2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2005 Pawel Jakub Dawidek <pjd@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/kernel.h>
35 #include <sys/module.h>
37 #include <sys/mutex.h>
40 #include <sys/sysctl.h>
41 #include <sys/malloc.h>
43 #include <geom/geom.h>
44 #include <geom/geom_dbg.h>
45 #include <geom/shsec/g_shsec.h>
47 FEATURE(geom_shsec, "GEOM shared secret device support");
49 static MALLOC_DEFINE(M_SHSEC, "shsec_data", "GEOM_SHSEC Data");
51 static uma_zone_t g_shsec_zone;
53 static int g_shsec_destroy(struct g_shsec_softc *sc, boolean_t force);
54 static int g_shsec_destroy_geom(struct gctl_req *req, struct g_class *mp,
57 static g_taste_t g_shsec_taste;
58 static g_ctl_req_t g_shsec_config;
59 static g_dumpconf_t g_shsec_dumpconf;
60 static g_init_t g_shsec_init;
61 static g_fini_t g_shsec_fini;
63 struct g_class g_shsec_class = {
64 .name = G_SHSEC_CLASS_NAME,
66 .ctlreq = g_shsec_config,
67 .taste = g_shsec_taste,
68 .destroy_geom = g_shsec_destroy_geom,
73 SYSCTL_DECL(_kern_geom);
74 static SYSCTL_NODE(_kern_geom, OID_AUTO, shsec, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
76 static u_int g_shsec_debug;
77 SYSCTL_UINT(_kern_geom_shsec, OID_AUTO, debug, CTLFLAG_RWTUN, &g_shsec_debug, 0,
79 static u_long g_shsec_maxmem;
80 SYSCTL_ULONG(_kern_geom_shsec, OID_AUTO, maxmem,
81 CTLFLAG_RDTUN | CTLFLAG_NOFETCH, &g_shsec_maxmem,
82 0, "Maximum memory that can be allocated for I/O (in bytes)");
83 static u_int g_shsec_alloc_failed = 0;
84 SYSCTL_UINT(_kern_geom_shsec, OID_AUTO, alloc_failed, CTLFLAG_RD,
85 &g_shsec_alloc_failed, 0, "How many times I/O allocation failed");
88 * Greatest Common Divisor.
104 * Least Common Multiple.
107 lcm(u_int a, u_int b)
110 return ((a * b) / gcd(a, b));
114 g_shsec_init(struct g_class *mp __unused)
117 g_shsec_maxmem = maxphys * 100;
118 TUNABLE_ULONG_FETCH("kern.geom.shsec.maxmem,", &g_shsec_maxmem);
119 g_shsec_zone = uma_zcreate("g_shsec_zone", maxphys, NULL, NULL, NULL,
121 g_shsec_maxmem -= g_shsec_maxmem % maxphys;
122 uma_zone_set_max(g_shsec_zone, g_shsec_maxmem / maxphys);
126 g_shsec_fini(struct g_class *mp __unused)
129 uma_zdestroy(g_shsec_zone);
133 * Return the number of valid disks.
136 g_shsec_nvalid(struct g_shsec_softc *sc)
141 for (i = 0; i < sc->sc_ndisks; i++) {
142 if (sc->sc_disks[i] != NULL)
150 g_shsec_remove_disk(struct g_consumer *cp)
152 struct g_shsec_softc *sc;
155 KASSERT(cp != NULL, ("Non-valid disk in %s.", __func__));
156 sc = (struct g_shsec_softc *)cp->private;
157 KASSERT(sc != NULL, ("NULL sc in %s.", __func__));
160 G_SHSEC_DEBUG(0, "Disk %s removed from %s.", cp->provider->name,
163 sc->sc_disks[no] = NULL;
164 if (sc->sc_provider != NULL) {
165 g_wither_provider(sc->sc_provider, ENXIO);
166 sc->sc_provider = NULL;
167 G_SHSEC_DEBUG(0, "Device %s removed.", sc->sc_name);
170 if (cp->acr > 0 || cp->acw > 0 || cp->ace > 0)
173 g_destroy_consumer(cp);
177 g_shsec_orphan(struct g_consumer *cp)
179 struct g_shsec_softc *sc;
188 g_shsec_remove_disk(cp);
