373         if (bc)
0374             break;
0375 
0376         if (!test_bit(BSG_F_BLOCK, &bd->flags)) {
0377             bc = ERR_PTR(-EAGAIN);
0378             break;
0379         }
0380 
0381         ret = wait_event_interruptible(bd->wq_done, bd->done_cmds);
0382         if (ret) {
0383             bc = ERR_PTR(-ERESTARTSYS);
0384             break;
0385         }
0386     } while (1);
0387 
0388     dprintk("%s: returning done %p\n", bd->name, bc);
0389 
0390     return bc;
0391 }
0392 
0393 static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
0394                     struct bio *bio, struct bio *bidi_bio)
0395 {
0396     int ret = 0;
0397 
0398     dprintk("rq %p bio %p 0x%x\n", rq, bio, rq->errors);
0399     /*
0400      * fill in all the output members
0401      */
0402     hdr->device_status = rq->errors & 0xff;
0403     hdr->transport_status = host_byte(rq->errors);
0404     hdr->driver_status = driver_byte(rq->errors);
0405     hdr->info = 0;
0406     if (hdr->device_status || hdr->transport_status || hdr->driver_status)
0407         hdr->info |= SG_INFO_CHECK;
0408     hdr->response_len = 0;
0409 
0410     if (rq->sense_len && hdr->response) {
0411         int len = min_t(unsigned int, hdr->max_response_len,
0412                     rq->sense_len);
0413 
0414         ret = copy_to_user((void __user *)(unsigned long)hdr->response,
0415                    rq->sense, len);
0416         if (!ret)
0417             hdr->response_len = len;
0418         else
0419             ret = -EFAULT;
0420     }
0421 
0422     if (rq->next_rq) {
0423         hdr->dout_resid = rq->resid_len;
0424         hdr->din_resid = rq->next_rq->resid_len;
0425         blk_rq_unmap_user(bidi_bio);
0426         blk_put_request(rq->next_rq);
0427     } else if (rq_data_dir(rq) == READ)
0428         hdr->din_resid = rq->resid_len;
0429     else
0430         hdr->dout_resid = rq->resid_len;
0431 
0432     /*
0433      * If the request generated a negative error number, return it
0434      * (providing we aren't already returning an error); if it's
0435      * just a protocol response (i.e. non negative), that gets
0436      * processed above.
0437      */
0438     if (!ret && rq->errors < 0)
0439         ret = rq->errors;
0440 
0441     blk_rq_unmap_user(bio);
0442     if (rq->cmd != rq->__cmd)
0443         kfree(rq->cmd);
0444     blk_put_request(rq);
0445 
0446     return ret;
0447 }
0448 
0449 static bool bsg_complete(struct bsg_device *bd)
0450 {
0451     bool ret = false;
0452     bool spin;
0453 
0454     do {
0455         spin_lock_irq(&bd->lock);
0456 
0457         BUG_ON(bd->done_cmds > bd->queued_cmds);
0458 
0459         /*
0460          * All commands consumed.
