knfsd: Validate filehandle type in fsid_source
[linux-2.6/mini2440.git] / drivers / block / nbd.c
blobbe92c658f06edceaf3e762ae085a8bc39445b516
1 /*
2 * Network block device - make block devices work over TCP
4 * Note that you can not swap over this thing, yet. Seems to work but
5 * deadlocks sometimes - you can not swap over TCP in general.
6 *
7 * Copyright 1997-2000 Pavel Machek <pavel@ucw.cz>
8 * Parts copyright 2001 Steven Whitehouse <steve@chygwyn.com>
10 * This file is released under GPLv2 or later.
12 * (part of code stolen from loop.c)
15 #include <linux/major.h>
17 #include <linux/blkdev.h>
18 #include <linux/module.h>
19 #include <linux/init.h>
20 #include <linux/sched.h>
21 #include <linux/fs.h>
22 #include <linux/bio.h>
23 #include <linux/stat.h>
24 #include <linux/errno.h>
25 #include <linux/file.h>
26 #include <linux/ioctl.h>
27 #include <linux/compiler.h>
28 #include <linux/err.h>
29 #include <linux/kernel.h>
30 #include <net/sock.h>
32 #include <asm/uaccess.h>
33 #include <asm/system.h>
34 #include <asm/types.h>
36 #include <linux/nbd.h>
38 #define LO_MAGIC 0x68797548
40 #ifdef NDEBUG
41 #define dprintk(flags, fmt...)
42 #else /* NDEBUG */
43 #define dprintk(flags, fmt...) do { \
44 if (debugflags & (flags)) printk(KERN_DEBUG fmt); \
45 } while (0)
46 #define DBG_IOCTL 0x0004
47 #define DBG_INIT 0x0010
48 #define DBG_EXIT 0x0020
49 #define DBG_BLKDEV 0x0100
50 #define DBG_RX 0x0200
51 #define DBG_TX 0x0400
52 static unsigned int debugflags;
53 #endif /* NDEBUG */
55 static unsigned int nbds_max = 16;
56 static struct nbd_device nbd_dev[MAX_NBD];
59 * Use just one lock (or at most 1 per NIC). Two arguments for this:
60 * 1. Each NIC is essentially a synchronization point for all servers
61 * accessed through that NIC so there's no need to have more locks
62 * than NICs anyway.
63 * 2. More locks lead to more "Dirty cache line bouncing" which will slow
64 * down each lock to the point where they're actually slower than just
65 * a single lock.
66 * Thanks go to Jens Axboe and Al Viro for their LKML emails explaining this!
68 static DEFINE_SPINLOCK(nbd_lock);
70 #ifndef NDEBUG
71 static const char *ioctl_cmd_to_ascii(int cmd)
73 switch (cmd) {
74 case NBD_SET_SOCK: return "set-sock";
75 case NBD_SET_BLKSIZE: return "set-blksize";
76 case NBD_SET_SIZE: return "set-size";
77 case NBD_DO_IT: return "do-it";
78 case NBD_CLEAR_SOCK: return "clear-sock";
79 case NBD_CLEAR_QUE: return "clear-que";
80 case NBD_PRINT_DEBUG: return "print-debug";
81 case NBD_SET_SIZE_BLOCKS: return "set-size-blocks";
82 case NBD_DISCONNECT: return "disconnect";
83 case BLKROSET: return "set-read-only";
84 case BLKFLSBUF: return "flush-buffer-cache";
86 return "unknown";
89 static const char *nbdcmd_to_ascii(int cmd)
91 switch (cmd) {
92 case NBD_CMD_READ: return "read";
93 case NBD_CMD_WRITE: return "write";
94 case NBD_CMD_DISC: return "disconnect";
96 return "invalid";
98 #endif /* NDEBUG */
100 static void nbd_end_request(struct request *req)
102 int uptodate = (req->errors == 0) ? 1 : 0;
103 struct request_queue *q = req->q;
104 unsigned long flags;
106 dprintk(DBG_BLKDEV, "%s: request %p: %s\n", req->rq_disk->disk_name,
107 req, uptodate? "done": "failed");
109 spin_lock_irqsave(q->queue_lock, flags);
110 if (!end_that_request_first(req, uptodate, req->nr_sectors)) {
111 end_that_request_last(req, uptodate);
113 spin_unlock_irqrestore(q->queue_lock, flags);
117 * Send or receive packet.
