[SCSI] block: fix bio_add_page misuse with rq_map_data
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / block / blk-map.c
CommitLineData
86db1e29
JA
1/*
2 * Functions related to mapping data to requests
3 */
4#include <linux/kernel.h>
5#include <linux/module.h>
6#include <linux/bio.h>
7#include <linux/blkdev.h>
afdc1a78 8#include <scsi/sg.h> /* for struct sg_iovec */
86db1e29
JA
9
10#include "blk.h"
11
12int blk_rq_append_bio(struct request_queue *q, struct request *rq,
13 struct bio *bio)
14{
15 if (!rq->bio)
16 blk_rq_bio_prep(q, rq, bio);
17 else if (!ll_back_merge_fn(q, rq, bio))
18 return -EINVAL;
19 else {
20 rq->biotail->bi_next = bio;
21 rq->biotail = bio;
22
23 rq->data_len += bio->bi_size;
24 }
25 return 0;
26}
27EXPORT_SYMBOL(blk_rq_append_bio);
28
29static int __blk_rq_unmap_user(struct bio *bio)
30{
31 int ret = 0;
32
33 if (bio) {
34 if (bio_flagged(bio, BIO_USER_MAPPED))
35 bio_unmap_user(bio);
36 else
37 ret = bio_uncopy_user(bio);
38 }
39
40 return ret;
41}
42
43static int __blk_rq_map_user(struct request_queue *q, struct request *rq,
152e283f 44 struct rq_map_data *map_data, void __user *ubuf,
81882766 45 unsigned int len, int null_mapped, gfp_t gfp_mask)
86db1e29
JA
46{
47 unsigned long uaddr;
48 struct bio *bio, *orig_bio;
49 int reading, ret;
50
51 reading = rq_data_dir(rq) == READ;
52
53 /*
54 * if alignment requirement is satisfied, map in user pages for
55 * direct dma. else, set up kernel bounce buffers
56 */
57 uaddr = (unsigned long) ubuf;
87904074 58 if (blk_rq_aligned(q, ubuf, len) && !map_data)
a3bce90e 59 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
86db1e29 60 else
152e283f 61 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
86db1e29
JA
62
63 if (IS_ERR(bio))
64 return PTR_ERR(bio);
65
81882766
FT
66 if (null_mapped)
67 bio->bi_flags |= (1 << BIO_NULL_MAPPED);
68
86db1e29
JA
69 orig_bio = bio;
70 blk_queue_bounce(q, &bio);
71
72 /*
73 * We link the bounce buffer in and could have to traverse it
74 * later so we have to get a ref to prevent it from being freed
75 */
76 bio_get(bio);
77
78 ret = blk_rq_append_bio(q, rq, bio);
79 if (!ret)
80 return bio->bi_size;
81
82 /* if it was boucned we must call the end io function */
83 bio_endio(bio, 0);
84 __blk_rq_unmap_user(orig_bio);
85 bio_put(bio);
86 return ret;
87}
88
89/**
710027a4 90 * blk_rq_map_user - map user data to a request, for REQ_TYPE_BLOCK_PC usage
86db1e29
JA
91 * @q: request queue where request should be inserted
92 * @rq: request structure to fill
152e283f 93 * @map_data: pointer to the rq_map_data holding pages (if necessary)
86db1e29
JA
94 * @ubuf: the user buffer
95 * @len: length of user data
a3bce90e 96 * @gfp_mask: memory allocation flags
86db1e29
JA
97 *
98 * Description:
710027a4 99 * Data will be mapped directly for zero copy I/O, if possible. Otherwise
86db1e29
JA
100 * a kernel bounce buffer is used.
101 *
710027a4 102 * A matching blk_rq_unmap_user() must be issued at the end of I/O, while
86db1e29
JA
103 * still in process context.
104 *
105 * Note: The mapped bio may need to be bounced through blk_queue_bounce()
106 * before being submitted to the device, as pages mapped may be out of
107 * reach. It's the callers responsibility to make sure this happens. The
108 * original bio must be passed back in to blk_rq_unmap_user() for proper
109 * unmapping.
