1/*
   2 * Copyright (C) 2001, 2002 Sistina Software (UK) Limited.
   3 * Copyright (C) 2004 - 2006 Red Hat, Inc. All rights reserved.
   4 *
   5 * This file is released under the GPL.
   6 */
   7
   8#include "dm-core.h"
   9
  10#include <linux/module.h>
  11#include <linux/vmalloc.h>
  12#include <linux/miscdevice.h>
  13#include <linux/init.h>
  14#include <linux/wait.h>
  15#include <linux/slab.h>
  16#include <linux/dm-ioctl.h>
  17#include <linux/hdreg.h>
  18#include <linux/compat.h>
  19
  20#include <linux/uaccess.h>
  21
  22#define DM_MSG_PREFIX "ioctl"
  23#define DM_DRIVER_EMAIL "dm-devel@redhat.com"
  24
  25/*-----------------------------------------------------------------
  26 * The ioctl interface needs to be able to look up devices by
  27 * name or uuid.
  28 *---------------------------------------------------------------*/
  29struct hash_cell {
  30	struct list_head name_list;
  31	struct list_head uuid_list;
  32
  33	char *name;
  34	char *uuid;
  35	struct mapped_device *md;
  36	struct dm_table *new_map;
  37};
  38
  39/*
  40 * A dummy definition to make RCU happy.
  41 * struct dm_table should never be dereferenced in this file.
  42 */
  43struct dm_table {
  44	int undefined__;
  45};
  46
  47struct vers_iter {
  48    size_t param_size;
  49    struct dm_target_versions *vers, *old_vers;
  50    char *end;
  51    uint32_t flags;
  52};
  53
  54
  55#define NUM_BUCKETS 64
  56#define MASK_BUCKETS (NUM_BUCKETS - 1)
  57static struct list_head _name_buckets[NUM_BUCKETS];
  58static struct list_head _uuid_buckets[NUM_BUCKETS];
  59
  60static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred);
  61
  62/*
  63 * Guards access to both hash tables.
  64 */
  65static DECLARE_RWSEM(_hash_lock);
  66
  67/*
  68 * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
  69 */
  70static DEFINE_MUTEX(dm_hash_cells_mutex);
  71
  72static void init_buckets(struct list_head *buckets)
  73{
  74	unsigned int i;
  75
  76	for (i = 0; i < NUM_BUCKETS; i++)
  77		INIT_LIST_HEAD(buckets + i);
  78}
  79
  80static int dm_hash_init(void)
  81{
  82	init_buckets(_name_buckets);
  83	init_buckets(_uuid_buckets);
  84	return 0;
  85}
  86
  87static void dm_hash_exit(void)
  88{
  89	dm_hash_remove_all(false, false, false);
  90}
  91
  92/*-----------------------------------------------------------------
  93 * Hash function:
  94 * We're not really concerned with the str hash function being
  95 * fast since it's only used by the ioctl interface.
  96 *---------------------------------------------------------------*/
  97static unsigned int hash_str(const char *str)
  98{
  99	const unsigned int hash_mult = 2654435387U;
 100	unsigned int h = 0;
 101
 102	while (*str)
 103		h = (h + (unsigned int) *str++) * hash_mult;
 104
 105	return h & MASK_BUCKETS;
 106}
 107
 108/*-----------------------------------------------------------------
 109 * Code for looking up a device by name
 110 *---------------------------------------------------------------*/
 111static struct hash_cell *__get_name_cell(const char *str)
 112{
 113	struct hash_cell *hc;
 114	unsigned int h = hash_str(str);
 115
 116	list_for_each_entry (hc, _name_buckets + h, name_list)
 117		if (!strcmp(hc->name, str)) {
 118			dm_get(hc->md);
 119			return hc;
 120		}
 121
 122	return NULL;
 123}
 124
 125static struct hash_cell *__get_uuid_cell(const char *str)
 126{
 127	struct hash_cell *hc;
 128	unsigned int h = hash_str(str);
 129
 130	list_for_each_entry (hc, _uuid_buckets + h, uuid_list)
 131		if (!strcmp(hc->uuid, str)) {
 132			dm_get(hc->md);
 133			return hc;
 134		}
 135
 136	return NULL;
 137}
 138
 139static struct hash_cell *__get_dev_cell(uint64_t dev)
 140{
 141	struct mapped_device *md;
 142	struct hash_cell *hc;
 143
 144	md = dm_get_md(huge_decode_dev(dev));
 145	if (!md)
 146		return NULL;
 147
 148	hc = dm_get_mdptr(md);
 149	if (!hc) {
 150		dm_put(md);
 151		return NULL;
 152	}
 153
 154	return hc;
 155}
 156
 157/*-----------------------------------------------------------------
 158 * Inserting, removing and renaming a device.
 159 *---------------------------------------------------------------*/
 160static struct hash_cell *alloc_cell(const char *name, const char *uuid,
 161				    struct mapped_device *md)
 162{
 163	struct hash_cell *hc;
 164
 165	hc = kmalloc(sizeof(*hc), GFP_KERNEL);
 166	if (!hc)
 167		return NULL;
 168
 169	hc->name = kstrdup(name, GFP_KERNEL);
 170	if (!hc->name) {
 171		kfree(hc);
 172		return NULL;
 173	}
 174
 175	if (!uuid)
 176		hc->uuid = NULL;
 177
 178	else {
 179		hc->uuid = kstrdup(uuid, GFP_KERNEL);
 180		if (!hc->uuid) {
 181			kfree(hc->name);
 182			kfree(hc);
 183			return NULL;
 184		}
 185	}
 186
 187	INIT_LIST_HEAD(&hc->name_list);
 188	INIT_LIST_HEAD(&hc->uuid_list);
 189	hc->md = md;
 190	hc->new_map = NULL;
 191	return hc;
 192}
 193
 194static void free_cell(struct hash_cell *hc)
 195{
 196	if (hc) {
 197		kfree(hc->name);
 198		kfree(hc->uuid);
 199		kfree(hc);
 200	}
 201}
 202
 203/*
 204 * The kdev_t and uuid of a device can never change once it is
 205 * initially inserted.
 206 */
 207static int dm_hash_insert(const char *name, const char *uuid, struct mapped_device *md)
 208{
 209	struct hash_cell *cell, *hc;
 210
 211	/*
 212	 * Allocate the new cells.
 213	 */
 214	cell = alloc_cell(name, uuid, md);
 215	if (!cell)
 216		return -ENOMEM;
 217
 218	/*
 219	 * Insert the cell into both hash tables.