119 static int sock_xmit(struct socket *sock, int send, void *buf, int size,
120 int msg_flags)
122 int result;
123 struct msghdr msg;
124 struct kvec iov;
125 sigset_t blocked, oldset;
127 /* Allow interception of SIGKILL only
128 * Don't allow other signals to interrupt the transmission */
129 siginitsetinv(&blocked, sigmask(SIGKILL));
130 sigprocmask(SIG_SETMASK, &blocked, &oldset);
132 do {
133 sock->sk->sk_allocation = GFP_NOIO;
134 iov.iov_base = buf;
135 iov.iov_len = size;
136 msg.msg_name = NULL;
137 msg.msg_namelen = 0;
138 msg.msg_control = NULL;
139 msg.msg_controllen = 0;
140 msg.msg_flags = msg_flags | MSG_NOSIGNAL;
142 if (send)
143 result = kernel_sendmsg(sock, &msg, &iov, 1, size);
144 else
145 result = kernel_recvmsg(sock, &msg, &iov, 1, size, 0);
147 if (signal_pending(current)) {
148 siginfo_t info;
149 printk(KERN_WARNING "nbd (pid %d: %s) got signal %d\n",
150 current->pid, current->comm,
151 dequeue_signal_lock(current, &current->blocked, &info));
152 result = -EINTR;
153 break;
156 if (result <= 0) {
157 if (result == 0)
158 result = -EPIPE; /* short read */
159 break;
161 size -= result;
162 buf += result;
163 } while (size > 0);
165 sigprocmask(SIG_SETMASK, &oldset, NULL);
167 return result;
170 static inline int sock_send_bvec(struct socket *sock, struct bio_vec *bvec,
171 int flags)
173 int result;
174 void *kaddr = kmap(bvec->bv_page);
175 result = sock_xmit(sock, 1, kaddr + bvec->bv_offset, bvec->bv_len,
176 flags);
177 kunmap(bvec->bv_page);
178 return result;
181 static int nbd_send_req(struct nbd_device *lo, struct request *req)
183 int result, i, flags;
184 struct nbd_request request;
185 unsigned long size = req->nr_sectors << 9;
186 struct socket *sock = lo->sock;
188 request.magic = htonl(NBD_REQUEST_MAGIC);
189 request.type = htonl(nbd_cmd(req));
190 request.from = cpu_to_be64((u64) req->sector << 9);
191 request.len = htonl(size);
192 memcpy(request.handle, &req, sizeof(req));
194 dprintk(DBG_TX, "%s: request %p: sending control (%s@%llu,%luB)\n",
195 lo->disk->disk_name, req,
196 nbdcmd_to_ascii(nbd_cmd(req)),
197 (unsigned long long)req->sector << 9,
198 req->nr_sectors << 9);
199 result = sock_xmit(sock, 1, &request, sizeof(request),
200 (nbd_cmd(req) == NBD_CMD_WRITE)? MSG_MORE: 0);
201 if (result <= 0) {
202 printk(KERN_ERR "%s: Send control failed (result %d)\n",
203 lo->disk->disk_name, result);
204 goto error_out;
207 if (nbd_cmd(req) == NBD_CMD_WRITE) {
208 struct bio *bio;
210 * we are really probing at internals to determine
211 * whether to set MSG_MORE or not...