0461          */
0462         if (bd->done_cmds == bd->queued_cmds)
0463             ret = true;
0464 
0465         spin = !test_bit(BSG_F_BLOCK, &bd->flags);
0466 
0467         spin_unlock_irq(&bd->lock);
0468     } while (!ret && spin);
0469 
0470     return ret;
0471 }
0472 
0473 static int bsg_complete_all_commands(struct bsg_device *bd)
0474 {
0475     struct bsg_command *bc;
0476     int ret, tret;
0477 
0478     dprintk("%s: entered\n", bd->name);
0479 
0480     /*
0481      * wait for all commands to complete
0482      */
0483     io_wait_event(bd->wq_done, bsg_complete(bd));
0484 
0485     /*
0486      * discard done commands
0487      */
0488     ret = 0;
0489     do {
0490         spin_lock_irq(&bd->lock);
0491         if (!bd->queued_cmds) {
0492             spin_unlock_irq(&bd->lock);
0493             break;
0494         }
0495         spin_unlock_irq(&bd->lock);
0496 
0497         bc = bsg_get_done_cmd(bd);
0498         if (IS_ERR(bc))
0499             break;
0500 
0501         tret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio,
0502                         bc->bidi_bio);
0503         if (!ret)
0504             ret = tret;
0505 
0506         bsg_free_command(bc);
0507     } while (1);
0508 
0509     return ret;
0510 }
0511 
0512 static int
0513 __bsg_read(char __user *buf, size_t count, struct bsg_device *bd,
0514        const struct iovec *iov, ssize_t *bytes_read)
0515 {
0516     struct bsg_command *bc;
0517     int nr_commands, ret;
0518 
0519     if (count % sizeof(struct sg_io_v4))
0520         return -EINVAL;
0521 
0522     ret = 0;
0523     nr_commands = count / sizeof(struct sg_io_v4);
0524     while (nr_commands) {
0525         bc = bsg_get_done_cmd(bd);
0526         if (IS_ERR(bc)) {
0527             ret = PTR_ERR(bc);
0528             break;
0529         }
0530 
0531         /*
0532          * this is the only case where we need to copy data back
0533          * after completing the request. so do that here,
0534          * bsg_complete_work() cannot do that for us
0535          */
0536         ret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio,
0537                            bc->bidi_bio);
0538 
0539         if (copy_to_user(buf, &bc->hdr, sizeof(bc->hdr)))
0540             ret = -EFAULT;
0541 
0542         bsg_free_command(bc);
0543 
0544         if (ret)
0545             break;
0546 
0547         buf += sizeof(struct sg_io_v4);
0548         *bytes_read += sizeof(struct sg_io_v4);
0549         nr_commands--;
0550     }
0551 
0552     return ret;
0553 }
0554 
0555 static inline void bsg_set_block(struct bsg_device *bd, struct file *file)
0556 {
0557     if (file->f_flags & O_NONBLOCK)
0558         clear_bit(BSG_F_BLOCK, &bd->flags);
0559     else
0560         set_bit(BSG_F_BLOCK, &bd->flags);
0561 }
0562 
0563 /*
0564  * Check if the error is a "real" error that we should return.
0565  */
0566 static inline int err_block_err(int ret)
0567 {
0568     if (ret && ret != -ENOSPC && ret != -ENODATA && ret != -EAGAIN)
0569         return 1;
0570 
0571     return 0;
0572 }
0573 
0574 static ssize_t
0575 bsg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
0576 {
0577     struct bsg_device *bd = file->private_data;
0578     int ret;
0579     ssize_t bytes_read;
0580 
0581     dprintk("%s: read %Zd bytes\n", bd->name, count);
0582 
0583     bsg_set_block(bd, file);
0584 
0585     bytes_read = 0;
0586     ret = __bsg_read(buf, count, bd, NULL, &bytes_read);
0587     *ppos = bytes_read;
0588 
0589     if (!bytes_read || err_block_err(ret))
0590         bytes_read = ret;
0591 
0592     return bytes_read;
0593 }
0594 
