projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
nbd: fix use after free on module unload
[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / drivers / block / nbd.c
1 /*
2 * Network block device - make block devices work over TCP
3 *
4 * Note that you can not swap over this thing, yet. Seems to work but
5 * deadlocks sometimes - you can not swap over TCP in general.
6 *
7 * Copyright 1997-2000, 2008 Pavel Machek <pavel@ucw.cz>
8 * Parts copyright 2001 Steven Whitehouse <steve@chygwyn.com>
9 *
10 * This file is released under GPLv2 or later.
11 *
12 * (part of code stolen from loop.c)
13 */
14
15 #include <linux/major.h>
16
17 #include <linux/blkdev.h>
18 #include <linux/module.h>
19 #include <linux/init.h>
20 #include <linux/sched.h>
21 #include <linux/fs.h>
22 #include <linux/bio.h>
23 #include <linux/stat.h>
24 #include <linux/errno.h>
25 #include <linux/file.h>
26 #include <linux/ioctl.h>
27 #include <linux/mutex.h>
28 #include <linux/compiler.h>
29 #include <linux/err.h>
30 #include <linux/kernel.h>
31 #include <linux/slab.h>
32 #include <net/sock.h>
33 #include <linux/net.h>
34 #include <linux/kthread.h>
35 #include <linux/types.h>
36 #include <linux/debugfs.h>
37 #include <linux/blk-mq.h>
38
39 #include <linux/uaccess.h>
40 #include <asm/types.h>
41
42 #include <linux/nbd.h>
43 #include <linux/nbd-netlink.h>
44 #include <net/genetlink.h>
45
46 static DEFINE_IDR(nbd_index_idr);
47 static DEFINE_MUTEX(nbd_index_mutex);
48 static int nbd_total_devices = 0;
49
50 struct nbd_sock {
51 struct socket *sock;
52 struct mutex tx_lock;
53 struct request *pending;
54 int sent;
55 bool dead;
56 int fallback_index;
57 int cookie;
58 };
59
60 struct recv_thread_args {
61 struct work_struct work;
62 struct nbd_device *nbd;
63 int index;
64 };
65
66 struct link_dead_args {
67 struct work_struct work;
68 int index;
69 };
70
71 #define NBD_TIMEDOUT 0
72 #define NBD_DISCONNECT_REQUESTED 1
73 #define NBD_DISCONNECTED 2
74 #define NBD_HAS_PID_FILE 3
75 #define NBD_HAS_CONFIG_REF 4
76 #define NBD_BOUND 5
77 #define NBD_DESTROY_ON_DISCONNECT 6
78
79 struct nbd_config {
80 u32 flags;
81 unsigned long runtime_flags;
82 u64 dead_conn_timeout;
83
84 struct nbd_sock **socks;
85 int num_connections;
86 atomic_t live_connections;
87 wait_queue_head_t conn_wait;
88
89 atomic_t recv_threads;
90 wait_queue_head_t recv_wq;
91 loff_t blksize;
92 loff_t bytesize;
93 #if IS_ENABLED(CONFIG_DEBUG_FS)
94 struct dentry *dbg_dir;
95 #endif
96 };
97
98 struct nbd_device {
99 struct blk_mq_tag_set tag_set;
100
101 int index;
102 refcount_t config_refs;
103 refcount_t refs;
104 struct nbd_config *config;
105 struct mutex config_lock;
106 struct gendisk *disk;
107
108 struct list_head list;
109 struct task_struct *task_recv;
110 struct task_struct *task_setup;
111 };
112
113 struct nbd_cmd {
114 struct nbd_device *nbd;
115 int index;
116 int cookie;
117 struct completion send_complete;
118 int status;
119 };
120
121 #if IS_ENABLED(CONFIG_DEBUG_FS)
122 static struct dentry *nbd_dbg_dir;
123 #endif
124
125 #define nbd_name(nbd) ((nbd)->disk->disk_name)
126
127 #define NBD_MAGIC 0x68797548
128
129 static unsigned int nbds_max = 16;
130 static int max_part;
131 static struct workqueue_struct *recv_workqueue;
132 static int part_shift;
133
134 static int nbd_dev_dbg_init(struct nbd_device *nbd);
135 static void nbd_dev_dbg_close(struct nbd_device *nbd);
136 static void nbd_config_put(struct nbd_device *nbd);
137 static void nbd_connect_reply(struct genl_info *info, int index);
138 static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
139 static void nbd_dead_link_work(struct work_struct *work);
140
141 static inline struct device *nbd_to_dev(struct nbd_device *nbd)
142 {
143 return disk_to_dev(nbd->disk);
144 }
145
146 static const char *nbdcmd_to_ascii(int cmd)
147 {
148 switch (cmd) {
149 case NBD_CMD_READ: return "read";
150 case NBD_CMD_WRITE: return "write";
151 case NBD_CMD_DISC: return "disconnect";
152 case NBD_CMD_FLUSH: return "flush";
153 case NBD_CMD_TRIM: return "trim/discard";
154 }
155 return "invalid";
156 }
157
158 static ssize_t pid_show(struct device *dev,
159 struct device_attribute *attr, char *buf)
160 {
161 struct gendisk *disk = dev_to_disk(dev);
162 struct nbd_device *nbd = (struct nbd_device *)disk->private_data;
163
164 return sprintf(buf, "%d\n", task_pid_nr(nbd->task_recv));
165 }
166
167 static struct device_attribute pid_attr = {
168 .attr = { .name = "pid", .mode = S_IRUGO},
169 .show = pid_show,
170 };
171
172 static void nbd_dev_remove(struct nbd_device *nbd)
173 {
174 struct gendisk *disk = nbd->disk;
175 if (disk) {
176 del_gendisk(disk);
177 blk_cleanup_queue(disk->queue);
178 blk_mq_free_tag_set(&nbd->tag_set);
179 disk->private_data = NULL;
180 put_disk(disk);
181 }
182 kfree(nbd);
183 }
184
185 static void nbd_put(struct nbd_device *nbd)
186 {
187 if (refcount_dec_and_mutex_lock(&nbd->refs,
188 &nbd_index_mutex)) {
189 idr_remove(&nbd_index_idr, nbd->index);
190 mutex_unlock(&nbd_index_mutex);
191 nbd_dev_remove(nbd);
192 }
193 }
194
195 static int nbd_disconnected(struct nbd_config *config)
196 {
197 return test_bit(NBD_DISCONNECTED, &config->runtime_flags) ||
198 test_bit(NBD_DISCONNECT_REQUESTED, &config->runtime_flags);
199 }
200
201 static void nbd_mark_nsock_dead(struct nbd_device *nbd, struct nbd_sock *nsock,
202 int notify)
203 {
204 if (!nsock->dead && notify && !nbd_disconnected(nbd->config)) {
205 struct link_dead_args *args;
206 args = kmalloc(sizeof(struct link_dead_args), GFP_NOIO);
207 if (args) {
208 INIT_WORK(&args->work, nbd_dead_link_work);
209 args->index = nbd->index;
210 queue_work(system_wq, &args->work);
211 }
212 }
213 if (!nsock->dead) {
214 kernel_sock_shutdown(nsock->sock, SHUT_RDWR);
215 atomic_dec(&nbd->config->live_connections);
216 }
217 nsock->dead = true;
218 nsock->pending = NULL;
219 nsock->sent = 0;
220 }
221
222 static void nbd_size_clear(struct nbd_device *nbd)
223 {
224 if (nbd->config->bytesize) {
225 set_capacity(nbd->disk, 0);
226 kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE);
227 }
228 }
229
230 static void nbd_size_update(struct nbd_device *nbd)
231 {
232 struct nbd_config *config = nbd->config;
233 blk_queue_logical_block_size(nbd->disk->queue, config->blksize);
234 blk_queue_physical_block_size(nbd->disk->queue, config->blksize);
235 set_capacity(nbd->disk, config->bytesize >> 9);
236 kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE);
237 }
238
239 static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize,
240 loff_t nr_blocks)
241 {
242 struct nbd_config *config = nbd->config;
243 config->blksize = blocksize;
244 config->bytesize = blocksize * nr_blocks;
245 nbd_size_update(nbd);
246 }
247
248 static void nbd_complete_rq(struct request *req)
249 {
250 struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req);
251
252 dev_dbg(nbd_to_dev(cmd->nbd), "request %p: %s\n", cmd,
253 cmd->status ? "failed" : "done");
254
255 blk_mq_end_request(req, cmd->status);
256 }
257
258 /*
259 * Forcibly shutdown the socket causing all listeners to error
260 */
261 static void sock_shutdown(struct nbd_device *nbd)
262 {
263 struct nbd_config *config = nbd->config;
264 int i;
265
266 if (config->num_connections == 0)
267 return;
268 if (test_and_set_bit(NBD_DISCONNECTED, &config->runtime_flags))
269 return;
270
271 for (i = 0; i < config->num_connections; i++) {
272 struct nbd_sock *nsock = config->socks[i];
273 mutex_lock(&nsock->tx_lock);
274 nbd_mark_nsock_dead(nbd, nsock, 0);
275 mutex_unlock(&nsock->tx_lock);
276 }
277 dev_warn(disk_to_dev(nbd->disk), "shutting down sockets\n");
278 }
279
280 static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
281 bool reserved)
282 {
283 struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req);
284 struct nbd_device *nbd = cmd->nbd;
285 struct nbd_config *config;
286
287 if (!refcount_inc_not_zero(&nbd->config_refs)) {
288 cmd->status = -EIO;
289 return BLK_EH_HANDLED;
290 }
291
292 /* If we are waiting on our dead timer then we could get timeout
293 * callbacks for our request. For this we just want to reset the timer
294 * and let the queue side take care of everything.