213 rq_for_each_bio(bio, req) {
214 struct bio_vec *bvec;
215 bio_for_each_segment(bvec, bio, i) {
216 flags = 0;
217 if ((i < (bio->bi_vcnt - 1)) || bio->bi_next)
218 flags = MSG_MORE;
219 dprintk(DBG_TX, "%s: request %p: sending %d bytes data\n",
220 lo->disk->disk_name, req,
221 bvec->bv_len);
222 result = sock_send_bvec(sock, bvec, flags);
223 if (result <= 0) {
224 printk(KERN_ERR "%s: Send data failed (result %d)\n",
225 lo->disk->disk_name,
226 result);
227 goto error_out;
232 return 0;
234 error_out:
235 return 1;
238 static struct request *nbd_find_request(struct nbd_device *lo, char *handle)
240 struct request *req;
241 struct list_head *tmp;
242 struct request *xreq;
243 int err;
245 memcpy(&xreq, handle, sizeof(xreq));
247 err = wait_event_interruptible(lo->active_wq, lo->active_req != xreq);
248 if (unlikely(err))
249 goto out;
251 spin_lock(&lo->queue_lock);
252 list_for_each(tmp, &lo->queue_head) {
253 req = list_entry(tmp, struct request, queuelist);
254 if (req != xreq)
255 continue;
256 list_del_init(&req->queuelist);
257 spin_unlock(&lo->queue_lock);
258 return req;
260 spin_unlock(&lo->queue_lock);
262 err = -ENOENT;
264 out:
265 return ERR_PTR(err);
268 static inline int sock_recv_bvec(struct socket *sock, struct bio_vec *bvec)
270 int result;
271 void *kaddr = kmap(bvec->bv_page);
272 result = sock_xmit(sock, 0, kaddr + bvec->bv_offset, bvec->bv_len,
273 MSG_WAITALL);
274 kunmap(bvec->bv_page);
275 return result;
278 /* NULL returned = something went wrong, inform userspace */
279 static struct request *nbd_read_stat(struct nbd_device *lo)
281 int result;
282 struct nbd_reply reply;
283 struct request *req;
284 struct socket *sock = lo->sock;
286 reply.magic = 0;
287 result = sock_xmit(sock, 0, &reply, sizeof(reply), MSG_WAITALL);
288 if (result <= 0) {
289 printk(KERN_ERR "%s: Receive control failed (result %d)\n",
290 lo->disk->disk_name, result);
291 goto harderror;
294 if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
295 printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
296 lo->disk->disk_name,
297 (unsigned long)ntohl(reply.magic));
298 result = -EPROTO;
299 goto harderror;
302 req = nbd_find_request(lo, reply.handle);
303 if (unlikely(IS_ERR(req))) {
304 result = PTR_ERR(req);
305 if (result != -ENOENT)
306 goto harderror;
308 printk(KERN_ERR "%s: Unexpected reply (%p)\n",
309 lo->disk->disk_name, reply.handle);
310 result = -EBADR;
311 goto harderror;
314 if (ntohl(reply.error)) {
315 printk(KERN_ERR "%s: Other side returned error (%d)\n",
316 lo->disk->disk_name, ntohl(reply.error));
317 req->errors++;
318 return req;
321 dprintk(DBG_RX, "%s: request %p: got reply\n",
322 lo->disk->disk_name, req);
323 if (nbd_cmd(req) == NBD_CMD_READ) {
324 int i;
325 struct bio *bio;
326 rq_for_each_bio(bio, req) {
327 struct bio_vec *bvec;
328 bio_for_each_segment(bvec, bio, i) {
329 result = sock_recv_bvec(sock, bvec);
330 if (result <= 0) {
331 printk(KERN_ERR "%s: Receive data failed (result %d)\n",
332 lo->disk->disk_name,
333 result);
334 req->errors++;
335 return req;
337 dprintk(DBG_RX, "%s: request %p: got %d bytes data\n",
338 lo->disk->disk_name, req, bvec->bv_len);
342 return req;
343 harderror:
344 lo->harderror = result;
345 return NULL;
348 static ssize_t pid_show(struct gendisk *disk, char *page)
350 return sprintf(page, "%ld\n",
351 (long) ((struct nbd_device *)disk->private_data)->pid);
354 static struct disk_attribute pid_attr = {
355 .attr = { .name = "pid", .mode = S_IRUGO },
356 .show = pid_show,
359 static int nbd_do_it(struct nbd_device *lo)
361 struct request *req;
362 int ret;
364 BUG_ON(lo->magic != LO_MAGIC);
366 lo->pid = current->pid;
367 ret = sysfs_create_file(&lo->disk->kobj, &pid_attr.attr);
368 if (ret) {
369 printk(KERN_ERR "nbd: sysfs_create_file failed!");
370 return ret;
373 while ((req = nbd_read_stat(lo)) != NULL)
374 nbd_end_request(req);
376 sysfs_remove_file(&lo->disk->kobj, &pid_attr.attr);
377 return 0;
380 static void nbd_clear_que(struct nbd_device *lo)
382 struct request *req;
384 BUG_ON(lo->magic != LO_MAGIC);
387 * Because we have set lo->sock to NULL under the tx_lock, all
388 * modifications to the list must have completed by now. For
389 * the same reason, the active_req must be NULL.
