1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * BSG helper library 4 * 5 * Copyright (C) 2008 James Smart, Emulex Corporation 6 * Copyright (C) 2011 Red Hat, Inc. All rights reserved. 7 * Copyright (C) 2011 Mike Christie 8 */ 9 #include <linux/bsg.h> 10 #include <linux/slab.h> 11 #include <linux/blk-mq.h> 12 #include <linux/delay.h> 13 #include <linux/scatterlist.h> 14 #include <linux/bsg-lib.h> 15 #include <linux/export.h> 16 #include <scsi/scsi_cmnd.h> 17 #include <scsi/sg.h> 18 19 #define uptr64(val) ((void __user *)(uintptr_t)(val)) 20 21 struct bsg_set { 22 struct blk_mq_tag_set tag_set; 23 struct bsg_device *bd; 24 bsg_job_fn *job_fn; 25 bsg_timeout_fn *timeout_fn; 26 unsigned int reply_len; 27 }; 28 29 static int bsg_transport_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr, 30 bool open_for_write, unsigned int timeout) 31 { 32 struct bsg_set *bset = 33 container_of(q->tag_set, struct bsg_set, tag_set); 34 struct bsg_job *job; 35 struct request *rq; 36 struct bio *bio; 37 void *reply; 38 int ret; 39 40 if (hdr->protocol != BSG_PROTOCOL_SCSI || 41 hdr->subprotocol != BSG_SUB_PROTOCOL_SCSI_TRANSPORT) 42 return -EINVAL; 43 if (!capable(CAP_SYS_RAWIO)) 44 return -EPERM; 45 46 rq = blk_mq_alloc_request(q, hdr->dout_xfer_len ? 47 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0); 48 if (IS_ERR(rq)) 49 return PTR_ERR(rq); 50 rq->timeout = timeout; 51 52 job = blk_mq_rq_to_pdu(rq); 53 reply = job->reply; 54 memset(job, 0, sizeof(*job)); 55 job->reply = reply; 56 job->reply_len = bset->reply_len; 57 job->dd_data = job + 1; 58 59 job->request_len = hdr->request_len; 60 job->request = memdup_user(uptr64(hdr->request), hdr->request_len); 61 if (IS_ERR(job->request)) { 62 ret = PTR_ERR(job->request); 63 goto out_free_rq; 64 } 65 66 if (hdr->dout_xfer_len && hdr->din_xfer_len) { 67 job->bidi_rq = blk_mq_alloc_request(rq->q, REQ_OP_DRV_IN, 0); 68 if (IS_ERR(job->bidi_rq)) { 69 ret = PTR_ERR(job->bidi_rq); 70 goto out_free_job_request; 71 } 72 73 ret = blk_rq_map_user(rq->q, job->bidi_rq, NULL, 74 uptr64(hdr->din_xferp), hdr->din_xfer_len, 75 GFP_KERNEL); 76 if (ret) 77 goto out_free_bidi_rq; 78 79 job->bidi_bio = job->bidi_rq->bio; 80 } else { 81 job->bidi_rq = NULL; 82 job->bidi_bio = NULL; 83 } 84 85 ret = 0; 86 if (hdr->dout_xfer_len) { 87 ret = blk_rq_map_user(rq->q, rq, NULL, uptr64(hdr->dout_xferp), 88 hdr->dout_xfer_len, GFP_KERNEL); 89 } else if (hdr->din_xfer_len) { 90 ret = blk_rq_map_user(rq->q, rq, NULL, uptr64(hdr->din_xferp), 91 hdr->din_xfer_len, GFP_KERNEL); 92 } 93 94 if (ret) 95 goto out_unmap_bidi_rq; 96 97 bio = rq->bio; 98 blk_execute_rq(rq, !(hdr->flags & BSG_FLAG_Q_AT_TAIL)); 99 100 /* 101 * The assignments below don't make much sense, but are kept for 102 * bug by bug backwards compatibility: 103 */ 104 hdr->device_status = job->result & 0xff; 105 hdr->transport_status = host_byte(job->result); 106 hdr->driver_status = 0; 107 hdr->info = 0; 108 if (hdr->device_status || hdr->transport_status || hdr->driver_status) 109 hdr->info |= SG_INFO_CHECK; 110 hdr->response_len = 0; 111 112 if (job->result < 0) { 113 /* we're only returning the result field in the reply */ 114 job->reply_len = sizeof(u32); 115 ret = job->result; 116 } 117 118 if (job->reply_len && hdr->response) { 119 int len = min(hdr->max_response_len, job->reply_len); 120 121 if (copy_to_user(uptr64(hdr->response), job->reply, len)) 122 ret = -EFAULT; 123 else 124 hdr->response_len = len; 125 } 126 127 /* we assume all request payload was transferred, residual == 0 */ 128 hdr->dout_resid = 0; 129 130 if (job->bidi_rq) { 131 unsigned int rsp_len = job->reply_payload.payload_len; 132 133 if (WARN_ON(job->reply_payload_rcv_len > rsp_len)) 134 hdr->din_resid = 0; 135 else 136 hdr->din_resid = rsp_len - job->reply_payload_rcv_len; 137 } else { 138 hdr->din_resid = 0; 