0595 static int __bsg_write(struct bsg_device *bd, const char __user *buf,
0596                size_t count, ssize_t *bytes_written,
0597                fmode_t has_write_perm)
0598 {
0599     struct bsg_command *bc;
0600     struct request *rq;
0601     int ret, nr_commands;
0602 
0603     if (count % sizeof(struct sg_io_v4))
0604         return -EINVAL;
0605 
0606     nr_commands = count / sizeof(struct sg_io_v4);
0607     rq = NULL;
0608     bc = NULL;
0609     ret = 0;
0610     while (nr_commands) {
0611         struct request_queue *q = bd->queue;
0612 
0613         bc = bsg_alloc_command(bd);
0614         if (IS_ERR(bc)) {
0615             ret = PTR_ERR(bc);
0616             bc = NULL;
0617             break;
0618         }
0619 
0620         if (copy_from_user(&bc->hdr, buf, sizeof(bc->hdr))) {
0621             ret = -EFAULT;
0622             break;
0623         }
0624 
0625         /*
0626          * get a request, fill in the blanks, and add to request queue
0627          */
0628         rq = bsg_map_hdr(bd, &bc->hdr, has_write_perm, bc->sense);
0629         if (IS_ERR(rq)) {
0630             ret = PTR_ERR(rq);
0631             rq = NULL;
0632             break;
0633         }
0634 
0635         bsg_add_command(bd, q, bc, rq);
0636         bc = NULL;
0637         rq = NULL;
0638         nr_commands--;
0639         buf += sizeof(struct sg_io_v4);
0640         *bytes_written += sizeof(struct sg_io_v4);
0641     }
0642 
0643     if (bc)
0644         bsg_free_command(bc);
0645 
0646     return ret;
0647 }
0648 
0649 static ssize_t
0650 bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
0651 {
0652     struct bsg_device *bd = file->private_data;
0653     ssize_t bytes_written;
0654     int ret;
0655 
0656     dprintk("%s: write %Zd bytes\n", bd->name, count);
0657 
0658     if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
0659         return -EINVAL;
0660 
0661     bsg_set_block(bd, file);
0662 
0663     bytes_written = 0;
0664     ret = __bsg_write(bd, buf, count, &bytes_written,
0665               file->f_mode & FMODE_WRITE);
0666 
0667     *ppos = bytes_written;
0668 
0669     /*
0670      * return bytes written on non-fatal errors
0671      */
0672     if (!bytes_written || err_block_err(ret))
0673         bytes_written = ret;
0674 
0675     dprintk("%s: returning %Zd\n", bd->name, bytes_written);
0676     return bytes_written;
0677 }
0678 
0679 static struct bsg_device *bsg_alloc_device(void)
0680 {
0681     struct bsg_device *bd;
0682 
0683     bd = kzalloc(sizeof(struct bsg_device), GFP_KERNEL);
0684     if (unlikely(!bd))
0685         return NULL;
0686 
0687     spin_lock_init(&bd->lock);
0688 
0689     bd->max_queue = BSG_DEFAULT_CMDS;
0690 
0691     INIT_LIST_HEAD(&bd->busy_list);
0692     INIT_LIST_HEAD(&bd->done_list);
0693     INIT_HLIST_NODE(&bd->dev_list);
0694 
0695     init_waitqueue_head(&bd->wq_free);
0696     init_waitqueue_head(&bd->wq_done);
0697     return bd;
0698 }
0699 
0700 static void bsg_kref_release_function(struct kref *kref)
0701 {
0702     struct bsg_class_device *bcd =
0703         container_of(kref, struct bsg_class_device, ref);
0704     struct device *parent = bcd->parent;
0705 
0706     if (bcd->release)
0707         bcd->release(bcd->parent);
0708 
0709     put_device(parent);
0710 }
0711 
0712 static int bsg_put_device(struct bsg_device *bd)
0713 {
0714     int ret = 0, do_free;
0715     struct request_queue *q = bd->queue;
0716 
0717     mutex_lock(&bsg_mutex);
0718 
0719     do_free = atomic_dec_and_test(&bd->ref_count);
0720     if (!do_free) {
0721         mutex_unlock(&bsg_mutex);
0722         goto out;
0723     }
0724 