391 * As a consequence, we don't need to take the spin lock while
392 * purging the list here.
394 BUG_ON(lo->sock);
395 BUG_ON(lo->active_req);
397 while (!list_empty(&lo->queue_head)) {
398 req = list_entry(lo->queue_head.next, struct request,
399 queuelist);
400 list_del_init(&req->queuelist);
401 req->errors++;
402 nbd_end_request(req);
407 * We always wait for result of write, for now. It would be nice to make it optional
408 * in future
409 * if ((rq_data_dir(req) == WRITE) && (lo->flags & NBD_WRITE_NOCHK))
410 * { printk( "Warning: Ignoring result!\n"); nbd_end_request( req ); }
413 static void do_nbd_request(struct request_queue * q)
415 struct request *req;
417 while ((req = elv_next_request(q)) != NULL) {
418 struct nbd_device *lo;
420 blkdev_dequeue_request(req);
421 dprintk(DBG_BLKDEV, "%s: request %p: dequeued (flags=%x)\n",
422 req->rq_disk->disk_name, req, req->cmd_type);
424 if (!blk_fs_request(req))
425 goto error_out;
427 lo = req->rq_disk->private_data;
429 BUG_ON(lo->magic != LO_MAGIC);
431 nbd_cmd(req) = NBD_CMD_READ;
432 if (rq_data_dir(req) == WRITE) {
433 nbd_cmd(req) = NBD_CMD_WRITE;
434 if (lo->flags & NBD_READ_ONLY) {
435 printk(KERN_ERR "%s: Write on read-only\n",
436 lo->disk->disk_name);
437 goto error_out;
441 req->errors = 0;
442 spin_unlock_irq(q->queue_lock);
444 mutex_lock(&lo->tx_lock);
445 if (unlikely(!lo->sock)) {
446 mutex_unlock(&lo->tx_lock);
447 printk(KERN_ERR "%s: Attempted send on closed socket\n",
448 lo->disk->disk_name);
449 req->errors++;
450 nbd_end_request(req);
451 spin_lock_irq(q->queue_lock);
452 continue;
455 lo->active_req = req;
457 if (nbd_send_req(lo, req) != 0) {
458 printk(KERN_ERR "%s: Request send failed\n",
459 lo->disk->disk_name);
460 req->errors++;
461 nbd_end_request(req);
462 } else {
463 spin_lock(&lo->queue_lock);
464 list_add(&req->queuelist, &lo->queue_head);
465 spin_unlock(&lo->queue_lock);
468 lo->active_req = NULL;
469 mutex_unlock(&lo->tx_lock);
470 wake_up_all(&lo->active_wq);
472 spin_lock_irq(q->queue_lock);
473 continue;
475 error_out:
476 req->errors++;
477 spin_unlock(q->queue_lock);
478 nbd_end_request(req);
479 spin_lock(q->queue_lock);
481 return;
484 static int nbd_ioctl(struct inode *inode, struct file *file,
485 unsigned int cmd, unsigned long arg)
487 struct nbd_device *lo = inode->i_bdev->bd_disk->private_data;
488 int error;
489 struct request sreq ;
491 if (!capable(CAP_SYS_ADMIN))
492 return -EPERM;
494 BUG_ON(lo->magic != LO_MAGIC);
496 /* Anyone capable of this syscall can do *real bad* things */
497 dprintk(DBG_IOCTL, "%s: nbd_ioctl cmd=%s(0x%x) arg=%lu\n",
498 lo->disk->disk_name, ioctl_cmd_to_ascii(cmd), cmd, arg);
500 switch (cmd) {
501 case NBD_DISCONNECT:
502 printk(KERN_INFO "%s: NBD_DISCONNECT\n", lo->disk->disk_name);
503 sreq.cmd_type = REQ_TYPE_SPECIAL;
504 nbd_cmd(&sreq) = NBD_CMD_DISC;
506 * Set these to sane values in case server implementation
507 * fails to check the request type first and also to keep
508 * debugging output cleaner.