295 */
296 if (!completion_done(&cmd->send_complete)) {
297 nbd_config_put(nbd);
298 return BLK_EH_RESET_TIMER;
299 }
300 config = nbd->config;
301
302 if (config->num_connections > 1) {
303 dev_err_ratelimited(nbd_to_dev(nbd),
304 "Connection timed out, retrying\n");
305 /*
306 * Hooray we have more connections, requeue this IO, the submit
307 * path will put it on a real connection.
308 */
309 if (config->socks && config->num_connections > 1) {
310 if (cmd->index < config->num_connections) {
311 struct nbd_sock *nsock =
312 config->socks[cmd->index];
313 mutex_lock(&nsock->tx_lock);
314 /* We can have multiple outstanding requests, so
315 * we don't want to mark the nsock dead if we've
316 * already reconnected with a new socket, so
317 * only mark it dead if its the same socket we
318 * were sent out on.
319 */
320 if (cmd->cookie == nsock->cookie)
321 nbd_mark_nsock_dead(nbd, nsock, 1);
322 mutex_unlock(&nsock->tx_lock);
323 }
324 blk_mq_requeue_request(req, true);
325 nbd_config_put(nbd);
326 return BLK_EH_NOT_HANDLED;
327 }
328 } else {
329 dev_err_ratelimited(nbd_to_dev(nbd),
330 "Connection timed out\n");
331 }
332 set_bit(NBD_TIMEDOUT, &config->runtime_flags);
333 cmd->status = -EIO;
334 sock_shutdown(nbd);
335 nbd_config_put(nbd);
336
337 return BLK_EH_HANDLED;
338 }
339
340 /*
341 * Send or receive packet.
342 */
343 static int sock_xmit(struct nbd_device *nbd, int index, int send,
344 struct iov_iter *iter, int msg_flags, int *sent)
345 {
346 struct nbd_config *config = nbd->config;
347 struct socket *sock = config->socks[index]->sock;
348 int result;
349 struct msghdr msg;
350 unsigned long pflags = current->flags;
351
352 if (unlikely(!sock)) {
353 dev_err_ratelimited(disk_to_dev(nbd->disk),
354 "Attempted %s on closed socket in sock_xmit\n",
355 (send ? "send" : "recv"));
356 return -EINVAL;
357 }
358
359 msg.msg_iter = *iter;
360
361 current->flags |= PF_MEMALLOC;
362 do {
363 sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC;
364 msg.msg_name = NULL;
365 msg.msg_namelen = 0;
366 msg.msg_control = NULL;
367 msg.msg_controllen = 0;
368 msg.msg_flags = msg_flags | MSG_NOSIGNAL;
369
370 if (send)
371 result = sock_sendmsg(sock, &msg);
372 else
373 result = sock_recvmsg(sock, &msg, msg.msg_flags);
374
375 if (result <= 0) {
376 if (result == 0)
377 result = -EPIPE; /* short read */
378 break;
379 }
380 if (sent)
381 *sent += result;
382 } while (msg_data_left(&msg));
383
384 tsk_restore_flags(current, pflags, PF_MEMALLOC);
385
386 return result;
387 }
388
389 /* always call with the tx_lock held */
390 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
391 {
392 struct request *req = blk_mq_rq_from_pdu(cmd);
393 struct nbd_config *config = nbd->config;
394 struct nbd_sock *nsock = config->socks[index];
395 int result;
396 struct nbd_request request = {.magic = htonl(NBD_REQUEST_MAGIC)};
397 struct kvec iov = {.iov_base = &request, .iov_len = sizeof(request)};
398 struct iov_iter from;
399 unsigned long size = blk_rq_bytes(req);
400 struct bio *bio;
401 u32 type;
402 u32 tag = blk_mq_unique_tag(req);
403 int sent = nsock->sent, skip = 0;
404
405 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
406
407 switch (req_op(req)) {
408 case REQ_OP_DISCARD:
409 type = NBD_CMD_TRIM;
410 break;
411 case REQ_OP_FLUSH:
412 type = NBD_CMD_FLUSH;
413 break;
414 case REQ_OP_WRITE:
415 type = NBD_CMD_WRITE;
416 break;
417 case REQ_OP_READ:
418 type = NBD_CMD_READ;
419 break;
420 default:
421 return -EIO;
422 }
423
424 if (rq_data_dir(req) == WRITE &&
425 (config->flags & NBD_FLAG_READ_ONLY)) {
426 dev_err_ratelimited(disk_to_dev(nbd->disk),
427 "Write on read-only\n");
428 return -EIO;
429 }
430
431 /* We did a partial send previously, and we at least sent the whole
432 * request struct, so just go and send the rest of the pages in the
433 * request.
434 */
435 if (sent) {
436 if (sent >= sizeof(request)) {
437 skip = sent - sizeof(request);
438 goto send_pages;
439 }
440 iov_iter_advance(&from, sent);
441 }
442 cmd->index = index;
443 cmd->cookie = nsock->cookie;
444 request.type = htonl(type);
445 if (type != NBD_CMD_FLUSH) {
446 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
447 request.len = htonl(size);
448 }
449 memcpy(request.handle, &tag, sizeof(tag));
450
451 dev_dbg(nbd_to_dev(nbd), "request %p: sending control (%s@%llu,%uB)\n",
452 cmd, nbdcmd_to_ascii(type),
453 (unsigned long long)blk_rq_pos(req) << 9, blk_rq_bytes(req));
454 result = sock_xmit(nbd, index, 1, &from,
455 (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
456 if (result <= 0) {
457 if (result == -ERESTARTSYS) {
458 /* If we havne't sent anything we can just return BUSY,
459 * however if we have sent something we need to make
460 * sure we only allow this req to be sent until we are
461 * completely done.
462 */
463 if (sent) {
464 nsock->pending = req;
465 nsock->sent = sent;
466 }
467 return BLK_MQ_RQ_QUEUE_BUSY;
468 }
469 dev_err_ratelimited(disk_to_dev(nbd->disk),
470 "Send control failed (result %d)\n", result);
471 return -EAGAIN;
472 }
473 send_pages:
474 if (type != NBD_CMD_WRITE)
475 goto out;
476
477 bio = req->bio;
478 while (bio) {
479 struct bio *next = bio->bi_next;
480 struct bvec_iter iter;
481 struct bio_vec bvec;
482
483 bio_for_each_segment(bvec, bio, iter) {
484 bool is_last = !next && bio_iter_last(bvec, iter);
485 int flags = is_last ? 0 : MSG_MORE;
486
487 dev_dbg(nbd_to_dev(nbd), "request %p: sending %d bytes data\n",
488 cmd, bvec.bv_len);
489 iov_iter_bvec(&from, ITER_BVEC | WRITE,
490 &bvec, 1, bvec.bv_len);
491 if (skip) {
492 if (skip >= iov_iter_count(&from)) {
493 skip -= iov_iter_count(&from);
494 continue;
495 }
496 iov_iter_advance(&from, skip);
497 skip = 0;
498 }
499 result = sock_xmit(nbd, index, 1, &from, flags, &sent);
500 if (result <= 0) {
501 if (result == -ERESTARTSYS) {
502 /* We've already sent the header, we
503 * have no choice but to set pending and
504 * return BUSY.
505 */
506 nsock->pending = req;
507 nsock->sent = sent;
508 return BLK_MQ_RQ_QUEUE_BUSY;
509 }
510 dev_err(disk_to_dev(nbd->disk),
511 "Send data failed (result %d)\n",
512 result);
513 return -EAGAIN;
514 }
515 /*
516 * The completion might already have come in,
517 * so break for the last one instead of letting
518 * the iterator do it. This prevents use-after-free
519 * of the bio.
520 */
521 if (is_last)
522 break;
523 }
524 bio = next;
525 }
526 out:
527 nsock->pending = NULL;
528 nsock->sent = 0;
529 return 0;
530 }
531
532 /* NULL returned = something went wrong, inform userspace */
533 static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
534 {
535 struct nbd_config *config = nbd->config;
536 int result;
537 struct nbd_reply reply;
538 struct nbd_cmd *cmd;
539 struct request *req = NULL;
540 u16 hwq;
541 u32 tag;
542 struct kvec iov = {.iov_base = &reply, .iov_len = sizeof(reply)};
543 struct iov_iter to;
544
545 reply.magic = 0;
546 iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
547 result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
548 if (result <= 0) {
549 if (!nbd_disconnected(config))
550 dev_err(disk_to_dev(nbd->disk),
551 "Receive control failed (result %d)\n", result);
552 return ERR_PTR(result);
553 }
554
555 if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
556 dev_err(disk_to_dev(nbd->disk), "Wrong magic (0x%lx)\n",
557 (unsigned long)ntohl(reply.magic));
558 return ERR_PTR(-EPROTO);
559 }
560
561 memcpy(&tag, reply.handle, sizeof(u32));
562
563 hwq = blk_mq_unique_tag_to_hwq(tag);
564 if (hwq < nbd->tag_set.nr_hw_queues)
565 req = blk_mq_tag_to_rq(nbd->tag_set.tags[hwq],
566 blk_mq_unique_tag_to_tag(tag));
567 if (!req || !blk_mq_request_started(req)) {
568 dev_err(disk_to_dev(nbd->disk), "Unexpected reply (%d) %p\n",
569 tag, req);
570 return ERR_PTR(-ENOENT);
571 }
572 cmd = blk_mq_rq_to_pdu(req);
573 if (ntohl(reply.error)) {
574 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
575 ntohl(reply.error));
576 cmd->status = -EIO;
577 return cmd;
578 }
579
580 dev_dbg(nbd_to_dev(nbd), "request %p: got reply\n", cmd);
581 if (rq_data_dir(req) != WRITE) {
582 struct req_iterator iter;
583 struct bio_vec bvec;
584
585 rq_for_each_segment(bvec, req, iter) {
586 iov_iter_bvec(&to, ITER_BVEC | READ,
587 &bvec, 1, bvec.bv_len);
588 result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
589 if (result <= 0) {
590 dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n",
591 result);
592 /*
593 * If we've disconnected or we only have 1
594 * connection then we need to make sure we
595 * complete this request, otherwise error out
596 * and let the timeout stuff handle resubmitting
597 * this request onto another connection.