139 } 140 141 blk_rq_unmap_user(bio); 142 out_unmap_bidi_rq: 143 if (job->bidi_rq) 144 blk_rq_unmap_user(job->bidi_bio); 145 out_free_bidi_rq: 146 if (job->bidi_rq) 147 blk_mq_free_request(job->bidi_rq); 148 out_free_job_request: 149 kfree(job->request); 150 out_free_rq: 151 blk_mq_free_request(rq); 152 return ret; 153 } 154 155 /** 156 * bsg_teardown_job - routine to teardown a bsg job 157 * @kref: kref inside bsg_job that is to be torn down 158 */ 159 static void bsg_teardown_job(struct kref *kref) 160 { 161 struct bsg_job *job = container_of(kref, struct bsg_job, kref); 162 struct request *rq = blk_mq_rq_from_pdu(job); 163 164 put_device(job->dev); /* release reference for the request */ 165 166 kfree(job->request_payload.sg_list); 167 kfree(job->reply_payload.sg_list); 168 169 blk_mq_end_request(rq, BLK_STS_OK); 170 } 171 172 void bsg_job_put(struct bsg_job *job) 173 { 174 kref_put(&job->kref, bsg_teardown_job); 175 } 176 EXPORT_SYMBOL_GPL(bsg_job_put); 177 178 int bsg_job_get(struct bsg_job *job) 179 { 180 return kref_get_unless_zero(&job->kref); 181 } 182 EXPORT_SYMBOL_GPL(bsg_job_get); 183 184 /** 185 * bsg_job_done - completion routine for bsg requests 186 * @job: bsg_job that is complete 187 * @result: job reply result 188 * @reply_payload_rcv_len: length of payload recvd 189 * 190 * The LLD should call this when the bsg job has completed. 191 */ 192 void bsg_job_done(struct bsg_job *job, int result, 193 unsigned int reply_payload_rcv_len) 194 { 195 struct request *rq = blk_mq_rq_from_pdu(job); 196 197 job->result = result; 198 job->reply_payload_rcv_len = reply_payload_rcv_len; 199 if (likely(!blk_should_fake_timeout(rq->q))) 200 blk_mq_complete_request(rq); 201 } 202 EXPORT_SYMBOL_GPL(bsg_job_done); 203 204 /** 205 * bsg_complete - softirq done routine for destroying the bsg requests 206 * @rq: BSG request that holds the job to be destroyed 207 */ 208 static void bsg_complete(struct request *rq) 209 { 210 struct bsg_job *job = blk_mq_rq_to_pdu(rq); 211 212 bsg_job_put(job); 213 } 214 215 static int bsg_map_buffer(struct bsg_buffer *buf, struct request *req) 216 { 217 size_t sz = (sizeof(struct scatterlist) * req->nr_phys_segments); 218 219 BUG_ON(!req->nr_phys_segments); 220 221 buf->sg_list = kmalloc(sz, GFP_KERNEL); 222 if (!buf->sg_list) 223 return -ENOMEM; 224 sg_init_table(buf->sg_list, req->nr_phys_segments); 225 buf->sg_cnt = blk_rq_map_sg(req, buf->sg_list); 226 buf->payload_len = blk_rq_bytes(req); 227 return 0; 228 } 229 230 /** 231 * bsg_prepare_job - create the bsg_job structure for the bsg request 232 * @dev: device that is being sent the bsg request 233 * @req: BSG request that needs a job structure 234 */ 235 static bool bsg_prepare_job(struct device *dev, struct request *req) 236 { 237 struct bsg_job *job = blk_mq_rq_to_pdu(req); 238 int ret; 239 240 job->timeout = req->timeout; 241 242 if (req->bio) { 243 ret = bsg_map_buffer(&job->request_payload, req); 244 if (ret) 245 goto failjob_rls_job; 246 } 247 if (job->bidi_rq) { 248 ret = bsg_map_buffer(&job->reply_payload, job->bidi_rq); 249 if (ret) 250 goto failjob_rls_rqst_payload; 251 } 252 job->dev = dev; 253 /* take a reference for the request */ 254 get_device(job->dev); 255 kref_init(&job->kref); 256 return true; 257 258 failjob_rls_rqst_payload: 259 kfree(job->request_payload.sg_list); 260 failjob_rls_job: 261 job->result = -ENOMEM; 262 return false; 263 } 264 265 /** 266 * bsg_queue_rq - generic handler for bsg requests 267 * @hctx: hardware queue 268 * @bd: queue data 269 * 270 * On error the create_bsg_job function should return a -Exyz error value 271 * that will be set to ->result. 272 * 273 * Drivers/subsys should pass this to the queue init function. 