189 /* If there are no valid disks anymore, remove device. */
190 if (LIST_EMPTY(&gp->consumer))
191 g_shsec_destroy(sc, 1);
195 g_shsec_access(struct g_provider *pp, int dr, int dw, int de)
197 struct g_consumer *cp1, *cp2, *tmp;
198 struct g_shsec_softc *sc;
205 /* On first open, grab an extra "exclusive" bit */
206 if (pp->acr == 0 && pp->acw == 0 && pp->ace == 0)
208 /* ... and let go of it on last close */
209 if ((pp->acr + dr) == 0 && (pp->acw + dw) == 0 && (pp->ace + de) == 0)
213 LIST_FOREACH_SAFE(cp1, &gp->consumer, consumer, tmp) {
214 error = g_access(cp1, dr, dw, de);
217 if (cp1->acr == 0 && cp1->acw == 0 && cp1->ace == 0 &&
218 cp1->flags & G_CF_ORPHAN) {
220 g_destroy_consumer(cp1);
224 /* If there are no valid disks anymore, remove device. */
225 if (LIST_EMPTY(&gp->consumer))
226 g_shsec_destroy(sc, 1);
231 /* If we fail here, backout all previous changes. */
232 LIST_FOREACH(cp2, &gp->consumer, consumer) {
235 g_access(cp2, -dr, -dw, -de);
241 g_shsec_xor1(uint32_t *src, uint32_t *dst, ssize_t len)
244 for (; len > 0; len -= sizeof(uint32_t), dst++)
245 *dst = *dst ^ *src++;
246 KASSERT(len == 0, ("len != 0 (len=%zd)", len));
250 g_shsec_done(struct bio *bp)
254 pbp = bp->bio_parent;
255 if (bp->bio_error == 0)
256 G_SHSEC_LOGREQ(2, bp, "Request done.");
258 G_SHSEC_LOGREQ(0, bp, "Request failed (error=%d).",
260 if (pbp->bio_error == 0)
261 pbp->bio_error = bp->bio_error;
263 if (pbp->bio_cmd == BIO_READ) {
264 if ((pbp->bio_pflags & G_SHSEC_BFLAG_FIRST) != 0) {
265 bcopy(bp->bio_data, pbp->bio_data, pbp->bio_length);
268 g_shsec_xor1((uint32_t *)bp->bio_data,
269 (uint32_t *)pbp->bio_data,
270 (ssize_t)pbp->bio_length);
273 if (bp->bio_data != NULL) {
274 explicit_bzero(bp->bio_data, bp->bio_length);
275 uma_zfree(g_shsec_zone, bp->bio_data);
279 if (pbp->bio_children == pbp->bio_inbed) {
280 pbp->bio_completed = pbp->bio_length;
281 g_io_deliver(pbp, pbp->bio_error);
286 g_shsec_xor2(uint32_t *rand, uint32_t *dst, ssize_t len)
289 for (; len > 0; len -= sizeof(uint32_t), dst++) {
290 *rand = arc4random();
291 *dst = *dst ^ *rand++;
293 KASSERT(len == 0, ("len != 0 (len=%zd)", len));
297 g_shsec_start(struct bio *bp)
299 TAILQ_HEAD(, bio) queue = TAILQ_HEAD_INITIALIZER(queue);
300 struct g_shsec_softc *sc;
307 sc = bp->bio_to->geom->softc;
309 * If sc == NULL, provider's error should be set and g_shsec_start()
310 * should not be called at all.
313 ("Provider's error should be set (error=%d)(device=%s).",
314 bp->bio_to->error, bp->bio_to->name));
316 G_SHSEC_LOGREQ(2, bp, "Request received.");
318 switch (bp->bio_cmd) {
324 * Only those requests are supported.
329 /* To which provider it should be delivered? */
331 g_io_deliver(bp, EOPNOTSUPP);
336 * Allocate all bios first and calculate XOR.
339 len = bp->bio_length;
340 if (bp->bio_cmd == BIO_READ)
341 bp->bio_pflags = G_SHSEC_BFLAG_FIRST;
342 for (no = 0; no < sc->sc_ndisks; no++) {
343 cbp = g_clone_bio(bp);
348 TAILQ_INSERT_TAIL(&queue, cbp, bio_queue);
351 * Fill in the component buf structure.