598 */
599 if (nbd_disconnected(config) ||
600 config->num_connections <= 1) {
601 cmd->status = -EIO;
602 return cmd;
603 }
604 return ERR_PTR(-EIO);
605 }
606 dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
607 cmd, bvec.bv_len);
608 }
609 } else {
610 /* See the comment in nbd_queue_rq. */
611 wait_for_completion(&cmd->send_complete);
612 }
613 return cmd;
614 }
615
616 static void recv_work(struct work_struct *work)
617 {
618 struct recv_thread_args *args = container_of(work,
619 struct recv_thread_args,
620 work);
621 struct nbd_device *nbd = args->nbd;
622 struct nbd_config *config = nbd->config;
623 struct nbd_cmd *cmd;
624 int ret = 0;
625
626 while (1) {
627 cmd = nbd_read_stat(nbd, args->index);
628 if (IS_ERR(cmd)) {
629 struct nbd_sock *nsock = config->socks[args->index];
630
631 mutex_lock(&nsock->tx_lock);
632 nbd_mark_nsock_dead(nbd, nsock, 1);
633 mutex_unlock(&nsock->tx_lock);
634 ret = PTR_ERR(cmd);
635 break;
636 }
637
638 blk_mq_complete_request(blk_mq_rq_from_pdu(cmd));
639 }
640 atomic_dec(&config->recv_threads);
641 wake_up(&config->recv_wq);
642 nbd_config_put(nbd);
643 kfree(args);
644 }
645
646 static void nbd_clear_req(struct request *req, void *data, bool reserved)
647 {
648 struct nbd_cmd *cmd;
649
650 if (!blk_mq_request_started(req))
651 return;
652 cmd = blk_mq_rq_to_pdu(req);
653 cmd->status = -EIO;
654 blk_mq_complete_request(req);
655 }
656
657 static void nbd_clear_que(struct nbd_device *nbd)
658 {
659 blk_mq_stop_hw_queues(nbd->disk->queue);
660 blk_mq_tagset_busy_iter(&nbd->tag_set, nbd_clear_req, NULL);
661 blk_mq_start_hw_queues(nbd->disk->queue);
662 dev_dbg(disk_to_dev(nbd->disk), "queue cleared\n");
663 }
664
665 static int find_fallback(struct nbd_device *nbd, int index)
666 {
667 struct nbd_config *config = nbd->config;
668 int new_index = -1;
669 struct nbd_sock *nsock = config->socks[index];
670 int fallback = nsock->fallback_index;
671
672 if (test_bit(NBD_DISCONNECTED, &config->runtime_flags))
673 return new_index;
674
675 if (config->num_connections <= 1) {
676 dev_err_ratelimited(disk_to_dev(nbd->disk),
677 "Attempted send on invalid socket\n");
678 return new_index;
679 }
680
681 if (fallback >= 0 && fallback < config->num_connections &&
682 !config->socks[fallback]->dead)
683 return fallback;
684
685 if (nsock->fallback_index < 0 ||
686 nsock->fallback_index >= config->num_connections ||
687 config->socks[nsock->fallback_index]->dead) {
688 int i;
689 for (i = 0; i < config->num_connections; i++) {
690 if (i == index)
691 continue;
692 if (!config->socks[i]->dead) {
693 new_index = i;
694 break;
695 }
696 }
697 nsock->fallback_index = new_index;
698 if (new_index < 0) {
699 dev_err_ratelimited(disk_to_dev(nbd->disk),
700 "Dead connection, failed to find a fallback\n");
701 return new_index;
702 }
703 }
704 new_index = nsock->fallback_index;
705 return new_index;
706 }
707
708 static int wait_for_reconnect(struct nbd_device *nbd)
709 {
710 struct nbd_config *config = nbd->config;
711 if (!config->dead_conn_timeout)
712 return 0;
713 if (test_bit(NBD_DISCONNECTED, &config->runtime_flags))
714 return 0;
715 wait_event_interruptible_timeout(config->conn_wait,
716 atomic_read(&config->live_connections),
717 config->dead_conn_timeout);
718 return atomic_read(&config->live_connections);
719 }
720
721 static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
722 {
723 struct request *req = blk_mq_rq_from_pdu(cmd);
724 struct nbd_device *nbd = cmd->nbd;
725 struct nbd_config *config;
726 struct nbd_sock *nsock;
727 int ret;
728
729 if (!refcount_inc_not_zero(&nbd->config_refs)) {
730 dev_err_ratelimited(disk_to_dev(nbd->disk),
731 "Socks array is empty\n");
732 return -EINVAL;
733 }
734 config = nbd->config;
735
736 if (index >= config->num_connections) {
737 dev_err_ratelimited(disk_to_dev(nbd->disk),
738 "Attempted send on invalid socket\n");
739 nbd_config_put(nbd);
740 return -EINVAL;
741 }
742 cmd->status = 0;
743 again:
744 nsock = config->socks[index];
745 mutex_lock(&nsock->tx_lock);
746 if (nsock->dead) {
747 int old_index = index;
748 index = find_fallback(nbd, index);
749 mutex_unlock(&nsock->tx_lock);
750 if (index < 0) {
751 if (wait_for_reconnect(nbd)) {
752 index = old_index;
753 goto again;
754 }
755 /* All the sockets should already be down at this point,
756 * we just want to make sure that DISCONNECTED is set so
757 * any requests that come in that were queue'ed waiting
758 * for the reconnect timer don't trigger the timer again
759 * and instead just error out.
760 */
761 sock_shutdown(nbd);
762 nbd_config_put(nbd);
763 return -EIO;
764 }
765 goto again;
766 }
767
768 /* Handle the case that we have a pending request that was partially
769 * transmitted that _has_ to be serviced first. We need to call requeue
770 * here so that it gets put _after_ the request that is already on the
771 * dispatch list.
772 */
773 if (unlikely(nsock->pending && nsock->pending != req)) {
774 blk_mq_requeue_request(req, true);
775 ret = 0;
776 goto out;
777 }
778 /*
779 * Some failures are related to the link going down, so anything that
780 * returns EAGAIN can be retried on a different socket.
781 */
782 ret = nbd_send_cmd(nbd, cmd, index);
783 if (ret == -EAGAIN) {
784 dev_err_ratelimited(disk_to_dev(nbd->disk),
785 "Request send failed trying another connection\n");
786 nbd_mark_nsock_dead(nbd, nsock, 1);
787 mutex_unlock(&nsock->tx_lock);
788 goto again;
789 }
790 out:
791 mutex_unlock(&nsock->tx_lock);
792 nbd_config_put(nbd);
793 return ret;
794 }
795
796 static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
797 const struct blk_mq_queue_data *bd)
798 {
799 struct nbd_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
800 int ret;
801
802 /*
803 * Since we look at the bio's to send the request over the network we
804 * need to make sure the completion work doesn't mark this request done
805 * before we are done doing our send. This keeps us from dereferencing
806 * freed data if we have particularly fast completions (ie we get the
807 * completion before we exit sock_xmit on the last bvec) or in the case
808 * that the server is misbehaving (or there was an error) before we're
809 * done sending everything over the wire.
810 */
811 init_completion(&cmd->send_complete);
812 blk_mq_start_request(bd->rq);
813
814 /* We can be called directly from the user space process, which means we
815 * could possibly have signals pending so our sendmsg will fail. In
816 * this case we need to return that we are busy, otherwise error out as
817 * appropriate.