 220	 */
 221	down_write(&_hash_lock);
 222	hc = __get_name_cell(name);
 223	if (hc) {
 224		dm_put(hc->md);
 225		goto bad;
 226	}
 227
 228	list_add(&cell->name_list, _name_buckets + hash_str(name));
 229
 230	if (uuid) {
 231		hc = __get_uuid_cell(uuid);
 232		if (hc) {
 233			list_del(&cell->name_list);
 234			dm_put(hc->md);
 235			goto bad;
 236		}
 237		list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
 238	}
 239	dm_get(md);
 240	mutex_lock(&dm_hash_cells_mutex);
 241	dm_set_mdptr(md, cell);
 242	mutex_unlock(&dm_hash_cells_mutex);
 243	up_write(&_hash_lock);
 244
 245	return 0;
 246
 247 bad:
 248	up_write(&_hash_lock);
 249	free_cell(cell);
 250	return -EBUSY;
 251}
 252
 253static struct dm_table *__hash_remove(struct hash_cell *hc)
 254{
 255	struct dm_table *table;
 256	int srcu_idx;
 257
 258	/* remove from the dev hash */
 259	list_del(&hc->uuid_list);
 260	list_del(&hc->name_list);
 261	mutex_lock(&dm_hash_cells_mutex);
 262	dm_set_mdptr(hc->md, NULL);
 263	mutex_unlock(&dm_hash_cells_mutex);
 264
 265	table = dm_get_live_table(hc->md, &srcu_idx);
 266	if (table)
 267		dm_table_event(table);
 268	dm_put_live_table(hc->md, srcu_idx);
 269
 270	table = NULL;
 271	if (hc->new_map)
 272		table = hc->new_map;
 273	dm_put(hc->md);
 274	free_cell(hc);
 275
 276	return table;
 277}
 278
 279static void dm_hash_remove_all(bool keep_open_devices, bool mark_deferred, bool only_deferred)
 280{
 281	int i, dev_skipped;
 282	struct hash_cell *hc;
 283	struct mapped_device *md;
 284	struct dm_table *t;
 285
 286retry:
 287	dev_skipped = 0;
 288
 289	down_write(&_hash_lock);
 290
 291	for (i = 0; i < NUM_BUCKETS; i++) {
 292		list_for_each_entry(hc, _name_buckets + i, name_list) {
 293			md = hc->md;
 294			dm_get(md);
 295
 296			if (keep_open_devices &&
 297			    dm_lock_for_deletion(md, mark_deferred, only_deferred)) {
 298				dm_put(md);
 299				dev_skipped++;
 300				continue;
 301			}
 302
 303			t = __hash_remove(hc);
 304
 305			up_write(&_hash_lock);
 306
 307			if (t) {
 308				dm_sync_table(md);
 309				dm_table_destroy(t);
 310			}
 311			dm_put(md);
 312			if (likely(keep_open_devices))
 313				dm_destroy(md);
 314			else
 315				dm_destroy_immediate(md);
 316
 317			/*
 318			 * Some mapped devices may be using other mapped
 319			 * devices, so repeat until we make no further
 320			 * progress.  If a new mapped device is created
 321			 * here it will also get removed.
 322			 */
 323			goto retry;
 324		}
 325	}
 326
 327	up_write(&_hash_lock);
 328
 329	if (dev_skipped)
 330		DMWARN("remove_all left %d open device(s)", dev_skipped);
 331}
 332
 333/*
 334 * Set the uuid of a hash_cell that isn't already set.
 335 */
 336static void __set_cell_uuid(struct hash_cell *hc, char *new_uuid)
 337{
 338	mutex_lock(&dm_hash_cells_mutex);
 339	hc->uuid = new_uuid;
 340	mutex_unlock(&dm_hash_cells_mutex);
 341
 342	list_add(&hc->uuid_list, _uuid_buckets + hash_str(new_uuid));
 343}
 344
 345/*
 346 * Changes the name of a hash_cell and returns the old name for
 347 * the caller to free.
 348 */
 349static char *__change_cell_name(struct hash_cell *hc, char *new_name)
 350{
 351	char *old_name;
 352
 353	/*
 354	 * Rename and move the name cell.
 355	 */
 356	list_del(&hc->name_list);
 357	old_name = hc->name;
 358
 359	mutex_lock(&dm_hash_cells_mutex);
 360	hc->name = new_name;
 361	mutex_unlock(&dm_hash_cells_mutex);
 362
 363	list_add(&hc->name_list, _name_buckets + hash_str(new_name));
 364
 365	return old_name;
 366}
 367
 368static struct mapped_device *dm_hash_rename(struct dm_ioctl *param,
 369					    const char *new)
 370{
 371	char *new_data, *old_name = NULL;
 372	struct hash_cell *hc;
 373	struct dm_table *table;
 374	struct mapped_device *md;
 375	unsigned change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;
 376	int srcu_idx;
 377
 378	/*
 379	 * duplicate new.
 380	 */
 381	new_data = kstrdup(new, GFP_KERNEL);
 382	if (!new_data)
 383		return ERR_PTR(-ENOMEM);
 384
 385	down_write(&_hash_lock);
 386
 387	/*
 388	 * Is new free ?
 389	 */
 390	if (change_uuid)
 391		hc = __get_uuid_cell(new);
 392	else
 393		hc = __get_name_cell(new);
 394
 395	if (hc) {
 396		DMWARN("Unable to change %s on mapped device %s to one that "
 397		       "already exists: %s",
 398		       change_uuid ? "uuid" : "name",
 399		       param->name, new);
 400		dm_put(hc->md);
 401		up_write(&_hash_lock);
 402		kfree(new_data);
 403		return ERR_PTR(-EBUSY);
 404	}
 405
 406	/*
 407	 * Is there such a device as 'old' ?
 408	 */
 409	hc = __get_name_cell(param->name);
 410	if (!hc) {
 411		DMWARN("Unable to rename non-existent device, %s to %s%s",
 412		       param->name, change_uuid ? "uuid " : "", new);
 413		up_write(&_hash_lock);
 414		kfree(new_data);
 415		return ERR_PTR(-ENXIO);
 416	}
 417
 418	/*
 419	 * Does this device already have a uuid?
 420	 */
 421	if (change_uuid && hc->uuid) {
 422		DMWARN("Unable to change uuid of mapped device %s to %s "
 423		       "because uuid is already set to %s",
 424		       param->name, new, hc->uuid);
 425		dm_put(hc->md);
 426		up_write(&_hash_lock);
 427		kfree(new_data);
 428		return ERR_PTR(-EINVAL);
 429	}
 430
 431	if (change_uuid)
 432		__set_cell_uuid(hc, new_data);
 433	else
 434		old_name = __change_cell_name(hc, new_data);
 435
 436	/*
 437	 * Wake up any dm event waiters.
 438	 */
 439	table = dm_get_live_table(hc->md, &srcu_idx);
 440	if (table)
 441		dm_table_event(table);
 442	dm_put_live_table(hc->md, srcu_idx);
 443
 444	if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr))
 445		param->flags |= DM_UEVENT_GENERATED_FLAG;
 446
 447	md = hc->md;
 448	up_write(&_hash_lock);
 449	kfree(old_name);
 450
 451	return md;
 452}
 453
 454void dm_deferred_remove(void)
 455{
 456	dm_hash_remove_all(true, false, true);
 457}
 458
 459/*-----------------------------------------------------------------
 460 * Implementation of the ioctl commands
 461 *---------------------------------------------------------------*/
 462/*
 463 * All the ioctl commands get dispatched to functions with this
 464 * prototype.
 465 */
 466typedef int (*ioctl_fn)(struct dm_ioctl *param, size_t param_size);
 467
 468static int remove_all(struct dm_ioctl *param, size_t param_size)
 469{
 470	dm_hash_remove_all(true, !!(param->flags & DM_DEFERRED_REMOVE), false);
 471	param->data_size = 0;
 472	return 0;
 473}
 474
 475/*
 476 * Round up the ptr to an 8-byte boundary.
 477 */
 478#define ALIGN_MASK 7
 479static inline void *align_ptr(void *ptr)
 480{
 481	return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK);
 482}
 483
 484/*
 485 * Retrieves the data payload buffer from an already allocated
 486 * struct dm_ioctl.
 487 */
 488static void *get_result_buffer(struct dm_ioctl *param, size_t param_size,
 489			       size_t *len)
 490{
 491	param->data_start = align_ptr(param + 1) - (void *) param;
 492
 493	if (param->data_start < param_size)
 494		*len = param_size - param->data_start;
 495	else
 496		*len = 0;
 497
 498	return ((void *) param) + param->data_start;
 499}
 500
 501static int list_devices(struct dm_ioctl *param, size_t param_size)
 502{
 503	unsigned int i;
 504	struct hash_cell *hc;
 505	size_t len, needed = 0;
 506	struct gendisk *disk;
 507	struct dm_name_list *nl, *old_nl = NULL;
 508
 509	down_write(&_hash_lock);
 510
 511	/*
 512	 * Loop through all the devices working out how much
 513	 * space we need.
