drivers/block/rbd.c

   1
   2 /*
   3    rbd.c -- Export ceph rados objects as a Linux block device
   4
   5
   6    based on drivers/block/osdblk.c:
   7
   8    Copyright 2009 Red Hat, Inc.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; see the file COPYING.  If not, write to
  21    the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
  22
  23
  24
  25    For usage instructions, please refer to:
  26
  27                  Documentation/ABI/testing/sysfs-bus-rbd
  28
  29  */
  30
  31 #include <linux/ceph/libceph.h>
  32 #include <linux/ceph/osd_client.h>
  33 #include <linux/ceph/mon_client.h>
  34 #include <linux/ceph/cls_lock_client.h>
  35 #include <linux/ceph/decode.h>
  36 #include <linux/parser.h>
  37 #include <linux/bsearch.h>
  38
  39 #include <linux/kernel.h>
  40 #include <linux/device.h>
  41 #include <linux/module.h>
  42 #include <linux/blk-mq.h>
  43 #include <linux/fs.h>
  44 #include <linux/blkdev.h>
  45 #include <linux/slab.h>
  46 #include <linux/idr.h>
  47 #include <linux/workqueue.h>
  48
  49 #include "rbd_types.h"
  50
  51 #define RBD_DEBUG       /* Activate rbd_assert() calls */
  52
  53 /*
  54  * The basic unit of block I/O is a sector.  It is interpreted in a
  55  * number of contexts in Linux (blk, bio, genhd), but the default is
  56  * universally 512 bytes.  These symbols are just slightly more
  57  * meaningful than the bare numbers they represent.
  58  */
  59 #define SECTOR_SHIFT    9
  60 #define SECTOR_SIZE     (1ULL << SECTOR_SHIFT)
  61
  62 /*
  63  * Increment the given counter and return its updated value.
  64  * If the counter is already 0 it will not be incremented.
  65  * If the counter is already at its maximum value returns
  66  * -EINVAL without updating it.
  67  */
  68 static int atomic_inc_return_safe(atomic_t *v)
  69 {
  70         unsigned int counter;
  71
  72         counter = (unsigned int)__atomic_add_unless(v, 1, 0);
  73         if (counter <= (unsigned int)INT_MAX)
  74                 return (int)counter;
  75
  76         atomic_dec(v);
  77
  78         return -EINVAL;
  79 }
  80
  81 /* Decrement the counter.  Return the resulting value, or -EINVAL */
  82 static int atomic_dec_return_safe(atomic_t *v)
  83 {
  84         int counter;
  85
  86         counter = atomic_dec_return(v);
  87         if (counter >= 0)
  88                 return counter;
  89
  90         atomic_inc(v);
  91
  92         return -EINVAL;
  93 }
  94
  95 #define RBD_DRV_NAME "rbd"
  96
  97 #define RBD_MINORS_PER_MAJOR            256
  98 #define RBD_SINGLE_MAJOR_PART_SHIFT     4
  99
 100 #define RBD_MAX_PARENT_CHAIN_LEN        16
 101
 102 #define RBD_SNAP_DEV_NAME_PREFIX        "snap_"
 103 #define RBD_MAX_SNAP_NAME_LEN   \
 104                         (NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
 105
 106 #define RBD_MAX_SNAP_COUNT      510     /* allows max snapc to fit in 4KB */
 107
 108 #define RBD_SNAP_HEAD_NAME      "-"
 109
 110 #define BAD_SNAP_INDEX  U32_MAX         /* invalid index into snap array */
 111
 112 /* This allows a single page to hold an image name sent by OSD */
 113 #define RBD_IMAGE_NAME_LEN_MAX  (PAGE_SIZE - sizeof (__le32) - 1)
 114 #define RBD_IMAGE_ID_LEN_MAX    64
 115
 116 #define RBD_OBJ_PREFIX_LEN_MAX  64
 117
 118 #define RBD_NOTIFY_TIMEOUT      5       /* seconds */
 119 #define RBD_RETRY_DELAY         msecs_to_jiffies(1000)
 120
 121 /* Feature bits */
 122
 123 #define RBD_FEATURE_LAYERING    (1<<0)
 124 #define RBD_FEATURE_STRIPINGV2  (1<<1)
 125 #define RBD_FEATURE_EXCLUSIVE_LOCK (1<<2)
 126 #define RBD_FEATURES_ALL        (RBD_FEATURE_LAYERING |         \
 127                                  RBD_FEATURE_STRIPINGV2 |       \
 128                                  RBD_FEATURE_EXCLUSIVE_LOCK)
 129
 130 /* Features supported by this (client software) implementation. */
 131
 132 #define RBD_FEATURES_SUPPORTED  (RBD_FEATURES_ALL)
 133
 134 /*
 135  * An RBD device name will be "rbd#", where the "rbd" comes from
 136  * RBD_DRV_NAME above, and # is a unique integer identifier.
 137  */
 138 #define DEV_NAME_LEN            32
 139
 140 /*
 141  * block device image metadata (in-memory version)
 142  */
 143 struct rbd_image_header {
 144         /* These six fields never change for a given rbd image */
 145         char *object_prefix;
 146         __u8 obj_order;
 147         __u8 crypt_type;
 148         __u8 comp_type;
 149         u64 stripe_unit;
 150         u64 stripe_count;
 151         u64 features;           /* Might be changeable someday? */
 152
 153         /* The remaining fields need to be updated occasionally */
 154         u64 image_size;
 155         struct ceph_snap_context *snapc;
 156         char *snap_names;       /* format 1 only */
 157         u64 *snap_sizes;        /* format 1 only */
 158 };
 159
 160 /*
 161  * An rbd image specification.
 162  *
 163  * The tuple (pool_id, image_id, snap_id) is sufficient to uniquely
 164  * identify an image.  Each rbd_dev structure includes a pointer to
 165  * an rbd_spec structure that encapsulates this identity.
 166  *
 167  * Each of the id's in an rbd_spec has an associated name.  For a
 168  * user-mapped image, the names are supplied and the id's associated
 169  * with them are looked up.  For a layered image, a parent image is
 170  * defined by the tuple, and the names are looked up.
 171  *
 172  * An rbd_dev structure contains a parent_spec pointer which is
 173  * non-null if the image it represents is a child in a layered
 174  * image.  This pointer will refer to the rbd_spec structure used
 175  * by the parent rbd_dev for its own identity (i.e., the structure
 176  * is shared between the parent and child).
 177  *
 178  * Since these structures are populated once, during the discovery
 179  * phase of image construction, they are effectively immutable so
 180  * we make no effort to synchronize access to them.
 181  *
 182  * Note that code herein does not assume the image name is known (it
 183  * could be a null pointer).
 184  */
 185 struct rbd_spec {
 186         u64             pool_id;
 187         const char      *pool_name;
 188
 189         const char      *image_id;
 190         const char      *image_name;
 191
 192         u64             snap_id;
 193         const char      *snap_name;
 194
 195         struct kref     kref;
 196 };
 197
 198 /*
 199  * an instance of the client.  multiple devices may share an rbd client.
 200  */
 201 struct rbd_client {
 202         struct ceph_client      *client;
 203         struct kref             kref;
 204         struct list_head        node;
 205 };
 206
 207 struct rbd_img_request;
 208 typedef void (*rbd_img_callback_t)(struct rbd_img_request *);
 209
 210 #define BAD_WHICH       U32_MAX         /* Good which or bad which, which? */
 211
 212 struct rbd_obj_request;
 213 typedef void (*rbd_obj_callback_t)(struct rbd_obj_request *);
 214
 215 enum obj_request_type {
 216         OBJ_REQUEST_NODATA, OBJ_REQUEST_BIO, OBJ_REQUEST_PAGES
 217 };
 218
 219 enum obj_operation_type {
 220         OBJ_OP_WRITE,
 221         OBJ_OP_READ,
 222         OBJ_OP_DISCARD,
 223 };
 224
 225 enum obj_req_flags {
 226         OBJ_REQ_DONE,           /* completion flag: not done = 0, done = 1 */
 227         OBJ_REQ_IMG_DATA,       /* object usage: standalone = 0, image = 1 */
 228         OBJ_REQ_KNOWN,          /* EXISTS flag valid: no = 0, yes = 1 */
 229         OBJ_REQ_EXISTS,         /* target exists: no = 0, yes = 1 */
 230 };
 231
 232 struct rbd_obj_request {
 233         const char              *object_name;
 234         u64                     offset;         /* object start byte */
 235         u64                     length;         /* bytes from offset */
 236         unsigned long           flags;
 237
 238         /*
 239          * An object request associated with an image will have its
 240          * img_data flag set; a standalone object request will not.
 241          *
 242          * A standalone object request will have which == BAD_WHICH
 243          * and a null obj_request pointer.
 244          *
 245          * An object request initiated in support of a layered image
 246          * object (to check for its existence before a write) will
 247          * have which == BAD_WHICH and a non-null obj_request pointer.
 248          *
 249          * Finally, an object request for rbd image data will have
 250          * which != BAD_WHICH, and will have a non-null img_request
 251          * pointer.  The value of which will be in the range
 252          * 0..(img_request->obj_request_count-1).
 253          */
 254         union {
 255                 struct rbd_obj_request  *obj_request;   /* STAT op */
 256                 struct {
 257                         struct rbd_img_request  *img_request;
 258                         u64                     img_offset;
 259                         /* links for img_request->obj_requests list */
 260                         struct list_head        links;
 261                 };
 262         };
 263         u32                     which;          /* posn image request list */
 264
 265         enum obj_request_type   type;
 266         union {
 267                 struct bio      *bio_list;
 268                 struct {
 269                         struct page     **pages;
 270                         u32             page_count;
 271                 };
 272         };
 273         struct page             **copyup_pages;
 274         u32                     copyup_page_count;
 275
 276         struct ceph_osd_request *osd_req;
 277
 278         u64                     xferred;        /* bytes transferred */
 279         int                     result;
 280
 281         rbd_obj_callback_t      callback;
 282         struct completion       completion;
 283
 284         struct kref             kref;
 285 };
 286
 287 enum img_req_flags {
 288         IMG_REQ_WRITE,          /* I/O direction: read = 0, write = 1 */
 289         IMG_REQ_CHILD,          /* initiator: block = 0, child image = 1 */
 290         IMG_REQ_LAYERED,        /* ENOENT handling: normal = 0, layered = 1 */
 291         IMG_REQ_DISCARD,        /* discard: normal = 0, discard request = 1 */
 292 };
 293
 294 struct rbd_img_request {
 295         struct rbd_device       *rbd_dev;
 296         u64                     offset; /* starting image byte offset */
 297         u64                     length; /* byte count from offset */
 298         unsigned long           flags;
 299         union {
 300                 u64                     snap_id;        /* for reads */
 301                 struct ceph_snap_context *snapc;        /* for writes */
 302         };
 303         union {
 304                 struct request          *rq;            /* block request */
 305                 struct rbd_obj_request  *obj_request;   /* obj req initiator */
 306         };
 307         struct page             **copyup_pages;
 308         u32                     copyup_page_count;
 309         spinlock_t              completion_lock;/* protects next_completion */
 310         u32                     next_completion;
 311         rbd_img_callback_t      callback;
 312         u64                     xferred;/* aggregate bytes transferred */
 313         int                     result; /* first nonzero obj_request result */
 314
 315         u32                     obj_request_count;
 316         struct list_head        obj_requests;   /* rbd_obj_request structs */
 317
 318         struct kref             kref;
 319 };
 320
 321 #define for_each_obj_request(ireq, oreq) \
 322         list_for_each_entry(oreq, &(ireq)->obj_requests, links)
 323 #define for_each_obj_request_from(ireq, oreq) \
 324         list_for_each_entry_from(oreq, &(ireq)->obj_requests, links)
 325 #define for_each_obj_request_safe(ireq, oreq, n) \
 326         list_for_each_entry_safe_reverse(oreq, n, &(ireq)->obj_requests, links)
 327
 328 enum rbd_watch_state {
 329         RBD_WATCH_STATE_UNREGISTERED,
 330         RBD_WATCH_STATE_REGISTERED,
 331         RBD_WATCH_STATE_ERROR,
 332 };
 333
 334 enum rbd_lock_state {
 335         RBD_LOCK_STATE_UNLOCKED,
 336         RBD_LOCK_STATE_LOCKED,
 337         RBD_LOCK_STATE_RELEASING,
 338 };
 339
 340 /* WatchNotify::ClientId */
 341 struct rbd_client_id {
 342         u64 gid;
 343         u64 handle;
 344 };
 345
 346 struct rbd_mapping {
 347         u64                     size;
 348         u64                     features;
 349         bool                    read_only;
 350 };
 351
 352 /*
 353  * a single device
 354  */
 355 struct rbd_device {
 356         int                     dev_id;         /* blkdev unique id */
 357
 358         int                     major;          /* blkdev assigned major */
 359         int                     minor;
 360         struct gendisk          *disk;          /* blkdev's gendisk and rq */
 361
 362         u32                     image_format;   /* Either 1 or 2 */
 363         struct rbd_client       *rbd_client;
 364
 365         char                    name[DEV_NAME_LEN]; /* blkdev name, e.g. rbd3 */
 366
 367         spinlock_t              lock;           /* queue, flags, open_count */
 368
 369         struct rbd_image_header header;
 370         unsigned long           flags;          /* possibly lock protected */
 371         struct rbd_spec         *spec;
 372         struct rbd_options      *opts;
 373         char                    *config_info;   /* add{,_single_major} string */
 374
 375         struct ceph_object_id   header_oid;
 376         struct ceph_object_locator header_oloc;
 377
 378         struct ceph_file_layout layout;         /* used for all rbd requests */
 379
 380         struct mutex            watch_mutex;
 381         enum rbd_watch_state    watch_state;
 382         struct ceph_osd_linger_request *watch_handle;
 383         u64                     watch_cookie;
 384         struct delayed_work     watch_dwork;
 385
 386         struct rw_semaphore     lock_rwsem;
 387         enum rbd_lock_state     lock_state;
 388         struct rbd_client_id    owner_cid;
 389         struct work_struct      acquired_lock_work;
 390         struct work_struct      released_lock_work;
 391         struct delayed_work     lock_dwork;
 392         struct work_struct      unlock_work;
 393         wait_queue_head_t       lock_waitq;
 394
 395         struct workqueue_struct *task_wq;
 396
 397         struct rbd_spec         *parent_spec;
 398         u64                     parent_overlap;
 399         atomic_t                parent_ref;
 400         struct rbd_device       *parent;
 401
 402         /* Block layer tags. */
 403         struct blk_mq_tag_set   tag_set;
 404
 405         /* protects updating the header */
 406         struct rw_semaphore     header_rwsem;
 407
 408         struct rbd_mapping      mapping;
 409
 410         struct list_head        node;
 411
 412         /* sysfs related */
 413         struct device           dev;
 414         unsigned long           open_count;     /* protected by lock */
 415 };
 416
 417 /*
 418  * Flag bits for rbd_dev->flags.  If atomicity is required,
 419  * rbd_dev->lock is used to protect access.
 420  *
 421  * Currently, only the "removing" flag (which is coupled with the
 422  * "open_count" field) requires atomic access.
 423  */
 424 enum rbd_dev_flags {
 425         RBD_DEV_FLAG_EXISTS,    /* mapped snapshot has not been deleted */
 426         RBD_DEV_FLAG_REMOVING,  /* this mapping is being removed */
 427 };
 428
 429 static DEFINE_MUTEX(client_mutex);      /* Serialize client creation */
 430
 431 static LIST_HEAD(rbd_dev_list);    /* devices */
 432 static DEFINE_SPINLOCK(rbd_dev_list_lock);
 433
 434 static LIST_HEAD(rbd_client_list);              /* clients */
 435 static DEFINE_SPINLOCK(rbd_client_list_lock);
 436
 437 /* Slab caches for frequently-allocated structures */
 438
 439 static struct kmem_cache        *rbd_img_request_cache;
 440 static struct kmem_cache        *rbd_obj_request_cache;
 441 static struct kmem_cache        *rbd_segment_name_cache;
 442
 443 static int rbd_major;
 444 static DEFINE_IDA(rbd_dev_id_ida);
 445
 446 static struct workqueue_struct *rbd_wq;
 447
 448 /*
 449  * Default to false for now, as single-major requires >= 0.75 version of
 450  * userspace rbd utility.
 451  */
 452 static bool single_major = false;
 453 module_param(single_major, bool, S_IRUGO);
 454 MODULE_PARM_DESC(single_major, "Use a single major number for all rbd devices (default: false)");
 455
 456 static int rbd_img_request_submit(struct rbd_img_request *img_request);
 457
 458 static ssize_t rbd_add(struct bus_type *bus, const char *buf,
 459                        size_t count);
 460 static ssize_t rbd_remove(struct bus_type *bus, const char *buf,
 461                           size_t count);
 462 static ssize_t rbd_add_single_major(struct bus_type *bus, const char *buf,
 463                                     size_t count);
 464 static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,
 465                                        size_t count);
 466 static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);
 467 static void rbd_spec_put(struct rbd_spec *spec);
 468
 469 static int rbd_dev_id_to_minor(int dev_id)
 470 {
 471         return dev_id << RBD_SINGLE_MAJOR_PART_SHIFT;
 472 }
 473
 474 static int minor_to_rbd_dev_id(int minor)
 475 {
 476         return minor >> RBD_SINGLE_MAJOR_PART_SHIFT;
 477 }
 478
 479 static bool rbd_is_lock_supported(struct rbd_device *rbd_dev)
 480 {
 481         return (rbd_dev->header.features & RBD_FEATURE_EXCLUSIVE_LOCK) &&
 482                rbd_dev->spec->snap_id == CEPH_NOSNAP &&
 483                !rbd_dev->mapping.read_only;
 484 }
 485
 486 static bool __rbd_is_lock_owner(struct rbd_device *rbd_dev)
 487 {
 488         return rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED ||
 489                rbd_dev->lock_state == RBD_LOCK_STATE_RELEASING;
 490 }
 491
 492 static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
 493 {
 494         bool is_lock_owner;
 495
 496         down_read(&rbd_dev->lock_rwsem);
 497         is_lock_owner = __rbd_is_lock_owner(rbd_dev);
 498         up_read(&rbd_dev->lock_rwsem);
 499         return is_lock_owner;
 500 }
 501
 502 static BUS_ATTR(add, S_IWUSR, NULL, rbd_add);
 503 static BUS_ATTR(remove, S_IWUSR, NULL, rbd_remove);
 504 static BUS_ATTR(add_single_major, S_IWUSR, NULL, rbd_add_single_major);
 505 static BUS_ATTR(remove_single_major, S_IWUSR, NULL, rbd_remove_single_major);
 506
 507 static struct attribute *rbd_bus_attrs[] = {
 508         &bus_attr_add.attr,
 509         &bus_attr_remove.attr,
 510         &bus_attr_add_single_major.attr,
 511         &bus_attr_remove_single_major.attr,
 512         NULL,
 513 };
 514
 515 static umode_t rbd_bus_is_visible(struct kobject *kobj,
 516                                   struct attribute *attr, int index)
 517 {
 518         if (!single_major &&
 519             (attr == &bus_attr_add_single_major.attr ||
 520              attr == &bus_attr_remove_single_major.attr))
 521                 return 0;
 522
 523         return attr->mode;
 524 }
 525
 526 static const struct attribute_group rbd_bus_group = {
 527         .attrs = rbd_bus_attrs,
 528         .is_visible = rbd_bus_is_visible,
 529 };
 530 __ATTRIBUTE_GROUPS(rbd_bus);
 531
 532 static struct bus_type rbd_bus_type = {
 533         .name           = "rbd",
 534         .bus_groups     = rbd_bus_groups,
 535 };
 536
 537 static void rbd_root_dev_release(struct device *dev)
 538 {
 539 }
 540
 541 static struct device rbd_root_dev = {
 542         .init_name =    "rbd",
 543         .release =      rbd_root_dev_release,
 544 };
 545
 546 static __printf(2, 3)
 547 void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...)
 548 {
 549         struct va_format vaf;
 550         va_list args;
 551
 552         va_start(args, fmt);
 553         vaf.fmt = fmt;
 554         vaf.va = &args;
 555
 556         if (!rbd_dev)
 557                 printk(KERN_WARNING "%s: %pV\n", RBD_DRV_NAME, &vaf);
 558         else if (rbd_dev->disk)
 559                 printk(KERN_WARNING "%s: %s: %pV\n",
 560                         RBD_DRV_NAME, rbd_dev->disk->disk_name, &vaf);
 561         else if (rbd_dev->spec && rbd_dev->spec->image_name)
 562                 printk(KERN_WARNING "%s: image %s: %pV\n",
 563                         RBD_DRV_NAME, rbd_dev->spec->image_name, &vaf);
 564         else if (rbd_dev->spec && rbd_dev->spec->image_id)
 565                 printk(KERN_WARNING "%s: id %s: %pV\n",
 566                         RBD_DRV_NAME, rbd_dev->spec->image_id, &vaf);
 567         else    /* punt */
 568                 printk(KERN_WARNING "%s: rbd_dev %p: %pV\n",
 569                         RBD_DRV_NAME, rbd_dev, &vaf);
 570         va_end(args);
 571 }
 572
 573 #ifdef RBD_DEBUG
 574 #define rbd_assert(expr)                                                \
 575                 if (unlikely(!(expr))) {                                \
 576                         printk(KERN_ERR "\nAssertion failure in %s() "  \
 577                                                 "at line %d:\n\n"       \
 578                                         "\trbd_assert(%s);\n\n",        \
 579                                         __func__, __LINE__, #expr);     \
 580                         BUG();                                          \
 581                 }
 582 #else /* !RBD_DEBUG */
 583 #  define rbd_assert(expr)      ((void) 0)
 584 #endif /* !RBD_DEBUG */
 585
 586 static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request);
 587 static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request);
 588 static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
 589 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
 590
 591 static int rbd_dev_refresh(struct rbd_device *rbd_dev);
 592 static int rbd_dev_v2_header_onetime(struct rbd_device *rbd_dev);
 593 static int rbd_dev_header_info(struct rbd_device *rbd_dev);
 594 static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev);
 595 static const char *rbd_dev_v2_snap_name(struct rbd_device *rbd_dev,
 596                                         u64 snap_id);
 597 static int _rbd_dev_v2_snap_size(struct rbd_device *rbd_dev, u64 snap_id,
 598                                 u8 *order, u64 *snap_size);
 599 static int _rbd_dev_v2_snap_features(struct rbd_device *rbd_dev, u64 snap_id,
 600                 u64 *snap_features);
 601
 602 static int rbd_open(struct block_device *bdev, fmode_t mode)
 603 {
 604         struct rbd_device *rbd_dev = bdev->bd_disk->private_data;
 605         bool removing = false;
 606
 607         if ((mode & FMODE_WRITE) && rbd_dev->mapping.read_only)
 608                 return -EROFS;
 609
 610         spin_lock_irq(&rbd_dev->lock);
 611         if (test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags))
 612                 removing = true;
 613         else
 614                 rbd_dev->open_count++;
 615         spin_unlock_irq(&rbd_dev->lock);
 616         if (removing)
 617                 return -ENOENT;
 618
 619         (void) get_device(&rbd_dev->dev);
 620
 621         return 0;
 622 }
 623
 624 static void rbd_release(struct gendisk *disk, fmode_t mode)
 625 {
 626         struct rbd_device *rbd_dev = disk->private_data;
 627         unsigned long open_count_before;
 628
 629         spin_lock_irq(&rbd_dev->lock);
 630         open_count_before = rbd_dev->open_count--;
 631         spin_unlock_irq(&rbd_dev->lock);
 632         rbd_assert(open_count_before > 0);
 633
 634         put_device(&rbd_dev->dev);
 635 }
 636
 637 static int rbd_ioctl_set_ro(struct rbd_device *rbd_dev, unsigned long arg)
 638 {
 639         int ret = 0;
 640         int val;
 641         bool ro;
 642         bool ro_changed = false;
 643
 644         /* get_user() may sleep, so call it before taking rbd_dev->lock */
 645         if (get_user(val, (int __user *)(arg)))
 646                 return -EFAULT;
 647
 648         ro = val ? true : false;
 649         /* Snapshot doesn't allow to write*/
 650         if (rbd_dev->spec->snap_id != CEPH_NOSNAP && !ro)
 651                 return -EROFS;
 652
 653         spin_lock_irq(&rbd_dev->lock);
 654         /* prevent others open this device */
 655         if (rbd_dev->open_count > 1) {
 656                 ret = -EBUSY;
 657                 goto out;
 658         }
 659
 660         if (rbd_dev->mapping.read_only != ro) {
 661                 rbd_dev->mapping.read_only = ro;
 662                 ro_changed = true;
 663         }
 664
 665 out:
 666         spin_unlock_irq(&rbd_dev->lock);
 667         /* set_disk_ro() may sleep, so call it after releasing rbd_dev->lock */
 668         if (ret == 0 && ro_changed)
 669                 set_disk_ro(rbd_dev->disk, ro ? 1 : 0);
 670
 671         return ret;
 672 }
 673
 674 static int rbd_ioctl(struct block_device *bdev, fmode_t mode,
 675                         unsigned int cmd, unsigned long arg)
 676 {
 677         struct rbd_device *rbd_dev = bdev->bd_disk->private_data;
 678         int ret = 0;
 679
 680         switch (cmd) {
 681         case BLKROSET:
 682                 ret = rbd_ioctl_set_ro(rbd_dev, arg);
 683                 break;
 684         default:
 685                 ret = -ENOTTY;
 686         }
 687
 688         return ret;
 689 }
 690
 691 #ifdef CONFIG_COMPAT
 692 static int rbd_compat_ioctl(struct block_device *bdev, fmode_t mode,
 693                                 unsigned int cmd, unsigned long arg)
 694 {
 695         return rbd_ioctl(bdev, mode, cmd, arg);
 696 }
 697 #endif /* CONFIG_COMPAT */
 698
 699 static const struct block_device_operations rbd_bd_ops = {
 700         .owner                  = THIS_MODULE,
 701         .open                   = rbd_open,
 702         .release                = rbd_release,
 703         .ioctl                  = rbd_ioctl,
 704 #ifdef CONFIG_COMPAT
 705         .compat_ioctl           = rbd_compat_ioctl,
 706 #endif
 707 };
 708
 709 /*
 710  * Initialize an rbd client instance.  Success or not, this function
 711  * consumes ceph_opts.  Caller holds client_mutex.
 712  */
 713 static struct rbd_client *rbd_client_create(struct ceph_options *ceph_opts)
 714 {
 715         struct rbd_client *rbdc;
 716         int ret = -ENOMEM;
 717
 718         dout("%s:\n", __func__);
 719         rbdc = kmalloc(sizeof(struct rbd_client), GFP_KERNEL);
 720         if (!rbdc)
 721                 goto out_opt;
 722
 723         kref_init(&rbdc->kref);
 724         INIT_LIST_HEAD(&rbdc->node);
 725
 726         rbdc->client = ceph_create_client(ceph_opts, rbdc, 0, 0);
 727         if (IS_ERR(rbdc->client))
 728                 goto out_rbdc;
 729         ceph_opts = NULL; /* Now rbdc->client is responsible for ceph_opts */
 730
 731         ret = ceph_open_session(rbdc->client);
 732         if (ret < 0)
 733                 goto out_client;
 734
 735         spin_lock(&rbd_client_list_lock);
 736         list_add_tail(&rbdc->node, &rbd_client_list);
 737         spin_unlock(&rbd_client_list_lock);
 738
 739         dout("%s: rbdc %p\n", __func__, rbdc);
 740
 741         return rbdc;
 742 out_client:
 743         ceph_destroy_client(rbdc->client);
 744 out_rbdc:
 745         kfree(rbdc);
 746 out_opt:
 747         if (ceph_opts)
 748                 ceph_destroy_options(ceph_opts);
 749         dout("%s: error %d\n", __func__, ret);
 750
 751         return ERR_PTR(ret);
 752 }
 753
 754 static struct rbd_client *__rbd_get_client(struct rbd_client *rbdc)
 755 {
 756         kref_get(&rbdc->kref);
 757
 758         return rbdc;
 759 }
 760
 761 /*
 762  * Find a ceph client with specific addr and configuration.  If
 763  * found, bump its reference count.