818 */
819 ret = nbd_handle_cmd(cmd, hctx->queue_num);
820 if (ret < 0)
821 ret = BLK_MQ_RQ_QUEUE_ERROR;
822 if (!ret)
823 ret = BLK_MQ_RQ_QUEUE_OK;
824 complete(&cmd->send_complete);
825
826 return ret;
827 }
828
829 static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
830 bool netlink)
831 {
832 struct nbd_config *config = nbd->config;
833 struct socket *sock;
834 struct nbd_sock **socks;
835 struct nbd_sock *nsock;
836 int err;
837
838 sock = sockfd_lookup(arg, &err);
839 if (!sock)
840 return err;
841
842 if (!netlink && !nbd->task_setup &&
843 !test_bit(NBD_BOUND, &config->runtime_flags))
844 nbd->task_setup = current;
845
846 if (!netlink &&
847 (nbd->task_setup != current ||
848 test_bit(NBD_BOUND, &config->runtime_flags))) {
849 dev_err(disk_to_dev(nbd->disk),
850 "Device being setup by another task");
851 sockfd_put(sock);
852 return -EBUSY;
853 }
854
855 socks = krealloc(config->socks, (config->num_connections + 1) *
856 sizeof(struct nbd_sock *), GFP_KERNEL);
857 if (!socks) {
858 sockfd_put(sock);
859 return -ENOMEM;
860 }
861 nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL);
862 if (!nsock) {
863 sockfd_put(sock);
864 return -ENOMEM;
865 }
866
867 config->socks = socks;
868
869 nsock->fallback_index = -1;
870 nsock->dead = false;
871 mutex_init(&nsock->tx_lock);
872 nsock->sock = sock;
873 nsock->pending = NULL;
874 nsock->sent = 0;
875 nsock->cookie = 0;
876 socks[config->num_connections++] = nsock;
877 atomic_inc(&config->live_connections);
878
879 return 0;
880 }
881
882 static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
883 {
884 struct nbd_config *config = nbd->config;
885 struct socket *sock, *old;
886 struct recv_thread_args *args;
887 int i;
888 int err;
889
890 sock = sockfd_lookup(arg, &err);
891 if (!sock)
892 return err;
893
894 args = kzalloc(sizeof(*args), GFP_KERNEL);
895 if (!args) {
896 sockfd_put(sock);
897 return -ENOMEM;
898 }
899
900 for (i = 0; i < config->num_connections; i++) {
901 struct nbd_sock *nsock = config->socks[i];
902
903 if (!nsock->dead)
904 continue;
905
906 mutex_lock(&nsock->tx_lock);
907 if (!nsock->dead) {
908 mutex_unlock(&nsock->tx_lock);
909 continue;
910 }
911 sk_set_memalloc(sock->sk);
912 atomic_inc(&config->recv_threads);
913 refcount_inc(&nbd->config_refs);
914 old = nsock->sock;
915 nsock->fallback_index = -1;
916 nsock->sock = sock;
917 nsock->dead = false;
918 INIT_WORK(&args->work, recv_work);
919 args->index = i;
920 args->nbd = nbd;
921 nsock->cookie++;
922 mutex_unlock(&nsock->tx_lock);
923 sockfd_put(old);
924
925 /* We take the tx_mutex in an error path in the recv_work, so we
926 * need to queue_work outside of the tx_mutex.
927 */
928 queue_work(recv_workqueue, &args->work);
929
930 atomic_inc(&config->live_connections);
931 wake_up(&config->conn_wait);
932 return 0;
933 }
934 sockfd_put(sock);
935 kfree(args);
936 return -ENOSPC;
937 }
938
939 /* Reset all properties of an NBD device */
940 static void nbd_reset(struct nbd_device *nbd)
941 {
942 nbd->config = NULL;
943 nbd->tag_set.timeout = 0;
944 queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
945 }
946
947 static void nbd_bdev_reset(struct block_device *bdev)
948 {
949 if (bdev->bd_openers > 1)
950 return;
951 bd_set_size(bdev, 0);
952 if (max_part > 0) {
953 blkdev_reread_part(bdev);
954 bdev->bd_invalidated = 1;
955 }
956 }
957
958 static void nbd_parse_flags(struct nbd_device *nbd)
959 {
960 struct nbd_config *config = nbd->config;
961 if (config->flags & NBD_FLAG_READ_ONLY)
962 set_disk_ro(nbd->disk, true);
963 else
964 set_disk_ro(nbd->disk, false);
965 if (config->flags & NBD_FLAG_SEND_TRIM)
966 queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
967 if (config->flags & NBD_FLAG_SEND_FLUSH)
968 blk_queue_write_cache(nbd->disk->queue, true, false);
969 else
970 blk_queue_write_cache(nbd->disk->queue, false, false);
971 }
972
973 static void send_disconnects(struct nbd_device *nbd)
974 {
975 struct nbd_config *config = nbd->config;
976 struct nbd_request request = {
977 .magic = htonl(NBD_REQUEST_MAGIC),
978 .type = htonl(NBD_CMD_DISC),
979 };
980 struct kvec iov = {.iov_base = &request, .iov_len = sizeof(request)};
981 struct iov_iter from;
982 int i, ret;
983
984 for (i = 0; i < config->num_connections; i++) {
985 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
986 ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
987 if (ret <= 0)
988 dev_err(disk_to_dev(nbd->disk),
989 "Send disconnect failed %d\n", ret);
990 }
991 }
992
993 static int nbd_disconnect(struct nbd_device *nbd)
994 {
995 struct nbd_config *config = nbd->config;
996
997 dev_info(disk_to_dev(nbd->disk), "NBD_DISCONNECT\n");
998 if (!test_and_set_bit(NBD_DISCONNECT_REQUESTED,
999 &config->runtime_flags))
1000 send_disconnects(nbd);
1001 return 0;
1002 }
1003
1004 static void nbd_clear_sock(struct nbd_device *nbd)
1005 {
1006 sock_shutdown(nbd);
1007 nbd_clear_que(nbd);
1008 nbd->task_setup = NULL;
1009 }
1010
1011 static void nbd_config_put(struct nbd_device *nbd)
1012 {
1013 if (refcount_dec_and_mutex_lock(&nbd->config_refs,
1014 &nbd->config_lock)) {
1015 struct nbd_config *config = nbd->config;
1016 nbd_dev_dbg_close(nbd);
1017 nbd_size_clear(nbd);
1018 if (test_and_clear_bit(NBD_HAS_PID_FILE,
1019 &config->runtime_flags))
1020 device_remove_file(disk_to_dev(nbd->disk), &pid_attr);
1021 nbd->task_recv = NULL;
1022 nbd_clear_sock(nbd);
1023 if (config->num_connections) {
1024 int i;
1025 for (i = 0; i < config->num_connections; i++) {
1026 sockfd_put(config->socks[i]->sock);
1027 kfree(config->socks[i]);
1028 }
1029 kfree(config->socks);
1030 }
1031 nbd_reset(nbd);
1032
1033 mutex_unlock(&nbd->config_lock);
1034 nbd_put(nbd);
1035 module_put(THIS_MODULE);
1036 }
1037 }
1038
1039 static int nbd_start_device(struct nbd_device *nbd)
1040 {
1041 struct nbd_config *config = nbd->config;
1042 int num_connections = config->num_connections;
1043 int error = 0, i;
1044
1045 if (nbd->task_recv)
1046 return -EBUSY;
1047 if (!config->socks)
1048 return -EINVAL;
1049 if (num_connections > 1 &&
1050 !(config->flags & NBD_FLAG_CAN_MULTI_CONN)) {
1051 dev_err(disk_to_dev(nbd->disk), "server does not support multiple connections per device.\n");
1052 return -EINVAL;
1053 }
1054
1055 blk_mq_update_nr_hw_queues(&nbd->tag_set, config->num_connections);
1056 nbd->task_recv = current;
1057
1058 nbd_parse_flags(nbd);
1059
1060 error = device_create_file(disk_to_dev(nbd->disk), &pid_attr);
1061 if (error) {
1062 dev_err(disk_to_dev(nbd->disk), "device_create_file failed!\n");
1063 return error;
1064 }
1065 set_bit(NBD_HAS_PID_FILE, &config->runtime_flags);
1066
1067 nbd_dev_dbg_init(nbd);
1068 for (i = 0; i < num_connections; i++) {
1069 struct recv_thread_args *args;
1070
1071 args = kzalloc(sizeof(*args), GFP_KERNEL);
1072 if (!args) {
1073 sock_shutdown(nbd);
1074 return -ENOMEM;
1075 }
1076 sk_set_memalloc(config->socks[i]->sock->sk);
1077 atomic_inc(&config->recv_threads);
1078 refcount_inc(&nbd->config_refs);
1079 INIT_WORK(&args->work, recv_work);
1080 args->nbd = nbd;
1081 args->index = i;
1082 queue_work(recv_workqueue, &args->work);
1083 }
1084 return error;
1085 }
1086
1087 static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *bdev)
1088 {
1089 struct nbd_config *config = nbd->config;
1090 int ret;
1091
1092 ret = nbd_start_device(nbd);
1093 if (ret)
1094 return ret;
1095
1096 bd_set_size(bdev, config->bytesize);
1097 if (max_part)
1098 bdev->bd_invalidated = 1;
1099 mutex_unlock(&nbd->config_lock);
1100 ret = wait_event_interruptible(config->recv_wq,
1101 atomic_read(&config->recv_threads) == 0);
1102 if (ret)
1103 sock_shutdown(nbd);
1104 mutex_lock(&nbd->config_lock);
1105 bd_set_size(bdev, 0);
1106 /* user requested, ignore socket errors */
1107 if (test_bit(NBD_DISCONNECT_REQUESTED, &config->runtime_flags))
1108 ret = 0;
1109 if (test_bit(NBD_TIMEDOUT, &config->runtime_flags))
1110 ret = -ETIMEDOUT;
1111 return ret;
1112 }
1113
1114 static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
1115 struct block_device *bdev)
1116 {
1117 sock_shutdown(nbd);
1118 kill_bdev(bdev);
1119 nbd_bdev_reset(bdev);
1120 if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
1121 &nbd->config->runtime_flags))
1122 nbd_config_put(nbd);
1123 }
1124
1125 /* Must be called with config_lock held */
1126 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
1127 unsigned int cmd, unsigned long arg)
1128 {
1129 struct nbd_config *config = nbd->config;
1130
1131 switch (cmd) {
1132 case NBD_DISCONNECT:
1133 return nbd_disconnect(nbd);
1134 case NBD_CLEAR_SOCK:
1135 nbd_clear_sock_ioctl(nbd, bdev);
1136 return 0;
1137 case NBD_SET_SOCK:
1138 return nbd_add_socket(nbd, arg, false);
1139 case NBD_SET_BLKSIZE:
1140 nbd_size_set(nbd, arg,
1141 div_s64(config->bytesize, arg));
1142 return 0;
1143 case NBD_SET_SIZE:
1144 nbd_size_set(nbd, config->blksize,
1145 div_s64(arg, config->blksize));
1146 return 0;
1147 case NBD_SET_SIZE_BLOCKS:
1148 nbd_size_set(nbd, config->blksize, arg);
1149 return 0;
1150 case NBD_SET_TIMEOUT:
1151 if (arg) {
1152 nbd->tag_set.timeout = arg * HZ;
1153 blk_queue_rq_timeout(nbd->disk->queue, arg * HZ);
1154 }
1155 return 0;
1156
1157 case NBD_SET_FLAGS:
1158 config->flags = arg;
1159 return 0;
1160 case NBD_DO_IT:
1161 return nbd_start_device_ioctl(nbd, bdev);
1162 case NBD_CLEAR_QUE:
1163 /*
1164 * This is for compatibility only. The queue is always cleared
1165 * by NBD_DO_IT or NBD_CLEAR_SOCK.