0725     hlist_del(&bd->dev_list);
0726     mutex_unlock(&bsg_mutex);
0727 
0728     dprintk("%s: tearing down\n", bd->name);
0729 
0730     /*
0731      * close can always block
0732      */
0733     set_bit(BSG_F_BLOCK, &bd->flags);
0734 
0735     /*
0736      * correct error detection baddies here again. it's the responsibility
0737      * of the app to properly reap commands before close() if it wants
0738      * fool-proof error detection
0739      */
0740     ret = bsg_complete_all_commands(bd);
0741 
0742     kfree(bd);
0743 out:
0744     kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
0745     if (do_free)
0746         blk_put_queue(q);
0747     return ret;
0748 }
0749 
0750 static struct bsg_device *bsg_add_device(struct inode *inode,
0751                      struct request_queue *rq,
0752                      struct file *file)
0753 {
0754     struct bsg_device *bd;
0755 #ifdef BSG_DEBUG
0756     unsigned char buf[32];
0757 #endif
0758     if (!blk_get_queue(rq))
0759         return ERR_PTR(-ENXIO);
0760 
0761     bd = bsg_alloc_device();
0762     if (!bd) {
0763         blk_put_queue(rq);
0764         return ERR_PTR(-ENOMEM);
0765     }
0766 
0767     bd->queue = rq;
0768 
0769     bsg_set_block(bd, file);
0770 
0771     atomic_set(&bd->ref_count, 1);
0772     mutex_lock(&bsg_mutex);
0773     hlist_add_head(&bd->dev_list, bsg_dev_idx_hash(iminor(inode)));
0774 
0775     strncpy(bd->name, dev_name(rq->bsg_dev.class_dev), sizeof(bd->name) - 1);
0776     dprintk("bound to <%s>, max queue %d\n",
0777         format_dev_t(buf, inode->i_rdev), bd->max_queue);
0778 
0779     mutex_unlock(&bsg_mutex);
0780     return bd;
0781 }
0782 
0783 static struct bsg_device *__bsg_get_device(int minor, struct request_queue *q)
0784 {
0785     struct bsg_device *bd;
0786 
0787     mutex_lock(&bsg_mutex);
0788 
0789     hlist_for_each_entry(bd, bsg_dev_idx_hash(minor), dev_list) {
0790         if (bd->queue == q) {
0791             atomic_inc(&bd->ref_count);
0792             goto found;
0793         }
0794     }
0795     bd = NULL;
0796 found:
0797     mutex_unlock(&bsg_mutex);
0798     return bd;
0799 }
0800 
0801 static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
0802 {
0803     struct bsg_device *bd;
0804     struct bsg_class_device *bcd;
0805 
0806     /*
0807      * find the class device
0808      */
0809     mutex_lock(&bsg_mutex);
0810     bcd = idr_find(&bsg_minor_idr, iminor(inode));
0811     if (bcd)
0812         kref_get(&bcd->ref);
0813     mutex_unlock(&bsg_mutex);
0814 
0815     if (!bcd)
0816         return ERR_PTR(-ENODEV);
0817 
0818     bd = __bsg_get_device(iminor(inode), bcd->queue);
0819     if (bd)
0820         return bd;
0821 
0822     bd = bsg_add_device(inode, bcd->queue, file);
0823     if (IS_ERR(bd))
0824         kref_put(&bcd->ref, bsg_kref_release_function);
0825 
0826     return bd;
0827 }
0828 
0829 static int bsg_open(struct inode *inode, struct file *file)
0830 {
0831     struct bsg_device *bd;
0832 
0833     bd = bsg_get_device(inode, file);
0834 
0835     if (IS_ERR(bd))
0836         return PTR_ERR(bd);
0837 
0838     file->private_data = bd;
0839     return 0;
0840 }
0841 
0842 static int bsg_release(struct inode *inode, struct file *file)
0843 {
0844     struct bsg_device *bd = file->private_data;
0845 
0846     file->private_data = NULL;
0847     return bsg_put_device(bd);
0848 }
0849 
0850 static unsigned int bsg_poll(struct file *file, poll_table *wait)
0851 {
0852     struct bsg_device *bd = file->private_data;
0853     unsigned int mask = 0;
0854 
0855     poll_wait(file, &bd->wq_done, wait);
0856     poll_wait(file, &bd->wq_free, wait);