 764  */
 765 static struct rbd_client *rbd_client_find(struct ceph_options *ceph_opts)
 766 {
 767         struct rbd_client *client_node;
 768         bool found = false;
 769
 770         if (ceph_opts->flags & CEPH_OPT_NOSHARE)
 771                 return NULL;
 772
 773         spin_lock(&rbd_client_list_lock);
 774         list_for_each_entry(client_node, &rbd_client_list, node) {
 775                 if (!ceph_compare_options(ceph_opts, client_node->client)) {
 776                         __rbd_get_client(client_node);
 777
 778                         found = true;
 779                         break;
 780                 }
 781         }
 782         spin_unlock(&rbd_client_list_lock);
 783
 784         return found ? client_node : NULL;
 785 }
 786
 787 /*
 788  * (Per device) rbd map options
 789  */
 790 enum {
 791         Opt_queue_depth,
 792         Opt_last_int,
 793         /* int args above */
 794         Opt_last_string,
 795         /* string args above */
 796         Opt_read_only,
 797         Opt_read_write,
 798         Opt_lock_on_read,
 799         Opt_err
 800 };
 801
 802 static match_table_t rbd_opts_tokens = {
 803         {Opt_queue_depth, "queue_depth=%d"},
 804         /* int args above */
 805         /* string args above */
 806         {Opt_read_only, "read_only"},
 807         {Opt_read_only, "ro"},          /* Alternate spelling */
 808         {Opt_read_write, "read_write"},
 809         {Opt_read_write, "rw"},         /* Alternate spelling */
 810         {Opt_lock_on_read, "lock_on_read"},
 811         {Opt_err, NULL}
 812 };
 813
 814 struct rbd_options {
 815         int     queue_depth;
 816         bool    read_only;
 817         bool    lock_on_read;
 818 };
 819
 820 #define RBD_QUEUE_DEPTH_DEFAULT BLKDEV_MAX_RQ
 821 #define RBD_READ_ONLY_DEFAULT   false
 822 #define RBD_LOCK_ON_READ_DEFAULT false
 823
 824 static int parse_rbd_opts_token(char *c, void *private)
 825 {
 826         struct rbd_options *rbd_opts = private;
 827         substring_t argstr[MAX_OPT_ARGS];
 828         int token, intval, ret;
 829
 830         token = match_token(c, rbd_opts_tokens, argstr);
 831         if (token < Opt_last_int) {
 832                 ret = match_int(&argstr[0], &intval);
 833                 if (ret < 0) {
 834                         pr_err("bad mount option arg (not int) at '%s'\n", c);
 835                         return ret;
 836                 }
 837                 dout("got int token %d val %d\n", token, intval);
 838         } else if (token > Opt_last_int && token < Opt_last_string) {
 839                 dout("got string token %d val %s\n", token, argstr[0].from);
 840         } else {
 841                 dout("got token %d\n", token);
 842         }
 843
 844         switch (token) {
 845         case Opt_queue_depth:
 846                 if (intval < 1) {
 847                         pr_err("queue_depth out of range\n");
 848                         return -EINVAL;
 849                 }
 850                 rbd_opts->queue_depth = intval;
 851                 break;
 852         case Opt_read_only:
 853                 rbd_opts->read_only = true;
 854                 break;
 855         case Opt_read_write:
 856                 rbd_opts->read_only = false;
 857                 break;
 858         case Opt_lock_on_read:
 859                 rbd_opts->lock_on_read = true;
 860                 break;
 861         default:
 862                 /* libceph prints "bad option" msg */
 863                 return -EINVAL;
 864         }
 865
 866         return 0;
 867 }
 868
 869 static char* obj_op_name(enum obj_operation_type op_type)
 870 {
 871         switch (op_type) {
 872         case OBJ_OP_READ:
 873                 return "read";
 874         case OBJ_OP_WRITE:
 875                 return "write";
 876         case OBJ_OP_DISCARD:
 877                 return "discard";
 878         default:
 879                 return "???";
 880         }
 881 }
 882
 883 /*
 884  * Get a ceph client with specific addr and configuration, if one does
 885  * not exist create it.  Either way, ceph_opts is consumed by this
 886  * function.
 887  */
 888 static struct rbd_client *rbd_get_client(struct ceph_options *ceph_opts)
 889 {
 890         struct rbd_client *rbdc;
 891
 892         mutex_lock_nested(&client_mutex, SINGLE_DEPTH_NESTING);
 893         rbdc = rbd_client_find(ceph_opts);
 894         if (rbdc)       /* using an existing client */
 895                 ceph_destroy_options(ceph_opts);
 896         else
 897                 rbdc = rbd_client_create(ceph_opts);
 898         mutex_unlock(&client_mutex);
 899
 900         return rbdc;
 901 }
 902
 903 /*
 904  * Destroy ceph client
 905  *
 906  * Caller must hold rbd_client_list_lock.
 907  */
 908 static void rbd_client_release(struct kref *kref)
 909 {
 910         struct rbd_client *rbdc = container_of(kref, struct rbd_client, kref);
 911
 912         dout("%s: rbdc %p\n", __func__, rbdc);
 913         spin_lock(&rbd_client_list_lock);
 914         list_del(&rbdc->node);
 915         spin_unlock(&rbd_client_list_lock);
 916
 917         ceph_destroy_client(rbdc->client);
 918         kfree(rbdc);
 919 }
 920
 921 /*
 922  * Drop reference to ceph client node. If it's not referenced anymore, release
 923  * it.
 924  */
 925 static void rbd_put_client(struct rbd_client *rbdc)
 926 {
 927         if (rbdc)
 928                 kref_put(&rbdc->kref, rbd_client_release);
 929 }
 930
 931 static bool rbd_image_format_valid(u32 image_format)
 932 {
 933         return image_format == 1 || image_format == 2;
 934 }
 935
 936 static bool rbd_dev_ondisk_valid(struct rbd_image_header_ondisk *ondisk)
 937 {
 938         size_t size;
 939         u32 snap_count;
 940
 941         /* The header has to start with the magic rbd header text */
 942         if (memcmp(&ondisk->text, RBD_HEADER_TEXT, sizeof (RBD_HEADER_TEXT)))
 943                 return false;
 944
 945         /* The bio layer requires at least sector-sized I/O */
 946
 947         if (ondisk->options.order < SECTOR_SHIFT)
 948                 return false;
 949
 950         /* If we use u64 in a few spots we may be able to loosen this */
 951
 952         if (ondisk->options.order > 8 * sizeof (int) - 1)
 953                 return false;
 954
 955         /*
 956          * The size of a snapshot header has to fit in a size_t, and
 957          * that limits the number of snapshots.
 958          */
 959         snap_count = le32_to_cpu(ondisk->snap_count);
 960         size = SIZE_MAX - sizeof (struct ceph_snap_context);
 961         if (snap_count > size / sizeof (__le64))
 962                 return false;
 963
 964         /*
 965          * Not only that, but the size of the entire the snapshot
 966          * header must also be representable in a size_t.
 967          */
 968         size -= snap_count * sizeof (__le64);
 969         if ((u64) size < le64_to_cpu(ondisk->snap_names_len))
 970                 return false;
 971
 972         return true;
 973 }
 974
 975 /*
 976  * Fill an rbd image header with information from the given format 1
 977  * on-disk header.
 978  */
 979 static int rbd_header_from_disk(struct rbd_device *rbd_dev,
 980                                  struct rbd_image_header_ondisk *ondisk)
 981 {
 982         struct rbd_image_header *header = &rbd_dev->header;
 983         bool first_time = header->object_prefix == NULL;
 984         struct ceph_snap_context *snapc;
 985         char *object_prefix = NULL;
 986         char *snap_names = NULL;
 987         u64 *snap_sizes = NULL;
 988         u32 snap_count;
 989         size_t size;
 990         int ret = -ENOMEM;
 991         u32 i;
 992
 993         /* Allocate this now to avoid having to handle failure below */
 994
 995         if (first_time) {
 996                 size_t len;
 997
 998                 len = strnlen(ondisk->object_prefix,
 999                                 sizeof (ondisk->object_prefix));
1000                 object_prefix = kmalloc(len + 1, GFP_KERNEL);
1001                 if (!object_prefix)
1002                         return -ENOMEM;
1003                 memcpy(object_prefix, ondisk->object_prefix, len);
1004                 object_prefix[len] = '\0';
1005         }
1006
1007         /* Allocate the snapshot context and fill it in */
1008
1009         snap_count = le32_to_cpu(ondisk->snap_count);
1010         snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);
1011         if (!snapc)
1012                 goto out_err;
1013         snapc->seq = le64_to_cpu(ondisk->snap_seq);
1014         if (snap_count) {
1015                 struct rbd_image_snap_ondisk *snaps;
1016                 u64 snap_names_len = le64_to_cpu(ondisk->snap_names_len);
1017
1018                 /* We'll keep a copy of the snapshot names... */
1019
1020                 if (snap_names_len > (u64)SIZE_MAX)
1021                         goto out_2big;
1022                 snap_names = kmalloc(snap_names_len, GFP_KERNEL);
1023                 if (!snap_names)
1024                         goto out_err;
1025
1026                 /* ...as well as the array of their sizes. */
1027
1028                 size = snap_count * sizeof (*header->snap_sizes);
1029                 snap_sizes = kmalloc(size, GFP_KERNEL);
1030                 if (!snap_sizes)
1031                         goto out_err;
1032
1033                 /*
1034                  * Copy the names, and fill in each snapshot's id
1035                  * and size.
1036                  *
1037                  * Note that rbd_dev_v1_header_info() guarantees the
1038                  * ondisk buffer we're working with has
1039                  * snap_names_len bytes beyond the end of the
1040                  * snapshot id array, this memcpy() is safe.
1041                  */
1042                 memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);
1043                 snaps = ondisk->snaps;
1044                 for (i = 0; i < snap_count; i++) {
1045                         snapc->snaps[i] = le64_to_cpu(snaps[i].id);
1046                         snap_sizes[i] = le64_to_cpu(snaps[i].image_size);
1047                 }
1048         }
1049
1050         /* We won't fail any more, fill in the header */
1051
1052         if (first_time) {
1053                 header->object_prefix = object_prefix;
1054                 header->obj_order = ondisk->options.order;
1055                 header->crypt_type = ondisk->options.crypt_type;
1056                 header->comp_type = ondisk->options.comp_type;
1057                 /* The rest aren't used for format 1 images */
1058                 header->stripe_unit = 0;
1059                 header->stripe_count = 0;
1060                 header->features = 0;
1061         } else {
1062                 ceph_put_snap_context(header->snapc);
1063                 kfree(header->snap_names);
1064                 kfree(header->snap_sizes);
1065         }
1066
1067         /* The remaining fields always get updated (when we refresh) */
1068
1069         header->image_size = le64_to_cpu(ondisk->image_size);
1070         header->snapc = snapc;
1071         header->snap_names = snap_names;
1072         header->snap_sizes = snap_sizes;
1073
1074         return 0;
1075 out_2big:
1076         ret = -EIO;
1077 out_err:
1078         kfree(snap_sizes);
1079         kfree(snap_names);
1080         ceph_put_snap_context(snapc);
1081         kfree(object_prefix);
1082
1083         return ret;
1084 }
1085
1086 static const char *_rbd_dev_v1_snap_name(struct rbd_device *rbd_dev, u32 which)
1087 {
1088         const char *snap_name;
1089
1090         rbd_assert(which < rbd_dev->header.snapc->num_snaps);
1091
1092         /* Skip over names until we find the one we are looking for */
1093
1094         snap_name = rbd_dev->header.snap_names;
1095         while (which--)
1096                 snap_name += strlen(snap_name) + 1;
1097
1098         return kstrdup(snap_name, GFP_KERNEL);
1099 }
1100
1101 /*
1102  * Snapshot id comparison function for use with qsort()/bsearch().
1103  * Note that result is for snapshots in *descending* order.
1104  */
1105 static int snapid_compare_reverse(const void *s1, const void *s2)
1106 {
1107         u64 snap_id1 = *(u64 *)s1;
1108         u64 snap_id2 = *(u64 *)s2;
1109
1110         if (snap_id1 < snap_id2)
1111                 return 1;
1112         return snap_id1 == snap_id2 ? 0 : -1;
1113 }
1114
1115 /*
1116  * Search a snapshot context to see if the given snapshot id is
1117  * present.
1118  *
1119  * Returns the position of the snapshot id in the array if it's found,
1120  * or BAD_SNAP_INDEX otherwise.
1121  *
1122  * Note: The snapshot array is in kept sorted (by the osd) in
1123  * reverse order, highest snapshot id first.
1124  */
1125 static u32 rbd_dev_snap_index(struct rbd_device *rbd_dev, u64 snap_id)
1126 {
1127         struct ceph_snap_context *snapc = rbd_dev->header.snapc;
1128         u64 *found;
1129
1130         found = bsearch(&snap_id, &snapc->snaps, snapc->num_snaps,
1131                                 sizeof (snap_id), snapid_compare_reverse);
1132
1133         return found ? (u32)(found - &snapc->snaps[0]) : BAD_SNAP_INDEX;
1134 }
1135
1136 static const char *rbd_dev_v1_snap_name(struct rbd_device *rbd_dev,
1137                                         u64 snap_id)
1138 {
1139         u32 which;
1140         const char *snap_name;
1141
1142         which = rbd_dev_snap_index(rbd_dev, snap_id);
1143         if (which == BAD_SNAP_INDEX)
1144                 return ERR_PTR(-ENOENT);
1145
1146         snap_name = _rbd_dev_v1_snap_name(rbd_dev, which);
1147         return snap_name ? snap_name : ERR_PTR(-ENOMEM);
1148 }
1149
1150 static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)
1151 {
1152         if (snap_id == CEPH_NOSNAP)
1153                 return RBD_SNAP_HEAD_NAME;
1154
1155         rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
1156         if (rbd_dev->image_format == 1)
1157                 return rbd_dev_v1_snap_name(rbd_dev, snap_id);
1158
1159         return rbd_dev_v2_snap_name(rbd_dev, snap_id);
1160 }
1161
1162 static int rbd_snap_size(struct rbd_device *rbd_dev, u64 snap_id,
1163                                 u64 *snap_size)
1164 {
1165         rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
1166         if (snap_id == CEPH_NOSNAP) {
1167                 *snap_size = rbd_dev->header.image_size;
1168         } else if (rbd_dev->image_format == 1) {
1169                 u32 which;
1170
1171                 which = rbd_dev_snap_index(rbd_dev, snap_id);
1172                 if (which == BAD_SNAP_INDEX)
1173                         return -ENOENT;
1174
1175                 *snap_size = rbd_dev->header.snap_sizes[which];
1176         } else {
1177                 u64 size = 0;
1178                 int ret;
1179
1180                 ret = _rbd_dev_v2_snap_size(rbd_dev, snap_id, NULL, &size);
1181                 if (ret)
1182                         return ret;
1183
1184                 *snap_size = size;
1185         }
1186         return 0;
1187 }
1188
1189 static int rbd_snap_features(struct rbd_device *rbd_dev, u64 snap_id,
1190                         u64 *snap_features)
1191 {
1192         rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
1193         if (snap_id == CEPH_NOSNAP) {
1194                 *snap_features = rbd_dev->header.features;
1195         } else if (rbd_dev->image_format == 1) {
1196                 *snap_features = 0;     /* No features for format 1 */
1197         } else {
1198                 u64 features = 0;
1199                 int ret;
1200
1201                 ret = _rbd_dev_v2_snap_features(rbd_dev, snap_id, &features);
1202                 if (ret)
1203                         return ret;
1204
1205                 *snap_features = features;
1206         }
1207         return 0;
1208 }
1209
1210 static int rbd_dev_mapping_set(struct rbd_device *rbd_dev)
1211 {
1212         u64 snap_id = rbd_dev->spec->snap_id;
1213         u64 size = 0;
1214         u64 features = 0;
1215         int ret;
1216
1217         ret = rbd_snap_size(rbd_dev, snap_id, &size);
1218         if (ret)
1219                 return ret;
1220         ret = rbd_snap_features(rbd_dev, snap_id, &features);
1221         if (ret)
1222                 return ret;
1223
1224         rbd_dev->mapping.size = size;
1225         rbd_dev->mapping.features = features;
1226
1227         return 0;
1228 }
1229
1230 static void rbd_dev_mapping_clear(struct rbd_device *rbd_dev)
1231 {
1232         rbd_dev->mapping.size = 0;
1233         rbd_dev->mapping.features = 0;
1234 }
1235
1236 static void rbd_segment_name_free(const char *name)
1237 {
1238         /* The explicit cast here is needed to drop the const qualifier */
1239
1240         kmem_cache_free(rbd_segment_name_cache, (void *)name);
1241 }
1242
1243 static const char *rbd_segment_name(struct rbd_device *rbd_dev, u64 offset)
1244 {
1245         char *name;
1246         u64 segment;
1247         int ret;
1248         char *name_format;
1249
1250         name = kmem_cache_alloc(rbd_segment_name_cache, GFP_NOIO);
1251         if (!name)
1252                 return NULL;
1253         segment = offset >> rbd_dev->header.obj_order;
1254         name_format = "%s.%012llx";
1255         if (rbd_dev->image_format == 2)
1256                 name_format = "%s.%016llx";
1257         ret = snprintf(name, CEPH_MAX_OID_NAME_LEN + 1, name_format,
1258                         rbd_dev->header.object_prefix, segment);
1259         if (ret < 0 || ret > CEPH_MAX_OID_NAME_LEN) {
1260                 pr_err("error formatting segment name for #%llu (%d)\n",
1261                         segment, ret);
1262                 rbd_segment_name_free(name);
1263                 name = NULL;
1264         }
1265
1266         return name;
1267 }
1268
1269 static u64 rbd_segment_offset(struct rbd_device *rbd_dev, u64 offset)
1270 {
1271         u64 segment_size = (u64) 1 << rbd_dev->header.obj_order;
1272
1273         return offset & (segment_size - 1);
1274 }
1275
1276 static u64 rbd_segment_length(struct rbd_device *rbd_dev,
1277                                 u64 offset, u64 length)
1278 {
1279         u64 segment_size = (u64) 1 << rbd_dev->header.obj_order;
1280
1281         offset &= segment_size - 1;
1282
1283         rbd_assert(length <= U64_MAX - offset);
1284         if (offset + length > segment_size)
1285                 length = segment_size - offset;
1286
1287         return length;
1288 }
1289
1290 /*
1291  * returns the size of an object in the image
1292  */
1293 static u64 rbd_obj_bytes(struct rbd_image_header *header)
1294 {
1295         return 1 << header->obj_order;
1296 }
1297
1298 /*
1299  * bio helpers
1300  */
1301
1302 static void bio_chain_put(struct bio *chain)
1303 {
1304         struct bio *tmp;
1305
1306         while (chain) {
1307                 tmp = chain;
1308                 chain = chain->bi_next;
1309                 bio_put(tmp);
1310         }
1311 }
1312
1313 /*
1314  * zeros a bio chain, starting at specific offset
1315  */
1316 static void zero_bio_chain(struct bio *chain, int start_ofs)
1317 {
1318         struct bio_vec bv;
1319         struct bvec_iter iter;
1320         unsigned long flags;
1321         void *buf;
1322         int pos = 0;
1323
1324         while (chain) {
1325                 bio_for_each_segment(bv, chain, iter) {
1326                         if (pos + bv.bv_len > start_ofs) {
1327                                 int remainder = max(start_ofs - pos, 0);
1328                                 buf = bvec_kmap_irq(&bv, &flags);
1329                                 memset(buf + remainder, 0,
1330                                        bv.bv_len - remainder);
1331                                 flush_dcache_page(bv.bv_page);
1332                                 bvec_kunmap_irq(buf, &flags);
1333                         }
1334                         pos += bv.bv_len;
1335                 }
1336
1337                 chain = chain->bi_next;
1338         }
1339 }
1340
1341 /*
1342  * similar to zero_bio_chain(), zeros data defined by a page array,
1343  * starting at the given byte offset from the start of the array and
1344  * continuing up to the given end offset.  The pages array is
1345  * assumed to be big enough to hold all bytes up to the end.
1346  */
1347 static void zero_pages(struct page **pages, u64 offset, u64 end)
1348 {
1349         struct page **page = &pages[offset >> PAGE_SHIFT];
1350
1351         rbd_assert(end > offset);
1352         rbd_assert(end - offset <= (u64)SIZE_MAX);
1353         while (offset < end) {
1354                 size_t page_offset;
1355                 size_t length;
1356                 unsigned long flags;
1357                 void *kaddr;
1358
1359                 page_offset = offset & ~PAGE_MASK;
1360                 length = min_t(size_t, PAGE_SIZE - page_offset, end - offset);
1361                 local_irq_save(flags);
1362                 kaddr = kmap_atomic(*page);
1363                 memset(kaddr + page_offset, 0, length);
1364                 flush_dcache_page(*page);
1365                 kunmap_atomic(kaddr);
1366                 local_irq_restore(flags);
1367
1368                 offset += length;
1369                 page++;
1370         }
1371 }
1372
1373 /*
1374  * Clone a portion of a bio, starting at the given byte offset
1375  * and continuing for the number of bytes indicated.
1376  */
1377 static struct bio *bio_clone_range(struct bio *bio_src,
1378                                         unsigned int offset,
1379                                         unsigned int len,
1380                                         gfp_t gfpmask)
1381 {
1382         struct bio *bio;
1383
1384         bio = bio_clone(bio_src, gfpmask);
1385         if (!bio)
1386                 return NULL;    /* ENOMEM */
1387
1388         bio_advance(bio, offset);
1389         bio->bi_iter.bi_size = len;
1390
1391         return bio;
1392 }
1393
1394 /*
1395  * Clone a portion of a bio chain, starting at the given byte offset
1396  * into the first bio in the source chain and continuing for the
1397  * number of bytes indicated.  The result is another bio chain of
1398  * exactly the given length, or a null pointer on error.
1399  *
1400  * The bio_src and offset parameters are both in-out.  On entry they
1401  * refer to the first source bio and the offset into that bio where
1402  * the start of data to be cloned is located.
1403  *
1404  * On return, bio_src is updated to refer to the bio in the source
1405  * chain that contains first un-cloned byte, and *offset will
1406  * contain the offset of that byte within that bio.
1407  */
1408 static struct bio *bio_chain_clone_range(struct bio **bio_src,
1409                                         unsigned int *offset,
1410                                         unsigned int len,
1411                                         gfp_t gfpmask)
1412 {
1413         struct bio *bi = *bio_src;
1414         unsigned int off = *offset;
1415         struct bio *chain = NULL;
1416         struct bio **end;
1417
1418         /* Build up a chain of clone bios up to the limit */
1419
1420         if (!bi || off >= bi->bi_iter.bi_size || !len)
1421                 return NULL;            /* Nothing to clone */
1422
1423         end = &chain;
1424         while (len) {
1425                 unsigned int bi_size;
1426                 struct bio *bio;
1427
1428                 if (!bi) {
1429                         rbd_warn(NULL, "bio_chain exhausted with %u left", len);
1430                         goto out_err;   /* EINVAL; ran out of bio's */
1431                 }
1432                 bi_size = min_t(unsigned int, bi->bi_iter.bi_size - off, len);
1433                 bio = bio_clone_range(bi, off, bi_size, gfpmask);
1434                 if (!bio)
1435                         goto out_err;   /* ENOMEM */
1436
1437                 *end = bio;
1438                 end = &bio->bi_next;
1439
1440                 off += bi_size;
1441                 if (off == bi->bi_iter.bi_size) {
1442                         bi = bi->bi_next;
1443                         off = 0;
1444                 }
1445                 len -= bi_size;
1446         }
1447         *bio_src = bi;
1448         *offset = off;
1449
1450         return chain;
1451 out_err:
1452         bio_chain_put(chain);
1453
1454         return NULL;
1455 }
1456
1457 /*
1458  * The default/initial value for all object request flags is 0.  For
1459  * each flag, once its value is set to 1 it is never reset to 0
1460  * again.
1461  */
1462 static void obj_request_img_data_set(struct rbd_obj_request *obj_request)
1463 {
1464         if (test_and_set_bit(OBJ_REQ_IMG_DATA, &obj_request->flags)) {
1465                 struct rbd_device *rbd_dev;
1466
1467                 rbd_dev = obj_request->img_request->rbd_dev;
1468                 rbd_warn(rbd_dev, "obj_request %p already marked img_data",
1469                         obj_request);
1470         }
1471 }
1472
1473 static bool obj_request_img_data_test(struct rbd_obj_request *obj_request)
1474 {
1475         smp_mb();
1476         return test_bit(OBJ_REQ_IMG_DATA, &obj_request->flags) != 0;
1477 }
1478
1479 static void obj_request_done_set(struct rbd_obj_request *obj_request)
1480 {
1481         if (test_and_set_bit(OBJ_REQ_DONE, &obj_request->flags)) {
1482                 struct rbd_device *rbd_dev = NULL;
1483
1484                 if (obj_request_img_data_test(obj_request))
1485                         rbd_dev = obj_request->img_request->rbd_dev;
1486                 rbd_warn(rbd_dev, "obj_request %p already marked done",
1487                         obj_request);
1488         }
1489 }
1490
1491 static bool obj_request_done_test(struct rbd_obj_request *obj_request)
1492 {
1493         smp_mb();
1494         return test_bit(OBJ_REQ_DONE, &obj_request->flags) != 0;
1495 }
1496
1497 /*
1498  * This sets the KNOWN flag after (possibly) setting the EXISTS
1499  * flag.  The latter is set based on the "exists" value provided.
1500  *
1501  * Note that for our purposes once an object exists it never goes
1502  * away again.  It's possible that the response from two existence
1503  * checks are separated by the creation of the target object, and
1504  * the first ("doesn't exist") response arrives *after* the second
1505  * ("does exist").  In that case we ignore the second one.
1506  */
1507 static void obj_request_existence_set(struct rbd_obj_request *obj_request,
1508                                 bool exists)
1509 {
1510         if (exists)
1511                 set_bit(OBJ_REQ_EXISTS, &obj_request->flags);
1512         set_bit(OBJ_REQ_KNOWN, &obj_request->flags);
1513         smp_mb();
1514 }
1515
1516 static bool obj_request_known_test(struct rbd_obj_request *obj_request)
1517 {
1518         smp_mb();
1519         return test_bit(OBJ_REQ_KNOWN, &obj_request->flags) != 0;
1520 }
1521
1522 static bool obj_request_exists_test(struct rbd_obj_request *obj_request)
1523 {
1524         smp_mb();
1525         return test_bit(OBJ_REQ_EXISTS, &obj_request->flags) != 0;
1526 }
1527
1528 static bool obj_request_overlaps_parent(struct rbd_obj_request *obj_request)
1529 {
1530         struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
1531
1532         return obj_request->img_offset <
1533             round_up(rbd_dev->parent_overlap, rbd_obj_bytes(&rbd_dev->header));
1534 }
1535
1536 static void rbd_obj_request_get(struct rbd_obj_request *obj_request)
1537 {
1538         dout("%s: obj %p (was %d)\n", __func__, obj_request,
1539                 atomic_read(&obj_request->kref.refcount));
1540         kref_get(&obj_request->kref);
1541 }
1542
1543 static void rbd_obj_request_destroy(struct kref *kref);
1544 static void rbd_obj_request_put(struct rbd_obj_request *obj_request)
1545 {
1546         rbd_assert(obj_request != NULL);
1547         dout("%s: obj %p (was %d)\n", __func__, obj_request,
1548                 atomic_read(&obj_request->kref.refcount));
1549         kref_put(&obj_request->kref, rbd_obj_request_destroy);
1550 }
1551
1552 static void rbd_img_request_get(struct rbd_img_request *img_request)
1553 {
1554         dout("%s: img %p (was %d)\n", __func__, img_request,
1555              atomic_read(&img_request->kref.refcount));
1556         kref_get(&img_request->kref);
1557 }
1558
1559 static bool img_request_child_test(struct rbd_img_request *img_request);
1560 static void rbd_parent_request_destroy(struct kref *kref);
1561 static void rbd_img_request_destroy(struct kref *kref);
1562 static void rbd_img_request_put(struct rbd_img_request *img_request)
1563 {
1564         rbd_assert(img_request != NULL);
1565         dout("%s: img %p (was %d)\n", __func__, img_request,
1566                 atomic_read(&img_request->kref.refcount));
1567         if (img_request_child_test(img_request))
1568                 kref_put(&img_request->kref, rbd_parent_request_destroy);
1569         else
1570                 kref_put(&img_request->kref, rbd_img_request_destroy);
1571 }
1572
1573 static inline void rbd_img_obj_request_add(struct rbd_img_request *img_request,
1574                                         struct rbd_obj_request *obj_request)
1575 {
1576         rbd_assert(obj_request->img_request == NULL);
1577
1578         /* Image request now owns object's original reference */
1579         obj_request->img_request = img_request;
1580         obj_request->which = img_request->obj_request_count;
1581         rbd_assert(!obj_request_img_data_test(obj_request));
1582         obj_request_img_data_set(obj_request);
1583         rbd_assert(obj_request->which != BAD_WHICH);
1584         img_request->obj_request_count++;
1585         list_add_tail(&obj_request->links, &img_request->obj_requests);
1586         dout("%s: img %p obj %p w=%u\n", __func__, img_request, obj_request,
1587                 obj_request->which);
1588 }
1589
1590 static inline void rbd_img_obj_request_del(struct rbd_img_request *img_request,
1591                                         struct rbd_obj_request *obj_request)
1592 {
1593         rbd_assert(obj_request->which != BAD_WHICH);
1594
1595         dout("%s: img %p obj %p w=%u\n", __func__, img_request, obj_request,
1596                 obj_request->which);
1597         list_del(&obj_request->links);
1598         rbd_assert(img_request->obj_request_count > 0);
1599         img_request->obj_request_count--;
1600         rbd_assert(obj_request->which == img_request->obj_request_count);
1601         obj_request->which = BAD_WHICH;
1602         rbd_assert(obj_request_img_data_test(obj_request));
1603         rbd_assert(obj_request->img_request == img_request);
1604         obj_request->img_request = NULL;
1605         obj_request->callback = NULL;
1606         rbd_obj_request_put(obj_request);
1607 }
1608
1609 static bool obj_request_type_valid(enum obj_request_type type)
1610 {
1611         switch (type) {
1612         case OBJ_REQUEST_NODATA:
1613         case OBJ_REQUEST_BIO:
1614         case OBJ_REQUEST_PAGES:
1615                 return true;
1616         default:
1617                 return false;
1618         }
1619 }
1620
1621 static void rbd_img_obj_callback(struct rbd_obj_request *obj_request);
1622
1623 static void rbd_obj_request_submit(struct rbd_obj_request *obj_request)
1624 {
1625         struct ceph_osd_request *osd_req = obj_request->osd_req;
1626
1627         dout("%s %p osd_req %p\n", __func__, obj_request, osd_req);
1628         if (obj_request_img_data_test(obj_request)) {
1629                 WARN_ON(obj_request->callback != rbd_img_obj_callback);
1630                 rbd_img_request_get(obj_request->img_request);
1631         }
1632         ceph_osdc_start_request(osd_req->r_osdc, osd_req, false);
1633 }
1634
1635 static void rbd_obj_request_end(struct rbd_obj_request *obj_request)
1636 {
1637         dout("%s %p\n", __func__, obj_request);
1638         ceph_osdc_cancel_request(obj_request->osd_req);
1639 }
1640
1641 /*
1642  * Wait for an object request to complete.  If interrupted, cancel the
1643  * underlying osd request.