1166 */
1167 return 0;
1168 case NBD_PRINT_DEBUG:
1169 /*
1170 * For compatibility only, we no longer keep a list of
1171 * outstanding requests.
1172 */
1173 return 0;
1174 }
1175 return -ENOTTY;
1176 }
1177
1178 static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
1179 unsigned int cmd, unsigned long arg)
1180 {
1181 struct nbd_device *nbd = bdev->bd_disk->private_data;
1182 struct nbd_config *config = nbd->config;
1183 int error = -EINVAL;
1184
1185 if (!capable(CAP_SYS_ADMIN))
1186 return -EPERM;
1187
1188 mutex_lock(&nbd->config_lock);
1189
1190 /* Don't allow ioctl operations on a nbd device that was created with
1191 * netlink, unless it's DISCONNECT or CLEAR_SOCK, which are fine.
1192 */
1193 if (!test_bit(NBD_BOUND, &config->runtime_flags) ||
1194 (cmd == NBD_DISCONNECT || cmd == NBD_CLEAR_SOCK))
1195 error = __nbd_ioctl(bdev, nbd, cmd, arg);
1196 else
1197 dev_err(nbd_to_dev(nbd), "Cannot use ioctl interface on a netlink controlled device.\n");
1198 mutex_unlock(&nbd->config_lock);
1199 return error;
1200 }
1201
1202 static struct nbd_config *nbd_alloc_config(void)
1203 {
1204 struct nbd_config *config;
1205
1206 config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
1207 if (!config)
1208 return NULL;
1209 atomic_set(&config->recv_threads, 0);
1210 init_waitqueue_head(&config->recv_wq);
1211 init_waitqueue_head(&config->conn_wait);
1212 config->blksize = 1024;
1213 atomic_set(&config->live_connections, 0);
1214 try_module_get(THIS_MODULE);
1215 return config;
1216 }
1217
1218 static int nbd_open(struct block_device *bdev, fmode_t mode)
1219 {
1220 struct nbd_device *nbd;
1221 int ret = 0;
1222
1223 mutex_lock(&nbd_index_mutex);
1224 nbd = bdev->bd_disk->private_data;
1225 if (!nbd) {
1226 ret = -ENXIO;
1227 goto out;
1228 }
1229 if (!refcount_inc_not_zero(&nbd->refs)) {
1230 ret = -ENXIO;
1231 goto out;
1232 }
1233 if (!refcount_inc_not_zero(&nbd->config_refs)) {
1234 struct nbd_config *config;
1235
1236 mutex_lock(&nbd->config_lock);
1237 if (refcount_inc_not_zero(&nbd->config_refs)) {
1238 mutex_unlock(&nbd->config_lock);
1239 goto out;
1240 }
1241 config = nbd->config = nbd_alloc_config();
1242 if (!config) {
1243 ret = -ENOMEM;
1244 mutex_unlock(&nbd->config_lock);
1245 goto out;
1246 }
1247 refcount_set(&nbd->config_refs, 1);
1248 refcount_inc(&nbd->refs);
1249 mutex_unlock(&nbd->config_lock);
1250 }
1251 out:
1252 mutex_unlock(&nbd_index_mutex);
1253 return ret;
1254 }
1255
1256 static void nbd_release(struct gendisk *disk, fmode_t mode)
1257 {
1258 struct nbd_device *nbd = disk->private_data;
1259 nbd_config_put(nbd);
1260 nbd_put(nbd);
1261 }
1262
1263 static const struct block_device_operations nbd_fops =
1264 {
1265 .owner = THIS_MODULE,
1266 .open = nbd_open,
1267 .release = nbd_release,
1268 .ioctl = nbd_ioctl,
1269 .compat_ioctl = nbd_ioctl,
1270 };
1271
1272 #if IS_ENABLED(CONFIG_DEBUG_FS)
1273
1274 static int nbd_dbg_tasks_show(struct seq_file *s, void *unused)
1275 {
1276 struct nbd_device *nbd = s->private;
1277
1278 if (nbd->task_recv)
1279 seq_printf(s, "recv: %d\n", task_pid_nr(nbd->task_recv));
1280
1281 return 0;
1282 }
1283
1284 static int nbd_dbg_tasks_open(struct inode *inode, struct file *file)
1285 {
1286 return single_open(file, nbd_dbg_tasks_show, inode->i_private);
1287 }
1288
1289 static const struct file_operations nbd_dbg_tasks_ops = {
1290 .open = nbd_dbg_tasks_open,
1291 .read = seq_read,
1292 .llseek = seq_lseek,
1293 .release = single_release,
1294 };
1295
1296 static int nbd_dbg_flags_show(struct seq_file *s, void *unused)
1297 {
1298 struct nbd_device *nbd = s->private;
1299 u32 flags = nbd->config->flags;
1300
1301 seq_printf(s, "Hex: 0x%08x\n\n", flags);
1302
1303 seq_puts(s, "Known flags:\n");
1304
1305 if (flags & NBD_FLAG_HAS_FLAGS)
1306 seq_puts(s, "NBD_FLAG_HAS_FLAGS\n");
1307 if (flags & NBD_FLAG_READ_ONLY)
1308 seq_puts(s, "NBD_FLAG_READ_ONLY\n");
1309 if (flags & NBD_FLAG_SEND_FLUSH)
1310 seq_puts(s, "NBD_FLAG_SEND_FLUSH\n");
1311 if (flags & NBD_FLAG_SEND_TRIM)
1312 seq_puts(s, "NBD_FLAG_SEND_TRIM\n");
1313
1314 return 0;
1315 }
1316
1317 static int nbd_dbg_flags_open(struct inode *inode, struct file *file)
1318 {
1319 return single_open(file, nbd_dbg_flags_show, inode->i_private);
1320 }
1321
1322 static const struct file_operations nbd_dbg_flags_ops = {
1323 .open = nbd_dbg_flags_open,
1324 .read = seq_read,
1325 .llseek = seq_lseek,
1326 .release = single_release,
1327 };
1328
1329 static int nbd_dev_dbg_init(struct nbd_device *nbd)
1330 {
1331 struct dentry *dir;
1332 struct nbd_config *config = nbd->config;
1333
1334 if (!nbd_dbg_dir)
1335 return -EIO;
1336
1337 dir = debugfs_create_dir(nbd_name(nbd), nbd_dbg_dir);
1338 if (!dir) {
1339 dev_err(nbd_to_dev(nbd), "Failed to create debugfs dir for '%s'\n",
1340 nbd_name(nbd));
1341 return -EIO;
1342 }
1343 config->dbg_dir = dir;
1344
1345 debugfs_create_file("tasks", 0444, dir, nbd, &nbd_dbg_tasks_ops);
1346 debugfs_create_u64("size_bytes", 0444, dir, &config->bytesize);
1347 debugfs_create_u32("timeout", 0444, dir, &nbd->tag_set.timeout);
1348 debugfs_create_u64("blocksize", 0444, dir, &config->blksize);
1349 debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_ops);
1350
1351 return 0;
1352 }
1353
1354 static void nbd_dev_dbg_close(struct nbd_device *nbd)
1355 {
1356 debugfs_remove_recursive(nbd->config->dbg_dir);
1357 }
1358
1359 static int nbd_dbg_init(void)
1360 {
1361 struct dentry *dbg_dir;
1362
1363 dbg_dir = debugfs_create_dir("nbd", NULL);
1364 if (!dbg_dir)
1365 return -EIO;
1366
1367 nbd_dbg_dir = dbg_dir;
1368
1369 return 0;
1370 }
1371
1372 static void nbd_dbg_close(void)
1373 {
1374 debugfs_remove_recursive(nbd_dbg_dir);
1375 }
1376
1377 #else /* IS_ENABLED(CONFIG_DEBUG_FS) */
1378
1379 static int nbd_dev_dbg_init(struct nbd_device *nbd)
1380 {
1381 return 0;
1382 }
1383
1384 static void nbd_dev_dbg_close(struct nbd_device *nbd)
1385 {
1386 }
1387
1388 static int nbd_dbg_init(void)
1389 {
1390 return 0;
1391 }
1392
1393 static void nbd_dbg_close(void)
1394 {
1395 }
1396
1397 #endif
1398
1399 static int nbd_init_request(void *data, struct request *rq,
1400 unsigned int hctx_idx, unsigned int request_idx,
1401 unsigned int numa_node)
1402 {
1403 struct nbd_cmd *cmd = blk_mq_rq_to_pdu(rq);
1404 cmd->nbd = data;
1405 return 0;
1406 }
1407
1408 static const struct blk_mq_ops nbd_mq_ops = {
1409 .queue_rq = nbd_queue_rq,
1410 .complete = nbd_complete_rq,
1411 .init_request = nbd_init_request,
1412 .timeout = nbd_xmit_timeout,
1413 };
1414
1415 static int nbd_dev_add(int index)
1416 {
1417 struct nbd_device *nbd;
1418 struct gendisk *disk;
1419 struct request_queue *q;
1420 int err = -ENOMEM;
1421
1422 nbd = kzalloc(sizeof(struct nbd_device), GFP_KERNEL);
1423 if (!nbd)
1424 goto out;
1425
1426 disk = alloc_disk(1 << part_shift);
1427 if (!disk)
1428 goto out_free_nbd;
1429
1430 if (index >= 0) {
1431 err = idr_alloc(&nbd_index_idr, nbd, index, index + 1,
1432 GFP_KERNEL);
1433 if (err == -ENOSPC)