110 */
111int blk_rq_map_user(struct request_queue *q, struct request *rq,
152e283f
FT
112 struct rq_map_data *map_data, void __user *ubuf,
113 unsigned long len, gfp_t gfp_mask)
86db1e29
JA
114{
115 unsigned long bytes_read = 0;
116 struct bio *bio = NULL;
81882766 117 int ret, null_mapped = 0;
86db1e29
JA
118
119 if (len > (q->max_hw_sectors << 9))
120 return -EINVAL;
81882766 121 if (!len)
86db1e29 122 return -EINVAL;
81882766
FT
123 if (!ubuf) {
124 if (!map_data || rq_data_dir(rq) != READ)
125 return -EINVAL;
126 null_mapped = 1;
127 }
86db1e29
JA
128
129 while (bytes_read != len) {
130 unsigned long map_len, end, start;
131
132 map_len = min_t(unsigned long, len - bytes_read, BIO_MAX_SIZE);
133 end = ((unsigned long)ubuf + map_len + PAGE_SIZE - 1)
134 >> PAGE_SHIFT;
135 start = (unsigned long)ubuf >> PAGE_SHIFT;
136
137 /*
138 * A bad offset could cause us to require BIO_MAX_PAGES + 1
139 * pages. If this happens we just lower the requested
140 * mapping len by a page so that we can fit
141 */
142 if (end - start > BIO_MAX_PAGES)
143 map_len -= PAGE_SIZE;
144
152e283f 145 ret = __blk_rq_map_user(q, rq, map_data, ubuf, map_len,
81882766 146 null_mapped, gfp_mask);
86db1e29
JA
147 if (ret < 0)
148 goto unmap_rq;
149 if (!bio)
150 bio = rq->bio;
151 bytes_read += ret;
152 ubuf += ret;
153 }
154
f18573ab
FT
155 if (!bio_flagged(bio, BIO_USER_MAPPED))
156 rq->cmd_flags |= REQ_COPY_USER;
40b01b9b 157
86db1e29
JA
158 rq->buffer = rq->data = NULL;
159 return 0;
160unmap_rq:
161 blk_rq_unmap_user(bio);
84e9e03c 162 rq->bio = NULL;
86db1e29
JA
163 return ret;
164}
86db1e29
JA
165EXPORT_SYMBOL(blk_rq_map_user);
166
167/**
710027a4 168 * blk_rq_map_user_iov - map user data to a request, for REQ_TYPE_BLOCK_PC usage
86db1e29
JA
169 * @q: request queue where request should be inserted
170 * @rq: request to map data to
152e283f 171 * @map_data: pointer to the rq_map_data holding pages (if necessary)
86db1e29
JA
172 * @iov: pointer to the iovec
173 * @iov_count: number of elements in the iovec
174 * @len: I/O byte count
a3bce90e 175 * @gfp_mask: memory allocation flags
86db1e29
JA
176 *
177 * Description:
710027a4 178 * Data will be mapped directly for zero copy I/O, if possible. Otherwise
86db1e29
JA
179 * a kernel bounce buffer is used.
180 *
710027a4 181 * A matching blk_rq_unmap_user() must be issued at the end of I/O, while
86db1e29
JA
182 * still in process context.
183 *
184 * Note: The mapped bio may need to be bounced through blk_queue_bounce()
185 * before being submitted to the device, as pages mapped may be out of
186 * reach. It's the callers responsibility to make sure this happens. The
187 * original bio must be passed back in to blk_rq_unmap_user() for proper
188 * unmapping.