1644  *
1645  * @timeout: in jiffies, 0 means "wait forever"
1646  */
1647 static int __rbd_obj_request_wait(struct rbd_obj_request *obj_request,
1648                                   unsigned long timeout)
1649 {
1650         long ret;
1651
1652         dout("%s %p\n", __func__, obj_request);
1653         ret = wait_for_completion_interruptible_timeout(
1654                                         &obj_request->completion,
1655                                         ceph_timeout_jiffies(timeout));
1656         if (ret <= 0) {
1657                 if (ret == 0)
1658                         ret = -ETIMEDOUT;
1659                 rbd_obj_request_end(obj_request);
1660         } else {
1661                 ret = 0;
1662         }
1663
1664         dout("%s %p ret %d\n", __func__, obj_request, (int)ret);
1665         return ret;
1666 }
1667
1668 static int rbd_obj_request_wait(struct rbd_obj_request *obj_request)
1669 {
1670         return __rbd_obj_request_wait(obj_request, 0);
1671 }
1672
1673 static void rbd_img_request_complete(struct rbd_img_request *img_request)
1674 {
1675
1676         dout("%s: img %p\n", __func__, img_request);
1677
1678         /*
1679          * If no error occurred, compute the aggregate transfer
1680          * count for the image request.  We could instead use
1681          * atomic64_cmpxchg() to update it as each object request
1682          * completes; not clear which way is better off hand.
1683          */
1684         if (!img_request->result) {
1685                 struct rbd_obj_request *obj_request;
1686                 u64 xferred = 0;
1687
1688                 for_each_obj_request(img_request, obj_request)
1689                         xferred += obj_request->xferred;
1690                 img_request->xferred = xferred;
1691         }
1692
1693         if (img_request->callback)
1694                 img_request->callback(img_request);
1695         else
1696                 rbd_img_request_put(img_request);
1697 }
1698
1699 /*
1700  * The default/initial value for all image request flags is 0.  Each
1701  * is conditionally set to 1 at image request initialization time
1702  * and currently never change thereafter.
1703  */
1704 static void img_request_write_set(struct rbd_img_request *img_request)
1705 {
1706         set_bit(IMG_REQ_WRITE, &img_request->flags);
1707         smp_mb();
1708 }
1709
1710 static bool img_request_write_test(struct rbd_img_request *img_request)
1711 {
1712         smp_mb();
1713         return test_bit(IMG_REQ_WRITE, &img_request->flags) != 0;
1714 }
1715
1716 /*
1717  * Set the discard flag when the img_request is an discard request
1718  */
1719 static void img_request_discard_set(struct rbd_img_request *img_request)
1720 {
1721         set_bit(IMG_REQ_DISCARD, &img_request->flags);
1722         smp_mb();
1723 }
1724
1725 static bool img_request_discard_test(struct rbd_img_request *img_request)
1726 {
1727         smp_mb();
1728         return test_bit(IMG_REQ_DISCARD, &img_request->flags) != 0;
1729 }
1730
1731 static void img_request_child_set(struct rbd_img_request *img_request)
1732 {
1733         set_bit(IMG_REQ_CHILD, &img_request->flags);
1734         smp_mb();
1735 }
1736
1737 static void img_request_child_clear(struct rbd_img_request *img_request)
1738 {
1739         clear_bit(IMG_REQ_CHILD, &img_request->flags);
1740         smp_mb();
1741 }
1742
1743 static bool img_request_child_test(struct rbd_img_request *img_request)
1744 {
1745         smp_mb();
1746         return test_bit(IMG_REQ_CHILD, &img_request->flags) != 0;
1747 }
1748
1749 static void img_request_layered_set(struct rbd_img_request *img_request)
1750 {
1751         set_bit(IMG_REQ_LAYERED, &img_request->flags);
1752         smp_mb();
1753 }
1754
1755 static void img_request_layered_clear(struct rbd_img_request *img_request)
1756 {
1757         clear_bit(IMG_REQ_LAYERED, &img_request->flags);
1758         smp_mb();
1759 }
1760
1761 static bool img_request_layered_test(struct rbd_img_request *img_request)
1762 {
1763         smp_mb();
1764         return test_bit(IMG_REQ_LAYERED, &img_request->flags) != 0;
1765 }
1766
1767 static enum obj_operation_type
1768 rbd_img_request_op_type(struct rbd_img_request *img_request)
1769 {
1770         if (img_request_write_test(img_request))
1771                 return OBJ_OP_WRITE;
1772         else if (img_request_discard_test(img_request))
1773                 return OBJ_OP_DISCARD;
1774         else
1775                 return OBJ_OP_READ;
1776 }
1777
1778 static void
1779 rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
1780 {
1781         u64 xferred = obj_request->xferred;
1782         u64 length = obj_request->length;
1783
1784         dout("%s: obj %p img %p result %d %llu/%llu\n", __func__,
1785                 obj_request, obj_request->img_request, obj_request->result,
1786                 xferred, length);
1787         /*
1788          * ENOENT means a hole in the image.  We zero-fill the entire
1789          * length of the request.  A short read also implies zero-fill
1790          * to the end of the request.  An error requires the whole
1791          * length of the request to be reported finished with an error
1792          * to the block layer.  In each case we update the xferred
1793          * count to indicate the whole request was satisfied.
1794          */
1795         rbd_assert(obj_request->type != OBJ_REQUEST_NODATA);
1796         if (obj_request->result == -ENOENT) {
1797                 if (obj_request->type == OBJ_REQUEST_BIO)
1798                         zero_bio_chain(obj_request->bio_list, 0);
1799                 else
1800                         zero_pages(obj_request->pages, 0, length);
1801                 obj_request->result = 0;
1802         } else if (xferred < length && !obj_request->result) {
1803                 if (obj_request->type == OBJ_REQUEST_BIO)
1804                         zero_bio_chain(obj_request->bio_list, xferred);
1805                 else
1806                         zero_pages(obj_request->pages, xferred, length);
1807         }
1808         obj_request->xferred = length;
1809         obj_request_done_set(obj_request);
1810 }
1811
1812 static void rbd_obj_request_complete(struct rbd_obj_request *obj_request)
1813 {
1814         dout("%s: obj %p cb %p\n", __func__, obj_request,
1815                 obj_request->callback);
1816         if (obj_request->callback)
1817                 obj_request->callback(obj_request);
1818         else
1819                 complete_all(&obj_request->completion);
1820 }
1821
1822 static void rbd_obj_request_error(struct rbd_obj_request *obj_request, int err)
1823 {
1824         obj_request->result = err;
1825         obj_request->xferred = 0;
1826         /*
1827          * kludge - mirror rbd_obj_request_submit() to match a put in
1828          * rbd_img_obj_callback()
1829          */
1830         if (obj_request_img_data_test(obj_request)) {
1831                 WARN_ON(obj_request->callback != rbd_img_obj_callback);
1832                 rbd_img_request_get(obj_request->img_request);
1833         }
1834         obj_request_done_set(obj_request);
1835         rbd_obj_request_complete(obj_request);
1836 }
1837
1838 static void rbd_osd_read_callback(struct rbd_obj_request *obj_request)
1839 {
1840         struct rbd_img_request *img_request = NULL;
1841         struct rbd_device *rbd_dev = NULL;
1842         bool layered = false;
1843
1844         if (obj_request_img_data_test(obj_request)) {
1845                 img_request = obj_request->img_request;
1846                 layered = img_request && img_request_layered_test(img_request);
1847                 rbd_dev = img_request->rbd_dev;
1848         }
1849
1850         dout("%s: obj %p img %p result %d %llu/%llu\n", __func__,
1851                 obj_request, img_request, obj_request->result,
1852                 obj_request->xferred, obj_request->length);
1853         if (layered && obj_request->result == -ENOENT &&
1854                         obj_request->img_offset < rbd_dev->parent_overlap)
1855                 rbd_img_parent_read(obj_request);
1856         else if (img_request)
1857                 rbd_img_obj_request_read_callback(obj_request);
1858         else
1859                 obj_request_done_set(obj_request);
1860 }
1861
1862 static void rbd_osd_write_callback(struct rbd_obj_request *obj_request)
1863 {
1864         dout("%s: obj %p result %d %llu\n", __func__, obj_request,
1865                 obj_request->result, obj_request->length);
1866         /*
1867          * There is no such thing as a successful short write.  Set
1868          * it to our originally-requested length.
1869          */
1870         obj_request->xferred = obj_request->length;
1871         obj_request_done_set(obj_request);
1872 }
1873
1874 static void rbd_osd_discard_callback(struct rbd_obj_request *obj_request)
1875 {
1876         dout("%s: obj %p result %d %llu\n", __func__, obj_request,
1877                 obj_request->result, obj_request->length);
1878         /*
1879          * There is no such thing as a successful short discard.  Set
1880          * it to our originally-requested length.
1881          */
1882         obj_request->xferred = obj_request->length;
1883         /* discarding a non-existent object is not a problem */
1884         if (obj_request->result == -ENOENT)
1885                 obj_request->result = 0;
1886         obj_request_done_set(obj_request);
1887 }
1888
1889 /*
1890  * For a simple stat call there's nothing to do.  We'll do more if
1891  * this is part of a write sequence for a layered image.
1892  */
1893 static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request)
1894 {
1895         dout("%s: obj %p\n", __func__, obj_request);
1896         obj_request_done_set(obj_request);
1897 }
1898
1899 static void rbd_osd_call_callback(struct rbd_obj_request *obj_request)
1900 {
1901         dout("%s: obj %p\n", __func__, obj_request);
1902
1903         if (obj_request_img_data_test(obj_request))
1904                 rbd_osd_copyup_callback(obj_request);
1905         else
1906                 obj_request_done_set(obj_request);
1907 }
1908
1909 static void rbd_osd_req_callback(struct ceph_osd_request *osd_req)
1910 {
1911         struct rbd_obj_request *obj_request = osd_req->r_priv;
1912         u16 opcode;
1913
1914         dout("%s: osd_req %p\n", __func__, osd_req);
1915         rbd_assert(osd_req == obj_request->osd_req);
1916         if (obj_request_img_data_test(obj_request)) {
1917                 rbd_assert(obj_request->img_request);
1918                 rbd_assert(obj_request->which != BAD_WHICH);
1919         } else {
1920                 rbd_assert(obj_request->which == BAD_WHICH);
1921         }
1922
1923         if (osd_req->r_result < 0)
1924                 obj_request->result = osd_req->r_result;
1925
1926         /*
1927          * We support a 64-bit length, but ultimately it has to be
1928          * passed to the block layer, which just supports a 32-bit
1929          * length field.
1930          */
1931         obj_request->xferred = osd_req->r_ops[0].outdata_len;
1932         rbd_assert(obj_request->xferred < (u64)UINT_MAX);
1933
1934         opcode = osd_req->r_ops[0].op;
1935         switch (opcode) {
1936         case CEPH_OSD_OP_READ:
1937                 rbd_osd_read_callback(obj_request);
1938                 break;
1939         case CEPH_OSD_OP_SETALLOCHINT:
1940                 rbd_assert(osd_req->r_ops[1].op == CEPH_OSD_OP_WRITE ||
1941                            osd_req->r_ops[1].op == CEPH_OSD_OP_WRITEFULL);
1942                 /* fall through */
1943         case CEPH_OSD_OP_WRITE:
1944         case CEPH_OSD_OP_WRITEFULL:
1945                 rbd_osd_write_callback(obj_request);
1946                 break;
1947         case CEPH_OSD_OP_STAT:
1948                 rbd_osd_stat_callback(obj_request);
1949                 break;
1950         case CEPH_OSD_OP_DELETE:
1951         case CEPH_OSD_OP_TRUNCATE:
1952         case CEPH_OSD_OP_ZERO:
1953                 rbd_osd_discard_callback(obj_request);
1954                 break;
1955         case CEPH_OSD_OP_CALL:
1956                 rbd_osd_call_callback(obj_request);
1957                 break;
1958         default:
1959                 rbd_warn(NULL, "%s: unsupported op %hu",
1960                         obj_request->object_name, (unsigned short) opcode);
1961                 break;
1962         }
1963
1964         if (obj_request_done_test(obj_request))
1965                 rbd_obj_request_complete(obj_request);
1966 }
1967
1968 static void rbd_osd_req_format_read(struct rbd_obj_request *obj_request)
1969 {
1970         struct ceph_osd_request *osd_req = obj_request->osd_req;
1971
1972         rbd_assert(obj_request_img_data_test(obj_request));
1973         osd_req->r_snapid = obj_request->img_request->snap_id;
1974 }
1975
1976 static void rbd_osd_req_format_write(struct rbd_obj_request *obj_request)
1977 {
1978         struct ceph_osd_request *osd_req = obj_request->osd_req;
1979
1980         osd_req->r_mtime = CURRENT_TIME;
1981         osd_req->r_data_offset = obj_request->offset;
1982 }
1983
1984 /*
1985  * Create an osd request.  A read request has one osd op (read).
1986  * A write request has either one (watch) or two (hint+write) osd ops.
1987  * (All rbd data writes are prefixed with an allocation hint op, but
1988  * technically osd watch is a write request, hence this distinction.)
1989  */
1990 static struct ceph_osd_request *rbd_osd_req_create(
1991                                         struct rbd_device *rbd_dev,
1992                                         enum obj_operation_type op_type,
1993                                         unsigned int num_ops,
1994                                         struct rbd_obj_request *obj_request)
1995 {
1996         struct ceph_snap_context *snapc = NULL;
1997         struct ceph_osd_client *osdc;
1998         struct ceph_osd_request *osd_req;
1999
2000         if (obj_request_img_data_test(obj_request) &&
2001                 (op_type == OBJ_OP_DISCARD || op_type == OBJ_OP_WRITE)) {
2002                 struct rbd_img_request *img_request = obj_request->img_request;
2003                 if (op_type == OBJ_OP_WRITE) {
2004                         rbd_assert(img_request_write_test(img_request));
2005                 } else {
2006                         rbd_assert(img_request_discard_test(img_request));
2007                 }
2008                 snapc = img_request->snapc;
2009         }
2010
2011         rbd_assert(num_ops == 1 || ((op_type == OBJ_OP_WRITE) && num_ops == 2));
2012
2013         /* Allocate and initialize the request, for the num_ops ops */
2014
2015         osdc = &rbd_dev->rbd_client->client->osdc;
2016         osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false,
2017                                           GFP_NOIO);
2018         if (!osd_req)
2019                 goto fail;
2020
2021         if (op_type == OBJ_OP_WRITE || op_type == OBJ_OP_DISCARD)
2022                 osd_req->r_flags = CEPH_OSD_FLAG_WRITE | CEPH_OSD_FLAG_ONDISK;
2023         else
2024                 osd_req->r_flags = CEPH_OSD_FLAG_READ;
2025
2026         osd_req->r_callback = rbd_osd_req_callback;
2027         osd_req->r_priv = obj_request;
2028
2029         osd_req->r_base_oloc.pool = rbd_dev->layout.pool_id;
2030         if (ceph_oid_aprintf(&osd_req->r_base_oid, GFP_NOIO, "%s",
2031                              obj_request->object_name))
2032                 goto fail;
2033
2034         if (ceph_osdc_alloc_messages(osd_req, GFP_NOIO))
2035                 goto fail;
2036
2037         return osd_req;
2038
2039 fail:
2040         ceph_osdc_put_request(osd_req);
2041         return NULL;
2042 }
2043
2044 /*
2045  * Create a copyup osd request based on the information in the object
2046  * request supplied.  A copyup request has two or three osd ops, a
2047  * copyup method call, potentially a hint op, and a write or truncate
2048  * or zero op.
2049  */
2050 static struct ceph_osd_request *
2051 rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request)
2052 {
2053         struct rbd_img_request *img_request;
2054         struct ceph_snap_context *snapc;
2055         struct rbd_device *rbd_dev;
2056         struct ceph_osd_client *osdc;
2057         struct ceph_osd_request *osd_req;
2058         int num_osd_ops = 3;
2059
2060         rbd_assert(obj_request_img_data_test(obj_request));
2061         img_request = obj_request->img_request;
2062         rbd_assert(img_request);
2063         rbd_assert(img_request_write_test(img_request) ||
2064                         img_request_discard_test(img_request));
2065
2066         if (img_request_discard_test(img_request))
2067                 num_osd_ops = 2;
2068
2069         /* Allocate and initialize the request, for all the ops */
2070
2071         snapc = img_request->snapc;
2072         rbd_dev = img_request->rbd_dev;
2073         osdc = &rbd_dev->rbd_client->client->osdc;
2074         osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops,
2075                                                 false, GFP_NOIO);
2076         if (!osd_req)
2077                 goto fail;
2078
2079         osd_req->r_flags = CEPH_OSD_FLAG_WRITE | CEPH_OSD_FLAG_ONDISK;
2080         osd_req->r_callback = rbd_osd_req_callback;
2081         osd_req->r_priv = obj_request;
2082
2083         osd_req->r_base_oloc.pool = rbd_dev->layout.pool_id;
2084         if (ceph_oid_aprintf(&osd_req->r_base_oid, GFP_NOIO, "%s",
2085                              obj_request->object_name))
2086                 goto fail;
2087
2088         if (ceph_osdc_alloc_messages(osd_req, GFP_NOIO))
2089                 goto fail;
2090
2091         return osd_req;
2092
2093 fail:
2094         ceph_osdc_put_request(osd_req);
2095         return NULL;
2096 }
2097
2098
2099 static void rbd_osd_req_destroy(struct ceph_osd_request *osd_req)
2100 {
2101         ceph_osdc_put_request(osd_req);
2102 }
2103
2104 /* object_name is assumed to be a non-null pointer and NUL-terminated */
2105
2106 static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
2107                                                 u64 offset, u64 length,
2108                                                 enum obj_request_type type)
2109 {
2110         struct rbd_obj_request *obj_request;
2111         size_t size;
2112         char *name;
2113
2114         rbd_assert(obj_request_type_valid(type));
2115
2116         size = strlen(object_name) + 1;
2117         name = kmalloc(size, GFP_NOIO);
2118         if (!name)
2119                 return NULL;
2120
2121         obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
2122         if (!obj_request) {
2123                 kfree(name);
2124                 return NULL;
2125         }
2126
2127         obj_request->object_name = memcpy(name, object_name, size);
2128         obj_request->offset = offset;
2129         obj_request->length = length;
2130         obj_request->flags = 0;
2131         obj_request->which = BAD_WHICH;
2132         obj_request->type = type;
2133         INIT_LIST_HEAD(&obj_request->links);
2134         init_completion(&obj_request->completion);
2135         kref_init(&obj_request->kref);
2136
2137         dout("%s: \"%s\" %llu/%llu %d -> obj %p\n", __func__, object_name,
2138                 offset, length, (int)type, obj_request);
2139
2140         return obj_request;
2141 }
2142
2143 static void rbd_obj_request_destroy(struct kref *kref)
2144 {
2145         struct rbd_obj_request *obj_request;
2146
2147         obj_request = container_of(kref, struct rbd_obj_request, kref);
2148
2149         dout("%s: obj %p\n", __func__, obj_request);
2150
2151         rbd_assert(obj_request->img_request == NULL);
2152         rbd_assert(obj_request->which == BAD_WHICH);
2153
2154         if (obj_request->osd_req)
2155                 rbd_osd_req_destroy(obj_request->osd_req);
2156
2157         rbd_assert(obj_request_type_valid(obj_request->type));
2158         switch (obj_request->type) {
2159         case OBJ_REQUEST_NODATA:
2160                 break;          /* Nothing to do */
2161         case OBJ_REQUEST_BIO:
2162                 if (obj_request->bio_list)
2163                         bio_chain_put(obj_request->bio_list);
2164                 break;
2165         case OBJ_REQUEST_PAGES:
2166                 /* img_data requests don't own their page array */
2167                 if (obj_request->pages &&
2168                     !obj_request_img_data_test(obj_request))
2169                         ceph_release_page_vector(obj_request->pages,
2170                                                 obj_request->page_count);
2171                 break;
2172         }
2173
2174         kfree(obj_request->object_name);
2175         obj_request->object_name = NULL;
2176         kmem_cache_free(rbd_obj_request_cache, obj_request);
2177 }
2178
2179 /* It's OK to call this for a device with no parent */
2180
2181 static void rbd_spec_put(struct rbd_spec *spec);
2182 static void rbd_dev_unparent(struct rbd_device *rbd_dev)
2183 {
2184         rbd_dev_remove_parent(rbd_dev);
2185         rbd_spec_put(rbd_dev->parent_spec);
2186         rbd_dev->parent_spec = NULL;
2187         rbd_dev->parent_overlap = 0;
2188 }
2189
2190 /*
2191  * Parent image reference counting is used to determine when an
2192  * image's parent fields can be safely torn down--after there are no
2193  * more in-flight requests to the parent image.  When the last
2194  * reference is dropped, cleaning them up is safe.
2195  */
2196 static void rbd_dev_parent_put(struct rbd_device *rbd_dev)
2197 {
2198         int counter;
2199
2200         if (!rbd_dev->parent_spec)
2201                 return;
2202
2203         counter = atomic_dec_return_safe(&rbd_dev->parent_ref);
2204         if (counter > 0)
2205                 return;
2206
2207         /* Last reference; clean up parent data structures */
2208
2209         if (!counter)
2210                 rbd_dev_unparent(rbd_dev);
2211         else
2212                 rbd_warn(rbd_dev, "parent reference underflow");
2213 }
2214
2215 /*
2216  * If an image has a non-zero parent overlap, get a reference to its
2217  * parent.
2218  *
2219  * Returns true if the rbd device has a parent with a non-zero
2220  * overlap and a reference for it was successfully taken, or
2221  * false otherwise.
2222  */
2223 static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
2224 {
2225         int counter = 0;
2226
2227         if (!rbd_dev->parent_spec)
2228                 return false;
2229
2230         down_read(&rbd_dev->header_rwsem);
2231         if (rbd_dev->parent_overlap)
2232                 counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
2233         up_read(&rbd_dev->header_rwsem);
2234
2235         if (counter < 0)
2236                 rbd_warn(rbd_dev, "parent reference overflow");
2237
2238         return counter > 0;
2239 }
2240
2241 /*
2242  * Caller is responsible for filling in the list of object requests
2243  * that comprises the image request, and the Linux request pointer
2244  * (if there is one).
2245  */
2246 static struct rbd_img_request *rbd_img_request_create(
2247                                         struct rbd_device *rbd_dev,
2248                                         u64 offset, u64 length,
2249                                         enum obj_operation_type op_type,
2250                                         struct ceph_snap_context *snapc)
2251 {
2252         struct rbd_img_request *img_request;
2253
2254         img_request = kmem_cache_alloc(rbd_img_request_cache, GFP_NOIO);
2255         if (!img_request)
2256                 return NULL;
2257
2258         img_request->rq = NULL;
2259         img_request->rbd_dev = rbd_dev;
2260         img_request->offset = offset;
2261         img_request->length = length;
2262         img_request->flags = 0;
2263         if (op_type == OBJ_OP_DISCARD) {
2264                 img_request_discard_set(img_request);
2265                 img_request->snapc = snapc;
2266         } else if (op_type == OBJ_OP_WRITE) {
2267                 img_request_write_set(img_request);
2268                 img_request->snapc = snapc;
2269         } else {
2270                 img_request->snap_id = rbd_dev->spec->snap_id;
2271         }
2272         if (rbd_dev_parent_get(rbd_dev))
2273                 img_request_layered_set(img_request);
2274         spin_lock_init(&img_request->completion_lock);
2275         img_request->next_completion = 0;
2276         img_request->callback = NULL;
2277         img_request->result = 0;
2278         img_request->obj_request_count = 0;
2279         INIT_LIST_HEAD(&img_request->obj_requests);
2280         kref_init(&img_request->kref);
2281
2282         dout("%s: rbd_dev %p %s %llu/%llu -> img %p\n", __func__, rbd_dev,
2283                 obj_op_name(op_type), offset, length, img_request);
2284
2285         return img_request;
2286 }
2287
2288 static void rbd_img_request_destroy(struct kref *kref)
2289 {
2290         struct rbd_img_request *img_request;
2291         struct rbd_obj_request *obj_request;
2292         struct rbd_obj_request *next_obj_request;
2293
2294         img_request = container_of(kref, struct rbd_img_request, kref);
2295
2296         dout("%s: img %p\n", __func__, img_request);
2297
2298         for_each_obj_request_safe(img_request, obj_request, next_obj_request)
2299                 rbd_img_obj_request_del(img_request, obj_request);
2300         rbd_assert(img_request->obj_request_count == 0);
2301
2302         if (img_request_layered_test(img_request)) {
2303                 img_request_layered_clear(img_request);
2304                 rbd_dev_parent_put(img_request->rbd_dev);
2305         }
2306
2307         if (img_request_write_test(img_request) ||
2308                 img_request_discard_test(img_request))
2309                 ceph_put_snap_context(img_request->snapc);
2310
2311         kmem_cache_free(rbd_img_request_cache, img_request);
2312 }
2313
2314 static struct rbd_img_request *rbd_parent_request_create(
2315                                         struct rbd_obj_request *obj_request,
2316                                         u64 img_offset, u64 length)
2317 {
2318         struct rbd_img_request *parent_request;
2319         struct rbd_device *rbd_dev;
2320
2321         rbd_assert(obj_request->img_request);
2322         rbd_dev = obj_request->img_request->rbd_dev;
2323
2324         parent_request = rbd_img_request_create(rbd_dev->parent, img_offset,
2325                                                 length, OBJ_OP_READ, NULL);
2326         if (!parent_request)
2327                 return NULL;
2328
2329         img_request_child_set(parent_request);
2330         rbd_obj_request_get(obj_request);
2331         parent_request->obj_request = obj_request;
2332
2333         return parent_request;
2334 }
2335
2336 static void rbd_parent_request_destroy(struct kref *kref)
2337 {
2338         struct rbd_img_request *parent_request;
2339         struct rbd_obj_request *orig_request;
2340
2341         parent_request = container_of(kref, struct rbd_img_request, kref);
2342         orig_request = parent_request->obj_request;
2343
2344         parent_request->obj_request = NULL;
2345         rbd_obj_request_put(orig_request);
2346         img_request_child_clear(parent_request);
2347
2348         rbd_img_request_destroy(kref);
2349 }
2350
2351 static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request)
2352 {
2353         struct rbd_img_request *img_request;
2354         unsigned int xferred;
2355         int result;
2356         bool more;
2357
2358         rbd_assert(obj_request_img_data_test(obj_request));
2359         img_request = obj_request->img_request;
2360
2361         rbd_assert(obj_request->xferred <= (u64)UINT_MAX);
2362         xferred = (unsigned int)obj_request->xferred;
2363         result = obj_request->result;
2364         if (result) {
2365                 struct rbd_device *rbd_dev = img_request->rbd_dev;
2366                 enum obj_operation_type op_type;
2367
2368                 if (img_request_discard_test(img_request))
2369                         op_type = OBJ_OP_DISCARD;
2370                 else if (img_request_write_test(img_request))
2371                         op_type = OBJ_OP_WRITE;
2372                 else
2373                         op_type = OBJ_OP_READ;
2374
2375                 rbd_warn(rbd_dev, "%s %llx at %llx (%llx)",
2376                         obj_op_name(op_type), obj_request->length,
2377                         obj_request->img_offset, obj_request->offset);
2378                 rbd_warn(rbd_dev, "  result %d xferred %x",
2379                         result, xferred);
2380                 if (!img_request->result)
2381                         img_request->result = result;
2382                 /*
2383                  * Need to end I/O on the entire obj_request worth of
2384                  * bytes in case of error.
2385                  */
2386                 xferred = obj_request->length;
2387         }
2388
2389         if (img_request_child_test(img_request)) {
2390                 rbd_assert(img_request->obj_request != NULL);
2391                 more = obj_request->which < img_request->obj_request_count - 1;
2392         } else {
2393                 rbd_assert(img_request->rq != NULL);
2394
2395                 more = blk_update_request(img_request->rq, result, xferred);
2396                 if (!more)
2397                         __blk_mq_end_request(img_request->rq, result);
2398         }
2399
2400         return more;
2401 }
2402
2403 static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
2404 {
2405         struct rbd_img_request *img_request;
2406         u32 which = obj_request->which;
2407         bool more = true;
2408
2409         rbd_assert(obj_request_img_data_test(obj_request));
2410         img_request = obj_request->img_request;
2411
2412         dout("%s: img %p obj %p\n", __func__, img_request, obj_request);
2413         rbd_assert(img_request != NULL);
2414         rbd_assert(img_request->obj_request_count > 0);
2415         rbd_assert(which != BAD_WHICH);
2416         rbd_assert(which < img_request->obj_request_count);
2417
2418         spin_lock_irq(&img_request->completion_lock);
2419         if (which != img_request->next_completion)
2420                 goto out;
2421
2422         for_each_obj_request_from(img_request, obj_request) {
2423                 rbd_assert(more);
2424                 rbd_assert(which < img_request->obj_request_count);
2425
2426                 if (!obj_request_done_test(obj_request))
2427                         break;
2428                 more = rbd_img_obj_end_request(obj_request);
2429                 which++;
2430         }
2431
2432         rbd_assert(more ^ (which == img_request->obj_request_count));
2433         img_request->next_completion = which;
2434 out:
2435         spin_unlock_irq(&img_request->completion_lock);
2436         rbd_img_request_put(img_request);
2437
2438         if (!more)
2439                 rbd_img_request_complete(img_request);
2440 }
2441
2442 /*
2443  * Add individual osd ops to the given ceph_osd_request and prepare
2444  * them for submission. num_ops is the current number of
2445  * osd operations already to the object request.