1434 err = -EEXIST;
1435 } else {
1436 err = idr_alloc(&nbd_index_idr, nbd, 0, 0, GFP_KERNEL);
1437 if (err >= 0)
1438 index = err;
1439 }
1440 if (err < 0)
1441 goto out_free_disk;
1442
1443 nbd->index = index;
1444 nbd->disk = disk;
1445 nbd->tag_set.ops = &nbd_mq_ops;
1446 nbd->tag_set.nr_hw_queues = 1;
1447 nbd->tag_set.queue_depth = 128;
1448 nbd->tag_set.numa_node = NUMA_NO_NODE;
1449 nbd->tag_set.cmd_size = sizeof(struct nbd_cmd);
1450 nbd->tag_set.flags = BLK_MQ_F_SHOULD_MERGE |
1451 BLK_MQ_F_SG_MERGE | BLK_MQ_F_BLOCKING;
1452 nbd->tag_set.driver_data = nbd;
1453
1454 err = blk_mq_alloc_tag_set(&nbd->tag_set);
1455 if (err)
1456 goto out_free_idr;
1457
1458 q = blk_mq_init_queue(&nbd->tag_set);
1459 if (IS_ERR(q)) {
1460 err = PTR_ERR(q);
1461 goto out_free_tags;
1462 }
1463 disk->queue = q;
1464
1465 /*
1466 * Tell the block layer that we are not a rotational device
1467 */
1468 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, disk->queue);
1469 queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, disk->queue);
1470 disk->queue->limits.discard_granularity = 512;
1471 blk_queue_max_discard_sectors(disk->queue, UINT_MAX);
1472 blk_queue_max_segment_size(disk->queue, UINT_MAX);
1473 blk_queue_max_segments(disk->queue, USHRT_MAX);
1474 blk_queue_max_hw_sectors(disk->queue, 65536);
1475 disk->queue->limits.max_sectors = 256;
1476
1477 mutex_init(&nbd->config_lock);
1478 refcount_set(&nbd->config_refs, 0);
1479 refcount_set(&nbd->refs, 1);
1480 INIT_LIST_HEAD(&nbd->list);
1481 disk->major = NBD_MAJOR;
1482 disk->first_minor = index << part_shift;
1483 disk->fops = &nbd_fops;
1484 disk->private_data = nbd;
1485 sprintf(disk->disk_name, "nbd%d", index);
1486 nbd_reset(nbd);
1487 add_disk(disk);
1488 nbd_total_devices++;
1489 return index;
1490
1491 out_free_tags:
1492 blk_mq_free_tag_set(&nbd->tag_set);
1493 out_free_idr:
1494 idr_remove(&nbd_index_idr, index);
1495 out_free_disk:
1496 put_disk(disk);
1497 out_free_nbd:
1498 kfree(nbd);
1499 out:
1500 return err;
1501 }
1502
1503 static int find_free_cb(int id, void *ptr, void *data)
1504 {
1505 struct nbd_device *nbd = ptr;
1506 struct nbd_device **found = data;
1507
1508 if (!refcount_read(&nbd->config_refs)) {
1509 *found = nbd;
1510 return 1;
1511 }
1512 return 0;
1513 }
1514
1515 /* Netlink interface. */
1516 static struct nla_policy nbd_attr_policy[NBD_ATTR_MAX + 1] = {
1517 [NBD_ATTR_INDEX] = { .type = NLA_U32 },
1518 [NBD_ATTR_SIZE_BYTES] = { .type = NLA_U64 },
1519 [NBD_ATTR_BLOCK_SIZE_BYTES] = { .type = NLA_U64 },
1520 [NBD_ATTR_TIMEOUT] = { .type = NLA_U64 },
1521 [NBD_ATTR_SERVER_FLAGS] = { .type = NLA_U64 },
1522 [NBD_ATTR_CLIENT_FLAGS] = { .type = NLA_U64 },
1523 [NBD_ATTR_SOCKETS] = { .type = NLA_NESTED},
1524 [NBD_ATTR_DEAD_CONN_TIMEOUT] = { .type = NLA_U64 },
1525 [NBD_ATTR_DEVICE_LIST] = { .type = NLA_NESTED},
1526 };
1527
1528 static struct nla_policy nbd_sock_policy[NBD_SOCK_MAX + 1] = {
1529 [NBD_SOCK_FD] = { .type = NLA_U32 },
1530 };
1531
1532 /* We don't use this right now since we don't parse the incoming list, but we
1533 * still want it here so userspace knows what to expect.
1534 */
1535 static struct nla_policy __attribute__((unused))
1536 nbd_device_policy[NBD_DEVICE_ATTR_MAX + 1] = {
1537 [NBD_DEVICE_INDEX] = { .type = NLA_U32 },
1538 [NBD_DEVICE_CONNECTED] = { .type = NLA_U8 },
1539 };
1540
1541 static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
1542 {
1543 struct nbd_device *nbd = NULL;
1544 struct nbd_config *config;
1545 int index = -1;
1546 int ret;
1547 bool put_dev = false;
1548
1549 if (!netlink_capable(skb, CAP_SYS_ADMIN))
1550 return -EPERM;
1551
1552 if (info->attrs[NBD_ATTR_INDEX])
1553 index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
1554 if (!info->attrs[NBD_ATTR_SOCKETS]) {
1555 printk(KERN_ERR "nbd: must specify at least one socket\n");
1556 return -EINVAL;
1557 }
1558 if (!info->attrs[NBD_ATTR_SIZE_BYTES]) {
1559 printk(KERN_ERR "nbd: must specify a size in bytes for the device\n");
1560 return -EINVAL;
1561 }
1562 again:
1563 mutex_lock(&nbd_index_mutex);
1564 if (index == -1) {
1565 ret = idr_for_each(&nbd_index_idr, &find_free_cb, &nbd);
1566 if (ret == 0) {
1567 int new_index;
1568 new_index = nbd_dev_add(-1);
1569 if (new_index < 0) {
1570 mutex_unlock(&nbd_index_mutex);
1571 printk(KERN_ERR "nbd: failed to add new device\n");
1572 return ret;
1573 }
1574 nbd = idr_find(&nbd_index_idr, new_index);
1575 }
1576 } else {
1577 nbd = idr_find(&nbd_index_idr, index);
1578 }
1579 if (!nbd) {
1580 printk(KERN_ERR "nbd: couldn't find device at index %d\n",
1581 index);
1582 mutex_unlock(&nbd_index_mutex);
1583 return -EINVAL;
1584 }
1585 if (!refcount_inc_not_zero(&nbd->refs)) {
1586 mutex_unlock(&nbd_index_mutex);
1587 if (index == -1)
1588 goto again;
1589 printk(KERN_ERR "nbd: device at index %d is going down\n",
1590 index);
1591 return -EINVAL;
1592 }
1593 mutex_unlock(&nbd_index_mutex);
1594
1595 mutex_lock(&nbd->config_lock);
1596 if (refcount_read(&nbd->config_refs)) {
1597 mutex_unlock(&nbd->config_lock);
1598 nbd_put(nbd);
1599 if (index == -1)
1600 goto again;
1601 printk(KERN_ERR "nbd: nbd%d already in use\n", index);
1602 return -EBUSY;
1603 }
1604 if (WARN_ON(nbd->config)) {
1605 mutex_unlock(&nbd->config_lock);
1606 nbd_put(nbd);
1607 return -EINVAL;
1608 }
1609 config = nbd->config = nbd_alloc_config();
1610 if (!nbd->config) {
1611 mutex_unlock(&nbd->config_lock);
1612 nbd_put(nbd);
1613 printk(KERN_ERR "nbd: couldn't allocate config\n");
1614 return -ENOMEM;
1615 }
1616 refcount_set(&nbd->config_refs, 1);
1617 set_bit(NBD_BOUND, &config->runtime_flags);
1618
1619 if (info->attrs[NBD_ATTR_SIZE_BYTES]) {
1620 u64 bytes = nla_get_u64(info->attrs[NBD_ATTR_SIZE_BYTES]);
1621 nbd_size_set(nbd, config->blksize,
1622 div64_u64(bytes, config->blksize));
1623 }
1624 if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
1625 u64 bsize =
1626 nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
1627 nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
1628 }
1629 if (info->attrs[NBD_ATTR_TIMEOUT]) {
1630 u64 timeout = nla_get_u64(info->attrs[NBD_ATTR_TIMEOUT]);
1631 nbd->tag_set.timeout = timeout * HZ;
1632 blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ);
1633 }
1634 if (info->attrs[NBD_ATTR_DEAD_CONN_TIMEOUT]) {
1635 config->dead_conn_timeout =
1636 nla_get_u64(info->attrs[NBD_ATTR_DEAD_CONN_TIMEOUT]);
1637 config->dead_conn_timeout *= HZ;
1638 }
1639 if (info->attrs[NBD_ATTR_SERVER_FLAGS])
1640 config->flags =
1641 nla_get_u64(info->attrs[NBD_ATTR_SERVER_FLAGS]);
1642 if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) {
1643 u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]);
1644 if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) {
1645 set_bit(NBD_DESTROY_ON_DISCONNECT,
1646 &config->runtime_flags);
1647 put_dev = true;
1648 }
1649 }
1650
1651 if (info->attrs[NBD_ATTR_SOCKETS]) {
1652 struct nlattr *attr;
1653 int rem, fd;
1654
1655 nla_for_each_nested(attr, info->attrs[NBD_ATTR_SOCKETS],