353 cbp->bio_done = g_shsec_done;
354 cbp->bio_caller2 = sc->sc_disks[no];
355 if (bp->bio_cmd == BIO_READ || bp->bio_cmd == BIO_WRITE) {
356 cbp->bio_data = uma_zalloc(g_shsec_zone, M_NOWAIT);
357 if (cbp->bio_data == NULL) {
358 g_shsec_alloc_failed++;
362 if (bp->bio_cmd == BIO_WRITE) {
364 dst = (uint32_t *)cbp->bio_data;
365 bcopy(bp->bio_data, dst, len);
367 g_shsec_xor2((uint32_t *)cbp->bio_data,
374 * Fire off all allocated requests!
376 while ((cbp = TAILQ_FIRST(&queue)) != NULL) {
377 struct g_consumer *cp;
379 TAILQ_REMOVE(&queue, cbp, bio_queue);
380 cp = cbp->bio_caller2;
381 cbp->bio_caller2 = NULL;
382 cbp->bio_to = cp->provider;
383 G_SHSEC_LOGREQ(2, cbp, "Sending request.");
384 g_io_request(cbp, cp);
388 while ((cbp = TAILQ_FIRST(&queue)) != NULL) {
389 TAILQ_REMOVE(&queue, cbp, bio_queue);
391 if (cbp->bio_data != NULL) {
392 explicit_bzero(cbp->bio_data, cbp->bio_length);
393 uma_zfree(g_shsec_zone, cbp->bio_data);
397 if (bp->bio_error == 0)
398 bp->bio_error = error;
399 g_io_deliver(bp, bp->bio_error);
403 g_shsec_check_and_run(struct g_shsec_softc *sc)
406 u_int no, sectorsize = 0;
408 if (g_shsec_nvalid(sc) != sc->sc_ndisks)
411 sc->sc_provider = g_new_providerf(sc->sc_geom, "shsec/%s", sc->sc_name);
413 * Find the smallest disk.
415 mediasize = sc->sc_disks[0]->provider->mediasize;
416 mediasize -= sc->sc_disks[0]->provider->sectorsize;
417 sectorsize = sc->sc_disks[0]->provider->sectorsize;
418 for (no = 1; no < sc->sc_ndisks; no++) {
419 ms = sc->sc_disks[no]->provider->mediasize;
420 ms -= sc->sc_disks[no]->provider->sectorsize;
423 sectorsize = lcm(sectorsize,
424 sc->sc_disks[no]->provider->sectorsize);
426 sc->sc_provider->sectorsize = sectorsize;
427 sc->sc_provider->mediasize = mediasize;
428 g_error_provider(sc->sc_provider, 0);
430 G_SHSEC_DEBUG(0, "Device %s activated.", sc->sc_name);
434 g_shsec_read_metadata(struct g_consumer *cp, struct g_shsec_metadata *md)
436 struct g_provider *pp;
442 error = g_access(cp, 1, 0, 0);
447 buf = g_read_data(cp, pp->mediasize - pp->sectorsize, pp->sectorsize,
450 g_access(cp, -1, 0, 0);
454 /* Decode metadata. */
455 shsec_metadata_decode(buf, md);
462 * Add disk to given device.
465 g_shsec_add_disk(struct g_shsec_softc *sc, struct g_provider *pp, u_int no)
467 struct g_consumer *cp, *fcp;
469 struct g_shsec_metadata md;
472 /* Metadata corrupted? */
473 if (no >= sc->sc_ndisks)
476 /* Check if disk is not already attached. */
477 if (sc->sc_disks[no] != NULL)
481 fcp = LIST_FIRST(&gp->consumer);
483 cp = g_new_consumer(gp);
484 error = g_attach(cp, pp);
486 g_destroy_consumer(cp);
490 if (fcp != NULL && (fcp->acr > 0 || fcp->acw > 0 || fcp->ace > 0)) {
491 error = g_access(cp, fcp->acr, fcp->acw, fcp->ace);
494 g_destroy_consumer(cp);
499 /* Reread metadata. */
500 error = g_shsec_read_metadata(cp, &md);
504 if (strcmp(md.md_magic, G_SHSEC_MAGIC) != 0 ||
505 strcmp(md.md_name, sc->sc_name) != 0 || md.md_id != sc->sc_id) {
506 G_SHSEC_DEBUG(0, "Metadata on %s changed.", pp->name);
512 sc->sc_disks[no] = cp;
514 G_SHSEC_DEBUG(0, "Disk %s attached to %s.", pp->name, sc->sc_name);
516 g_shsec_check_and_run(sc);
520 if (fcp != NULL && (fcp->acr > 0 || fcp->acw > 0 || fcp->ace > 0))
521 g_access(cp, -fcp->acr, -fcp->acw, -fcp->ace);
523 g_destroy_consumer(cp);