2446  */
2447 static void rbd_img_obj_request_fill(struct rbd_obj_request *obj_request,
2448                                 struct ceph_osd_request *osd_request,
2449                                 enum obj_operation_type op_type,
2450                                 unsigned int num_ops)
2451 {
2452         struct rbd_img_request *img_request = obj_request->img_request;
2453         struct rbd_device *rbd_dev = img_request->rbd_dev;
2454         u64 object_size = rbd_obj_bytes(&rbd_dev->header);
2455         u64 offset = obj_request->offset;
2456         u64 length = obj_request->length;
2457         u64 img_end;
2458         u16 opcode;
2459
2460         if (op_type == OBJ_OP_DISCARD) {
2461                 if (!offset && length == object_size &&
2462                     (!img_request_layered_test(img_request) ||
2463                      !obj_request_overlaps_parent(obj_request))) {
2464                         opcode = CEPH_OSD_OP_DELETE;
2465                 } else if ((offset + length == object_size)) {
2466                         opcode = CEPH_OSD_OP_TRUNCATE;
2467                 } else {
2468                         down_read(&rbd_dev->header_rwsem);
2469                         img_end = rbd_dev->header.image_size;
2470                         up_read(&rbd_dev->header_rwsem);
2471
2472                         if (obj_request->img_offset + length == img_end)
2473                                 opcode = CEPH_OSD_OP_TRUNCATE;
2474                         else
2475                                 opcode = CEPH_OSD_OP_ZERO;
2476                 }
2477         } else if (op_type == OBJ_OP_WRITE) {
2478                 if (!offset && length == object_size)
2479                         opcode = CEPH_OSD_OP_WRITEFULL;
2480                 else
2481                         opcode = CEPH_OSD_OP_WRITE;
2482                 osd_req_op_alloc_hint_init(osd_request, num_ops,
2483                                         object_size, object_size);
2484                 num_ops++;
2485         } else {
2486                 opcode = CEPH_OSD_OP_READ;
2487         }
2488
2489         if (opcode == CEPH_OSD_OP_DELETE)
2490                 osd_req_op_init(osd_request, num_ops, opcode, 0);
2491         else
2492                 osd_req_op_extent_init(osd_request, num_ops, opcode,
2493                                        offset, length, 0, 0);
2494
2495         if (obj_request->type == OBJ_REQUEST_BIO)
2496                 osd_req_op_extent_osd_data_bio(osd_request, num_ops,
2497                                         obj_request->bio_list, length);
2498         else if (obj_request->type == OBJ_REQUEST_PAGES)
2499                 osd_req_op_extent_osd_data_pages(osd_request, num_ops,
2500                                         obj_request->pages, length,
2501                                         offset & ~PAGE_MASK, false, false);
2502
2503         /* Discards are also writes */
2504         if (op_type == OBJ_OP_WRITE || op_type == OBJ_OP_DISCARD)
2505                 rbd_osd_req_format_write(obj_request);
2506         else
2507                 rbd_osd_req_format_read(obj_request);
2508 }
2509
2510 /*
2511  * Split up an image request into one or more object requests, each
2512  * to a different object.  The "type" parameter indicates whether
2513  * "data_desc" is the pointer to the head of a list of bio
2514  * structures, or the base of a page array.  In either case this
2515  * function assumes data_desc describes memory sufficient to hold
2516  * all data described by the image request.
2517  */
2518 static int rbd_img_request_fill(struct rbd_img_request *img_request,
2519                                         enum obj_request_type type,
2520                                         void *data_desc)
2521 {
2522         struct rbd_device *rbd_dev = img_request->rbd_dev;
2523         struct rbd_obj_request *obj_request = NULL;
2524         struct rbd_obj_request *next_obj_request;
2525         struct bio *bio_list = NULL;
2526         unsigned int bio_offset = 0;
2527         struct page **pages = NULL;
2528         enum obj_operation_type op_type;
2529         u64 img_offset;
2530         u64 resid;
2531
2532         dout("%s: img %p type %d data_desc %p\n", __func__, img_request,
2533                 (int)type, data_desc);
2534
2535         img_offset = img_request->offset;
2536         resid = img_request->length;
2537         rbd_assert(resid > 0);
2538         op_type = rbd_img_request_op_type(img_request);
2539
2540         if (type == OBJ_REQUEST_BIO) {
2541                 bio_list = data_desc;
2542                 rbd_assert(img_offset ==
2543                            bio_list->bi_iter.bi_sector << SECTOR_SHIFT);
2544         } else if (type == OBJ_REQUEST_PAGES) {
2545                 pages = data_desc;
2546         }
2547
2548         while (resid) {
2549                 struct ceph_osd_request *osd_req;
2550                 const char *object_name;
2551                 u64 offset;
2552                 u64 length;
2553
2554                 object_name = rbd_segment_name(rbd_dev, img_offset);
2555                 if (!object_name)
2556                         goto out_unwind;
2557                 offset = rbd_segment_offset(rbd_dev, img_offset);
2558                 length = rbd_segment_length(rbd_dev, img_offset, resid);
2559                 obj_request = rbd_obj_request_create(object_name,
2560                                                 offset, length, type);
2561                 /* object request has its own copy of the object name */
2562                 rbd_segment_name_free(object_name);
2563                 if (!obj_request)
2564                         goto out_unwind;
2565
2566                 /*
2567                  * set obj_request->img_request before creating the
2568                  * osd_request so that it gets the right snapc
2569                  */
2570                 rbd_img_obj_request_add(img_request, obj_request);
2571
2572                 if (type == OBJ_REQUEST_BIO) {
2573                         unsigned int clone_size;
2574
2575                         rbd_assert(length <= (u64)UINT_MAX);
2576                         clone_size = (unsigned int)length;
2577                         obj_request->bio_list =
2578                                         bio_chain_clone_range(&bio_list,
2579                                                                 &bio_offset,
2580                                                                 clone_size,
2581                                                                 GFP_NOIO);
2582                         if (!obj_request->bio_list)
2583                                 goto out_unwind;
2584                 } else if (type == OBJ_REQUEST_PAGES) {
2585                         unsigned int page_count;
2586
2587                         obj_request->pages = pages;
2588                         page_count = (u32)calc_pages_for(offset, length);
2589                         obj_request->page_count = page_count;
2590                         if ((offset + length) & ~PAGE_MASK)
2591                                 page_count--;   /* more on last page */
2592                         pages += page_count;
2593                 }
2594
2595                 osd_req = rbd_osd_req_create(rbd_dev, op_type,
2596                                         (op_type == OBJ_OP_WRITE) ? 2 : 1,
2597                                         obj_request);
2598                 if (!osd_req)
2599                         goto out_unwind;
2600
2601                 obj_request->osd_req = osd_req;
2602                 obj_request->callback = rbd_img_obj_callback;
2603                 obj_request->img_offset = img_offset;
2604
2605                 rbd_img_obj_request_fill(obj_request, osd_req, op_type, 0);
2606
2607                 img_offset += length;
2608                 resid -= length;
2609         }
2610
2611         return 0;
2612
2613 out_unwind:
2614         for_each_obj_request_safe(img_request, obj_request, next_obj_request)
2615                 rbd_img_obj_request_del(img_request, obj_request);
2616
2617         return -ENOMEM;
2618 }
2619
2620 static void
2621 rbd_osd_copyup_callback(struct rbd_obj_request *obj_request)
2622 {
2623         struct rbd_img_request *img_request;
2624         struct rbd_device *rbd_dev;
2625         struct page **pages;
2626         u32 page_count;
2627
2628         dout("%s: obj %p\n", __func__, obj_request);
2629
2630         rbd_assert(obj_request->type == OBJ_REQUEST_BIO ||
2631                 obj_request->type == OBJ_REQUEST_NODATA);
2632         rbd_assert(obj_request_img_data_test(obj_request));
2633         img_request = obj_request->img_request;
2634         rbd_assert(img_request);
2635
2636         rbd_dev = img_request->rbd_dev;
2637         rbd_assert(rbd_dev);
2638
2639         pages = obj_request->copyup_pages;
2640         rbd_assert(pages != NULL);
2641         obj_request->copyup_pages = NULL;
2642         page_count = obj_request->copyup_page_count;
2643         rbd_assert(page_count);
2644         obj_request->copyup_page_count = 0;
2645         ceph_release_page_vector(pages, page_count);
2646
2647         /*
2648          * We want the transfer count to reflect the size of the
2649          * original write request.  There is no such thing as a
2650          * successful short write, so if the request was successful
2651          * we can just set it to the originally-requested length.
2652          */
2653         if (!obj_request->result)
2654                 obj_request->xferred = obj_request->length;
2655
2656         obj_request_done_set(obj_request);
2657 }
2658
2659 static void
2660 rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
2661 {
2662         struct rbd_obj_request *orig_request;
2663         struct ceph_osd_request *osd_req;
2664         struct rbd_device *rbd_dev;
2665         struct page **pages;
2666         enum obj_operation_type op_type;
2667         u32 page_count;
2668         int img_result;
2669         u64 parent_length;
2670
2671         rbd_assert(img_request_child_test(img_request));
2672
2673         /* First get what we need from the image request */
2674
2675         pages = img_request->copyup_pages;
2676         rbd_assert(pages != NULL);
2677         img_request->copyup_pages = NULL;
2678         page_count = img_request->copyup_page_count;
2679         rbd_assert(page_count);
2680         img_request->copyup_page_count = 0;
2681
2682         orig_request = img_request->obj_request;
2683         rbd_assert(orig_request != NULL);
2684         rbd_assert(obj_request_type_valid(orig_request->type));
2685         img_result = img_request->result;
2686         parent_length = img_request->length;
2687         rbd_assert(img_result || parent_length == img_request->xferred);
2688         rbd_img_request_put(img_request);
2689
2690         rbd_assert(orig_request->img_request);
2691         rbd_dev = orig_request->img_request->rbd_dev;
2692         rbd_assert(rbd_dev);
2693
2694         /*
2695          * If the overlap has become 0 (most likely because the
2696          * image has been flattened) we need to free the pages
2697          * and re-submit the original write request.
2698          */
2699         if (!rbd_dev->parent_overlap) {
2700                 ceph_release_page_vector(pages, page_count);
2701                 rbd_obj_request_submit(orig_request);
2702                 return;
2703         }
2704
2705         if (img_result)
2706                 goto out_err;
2707
2708         /*
2709          * The original osd request is of no use to use any more.
2710          * We need a new one that can hold the three ops in a copyup
2711          * request.  Allocate the new copyup osd request for the
2712          * original request, and release the old one.
2713          */
2714         img_result = -ENOMEM;
2715         osd_req = rbd_osd_req_create_copyup(orig_request);
2716         if (!osd_req)
2717                 goto out_err;
2718         rbd_osd_req_destroy(orig_request->osd_req);
2719         orig_request->osd_req = osd_req;
2720         orig_request->copyup_pages = pages;
2721         orig_request->copyup_page_count = page_count;
2722
2723         /* Initialize the copyup op */
2724
2725         osd_req_op_cls_init(osd_req, 0, CEPH_OSD_OP_CALL, "rbd", "copyup");
2726         osd_req_op_cls_request_data_pages(osd_req, 0, pages, parent_length, 0,
2727                                                 false, false);
2728
2729         /* Add the other op(s) */
2730
2731         op_type = rbd_img_request_op_type(orig_request->img_request);
2732         rbd_img_obj_request_fill(orig_request, osd_req, op_type, 1);
2733
2734         /* All set, send it off. */
2735
2736         rbd_obj_request_submit(orig_request);
2737         return;
2738
2739 out_err:
2740         ceph_release_page_vector(pages, page_count);
2741         rbd_obj_request_error(orig_request, img_result);
2742 }
2743
2744 /*
2745  * Read from the parent image the range of data that covers the
2746  * entire target of the given object request.  This is used for
2747  * satisfying a layered image write request when the target of an
2748  * object request from the image request does not exist.
2749  *
2750  * A page array big enough to hold the returned data is allocated
2751  * and supplied to rbd_img_request_fill() as the "data descriptor."
2752  * When the read completes, this page array will be transferred to
2753  * the original object request for the copyup operation.
2754  *
2755  * If an error occurs, it is recorded as the result of the original
2756  * object request in rbd_img_obj_exists_callback().
2757  */
2758 static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
2759 {
2760         struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
2761         struct rbd_img_request *parent_request = NULL;
2762         u64 img_offset;
2763         u64 length;
2764         struct page **pages = NULL;
2765         u32 page_count;
2766         int result;
2767
2768         rbd_assert(rbd_dev->parent != NULL);
2769
2770         /*
2771          * Determine the byte range covered by the object in the
2772          * child image to which the original request was to be sent.
2773          */
2774         img_offset = obj_request->img_offset - obj_request->offset;
2775         length = (u64)1 << rbd_dev->header.obj_order;
2776
2777         /*
2778          * There is no defined parent data beyond the parent
2779          * overlap, so limit what we read at that boundary if
2780          * necessary.
2781          */
2782         if (img_offset + length > rbd_dev->parent_overlap) {
2783                 rbd_assert(img_offset < rbd_dev->parent_overlap);
2784                 length = rbd_dev->parent_overlap - img_offset;
2785         }
2786
2787         /*
2788          * Allocate a page array big enough to receive the data read
2789          * from the parent.
2790          */
2791         page_count = (u32)calc_pages_for(0, length);
2792         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
2793         if (IS_ERR(pages)) {
2794                 result = PTR_ERR(pages);
2795                 pages = NULL;
2796                 goto out_err;
2797         }
2798
2799         result = -ENOMEM;
2800         parent_request = rbd_parent_request_create(obj_request,
2801                                                 img_offset, length);
2802         if (!parent_request)
2803                 goto out_err;
2804
2805         result = rbd_img_request_fill(parent_request, OBJ_REQUEST_PAGES, pages);
2806         if (result)
2807                 goto out_err;
2808
2809         parent_request->copyup_pages = pages;
2810         parent_request->copyup_page_count = page_count;
2811         parent_request->callback = rbd_img_obj_parent_read_full_callback;
2812
2813         result = rbd_img_request_submit(parent_request);
2814         if (!result)
2815                 return 0;
2816
2817         parent_request->copyup_pages = NULL;
2818         parent_request->copyup_page_count = 0;
2819         parent_request->obj_request = NULL;
2820         rbd_obj_request_put(obj_request);
2821 out_err:
2822         if (pages)
2823                 ceph_release_page_vector(pages, page_count);
2824         if (parent_request)
2825                 rbd_img_request_put(parent_request);
2826         return result;
2827 }
2828
2829 static void rbd_img_obj_exists_callback(struct rbd_obj_request *obj_request)
2830 {
2831         struct rbd_obj_request *orig_request;
2832         struct rbd_device *rbd_dev;
2833         int result;
2834
2835         rbd_assert(!obj_request_img_data_test(obj_request));
2836
2837         /*
2838          * All we need from the object request is the original
2839          * request and the result of the STAT op.  Grab those, then
2840          * we're done with the request.
2841          */
2842         orig_request = obj_request->obj_request;
2843         obj_request->obj_request = NULL;
2844         rbd_obj_request_put(orig_request);
2845         rbd_assert(orig_request);
2846         rbd_assert(orig_request->img_request);
2847
2848         result = obj_request->result;
2849         obj_request->result = 0;
2850
2851         dout("%s: obj %p for obj %p result %d %llu/%llu\n", __func__,
2852                 obj_request, orig_request, result,
2853                 obj_request->xferred, obj_request->length);
2854         rbd_obj_request_put(obj_request);
2855
2856         /*
2857          * If the overlap has become 0 (most likely because the
2858          * image has been flattened) we need to re-submit the
2859          * original request.
2860          */
2861         rbd_dev = orig_request->img_request->rbd_dev;
2862         if (!rbd_dev->parent_overlap) {
2863                 rbd_obj_request_submit(orig_request);
2864                 return;
2865         }
2866
2867         /*
2868          * Our only purpose here is to determine whether the object
2869          * exists, and we don't want to treat the non-existence as
2870          * an error.  If something else comes back, transfer the
2871          * error to the original request and complete it now.
2872          */
2873         if (!result) {
2874                 obj_request_existence_set(orig_request, true);
2875         } else if (result == -ENOENT) {
2876                 obj_request_existence_set(orig_request, false);
2877         } else {
2878                 goto fail_orig_request;
2879         }
2880
2881         /*
2882          * Resubmit the original request now that we have recorded
2883          * whether the target object exists.
2884          */
2885         result = rbd_img_obj_request_submit(orig_request);
2886         if (result)
2887                 goto fail_orig_request;
2888
2889         return;
2890
2891 fail_orig_request:
2892         rbd_obj_request_error(orig_request, result);
2893 }
2894
2895 static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request)
2896 {
2897         struct rbd_device *rbd_dev = obj_request->img_request->rbd_dev;
2898         struct rbd_obj_request *stat_request;
2899         struct page **pages;
2900         u32 page_count;
2901         size_t size;
2902         int ret;
2903
2904         stat_request = rbd_obj_request_create(obj_request->object_name, 0, 0,
2905                                               OBJ_REQUEST_PAGES);
2906         if (!stat_request)
2907                 return -ENOMEM;
2908
2909         stat_request->osd_req = rbd_osd_req_create(rbd_dev, OBJ_OP_READ, 1,
2910                                                    stat_request);
2911         if (!stat_request->osd_req) {
2912                 ret = -ENOMEM;
2913                 goto fail_stat_request;
2914         }
2915
2916         /*
2917          * The response data for a STAT call consists of:
2918          *     le64 length;
2919          *     struct {
2920          *         le32 tv_sec;
2921          *         le32 tv_nsec;
2922          *     } mtime;
2923          */
2924         size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
2925         page_count = (u32)calc_pages_for(0, size);
2926         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
2927         if (IS_ERR(pages)) {
2928                 ret = PTR_ERR(pages);
2929                 goto fail_stat_request;
2930         }
2931
2932         osd_req_op_init(stat_request->osd_req, 0, CEPH_OSD_OP_STAT, 0);
2933         osd_req_op_raw_data_in_pages(stat_request->osd_req, 0, pages, size, 0,
2934                                      false, false);
2935
2936         rbd_obj_request_get(obj_request);
2937         stat_request->obj_request = obj_request;
2938         stat_request->pages = pages;
2939         stat_request->page_count = page_count;
2940         stat_request->callback = rbd_img_obj_exists_callback;
2941
2942         rbd_obj_request_submit(stat_request);
2943         return 0;
2944
2945 fail_stat_request:
2946         rbd_obj_request_put(stat_request);
2947         return ret;
2948 }
2949
2950 static bool img_obj_request_simple(struct rbd_obj_request *obj_request)
2951 {
2952         struct rbd_img_request *img_request = obj_request->img_request;
2953         struct rbd_device *rbd_dev = img_request->rbd_dev;
2954
2955         /* Reads */
2956         if (!img_request_write_test(img_request) &&
2957             !img_request_discard_test(img_request))
2958                 return true;
2959
2960         /* Non-layered writes */
2961         if (!img_request_layered_test(img_request))
2962                 return true;
2963
2964         /*
2965          * Layered writes outside of the parent overlap range don't
2966          * share any data with the parent.
2967          */
2968         if (!obj_request_overlaps_parent(obj_request))
2969                 return true;
2970
2971         /*
2972          * Entire-object layered writes - we will overwrite whatever
2973          * parent data there is anyway.
2974          */
2975         if (!obj_request->offset &&
2976             obj_request->length == rbd_obj_bytes(&rbd_dev->header))
2977                 return true;
2978
2979         /*
2980          * If the object is known to already exist, its parent data has
2981          * already been copied.
2982          */
2983         if (obj_request_known_test(obj_request) &&
2984             obj_request_exists_test(obj_request))
2985                 return true;
2986
2987         return false;
2988 }
2989
2990 static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request)
2991 {
2992         rbd_assert(obj_request_img_data_test(obj_request));
2993         rbd_assert(obj_request_type_valid(obj_request->type));
2994         rbd_assert(obj_request->img_request);
2995
2996         if (img_obj_request_simple(obj_request)) {
2997                 rbd_obj_request_submit(obj_request);
2998                 return 0;
2999         }
3000
3001         /*
3002          * It's a layered write.  The target object might exist but
3003          * we may not know that yet.  If we know it doesn't exist,
3004          * start by reading the data for the full target object from
3005          * the parent so we can use it for a copyup to the target.
3006          */
3007         if (obj_request_known_test(obj_request))
3008                 return rbd_img_obj_parent_read_full(obj_request);
3009
3010         /* We don't know whether the target exists.  Go find out. */
3011
3012         return rbd_img_obj_exists_submit(obj_request);
3013 }
3014
3015 static int rbd_img_request_submit(struct rbd_img_request *img_request)
3016 {
3017         struct rbd_obj_request *obj_request;
3018         struct rbd_obj_request *next_obj_request;
3019         int ret = 0;
3020
3021         dout("%s: img %p\n", __func__, img_request);
3022
3023         rbd_img_request_get(img_request);
3024         for_each_obj_request_safe(img_request, obj_request, next_obj_request) {
3025                 ret = rbd_img_obj_request_submit(obj_request);
3026                 if (ret)
3027                         goto out_put_ireq;
3028         }
3029
3030 out_put_ireq:
3031         rbd_img_request_put(img_request);
3032         return ret;
3033 }
3034
3035 static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)
3036 {
3037         struct rbd_obj_request *obj_request;
3038         struct rbd_device *rbd_dev;
3039         u64 obj_end;
3040         u64 img_xferred;
3041         int img_result;
3042
3043         rbd_assert(img_request_child_test(img_request));
3044
3045         /* First get what we need from the image request and release it */
3046
3047         obj_request = img_request->obj_request;
3048         img_xferred = img_request->xferred;
3049         img_result = img_request->result;
3050         rbd_img_request_put(img_request);
3051
3052         /*
3053          * If the overlap has become 0 (most likely because the
3054          * image has been flattened) we need to re-submit the
3055          * original request.
3056          */
3057         rbd_assert(obj_request);
3058         rbd_assert(obj_request->img_request);
3059         rbd_dev = obj_request->img_request->rbd_dev;
3060         if (!rbd_dev->parent_overlap) {
3061                 rbd_obj_request_submit(obj_request);
3062                 return;
3063         }
3064
3065         obj_request->result = img_result;
3066         if (obj_request->result)
3067                 goto out;
3068
3069         /*
3070          * We need to zero anything beyond the parent overlap
3071          * boundary.  Since rbd_img_obj_request_read_callback()
3072          * will zero anything beyond the end of a short read, an
3073          * easy way to do this is to pretend the data from the
3074          * parent came up short--ending at the overlap boundary.