510 sreq.sector = 0;
511 sreq.nr_sectors = 0;
512 if (!lo->sock)
513 return -EINVAL;
514 nbd_send_req(lo, &sreq);
515 return 0;
517 case NBD_CLEAR_SOCK:
518 error = 0;
519 mutex_lock(&lo->tx_lock);
520 lo->sock = NULL;
521 mutex_unlock(&lo->tx_lock);
522 file = lo->file;
523 lo->file = NULL;
524 nbd_clear_que(lo);
525 BUG_ON(!list_empty(&lo->queue_head));
526 if (file)
527 fput(file);
528 return error;
529 case NBD_SET_SOCK:
530 if (lo->file)
531 return -EBUSY;
532 error = -EINVAL;
533 file = fget(arg);
534 if (file) {
535 inode = file->f_path.dentry->d_inode;
536 if (S_ISSOCK(inode->i_mode)) {
537 lo->file = file;
538 lo->sock = SOCKET_I(inode);
539 error = 0;
540 } else {
541 fput(file);
544 return error;
545 case NBD_SET_BLKSIZE:
546 lo->blksize = arg;
547 lo->bytesize &= ~(lo->blksize-1);
548 inode->i_bdev->bd_inode->i_size = lo->bytesize;
549 set_blocksize(inode->i_bdev, lo->blksize);
550 set_capacity(lo->disk, lo->bytesize >> 9);
551 return 0;
552 case NBD_SET_SIZE:
553 lo->bytesize = arg & ~(lo->blksize-1);
554 inode->i_bdev->bd_inode->i_size = lo->bytesize;
555 set_blocksize(inode->i_bdev, lo->blksize);
556 set_capacity(lo->disk, lo->bytesize >> 9);
557 return 0;
558 case NBD_SET_SIZE_BLOCKS:
559 lo->bytesize = ((u64) arg) * lo->blksize;
560 inode->i_bdev->bd_inode->i_size = lo->bytesize;
561 set_blocksize(inode->i_bdev, lo->blksize);
562 set_capacity(lo->disk, lo->bytesize >> 9);
563 return 0;
564 case NBD_DO_IT:
565 if (!lo->file)
566 return -EINVAL;
567 error = nbd_do_it(lo);
568 if (error)
569 return error;
570 /* on return tidy up in case we have a signal */
571 /* Forcibly shutdown the socket causing all listeners
572 * to error
574 * FIXME: This code is duplicated from sys_shutdown, but
575 * there should be a more generic interface rather than
576 * calling socket ops directly here */
577 mutex_lock(&lo->tx_lock);
578 if (lo->sock) {
579 printk(KERN_WARNING "%s: shutting down socket\n",
580 lo->disk->disk_name);
581 lo->sock->ops->shutdown(lo->sock,
582 SEND_SHUTDOWN|RCV_SHUTDOWN);
583 lo->sock = NULL;
585 mutex_unlock(&lo->tx_lock);
586 file = lo->file;
587 lo->file = NULL;
588 nbd_clear_que(lo);
589 printk(KERN_WARNING "%s: queue cleared\n", lo->disk->disk_name);
590 if (file)
591 fput(file);
592 return lo->harderror;
593 case NBD_CLEAR_QUE:
595 * This is for compatibility only. The queue is always cleared
596 * by NBD_DO_IT or NBD_CLEAR_SOCK.