527 static struct g_geom *
528 g_shsec_create(struct g_class *mp, const struct g_shsec_metadata *md)
530 struct g_shsec_softc *sc;
534 G_SHSEC_DEBUG(1, "Creating device %s (id=%u).", md->md_name, md->md_id);
536 /* Two disks is minimum. */
537 if (md->md_all < 2) {
538 G_SHSEC_DEBUG(0, "Too few disks defined for %s.", md->md_name);
542 /* Check for duplicate unit */
543 LIST_FOREACH(gp, &mp->geom, geom) {
545 if (sc != NULL && strcmp(sc->sc_name, md->md_name) == 0) {
546 G_SHSEC_DEBUG(0, "Device %s already configured.",
551 gp = g_new_geomf(mp, "%s", md->md_name);
552 sc = malloc(sizeof(*sc), M_SHSEC, M_WAITOK | M_ZERO);
553 gp->start = g_shsec_start;
554 gp->spoiled = g_shsec_orphan;
555 gp->orphan = g_shsec_orphan;
556 gp->access = g_shsec_access;
557 gp->dumpconf = g_shsec_dumpconf;
559 sc->sc_id = md->md_id;
560 sc->sc_ndisks = md->md_all;
561 sc->sc_disks = malloc(sizeof(struct g_consumer *) * sc->sc_ndisks,
562 M_SHSEC, M_WAITOK | M_ZERO);
563 for (no = 0; no < sc->sc_ndisks; no++)
564 sc->sc_disks[no] = NULL;
568 sc->sc_provider = NULL;
570 G_SHSEC_DEBUG(0, "Device %s created (id=%u).", sc->sc_name, sc->sc_id);
576 g_shsec_destroy(struct g_shsec_softc *sc, boolean_t force)
578 struct g_provider *pp;
587 pp = sc->sc_provider;
588 if (pp != NULL && (pp->acr != 0 || pp->acw != 0 || pp->ace != 0)) {
590 G_SHSEC_DEBUG(0, "Device %s is still open, so it "
591 "can't be definitely removed.", pp->name);
594 "Device %s is still open (r%dw%de%d).", pp->name,
595 pp->acr, pp->acw, pp->ace);
600 for (no = 0; no < sc->sc_ndisks; no++) {
601 if (sc->sc_disks[no] != NULL)
602 g_shsec_remove_disk(sc->sc_disks[no]);
607 KASSERT(sc->sc_provider == NULL, ("Provider still exists? (device=%s)",
609 free(sc->sc_disks, M_SHSEC);
612 pp = LIST_FIRST(&gp->provider);
613 if (pp == NULL || (pp->acr == 0 && pp->acw == 0 && pp->ace == 0))
614 G_SHSEC_DEBUG(0, "Device %s destroyed.", gp->name);
616 g_wither_geom(gp, ENXIO);
622 g_shsec_destroy_geom(struct gctl_req *req __unused, struct g_class *mp __unused,
625 struct g_shsec_softc *sc;
628 return (g_shsec_destroy(sc, 0));
631 static struct g_geom *
632 g_shsec_taste(struct g_class *mp, struct g_provider *pp, int flags __unused)
634 struct g_shsec_metadata md;
635 struct g_shsec_softc *sc;
636 struct g_consumer *cp;
640 g_trace(G_T_TOPOLOGY, "%s(%s, %s)", __func__, mp->name, pp->name);
643 /* Skip providers that are already open for writing. */
647 G_SHSEC_DEBUG(3, "Tasting %s.", pp->name);
649 gp = g_new_geomf(mp, "shsec:taste");
650 gp->start = g_shsec_start;
651 gp->access = g_shsec_access;
652 gp->orphan = g_shsec_orphan;
653 cp = g_new_consumer(gp);
654 cp->flags |= G_CF_DIRECT_SEND | G_CF_DIRECT_RECEIVE;
655 error = g_attach(cp, pp);
657 error = g_shsec_read_metadata(cp, &md);
660 g_destroy_consumer(cp);
666 if (strcmp(md.md_magic, G_SHSEC_MAGIC) != 0)
668 if (md.md_version > G_SHSEC_VERSION) {
669 G_SHSEC_DEBUG(0, "Kernel module is too old to handle %s.\n",
674 * Backward compatibility:
676 /* There was no md_provsize field in earlier versions of metadata. */
677 if (md.md_version < 1)
678 md.md_provsize = pp->mediasize;
680 if (md.md_provider[0] != '\0' &&
681 !g_compare_names(md.md_provider, pp->name))
683 if (md.md_provsize != pp->mediasize)
687 * Let's check if device already exists.