 514	 */
 515	for (i = 0; i < NUM_BUCKETS; i++) {
 516		list_for_each_entry (hc, _name_buckets + i, name_list) {
 517			needed += sizeof(struct dm_name_list);
 518			needed += strlen(hc->name) + 1;
 519			needed += ALIGN_MASK;
 520		}
 521	}
 522
 523	/*
 524	 * Grab our output buffer.
 525	 */
 526	nl = get_result_buffer(param, param_size, &len);
 527	if (len < needed) {
 528		param->flags |= DM_BUFFER_FULL_FLAG;
 529		goto out;
 530	}
 531	param->data_size = param->data_start + needed;
 532
 533	nl->dev = 0;	/* Flags no data */
 534
 535	/*
 536	 * Now loop through filling out the names.
 537	 */
 538	for (i = 0; i < NUM_BUCKETS; i++) {
 539		list_for_each_entry (hc, _name_buckets + i, name_list) {
 540			if (old_nl)
 541				old_nl->next = (uint32_t) ((void *) nl -
 542							   (void *) old_nl);
 543			disk = dm_disk(hc->md);
 544			nl->dev = huge_encode_dev(disk_devt(disk));
 545			nl->next = 0;
 546			strcpy(nl->name, hc->name);
 547
 548			old_nl = nl;
 549			nl = align_ptr(((void *) ++nl) + strlen(hc->name) + 1);
 550		}
 551	}
 552
 553 out:
 554	up_write(&_hash_lock);
 555	return 0;
 556}
 557
 558static void list_version_get_needed(struct target_type *tt, void *needed_param)
 559{
 560    size_t *needed = needed_param;
 561
 562    *needed += sizeof(struct dm_target_versions);
 563    *needed += strlen(tt->name);
 564    *needed += ALIGN_MASK;
 565}
 566
 567static void list_version_get_info(struct target_type *tt, void *param)
 568{
 569    struct vers_iter *info = param;
 570
 571    /* Check space - it might have changed since the first iteration */
 572    if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 >
 573	info->end) {
 574
 575	info->flags = DM_BUFFER_FULL_FLAG;
 576	return;
 577    }
 578
 579    if (info->old_vers)
 580	info->old_vers->next = (uint32_t) ((void *)info->vers -
 581					   (void *)info->old_vers);
 582    info->vers->version[0] = tt->version[0];
 583    info->vers->version[1] = tt->version[1];
 584    info->vers->version[2] = tt->version[2];
 585    info->vers->next = 0;
 586    strcpy(info->vers->name, tt->name);
 587
 588    info->old_vers = info->vers;
 589    info->vers = align_ptr(((void *) ++info->vers) + strlen(tt->name) + 1);
 590}
 591
 592static int list_versions(struct dm_ioctl *param, size_t param_size)
 593{
 594	size_t len, needed = 0;
 595	struct dm_target_versions *vers;
 596	struct vers_iter iter_info;
 597
 598	/*
 599	 * Loop through all the devices working out how much
 600	 * space we need.
 601	 */
 602	dm_target_iterate(list_version_get_needed, &needed);
 603
 604	/*
 605	 * Grab our output buffer.
 606	 */
 607	vers = get_result_buffer(param, param_size, &len);
 608	if (len < needed) {
 609		param->flags |= DM_BUFFER_FULL_FLAG;
 610		goto out;
 611	}
 612	param->data_size = param->data_start + needed;
 613
 614	iter_info.param_size = param_size;
 615	iter_info.old_vers = NULL;
 616	iter_info.vers = vers;
 617	iter_info.flags = 0;
 618	iter_info.end = (char *)vers+len;
 619
 620	/*
 621	 * Now loop through filling out the names & versions.
 622	 */
 623	dm_target_iterate(list_version_get_info, &iter_info);
 624	param->flags |= iter_info.flags;
 625
 626 out:
 627	return 0;
 628}
 629
 630static int check_name(const char *name)
 631{
 632	if (strchr(name, '/')) {
 633		DMWARN("invalid device name");
 634		return -EINVAL;
 635	}
 636
 637	return 0;
 638}
 639
 640/*
 641 * On successful return, the caller must not attempt to acquire
 642 * _hash_lock without first calling dm_put_live_table, because dm_table_destroy
 643 * waits for this dm_put_live_table and could be called under this lock.
 644 */
 645static struct dm_table *dm_get_inactive_table(struct mapped_device *md, int *srcu_idx)
 646{
 647	struct hash_cell *hc;
 648	struct dm_table *table = NULL;
 649
 650	/* increment rcu count, we don't care about the table pointer */
 651	dm_get_live_table(md, srcu_idx);
 652
 653	down_read(&_hash_lock);
 654	hc = dm_get_mdptr(md);
 655	if (!hc || hc->md != md) {
 656		DMWARN("device has been removed from the dev hash table.");
 657		goto out;
 658	}
 659
 660	table = hc->new_map;
 661
 662out:
 663	up_read(&_hash_lock);
 664
 665	return table;
 666}
 667
 668static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,
 669						      struct dm_ioctl *param,
 670						      int *srcu_idx)
 671{
 672	return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?
 673		dm_get_inactive_table(md, srcu_idx) : dm_get_live_table(md, srcu_idx);
 674}
 675
 676/*
 677 * Fills in a dm_ioctl structure, ready for sending back to
 678 * userland.
 679 */
 680static void __dev_status(struct mapped_device *md, struct dm_ioctl *param)
 681{
 682	struct gendisk *disk = dm_disk(md);
 683	struct dm_table *table;
 684	int srcu_idx;
 685
 686	param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |
 687			  DM_ACTIVE_PRESENT_FLAG | DM_INTERNAL_SUSPEND_FLAG);
 688
 689	if (dm_suspended_md(md))
 690		param->flags |= DM_SUSPEND_FLAG;
 691
 692	if (dm_suspended_internally_md(md))
 693		param->flags |= DM_INTERNAL_SUSPEND_FLAG;
 694
 695	if (dm_test_deferred_remove_flag(md))
 696		param->flags |= DM_DEFERRED_REMOVE;
 697
 698	param->dev = huge_encode_dev(disk_devt(disk));
 699
 700	/*
 701	 * Yes, this will be out of date by the time it gets back
 702	 * to userland, but it is still very useful for
 703	 * debugging.
 704	 */
 705	param->open_count = dm_open_count(md);
 706
 707	param->event_nr = dm_get_event_nr(md);
 708	param->target_count = 0;
 709
 710	table = dm_get_live_table(md, &srcu_idx);
 711	if (table) {
 712		if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {
 713			if (get_disk_ro(disk))
 714				param->flags |= DM_READONLY_FLAG;
 715			param->target_count = dm_table_get_num_targets(table);
 716		}
 717
 718		param->flags |= DM_ACTIVE_PRESENT_FLAG;
 719	}
 720	dm_put_live_table(md, srcu_idx);
 721
 722	if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {
 723		int srcu_idx;
 724		table = dm_get_inactive_table(md, &srcu_idx);
 725		if (table) {
 726			if (!(dm_table_get_mode(table) & FMODE_WRITE))
 727				param->flags |= DM_READONLY_FLAG;
 728			param->target_count = dm_table_get_num_targets(table);
 729		}
 730		dm_put_live_table(md, srcu_idx);
 731	}
 732}
 733
 734static int dev_create(struct dm_ioctl *param, size_t param_size)
 735{
 736	int r, m = DM_ANY_MINOR;
 737	struct mapped_device *md;
 738
 739	r = check_name(param->name);
 740	if (r)
 741		return r;
 742
 743	if (param->flags & DM_PERSISTENT_DEV_FLAG)
 744		m = MINOR(huge_decode_dev(param->dev));
 745
 746	r = dm_create(m, &md);
 747	if (r)
 748		return r;
 749
 750	r = dm_hash_insert(param->name, *param->uuid ? param->uuid : NULL, md);
 751	if (r) {
 752		dm_put(md);
 753		dm_destroy(md);
 754		return r;
 755	}
 756
 757	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
 758
 759	__dev_status(md, param);
 760
 761	dm_put(md);
 762
 763	return 0;
 764}
 765
 766/*
 767 * Always use UUID for lookups if it's present, otherwise use name or dev.