274 */ 275 static blk_status_t bsg_queue_rq(struct blk_mq_hw_ctx *hctx, 276 const struct blk_mq_queue_data *bd) 277 { 278 struct request_queue *q = hctx->queue; 279 struct device *dev = q->queuedata; 280 struct request *req = bd->rq; 281 struct bsg_set *bset = 282 container_of(q->tag_set, struct bsg_set, tag_set); 283 blk_status_t sts = BLK_STS_IOERR; 284 int ret; 285 286 blk_mq_start_request(req); 287 288 if (!get_device(dev)) 289 return BLK_STS_IOERR; 290 291 if (!bsg_prepare_job(dev, req)) 292 goto out; 293 294 ret = bset->job_fn(blk_mq_rq_to_pdu(req)); 295 if (!ret) 296 sts = BLK_STS_OK; 297 298 out: 299 put_device(dev); 300 return sts; 301 } 302 303 /* called right after the request is allocated for the request_queue */ 304 static int bsg_init_rq(struct blk_mq_tag_set *set, struct request *req, 305 unsigned int hctx_idx, int numa_node) 306 { 307 struct bsg_set *bset = container_of(set, struct bsg_set, tag_set); 308 struct bsg_job *job = blk_mq_rq_to_pdu(req); 309 310 job->reply = kzalloc(bset->reply_len, GFP_KERNEL); 311 if (!job->reply) 312 return -ENOMEM; 313 return 0; 314 } 315 316 static void bsg_exit_rq(struct blk_mq_tag_set *set, struct request *req, 317 unsigned int hctx_idx) 318 { 319 struct bsg_job *job = blk_mq_rq_to_pdu(req); 320 321 kfree(job->reply); 322 } 323 324 void bsg_remove_queue(struct request_queue *q) 325 { 326 if (q) { 327 struct bsg_set *bset = 328 container_of(q->tag_set, struct bsg_set, tag_set); 329 330 bsg_unregister_queue(bset->bd); 331 blk_mq_destroy_queue(q); 332 blk_put_queue(q); 333 blk_mq_free_tag_set(&bset->tag_set); 334 kfree(bset); 335 } 336 } 337 EXPORT_SYMBOL_GPL(bsg_remove_queue); 338 339 static enum blk_eh_timer_return bsg_timeout(struct request *rq) 340 { 341 struct bsg_set *bset = 342 container_of(rq->q->tag_set, struct bsg_set, tag_set); 343 344 if (!bset->timeout_fn) 345 return BLK_EH_DONE; 346 return bset->timeout_fn(rq); 347 } 348 349 static const struct blk_mq_ops bsg_mq_ops = { 350 .queue_rq = bsg_queue_rq, 351 .init_request = bsg_init_rq, 352 .exit_request = bsg_exit_rq, 353 .complete = bsg_complete, 354 .timeout = bsg_timeout, 355 }; 356 357 /** 358 * bsg_setup_queue - Create and add the bsg hooks so we can receive requests 359 * @dev: device to attach bsg device to 360 * @name: device to give bsg device 361 * @lim: queue limits for the bsg queue 362 * @job_fn: bsg job handler 363 * @timeout: timeout handler function pointer 364 * @dd_job_size: size of LLD data needed for each job 365 * @reply_len: size of the reply buffer needed for each job 366 */ 367 struct request_queue *bsg_setup_queue(struct device *dev, const char *name, 368 struct queue_limits *lim, bsg_job_fn *job_fn, 369 bsg_timeout_fn *timeout, int dd_job_size, 370 unsigned int reply_len) 371 { 372 struct bsg_set *bset; 373 struct blk_mq_tag_set *set; 374 struct request_queue *q; 375 int ret = -ENOMEM; 376 377 bset = kzalloc_obj(*bset); 378 if (!bset) 379 return ERR_PTR(-ENOMEM); 380 381 bset->job_fn = job_fn; 382 bset->timeout_fn = timeout; 383 bset->reply_len = reply_len; 384 385 set = &bset->tag_set; 386 set->ops = &bsg_mq_ops; 387 set->nr_hw_queues = 1; 388 set->queue_depth = 128; 389 set->numa_node = NUMA_NO_NODE; 390 set->cmd_size = sizeof(struct bsg_job) + dd_job_size; 391 set->flags = BLK_MQ_F_BLOCKING; 392 if (blk_mq_alloc_tag_set(set)) 393 goto out_tag_set; 394 395 q = blk_mq_alloc_queue(set, lim, dev); 396 if (IS_ERR(q)) { 397 ret = PTR_ERR(q); 398 goto out_queue; 399 } 400 401 blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT); 402 403 bset->bd = bsg_register_queue(q, dev, name, bsg_transport_sg_io_fn, NULL); 404 if (IS_ERR(bset->bd)) { 405 ret = PTR_ERR(bset->bd); 406 goto out_cleanup_queue; 407 } 408 409 return q; 410 out_cleanup_queue: 411 blk_mq_destroy_queue(q); 412 blk_put_queue(q); 413 out_queue: 414 blk_mq_free_tag_set(set); 415 out_tag_set: 416 kfree(bset); 417 return ERR_PTR(ret); 418 } 419 EXPORT_SYMBOL_GPL(bsg_setup_queue); 420