3075          */
3076         rbd_assert(obj_request->img_offset < U64_MAX - obj_request->length);
3077         obj_end = obj_request->img_offset + obj_request->length;
3078         if (obj_end > rbd_dev->parent_overlap) {
3079                 u64 xferred = 0;
3080
3081                 if (obj_request->img_offset < rbd_dev->parent_overlap)
3082                         xferred = rbd_dev->parent_overlap -
3083                                         obj_request->img_offset;
3084
3085                 obj_request->xferred = min(img_xferred, xferred);
3086         } else {
3087                 obj_request->xferred = img_xferred;
3088         }
3089 out:
3090         rbd_img_obj_request_read_callback(obj_request);
3091         rbd_obj_request_complete(obj_request);
3092 }
3093
3094 static void rbd_img_parent_read(struct rbd_obj_request *obj_request)
3095 {
3096         struct rbd_img_request *img_request;
3097         int result;
3098
3099         rbd_assert(obj_request_img_data_test(obj_request));
3100         rbd_assert(obj_request->img_request != NULL);
3101         rbd_assert(obj_request->result == (s32) -ENOENT);
3102         rbd_assert(obj_request_type_valid(obj_request->type));
3103
3104         /* rbd_read_finish(obj_request, obj_request->length); */
3105         img_request = rbd_parent_request_create(obj_request,
3106                                                 obj_request->img_offset,
3107                                                 obj_request->length);
3108         result = -ENOMEM;
3109         if (!img_request)
3110                 goto out_err;
3111
3112         if (obj_request->type == OBJ_REQUEST_BIO)
3113                 result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO,
3114                                                 obj_request->bio_list);
3115         else
3116                 result = rbd_img_request_fill(img_request, OBJ_REQUEST_PAGES,
3117                                                 obj_request->pages);
3118         if (result)
3119                 goto out_err;
3120
3121         img_request->callback = rbd_img_parent_read_callback;
3122         result = rbd_img_request_submit(img_request);
3123         if (result)
3124                 goto out_err;
3125
3126         return;
3127 out_err:
3128         if (img_request)
3129                 rbd_img_request_put(img_request);
3130         obj_request->result = result;
3131         obj_request->xferred = 0;
3132         obj_request_done_set(obj_request);
3133 }
3134
3135 static const struct rbd_client_id rbd_empty_cid;
3136
3137 static bool rbd_cid_equal(const struct rbd_client_id *lhs,
3138                           const struct rbd_client_id *rhs)
3139 {
3140         return lhs->gid == rhs->gid && lhs->handle == rhs->handle;
3141 }
3142
3143 static struct rbd_client_id rbd_get_cid(struct rbd_device *rbd_dev)
3144 {
3145         struct rbd_client_id cid;
3146
3147         mutex_lock(&rbd_dev->watch_mutex);
3148         cid.gid = ceph_client_gid(rbd_dev->rbd_client->client);
3149         cid.handle = rbd_dev->watch_cookie;
3150         mutex_unlock(&rbd_dev->watch_mutex);
3151         return cid;
3152 }
3153
3154 /*
3155  * lock_rwsem must be held for write
3156  */
3157 static void rbd_set_owner_cid(struct rbd_device *rbd_dev,
3158                               const struct rbd_client_id *cid)
3159 {
3160         dout("%s rbd_dev %p %llu-%llu -> %llu-%llu\n", __func__, rbd_dev,
3161              rbd_dev->owner_cid.gid, rbd_dev->owner_cid.handle,
3162              cid->gid, cid->handle);
3163         rbd_dev->owner_cid = *cid; /* struct */
3164 }
3165
3166 static void format_lock_cookie(struct rbd_device *rbd_dev, char *buf)
3167 {
3168         mutex_lock(&rbd_dev->watch_mutex);
3169         sprintf(buf, "%s %llu", RBD_LOCK_COOKIE_PREFIX, rbd_dev->watch_cookie);
3170         mutex_unlock(&rbd_dev->watch_mutex);
3171 }
3172
3173 /*
3174  * lock_rwsem must be held for write
3175  */
3176 static int rbd_lock(struct rbd_device *rbd_dev)
3177 {
3178         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3179         struct rbd_client_id cid = rbd_get_cid(rbd_dev);
3180         char cookie[32];
3181         int ret;
3182
3183         WARN_ON(__rbd_is_lock_owner(rbd_dev));
3184
3185         format_lock_cookie(rbd_dev, cookie);
3186         ret = ceph_cls_lock(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
3187                             RBD_LOCK_NAME, CEPH_CLS_LOCK_EXCLUSIVE, cookie,
3188                             RBD_LOCK_TAG, "", 0);
3189         if (ret)
3190                 return ret;
3191
3192         rbd_dev->lock_state = RBD_LOCK_STATE_LOCKED;
3193         rbd_set_owner_cid(rbd_dev, &cid);
3194         queue_work(rbd_dev->task_wq, &rbd_dev->acquired_lock_work);
3195         return 0;
3196 }
3197
3198 /*
3199  * lock_rwsem must be held for write
3200  */
3201 static int rbd_unlock(struct rbd_device *rbd_dev)
3202 {
3203         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3204         char cookie[32];
3205         int ret;
3206
3207         WARN_ON(!__rbd_is_lock_owner(rbd_dev));
3208
3209         rbd_dev->lock_state = RBD_LOCK_STATE_UNLOCKED;
3210
3211         format_lock_cookie(rbd_dev, cookie);
3212         ret = ceph_cls_unlock(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
3213                               RBD_LOCK_NAME, cookie);
3214         if (ret && ret != -ENOENT) {
3215                 rbd_warn(rbd_dev, "cls_unlock failed: %d", ret);
3216                 return ret;
3217         }
3218
3219         rbd_set_owner_cid(rbd_dev, &rbd_empty_cid);
3220         queue_work(rbd_dev->task_wq, &rbd_dev->released_lock_work);
3221         return 0;
3222 }
3223
3224 static int __rbd_notify_op_lock(struct rbd_device *rbd_dev,
3225                                 enum rbd_notify_op notify_op,
3226                                 struct page ***preply_pages,
3227                                 size_t *preply_len)
3228 {
3229         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3230         struct rbd_client_id cid = rbd_get_cid(rbd_dev);
3231         int buf_size = 4 + 8 + 8 + CEPH_ENCODING_START_BLK_LEN;
3232         char buf[buf_size];
3233         void *p = buf;
3234
3235         dout("%s rbd_dev %p notify_op %d\n", __func__, rbd_dev, notify_op);
3236
3237         /* encode *LockPayload NotifyMessage (op + ClientId) */
3238         ceph_start_encoding(&p, 2, 1, buf_size - CEPH_ENCODING_START_BLK_LEN);
3239         ceph_encode_32(&p, notify_op);
3240         ceph_encode_64(&p, cid.gid);
3241         ceph_encode_64(&p, cid.handle);
3242
3243         return ceph_osdc_notify(osdc, &rbd_dev->header_oid,
3244                                 &rbd_dev->header_oloc, buf, buf_size,
3245                                 RBD_NOTIFY_TIMEOUT, preply_pages, preply_len);
3246 }
3247
3248 static void rbd_notify_op_lock(struct rbd_device *rbd_dev,
3249                                enum rbd_notify_op notify_op)
3250 {
3251         struct page **reply_pages;
3252         size_t reply_len;
3253
3254         __rbd_notify_op_lock(rbd_dev, notify_op, &reply_pages, &reply_len);
3255         ceph_release_page_vector(reply_pages, calc_pages_for(0, reply_len));
3256 }
3257
3258 static void rbd_notify_acquired_lock(struct work_struct *work)
3259 {
3260         struct rbd_device *rbd_dev = container_of(work, struct rbd_device,
3261                                                   acquired_lock_work);
3262
3263         rbd_notify_op_lock(rbd_dev, RBD_NOTIFY_OP_ACQUIRED_LOCK);
3264 }
3265
3266 static void rbd_notify_released_lock(struct work_struct *work)
3267 {
3268         struct rbd_device *rbd_dev = container_of(work, struct rbd_device,
3269                                                   released_lock_work);
3270
3271         rbd_notify_op_lock(rbd_dev, RBD_NOTIFY_OP_RELEASED_LOCK);
3272 }
3273
3274 static int rbd_request_lock(struct rbd_device *rbd_dev)
3275 {
3276         struct page **reply_pages;
3277         size_t reply_len;
3278         bool lock_owner_responded = false;
3279         int ret;
3280
3281         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3282
3283         ret = __rbd_notify_op_lock(rbd_dev, RBD_NOTIFY_OP_REQUEST_LOCK,
3284                                    &reply_pages, &reply_len);
3285         if (ret && ret != -ETIMEDOUT) {
3286                 rbd_warn(rbd_dev, "failed to request lock: %d", ret);
3287                 goto out;
3288         }
3289
3290         if (reply_len > 0 && reply_len <= PAGE_SIZE) {
3291                 void *p = page_address(reply_pages[0]);
3292                 void *const end = p + reply_len;
3293                 u32 n;
3294
3295                 ceph_decode_32_safe(&p, end, n, e_inval); /* num_acks */
3296                 while (n--) {
3297                         u8 struct_v;
3298                         u32 len;
3299
3300                         ceph_decode_need(&p, end, 8 + 8, e_inval);
3301                         p += 8 + 8; /* skip gid and cookie */
3302
3303                         ceph_decode_32_safe(&p, end, len, e_inval);
3304                         if (!len)
3305                                 continue;
3306
3307                         if (lock_owner_responded) {
3308                                 rbd_warn(rbd_dev,
3309                                          "duplicate lock owners detected");
3310                                 ret = -EIO;
3311                                 goto out;
3312                         }
3313
3314                         lock_owner_responded = true;
3315                         ret = ceph_start_decoding(&p, end, 1, "ResponseMessage",
3316                                                   &struct_v, &len);
3317                         if (ret) {
3318                                 rbd_warn(rbd_dev,
3319                                          "failed to decode ResponseMessage: %d",
3320                                          ret);
3321                                 goto e_inval;
3322                         }
3323
3324                         ret = ceph_decode_32(&p);
3325                 }
3326         }
3327
3328         if (!lock_owner_responded) {
3329                 rbd_warn(rbd_dev, "no lock owners detected");
3330                 ret = -ETIMEDOUT;
3331         }
3332
3333 out:
3334         ceph_release_page_vector(reply_pages, calc_pages_for(0, reply_len));
3335         return ret;
3336
3337 e_inval:
3338         ret = -EINVAL;
3339         goto out;
3340 }
3341
3342 static void wake_requests(struct rbd_device *rbd_dev, bool wake_all)
3343 {
3344         dout("%s rbd_dev %p wake_all %d\n", __func__, rbd_dev, wake_all);
3345
3346         cancel_delayed_work(&rbd_dev->lock_dwork);
3347         if (wake_all)
3348                 wake_up_all(&rbd_dev->lock_waitq);
3349         else
3350                 wake_up(&rbd_dev->lock_waitq);
3351 }
3352
3353 static int get_lock_owner_info(struct rbd_device *rbd_dev,
3354                                struct ceph_locker **lockers, u32 *num_lockers)
3355 {
3356         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3357         u8 lock_type;
3358         char *lock_tag;
3359         int ret;
3360
3361         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3362
3363         ret = ceph_cls_lock_info(osdc, &rbd_dev->header_oid,
3364                                  &rbd_dev->header_oloc, RBD_LOCK_NAME,
3365                                  &lock_type, &lock_tag, lockers, num_lockers);
3366         if (ret)
3367                 return ret;
3368
3369         if (*num_lockers == 0) {
3370                 dout("%s rbd_dev %p no lockers detected\n", __func__, rbd_dev);
3371                 goto out;
3372         }
3373
3374         if (strcmp(lock_tag, RBD_LOCK_TAG)) {
3375                 rbd_warn(rbd_dev, "locked by external mechanism, tag %s",
3376                          lock_tag);
3377                 ret = -EBUSY;
3378                 goto out;
3379         }
3380
3381         if (lock_type == CEPH_CLS_LOCK_SHARED) {
3382                 rbd_warn(rbd_dev, "shared lock type detected");
3383                 ret = -EBUSY;
3384                 goto out;
3385         }
3386
3387         if (strncmp((*lockers)[0].id.cookie, RBD_LOCK_COOKIE_PREFIX,
3388                     strlen(RBD_LOCK_COOKIE_PREFIX))) {
3389                 rbd_warn(rbd_dev, "locked by external mechanism, cookie %s",
3390                          (*lockers)[0].id.cookie);
3391                 ret = -EBUSY;
3392                 goto out;
3393         }
3394
3395 out:
3396         kfree(lock_tag);
3397         return ret;
3398 }
3399
3400 static int find_watcher(struct rbd_device *rbd_dev,
3401                         const struct ceph_locker *locker)
3402 {
3403         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3404         struct ceph_watch_item *watchers;
3405         u32 num_watchers;
3406         u64 cookie;
3407         int i;
3408         int ret;
3409
3410         ret = ceph_osdc_list_watchers(osdc, &rbd_dev->header_oid,
3411                                       &rbd_dev->header_oloc, &watchers,
3412                                       &num_watchers);
3413         if (ret)
3414                 return ret;
3415
3416         sscanf(locker->id.cookie, RBD_LOCK_COOKIE_PREFIX " %llu", &cookie);
3417         for (i = 0; i < num_watchers; i++) {
3418                 if (!memcmp(&watchers[i].addr, &locker->info.addr,
3419                             sizeof(locker->info.addr)) &&
3420                     watchers[i].cookie == cookie) {
3421                         struct rbd_client_id cid = {
3422                                 .gid = le64_to_cpu(watchers[i].name.num),
3423                                 .handle = cookie,
3424                         };
3425
3426                         dout("%s rbd_dev %p found cid %llu-%llu\n", __func__,
3427                              rbd_dev, cid.gid, cid.handle);
3428                         rbd_set_owner_cid(rbd_dev, &cid);
3429                         ret = 1;
3430                         goto out;
3431                 }
3432         }
3433
3434         dout("%s rbd_dev %p no watchers\n", __func__, rbd_dev);
3435         ret = 0;
3436 out:
3437         kfree(watchers);
3438         return ret;
3439 }
3440
3441 /*
3442  * lock_rwsem must be held for write
3443  */
3444 static int rbd_try_lock(struct rbd_device *rbd_dev)
3445 {
3446         struct ceph_client *client = rbd_dev->rbd_client->client;
3447         struct ceph_locker *lockers;
3448         u32 num_lockers;
3449         int ret;
3450
3451         for (;;) {
3452                 ret = rbd_lock(rbd_dev);
3453                 if (ret != -EBUSY)
3454                         return ret;
3455
3456                 /* determine if the current lock holder is still alive */
3457                 ret = get_lock_owner_info(rbd_dev, &lockers, &num_lockers);
3458                 if (ret)
3459                         return ret;
3460
3461                 if (num_lockers == 0)
3462                         goto again;
3463
3464                 ret = find_watcher(rbd_dev, lockers);
3465                 if (ret) {
3466                         if (ret > 0)
3467                                 ret = 0; /* have to request lock */
3468                         goto out;
3469                 }
3470
3471                 rbd_warn(rbd_dev, "%s%llu seems dead, breaking lock",
3472                          ENTITY_NAME(lockers[0].id.name));
3473
3474                 ret = ceph_monc_blacklist_add(&client->monc,
3475                                               &lockers[0].info.addr);
3476                 if (ret) {
3477                         rbd_warn(rbd_dev, "blacklist of %s%llu failed: %d",
3478                                  ENTITY_NAME(lockers[0].id.name), ret);
3479                         goto out;
3480                 }
3481
3482                 ret = ceph_cls_break_lock(&client->osdc, &rbd_dev->header_oid,
3483                                           &rbd_dev->header_oloc, RBD_LOCK_NAME,
3484                                           lockers[0].id.cookie,
3485                                           &lockers[0].id.name);
3486                 if (ret && ret != -ENOENT)
3487                         goto out;
3488
3489 again:
3490                 ceph_free_lockers(lockers, num_lockers);
3491         }
3492
3493 out:
3494         ceph_free_lockers(lockers, num_lockers);
3495         return ret;
3496 }
3497
3498 /*
3499  * ret is set only if lock_state is RBD_LOCK_STATE_UNLOCKED
3500  */
3501 static enum rbd_lock_state rbd_try_acquire_lock(struct rbd_device *rbd_dev,
3502                                                 int *pret)
3503 {
3504         enum rbd_lock_state lock_state;
3505
3506         down_read(&rbd_dev->lock_rwsem);
3507         dout("%s rbd_dev %p read lock_state %d\n", __func__, rbd_dev,
3508              rbd_dev->lock_state);
3509         if (__rbd_is_lock_owner(rbd_dev)) {
3510                 lock_state = rbd_dev->lock_state;
3511                 up_read(&rbd_dev->lock_rwsem);
3512                 return lock_state;
3513         }
3514
3515         up_read(&rbd_dev->lock_rwsem);
3516         down_write(&rbd_dev->lock_rwsem);
3517         dout("%s rbd_dev %p write lock_state %d\n", __func__, rbd_dev,
3518              rbd_dev->lock_state);
3519         if (!__rbd_is_lock_owner(rbd_dev)) {
3520                 *pret = rbd_try_lock(rbd_dev);
3521                 if (*pret)
3522                         rbd_warn(rbd_dev, "failed to acquire lock: %d", *pret);
3523         }
3524
3525         lock_state = rbd_dev->lock_state;
3526         up_write(&rbd_dev->lock_rwsem);
3527         return lock_state;
3528 }
3529
3530 static void rbd_acquire_lock(struct work_struct *work)
3531 {
3532         struct rbd_device *rbd_dev = container_of(to_delayed_work(work),
3533                                             struct rbd_device, lock_dwork);
3534         enum rbd_lock_state lock_state;
3535         int ret;
3536
3537         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3538 again:
3539         lock_state = rbd_try_acquire_lock(rbd_dev, &ret);
3540         if (lock_state != RBD_LOCK_STATE_UNLOCKED || ret == -EBLACKLISTED) {
3541                 if (lock_state == RBD_LOCK_STATE_LOCKED)
3542                         wake_requests(rbd_dev, true);
3543                 dout("%s rbd_dev %p lock_state %d ret %d - done\n", __func__,
3544                      rbd_dev, lock_state, ret);
3545                 return;
3546         }
3547
3548         ret = rbd_request_lock(rbd_dev);
3549         if (ret == -ETIMEDOUT) {
3550                 goto again; /* treat this as a dead client */
3551         } else if (ret < 0) {
3552                 rbd_warn(rbd_dev, "error requesting lock: %d", ret);
3553                 mod_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork,
3554                                  RBD_RETRY_DELAY);
3555         } else {
3556                 /*
3557                  * lock owner acked, but resend if we don't see them
3558                  * release the lock
3559                  */
3560                 dout("%s rbd_dev %p requeueing lock_dwork\n", __func__,
3561                      rbd_dev);
3562                 mod_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork,
3563                     msecs_to_jiffies(2 * RBD_NOTIFY_TIMEOUT * MSEC_PER_SEC));
3564         }
3565 }
3566
3567 /*
3568  * lock_rwsem must be held for write
3569  */
3570 static bool rbd_release_lock(struct rbd_device *rbd_dev)
3571 {
3572         dout("%s rbd_dev %p read lock_state %d\n", __func__, rbd_dev,
3573              rbd_dev->lock_state);
3574         if (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED)
3575                 return false;
3576
3577         rbd_dev->lock_state = RBD_LOCK_STATE_RELEASING;
3578         downgrade_write(&rbd_dev->lock_rwsem);
3579         /*
3580          * Ensure that all in-flight IO is flushed.
3581          *
3582          * FIXME: ceph_osdc_sync() flushes the entire OSD client, which
3583          * may be shared with other devices.
3584          */
3585         ceph_osdc_sync(&rbd_dev->rbd_client->client->osdc);
3586         up_read(&rbd_dev->lock_rwsem);
3587
3588         down_write(&rbd_dev->lock_rwsem);
3589         dout("%s rbd_dev %p write lock_state %d\n", __func__, rbd_dev,
3590              rbd_dev->lock_state);
3591         if (rbd_dev->lock_state != RBD_LOCK_STATE_RELEASING)
3592                 return false;
3593
3594         if (!rbd_unlock(rbd_dev))
3595                 /*
3596                  * Give others a chance to grab the lock - we would re-acquire
3597                  * almost immediately if we got new IO during ceph_osdc_sync()
3598                  * otherwise.  We need to ack our own notifications, so this
3599                  * lock_dwork will be requeued from rbd_wait_state_locked()
3600                  * after wake_requests() in rbd_handle_released_lock().
3601                  */
3602                 cancel_delayed_work(&rbd_dev->lock_dwork);
3603
3604         return true;
3605 }
3606
3607 static void rbd_release_lock_work(struct work_struct *work)
3608 {
3609         struct rbd_device *rbd_dev = container_of(work, struct rbd_device,
3610                                                   unlock_work);
3611
3612         down_write(&rbd_dev->lock_rwsem);
3613         rbd_release_lock(rbd_dev);
3614         up_write(&rbd_dev->lock_rwsem);
3615 }
3616
3617 static void rbd_handle_acquired_lock(struct rbd_device *rbd_dev, u8 struct_v,
3618                                      void **p)
3619 {
3620         struct rbd_client_id cid = { 0 };
3621
3622         if (struct_v >= 2) {
3623                 cid.gid = ceph_decode_64(p);
3624                 cid.handle = ceph_decode_64(p);
3625         }
3626
3627         dout("%s rbd_dev %p cid %llu-%llu\n", __func__, rbd_dev, cid.gid,
3628              cid.handle);
3629         if (!rbd_cid_equal(&cid, &rbd_empty_cid)) {
3630                 down_write(&rbd_dev->lock_rwsem);
3631                 if (rbd_cid_equal(&cid, &rbd_dev->owner_cid)) {
3632                         /*
3633                          * we already know that the remote client is
3634                          * the owner
3635                          */
3636                         up_write(&rbd_dev->lock_rwsem);
3637                         return;
3638                 }
3639
3640                 rbd_set_owner_cid(rbd_dev, &cid);
3641                 downgrade_write(&rbd_dev->lock_rwsem);
3642         } else {
3643                 down_read(&rbd_dev->lock_rwsem);
3644         }
3645
3646         if (!__rbd_is_lock_owner(rbd_dev))
3647                 wake_requests(rbd_dev, false);
3648         up_read(&rbd_dev->lock_rwsem);
3649 }
3650
3651 static void rbd_handle_released_lock(struct rbd_device *rbd_dev, u8 struct_v,
3652                                      void **p)
3653 {
3654         struct rbd_client_id cid = { 0 };
3655
3656         if (struct_v >= 2) {
3657                 cid.gid = ceph_decode_64(p);
3658                 cid.handle = ceph_decode_64(p);
3659         }
3660
3661         dout("%s rbd_dev %p cid %llu-%llu\n", __func__, rbd_dev, cid.gid,
3662              cid.handle);
3663         if (!rbd_cid_equal(&cid, &rbd_empty_cid)) {
3664                 down_write(&rbd_dev->lock_rwsem);
3665                 if (!rbd_cid_equal(&cid, &rbd_dev->owner_cid)) {
3666                         dout("%s rbd_dev %p unexpected owner, cid %llu-%llu != owner_cid %llu-%llu\n",
3667                              __func__, rbd_dev, cid.gid, cid.handle,
3668                              rbd_dev->owner_cid.gid, rbd_dev->owner_cid.handle);
3669                         up_write(&rbd_dev->lock_rwsem);
3670                         return;
3671                 }
3672
3673                 rbd_set_owner_cid(rbd_dev, &rbd_empty_cid);
3674                 downgrade_write(&rbd_dev->lock_rwsem);
3675         } else {
3676                 down_read(&rbd_dev->lock_rwsem);
3677         }
3678
3679         if (!__rbd_is_lock_owner(rbd_dev))
3680                 wake_requests(rbd_dev, false);
3681         up_read(&rbd_dev->lock_rwsem);
3682 }
3683
3684 static bool rbd_handle_request_lock(struct rbd_device *rbd_dev, u8 struct_v,
3685                                     void **p)
3686 {
3687         struct rbd_client_id my_cid = rbd_get_cid(rbd_dev);
3688         struct rbd_client_id cid = { 0 };
3689         bool need_to_send;
3690
3691         if (struct_v >= 2) {
3692                 cid.gid = ceph_decode_64(p);
3693                 cid.handle = ceph_decode_64(p);
3694         }
3695
3696         dout("%s rbd_dev %p cid %llu-%llu\n", __func__, rbd_dev, cid.gid,
3697              cid.handle);
3698         if (rbd_cid_equal(&cid, &my_cid))
3699                 return false;
3700
3701         down_read(&rbd_dev->lock_rwsem);
3702         need_to_send = __rbd_is_lock_owner(rbd_dev);
3703         if (rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED) {
3704                 if (!rbd_cid_equal(&rbd_dev->owner_cid, &rbd_empty_cid)) {
3705                         dout("%s rbd_dev %p queueing unlock_work\n", __func__,
3706                              rbd_dev);
3707                         queue_work(rbd_dev->task_wq, &rbd_dev->unlock_work);
3708                 }
3709         }
3710         up_read(&rbd_dev->lock_rwsem);
3711         return need_to_send;
3712 }
3713
3714 static void __rbd_acknowledge_notify(struct rbd_device *rbd_dev,
3715                                      u64 notify_id, u64 cookie, s32 *result)
3716 {
3717         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3718         int buf_size = 4 + CEPH_ENCODING_START_BLK_LEN;
3719         char buf[buf_size];
3720         int ret;
3721
3722         if (result) {
3723                 void *p = buf;
3724
3725                 /* encode ResponseMessage */
3726                 ceph_start_encoding(&p, 1, 1,
3727                                     buf_size - CEPH_ENCODING_START_BLK_LEN);
3728                 ceph_encode_32(&p, *result);
3729         } else {
3730                 buf_size = 0;
3731         }
3732
3733         ret = ceph_osdc_notify_ack(osdc, &rbd_dev->header_oid,
3734                                    &rbd_dev->header_oloc, notify_id, cookie,
3735                                    buf, buf_size);
3736         if (ret)
3737                 rbd_warn(rbd_dev, "acknowledge_notify failed: %d", ret);
3738 }
3739
3740 static void rbd_acknowledge_notify(struct rbd_device *rbd_dev, u64 notify_id,
3741                                    u64 cookie)
3742 {
3743         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3744         __rbd_acknowledge_notify(rbd_dev, notify_id, cookie, NULL);
3745 }
3746
3747 static void rbd_acknowledge_notify_result(struct rbd_device *rbd_dev,
3748                                           u64 notify_id, u64 cookie, s32 result)
3749 {
3750         dout("%s rbd_dev %p result %d\n", __func__, rbd_dev, result);
3751         __rbd_acknowledge_notify(rbd_dev, notify_id, cookie, &result);
3752 }
3753
3754 static void rbd_watch_cb(void *arg, u64 notify_id, u64 cookie,
3755                          u64 notifier_id, void *data, size_t data_len)
3756 {
3757         struct rbd_device *rbd_dev = arg;
3758         void *p = data;
3759         void *const end = p + data_len;
3760         u8 struct_v;
3761         u32 len;
3762         u32 notify_op;
3763         int ret;
3764
3765         dout("%s rbd_dev %p cookie %llu notify_id %llu data_len %zu\n",
3766              __func__, rbd_dev, cookie, notify_id, data_len);
3767         if (data_len) {
3768                 ret = ceph_start_decoding(&p, end, 1, "NotifyMessage",
3769                                           &struct_v, &len);
3770                 if (ret) {
3771                         rbd_warn(rbd_dev, "failed to decode NotifyMessage: %d",
3772                                  ret);
3773                         return;
3774                 }
3775
3776                 notify_op = ceph_decode_32(&p);
3777         } else {
3778                 /* legacy notification for header updates */
3779                 notify_op = RBD_NOTIFY_OP_HEADER_UPDATE;
3780                 len = 0;
3781         }
3782
3783         dout("%s rbd_dev %p notify_op %u\n", __func__, rbd_dev, notify_op);
3784         switch (notify_op) {
3785         case RBD_NOTIFY_OP_ACQUIRED_LOCK:
3786                 rbd_handle_acquired_lock(rbd_dev, struct_v, &p);
3787                 rbd_acknowledge_notify(rbd_dev, notify_id, cookie);
3788                 break;
3789         case RBD_NOTIFY_OP_RELEASED_LOCK:
3790                 rbd_handle_released_lock(rbd_dev, struct_v, &p);
3791                 rbd_acknowledge_notify(rbd_dev, notify_id, cookie);
3792                 break;
3793         case RBD_NOTIFY_OP_REQUEST_LOCK:
3794                 if (rbd_handle_request_lock(rbd_dev, struct_v, &p))
3795                         /*
3796                          * send ResponseMessage(0) back so the client
3797                          * can detect a missing owner
3798                          */
3799                         rbd_acknowledge_notify_result(rbd_dev, notify_id,
3800                                                       cookie, 0);
3801                 else
3802                         rbd_acknowledge_notify(rbd_dev, notify_id, cookie);
3803                 break;
3804         case RBD_NOTIFY_OP_HEADER_UPDATE:
3805                 ret = rbd_dev_refresh(rbd_dev);
3806                 if (ret)
3807                         rbd_warn(rbd_dev, "refresh failed: %d", ret);
3808
3809                 rbd_acknowledge_notify(rbd_dev, notify_id, cookie);
3810                 break;
3811         default:
3812                 if (rbd_is_lock_owner(rbd_dev))
3813                         rbd_acknowledge_notify_result(rbd_dev, notify_id,
3814                                                       cookie, -EOPNOTSUPP);
3815                 else
3816                         rbd_acknowledge_notify(rbd_dev, notify_id, cookie);
3817                 break;
3818         }
3819 }
3820
3821 static void __rbd_unregister_watch(struct rbd_device *rbd_dev);
3822
3823 static void rbd_watch_errcb(void *arg, u64 cookie, int err)
3824 {
3825         struct rbd_device *rbd_dev = arg;
3826
3827         rbd_warn(rbd_dev, "encountered watch error: %d", err);
3828
3829         down_write(&rbd_dev->lock_rwsem);
3830         rbd_set_owner_cid(rbd_dev, &rbd_empty_cid);
3831         up_write(&rbd_dev->lock_rwsem);
3832
3833         mutex_lock(&rbd_dev->watch_mutex);
3834         if (rbd_dev->watch_state == RBD_WATCH_STATE_REGISTERED) {
3835                 __rbd_unregister_watch(rbd_dev);
3836                 rbd_dev->watch_state = RBD_WATCH_STATE_ERROR;
3837
3838                 queue_delayed_work(rbd_dev->task_wq, &rbd_dev->watch_dwork, 0);
3839         }
3840         mutex_unlock(&rbd_dev->watch_mutex);
3841 }
3842
3843 /*
3844  * watch_mutex must be locked
3845  */
3846 static int __rbd_register_watch(struct rbd_device *rbd_dev)
3847 {
3848         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3849         struct ceph_osd_linger_request *handle;
3850
3851         rbd_assert(!rbd_dev->watch_handle);
3852         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3853
3854         handle = ceph_osdc_watch(osdc, &rbd_dev->header_oid,
3855                                  &rbd_dev->header_oloc, rbd_watch_cb,
3856                                  rbd_watch_errcb, rbd_dev);
3857         if (IS_ERR(handle))
3858                 return PTR_ERR(handle);
3859
3860         rbd_dev->watch_handle = handle;
3861         return 0;
3862 }
3863
3864 /*
3865  * watch_mutex must be locked
3866  */
3867 static void __rbd_unregister_watch(struct rbd_device *rbd_dev)
3868 {
3869         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
3870         int ret;
3871
3872         rbd_assert(rbd_dev->watch_handle);
3873         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3874
3875         ret = ceph_osdc_unwatch(osdc, rbd_dev->watch_handle);
3876         if (ret)
3877                 rbd_warn(rbd_dev, "failed to unwatch: %d", ret);
3878
3879         rbd_dev->watch_handle = NULL;
3880 }
3881
3882 static int rbd_register_watch(struct rbd_device *rbd_dev)
3883 {
3884         int ret;
3885
3886         mutex_lock(&rbd_dev->watch_mutex);
3887         rbd_assert(rbd_dev->watch_state == RBD_WATCH_STATE_UNREGISTERED);
3888         ret = __rbd_register_watch(rbd_dev);
3889         if (ret)
3890                 goto out;
3891
3892         rbd_dev->watch_state = RBD_WATCH_STATE_REGISTERED;
3893         rbd_dev->watch_cookie = rbd_dev->watch_handle->linger_id;
3894
3895 out:
3896         mutex_unlock(&rbd_dev->watch_mutex);
3897         return ret;
3898 }
3899
3900 static void cancel_tasks_sync(struct rbd_device *rbd_dev)
3901 {
3902         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3903
3904         cancel_delayed_work_sync(&rbd_dev->watch_dwork);
3905         cancel_work_sync(&rbd_dev->acquired_lock_work);
3906         cancel_work_sync(&rbd_dev->released_lock_work);
3907         cancel_delayed_work_sync(&rbd_dev->lock_dwork);
3908         cancel_work_sync(&rbd_dev->unlock_work);
3909 }
3910
3911 static void rbd_unregister_watch(struct rbd_device *rbd_dev)
3912 {
3913         WARN_ON(waitqueue_active(&rbd_dev->lock_waitq));
3914         cancel_tasks_sync(rbd_dev);
3915
3916         mutex_lock(&rbd_dev->watch_mutex);
3917         if (rbd_dev->watch_state == RBD_WATCH_STATE_REGISTERED)
3918                 __rbd_unregister_watch(rbd_dev);
3919         rbd_dev->watch_state = RBD_WATCH_STATE_UNREGISTERED;
3920         mutex_unlock(&rbd_dev->watch_mutex);
3921
3922         ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
3923 }
3924
3925 static void rbd_reregister_watch(struct work_struct *work)
3926 {
3927         struct rbd_device *rbd_dev = container_of(to_delayed_work(work),
3928                                             struct rbd_device, watch_dwork);
3929         bool was_lock_owner = false;
3930         int ret;
3931
3932         dout("%s rbd_dev %p\n", __func__, rbd_dev);
3933
3934         down_write(&rbd_dev->lock_rwsem);
3935         if (rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED)
3936                 was_lock_owner = rbd_release_lock(rbd_dev);
3937
3938         mutex_lock(&rbd_dev->watch_mutex);
3939         if (rbd_dev->watch_state != RBD_WATCH_STATE_ERROR)
3940                 goto fail_unlock;
3941
3942         ret = __rbd_register_watch(rbd_dev);
3943         if (ret) {
3944                 rbd_warn(rbd_dev, "failed to reregister watch: %d", ret);
3945                 if (ret != -EBLACKLISTED)
3946                         queue_delayed_work(rbd_dev->task_wq,
3947                                            &rbd_dev->watch_dwork,
3948                                            RBD_RETRY_DELAY);
3949                 goto fail_unlock;
3950         }
3951
3952         rbd_dev->watch_state = RBD_WATCH_STATE_REGISTERED;
3953         rbd_dev->watch_cookie = rbd_dev->watch_handle->linger_id;
3954         mutex_unlock(&rbd_dev->watch_mutex);
3955
3956         ret = rbd_dev_refresh(rbd_dev);
3957         if (ret)
3958                 rbd_warn(rbd_dev, "reregisteration refresh failed: %d", ret);
3959
3960         if (was_lock_owner) {
3961                 ret = rbd_try_lock(rbd_dev);
3962                 if (ret)
3963                         rbd_warn(rbd_dev, "reregisteration lock failed: %d",
3964                                  ret);
3965         }
3966
3967         up_write(&rbd_dev->lock_rwsem);
3968         wake_requests(rbd_dev, true);
3969         return;
3970
3971 fail_unlock:
3972         mutex_unlock(&rbd_dev->watch_mutex);
3973         up_write(&rbd_dev->lock_rwsem);
3974 }
3975
3976 /*
3977  * Synchronous osd object method call.  Returns the number of bytes
3978  * returned in the outbound buffer, or a negative error code.
3979  */
3980 static int rbd_obj_method_sync(struct rbd_device *rbd_dev,
3981                              const char *object_name,
3982                              const char *class_name,
3983                              const char *method_name,
3984                              const void *outbound,
3985                              size_t outbound_size,
3986                              void *inbound,
3987                              size_t inbound_size)
3988 {
3989         struct rbd_obj_request *obj_request;
3990         struct page **pages;
3991         u32 page_count;
3992         int ret;
3993
3994         /*
3995          * Method calls are ultimately read operations.  The result
3996          * should placed into the inbound buffer provided.  They
3997          * also supply outbound data--parameters for the object
3998          * method.  Currently if this is present it will be a
3999          * snapshot id.
4000          */
4001         page_count = (u32)calc_pages_for(0, inbound_size);
4002         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
4003         if (IS_ERR(pages))
4004                 return PTR_ERR(pages);
4005
4006         ret = -ENOMEM;
4007         obj_request = rbd_obj_request_create(object_name, 0, inbound_size,
4008                                                         OBJ_REQUEST_PAGES);
4009         if (!obj_request)
4010                 goto out;
4011
4012         obj_request->pages = pages;
4013         obj_request->page_count = page_count;
4014
4015         obj_request->osd_req = rbd_osd_req_create(rbd_dev, OBJ_OP_READ, 1,
4016                                                   obj_request);
4017         if (!obj_request->osd_req)
4018                 goto out;
4019
4020         osd_req_op_cls_init(obj_request->osd_req, 0, CEPH_OSD_OP_CALL,
4021                                         class_name, method_name);
4022         if (outbound_size) {
4023                 struct ceph_pagelist *pagelist;
4024
4025                 pagelist = kmalloc(sizeof (*pagelist), GFP_NOFS);
4026                 if (!pagelist)
4027                         goto out;
4028
4029                 ceph_pagelist_init(pagelist);
4030                 ceph_pagelist_append(pagelist, outbound, outbound_size);
4031                 osd_req_op_cls_request_data_pagelist(obj_request->osd_req, 0,
4032                                                 pagelist);
4033         }
4034         osd_req_op_cls_response_data_pages(obj_request->osd_req, 0,
4035                                         obj_request->pages, inbound_size,
4036                                         0, false, false);
4037
4038         rbd_obj_request_submit(obj_request);
4039         ret = rbd_obj_request_wait(obj_request);
4040         if (ret)
4041                 goto out;
4042
4043         ret = obj_request->result;
4044         if (ret < 0)
4045                 goto out;
4046
4047         rbd_assert(obj_request->xferred < (u64)INT_MAX);
4048         ret = (int)obj_request->xferred;
4049         ceph_copy_from_page_vector(pages, inbound, 0, obj_request->xferred);
4050 out:
4051         if (obj_request)
4052                 rbd_obj_request_put(obj_request);
4053         else
4054                 ceph_release_page_vector(pages, page_count);
4055
4056         return ret;
4057 }
4058
4059 /*
4060  * lock_rwsem must be held for read
4061  */
4062 static void rbd_wait_state_locked(struct rbd_device *rbd_dev)
4063 {
4064         DEFINE_WAIT(wait);
4065
4066         do {
4067                 /*
4068                  * Note the use of mod_delayed_work() in rbd_acquire_lock()
4069                  * and cancel_delayed_work() in wake_requests().