 768 */
 769static struct hash_cell *__find_device_hash_cell(struct dm_ioctl *param)
 770{
 771	struct hash_cell *hc = NULL;
 772
 773	if (*param->uuid) {
 774		if (*param->name || param->dev)
 775			return NULL;
 776
 777		hc = __get_uuid_cell(param->uuid);
 778		if (!hc)
 779			return NULL;
 780	} else if (*param->name) {
 781		if (param->dev)
 782			return NULL;
 783
 784		hc = __get_name_cell(param->name);
 785		if (!hc)
 786			return NULL;
 787	} else if (param->dev) {
 788		hc = __get_dev_cell(param->dev);
 789		if (!hc)
 790			return NULL;
 791	} else
 792		return NULL;
 793
 794	/*
 795	 * Sneakily write in both the name and the uuid
 796	 * while we have the cell.
 797	 */
 798	strlcpy(param->name, hc->name, sizeof(param->name));
 799	if (hc->uuid)
 800		strlcpy(param->uuid, hc->uuid, sizeof(param->uuid));
 801	else
 802		param->uuid[0] = '\0';
 803
 804	if (hc->new_map)
 805		param->flags |= DM_INACTIVE_PRESENT_FLAG;
 806	else
 807		param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
 808
 809	return hc;
 810}
 811
 812static struct mapped_device *find_device(struct dm_ioctl *param)
 813{
 814	struct hash_cell *hc;
 815	struct mapped_device *md = NULL;
 816
 817	down_read(&_hash_lock);
 818	hc = __find_device_hash_cell(param);
 819	if (hc)
 820		md = hc->md;
 821	up_read(&_hash_lock);
 822
 823	return md;
 824}
 825
 826static int dev_remove(struct dm_ioctl *param, size_t param_size)
 827{
 828	struct hash_cell *hc;
 829	struct mapped_device *md;
 830	int r;
 831	struct dm_table *t;
 832
 833	down_write(&_hash_lock);
 834	hc = __find_device_hash_cell(param);
 835
 836	if (!hc) {
 837		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
 838		up_write(&_hash_lock);
 839		return -ENXIO;
 840	}
 841
 842	md = hc->md;
 843
 844	/*
 845	 * Ensure the device is not open and nothing further can open it.
 846	 */
 847	r = dm_lock_for_deletion(md, !!(param->flags & DM_DEFERRED_REMOVE), false);
 848	if (r) {
 849		if (r == -EBUSY && param->flags & DM_DEFERRED_REMOVE) {
 850			up_write(&_hash_lock);
 851			dm_put(md);
 852			return 0;
 853		}
 854		DMDEBUG_LIMIT("unable to remove open device %s", hc->name);
 855		up_write(&_hash_lock);
 856		dm_put(md);
 857		return r;
 858	}
 859
 860	t = __hash_remove(hc);
 861	up_write(&_hash_lock);
 862
 863	if (t) {
 864		dm_sync_table(md);
 865		dm_table_destroy(t);
 866	}
 867
 868	param->flags &= ~DM_DEFERRED_REMOVE;
 869
 870	if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr))
 871		param->flags |= DM_UEVENT_GENERATED_FLAG;
 872
 873	dm_put(md);
 874	dm_destroy(md);
 875	return 0;
 876}
 877
 878/*
 879 * Check a string doesn't overrun the chunk of
 880 * memory we copied from userland.
 881 */
 882static int invalid_str(char *str, void *end)
 883{
 884	while ((void *) str < end)
 885		if (!*str++)
 886			return 0;
 887
 888	return -EINVAL;
 889}
 890
 891static int dev_rename(struct dm_ioctl *param, size_t param_size)
 892{
 893	int r;
 894	char *new_data = (char *) param + param->data_start;
 895	struct mapped_device *md;
 896	unsigned change_uuid = (param->flags & DM_UUID_FLAG) ? 1 : 0;
 897
 898	if (new_data < param->data ||
 899	    invalid_str(new_data, (void *) param + param_size) || !*new_data ||
 900	    strlen(new_data) > (change_uuid ? DM_UUID_LEN - 1 : DM_NAME_LEN - 1)) {
 901		DMWARN("Invalid new mapped device name or uuid string supplied.");
 902		return -EINVAL;
 903	}
 904
 905	if (!change_uuid) {
 906		r = check_name(new_data);
 907		if (r)
 908			return r;
 909	}
 910
 911	md = dm_hash_rename(param, new_data);
 912	if (IS_ERR(md))
 913		return PTR_ERR(md);
 914
 915	__dev_status(md, param);
 916	dm_put(md);
 917
 918	return 0;
 919}
 920
 921static int dev_set_geometry(struct dm_ioctl *param, size_t param_size)
 922{
 923	int r = -EINVAL, x;
 924	struct mapped_device *md;
 925	struct hd_geometry geometry;
 926	unsigned long indata[4];
 927	char *geostr = (char *) param + param->data_start;
 928	char dummy;
 929
 930	md = find_device(param);
 931	if (!md)
 932		return -ENXIO;
 933
 934	if (geostr < param->data ||
 935	    invalid_str(geostr, (void *) param + param_size)) {
 936		DMWARN("Invalid geometry supplied.");
 937		goto out;
 938	}
 939
 940	x = sscanf(geostr, "%lu %lu %lu %lu%c", indata,
 941		   indata + 1, indata + 2, indata + 3, &dummy);
 942
 943	if (x != 4) {
 944		DMWARN("Unable to interpret geometry settings.");
 945		goto out;
 946	}
 947
 948	if (indata[0] > 65535 || indata[1] > 255 ||
 949	    indata[2] > 255 || indata[3] > ULONG_MAX) {
 950		DMWARN("Geometry exceeds range limits.");
 951		goto out;
 952	}
 953
 954	geometry.cylinders = indata[0];
 955	geometry.heads = indata[1];
 956	geometry.sectors = indata[2];
 957	geometry.start = indata[3];
 958
 959	r = dm_set_geometry(md, &geometry);
 960
 961	param->data_size = 0;
 962
 963out:
 964	dm_put(md);
 965	return r;
 966}
 967
 968static int do_suspend(struct dm_ioctl *param)
 969{
 970	int r = 0;
 971	unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
 972	struct mapped_device *md;
 973
 974	md = find_device(param);
 975	if (!md)
 976		return -ENXIO;
 977
 978	if (param->flags & DM_SKIP_LOCKFS_FLAG)
 979		suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
 980	if (param->flags & DM_NOFLUSH_FLAG)
 981		suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
 982
 983	if (!dm_suspended_md(md)) {
 984		r = dm_suspend(md, suspend_flags);
 985		if (r)
 986			goto out;
 987	}
 988
 989	__dev_status(md, param);
 990
 991out:
 992	dm_put(md);
 993
 994	return r;
 995}
 996
 997static int do_resume(struct dm_ioctl *param)
 998{
 999	int r = 0;
1000	unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
1001	struct hash_cell *hc;
1002	struct mapped_device *md;
1003	struct dm_table *new_map, *old_map = NULL;
1004
1005	down_write(&_hash_lock);
1006
1007	hc = __find_device_hash_cell(param);
1008	if (!hc) {
1009		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
1010		up_write(&_hash_lock);
1011		return -ENXIO;
1012	}
1013
1014	md = hc->md;
1015
1016	new_map = hc->new_map;
1017	hc->new_map = NULL;
1018	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
1019
1020	up_write(&_hash_lock);
1021
1022	/* Do we need to load a new map ? */
1023	if (new_map) {
1024		/* Suspend if it isn't already suspended */
1025		if (param->flags & DM_SKIP_LOCKFS_FLAG)
1026			suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
1027		if (param->flags & DM_NOFLUSH_FLAG)
1028			suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
1029		if (!dm_suspended_md(md))
1030			dm_suspend(md, suspend_flags);
1031
1032		old_map = dm_swap_table(md, new_map);
1033		if (IS_ERR(old_map)) {
1034			dm_sync_table(md);
1035			dm_table_destroy(new_map);
1036			dm_put(md);
1037			return PTR_ERR(old_map);
1038		}
1039
1040		if (dm_table_get_mode(new_map) & FMODE_WRITE)
1041			set_disk_ro(dm_disk(md), 0);
1042		else
1043			set_disk_ro(dm_disk(md), 1);
1044	}
1045
1046	if (dm_suspended_md(md)) {
1047		r = dm_resume(md);
1048		if (!r && !dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr))
1049			param->flags |= DM_UEVENT_GENERATED_FLAG;
1050	}
1051
1052	/*
1053	 * Since dm_swap_table synchronizes RCU, nobody should be in
1054	 * read-side critical section already.