598 BUG_ON(!lo->sock && !list_empty(&lo->queue_head));
599 return 0;
600 case NBD_PRINT_DEBUG:
601 printk(KERN_INFO "%s: next = %p, prev = %p, head = %p\n",
602 inode->i_bdev->bd_disk->disk_name,
603 lo->queue_head.next, lo->queue_head.prev,
604 &lo->queue_head);
605 return 0;
607 return -EINVAL;
610 static struct block_device_operations nbd_fops =
612 .owner = THIS_MODULE,
613 .ioctl = nbd_ioctl,
617 * And here should be modules and kernel interface
618 * (Just smiley confuses emacs :-)
621 static int __init nbd_init(void)
623 int err = -ENOMEM;
624 int i;
626 BUILD_BUG_ON(sizeof(struct nbd_request) != 28);
628 if (nbds_max > MAX_NBD) {
629 printk(KERN_CRIT "nbd: cannot allocate more than %u nbds; %u requested.\n", MAX_NBD,
630 nbds_max);
631 return -EINVAL;
634 for (i = 0; i < nbds_max; i++) {
635 struct gendisk *disk = alloc_disk(1);
636 if (!disk)
637 goto out;
638 nbd_dev[i].disk = disk;
640 * The new linux 2.5 block layer implementation requires
641 * every gendisk to have its very own request_queue struct.
642 * These structs are big so we dynamically allocate them.
644 disk->queue = blk_init_queue(do_nbd_request, &nbd_lock);
645 if (!disk->queue) {
646 put_disk(disk);
647 goto out;
651 if (register_blkdev(NBD_MAJOR, "nbd")) {
652 err = -EIO;
653 goto out;
656 printk(KERN_INFO "nbd: registered device at major %d\n", NBD_MAJOR);
657 dprintk(DBG_INIT, "nbd: debugflags=0x%x\n", debugflags);
659 for (i = 0; i < nbds_max; i++) {
660 struct gendisk *disk = nbd_dev[i].disk;
661 nbd_dev[i].file = NULL;
662 nbd_dev[i].magic = LO_MAGIC;
663 nbd_dev[i].flags = 0;
664 spin_lock_init(&nbd_dev[i].queue_lock);
665 INIT_LIST_HEAD(&nbd_dev[i].queue_head);
666 mutex_init(&nbd_dev[i].tx_lock);
667 init_waitqueue_head(&nbd_dev[i].active_wq);
668 nbd_dev[i].blksize = 1024;
669 nbd_dev[i].bytesize = 0x7ffffc00ULL << 10; /* 2TB */
670 disk->major = NBD_MAJOR;
671 disk->first_minor = i;
672 disk->fops = &nbd_fops;
673 disk->private_data = &nbd_dev[i];
674 disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
675 sprintf(disk->disk_name, "nbd%d", i);
676 set_capacity(disk, 0x7ffffc00ULL << 1); /* 2 TB */
677 add_disk(disk);
680 return 0;
681 out:
682 while (i--) {
683 blk_cleanup_queue(nbd_dev[i].disk->queue);
684 put_disk(nbd_dev[i].disk);
686 return err;
689 static void __exit nbd_cleanup(void)
691 int i;
692 for (i = 0; i < nbds_max; i++) {
693 struct gendisk *disk = nbd_dev[i].disk;
694 nbd_dev[i].magic = 0;
695 if (disk) {
696 del_gendisk(disk);
697 blk_cleanup_queue(disk->queue);
698 put_disk(disk);
701 unregister_blkdev(NBD_MAJOR, "nbd");
702 printk(KERN_INFO "nbd: unregistered device at major %d\n", NBD_MAJOR);
705 module_init(nbd_init);
706 module_exit(nbd_cleanup);
708 MODULE_DESCRIPTION("Network Block Device");
709 MODULE_LICENSE("GPL");
711 module_param(nbds_max, int, 0444);
712 MODULE_PARM_DESC(nbds_max, "How many network block devices to initialize.");
713 #ifndef NDEBUG
714 module_param(debugflags, int, 0644);
715 MODULE_PARM_DESC(debugflags, "flags for controlling debug output");
716 #endif