1656 rem) {
1657 struct nlattr *socks[NBD_SOCK_MAX+1];
1658
1659 if (nla_type(attr) != NBD_SOCK_ITEM) {
1660 printk(KERN_ERR "nbd: socks must be embedded in a SOCK_ITEM attr\n");
1661 ret = -EINVAL;
1662 goto out;
1663 }
1664 ret = nla_parse_nested(socks, NBD_SOCK_MAX, attr,
1665 nbd_sock_policy);
1666 if (ret != 0) {
1667 printk(KERN_ERR "nbd: error processing sock list\n");
1668 ret = -EINVAL;
1669 goto out;
1670 }
1671 if (!socks[NBD_SOCK_FD])
1672 continue;
1673 fd = (int)nla_get_u32(socks[NBD_SOCK_FD]);
1674 ret = nbd_add_socket(nbd, fd, true);
1675 if (ret)
1676 goto out;
1677 }
1678 }
1679 ret = nbd_start_device(nbd);
1680 out:
1681 mutex_unlock(&nbd->config_lock);
1682 if (!ret) {
1683 set_bit(NBD_HAS_CONFIG_REF, &config->runtime_flags);
1684 refcount_inc(&nbd->config_refs);
1685 nbd_connect_reply(info, nbd->index);
1686 }
1687 nbd_config_put(nbd);
1688 if (put_dev)
1689 nbd_put(nbd);
1690 return ret;
1691 }
1692
1693 static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info)
1694 {
1695 struct nbd_device *nbd;
1696 int index;
1697
1698 if (!netlink_capable(skb, CAP_SYS_ADMIN))
1699 return -EPERM;
1700
1701 if (!info->attrs[NBD_ATTR_INDEX]) {
1702 printk(KERN_ERR "nbd: must specify an index to disconnect\n");
1703 return -EINVAL;
1704 }
1705 index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
1706 mutex_lock(&nbd_index_mutex);
1707 nbd = idr_find(&nbd_index_idr, index);
1708 if (!nbd) {
1709 mutex_unlock(&nbd_index_mutex);
1710 printk(KERN_ERR "nbd: couldn't find device at index %d\n",
1711 index);
1712 return -EINVAL;
1713 }
1714 if (!refcount_inc_not_zero(&nbd->refs)) {
1715 mutex_unlock(&nbd_index_mutex);
1716 printk(KERN_ERR "nbd: device at index %d is going down\n",
1717 index);
1718 return -EINVAL;
1719 }
1720 mutex_unlock(&nbd_index_mutex);
1721 if (!refcount_inc_not_zero(&nbd->config_refs)) {
1722 nbd_put(nbd);
1723 return 0;
1724 }
1725 mutex_lock(&nbd->config_lock);
1726 nbd_disconnect(nbd);
1727 mutex_unlock(&nbd->config_lock);
1728 if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
1729 &nbd->config->runtime_flags))
1730 nbd_config_put(nbd);
1731 nbd_config_put(nbd);
1732 nbd_put(nbd);
1733 return 0;
1734 }
1735
1736 static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
1737 {
1738 struct nbd_device *nbd = NULL;
1739 struct nbd_config *config;
1740 int index;
1741 int ret = -EINVAL;
1742 bool put_dev = false;
1743
1744 if (!netlink_capable(skb, CAP_SYS_ADMIN))
1745 return -EPERM;
1746
1747 if (!info->attrs[NBD_ATTR_INDEX]) {
1748 printk(KERN_ERR "nbd: must specify a device to reconfigure\n");
1749 return -EINVAL;
1750 }
1751 index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
1752 mutex_lock(&nbd_index_mutex);
1753 nbd = idr_find(&nbd_index_idr, index);
1754 if (!nbd) {
1755 mutex_unlock(&nbd_index_mutex);
1756 printk(KERN_ERR "nbd: couldn't find a device at index %d\n",
1757 index);
1758 return -EINVAL;
1759 }
1760 if (!refcount_inc_not_zero(&nbd->refs)) {
1761 mutex_unlock(&nbd_index_mutex);
1762 printk(KERN_ERR "nbd: device at index %d is going down\n",
1763 index);
1764 return -EINVAL;
1765 }
1766 mutex_unlock(&nbd_index_mutex);
1767
1768 if (!refcount_inc_not_zero(&nbd->config_refs)) {
1769 dev_err(nbd_to_dev(nbd),
1770 "not configured, cannot reconfigure\n");
1771 nbd_put(nbd);
1772 return -EINVAL;
1773 }
1774
1775 mutex_lock(&nbd->config_lock);
1776 config = nbd->config;
1777 if (!test_bit(NBD_BOUND, &config->runtime_flags) ||
1778 !nbd->task_recv) {
1779 dev_err(nbd_to_dev(nbd),
1780 "not configured, cannot reconfigure\n");
1781 goto out;
1782 }
1783
1784 if (info->attrs[NBD_ATTR_TIMEOUT]) {
1785 u64 timeout = nla_get_u64(info->attrs[NBD_ATTR_TIMEOUT]);
1786 nbd->tag_set.timeout = timeout * HZ;
1787 blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ);
1788 }
1789 if (info->attrs[NBD_ATTR_DEAD_CONN_TIMEOUT]) {
1790 config->dead_conn_timeout =
1791 nla_get_u64(info->attrs[NBD_ATTR_DEAD_CONN_TIMEOUT]);
1792 config->dead_conn_timeout *= HZ;
1793 }
1794 if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) {
1795 u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]);
1796 if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) {
1797 if (!test_and_set_bit(NBD_DESTROY_ON_DISCONNECT,
1798 &config->runtime_flags))
1799 put_dev = true;
1800 } else {
1801 if (test_and_clear_bit(NBD_DESTROY_ON_DISCONNECT,
1802 &config->runtime_flags))
1803 refcount_inc(&nbd->refs);
1804 }
1805 }
1806
1807 if (info->attrs[NBD_ATTR_SOCKETS]) {
1808 struct nlattr *attr;
1809 int rem, fd;
1810
1811 nla_for_each_nested(attr, info->attrs[NBD_ATTR_SOCKETS],
1812 rem) {
1813 struct nlattr *socks[NBD_SOCK_MAX+1];
1814
1815 if (nla_type(attr) != NBD_SOCK_ITEM) {
1816 printk(KERN_ERR "nbd: socks must be embedded in a SOCK_ITEM attr\n");
1817 ret = -EINVAL;
1818 goto out;
1819 }
1820 ret = nla_parse_nested(socks, NBD_SOCK_MAX, attr,
1821 nbd_sock_policy);
1822 if (ret != 0) {
1823 printk(KERN_ERR "nbd: error processing sock list\n");
1824 ret = -EINVAL;
1825 goto out;
1826 }
1827 if (!socks[NBD_SOCK_FD])
1828 continue;
1829 fd = (int)nla_get_u32(socks[NBD_SOCK_FD]);
1830 ret = nbd_reconnect_socket(nbd, fd);
1831 if (ret) {
1832 if (ret == -ENOSPC)
1833 ret = 0;
1834 goto out;
1835 }
1836 dev_info(nbd_to_dev(nbd), "reconnected socket\n");
1837 }
1838 }
1839 out:
1840 mutex_unlock(&nbd->config_lock);
1841 nbd_config_put(nbd);
1842 nbd_put(nbd);
1843 if (put_dev)
1844 nbd_put(nbd);
1845 return ret;
1846 }
1847
1848 static const struct genl_ops nbd_connect_genl_ops[] = {
1849 {
1850 .cmd = NBD_CMD_CONNECT,
1851 .policy = nbd_attr_policy,
1852 .doit = nbd_genl_connect,
1853 },
1854 {
1855 .cmd = NBD_CMD_DISCONNECT,
1856 .policy = nbd_attr_policy,
1857 .doit = nbd_genl_disconnect,
1858 },
1859 {
1860 .cmd = NBD_CMD_RECONFIGURE,
1861 .policy = nbd_attr_policy,
1862 .doit = nbd_genl_reconfigure,
1863 },
1864 {
1865 .cmd = NBD_CMD_STATUS,
1866 .policy = nbd_attr_policy,
1867 .doit = nbd_genl_status,
1868 },
1869 };
1870
1871 static const struct genl_multicast_group nbd_mcast_grps[] = {
1872 { .name = NBD_GENL_MCAST_GROUP_NAME, },
1873 };
1874
1875 static struct genl_family nbd_genl_family __ro_after_init = {
1876 .hdrsize = 0,
1877 .name = NBD_GENL_FAMILY_NAME,
1878 .version = NBD_GENL_VERSION,
1879 .module = THIS_MODULE,
1880 .ops = nbd_connect_genl_ops,
1881 .n_ops = ARRAY_SIZE(nbd_connect_genl_ops),
1882 .maxattr = NBD_ATTR_MAX,
1883 .mcgrps = nbd_mcast_grps,
1884 .n_mcgrps = ARRAY_SIZE(nbd_mcast_grps),
1885 };
1886
1887 static int populate_nbd_status(struct nbd_device *nbd, struct sk_buff *reply)
1888 {
1889 struct nlattr *dev_opt;
1890 u8 connected = 0;
1891 int ret;
1892
1893 /* This is a little racey, but for status it's ok. The
1894 * reason we don't take a ref here is because we can't
1895 * take a ref in the index == -1 case as we would need
1896 * to put under the nbd_index_mutex, which could
1897 * deadlock if we are configured to remove ourselves
1898 * once we're disconnected.