690 LIST_FOREACH(gp, &mp->geom, geom) {
694 if (strcmp(md.md_name, sc->sc_name) != 0)
696 if (md.md_id != sc->sc_id)
701 G_SHSEC_DEBUG(1, "Adding disk %s to %s.", pp->name, gp->name);
702 error = g_shsec_add_disk(sc, pp, md.md_no);
704 G_SHSEC_DEBUG(0, "Cannot add disk %s to %s (error=%d).",
705 pp->name, gp->name, error);
709 gp = g_shsec_create(mp, &md);
711 G_SHSEC_DEBUG(0, "Cannot create device %s.", md.md_name);
715 G_SHSEC_DEBUG(1, "Adding disk %s to %s.", pp->name, gp->name);
716 error = g_shsec_add_disk(sc, pp, md.md_no);
718 G_SHSEC_DEBUG(0, "Cannot add disk %s to %s (error=%d).",
719 pp->name, gp->name, error);
720 g_shsec_destroy(sc, 1);
727 static struct g_shsec_softc *
728 g_shsec_find_device(struct g_class *mp, const char *name)
730 struct g_shsec_softc *sc;
733 LIST_FOREACH(gp, &mp->geom, geom) {
737 if (strcmp(sc->sc_name, name) == 0)
744 g_shsec_ctl_destroy(struct gctl_req *req, struct g_class *mp)
746 struct g_shsec_softc *sc;
747 int *force, *nargs, error;
754 nargs = gctl_get_paraml(req, "nargs", sizeof(*nargs));
756 gctl_error(req, "No '%s' argument.", "nargs");
760 gctl_error(req, "Missing device(s).");
763 force = gctl_get_paraml(req, "force", sizeof(*force));
765 gctl_error(req, "No '%s' argument.", "force");
769 for (i = 0; i < (u_int)*nargs; i++) {
770 snprintf(param, sizeof(param), "arg%u", i);
771 name = gctl_get_asciiparam(req, param);
773 gctl_error(req, "No 'arg%u' argument.", i);
776 sc = g_shsec_find_device(mp, name);
778 gctl_error(req, "No such device: %s.", name);
781 error = g_shsec_destroy(sc, *force);
783 gctl_error(req, "Cannot destroy device %s (error=%d).",
791 g_shsec_config(struct gctl_req *req, struct g_class *mp, const char *verb)
797 version = gctl_get_paraml(req, "version", sizeof(*version));
798 if (version == NULL) {
799 gctl_error(req, "No '%s' argument.", "version");
802 if (*version != G_SHSEC_VERSION) {
803 gctl_error(req, "Userland and kernel parts are out of sync.");
807 if (strcmp(verb, "stop") == 0) {
808 g_shsec_ctl_destroy(req, mp);
812 gctl_error(req, "Unknown verb.");
816 g_shsec_dumpconf(struct sbuf *sb, const char *indent, struct g_geom *gp,
817 struct g_consumer *cp, struct g_provider *pp)
819 struct g_shsec_softc *sc;
826 } else if (cp != NULL) {
827 sbuf_printf(sb, "%s<Number>%u</Number>\n", indent,
830 sbuf_printf(sb, "%s<ID>%u</ID>\n", indent, (u_int)sc->sc_id);
831 sbuf_printf(sb, "%s<Status>Total=%u, Online=%u</Status>\n",
832 indent, sc->sc_ndisks, g_shsec_nvalid(sc));
833 sbuf_printf(sb, "%s<State>", indent);
834 if (sc->sc_provider != NULL && sc->sc_provider->error == 0)
835 sbuf_printf(sb, "UP");
837 sbuf_printf(sb, "DOWN");
838 sbuf_printf(sb, "</State>\n");
842 DECLARE_GEOM_CLASS(g_shsec_class, g_shsec);
843 MODULE_VERSION(geom_shsec, 0);