1055	 */
1056	if (old_map)
1057		dm_table_destroy(old_map);
1058
1059	if (!r)
1060		__dev_status(md, param);
1061
1062	dm_put(md);
1063	return r;
1064}
1065
1066/*
1067 * Set or unset the suspension state of a device.
1068 * If the device already is in the requested state we just return its status.
1069 */
1070static int dev_suspend(struct dm_ioctl *param, size_t param_size)
1071{
1072	if (param->flags & DM_SUSPEND_FLAG)
1073		return do_suspend(param);
1074
1075	return do_resume(param);
1076}
1077
1078/*
1079 * Copies device info back to user space, used by
1080 * the create and info ioctls.
1081 */
1082static int dev_status(struct dm_ioctl *param, size_t param_size)
1083{
1084	struct mapped_device *md;
1085
1086	md = find_device(param);
1087	if (!md)
1088		return -ENXIO;
1089
1090	__dev_status(md, param);
1091	dm_put(md);
1092
1093	return 0;
1094}
1095
1096/*
1097 * Build up the status struct for each target
1098 */
1099static void retrieve_status(struct dm_table *table,
1100			    struct dm_ioctl *param, size_t param_size)
1101{
1102	unsigned int i, num_targets;
1103	struct dm_target_spec *spec;
1104	char *outbuf, *outptr;
1105	status_type_t type;
1106	size_t remaining, len, used = 0;
1107	unsigned status_flags = 0;
1108
1109	outptr = outbuf = get_result_buffer(param, param_size, &len);
1110
1111	if (param->flags & DM_STATUS_TABLE_FLAG)
1112		type = STATUSTYPE_TABLE;
1113	else
1114		type = STATUSTYPE_INFO;
1115
1116	/* Get all the target info */
1117	num_targets = dm_table_get_num_targets(table);
1118	for (i = 0; i < num_targets; i++) {
1119		struct dm_target *ti = dm_table_get_target(table, i);
1120		size_t l;
1121
1122		remaining = len - (outptr - outbuf);
1123		if (remaining <= sizeof(struct dm_target_spec)) {
1124			param->flags |= DM_BUFFER_FULL_FLAG;
1125			break;
1126		}
1127
1128		spec = (struct dm_target_spec *) outptr;
1129
1130		spec->status = 0;
1131		spec->sector_start = ti->begin;
1132		spec->length = ti->len;
1133		strncpy(spec->target_type, ti->type->name,
1134			sizeof(spec->target_type));
1135
1136		outptr += sizeof(struct dm_target_spec);
1137		remaining = len - (outptr - outbuf);
1138		if (remaining <= 0) {
1139			param->flags |= DM_BUFFER_FULL_FLAG;
1140			break;
1141		}
1142
1143		/* Get the status/table string from the target driver */
1144		if (ti->type->status) {
1145			if (param->flags & DM_NOFLUSH_FLAG)
1146				status_flags |= DM_STATUS_NOFLUSH_FLAG;
1147			ti->type->status(ti, type, status_flags, outptr, remaining);
1148		} else
1149			outptr[0] = '\0';
1150
1151		l = strlen(outptr) + 1;
1152		if (l == remaining) {
1153			param->flags |= DM_BUFFER_FULL_FLAG;
1154			break;
1155		}
1156
1157		outptr += l;
1158		used = param->data_start + (outptr - outbuf);
1159
1160		outptr = align_ptr(outptr);
1161		spec->next = outptr - outbuf;
1162	}
1163
1164	if (used)
1165		param->data_size = used;
1166
1167	param->target_count = num_targets;
1168}
1169
1170/*
1171 * Wait for a device to report an event
1172 */
1173static int dev_wait(struct dm_ioctl *param, size_t param_size)
1174{
1175	int r = 0;
1176	struct mapped_device *md;
1177	struct dm_table *table;
1178	int srcu_idx;
1179
1180	md = find_device(param);
1181	if (!md)
1182		return -ENXIO;
1183
1184	/*
1185	 * Wait for a notification event
1186	 */
1187	if (dm_wait_event(md, param->event_nr)) {
1188		r = -ERESTARTSYS;
1189		goto out;
1190	}
1191
1192	/*
1193	 * The userland program is going to want to know what
1194	 * changed to trigger the event, so we may as well tell
1195	 * him and save an ioctl.