4070                  */
4071                 dout("%s rbd_dev %p queueing lock_dwork\n", __func__, rbd_dev);
4072                 queue_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork, 0);
4073                 prepare_to_wait_exclusive(&rbd_dev->lock_waitq, &wait,
4074                                           TASK_UNINTERRUPTIBLE);
4075                 up_read(&rbd_dev->lock_rwsem);
4076                 schedule();
4077                 down_read(&rbd_dev->lock_rwsem);
4078         } while (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED);
4079         finish_wait(&rbd_dev->lock_waitq, &wait);
4080 }
4081
4082 static void rbd_queue_workfn(struct work_struct *work)
4083 {
4084         struct request *rq = blk_mq_rq_from_pdu(work);
4085         struct rbd_device *rbd_dev = rq->q->queuedata;
4086         struct rbd_img_request *img_request;
4087         struct ceph_snap_context *snapc = NULL;
4088         u64 offset = (u64)blk_rq_pos(rq) << SECTOR_SHIFT;
4089         u64 length = blk_rq_bytes(rq);
4090         enum obj_operation_type op_type;
4091         u64 mapping_size;
4092         bool must_be_locked;
4093         int result;
4094
4095         if (rq->cmd_type != REQ_TYPE_FS) {
4096                 dout("%s: non-fs request type %d\n", __func__,
4097                         (int) rq->cmd_type);
4098                 result = -EIO;
4099                 goto err;
4100         }
4101
4102         if (req_op(rq) == REQ_OP_DISCARD)
4103                 op_type = OBJ_OP_DISCARD;
4104         else if (req_op(rq) == REQ_OP_WRITE)
4105                 op_type = OBJ_OP_WRITE;
4106         else
4107                 op_type = OBJ_OP_READ;
4108
4109         /* Ignore/skip any zero-length requests */
4110
4111         if (!length) {
4112                 dout("%s: zero-length request\n", __func__);
4113                 result = 0;
4114                 goto err_rq;
4115         }
4116
4117         /* Only reads are allowed to a read-only device */
4118
4119         if (op_type != OBJ_OP_READ) {
4120                 if (rbd_dev->mapping.read_only) {
4121                         result = -EROFS;
4122                         goto err_rq;
4123                 }
4124                 rbd_assert(rbd_dev->spec->snap_id == CEPH_NOSNAP);
4125         }
4126
4127         /*
4128          * Quit early if the mapped snapshot no longer exists.  It's
4129          * still possible the snapshot will have disappeared by the
4130          * time our request arrives at the osd, but there's no sense in
4131          * sending it if we already know.
4132          */
4133         if (!test_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags)) {
4134                 dout("request for non-existent snapshot");
4135                 rbd_assert(rbd_dev->spec->snap_id != CEPH_NOSNAP);
4136                 result = -ENXIO;
4137                 goto err_rq;
4138         }
4139
4140         if (offset && length > U64_MAX - offset + 1) {
4141                 rbd_warn(rbd_dev, "bad request range (%llu~%llu)", offset,
4142                          length);
4143                 result = -EINVAL;
4144                 goto err_rq;    /* Shouldn't happen */
4145         }
4146
4147         blk_mq_start_request(rq);
4148
4149         down_read(&rbd_dev->header_rwsem);
4150         mapping_size = rbd_dev->mapping.size;
4151         if (op_type != OBJ_OP_READ) {
4152                 snapc = rbd_dev->header.snapc;
4153                 ceph_get_snap_context(snapc);
4154                 must_be_locked = rbd_is_lock_supported(rbd_dev);
4155         } else {
4156                 must_be_locked = rbd_dev->opts->lock_on_read &&
4157                                         rbd_is_lock_supported(rbd_dev);
4158         }
4159         up_read(&rbd_dev->header_rwsem);
4160
4161         if (offset + length > mapping_size) {
4162                 rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", offset,
4163                          length, mapping_size);
4164                 result = -EIO;
4165                 goto err_rq;
4166         }
4167
4168         if (must_be_locked) {
4169                 down_read(&rbd_dev->lock_rwsem);
4170                 if (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED)
4171                         rbd_wait_state_locked(rbd_dev);
4172         }
4173
4174         img_request = rbd_img_request_create(rbd_dev, offset, length, op_type,
4175                                              snapc);
4176         if (!img_request) {
4177                 result = -ENOMEM;
4178                 goto err_unlock;
4179         }
4180         img_request->rq = rq;
4181         snapc = NULL; /* img_request consumes a ref */
4182
4183         if (op_type == OBJ_OP_DISCARD)
4184                 result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,
4185                                               NULL);
4186         else
4187                 result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO,
4188                                               rq->bio);
4189         if (result)
4190                 goto err_img_request;
4191
4192         result = rbd_img_request_submit(img_request);
4193         if (result)
4194                 goto err_img_request;
4195
4196         if (must_be_locked)
4197                 up_read(&rbd_dev->lock_rwsem);
4198         return;
4199
4200 err_img_request:
4201         rbd_img_request_put(img_request);
4202 err_unlock:
4203         if (must_be_locked)
4204                 up_read(&rbd_dev->lock_rwsem);
4205 err_rq:
4206         if (result)
4207                 rbd_warn(rbd_dev, "%s %llx at %llx result %d",
4208                          obj_op_name(op_type), length, offset, result);
4209         ceph_put_snap_context(snapc);
4210 err:
4211         blk_mq_end_request(rq, result);
4212 }
4213
4214 static int rbd_queue_rq(struct blk_mq_hw_ctx *hctx,
4215                 const struct blk_mq_queue_data *bd)
4216 {
4217         struct request *rq = bd->rq;
4218         struct work_struct *work = blk_mq_rq_to_pdu(rq);
4219
4220         queue_work(rbd_wq, work);
4221         return BLK_MQ_RQ_QUEUE_OK;
4222 }
4223
4224 static void rbd_free_disk(struct rbd_device *rbd_dev)
4225 {
4226         struct gendisk *disk = rbd_dev->disk;
4227
4228         if (!disk)
4229                 return;
4230
4231         rbd_dev->disk = NULL;
4232         if (disk->flags & GENHD_FL_UP) {
4233                 del_gendisk(disk);
4234                 if (disk->queue)
4235                         blk_cleanup_queue(disk->queue);
4236                 blk_mq_free_tag_set(&rbd_dev->tag_set);
4237         }
4238         put_disk(disk);
4239 }
4240
4241 static int rbd_obj_read_sync(struct rbd_device *rbd_dev,
4242                                 const char *object_name,
4243                                 u64 offset, u64 length, void *buf)
4244
4245 {
4246         struct rbd_obj_request *obj_request;
4247         struct page **pages = NULL;
4248         u32 page_count;
4249         size_t size;
4250         int ret;
4251
4252         page_count = (u32) calc_pages_for(offset, length);
4253         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
4254         if (IS_ERR(pages))
4255                 return PTR_ERR(pages);
4256
4257         ret = -ENOMEM;
4258         obj_request = rbd_obj_request_create(object_name, offset, length,
4259                                                         OBJ_REQUEST_PAGES);
4260         if (!obj_request)
4261                 goto out;
4262
4263         obj_request->pages = pages;
4264         obj_request->page_count = page_count;
4265
4266         obj_request->osd_req = rbd_osd_req_create(rbd_dev, OBJ_OP_READ, 1,
4267                                                   obj_request);
4268         if (!obj_request->osd_req)
4269                 goto out;
4270
4271         osd_req_op_extent_init(obj_request->osd_req, 0, CEPH_OSD_OP_READ,
4272                                         offset, length, 0, 0);
4273         osd_req_op_extent_osd_data_pages(obj_request->osd_req, 0,
4274                                         obj_request->pages,
4275                                         obj_request->length,
4276                                         obj_request->offset & ~PAGE_MASK,
4277                                         false, false);
4278
4279         rbd_obj_request_submit(obj_request);
4280         ret = rbd_obj_request_wait(obj_request);
4281         if (ret)
4282                 goto out;
4283
4284         ret = obj_request->result;
4285         if (ret < 0)
4286                 goto out;
4287
4288         rbd_assert(obj_request->xferred <= (u64) SIZE_MAX);
4289         size = (size_t) obj_request->xferred;
4290         ceph_copy_from_page_vector(pages, buf, 0, size);
4291         rbd_assert(size <= (size_t)INT_MAX);
4292         ret = (int)size;
4293 out:
4294         if (obj_request)
4295                 rbd_obj_request_put(obj_request);
4296         else
4297                 ceph_release_page_vector(pages, page_count);
4298
4299         return ret;
4300 }
4301
4302 /*
4303  * Read the complete header for the given rbd device.  On successful
4304  * return, the rbd_dev->header field will contain up-to-date
4305  * information about the image.
4306  */
4307 static int rbd_dev_v1_header_info(struct rbd_device *rbd_dev)
4308 {
4309         struct rbd_image_header_ondisk *ondisk = NULL;
4310         u32 snap_count = 0;
4311         u64 names_size = 0;
4312         u32 want_count;
4313         int ret;
4314
4315         /*
4316          * The complete header will include an array of its 64-bit
4317          * snapshot ids, followed by the names of those snapshots as
4318          * a contiguous block of NUL-terminated strings.  Note that
4319          * the number of snapshots could change by the time we read
4320          * it in, in which case we re-read it.
4321          */
4322         do {
4323                 size_t size;
4324
4325                 kfree(ondisk);
4326
4327                 size = sizeof (*ondisk);
4328                 size += snap_count * sizeof (struct rbd_image_snap_ondisk);
4329                 size += names_size;
4330                 ondisk = kmalloc(size, GFP_KERNEL);
4331                 if (!ondisk)
4332                         return -ENOMEM;
4333
4334                 ret = rbd_obj_read_sync(rbd_dev, rbd_dev->header_oid.name,
4335                                        0, size, ondisk);
4336                 if (ret < 0)
4337                         goto out;
4338                 if ((size_t)ret < size) {
4339                         ret = -ENXIO;
4340                         rbd_warn(rbd_dev, "short header read (want %zd got %d)",
4341                                 size, ret);
4342                         goto out;
4343                 }
4344                 if (!rbd_dev_ondisk_valid(ondisk)) {
4345                         ret = -ENXIO;
4346                         rbd_warn(rbd_dev, "invalid header");
4347                         goto out;
4348                 }
4349
4350                 names_size = le64_to_cpu(ondisk->snap_names_len);
4351                 want_count = snap_count;
4352                 snap_count = le32_to_cpu(ondisk->snap_count);
4353         } while (snap_count != want_count);
4354
4355         ret = rbd_header_from_disk(rbd_dev, ondisk);
4356 out:
4357         kfree(ondisk);
4358
4359         return ret;
4360 }
4361
4362 /*
4363  * Clear the rbd device's EXISTS flag if the snapshot it's mapped to
4364  * has disappeared from the (just updated) snapshot context.
4365  */
4366 static void rbd_exists_validate(struct rbd_device *rbd_dev)
4367 {
4368         u64 snap_id;
4369
4370         if (!test_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags))
4371                 return;
4372
4373         snap_id = rbd_dev->spec->snap_id;
4374         if (snap_id == CEPH_NOSNAP)
4375                 return;
4376
4377         if (rbd_dev_snap_index(rbd_dev, snap_id) == BAD_SNAP_INDEX)
4378                 clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
4379 }
4380
4381 static void rbd_dev_update_size(struct rbd_device *rbd_dev)
4382 {
4383         sector_t size;
4384
4385         /*
4386          * If EXISTS is not set, rbd_dev->disk may be NULL, so don't
4387          * try to update its size.  If REMOVING is set, updating size
4388          * is just useless work since the device can't be opened.
4389          */
4390         if (test_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags) &&
4391             !test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags)) {
4392                 size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
4393                 dout("setting size to %llu sectors", (unsigned long long)size);
4394                 set_capacity(rbd_dev->disk, size);
4395                 revalidate_disk(rbd_dev->disk);
4396         }
4397 }
4398
4399 static int rbd_dev_refresh(struct rbd_device *rbd_dev)
4400 {
4401         u64 mapping_size;
4402         int ret;
4403
4404         down_write(&rbd_dev->header_rwsem);
4405         mapping_size = rbd_dev->mapping.size;
4406
4407         ret = rbd_dev_header_info(rbd_dev);
4408         if (ret)
4409                 goto out;
4410
4411         /*
4412          * If there is a parent, see if it has disappeared due to the
4413          * mapped image getting flattened.
4414          */
4415         if (rbd_dev->parent) {
4416                 ret = rbd_dev_v2_parent_info(rbd_dev);
4417                 if (ret)
4418                         goto out;
4419         }
4420
4421         if (rbd_dev->spec->snap_id == CEPH_NOSNAP) {
4422                 rbd_dev->mapping.size = rbd_dev->header.image_size;
4423         } else {
4424                 /* validate mapped snapshot's EXISTS flag */
4425                 rbd_exists_validate(rbd_dev);
4426         }
4427
4428 out:
4429         up_write(&rbd_dev->header_rwsem);
4430         if (!ret && mapping_size != rbd_dev->mapping.size)
4431                 rbd_dev_update_size(rbd_dev);
4432
4433         return ret;
4434 }
4435
4436 static int rbd_init_request(void *data, struct request *rq,
4437                 unsigned int hctx_idx, unsigned int request_idx,
4438                 unsigned int numa_node)
4439 {
4440         struct work_struct *work = blk_mq_rq_to_pdu(rq);
4441
4442         INIT_WORK(work, rbd_queue_workfn);
4443         return 0;
4444 }
4445
4446 static struct blk_mq_ops rbd_mq_ops = {
4447         .queue_rq       = rbd_queue_rq,
4448         .map_queue      = blk_mq_map_queue,
4449         .init_request   = rbd_init_request,
4450 };
4451
4452 static int rbd_init_disk(struct rbd_device *rbd_dev)
4453 {
4454         struct gendisk *disk;
4455         struct request_queue *q;
4456         u64 segment_size;
4457         int err;
4458
4459         /* create gendisk info */
4460         disk = alloc_disk(single_major ?
4461                           (1 << RBD_SINGLE_MAJOR_PART_SHIFT) :
4462                           RBD_MINORS_PER_MAJOR);
4463         if (!disk)
4464                 return -ENOMEM;
4465
4466         snprintf(disk->disk_name, sizeof(disk->disk_name), RBD_DRV_NAME "%d",
4467                  rbd_dev->dev_id);
4468         disk->major = rbd_dev->major;
4469         disk->first_minor = rbd_dev->minor;
4470         if (single_major)
4471                 disk->flags |= GENHD_FL_EXT_DEVT;
4472         disk->fops = &rbd_bd_ops;
4473         disk->private_data = rbd_dev;
4474
4475         memset(&rbd_dev->tag_set, 0, sizeof(rbd_dev->tag_set));
4476         rbd_dev->tag_set.ops = &rbd_mq_ops;
4477         rbd_dev->tag_set.queue_depth = rbd_dev->opts->queue_depth;
4478         rbd_dev->tag_set.numa_node = NUMA_NO_NODE;
4479         rbd_dev->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_SG_MERGE;
4480         rbd_dev->tag_set.nr_hw_queues = 1;
4481         rbd_dev->tag_set.cmd_size = sizeof(struct work_struct);
4482
4483         err = blk_mq_alloc_tag_set(&rbd_dev->tag_set);
4484         if (err)
4485                 goto out_disk;
4486
4487         q = blk_mq_init_queue(&rbd_dev->tag_set);
4488         if (IS_ERR(q)) {
4489                 err = PTR_ERR(q);
4490                 goto out_tag_set;
4491         }
4492
4493         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
4494         /* QUEUE_FLAG_ADD_RANDOM is off by default for blk-mq */
4495
4496         /* set io sizes to object size */
4497         segment_size = rbd_obj_bytes(&rbd_dev->header);
4498         blk_queue_max_hw_sectors(q, segment_size / SECTOR_SIZE);
4499         q->limits.max_sectors = queue_max_hw_sectors(q);
4500         blk_queue_max_segments(q, segment_size / SECTOR_SIZE);
4501         blk_queue_max_segment_size(q, segment_size);
4502         blk_queue_io_min(q, segment_size);
4503         blk_queue_io_opt(q, segment_size);
4504
4505         /* enable the discard support */
4506         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
4507         q->limits.discard_granularity = segment_size;
4508         q->limits.discard_alignment = segment_size;
4509         blk_queue_max_discard_sectors(q, segment_size / SECTOR_SIZE);
4510         q->limits.discard_zeroes_data = 1;
4511
4512         if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
4513                 q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES;
4514
4515         disk->queue = q;
4516
4517         q->queuedata = rbd_dev;
4518
4519         rbd_dev->disk = disk;
4520
4521         return 0;
4522 out_tag_set:
4523         blk_mq_free_tag_set(&rbd_dev->tag_set);
4524 out_disk:
4525         put_disk(disk);
4526         return err;
4527 }
4528
4529 /*
4530   sysfs
4531 */
4532
4533 static struct rbd_device *dev_to_rbd_dev(struct device *dev)
4534 {
4535         return container_of(dev, struct rbd_device, dev);
4536 }
4537
4538 static ssize_t rbd_size_show(struct device *dev,
4539                              struct device_attribute *attr, char *buf)
4540 {
4541         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4542
4543         return sprintf(buf, "%llu\n",
4544                 (unsigned long long)rbd_dev->mapping.size);
4545 }
4546
4547 /*
4548  * Note this shows the features for whatever's mapped, which is not
4549  * necessarily the base image.
4550  */
4551 static ssize_t rbd_features_show(struct device *dev,
4552                              struct device_attribute *attr, char *buf)
4553 {
4554         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4555
4556         return sprintf(buf, "0x%016llx\n",
4557                         (unsigned long long)rbd_dev->mapping.features);
4558 }
4559
4560 static ssize_t rbd_major_show(struct device *dev,
4561                               struct device_attribute *attr, char *buf)
4562 {
4563         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4564
4565         if (rbd_dev->major)
4566                 return sprintf(buf, "%d\n", rbd_dev->major);
4567
4568         return sprintf(buf, "(none)\n");
4569 }
4570
4571 static ssize_t rbd_minor_show(struct device *dev,
4572                               struct device_attribute *attr, char *buf)
4573 {
4574         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4575
4576         return sprintf(buf, "%d\n", rbd_dev->minor);
4577 }
4578
4579 static ssize_t rbd_client_addr_show(struct device *dev,
4580                                     struct device_attribute *attr, char *buf)
4581 {
4582         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4583         struct ceph_entity_addr *client_addr =
4584             ceph_client_addr(rbd_dev->rbd_client->client);
4585
4586         return sprintf(buf, "%pISpc/%u\n", &client_addr->in_addr,
4587                        le32_to_cpu(client_addr->nonce));
4588 }
4589
4590 static ssize_t rbd_client_id_show(struct device *dev,
4591                                   struct device_attribute *attr, char *buf)
4592 {
4593         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4594
4595         return sprintf(buf, "client%lld\n",
4596                        ceph_client_gid(rbd_dev->rbd_client->client));
4597 }
4598
4599 static ssize_t rbd_cluster_fsid_show(struct device *dev,
4600                                      struct device_attribute *attr, char *buf)
4601 {
4602         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4603
4604         return sprintf(buf, "%pU\n", &rbd_dev->rbd_client->client->fsid);
4605 }
4606
4607 static ssize_t rbd_config_info_show(struct device *dev,
4608                                     struct device_attribute *attr, char *buf)
4609 {
4610         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4611
4612         return sprintf(buf, "%s\n", rbd_dev->config_info);
4613 }
4614
4615 static ssize_t rbd_pool_show(struct device *dev,
4616                              struct device_attribute *attr, char *buf)
4617 {
4618         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4619
4620         return sprintf(buf, "%s\n", rbd_dev->spec->pool_name);
4621 }
4622
4623 static ssize_t rbd_pool_id_show(struct device *dev,
4624                              struct device_attribute *attr, char *buf)
4625 {
4626         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4627
4628         return sprintf(buf, "%llu\n",
4629                         (unsigned long long) rbd_dev->spec->pool_id);
4630 }
4631
4632 static ssize_t rbd_name_show(struct device *dev,
4633                              struct device_attribute *attr, char *buf)
4634 {
4635         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4636
4637         if (rbd_dev->spec->image_name)
4638                 return sprintf(buf, "%s\n", rbd_dev->spec->image_name);
4639
4640         return sprintf(buf, "(unknown)\n");
4641 }
4642
4643 static ssize_t rbd_image_id_show(struct device *dev,
4644                              struct device_attribute *attr, char *buf)
4645 {
4646         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4647
4648         return sprintf(buf, "%s\n", rbd_dev->spec->image_id);
4649 }
4650
4651 /*
4652  * Shows the name of the currently-mapped snapshot (or
4653  * RBD_SNAP_HEAD_NAME for the base image).
4654  */
4655 static ssize_t rbd_snap_show(struct device *dev,
4656                              struct device_attribute *attr,
4657                              char *buf)
4658 {
4659         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4660
4661         return sprintf(buf, "%s\n", rbd_dev->spec->snap_name);
4662 }
4663
4664 static ssize_t rbd_snap_id_show(struct device *dev,
4665                                 struct device_attribute *attr, char *buf)
4666 {
4667         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4668
4669         return sprintf(buf, "%llu\n", rbd_dev->spec->snap_id);
4670 }
4671
4672 /*
4673  * For a v2 image, shows the chain of parent images, separated by empty
4674  * lines.  For v1 images or if there is no parent, shows "(no parent
4675  * image)".
4676  */
4677 static ssize_t rbd_parent_show(struct device *dev,
4678                                struct device_attribute *attr,
4679                                char *buf)
4680 {
4681         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4682         ssize_t count = 0;
4683
4684         if (!rbd_dev->parent)
4685                 return sprintf(buf, "(no parent image)\n");
4686
4687         for ( ; rbd_dev->parent; rbd_dev = rbd_dev->parent) {
4688                 struct rbd_spec *spec = rbd_dev->parent_spec;
4689
4690                 count += sprintf(&buf[count], "%s"
4691                             "pool_id %llu\npool_name %s\n"
4692                             "image_id %s\nimage_name %s\n"
4693                             "snap_id %llu\nsnap_name %s\n"
4694                             "overlap %llu\n",
4695                             !count ? "" : "\n", /* first? */
4696                             spec->pool_id, spec->pool_name,
4697                             spec->image_id, spec->image_name ?: "(unknown)",
4698                             spec->snap_id, spec->snap_name,
4699                             rbd_dev->parent_overlap);
4700         }
4701
4702         return count;
4703 }
4704
4705 static ssize_t rbd_image_refresh(struct device *dev,
4706                                  struct device_attribute *attr,
4707                                  const char *buf,
4708                                  size_t size)
4709 {
4710         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4711         int ret;
4712
4713         ret = rbd_dev_refresh(rbd_dev);
4714         if (ret)
4715                 return ret;
4716
4717         return size;
4718 }
4719
4720 static DEVICE_ATTR(size, S_IRUGO, rbd_size_show, NULL);
4721 static DEVICE_ATTR(features, S_IRUGO, rbd_features_show, NULL);
4722 static DEVICE_ATTR(major, S_IRUGO, rbd_major_show, NULL);
4723 static DEVICE_ATTR(minor, S_IRUGO, rbd_minor_show, NULL);
4724 static DEVICE_ATTR(client_addr, S_IRUGO, rbd_client_addr_show, NULL);
4725 static DEVICE_ATTR(client_id, S_IRUGO, rbd_client_id_show, NULL);
4726 static DEVICE_ATTR(cluster_fsid, S_IRUGO, rbd_cluster_fsid_show, NULL);
4727 static DEVICE_ATTR(config_info, S_IRUSR, rbd_config_info_show, NULL);
4728 static DEVICE_ATTR(pool, S_IRUGO, rbd_pool_show, NULL);
4729 static DEVICE_ATTR(pool_id, S_IRUGO, rbd_pool_id_show, NULL);
4730 static DEVICE_ATTR(name, S_IRUGO, rbd_name_show, NULL);
4731 static DEVICE_ATTR(image_id, S_IRUGO, rbd_image_id_show, NULL);
4732 static DEVICE_ATTR(refresh, S_IWUSR, NULL, rbd_image_refresh);
4733 static DEVICE_ATTR(current_snap, S_IRUGO, rbd_snap_show, NULL);
4734 static DEVICE_ATTR(snap_id, S_IRUGO, rbd_snap_id_show, NULL);
4735 static DEVICE_ATTR(parent, S_IRUGO, rbd_parent_show, NULL);
4736
4737 static struct attribute *rbd_attrs[] = {
4738         &dev_attr_size.attr,
4739         &dev_attr_features.attr,
4740         &dev_attr_major.attr,
4741         &dev_attr_minor.attr,
4742         &dev_attr_client_addr.attr,
4743         &dev_attr_client_id.attr,
4744         &dev_attr_cluster_fsid.attr,
4745         &dev_attr_config_info.attr,
4746         &dev_attr_pool.attr,
4747         &dev_attr_pool_id.attr,
4748         &dev_attr_name.attr,
4749         &dev_attr_image_id.attr,
4750         &dev_attr_current_snap.attr,
4751         &dev_attr_snap_id.attr,
4752         &dev_attr_parent.attr,
4753         &dev_attr_refresh.attr,
4754         NULL
4755 };
4756
4757 static struct attribute_group rbd_attr_group = {
4758         .attrs = rbd_attrs,
4759 };
4760
4761 static const struct attribute_group *rbd_attr_groups[] = {
4762         &rbd_attr_group,
4763         NULL
4764 };
4765
4766 static void rbd_dev_release(struct device *dev);
4767
4768 static struct device_type rbd_device_type = {
4769         .name           = "rbd",
4770         .groups         = rbd_attr_groups,
4771         .release        = rbd_dev_release,
4772 };
4773
4774 static struct rbd_spec *rbd_spec_get(struct rbd_spec *spec)
4775 {
4776         kref_get(&spec->kref);
4777
4778         return spec;
4779 }
4780
4781 static void rbd_spec_free(struct kref *kref);
4782 static void rbd_spec_put(struct rbd_spec *spec)
4783 {
4784         if (spec)
4785                 kref_put(&spec->kref, rbd_spec_free);
4786 }
4787
4788 static struct rbd_spec *rbd_spec_alloc(void)
4789 {
4790         struct rbd_spec *spec;
4791
4792         spec = kzalloc(sizeof (*spec), GFP_KERNEL);
4793         if (!spec)
4794                 return NULL;
4795
4796         spec->pool_id = CEPH_NOPOOL;
4797         spec->snap_id = CEPH_NOSNAP;
4798         kref_init(&spec->kref);
4799
4800         return spec;
4801 }
4802
4803 static void rbd_spec_free(struct kref *kref)
4804 {
4805         struct rbd_spec *spec = container_of(kref, struct rbd_spec, kref);
4806
4807         kfree(spec->pool_name);
4808         kfree(spec->image_id);
4809         kfree(spec->image_name);
4810         kfree(spec->snap_name);
4811         kfree(spec);
4812 }
4813
4814 static void rbd_dev_free(struct rbd_device *rbd_dev)
4815 {
4816         WARN_ON(rbd_dev->watch_state != RBD_WATCH_STATE_UNREGISTERED);
4817         WARN_ON(rbd_dev->lock_state != RBD_LOCK_STATE_UNLOCKED);
4818
4819         ceph_oid_destroy(&rbd_dev->header_oid);
4820         ceph_oloc_destroy(&rbd_dev->header_oloc);
4821         kfree(rbd_dev->config_info);
4822
4823         rbd_put_client(rbd_dev->rbd_client);
4824         rbd_spec_put(rbd_dev->spec);
4825         kfree(rbd_dev->opts);
4826         kfree(rbd_dev);
4827 }
4828
4829 static void rbd_dev_release(struct device *dev)
4830 {
4831         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
4832         bool need_put = !!rbd_dev->opts;
4833
4834         if (need_put) {
4835                 destroy_workqueue(rbd_dev->task_wq);
4836                 ida_simple_remove(&rbd_dev_id_ida, rbd_dev->dev_id);
4837         }
4838
4839         rbd_dev_free(rbd_dev);
4840
4841         /*
4842          * This is racy, but way better than putting module outside of
4843          * the release callback.  The race window is pretty small, so
4844          * doing something similar to dm (dm-builtin.c) is overkill.