0857 
0858     spin_lock_irq(&bd->lock);
0859     if (!list_empty(&bd->done_list))
0860         mask |= POLLIN | POLLRDNORM;
0861     if (bd->queued_cmds < bd->max_queue)
0862         mask |= POLLOUT;
0863     spin_unlock_irq(&bd->lock);
0864 
0865     return mask;
0866 }
0867 
0868 static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
0869 {
0870     struct bsg_device *bd = file->private_data;
0871     int __user *uarg = (int __user *) arg;
0872     int ret;
0873 
0874     switch (cmd) {
0875         /*
0876          * our own ioctls
0877          */
0878     case SG_GET_COMMAND_Q:
0879         return put_user(bd->max_queue, uarg);
0880     case SG_SET_COMMAND_Q: {
0881         int queue;
0882 
0883         if (get_user(queue, uarg))
0884             return -EFAULT;
0885         if (queue < 1)
0886             return -EINVAL;
0887 
0888         spin_lock_irq(&bd->lock);
0889         bd->max_queue = queue;
0890         spin_unlock_irq(&bd->lock);
0891         return 0;
0892     }
0893 
0894     /*
0895      * SCSI/sg ioctls
0896      */
0897     case SG_GET_VERSION_NUM:
0898     case SCSI_IOCTL_GET_IDLUN:
0899     case SCSI_IOCTL_GET_BUS_NUMBER:
0900     case SG_SET_TIMEOUT:
0901     case SG_GET_TIMEOUT:
0902     case SG_GET_RESERVED_SIZE:
0903     case SG_SET_RESERVED_SIZE:
0904     case SG_EMULATED_HOST:
0905     case SCSI_IOCTL_SEND_COMMAND: {
0906         void __user *uarg = (void __user *) arg;
0907         return scsi_cmd_ioctl(bd->queue, NULL, file->f_mode, cmd, uarg);
0908     }
0909     case SG_IO: {
0910         struct request *rq;
0911         struct bio *bio, *bidi_bio = NULL;
0912         struct sg_io_v4 hdr;
0913         int at_head;
0914         u8 sense[SCSI_SENSE_BUFFERSIZE];
0915 
0916         if (copy_from_user(&hdr, uarg, sizeof(hdr)))
0917             return -EFAULT;
0918 
0919         rq = bsg_map_hdr(bd, &hdr, file->f_mode & FMODE_WRITE, sense);
0920         if (IS_ERR(rq))
0921             return PTR_ERR(rq);
0922 
0923         bio = rq->bio;
0924         if (rq->next_rq)
0925             bidi_bio = rq->next_rq->bio;
0926 
0927         at_head = (0 == (hdr.flags & BSG_FLAG_Q_AT_TAIL));
0928         blk_execute_rq(bd->queue, NULL, rq, at_head);
0929         ret = blk_complete_sgv4_hdr_rq(rq, &hdr, bio, bidi_bio);
0930 
0931         if (copy_to_user(uarg, &hdr, sizeof(hdr)))
0932             return -EFAULT;
0933 
0934         return ret;
0935     }
0936     /*
0937      * block device ioctls
0938      */
0939     default:
0940 #if 0
0941         return ioctl_by_bdev(bd->bdev, cmd, arg);
0942 #else
0943         return -ENOTTY;
0944 #endif
0945     }
0946 }
0947 
0948 static const struct file_operations bsg_fops = {
0949     .read       =   bsg_read,
0950     .write      =   bsg_write,
0951     .poll       =   bsg_poll,
0952     .open       =   bsg_open,
0953     .release    =   bsg_release,
0954     .unlocked_ioctl =   bsg_ioctl,
0955     .owner      =   THIS_MODULE,
0956     .llseek     =   default_llseek,
0957 };
0958 
0959 void bsg_unregister_queue(struct request_queue *q)
0960 {
0961     struct bsg_class_device *bcd = &q->bsg_dev;
0962 
0963     if (!bcd->class_dev)
0964         return;
0965 
0966     mutex_lock(&bsg_mutex);
0967     idr_remove(&bsg_minor_idr, bcd->minor);
0968     if (q->kobj.sd)
0969         sysfs_remove_link(&q->kobj, "bsg");
0970     device_unregister(bcd->class_dev);
0971     bcd->class_dev = NULL;
0972     kref_put(&bcd->ref, bsg_kref_release_function);
0973     mutex_unlock(&bsg_mutex);
0974 }
0975 EXPORT_SYMBOL_GPL(bsg_unregister_queue);
0976 
0977 int bsg_register_queue(struct request_queue *q, struct device *parent,