1899 */
1900 if (refcount_read(&nbd->config_refs))
1901 connected = 1;
1902 dev_opt = nla_nest_start(reply, NBD_DEVICE_ITEM);
1903 if (!dev_opt)
1904 return -EMSGSIZE;
1905 ret = nla_put_u32(reply, NBD_DEVICE_INDEX, nbd->index);
1906 if (ret)
1907 return -EMSGSIZE;
1908 ret = nla_put_u8(reply, NBD_DEVICE_CONNECTED,
1909 connected);
1910 if (ret)
1911 return -EMSGSIZE;
1912 nla_nest_end(reply, dev_opt);
1913 return 0;
1914 }
1915
1916 static int status_cb(int id, void *ptr, void *data)
1917 {
1918 struct nbd_device *nbd = ptr;
1919 return populate_nbd_status(nbd, (struct sk_buff *)data);
1920 }
1921
1922 static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info)
1923 {
1924 struct nlattr *dev_list;
1925 struct sk_buff *reply;
1926 void *reply_head;
1927 size_t msg_size;
1928 int index = -1;
1929 int ret = -ENOMEM;
1930
1931 if (info->attrs[NBD_ATTR_INDEX])
1932 index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
1933
1934 mutex_lock(&nbd_index_mutex);
1935
1936 msg_size = nla_total_size(nla_attr_size(sizeof(u32)) +
1937 nla_attr_size(sizeof(u8)));
1938 msg_size *= (index == -1) ? nbd_total_devices : 1;
1939
1940 reply = genlmsg_new(msg_size, GFP_KERNEL);
1941 if (!reply)
1942 goto out;
1943 reply_head = genlmsg_put_reply(reply, info, &nbd_genl_family, 0,
1944 NBD_CMD_STATUS);
1945 if (!reply_head) {
1946 nlmsg_free(reply);
1947 goto out;
1948 }
1949
1950 dev_list = nla_nest_start(reply, NBD_ATTR_DEVICE_LIST);
1951 if (index == -1) {
1952 ret = idr_for_each(&nbd_index_idr, &status_cb, reply);
1953 if (ret) {
1954 nlmsg_free(reply);
1955 goto out;
1956 }
1957 } else {
1958 struct nbd_device *nbd;
1959 nbd = idr_find(&nbd_index_idr, index);
1960 if (nbd) {
1961 ret = populate_nbd_status(nbd, reply);
1962 if (ret) {
1963 nlmsg_free(reply);
1964 goto out;
1965 }
1966 }
1967 }
1968 nla_nest_end(reply, dev_list);
1969 genlmsg_end(reply, reply_head);
1970 genlmsg_reply(reply, info);
1971 ret = 0;
1972 out:
1973 mutex_unlock(&nbd_index_mutex);
1974 return ret;
1975 }
1976
1977 static void nbd_connect_reply(struct genl_info *info, int index)
1978 {
1979 struct sk_buff *skb;
1980 void *msg_head;
1981 int ret;
1982
1983 skb = genlmsg_new(nla_total_size(sizeof(u32)), GFP_KERNEL);
1984 if (!skb)
1985 return;
1986 msg_head = genlmsg_put_reply(skb, info, &nbd_genl_family, 0,
1987 NBD_CMD_CONNECT);
1988 if (!msg_head) {
1989 nlmsg_free(skb);
1990 return;
1991 }
1992 ret = nla_put_u32(skb, NBD_ATTR_INDEX, index);
1993 if (ret) {
1994 nlmsg_free(skb);
1995 return;
1996 }
1997 genlmsg_end(skb, msg_head);
1998 genlmsg_reply(skb, info);
1999 }
2000
2001 static void nbd_mcast_index(int index)
2002 {
2003 struct sk_buff *skb;
2004 void *msg_head;
2005 int ret;
2006
2007 skb = genlmsg_new(nla_total_size(sizeof(u32)), GFP_KERNEL);
2008 if (!skb)
2009 return;
2010 msg_head = genlmsg_put(skb, 0, 0, &nbd_genl_family, 0,
2011 NBD_CMD_LINK_DEAD);
2012 if (!msg_head) {
2013 nlmsg_free(skb);
2014 return;
2015 }
2016 ret = nla_put_u32(skb, NBD_ATTR_INDEX, index);
2017 if (ret) {
2018 nlmsg_free(skb);
2019 return;
2020 }
2021 genlmsg_end(skb, msg_head);
2022 genlmsg_multicast(&nbd_genl_family, skb, 0, 0, GFP_KERNEL);
2023 }
2024
2025 static void nbd_dead_link_work(struct work_struct *work)
2026 {
2027 struct link_dead_args *args = container_of(work, struct link_dead_args,
2028 work);
2029 nbd_mcast_index(args->index);
2030 kfree(args);
2031 }
2032
2033 static int __init nbd_init(void)
2034 {
2035 int i;
2036
2037 BUILD_BUG_ON(sizeof(struct nbd_request) != 28);
2038
2039 if (max_part < 0) {
2040 printk(KERN_ERR "nbd: max_part must be >= 0\n");
2041 return -EINVAL;
2042 }
2043
2044 part_shift = 0;
2045 if (max_part > 0) {
2046 part_shift = fls(max_part);
2047
2048 /*
2049 * Adjust max_part according to part_shift as it is exported
2050 * to user space so that user can know the max number of
2051 * partition kernel should be able to manage.
2052 *
2053 * Note that -1 is required because partition 0 is reserved
2054 * for the whole disk.
2055 */
2056 max_part = (1UL << part_shift) - 1;
2057 }
2058
2059 if ((1UL << part_shift) > DISK_MAX_PARTS)
2060 return -EINVAL;
2061
2062 if (nbds_max > 1UL << (MINORBITS - part_shift))
2063 return -EINVAL;
2064 recv_workqueue = alloc_workqueue("knbd-recv",
2065 WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
2066 if (!recv_workqueue)
2067 return -ENOMEM;
2068
2069 if (register_blkdev(NBD_MAJOR, "nbd")) {
2070 destroy_workqueue(recv_workqueue);
2071 return -EIO;
2072 }
2073
2074 if (genl_register_family(&nbd_genl_family)) {
2075 unregister_blkdev(NBD_MAJOR, "nbd");
2076 destroy_workqueue(recv_workqueue);
2077 return -EINVAL;
2078 }
2079 nbd_dbg_init();
2080
2081 mutex_lock(&nbd_index_mutex);
2082 for (i = 0; i < nbds_max; i++)
2083 nbd_dev_add(i);
2084 mutex_unlock(&nbd_index_mutex);
2085 return 0;
2086 }
2087
2088 static int nbd_exit_cb(int id, void *ptr, void *data)
2089 {
2090 struct list_head *list = (struct list_head *)data;
2091 struct nbd_device *nbd = ptr;
2092
2093 list_add_tail(&nbd->list, list);
2094 return 0;
2095 }
2096
2097 static void __exit nbd_cleanup(void)
2098 {
2099 struct nbd_device *nbd;
2100 LIST_HEAD(del_list);
2101
2102 nbd_dbg_close();
2103
2104 mutex_lock(&nbd_index_mutex);
2105 idr_for_each(&nbd_index_idr, &nbd_exit_cb, &del_list);
2106 mutex_unlock(&nbd_index_mutex);
2107
2108 while (!list_empty(&del_list)) {
2109 nbd = list_first_entry(&del_list, struct nbd_device, list);
2110 list_del_init(&nbd->list);
2111 if (refcount_read(&nbd->refs) != 1)
2112 printk(KERN_ERR "nbd: possibly leaking a device\n");
2113 nbd_put(nbd);
2114 }
2115
2116 idr_destroy(&nbd_index_idr);
2117 genl_unregister_family(&nbd_genl_family);
2118 destroy_workqueue(recv_workqueue);
2119 unregister_blkdev(NBD_MAJOR, "nbd");
2120 }
2121
2122 module_init(nbd_init);
2123 module_exit(nbd_cleanup);
2124
2125 MODULE_DESCRIPTION("Network Block Device");
2126 MODULE_LICENSE("GPL");
2127
2128 module_param(nbds_max, int, 0444);
2129 MODULE_PARM_DESC(nbds_max, "number of network block devices to initialize (default: 16)");
2130 module_param(max_part, int, 0444);
2131 MODULE_PARM_DESC(max_part, "number of partitions per device (default: 0)");