4845          */
4846         if (need_put)
4847                 module_put(THIS_MODULE);
4848 }
4849
4850 static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc,
4851                                            struct rbd_spec *spec)
4852 {
4853         struct rbd_device *rbd_dev;
4854
4855         rbd_dev = kzalloc(sizeof(*rbd_dev), GFP_KERNEL);
4856         if (!rbd_dev)
4857                 return NULL;
4858
4859         spin_lock_init(&rbd_dev->lock);
4860         INIT_LIST_HEAD(&rbd_dev->node);
4861         init_rwsem(&rbd_dev->header_rwsem);
4862
4863         ceph_oid_init(&rbd_dev->header_oid);
4864         ceph_oloc_init(&rbd_dev->header_oloc);
4865
4866         mutex_init(&rbd_dev->watch_mutex);
4867         rbd_dev->watch_state = RBD_WATCH_STATE_UNREGISTERED;
4868         INIT_DELAYED_WORK(&rbd_dev->watch_dwork, rbd_reregister_watch);
4869
4870         init_rwsem(&rbd_dev->lock_rwsem);
4871         rbd_dev->lock_state = RBD_LOCK_STATE_UNLOCKED;
4872         INIT_WORK(&rbd_dev->acquired_lock_work, rbd_notify_acquired_lock);
4873         INIT_WORK(&rbd_dev->released_lock_work, rbd_notify_released_lock);
4874         INIT_DELAYED_WORK(&rbd_dev->lock_dwork, rbd_acquire_lock);
4875         INIT_WORK(&rbd_dev->unlock_work, rbd_release_lock_work);
4876         init_waitqueue_head(&rbd_dev->lock_waitq);
4877
4878         rbd_dev->dev.bus = &rbd_bus_type;
4879         rbd_dev->dev.type = &rbd_device_type;
4880         rbd_dev->dev.parent = &rbd_root_dev;
4881         device_initialize(&rbd_dev->dev);
4882
4883         rbd_dev->rbd_client = rbdc;
4884         rbd_dev->spec = spec;
4885
4886         rbd_dev->layout.stripe_unit = 1 << RBD_MAX_OBJ_ORDER;
4887         rbd_dev->layout.stripe_count = 1;
4888         rbd_dev->layout.object_size = 1 << RBD_MAX_OBJ_ORDER;
4889         rbd_dev->layout.pool_id = spec->pool_id;
4890         RCU_INIT_POINTER(rbd_dev->layout.pool_ns, NULL);
4891
4892         return rbd_dev;
4893 }
4894
4895 /*
4896  * Create a mapping rbd_dev.
4897  */
4898 static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc,
4899                                          struct rbd_spec *spec,
4900                                          struct rbd_options *opts)
4901 {
4902         struct rbd_device *rbd_dev;
4903
4904         rbd_dev = __rbd_dev_create(rbdc, spec);
4905         if (!rbd_dev)
4906                 return NULL;
4907
4908         rbd_dev->opts = opts;
4909
4910         /* get an id and fill in device name */
4911         rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0,
4912                                          minor_to_rbd_dev_id(1 << MINORBITS),
4913                                          GFP_KERNEL);
4914         if (rbd_dev->dev_id < 0)
4915                 goto fail_rbd_dev;
4916
4917         sprintf(rbd_dev->name, RBD_DRV_NAME "%d", rbd_dev->dev_id);
4918         rbd_dev->task_wq = alloc_ordered_workqueue("%s-tasks", WQ_MEM_RECLAIM,
4919                                                    rbd_dev->name);
4920         if (!rbd_dev->task_wq)
4921                 goto fail_dev_id;
4922
4923         /* we have a ref from do_rbd_add() */
4924         __module_get(THIS_MODULE);
4925
4926         dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id);
4927         return rbd_dev;
4928
4929 fail_dev_id:
4930         ida_simple_remove(&rbd_dev_id_ida, rbd_dev->dev_id);
4931 fail_rbd_dev:
4932         rbd_dev_free(rbd_dev);
4933         return NULL;
4934 }
4935
4936 static void rbd_dev_destroy(struct rbd_device *rbd_dev)
4937 {
4938         if (rbd_dev)
4939                 put_device(&rbd_dev->dev);
4940 }
4941
4942 /*
4943  * Get the size and object order for an image snapshot, or if
4944  * snap_id is CEPH_NOSNAP, gets this information for the base
4945  * image.
4946  */
4947 static int _rbd_dev_v2_snap_size(struct rbd_device *rbd_dev, u64 snap_id,
4948                                 u8 *order, u64 *snap_size)
4949 {
4950         __le64 snapid = cpu_to_le64(snap_id);
4951         int ret;
4952         struct {
4953                 u8 order;
4954                 __le64 size;
4955         } __attribute__ ((packed)) size_buf = { 0 };
4956
4957         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
4958                                 "rbd", "get_size",
4959                                 &snapid, sizeof (snapid),
4960                                 &size_buf, sizeof (size_buf));
4961         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
4962         if (ret < 0)
4963                 return ret;
4964         if (ret < sizeof (size_buf))
4965                 return -ERANGE;
4966
4967         if (order) {
4968                 *order = size_buf.order;
4969                 dout("  order %u", (unsigned int)*order);
4970         }
4971         *snap_size = le64_to_cpu(size_buf.size);
4972
4973         dout("  snap_id 0x%016llx snap_size = %llu\n",
4974                 (unsigned long long)snap_id,
4975                 (unsigned long long)*snap_size);
4976
4977         return 0;
4978 }
4979
4980 static int rbd_dev_v2_image_size(struct rbd_device *rbd_dev)
4981 {
4982         return _rbd_dev_v2_snap_size(rbd_dev, CEPH_NOSNAP,
4983                                         &rbd_dev->header.obj_order,
4984                                         &rbd_dev->header.image_size);
4985 }
4986
4987 static int rbd_dev_v2_object_prefix(struct rbd_device *rbd_dev)
4988 {
4989         void *reply_buf;
4990         int ret;
4991         void *p;
4992
4993         reply_buf = kzalloc(RBD_OBJ_PREFIX_LEN_MAX, GFP_KERNEL);
4994         if (!reply_buf)
4995                 return -ENOMEM;
4996
4997         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
4998                                 "rbd", "get_object_prefix", NULL, 0,
4999                                 reply_buf, RBD_OBJ_PREFIX_LEN_MAX);
5000         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5001         if (ret < 0)
5002                 goto out;
5003
5004         p = reply_buf;
5005         rbd_dev->header.object_prefix = ceph_extract_encoded_string(&p,
5006                                                 p + ret, NULL, GFP_NOIO);
5007         ret = 0;
5008
5009         if (IS_ERR(rbd_dev->header.object_prefix)) {
5010                 ret = PTR_ERR(rbd_dev->header.object_prefix);
5011                 rbd_dev->header.object_prefix = NULL;
5012         } else {
5013                 dout("  object_prefix = %s\n", rbd_dev->header.object_prefix);
5014         }
5015 out:
5016         kfree(reply_buf);
5017
5018         return ret;
5019 }
5020
5021 static int _rbd_dev_v2_snap_features(struct rbd_device *rbd_dev, u64 snap_id,
5022                 u64 *snap_features)
5023 {
5024         __le64 snapid = cpu_to_le64(snap_id);
5025         struct {
5026                 __le64 features;
5027                 __le64 incompat;
5028         } __attribute__ ((packed)) features_buf = { 0 };
5029         u64 unsup;
5030         int ret;
5031
5032         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
5033                                 "rbd", "get_features",
5034                                 &snapid, sizeof (snapid),
5035                                 &features_buf, sizeof (features_buf));
5036         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5037         if (ret < 0)
5038                 return ret;
5039         if (ret < sizeof (features_buf))
5040                 return -ERANGE;
5041
5042         unsup = le64_to_cpu(features_buf.incompat) & ~RBD_FEATURES_SUPPORTED;
5043         if (unsup) {
5044                 rbd_warn(rbd_dev, "image uses unsupported features: 0x%llx",
5045                          unsup);
5046                 return -ENXIO;
5047         }
5048
5049         *snap_features = le64_to_cpu(features_buf.features);
5050
5051         dout("  snap_id 0x%016llx features = 0x%016llx incompat = 0x%016llx\n",
5052                 (unsigned long long)snap_id,
5053                 (unsigned long long)*snap_features,
5054                 (unsigned long long)le64_to_cpu(features_buf.incompat));
5055
5056         return 0;
5057 }
5058
5059 static int rbd_dev_v2_features(struct rbd_device *rbd_dev)
5060 {
5061         return _rbd_dev_v2_snap_features(rbd_dev, CEPH_NOSNAP,
5062                                                 &rbd_dev->header.features);
5063 }
5064
5065 static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
5066 {
5067         struct rbd_spec *parent_spec;
5068         size_t size;
5069         void *reply_buf = NULL;
5070         __le64 snapid;
5071         void *p;
5072         void *end;
5073         u64 pool_id;
5074         char *image_id;
5075         u64 snap_id;
5076         u64 overlap;
5077         int ret;
5078
5079         parent_spec = rbd_spec_alloc();
5080         if (!parent_spec)
5081                 return -ENOMEM;
5082
5083         size = sizeof (__le64) +                                /* pool_id */
5084                 sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX +        /* image_id */
5085                 sizeof (__le64) +                               /* snap_id */
5086                 sizeof (__le64);                                /* overlap */
5087         reply_buf = kmalloc(size, GFP_KERNEL);
5088         if (!reply_buf) {
5089                 ret = -ENOMEM;
5090                 goto out_err;
5091         }
5092
5093         snapid = cpu_to_le64(rbd_dev->spec->snap_id);
5094         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
5095                                 "rbd", "get_parent",
5096                                 &snapid, sizeof (snapid),
5097                                 reply_buf, size);
5098         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5099         if (ret < 0)
5100                 goto out_err;
5101
5102         p = reply_buf;
5103         end = reply_buf + ret;
5104         ret = -ERANGE;
5105         ceph_decode_64_safe(&p, end, pool_id, out_err);
5106         if (pool_id == CEPH_NOPOOL) {
5107                 /*
5108                  * Either the parent never existed, or we have
5109                  * record of it but the image got flattened so it no
5110                  * longer has a parent.  When the parent of a
5111                  * layered image disappears we immediately set the
5112                  * overlap to 0.  The effect of this is that all new
5113                  * requests will be treated as if the image had no
5114                  * parent.
5115                  */
5116                 if (rbd_dev->parent_overlap) {
5117                         rbd_dev->parent_overlap = 0;
5118                         rbd_dev_parent_put(rbd_dev);
5119                         pr_info("%s: clone image has been flattened\n",
5120                                 rbd_dev->disk->disk_name);
5121                 }
5122
5123                 goto out;       /* No parent?  No problem. */
5124         }
5125
5126         /* The ceph file layout needs to fit pool id in 32 bits */
5127
5128         ret = -EIO;
5129         if (pool_id > (u64)U32_MAX) {
5130                 rbd_warn(NULL, "parent pool id too large (%llu > %u)",
5131                         (unsigned long long)pool_id, U32_MAX);
5132                 goto out_err;
5133         }
5134
5135         image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
5136         if (IS_ERR(image_id)) {
5137                 ret = PTR_ERR(image_id);
5138                 goto out_err;
5139         }
5140         ceph_decode_64_safe(&p, end, snap_id, out_err);
5141         ceph_decode_64_safe(&p, end, overlap, out_err);
5142
5143         /*
5144          * The parent won't change (except when the clone is
5145          * flattened, already handled that).  So we only need to
5146          * record the parent spec we have not already done so.
5147          */
5148         if (!rbd_dev->parent_spec) {
5149                 parent_spec->pool_id = pool_id;
5150                 parent_spec->image_id = image_id;
5151                 parent_spec->snap_id = snap_id;
5152                 rbd_dev->parent_spec = parent_spec;
5153                 parent_spec = NULL;     /* rbd_dev now owns this */
5154         } else {
5155                 kfree(image_id);
5156         }
5157
5158         /*
5159          * We always update the parent overlap.  If it's zero we issue
5160          * a warning, as we will proceed as if there was no parent.
5161          */
5162         if (!overlap) {
5163                 if (parent_spec) {
5164                         /* refresh, careful to warn just once */
5165                         if (rbd_dev->parent_overlap)
5166                                 rbd_warn(rbd_dev,
5167                                     "clone now standalone (overlap became 0)");
5168                 } else {
5169                         /* initial probe */
5170                         rbd_warn(rbd_dev, "clone is standalone (overlap 0)");
5171                 }
5172         }
5173         rbd_dev->parent_overlap = overlap;
5174
5175 out:
5176         ret = 0;
5177 out_err:
5178         kfree(reply_buf);
5179         rbd_spec_put(parent_spec);
5180
5181         return ret;
5182 }
5183
5184 static int rbd_dev_v2_striping_info(struct rbd_device *rbd_dev)
5185 {
5186         struct {
5187                 __le64 stripe_unit;
5188                 __le64 stripe_count;
5189         } __attribute__ ((packed)) striping_info_buf = { 0 };
5190         size_t size = sizeof (striping_info_buf);
5191         void *p;
5192         u64 obj_size;
5193         u64 stripe_unit;
5194         u64 stripe_count;
5195         int ret;
5196
5197         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
5198                                 "rbd", "get_stripe_unit_count", NULL, 0,
5199                                 (char *)&striping_info_buf, size);
5200         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5201         if (ret < 0)
5202                 return ret;
5203         if (ret < size)
5204                 return -ERANGE;
5205
5206         /*
5207          * We don't actually support the "fancy striping" feature
5208          * (STRIPINGV2) yet, but if the striping sizes are the
5209          * defaults the behavior is the same as before.  So find
5210          * out, and only fail if the image has non-default values.
5211          */
5212         ret = -EINVAL;
5213         obj_size = (u64)1 << rbd_dev->header.obj_order;
5214         p = &striping_info_buf;
5215         stripe_unit = ceph_decode_64(&p);
5216         if (stripe_unit != obj_size) {
5217                 rbd_warn(rbd_dev, "unsupported stripe unit "
5218                                 "(got %llu want %llu)",
5219                                 stripe_unit, obj_size);
5220                 return -EINVAL;
5221         }
5222         stripe_count = ceph_decode_64(&p);
5223         if (stripe_count != 1) {
5224                 rbd_warn(rbd_dev, "unsupported stripe count "
5225                                 "(got %llu want 1)", stripe_count);
5226                 return -EINVAL;
5227         }
5228         rbd_dev->header.stripe_unit = stripe_unit;
5229         rbd_dev->header.stripe_count = stripe_count;
5230
5231         return 0;
5232 }
5233
5234 static char *rbd_dev_image_name(struct rbd_device *rbd_dev)
5235 {
5236         size_t image_id_size;
5237         char *image_id;
5238         void *p;
5239         void *end;
5240         size_t size;
5241         void *reply_buf = NULL;
5242         size_t len = 0;
5243         char *image_name = NULL;
5244         int ret;
5245
5246         rbd_assert(!rbd_dev->spec->image_name);
5247
5248         len = strlen(rbd_dev->spec->image_id);
5249         image_id_size = sizeof (__le32) + len;
5250         image_id = kmalloc(image_id_size, GFP_KERNEL);
5251         if (!image_id)
5252                 return NULL;
5253
5254         p = image_id;
5255         end = image_id + image_id_size;
5256         ceph_encode_string(&p, end, rbd_dev->spec->image_id, (u32)len);
5257
5258         size = sizeof (__le32) + RBD_IMAGE_NAME_LEN_MAX;
5259         reply_buf = kmalloc(size, GFP_KERNEL);
5260         if (!reply_buf)
5261                 goto out;
5262
5263         ret = rbd_obj_method_sync(rbd_dev, RBD_DIRECTORY,
5264                                 "rbd", "dir_get_name",
5265                                 image_id, image_id_size,
5266                                 reply_buf, size);
5267         if (ret < 0)
5268                 goto out;
5269         p = reply_buf;
5270         end = reply_buf + ret;
5271
5272         image_name = ceph_extract_encoded_string(&p, end, &len, GFP_KERNEL);
5273         if (IS_ERR(image_name))
5274                 image_name = NULL;
5275         else
5276                 dout("%s: name is %s len is %zd\n", __func__, image_name, len);
5277 out:
5278         kfree(reply_buf);
5279         kfree(image_id);
5280
5281         return image_name;
5282 }
5283
5284 static u64 rbd_v1_snap_id_by_name(struct rbd_device *rbd_dev, const char *name)
5285 {
5286         struct ceph_snap_context *snapc = rbd_dev->header.snapc;
5287         const char *snap_name;
5288         u32 which = 0;
5289
5290         /* Skip over names until we find the one we are looking for */
5291
5292         snap_name = rbd_dev->header.snap_names;
5293         while (which < snapc->num_snaps) {
5294                 if (!strcmp(name, snap_name))
5295                         return snapc->snaps[which];
5296                 snap_name += strlen(snap_name) + 1;
5297                 which++;
5298         }
5299         return CEPH_NOSNAP;
5300 }
5301
5302 static u64 rbd_v2_snap_id_by_name(struct rbd_device *rbd_dev, const char *name)
5303 {
5304         struct ceph_snap_context *snapc = rbd_dev->header.snapc;
5305         u32 which;
5306         bool found = false;
5307         u64 snap_id;
5308
5309         for (which = 0; !found && which < snapc->num_snaps; which++) {
5310                 const char *snap_name;
5311
5312                 snap_id = snapc->snaps[which];
5313                 snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);
5314                 if (IS_ERR(snap_name)) {
5315                         /* ignore no-longer existing snapshots */
5316                         if (PTR_ERR(snap_name) == -ENOENT)
5317                                 continue;
5318                         else
5319                                 break;
5320                 }
5321                 found = !strcmp(name, snap_name);
5322                 kfree(snap_name);
5323         }
5324         return found ? snap_id : CEPH_NOSNAP;
5325 }
5326
5327 /*
5328  * Assumes name is never RBD_SNAP_HEAD_NAME; returns CEPH_NOSNAP if
5329  * no snapshot by that name is found, or if an error occurs.
5330  */
5331 static u64 rbd_snap_id_by_name(struct rbd_device *rbd_dev, const char *name)
5332 {
5333         if (rbd_dev->image_format == 1)
5334                 return rbd_v1_snap_id_by_name(rbd_dev, name);
5335
5336         return rbd_v2_snap_id_by_name(rbd_dev, name);
5337 }
5338
5339 /*
5340  * An image being mapped will have everything but the snap id.
5341  */
5342 static int rbd_spec_fill_snap_id(struct rbd_device *rbd_dev)
5343 {
5344         struct rbd_spec *spec = rbd_dev->spec;
5345
5346         rbd_assert(spec->pool_id != CEPH_NOPOOL && spec->pool_name);
5347         rbd_assert(spec->image_id && spec->image_name);
5348         rbd_assert(spec->snap_name);
5349
5350         if (strcmp(spec->snap_name, RBD_SNAP_HEAD_NAME)) {
5351                 u64 snap_id;
5352
5353                 snap_id = rbd_snap_id_by_name(rbd_dev, spec->snap_name);
5354                 if (snap_id == CEPH_NOSNAP)
5355                         return -ENOENT;
5356
5357                 spec->snap_id = snap_id;
5358         } else {
5359                 spec->snap_id = CEPH_NOSNAP;
5360         }
5361
5362         return 0;
5363 }
5364
5365 /*
5366  * A parent image will have all ids but none of the names.
5367  *
5368  * All names in an rbd spec are dynamically allocated.  It's OK if we
5369  * can't figure out the name for an image id.
5370  */
5371 static int rbd_spec_fill_names(struct rbd_device *rbd_dev)
5372 {
5373         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
5374         struct rbd_spec *spec = rbd_dev->spec;
5375         const char *pool_name;
5376         const char *image_name;
5377         const char *snap_name;
5378         int ret;
5379
5380         rbd_assert(spec->pool_id != CEPH_NOPOOL);
5381         rbd_assert(spec->image_id);
5382         rbd_assert(spec->snap_id != CEPH_NOSNAP);
5383
5384         /* Get the pool name; we have to make our own copy of this */
5385
5386         pool_name = ceph_pg_pool_name_by_id(osdc->osdmap, spec->pool_id);
5387         if (!pool_name) {
5388                 rbd_warn(rbd_dev, "no pool with id %llu", spec->pool_id);
5389                 return -EIO;
5390         }
5391         pool_name = kstrdup(pool_name, GFP_KERNEL);
5392         if (!pool_name)
5393                 return -ENOMEM;
5394
5395         /* Fetch the image name; tolerate failure here */
5396
5397         image_name = rbd_dev_image_name(rbd_dev);
5398         if (!image_name)
5399                 rbd_warn(rbd_dev, "unable to get image name");
5400
5401         /* Fetch the snapshot name */
5402
5403         snap_name = rbd_snap_name(rbd_dev, spec->snap_id);
5404         if (IS_ERR(snap_name)) {
5405                 ret = PTR_ERR(snap_name);
5406                 goto out_err;
5407         }
5408
5409         spec->pool_name = pool_name;
5410         spec->image_name = image_name;
5411         spec->snap_name = snap_name;
5412
5413         return 0;
5414
5415 out_err:
5416         kfree(image_name);
5417         kfree(pool_name);
5418         return ret;
5419 }
5420
5421 static int rbd_dev_v2_snap_context(struct rbd_device *rbd_dev)
5422 {
5423         size_t size;
5424         int ret;
5425         void *reply_buf;
5426         void *p;
5427         void *end;
5428         u64 seq;
5429         u32 snap_count;
5430         struct ceph_snap_context *snapc;
5431         u32 i;
5432
5433         /*
5434          * We'll need room for the seq value (maximum snapshot id),
5435          * snapshot count, and array of that many snapshot ids.
5436          * For now we have a fixed upper limit on the number we're
5437          * prepared to receive.
5438          */
5439         size = sizeof (__le64) + sizeof (__le32) +
5440                         RBD_MAX_SNAP_COUNT * sizeof (__le64);
5441         reply_buf = kzalloc(size, GFP_KERNEL);
5442         if (!reply_buf)
5443                 return -ENOMEM;
5444
5445         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
5446                                 "rbd", "get_snapcontext", NULL, 0,
5447                                 reply_buf, size);
5448         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5449         if (ret < 0)
5450                 goto out;
5451
5452         p = reply_buf;
5453         end = reply_buf + ret;
5454         ret = -ERANGE;
5455         ceph_decode_64_safe(&p, end, seq, out);
5456         ceph_decode_32_safe(&p, end, snap_count, out);
5457
5458         /*
5459          * Make sure the reported number of snapshot ids wouldn't go
5460          * beyond the end of our buffer.  But before checking that,
5461          * make sure the computed size of the snapshot context we
5462          * allocate is representable in a size_t.
5463          */
5464         if (snap_count > (SIZE_MAX - sizeof (struct ceph_snap_context))
5465                                  / sizeof (u64)) {
5466                 ret = -EINVAL;
5467                 goto out;
5468         }
5469         if (!ceph_has_room(&p, end, snap_count * sizeof (__le64)))
5470                 goto out;
5471         ret = 0;
5472
5473         snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);
5474         if (!snapc) {
5475                 ret = -ENOMEM;
5476                 goto out;
5477         }
5478         snapc->seq = seq;
5479         for (i = 0; i < snap_count; i++)
5480                 snapc->snaps[i] = ceph_decode_64(&p);
5481
5482         ceph_put_snap_context(rbd_dev->header.snapc);
5483         rbd_dev->header.snapc = snapc;
5484
5485         dout("  snap context seq = %llu, snap_count = %u\n",
5486                 (unsigned long long)seq, (unsigned int)snap_count);
5487 out:
5488         kfree(reply_buf);
5489
5490         return ret;
5491 }
5492
5493 static const char *rbd_dev_v2_snap_name(struct rbd_device *rbd_dev,
5494                                         u64 snap_id)
5495 {
5496         size_t size;
5497         void *reply_buf;
5498         __le64 snapid;
5499         int ret;
5500         void *p;
5501         void *end;
5502         char *snap_name;
5503
5504         size = sizeof (__le32) + RBD_MAX_SNAP_NAME_LEN;
5505         reply_buf = kmalloc(size, GFP_KERNEL);
5506         if (!reply_buf)
5507                 return ERR_PTR(-ENOMEM);
5508
5509         snapid = cpu_to_le64(snap_id);
5510         ret = rbd_obj_method_sync(rbd_dev, rbd_dev->header_oid.name,
5511                                 "rbd", "get_snapshot_name",
5512                                 &snapid, sizeof (snapid),
5513                                 reply_buf, size);
5514         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5515         if (ret < 0) {
5516                 snap_name = ERR_PTR(ret);
5517                 goto out;
5518         }
5519
5520         p = reply_buf;
5521         end = reply_buf + ret;
5522         snap_name = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
5523         if (IS_ERR(snap_name))
5524                 goto out;
5525
5526         dout("  snap_id 0x%016llx snap_name = %s\n",
5527                 (unsigned long long)snap_id, snap_name);
5528 out:
5529         kfree(reply_buf);
5530
5531         return snap_name;
5532 }
5533
5534 static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev)
5535 {
5536         bool first_time = rbd_dev->header.object_prefix == NULL;
5537         int ret;
5538
5539         ret = rbd_dev_v2_image_size(rbd_dev);
5540         if (ret)
5541                 return ret;
5542
5543         if (first_time) {
5544                 ret = rbd_dev_v2_header_onetime(rbd_dev);
5545                 if (ret)
5546                         return ret;
5547         }
5548
5549         ret = rbd_dev_v2_snap_context(rbd_dev);
5550         if (ret && first_time) {
5551                 kfree(rbd_dev->header.object_prefix);
5552                 rbd_dev->header.object_prefix = NULL;
5553         }
5554
5555         return ret;
5556 }
5557
5558 static int rbd_dev_header_info(struct rbd_device *rbd_dev)
5559 {
5560         rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
5561
5562         if (rbd_dev->image_format == 1)
5563                 return rbd_dev_v1_header_info(rbd_dev);
5564
5565         return rbd_dev_v2_header_info(rbd_dev);
5566 }
5567
5568 /*
5569  * Skips over white space at *buf, and updates *buf to point to the
5570  * first found non-space character (if any). Returns the length of
5571  * the token (string of non-white space characters) found.  Note
5572  * that *buf must be terminated with '\0'.
5573  */
5574 static inline size_t next_token(const char **buf)
5575 {
5576         /*
5577         * These are the characters that produce nonzero for
5578         * isspace() in the "C" and "POSIX" locales.
5579         */
5580         const char *spaces = " \f\n\r\t\v";
5581
5582         *buf += strspn(*buf, spaces);   /* Find start of token */
5583
5584         return strcspn(*buf, spaces);   /* Return token length */
5585 }
5586
5587 /*
5588  * Finds the next token in *buf, dynamically allocates a buffer big
5589  * enough to hold a copy of it, and copies the token into the new
5590  * buffer.  The copy is guaranteed to be terminated with '\0'.  Note
5591  * that a duplicate buffer is created even for a zero-length token.
5592  *
5593  * Returns a pointer to the newly-allocated duplicate, or a null
5594  * pointer if memory for the duplicate was not available.  If
5595  * the lenp argument is a non-null pointer, the length of the token
5596  * (not including the '\0') is returned in *lenp.
5597  *
5598  * If successful, the *buf pointer will be updated to point beyond
5599  * the end of the found token.
5600  *
5601  * Note: uses GFP_KERNEL for allocation.
5602  */
5603 static inline char *dup_token(const char **buf, size_t *lenp)
5604 {
5605         char *dup;
5606         size_t len;
5607
5608         len = next_token(buf);
5609         dup = kmemdup(*buf, len + 1, GFP_KERNEL);
5610         if (!dup)
5611                 return NULL;
5612         *(dup + len) = '\0';
5613         *buf += len;
5614
5615         if (lenp)
5616                 *lenp = len;
5617
5618         return dup;
5619 }
5620
5621 /*
5622  * Parse the options provided for an "rbd add" (i.e., rbd image
5623  * mapping) request.  These arrive via a write to /sys/bus/rbd/add,
5624  * and the data written is passed here via a NUL-terminated buffer.
5625  * Returns 0 if successful or an error code otherwise.
5626  *
5627  * The information extracted from these options is recorded in
5628  * the other parameters which return dynamically-allocated
5629  * structures:
5630  *  ceph_opts
5631  *      The address of a pointer that will refer to a ceph options
5632  *      structure.  Caller must release the returned pointer using
5633  *      ceph_destroy_options() when it is no longer needed.
5634  *  rbd_opts
5635  *      Address of an rbd options pointer.  Fully initialized by
5636  *      this function; caller must release with kfree().
5637  *  spec
5638  *      Address of an rbd image specification pointer.  Fully
5639  *      initialized by this function based on parsed options.
5640  *      Caller must release with rbd_spec_put().
5641  *
5642  * The options passed take this form:
5643  *  <mon_addrs> <options> <pool_name> <image_name> [<snap_id>]
5644  * where:
5645  *  <mon_addrs>
5646  *      A comma-separated list of one or more monitor addresses.
5647  *      A monitor address is an ip address, optionally followed
5648  *      by a port number (separated by a colon).
5649  *        I.e.:  ip1[:port1][,ip2[:port2]...]
5650  *  <options>
5651  *      A comma-separated list of ceph and/or rbd options.
5652  *  <pool_name>
5653  *      The name of the rados pool containing the rbd image.
5654  *  <image_name>
5655  *      The name of the image in that pool to map.
5656  *  <snap_id>
5657  *      An optional snapshot id.  If provided, the mapping will
5658  *      present data from the image at the time that snapshot was
5659  *      created.  The image head is used if no snapshot id is
5660  *      provided.  Snapshot mappings are always read-only.