0978                const char *name, void (*release)(struct device *))
0979 {
0980     struct bsg_class_device *bcd;
0981     dev_t dev;
0982     int ret;
0983     struct device *class_dev = NULL;
0984     const char *devname;
0985 
0986     if (name)
0987         devname = name;
0988     else
0989         devname = dev_name(parent);
0990 
0991     /*
0992      * we need a proper transport to send commands, not a stacked device
0993      */
0994     if (!queue_is_rq_based(q))
0995         return 0;
0996 
0997     bcd = &q->bsg_dev;
0998     memset(bcd, 0, sizeof(*bcd));
0999 
1000     mutex_lock(&bsg_mutex);
1001 
1002     ret = idr_alloc(&bsg_minor_idr, bcd, 0, BSG_MAX_DEVS, GFP_KERNEL);
1003     if (ret < 0) {
1004         if (ret == -ENOSPC) {
1005             printk(KERN_ERR "bsg: too many bsg devices\n");
1006             ret = -EINVAL;
1007         }
1008         goto unlock;
1009     }
1010 
1011     bcd->minor = ret;
1012     bcd->queue = q;
1013     bcd->parent = get_device(parent);
1014     bcd->release = release;
1015     kref_init(&bcd->ref);
1016     dev = MKDEV(bsg_major, bcd->minor);
1017     class_dev = device_create(bsg_class, parent, dev, NULL, "%s", devname);
1018     if (IS_ERR(class_dev)) {
1019         ret = PTR_ERR(class_dev);
1020         goto put_dev;
1021     }
1022     bcd->class_dev = class_dev;
1023 
1024     if (q->kobj.sd) {
1025         ret = sysfs_create_link(&q->kobj, &bcd->class_dev->kobj, "bsg");
1026         if (ret)
1027             goto unregister_class_dev;
1028     }
1029 
1030     mutex_unlock(&bsg_mutex);
1031     return 0;
1032 
1033 unregister_class_dev:
1034     device_unregister(class_dev);
1035 put_dev:
1036     put_device(parent);
1037     idr_remove(&bsg_minor_idr, bcd->minor);
1038 unlock:
1039     mutex_unlock(&bsg_mutex);
1040     return ret;
1041 }
1042 EXPORT_SYMBOL_GPL(bsg_register_queue);
1043 
1044 static struct cdev bsg_cdev;
1045 
1046 static char *bsg_devnode(struct device *dev, umode_t *mode)
1047 {
1048     return kasprintf(GFP_KERNEL, "bsg/%s", dev_name(dev));
1049 }
1050 
1051 static int __init bsg_init(void)
1052 {
1053     int ret, i;
1054     dev_t devid;
1055 
1056     bsg_cmd_cachep = kmem_cache_create("bsg_cmd",
1057                 sizeof(struct bsg_command), 0, 0, NULL);
1058     if (!bsg_cmd_cachep) {
1059         printk(KERN_ERR "bsg: failed creating slab cache\n");
1060         return -ENOMEM;
1061     }
1062 
1063     for (i = 0; i < BSG_LIST_ARRAY_SIZE; i++)
1064         INIT_HLIST_HEAD(&bsg_device_list[i]);
1065 
1066     bsg_class = class_create(THIS_MODULE, "bsg");
1067     if (IS_ERR(bsg_class)) {
1068         ret = PTR_ERR(bsg_class);
1069         goto destroy_kmemcache;
1070     }
1071     bsg_class->devnode = bsg_devnode;
1072 
1073     ret = alloc_chrdev_region(&devid, 0, BSG_MAX_DEVS, "bsg");
1074     if (ret)
1075         goto destroy_bsg_class;
1076 
1077     bsg_major = MAJOR(devid);
1078 
1079     cdev_init(&bsg_cdev, &bsg_fops);
1080     ret = cdev_add(&bsg_cdev, MKDEV(bsg_major, 0), BSG_MAX_DEVS);
1081     if (ret)
1082         goto unregister_chrdev;
1083 
1084     printk(KERN_INFO BSG_DESCRIPTION " version " BSG_VERSION
1085            " loaded (major %d)\n", bsg_major);
1086     return 0;
1087 unregister_chrdev:
1088     unregister_chrdev_region(MKDEV(bsg_major, 0), BSG_MAX_DEVS);
1089 destroy_bsg_class:
1090     class_destroy(bsg_class);
1091 destroy_kmemcache:
1092     kmem_cache_destroy(bsg_cmd_cachep);
1093     return ret;
1094 }
1095 
1096 MODULE_AUTHOR("Jens Axboe");
1097 MODULE_DESCRIPTION(BSG_DESCRIPTION);
1098 MODULE_LICENSE("GPL");
1099 
1100 device_initcall(bsg_init);