1196	 */
1197	__dev_status(md, param);
1198
1199	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1200	if (table)
1201		retrieve_status(table, param, param_size);
1202	dm_put_live_table(md, srcu_idx);
1203
1204out:
1205	dm_put(md);
1206
1207	return r;
1208}
1209
1210static inline fmode_t get_mode(struct dm_ioctl *param)
1211{
1212	fmode_t mode = FMODE_READ | FMODE_WRITE;
1213
1214	if (param->flags & DM_READONLY_FLAG)
1215		mode = FMODE_READ;
1216
1217	return mode;
1218}
1219
1220static int next_target(struct dm_target_spec *last, uint32_t next, void *end,
1221		       struct dm_target_spec **spec, char **target_params)
1222{
1223	*spec = (struct dm_target_spec *) ((unsigned char *) last + next);
1224	*target_params = (char *) (*spec + 1);
1225
1226	if (*spec < (last + 1))
1227		return -EINVAL;
1228
1229	return invalid_str(*target_params, end);
1230}
1231
1232static int populate_table(struct dm_table *table,
1233			  struct dm_ioctl *param, size_t param_size)
1234{
1235	int r;
1236	unsigned int i = 0;
1237	struct dm_target_spec *spec = (struct dm_target_spec *) param;
1238	uint32_t next = param->data_start;
1239	void *end = (void *) param + param_size;
1240	char *target_params;
1241
1242	if (!param->target_count) {
1243		DMWARN("populate_table: no targets specified");
1244		return -EINVAL;
1245	}
1246
1247	for (i = 0; i < param->target_count; i++) {
1248
1249		r = next_target(spec, next, end, &spec, &target_params);
1250		if (r) {
1251			DMWARN("unable to find target");
1252			return r;
1253		}
1254
1255		r = dm_table_add_target(table, spec->target_type,
1256					(sector_t) spec->sector_start,
1257					(sector_t) spec->length,
1258					target_params);
1259		if (r) {
1260			DMWARN("error adding target to table");
1261			return r;
1262		}
1263
1264		next = spec->next;
1265	}
1266
1267	return dm_table_complete(table);
1268}
1269
1270static bool is_valid_type(unsigned cur, unsigned new)
1271{
1272	if (cur == new ||
1273	    (cur == DM_TYPE_BIO_BASED && new == DM_TYPE_DAX_BIO_BASED))
1274		return true;
1275
1276	return false;
1277}
1278
1279static int table_load(struct dm_ioctl *param, size_t param_size)
1280{
1281	int r;
1282	struct hash_cell *hc;
1283	struct dm_table *t, *old_map = NULL;
1284	struct mapped_device *md;
1285	struct target_type *immutable_target_type;
1286
1287	md = find_device(param);
1288	if (!md)
1289		return -ENXIO;
1290
1291	r = dm_table_create(&t, get_mode(param), param->target_count, md);
1292	if (r)
1293		goto err;
1294
1295	/* Protect md->type and md->queue against concurrent table loads. */
1296	dm_lock_md_type(md);
1297	r = populate_table(t, param, param_size);
1298	if (r)
1299		goto err_unlock_md_type;
1300
1301	immutable_target_type = dm_get_immutable_target_type(md);
1302	if (immutable_target_type &&
1303	    (immutable_target_type != dm_table_get_immutable_target_type(t)) &&
1304	    !dm_table_get_wildcard_target(t)) {
1305		DMWARN("can't replace immutable target type %s",
1306		       immutable_target_type->name);
1307		r = -EINVAL;
1308		goto err_unlock_md_type;
1309	}
1310
1311	if (dm_get_md_type(md) == DM_TYPE_NONE) {
1312		/* Initial table load: acquire type of table. */
1313		dm_set_md_type(md, dm_table_get_type(t));
1314
1315		/* setup md->queue to reflect md's type (may block) */
1316		r = dm_setup_md_queue(md, t);
1317		if (r) {
1318			DMWARN("unable to set up device queue for new table.");
1319			goto err_unlock_md_type;
1320		}
1321	} else if (!is_valid_type(dm_get_md_type(md), dm_table_get_type(t))) {
1322		DMWARN("can't change device type after initial table load.");
1323		r = -EINVAL;
1324		goto err_unlock_md_type;
1325	}
1326
1327	dm_unlock_md_type(md);
1328
1329	/* stage inactive table */
1330	down_write(&_hash_lock);
1331	hc = dm_get_mdptr(md);
1332	if (!hc || hc->md != md) {
1333		DMWARN("device has been removed from the dev hash table.");
1334		up_write(&_hash_lock);
1335		r = -ENXIO;
1336		goto err_destroy_table;
1337	}
1338
1339	if (hc->new_map)
1340		old_map = hc->new_map;
1341	hc->new_map = t;
1342	up_write(&_hash_lock);
1343
1344	param->flags |= DM_INACTIVE_PRESENT_FLAG;
1345	__dev_status(md, param);
1346
1347	if (old_map) {
1348		dm_sync_table(md);
1349		dm_table_destroy(old_map);
1350	}
1351
1352	dm_put(md);
1353
1354	return 0;
1355
1356err_unlock_md_type:
1357	dm_unlock_md_type(md);
1358err_destroy_table:
1359	dm_table_destroy(t);
1360err:
1361	dm_put(md);
1362
1363	return r;
1364}
1365
1366static int table_clear(struct dm_ioctl *param, size_t param_size)
1367{
1368	struct hash_cell *hc;
1369	struct mapped_device *md;
1370	struct dm_table *old_map = NULL;
1371
1372	down_write(&_hash_lock);
1373
1374	hc = __find_device_hash_cell(param);
1375	if (!hc) {
1376		DMDEBUG_LIMIT("device doesn't appear to be in the dev hash table.");
1377		up_write(&_hash_lock);
1378		return -ENXIO;
1379	}
1380
1381	if (hc->new_map) {
1382		old_map = hc->new_map;
1383		hc->new_map = NULL;
1384	}
1385
1386	param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
1387
1388	__dev_status(hc->md, param);
1389	md = hc->md;
1390	up_write(&_hash_lock);
1391	if (old_map) {
1392		dm_sync_table(md);
1393		dm_table_destroy(old_map);
1394	}
1395	dm_put(md);
1396
1397	return 0;
1398}
1399
1400/*
1401 * Retrieves a list of devices used by a particular dm device.
1402 */
1403static void retrieve_deps(struct dm_table *table,
1404			  struct dm_ioctl *param, size_t param_size)
1405{
1406	unsigned int count = 0;
1407	struct list_head *tmp;
1408	size_t len, needed;
1409	struct dm_dev_internal *dd;
1410	struct dm_target_deps *deps;
1411
1412	deps = get_result_buffer(param, param_size, &len);
1413
1414	/*
1415	 * Count the devices.
1416	 */
1417	list_for_each (tmp, dm_table_get_devices(table))
1418		count++;
1419
1420	/*
1421	 * Check we have enough space.
1422	 */
1423	needed = sizeof(*deps) + (sizeof(*deps->dev) * count);
1424	if (len < needed) {
1425		param->flags |= DM_BUFFER_FULL_FLAG;
1426		return;
1427	}
1428
1429	/*
1430	 * Fill in the devices.
1431	 */
1432	deps->count = count;
1433	count = 0;
1434	list_for_each_entry (dd, dm_table_get_devices(table), list)
1435		deps->dev[count++] = huge_encode_dev(dd->dm_dev->bdev->bd_dev);
1436
1437	param->data_size = param->data_start + needed;
1438}
1439
1440static int table_deps(struct dm_ioctl *param, size_t param_size)
1441{
1442	struct mapped_device *md;
1443	struct dm_table *table;
1444	int srcu_idx;
1445
1446	md = find_device(param);
1447	if (!md)
1448		return -ENXIO;
1449
1450	__dev_status(md, param);
1451
1452	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1453	if (table)
1454		retrieve_deps(table, param, param_size);
1455	dm_put_live_table(md, srcu_idx);
1456
1457	dm_put(md);
1458
1459	return 0;
1460}
1461
1462/*
1463 * Return the status of a device as a text string for each
1464 * target.
1465 */
1466static int table_status(struct dm_ioctl *param, size_t param_size)
1467{
1468	struct mapped_device *md;
1469	struct dm_table *table;
1470	int srcu_idx;
1471
1472	md = find_device(param);
1473	if (!md)
1474		return -ENXIO;
1475
1476	__dev_status(md, param);
1477
1478	table = dm_get_live_or_inactive_table(md, param, &srcu_idx);
1479	if (table)
1480		retrieve_status(table, param, param_size);
1481	dm_put_live_table(md, srcu_idx);
1482
1483	dm_put(md);
1484
1485	return 0;
1486}
1487
1488/*
1489 * Process device-mapper dependent messages.  Messages prefixed with '@'
1490 * are processed by the DM core.  All others are delivered to the target.
1491 * Returns a number <= 1 if message was processed by device mapper.
1492 * Returns 2 if message should be delivered to the target.
1493 */
1494static int message_for_md(struct mapped_device *md, unsigned argc, char **argv,
1495			  char *result, unsigned maxlen)
1496{
1497	int r;
1498
1499	if (**argv != '@')
1500		return 2; /* no '@' prefix, deliver to target */
1501
1502	if (!strcasecmp(argv[0], "@cancel_deferred_remove")) {
1503		if (argc != 1) {
1504			DMERR("Invalid arguments for @cancel_deferred_remove");
1505			return -EINVAL;
1506		}
1507		return dm_cancel_deferred_remove(md);
1508	}
1509
1510	r = dm_stats_message(md, argc, argv, result, maxlen);
1511	if (r < 2)
1512		return r;
1513
1514	DMERR("Unsupported message sent to DM core: %s", argv[0]);
1515	return -EINVAL;
1516}
1517
1518/*
1519 * Pass a message to the target that's at the supplied device offset.