5661  */
5662 static int rbd_add_parse_args(const char *buf,
5663                                 struct ceph_options **ceph_opts,
5664                                 struct rbd_options **opts,
5665                                 struct rbd_spec **rbd_spec)
5666 {
5667         size_t len;
5668         char *options;
5669         const char *mon_addrs;
5670         char *snap_name;
5671         size_t mon_addrs_size;
5672         struct rbd_spec *spec = NULL;
5673         struct rbd_options *rbd_opts = NULL;
5674         struct ceph_options *copts;
5675         int ret;
5676
5677         /* The first four tokens are required */
5678
5679         len = next_token(&buf);
5680         if (!len) {
5681                 rbd_warn(NULL, "no monitor address(es) provided");
5682                 return -EINVAL;
5683         }
5684         mon_addrs = buf;
5685         mon_addrs_size = len + 1;
5686         buf += len;
5687
5688         ret = -EINVAL;
5689         options = dup_token(&buf, NULL);
5690         if (!options)
5691                 return -ENOMEM;
5692         if (!*options) {
5693                 rbd_warn(NULL, "no options provided");
5694                 goto out_err;
5695         }
5696
5697         spec = rbd_spec_alloc();
5698         if (!spec)
5699                 goto out_mem;
5700
5701         spec->pool_name = dup_token(&buf, NULL);
5702         if (!spec->pool_name)
5703                 goto out_mem;
5704         if (!*spec->pool_name) {
5705                 rbd_warn(NULL, "no pool name provided");
5706                 goto out_err;
5707         }
5708
5709         spec->image_name = dup_token(&buf, NULL);
5710         if (!spec->image_name)
5711                 goto out_mem;
5712         if (!*spec->image_name) {
5713                 rbd_warn(NULL, "no image name provided");
5714                 goto out_err;
5715         }
5716
5717         /*
5718          * Snapshot name is optional; default is to use "-"
5719          * (indicating the head/no snapshot).
5720          */
5721         len = next_token(&buf);
5722         if (!len) {
5723                 buf = RBD_SNAP_HEAD_NAME; /* No snapshot supplied */
5724                 len = sizeof (RBD_SNAP_HEAD_NAME) - 1;
5725         } else if (len > RBD_MAX_SNAP_NAME_LEN) {
5726                 ret = -ENAMETOOLONG;
5727                 goto out_err;
5728         }
5729         snap_name = kmemdup(buf, len + 1, GFP_KERNEL);
5730         if (!snap_name)
5731                 goto out_mem;
5732         *(snap_name + len) = '\0';
5733         spec->snap_name = snap_name;
5734
5735         /* Initialize all rbd options to the defaults */
5736
5737         rbd_opts = kzalloc(sizeof (*rbd_opts), GFP_KERNEL);
5738         if (!rbd_opts)
5739                 goto out_mem;
5740
5741         rbd_opts->read_only = RBD_READ_ONLY_DEFAULT;
5742         rbd_opts->queue_depth = RBD_QUEUE_DEPTH_DEFAULT;
5743         rbd_opts->lock_on_read = RBD_LOCK_ON_READ_DEFAULT;
5744
5745         copts = ceph_parse_options(options, mon_addrs,
5746                                         mon_addrs + mon_addrs_size - 1,
5747                                         parse_rbd_opts_token, rbd_opts);
5748         if (IS_ERR(copts)) {
5749                 ret = PTR_ERR(copts);
5750                 goto out_err;
5751         }
5752         kfree(options);
5753
5754         *ceph_opts = copts;
5755         *opts = rbd_opts;
5756         *rbd_spec = spec;
5757
5758         return 0;
5759 out_mem:
5760         ret = -ENOMEM;
5761 out_err:
5762         kfree(rbd_opts);
5763         rbd_spec_put(spec);
5764         kfree(options);
5765
5766         return ret;
5767 }
5768
5769 /*
5770  * Return pool id (>= 0) or a negative error code.
5771  */
5772 static int rbd_add_get_pool_id(struct rbd_client *rbdc, const char *pool_name)
5773 {
5774         struct ceph_options *opts = rbdc->client->options;
5775         u64 newest_epoch;
5776         int tries = 0;
5777         int ret;
5778
5779 again:
5780         ret = ceph_pg_poolid_by_name(rbdc->client->osdc.osdmap, pool_name);
5781         if (ret == -ENOENT && tries++ < 1) {
5782                 ret = ceph_monc_get_version(&rbdc->client->monc, "osdmap",
5783                                             &newest_epoch);
5784                 if (ret < 0)
5785                         return ret;
5786
5787                 if (rbdc->client->osdc.osdmap->epoch < newest_epoch) {
5788                         ceph_osdc_maybe_request_map(&rbdc->client->osdc);
5789                         (void) ceph_monc_wait_osdmap(&rbdc->client->monc,
5790                                                      newest_epoch,
5791                                                      opts->mount_timeout);
5792                         goto again;
5793                 } else {
5794                         /* the osdmap we have is new enough */
5795                         return -ENOENT;
5796                 }
5797         }
5798
5799         return ret;
5800 }
5801
5802 /*
5803  * An rbd format 2 image has a unique identifier, distinct from the
5804  * name given to it by the user.  Internally, that identifier is
5805  * what's used to specify the names of objects related to the image.
5806  *
5807  * A special "rbd id" object is used to map an rbd image name to its
5808  * id.  If that object doesn't exist, then there is no v2 rbd image
5809  * with the supplied name.
5810  *
5811  * This function will record the given rbd_dev's image_id field if
5812  * it can be determined, and in that case will return 0.  If any
5813  * errors occur a negative errno will be returned and the rbd_dev's
5814  * image_id field will be unchanged (and should be NULL).
5815  */
5816 static int rbd_dev_image_id(struct rbd_device *rbd_dev)
5817 {
5818         int ret;
5819         size_t size;
5820         char *object_name;
5821         void *response;
5822         char *image_id;
5823
5824         /*
5825          * When probing a parent image, the image id is already
5826          * known (and the image name likely is not).  There's no
5827          * need to fetch the image id again in this case.  We
5828          * do still need to set the image format though.
5829          */
5830         if (rbd_dev->spec->image_id) {
5831                 rbd_dev->image_format = *rbd_dev->spec->image_id ? 2 : 1;
5832
5833                 return 0;
5834         }
5835
5836         /*
5837          * First, see if the format 2 image id file exists, and if
5838          * so, get the image's persistent id from it.
5839          */
5840         size = sizeof (RBD_ID_PREFIX) + strlen(rbd_dev->spec->image_name);
5841         object_name = kmalloc(size, GFP_NOIO);
5842         if (!object_name)
5843                 return -ENOMEM;
5844         sprintf(object_name, "%s%s", RBD_ID_PREFIX, rbd_dev->spec->image_name);
5845         dout("rbd id object name is %s\n", object_name);
5846
5847         /* Response will be an encoded string, which includes a length */
5848
5849         size = sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX;
5850         response = kzalloc(size, GFP_NOIO);
5851         if (!response) {
5852                 ret = -ENOMEM;
5853                 goto out;
5854         }
5855
5856         /* If it doesn't exist we'll assume it's a format 1 image */
5857
5858         ret = rbd_obj_method_sync(rbd_dev, object_name,
5859                                 "rbd", "get_id", NULL, 0,
5860                                 response, RBD_IMAGE_ID_LEN_MAX);
5861         dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
5862         if (ret == -ENOENT) {
5863                 image_id = kstrdup("", GFP_KERNEL);
5864                 ret = image_id ? 0 : -ENOMEM;
5865                 if (!ret)
5866                         rbd_dev->image_format = 1;
5867         } else if (ret >= 0) {
5868                 void *p = response;
5869
5870                 image_id = ceph_extract_encoded_string(&p, p + ret,
5871                                                 NULL, GFP_NOIO);
5872                 ret = PTR_ERR_OR_ZERO(image_id);
5873                 if (!ret)
5874                         rbd_dev->image_format = 2;
5875         }
5876
5877         if (!ret) {
5878                 rbd_dev->spec->image_id = image_id;
5879                 dout("image_id is %s\n", image_id);
5880         }
5881 out:
5882         kfree(response);
5883         kfree(object_name);
5884
5885         return ret;
5886 }
5887
5888 /*
5889  * Undo whatever state changes are made by v1 or v2 header info
5890  * call.
5891  */
5892 static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
5893 {
5894         struct rbd_image_header *header;
5895
5896         rbd_dev_parent_put(rbd_dev);
5897
5898         /* Free dynamic fields from the header, then zero it out */
5899
5900         header = &rbd_dev->header;
5901         ceph_put_snap_context(header->snapc);
5902         kfree(header->snap_sizes);
5903         kfree(header->snap_names);
5904         kfree(header->object_prefix);
5905         memset(header, 0, sizeof (*header));
5906 }
5907
5908 static int rbd_dev_v2_header_onetime(struct rbd_device *rbd_dev)
5909 {
5910         int ret;
5911
5912         ret = rbd_dev_v2_object_prefix(rbd_dev);
5913         if (ret)
5914                 goto out_err;
5915
5916         /*
5917          * Get the and check features for the image.  Currently the
5918          * features are assumed to never change.
5919          */
5920         ret = rbd_dev_v2_features(rbd_dev);
5921         if (ret)
5922                 goto out_err;
5923
5924         /* If the image supports fancy striping, get its parameters */
5925
5926         if (rbd_dev->header.features & RBD_FEATURE_STRIPINGV2) {
5927                 ret = rbd_dev_v2_striping_info(rbd_dev);
5928                 if (ret < 0)
5929                         goto out_err;
5930         }
5931         /* No support for crypto and compression type format 2 images */
5932
5933         return 0;
5934 out_err:
5935         rbd_dev->header.features = 0;
5936         kfree(rbd_dev->header.object_prefix);
5937         rbd_dev->header.object_prefix = NULL;
5938
5939         return ret;
5940 }
5941
5942 /*
5943  * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->
5944  * rbd_dev_image_probe() recursion depth, which means it's also the
5945  * length of the already discovered part of the parent chain.
5946  */
5947 static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
5948 {
5949         struct rbd_device *parent = NULL;
5950         int ret;
5951
5952         if (!rbd_dev->parent_spec)
5953                 return 0;
5954
5955         if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {
5956                 pr_info("parent chain is too long (%d)\n", depth);
5957                 ret = -EINVAL;
5958                 goto out_err;
5959         }
5960
5961         parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
5962         if (!parent) {
5963                 ret = -ENOMEM;
5964                 goto out_err;
5965         }
5966
5967         /*
5968          * Images related by parent/child relationships always share
5969          * rbd_client and spec/parent_spec, so bump their refcounts.
5970          */
5971         __rbd_get_client(rbd_dev->rbd_client);
5972         rbd_spec_get(rbd_dev->parent_spec);
5973
5974         ret = rbd_dev_image_probe(parent, depth);
5975         if (ret < 0)
5976                 goto out_err;
5977
5978         rbd_dev->parent = parent;
5979         atomic_set(&rbd_dev->parent_ref, 1);
5980         return 0;
5981
5982 out_err:
5983         rbd_dev_unparent(rbd_dev);
5984         rbd_dev_destroy(parent);
5985         return ret;
5986 }
5987
5988 /*
5989  * rbd_dev->header_rwsem must be locked for write and will be unlocked
5990  * upon return.
5991  */
5992 static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
5993 {
5994         int ret;
5995
5996         /* Record our major and minor device numbers. */
5997
5998         if (!single_major) {
5999                 ret = register_blkdev(0, rbd_dev->name);
6000                 if (ret < 0)
6001                         goto err_out_unlock;
6002
6003                 rbd_dev->major = ret;
6004                 rbd_dev->minor = 0;
6005         } else {
6006                 rbd_dev->major = rbd_major;
6007                 rbd_dev->minor = rbd_dev_id_to_minor(rbd_dev->dev_id);
6008         }
6009
6010         /* Set up the blkdev mapping. */
6011
6012         ret = rbd_init_disk(rbd_dev);
6013         if (ret)
6014                 goto err_out_blkdev;
6015
6016         ret = rbd_dev_mapping_set(rbd_dev);
6017         if (ret)
6018                 goto err_out_disk;
6019
6020         set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
6021         set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only);
6022
6023         dev_set_name(&rbd_dev->dev, "%d", rbd_dev->dev_id);
6024         ret = device_add(&rbd_dev->dev);
6025         if (ret)
6026                 goto err_out_mapping;
6027
6028         /* Everything's ready.  Announce the disk to the world. */
6029
6030         set_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
6031         up_write(&rbd_dev->header_rwsem);
6032
6033         spin_lock(&rbd_dev_list_lock);
6034         list_add_tail(&rbd_dev->node, &rbd_dev_list);
6035         spin_unlock(&rbd_dev_list_lock);
6036
6037         add_disk(rbd_dev->disk);
6038         pr_info("%s: capacity %llu features 0x%llx\n", rbd_dev->disk->disk_name,
6039                 (unsigned long long)get_capacity(rbd_dev->disk) << SECTOR_SHIFT,
6040                 rbd_dev->header.features);
6041
6042         return ret;
6043
6044 err_out_mapping:
6045         rbd_dev_mapping_clear(rbd_dev);
6046 err_out_disk:
6047         rbd_free_disk(rbd_dev);
6048 err_out_blkdev:
6049         if (!single_major)
6050                 unregister_blkdev(rbd_dev->major, rbd_dev->name);
6051 err_out_unlock:
6052         up_write(&rbd_dev->header_rwsem);
6053         return ret;
6054 }
6055
6056 static int rbd_dev_header_name(struct rbd_device *rbd_dev)
6057 {
6058         struct rbd_spec *spec = rbd_dev->spec;
6059         int ret;
6060
6061         /* Record the header object name for this rbd image. */
6062
6063         rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
6064
6065         rbd_dev->header_oloc.pool = rbd_dev->layout.pool_id;
6066         if (rbd_dev->image_format == 1)
6067                 ret = ceph_oid_aprintf(&rbd_dev->header_oid, GFP_KERNEL, "%s%s",
6068                                        spec->image_name, RBD_SUFFIX);
6069         else
6070                 ret = ceph_oid_aprintf(&rbd_dev->header_oid, GFP_KERNEL, "%s%s",
6071                                        RBD_HEADER_PREFIX, spec->image_id);
6072
6073         return ret;
6074 }
6075
6076 static void rbd_dev_image_release(struct rbd_device *rbd_dev)
6077 {
6078         rbd_dev_unprobe(rbd_dev);
6079         rbd_dev->image_format = 0;
6080         kfree(rbd_dev->spec->image_id);
6081         rbd_dev->spec->image_id = NULL;
6082
6083         rbd_dev_destroy(rbd_dev);
6084 }
6085
6086 /*
6087  * Probe for the existence of the header object for the given rbd
6088  * device.  If this image is the one being mapped (i.e., not a
6089  * parent), initiate a watch on its header object before using that
6090  * object to get detailed information about the rbd image.
6091  */
6092 static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
6093 {
6094         int ret;
6095
6096         /*
6097          * Get the id from the image id object.  Unless there's an
6098          * error, rbd_dev->spec->image_id will be filled in with
6099          * a dynamically-allocated string, and rbd_dev->image_format
6100          * will be set to either 1 or 2.
6101          */
6102         ret = rbd_dev_image_id(rbd_dev);
6103         if (ret)
6104                 return ret;
6105
6106         ret = rbd_dev_header_name(rbd_dev);
6107         if (ret)
6108                 goto err_out_format;
6109
6110         if (!depth) {
6111                 ret = rbd_register_watch(rbd_dev);
6112                 if (ret) {
6113                         if (ret == -ENOENT)
6114                                 pr_info("image %s/%s does not exist\n",
6115                                         rbd_dev->spec->pool_name,
6116                                         rbd_dev->spec->image_name);
6117                         goto err_out_format;
6118                 }
6119         }
6120
6121         ret = rbd_dev_header_info(rbd_dev);
6122         if (ret)
6123                 goto err_out_watch;
6124
6125         /*
6126          * If this image is the one being mapped, we have pool name and
6127          * id, image name and id, and snap name - need to fill snap id.
6128          * Otherwise this is a parent image, identified by pool, image
6129          * and snap ids - need to fill in names for those ids.
6130          */
6131         if (!depth)
6132                 ret = rbd_spec_fill_snap_id(rbd_dev);
6133         else
6134                 ret = rbd_spec_fill_names(rbd_dev);
6135         if (ret) {
6136                 if (ret == -ENOENT)
6137                         pr_info("snap %s/%s@%s does not exist\n",
6138                                 rbd_dev->spec->pool_name,
6139                                 rbd_dev->spec->image_name,
6140                                 rbd_dev->spec->snap_name);
6141                 goto err_out_probe;
6142         }
6143
6144         if (rbd_dev->header.features & RBD_FEATURE_LAYERING) {
6145                 ret = rbd_dev_v2_parent_info(rbd_dev);
6146                 if (ret)
6147                         goto err_out_probe;
6148
6149                 /*
6150                  * Need to warn users if this image is the one being
6151                  * mapped and has a parent.
6152                  */
6153                 if (!depth && rbd_dev->parent_spec)
6154                         rbd_warn(rbd_dev,
6155                                  "WARNING: kernel layering is EXPERIMENTAL!");
6156         }
6157
6158         ret = rbd_dev_probe_parent(rbd_dev, depth);
6159         if (ret)
6160                 goto err_out_probe;
6161
6162         dout("discovered format %u image, header name is %s\n",
6163                 rbd_dev->image_format, rbd_dev->header_oid.name);
6164         return 0;
6165
6166 err_out_probe:
6167         rbd_dev_unprobe(rbd_dev);
6168 err_out_watch:
6169         if (!depth)
6170                 rbd_unregister_watch(rbd_dev);
6171 err_out_format:
6172         rbd_dev->image_format = 0;
6173         kfree(rbd_dev->spec->image_id);
6174         rbd_dev->spec->image_id = NULL;
6175         return ret;
6176 }
6177
6178 static ssize_t do_rbd_add(struct bus_type *bus,
6179                           const char *buf,
6180                           size_t count)
6181 {
6182         struct rbd_device *rbd_dev = NULL;
6183         struct ceph_options *ceph_opts = NULL;
6184         struct rbd_options *rbd_opts = NULL;
6185         struct rbd_spec *spec = NULL;
6186         struct rbd_client *rbdc;
6187         bool read_only;
6188         int rc;
6189
6190         if (!try_module_get(THIS_MODULE))
6191                 return -ENODEV;
6192
6193         /* parse add command */
6194         rc = rbd_add_parse_args(buf, &ceph_opts, &rbd_opts, &spec);
6195         if (rc < 0)
6196                 goto out;
6197
6198         rbdc = rbd_get_client(ceph_opts);
6199         if (IS_ERR(rbdc)) {
6200                 rc = PTR_ERR(rbdc);
6201                 goto err_out_args;
6202         }
6203
6204         /* pick the pool */
6205         rc = rbd_add_get_pool_id(rbdc, spec->pool_name);
6206         if (rc < 0) {
6207                 if (rc == -ENOENT)
6208                         pr_info("pool %s does not exist\n", spec->pool_name);
6209                 goto err_out_client;
6210         }
6211         spec->pool_id = (u64)rc;
6212
6213         rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts);
6214         if (!rbd_dev) {
6215                 rc = -ENOMEM;
6216                 goto err_out_client;
6217         }
6218         rbdc = NULL;            /* rbd_dev now owns this */
6219         spec = NULL;            /* rbd_dev now owns this */
6220         rbd_opts = NULL;        /* rbd_dev now owns this */
6221
6222         rbd_dev->config_info = kstrdup(buf, GFP_KERNEL);
6223         if (!rbd_dev->config_info) {
6224                 rc = -ENOMEM;
6225                 goto err_out_rbd_dev;
6226         }
6227
6228         down_write(&rbd_dev->header_rwsem);
6229         rc = rbd_dev_image_probe(rbd_dev, 0);
6230         if (rc < 0) {
6231                 up_write(&rbd_dev->header_rwsem);
6232                 goto err_out_rbd_dev;
6233         }
6234
6235         /* If we are mapping a snapshot it must be marked read-only */
6236
6237         read_only = rbd_dev->opts->read_only;
6238         if (rbd_dev->spec->snap_id != CEPH_NOSNAP)
6239                 read_only = true;
6240         rbd_dev->mapping.read_only = read_only;
6241
6242         rc = rbd_dev_device_setup(rbd_dev);
6243         if (rc) {
6244                 /*
6245                  * rbd_unregister_watch() can't be moved into
6246                  * rbd_dev_image_release() without refactoring, see
6247                  * commit 1f3ef78861ac.
6248                  */
6249                 rbd_unregister_watch(rbd_dev);
6250                 rbd_dev_image_release(rbd_dev);
6251                 goto out;
6252         }
6253
6254         rc = count;
6255 out:
6256         module_put(THIS_MODULE);
6257         return rc;
6258
6259 err_out_rbd_dev:
6260         rbd_dev_destroy(rbd_dev);
6261 err_out_client:
6262         rbd_put_client(rbdc);
6263 err_out_args:
6264         rbd_spec_put(spec);
6265         kfree(rbd_opts);
6266         goto out;
6267 }
6268
6269 static ssize_t rbd_add(struct bus_type *bus,
6270                        const char *buf,
6271                        size_t count)
6272 {
6273         if (single_major)
6274                 return -EINVAL;
6275
6276         return do_rbd_add(bus, buf, count);
6277 }
6278
6279 static ssize_t rbd_add_single_major(struct bus_type *bus,
6280                                     const char *buf,
6281                                     size_t count)
6282 {
6283         return do_rbd_add(bus, buf, count);
6284 }
6285
6286 static void rbd_dev_device_release(struct rbd_device *rbd_dev)
6287 {
6288         rbd_free_disk(rbd_dev);
6289
6290         spin_lock(&rbd_dev_list_lock);
6291         list_del_init(&rbd_dev->node);
6292         spin_unlock(&rbd_dev_list_lock);
6293
6294         clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
6295         device_del(&rbd_dev->dev);
6296         rbd_dev_mapping_clear(rbd_dev);
6297         if (!single_major)
6298                 unregister_blkdev(rbd_dev->major, rbd_dev->name);
6299 }
6300
6301 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev)
6302 {
6303         while (rbd_dev->parent) {
6304                 struct rbd_device *first = rbd_dev;
6305                 struct rbd_device *second = first->parent;
6306                 struct rbd_device *third;
6307
6308                 /*
6309                  * Follow to the parent with no grandparent and
6310                  * remove it.
6311                  */
6312                 while (second && (third = second->parent)) {
6313                         first = second;
6314                         second = third;
6315                 }
6316                 rbd_assert(second);
6317                 rbd_dev_image_release(second);
6318                 first->parent = NULL;
6319                 first->parent_overlap = 0;
6320
6321                 rbd_assert(first->parent_spec);
6322                 rbd_spec_put(first->parent_spec);
6323                 first->parent_spec = NULL;
6324         }
6325 }
6326
6327 static ssize_t do_rbd_remove(struct bus_type *bus,
6328                              const char *buf,
6329                              size_t count)
6330 {
6331         struct rbd_device *rbd_dev = NULL;
6332         struct list_head *tmp;
6333         int dev_id;
6334         char opt_buf[6];
6335         bool already = false;
6336         bool force = false;
6337         int ret;
6338
6339         dev_id = -1;
6340         opt_buf[0] = '\0';
6341         sscanf(buf, "%d %5s", &dev_id, opt_buf);
6342         if (dev_id < 0) {
6343                 pr_err("dev_id out of range\n");
6344                 return -EINVAL;
6345         }
6346         if (opt_buf[0] != '\0') {
6347                 if (!strcmp(opt_buf, "force")) {
6348                         force = true;
6349                 } else {
6350                         pr_err("bad remove option at '%s'\n", opt_buf);
6351                         return -EINVAL;
6352                 }
6353         }
6354
6355         ret = -ENOENT;
6356         spin_lock(&rbd_dev_list_lock);
6357         list_for_each(tmp, &rbd_dev_list) {
6358                 rbd_dev = list_entry(tmp, struct rbd_device, node);
6359                 if (rbd_dev->dev_id == dev_id) {
6360                         ret = 0;
6361                         break;
6362                 }
6363         }
6364         if (!ret) {
6365                 spin_lock_irq(&rbd_dev->lock);
6366                 if (rbd_dev->open_count && !force)
6367                         ret = -EBUSY;
6368                 else
6369                         already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
6370                                                         &rbd_dev->flags);
6371                 spin_unlock_irq(&rbd_dev->lock);
6372         }
6373         spin_unlock(&rbd_dev_list_lock);
6374         if (ret < 0 || already)
6375                 return ret;
6376
6377         if (force) {
6378                 /*
6379                  * Prevent new IO from being queued and wait for existing
6380                  * IO to complete/fail.
6381                  */
6382                 blk_mq_freeze_queue(rbd_dev->disk->queue);
6383                 blk_set_queue_dying(rbd_dev->disk->queue);
6384         }
6385
6386         down_write(&rbd_dev->lock_rwsem);
6387         if (__rbd_is_lock_owner(rbd_dev))
6388                 rbd_unlock(rbd_dev);
6389         up_write(&rbd_dev->lock_rwsem);
6390         rbd_unregister_watch(rbd_dev);
6391
6392         /*
6393          * Don't free anything from rbd_dev->disk until after all
6394          * notifies are completely processed. Otherwise
6395          * rbd_bus_del_dev() will race with rbd_watch_cb(), resulting
6396          * in a potential use after free of rbd_dev->disk or rbd_dev.
6397          */
6398         rbd_dev_device_release(rbd_dev);
6399         rbd_dev_image_release(rbd_dev);
6400
6401         return count;
6402 }
6403
6404 static ssize_t rbd_remove(struct bus_type *bus,
6405                           const char *buf,
6406                           size_t count)
6407 {
6408         if (single_major)
6409                 return -EINVAL;
6410
6411         return do_rbd_remove(bus, buf, count);
6412 }
6413
6414 static ssize_t rbd_remove_single_major(struct bus_type *bus,
6415                                        const char *buf,
6416                                        size_t count)
6417 {
6418         return do_rbd_remove(bus, buf, count);
6419 }
6420
6421 /*
6422  * create control files in sysfs
6423  * /sys/bus/rbd/...
6424  */
6425 static int rbd_sysfs_init(void)
6426 {
6427         int ret;
6428
6429         ret = device_register(&rbd_root_dev);
6430         if (ret < 0)
6431                 return ret;
6432
6433         ret = bus_register(&rbd_bus_type);
6434         if (ret < 0)
6435                 device_unregister(&rbd_root_dev);
6436
6437         return ret;
6438 }
6439
6440 static void rbd_sysfs_cleanup(void)
6441 {
6442         bus_unregister(&rbd_bus_type);
6443         device_unregister(&rbd_root_dev);
6444 }
6445
6446 static int rbd_slab_init(void)
6447 {
6448         rbd_assert(!rbd_img_request_cache);
6449         rbd_img_request_cache = KMEM_CACHE(rbd_img_request, 0);
6450         if (!rbd_img_request_cache)
6451                 return -ENOMEM;
6452
6453         rbd_assert(!rbd_obj_request_cache);
6454         rbd_obj_request_cache = KMEM_CACHE(rbd_obj_request, 0);
6455         if (!rbd_obj_request_cache)
6456                 goto out_err;
6457
6458         rbd_assert(!rbd_segment_name_cache);
6459         rbd_segment_name_cache = kmem_cache_create("rbd_segment_name",
6460                                         CEPH_MAX_OID_NAME_LEN + 1, 1, 0, NULL);
6461         if (rbd_segment_name_cache)
6462                 return 0;
6463 out_err:
6464         kmem_cache_destroy(rbd_obj_request_cache);
6465         rbd_obj_request_cache = NULL;
6466
6467         kmem_cache_destroy(rbd_img_request_cache);
6468         rbd_img_request_cache = NULL;
6469
6470         return -ENOMEM;
6471 }
6472
6473 static void rbd_slab_exit(void)
6474 {
6475         rbd_assert(rbd_segment_name_cache);
6476         kmem_cache_destroy(rbd_segment_name_cache);
6477         rbd_segment_name_cache = NULL;
6478
6479         rbd_assert(rbd_obj_request_cache);
6480         kmem_cache_destroy(rbd_obj_request_cache);
6481         rbd_obj_request_cache = NULL;
6482
6483         rbd_assert(rbd_img_request_cache);
6484         kmem_cache_destroy(rbd_img_request_cache);
6485         rbd_img_request_cache = NULL;
6486 }
6487
6488 static int __init rbd_init(void)
6489 {
6490         int rc;
6491
6492         if (!libceph_compatible(NULL)) {
6493                 rbd_warn(NULL, "libceph incompatibility (quitting)");
6494                 return -EINVAL;
6495         }
6496
6497         rc = rbd_slab_init();
6498         if (rc)
6499                 return rc;
6500
6501         /*
6502          * The number of active work items is limited by the number of
6503          * rbd devices * queue depth, so leave @max_active at default.
6504          */
6505         rbd_wq = alloc_workqueue(RBD_DRV_NAME, WQ_MEM_RECLAIM, 0);
6506         if (!rbd_wq) {
6507                 rc = -ENOMEM;
6508                 goto err_out_slab;
6509         }
6510
6511         if (single_major) {
6512                 rbd_major = register_blkdev(0, RBD_DRV_NAME);
6513                 if (rbd_major < 0) {
6514                         rc = rbd_major;
6515                         goto err_out_wq;
6516                 }
6517         }
6518
6519         rc = rbd_sysfs_init();
6520         if (rc)
6521                 goto err_out_blkdev;
6522
6523         if (single_major)
6524                 pr_info("loaded (major %d)\n", rbd_major);
6525         else
6526                 pr_info("loaded\n");
6527
6528         return 0;
6529
6530 err_out_blkdev:
6531         if (single_major)
6532                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
6533 err_out_wq:
6534         destroy_workqueue(rbd_wq);
6535 err_out_slab:
6536         rbd_slab_exit();
6537         return rc;
6538 }
6539
6540 static void __exit rbd_exit(void)
6541 {
6542         ida_destroy(&rbd_dev_id_ida);
6543         rbd_sysfs_cleanup();
6544         if (single_major)
6545                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
6546         destroy_workqueue(rbd_wq);
6547         rbd_slab_exit();
6548 }
6549
6550 module_init(rbd_init);
6551 module_exit(rbd_exit);
6552
6553 MODULE_AUTHOR("Alex Elder <elder@inktank.com>");
6554 MODULE_AUTHOR("Sage Weil <sage@newdream.net>");
6555 MODULE_AUTHOR("Yehuda Sadeh <yehuda@hq.newdream.net>");
6556 /* following authorship retained from original osdblk.c */
6557 MODULE_AUTHOR("Jeff Garzik <jeff@garzik.org>");
6558
6559 MODULE_DESCRIPTION("RADOS Block Device (RBD) driver");
6560 MODULE_LICENSE("GPL");