189 */
190int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
152e283f
FT
191 struct rq_map_data *map_data, struct sg_iovec *iov,
192 int iov_count, unsigned int len, gfp_t gfp_mask)
86db1e29
JA
193{
194 struct bio *bio;
afdc1a78
FT
195 int i, read = rq_data_dir(rq) == READ;
196 int unaligned = 0;
86db1e29
JA
197
198 if (!iov || iov_count <= 0)
199 return -EINVAL;
200
afdc1a78
FT
201 for (i = 0; i < iov_count; i++) {
202 unsigned long uaddr = (unsigned long)iov[i].iov_base;
203
204 if (uaddr & queue_dma_alignment(q)) {
205 unaligned = 1;
206 break;
207 }
208 }
209
152e283f
FT
210 if (unaligned || (q->dma_pad_mask & len) || map_data)
211 bio = bio_copy_user_iov(q, map_data, iov, iov_count, read,
212 gfp_mask);
afdc1a78 213 else
a3bce90e 214 bio = bio_map_user_iov(q, NULL, iov, iov_count, read, gfp_mask);
afdc1a78 215
86db1e29
JA
216 if (IS_ERR(bio))
217 return PTR_ERR(bio);
218
219 if (bio->bi_size != len) {
c26156b2
JA
220 /*
221 * Grab an extra reference to this bio, as bio_unmap_user()
222 * expects to be able to drop it twice as it happens on the
223 * normal IO completion path
224 */
225 bio_get(bio);
86db1e29 226 bio_endio(bio, 0);
53cc0b29 227 __blk_rq_unmap_user(bio);
86db1e29
JA
228 return -EINVAL;
229 }
230
f18573ab
FT
231 if (!bio_flagged(bio, BIO_USER_MAPPED))
232 rq->cmd_flags |= REQ_COPY_USER;
233
07359fc6 234 blk_queue_bounce(q, &bio);
86db1e29
JA
235 bio_get(bio);
236 blk_rq_bio_prep(q, rq, bio);
237 rq->buffer = rq->data = NULL;
238 return 0;
239}
152e283f 240EXPORT_SYMBOL(blk_rq_map_user_iov);
86db1e29
JA
241
242/**
243 * blk_rq_unmap_user - unmap a request with user data
244 * @bio: start of bio list
245 *
246 * Description:
247 * Unmap a rq previously mapped by blk_rq_map_user(). The caller must
248 * supply the original rq->bio from the blk_rq_map_user() return, since
710027a4 249 * the I/O completion may have changed rq->bio.
86db1e29
JA
250 */
251int blk_rq_unmap_user(struct bio *bio)
252{
253 struct bio *mapped_bio;
254 int ret = 0, ret2;
255
256 while (bio) {
257 mapped_bio = bio;
258 if (unlikely(bio_flagged(bio, BIO_BOUNCED)))
259 mapped_bio = bio->bi_private;
260
261 ret2 = __blk_rq_unmap_user(mapped_bio);
262 if (ret2 && !ret)
263 ret = ret2;
264
265 mapped_bio = bio;
266 bio = bio->bi_next;
267 bio_put(mapped_bio);
268 }
269
270 return ret;
271}
86db1e29
JA
272EXPORT_SYMBOL(blk_rq_unmap_user);
273
274/**
710027a4 275 * blk_rq_map_kern - map kernel data to a request, for REQ_TYPE_BLOCK_PC usage
86db1e29
JA
276 * @q: request queue where request should be inserted
277 * @rq: request to fill
278 * @kbuf: the kernel buffer
279 * @len: length of user data
280 * @gfp_mask: memory allocation flags
68154e90
FT
281 *
282 * Description:
283 * Data will be mapped directly if possible. Otherwise a bounce
284 * buffer is used.
86db1e29
JA
285 */
286int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
287 unsigned int len, gfp_t gfp_mask)
288{
68154e90
FT
289 int reading = rq_data_dir(rq) == READ;
290 int do_copy = 0;
86db1e29
JA
291 struct bio *bio;
292
293 if (len > (q->max_hw_sectors << 9))
294 return -EINVAL;
295 if (!len || !kbuf)
296 return -EINVAL;
297
87904074 298 do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
68154e90
FT
299 if (do_copy)
300 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
301 else
302 bio = bio_map_kern(q, kbuf, len, gfp_mask);
303
86db1e29
JA
304 if (IS_ERR(bio))
305 return PTR_ERR(bio);
306
307 if (rq_data_dir(rq) == WRITE)
308 bio->bi_rw |= (1 << BIO_RW);
309
68154e90
FT
310 if (do_copy)
311 rq->cmd_flags |= REQ_COPY_USER;
312
86db1e29
JA
313 blk_rq_bio_prep(q, rq, bio);
314 blk_queue_bounce(q, &rq->bio);
315 rq->buffer = rq->data = NULL;
316 return 0;
317}
86db1e29 318EXPORT_SYMBOL(blk_rq_map_kern);