1520 */
1521static int target_message(struct dm_ioctl *param, size_t param_size)
1522{
1523	int r, argc;
1524	char **argv;
1525	struct mapped_device *md;
1526	struct dm_table *table;
1527	struct dm_target *ti;
1528	struct dm_target_msg *tmsg = (void *) param + param->data_start;
1529	size_t maxlen;
1530	char *result = get_result_buffer(param, param_size, &maxlen);
1531	int srcu_idx;
1532
1533	md = find_device(param);
1534	if (!md)
1535		return -ENXIO;
1536
1537	if (tmsg < (struct dm_target_msg *) param->data ||
1538	    invalid_str(tmsg->message, (void *) param + param_size)) {
1539		DMWARN("Invalid target message parameters.");
1540		r = -EINVAL;
1541		goto out;
1542	}
1543
1544	r = dm_split_args(&argc, &argv, tmsg->message);
1545	if (r) {
1546		DMWARN("Failed to split target message parameters");
1547		goto out;
1548	}
1549
1550	if (!argc) {
1551		DMWARN("Empty message received.");
1552		goto out_argv;
1553	}
1554
1555	r = message_for_md(md, argc, argv, result, maxlen);
1556	if (r <= 1)
1557		goto out_argv;
1558
1559	table = dm_get_live_table(md, &srcu_idx);
1560	if (!table)
1561		goto out_table;
1562
1563	if (dm_deleting_md(md)) {
1564		r = -ENXIO;
1565		goto out_table;
1566	}
1567
1568	ti = dm_table_find_target(table, tmsg->sector);
1569	if (!dm_target_is_valid(ti)) {
1570		DMWARN("Target message sector outside device.");
1571		r = -EINVAL;
1572	} else if (ti->type->message)
1573		r = ti->type->message(ti, argc, argv);
1574	else {
1575		DMWARN("Target type does not support messages");
1576		r = -EINVAL;
1577	}
1578
1579 out_table:
1580	dm_put_live_table(md, srcu_idx);
1581 out_argv:
1582	kfree(argv);
1583 out:
1584	if (r >= 0)
1585		__dev_status(md, param);
1586
1587	if (r == 1) {
1588		param->flags |= DM_DATA_OUT_FLAG;
1589		if (dm_message_test_buffer_overflow(result, maxlen))
1590			param->flags |= DM_BUFFER_FULL_FLAG;
1591		else
1592			param->data_size = param->data_start + strlen(result) + 1;
1593		r = 0;
1594	}
1595
1596	dm_put(md);
1597	return r;
1598}
1599
1600/*
1601 * The ioctl parameter block consists of two parts, a dm_ioctl struct
1602 * followed by a data buffer.  This flag is set if the second part,
1603 * which has a variable size, is not used by the function processing
1604 * the ioctl.
1605 */
1606#define IOCTL_FLAGS_NO_PARAMS	1
1607
1608/*-----------------------------------------------------------------
1609 * Implementation of open/close/ioctl on the special char
1610 * device.
1611 *---------------------------------------------------------------*/
1612static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
1613{
1614	static struct {
1615		int cmd;
1616		int flags;
1617		ioctl_fn fn;
1618	} _ioctls[] = {
1619		{DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
1620		{DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all},
1621		{DM_LIST_DEVICES_CMD, 0, list_devices},
1622
1623		{DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create},
1624		{DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove},
1625		{DM_DEV_RENAME_CMD, 0, dev_rename},
1626		{DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
1627		{DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
1628		{DM_DEV_WAIT_CMD, 0, dev_wait},
1629
1630		{DM_TABLE_LOAD_CMD, 0, table_load},
1631		{DM_TABLE_CLEAR_CMD, IOCTL_FLAGS_NO_PARAMS, table_clear},
1632		{DM_TABLE_DEPS_CMD, 0, table_deps},
1633		{DM_TABLE_STATUS_CMD, 0, table_status},
1634
1635		{DM_LIST_VERSIONS_CMD, 0, list_versions},
1636
1637		{DM_TARGET_MSG_CMD, 0, target_message},
1638		{DM_DEV_SET_GEOMETRY_CMD, 0, dev_set_geometry}
1639	};
1640
1641	if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
1642		return NULL;
1643
1644	*ioctl_flags = _ioctls[cmd].flags;
1645	return _ioctls[cmd].fn;
1646}
1647
1648/*
1649 * As well as checking the version compatibility this always
1650 * copies the kernel interface version out.
1651 */
1652static int check_version(unsigned int cmd, struct dm_ioctl __user *user)
1653{
1654	uint32_t version[3];
1655	int r = 0;
1656
1657	if (copy_from_user(version, user->version, sizeof(version)))
1658		return -EFAULT;
1659
1660	if ((DM_VERSION_MAJOR != version[0]) ||
1661	    (DM_VERSION_MINOR < version[1])) {
1662		DMWARN("ioctl interface mismatch: "
1663		       "kernel(%u.%u.%u), user(%u.%u.%u), cmd(%d)",
1664		       DM_VERSION_MAJOR, DM_VERSION_MINOR,
1665		       DM_VERSION_PATCHLEVEL,
1666		       version[0], version[1], version[2], cmd);
1667		r = -EINVAL;
1668	}
1669
1670	/*
1671	 * Fill in the kernel version.
1672	 */
1673	version[0] = DM_VERSION_MAJOR;
1674	version[1] = DM_VERSION_MINOR;
1675	version[2] = DM_VERSION_PATCHLEVEL;
1676	if (copy_to_user(user->version, version, sizeof(version)))
1677		return -EFAULT;
1678
1679	return r;
1680}
1681
1682#define DM_PARAMS_MALLOC	0x0001	/* Params allocated with kvmalloc() */
 
1683#define DM_WIPE_BUFFER		0x0010	/* Wipe input buffer before returning from ioctl */
1684
1685static void free_params(struct dm_ioctl *param, size_t param_size, int param_flags)
1686{
1687	if (param_flags & DM_WIPE_BUFFER)
1688		memset(param, 0, param_size);
1689
1690	if (param_flags & DM_PARAMS_MALLOC)
1691		kvfree(param);
 
 
1692}
1693
1694static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
1695		       int ioctl_flags,
1696		       struct dm_ioctl **param, int *param_flags)
1697{
1698	struct dm_ioctl *dmi;
1699	int secure_data;
1700	const size_t minimum_data_size = offsetof(struct dm_ioctl, data);
1701
1702	if (copy_from_user(param_kernel, user, minimum_data_size))
1703		return -EFAULT;
1704
1705	if (param_kernel->data_size < minimum_data_size)
1706		return -EINVAL;
1707
1708	secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG;
1709
1710	*param_flags = secure_data ? DM_WIPE_BUFFER : 0;
1711
1712	if (ioctl_flags & IOCTL_FLAGS_NO_PARAMS) {
1713		dmi = param_kernel;
1714		dmi->data_size = minimum_data_size;
1715		goto data_copied;
1716	}
1717
1718	/*
1719	 * Try to avoid low memory issues when a device is suspended.
1720	 * Use kmalloc() rather than vmalloc() when we can.
1721	 */
1722	dmi = NULL;
1723	if (param_kernel->data_size <= KMALLOC_MAX_SIZE)
1724		dmi = kmalloc(param_kernel->data_size, GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
 
 
 
1725
1726	if (!dmi) {
1727		unsigned noio_flag;
1728		noio_flag = memalloc_noio_save();
1729		dmi = __vmalloc(param_kernel->data_size, GFP_NOIO | __GFP_HIGH | __GFP_HIGHMEM, PAGE_KERNEL);
1730		memalloc_noio_restore(noio_flag);
 
 
1731	}
1732
1733	if (!dmi) {
1734		if (secure_data && clear_user(user, param_kernel->data_size))
1735			return -EFAULT;
1736		return -ENOMEM;
1737	}
1738
1739	*param_flags |= DM_PARAMS_MALLOC;
1740
1741	if (copy_from_user(dmi, user, param_kernel->data_size))
1742		goto bad;
1743
1744data_copied:
1745	/*
1746	 * Abort if something changed the ioctl data while it was being copied.
1747	 */
1748	if (dmi->data_size != param_kernel->data_size) {
1749		DMERR("rejecting ioctl: data size modified while processing parameters");
1750		goto bad;
1751	}
1752
1753	/* Wipe the user buffer so we do not return it to userspace */
1754	if (secure_data && clear_user(user, param_kernel->data_size))
1755		goto bad;
1756
1757	*param = dmi;
1758	return 0;
1759
1760bad:
1761	free_params(dmi, param_kernel->data_size, *param_flags);
1762
1763	return -EFAULT;
1764}
1765
1766static int validate_params(uint cmd, struct dm_ioctl *param)
1767{
1768	/* Always clear this flag */
1769	param->flags &= ~DM_BUFFER_FULL_FLAG;
1770	param->flags &= ~DM_UEVENT_GENERATED_FLAG;
1771	param->flags &= ~DM_SECURE_DATA_FLAG;
1772	param->flags &= ~DM_DATA_OUT_FLAG;
1773
1774	/* Ignores parameters */
1775	if (cmd == DM_REMOVE_ALL_CMD ||
1776	    cmd == DM_LIST_DEVICES_CMD ||
1777	    cmd == DM_LIST_VERSIONS_CMD)
1778		return 0;
1779
1780	if ((cmd == DM_DEV_CREATE_CMD)) {
1781		if (!*param->name) {
1782			DMWARN("name not supplied when creating device");
1783			return -EINVAL;
1784		}
1785	} else if ((*param->uuid && *param->name)) {
1786		DMWARN("only supply one of name or uuid, cmd(%u)", cmd);
1787		return -EINVAL;
1788	}
1789
1790	/* Ensure strings are terminated */
1791	param->name[DM_NAME_LEN - 1] = '\0';
1792	param->uuid[DM_UUID_LEN - 1] = '\0';
1793
1794	return 0;
1795}
1796
1797static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
1798{
1799	int r = 0;
1800	int ioctl_flags;
1801	int param_flags;
1802	unsigned int cmd;
1803	struct dm_ioctl *uninitialized_var(param);
1804	ioctl_fn fn = NULL;
1805	size_t input_param_size;
1806	struct dm_ioctl param_kernel;
1807
1808	/* only root can play with this */
1809	if (!capable(CAP_SYS_ADMIN))
1810		return -EACCES;
1811
1812	if (_IOC_TYPE(command) != DM_IOCTL)
1813		return -ENOTTY;
1814
1815	cmd = _IOC_NR(command);
1816
1817	/*
1818	 * Check the interface version passed in.  This also
1819	 * writes out the kernel's interface version.
1820	 */
1821	r = check_version(cmd, user);
1822	if (r)
1823		return r;
1824
1825	/*
1826	 * Nothing more to do for the version command.
1827	 */
1828	if (cmd == DM_VERSION_CMD)
1829		return 0;
1830
1831	fn = lookup_ioctl(cmd, &ioctl_flags);
1832	if (!fn) {
1833		DMWARN("dm_ctl_ioctl: unknown command 0x%x", command);
1834		return -ENOTTY;
1835	}
1836
1837	/*
1838	 * Copy the parameters into kernel space.
1839	 */
1840	r = copy_params(user, &param_kernel, ioctl_flags, &param, &param_flags);
1841
1842	if (r)
1843		return r;
1844
1845	input_param_size = param->data_size;
1846	r = validate_params(cmd, param);
1847	if (r)
1848		goto out;
1849
1850	param->data_size = sizeof(*param);
1851	r = fn(param, input_param_size);
1852
1853	if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
1854	    unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
1855		DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
1856
1857	/*
1858	 * Copy the results back to userland.
1859	 */
1860	if (!r && copy_to_user(user, param, param->data_size))
1861		r = -EFAULT;
1862
1863out:
1864	free_params(param, input_param_size, param_flags);
1865	return r;
1866}
1867
1868static long dm_ctl_ioctl(struct file *file, uint command, ulong u)
1869{
1870	return (long)ctl_ioctl(command, (struct dm_ioctl __user *)u);
1871}
1872
1873#ifdef CONFIG_COMPAT
1874static long dm_compat_ctl_ioctl(struct file *file, uint command, ulong u)
1875{
1876	return (long)dm_ctl_ioctl(file, command, (ulong) compat_ptr(u));
1877}
1878#else
1879#define dm_compat_ctl_ioctl NULL
1880#endif
1881
1882static const struct file_operations _ctl_fops = {
1883	.open = nonseekable_open,
1884	.unlocked_ioctl	 = dm_ctl_ioctl,
1885	.compat_ioctl = dm_compat_ctl_ioctl,
1886	.owner	 = THIS_MODULE,
1887	.llseek  = noop_llseek,
1888};
1889
1890static struct miscdevice _dm_misc = {
1891	.minor		= MAPPER_CTRL_MINOR,
1892	.name  		= DM_NAME,
1893	.nodename	= DM_DIR "/" DM_CONTROL_NODE,
1894	.fops  		= &_ctl_fops
1895};
1896
1897MODULE_ALIAS_MISCDEV(MAPPER_CTRL_MINOR);
1898MODULE_ALIAS("devname:" DM_DIR "/" DM_CONTROL_NODE);
1899
1900/*
1901 * Create misc character device and link to DM_DIR/control.
1902 */
1903int __init dm_interface_init(void)
1904{
1905	int r;
1906
1907	r = dm_hash_init();
1908	if (r)
1909		return r;
1910
1911	r = misc_register(&_dm_misc);
1912	if (r) {
1913		DMERR("misc_register failed for control device");
1914		dm_hash_exit();
1915		return r;
1916	}
1917
1918	DMINFO("%d.%d.%d%s initialised: %s", DM_VERSION_MAJOR,
1919	       DM_VERSION_MINOR, DM_VERSION_PATCHLEVEL, DM_VERSION_EXTRA,
1920	       DM_DRIVER_EMAIL);
1921	return 0;
1922}
1923
1924void dm_interface_exit(void)
1925{
1926	misc_deregister(&_dm_misc);
1927	dm_hash_exit();
1928}
1929
1930/**
1931 * dm_copy_name_and_uuid - Copy mapped device name & uuid into supplied buffers
1932 * @md: Pointer to mapped_device
1933 * @name: Buffer (size DM_NAME_LEN) for name
1934 * @uuid: Buffer (size DM_UUID_LEN) for uuid or empty string if uuid not defined
1935 */
1936int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
1937{
1938	int r = 0;
1939	struct hash_cell *hc;
1940
1941	if (!md)
1942		return -ENXIO;
1943
1944	mutex_lock(&dm_hash_cells_mutex);
1945	hc = dm_get_mdptr(md);
1946	if (!hc || hc->md != md) {
1947		r = -ENXIO;
1948		goto out;
1949	}
1950
1951	if (name)
1952		strcpy(name, hc->name);
1953	if (uuid)
1954		strcpy(uuid, hc->uuid ? : "");
1955
1956out:
1957	mutex_unlock(&dm_hash_cells_mutex);
1958
1959	return r;
1960}